[PATCH nft] ct: use nftables sysconf location for connlabel configuration

[PATCH nft] ct: use nftables sysconf location for connlabel configuration

[Florian Westphal]

Instead of using /etc/xtables use the nftables syconfdir.
Also update error message to tell which label failed translation
and which config file was used for this:

nft add filter input ct label foo
<cmdline>:1:27-29: Error: /etc/nftables/connlabel.conf: could not parse conntrack label "foo"

Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
---
 src/Makefile.am | 2 ++
 src/ct.c        | 7 +++++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/Makefile.am b/src/Makefile.am
index 8c59449..ff1dd6e 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -27,6 +27,8 @@ parser_bison.o scanner.o: AM_CFLAGS += -Wno-missing-prototypes -Wno-missing-decl
 
 BUILT_SOURCES = parser_bison.h
 
+ct.o: AM_CFLAGS += -DCONNLABEL_PATH="\"${sysconfdir}/\""
+
 nft_SOURCES =	main.c				\
 		rule.c				\
 		statement.c			\
diff --git a/src/ct.c b/src/ct.c
index b971ba1..e974307 100644
--- a/src/ct.c
+++ b/src/ct.c
@@ -29,6 +29,8 @@
 #include <utils.h>
 #include <statement.h>
 
+#define CONNLABEL_CONF	CONNLABEL_PATH "connlabel.conf"
+
 static const struct symbol_table ct_state_tbl = {
 	.symbols	= {
 		SYMBOL("invalid",	NF_CT_STATE_INVALID_BIT),
@@ -128,7 +130,8 @@ static struct error_record *ct_label_type_parse(const struct expr *sym,
 
 	dtype = sym->dtype;
 	if (s->identifier == NULL)
-		return error(&sym->location, "Could not parse %s", dtype->desc);
+		return error(&sym->location, "%s: could not parse %s \"%s\"", CONNLABEL_CONF,
+			     dtype->desc, sym->identifier);
 
 	if (s->value >= CT_LABEL_BIT_SIZE)
 		return error(&sym->location, "%s: out of range (%u max)",
@@ -158,7 +161,7 @@ static const struct datatype ct_label_type = {
 
 static void __init ct_label_table_init(void)
 {
-	ct_label_tbl = rt_symbol_table_init("/etc/xtables/connlabel.conf");
+	ct_label_tbl = rt_symbol_table_init(CONNLABEL_CONF);
 }
 
 #ifndef NF_CT_HELPER_NAME_LEN
-- 
2.7.3

Re: [PATCH nft] ct: use nftables sysconf location for connlabel configuration

[Pablo Neira Ayuso]

[-- Attachment #1: Type: text/plain, Size: 1070 bytes --]

On Wed, Jul 20, 2016 at 12:17:05PM +0200, Florian Westphal wrote:
> Instead of using /etc/xtables use the nftables syconfdir.
> Also update error message to tell which label failed translation
> and which config file was used for this:
> 
> nft add filter input ct label foo
> <cmdline>:1:27-29: Error: /etc/nftables/connlabel.conf: could not parse conntrack label "foo"
> 
> Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org>
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
>  src/Makefile.am | 2 ++
>  src/ct.c        | 7 +++++--
>  2 files changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/src/Makefile.am b/src/Makefile.am
> index 8c59449..ff1dd6e 100644
> --- a/src/Makefile.am
> +++ b/src/Makefile.am
> @@ -27,6 +27,8 @@ parser_bison.o scanner.o: AM_CFLAGS += -Wno-missing-prototypes -Wno-missing-decl
>  
>  BUILT_SOURCES = parser_bison.h
>  
> +ct.o: AM_CFLAGS += -DCONNLABEL_PATH="\"${sysconfdir}/\""

I think we can simplify this by using DEFAULT_INCLUDE_PATH.

See patch attached, it applies on top of this one. Feel free to
collapse them.

[-- Attachment #2: x.patch --]
[-- Type: text/x-diff, Size: 1207 bytes --]

diff --git a/src/Makefile.am b/src/Makefile.am
index ff1dd6e..8c59449 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -27,8 +27,6 @@ parser_bison.o scanner.o: AM_CFLAGS += -Wno-missing-prototypes -Wno-missing-decl
 
 BUILT_SOURCES = parser_bison.h
 
-ct.o: AM_CFLAGS += -DCONNLABEL_PATH="\"${sysconfdir}/\""
-
 nft_SOURCES =	main.c				\
 		rule.c				\
 		statement.c			\
diff --git a/src/ct.c b/src/ct.c
index e974307..f383f29 100644
--- a/src/ct.c
+++ b/src/ct.c
@@ -29,7 +29,7 @@
 #include <utils.h>
 #include <statement.h>
 
-#define CONNLABEL_CONF	CONNLABEL_PATH "connlabel.conf"
+#define CONNLABEL_CONF	DEFAULT_INCLUDE_PATH "connlabel.conf"
 
 static const struct symbol_table ct_state_tbl = {
 	.symbols	= {
@@ -130,8 +130,8 @@ static struct error_record *ct_label_type_parse(const struct expr *sym,
 
 	dtype = sym->dtype;
 	if (s->identifier == NULL)
-		return error(&sym->location, "%s: could not parse %s \"%s\"", CONNLABEL_CONF,
-			     dtype->desc, sym->identifier);
+		return error(&sym->location, "%s: could not parse %s \"%s\"",
+			     CONNLABEL_CONF, dtype->desc, sym->identifier);
 
 	if (s->value >= CT_LABEL_BIT_SIZE)
 		return error(&sym->location, "%s: out of range (%u max)",

Re: [PATCH nft] ct: use nftables sysconf location for connlabel configuration

[Florian Westphal]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Wed, Jul 20, 2016 at 12:17:05PM +0200, Florian Westphal wrote:
> > Instead of using /etc/xtables use the nftables syconfdir.
> > Also update error message to tell which label failed translation
> > and which config file was used for this:
> > 
> > nft add filter input ct label foo
> > <cmdline>:1:27-29: Error: /etc/nftables/connlabel.conf: could not parse conntrack label "foo"
> > 
> > Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org>
> > Signed-off-by: Florian Westphal <fw@strlen.de>
> > ---
> >  src/Makefile.am | 2 ++
> >  src/ct.c        | 7 +++++--
> >  2 files changed, 7 insertions(+), 2 deletions(-)
> > 
> > diff --git a/src/Makefile.am b/src/Makefile.am
> > index 8c59449..ff1dd6e 100644
> > --- a/src/Makefile.am
> > +++ b/src/Makefile.am
> > @@ -27,6 +27,8 @@ parser_bison.o scanner.o: AM_CFLAGS += -Wno-missing-prototypes -Wno-missing-decl
> >  
> >  BUILT_SOURCES = parser_bison.h
> >  
> > +ct.o: AM_CFLAGS += -DCONNLABEL_PATH="\"${sysconfdir}/\""
> 
> I think we can simplify this by using DEFAULT_INCLUDE_PATH.
> 
> See patch attached, it applies on top of this one. Feel free to
> collapse them.

Okay, I pushed it to nftables.git (with your patch collapsed).