Skip to contentSkip to conversation

configure: Show support for connlabel

PATCH Superseded Shivani Bhardwaj 2 participants 4 messages Mar 12, 2016 – Mar 16, 2016 netfilter

v3 of 4 Superseded Latest is v4 →

lore
Share & tools
lore

Shivani Bhardwaj

author
#0 lore raw

PATCH v3 1/1 configure: Show support for connlabel

Add the --disable-connlabel option and the appropriate functionality associated with it.

After this patch, iptables configuration shows up as:

Iptables Configuration:

  IPv4 support:                         yes
  IPv6 support:                         yes
  Devel support:                        yes
  IPQ support:                          no
  Large file support:                   yes
  BPF utils support:                    no
  nfsynproxy util support:              no
  nftables support:                     yes
  connlabel support:                    yes
Signed-off-by Shivani Bhardwaj <[email protected]>

---
Changes in v3:
Remove check for libnfnetlink from the if block

Changes in v2:
Correct the option to disable-connlabel and add code to make it work

 configure.ac | 30 +++++++++++++++++++++---------
 1 file changed, 21 insertions(+), 9 deletions(-)
configure.ac +21 -9
index 33a8f2d..f9bc2a3 100644
@@ -63,6 +63,10 @@ AC_ARG_WITH([pkgconfigdir], AS_HELP_STRING([--with-pkgconfigdir=PATH],
 AC_ARG_ENABLE([nftables],
 	AS_HELP_STRING([--disable-nftables], [Do not build nftables compat]),
 	[enable_nftables="$enableval"], [enable_nftables="yes"])
+AC_ARG_ENABLE([connlabel],
+	AS_HELP_STRING([--disable-connlabel],
+	[Do not build libnetfilter_conntrack]),
+	[enable_connlabel="$enableval"], [enable_connlabel="yes"])
 
 libiptc_LDFLAGS2="";
 AX_CHECK_LINKER_FLAGS([-Wl,--no-as-needed],

@@ -93,15 +97,6 @@ if test "$ac_cv_header_linux_ip_vs_h" != "yes"; then
 	blacklist_modules="$blacklist_modules ipvs";
 fi;
 
-PKG_CHECK_MODULES([libnetfilter_conntrack], [libnetfilter_conntrack >= 1.0.4],
-	[nfconntrack=1], [nfconntrack=0])
-AM_CONDITIONAL([HAVE_LIBNETFILTER_CONNTRACK], [test "$nfconntrack" = 1])
-
-if test "$nfconntrack" -ne 1; then
-	blacklist_modules="$blacklist_modules connlabel";
-	echo "WARNING: libnetfilter_conntrack not found, connlabel match will not be built";
-fi;
-
 AC_CHECK_SIZEOF([struct ip6_hdr], [], [#include <netinet/ip6.h>])
 
 AM_CONDITIONAL([ENABLE_STATIC], [test "$enable_static" = "yes"])

@@ -114,6 +109,7 @@ AM_CONDITIONAL([ENABLE_LIBIPQ], [test "$enable_libipq" = "yes"])
 AM_CONDITIONAL([ENABLE_BPFC], [test "$enable_bpfc" = "yes"])
 AM_CONDITIONAL([ENABLE_SYNCONF], [test "$enable_nfsynproxy" = "yes"])
 AM_CONDITIONAL([ENABLE_NFTABLES], [test "$enable_nftables" = "yes"])
+AM_CONDITIONAL([ENABLE_CONNLABEL], [test "$enable_connlabel" = "yes"])
 
 if test "x$enable_bpfc" = "xyes" || test "x$enable_nfsynproxy" = "xyes"; then
 	AC_CHECK_LIB(pcap, pcap_compile,, AC_MSG_ERROR(missing libpcap library required by bpf compiler or nfsynproxy tool))

@@ -168,6 +164,21 @@ if test "$nftables" != 1; then
 	blacklist_a_modules="$blacklist_a_modules mangle"
 fi
 
+if test "x$enable_connlabel" = "xyes"; then
+	PKG_CHECK_MODULES([libnetfilter_conntrack],
+		[libnetfilter_conntrack >= 1.0.4],
+		[nfconntrack=1], [nfconntrack=0])
+
+	if test "$nfconntrack" -ne 1; then
+		blacklist_modules="$blacklist_modules connlabel";
+		echo "WARNING: libnetfilter_conntrack not found, connlabel match will not be built";
+	fi;
+else
+	blacklist_modules="$blacklist_modules connlabel";
+fi;
+
+AM_CONDITIONAL([HAVE_LIBNETFILTER_CONNTRACK], [test "$nfconntrack" = 1])
+
 AC_SUBST([blacklist_modules])
 AC_SUBST([blacklist_x_modules])
 AC_SUBST([blacklist_b_modules])

@@ -243,6 +254,7 @@ Iptables Configuration:
   BPF utils support:			${enable_bpfc}
   nfsynproxy util support:		${enable_nfsynproxy}
   nftables support:			${enable_nftables}
+  connlabel support:			${enable_connlabel}
 
 Build parameters:
   Put plugins into executable (static):	${enable_static}
Signature · 1 line
1.9.1
maintainer
#1 lore raw
Quoted 6 lines · Shivani Bhardwaj

Add the --disable-connlabel option and the appropriate functionality associated with it.

After this patch, iptables configuration shows up as:

Iptables Configuration:

Quoted 9 lines
  IPv4 support:                         yes
  IPv6 support:                         yes
  Devel support:                        yes
  IPQ support:                          no
  Large file support:                   yes
  BPF utils support:                    no
  nfsynproxy util support:              no
  nftables support:                     yes
  connlabel support:                    yes

I think we are almost there, see below.

Quoted 16 lines
Signed-off-by Shivani Bhardwaj <[email protected]>

---
Changes in v3:
Remove check for libnfnetlink from the if block

Changes in v2:
Correct the option to disable-connlabel and add code to make it work

 configure.ac | 30 +++++++++++++++++++++---------
 1 file changed, 21 insertions(+), 9 deletions(-)
configure.ac +0 -0
index 33a8f2d..f9bc2a3 100644

[...]

configure.ac if test "$nftables" != 1; then · line 174

Quoted 12 lines
configure.ac +8 -0
@@ -168,6 +164,21 @@ if test "$nftables" != 1; then
 	blacklist_a_modules="$blacklist_a_modules mangle"
 fi
 
+if test "x$enable_connlabel" = "xyes"; then
+	PKG_CHECK_MODULES([libnetfilter_conntrack],
+		[libnetfilter_conntrack >= 1.0.4],
+		[nfconntrack=1], [nfconntrack=0])
+
+	if test "$nfconntrack" -ne 1; then
+		blacklist_modules="$blacklist_modules connlabel";
+		echo "WARNING: libnetfilter_conntrack not found, connlabel match will not be built";

Could you set enable_connlabel to "no" when this occurs so the banner also displays that connlabel support has been skipped?

Quoted 4 lines
configure.ac +4 -0
+	fi;
+else
+	blacklist_modules="$blacklist_modules connlabel";
+fi;
author
#2 lore raw
Quoted 40 lines · Pablo Neira Ayuso
Quoted 6 lines · Shivani Bhardwaj

Add the --disable-connlabel option and the appropriate functionality associated with it.

After this patch, iptables configuration shows up as:

Iptables Configuration:

Quoted 9 lines
  IPv4 support:                         yes
  IPv6 support:                         yes
  Devel support:                        yes
  IPQ support:                          no
  Large file support:                   yes
  BPF utils support:                    no
  nfsynproxy util support:              no
  nftables support:                     yes
  connlabel support:                    yes

I think we are almost there, see below.

Quoted 16 lines
Signed-off-by Shivani Bhardwaj <[email protected]>

---
Changes in v3:
Remove check for libnfnetlink from the if block

Changes in v2:
Correct the option to disable-connlabel and add code to make it work

 configure.ac | 30 +++++++++++++++++++++---------
 1 file changed, 21 insertions(+), 9 deletions(-)
configure.ac +0 -0
index 33a8f2d..f9bc2a3 100644

[...]

Quoted 4 lines
configure.ac +0 -0
@@ -168,6 +164,21 @@ if test "$nftables" != 1; then
      blacklist_a_modules="$blacklist_a_modules mangle"
 fi
Quoted 12 lines

configure.ac if test "$nftables" != 1; then · line 174

Quoted 8 lines
configure.ac +8 -0
+if test "x$enable_connlabel" = "xyes"; then
+     PKG_CHECK_MODULES([libnetfilter_conntrack],
+             [libnetfilter_conntrack >= 1.0.4],
+             [nfconntrack=1], [nfconntrack=0])
+
+     if test "$nfconntrack" -ne 1; then
+             blacklist_modules="$blacklist_modules connlabel";
+             echo "WARNING: libnetfilter_conntrack not found, connlabel match will not be built";

Could you set enable_connlabel to "no" when this occurs so the banner also displays that connlabel support has been skipped?

OK. Thanks.
One question, in case of nftables, I see enable_nftables is nowhere set to "no", should that be added in case package requirements are not met?
Same for bpfc and nfsynproxy.

Quoted 4 lines
Quoted 4 lines
configure.ac +4 -0
+     fi;
+else
+     blacklist_modules="$blacklist_modules connlabel";
+fi;
maintainer
#3 lore raw
Quoted 13 lines · Shivani Bhardwaj
Quoted 12 lines · Pablo Neira Ayuso

configure.ac if test "$nftables" != 1; then · line 174

Quoted 8 lines
configure.ac +8 -0
+if test "x$enable_connlabel" = "xyes"; then
+     PKG_CHECK_MODULES([libnetfilter_conntrack],
+             [libnetfilter_conntrack >= 1.0.4],
+             [nfconntrack=1], [nfconntrack=0])
+
+     if test "$nfconntrack" -ne 1; then
+             blacklist_modules="$blacklist_modules connlabel";
+             echo "WARNING: libnetfilter_conntrack not found, connlabel match will not be built";

Could you set enable_connlabel to "no" when this occurs so the banner also displays that connlabel support has been skipped?

Quoted 4 lines

OK. Thanks.
One question, in case of nftables, I see enable_nftables is nowhere set to "no", should that be added in case package requirements are not met?

$ ./configure --prefix=/usr --disable-nftables
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /bin/mkdir -p
...
Iptables Configuration:
  IPv4 support:                         yes
  IPv6 support:                         yes
  Devel support:                        yes
  IPQ support:                          no
  Large file support:                   yes
  BPF utils support:                    no
  nfsynproxy util support:              no
  nftables support:                     no <------
  connlabel support:                    yes

It says "no" when explicitly disabled. Note that the connlabel case was special with regards to others, since it didn't ask for explicit disable/enable in first place.

Quoted 1 line

Same for bpfc and nfsynproxy.

I can see here these:

--disable-nfsynproxy --disable-bpf-compiler

show "no" in the configuration message.