iptables: add upstream patch fixing the message 'connlabel.conf not found'
PATCH 1/1 iptables: add upstream patch fixing the message 'connlabel.conf not found'
From: Thomas De Schampheleire <[email protected]>
In iptables versions 1.4.20 and 1.4.21, any call to iptables would generate a message
cannot open connlabel.conf, not registering 'connlabel' match: No
such file or directory
This problem was reported at [1] and subsequently fixed with commit [2], but no upstream release has been made since. This patch imports the fix into Buildroot, awaiting a new release of iptables.
[1] http://marc.info/?l=netfilter-devel&m=140990442432002&w=2
[2] http://git.netfilter.org/iptables/commit/?id=825fbda5482a7d5ec5a6619c81fe07ff865c7d6e
--- .../iptables/0006-fix-connlabel-conf-warning.patch | 72 ++++++++++++++++++++++ 1 file changed, 72 insertions(+) create mode 100644 package/iptables/0006-fix-connlabel-conf-warning.patch
package/iptables/0006-fix-connlabel-conf-warning.patch new file +72 -0
@@ -0,0 +1,72 @@ +From 825fbda5482a7d5ec5a6619c81fe07ff865c7d6e Mon Sep 17 00:00:00 2001 +From: Florian Westphal <[email protected]> +Date: Fri, 5 Sep 2014 20:45:56 +0200 +Subject: extensions: libxt_connlabel: do not open config file from _init hook + +else, static builds will print this for every iptables invocation, +even 'iptables -L'. Delay open until we need to translate a mapping. + +Reported-by: Thomas De Schampheleire <[email protected]> +Signed-off-by: Florian Westphal <[email protected]> +[Thomas De Schampheleire: import unchanged into Buildroot] +Signed-off-by: Thomas De Schampheleire <[email protected]> + +diff --git a/extensions/libxt_connlabel.c b/extensions/libxt_connlabel.c +index c84a167..1f83095 100644 +--- a/extensions/libxt_connlabel.c ++++ b/extensions/libxt_connlabel.c +@@ -29,11 +29,26 @@ static const struct xt_option_entry connlabel_mt_opts[] = { + XTOPT_TABLEEND, + }; + ++/* cannot do this via _init, else static builds might spew error message ++ * for every iptables invocation. ++ */ ++static void connlabel_open(void) ++{ ++ if (map) ++ return; ++ ++ map = nfct_labelmap_new(NULL); ++ if (!map && errno) ++ xtables_error(RESOURCE_PROBLEM, "cannot open connlabel.conf: %s\n", ++ strerror(errno)); ++} ++ + static void connlabel_mt_parse(struct xt_option_call *cb) + { + struct xt_connlabel_mtinfo *info = cb->data; + int tmp; + ++ connlabel_open(); + xtables_option_parse(cb); + + switch (cb->entry->id) { +@@ -54,7 +69,11 @@ static void connlabel_mt_parse(struct xt_option_call *cb) + + static const char *connlabel_get_name(int b) + { +- const char *name = nfct_labelmap_get_name(map, b); ++ const char *name; ++ ++ connlabel_open(); ++ ++ name = nfct_labelmap_get_name(map, b); + if (name && strcmp(name, "")) + return name; + return NULL; +@@ -114,11 +133,5 @@ static struct xtables_match connlabel_mt_reg = { + + void _init(void) + { +- map = nfct_labelmap_new(NULL); +- if (!map) { +- fprintf(stderr, "cannot open connlabel.conf, not registering '%s' match: %s\n", +- connlabel_mt_reg.name, strerror(errno)); +- return; +- } + xtables_register_match(&connlabel_mt_reg); + } +-- +cgit v0.10.1 +
Signature · 1 line
1.9.5
PATCH 1/1 iptables: add upstream patch fixing the message 'connlabel.conf not found'
Quoted 8 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Thomas" == Thomas De Schampheleire <[email protected]> writes:
From: Thomas De Schampheleire <[email protected]> In iptables versions 1.4.20 and 1.4.21, any call to iptables would generate a message
cannot open connlabel.conf, not registering 'connlabel' match: No
such file or directory
Committed, thanks.
Do you see this with mainline buildroot? We do pass --disable-static for !BR2_STATIC_LIBS builds, so I'm not sure how it could trigger for your?
But the fix does make sense for completely static builds.
Signature · 1 line
Bye, Peter Korsgaard
PATCH 1/1 iptables: add upstream patch fixing the message 'connlabel.conf not found'
Quoted 9 lines · Peter Korsgaard
Quoted 8 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Thomas" == Thomas De Schampheleire <[email protected]> writes:
From: Thomas De Schampheleire <[email protected]> In iptables versions 1.4.20 and 1.4.21, any call to iptables would generate a message
cannot open connlabel.conf, not registering 'connlabel' match: No
such file or directory
Quoted 6 lines
Committed, thanks.
Do you see this with mainline buildroot? We do pass --disable-static for !BR2_STATIC_LIBS builds, so I'm not sure how it could trigger for your?
But the fix does make sense for completely static builds.
We noticed this problem after upgrading to a newer buildroot version a few releases back (but never sent that patch to buildroot until now). We are not using a static build, nor did we make changes to iptables.mk here.
I don't really know why the author of the patch mentioned static in the commit message. Maybe he is not referring to 'static' in the sense that Buildroot does.
Anyway, we were thus seeing this message with standard iptables calls on a standard system.
/Thomas
PATCH 1/1 iptables: add upstream patch fixing the message 'connlabel.conf not found'
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Thomas" == Thomas De Schampheleire <[email protected]> writes:
Hi,
Quoted 5 lines
Quoted 4 lines
Do you see this with mainline buildroot? We do pass --disable-static for !BR2_STATIC_LIBS builds, so I'm not sure how it could trigger for your?
But the fix does make sense for completely static builds.
Quoted 7 lines
We noticed this problem after upgrading to a newer buildroot version a few releases back (but never sent that patch to buildroot until now). We are not using a static build, nor did we make changes to iptables.mk here.
I don't really know why the author of the patch mentioned static in the commit message. Maybe he is not referring to 'static' in the sense that Buildroot does.
As far as I read the mail it is about configuring iptables with --enable-static
Quoted 2 lines
Anyway, we were thus seeing this message with standard iptables calls on a standard system.
But with a Buildroot version not including:
commit 9f13ddf3bab51ae762b82ce9f767ac1abcdb7b2e
Author: Gustavo Zacarias <[email protected]> Date: Tue Oct 21 13:58:14 2014 -0300
iptables: disable static for dynamic builds
It leads to ugly runtime warnings, see:
http://patchwork.ozlabs.org/patch/386215/
It's also required for xtables-addons.
Right?
Signature · 2 lines
Venlig hilsen, Peter Korsgaard
PATCH 1/1 iptables: add upstream patch fixing the message 'connlabel.conf not found'
Quoted 2 lines · Peter Korsgaard
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
"Thomas" == Thomas De Schampheleire <[email protected]>
Quoted 4 lines · writes:
Hi,
Quoted 1 line
Quoted 1 line
Do you see this with mainline buildroot? We do pass --disable-static
for
Quoted 1 line
Quoted 1 line
Quoted 1 line
!BR2_STATIC_LIBS builds, so I'm not sure how it could trigger for
your?
Quoted 29 lines
Quoted 10 lines
Quoted 2 lines
But the fix does make sense for completely static builds.
We noticed this problem after upgrading to a newer buildroot version a few releases back (but never sent that patch to buildroot until now). We are not using a static build, nor did we make changes to iptables.mk here.
I don't really know why the author of the patch mentioned static in the commit message. Maybe he is not referring to 'static' in the sense that Buildroot does.As far as I read the mail it is about configuring iptables with --enable-static
Quoted 2 lines
Anyway, we were thus seeing this message with standard iptables calls on a standard system.
But with a Buildroot version not including:
commit
9f13ddf3bab51ae762b82ce9f767ac1abcdb7b2eAuthor: Gustavo Zacarias <[email protected]> Date: Tue Oct 21 13:58:14 2014 -0300iptables: disable static for dynamic builds
It leads to ugly runtime warnings, see:
http://patchwork.ozlabs.org/patch/386215/
It's also required for xtables-addons.
Quoted 5 lines
Signed-off-by Gustavo Zacarias <[email protected]>Reviewed-by "Yann E. MORIN" <[email protected]>Signed-off-by Thomas Petazzoni <[email protected]>Right?
Makes sense, we were updating from 2013.05 to 2014.05 back then. I wasn't aware of the above patch.
It means that for our use case, we
wouldn't need it any more (we're on 2015.05 now).
Thanks for refreshing that for me :)
/Thomas
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.busybox.net/pipermail/buildroot/attachments/20151020/3bea789c/attachment.html>