iptables: Fix connlabel.conf install location

PATCH Applied Phil Oester 3 participants 9 messages Jun 11, 2013 – Jul 3, 2013

Subsystems (2)

Kbuild netfilter

lore

Share & tools

lore

Phil Oester

author

2013-06-11 17:05 UTC #0 lore raw

PATCH 1/1 iptables: Fix connlabel.conf install location

As reported by Danny Rawlins in bug #828, connlabel.conf is unconditionally installed in /etc/xtables instead of using prefix set at configure time. Fix to use sysconfdir variable.

This closes bugzilla #828.

Phil

Signed-off-by Phil Oester <[email protected]>

Makefile.am +2 -2

index cd008a1..73f1352 100644
@@ -25,8 +25,8 @@ tarball:
 	rm -Rf /tmp/${PACKAGE_TARNAME}-${PACKAGE_VERSION};
 
 install-data-hook:
-	@mkdir -p -m 755 $(DESTDIR)/etc/xtables/ || :
-	@test -f /etc/xtables/connlabel.conf || $(INSTALL) -m 644 etc/xtables/connlabel.conf $(DESTDIR)/etc/xtables/connlabel.conf || :
+	@mkdir -p -m 755 @sysconfdir@/xtables/ || :
+	@test -f @sysconfdir@/xtables/connlabel.conf || $(INSTALL) -m 644 etc/xtables/connlabel.conf @sysconfdir@/xtables/connlabel.conf || :
 
 config.status: extensions/GNUmakefile.in \
 	include/xtables-version.h.in include/iptables/internal.h.in

Florian Westphal

maintainer

2013-06-12 07:51 UTC #1 lore raw

Quoted 3 lines · Phil Oester

As reported by Danny Rawlins in bug #828, connlabel.conf is unconditionally installed in /etc/xtables instead of using prefix set at configure time. Fix to use sysconfdir variable.

It was intentional.
I don't want userspace to start guessing where the config file is.

Pablo Neira Ayuso

maintainer Applied

2013-06-12 08:04 UTC #8 lore raw

In reply to Phil Oester

Quoted 5 lines · Phil Oester

As reported by Danny Rawlins in bug #828, connlabel.conf is unconditionally installed in /etc/xtables instead of using prefix set at configure time. Fix to use sysconfdir variable.
This closes bugzilla #828.

Applied, thanks Phil.

Pablo Neira Ayuso

maintainer

2013-06-12 08:50 UTC #2 lore raw

In reply to Florian Westphal

Quoted 7 lines · Florian Westphal

Quoted 3 lines · Phil Oester
As reported by Danny Rawlins in bug #828, connlabel.conf is unconditionally installed in /etc/xtables instead of using prefix set at configure time. Fix to use sysconfdir variable.
It was intentional.
I don't want userspace to start guessing where the config file is.

Sorry Florian, we crossed emails while replying this.

I think this is still useful for people cross-compiling and installing iptables in some custom location.

Regards.

Pablo Neira Ayuso

maintainer

2013-06-12 09:08 UTC #3 lore raw

Quoted 6 lines · Pablo Neira Ayuso

Quoted 5 lines · Florian Westphal
Quoted 3 lines · Phil Oester
As reported by Danny Rawlins in bug #828, connlabel.conf is unconditionally installed in /etc/xtables instead of using prefix set at configure time. Fix to use sysconfdir variable.

Quoted 7 lines

Quoted 2 lines
It was intentional.
I don't want userspace to start guessing where the config file is.
Sorry Florian, we crossed emails while replying this.
I think this is still useful for people cross-compiling and installing iptables in some custom location.

Hm, still, this may confuse people, as xt_connlabel always looks at:

#define CONNLABEL_CFG "/etc/xtables/connlabel.conf"

Florian Westphal

maintainer

2013-06-12 10:06 UTC #4 lore raw

Quoted 6 lines · Pablo Neira Ayuso

Quoted 2 lines
I think this is still useful for people cross-compiling and installing iptables in some custom location.
Hm, still, this may confuse people, as xt_connlabel always looks at:
#define CONNLABEL_CFG "/etc/xtables/connlabel.conf"

Right; this is easily fixable. However, this is also the default in libnetfilter_conntrack. But lnf-ct wont be able to know what configure options iptables was built with.

So libnetfilter-conntrack and conntrack-tool would end up having to try a couple of locations to find that config file...

Pablo Neira Ayuso

maintainer

2013-06-25 16:01 UTC #5 lore raw

Quoted 11 lines · Florian Westphal

Quoted 6 lines · Pablo Neira Ayuso
Quoted 2 lines
I think this is still useful for people cross-compiling and installing iptables in some custom location.
Hm, still, this may confuse people, as xt_connlabel always looks at:
#define CONNLABEL_CFG "/etc/xtables/connlabel.conf"
Right; this is easily fixable. However, this is also the default in libnetfilter_conntrack. But lnf-ct wont be able to know what configure options iptables was built with.

We can define the default location in libnetfilter_conntrack.h, eg.

#define NFCT_CONNLABEL_CFG "/etc/xtables/connlabel.conf"

I think connlabel is not of much use without libnetfilter_conntrack, since it provides the translation of the connlabel mapping. So we can conditionally compile connlabel support if libnetfilter_conntrack is installed. We can make it a soft dependency, ie. no need for --enable-connlabel.

Regards.

Florian Westphal

maintainer

2013-06-25 19:52 UTC #6 lore raw

Quoted 9 lines · Pablo Neira Ayuso

Quoted 8 lines · Florian Westphal
Quoted 6 lines · Pablo Neira Ayuso
Quoted 2 lines
I think this is still useful for people cross-compiling and installing iptables in some custom location.
Hm, still, this may confuse people, as xt_connlabel always looks at:
#define CONNLABEL_CFG "/etc/xtables/connlabel.conf"

Quoted 7 lines

Quoted 3 lines
Right; this is easily fixable. However, this is also the default in libnetfilter_conntrack. But lnf-ct wont be able to know what configure options iptables was built with.
We can define the default location in libnetfilter_conntrack.h, eg.
#define NFCT_CONNLABEL_CFG "/etc/xtables/connlabel.conf"

Sure, I can move the definition from conntrack/labels.c to a public header.

Quoted 5 lines

I think connlabel is not of much use without libnetfilter_conntrack, since it provides the translation of the connlabel mapping. So we can conditionally compile connlabel support if libnetfilter_conntrack is installed. We can make it a soft dependency, ie. no need for --enable-connlabel.

Hrm, the iptables connlabel extension currently parses the labels config itself.

What we can do is to add soft dependency in iptables for libnetfilter_conntrack, build the connlabel extension conditionally and then remove the default file from iptables.

Is that what you have in mind?

Pablo Neira Ayuso

maintainer

2013-07-03 00:13 UTC #7 lore raw

Quoted 27 lines · Florian Westphal

Quoted 9 lines · Pablo Neira Ayuso
Quoted 8 lines · Florian Westphal
Quoted 6 lines · Pablo Neira Ayuso
Quoted 2 lines
I think this is still useful for people cross-compiling and installing iptables in some custom location.
Hm, still, this may confuse people, as xt_connlabel always looks at:
#define CONNLABEL_CFG "/etc/xtables/connlabel.conf"
Quoted 7 lines
Quoted 3 lines
Right; this is easily fixable. However, this is also the default in libnetfilter_conntrack. But lnf-ct wont be able to know what configure options iptables was built with.
We can define the default location in libnetfilter_conntrack.h, eg.
#define NFCT_CONNLABEL_CFG "/etc/xtables/connlabel.conf"
Sure, I can move the definition from conntrack/labels.c to a public header.
Quoted 5 lines
I think connlabel is not of much use without libnetfilter_conntrack, since it provides the translation of the connlabel mapping. So we can conditionally compile connlabel support if libnetfilter_conntrack is installed. We can make it a soft dependency, ie. no need for --enable-connlabel.

Quoted 8 lines

Hrm, the iptables connlabel extension currently parses the labels config itself.
What we can do is to add soft dependency in iptables for libnetfilter_conntrack, build the connlabel extension conditionally and then remove the default file from iptables.
Is that what you have in mind?

Yes. BTW, you could simplify the existing iptables extension by using the connlabel API provided by libnetfilter_conntrack.

I think you can also add --with-libnfct=PATH for people that want to place the library somewhere in the tree, not the standard location.

Thanks.