| Message ID | 20190219193953.29066-4-phil@nwl.cc |
|---|---|
| State | Superseded |
| Delegated to: | Pablo Neira |
| Headers | show |
| Series | Make testsuites a bit more versatile | expand |
Hi Phil, On Tue, Feb 19, 2019 at 08:39:51PM +0100, Phil Sutter wrote: > Check for environment variable XT_CONNLABEL_CFG and if set use its value > as path to connlabel.conf. > > Signed-off-by: Phil Sutter <phil@nwl.cc> > --- > extensions/libxt_connlabel.c | 6 ++++-- > extensions/libxt_connlabel.man | 2 ++ > 2 files changed, 6 insertions(+), 2 deletions(-) > > diff --git a/extensions/libxt_connlabel.c b/extensions/libxt_connlabel.c > index d06bb27a7c2e9..9a2f9ce34647e 100644 > --- a/extensions/libxt_connlabel.c > +++ b/extensions/libxt_connlabel.c > @@ -3,6 +3,7 @@ > #include <string.h> > #include <stdio.h> > #include <stdint.h> > +#include <stdlib.h> > #include <xtables.h> > #include <linux/netfilter/xt_connlabel.h> > #include <libnetfilter_conntrack/libnetfilter_conntrack.h> > @@ -39,11 +40,12 @@ static void connlabel_open(void) > if (map) > return; > > - map = nfct_labelmap_new(NULL); > + fname = getenv("XT_CONNLABEL_CFG") ?: nfct_labels_get_path(); Only one question about this one: Would you need anything similar for nft? If so, probably it's better to place this code in libnetfilter_conntrack.
Hi Pablo, On Fri, Mar 01, 2019 at 01:52:09PM +0100, Pablo Neira Ayuso wrote: > Hi Phil, > > On Tue, Feb 19, 2019 at 08:39:51PM +0100, Phil Sutter wrote: > > Check for environment variable XT_CONNLABEL_CFG and if set use its value > > as path to connlabel.conf. > > > > Signed-off-by: Phil Sutter <phil@nwl.cc> > > --- > > extensions/libxt_connlabel.c | 6 ++++-- > > extensions/libxt_connlabel.man | 2 ++ > > 2 files changed, 6 insertions(+), 2 deletions(-) > > > > diff --git a/extensions/libxt_connlabel.c b/extensions/libxt_connlabel.c > > index d06bb27a7c2e9..9a2f9ce34647e 100644 > > --- a/extensions/libxt_connlabel.c > > +++ b/extensions/libxt_connlabel.c > > @@ -3,6 +3,7 @@ > > #include <string.h> > > #include <stdio.h> > > #include <stdint.h> > > +#include <stdlib.h> > > #include <xtables.h> > > #include <linux/netfilter/xt_connlabel.h> > > #include <libnetfilter_conntrack/libnetfilter_conntrack.h> > > @@ -39,11 +40,12 @@ static void connlabel_open(void) > > if (map) > > return; > > > > - map = nfct_labelmap_new(NULL); > > + fname = getenv("XT_CONNLABEL_CFG") ?: nfct_labels_get_path(); > > Only one question about this one: Would you need anything similar for > nft? If so, probably it's better to place this code in > libnetfilter_conntrack. I guess not: In nftables, /etc/connlabel.conf is manually parsed via call to rt_symbol_table_init(). So while I could add the above to libnetfilter_conntrack, it wouldn't affect nftables. Cheers, Phil
diff --git a/extensions/libxt_connlabel.c b/extensions/libxt_connlabel.c index d06bb27a7c2e9..9a2f9ce34647e 100644 --- a/extensions/libxt_connlabel.c +++ b/extensions/libxt_connlabel.c @@ -3,6 +3,7 @@ #include <string.h> #include <stdio.h> #include <stdint.h> +#include <stdlib.h> #include <xtables.h> #include <linux/netfilter/xt_connlabel.h> #include <libnetfilter_conntrack/libnetfilter_conntrack.h> @@ -39,11 +40,12 @@ static void connlabel_open(void) if (map) return; - map = nfct_labelmap_new(NULL); + fname = getenv("XT_CONNLABEL_CFG") ?: nfct_labels_get_path(); + + map = nfct_labelmap_new(fname); if (map != NULL) return; - fname = nfct_labels_get_path(); if (errno) { xtables_error(RESOURCE_PROBLEM, "cannot open %s: %s", fname, strerror(errno)); diff --git a/extensions/libxt_connlabel.man b/extensions/libxt_connlabel.man index bdaa51e8b033f..c6312a88ed35c 100644 --- a/extensions/libxt_connlabel.man +++ b/extensions/libxt_connlabel.man @@ -19,6 +19,8 @@ option was negated). .PP This match depends on libnetfilter_conntrack 1.0.4 or later. Label translation is done via the \fB/etc/xtables/connlabel.conf\fP configuration file. +To use label names defined in a different file, \fBXT_CONNLABEL_CFG\fP +environment variable may be set to the full path of that file. .PP Example: .IP
Check for environment variable XT_CONNLABEL_CFG and if set use its value as path to connlabel.conf. Signed-off-by: Phil Sutter <phil@nwl.cc> --- extensions/libxt_connlabel.c | 6 ++++-- extensions/libxt_connlabel.man | 2 ++ 2 files changed, 6 insertions(+), 2 deletions(-)