Re: [ptxdist] [PATCH 1/5] iptables: bump version to 1.6.0 and update compile switches

[Michael Olbrich <m.olbrich@pengutronix.de>]

On Wed, Apr 06, 2016 at 05:20:23PM +0200, Andreas Geisenhainer wrote:
>     - since iptables 1.6.0 depends on libnftnl, this patchset adds support
>       for nftables, too.
>       nftables should be used on sufficient new kernel, somewhere around 4.2
>       should be ok.
>     - new libraries to resolv dependencies are
>       - libnftnl
>       - libmnl
> 
> Signed-off-by: Andreas Geisenhainer <Andreas.Geisenhainer@atsonline.de>
> ---
>  rules/iptables.in   | 18 ++++++++++++++++++
>  rules/iptables.make | 47 +++++++++++++++++++++++++++++++++++++++++------
>  2 files changed, 59 insertions(+), 6 deletions(-)
> 
> diff --git a/rules/iptables.in b/rules/iptables.in
> index e6f3699..6e4bc91 100644
> --- a/rules/iptables.in
> +++ b/rules/iptables.in
> @@ -7,6 +7,7 @@ menuconfig IPTABLES
>  	select LIBC_M
>  	select LIBC_DL
>  	select GCCLIBS_GCC_S
> +	select LIBNFTNL

Please reorder your patches so libnftnl is actually available.

>  	select LIBNFNETLINK if IPTABLES_LIBNFNETLINK
>  	help
>  	  Iptables  is used to set up, maintain, and inspect the
> @@ -32,6 +33,16 @@ config IPTABLES_LIBIPQ
>  	  Builds and installs libipq (the iptables userspace packet
>  	  queuing library).
>  
> +config IPTABLES_BPF_COMPILE
> +	bool
> +    prompt "install BPF_compile"

Maybe we could enable this unconditionally? I guessing the binary will be
rather small and this doesn't introduce any new external dependencies.

> +	help
> +	  Enable for the Berkeley Packet Filter(BPF) compile helper program.
> +
> +config IPTABLES_NFSYNPROXY
> +	bool
> +    prompt "install nfsynproxy"

Same here. What's this for anyways?

> +
>  config IPTABLES_INSTALL_TOOLS
>  	bool "install executables"
>  	help
> @@ -61,4 +72,11 @@ config IPTABLES_LIBNFNETLINK
>  	help
>  	  Select if iptables should be build against libnfnetlink
>  
> +config IPTABLES_NFTABLES_COMPAT
> +	bool
> +	select NFTABLES
> +	prompt "nftables compat"
> +	help
> +	  build with nftables compability support
> +
>  endif
> diff --git a/rules/iptables.make b/rules/iptables.make
> index 8a1ea66..90df197 100644
> --- a/rules/iptables.make
> +++ b/rules/iptables.make
> @@ -4,6 +4,8 @@
>  #               2007 by Carsten Schlote, konzeptpark
>  #               2008 by Juergen Beisert
>  #               2009 by Marc Kleine-Budde <mkl@pengutronix.de>
> +#               2016 by Andreas Geisenhainer <andreas.geisenhainer@atsonline.de>
> +#
>  #
>  # See CREDITS for details about who has contributed to this project.
>  #
> @@ -19,8 +21,8 @@ PACKAGES-$(PTXCONF_IPTABLES) += iptables
>  #
>  # Paths and names
>  #
> -IPTABLES_VERSION	:= 1.4.21
> -IPTABLES_MD5		:= 536d048c8e8eeebcd9757d0863ebb0c0
> +IPTABLES_VERSION	:= 1.6.0
> +IPTABLES_MD5		:= 27ba3451cb622467fc9267a176f19a31
>  IPTABLES		:= iptables-$(IPTABLES_VERSION)
>  IPTABLES_SUFFIX		:= tar.bz2
>  IPTABLES_URL		:= http://ftp.netfilter.org/pub/iptables/$(IPTABLES).$(IPTABLES_SUFFIX)
> @@ -43,12 +45,15 @@ IPTABLES_CONF_OPT	:= \
>  	$(GLOBAL_LARGE_FILE_OPTION) \
>  	--enable-devel \
>  	--$(call ptx/endis, PTXCONF_IPTABLES_LIBIPQ)-libipq \
> +	--$(call ptx/endis, PTXCONF_IPTABLES_BPF_COMPILE)-bpf-compiler \
> +	--$(call ptx/endis, PTXCONF_IPTABLES_NFTABLES_COMPAT)-nftables \
> +	--$(call ptx/endis, PTXCONF_IPTABLES_NFSYNPROXY)-nfsynproxy \

Make sure --disable-* works correctly now. Otherwise you need to use:
	$(call ptx/ifdef, PTXCONF_IPTABLES_...,--enable-...)

>  	--with-kernel=$(KERNEL_HEADERS_DIR) \
>  	--with-xtlibdir=/usr/lib
>  
> -## broken configure.ac, so setting these would _enable_ the options:
> -#	--disable-bpf-compiler
> -#	--disable-nfsynproxy
> +# static build is possible, but probably not useful. expand with:
> +#	--enable-static --disable-shared

No need to comment on shared/static options. It's the same for everything.

Michael

> +
>  
>  # ----------------------------------------------------------------------------
>  # Install
> @@ -110,8 +115,8 @@ endif
>  
>  ifdef PTXCONF_IPTABLES_INSTALL_TOOLS
>  	@$(call install_copy, iptables, 0, 0, 0755, -, /usr/sbin/xtables-multi)
> -
>  	@$(call install_link, iptables, ../sbin/xtables-multi, /usr/bin/iptables-xml)
> +	@$(call install_copy, iptables, 0, 0, 0755, -, /usr/sbin/nfnl_osf)
>  
>  ifdef PTXCONF_IPTABLES_IPV6
>  # 	# IPv6 part
> @@ -132,6 +137,36 @@ ifdef PTXCONF_IPTABLES_INSTALL_IPTABLES_APPLY
>  	@$(call install_copy, iptables, 0, 0, 0755, -, /usr/sbin/iptables-apply)
>  endif
>  
> +#	#  nftables compability layer
> +ifdef PTXCONF_IPTABLES_NFTABLES_COMPAT
> +	@$(call install_copy, iptables, 0, 0, 0755, -, /usr/sbin/xtables-compat-multi)
> +
> +ifdef PTXCONF_IPTABLES_IPV4
> +# 	# IPv4 part
> +	@$(call install_link, iptables, xtables-compat-multi, /usr/sbin/iptables-compat)
> +	@$(call install_link, iptables, xtables-compat-multi, /usr/sbin/iptables-compat-save)
> +	@$(call install_link, iptables, xtables-compat-multi, /usr/sbin/iptables-compat-restore)
> +endif
> +
> +ifdef PTXCONF_IPTABLES_IPV6
> +# 	# IPv6 part
> +	@$(call install_link, iptables, xtables-compat-multi, /usr/sbin/ip6tables-compat)
> +	@$(call install_link, iptables, xtables-compat-multi, /usr/sbin/ip6tables-compat-save)
> +	@$(call install_link, iptables, xtables-compat-multi, /usr/sbin/ip6tables-compat-restore)
> +endif
> +
> +	@$(call install_link, iptables, xtables-compat-multi, /usr/sbin/arptables-compat)
> +	@$(call install_link, iptables, xtables-compat-multi, /usr/sbin/ebtables-compat)
> +endif
> +
> +ifdef PTXCONF_IPTABLES_NFSYNPROXY
> +	@$(call install_copy, iptables, 0, 0, 0755, -, /usr/sbin/nfsynproxy)
> +endif
> +
> +ifdef PTXCONF_IPTABLES_BPF_COMPILE
> +	@$(call install_copy, iptables, 0, 0, 0755, -, /usr/sbin/nfbpf_compile)
> +endif
> +
>  	@$(call install_finish, iptables)
>  
>  	@$(call touch)
> -- 
> 2.8.0.rc3
> 
> ____________
> Virus checked by G Data MailSecurity
> Version: AVA 25.6071 dated 06.04.2016
> Virus news: www.antiviruslab.com.
> 
> _______________________________________________
> ptxdist mailing list
> ptxdist@pengutronix.de

-- 
Pengutronix e.K.                           |                             |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de