Re: [ptxdist] [PATCH 1/5] iptables: bump version to 1.6.0 and updatecompile switches

[Andreas Geisenhainer <Andreas.Geisenhainer@atsonline.de>]

Hello Michael.

On 07/04/16 12:55 PM, Michael Olbrich wrote:
> On Wed, Apr 06, 2016 at 05:20:23PM +0200, Andreas Geisenhainer wrote:
>> @@ -7,6 +7,7 @@ menuconfig IPTABLES
>>   	select LIBC_M
>>   	select LIBC_DL
>>   	select GCCLIBS_GCC_S
>> +	select LIBNFTNL
> Please reorder your patches so libnftnl is actually available.

Oh, i see. I didn't think about treating each commit as
separate entity.

>> +config IPTABLES_BPF_COMPILE
>> +	bool
>> +    prompt "install BPF_compile"
> Maybe we could enable this unconditionally? I guessing the binary will be
> rather small and this doesn't introduce any new external dependencies.
>
>> +	help
>> +	  Enable for the Berkeley Packet Filter(BPF) compile helper program.
>> +
>> +config IPTABLES_NFSYNPROXY
>> +	bool
>> +    prompt "install nfsynproxy"
> Same here. What's this for anyways?

I have no clue, but i assumed there could be some use for it.
And going with the safe option, I created kconfig selections for
them. There are three tool (nfbpf_compile, nfnl_osf, nfsynproxy),
together these are less than 100kB of data. It should be safe
to just install them.
On the other hand: nobody seemed to miss them for the 1.4.21 release …


>> @@ -43,12 +45,15 @@ IPTABLES_CONF_OPT	:= \
>>   	$(GLOBAL_LARGE_FILE_OPTION) \
>>   	--enable-devel \
>>   	--$(call ptx/endis, PTXCONF_IPTABLES_LIBIPQ)-libipq \
>> +	--$(call ptx/endis, PTXCONF_IPTABLES_BPF_COMPILE)-bpf-compiler \
>> +	--$(call ptx/endis, PTXCONF_IPTABLES_NFTABLES_COMPAT)-nftables \
>> +	--$(call ptx/endis, PTXCONF_IPTABLES_NFSYNPROXY)-nfsynproxy \
> Make sure --disable-* works correctly now. Otherwise you need to use:
> 	$(call ptx/ifdef, PTXCONF_IPTABLES_...,--enable-...)

I tested the enable/disable versions for bpf-compile and nfsynproxy, they
seemed to work. Disabling them, stated the correct option after 
configuration
and it did not build the corresponding binary.

I just double checked. The nftables support does work as advertised.
Disabling it, does not build the "xtables-compat-multi" binary.
I paraphrased the help text.

>>   	--with-kernel=$(KERNEL_HEADERS_DIR) \
>>   	--with-xtlibdir=/usr/lib
>>   
>> -## broken configure.ac, so setting these would _enable_ the options:
>> -#	--disable-bpf-compiler
>> -#	--disable-nfsynproxy
>> +# static build is possible, but probably not useful. expand with:
>> +#	--enable-static --disable-shared
> No need to comment on shared/static options. It's the same for everything.
I was stumped, testing this. Using the "--enable-static" switch did not 
produce
static binaries. It seems, the build process did favor the "--enable-shared"
default option. So I figured it could be helpful to other. Will remove it.


I'll add your other recommendations and resubmit the patch set.

regards
Andreas

____________
Virus checked by G Data MailSecurity
Version: AVA 25.6081 dated 07.04.2016
Virus news: www.antiviruslab.com

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de