Re: [iptables PATCH 3/5] extensions: connlabel: Allow connlabel.conf override

[Phil Sutter <phil@nwl.cc>]

Hi Pablo,

On Fri, Mar 01, 2019 at 01:52:09PM +0100, Pablo Neira Ayuso wrote:
> Hi Phil,
> 
> On Tue, Feb 19, 2019 at 08:39:51PM +0100, Phil Sutter wrote:
> > Check for environment variable XT_CONNLABEL_CFG and if set use its value
> > as path to connlabel.conf.
> > 
> > Signed-off-by: Phil Sutter <phil@nwl.cc>
> > ---
> >  extensions/libxt_connlabel.c   | 6 ++++--
> >  extensions/libxt_connlabel.man | 2 ++
> >  2 files changed, 6 insertions(+), 2 deletions(-)
> > 
> > diff --git a/extensions/libxt_connlabel.c b/extensions/libxt_connlabel.c
> > index d06bb27a7c2e9..9a2f9ce34647e 100644
> > --- a/extensions/libxt_connlabel.c
> > +++ b/extensions/libxt_connlabel.c
> > @@ -3,6 +3,7 @@
> >  #include <string.h>
> >  #include <stdio.h>
> >  #include <stdint.h>
> > +#include <stdlib.h>
> >  #include <xtables.h>
> >  #include <linux/netfilter/xt_connlabel.h>
> >  #include <libnetfilter_conntrack/libnetfilter_conntrack.h>
> > @@ -39,11 +40,12 @@ static void connlabel_open(void)
> >  	if (map)
> >  		return;
> >  
> > -	map = nfct_labelmap_new(NULL);
> > +	fname = getenv("XT_CONNLABEL_CFG") ?: nfct_labels_get_path();
> 
> Only one question about this one: Would you need anything similar for
> nft? If so, probably it's better to place this code in
> libnetfilter_conntrack.

I guess not: In nftables, /etc/connlabel.conf is manually parsed via
call to rt_symbol_table_init(). So while I could add the above to
libnetfilter_conntrack, it wouldn't affect nftables.

Cheers, Phil