Hello Michael.
On 07/04/16 12:55 PM, Michael Olbrich wrote:
On Wed, Apr 06, 2016 at 05:20:23PM +0200, Andreas Geisenhainer wrote:
@@ -7,6 +7,7 @@ menuconfig IPTABLES
select LIBC_M
select LIBC_DL
select GCCLIBS_GCC_S
+ select LIBNFTNL
Please reorder your patches so libnftnl is actually available.
Oh, i see. I didn't think about treating each commit as
separate entity.
+config IPTABLES_BPF_COMPILE
+ bool
+ prompt "install BPF_compile"
Maybe we could enable this unconditionally? I guessing the binary will be
rather small and this doesn't introduce any new external dependencies.
+ help
+ Enable for the Berkeley Packet Filter(BPF) compile helper program.
+
+config IPTABLES_NFSYNPROXY
+ bool
+ prompt "install nfsynproxy"
Same here. What's this for anyways?
I have no clue, but i assumed there could be some use for it.
And going with the safe option, I created kconfig selections for
them. There are three tool (nfbpf_compile, nfnl_osf, nfsynproxy),
together these are less than 100kB of data. It should be safe
to just install them.
On the other hand: nobody seemed to miss them for the 1.4.21 release …
@@ -43,12 +45,15 @@ IPTABLES_CONF_OPT := \
$(GLOBAL_LARGE_FILE_OPTION) \
--enable-devel \
--$(call ptx/endis, PTXCONF_IPTABLES_LIBIPQ)-libipq \
+ --$(call ptx/endis, PTXCONF_IPTABLES_BPF_COMPILE)-bpf-compiler \
+ --$(call ptx/endis, PTXCONF_IPTABLES_NFTABLES_COMPAT)-nftables \
+ --$(call ptx/endis, PTXCONF_IPTABLES_NFSYNPROXY)-nfsynproxy \
Make sure --disable-* works correctly now. Otherwise you need to use:
$(call ptx/ifdef, PTXCONF_IPTABLES_...,--enable-...)
I tested the enable/disable versions for bpf-compile and nfsynproxy, they
seemed to work. Disabling them, stated the correct option after
configuration
and it did not build the corresponding binary.
I just double checked. The nftables support does work as advertised.
Disabling it, does not build the "xtables-compat-multi" binary.
I paraphrased the help text.
--with-kernel=$(KERNEL_HEADERS_DIR) \
--with-xtlibdir=/usr/lib
-## broken configure.ac, so setting these would _enable_ the options:
-# --disable-bpf-compiler
-# --disable-nfsynproxy
+# static build is possible, but probably not useful. expand with:
+# --enable-static --disable-shared
No need to comment on shared/static options. It's the same for everything.
I was stumped, testing this. Using the "--enable-static" switch did not
produce
static binaries. It seems, the build process did favor the "--enable-shared"
default option. So I figured it could be helpful to other. Will remove it.
I'll add your other recommendations and resubmit the patch set.
regards
Andreas
____________
Virus checked by G Data MailSecurity
Version: AVA 25.6081 dated 07.04.2016
Virus news: www.antiviruslab.com
_______________________________________________
ptxdist mailing list
[email protected]
