On Mon, Mar 07, 2016 at 11:05:15PM +0530, Shivani Bhardwaj wrote: > On Mon, Mar 7, 2016 at 7:39 PM, Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > > On Mon, Mar 07, 2016 at 02:44:47PM +0530, Shivani Bhardwaj wrote: > >> Add the --enable-connlabel option and show whether it is already > >> supported. > >> > >> After this patch, iptables configuration shows up as: > >> > >> Iptables Configuration: > >> IPv4 support: yes > >> IPv6 support: yes > >> Devel support: yes > >> IPQ support: no > >> Large file support: yes > >> BPF utils support: no > >> nfsynproxy util support: no > >> nftables support: yes > >> connlabel support: yes > >> > >> Signed-off-by: Shivani Bhardwaj <shivanib134@xxxxxxxxx> > >> --- > >> configure.ac | 5 +++++ > >> 1 file changed, 5 insertions(+) > >> > >> diff --git a/configure.ac b/configure.ac > >> index 33a8f2d..c946d69 100644 > >> --- a/configure.ac > >> +++ b/configure.ac > >> @@ -63,6 +63,9 @@ AC_ARG_WITH([pkgconfigdir], AS_HELP_STRING([--with-pkgconfigdir=PATH], > >> AC_ARG_ENABLE([nftables], > >> AS_HELP_STRING([--disable-nftables], [Do not build nftables compat]), > >> [enable_nftables="$enableval"], [enable_nftables="yes"]) > >> +AC_ARG_ENABLE([connlabel], > >> + AS_HELP_STRING([--enable-connlabel], [Build libnetfilter_conntrack]), > >> + [enable_connlabel="$enableval"], [enable_connlabel="yes"]) > > > > I think there is still some missing code here. If the user requests > > connlabel but libnetfilter_conntrack (including the right version) is > > not available, then I would fail and display an error since the user > > is explicitly asking for this. > > > > Otherwise, we can fall back on the existing behaviour: just lazy check > > if it's there and enable it in that case. If the library is not > > present, just skip this. > > > > The --disable-connlabel should also work, in that case, we should skip > > adding support for this. > > > > Can you look into fitting this logic into this? Thanks. > > > Yes, I'll do that. > I need a bit of help here. > I followed some other modules for which support has been mentioned. > For example, libipq > When I first ran the configure script, it turned out > IPQ support: no > > I did next time with the option --enable-libipq > As expected, > IPQ support: yes > > But, I tried writing the output of both these cases to files and when > I looked up for difference between the two, turned out only this IPQ > support line was different among them, in any case following was shown > > config.status: creating libipq/Makefile > config.status: creating libipq/libipq.pc > > (because this is a part of AC_CONFIG_FILES) > > I do not see any code associated with libipq in configure.ac. > May be I'm not understanding how these options are working, could you > please clarify a bit? Those are the userspace bits for the old ip_queue support that was removed years ago, since NFQUEUE superseded for many years. commit d16cf20e2f2f13411eece7f7fb72c17d141c4a84 Author: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> Date: Tue May 8 19:45:28 2012 +0200 netfilter: remove ip_queue support You can still cd iptables/libipq and type 'make' to compile the this small userspace library since we have to keep new iptables releases running with old kernels. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html