Hi Pablo,
On Fri, Mar 01, 2019 at 01:52:09PM +0100, Pablo Neira Ayuso wrote:
> Hi Phil,
>
> On Tue, Feb 19, 2019 at 08:39:51PM +0100, Phil Sutter wrote:
> > Check for environment variable XT_CONNLABEL_CFG and if set use its value
> > as path to connlabel.conf.
> >
> > Signed-off-by: Phil Sutter <phil@xxxxxx>
> > ---
> > extensions/libxt_connlabel.c | 6 ++++--
> > extensions/libxt_connlabel.man | 2 ++
> > 2 files changed, 6 insertions(+), 2 deletions(-)
> >
> > diff --git a/extensions/libxt_connlabel.c b/extensions/libxt_connlabel.c
> > index d06bb27a7c2e9..9a2f9ce34647e 100644
> > --- a/extensions/libxt_connlabel.c
> > +++ b/extensions/libxt_connlabel.c
> > @@ -3,6 +3,7 @@
> > #include <string.h>
> > #include <stdio.h>
> > #include <stdint.h>
> > +#include <stdlib.h>
> > #include <xtables.h>
> > #include <linux/netfilter/xt_connlabel.h>
> > #include <libnetfilter_conntrack/libnetfilter_conntrack.h>
> > @@ -39,11 +40,12 @@ static void connlabel_open(void)
> > if (map)
> > return;
> >
> > - map = nfct_labelmap_new(NULL);
> > + fname = getenv("XT_CONNLABEL_CFG") ?: nfct_labels_get_path();
>
> Only one question about this one: Would you need anything similar for
> nft? If so, probably it's better to place this code in
> libnetfilter_conntrack.
I guess not: In nftables, /etc/connlabel.conf is manually parsed via
call to rt_symbol_table_init(). So while I could add the above to
libnetfilter_conntrack, it wouldn't affect nftables.
Cheers, Phil
