|
 |
9c64ad |
Adapted version of
|
|
|
9c64ad |
|
|
|
9c64ad |
commit b91af533f4da15854893ba5cc082e1df6bcf9a97
|
|
|
9c64ad |
Author: Lorenzo Colitti <lorenzo@google.com>
|
|
|
9c64ad |
Date: Tue Mar 14 17:55:50 2017 +0900
|
|
|
9c64ad |
|
|
|
9c64ad |
iptables: set the path of the lock file via a configure option.
|
|
|
9c64ad |
|
|
|
9c64ad |
Currently the iptables lock is hardcoded as "/run/xtables.lock".
|
|
|
9c64ad |
Allow users to change this path using the --with-xt-lock-name
|
|
|
9c64ad |
option to ./configure option. This is useful on systems like
|
|
|
9c64ad |
Android which do not have /run.
|
|
|
9c64ad |
|
|
|
9c64ad |
Tested on Ubuntu, as follows:
|
|
|
9c64ad |
|
|
|
9c64ad |
1. By default, the lock is placed in /run/xtables.lock:
|
|
|
9c64ad |
|
|
|
9c64ad |
$ make distclean-recursive && ./autogen.sh &&
|
|
|
9c64ad |
./configure --disable-nftables --prefix /tmp/iptables &&
|
|
|
9c64ad |
make -j64 &&
|
|
|
9c64ad |
make install &&
|
|
|
9c64ad |
sudo strace -e open,flock /tmp/iptables/sbin/iptables -L foo
|
|
|
9c64ad |
...
|
|
|
9c64ad |
open("/run/xtables.lock", O_RDONLY|O_CREAT, 0600) = 3
|
|
|
9c64ad |
flock(3, LOCK_EX|LOCK_NB) = 0
|
|
|
9c64ad |
iptables: No chain/target/match by that name.
|
|
|
9c64ad |
|
|
|
9c64ad |
2. Specifying the lock results in the expected location being
|
|
|
9c64ad |
used:
|
|
|
9c64ad |
|
|
|
9c64ad |
$ make distclean-recursive && ./autogen.sh && \
|
|
|
9c64ad |
./configure --disable-nftables --prefix /tmp/iptables \
|
|
|
9c64ad |
--with-xt-lock-name=/tmp/iptables/run/xtables.lock &&
|
|
|
9c64ad |
make -j64 &&
|
|
|
9c64ad |
make install &&
|
|
|
9c64ad |
sudo strace -e open,flock /tmp/iptables/sbin/iptables -L foo
|
|
|
9c64ad |
...
|
|
|
9c64ad |
open("/tmp/iptables/run/xtables.lock", O_RDONLY|O_CREAT, 0600) = 3
|
|
|
9c64ad |
flock(3, LOCK_EX|LOCK_NB) = 0
|
|
|
9c64ad |
iptables: No chain/target/match by that name.
|
|
|
9c64ad |
|
|
|
9c64ad |
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
|
|
|
9c64ad |
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
9c64ad |
|
|
|
9c64ad |
diff -up iptables-1.4.21/configure.ac.configure_set_lock_file_path iptables-1.4.21/configure.ac
|
|
|
9c64ad |
--- iptables-1.4.21/configure.ac.configure_set_lock_file_path 2013-11-22 12:18:13.000000000 +0100
|
|
|
9c64ad |
+++ iptables-1.4.21/configure.ac 2017-04-05 14:47:17.308782472 +0200
|
|
|
9c64ad |
@@ -60,6 +60,10 @@ AC_ARG_ENABLE([nfsynproxy],
|
|
|
9c64ad |
AC_ARG_WITH([pkgconfigdir], AS_HELP_STRING([--with-pkgconfigdir=PATH],
|
|
|
9c64ad |
[Path to the pkgconfig directory [[LIBDIR/pkgconfig]]]),
|
|
|
9c64ad |
[pkgconfigdir="$withval"], [pkgconfigdir='${libdir}/pkgconfig'])
|
|
|
9c64ad |
+AC_ARG_WITH([xt-lock-name], AS_HELP_STRING([--with-xt-lock-name=PATH],
|
|
|
9c64ad |
+ [Path to the xtables lock [[/run/xtables.lock]]]),
|
|
|
9c64ad |
+ [xt_lock_name="$withval"],
|
|
|
9c64ad |
+ [xt_lock_name="/run/xtables.lock"])
|
|
|
9c64ad |
|
|
|
9c64ad |
libiptc_LDFLAGS2="";
|
|
|
9c64ad |
AX_CHECK_LINKER_FLAGS([-Wl,--no-as-needed],
|
|
|
9c64ad |
@@ -118,7 +122,7 @@ AM_CONDITIONAL([HAVE_LIBNFNETLINK], [tes
|
|
|
9c64ad |
regular_CFLAGS="-Wall -Waggregate-return -Wmissing-declarations \
|
|
|
9c64ad |
-Wmissing-prototypes -Wredundant-decls -Wshadow -Wstrict-prototypes \
|
|
|
9c64ad |
-Winline -pipe";
|
|
|
9c64ad |
-regular_CPPFLAGS="${largefile_cppflags} -D_REENTRANT \
|
|
|
9c64ad |
+regular_CPPFLAGS="${largefile_cppflags} -DXT_LOCK_NAME=\\\"\${xt_lock_name}\\\" -D_REENTRANT \
|
|
|
9c64ad |
-DXTABLES_LIBDIR=\\\"\${xtlibdir}\\\" -DXTABLES_INTERNAL";
|
|
|
9c64ad |
kinclude_CPPFLAGS="";
|
|
|
9c64ad |
if [[ -n "$kbuilddir" ]]; then
|
|
|
9c64ad |
@@ -156,6 +160,7 @@ AC_SUBST([libxtables_vcurrent])
|
|
|
9c64ad |
AC_SUBST([libxtables_vage])
|
|
|
9c64ad |
libxtables_vmajor=$(($libxtables_vcurrent - $libxtables_vage));
|
|
|
9c64ad |
AC_SUBST([libxtables_vmajor])
|
|
|
9c64ad |
+AC_SUBST([xt_lock_name])
|
|
|
9c64ad |
|
|
|
9c64ad |
AC_CONFIG_FILES([Makefile extensions/GNUmakefile include/Makefile
|
|
|
9c64ad |
iptables/Makefile iptables/xtables.pc
|
|
|
9c64ad |
@@ -188,7 +193,8 @@ Build parameters:
|
|
|
9c64ad |
Support plugins via dlopen (shared): ${enable_shared}
|
|
|
9c64ad |
Installation prefix (--prefix): ${prefix}
|
|
|
9c64ad |
Xtables extension directory: ${e_xtlibdir}
|
|
|
9c64ad |
- Pkg-config directory: ${e_pkgconfigdir}"
|
|
|
9c64ad |
+ Pkg-config directory: ${e_pkgconfigdir}
|
|
|
9c64ad |
+ Xtables lock file: ${xt_lock_name}"
|
|
|
9c64ad |
|
|
|
9c64ad |
if [[ -n "$ksourcedir" ]]; then
|
|
|
9c64ad |
echo " Kernel source directory: ${ksourcedir}"
|
|
|
9c64ad |
diff -up iptables-1.4.21/iptables/xshared.c.configure_set_lock_file_path iptables-1.4.21/iptables/xshared.c
|
|
|
9c64ad |
--- iptables-1.4.21/iptables/xshared.c.configure_set_lock_file_path 2017-04-05 14:46:47.861540910 +0200
|
|
|
9c64ad |
+++ iptables-1.4.21/iptables/xshared.c 2017-04-05 14:46:47.863540927 +0200
|
|
|
9c64ad |
@@ -17,8 +17,6 @@
|
|
|
9c64ad |
#include <math.h>
|
|
|
9c64ad |
#include "xshared.h"
|
|
|
9c64ad |
|
|
|
9c64ad |
-#define XT_LOCK_NAME "/run/xtables.lock"
|
|
|
9c64ad |
-
|
|
|
9c64ad |
/*
|
|
|
9c64ad |
* Print out any special helps. A user might like to be able to add a --help
|
|
|
9c64ad |
* to the commandline, and see expected results. So we call help for all
|