| Message ID | 20190710080835.296696-1-arnd@arndb.de |
|---|---|
| State | Accepted |
| Delegated to: | Pablo Neira |
| Headers | show |
| Series | [net-next] netfilter: bridge: make NF_TABLES_BRIDGE tristate | expand |
On Wed, Jul 10, 2019 at 10:08:20AM +0200, Arnd Bergmann wrote: > The new nft_meta_bridge code fails to link as built-in when NF_TABLES > is a loadable module. Applied, thanks Arnd.
On Wed, Jul 10, 2019 at 10:08:20AM +0200, Arnd Bergmann wrote: > The new nft_meta_bridge code fails to link as built-in when NF_TABLES > is a loadable module. > > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_eval': > nft_meta_bridge.c:(.text+0x1e8): undefined reference to `nft_meta_get_eval' > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_init': > nft_meta_bridge.c:(.text+0x468): undefined reference to `nft_meta_get_init' > nft_meta_bridge.c:(.text+0x49c): undefined reference to `nft_parse_register' > nft_meta_bridge.c:(.text+0x4cc): undefined reference to `nft_validate_register_store' > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_exit': > nft_meta_bridge.c:(.exit.text+0x14): undefined reference to `nft_unregister_expr' > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_init': > nft_meta_bridge.c:(.init.text+0x14): undefined reference to `nft_register_expr' > net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x60): undefined reference to `nft_meta_get_dump' > net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x88): undefined reference to `nft_meta_set_eval' > > This can happen because the NF_TABLES_BRIDGE dependency itself is just a > 'bool'. Make the symbol a 'tristate' instead so Kconfig can propagate the > dependencies correctly. Hm. Something breaks here. Investigating. Looks like bridge support is gone after this, nft fails to register the filter chain type: # nft add table bridge x # nft add chain bridge x y { type filter hook input priority 0\; } Error: Could not process rule: No such file or directory
On Thu, Jul 18, 2019 at 09:01:10PM +0200, Pablo Neira Ayuso wrote: > On Wed, Jul 10, 2019 at 10:08:20AM +0200, Arnd Bergmann wrote: > > The new nft_meta_bridge code fails to link as built-in when NF_TABLES > > is a loadable module. > > > > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_eval': > > nft_meta_bridge.c:(.text+0x1e8): undefined reference to `nft_meta_get_eval' > > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_init': > > nft_meta_bridge.c:(.text+0x468): undefined reference to `nft_meta_get_init' > > nft_meta_bridge.c:(.text+0x49c): undefined reference to `nft_parse_register' > > nft_meta_bridge.c:(.text+0x4cc): undefined reference to `nft_validate_register_store' > > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_exit': > > nft_meta_bridge.c:(.exit.text+0x14): undefined reference to `nft_unregister_expr' > > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_init': > > nft_meta_bridge.c:(.init.text+0x14): undefined reference to `nft_register_expr' > > net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x60): undefined reference to `nft_meta_get_dump' > > net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x88): undefined reference to `nft_meta_set_eval' > > > > This can happen because the NF_TABLES_BRIDGE dependency itself is just a > > 'bool'. Make the symbol a 'tristate' instead so Kconfig can propagate the > > dependencies correctly. > > Hm. Something breaks here. Investigating. Looks like bridge support is > gone after this, nft fails to register the filter chain type: > > # nft add table bridge x > # nft add chain bridge x y { type filter hook input priority 0\; } > Error: Could not process rule: No such file or directory Found it. It seems this patch is needed, on top of your patch. I can just squash this chunk into your original patch and push it out if you're OK witht this. Thanks.
On Fri, Jul 19, 2019 at 8:37 AM Pablo Neira Ayuso <pablo@netfilter.org> wrote: > > On Thu, Jul 18, 2019 at 09:01:10PM +0200, Pablo Neira Ayuso wrote: > > On Wed, Jul 10, 2019 at 10:08:20AM +0200, Arnd Bergmann wrote: > > > The new nft_meta_bridge code fails to link as built-in when NF_TABLES > > > is a loadable module. > > > > > > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_eval': > > > nft_meta_bridge.c:(.text+0x1e8): undefined reference to `nft_meta_get_eval' > > > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_init': > > > nft_meta_bridge.c:(.text+0x468): undefined reference to `nft_meta_get_init' > > > nft_meta_bridge.c:(.text+0x49c): undefined reference to `nft_parse_register' > > > nft_meta_bridge.c:(.text+0x4cc): undefined reference to `nft_validate_register_store' > > > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_exit': > > > nft_meta_bridge.c:(.exit.text+0x14): undefined reference to `nft_unregister_expr' > > > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_init': > > > nft_meta_bridge.c:(.init.text+0x14): undefined reference to `nft_register_expr' > > > net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x60): undefined reference to `nft_meta_get_dump' > > > net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x88): undefined reference to `nft_meta_set_eval' > > > > > > This can happen because the NF_TABLES_BRIDGE dependency itself is just a > > > 'bool'. Make the symbol a 'tristate' instead so Kconfig can propagate the > > > dependencies correctly. > > > > Hm. Something breaks here. Investigating. Looks like bridge support is > > gone after this, nft fails to register the filter chain type: > > > > # nft add table bridge x > > # nft add chain bridge x y { type filter hook input priority 0\; } > > Error: Could not process rule: No such file or directory > > Found it. It seems this patch is needed, on top of your patch. Right, makes sense. > I can just squash this chunk into your original patch and push it out > if you're OK witht this. Yes, please do. Arnd
diff --git a/net/bridge/netfilter/Kconfig b/net/bridge/netfilter/Kconfig index 154fa558bb90..d0c75d7ec074 100644 --- a/net/bridge/netfilter/Kconfig +++ b/net/bridge/netfilter/Kconfig @@ -6,7 +6,7 @@ menuconfig NF_TABLES_BRIDGE depends on BRIDGE && NETFILTER && NF_TABLES select NETFILTER_FAMILY_BRIDGE - bool "Ethernet Bridge nf_tables support" + tristate "Ethernet Bridge nf_tables support" if NF_TABLES_BRIDGE
The new nft_meta_bridge code fails to link as built-in when NF_TABLES is a loadable module. net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_eval': nft_meta_bridge.c:(.text+0x1e8): undefined reference to `nft_meta_get_eval' net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_init': nft_meta_bridge.c:(.text+0x468): undefined reference to `nft_meta_get_init' nft_meta_bridge.c:(.text+0x49c): undefined reference to `nft_parse_register' nft_meta_bridge.c:(.text+0x4cc): undefined reference to `nft_validate_register_store' net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_exit': nft_meta_bridge.c:(.exit.text+0x14): undefined reference to `nft_unregister_expr' net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_init': nft_meta_bridge.c:(.init.text+0x14): undefined reference to `nft_register_expr' net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x60): undefined reference to `nft_meta_get_dump' net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x88): undefined reference to `nft_meta_set_eval' This can happen because the NF_TABLES_BRIDGE dependency itself is just a 'bool'. Make the symbol a 'tristate' instead so Kconfig can propagate the dependencies correctly. Fixes: 30e103fe24de ("netfilter: nft_meta: move bridge meta keys into nft_meta_bridge") Signed-off-by: Arnd Bergmann <arnd@arndb.de> --- net/bridge/netfilter/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)