diff mbox series

[net-next] netfilter: bridge: make NF_TABLES_BRIDGE tristate

Message ID 20190710080835.296696-1-arnd@arndb.de
State New
Headers show
Series [net-next] netfilter: bridge: make NF_TABLES_BRIDGE tristate | expand

Commit Message

Arnd Bergmann July 10, 2019, 8:08 a.m. UTC
The new nft_meta_bridge code fails to link as built-in when NF_TABLES
is a loadable module.

net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_eval':
nft_meta_bridge.c:(.text+0x1e8): undefined reference to `nft_meta_get_eval'
net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_init':
nft_meta_bridge.c:(.text+0x468): undefined reference to `nft_meta_get_init'
nft_meta_bridge.c:(.text+0x49c): undefined reference to `nft_parse_register'
nft_meta_bridge.c:(.text+0x4cc): undefined reference to `nft_validate_register_store'
net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_exit':
nft_meta_bridge.c:(.exit.text+0x14): undefined reference to `nft_unregister_expr'
net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_init':
nft_meta_bridge.c:(.init.text+0x14): undefined reference to `nft_register_expr'
net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x60): undefined reference to `nft_meta_get_dump'
net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x88): undefined reference to `nft_meta_set_eval'

This can happen because the NF_TABLES_BRIDGE dependency itself is just a
'bool'.  Make the symbol a 'tristate' instead so Kconfig can propagate the
dependencies correctly.

Fixes: 30e103fe24de ("netfilter: nft_meta: move bridge meta keys into nft_meta_bridge")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

---
 net/bridge/netfilter/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

-- 
2.20.0

Comments

Pablo Neira Ayuso July 18, 2019, 6:24 p.m. UTC | #1
On Wed, Jul 10, 2019 at 10:08:20AM +0200, Arnd Bergmann wrote:
> The new nft_meta_bridge code fails to link as built-in when NF_TABLES

> is a loadable module.


Applied, thanks Arnd.
Pablo Neira Ayuso July 19, 2019, 6:37 a.m. UTC | #2
On Thu, Jul 18, 2019 at 09:01:10PM +0200, Pablo Neira Ayuso wrote:
> On Wed, Jul 10, 2019 at 10:08:20AM +0200, Arnd Bergmann wrote:

> > The new nft_meta_bridge code fails to link as built-in when NF_TABLES

> > is a loadable module.

> > 

> > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_eval':

> > nft_meta_bridge.c:(.text+0x1e8): undefined reference to `nft_meta_get_eval'

> > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_init':

> > nft_meta_bridge.c:(.text+0x468): undefined reference to `nft_meta_get_init'

> > nft_meta_bridge.c:(.text+0x49c): undefined reference to `nft_parse_register'

> > nft_meta_bridge.c:(.text+0x4cc): undefined reference to `nft_validate_register_store'

> > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_exit':

> > nft_meta_bridge.c:(.exit.text+0x14): undefined reference to `nft_unregister_expr'

> > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_init':

> > nft_meta_bridge.c:(.init.text+0x14): undefined reference to `nft_register_expr'

> > net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x60): undefined reference to `nft_meta_get_dump'

> > net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x88): undefined reference to `nft_meta_set_eval'

> > 

> > This can happen because the NF_TABLES_BRIDGE dependency itself is just a

> > 'bool'.  Make the symbol a 'tristate' instead so Kconfig can propagate the

> > dependencies correctly.

> 

> Hm. Something breaks here. Investigating. Looks like bridge support is

> gone after this, nft fails to register the filter chain type:

> 

> # nft add table bridge x

> # nft add chain bridge x y { type filter hook input priority 0\; }

> Error: Could not process rule: No such file or directory


Found it. It seems this patch is needed, on top of your patch.

I can just squash this chunk into your original patch and push it out
if you're OK witht this.

Thanks.
diff --git a/net/netfilter/nft_chain_filter.c b/net/netfilter/nft_chain_filter.c
index 3fd540b2c6ba..b5d5d071d765 100644
--- a/net/netfilter/nft_chain_filter.c
+++ b/net/netfilter/nft_chain_filter.c
@@ -193,7 +193,7 @@ static inline void nft_chain_filter_inet_init(void) {}
 static inline void nft_chain_filter_inet_fini(void) {}
 #endif /* CONFIG_NF_TABLES_IPV6 */
 
-#ifdef CONFIG_NF_TABLES_BRIDGE
+#if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE)
 static unsigned int
 nft_do_chain_bridge(void *priv,
 		    struct sk_buff *skb,
Arnd Bergmann July 19, 2019, 6:49 a.m. UTC | #3
On Fri, Jul 19, 2019 at 8:37 AM Pablo Neira Ayuso <pablo@netfilter.org> wrote:
>

> On Thu, Jul 18, 2019 at 09:01:10PM +0200, Pablo Neira Ayuso wrote:

> > On Wed, Jul 10, 2019 at 10:08:20AM +0200, Arnd Bergmann wrote:

> > > The new nft_meta_bridge code fails to link as built-in when NF_TABLES

> > > is a loadable module.

> > >

> > > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_eval':

> > > nft_meta_bridge.c:(.text+0x1e8): undefined reference to `nft_meta_get_eval'

> > > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_init':

> > > nft_meta_bridge.c:(.text+0x468): undefined reference to `nft_meta_get_init'

> > > nft_meta_bridge.c:(.text+0x49c): undefined reference to `nft_parse_register'

> > > nft_meta_bridge.c:(.text+0x4cc): undefined reference to `nft_validate_register_store'

> > > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_exit':

> > > nft_meta_bridge.c:(.exit.text+0x14): undefined reference to `nft_unregister_expr'

> > > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_init':

> > > nft_meta_bridge.c:(.init.text+0x14): undefined reference to `nft_register_expr'

> > > net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x60): undefined reference to `nft_meta_get_dump'

> > > net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x88): undefined reference to `nft_meta_set_eval'

> > >

> > > This can happen because the NF_TABLES_BRIDGE dependency itself is just a

> > > 'bool'.  Make the symbol a 'tristate' instead so Kconfig can propagate the

> > > dependencies correctly.

> >

> > Hm. Something breaks here. Investigating. Looks like bridge support is

> > gone after this, nft fails to register the filter chain type:

> >

> > # nft add table bridge x

> > # nft add chain bridge x y { type filter hook input priority 0\; }

> > Error: Could not process rule: No such file or directory

>

> Found it. It seems this patch is needed, on top of your patch.


Right, makes sense.

> I can just squash this chunk into your original patch and push it out

> if you're OK witht this.


Yes, please do.

      Arnd
diff mbox series

Patch

diff --git a/net/bridge/netfilter/Kconfig b/net/bridge/netfilter/Kconfig
index 154fa558bb90..d0c75d7ec074 100644
--- a/net/bridge/netfilter/Kconfig
+++ b/net/bridge/netfilter/Kconfig
@@ -6,7 +6,7 @@ 
 menuconfig NF_TABLES_BRIDGE
 	depends on BRIDGE && NETFILTER && NF_TABLES
 	select NETFILTER_FAMILY_BRIDGE
-	bool "Ethernet Bridge nf_tables support"
+	tristate "Ethernet Bridge nf_tables support"
 
 if NF_TABLES_BRIDGE