xtables-addons build failed with linux 4.5 header

xtables-addons build failed with linux 4.5 header

[Normand]

Hi there,
I do not know if problem is already reported, but build of xtables-addons is failing as reported by (1)

(1) https://build.opensuse.org/package/show/security:netfilter/xtables-addons
===
[   81s] gcc -Wp,-MMD,./.libxt_pknock.oo.d,-MT,libxt_pknock.oo -D_LARGEFILE_SOURCE=1 -D_LARGE_FILES -D_FILE_OFFSET_BITS=64 	-D_REENTRANT -I../../include -I/home/abuild/rpmbuild/BUILD/xtables-addons-default-2.10/extensions -Wall -Waggregate-return -Wmissing-declarations 	-Wmissing-prototypes -Wredundant-decls -Wshadow -Wstrict-prototypes 	-Winline -pipe -I/usr/include/iptables -DPIC -fPIC 
-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector -funwind-tables -fasynchronous-unwind-tables -g -o libxt_pknock.oo -c libxt_pknock.c;
[   81s] In file included from /usr/include/iptables/xtables.h:16:0,
[   81s]                  from libxt_pknock.c:15:
[   81s] /usr/include/linux/if.h:71:2: error: redeclaration of enumerator 'IFF_UP'
[   81s]   IFF_UP    = 1<<0,  /* sysfs */
[   81s]   ^
===

-- 
Michel Normand

Re: xtables-addons build failed with linux 4.5 header

[Jan Engelhardt]

On Wednesday 2016-04-20 12:49, Normand wrote:
> -fasynchronous-unwind-tables -g -o libxt_pknock.oo -c libxt_pknock.c;
> [   81s] In file included from /usr/include/iptables/xtables.h:16:0,
> [   81s]                  from libxt_pknock.c:15:
> [   81s] /usr/include/linux/if.h:71:2: error: redeclaration of enumerator
> 'IFF_UP'
> [   81s]   IFF_UP    = 1<<0,  /* sysfs */
> [   81s]   ^

git blame include/uapi/linux/netfilter_ipv4/ip_tables.h:
1ffad83d (Mikko Rapeli  2015-10-15 07:56:30 +0200  20) #include <linux/if.h>

Great. That commit broke userspace programs like

 #include <net/if.h>
 #include <linux/netfilter_ipv4/ip_tables.h>

The only reason it did not break the iptables source code _yet_ is 
because iptables.git keeps a cached copy (old by now). As soon as 
someone updates those too as part of the regular routine, all goes to 
the bin.

[PATCH] netfilter: resolve compilation error in userspace when using ip_tables.h

[Jan Engelhardt]

Compilation of iptables plugins which include these two lines

	#include <xtables.h>
	#include <linux/netfilter_ipv4/ip_tables.h>

fails since commit 1ffad83dffd675cd742286ae82dca7d746cb0da8, because
the userspace parts almost everywhere include <net/if.h>, which
collides with <linux/if.h>.

Use the __KERNEL__ trick that was last present in
d16cf20e2f2f13411eece7f7fb72c17d141c4a84^:include/linux/netfilter_ipv4/ip_queue.h
to resolve this.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
---
 include/uapi/linux/netfilter_ipv4/ip_tables.h | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/include/uapi/linux/netfilter_ipv4/ip_tables.h b/include/uapi/linux/netfilter_ipv4/ip_tables.h
index d0da53d..784a4b7 100644
--- a/include/uapi/linux/netfilter_ipv4/ip_tables.h
+++ b/include/uapi/linux/netfilter_ipv4/ip_tables.h
@@ -17,7 +17,11 @@
 
 #include <linux/types.h>
 #include <linux/compiler.h>
-#include <linux/if.h>
+#ifdef __KERNEL__
+#	include <linux/if.h>
+#else
+#	include <net/if.h>
+#endif
 #include <linux/netfilter_ipv4.h>
 
 #include <linux/netfilter/x_tables.h>
-- 
2.6.6

Re: [PATCH] netfilter: resolve compilation error in userspace when using ip_tables.h

[Mikko Rapeli]

On Fri, Apr 22, 2016 at 04:04:30PM +0200, Jan Engelhardt wrote:
> Compilation of iptables plugins which include these two lines
> 
> 	#include <xtables.h>
> 	#include <linux/netfilter_ipv4/ip_tables.h>
> 
> fails since commit 1ffad83dffd675cd742286ae82dca7d746cb0da8, because
> the userspace parts almost everywhere include <net/if.h>, which
> collides with <linux/if.h>.
> 
> Use the __KERNEL__ trick that was last present in
> d16cf20e2f2f13411eece7f7fb72c17d141c4a84^:include/linux/netfilter_ipv4/ip_queue.h
> to resolve this.
> 
> Signed-off-by: Jan Engelhardt <jengelh@inai.de>
> ---
>  include/uapi/linux/netfilter_ipv4/ip_tables.h | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/include/uapi/linux/netfilter_ipv4/ip_tables.h b/include/uapi/linux/netfilter_ipv4/ip_tables.h
> index d0da53d..784a4b7 100644
> --- a/include/uapi/linux/netfilter_ipv4/ip_tables.h
> +++ b/include/uapi/linux/netfilter_ipv4/ip_tables.h
> @@ -17,7 +17,11 @@
>  
>  #include <linux/types.h>
>  #include <linux/compiler.h>
> -#include <linux/if.h>
> +#ifdef __KERNEL__
> +#	include <linux/if.h>
> +#else
> +#	include <net/if.h>
> +#endif

When I tried to fix uapi header compile problems like this, they got rejected
in review since kernel uapi headers should not include on glibc headers.

I hope http://marc.info/?l=linux-kernel&m=146151279018490
fixes this. If not, then I guess the headers include kernel side headers
before glibc ones and need some #define magic into glibc.

-Mikko