linux-next: build failure after merge of the netfilter-next tree

linux-next: build failure after merge of the netfilter-next tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 1259 bytes --]

Hi all,

After merging the netfilter tree, today's linux-next build (powerpc
ppc44x_defconfig) failed like this:

In file included from /home/sfr/next/next/net/bridge/br_input.c:19:
/home/sfr/next/next/include/net/netfilter/nf_queue.h:16:23: error: field 'state'
 has incomplete type
  struct nf_hook_state state;
                       ^~~~~

Caused by commit

  971502d77faa ("bridge: netfilter: unroll NF_HOOK helper in bridge input path")

This build has CONFIG_NETFILTER not set.

I have applied this patch for today:

From: Stephen Rothwell <sfr@canb.auug.org.au>
Date: Fri, 12 Apr 2019 16:32:47 +1000
Subject: [PATCH] bridge: only include nf_queue.h if needed

---
 net/bridge/br_input.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index e0aacfedcfe1..86dc46f6a68f 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -16,7 +16,9 @@
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/netfilter_bridge.h>
+#ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
 #include <net/netfilter/nf_queue.h>
+#endif
 #include <linux/neighbour.h>
 #include <net/arp.h>
 #include <linux/export.h>
-- 
2.20.1

-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: linux-next: build failure after merge of the netfilter-next tree

[Florian Westphal]

Stephen Rothwell <sfr@canb.auug.org.au> wrote:
> After merging the netfilter tree, today's linux-next build (powerpc
> ppc44x_defconfig) failed like this:
> 
> In file included from /home/sfr/next/next/net/bridge/br_input.c:19:
> /home/sfr/next/next/include/net/netfilter/nf_queue.h:16:23: error: field 'state'
>  has incomplete type
>   struct nf_hook_state state;
>                        ^~~~~
> Caused by commit
> 
>   971502d77faa ("bridge: netfilter: unroll NF_HOOK helper in bridge input path")
> 
> This build has CONFIG_NETFILTER not set.
> 
> I have applied this patch for today:

Can you submit this fix formally to netfilter-devel@vger.kernel.org?

Re: linux-next: build failure after merge of the netfilter-next tree

[Pablo Neira Ayuso]

On Fri, Apr 12, 2019 at 04:37:20PM +1000, Stephen Rothwell wrote:
> Hi all,
> 
> After merging the netfilter tree, today's linux-next build (powerpc
> ppc44x_defconfig) failed like this:
> 
> In file included from /home/sfr/next/next/net/bridge/br_input.c:19:
> /home/sfr/next/next/include/net/netfilter/nf_queue.h:16:23: error: field 'state'
>  has incomplete type
>   struct nf_hook_state state;
>                        ^~~~~
> 
> Caused by commit
> 
>   971502d77faa ("bridge: netfilter: unroll NF_HOOK helper in bridge input path")
> 
> This build has CONFIG_NETFILTER not set.

I have applied this to nf-next, thanks.

Re: linux-next: build failure after merge of the netfilter-next tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 971 bytes --]

Hi Florian,

On Fri, 12 Apr 2019 10:15:27 +0200 Florian Westphal <fw@strlen.de> wrote:
>
> Stephen Rothwell <sfr@canb.auug.org.au> wrote:
> > After merging the netfilter tree, today's linux-next build (powerpc
> > ppc44x_defconfig) failed like this:
> > 
> > In file included from /home/sfr/next/next/net/bridge/br_input.c:19:
> > /home/sfr/next/next/include/net/netfilter/nf_queue.h:16:23: error: field 'state'
> >  has incomplete type
> >   struct nf_hook_state state;
> >                        ^~~~~
> > Caused by commit
> > 
> >   971502d77faa ("bridge: netfilter: unroll NF_HOOK helper in bridge input path")
> > 
> > This build has CONFIG_NETFILTER not set.
> > 
> > I have applied this patch for today:  
> 
> Can you submit this fix formally to netfilter-devel@vger.kernel.org?

Done.  Though I was hoping someone might come up with a better solution
(I don't particularly like conditional inclusions).

-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: linux-next: build failure after merge of the netfilter-next tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 7676 bytes --]

Hi all,

On Mon, 8 Jul 2019 13:39:58 +1000 Stephen Rothwell <sfr@canb.auug.org.au> wrote:
>
> After merging the netfilter-next tree, today's linux-next build (x86_64
> allmodconfig) failed like this:
> 
> In file included from <command-line>:
> include/net/netfilter/nft_meta.h:6:21: warning: 'key' is narrower than values of its type
>   enum nft_meta_keys key:8;
>                      ^~~
> include/net/netfilter/nft_meta.h:6:21: error: field 'key' has incomplete type
> include/net/netfilter/nft_meta.h:8:22: warning: 'dreg' is narrower than values of its type
>    enum nft_registers dreg:8;
>                       ^~~~
> include/net/netfilter/nft_meta.h:8:22: error: field 'dreg' has incomplete type
> include/net/netfilter/nft_meta.h:9:22: warning: 'sreg' is narrower than values of its type
>    enum nft_registers sreg:8;
>                       ^~~~
> include/net/netfilter/nft_meta.h:9:22: error: field 'sreg' has incomplete type
> include/net/netfilter/nft_meta.h:13:32: error: array type has incomplete element type 'struct nla_policy'
>  extern const struct nla_policy nft_meta_policy[];
>                                 ^~~~~~~~~~~~~~~
> include/net/netfilter/nft_meta.h:17:22: warning: 'struct nlattr' declared inside parameter list will not be visible outside of this definition or declaration
>          const struct nlattr * const tb[]);
>                       ^~~~~~
> include/net/netfilter/nft_meta.h:16:22: warning: 'struct nft_expr' declared inside parameter list will not be visible outside of this definition or declaration
>          const struct nft_expr *expr,
>                       ^~~~~~~~
> include/net/netfilter/nft_meta.h:15:36: warning: 'struct nft_ctx' declared inside parameter list will not be visible outside of this definition or declaration
>  int nft_meta_get_init(const struct nft_ctx *ctx,
>                                     ^~~~~~~
> include/net/netfilter/nft_meta.h:21:22: warning: 'struct nlattr' declared inside parameter list will not be visible outside of this definition or declaration
>          const struct nlattr * const tb[]);
>                       ^~~~~~
> include/net/netfilter/nft_meta.h:20:22: warning: 'struct nft_expr' declared inside parameter list will not be visible outside of this definition or declaration
>          const struct nft_expr *expr,
>                       ^~~~~~~~
> include/net/netfilter/nft_meta.h:19:36: warning: 'struct nft_ctx' declared inside parameter list will not be visible outside of this definition or declaration
>  int nft_meta_set_init(const struct nft_ctx *ctx,
>                                     ^~~~~~~
> include/net/netfilter/nft_meta.h:24:22: warning: 'struct nft_expr' declared inside parameter list will not be visible outside of this definition or declaration
>          const struct nft_expr *expr);
>                       ^~~~~~~~
> include/net/netfilter/nft_meta.h:23:30: warning: 'struct sk_buff' declared inside parameter list will not be visible outside of this definition or declaration
>  int nft_meta_get_dump(struct sk_buff *skb,
>                               ^~~~~~~
> include/net/netfilter/nft_meta.h:27:22: warning: 'struct nft_expr' declared inside parameter list will not be visible outside of this definition or declaration
>          const struct nft_expr *expr);
>                       ^~~~~~~~
> include/net/netfilter/nft_meta.h:26:30: warning: 'struct sk_buff' declared inside parameter list will not be visible outside of this definition or declaration
>  int nft_meta_set_dump(struct sk_buff *skb,
>                               ^~~~~~~
> include/net/netfilter/nft_meta.h:31:23: warning: 'struct nft_pktinfo' declared inside parameter list will not be visible outside of this definition or declaration
>           const struct nft_pktinfo *pkt);
>                        ^~~~~~~~~~~
> include/net/netfilter/nft_meta.h:30:17: warning: 'struct nft_regs' declared inside parameter list will not be visible outside of this definition or declaration
>           struct nft_regs *regs,
>                  ^~~~~~~~
> include/net/netfilter/nft_meta.h:29:37: warning: 'struct nft_expr' declared inside parameter list will not be visible outside of this definition or declaration
>  void nft_meta_get_eval(const struct nft_expr *expr,
>                                      ^~~~~~~~
> include/net/netfilter/nft_meta.h:35:23: warning: 'struct nft_pktinfo' declared inside parameter list will not be visible outside of this definition or declaration
>           const struct nft_pktinfo *pkt);
>                        ^~~~~~~~~~~
> include/net/netfilter/nft_meta.h:34:17: warning: 'struct nft_regs' declared inside parameter list will not be visible outside of this definition or declaration
>           struct nft_regs *regs,
>                  ^~~~~~~~
> include/net/netfilter/nft_meta.h:33:37: warning: 'struct nft_expr' declared inside parameter list will not be visible outside of this definition or declaration
>  void nft_meta_set_eval(const struct nft_expr *expr,
>                                      ^~~~~~~~
> include/net/netfilter/nft_meta.h:38:19: warning: 'struct nft_expr' declared inside parameter list will not be visible outside of this definition or declaration
>       const struct nft_expr *expr);
>                    ^~~~~~~~
> include/net/netfilter/nft_meta.h:37:40: warning: 'struct nft_ctx' declared inside parameter list will not be visible outside of this definition or declaration
>  void nft_meta_set_destroy(const struct nft_ctx *ctx,
>                                         ^~~~~~~
> include/net/netfilter/nft_meta.h:42:19: warning: 'struct nft_data' declared inside parameter list will not be visible outside of this definition or declaration
>       const struct nft_data **data);
>                    ^~~~~~~~
> include/net/netfilter/nft_meta.h:41:19: warning: 'struct nft_expr' declared inside parameter list will not be visible outside of this definition or declaration
>       const struct nft_expr *expr,
>                    ^~~~~~~~
> include/net/netfilter/nft_meta.h:40:40: warning: 'struct nft_ctx' declared inside parameter list will not be visible outside of this definition or declaration
>  int nft_meta_set_validate(const struct nft_ctx *ctx,
>                                         ^~~~~~~
> 
> Caused by commit
> 
>   30e103fe24de ("netfilter: nft_meta: move bridge meta keys into nft_meta_bridge")
> 
> interacting with commit
> 
>   3a768d9f7ae5 ("kbuild: compile-test kernel headers to ensure they are self-contained")
> 
> from the kbuild tree.
> 
> I have applied the following patch for today.
> 
> From: Stephen Rothwell <sfr@canb.auug.org.au>
> Date: Mon, 8 Jul 2019 13:34:42 +1000
> Subject: [PATCH] don't test build another netfilter header
> 
> Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
> ---
>  include/Kbuild | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/include/Kbuild b/include/Kbuild
> index 78434c59701f..cfd73c94d015 100644
> --- a/include/Kbuild
> +++ b/include/Kbuild
> @@ -900,6 +900,7 @@ header-test-			+= net/netfilter/nf_tables_core.h
>  header-test-			+= net/netfilter/nf_tables_ipv4.h
>  header-test-			+= net/netfilter/nf_tables_ipv6.h
>  header-test-			+= net/netfilter/nft_fib.h
> +header-test-			+= net/netfilter/nft_meta.h
>  header-test-			+= net/netfilter/nft_reject.h
>  header-test-			+= net/netns/can.h
>  header-test-			+= net/netns/generic.h

I reported this yesterday against the netflter-next tree, but now the
fix patch is needed in the merge of the net-next tree.

-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

linux-next: build failure after merge of the netfilter-next tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 7243 bytes --]

Hi all,

After merging the netfilter-next tree, today's linux-next build (x86_64
allmodconfig) failed like this:

In file included from <command-line>:
include/net/netfilter/nft_meta.h:6:21: warning: 'key' is narrower than values of its type
  enum nft_meta_keys key:8;
                     ^~~
include/net/netfilter/nft_meta.h:6:21: error: field 'key' has incomplete type
include/net/netfilter/nft_meta.h:8:22: warning: 'dreg' is narrower than values of its type
   enum nft_registers dreg:8;
                      ^~~~
include/net/netfilter/nft_meta.h:8:22: error: field 'dreg' has incomplete type
include/net/netfilter/nft_meta.h:9:22: warning: 'sreg' is narrower than values of its type
   enum nft_registers sreg:8;
                      ^~~~
include/net/netfilter/nft_meta.h:9:22: error: field 'sreg' has incomplete type
include/net/netfilter/nft_meta.h:13:32: error: array type has incomplete element type 'struct nla_policy'
 extern const struct nla_policy nft_meta_policy[];
                                ^~~~~~~~~~~~~~~
include/net/netfilter/nft_meta.h:17:22: warning: 'struct nlattr' declared inside parameter list will not be visible outside of this definition or declaration
         const struct nlattr * const tb[]);
                      ^~~~~~
include/net/netfilter/nft_meta.h:16:22: warning: 'struct nft_expr' declared inside parameter list will not be visible outside of this definition or declaration
         const struct nft_expr *expr,
                      ^~~~~~~~
include/net/netfilter/nft_meta.h:15:36: warning: 'struct nft_ctx' declared inside parameter list will not be visible outside of this definition or declaration
 int nft_meta_get_init(const struct nft_ctx *ctx,
                                    ^~~~~~~
include/net/netfilter/nft_meta.h:21:22: warning: 'struct nlattr' declared inside parameter list will not be visible outside of this definition or declaration
         const struct nlattr * const tb[]);
                      ^~~~~~
include/net/netfilter/nft_meta.h:20:22: warning: 'struct nft_expr' declared inside parameter list will not be visible outside of this definition or declaration
         const struct nft_expr *expr,
                      ^~~~~~~~
include/net/netfilter/nft_meta.h:19:36: warning: 'struct nft_ctx' declared inside parameter list will not be visible outside of this definition or declaration
 int nft_meta_set_init(const struct nft_ctx *ctx,
                                    ^~~~~~~
include/net/netfilter/nft_meta.h:24:22: warning: 'struct nft_expr' declared inside parameter list will not be visible outside of this definition or declaration
         const struct nft_expr *expr);
                      ^~~~~~~~
include/net/netfilter/nft_meta.h:23:30: warning: 'struct sk_buff' declared inside parameter list will not be visible outside of this definition or declaration
 int nft_meta_get_dump(struct sk_buff *skb,
                              ^~~~~~~
include/net/netfilter/nft_meta.h:27:22: warning: 'struct nft_expr' declared inside parameter list will not be visible outside of this definition or declaration
         const struct nft_expr *expr);
                      ^~~~~~~~
include/net/netfilter/nft_meta.h:26:30: warning: 'struct sk_buff' declared inside parameter list will not be visible outside of this definition or declaration
 int nft_meta_set_dump(struct sk_buff *skb,
                              ^~~~~~~
include/net/netfilter/nft_meta.h:31:23: warning: 'struct nft_pktinfo' declared inside parameter list will not be visible outside of this definition or declaration
          const struct nft_pktinfo *pkt);
                       ^~~~~~~~~~~
include/net/netfilter/nft_meta.h:30:17: warning: 'struct nft_regs' declared inside parameter list will not be visible outside of this definition or declaration
          struct nft_regs *regs,
                 ^~~~~~~~
include/net/netfilter/nft_meta.h:29:37: warning: 'struct nft_expr' declared inside parameter list will not be visible outside of this definition or declaration
 void nft_meta_get_eval(const struct nft_expr *expr,
                                     ^~~~~~~~
include/net/netfilter/nft_meta.h:35:23: warning: 'struct nft_pktinfo' declared inside parameter list will not be visible outside of this definition or declaration
          const struct nft_pktinfo *pkt);
                       ^~~~~~~~~~~
include/net/netfilter/nft_meta.h:34:17: warning: 'struct nft_regs' declared inside parameter list will not be visible outside of this definition or declaration
          struct nft_regs *regs,
                 ^~~~~~~~
include/net/netfilter/nft_meta.h:33:37: warning: 'struct nft_expr' declared inside parameter list will not be visible outside of this definition or declaration
 void nft_meta_set_eval(const struct nft_expr *expr,
                                     ^~~~~~~~
include/net/netfilter/nft_meta.h:38:19: warning: 'struct nft_expr' declared inside parameter list will not be visible outside of this definition or declaration
      const struct nft_expr *expr);
                   ^~~~~~~~
include/net/netfilter/nft_meta.h:37:40: warning: 'struct nft_ctx' declared inside parameter list will not be visible outside of this definition or declaration
 void nft_meta_set_destroy(const struct nft_ctx *ctx,
                                        ^~~~~~~
include/net/netfilter/nft_meta.h:42:19: warning: 'struct nft_data' declared inside parameter list will not be visible outside of this definition or declaration
      const struct nft_data **data);
                   ^~~~~~~~
include/net/netfilter/nft_meta.h:41:19: warning: 'struct nft_expr' declared inside parameter list will not be visible outside of this definition or declaration
      const struct nft_expr *expr,
                   ^~~~~~~~
include/net/netfilter/nft_meta.h:40:40: warning: 'struct nft_ctx' declared inside parameter list will not be visible outside of this definition or declaration
 int nft_meta_set_validate(const struct nft_ctx *ctx,
                                        ^~~~~~~

Caused by commit

  30e103fe24de ("netfilter: nft_meta: move bridge meta keys into nft_meta_bridge")

interacting with commit

  3a768d9f7ae5 ("kbuild: compile-test kernel headers to ensure they are self-contained")

from the kbuild tree.

I have applied the following patch for today.

From: Stephen Rothwell <sfr@canb.auug.org.au>
Date: Mon, 8 Jul 2019 13:34:42 +1000
Subject: [PATCH] don't test build another netfilter header

Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
---
 include/Kbuild | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/Kbuild b/include/Kbuild
index 78434c59701f..cfd73c94d015 100644
--- a/include/Kbuild
+++ b/include/Kbuild
@@ -900,6 +900,7 @@ header-test-			+= net/netfilter/nf_tables_core.h
 header-test-			+= net/netfilter/nf_tables_ipv4.h
 header-test-			+= net/netfilter/nf_tables_ipv6.h
 header-test-			+= net/netfilter/nft_fib.h
+header-test-			+= net/netfilter/nft_meta.h
 header-test-			+= net/netfilter/nft_reject.h
 header-test-			+= net/netns/can.h
 header-test-			+= net/netns/generic.h
-- 
2.20.1

-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: linux-next: build failure after merge of the netfilter-next tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 284 bytes --]

Hi Pablo,

On Thu, 20 Jun 2019 15:57:03 +0200 Pablo Neira Ayuso <pablo@netfilter.org> wrote:
>
> https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git/commit/?id=8527fa6cc68a489f735823e61b31ec6cb266274a

Good timing :-)

Thanks.

-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: linux-next: build failure after merge of the netfilter-next tree

[Pablo Neira Ayuso]

On Thu, Jun 20, 2019 at 11:47:43PM +1000, Stephen Rothwell wrote:
> Hi all,
> 
> After merging the netfilter-next tree, today's linux-next build
> (arm imx_v4_v5_defconfig and several others) failed like this:
> 
> In file included from net/netfilter/core.c:19:0:
> include/linux/netfilter_ipv6.h: In function 'nf_ipv6_cookie_init_sequence':
> include/linux/netfilter_ipv6.h:174:2: error: implicit declaration of function '__cookie_v6_init_sequence' [-Werror=implicit-function-declaration]
> include/linux/netfilter_ipv6.h: In function 'nf_cookie_v6_check':
> include/linux/netfilter_ipv6.h:189:2: error: implicit declaration of function '__cookie_v6_check' [-Werror=implicit-function-declaration]
> 
> Caused by commit
> 
>   3006a5224f15 ("netfilter: synproxy: remove module dependency on IPv6 SYNPROXY")
> 
> This has been happening for a few days, sorry.
> 
> # CONFIG_IPV6 is not set

https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git/commit/?id=8527fa6cc68a489f735823e61b31ec6cb266274a

linux-next: build failure after merge of the netfilter-next tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 839 bytes --]

Hi all,

After merging the netfilter-next tree, today's linux-next build
(arm imx_v4_v5_defconfig and several others) failed like this:

In file included from net/netfilter/core.c:19:0:
include/linux/netfilter_ipv6.h: In function 'nf_ipv6_cookie_init_sequence':
include/linux/netfilter_ipv6.h:174:2: error: implicit declaration of function '__cookie_v6_init_sequence' [-Werror=implicit-function-declaration]
include/linux/netfilter_ipv6.h: In function 'nf_cookie_v6_check':
include/linux/netfilter_ipv6.h:189:2: error: implicit declaration of function '__cookie_v6_check' [-Werror=implicit-function-declaration]

Caused by commit

  3006a5224f15 ("netfilter: synproxy: remove module dependency on IPv6 SYNPROXY")

This has been happening for a few days, sorry.

# CONFIG_IPV6 is not set

-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

linux-next: build failure after merge of the netfilter-next tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 3240 bytes --]

Hi all,

After merging the netfilter-next tree, today's linux-next build (powerpc
allyesconfig) failed like this:

ld: net/ipv4/netfilter/nf_reject_ipv4.o:(.opd+0x78): multiple definition of `nf_reject_verify_csum'; net/netfilter/nft_reject_inet.o:(.opd+0x78): first defined here
ld: net/ipv4/netfilter/nf_reject_ipv4.o: in function `.nf_reject_verify_csum':
(.text.nf_reject_verify_csum+0x0): multiple definition of `.nf_reject_verify_csum'; net/netfilter/nft_reject_inet.o:(.text.nf_reject_verify_csum+0x0): first defined here
ld: net/ipv4/netfilter/nft_reject_ipv4.o:(.opd+0x48): multiple definition of `nf_reject_verify_csum'; net/netfilter/nft_reject_inet.o:(.opd+0x78): first defined here
ld: net/ipv4/netfilter/nft_reject_ipv4.o: in function `.nf_reject_verify_csum':
(.text.nf_reject_verify_csum+0x0): multiple definition of `.nf_reject_verify_csum'; net/netfilter/nft_reject_inet.o:(.text.nf_reject_verify_csum+0x0): first defined here
ld: net/ipv4/netfilter/ipt_REJECT.o:(.opd+0x60): multiple definition of `nf_reject_verify_csum'; net/netfilter/nft_reject_inet.o:(.opd+0x78): first defined here
ld: net/ipv4/netfilter/ipt_REJECT.o: in function `.nf_reject_verify_csum':
(.text.nf_reject_verify_csum+0x0): multiple definition of `.nf_reject_verify_csum'; net/netfilter/nft_reject_inet.o:(.text.nf_reject_verify_csum+0x0): first defined here
ld: net/ipv6/netfilter/nf_reject_ipv6.o:(.opd+0x78): multiple definition of `nf_reject_verify_csum'; net/netfilter/nft_reject_inet.o:(.opd+0x78): first defined here
ld: net/ipv6/netfilter/nf_reject_ipv6.o: in function `.nf_reject_verify_csum':
(.text.nf_reject_verify_csum+0x0): multiple definition of `.nf_reject_verify_csum'; net/netfilter/nft_reject_inet.o:(.text.nf_reject_verify_csum+0x0): first defined here
ld: net/ipv6/netfilter/nft_reject_ipv6.o:(.opd+0x48): multiple definition of `nf_reject_verify_csum'; net/netfilter/nft_reject_inet.o:(.opd+0x78): first defined here
ld: net/ipv6/netfilter/nft_reject_ipv6.o: in function `.nf_reject_verify_csum':
(.text.nf_reject_verify_csum+0x0): multiple definition of `.nf_reject_verify_csum'; net/netfilter/nft_reject_inet.o:(.text.nf_reject_verify_csum+0x0): first defined here
ld: net/ipv6/netfilter/ip6t_REJECT.o:(.opd+0x60): multiple definition of `nf_reject_verify_csum'; net/netfilter/nft_reject_inet.o:(.opd+0x78): first defined here
ld: net/ipv6/netfilter/ip6t_REJECT.o: in function `.nf_reject_verify_csum':
(.text.nf_reject_verify_csum+0x0): multiple definition of `.nf_reject_verify_csum'; net/netfilter/nft_reject_inet.o:(.text.nf_reject_verify_csum+0x0): first defined here
ld: net/bridge/netfilter/nft_reject_bridge.o:(.opd+0x108): multiple definition of `nf_reject_verify_csum'; net/netfilter/nft_reject_inet.o:(.opd+0x78): first defined here
ld: net/bridge/netfilter/nft_reject_bridge.o: in function `.nf_reject_verify_csum':
(.text.nf_reject_verify_csum+0x0): multiple definition of `.nf_reject_verify_csum'; net/netfilter/nft_reject_inet.o:(.text.nf_reject_verify_csum+0x0): first defined here

Caused by commit

  bfcf40da7559 ("netfilter: reject: skip csum verification for protocols that don't support it")

I have reverted that commit for today.



-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

linux-next: build failure after merge of the netfilter-next tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 1067 bytes --]

Hi all,

After merging the netfilter-next tree, today's linux-next build
(powerpc ppc64_defconfig) failed like this:

ERROR: ".nf_conntrack_invert_icmpv6_tuple" [net/netfilter/nf_conntrack.ko] undefined!
ERROR: ".nf_conntrack_icmpv6_packet" [net/netfilter/nf_conntrack.ko] undefined!
ERROR: ".nf_conntrack_icmpv6_init_net" [net/netfilter/nf_conntrack.ko] undefined!
ERROR: ".icmpv6_pkt_to_tuple" [net/netfilter/nf_conntrack.ko] undefined!
ERROR: ".nf_ct_gre_keymap_destroy" [net/netfilter/nf_conntrack.ko] undefined!

Caused by commit

  a47c54048162 ("netfilter: conntrack: handle builtin l4proto packet functions via direct calls")
  e2e48b471634 ("netfilter: conntrack: handle icmp pkt_to_tuple helper via direct calls")
  197c4300aec0 ("netfilter: conntrack: remove invert_tuple callback")
  2a389de86e4a ("netfilter: conntrack: remove l4proto init and get_net callbacks")
  e56894356f60 ("netfilter: conntrack: remove l4proto destroy hook")

I have used the netfilter-next tree from next-20190118 for today.

-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: linux-next: build failure after merge of the netfilter-next tree

[Pablo Neira Ayuso]

On Tue, Oct 16, 2018 at 10:41:25AM +1100, Stephen Rothwell wrote:
> Hi all,
> 
> After merging the netfilter-next tree, today's linux-next build (x86_64
> allmodconfig) failed like this:

Thanks for reporting, I'll keep back this patch by now.

linux-next: build failure after merge of the netfilter-next tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 3050 bytes --]

Hi all,

After merging the netfilter-next tree, today's linux-next build (x86_64
allmodconfig) failed like this:

net/ipv4/netfilter/ipt_ECN.c: In function 'set_ect_tcp':
net/ipv4/netfilter/ipt_ECN.c:58:28: error: 'IPT_ECN_OP_SET_ECE' undeclared (first use in this function); did you mean 'IPT_ECN_OP_MATCH_ECE'?
  if ((!(einfo->operation & IPT_ECN_OP_SET_ECE) ||
                            ^~~~~~~~~~~~~~~~~~
                            IPT_ECN_OP_MATCH_ECE
net/ipv4/netfilter/ipt_ECN.c:58:28: note: each undeclared identifier is reported only once for each function it appears in
net/ipv4/netfilter/ipt_ECN.c:60:28: error: 'IPT_ECN_OP_SET_CWR' undeclared (first use in this function); did you mean 'IPT_ECN_OP_MATCH_CWR'?
      (!(einfo->operation & IPT_ECN_OP_SET_CWR) ||
                            ^~~~~~~~~~~~~~~~~~
                            IPT_ECN_OP_MATCH_CWR
net/ipv4/netfilter/ipt_ECN.c: In function 'ecn_tg':
net/ipv4/netfilter/ipt_ECN.c:84:25: error: 'IPT_ECN_OP_SET_IP' undeclared (first use in this function); did you mean 'IPT_ECN_OP_MATCH_IP'?
  if (einfo->operation & IPT_ECN_OP_SET_IP)
                         ^~~~~~~~~~~~~~~~~
                         IPT_ECN_OP_MATCH_IP
net/ipv4/netfilter/ipt_ECN.c:88:26: error: 'IPT_ECN_OP_SET_ECE' undeclared (first use in this function); did you mean 'IPT_ECN_OP_MATCH_ECE'?
  if (einfo->operation & (IPT_ECN_OP_SET_ECE | IPT_ECN_OP_SET_CWR) &&
                          ^~~~~~~~~~~~~~~~~~
                          IPT_ECN_OP_MATCH_ECE
net/ipv4/netfilter/ipt_ECN.c:88:47: error: 'IPT_ECN_OP_SET_CWR' undeclared (first use in this function); did you mean 'IPT_ECN_OP_MATCH_CWR'?
  if (einfo->operation & (IPT_ECN_OP_SET_ECE | IPT_ECN_OP_SET_CWR) &&
                                               ^~~~~~~~~~~~~~~~~~
                                               IPT_ECN_OP_MATCH_CWR
net/ipv4/netfilter/ipt_ECN.c: In function 'ecn_tg_check':
net/ipv4/netfilter/ipt_ECN.c:101:25: error: 'IPT_ECN_OP_MASK' undeclared (first use in this function); did you mean 'IPT_ECN_IP_MASK'?
  if (einfo->operation & IPT_ECN_OP_MASK)
                         ^~~~~~~~~~~~~~~
                         IPT_ECN_IP_MASK
net/ipv4/netfilter/ipt_ECN.c:107:27: error: 'IPT_ECN_OP_SET_ECE' undeclared (first use in this function); did you mean 'IPT_ECN_OP_MATCH_ECE'?
  if ((einfo->operation & (IPT_ECN_OP_SET_ECE|IPT_ECN_OP_SET_CWR)) &&
                           ^~~~~~~~~~~~~~~~~~
                           IPT_ECN_OP_MATCH_ECE
net/ipv4/netfilter/ipt_ECN.c:107:46: error: 'IPT_ECN_OP_SET_CWR' undeclared (first use in this function); did you mean 'IPT_ECN_OP_MATCH_CWR'?
  if ((einfo->operation & (IPT_ECN_OP_SET_ECE|IPT_ECN_OP_SET_CWR)) &&
                                              ^~~~~~~~~~~~~~~~~~
                                              IPT_ECN_OP_MATCH_CWR

Caused by commit

  25038aaf0cbf ("UAPI: netfilter: Fix symbol collision issues [ver #2]")

I used the netfilter-next tree from next-20181015 for today.

-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

linux-next: build failure after merge of the netfilter-next tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 12543 bytes --]

Hi all,

After merging the netfilter-next tree, today's linux-next build (x86_64
allmodconfig) failed like this:

net/netfilter/nft_tproxy.c: In function 'nft_tproxy_eval_v4':
net/netfilter/nft_tproxy.c:48:48: warning: passing argument 3 of 'nf_tproxy_get_sock_v4' makes integer from pointer without a cast [-Wint-conversion]
  sk = nf_tproxy_get_sock_v4(nft_net(pkt), skb, hp, iph->protocol,
                                                ^~
In file included from net/netfilter/nft_tproxy.c:6:0:
include/net/netfilter/nf_tproxy.h:75:1: note: expected 'u8 {aka const unsigned char}' but argument is of type 'struct udphdr *'
 nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb,
 ^~~~~~~~~~~~~~~~~~~~~
net/netfilter/nft_tproxy.c:50:20: warning: passing argument 8 of 'nf_tproxy_get_sock_v4' makes pointer from integer without a cast [-Wint-conversion]
        hp->source, hp->dest,
                    ^~
In file included from net/netfilter/nft_tproxy.c:6:0:
include/net/netfilter/nf_tproxy.h:75:1: note: expected 'const struct net_device *' but argument is of type '__be16 {aka short unsigned int}'
 nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb,
 ^~~~~~~~~~~~~~~~~~~~~
net/netfilter/nft_tproxy.c:51:8: error: incompatible type for argument 9 of 'nf_tproxy_get_sock_v4'
        skb->dev, NF_TPROXY_LOOKUP_ESTABLISHED);
        ^~~
In file included from net/netfilter/nft_tproxy.c:6:0:
include/net/netfilter/nf_tproxy.h:75:1: note: expected 'const enum nf_tproxy_lookup_t' but argument is of type 'struct net_device *'
 nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb,
 ^~~~~~~~~~~~~~~~~~~~~
net/netfilter/nft_tproxy.c:48:7: error: too many arguments to function 'nf_tproxy_get_sock_v4'
  sk = nf_tproxy_get_sock_v4(nft_net(pkt), skb, hp, iph->protocol,
       ^~~~~~~~~~~~~~~~~~~~~
In file included from net/netfilter/nft_tproxy.c:6:0:
include/net/netfilter/nf_tproxy.h:75:1: note: declared here
 nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb,
 ^~~~~~~~~~~~~~~~~~~~~
net/netfilter/nft_tproxy.c:69:49: warning: passing argument 3 of 'nf_tproxy_get_sock_v4' makes integer from pointer without a cast [-Wint-conversion]
   sk = nf_tproxy_get_sock_v4(nft_net(pkt), skb, hp, iph->protocol,
                                                 ^~
In file included from net/netfilter/nft_tproxy.c:6:0:
include/net/netfilter/nf_tproxy.h:75:1: note: expected 'u8 {aka const unsigned char}' but argument is of type 'struct udphdr *'
 nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb,
 ^~~~~~~~~~~~~~~~~~~~~
net/netfilter/nft_tproxy.c:71:21: warning: passing argument 8 of 'nf_tproxy_get_sock_v4' makes pointer from integer without a cast [-Wint-conversion]
         hp->source, tport,
                     ^~~~~
In file included from net/netfilter/nft_tproxy.c:6:0:
include/net/netfilter/nf_tproxy.h:75:1: note: expected 'const struct net_device *' but argument is of type '__be16 {aka short unsigned int}'
 nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb,
 ^~~~~~~~~~~~~~~~~~~~~
net/netfilter/nft_tproxy.c:72:9: error: incompatible type for argument 9 of 'nf_tproxy_get_sock_v4'
         skb->dev, NF_TPROXY_LOOKUP_LISTENER);
         ^~~
In file included from net/netfilter/nft_tproxy.c:6:0:
include/net/netfilter/nf_tproxy.h:75:1: note: expected 'const enum nf_tproxy_lookup_t' but argument is of type 'struct net_device *'
 nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb,
 ^~~~~~~~~~~~~~~~~~~~~
net/netfilter/nft_tproxy.c:69:8: error: too many arguments to function 'nf_tproxy_get_sock_v4'
   sk = nf_tproxy_get_sock_v4(nft_net(pkt), skb, hp, iph->protocol,
        ^~~~~~~~~~~~~~~~~~~~~
In file included from net/netfilter/nft_tproxy.c:6:0:
include/net/netfilter/nf_tproxy.h:75:1: note: declared here
 nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb,
 ^~~~~~~~~~~~~~~~~~~~~
net/netfilter/nft_tproxy.c: In function 'nft_tproxy_eval_v6':
net/netfilter/nft_tproxy.c:111:55: warning: passing argument 4 of 'nf_tproxy_get_sock_v6' makes integer from pointer without a cast [-Wint-conversion]
  sk = nf_tproxy_get_sock_v6(nft_net(pkt), skb, thoff, hp, l4proto,
                                                       ^~
In file included from net/netfilter/nft_tproxy.c:6:0:
include/net/netfilter/nf_tproxy.h:114:1: note: expected 'u8 {aka const unsigned char}' but argument is of type 'struct udphdr *'
 nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff,
 ^~~~~~~~~~~~~~~~~~~~~
net/netfilter/nft_tproxy.c:111:59: warning: passing argument 5 of 'nf_tproxy_get_sock_v6' makes pointer from integer without a cast [-Wint-conversion]
  sk = nf_tproxy_get_sock_v6(nft_net(pkt), skb, thoff, hp, l4proto,
                                                           ^~~~~~~
In file included from net/netfilter/nft_tproxy.c:6:0:
include/net/netfilter/nf_tproxy.h:114:1: note: expected 'const struct in6_addr *' but argument is of type 'int'
 nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff,
 ^~~~~~~~~~~~~~~~~~~~~
net/netfilter/nft_tproxy.c:112:21: warning: passing argument 7 of 'nf_tproxy_get_sock_v6' makes integer from pointer without a cast [-Wint-conversion]
        &iph->saddr, &iph->daddr,
                     ^
In file included from net/netfilter/nft_tproxy.c:6:0:
include/net/netfilter/nf_tproxy.h:114:1: note: expected '__be16 {aka const short unsigned int}' but argument is of type 'const struct in6_addr *'
 nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff,
 ^~~~~~~~~~~~~~~~~~~~~
net/netfilter/nft_tproxy.c:113:20: warning: passing argument 9 of 'nf_tproxy_get_sock_v6' makes pointer from integer without a cast [-Wint-conversion]
        hp->source, hp->dest,
                    ^~
In file included from net/netfilter/nft_tproxy.c:6:0:
include/net/netfilter/nf_tproxy.h:114:1: note: expected 'const struct net_device *' but argument is of type '__be16 {aka short unsigned int}'
 nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff,
 ^~~~~~~~~~~~~~~~~~~~~
net/netfilter/nft_tproxy.c:114:8: error: incompatible type for argument 10 of 'nf_tproxy_get_sock_v6'
        nft_in(pkt), NF_TPROXY_LOOKUP_ESTABLISHED);
        ^~~~~~
In file included from net/netfilter/nft_tproxy.c:6:0:
include/net/netfilter/nf_tproxy.h:114:1: note: expected 'const enum nf_tproxy_lookup_t' but argument is of type 'const struct net_device *'
 nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff,
 ^~~~~~~~~~~~~~~~~~~~~
net/netfilter/nft_tproxy.c:111:7: error: too many arguments to function 'nf_tproxy_get_sock_v6'
  sk = nf_tproxy_get_sock_v6(nft_net(pkt), skb, thoff, hp, l4proto,
       ^~~~~~~~~~~~~~~~~~~~~
In file included from net/netfilter/nft_tproxy.c:6:0:
include/net/netfilter/nf_tproxy.h:114:1: note: declared here
 nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff,
 ^~~~~~~~~~~~~~~~~~~~~
net/netfilter/nft_tproxy.c:137:56: warning: passing argument 4 of 'nf_tproxy_get_sock_v6' makes integer from pointer without a cast [-Wint-conversion]
   sk = nf_tproxy_get_sock_v6(nft_net(pkt), skb, thoff, hp,
                                                        ^~
In file included from net/netfilter/nft_tproxy.c:6:0:
include/net/netfilter/nf_tproxy.h:114:1: note: expected 'u8 {aka const unsigned char}' but argument is of type 'struct udphdr *'
 nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff,
 ^~~~~~~~~~~~~~~~~~~~~
net/netfilter/nft_tproxy.c:138:9: warning: passing argument 5 of 'nf_tproxy_get_sock_v6' makes pointer from integer without a cast [-Wint-conversion]
         l4proto, &iph->saddr, &taddr,
         ^~~~~~~
In file included from net/netfilter/nft_tproxy.c:6:0:
include/net/netfilter/nf_tproxy.h:114:1: note: expected 'const struct in6_addr *' but argument is of type 'int'
 nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff,
 ^~~~~~~~~~~~~~~~~~~~~
net/netfilter/nft_tproxy.c:138:31: warning: passing argument 7 of 'nf_tproxy_get_sock_v6' makes integer from pointer without a cast [-Wint-conversion]
         l4proto, &iph->saddr, &taddr,
                               ^
In file included from net/netfilter/nft_tproxy.c:6:0:
include/net/netfilter/nf_tproxy.h:114:1: note: expected '__be16 {aka const short unsigned int}' but argument is of type 'struct in6_addr *'
 nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff,
 ^~~~~~~~~~~~~~~~~~~~~
net/netfilter/nft_tproxy.c:139:21: warning: passing argument 9 of 'nf_tproxy_get_sock_v6' makes pointer from integer without a cast [-Wint-conversion]
         hp->source, tport,
                     ^~~~~
In file included from net/netfilter/nft_tproxy.c:6:0:
include/net/netfilter/nf_tproxy.h:114:1: note: expected 'const struct net_device *' but argument is of type '__be16 {aka short unsigned int}'
 nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff,
 ^~~~~~~~~~~~~~~~~~~~~
net/netfilter/nft_tproxy.c:140:9: error: incompatible type for argument 10 of 'nf_tproxy_get_sock_v6'
         nft_in(pkt), NF_TPROXY_LOOKUP_LISTENER);
         ^~~~~~
In file included from net/netfilter/nft_tproxy.c:6:0:
include/net/netfilter/nf_tproxy.h:114:1: note: expected 'const enum nf_tproxy_lookup_t' but argument is of type 'const struct net_device *'
 nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff,
 ^~~~~~~~~~~~~~~~~~~~~
net/netfilter/nft_tproxy.c:137:8: error: too many arguments to function 'nf_tproxy_get_sock_v6'
   sk = nf_tproxy_get_sock_v6(nft_net(pkt), skb, thoff, hp,
        ^~~~~~~~~~~~~~~~~~~~~
In file included from net/netfilter/nft_tproxy.c:6:0:
include/net/netfilter/nf_tproxy.h:114:1: note: declared here
 nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff,
 ^~~~~~~~~~~~~~~~~~~~~

Caused by commit

  08668354bdbf ("netfilter: Add native tproxy support for nf_tables")

interacting with commit

  5711b4e89319 ("netfilter: nf_tproxy: fix possible non-linear access to transport header")

from the net tree.

I have applied the following merge fix up patch:

From: Stephen Rothwell <sfr@canb.auug.org.au>
Date: Wed, 18 Jul 2018 11:41:50 +1000
Subject: [PATCH] netfilter: nf_tproxy: merge fix ups for API changes

Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
---
 net/netfilter/nft_tproxy.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/nft_tproxy.c b/net/netfilter/nft_tproxy.c
index 5ca797ea335c..23ea9396a693 100644
--- a/net/netfilter/nft_tproxy.c
+++ b/net/netfilter/nft_tproxy.c
@@ -45,7 +45,7 @@ static void nft_tproxy_eval_v4(const struct nft_expr *expr,
 	 * happens if the redirect already happened and the current packet
 	 * belongs to an already established connection
 	 */
-	sk = nf_tproxy_get_sock_v4(nft_net(pkt), skb, hp, iph->protocol,
+	sk = nf_tproxy_get_sock_v4(nft_net(pkt), skb, iph->protocol,
 				   iph->saddr, iph->daddr,
 				   hp->source, hp->dest,
 				   skb->dev, NF_TPROXY_LOOKUP_ESTABLISHED);
@@ -66,7 +66,7 @@ static void nft_tproxy_eval_v4(const struct nft_expr *expr,
 	else if (!sk)
 		/* no, there's no established connection, check if
 		 * there's a listener on the redirected addr/port */
-		sk = nf_tproxy_get_sock_v4(nft_net(pkt), skb, hp, iph->protocol,
+		sk = nf_tproxy_get_sock_v4(nft_net(pkt), skb, iph->protocol,
 					   iph->saddr, taddr,
 					   hp->source, tport,
 					   skb->dev, NF_TPROXY_LOOKUP_LISTENER);
@@ -108,7 +108,7 @@ static void nft_tproxy_eval_v6(const struct nft_expr *expr,
 	 * happens if the redirect already happened and the current packet
 	 * belongs to an already established connection.
 	 */
-	sk = nf_tproxy_get_sock_v6(nft_net(pkt), skb, thoff, hp, l4proto,
+	sk = nf_tproxy_get_sock_v6(nft_net(pkt), skb, thoff, l4proto,
 				   &iph->saddr, &iph->daddr,
 				   hp->source, hp->dest,
 				   nft_in(pkt), NF_TPROXY_LOOKUP_ESTABLISHED);
@@ -134,7 +134,7 @@ static void nft_tproxy_eval_v6(const struct nft_expr *expr,
 	else if (!sk)
 		/* no there's no established connection, check if
 		 * there's a listener on the redirected addr/port */
-		sk = nf_tproxy_get_sock_v6(nft_net(pkt), skb, thoff, hp,
+		sk = nf_tproxy_get_sock_v6(nft_net(pkt), skb, thoff,
 					   l4proto, &iph->saddr, &taddr,
 					   hp->source, tport,
 					   nft_in(pkt), NF_TPROXY_LOOKUP_LISTENER);
-- 
2.18.0

-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

linux-next: build failure after merge of the netfilter-next tree

[Stephen Rothwell]

Hi all,

After merging the netfilter-next tree, today's linux-next build (powerpc
ppc64_defconfig) failed like this:

ERROR: "nf_conntrack_htable_size" [net/netfilter/nf_conntrack_netlink.ko] undefined!
ERROR: "nf_conntrack_htable_size" [net/ipv4/netfilter/nf_conntrack_ipv4.ko] undefined!

Caused by commit

  adf0516845bc ("netfilter: remove ip_conntrack* sysctl compat code")

or maybe

  92e47ba8839b ("netfilter: conntrack: simplify the code by using nf_conntrack_get_ht")

I have used the netfilter-next tree from next-20160817 for today.

-- 
Cheers,
Stephen Rothwell