[PATCH nf-next] nfilter: nf_hooks: fix build failure with NF_TABLES=n

[PATCH nf-next] nfilter: nf_hooks: fix build failure with NF_TABLES=n

[Florian Westphal]

nfnetlink_hook.c: In function 'nfnl_hook_put_nft_chain_info':
nfnetlink_hook.c:76:7: error: implicit declaration of 'nft_is_active'

This macro is only defined when NF_TABLES is enabled.
Add IS_ENABLED guards for this.

Reported-by: kernel test robot <lkp@intel.com>
Fixes: 252956528caa ("netfilter: add new hook nfnl subsystem")
Signed-off-by: Florian Westphal <fw@strlen.de>
---
 net/netfilter/nfnetlink_hook.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/netfilter/nfnetlink_hook.c b/net/netfilter/nfnetlink_hook.c
index 04586dfa2acd..d624805e977c 100644
--- a/net/netfilter/nfnetlink_hook.c
+++ b/net/netfilter/nfnetlink_hook.c
@@ -61,6 +61,7 @@ static int nfnl_hook_put_nft_chain_info(struct sk_buff *nlskb,
 					unsigned int seq,
 					const struct nf_hook_ops *ops)
 {
+#if IS_ENABLED(CONFIG_NF_TABLES)
 	struct net *net = sock_net(nlskb->sk);
 	struct nlattr *nest, *nest2;
 	struct nft_chain *chain;
@@ -104,6 +105,9 @@ static int nfnl_hook_put_nft_chain_info(struct sk_buff *nlskb,
 cancel_nest:
 	nla_nest_cancel(nlskb, nest);
 	return -EMSGSIZE;
+#else
+	return 0;
+#endif
 }
 
 static int nfnl_hook_dump_one(struct sk_buff *nlskb,
-- 
2.31.1

Re: [PATCH nf-next] nfilter: nf_hooks: fix build failure with NF_TABLES=n

[Pablo Neira Ayuso]

Maybe from Kconfig, select CONFIG_NF_TABLES from NFNETLINK_HOOK to
reduce ifdef pollution?

On Tue, Jun 08, 2021 at 04:42:37PM +0200, Florian Westphal wrote:
> nfnetlink_hook.c: In function 'nfnl_hook_put_nft_chain_info':
> nfnetlink_hook.c:76:7: error: implicit declaration of 'nft_is_active'
> 
> This macro is only defined when NF_TABLES is enabled.
> Add IS_ENABLED guards for this.
> 
> Reported-by: kernel test robot <lkp@intel.com>
> Fixes: 252956528caa ("netfilter: add new hook nfnl subsystem")
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
>  net/netfilter/nfnetlink_hook.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/net/netfilter/nfnetlink_hook.c b/net/netfilter/nfnetlink_hook.c
> index 04586dfa2acd..d624805e977c 100644
> --- a/net/netfilter/nfnetlink_hook.c
> +++ b/net/netfilter/nfnetlink_hook.c
> @@ -61,6 +61,7 @@ static int nfnl_hook_put_nft_chain_info(struct sk_buff *nlskb,
>  					unsigned int seq,
>  					const struct nf_hook_ops *ops)
>  {
> +#if IS_ENABLED(CONFIG_NF_TABLES)
>  	struct net *net = sock_net(nlskb->sk);
>  	struct nlattr *nest, *nest2;
>  	struct nft_chain *chain;
> @@ -104,6 +105,9 @@ static int nfnl_hook_put_nft_chain_info(struct sk_buff *nlskb,
>  cancel_nest:
>  	nla_nest_cancel(nlskb, nest);
>  	return -EMSGSIZE;
> +#else
> +	return 0;
> +#endif
>  }
>  
>  static int nfnl_hook_dump_one(struct sk_buff *nlskb,
> -- 
> 2.31.1
> 

Re: [PATCH nf-next] nfilter: nf_hooks: fix build failure with NF_TABLES=n

[Florian Westphal]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> Maybe from Kconfig, select CONFIG_NF_TABLES from NFNETLINK_HOOK to
> reduce ifdef pollution?

Why? It doesn't depend on nftables?

Re: [PATCH nf-next] nfilter: nf_hooks: fix build failure with NF_TABLES=n

[Pablo Neira Ayuso]

On Tue, Jun 08, 2021 at 05:53:26PM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > Maybe from Kconfig, select CONFIG_NF_TABLES from NFNETLINK_HOOK to
> > reduce ifdef pollution?
> 
> Why? It doesn't depend on nftables?

From kernelside, yes. But you have to compile userspace nftables to
use this infra, unless there is separated tooling, userspace library
or you code your own netlink userspace code.

Adding the "depends on" might also help signal distros that this
subsystem is useful to be turned on.

The #ifdef is perfectly fine to fix the kbuild robot issue, I was just
thinking if it is probably better a different path when looking at the
whole picture.

Re: [PATCH nf-next] nfilter: nf_hooks: fix build failure with NF_TABLES=n

[Florian Westphal]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Tue, Jun 08, 2021 at 05:53:26PM +0200, Florian Westphal wrote:
> > Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > > Maybe from Kconfig, select CONFIG_NF_TABLES from NFNETLINK_HOOK to
> > > reduce ifdef pollution?
> > 
> > Why? It doesn't depend on nftables?
> 
> From kernelside, yes. But you have to compile userspace nftables to
> use this infra, unless there is separated tooling, userspace library
> or you code your own netlink userspace code.
> 
> Adding the "depends on" might also help signal distros that this
> subsystem is useful to be turned on.
> 
> The #ifdef is perfectly fine to fix the kbuild robot issue, I was just
> thinking if it is probably better a different path when looking at the
> whole picture.

Fair enough, please discard this, I will send the depends-on patch then.