[net-next] netfilter: bridge: make NF_TABLES_BRIDGE tristate

The new nft_meta_bridge code fails to link as built-in when NF_TABLES
is a loadable module.

net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_eval':
nft_meta_bridge.c:(.text+0x1e8): undefined reference to `nft_meta_get_eval'
net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_init':
nft_meta_bridge.c:(.text+0x468): undefined reference to `nft_meta_get_init'
nft_meta_bridge.c:(.text+0x49c): undefined reference to `nft_parse_register'
nft_meta_bridge.c:(.text+0x4cc): undefined reference to `nft_validate_register_store'
net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_exit':
nft_meta_bridge.c:(.exit.text+0x14): undefined reference to `nft_unregister_expr'
net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_init':
nft_meta_bridge.c:(.init.text+0x14): undefined reference to `nft_register_expr'
net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x60): undefined reference to `nft_meta_get_dump'
net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x88): undefined reference to `nft_meta_set_eval'

This can happen because the NF_TABLES_BRIDGE dependency itself is just a
'bool'.  Make the symbol a 'tristate' instead so Kconfig can propagate the
dependencies correctly.

Fixes: 30e103fe24de ("netfilter: nft_meta: move bridge meta keys into nft_meta_bridge")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

---
 net/bridge/netfilter/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

-- 
2.20.0

On Wed, Jul 10, 2019 at 10:08:20AM +0200, Arnd Bergmann wrote:
> The new nft_meta_bridge code fails to link as built-in when NF_TABLES

> is a loadable module.


Applied, thanks Arnd.

On Thu, Jul 18, 2019 at 09:01:10PM +0200, Pablo Neira Ayuso wrote:
> On Wed, Jul 10, 2019 at 10:08:20AM +0200, Arnd Bergmann wrote:

> > The new nft_meta_bridge code fails to link as built-in when NF_TABLES

> > is a loadable module.

> > 

> > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_eval':

> > nft_meta_bridge.c:(.text+0x1e8): undefined reference to `nft_meta_get_eval'

> > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_init':

> > nft_meta_bridge.c:(.text+0x468): undefined reference to `nft_meta_get_init'

> > nft_meta_bridge.c:(.text+0x49c): undefined reference to `nft_parse_register'

> > nft_meta_bridge.c:(.text+0x4cc): undefined reference to `nft_validate_register_store'

> > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_exit':

> > nft_meta_bridge.c:(.exit.text+0x14): undefined reference to `nft_unregister_expr'

> > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_init':

> > nft_meta_bridge.c:(.init.text+0x14): undefined reference to `nft_register_expr'

> > net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x60): undefined reference to `nft_meta_get_dump'

> > net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x88): undefined reference to `nft_meta_set_eval'

> > 

> > This can happen because the NF_TABLES_BRIDGE dependency itself is just a

> > 'bool'.  Make the symbol a 'tristate' instead so Kconfig can propagate the

> > dependencies correctly.

> 

> Hm. Something breaks here. Investigating. Looks like bridge support is

> gone after this, nft fails to register the filter chain type:

> 

> # nft add table bridge x

> # nft add chain bridge x y { type filter hook input priority 0\; }

> Error: Could not process rule: No such file or directory


Found it. It seems this patch is needed, on top of your patch.

I can just squash this chunk into your original patch and push it out
if you're OK witht this.

Thanks.
diff --git a/net/netfilter/nft_chain_filter.c b/net/netfilter/nft_chain_filter.c
index 3fd540b2c6ba..b5d5d071d765 100644
--- a/net/netfilter/nft_chain_filter.c
+++ b/net/netfilter/nft_chain_filter.c
@@ -193,7 +193,7 @@ static inline void nft_chain_filter_inet_init(void) {}
 static inline void nft_chain_filter_inet_fini(void) {}
 #endif /* CONFIG_NF_TABLES_IPV6 */
 
-#ifdef CONFIG_NF_TABLES_BRIDGE
+#if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE)
 static unsigned int
 nft_do_chain_bridge(void *priv,
 		    struct sk_buff *skb,

On Fri, Jul 19, 2019 at 8:37 AM Pablo Neira Ayuso <pablo@netfilter.org> wrote:
>

> On Thu, Jul 18, 2019 at 09:01:10PM +0200, Pablo Neira Ayuso wrote:

> > On Wed, Jul 10, 2019 at 10:08:20AM +0200, Arnd Bergmann wrote:

> > > The new nft_meta_bridge code fails to link as built-in when NF_TABLES

> > > is a loadable module.

> > >

> > > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_eval':

> > > nft_meta_bridge.c:(.text+0x1e8): undefined reference to `nft_meta_get_eval'

> > > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_init':

> > > nft_meta_bridge.c:(.text+0x468): undefined reference to `nft_meta_get_init'

> > > nft_meta_bridge.c:(.text+0x49c): undefined reference to `nft_parse_register'

> > > nft_meta_bridge.c:(.text+0x4cc): undefined reference to `nft_validate_register_store'

> > > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_exit':

> > > nft_meta_bridge.c:(.exit.text+0x14): undefined reference to `nft_unregister_expr'

> > > net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_init':

> > > nft_meta_bridge.c:(.init.text+0x14): undefined reference to `nft_register_expr'

> > > net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x60): undefined reference to `nft_meta_get_dump'

> > > net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x88): undefined reference to `nft_meta_set_eval'

> > >

> > > This can happen because the NF_TABLES_BRIDGE dependency itself is just a

> > > 'bool'.  Make the symbol a 'tristate' instead so Kconfig can propagate the

> > > dependencies correctly.

> >

> > Hm. Something breaks here. Investigating. Looks like bridge support is

> > gone after this, nft fails to register the filter chain type:

> >

> > # nft add table bridge x

> > # nft add chain bridge x y { type filter hook input priority 0\; }

> > Error: Could not process rule: No such file or directory

>

> Found it. It seems this patch is needed, on top of your patch.


Right, makes sense.

> I can just squash this chunk into your original patch and push it out

> if you're OK witht this.


Yes, please do.

      Arnd