I know that nftables isn't officially supported in BLFS, but it is an option given in the iptables section in the security chapter. I've decided to try and install it, but get errors when trying to make the package - my LFS and initial foray into BLFS has been by following the systemd 8.0 version, kernel 4.9.9.
I get the following error:
Code:
[ /sources/nftables ]$ make
make all-recursive
make[1]: Entering directory '/sources/nftables'
Making all in src
make[2]: Entering directory '/sources/nftables/src'
make all-am
make[3]: Entering directory '/sources/nftables/src'
CC netlink.o
netlink.c: In function ‘alloc_nftnl_obj’:
netlink.c:321:26: error: ‘NFTNL_OBJ_CT_HELPER_NAME’ undeclared (first use in this function)
nftnl_obj_set_str(nlo, NFTNL_OBJ_CT_HELPER_NAME,
^~~~~~~~~~~~~~~~~~~~~~~~
netlink.c:321:26: note: each undeclared identifier is reported only once for each function it appears in
netlink.c:323:3: warning: implicit declaration of function ‘nftnl_obj_set_u8’ [-Wimplicit-function-declaration]
nftnl_obj_set_u8(nlo, NFTNL_OBJ_CT_HELPER_L4PROTO,
^~~~~~~~~~~~~~~~
netlink.c:323:25: error: ‘NFTNL_OBJ_CT_HELPER_L4PROTO’ undeclared (first use in this function)
nftnl_obj_set_u8(nlo, NFTNL_OBJ_CT_HELPER_L4PROTO,
^~~~~~~~~~~~~~~~~~~~~~~~~~~
netlink.c:326:4: warning: implicit declaration of function ‘nftnl_obj_set_u16’ [-Wimplicit-function-declaration]
nftnl_obj_set_u16(nlo, NFTNL_OBJ_CT_HELPER_L3PROTO,
^~~~~~~~~~~~~~~~~
netlink.c:326:27: error: ‘NFTNL_OBJ_CT_HELPER_L3PROTO’ undeclared (first use in this function)
nftnl_obj_set_u16(nlo, NFTNL_OBJ_CT_HELPER_L3PROTO,
^~~~~~~~~~~~~~~~~~~~~~~~~~~
netlink.c: In function ‘netlink_delinearize_set’:
netlink.c:1159:5: warning: implicit declaration of function ‘nftnl_udata_get_u32’ [-Wimplicit-function-declaration]
nftnl_udata_get_u32(ud[UDATA_SET_KEYBYTEORDER]);
^~~~~~~~~~~~~~~~~~~
netlink.c: In function ‘netlink_add_set_batch’:
netlink.c:1301:7: warning: implicit declaration of function ‘nftnl_udata_put_u32’ [-Wimplicit-function-declaration]
if (!nftnl_udata_put_u32(udbuf, UDATA_SET_KEYBYTEORDER,
^~~~~~~~~~~~~~~~~~~
netlink.c: In function ‘netlink_delinearize_obj’:
netlink.c:1829:28: error: ‘NFTNL_OBJ_CT_HELPER_NAME’ undeclared (first use in this function)
nftnl_obj_get_str(nlo, NFTNL_OBJ_CT_HELPER_NAME));
^~~~~~~~~~~~~~~~~~~~~~~~
netlink.c:1830:21: warning: implicit declaration of function ‘nftnl_obj_get_u16’ [-Wimplicit-function-declaration]
obj->ct.l3proto = nftnl_obj_get_u16(nlo, NFTNL_OBJ_CT_HELPER_L3PROTO);
^~~~~~~~~~~~~~~~~
netlink.c:1830:44: error: ‘NFTNL_OBJ_CT_HELPER_L3PROTO’ undeclared (first use in this function)
obj->ct.l3proto = nftnl_obj_get_u16(nlo, NFTNL_OBJ_CT_HELPER_L3PROTO);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
netlink.c:1831:21: warning: implicit declaration of function ‘nftnl_obj_get_u8’ [-Wimplicit-function-declaration]
obj->ct.l4proto = nftnl_obj_get_u8(nlo, NFTNL_OBJ_CT_HELPER_L4PROTO);
^~~~~~~~~~~~~~~~
netlink.c:1831:43: error: ‘NFTNL_OBJ_CT_HELPER_L4PROTO’ undeclared (first use in this function)
obj->ct.l4proto = nftnl_obj_get_u8(nlo, NFTNL_OBJ_CT_HELPER_L4PROTO);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
make[3]: *** [Makefile:469: netlink.o] Error 1
make[3]: Leaving directory '/sources/nftables/src'
make[2]: *** [Makefile:345: all] Error 2
make[2]: Leaving directory '/sources/nftables/src'
make[1]: *** [Makefile:395: all-recursive] Error 1
make[1]: Leaving directory '/sources/nftables'
make: *** [Makefile:336: all] Error 2
As per the
instructions, libgmp and libreadline are installed during LFS and I've installed libmnl and libnftnl, both with the configure options of --prefix=/usr and --sbindir=/sbin. I'm not aware of any other dependencies that I need to install.
After running sh autogen.sh, I configured nftables with the --prefix=/usr and --sbindir=/sbin flags.
I've recompiled the kernel with modules to support nftables and they are enabled:
Code:
lsmod | grep nf_tables
nf_tables_inet 1787 0
nf_tables_arp 1842 0
nf_tables_ipv6 2317 1 nf_tables_inet
nf_tables_ipv4 2253 1 nf_tables_inet
nf_tables 60319 4 nf_tables_arp,nf_tables_ipv6,nf_tables_ipv4,nf_tables_inet
I'm pretty stuck trying to figure out how to proceed; any help would be hugely welcome.
Edit 1:
I've noticed that there are some flags in the configure script that relate to LIBNFTNL (and others, but since the current error seems to relate to this, I'll start here).
Code:
LIBNFTNL_CFLAGS
C compiler flags for LIBNFTNL, overriding pkg-config
LIBNFTNL_LIBS
linker flags for LIBNFTNL, overriding pkg-config
Is setting these flags (if that's even possible - reached and exceeded the extent of my knowledge of make) likely to help? What should they be set to?
