Bugzilla Bug 205127

when compiling iptables-1.4.0-r1 with l7filter USE flag enabled, there is this
error :

>>> Compiling source in /var/tmp/portage/net-firewall/iptables-1.4.0-r1/work/iptables-1.4.0 ...
Making dependencies: please wait...
Unable to resolve dependency on linux/compiler.h. Try 'make clean'.


    Please try `make KERNEL_DIR=path-to-correct-kernel'.


This is solved with the following patch

Created an attachment (id=140572) [edit]
iptables-layer7-fix.patch

Patch against the ebuild that fix the build error

Guillaume, what USE flags do you use to build iptables, please, provide emerge
--info, and full build output.

iptables USE flags : extensions ipv6 l7filter -imq -static
Simply removing l7filter USE solves the compilation error. Applying the patch I
provided also fixes the compilation error.



Portage 2.1.4_rc14 (hardened/x86/2.6, gcc-3.4.6, glibc-2.7-r1, 2.6.23-xwing-r3
i686)
=================================================================
System uname: 2.6.23-xwing-r3 i686 Intel(R) Celeron(R) CPU 2.53GHz
Timestamp of tree: Wed, 09 Jan 2008 21:30:01 +0000
app-shells/bash:     3.2_p33
dev-lang/python:     2.5.1-r5
sys-apps/baselayout: 1.12.10-r5
sys-apps/sandbox:    1.2.18.1-r2
sys-devel/autoconf:  2.61-r1
sys-devel/automake:  1.7.9-r1, 1.10
sys-devel/binutils:  2.18-r1
sys-devel/gcc-config: 1.4.0-r4
sys-devel/libtool:   1.5.24
virtual/os-headers:  2.6.23-r3
ACCEPT_KEYWORDS="x86 ~x86"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-march=pentium4 -O2 -mtune=pentium4 -pipe"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /var/bind"
CONFIG_PROTECT_MASK="/etc/env.d /etc/fonts/fonts.conf /etc/gconf
/etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/
/etc/php/cli-php5/ext-active/ /etc/revdep-rebuild /etc/terminfo
/etc/udev/rules.d"
CXXFLAGS="-march=pentium4 -O2 -mtune=pentium4 -pipe"
DISTDIR="/usr/portage/distfiles"
EMERGE_DEFAULT_OPTS="--with-bdeps y"
FEATURES="buildsyspkg collision-protect distlocks fixpackages metadata-transfer
sandbox sfperms strict unmerge-orphans userfetch userpriv usersandbox"
GENTOO_MIRRORS="http://r2d2.v6.xwing.info/
http://mirror.ovh.net/gentoo-distfiles/     http://gentoo.zie.pg.gda.pl
http://gentoo.tiscali.nl/"
LANG="fr_FR.UTF-8"
LC_ALL="fr_FR.UTF-8"
LINGUAS="fr"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --delete-after --stats --timeout=180
--exclude=/distfiles --exclude=/local --exclude=/packages
--filter=H_**/files/digest-*"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/portage/local/layman/webapps-experimental
/usr/local/overlays/gcpan-portage /usr/local/overlays/portage
/usr/local/overlays/local-portage"
SYNC="rsync://r2d2.v6.xwing.info/gentoo-portage"
USE="4kstacks acl acpi acpi4linux apache2 async bash-completion bashlogger
berkdb bzip2 clamav cracklib crypt dba dbx devmap dga enscript expat extensions
fbcon freetype fs gd gdbm gif gmp gocr hardened idled idn imagemagick imap
imlib2 iproute2 ipv6 ithreads jpeg l7filter ldap maildir md5sum mhash midi mmx
ncurses nls nptl nptlonly ocrad pam pcre perl php pic png posix python readline
rrdtool sasl slang sni soap sockets spf sse sse2 ssl subversion sysfs syslog
tcpd threads tiff truetype truetype-fonts type1 type1-fonts udev unicode
urandom usb vim-pager vim-syntax x86 xml2 xorg zlib" ALSA_CARDS="ali5451
als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1 emu10k1x ens1370
ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident
usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy
dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear
meter mulaw multi null plug rate route share shm softvol"
APACHE2_MODULES="actions alias auth_basic auth_digest authn_dbd authn_default
authn_file authz_default authz_groupfile authz_host authz_owner authz_user
autoindex dbd dir env expires include log_config mime mime_magic negotiation
proxy proxy_connect proxy_http rewrite setenvif" APACHE2_MPMS="worker"
ELIBC="glibc" INPUT_DEVICES="mouse keyboard" KERNEL="linux" LCD_DEVICES="bayrad
cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="fr"
USERLAND="GNU" VIDEO_CARDS="apm ark chips cirrus cyrix dummy fbdev glint i128
i740 i810 imstt mach64 mga neomagic nsc nv r128 radeon rendition s3 s3virge
savage siliconmotion sis sisusb tdfx tga trident tseng v4l vesa vga via vmware
voodoo"
Unset:  CPPFLAGS, CTARGET, INSTALL_MASK, LDFLAGS, PORTAGE_COMPRESS,
PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

Full build output :


# emerge iptables
Calculating dependencies... done!
>>> Verifying ebuild Manifests...

>>> Emerging (1 of 1) net-firewall/iptables-1.4.0-r1 to /
 * netfilter-layer7-v2.17.tar.gz MD5 RMD160 SHA1 SHA256 size ;-) ...           
                                                                               
                                                                        [ ok ]
 * iptables-1.4.0.tar.bz2 MD5 RMD160 SHA1 SHA256 size ;-) ...                  
                                                                               
                                                                        [ ok ]
 * checking ebuild checksums ;-) ...                                           
                                                                               
                                                                        [ ok ]
 * checking auxfile checksums ;-) ...                                          
                                                                               
                                                                        [ ok ]
 * checking miscfile checksums ;-) ...                                         
                                                                               
                                                                        [ ok ]
 * checking iptables-1.4.0.tar.bz2 ;-) ...                                     
                                                                               
                                                                        [ ok ]
 * checking netfilter-layer7-v2.17.tar.gz ;-) ...                              
                                                                               
                                                                        [ ok ]
 * WARNING: 3rd party extensions has been enabled.
 * This means that iptables will use your currently installed
 * kernel in /usr/src/linux as headers for iptables.
 *
 * You may have to patch your kernel to allow iptables to build.
 * Please check http://ftp.netfilter.org/pub/patch-o-matic-ng/snapshot/ for
patches
 * for your kernel.
 *
 * Determining the location of the kernel source code
 * Found kernel source directory:
 *     /usr/src/linux
 * Found sources for kernel version:
 *     2.6.23-xwing-r3
>>> Unpacking source...
>>> Unpacking iptables-1.4.0.tar.bz2 to /var/tmp/portage/net-firewall/iptables-1.4.0-r1/work
>>> Unpacking netfilter-layer7-v2.17.tar.gz to /var/tmp/portage/net-firewall/iptables-1.4.0-r1/work
 * Applying iptables-1.4.0-dev-files.patch ...                                 
                                                                               
                                                                        [ ok ]
 * Applying grsecurity-1.2.8-iptables.patch-1.3.1 ...                          
                                                                               
                                                                        [ ok ]
 * Applying iptables-1.4-for-kernel-2.6.20forward-layer7-2.17.patch ...        
                                                                               
                                                                        [ ok ]
>>> Source unpacked.
>>> Compiling source in /var/tmp/portage/net-firewall/iptables-1.4.0-r1/work/iptables-1.4.0 ...
Making dependencies: please wait...
Unable to resolve dependency on linux/compiler.h. Try 'make clean'.


    Please try `make KERNEL_DIR=path-to-correct-kernel'.


Extensions found:
 *
 * ERROR: net-firewall/iptables-1.4.0-r1 failed.
 * Call stack:
 *               ebuild.sh, line   46:  Called src_compile
 *             environment, line 2775:  Called die
 * The specific snippet of code:
 *       emake COPT_FLAGS="${CFLAGS}" ${myconf} CC="$(tc-getCC)" || diefunc
"$FUNCNAME" "$LINENO" "$?" "${diemsg}"
 *  The die message:
 *   failure - with l7filter and/or imq patch and/or other miscellanious
patches added
 *
 * If you need support, post the topmost build error, and the call stack if
relevant.
 * A complete build log is located at
'/var/tmp/portage/net-firewall/iptables-1.4.0-r1/temp/build.log'.
 * The ebuild environment file is located at
'/var/tmp/portage/net-firewall/iptables-1.4.0-r1/temp/environment'.
 *

Created an attachment (id=140726) [edit]
iptables-1.4.0-Rules.make.patch

Guillaume, I've tried to understand what going on, but I failed to reproduce
the bug here, so I have to ask you more questions before I start to install
hardened system...

Could you show me the output of 
ls -la /lib/modules/$(uname -r)/source
ls  /lib/modules/$(uname -r)/source
eselect kernel list
gcc-config -l
?

Also could you apply this patch and show me output of build process with this
patch applied.

BTW. Are you sure that you disable l7-filter only and keep extensions USE flag
on?

Hi,

This is a monolithic kernel without modules support, so there is no
/lib/modules/$(uname -r)/source directory ("make modules_install" does not work
on kernels with modules support disabled, /lib/modules does not make sense in
such cases)

I just realize writing this that THIS point should be the problem, and that's
why KERNEL_DIR should be indicated to the build (just like on the 1.3.8 ebuild
does)



# eselect kernel list
Available kernel symlink targets:
  [1]   linux-2.6.23-hardened-r2
  [2]   linux-2.6.23-hardened-r5 *

# gcc-config -l
 [1] i686-pc-linux-gnu-3.4.6 *
 [2] i686-pc-linux-gnu-3.4.6-hardenednopie
 [3] i686-pc-linux-gnu-3.4.6-hardenednopiessp
 [4] i686-pc-linux-gnu-3.4.6-hardenednossp
 [5] i686-pc-linux-gnu-3.4.6-vanilla


Compilation output with your patch :
>>> Compiling source in /var/tmp/portage/net-firewall/iptables-1.4.0-r1/work/iptables-1.4.0 ...
Making dependencies: please wait... /lib/modules/2.6.23-xwing-r3/source
Generating dependency: extensions/libxt_TRACE.d
Generating dependency: extensions/libxt_TCPMSS.d
Generating dependency: extensions/libxt_NOTRACK.d
Generating dependency: extensions/libxt_NFQUEUE.d
Generating dependency: extensions/libxt_NFLOG.d
Generating dependency: extensions/libxt_MARK.d
Generating dependency: extensions/libxt_DSCP.d
Generating dependency: extensions/libxt_CONNMARK.d
Generating dependency: extensions/libxt_CLASSIFY.d
Generating dependency: extensions/libxt_udp.d
Generating dependency: extensions/libxt_u32.d
Generating dependency: extensions/libxt_time.d
Generating dependency: extensions/libxt_tcpmss.d
Generating dependency: extensions/libxt_tcp.d
Generating dependency: extensions/libxt_string.d
Generating dependency: extensions/libxt_standard.d
Generating dependency: extensions/libxt_statistic.d
Generating dependency: extensions/libxt_state.d
Generating dependency: extensions/libxt_sctp.d
Generating dependency: extensions/libxt_quota.d
Generating dependency: extensions/libxt_pkttype.d
Generating dependency: extensions/libxt_physdev.d
Generating dependency: extensions/libxt_multiport.d
Generating dependency: extensions/libxt_mark.d
Generating dependency: extensions/libxt_mac.d
Generating dependency: extensions/libxt_limit.d
Generating dependency: extensions/libxt_length.d
Generating dependency: extensions/libxt_helper.d
Generating dependency: extensions/libxt_hashlimit.d
Generating dependency: extensions/libxt_esp.d
Generating dependency: extensions/libxt_dscp.d
Generating dependency: extensions/libxt_dccp.d
Generating dependency: extensions/libxt_comment.d
Generating dependency: extensions/libxt_connlimit.d
Generating dependency: extensions/libxt_connmark.d
Generating dependency: extensions/libxt_connbytes.d
Generating dependency: extensions/libip6t_REJECT.d
Generating dependency: extensions/libip6t_LOG.d
Generating dependency: extensions/libip6t_HL.d
Generating dependency: extensions/libip6t_rt.d
Generating dependency: extensions/libip6t_policy.d
Generating dependency: extensions/libip6t_owner.d
Generating dependency: extensions/libip6t_mh.d
Generating dependency: extensions/libip6t_ipv6header.d
Generating dependency: extensions/libip6t_icmp6.d
Generating dependency: extensions/libip6t_hl.d
Generating dependency: extensions/libip6t_hbh.d
Generating dependency: extensions/libip6t_frag.d
Generating dependency: extensions/libip6t_eui64.d
Generating dependency: extensions/libip6t_dst.d
Generating dependency: extensions/libip6t_ah.d
Generating dependency: extensions/libipt_ULOG.d
Generating dependency: extensions/libipt_TTL.d
Generating dependency: extensions/libipt_TOS.d
Generating dependency: extensions/libipt_SNAT.d
Generating dependency: extensions/libipt_SAME.d
Generating dependency: extensions/libipt_REJECT.d
Generating dependency: extensions/libipt_REDIRECT.d
Generating dependency: extensions/libipt_NETMAP.d
Generating dependency: extensions/libipt_MIRROR.d
Generating dependency: extensions/libipt_MASQUERADE.d
Generating dependency: extensions/libipt_LOG.d
Generating dependency: extensions/libipt_ECN.d
Generating dependency: extensions/libipt_DNAT.d
Generating dependency: extensions/libipt_CLUSTERIP.d
Generating dependency: extensions/libipt_unclean.d
Generating dependency: extensions/libipt_ttl.d
Generating dependency: extensions/libipt_tos.d
Generating dependency: extensions/libipt_recent.d
Generating dependency: extensions/libipt_realm.d
Generating dependency: extensions/libipt_policy.d
Generating dependency: extensions/libipt_owner.d
Generating dependency: extensions/libipt_iprange.d
Generating dependency: extensions/libipt_icmp.d
Generating dependency: extensions/libipt_ecn.d
Generating dependency: extensions/libipt_conntrack.d
Generating dependency: extensions/libipt_addrtype.d
Generating dependency: extensions/libipt_ah.d
Generating dependency: extensions/libipt_stealth.d
Unable to resolve dependency on linux/compiler.h. Try 'make clean'.


    Please try `make KERNEL_DIR=path-to-correct-kernel'.



About disabling l7filter USE, very sorry, I was horribly mistaken, this does
not solves the problem : This was on an other Gentoo system...

Monolithic kernel makes sense and now I see the problem - we should always
export KERNEL_DIR.

In case of vanilla iptables (USE="-imq -l7filter -extesions") we did that,
while in case of any of that enabled we did not exported KERNEL_DIR and
iptables build system fall back to /lib/modules/$(uname -r)/source that does
not work in case of monolithic kernel.

Before your last comment it was unclear how l7filter influenced that as
extensions should affect that behavior too, while you reported different.
Please be more attentive next time. 

Not it's FIXED in CVS. Thank you for report!