don't use __be16 in files used by userspace

Hi Dave!

This (or a different solution such as
"#ifndef __KERNEL__ #define __be16 #endif" needs to go in before 2.6.14 is released, since otherwise we'd break userspace compilation :(

Please apply, thanks.

[NETFILTER] do not use __be16 in headerfile that is used by userspace

__be16 is not defined in userspace, and therefore iptables cannot be compiled with such types in ip_conntrack_tuple.h. Yes, we can add a bogus #define to iptables userspace, but we can only do so for new releases, not for old ones. Since we do not want to loose the ability to compile old iptables programs on new kernels, we revert the change.

---
commit 4714eea267d67e65aabb6518cbfa81b8c45c2147
tree caf15c3b67ea6595db868305e7042cbea3f01edf
parent d5b3f0a9fdcf7881d3b6efedd862aef6d561db03
author Harald Welte <[email protected]> Fri, 07 Oct 2005 12:59:02 +0200 committer Harald Welte <[email protected]> Fri, 07 Oct 2005 12:59:02 +0200

 include/linux/netfilter_ipv4/ip_conntrack_tuple.h |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

@@ -17,7 +17,7 @@ union ip_conntrack_manip_proto
 	u_int16_t all;
 
 	struct {
-		__be16 port;
+		u_int16_t port;
 	} tcp;
 	struct {
 		u_int16_t port;

@@ -29,7 +29,7 @@ union ip_conntrack_manip_proto
 		u_int16_t port;
 	} sctp;
 	struct {
-		__be16 key;	/* key is 32bit, pptp only uses 16 */
+		u_int16_t key;	/* key is 32bit, pptp only uses 16 */
 	} gre;
 };
 

@@ -65,7 +65,7 @@ struct ip_conntrack_tuple
 				u_int16_t port;
 			} sctp;
 			struct {
-				__be16 key;	/* key is 32bit, 
+				u_int16_t key;	/* key is 32bit, 
 						 * pptp only uses 16 */
 			} gre;
 		} u;

- Harald Welte <[email protected]>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

From: Harald Welte <[email protected]>
Date: Fri, 7 Oct 2005 12:31:05 +0200

I'm not applying this.

The reverting of endianness annotations would be a serious regression. If we need userland compatible defines we can either:

1) Do what iproute2 and friends do, which is ship sanitized kernel headers in their userland source tree.

2) As you suggest have a suitable __be* et al. define when __KERNEL__ is not set.

Actually... What's the problem anyways? #2 seems to already be done.

In linux/types.h we have:

#ifdef __CHECKER__
#define __bitwise __attribute__((bitwise))
#else
#define __bitwise
#endif

typedef __u16 __bitwise __le16;
typedef __u16 __bitwise __be16;
typedef __u32 __bitwise __le32;
typedef __u32 __bitwise __be32;
#if defined(__GNUC__) && !defined(__STRICT_ANSI__) typedef __u64 __bitwise __le64;
typedef __u64 __bitwise __be64;
#endif

And this should just work.

That isn't even protected by __KERNEL__, it's fully visible to userspace when you include linux/types.h

As I almost expected. But it was worth a try ;)

we're thinking about this, but concluded for ip_conntrack it's too late now. There is too much interdependency between dozens of files, so we'd have to have a script that grep/sed's what we really need :(

For nf_conntrack (in my git tree, pending for 2.6.15), we have a strict separation of all header files. Only the absolute minimum that is required by userspace goes into include/linux/netfilter/, and everything else into include/net/netfilter.

This way we make sure we can make a clean copy of everything in include/linux/netfilter/* and put that into userspace (i.e. libnfnetlink_conntrack, ...)

include/linux/netfilter_ipv4/ip_conntrack_tuple.h doesn't include <linux/types.h>, and the (existing, old) userspace code has no reason to include it before ip_conntrack_tuple.h either.

So as I just confirmed, adding a #include seems to be fixing the problem.

Please apply the patch below instead. Thanks!

[NETFILTER] Add missing include to ip_conntrack_tuple.h

Without this #include, __be16 is not defined and userspace programs will break.

---
commit 0b4f28e7d0a469b2877ac18619af9c9695972c09
tree ad8281918b1cee5678acca048ab502bc346364f5
parent f3c27d8351a2ad3aa586549680b83e19670d6815
author Harald Welte <[email protected]> Sat, 08 Oct 2005 00:15:03 +0200 committer Harald Welte <[email protected]> Sat, 08 Oct 2005 00:15:03 +0200

 include/linux/netfilter_ipv4/ip_conntrack_tuple.h |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

@@ -1,6 +1,8 @@
 #ifndef _IP_CONNTRACK_TUPLE_H
 #define _IP_CONNTRACK_TUPLE_H
 
+#include <linux/types.h>
+
 /* A `tuple' is a structure containing the information to uniquely
   identify a connection.  ie. if two packets have the same tuple, they
   are in the same connection; if not, they are not.

- Harald Welte <[email protected]>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

From: Harald Welte <[email protected]>
Date: Sat, 8 Oct 2005 00:15:00 +0200

Now that looks a lot better, applied.

Thanks!