Hi all. I need to compile kernel module, in my case it is NFT_OBJREF, but it is not selected by default. What could be the easiest way to get it compiled as module without touching make menu_kernelconfig? I need to do some tests with nft_objref and do not really know which user space module is triggering selection of that kernel module, so would be nice just to somehow build it as .
make menuconfig of the OpenWRT build system should reveal what is pulling it in within the "help" for the module. find and fgrep of the Makefiles should also accomplish that.
I've never built a single kernel module. The whole build process is reasonably fast once the cross tools are built.
Edit -- While I compile nftables in my builds, I don't see that module in my output, nor do I see it in any of the Makefiles.
lede_source$ fgrep -i nft .config
# CONFIG_PACKAGE_kmod-nft-arp is not set
CONFIG_PACKAGE_kmod-nft-bridge=y
CONFIG_PACKAGE_kmod-nft-core=y
# CONFIG_PACKAGE_kmod-nft-nat is not set
# CONFIG_PACKAGE_kmod-nft-nat6 is not set
CONFIG_PACKAGE_libnftnl=y
# CONFIG_IPTABLES_NFTABLES is not set
CONFIG_PACKAGE_nftables=y
lede_source$ find package feeds -name Makefile -exec fgrep -Hi objref {} \;
[no output]
Edit: I also don't see any module of that name in lsmod nor in the kernel module directory on an Ubuntu system that uses nftables for its firewall
4.13.0-39-generic #44-Ubuntu SMP Thu Apr 5 14:25:01 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
You can search in make menuconfig by using the "/" backslash search function.
Hi. Thanks for help.
I have that module defined in kernel config file placed at /source/target/linux/generic/config-4.14/.config. It was defined as
# CONFIG_NFT_OBJREF is not set
Then I changed it to =y and compiled. Compilation went fine, I got file nft_objref.ko, but it was not part of an image. So I needed manually to copy it to /lib/modules/4.14.37/ in the router and do insmod nft_objref. Now, my knowledge is lacking a bit in order to make nft_objref.ko a part of image after compilation. Would be great if you could help me with some guidance.
Now small pre-history, why I need this module. I'm using nftables v.0.8.2 and apparently custom helpers are not working. I just can't add any custom helper in my rule set. Nftables returns error saying that file or folder is not found. So I've got some ideas on netfilter mailing lists. Apparently helpers must work out of the box on nftables, but if it doesn't. In that case it makes sense to try with nft_objref module. And yes, now helpers (also custom ones) are working without any problems with nft_objref module loaded.
So again, I'd really appreciate if you could help me with adding nft_objref module to final image. I'd like to have it as a part of compilation/building.
Ah, I'm on a 4.9 kernel for OpenWRT and not yet on 4.14 or later for my Debian/Ubuntu machines.
I would imagine that make menuconfig should reveal CONFIG_NFT_OBJREF somewhere. The search feature works pretty well (/ key). Setting the "found" menu item to * should result in it being build and included in the image.
It's still somewhat puzzling as
https://wiki.nftables.org/wiki-nftables/index.php/List_of_updates_since_Linux_kernel_3.13#4.15
suggests that "Fetch single elements of a set (i.e, nft get element)" was introduced in 4.15.
Perhaps a version mismatch somehow between your userspace build and the kernel?
Maybe a userspace script trying to use an unsupported feature in nft for 4.14?
Edit: I do see the config parameter in https://github.com/torvalds/linux/blob/v4.14/net/netfilter/Makefile
0util@util0:~/br/wrtpac/source/target$ grep -r NFT_OBJREF
linux/generic/config-4.14:# CONFIG_NFT_OBJREF is not set
linux/generic/backport-4.14/326-netfilter-nf_tables-flow-offload-expression.patch: obj-$(CONFIG_NFT_OBJREF) += nft_objref.o
Not sure as to target, but:
target/linux/??target??/config-4.14
add
CONFIG_NFT_OBJREF=y
may be required to address the actual inclusion.
I guess that would be a forward slash, oh-well
Ok.
@jeff. Search with / key in make menuconfig does not reveal anything (I search for nft_objref). So that is a bit strange. I'm building latest trunk version and I was hoping that nftables version used in trunk must be compatible with currently used kernel. Otherwise it does not make any sense.
@anomeome. I have already done that yesterday as explained in my post. make V=s generated me nft_objref.ko module, but it was not included in the final image.
I'm quite sure, that manipulating a bit in /net/netfilter/Makefile would give result I want, but I'm not really sure where should I add nft_objref.o in Makefile, so that it becomes compiled in the kernel.
Ok, still struggling. What I have tried was to grep all files for nf_conntrack_ftp. Took it as an example, as it is being built like module and it is being added to the final image. Everything I found in .config and Makefile was the same settings as for nft_objref. So I'm really lost. All kernel netfilter modules that are built as <m> are stored in /source/build_dir/target-x86_64_musl/linux-x86_64/linux-4.14.37/net/netfilter, but they are also part of /source/build_dir/target-x86_64_musl/root-x86/lib/modules/4.14.37/ (excecpt of nft_objref) and all modules from that location is a part of final image. I can't find any setting in order to force nft_objref to be copied to that location automatically. Hope that gives some more info and somebody could advice me how to fix this.