iptables-netflow dkms build error on 5.15 jammy

[Andrea Righi]

[Impact]

iptables-netflow-dkms fails to build on the latest 5.15 jammy kernel:

/var/lib/dkms/ipt-netflow/2.5.1/build/ipt_NETFLOW.c: In function ‘netflow_conntrack_event’:
/var/lib/dkms/ipt-netflow/2.5.1/build/ipt_NETFLOW.c:4604:31: error: ‘struct nf_ct_event_notifier’ has no member named ‘fcn’
 4604 | ret = notifier->fcn(events, item);
      | ^~
/var/lib/dkms/ipt-netflow/2.5.1/build/ipt_NETFLOW.c: At top level:
/var/lib/dkms/ipt-netflow/2.5.1/build/ipt_NETFLOW.c:4669:10: error: ‘struct nf_ct_event_notifier’ has no member named ‘fcn’
 4669 | .fcn = netflow_conntrack_event
      | ^~~
/var/lib/dkms/ipt-netflow/2.5.1/build/ipt_NETFLOW.c:4669:16: error: initialization of ‘int (*)(unsigned int, const struct nf_ct_event *)’ from incompatible pointer type ‘int (*)(const unsigned int, struct nf_ct_event *)’ [-Werror=incompatible-pointer-types]
 4669 | .fcn = netflow_conntrack_event
      | ^~~~~~~~~~~~~~~~~~~~~~~
/var/lib/dkms/ipt-netflow/2.5.1/build/ipt_NETFLOW.c:4669:16: note: (near initialization for ‘ctnl_notifier.ct_event’)
/var/lib/dkms/ipt-netflow/2.5.1/build/ipt_NETFLOW.c: In function ‘unset_notifier_cb’:
/var/lib/dkms/ipt-netflow/2.5.1/build/ipt_NETFLOW.c:5437:25: error: too many arguments to function ‘nf_conntrack_unregister_notifier’
 5437 | nf_conntrack_unregister_notifier(NET_ARG &ctnl_notifier);
      | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ./include/net/netfilter/nf_conntrack_core.h:18,
                 from /var/lib/dkms/ipt-netflow/2.5.1/build/ipt_NETFLOW.c:67:
./include/net/netfilter/nf_conntrack_ecache.h:88:6: note: declared here
   88 | void nf_conntrack_unregister_notifier(struct net *net);
      | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from /var/lib/dkms/ipt-netflow/2.5.1/build/ipt_NETFLOW.c:78:
/var/lib/dkms/ipt-netflow/2.5.1/build/murmur3.h: In function ‘murmur3’:
/var/lib/dkms/ipt-netflow/2.5.1/build/murmur3.h:35:28: warning: this statement may fall through [-Wimplicit-fallthrough=]
   35 | case 3: k1 ^= tail[2] << 16; /* FALLTHROUGH */
      | ~~~^~~~~~~~~~~~~~~~
/var/lib/dkms/ipt-netflow/2.5.1/build/murmur3.h:36:17: note: here
   36 | case 2: k1 ^= tail[1] << 8; /* FALLTHROUGH */
      | ^~~~
/var/lib/dkms/ipt-netflow/2.5.1/build/murmur3.h:36:28: warning: this statement may fall through [-Wimplicit-fallthrough=]
   36 | case 2: k1 ^= tail[1] << 8; /* FALLTHROUGH */
      | ~~~^~~~~~~~~~~~~~~
/var/lib/dkms/ipt-netflow/2.5.1/build/murmur3.h:37:17: note: here
   37 | case 1: k1 ^= tail[0];
      | ^~~~
/var/lib/dkms/ipt-netflow/2.5.1/build/ipt_NETFLOW.c: In function ‘parse_sampler’:
/var/lib/dkms/ipt-netflow/2.5.1/build/ipt_NETFLOW.c:2216:21: warning: this statement may fall through [-Wimplicit-fallthrough=]
 2216 | ret = -EINVAL;
/var/lib/dkms/ipt-netflow/2.5.1/build/ipt_NETFLOW.c:2218:9: note: here
 2218 | case '\0': /* empty */
      | ^~~~

[Test case]

sudo apt install iptables-netflow-dkms

[Fix]

Adjust a few function prototype changes to properly build on 5.15. No logical changes are required to fix this issue.

[Regression potential]

We may see regressions in iptables-netflow with old kernels (< 5.15), but the changes are trivial so the risk of regressions is low.

[Andrea Righi (arighi)]

Attached debdiff fixes the build errors with 5.15.

[Dimitri John Ledkov (xnox)]

What about merging 2.6 from debian too?

[Dimitri John Ledkov (xnox)]

doing forced sync from debian to bring in v2.6, then will upload the proposed v5.15 patch on top.

[Launchpad Janitor (janitor)]

This bug was fixed in the package iptables-netflow - 2.6-2ubuntu1

---------------
iptables-netflow (2.6-2ubuntu1) jammy; urgency=medium

  * Support linux 5.15 (LP: #1951611)
    - debian/patches/0010-support-kernel-5.15.patch

 -- Andrea Righi <email address hidden> Fri, 19 Nov 2021 16:11:54 +0000