Skip to content

Fix install time error of glb-redirect on ubuntu noble#194

Open
mpenny-github wants to merge 5 commits into
masterfrom
glb_redirect_fix
Open

Fix install time error of glb-redirect on ubuntu noble#194
mpenny-github wants to merge 5 commits into
masterfrom
glb_redirect_fix

Conversation

@mpenny-github

Copy link
Copy Markdown
Contributor

The glb-redirect-iptables-dkms package failed to build on Ubuntu Noble (kernel 6.8+) because two things in the source are incompatible with newer kernels and toolchains.

  1. The kernel module passed a third argument to __cookie_v[46]_check(), which dropped that argument in the 6.x kernel API.
  2. The userspace xtables target defined a _init() function that collides with crti.o's _init on Noble's gcc-13/binutils.
# Kernel module (DKMS build, kernel 6.8):
ipt_GLBREDIRECT.c: In function 'glbredirect_tg4':
ipt_GLBREDIRECT.c:614:51: error: too many arguments to function '__cookie_v4_check'
  614 |     int mss = __cookie_v4_check(iph_v4, th, ntohl(th->ack_seq) - 1);
      |                                                   ^~~~~~~~~~~~~
In file included from ipt_GLBREDIRECT.c:NN:
.../include/net/tcp.h:NNN:5: note: declared here
  NNN | int __cookie_v4_check(const struct iphdr *iph, const struct tcphdr *th);
      |     ^~~~~~~~~~~~~~~~~
ipt_GLBREDIRECT.c:654:51: error: too many arguments to function '__cookie_v6_check'
  654 |     int mss = __cookie_v6_check(iph_v6, th, ntohl(th->ack_seq) - 1);
      |                                                   ^~~~~~~~~~~~~

# Userspace xtables target (link stage, gcc-13/binutils on noble):
/usr/bin/ld: libxt_GLBREDIRECT.c:(.text+0xNN): multiple definition of `_init';
  /usr/lib/x86_64-linux-gnu/crti.o:(.init+0x0): first defined here
collect2: error: ld returned 1 exit status
make: *** [Makefile:35: libxt_GLBREDIRECT.so] Error 1

Because the package ships as a source-only DKMS deb, these errors only surfaced at install time and were never caught in CI. The fix version-guards the cookie calls and replaces _init() with a constructor function, plus adds a compile check to the test suite.

Copilot AI review requested due to automatic review settings June 26, 2026 14:28
GitHub Advanced Security started work on behalf of mpenny-github June 26, 2026 14:28 View session
GitHub Advanced Security finished work on behalf of mpenny-github June 26, 2026 14:29

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes Ubuntu Noble (kernel 6.8+/newer toolchains) install-time build failures for the glb-redirect-iptables-dkms source-only DKMS package by updating both the kernel module and the userspace xtables plugin, and adding a compile-time build check to catch regressions earlier in CI.

Changes:

  • Version-guards __cookie_v[46]_check() calls to match newer kernel APIs.
  • Replaces the userspace _init() entry point with a constructor to avoid linker symbol collisions on newer toolchains.
  • Adds a compile-check step to the glb-redirect test script to build the kernel module and xtables target in CI.
Show a summary per file
File Description
src/glb-redirect/script/test Adds a compile-check that builds ipt_GLBREDIRECT.ko and libxt_GLBREDIRECT.so during tests.
src/glb-redirect/libxt_GLBREDIRECT.c Switches from legacy _init to a constructor-based registration function for the xtables target.
src/glb-redirect/ipt_GLBREDIRECT.c Adds kernel-version guards around syncookie __cookie_v4_check/__cookie_v6_check calls.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 3/3 changed files
  • Comments generated: 3
  • Review effort level: Low

Comment thread src/glb-redirect/ipt_GLBREDIRECT.c Outdated
Comment thread src/glb-redirect/ipt_GLBREDIRECT.c Outdated
Comment thread src/glb-redirect/script/test
A fixed LINUX_VERSION_CODE guard is unreliable because distributions
backport the removal of the trailing 'cookie' argument (dropped upstream
in Linux 6.8) into earlier kernels. Probe net/tcp.h in the Makefile and
pass the detected arity to the C code, falling back to a version
heuristic only when the header cannot be read.
GitHub Advanced Security started work on behalf of mpenny-github June 26, 2026 14:59 View session
GitHub Advanced Security finished work on behalf of mpenny-github June 26, 2026 14:59
…ructive

The compile-check temporarily strips lines the build image injects into
the in-tree kasan/kcsan kernel headers. Previously it edited them in
place with sed -i and never restored them, leaving persistent changes on
real hosts/Vagrant VMs (e.g. under sudo script/test) that could break
other builds. Back the headers up before patching and restore them on
any exit (success, failure, or signal) via a trap.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review details

  • Files reviewed: 4/4 changed files
  • Comments generated: 2
  • Review effort level: Low

Comment thread src/glb-redirect/script/test
Comment thread src/glb-redirect/Makefile
Use a defensive parameter expansion and rm -rf -- so restore_headers()
can never fail under set -e ('missing operand') or delete an unintended
path if backup_dir is ever empty/unset.
…found

The previous probe piped awk to 'grep -c u32', which yields 0 both when
the 2-arg form is present AND when __cookie_v4_check() isn't found at all,
wrongly forcing GLB_COOKIE_CHECK_NO_COOKIE_ARG in the latter case. Capture
the declaration text instead and only emit a define when it is actually
found (using findstring to pick the form); otherwise emit nothing so the
C code falls back to its LINUX_VERSION_CODE heuristic as documented.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review details

  • Files reviewed: 4/4 changed files
  • Comments generated: 0 new
  • Review effort level: Medium

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants