error: ‘NFPROTO_NETDEV’ undeclared here (not in a function); did you mean ‘NFPROTO_DECNET’?

[InputOutputZ]

Environment

• bpftool version: 7.6.0
• Linux kernel version: 6.9.7
• (optionally) clang/LLVM version: 4.8.5
• ...

Describe the bug

I tried to compile bpf tool on Linux 6.9.7 Kernel and it thows

...                        libbfd: [ OFF ]
...               clang-bpf-co-re: [ OFF ]
...                          llvm: [ OFF ]
...                        libcap: [ on  ]
  CC       link.o
link.c:660:10: error: ‘NFPROTO_NETDEV’ undeclared here (not in a function); did you mean ‘NFPROTO_DECNET’?
  660 |         [NFPROTO_NETDEV] = "netdev",
      |          ^~~~~~~~~~~~~~
      |          NFPROTO_DECNET
link.c:660:10: error: array index in initializer not of integer type
link.c:660:10: note: (near initialization for ‘pf2name’)
make: *** [Makefile:253: link.o] Error 1

I checked netfilter header file and its missing netdev enum entry yet I understood from online sources that bpftool doesn't rely on netfilter and wondered why do I get this error?

Is there any workaround to get bpf compiled? if not which linux kernels are compatible with bpftool?

Looking forward for any ideas, with thanks.

Zak.

[qmonnet]

Hi, and thanks for the report!

I understood from online sources that bpftool doesn't rely on netfilter

Correct, bpftool does not use Netfilter. However, BPF programs can be attached to Netfilter hooks, and as a consequence, bpftool supports dumping information on programs attached to these hooks - more specifically, bpftool link and bpftool net will show information on BPF links of type Netfilter and on programs attached on Netfilter hooks. This is why we have this mention of NFPROTO_NETDEV in the code.

I checked netfilter header file and its missing netdev enum entry yet

This is surprising. The entry has been around since Linux 4.2, back in 2015, if I'm not mistaken. Do you have the Linux UAPI headers installed on your system? This is also the first report I hear about this definition missing.

How about the other enum values for NFPROTO_..., by the way? Do you have NFPROTO_ARP defined? I don't understand why it would fail on NFPROTO_NETDEV, only. If you removed that array line with NFPROTO_NETDEV in pf2name(), would it build?

Is there any workaround to get bpf compiled? if not which linux kernels are compatible with bpftool?

Not sure what to say. It's supposed to build fine on Linux 6.9, unless maybe if you don't have the development headers. Do you have them installed on your system? (I'd expect more definitions to be missing if you don't have them, though). By the way, did you try to compile from this repo, or from the bpftool version in the Linux repository? Not that I expect any difference, I'm asking just in case.

[InputOutputZ]

Hi, and thanks for the report!

Hi, no problem.

This is surprising. The entry has been around since Linux 4.2, back in 2015, if I'm not mistaken. Do you have the Linux UAPI headers installed on your system? This is also the first report I hear about this definition missing.

It looks like elrepo mainline kernel last release which was published last year in June for CentOS 7 was modified and NETDEV was removed from and it doesnt have any kernel nor development headers available. So, I don't have kernel headers nor the development headers for Kernel 6.9.7 as I couldnt find available in /usr/src/kernels/ nor /lib/modules/. I couldn't find any available package to install from YUM.

How about the other enum values for NFPROTO_..., by the way? Do you have NFPROTO_ARP defined? I don't understand why it would fail on NFPROTO_NETDEV, only. If you removed that array line with NFPROTO_NETDEV in pf2name(), would it build?

I couldn't find any of these values NFPROTO_ARP and NFPROTO_NETDEV but when removed NFPROTO_NETDEV, I was able to compile and install bpftool successfully and yes it would build ^^.

Not sure what to say. It's supposed to build fine on Linux 6.9, unless maybe if you don't have the development headers. Do you have them installed on your system? (I'd expect more definitions to be missing if you don't have them, though). By the way, did you try to compile from this repo, or from the bpftool version in the Linux repository? Not that I expect any difference, I'm asking just in case.

I did try to compile from this repo. I don't have development headers for 6.9, but noticed older kernel 3.10.0 headers are installed as yum package and it could be the reason why bpftool is not throwing more errors.

I ran bpftool link and bpftool net commands and the latter outputs only the following:-

xdp:

tc:

flow_dissector:

netfilter:

Will play with it more and see if I can utilise bpftool with my usecase. I just wanted to write ebpf program to listen for certain events and hope omitting NETDEV wont cause any issue from long term.

Anyhow, it seems to be EOL distribution issue, and please close this issue ticket as resolved if you deem it as such, anyways with thanks for you assistance,.

Zak

[qmonnet]

OK thank you. I'll close for now, don't hesitate to report any interesting findings 🙂

[qmonnet]

Reopening this issue: Once https://lore.kernel.org/all/20250905224708.2469021-5-irogers@google.com/#t lands in bpf-next tree, we should probably synchronise netfilter.h and netfilter_arp.h UAPI headers from kernel's tools/include as well as part of the sync-up process - this should avoid this issue to come up on systems that don't have the right definitions for some reason.