The VIR_WARNINGS_NO_CAST_ALIGN / VIR_WARNINGS_RESET should not have any trailing ';' since they are pragmas. The use of a ';' results in an empty statement which confuses CIL. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com&gt; --- src/nwfilter/nwfilter_dhcpsnoop.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/nwfilter/nwfilter_dhcpsnoop.c b/src/nwfilter/nwfilter_dhcpsnoop.c index e8fcfef..a96a790 100644 --- a/src/nwfilter/nwfilter_dhcpsnoop.c +++ b/src/nwfilter/nwfilter_dhcpsnoop.c @@ -981,9 +981,9 @@ virNWFilterSnoopDHCPDecode(virNWFilterSnoopReqPtr req, /* go through the protocol headers */ switch (ntohs(pep->eh_type)) { case ETHERTYPE_IP: - VIR_WARNINGS_NO_CAST_ALIGN; + VIR_WARNINGS_NO_CAST_ALIGN pip = (struct iphdr *) pep->eh_data; - VIR_WARNINGS_RESET; + VIR_WARNINGS_RESET len -= offsetof(virNWFilterSnoopEthHdr, eh_data); break; default: -- 1.8.4.2