net: netfilter: avoid implicit includes
Subsystems (5)
Florian Westphal
maintainercover net: netfilter: avoid implicit includes
There are various headers/subsystems that include xtables or nftables headers even though they are unrelated.
Also nf_conntrack relies on implicit includes, esp. for GRE internals, which get pulled in via nf_conntrack.h even though only nf_conntrack_proto_gre.c needs this.
Other locations should include pptp.h or gre.h as needed. Start to remove some of these entanglements.
Florian Westphal (2):
netfilter: nf_conntrack: don't rely on implicit includes
netfilter: don't include xt and nftables.h in unrelated subsystems
include/linux/audit.h | 1 - include/linux/netfilter/nf_conntrack_proto_gre.h | 3 --- include/net/netfilter/nf_conntrack.h | 1 + include/net/netfilter/nf_conntrack_tuple.h | 2 +- include/net/netfilter/nf_tables.h | 1 - net/bridge/netfilter/nf_conntrack_bridge.c | 3 +-- net/netfilter/nf_conntrack_h323_main.c | 1 + net/netfilter/nf_conntrack_netlink.c | 1 + net/netfilter/nf_conntrack_proto_gre.c | 2 ++ net/netfilter/nf_flow_table_ip.c | 2 ++ net/netfilter/nf_flow_table_offload.c | 1 + net/netfilter/nf_flow_table_path.c | 1 + net/netfilter/nf_nat_ovs.c | 3 +++ net/netfilter/nf_nat_proto.c | 1 + net/netfilter/nf_synproxy_core.c | 1 + net/netfilter/nf_tables_api.c | 1 + net/netfilter/nft_flow_offload.c | 1 + net/netfilter/nft_synproxy.c | 1 + net/sched/act_ct.c | 2 ++ net/sched/act_ctinfo.c | 1 + 20 files changed, 22 insertions(+), 8 deletions(-)
Signature · 1 line
2.52.0
Florian Westphal
maintainerPATCH 1/2 netfilter: nf_conntrack: don't rely on implicit includes
several netfilter compilation units rely on implicit includes coming from nf_conntrack_proto_gre.h.
Clean this up and add the required dependencies where needed.
nf_conntrack.h requires net_generic() helper.
Place various gre/ppp/vlan includes to where they are needed.
Signed-off-by Florian Westphal <[email protected]>
--- include/linux/netfilter/nf_conntrack_proto_gre.h | 3 --- include/net/netfilter/nf_conntrack.h | 1 + net/netfilter/nf_conntrack_netlink.c | 1 + net/netfilter/nf_conntrack_proto_gre.c | 2 ++ net/netfilter/nf_flow_table_ip.c | 2 ++ net/netfilter/nf_flow_table_offload.c | 1 + net/netfilter/nf_flow_table_path.c | 1 + net/netfilter/nf_nat_ovs.c | 3 +++ net/netfilter/nf_nat_proto.c | 1 + net/netfilter/nft_flow_offload.c | 1 + net/sched/act_ct.c | 2 ++ net/sched/act_ctinfo.c | 1 + 12 files changed, 16 insertions(+), 3 deletions(-)
include/linux/netfilter/nf_conntrack_proto_gre.h +0 -3
@@ -1,9 +1,6 @@/* SPDX-License-Identifier: GPL-2.0 */ #ifndef _CONNTRACK_PROTO_GRE_H #define _CONNTRACK_PROTO_GRE_H -#include <asm/byteorder.h> -#include <net/gre.h> -#include <net/pptp.h> struct nf_ct_gre { unsigned int stream_timeout;
include/net/netfilter/nf_conntrack.h +1 -0
@@ -16,6 +16,7 @@#include <linux/bitops.h> #include <linux/compiler.h> +#include <net/netns/generic.h> #include <linux/netfilter/nf_conntrack_common.h> #include <linux/netfilter/nf_conntrack_tcp.h> #include <linux/netfilter/nf_conntrack_sctp.h>
net/netfilter/nf_conntrack_netlink.c +1 -0
@@ -32,6 +32,7 @@#include <linux/siphash.h> #include <linux/netfilter.h> +#include <net/ipv6.h> #include <net/netlink.h> #include <net/sock.h> #include <net/netfilter/nf_conntrack.h>
net/netfilter/nf_conntrack_proto_gre.c +2 -0
@@ -33,12 +33,14 @@#include <linux/skbuff.h> #include <linux/slab.h> #include <net/dst.h> +#include <net/gre.h> #include <net/net_namespace.h> #include <net/netns/generic.h> #include <net/netfilter/nf_conntrack_l4proto.h> #include <net/netfilter/nf_conntrack_helper.h> #include <net/netfilter/nf_conntrack_core.h> #include <net/netfilter/nf_conntrack_timeout.h> +#include <net/pptp.h> #include <linux/netfilter/nf_conntrack_proto_gre.h> #include <linux/netfilter/nf_conntrack_pptp.h>
net/netfilter/nf_flow_table_ip.c +2 -0
@@ -8,6 +8,8 @@#include <linux/ipv6.h> #include <linux/netdevice.h> #include <linux/if_ether.h> +#include <linux/if_vlan.h> +#include <net/gre.h> #include <net/gso.h> #include <net/ip.h> #include <net/ipv6.h>
net/netfilter/nf_flow_table_offload.c +1 -0
@@ -6,6 +6,7 @@#include <linux/netdevice.h> #include <linux/tc_act/tc_csum.h> #include <net/flow_offload.h> +#include <net/ip_tunnels.h> #include <net/netfilter/nf_flow_table.h> #include <net/netfilter/nf_tables.h> #include <net/netfilter/nf_conntrack.h>
net/netfilter/nf_flow_table_path.c +1 -0
@@ -2,6 +2,7 @@#include <linux/kernel.h> #include <linux/module.h> #include <linux/init.h> +#include <linux/etherdevice.h> #include <linux/netlink.h> #include <linux/netfilter.h> #include <linux/spinlock.h>
net/netfilter/nf_nat_ovs.c +3 -0
@@ -2,6 +2,9 @@/* Support nat functions for openvswitch and used by OVS and TC conntrack. */ #include <net/netfilter/nf_nat.h> +#include <net/ipv6.h> +#include <linux/ip.h> +#include <linux/if_vlan.h> /* Modelled after nf_nat_ipv[46]_fn(). * range is only used for new, uninitialized NAT state.
net/netfilter/nf_nat_proto.c +1 -0
@@ -25,6 +25,7 @@#include <net/ip6_route.h> #include <net/xfrm.h> #include <net/ipv6.h> +#include <net/pptp.h> #include <net/netfilter/nf_conntrack_core.h> #include <net/netfilter/nf_conntrack.h>
net/netfilter/nft_flow_offload.c +1 -0
@@ -1,4 +1,5 @@// SPDX-License-Identifier: GPL-2.0-only +#include <linux/etherdevice.h> #include <linux/kernel.h> #include <linux/module.h> #include <linux/init.h>
net/sched/act_ct.c +2 -0
@@ -13,9 +13,11 @@#include <linux/skbuff.h> #include <linux/rtnetlink.h> #include <linux/pkt_cls.h> +#include <linux/if_tunnel.h> #include <linux/ip.h> #include <linux/ipv6.h> #include <linux/rhashtable.h> +#include <net/gre.h> #include <net/netlink.h> #include <net/pkt_sched.h> #include <net/pkt_cls.h>
net/sched/act_ctinfo.c +1 -0
@@ -16,6 +16,7 @@#include <net/pkt_sched.h> #include <net/act_api.h> #include <net/pkt_cls.h> +#include <net/inet_ecn.h> #include <uapi/linux/tc_act/tc_ctinfo.h> #include <net/tc_act/tc_ctinfo.h> #include <net/tc_wrapper.h>
Signature · 1 line
2.52.0
kernel test robot
build botRe: [PATCH nf-next 1/2] netfilter: nf_conntrack: don't rely on implicit includes
kernel test robot noticed the following build errors:
Hi Florian,
kernel test robot noticed the following build errors:
[auto build test ERROR on netfilter-nf/main]
[also build test ERROR on pcmoore-audit/next next-20260108] [cannot apply to nf-next/master linus/master v6.16-rc1]
[If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Florian-Westphal/netfilter-nf_conntrack-don-t-rely-on-implicit-includes/20260108-012311 base: https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git main patch link: https://lore.kernel.org/r/20260107152548.31769-2-fw%40strlen.de patch subject: [PATCH nf-next 1/2] netfilter: nf_conntrack: don't rely on implicit includes config: x86_64-rhel-9.4-bpf (https://download.01.org/0day-ci/archive/20260108/[email protected]/config) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260108/[email protected]/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Closes: https://lore.kernel.org/oe-kbuild-all/[email protected]/
All errors (new ones prefixed by >>):
net/netfilter/nf_conntrack_bpf.c: In function 'bpf_skb_ct_alloc':
>> net/netfilter/nf_conntrack_bpf.c:367:46: error: implicit declaration of function 'sock_net'; did you mean 'check_net'? [-Wimplicit-function-declaration]
367 | net = skb->dev ? dev_net(skb->dev) : sock_net(skb->sk);
| ^~~~~~~~
| check_net
>> net/netfilter/nf_conntrack_bpf.c:367:44: error: pointer/integer type mismatch in conditional expression [-Wint-conversion]
367 | net = skb->dev ? dev_net(skb->dev) : sock_net(skb->sk);
| ^
net/netfilter/nf_conntrack_bpf.c: In function 'bpf_skb_ct_lookup':
net/netfilter/nf_conntrack_bpf.c:402:51: error: pointer/integer type mismatch in conditional expression [-Wint-conversion]
402 | caller_net = skb->dev ? dev_net(skb->dev) : sock_net(skb->sk);
| ^vim +367 net/netfilter/nf_conntrack_bpf.c
b4c2b9593a1c4c Kumar Kartikeya Dwivedi 2022-01-14 343
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 344 /* bpf_skb_ct_alloc - Allocate a new CT entry
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 345 *
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 346 * Parameters:
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 347 * @skb_ctx - Pointer to ctx (__sk_buff) in TC program
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 348 * Cannot be NULL
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 349 * @bpf_tuple - Pointer to memory representing the tuple to look up
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 350 * Cannot be NULL
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 351 * @tuple__sz - Length of the tuple structure
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 352 * Must be one of sizeof(bpf_tuple->ipv4) or
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 353 * sizeof(bpf_tuple->ipv6)
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 354 * @opts - Additional options for allocation (documented above)
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 355 * Cannot be NULL
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 356 * @opts__sz - Length of the bpf_ct_opts structure
ece4b296904167 Brad Cowie 2024-05-22 357 * Must be NF_BPF_CT_OPTS_SZ (16) or 12
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 358 */
400031e05adfce David Vernet 2023-02-01 359 __bpf_kfunc struct nf_conn___init *
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 360 bpf_skb_ct_alloc(struct __sk_buff *skb_ctx, struct bpf_sock_tuple *bpf_tuple,
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 361 u32 tuple__sz, struct bpf_ct_opts *opts, u32 opts__sz)
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 362 {
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 363 struct sk_buff *skb = (struct sk_buff *)skb_ctx;
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 364 struct nf_conn *nfct;
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 365 struct net *net;
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 366
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 @367 net = skb->dev ? dev_net(skb->dev) : sock_net(skb->sk);
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 368 nfct = __bpf_nf_ct_alloc_entry(net, bpf_tuple, tuple__sz, opts, opts__sz, 10);
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 369 if (IS_ERR(nfct)) {
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 370 if (opts)
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 371 opts->error = PTR_ERR(nfct);
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 372 return NULL;
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 373 }
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 374
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 375 return (struct nf_conn___init *)nfct;
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 376 }
d7e79c97c00ca8 Lorenzo Bianconi 2022-07-21 377 Signature · 2 lines
0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki
Florian Westphal
maintainerPATCH 2/2 netfilter: don't include xt and nftables.h in unrelated subsystems
In reply to Florian Westphalconntrack, xtables and nftables are distinct subsystems, don't use them in other subystems.
Signed-off-by Florian Westphal <[email protected]>
--- include/linux/audit.h | 1 - include/net/netfilter/nf_conntrack_tuple.h | 2 +- include/net/netfilter/nf_tables.h | 1 - net/bridge/netfilter/nf_conntrack_bridge.c | 3 +-- net/netfilter/nf_conntrack_h323_main.c | 1 + net/netfilter/nf_synproxy_core.c | 1 + net/netfilter/nf_tables_api.c | 1 + net/netfilter/nft_synproxy.c | 1 + 8 files changed, 6 insertions(+), 5 deletions(-)
include/linux/audit.h +0 -1
@@ -13,7 +13,6 @@#include <linux/ptrace.h> #include <linux/audit_arch.h> #include <uapi/linux/audit.h> -#include <uapi/linux/netfilter/nf_tables.h> #include <uapi/linux/fanotify.h> #define AUDIT_INO_UNSET ((unsigned long)-1)
include/net/netfilter/nf_conntrack_tuple.h +1 -1
@@ -11,7 +11,7 @@#ifndef _NF_CONNTRACK_TUPLE_H#define _NF_CONNTRACK_TUPLE_H -#include <linux/netfilter/x_tables.h> +#include <linux/netfilter.h> #include <linux/netfilter/nf_conntrack_tuple_common.h> #include <linux/list_nulls.h>
include/net/netfilter/nf_tables.h +0 -1
@@ -6,7 +6,6 @@#include <linux/list.h> #include <linux/netfilter.h> #include <linux/netfilter/nfnetlink.h> -#include <linux/netfilter/x_tables.h> #include <linux/netfilter/nf_tables.h> #include <linux/u64_stats_sync.h> #include <linux/rhashtable.h>
net/bridge/netfilter/nf_conntrack_bridge.c +1 -2
@@ -16,8 +16,7 @@#include <net/netfilter/nf_conntrack_helper.h> #include <net/netfilter/nf_conntrack_bridge.h> -#include <linux/netfilter/nf_tables.h> -#include <net/netfilter/nf_tables.h> +#include <linux/netfilter_ipv4.h> #include "../br_private.h"
net/netfilter/nf_conntrack_h323_main.c +1 -0
@@ -23,6 +23,7 @@#include <linux/skbuff.h> #include <net/route.h> #include <net/ip6_route.h> +#include <linux/netfilter_ipv4.h> #include <linux/netfilter_ipv6.h> #include <net/netfilter/nf_conntrack.h>
net/netfilter/nf_synproxy_core.c +1 -0
@@ -10,6 +10,7 @@#include <net/netns/generic.h> #include <linux/proc_fs.h> +#include <linux/netfilter_ipv4.h> #include <linux/netfilter_ipv6.h> #include <linux/netfilter/nf_synproxy.h>
net/netfilter/nf_tables_api.c +1 -0
@@ -14,6 +14,7 @@#include <linux/rhashtable.h> #include <linux/audit.h> #include <linux/netfilter.h> +#include <linux/netfilter_ipv4.h> #include <linux/netfilter/nfnetlink.h> #include <linux/netfilter/nf_tables.h> #include <net/netfilter/nf_flow_table.h>
net/netfilter/nft_synproxy.c +1 -0
@@ -7,6 +7,7 @@#include <net/netfilter/nf_conntrack.h> #include <net/netfilter/nf_conntrack_synproxy.h> #include <net/netfilter/nf_synproxy.h> +#include <linux/netfilter_ipv4.h> #include <linux/netfilter/nf_tables.h> #include <linux/netfilter/nf_synproxy.h>
Signature · 1 line
2.52.0