[PATCH nf-next 0/2] net: netfilter: avoid implicit includes

Florian Westphal
2026-01-07T15:26:00Z

There are various headers/subsystems that include xtables or
nftables headers even though they are unrelated.

Also nf_conntrack relies on implicit includes, esp. for GRE
internals, which get pulled in via nf_conntrack.h even though only
nf_conntrack_proto_gre.c needs this.

Other locations should include pptp.h or gre.h as needed.
Start to remove some of these entanglements.

Florian Westphal (2):
netfilter: nf_conntrack: don't rely on implicit includes
netfilter: don't include xt and nftables.h in unrelated subsystems

include/linux/audit.h | 1 -
include/linux/netfilter/nf_conntrack_proto_gre.h | 3 ---
include/net/netfilter/nf_conntrack.h | 1 +
include/net/netfilter/nf_conntrack_tuple.h | 2 +-
include/net/netfilter/nf_tables.h | 1 -
net/bridge/netfilter/nf_conntrack_bridge.c | 3 +--
net/netfilter/nf_conntrack_h323_main.c | 1 +
net/netfilter/nf_conntrack_netlink.c | 1 +
net/netfilter/nf_conntrack_proto_gre.c | 2 ++
net/netfilter/nf_flow_table_ip.c | 2 ++
net/netfilter/nf_flow_table_offload.c | 1 +
net/netfilter/nf_flow_table_path.c | 1 +
net/netfilter/nf_nat_ovs.c | 3 +++
net/netfilter/nf_nat_proto.c | 1 +
net/netfilter/nf_synproxy_core.c | 1 +
net/netfilter/nf_tables_api.c | 1 +
net/netfilter/nft_flow_offload.c | 1 +
net/netfilter/nft_synproxy.c | 1 +
net/sched/act_ct.c | 2 ++
net/sched/act_ctinfo.c | 1 +
20 files changed, 22 insertions(+), 8 deletions(-)

--
2.52.0