[PATCH nf-next 0/2] net: netfilter: avoid implicit includes

public inbox for bridge@lists.linux.dev
 help / color / mirror / Atom feed

* [PATCH nf-next 0/2] net: netfilter: avoid implicit includes
@ 2026-01-07 15:24 Florian Westphal
  2026-01-07 15:24 ` [PATCH nf-next 1/2] netfilter: nf_conntrack: don't rely on " Florian Westphal
  2026-01-07 15:24 ` [PATCH nf-next 2/2] netfilter: don't include xt and nftables.h in unrelated subsystems Florian Westphal
  0 siblings, 2 replies; 4+ messages in thread
From: Florian Westphal @ 2026-01-07 15:24 UTC (permalink / raw)
  To: netfilter-devel
  Cc: jhs, xiyou.wangcong, jiri, audit, bridge, Florian Westphal

There are various headers/subsystems that include xtables or
nftables headers even though they are unrelated.

Also nf_conntrack relies on implicit includes, esp. for GRE
internals, which get pulled in via nf_conntrack.h even though only
nf_conntrack_proto_gre.c needs this.

Other locations should include pptp.h or gre.h as needed.
Start to remove some of these entanglements.

Florian Westphal (2):
  netfilter: nf_conntrack: don't rely on implicit includes
  netfilter: don't include xt and nftables.h in unrelated subsystems

 include/linux/audit.h                            | 1 -
 include/linux/netfilter/nf_conntrack_proto_gre.h | 3 ---
 include/net/netfilter/nf_conntrack.h             | 1 +
 include/net/netfilter/nf_conntrack_tuple.h       | 2 +-
 include/net/netfilter/nf_tables.h                | 1 -
 net/bridge/netfilter/nf_conntrack_bridge.c       | 3 +--
 net/netfilter/nf_conntrack_h323_main.c           | 1 +
 net/netfilter/nf_conntrack_netlink.c             | 1 +
 net/netfilter/nf_conntrack_proto_gre.c           | 2 ++
 net/netfilter/nf_flow_table_ip.c                 | 2 ++
 net/netfilter/nf_flow_table_offload.c            | 1 +
 net/netfilter/nf_flow_table_path.c               | 1 +
 net/netfilter/nf_nat_ovs.c                       | 3 +++
 net/netfilter/nf_nat_proto.c                     | 1 +
 net/netfilter/nf_synproxy_core.c                 | 1 +
 net/netfilter/nf_tables_api.c                    | 1 +
 net/netfilter/nft_flow_offload.c                 | 1 +
 net/netfilter/nft_synproxy.c                     | 1 +
 net/sched/act_ct.c                               | 2 ++
 net/sched/act_ctinfo.c                           | 1 +
 20 files changed, 22 insertions(+), 8 deletions(-)

-- 
2.52.0


^ permalink raw reply	[flat|nested] 4+ messages in thread

* [PATCH nf-next 1/2] netfilter: nf_conntrack: don't rely on implicit includes
  2026-01-07 15:24 [PATCH nf-next 0/2] net: netfilter: avoid implicit includes Florian Westphal
@ 2026-01-07 15:24 ` Florian Westphal
  2026-01-08 18:27   ` kernel test robot
  2026-01-07 15:24 ` [PATCH nf-next 2/2] netfilter: don't include xt and nftables.h in unrelated subsystems Florian Westphal
  1 sibling, 1 reply; 4+ messages in thread
From: Florian Westphal @ 2026-01-07 15:24 UTC (permalink / raw)
  To: netfilter-devel
  Cc: jhs, xiyou.wangcong, jiri, audit, bridge, Florian Westphal

several netfilter compilation units rely on implicit includes
coming from nf_conntrack_proto_gre.h.

Clean this up and add the required dependencies where needed.

nf_conntrack.h requires net_generic() helper.
Place various gre/ppp/vlan includes to where they are needed.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 include/linux/netfilter/nf_conntrack_proto_gre.h | 3 ---
 include/net/netfilter/nf_conntrack.h             | 1 +
 net/netfilter/nf_conntrack_netlink.c             | 1 +
 net/netfilter/nf_conntrack_proto_gre.c           | 2 ++
 net/netfilter/nf_flow_table_ip.c                 | 2 ++
 net/netfilter/nf_flow_table_offload.c            | 1 +
 net/netfilter/nf_flow_table_path.c               | 1 +
 net/netfilter/nf_nat_ovs.c                       | 3 +++
 net/netfilter/nf_nat_proto.c                     | 1 +
 net/netfilter/nft_flow_offload.c                 | 1 +
 net/sched/act_ct.c                               | 2 ++
 net/sched/act_ctinfo.c                           | 1 +
 12 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/include/linux/netfilter/nf_conntrack_proto_gre.h b/include/linux/netfilter/nf_conntrack_proto_gre.h
index 34ce5d2f37a2..9ee7014400e8 100644
--- a/include/linux/netfilter/nf_conntrack_proto_gre.h
+++ b/include/linux/netfilter/nf_conntrack_proto_gre.h
@@ -1,9 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0 */
 #ifndef _CONNTRACK_PROTO_GRE_H
 #define _CONNTRACK_PROTO_GRE_H
-#include <asm/byteorder.h>
-#include <net/gre.h>
-#include <net/pptp.h>
 
 struct nf_ct_gre {
 	unsigned int stream_timeout;
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index aa0a7c82199e..bc42dd0e10e6 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -16,6 +16,7 @@
 #include <linux/bitops.h>
 #include <linux/compiler.h>
 
+#include <net/netns/generic.h>
 #include <linux/netfilter/nf_conntrack_common.h>
 #include <linux/netfilter/nf_conntrack_tcp.h>
 #include <linux/netfilter/nf_conntrack_sctp.h>
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 3a04665adf99..662f6bbfa805 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -32,6 +32,7 @@
 #include <linux/siphash.h>
 
 #include <linux/netfilter.h>
+#include <net/ipv6.h>
 #include <net/netlink.h>
 #include <net/sock.h>
 #include <net/netfilter/nf_conntrack.h>
diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
index af369e686fc5..b894bb7a97ad 100644
--- a/net/netfilter/nf_conntrack_proto_gre.c
+++ b/net/netfilter/nf_conntrack_proto_gre.c
@@ -33,12 +33,14 @@
 #include <linux/skbuff.h>
 #include <linux/slab.h>
 #include <net/dst.h>
+#include <net/gre.h>
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/nf_conntrack_timeout.h>
+#include <net/pptp.h>
 #include <linux/netfilter/nf_conntrack_proto_gre.h>
 #include <linux/netfilter/nf_conntrack_pptp.h>
 
diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
index 78883343e5d6..11da560f38bf 100644
--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c
@@ -8,6 +8,8 @@
 #include <linux/ipv6.h>
 #include <linux/netdevice.h>
 #include <linux/if_ether.h>
+#include <linux/if_vlan.h>
+#include <net/gre.h>
 #include <net/gso.h>
 #include <net/ip.h>
 #include <net/ipv6.h>
diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
index d8f7bfd60ac6..b1966b68c48a 100644
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -6,6 +6,7 @@
 #include <linux/netdevice.h>
 #include <linux/tc_act/tc_csum.h>
 #include <net/flow_offload.h>
+#include <net/ip_tunnels.h>
 #include <net/netfilter/nf_flow_table.h>
 #include <net/netfilter/nf_tables.h>
 #include <net/netfilter/nf_conntrack.h>
diff --git a/net/netfilter/nf_flow_table_path.c b/net/netfilter/nf_flow_table_path.c
index eb24fe2715dc..6bb9579dcc2a 100644
--- a/net/netfilter/nf_flow_table_path.c
+++ b/net/netfilter/nf_flow_table_path.c
@@ -2,6 +2,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/etherdevice.h>
 #include <linux/netlink.h>
 #include <linux/netfilter.h>
 #include <linux/spinlock.h>
diff --git a/net/netfilter/nf_nat_ovs.c b/net/netfilter/nf_nat_ovs.c
index 0f9a559f6207..31474e8c034a 100644
--- a/net/netfilter/nf_nat_ovs.c
+++ b/net/netfilter/nf_nat_ovs.c
@@ -2,6 +2,9 @@
 /* Support nat functions for openvswitch and used by OVS and TC conntrack. */
 
 #include <net/netfilter/nf_nat.h>
+#include <net/ipv6.h>
+#include <linux/ip.h>
+#include <linux/if_vlan.h>
 
 /* Modelled after nf_nat_ipv[46]_fn().
  * range is only used for new, uninitialized NAT state.
diff --git a/net/netfilter/nf_nat_proto.c b/net/netfilter/nf_nat_proto.c
index b14a434b9561..97c0f841fc96 100644
--- a/net/netfilter/nf_nat_proto.c
+++ b/net/netfilter/nf_nat_proto.c
@@ -25,6 +25,7 @@
 #include <net/ip6_route.h>
 #include <net/xfrm.h>
 #include <net/ipv6.h>
+#include <net/pptp.h>
 
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/nf_conntrack.h>
diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
index b8f76c9057fd..179d0e59e2b5 100644
--- a/net/netfilter/nft_flow_offload.c
+++ b/net/netfilter/nft_flow_offload.c
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0-only
+#include <linux/etherdevice.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
index 2b6ac7069dc1..81d488655793 100644
--- a/net/sched/act_ct.c
+++ b/net/sched/act_ct.c
@@ -13,9 +13,11 @@
 #include <linux/skbuff.h>
 #include <linux/rtnetlink.h>
 #include <linux/pkt_cls.h>
+#include <linux/if_tunnel.h>
 #include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <linux/rhashtable.h>
+#include <net/gre.h>
 #include <net/netlink.h>
 #include <net/pkt_sched.h>
 #include <net/pkt_cls.h>
diff --git a/net/sched/act_ctinfo.c b/net/sched/act_ctinfo.c
index 71efe04d00b5..d2c750bab1d3 100644
--- a/net/sched/act_ctinfo.c
+++ b/net/sched/act_ctinfo.c
@@ -16,6 +16,7 @@
 #include <net/pkt_sched.h>
 #include <net/act_api.h>
 #include <net/pkt_cls.h>
+#include <net/inet_ecn.h>
 #include <uapi/linux/tc_act/tc_ctinfo.h>
 #include <net/tc_act/tc_ctinfo.h>
 #include <net/tc_wrapper.h>
-- 
2.52.0


^ permalink raw reply related	[flat|nested] 4+ messages in thread

* Re: [PATCH nf-next 1/2] netfilter: nf_conntrack: don't rely on implicit includes
  2026-01-07 15:24 ` [PATCH nf-next 1/2] netfilter: nf_conntrack: don't rely on " Florian Westphal
@ 2026-01-08 18:27   ` kernel test robot
  0 siblings, 0 replies; 4+ messages in thread
From: kernel test robot @ 2026-01-08 18:27 UTC (permalink / raw)
  To: Florian Westphal, netfilter-devel
  Cc: oe-kbuild-all, jhs, xiyou.wangcong, jiri, audit, bridge,
	Florian Westphal

Hi Florian,

kernel test robot noticed the following build errors:

[auto build test ERROR on netfilter-nf/main]
[also build test ERROR on pcmoore-audit/next next-20260108]
[cannot apply to nf-next/master linus/master v6.16-rc1]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Florian-Westphal/netfilter-nf_conntrack-don-t-rely-on-implicit-includes/20260108-012311
base:   https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git main
patch link:    https://lore.kernel.org/r/20260107152548.31769-2-fw%40strlen.de
patch subject: [PATCH nf-next 1/2] netfilter: nf_conntrack: don't rely on implicit includes
config: x86_64-rhel-9.4-bpf (https://download.01.org/0day-ci/archive/20260108/202601081929.C2oDWexU-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260108/202601081929.C2oDWexU-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202601081929.C2oDWexU-lkp@intel.com/

All errors (new ones prefixed by >>):

   net/netfilter/nf_conntrack_bpf.c: In function 'bpf_skb_ct_alloc':
>> net/netfilter/nf_conntrack_bpf.c:367:46: error: implicit declaration of function 'sock_net'; did you mean 'check_net'? [-Wimplicit-function-declaration]
     367 |         net = skb->dev ? dev_net(skb->dev) : sock_net(skb->sk);
         |                                              ^~~~~~~~
         |                                              check_net
>> net/netfilter/nf_conntrack_bpf.c:367:44: error: pointer/integer type mismatch in conditional expression [-Wint-conversion]
     367 |         net = skb->dev ? dev_net(skb->dev) : sock_net(skb->sk);
         |                                            ^
   net/netfilter/nf_conntrack_bpf.c: In function 'bpf_skb_ct_lookup':
   net/netfilter/nf_conntrack_bpf.c:402:51: error: pointer/integer type mismatch in conditional expression [-Wint-conversion]
     402 |         caller_net = skb->dev ? dev_net(skb->dev) : sock_net(skb->sk);
         |                                                   ^


vim +367 net/netfilter/nf_conntrack_bpf.c

b4c2b9593a1c4c Kumar Kartikeya Dwivedi 2022-01-14  343  
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  344  /* bpf_skb_ct_alloc - Allocate a new CT entry
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  345   *
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  346   * Parameters:
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  347   * @skb_ctx	- Pointer to ctx (__sk_buff) in TC program
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  348   *		    Cannot be NULL
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  349   * @bpf_tuple	- Pointer to memory representing the tuple to look up
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  350   *		    Cannot be NULL
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  351   * @tuple__sz	- Length of the tuple structure
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  352   *		    Must be one of sizeof(bpf_tuple->ipv4) or
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  353   *		    sizeof(bpf_tuple->ipv6)
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  354   * @opts	- Additional options for allocation (documented above)
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  355   *		    Cannot be NULL
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  356   * @opts__sz	- Length of the bpf_ct_opts structure
ece4b296904167 Brad Cowie              2024-05-22  357   *		    Must be NF_BPF_CT_OPTS_SZ (16) or 12
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  358   */
400031e05adfce David Vernet            2023-02-01  359  __bpf_kfunc struct nf_conn___init *
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  360  bpf_skb_ct_alloc(struct __sk_buff *skb_ctx, struct bpf_sock_tuple *bpf_tuple,
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  361  		 u32 tuple__sz, struct bpf_ct_opts *opts, u32 opts__sz)
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  362  {
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  363  	struct sk_buff *skb = (struct sk_buff *)skb_ctx;
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  364  	struct nf_conn *nfct;
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  365  	struct net *net;
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  366  
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21 @367  	net = skb->dev ? dev_net(skb->dev) : sock_net(skb->sk);
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  368  	nfct = __bpf_nf_ct_alloc_entry(net, bpf_tuple, tuple__sz, opts, opts__sz, 10);
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  369  	if (IS_ERR(nfct)) {
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  370  		if (opts)
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  371  			opts->error = PTR_ERR(nfct);
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  372  		return NULL;
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  373  	}
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  374  
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  375  	return (struct nf_conn___init *)nfct;
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  376  }
d7e79c97c00ca8 Lorenzo Bianconi        2022-07-21  377  

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

^ permalink raw reply	[flat|nested] 4+ messages in thread

* [PATCH nf-next 2/2] netfilter: don't include xt and nftables.h in unrelated subsystems
  2026-01-07 15:24 [PATCH nf-next 0/2] net: netfilter: avoid implicit includes Florian Westphal
  2026-01-07 15:24 ` [PATCH nf-next 1/2] netfilter: nf_conntrack: don't rely on " Florian Westphal
@ 2026-01-07 15:24 ` Florian Westphal
  1 sibling, 0 replies; 4+ messages in thread
From: Florian Westphal @ 2026-01-07 15:24 UTC (permalink / raw)
  To: netfilter-devel
  Cc: jhs, xiyou.wangcong, jiri, audit, bridge, Florian Westphal

conntrack, xtables and nftables are distinct subsystems, don't use them
in other subystems.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 include/linux/audit.h                      | 1 -
 include/net/netfilter/nf_conntrack_tuple.h | 2 +-
 include/net/netfilter/nf_tables.h          | 1 -
 net/bridge/netfilter/nf_conntrack_bridge.c | 3 +--
 net/netfilter/nf_conntrack_h323_main.c     | 1 +
 net/netfilter/nf_synproxy_core.c           | 1 +
 net/netfilter/nf_tables_api.c              | 1 +
 net/netfilter/nft_synproxy.c               | 1 +
 8 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 536f8ee8da81..14df25095e19 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -13,7 +13,6 @@
 #include <linux/ptrace.h>
 #include <linux/audit_arch.h>
 #include <uapi/linux/audit.h>
-#include <uapi/linux/netfilter/nf_tables.h>
 #include <uapi/linux/fanotify.h>
 
 #define AUDIT_INO_UNSET ((unsigned long)-1)
diff --git a/include/net/netfilter/nf_conntrack_tuple.h b/include/net/netfilter/nf_conntrack_tuple.h
index f7dd950ff250..4d55b7325707 100644
--- a/include/net/netfilter/nf_conntrack_tuple.h
+++ b/include/net/netfilter/nf_conntrack_tuple.h
@@ -11,7 +11,7 @@
 #ifndef _NF_CONNTRACK_TUPLE_H
 #define _NF_CONNTRACK_TUPLE_H
 
-#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter.h>
 #include <linux/netfilter/nf_conntrack_tuple_common.h>
 #include <linux/list_nulls.h>
 
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 0e266c2d0e7f..2597077442e5 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -6,7 +6,6 @@
 #include <linux/list.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter/nfnetlink.h>
-#include <linux/netfilter/x_tables.h>
 #include <linux/netfilter/nf_tables.h>
 #include <linux/u64_stats_sync.h>
 #include <linux/rhashtable.h>
diff --git a/net/bridge/netfilter/nf_conntrack_bridge.c b/net/bridge/netfilter/nf_conntrack_bridge.c
index 6482de4d8750..3b28b84191be 100644
--- a/net/bridge/netfilter/nf_conntrack_bridge.c
+++ b/net/bridge/netfilter/nf_conntrack_bridge.c
@@ -16,8 +16,7 @@
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_bridge.h>
 
-#include <linux/netfilter/nf_tables.h>
-#include <net/netfilter/nf_tables.h>
+#include <linux/netfilter_ipv4.h>
 
 #include "../br_private.h"
 
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 14f73872f647..17f1f453d481 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -23,6 +23,7 @@
 #include <linux/skbuff.h>
 #include <net/route.h>
 #include <net/ip6_route.h>
+#include <linux/netfilter_ipv4.h>
 #include <linux/netfilter_ipv6.h>
 
 #include <net/netfilter/nf_conntrack.h>
diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
index 3fa3f5dfb264..57f57e2fc80a 100644
--- a/net/netfilter/nf_synproxy_core.c
+++ b/net/netfilter/nf_synproxy_core.c
@@ -10,6 +10,7 @@
 #include <net/netns/generic.h>
 #include <linux/proc_fs.h>
 
+#include <linux/netfilter_ipv4.h>
 #include <linux/netfilter_ipv6.h>
 #include <linux/netfilter/nf_synproxy.h>
 
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index e76af31f6a61..cb606eeadeed 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -14,6 +14,7 @@
 #include <linux/rhashtable.h>
 #include <linux/audit.h>
 #include <linux/netfilter.h>
+#include <linux/netfilter_ipv4.h>
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nf_tables.h>
 #include <net/netfilter/nf_flow_table.h>
diff --git a/net/netfilter/nft_synproxy.c b/net/netfilter/nft_synproxy.c
index 5d3e51825985..84d6c79ad889 100644
--- a/net/netfilter/nft_synproxy.c
+++ b/net/netfilter/nft_synproxy.c
@@ -7,6 +7,7 @@
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_synproxy.h>
 #include <net/netfilter/nf_synproxy.h>
+#include <linux/netfilter_ipv4.h>
 #include <linux/netfilter/nf_tables.h>
 #include <linux/netfilter/nf_synproxy.h>
 
-- 
2.52.0


^ permalink raw reply related	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2026-01-08 18:28 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-01-07 15:24 [PATCH nf-next 0/2] net: netfilter: avoid implicit includes Florian Westphal
2026-01-07 15:24 ` [PATCH nf-next 1/2] netfilter: nf_conntrack: don't rely on " Florian Westphal
2026-01-08 18:27   ` kernel test robot
2026-01-07 15:24 ` [PATCH nf-next 2/2] netfilter: don't include xt and nftables.h in unrelated subsystems Florian Westphal

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox