[PATCH nft v2 0/6] cleanup base includes and add <nft.h> header

[PATCH nft v2 0/6] cleanup base includes and add <nft.h> header

[Thomas Haller]

Changes to v1:
- rename <nftdefault.h> to <nft.h>
- move AC_USE_SYSTEM_EXTENSIONS earlier in configure.ac. It must be
  called before other compiler steps.
- reword commit messages.

Thomas Haller (6):
  meta: define _GNU_SOURCE to get strptime() from <time.h>
  src: add <nft.h> header and include it as first
  include: don't define _GNU_SOURCE in public header
  configure: use AC_USE_SYSTEM_EXTENSIONS to get _GNU_SOURCE
  include: include <std{bool,int}.h> via <nft.h>
  configure: drop AM_PROG_CC_C_O autoconf check

 configure.ac                   |  4 +++-
 include/Makefile.am            |  3 ++-
 include/cli.h                  |  1 -
 include/datatype.h             |  1 -
 include/dccpopt.h              |  1 -
 include/expression.h           |  1 -
 include/gmputil.h              |  2 --
 include/nft.h                  | 10 ++++++++++
 include/nftables.h             |  1 -
 include/nftables/libnftables.h |  1 -
 include/rule.h                 |  1 -
 include/utils.h                |  3 ---
 src/cache.c                    |  2 ++
 src/cli.c                      |  3 ++-
 src/cmd.c                      |  2 ++
 src/ct.c                       |  2 ++
 src/datatype.c                 |  2 ++
 src/dccpopt.c                  |  3 ++-
 src/erec.c                     |  4 ++--
 src/evaluate.c                 |  3 ++-
 src/expression.c               |  3 ++-
 src/exthdr.c                   |  3 ++-
 src/fib.c                      |  2 ++
 src/gmputil.c                  |  2 ++
 src/hash.c                     |  2 ++
 src/iface.c                    |  2 ++
 src/intervals.c                |  2 ++
 src/ipopt.c                    |  3 ++-
 src/json.c                     |  3 ++-
 src/libnftables.c              |  3 +++
 src/main.c                     |  2 ++
 src/mergesort.c                |  3 ++-
 src/meta.c                     |  8 +++-----
 src/mini-gmp.c                 |  2 ++
 src/misspell.c                 |  2 ++
 src/mnl.c                      |  2 ++
 src/monitor.c                  |  2 ++
 src/netlink.c                  |  2 ++
 src/netlink_delinearize.c      |  3 ++-
 src/netlink_linearize.c        |  2 ++
 src/nfnl_osf.c                 |  2 ++
 src/nftutils.c                 |  3 +--
 src/nftutils.h                 |  1 -
 src/numgen.c                   |  2 ++
 src/optimize.c                 |  3 ++-
 src/osf.c                      |  2 ++
 src/owner.c                    |  2 ++
 src/parser_json.c              |  4 ++--
 src/payload.c                  |  3 ++-
 src/print.c                    |  2 ++
 src/proto.c                    |  3 ++-
 src/rt.c                       |  3 ++-
 src/rule.c                     |  3 ++-
 src/scanner.l                  |  2 ++
 src/sctp_chunk.c               |  2 ++
 src/segtree.c                  |  2 ++
 src/socket.c                   |  2 ++
 src/statement.c                |  3 ++-
 src/tcpopt.c                   |  3 ++-
 src/utils.c                    |  2 ++
 src/xfrm.c                     |  2 ++
 src/xt.c                       |  2 ++
 62 files changed, 114 insertions(+), 42 deletions(-)
 create mode 100644 include/nft.h

-- 
2.41.0

[PATCH nft v2 1/6] meta: define _GNU_SOURCE to get strptime() from <time.h>

[Thomas Haller]

To use `strptime()`, the documentation indicates

  #define _XOPEN_SOURCE
  #include <time.h>

However, previously this was done wrongly.

For example, when building with musl we got a warning:

      CC       meta.lo
    meta.c:40: warning: "_XOPEN_SOURCE" redefined
       40 | #define _XOPEN_SOURCE
          |
    In file included from /usr/include/errno.h:8,
                     from meta.c:13:
    /usr/include/features.h:16: note: this is the location of the previous definition
       16 | #define _XOPEN_SOURCE 700
          |

Defining "__USE_XOPEN" is wrong. This is a glibc internal define not for
the user.

Note that if we just set _XOPEN_SOURCE (or _XOPEN_SOURCE=700), we won't
get other things like "struct tm.tm_gmtoff".

Instead, we already define _GNU_SOURCE at other places. Do that here
too, it will give us strptime() and all is good.

Also, those directives should be defined as first thing (or via "-D"
command line). See [1].

This is also important, because to use "time_t" in a header, we would
need to include <time.h>. That only works, if we get the feature test
macros right. That is, define the _?_SOURCE macro as first thing.

[1] https://www.gnu.org/software/libc/manual/html_node/Feature-Test-Macros.html

Signed-off-by: Thomas Haller <thaller@redhat.com>
---
 src/meta.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/src/meta.c b/src/meta.c
index bf2201009a8c..8508b11e70ce 100644
--- a/src/meta.c
+++ b/src/meta.c
@@ -10,6 +10,8 @@
  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  */
 
+#define _GNU_SOURCE
+
 #include <errno.h>
 #include <limits.h>
 #include <stddef.h>
@@ -25,6 +27,7 @@
 #include <linux/netfilter.h>
 #include <linux/pkt_sched.h>
 #include <linux/if_packet.h>
+#include <time.h>
 
 #include <nftables.h>
 #include <expression.h>
@@ -37,10 +40,6 @@
 #include <iface.h>
 #include <json.h>
 
-#define _XOPEN_SOURCE
-#define __USE_XOPEN
-#include <time.h>
-
 static void tchandle_type_print(const struct expr *expr,
 				struct output_ctx *octx)
 {
-- 
2.41.0

[PATCH nft v2 2/6] src: add <nft.h> header and include it as first

[Thomas Haller]

<config.h> is generated by the configure script. As it contains our
feature detection, it want to use it everywhere.

Likewise, in some of our sources, we define _GNU_SOURCE. This defines
the C variant we want to use. Such a define need to come before anything
else, and it would be confusing if different source files adhere to a
different C variant. It would be good to use autoconf's
AC_USE_SYSTEM_EXTENSIONS, in which case we would also need to ensure
that <config.h> is always included as first.

Instead of going through all source files and include <config.h> as
first, add a new header "include/nft.h", which is supposed to be
included in all our sources (and as first).

This will also allow us later to prepare some common base, like include
<stdbool.h> everywhere.

We aim that headers are self-contained, so that they can be included in
any order. Which, by the way, already didn't work because some headers
define _GNU_SOURCE, which would only work if the header gets included as
first. <nft.h> is however an exception to the rule: everything we compile
shall rely on having <nft.h> header included as first. This applies to
source files (which explicitly include <nft.h>) and to internal header
files (which are only compiled indirectly, by being included from a source
file).

Note that <config.h> has no include guards, which is at least ugly to
include multiple times. It doesn't cause problems in practice, because
it only contains defines and the compiler doesn't warn about redefining
a macro with the same value. Still, <nft.h> also ensures to include
<config.h> exactly once.

Signed-off-by: Thomas Haller <thaller@redhat.com>
---
 include/Makefile.am       | 3 ++-
 include/cli.h             | 1 -
 include/gmputil.h         | 2 --
 include/nft.h             | 9 +++++++++
 include/utils.h           | 1 -
 src/cache.c               | 2 ++
 src/cli.c                 | 3 ++-
 src/cmd.c                 | 2 ++
 src/ct.c                  | 2 ++
 src/datatype.c            | 2 ++
 src/dccpopt.c             | 2 ++
 src/erec.c                | 4 ++--
 src/evaluate.c            | 2 ++
 src/expression.c          | 2 ++
 src/exthdr.c              | 2 ++
 src/fib.c                 | 2 ++
 src/gmputil.c             | 2 ++
 src/hash.c                | 2 ++
 src/iface.c               | 2 ++
 src/intervals.c           | 2 ++
 src/ipopt.c               | 2 ++
 src/json.c                | 3 ++-
 src/libnftables.c         | 3 +++
 src/main.c                | 2 ++
 src/mergesort.c           | 2 ++
 src/meta.c                | 2 +-
 src/mini-gmp.c            | 2 ++
 src/misspell.c            | 2 ++
 src/mnl.c                 | 2 ++
 src/monitor.c             | 2 ++
 src/netlink.c             | 2 ++
 src/netlink_delinearize.c | 2 ++
 src/netlink_linearize.c   | 2 ++
 src/nfnl_osf.c            | 2 ++
 src/nftutils.c            | 2 +-
 src/numgen.c              | 2 ++
 src/optimize.c            | 3 ++-
 src/osf.c                 | 2 ++
 src/owner.c               | 2 ++
 src/parser_json.c         | 3 ++-
 src/payload.c             | 2 ++
 src/print.c               | 2 ++
 src/proto.c               | 2 ++
 src/rt.c                  | 2 ++
 src/rule.c                | 2 ++
 src/scanner.l             | 2 ++
 src/sctp_chunk.c          | 2 ++
 src/segtree.c             | 2 ++
 src/socket.c              | 2 ++
 src/statement.c           | 2 ++
 src/tcpopt.c              | 2 ++
 src/utils.c               | 2 ++
 src/xfrm.c                | 2 ++
 src/xt.c                  | 2 ++
 54 files changed, 108 insertions(+), 13 deletions(-)
 create mode 100644 include/nft.h

diff --git a/include/Makefile.am b/include/Makefile.am
index 1d20f404dbfe..162807b03900 100644
--- a/include/Makefile.am
+++ b/include/Makefile.am
@@ -1,11 +1,12 @@
 SUBDIRS =		linux		\
 			nftables
 
-noinst_HEADERS = 	cli.h		\
+noinst_HEADERS =	cli.h		\
 			cache.h		\
 			cmd.h		\
 			datatype.h	\
 			dccpopt.h	\
+			nft.h	\
 			expression.h	\
 			fib.h		\
 			hash.h		\
diff --git a/include/cli.h b/include/cli.h
index c854948e4a16..f0a0d47a645f 100644
--- a/include/cli.h
+++ b/include/cli.h
@@ -2,7 +2,6 @@
 #define _NFT_CLI_H_
 
 #include <nftables/libnftables.h>
-#include <config.h>
 
 #if defined(HAVE_LIBREADLINE) || defined(HAVE_LIBEDIT) || defined(HAVE_LIBLINENOISE)
 extern int cli_init(struct nft_ctx *nft);
diff --git a/include/gmputil.h b/include/gmputil.h
index 0cb85a7d0793..c524aced16ac 100644
--- a/include/gmputil.h
+++ b/include/gmputil.h
@@ -1,8 +1,6 @@
 #ifndef NFTABLES_GMPUTIL_H
 #define NFTABLES_GMPUTIL_H
 
-#include <config.h>
-
 #ifdef HAVE_LIBGMP
 #include <gmp.h>
 #else
diff --git a/include/nft.h b/include/nft.h
new file mode 100644
index 000000000000..4e66f8e6470d
--- /dev/null
+++ b/include/nft.h
@@ -0,0 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+#ifndef NFTABLES_NFT_H
+#define NFTABLES_NFT_H
+
+#define _GNU_SOURCE
+
+#include <config.h>
+
+#endif /* NFTABLES_NFT_H */
diff --git a/include/utils.h b/include/utils.h
index d5073e061033..6764f9219ada 100644
--- a/include/utils.h
+++ b/include/utils.h
@@ -11,7 +11,6 @@
 #include <list.h>
 #include <gmputil.h>
 
-#include "config.h"
 #ifdef HAVE_VISIBILITY_HIDDEN
 #       define __visible        __attribute__((visibility("default")))
 #       define EXPORT_SYMBOL(x) typeof(x) (x) __visible;
diff --git a/src/cache.c b/src/cache.c
index db9a9a75074a..3fe6bb407796 100644
--- a/src/cache.c
+++ b/src/cache.c
@@ -6,6 +6,8 @@
  * later) as published by the Free Software Foundation.
  */
 
+#include <nft.h>
+
 #include <expression.h>
 #include <statement.h>
 #include <rule.h>
diff --git a/src/cli.c b/src/cli.c
index 5f7e01ff9631..bfae90e67554 100644
--- a/src/cli.c
+++ b/src/cli.c
@@ -12,7 +12,8 @@
  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  */
 
-#include <config.h>
+#include <nft.h>
+
 #include <stdlib.h>
 #include <stdio.h>
 #include <stdarg.h>
diff --git a/src/cmd.c b/src/cmd.c
index 98216d54e78d..98859674d24b 100644
--- a/src/cmd.c
+++ b/src/cmd.c
@@ -6,6 +6,8 @@
  * later) as published by the Free Software Foundation.
  */
 
+#include <nft.h>
+
 #include <erec.h>
 #include <mnl.h>
 #include <cmd.h>
diff --git a/src/ct.c b/src/ct.c
index 64327561d089..ca35087ad7b7 100644
--- a/src/ct.c
+++ b/src/ct.c
@@ -10,6 +10,8 @@
  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  */
 
+#include <nft.h>
+
 #include <stddef.h>
 #include <stdlib.h>
 #include <stdio.h>
diff --git a/src/datatype.c b/src/datatype.c
index 64396db82a7e..dd6a5fbf5df8 100644
--- a/src/datatype.c
+++ b/src/datatype.c
@@ -8,6 +8,8 @@
  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  */
 
+#include <nft.h>
+
 #include <stdlib.h>
 #include <string.h>
 #include <inttypes.h>
diff --git a/src/dccpopt.c b/src/dccpopt.c
index 3a2eb9524a20..d713d9034c92 100644
--- a/src/dccpopt.c
+++ b/src/dccpopt.c
@@ -1,3 +1,5 @@
+#include <nft.h>
+
 #include <stddef.h>
 #include <stdint.h>
 
diff --git a/src/erec.c b/src/erec.c
index aebb8632583a..d26dee602e8a 100644
--- a/src/erec.c
+++ b/src/erec.c
@@ -8,8 +8,8 @@
  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  */
 
-#define _GNU_SOURCE
-#include <config.h>
+#include <nft.h>
+
 #include <stdio.h>
 #include <string.h>
 #include <stdarg.h>
diff --git a/src/evaluate.c b/src/evaluate.c
index 2b158aee720b..69a123511be8 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -8,6 +8,8 @@
  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  */
 
+#include <nft.h>
+
 #include <stddef.h>
 #include <stdlib.h>
 #include <stdio.h>
diff --git a/src/expression.c b/src/expression.c
index 34902c842d16..8ef008910da5 100644
--- a/src/expression.c
+++ b/src/expression.c
@@ -8,6 +8,8 @@
  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  */
 
+#include <nft.h>
+
 #include <stddef.h>
 #include <stdlib.h>
 #include <stdio.h>
diff --git a/src/exthdr.c b/src/exthdr.c
index 0358005b1b89..dd8c75815314 100644
--- a/src/exthdr.c
+++ b/src/exthdr.c
@@ -10,6 +10,8 @@
  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  */
 
+#include <nft.h>
+
 #include <stddef.h>
 #include <stdlib.h>
 #include <stdio.h>
diff --git a/src/fib.c b/src/fib.c
index 98c5786891f7..b977fe28e803 100644
--- a/src/fib.c
+++ b/src/fib.c
@@ -8,6 +8,8 @@
  * later) as published by the Free Software Foundation.
  */
 
+#include <nft.h>
+
 #include <nftables.h>
 #include <erec.h>
 #include <expression.h>
diff --git a/src/gmputil.c b/src/gmputil.c
index b356460fa739..9cda18534d0a 100644
--- a/src/gmputil.c
+++ b/src/gmputil.c
@@ -8,6 +8,8 @@
  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  */
 
+#include <nft.h>
+
 #include <stddef.h>
 #include <stdlib.h>
 #include <stdarg.h>
diff --git a/src/hash.c b/src/hash.c
index a3fd0872c3b9..1c8c00aa1491 100644
--- a/src/hash.c
+++ b/src/hash.c
@@ -8,6 +8,8 @@
  * later) as published by the Free Software Foundation.
  */
 
+#include <nft.h>
+
 #include <nftables.h>
 #include <expression.h>
 #include <datatype.h>
diff --git a/src/iface.c b/src/iface.c
index 3647778c1f0d..ec7f5c7f4cd9 100644
--- a/src/iface.c
+++ b/src/iface.c
@@ -6,6 +6,8 @@
  * later) as published by the Free Software Foundation.
  */
 
+#include <nft.h>
+
 #include <stdio.h>
 #include <stdlib.h>
 #include <net/if.h>
diff --git a/src/intervals.c b/src/intervals.c
index d79c52c58710..85de0199c373 100644
--- a/src/intervals.c
+++ b/src/intervals.c
@@ -6,6 +6,8 @@
  * later) as published by the Free Software Foundation.
  */
 
+#include <nft.h>
+
 #include <nftables.h>
 #include <expression.h>
 #include <intervals.h>
diff --git a/src/ipopt.c b/src/ipopt.c
index 67e904ff3d88..3ba67b011166 100644
--- a/src/ipopt.c
+++ b/src/ipopt.c
@@ -1,3 +1,5 @@
+#include <nft.h>
+
 #include <stdint.h>
 
 #include <netinet/in.h>
diff --git a/src/json.c b/src/json.c
index 31dd185666b1..446575c2afc0 100644
--- a/src/json.c
+++ b/src/json.c
@@ -6,7 +6,8 @@
  * later) as published by the Free Software Foundation.
  */
 
-#define _GNU_SOURCE
+#include <nft.h>
+
 #include <stdio.h>
 #include <string.h>
 
diff --git a/src/libnftables.c b/src/libnftables.c
index 69ea9d4135b7..9c802ec95f27 100644
--- a/src/libnftables.c
+++ b/src/libnftables.c
@@ -5,6 +5,9 @@
  * it under the terms of the GNU General Public License version 2 (or any
  * later) as published by the Free Software Foundation.
  */
+
+#include <nft.h>
+
 #include <nftables/libnftables.h>
 #include <erec.h>
 #include <mnl.h>
diff --git a/src/main.c b/src/main.c
index 40dc60c2258c..260338d320ab 100644
--- a/src/main.c
+++ b/src/main.c
@@ -8,6 +8,8 @@
  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  */
 
+#include <nft.h>
+
 #include <stdlib.h>
 #include <stddef.h>
 #include <unistd.h>
diff --git a/src/mergesort.c b/src/mergesort.c
index a3a9d6050ccb..9315093b3359 100644
--- a/src/mergesort.c
+++ b/src/mergesort.c
@@ -6,6 +6,8 @@
  * later) as published by the Free Software Foundation.
  */
 
+#include <nft.h>
+
 #include <stdint.h>
 #include <expression.h>
 #include <gmputil.h>
diff --git a/src/meta.c b/src/meta.c
index 8508b11e70ce..fcb872e669df 100644
--- a/src/meta.c
+++ b/src/meta.c
@@ -10,7 +10,7 @@
  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  */
 
-#define _GNU_SOURCE
+#include <nft.h>
 
 #include <errno.h>
 #include <limits.h>
diff --git a/src/mini-gmp.c b/src/mini-gmp.c
index 04bed3f51ddb..6217f7454651 100644
--- a/src/mini-gmp.c
+++ b/src/mini-gmp.c
@@ -41,6 +41,8 @@ see https://www.gnu.org/licenses/.  */
    mpn/generic/sbpi1_div_qr.c, mpn/generic/sub_n.c,
    mpn/generic/submul_1.c. */
 
+#include <nft.h>
+
 #include <assert.h>
 #include <ctype.h>
 #include <limits.h>
diff --git a/src/misspell.c b/src/misspell.c
index 8992c75e7bc1..18da4386ea5b 100644
--- a/src/misspell.c
+++ b/src/misspell.c
@@ -6,6 +6,8 @@
  * later) as published by the Free Software Foundation.
  */
 
+#include <nft.h>
+
 #include <stdlib.h>
 #include <string.h>
 #include <limits.h>
diff --git a/src/mnl.c b/src/mnl.c
index 9406fc482123..d583177d5490 100644
--- a/src/mnl.c
+++ b/src/mnl.c
@@ -8,6 +8,8 @@
  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  */
 
+#include <nft.h>
+
 #include <libmnl/libmnl.h>
 #include <libnftnl/common.h>
 #include <libnftnl/ruleset.h>
diff --git a/src/monitor.c b/src/monitor.c
index 3a1896917923..0554089b74ac 100644
--- a/src/monitor.c
+++ b/src/monitor.c
@@ -6,6 +6,8 @@
  * later) as published by the Free Software Foundation.
  */
 
+#include <nft.h>
+
 #include <string.h>
 #include <fcntl.h>
 #include <errno.h>
diff --git a/src/netlink.c b/src/netlink.c
index ed61cd896511..e1904a99d3ba 100644
--- a/src/netlink.c
+++ b/src/netlink.c
@@ -9,6 +9,8 @@
  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  */
 
+#include <nft.h>
+
 #include <string.h>
 #include <errno.h>
 #include <libmnl/libmnl.h>
diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index 125b6c685f80..dfa816cfdfb6 100644
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -9,6 +9,8 @@
  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  */
 
+#include <nft.h>
+
 #include <stdlib.h>
 #include <stdbool.h>
 #include <string.h>
diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c
index f5b2d6bb6cea..53a318aa2e62 100644
--- a/src/netlink_linearize.c
+++ b/src/netlink_linearize.c
@@ -9,6 +9,8 @@
  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  */
 
+#include <nft.h>
+
 #include <linux/netfilter/nf_tables.h>
 #include <linux/netfilter/nf_log.h>
 
diff --git a/src/nfnl_osf.c b/src/nfnl_osf.c
index 08e978de2f67..48e83ea8a549 100644
--- a/src/nfnl_osf.c
+++ b/src/nfnl_osf.c
@@ -19,6 +19,8 @@
  * Based on iptables/utils/nfnl_osf.c.
  */
 
+#include <nft.h>
+
 #include <sys/time.h>
 
 #include <ctype.h>
diff --git a/src/nftutils.c b/src/nftutils.c
index 13f879ddc5c7..14cb1fcf07de 100644
--- a/src/nftutils.c
+++ b/src/nftutils.c
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
 
-#include <config.h>
+#include <nft.h>
 
 #include "nftutils.h"
 
diff --git a/src/numgen.c b/src/numgen.c
index 256514d14671..3029fa58cc49 100644
--- a/src/numgen.c
+++ b/src/numgen.c
@@ -8,6 +8,8 @@
  * later) as published by the Free Software Foundation.
  */
 
+#include <nft.h>
+
 #include <nftables.h>
 #include <expression.h>
 #include <datatype.h>
diff --git a/src/optimize.c b/src/optimize.c
index 7ca57ce73873..0b99b6726115 100644
--- a/src/optimize.c
+++ b/src/optimize.c
@@ -11,7 +11,8 @@
  * programme.
  */
 
-#define _GNU_SOURCE
+#include <nft.h>
+
 #include <string.h>
 #include <errno.h>
 #include <inttypes.h>
diff --git a/src/osf.c b/src/osf.c
index c611b542206d..6f5ed9bc895a 100644
--- a/src/osf.c
+++ b/src/osf.c
@@ -6,6 +6,8 @@
  * later) as published by the Free Software Foundation.
  */
 
+#include <nft.h>
+
 #include <nftables.h>
 #include <expression.h>
 #include <utils.h>
diff --git a/src/owner.c b/src/owner.c
index c34b0c1501fa..be1756a68c75 100644
--- a/src/owner.c
+++ b/src/owner.c
@@ -6,6 +6,8 @@
  * later) as published by the Free Software Foundation.
  */
 
+#include <nft.h>
+
 #include <stdio.h>
 #include <unistd.h>
 #include <stdlib.h>
diff --git a/src/parser_json.c b/src/parser_json.c
index 92cffee905e3..323d15bb5b71 100644
--- a/src/parser_json.c
+++ b/src/parser_json.c
@@ -6,7 +6,8 @@
  * later) as published by the Free Software Foundation.
  */
 
-#define _GNU_SOURCE
+#include <nft.h>
+
 #include <errno.h>
 #include <stdint.h> /* needed by gmputil.h */
 #include <string.h>
diff --git a/src/payload.c b/src/payload.c
index 7862745b2035..9fdbf4997c4e 100644
--- a/src/payload.c
+++ b/src/payload.c
@@ -10,6 +10,8 @@
  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  */
 
+#include <nft.h>
+
 #include <stddef.h>
 #include <stdlib.h>
 #include <stdio.h>
diff --git a/src/print.c b/src/print.c
index 4896e13c2ca5..8aefa961fb24 100644
--- a/src/print.c
+++ b/src/print.c
@@ -6,6 +6,8 @@
  * later) as published by the Free Software Foundation.
  */
 
+#include <nft.h>
+
 #include <stdarg.h>
 #include <nftables.h>
 #include <utils.h>
diff --git a/src/proto.c b/src/proto.c
index edf99e840c0c..eb9c3ea18e68 100644
--- a/src/proto.c
+++ b/src/proto.c
@@ -9,6 +9,8 @@
  *
  */
 
+#include <nft.h>
+
 #include <stddef.h>
 #include <stdlib.h>
 #include <stdint.h>
diff --git a/src/rt.c b/src/rt.c
index d7aa5edd93a3..33820d4c8719 100644
--- a/src/rt.c
+++ b/src/rt.c
@@ -8,6 +8,8 @@
  * published by the Free Software Foundation.
  */
 
+#include <nft.h>
+
 #include <errno.h>
 #include <stddef.h>
 #include <stdlib.h>
diff --git a/src/rule.c b/src/rule.c
index b59fcd3a9fa8..f2c4768e01ab 100644
--- a/src/rule.c
+++ b/src/rule.c
@@ -8,6 +8,8 @@
  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  */
 
+#include <nft.h>
+
 #include <stddef.h>
 #include <stdlib.h>
 #include <stdio.h>
diff --git a/src/scanner.l b/src/scanner.l
index c903b8c3e02d..1aae1ecb09ef 100644
--- a/src/scanner.l
+++ b/src/scanner.l
@@ -10,6 +10,8 @@
 
 %{
 
+#include <nft.h>
+
 #include <limits.h>
 #include <glob.h>
 #include <netinet/in.h>
diff --git a/src/sctp_chunk.c b/src/sctp_chunk.c
index 6e73e72f8308..1cd5e20abf78 100644
--- a/src/sctp_chunk.c
+++ b/src/sctp_chunk.c
@@ -6,6 +6,8 @@
  * later) as published by the Free Software Foundation.
  */
 
+#include <nft.h>
+
 #include <exthdr.h>
 #include <sctp_chunk.h>
 
diff --git a/src/segtree.c b/src/segtree.c
index 0e3d111fb7ab..a265a0b30d64 100644
--- a/src/segtree.c
+++ b/src/segtree.c
@@ -8,6 +8,8 @@
  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  */
 
+#include <nft.h>
+
 #include <stdlib.h>
 #include <string.h>
 #include <inttypes.h>
diff --git a/src/socket.c b/src/socket.c
index 356557b4dbed..8a149e63dd73 100644
--- a/src/socket.c
+++ b/src/socket.c
@@ -8,6 +8,8 @@
  * later) as published by the Free Software Foundation.
  */
 
+#include <nft.h>
+
 #include <nftables.h>
 #include <expression.h>
 #include <socket.h>
diff --git a/src/statement.c b/src/statement.c
index 9ca7e208cf79..e6ea43d0a4d1 100644
--- a/src/statement.c
+++ b/src/statement.c
@@ -8,6 +8,8 @@
  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  */
 
+#include <nft.h>
+
 #include <stddef.h>
 #include <stdlib.h>
 #include <stdio.h>
diff --git a/src/tcpopt.c b/src/tcpopt.c
index c3e07d7889ab..5dd760a51aab 100644
--- a/src/tcpopt.c
+++ b/src/tcpopt.c
@@ -1,3 +1,5 @@
+#include <nft.h>
+
 #include <stddef.h>
 #include <stdlib.h>
 #include <stdio.h>
diff --git a/src/utils.c b/src/utils.c
index a5815018c775..d2841f3469b5 100644
--- a/src/utils.c
+++ b/src/utils.c
@@ -8,6 +8,8 @@
  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  */
 
+#include <nft.h>
+
 #include <stddef.h>
 #include <stdlib.h>
 #include <stdarg.h>
diff --git a/src/xfrm.c b/src/xfrm.c
index b27821a922f5..041c0ce7ac6d 100644
--- a/src/xfrm.c
+++ b/src/xfrm.c
@@ -8,6 +8,8 @@
  * later) as published by the Free Software Foundation.
  */
 
+#include <nft.h>
+
 #include <nftables.h>
 #include <erec.h>
 #include <expression.h>
diff --git a/src/xt.c b/src/xt.c
index b17aafd56538..df7140b4fa97 100644
--- a/src/xt.c
+++ b/src/xt.c
@@ -7,6 +7,8 @@
  * later) as published by the Free Software Foundation.
  */
 
+#include <nft.h>
+
 #include <stdlib.h>
 #include <time.h>
 #include <string.h>
-- 
2.41.0

[PATCH nft v2 3/6] include: don't define _GNU_SOURCE in public header

[Thomas Haller]

_GNU_SOURCE is supposed to be defined as first thing, before including any
libc headers. Defining it in the public header of nftables is wrong, because
it would only (somewhat) work if the user includes the nftables header as first
thing too. But that is not what users commonly would do, in particular with
autotools projects, where users would include <config.h> first.

It's also unnecessary. Nothing in "nftables/libnftables.h" itself
requires _GNU_SOURCE. Drop it.

Signed-off-by: Thomas Haller <thaller@redhat.com>
---
 include/nftables/libnftables.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/include/nftables/libnftables.h b/include/nftables/libnftables.h
index cc05969215bc..c1d48d765a42 100644
--- a/include/nftables/libnftables.h
+++ b/include/nftables/libnftables.h
@@ -9,7 +9,6 @@
 #ifndef LIB_NFTABLES_H
 #define LIB_NFTABLES_H
 
-#define _GNU_SOURCE
 #include <stdint.h>
 #include <stdio.h>
 #include <stdbool.h>
-- 
2.41.0

[PATCH nft v2 4/6] configure: use AC_USE_SYSTEM_EXTENSIONS to get _GNU_SOURCE

[Thomas Haller]

Let "configure" detect which features are available. Also, nftables is a
Linux project, so portability beyond gcc/clang and glibc/musl is less
relevant. And even if it were, then feature detection by "configure"
would still be preferable.

Use AC_USE_SYSTEM_EXTENSIONS ([1]).

Available since autoconf 2.60, from 2006 ([2]).

[1] https://www.gnu.org/software/autoconf/manual/autoconf-2.67/html_node/Posix-Variants.html#index-AC_005fUSE_005fSYSTEM_005fEXTENSIONS-1046
[2] https://lists.gnu.org/archive/html/autoconf/2006-06/msg00111.html

Signed-off-by: Thomas Haller <thaller@redhat.com>
---
 configure.ac  | 3 +++
 include/nft.h | 2 --
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/configure.ac b/configure.ac
index 42f0dc4cf392..baec66978847 100644
--- a/configure.ac
+++ b/configure.ac
@@ -23,6 +23,9 @@ AM_CONDITIONAL([BUILD_MAN], [test "x$enable_man_doc" = "xyes" ])
 
 # Checks for programs.
 AC_PROG_CC
+
+AC_USE_SYSTEM_EXTENSIONS
+
 AC_PROG_MKDIR_P
 AC_PROG_INSTALL
 AC_PROG_SED
diff --git a/include/nft.h b/include/nft.h
index 4e66f8e6470d..0fd481c6ef04 100644
--- a/include/nft.h
+++ b/include/nft.h
@@ -2,8 +2,6 @@
 #ifndef NFTABLES_NFT_H
 #define NFTABLES_NFT_H
 
-#define _GNU_SOURCE
-
 #include <config.h>
 
 #endif /* NFTABLES_NFT_H */
-- 
2.41.0

[PATCH nft v2 5/6] include: include <std{bool,int}.h> via <nft.h>

[Thomas Haller]

There is a minimum base that all our sources will end up needing. This
is what <nft.h> provides.

Add <stdbool.h> and <stdint.h> there. It's unlikely that we want to
implement anything, without having "bool" and "uint32_t" types
available.

Yes, this means the internal headers are not self-contained, with
respect to what <nft.h> provides. This is the exception to the rule, and
our internal headers should rely to have <nft.h> included for them.
They should not include <nft.h> themselves, because <nft.h> needs always
be included as first. So when an internal header would include <nft.h>
it would be unnecessary, because the header is *always* included
already.

Signed-off-by: Thomas Haller <thaller@redhat.com>
---
 include/datatype.h        | 1 -
 include/dccpopt.h         | 1 -
 include/expression.h      | 1 -
 include/nft.h             | 3 +++
 include/nftables.h        | 1 -
 include/rule.h            | 1 -
 include/utils.h           | 2 --
 src/dccpopt.c             | 1 -
 src/evaluate.c            | 1 -
 src/expression.c          | 1 -
 src/exthdr.c              | 1 -
 src/ipopt.c               | 1 -
 src/mergesort.c           | 1 -
 src/meta.c                | 1 -
 src/netlink_delinearize.c | 1 -
 src/nftutils.c            | 1 -
 src/nftutils.h            | 1 -
 src/parser_json.c         | 1 -
 src/payload.c             | 1 -
 src/proto.c               | 1 -
 src/rt.c                  | 1 -
 src/rule.c                | 1 -
 src/statement.c           | 1 -
 src/tcpopt.c              | 1 -
 24 files changed, 3 insertions(+), 24 deletions(-)

diff --git a/include/datatype.h b/include/datatype.h
index be5c6d1b4011..9ce7359cd340 100644
--- a/include/datatype.h
+++ b/include/datatype.h
@@ -1,7 +1,6 @@
 #ifndef NFTABLES_DATATYPE_H
 #define NFTABLES_DATATYPE_H
 
-#include <stdbool.h>
 #include <json.h>
 
 /**
diff --git a/include/dccpopt.h b/include/dccpopt.h
index 9686932d74b7..3617fc1ae766 100644
--- a/include/dccpopt.h
+++ b/include/dccpopt.h
@@ -2,7 +2,6 @@
 #define NFTABLES_DCCPOPT_H
 
 #include <nftables.h>
-#include <stdint.h>
 
 #define DCCPOPT_TYPE_MIN 0
 #define DCCPOPT_TYPE_MAX UINT8_MAX
diff --git a/include/expression.h b/include/expression.h
index 1f58a68c329f..733dd3cfc89c 100644
--- a/include/expression.h
+++ b/include/expression.h
@@ -1,7 +1,6 @@
 #ifndef NFTABLES_EXPRESSION_H
 #define NFTABLES_EXPRESSION_H
 
-#include <stdbool.h>
 #include <gmputil.h>
 #include <linux/netfilter/nf_tables.h>
 
diff --git a/include/nft.h b/include/nft.h
index 0fd481c6ef04..967eb7bcea09 100644
--- a/include/nft.h
+++ b/include/nft.h
@@ -4,4 +4,7 @@
 
 #include <config.h>
 
+#include <stdbool.h>
+#include <stdint.h>
+
 #endif /* NFTABLES_NFT_H */
diff --git a/include/nftables.h b/include/nftables.h
index f073fa95a60d..219a10100206 100644
--- a/include/nftables.h
+++ b/include/nftables.h
@@ -1,7 +1,6 @@
 #ifndef NFTABLES_NFTABLES_H
 #define NFTABLES_NFTABLES_H
 
-#include <stdbool.h>
 #include <stdarg.h>
 #include <limits.h>
 #include <utils.h>
diff --git a/include/rule.h b/include/rule.h
index 13ab1bf3df5a..8e876d0a42ed 100644
--- a/include/rule.h
+++ b/include/rule.h
@@ -1,7 +1,6 @@
 #ifndef NFTABLES_RULE_H
 #define NFTABLES_RULE_H
 
-#include <stdint.h>
 #include <nftables.h>
 #include <list.h>
 #include <netinet/in.h>
diff --git a/include/utils.h b/include/utils.h
index 6764f9219ada..cee1e5c1e8ae 100644
--- a/include/utils.h
+++ b/include/utils.h
@@ -2,8 +2,6 @@
 #define NFTABLES_UTILS_H
 
 #include <asm/byteorder.h>
-#include <stdint.h>
-#include <stdbool.h>
 #include <stdarg.h>
 #include <stdio.h>
 #include <unistd.h>
diff --git a/src/dccpopt.c b/src/dccpopt.c
index d713d9034c92..ebb645a98c5a 100644
--- a/src/dccpopt.c
+++ b/src/dccpopt.c
@@ -1,7 +1,6 @@
 #include <nft.h>
 
 #include <stddef.h>
-#include <stdint.h>
 
 #include <datatype.h>
 #include <dccpopt.h>
diff --git a/src/evaluate.c b/src/evaluate.c
index 69a123511be8..1ae2ef0de10c 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -13,7 +13,6 @@
 #include <stddef.h>
 #include <stdlib.h>
 #include <stdio.h>
-#include <stdint.h>
 #include <string.h>
 #include <arpa/inet.h>
 #include <linux/netfilter.h>
diff --git a/src/expression.c b/src/expression.c
index 8ef008910da5..147320f08937 100644
--- a/src/expression.c
+++ b/src/expression.c
@@ -13,7 +13,6 @@
 #include <stddef.h>
 #include <stdlib.h>
 #include <stdio.h>
-#include <stdint.h>
 #include <string.h>
 #include <limits.h>
 
diff --git a/src/exthdr.c b/src/exthdr.c
index dd8c75815314..8aba7da1fa69 100644
--- a/src/exthdr.c
+++ b/src/exthdr.c
@@ -15,7 +15,6 @@
 #include <stddef.h>
 #include <stdlib.h>
 #include <stdio.h>
-#include <stdint.h>
 #include <string.h>
 #include <netinet/in.h>
 #include <netinet/ip6.h>
diff --git a/src/ipopt.c b/src/ipopt.c
index 3ba67b011166..37f779d468ab 100644
--- a/src/ipopt.c
+++ b/src/ipopt.c
@@ -1,6 +1,5 @@
 #include <nft.h>
 
-#include <stdint.h>
 
 #include <netinet/in.h>
 #include <netinet/ip.h>
diff --git a/src/mergesort.c b/src/mergesort.c
index 9315093b3359..5965236af6b7 100644
--- a/src/mergesort.c
+++ b/src/mergesort.c
@@ -8,7 +8,6 @@
 
 #include <nft.h>
 
-#include <stdint.h>
 #include <expression.h>
 #include <gmputil.h>
 #include <list.h>
diff --git a/src/meta.c b/src/meta.c
index fcb872e669df..4f383269d032 100644
--- a/src/meta.c
+++ b/src/meta.c
@@ -17,7 +17,6 @@
 #include <stddef.h>
 #include <stdlib.h>
 #include <stdio.h>
-#include <stdint.h>
 #include <string.h>
 #include <net/if.h>
 #include <net/if_arp.h>
diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index dfa816cfdfb6..1121f730ffa7 100644
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -12,7 +12,6 @@
 #include <nft.h>
 
 #include <stdlib.h>
-#include <stdbool.h>
 #include <string.h>
 #include <limits.h>
 #include <linux/netfilter/nf_tables.h>
diff --git a/src/nftutils.c b/src/nftutils.c
index 14cb1fcf07de..9c7fe5edc022 100644
--- a/src/nftutils.c
+++ b/src/nftutils.c
@@ -6,7 +6,6 @@
 
 #include <netdb.h>
 #include <string.h>
-#include <stdint.h>
 
 /* Buffer size used for getprotobynumber_r() and similar. The manual comments
  * that a buffer of 1024 should be sufficient "for most applications"(??), so
diff --git a/src/nftutils.h b/src/nftutils.h
index cb584b9ca32b..7db56f428980 100644
--- a/src/nftutils.h
+++ b/src/nftutils.h
@@ -2,7 +2,6 @@
 #ifndef NFTUTILS_H
 #define NFTUTILS_H
 
-#include <stdbool.h>
 #include <stddef.h>
 
 /* The maximum buffer size for (struct protoent).p_name. It is excessively large,
diff --git a/src/parser_json.c b/src/parser_json.c
index 323d15bb5b71..4ea5b4326a90 100644
--- a/src/parser_json.c
+++ b/src/parser_json.c
@@ -9,7 +9,6 @@
 #include <nft.h>
 
 #include <errno.h>
-#include <stdint.h> /* needed by gmputil.h */
 #include <string.h>
 #include <syslog.h>
 
diff --git a/src/payload.c b/src/payload.c
index 9fdbf4997c4e..0afffb2338ef 100644
--- a/src/payload.c
+++ b/src/payload.c
@@ -15,7 +15,6 @@
 #include <stddef.h>
 #include <stdlib.h>
 #include <stdio.h>
-#include <stdint.h>
 #include <string.h>
 #include <net/if_arp.h>
 #include <arpa/inet.h>
diff --git a/src/proto.c b/src/proto.c
index eb9c3ea18e68..4650e58cd6ed 100644
--- a/src/proto.c
+++ b/src/proto.c
@@ -13,7 +13,6 @@
 
 #include <stddef.h>
 #include <stdlib.h>
-#include <stdint.h>
 #include <string.h>
 #include <net/if_arp.h>
 #include <arpa/inet.h>
diff --git a/src/rt.c b/src/rt.c
index 33820d4c8719..c8d75b369f8b 100644
--- a/src/rt.c
+++ b/src/rt.c
@@ -14,7 +14,6 @@
 #include <stddef.h>
 #include <stdlib.h>
 #include <stdio.h>
-#include <stdint.h>
 #include <string.h>
 #include <arpa/inet.h>
 #include <linux/netfilter.h>
diff --git a/src/rule.c b/src/rule.c
index f2c4768e01ab..8ea606e146b2 100644
--- a/src/rule.c
+++ b/src/rule.c
@@ -13,7 +13,6 @@
 #include <stddef.h>
 #include <stdlib.h>
 #include <stdio.h>
-#include <stdint.h>
 #include <string.h>
 #include <inttypes.h>
 #include <errno.h>
diff --git a/src/statement.c b/src/statement.c
index e6ea43d0a4d1..7b8e68f19117 100644
--- a/src/statement.c
+++ b/src/statement.c
@@ -13,7 +13,6 @@
 #include <stddef.h>
 #include <stdlib.h>
 #include <stdio.h>
-#include <stdint.h>
 #include <inttypes.h>
 #include <string.h>
 #include <syslog.h>
diff --git a/src/tcpopt.c b/src/tcpopt.c
index 5dd760a51aab..7b95a0113403 100644
--- a/src/tcpopt.c
+++ b/src/tcpopt.c
@@ -3,7 +3,6 @@
 #include <stddef.h>
 #include <stdlib.h>
 #include <stdio.h>
-#include <stdint.h>
 #include <string.h>
 #include <netinet/in.h>
 #include <netinet/ip6.h>
-- 
2.41.0

[PATCH nft v2 6/6] configure: drop AM_PROG_CC_C_O autoconf check

[Thomas Haller]

This macro is obsolete since automake 1.14 (2013). It might have been
unnecessary even before, in practice only gcc/clang are supported
compilers.

[1] https://www.gnu.org/software/automake/manual/html_node/Public-Macros.html#index-AM_005fPROG_005fCC_005fC_005fO
[2] https://lists.gnu.org/archive/html/info-gnu/2013-06/msg00009.html

Signed-off-by: Thomas Haller <thaller@redhat.com>
---
 configure.ac | 1 -
 1 file changed, 1 deletion(-)

diff --git a/configure.ac b/configure.ac
index baec66978847..0f763a793b84 100644
--- a/configure.ac
+++ b/configure.ac
@@ -47,7 +47,6 @@ fi
 
 AM_PROG_AR
 LT_INIT([disable-static])
-AM_PROG_CC_C_O
 AC_EXEEXT
 CHECK_GCC_FVISIBILITY
 
-- 
2.41.0

Re: [PATCH nft v2 0/6] cleanup base includes and add <nft.h> header

[Pablo Neira Ayuso]

On Fri, Aug 25, 2023 at 01:36:28PM +0200, Thomas Haller wrote:
> Changes to v1:
> - rename <nftdefault.h> to <nft.h>
> - move AC_USE_SYSTEM_EXTENSIONS earlier in configure.ac. It must be
>   called before other compiler steps.
> - reword commit messages.

Series applied, thanks