Set various -W flags on apple

Apple supports anything here that Clang supports and should have them
set the same as everywhere else.

Most importantly this gives apple the -Wno-deprecated-declarations flag
which has been driving me nuts on macos.

This also version-gates the -Wno-deprecated-declarations so that it
will turn on again when we bump the version beyond .10.

CMakeLists.txt

@@ -181,19 +181,11 @@ if(NOT TARGET sodium)
   export(TARGETS sodium NAMESPACE sodium:: FILE sodium-exports.cmake)
 endif()
 
-if(APPLE)
-  add_compile_options(-Wno-deprecated-declarations)
-else()
-  add_compile_options(-Wall -Wextra -Wno-unknown-pragmas -Wno-unused-function -Werror=vla)
-  if (CMAKE_CXX_COMPILER_ID MATCHES "Clang")
-    add_compile_options(-Wno-unknown-warning-option)
-  endif()
-  if(WARN_DEPRECATED)
-    add_compile_options(-Wdeprecated-declarations)
-  else()
-    add_compile_options(-Wno-deprecated-declarations)
-  endif()
-endif()
+add_compile_options(
+    "$<$<COMPILE_LANGUAGE:C,CXX>:-Wall;-Wextra;-Wno-unknown-pragmas;-Wno-unused-function;-Werror=vla>"
+    "$<$<COMPILE_LANGUAGE:C,CXX>:-W$<IF:$<BOOL:${WARN_DEPRECATED}>,,no->deprecated-declarations>"
+    "$<$<COMPILE_LANG_AND_ID:CXX,Clang,AppleClang>:-Wno-unknown-warning-option>"
+)
 
 if(XSAN)
   string(APPEND CMAKE_CXX_FLAGS_DEBUG " -fsanitize=${XSAN} -fno-omit-frame-pointer -fno-sanitize-recover")

llarp/apple/DNSTrampoline.m

@@ -13,6 +13,7 @@ on_request(
     const struct sockaddr* addr,
     unsigned flags)
 {
+  (void)flags;
   if (nread < 0)
   {
     NSLog(@"Read error: %s", uv_strerror(nread));
@@ -42,7 +43,9 @@ on_request(
 static void
 on_sent(uv_udp_send_t* req, int status)
 {
+  (void)status;
   NSArray<NSData*>* datagrams = (__bridge_transfer NSArray<NSData*>*)req->data;
+  (void)datagrams;
   free(req);
 }
 
@@ -73,6 +76,7 @@ write_flusher(uv_async_t* async)
 static void
 alloc_buffer(uv_handle_t* handle, size_t suggested_size, uv_buf_t* buf)
 {
+  (void)handle;
   buf->base = malloc(suggested_size);
   buf->len = suggested_size;
 }

llarp/apple/PacketTunnelProvider.m

@@ -91,7 +91,7 @@ del_ipv4_route(const char* addr, const char* netmask, void* ctx)
   LLARPPacketTunnel* t = (__bridge LLARPPacketTunnel*)ctx;
   NSMutableArray<NEIPv4Route*>* routes =
       [NSMutableArray arrayWithArray:t->settings.IPv4Settings.includedRoutes];
-  for (int i = 0; i < routes.count; i++)
+  for (size_t i = 0; i < routes.count; i++)
   {
     if ([routes[i].destinationAddress isEqualToString:route.destinationAddress] &&
         [routes[i].destinationSubnetMask isEqualToString:route.destinationSubnetMask])
@@ -137,7 +137,7 @@ del_ipv6_route(const char* addr, int prefix, void* ctx)
   LLARPPacketTunnel* t = (__bridge LLARPPacketTunnel*)ctx;
   NSMutableArray<NEIPv6Route*>* routes =
       [NSMutableArray arrayWithArray:t->settings.IPv6Settings.includedRoutes];
-  for (int i = 0; i < routes.count; i++)
+  for (size_t i = 0; i < routes.count; i++)
   {
     if ([routes[i].destinationAddress isEqualToString:route.destinationAddress] &&
         [routes[i].destinationNetworkPrefixLength

llarp/apple/route_manager.cpp

@@ -19,7 +19,7 @@ namespace llarp::apple
     }
 
     std::shared_ptr<llarp::handlers::TunEndpoint> tun;
-    router->hiddenServiceContext().ForEachService([&tun](const auto& name, const auto ep) {
+    router->hiddenServiceContext().ForEachService([&tun](const auto& /*name*/, const auto ep) {
       tun = std::dynamic_pointer_cast<llarp::handlers::TunEndpoint>(ep);
       return !tun;
     });

llarp/apple/route_manager.hpp

@@ -10,17 +10,17 @@ namespace llarp::apple
   {
    public:
     RouteManager(llarp::Context& ctx, llarp_route_callbacks rcs, void* callback_context)
-        : context{ctx}, route_callbacks{std::move(rcs)}, callback_context{callback_context}
+        : context{ctx}, callback_context{callback_context}, route_callbacks{std::move(rcs)}
     {}
 
     /// These are called for poking route holes, but we don't have to do that at all on macos
     /// because the appex isn't subject to its own rules.
     void
-    AddRoute(IPVariant_t ip, IPVariant_t gateway) override
+    AddRoute(IPVariant_t /*ip*/, IPVariant_t /*gateway*/) override
     {}
 
     void
-    DelRoute(IPVariant_t ip, IPVariant_t gateway) override
+    DelRoute(IPVariant_t /*ip*/, IPVariant_t /*gateway*/) override
     {}
 
     void
@@ -35,8 +35,8 @@ namespace llarp::apple
     void
     DelRouteViaInterface(vpn::NetworkInterface& vpn, IPRange range) override;
 
-    virtual std::vector<IPVariant_t>
-    GetGatewaysNotOnInterface(std::string ifname) override
+    std::vector<IPVariant_t>
+    GetGatewaysNotOnInterface(std::string /*ifname*/) override
     {
       // We can't get this on mac from our sandbox, but we don't actually need it because we
       // ignore the gateway for AddRoute/DelRoute anyway, so just return a zero IP.

llarp/handlers/tun.cpp

@@ -67,7 +67,7 @@ namespace llarp
           : m_Reply{std::move(reply)}, m_OurIP{std::move(our_ip)}, m_Config{std::move(conf)}
       {}
 
-      virtual ~DnsInterceptor() = default;
+       ~DnsInterceptor() override = default;
 
       void
       SendTo(const SockAddr& to, const SockAddr& from, OwnedBuffer buf) const override
@@ -91,23 +91,21 @@ namespace llarp
       bool
       WouldLoop(const SockAddr& to, const SockAddr& from) const override
       {
-#ifdef __APPLE__
-        (void)from;
+          if constexpr (platform::is_apple) {
         // DNS on Apple is a bit weird because in order for the NetworkExtension itself to send data
         // through the tunnel we have to proxy DNS requests through Apple APIs (and so our actual
-        // upstream DNS won't be set in our resolvers, which is why the vanilla IsUpstreamResolver
-        // won't work for us.  However when active the mac also only queries the main tunnel IP for
-        // DNS, so we consider anything else to be upstream-bound DNS to let it through the tunnel.
-        return to.asIPv6() != m_OurIP();
-#else
-        if (auto maybe_addr = m_Config.m_QueryBind)
+        // upstream DNS won't be set in our resolvers, which is why the vanilla WouldLoop won't work
+        // for us).  However when active the mac also only queries the main tunnel IP for DNS, so we
+        // consider anything else to be upstream-bound DNS to let it through the tunnel.
+        return to.getIP() != m_OurIP;
+          }
+        else if (auto maybe_addr = m_Config.m_QueryBind)
         {
           const auto& addr = *maybe_addr;
           // omit traffic to and from our dns socket
           return addr == to or addr == from;
         }
         return false;
-#endif
       }
     };