[PATCH nf-next 1/4] netfilter: x_tables: remove pr_debug in matches/targets

[PATCH nf-next 1/4] netfilter: x_tables: remove pr_debug in matches/targets

[Pablo Neira Ayuso]

Remove pr_debug() for these xtables extensions, these have no use these
days. Still, turn pr_debug() into pr_info_ratelimited() in the .check
path since this helps provide a hint via dmesg in legacy iptables.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/ipv4/netfilter/ipt_ah.c    | 10 +----
 net/ipv6/netfilter/ip6t_ah.c   | 27 +-------------
 net/ipv6/netfilter/ip6t_frag.c | 41 +-------------------
 net/ipv6/netfilter/ip6t_hbh.c  | 40 +++++---------------
 net/ipv6/netfilter/ip6t_mh.c   |  3 --
 net/ipv6/netfilter/ip6t_rt.c   |  6 +--
 net/netfilter/xt_IDLETIMER.c   | 68 ++++++----------------------------
 net/netfilter/xt_LOG.c         |  4 +-
 net/netfilter/xt_MASQUERADE.c  |  4 +-
 net/netfilter/xt_NETMAP.c      |  4 +-
 net/netfilter/xt_REDIRECT.c    |  4 +-
 net/netfilter/xt_esp.c         | 10 +----
 net/netfilter/xt_ipcomp.c      |  8 +---
 net/netfilter/xt_iprange.c     | 32 ++--------------
 net/netfilter/xt_ipvs.c        |  1 -
 net/netfilter/xt_multiport.c   |  4 --
 net/netfilter/xt_sctp.c        | 19 +---------
 net/netfilter/xt_tcpudp.c      |  8 +---
 18 files changed, 47 insertions(+), 246 deletions(-)

diff --git a/net/ipv4/netfilter/ipt_ah.c b/net/ipv4/netfilter/ipt_ah.c
index 161ba412cb08..7131f297ada2 100644
--- a/net/ipv4/netfilter/ipt_ah.c
+++ b/net/ipv4/netfilter/ipt_ah.c
@@ -19,12 +19,7 @@ MODULE_DESCRIPTION("Xtables: IPv4 IPsec-AH SPI match");
 static inline bool
 spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)
 {
-	bool r;
-	pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n",
-		 invert ? '!' : ' ', min, spi, max);
-	r = (spi >= min && spi <= max) ^ invert;
-	pr_debug(" result %s\n", r ? "PASS" : "FAILED");
-	return r;
+	return (spi >= min && spi <= max) ^ invert;
 }
 
 static bool ah_mt(const struct sk_buff *skb, struct xt_action_param *par)
@@ -42,7 +37,6 @@ static bool ah_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		/* We've been asked to examine this packet, and we
 		 * can't.  Hence, no choice but to drop.
 		 */
-		pr_debug("Dropping evil AH tinygram.\n");
 		par->hotdrop = true;
 		return false;
 	}
@@ -58,7 +52,7 @@ static int ah_mt_check(const struct xt_mtchk_param *par)
 
 	/* Must specify no unknown invflags */
 	if (ahinfo->invflags & ~IPT_AH_INV_MASK) {
-		pr_debug("unknown flags %X\n", ahinfo->invflags);
+		pr_info_ratelimited("unknown flags %X\n", ahinfo->invflags);
 		return -EINVAL;
 	}
 	return 0;
diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c
index 1258783ed876..dab7dbc6a675 100644
--- a/net/ipv6/netfilter/ip6t_ah.c
+++ b/net/ipv6/netfilter/ip6t_ah.c
@@ -24,13 +24,7 @@ MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
 static inline bool
 spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)
 {
-	bool r;
-
-	pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n",
-		 invert ? '!' : ' ', min, spi, max);
-	r = (spi >= min && spi <= max) ^ invert;
-	pr_debug(" result %s\n", r ? "PASS" : "FAILED");
-	return r;
+	return (spi >= min && spi <= max) ^ invert;
 }
 
 static bool ah_mt6(const struct sk_buff *skb, struct xt_action_param *par)
@@ -62,23 +56,6 @@ static bool ah_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 		return false;
 	}
 
-	pr_debug("IPv6 AH LEN %u %u ", hdrlen, ah->hdrlen);
-	pr_debug("RES %04X ", ah->reserved);
-	pr_debug("SPI %u %08X\n", ntohl(ah->spi), ntohl(ah->spi));
-
-	pr_debug("IPv6 AH spi %02X ",
-		 spi_match(ahinfo->spis[0], ahinfo->spis[1],
-			   ntohl(ah->spi),
-			   !!(ahinfo->invflags & IP6T_AH_INV_SPI)));
-	pr_debug("len %02X %04X %02X ",
-		 ahinfo->hdrlen, hdrlen,
-		 (!ahinfo->hdrlen ||
-		  (ahinfo->hdrlen == hdrlen) ^
-		  !!(ahinfo->invflags & IP6T_AH_INV_LEN)));
-	pr_debug("res %02X %04X %02X\n",
-		 ahinfo->hdrres, ah->reserved,
-		 !(ahinfo->hdrres && ah->reserved));
-
 	return spi_match(ahinfo->spis[0], ahinfo->spis[1],
 			  ntohl(ah->spi),
 			  !!(ahinfo->invflags & IP6T_AH_INV_SPI)) &&
@@ -93,7 +70,7 @@ static int ah_mt6_check(const struct xt_mtchk_param *par)
 	const struct ip6t_ah *ahinfo = par->matchinfo;
 
 	if (ahinfo->invflags & ~IP6T_AH_INV_MASK) {
-		pr_debug("unknown flags %X\n", ahinfo->invflags);
+		pr_info_ratelimited("unknown flags %X\n", ahinfo->invflags);
 		return -EINVAL;
 	}
 	return 0;
diff --git a/net/ipv6/netfilter/ip6t_frag.c b/net/ipv6/netfilter/ip6t_frag.c
index 3aad6439386b..f5f3cfb8704c 100644
--- a/net/ipv6/netfilter/ip6t_frag.c
+++ b/net/ipv6/netfilter/ip6t_frag.c
@@ -23,12 +23,7 @@ MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
 static inline bool
 id_match(u_int32_t min, u_int32_t max, u_int32_t id, bool invert)
 {
-	bool r;
-	pr_debug("id_match:%c 0x%x <= 0x%x <= 0x%x\n", invert ? '!' : ' ',
-		 min, id, max);
-	r = (id >= min && id <= max) ^ invert;
-	pr_debug(" result %s\n", r ? "PASS" : "FAILED");
-	return r;
+	return (id >= min && id <= max) ^ invert;
 }
 
 static bool
@@ -53,38 +48,6 @@ frag_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 		return false;
 	}
 
-	pr_debug("INFO %04X ", fh->frag_off);
-	pr_debug("OFFSET %04X ", ntohs(fh->frag_off) & ~0x7);
-	pr_debug("RES %02X %04X", fh->reserved, ntohs(fh->frag_off) & 0x6);
-	pr_debug("MF %04X ", fh->frag_off & htons(IP6_MF));
-	pr_debug("ID %u %08X\n", ntohl(fh->identification),
-		 ntohl(fh->identification));
-
-	pr_debug("IPv6 FRAG id %02X ",
-		 id_match(fraginfo->ids[0], fraginfo->ids[1],
-			  ntohl(fh->identification),
-			  !!(fraginfo->invflags & IP6T_FRAG_INV_IDS)));
-	pr_debug("res %02X %02X%04X %02X ",
-		 fraginfo->flags & IP6T_FRAG_RES, fh->reserved,
-		 ntohs(fh->frag_off) & 0x6,
-		 !((fraginfo->flags & IP6T_FRAG_RES) &&
-		   (fh->reserved || (ntohs(fh->frag_off) & 0x06))));
-	pr_debug("first %02X %02X %02X ",
-		 fraginfo->flags & IP6T_FRAG_FST,
-		 ntohs(fh->frag_off) & ~0x7,
-		 !((fraginfo->flags & IP6T_FRAG_FST) &&
-		   (ntohs(fh->frag_off) & ~0x7)));
-	pr_debug("mf %02X %02X %02X ",
-		 fraginfo->flags & IP6T_FRAG_MF,
-		 ntohs(fh->frag_off) & IP6_MF,
-		 !((fraginfo->flags & IP6T_FRAG_MF) &&
-		   !((ntohs(fh->frag_off) & IP6_MF))));
-	pr_debug("last %02X %02X %02X\n",
-		 fraginfo->flags & IP6T_FRAG_NMF,
-		 ntohs(fh->frag_off) & IP6_MF,
-		 !((fraginfo->flags & IP6T_FRAG_NMF) &&
-		   (ntohs(fh->frag_off) & IP6_MF)));
-
 	return id_match(fraginfo->ids[0], fraginfo->ids[1],
 			 ntohl(fh->identification),
 			 !!(fraginfo->invflags & IP6T_FRAG_INV_IDS)) &&
@@ -103,7 +66,7 @@ static int frag_mt6_check(const struct xt_mtchk_param *par)
 	const struct ip6t_frag *fraginfo = par->matchinfo;
 
 	if (fraginfo->invflags & ~IP6T_FRAG_INV_MASK) {
-		pr_debug("unknown flags %X\n", fraginfo->invflags);
+		pr_info_ratelimited("unknown flags %X\n", fraginfo->invflags);
 		return -EINVAL;
 	}
 	return 0;
diff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c
index 6d1a5d2026a6..37c207d3152a 100644
--- a/net/ipv6/netfilter/ip6t_hbh.c
+++ b/net/ipv6/netfilter/ip6t_hbh.c
@@ -79,14 +79,6 @@ hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 		return false;
 	}
 
-	pr_debug("IPv6 OPTS LEN %u %u ", hdrlen, oh->hdrlen);
-
-	pr_debug("len %02X %04X %02X ",
-		 optinfo->hdrlen, hdrlen,
-		 (!(optinfo->flags & IP6T_OPTS_LEN) ||
-		  ((optinfo->hdrlen == hdrlen) ^
-		   !!(optinfo->invflags & IP6T_OPTS_INV_LEN))));
-
 	ret = (!(optinfo->flags & IP6T_OPTS_LEN) ||
 	       ((optinfo->hdrlen == hdrlen) ^
 		!!(optinfo->invflags & IP6T_OPTS_INV_LEN)));
@@ -96,8 +88,6 @@ hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 	if (!(optinfo->flags & IP6T_OPTS_OPTS)) {
 		return ret;
 	} else {
-		pr_debug("Strict ");
-		pr_debug("#%d ", optinfo->optsnr);
 		for (temp = 0; temp < optinfo->optsnr; temp++) {
 			/* type field exists ? */
 			if (hdrlen < 1)
@@ -108,13 +98,9 @@ hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 				break;
 
 			/* Type check */
-			if (*tp != (optinfo->opts[temp] & 0xFF00) >> 8) {
-				pr_debug("Tbad %02X %02X\n", *tp,
-					 (optinfo->opts[temp] & 0xFF00) >> 8);
+			if (*tp != (optinfo->opts[temp] & 0xFF00) >> 8)
 				return false;
-			} else {
-				pr_debug("Tok ");
-			}
+
 			/* Length check */
 			if (*tp) {
 				u16 spec_len;
@@ -129,26 +115,18 @@ hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 					break;
 				spec_len = optinfo->opts[temp] & 0x00FF;
 
-				if (spec_len != 0x00FF && spec_len != *lp) {
-					pr_debug("Lbad %02X %04X\n", *lp,
-						 spec_len);
+				if (spec_len != 0x00FF && spec_len != *lp)
 					return false;
-				}
-				pr_debug("Lok ");
+
 				optlen = *lp + 2;
 			} else {
-				pr_debug("Pad1\n");
 				optlen = 1;
 			}
 
-			/* Step to the next */
-			pr_debug("len%04X\n", optlen);
-
 			if ((ptr > skb->len - optlen || hdrlen < optlen) &&
-			    temp < optinfo->optsnr - 1) {
-				pr_debug("new pointer is too large!\n");
+			    temp < optinfo->optsnr - 1)
 				break;
-			}
+
 			ptr += optlen;
 			hdrlen -= optlen;
 		}
@@ -166,16 +144,16 @@ static int hbh_mt6_check(const struct xt_mtchk_param *par)
 	const struct ip6t_opts *optsinfo = par->matchinfo;
 
 	if (optsinfo->invflags & ~IP6T_OPTS_INV_MASK) {
-		pr_debug("unknown flags %X\n", optsinfo->invflags);
+		pr_info_ratelimited("unknown flags %X\n", optsinfo->invflags);
 		return -EINVAL;
 	}
 	if (optsinfo->optsnr > IP6T_OPTS_OPTSNR) {
-		pr_debug("too many supported opts specified\n");
+		pr_info_ratelimited("too many supported opts specified\n");
 		return -EINVAL;
 	}
 
 	if (optsinfo->flags & IP6T_OPTS_NSTRICT) {
-		pr_debug("Not strict - not implemented");
+		pr_info_ratelimited("Not strict - not implemented");
 		return -EINVAL;
 	}
 
diff --git a/net/ipv6/netfilter/ip6t_mh.c b/net/ipv6/netfilter/ip6t_mh.c
index fd492b69acbc..ba6dcc7791a0 100644
--- a/net/ipv6/netfilter/ip6t_mh.c
+++ b/net/ipv6/netfilter/ip6t_mh.c
@@ -42,14 +42,11 @@ static bool mh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 	if (mh == NULL) {
 		/* We've been asked to examine this packet, and we
 		   can't.  Hence, no choice but to drop. */
-		pr_debug("Dropping evil MH tinygram.\n");
 		par->hotdrop = true;
 		return false;
 	}
 
 	if (mh->ip6mh_proto != IPPROTO_NONE) {
-		pr_debug("Dropping invalid MH Payload Proto: %u\n",
-			 mh->ip6mh_proto);
 		par->hotdrop = true;
 		return false;
 	}
diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
index 278b52752f36..0c01ac2746d1 100644
--- a/net/ipv6/netfilter/ip6t_rt.c
+++ b/net/ipv6/netfilter/ip6t_rt.c
@@ -155,18 +155,18 @@ static int rt_mt6_check(const struct xt_mtchk_param *par)
 	const struct ip6t_rt *rtinfo = par->matchinfo;
 
 	if (rtinfo->invflags & ~IP6T_RT_INV_MASK) {
-		pr_debug("unknown flags %X\n", rtinfo->invflags);
+		pr_info_ratelimited("unknown flags %X\n", rtinfo->invflags);
 		return -EINVAL;
 	}
 	if (rtinfo->addrnr > IP6T_RT_HOPS) {
-		pr_debug("too many addresses specified\n");
+		pr_info_ratelimited("too many addresses specified\n");
 		return -EINVAL;
 	}
 	if ((rtinfo->flags & (IP6T_RT_RES | IP6T_RT_FST_MASK)) &&
 	    (!(rtinfo->flags & IP6T_RT_TYP) ||
 	     (rtinfo->rt_type != 0) ||
 	     (rtinfo->invflags & IP6T_RT_INV_TYP))) {
-		pr_debug("`--rt-type 0' required before `--rt-0-*'");
+		pr_info_ratelimited("`--rt-type 0' required before `--rt-0-*'");
 		return -EINVAL;
 	}
 
diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c
index bfcf2d44e93d..15b698ea98aa 100644
--- a/net/netfilter/xt_IDLETIMER.c
+++ b/net/netfilter/xt_IDLETIMER.c
@@ -102,8 +102,6 @@ static void idletimer_tg_expired(struct timer_list *t)
 {
 	struct idletimer_tg *timer = timer_container_of(timer, t, timer);
 
-	pr_debug("timer %s expired\n", timer->attr.attr.name);
-
 	schedule_work(&timer->work);
 }
 
@@ -111,7 +109,6 @@ static void idletimer_tg_alarmproc(struct alarm *alarm, ktime_t now)
 {
 	struct idletimer_tg *timer = alarm->data;
 
-	pr_debug("alarm %s expired\n", timer->attr.attr.name);
 	schedule_work(&timer->work);
 }
 
@@ -171,7 +168,7 @@ static int idletimer_tg_create(struct idletimer_tg_info *info)
 
 	ret = sysfs_create_file(idletimer_tg_kobj, &info->timer->attr.attr);
 	if (ret < 0) {
-		pr_debug("couldn't add file to sysfs");
+		pr_info_ratelimited("couldn't add file to sysfs");
 		goto out_free_attr;
 	}
 
@@ -220,7 +217,7 @@ static int idletimer_tg_create_v1(struct idletimer_tg_info_v1 *info)
 
 	ret = sysfs_create_file(idletimer_tg_kobj, &info->timer->attr.attr);
 	if (ret < 0) {
-		pr_debug("couldn't add file to sysfs");
+		pr_info_ratelimited("couldn't add file to sysfs");
 		goto out_free_attr;
 	}
 
@@ -228,7 +225,6 @@ static int idletimer_tg_create_v1(struct idletimer_tg_info_v1 *info)
 	kobject_uevent(idletimer_tg_kobj,KOBJ_ADD);
 
 	list_add(&info->timer->entry, &idletimer_tg_list);
-	pr_debug("timer type value is %u", info->timer_type);
 	info->timer->timer_type = info->timer_type;
 	info->timer->refcnt = 1;
 
@@ -263,9 +259,6 @@ static unsigned int idletimer_tg_target(struct sk_buff *skb,
 {
 	const struct idletimer_tg_info *info = par->targinfo;
 
-	pr_debug("resetting timer %s, timeout period %u\n",
-		 info->label, info->timeout);
-
 	mod_timer(&info->timer->timer,
 		  secs_to_jiffies(info->timeout) + jiffies);
 
@@ -280,9 +273,6 @@ static unsigned int idletimer_tg_target_v1(struct sk_buff *skb,
 {
 	const struct idletimer_tg_info_v1 *info = par->targinfo;
 
-	pr_debug("resetting timer %s, timeout period %u\n",
-		 info->label, info->timeout);
-
 	if (info->timer->timer_type & XT_IDLETIMER_ALARM) {
 		idletimer_start_alarm_sec(info->timer, info->timeout);
 	} else {
@@ -296,17 +286,17 @@ static unsigned int idletimer_tg_target_v1(struct sk_buff *skb,
 static int idletimer_tg_helper(struct idletimer_tg_info *info)
 {
 	if (info->timeout == 0) {
-		pr_debug("timeout value is zero\n");
+		pr_info_ratelimited("timeout value is zero\n");
 		return -EINVAL;
 	}
 	if (info->timeout >= INT_MAX / 1000) {
-		pr_debug("timeout value is too big\n");
+		pr_info_ratelimited("timeout value is too big\n");
 		return -EINVAL;
 	}
 	if (info->label[0] == '\0' ||
 	    strnlen(info->label,
 		    MAX_IDLETIMER_LABEL_SIZE) == MAX_IDLETIMER_LABEL_SIZE) {
-		pr_debug("label is empty or not nul-terminated\n");
+		pr_info_ratelimited("label is empty or not nul-terminated\n");
 		return -EINVAL;
 	}
 	return 0;
@@ -318,34 +308,25 @@ static int idletimer_tg_checkentry(const struct xt_tgchk_param *par)
 	struct idletimer_tg_info *info = par->targinfo;
 	int ret;
 
-	pr_debug("checkentry targinfo%s\n", info->label);
-
 	ret = idletimer_tg_helper(info);
 	if(ret < 0)
-	{
-		pr_debug("checkentry helper return invalid\n");
 		return -EINVAL;
-	}
 	mutex_lock(&list_mutex);
 
 	info->timer = __idletimer_tg_find_by_label(info->label);
 	if (info->timer) {
 		if (info->timer->timer_type & XT_IDLETIMER_ALARM) {
-			pr_debug("Adding/Replacing rule with same label and different timer type is not allowed\n");
 			mutex_unlock(&list_mutex);
+			pr_info_ratelimited("Adding/Replacing rule with same label and different timer type is not allowed\n");
 			return -EINVAL;
 		}
 
 		info->timer->refcnt++;
 		mod_timer(&info->timer->timer,
 			  secs_to_jiffies(info->timeout) + jiffies);
-
-		pr_debug("increased refcnt of timer %s to %u\n",
-			 info->label, info->timer->refcnt);
 	} else {
 		ret = idletimer_tg_create(info);
 		if (ret < 0) {
-			pr_debug("failed to create timer\n");
 			mutex_unlock(&list_mutex);
 			return ret;
 		}
@@ -360,30 +341,23 @@ static int idletimer_tg_checkentry_v1(const struct xt_tgchk_param *par)
 	struct idletimer_tg_info_v1 *info = par->targinfo;
 	int ret;
 
-	pr_debug("checkentry targinfo%s\n", info->label);
-
 	if (info->send_nl_msg)
 		return -EOPNOTSUPP;
 
 	ret = idletimer_tg_helper((struct idletimer_tg_info *)info);
 	if(ret < 0)
-	{
-		pr_debug("checkentry helper return invalid\n");
 		return -EINVAL;
-	}
 
-	if (info->timer_type > XT_IDLETIMER_ALARM) {
-		pr_debug("invalid value for timer type\n");
+	if (info->timer_type > XT_IDLETIMER_ALARM)
 		return -EINVAL;
-	}
 
 	mutex_lock(&list_mutex);
 
 	info->timer = __idletimer_tg_find_by_label(info->label);
 	if (info->timer) {
 		if (info->timer->timer_type != info->timer_type) {
-			pr_debug("Adding/Replacing rule with same label and different timer type is not allowed\n");
 			mutex_unlock(&list_mutex);
+			pr_info_ratelimited("Adding/Replacing rule with same label and different timer type is not allowed\n");
 			return -EINVAL;
 		}
 
@@ -393,21 +367,15 @@ static int idletimer_tg_checkentry_v1(const struct xt_tgchk_param *par)
 			ktime_t tout = alarm_expires_remaining(&info->timer->alarm);
 			struct timespec64 ktimespec = ktime_to_timespec64(tout);
 
-			if (ktimespec.tv_sec > 0) {
-				pr_debug("time_expiry_remaining %lld\n",
-					 ktimespec.tv_sec);
+			if (ktimespec.tv_sec > 0)
 				idletimer_start_alarm_ktime(info->timer, tout);
-			}
 		} else {
 				mod_timer(&info->timer->timer,
 					secs_to_jiffies(info->timeout) + jiffies);
 		}
-		pr_debug("increased refcnt of timer %s to %u\n",
-			 info->label, info->timer->refcnt);
 	} else {
 		ret = idletimer_tg_create_v1(info);
 		if (ret < 0) {
-			pr_debug("failed to create timer\n");
 			mutex_unlock(&list_mutex);
 			return ret;
 		}
@@ -421,19 +389,13 @@ static void idletimer_tg_destroy(const struct xt_tgdtor_param *par)
 {
 	const struct idletimer_tg_info *info = par->targinfo;
 
-	pr_debug("destroy targinfo %s\n", info->label);
-
 	mutex_lock(&list_mutex);
 
 	if (--info->timer->refcnt > 0) {
-		pr_debug("decreased refcnt of timer %s to %u\n",
-			 info->label, info->timer->refcnt);
 		mutex_unlock(&list_mutex);
 		return;
 	}
 
-	pr_debug("deleting timer %s\n", info->label);
-
 	list_del(&info->timer->entry);
 	mutex_unlock(&list_mutex);
 
@@ -448,19 +410,13 @@ static void idletimer_tg_destroy_v1(const struct xt_tgdtor_param *par)
 {
 	const struct idletimer_tg_info_v1 *info = par->targinfo;
 
-	pr_debug("destroy targinfo %s\n", info->label);
-
 	mutex_lock(&list_mutex);
 
 	if (--info->timer->refcnt > 0) {
-		pr_debug("decreased refcnt of timer %s to %u\n",
-			 info->label, info->timer->refcnt);
 		mutex_unlock(&list_mutex);
 		return;
 	}
 
-	pr_debug("deleting timer %s\n", info->label);
-
 	list_del(&info->timer->entry);
 	mutex_unlock(&list_mutex);
 
@@ -534,7 +490,7 @@ static int __init idletimer_tg_init(void)
 	idletimer_tg_class = class_create("xt_idletimer");
 	err = PTR_ERR(idletimer_tg_class);
 	if (IS_ERR(idletimer_tg_class)) {
-		pr_debug("couldn't register device class\n");
+		pr_info_ratelimited("couldn't register device class\n");
 		goto out;
 	}
 
@@ -542,7 +498,7 @@ static int __init idletimer_tg_init(void)
 					    MKDEV(0, 0), NULL, "timers");
 	err = PTR_ERR(idletimer_tg_device);
 	if (IS_ERR(idletimer_tg_device)) {
-		pr_debug("couldn't register system device\n");
+		pr_info_ratelimited("couldn't register system device\n");
 		goto out_class;
 	}
 
@@ -551,7 +507,7 @@ static int __init idletimer_tg_init(void)
 	err = xt_register_targets(idletimer_tg, ARRAY_SIZE(idletimer_tg));
 
 	if (err < 0) {
-		pr_debug("couldn't register xt target\n");
+		pr_info_ratelimited("couldn't register xt target\n");
 		goto out_dev;
 	}
 
diff --git a/net/netfilter/xt_LOG.c b/net/netfilter/xt_LOG.c
index f39244f9c0ed..de3f176792a0 100644
--- a/net/netfilter/xt_LOG.c
+++ b/net/netfilter/xt_LOG.c
@@ -50,12 +50,12 @@ static int log_tg_check(const struct xt_tgchk_param *par)
 		return -EINVAL;
 
 	if (loginfo->level >= 8) {
-		pr_debug("level %u >= 8\n", loginfo->level);
+		pr_info_ratelimited("level %u >= 8\n", loginfo->level);
 		return -EINVAL;
 	}
 
 	if (loginfo->prefix[sizeof(loginfo->prefix)-1] != '\0') {
-		pr_debug("prefix is not null-terminated\n");
+		pr_info_ratelimited("prefix is not null-terminated\n");
 		return -EINVAL;
 	}
 
diff --git a/net/netfilter/xt_MASQUERADE.c b/net/netfilter/xt_MASQUERADE.c
index eae05c178336..cea488cec544 100644
--- a/net/netfilter/xt_MASQUERADE.c
+++ b/net/netfilter/xt_MASQUERADE.c
@@ -21,11 +21,11 @@ static int masquerade_tg_check(const struct xt_tgchk_param *par)
 	const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
 
 	if (mr->range[0].flags & NF_NAT_RANGE_MAP_IPS) {
-		pr_debug("bad MAP_IPS.\n");
+		pr_info_ratelimited("bad MAP_IPS.\n");
 		return -EINVAL;
 	}
 	if (mr->rangesize != 1) {
-		pr_debug("bad rangesize %u\n", mr->rangesize);
+		pr_info_ratelimited("bad rangesize %u\n", mr->rangesize);
 		return -EINVAL;
 	}
 	return nf_ct_netns_get(par->net, par->family);
diff --git a/net/netfilter/xt_NETMAP.c b/net/netfilter/xt_NETMAP.c
index cb2ee80d84fa..8c86d9a43373 100644
--- a/net/netfilter/xt_NETMAP.c
+++ b/net/netfilter/xt_NETMAP.c
@@ -106,11 +106,11 @@ static int netmap_tg4_check(const struct xt_tgchk_param *par)
 	const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
 
 	if (!(mr->range[0].flags & NF_NAT_RANGE_MAP_IPS)) {
-		pr_debug("bad MAP_IPS.\n");
+		pr_info_ratelimited("bad MAP_IPS.\n");
 		return -EINVAL;
 	}
 	if (mr->rangesize != 1) {
-		pr_debug("bad rangesize %u.\n", mr->rangesize);
+		pr_info_ratelimited("bad rangesize %u.\n", mr->rangesize);
 		return -EINVAL;
 	}
 	return nf_ct_netns_get(par->net, par->family);
diff --git a/net/netfilter/xt_REDIRECT.c b/net/netfilter/xt_REDIRECT.c
index ff66b56a3f97..27bc0545c4f7 100644
--- a/net/netfilter/xt_REDIRECT.c
+++ b/net/netfilter/xt_REDIRECT.c
@@ -51,11 +51,11 @@ static int redirect_tg4_check(const struct xt_tgchk_param *par)
 	const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
 
 	if (mr->range[0].flags & NF_NAT_RANGE_MAP_IPS) {
-		pr_debug("bad MAP_IPS.\n");
+		pr_info_ratelimited("bad MAP_IPS.\n");
 		return -EINVAL;
 	}
 	if (mr->rangesize != 1) {
-		pr_debug("bad rangesize %u.\n", mr->rangesize);
+		pr_info_ratelimited("bad rangesize %u.\n", mr->rangesize);
 		return -EINVAL;
 	}
 	return nf_ct_netns_get(par->net, par->family);
diff --git a/net/netfilter/xt_esp.c b/net/netfilter/xt_esp.c
index 2a1c0ad0ff07..68fd75884268 100644
--- a/net/netfilter/xt_esp.c
+++ b/net/netfilter/xt_esp.c
@@ -25,12 +25,7 @@ MODULE_ALIAS("ip6t_esp");
 static inline bool
 spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)
 {
-	bool r;
-	pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n",
-		 invert ? '!' : ' ', min, spi, max);
-	r = (spi >= min && spi <= max) ^ invert;
-	pr_debug(" result %s\n", r ? "PASS" : "FAILED");
-	return r;
+	return (spi >= min && spi <= max) ^ invert;
 }
 
 static bool esp_mt(const struct sk_buff *skb, struct xt_action_param *par)
@@ -48,7 +43,6 @@ static bool esp_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		/* We've been asked to examine this packet, and we
 		 * can't.  Hence, no choice but to drop.
 		 */
-		pr_debug("Dropping evil ESP tinygram.\n");
 		par->hotdrop = true;
 		return false;
 	}
@@ -62,7 +56,7 @@ static int esp_mt_check(const struct xt_mtchk_param *par)
 	const struct xt_esp *espinfo = par->matchinfo;
 
 	if (espinfo->invflags & ~XT_ESP_INV_MASK) {
-		pr_debug("unknown flags %X\n", espinfo->invflags);
+		pr_info_ratelimited("unknown flags %X\n", espinfo->invflags);
 		return -EINVAL;
 	}
 
diff --git a/net/netfilter/xt_ipcomp.c b/net/netfilter/xt_ipcomp.c
index 472da639a32e..3299c1ea60f9 100644
--- a/net/netfilter/xt_ipcomp.c
+++ b/net/netfilter/xt_ipcomp.c
@@ -29,12 +29,7 @@ MODULE_ALIAS("ip6t_ipcomp");
 static inline bool
 spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)
 {
-	bool r;
-	pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n",
-		 invert ? '!' : ' ', min, spi, max);
-	r = (spi >= min && spi <= max) ^ invert;
-	pr_debug(" result %s\n", r ? "PASS" : "FAILED");
-	return r;
+	return (spi >= min && spi <= max) ^ invert;
 }
 
 static bool comp_mt(const struct sk_buff *skb, struct xt_action_param *par)
@@ -52,7 +47,6 @@ static bool comp_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		/* We've been asked to examine this packet, and we
 		 * can't.  Hence, no choice but to drop.
 		 */
-		pr_debug("Dropping evil IPComp tinygram.\n");
 		par->hotdrop = true;
 		return false;
 	}
diff --git a/net/netfilter/xt_iprange.c b/net/netfilter/xt_iprange.c
index 0c9e014e30b4..bf61141fb785 100644
--- a/net/netfilter/xt_iprange.c
+++ b/net/netfilter/xt_iprange.c
@@ -24,27 +24,15 @@ iprange_mt4(const struct sk_buff *skb, struct xt_action_param *par)
 		m  = ntohl(iph->saddr) < ntohl(info->src_min.ip);
 		m |= ntohl(iph->saddr) > ntohl(info->src_max.ip);
 		m ^= !!(info->flags & IPRANGE_SRC_INV);
-		if (m) {
-			pr_debug("src IP %pI4 NOT in range %s%pI4-%pI4\n",
-			         &iph->saddr,
-			         (info->flags & IPRANGE_SRC_INV) ? "(INV) " : "",
-			         &info->src_min.ip,
-			         &info->src_max.ip);
+		if (m)
 			return false;
-		}
 	}
 	if (info->flags & IPRANGE_DST) {
 		m  = ntohl(iph->daddr) < ntohl(info->dst_min.ip);
 		m |= ntohl(iph->daddr) > ntohl(info->dst_max.ip);
 		m ^= !!(info->flags & IPRANGE_DST_INV);
-		if (m) {
-			pr_debug("dst IP %pI4 NOT in range %s%pI4-%pI4\n",
-			         &iph->daddr,
-			         (info->flags & IPRANGE_DST_INV) ? "(INV) " : "",
-			         &info->dst_min.ip,
-			         &info->dst_max.ip);
+		if (m)
 			return false;
-		}
 	}
 	return true;
 }
@@ -73,27 +61,15 @@ iprange_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 		m  = iprange_ipv6_lt(&iph->saddr, &info->src_min.in6);
 		m |= iprange_ipv6_lt(&info->src_max.in6, &iph->saddr);
 		m ^= !!(info->flags & IPRANGE_SRC_INV);
-		if (m) {
-			pr_debug("src IP %pI6 NOT in range %s%pI6-%pI6\n",
-				 &iph->saddr,
-				 (info->flags & IPRANGE_SRC_INV) ? "(INV) " : "",
-				 &info->src_min.in6,
-				 &info->src_max.in6);
+		if (m)
 			return false;
-		}
 	}
 	if (info->flags & IPRANGE_DST) {
 		m  = iprange_ipv6_lt(&iph->daddr, &info->dst_min.in6);
 		m |= iprange_ipv6_lt(&info->dst_max.in6, &iph->daddr);
 		m ^= !!(info->flags & IPRANGE_DST_INV);
-		if (m) {
-			pr_debug("dst IP %pI6 NOT in range %s%pI6-%pI6\n",
-				 &iph->daddr,
-				 (info->flags & IPRANGE_DST_INV) ? "(INV) " : "",
-				 &info->dst_min.in6,
-				 &info->dst_max.in6);
+		if (m)
 			return false;
-		}
 	}
 	return true;
 }
diff --git a/net/netfilter/xt_ipvs.c b/net/netfilter/xt_ipvs.c
index 253c71cc9a63..e13c0ffb73a9 100644
--- a/net/netfilter/xt_ipvs.c
+++ b/net/netfilter/xt_ipvs.c
@@ -148,7 +148,6 @@ ipvs_mt(const struct sk_buff *skb, struct xt_action_param *par)
 out_put_cp:
 	__ip_vs_conn_put(cp);
 out:
-	pr_debug("match=%d\n", match);
 	return match;
 }
 
diff --git a/net/netfilter/xt_multiport.c b/net/netfilter/xt_multiport.c
index a1691ff405d3..bff5f53a9bef 100644
--- a/net/netfilter/xt_multiport.c
+++ b/net/netfilter/xt_multiport.c
@@ -37,7 +37,6 @@ ports_match_v1(const struct xt_multiport_v1 *minfo,
 		if (minfo->pflags[i]) {
 			/* range port matching */
 			e = minfo->ports[++i];
-			pr_debug("src or dst matches with %d-%d?\n", s, e);
 
 			switch (minfo->flags) {
 			case XT_MULTIPORT_SOURCE:
@@ -58,8 +57,6 @@ ports_match_v1(const struct xt_multiport_v1 *minfo,
 			}
 		} else {
 			/* exact port matching */
-			pr_debug("src or dst matches with %d?\n", s);
-
 			switch (minfo->flags) {
 			case XT_MULTIPORT_SOURCE:
 				if (src == s)
@@ -97,7 +94,6 @@ multiport_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		/* We've been asked to examine this packet, and we
 		 * can't.  Hence, no choice but to drop.
 		 */
-		pr_debug("Dropping evil offset=0 tinygram.\n");
 		par->hotdrop = true;
 		return false;
 	}
diff --git a/net/netfilter/xt_sctp.c b/net/netfilter/xt_sctp.c
index b46a6a512058..d35c21d9651b 100644
--- a/net/netfilter/xt_sctp.c
+++ b/net/netfilter/xt_sctp.c
@@ -48,30 +48,17 @@ match_packet(const struct sk_buff *skb,
 	const struct xt_sctp_flag_info *flag_info = info->flag_info;
 	int flag_count = info->flag_count;
 
-#ifdef DEBUG
-	int i = 0;
-#endif
-
 	if (chunk_match_type == SCTP_CHUNK_MATCH_ALL)
 		SCTP_CHUNKMAP_COPY(chunkmapcopy, info->chunkmap);
 
 	do {
 		sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch);
 		if (sch == NULL || sch->length == 0) {
-			pr_debug("Dropping invalid SCTP packet.\n");
 			*hotdrop = true;
 			return false;
 		}
-#ifdef DEBUG
-		pr_debug("Chunk num: %d\toffset: %d\ttype: %d\tlength: %d"
-			 "\tflags: %x\n",
-			 ++i, offset, sch->type, htons(sch->length),
-			 sch->flags);
-#endif
 		offset += SCTP_PAD4(ntohs(sch->length));
 
-		pr_debug("skb->len: %d\toffset: %d\n", skb->len, offset);
-
 		if (SCTP_CHUNKMAP_IS_SET(info->chunkmap, sch->type)) {
 			switch (chunk_match_type) {
 			case SCTP_CHUNK_MATCH_ANY:
@@ -121,18 +108,14 @@ sctp_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	const struct sctphdr *sh;
 	struct sctphdr _sh;
 
-	if (par->fragoff != 0) {
-		pr_debug("Dropping non-first fragment.. FIXME\n");
+	if (par->fragoff != 0)
 		return false;
-	}
 
 	sh = skb_header_pointer(skb, par->thoff, sizeof(_sh), &_sh);
 	if (sh == NULL) {
-		pr_debug("Dropping evil TCP offset=0 tinygram.\n");
 		par->hotdrop = true;
 		return false;
 	}
-	pr_debug("spt: %d\tdpt: %d\n", ntohs(sh->source), ntohs(sh->dest));
 
 	return  SCCHECK(ntohs(sh->source) >= info->spts[0]
 			&& ntohs(sh->source) <= info->spts[1],
diff --git a/net/netfilter/xt_tcpudp.c b/net/netfilter/xt_tcpudp.c
index f76cf18f1a24..70608b8d06ab 100644
--- a/net/netfilter/xt_tcpudp.c
+++ b/net/netfilter/xt_tcpudp.c
@@ -44,8 +44,6 @@ tcp_find_option(u_int8_t option,
 	u_int8_t _opt[60 - sizeof(struct tcphdr)];
 	unsigned int i;
 
-	pr_debug("finding option\n");
-
 	if (!optlen)
 		return invert;
 
@@ -81,10 +79,8 @@ static bool tcp_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		   causes this. Its a cracker trying to break in by doing a
 		   flag overwrite to pass the direction checks.
 		*/
-		if (par->fragoff == 1) {
-			pr_debug("Dropping evil TCP offset=1 frag.\n");
+		if (par->fragoff == 1)
 			par->hotdrop = true;
-		}
 		/* Must not be a fragment. */
 		return false;
 	}
@@ -93,7 +89,6 @@ static bool tcp_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	if (th == NULL) {
 		/* We've been asked to examine this packet, and we
 		   can't.  Hence, no choice but to drop. */
-		pr_debug("Dropping evil TCP offset=0 tinygram.\n");
 		par->hotdrop = true;
 		return false;
 	}
@@ -145,7 +140,6 @@ static bool udp_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	if (uh == NULL) {
 		/* We've been asked to examine this packet, and we
 		   can't.  Hence, no choice but to drop. */
-		pr_debug("Dropping evil UDP tinygram.\n");
 		par->hotdrop = true;
 		return false;
 	}
-- 
2.47.3

[PATCH nf-next 2/4] netfilter: xt_CT: check for nul-terminated timeout and helper name

[Pablo Neira Ayuso]

Otherwise, ignore malformed helper/timeout string that userspace
provides.

Fixes: 84f3bb9ae9db ("netfilter: xtables: add CT target")
Fixes: 24de58f46516 ("netfilter: xt_CT: allow to attach timeout policy + glue code")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/xt_CT.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index e78660dfdf4b..91326014ade1 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -195,7 +195,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
 		goto err3;
 	}
 
-	if (info->helper[0]) {
+	if (info->helper[0] &&
+	    strnlen(info->helper, sizeof(info->helper)) < sizeof(info->helper)) {
 		if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) {
 			ret = -ENAMETOOLONG;
 			goto err3;
@@ -206,7 +207,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
 			goto err3;
 	}
 
-	if (info->timeout[0]) {
+	if (info->timeout[0] &&
+	    strnlen(info->timeout, sizeof(info->timeout)) < sizeof(info->timeout)) {
 		if (strnlen(info->timeout, sizeof(info->timeout)) == sizeof(info->timeout)) {
 			ret = -ENAMETOOLONG;
 			goto err4;
-- 
2.47.3

[PATCH nf-next 3/4] netfilter: x_tables: do not print specified table

[Pablo Neira Ayuso]

This is defensive, possibly this string has been already been sanitized
but simply print that this match/target extension can only be used for a
given table.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/ipv4/netfilter/ipt_rpfilter.c  | 3 +--
 net/ipv6/netfilter/ip6t_rpfilter.c | 2 +-
 net/netfilter/xt_CONNSECMARK.c     | 3 +--
 net/netfilter/xt_SECMARK.c         | 3 +--
 4 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c
index 6d9bf5106868..2c38fd6624aa 100644
--- a/net/ipv4/netfilter/ipt_rpfilter.c
+++ b/net/ipv4/netfilter/ipt_rpfilter.c
@@ -95,8 +95,7 @@ static int rpfilter_check(const struct xt_mtchk_param *par)
 
 	if (strcmp(par->table, "mangle") != 0 &&
 	    strcmp(par->table, "raw") != 0) {
-		pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table, not \'%s\'\n",
-				    par->table);
+		pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table\n");
 		return -EINVAL;
 	}
 
diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
index 67c87a88cde4..af8d10d49de8 100644
--- a/net/ipv6/netfilter/ip6t_rpfilter.c
+++ b/net/ipv6/netfilter/ip6t_rpfilter.c
@@ -118,7 +118,7 @@ static int rpfilter_check(const struct xt_mtchk_param *par)
 
 	if (strcmp(par->table, "mangle") != 0 &&
 	    strcmp(par->table, "raw") != 0) {
-		pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table, not \'%s\'\n",
+		pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table\n",
 				    par->table);
 		return -EINVAL;
 	}
diff --git a/net/netfilter/xt_CONNSECMARK.c b/net/netfilter/xt_CONNSECMARK.c
index 1494b3ee30e1..4e4436a9104b 100644
--- a/net/netfilter/xt_CONNSECMARK.c
+++ b/net/netfilter/xt_CONNSECMARK.c
@@ -87,8 +87,7 @@ static int connsecmark_tg_check(const struct xt_tgchk_param *par)
 
 	if (strcmp(par->table, "mangle") != 0 &&
 	    strcmp(par->table, "security") != 0) {
-		pr_info_ratelimited("only valid in \'mangle\' or \'security\' table, not \'%s\'\n",
-				    par->table);
+		pr_info_ratelimited("only valid in \'mangle\' or \'security\' table\n");
 		return -EINVAL;
 	}
 
diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c
index 5bc5ea505eb9..38e8e410b4e8 100644
--- a/net/netfilter/xt_SECMARK.c
+++ b/net/netfilter/xt_SECMARK.c
@@ -79,8 +79,7 @@ secmark_tg_check(const char *table, struct xt_secmark_target_info_v1 *info)
 
 	if (strcmp(table, "mangle") != 0 &&
 	    strcmp(table, "security") != 0) {
-		pr_info_ratelimited("only valid in \'mangle\' or \'security\' table, not \'%s\'\n",
-				    table);
+		pr_info_ratelimited("only valid in \'mangle\' or \'security\' table\n");
 		return -EINVAL;
 	}
 
-- 
2.47.3

Re: [PATCH nf-next 3/4] netfilter: x_tables: do not print specified table

[Jan Engelhardt]

On Tuesday 2026-08-18 14:27, Pablo Neira Ayuso wrote:

>This is defensive, possibly this string has been already been sanitized
>but simply print that this match/target extension can only be used for a
>given table.

>@@ -95,8 +95,7 @@ static int rpfilter_check(const struct xt_mtchk_param *par)
> 
> 	if (strcmp(par->table, "mangle") != 0 &&
> 	    strcmp(par->table, "raw") != 0) {
>-		pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table, not \'%s\'\n",
>-				    par->table);
>+		pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table\n");
> 		return -EINVAL;
> 	}

You have now robbed the user of information where the problem
originated from (and thus removed an avenue on further diagnosis /
remediation), which is one of the classic UI/UX sins[1].

(There should be countless webpages out there that can explain
better than me what's a good and what's a bad error message.)

The table names were historically static, and always valid. The only
requirement is that the string is \0-terminated. That should be true
even for nftables. The use of NLA_STRING for NFTA_TABLE_NAME should
enforce this at the netlink level already.

(Ironically, since C lacks a managed type like std::string, there is
less incentive to even have {ptr, len}-type string objects/views.)

Re: [PATCH nf-next 3/4] netfilter: x_tables: do not print specified table

[Pablo Neira Ayuso]

On Tue, Aug 18, 2026 at 02:55:35PM +0200, Jan Engelhardt wrote:
> 
> On Tuesday 2026-08-18 14:27, Pablo Neira Ayuso wrote:
> 
> >This is defensive, possibly this string has been already been sanitized
> >but simply print that this match/target extension can only be used for a
> >given table.
> 
> >@@ -95,8 +95,7 @@ static int rpfilter_check(const struct xt_mtchk_param *par)
> > 
> > 	if (strcmp(par->table, "mangle") != 0 &&
> > 	    strcmp(par->table, "raw") != 0) {
> >-		pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table, not \'%s\'\n",
> >-				    par->table);
> >+		pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table\n");
> > 		return -EINVAL;
> > 	}
> 
> You have now robbed the user of information where the problem
> originated from (and thus removed an avenue on further diagnosis /
> remediation), which is one of the classic UI/UX sins[1].
>
> (There should be countless webpages out there that can explain
> better than me what's a good and what's a bad error message.)

You are right, I will keep this patch back.

[PATCH nf-next 4/4] netfilter: xt_cgroup: use pr_info_ratelimited()

[Pablo Neira Ayuso]

This seems to be the last xtables extension not using the ratelimited
version, update it.

Fixes: c38c4597e4bf ("netfilter: implement xt_cgroup cgroup2 path match")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/xt_cgroup.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c
index 43d2ae2be628..ac1b7e71cd7f 100644
--- a/net/netfilter/xt_cgroup.c
+++ b/net/netfilter/xt_cgroup.c
@@ -33,7 +33,7 @@ static int cgroup_mt_check_v0(const struct xt_mtchk_param *par)
 		return -EINVAL;
 
 	if (!IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) {
-		pr_info(NET_CLS_CLASSID_INVALID_MSG);
+		pr_info_ratelimited(NET_CLS_CLASSID_INVALID_MSG);
 		return -EINVAL;
 	}
 
@@ -49,7 +49,7 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
 		return -EINVAL;
 
 	if (!info->has_path && !info->has_classid) {
-		pr_info("xt_cgroup: no path or classid specified\n");
+		pr_info_ratelimited("xt_cgroup: no path or classid specified\n");
 		return -EINVAL;
 	}
 
@@ -59,7 +59,7 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
 	}
 
 	if (info->has_classid && !IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) {
-		pr_info(NET_CLS_CLASSID_INVALID_MSG);
+		pr_info_ratelimited(NET_CLS_CLASSID_INVALID_MSG);
 		return -EINVAL;
 	}
 
@@ -89,7 +89,7 @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param *par)
 		return -EINVAL;
 
 	if (!info->has_path && !info->has_classid) {
-		pr_info("xt_cgroup: no path or classid specified\n");
+		pr_info_ratelimited("xt_cgroup: no path or classid specified\n");
 		return -EINVAL;
 	}
 
@@ -99,7 +99,7 @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param *par)
 	}
 
 	if (info->has_classid && !IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) {
-		pr_info(NET_CLS_CLASSID_INVALID_MSG);
+		pr_info_ratelimited(NET_CLS_CLASSID_INVALID_MSG);
 		return -EINVAL;
 	}
 
-- 
2.47.3

Re: [PATCH nf-next 4/4] netfilter: xt_cgroup: use pr_info_ratelimited()

[Florian Westphal]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> This seems to be the last xtables extension not using the ratelimited
> version, update it.

Makes sense, thanks Pablo.

Reviewed-by: Florian Westphal <fw@strlen.de>

Re: [PATCH nf-next 4/4] netfilter: xt_cgroup: use pr_info_ratelimited()

[Fernando Fernandez Mancera]

On 8/18/26 2:27 PM, Pablo Neira Ayuso wrote:
> This seems to be the last xtables extension not using the ratelimited
> version, update it.
> 
> Fixes: c38c4597e4bf ("netfilter: implement xt_cgroup cgroup2 path match")
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
For the whole series:

Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>

Thanks Pablo and Florian. Right getting rid of them makes much more 
sense than fixing the wrong spots.

Re: [PATCH nf-next 1/4] netfilter: x_tables: remove pr_debug in matches/targets

[Florian Westphal]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> Remove pr_debug() for these xtables extensions, these have no use these
> days. Still, turn pr_debug() into pr_info_ratelimited() in the .check
> path since this helps provide a hint via dmesg in legacy iptables.

Makes sense, thanks.

Reviewed-by: Florian Westphal <fw@strlen.de>