Re: [PATCH net 05/10] netfilter: x_tables: remove pr_debug

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Sat, Aug 22, 2026 at 12:52:27PM -0700, Jakub Kicinski wrote:
> This is an AI-generated review of your patch. The human sending this
> email has considered the AI review valid, or at least plausible.
> ---
> netfilter: x_tables: remove pr_debug
> 
> This drops the pr_debug() calls from a set of xtables matches and
> targets, and converts the ones in the .check paths into
> pr_info_ratelimited() so that legacy iptables users get a hint in dmesg
> when a rule is rejected.
> 
> A few observations below.
> 
> > diff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c
> > index 6d1a5d2026a67..37c207d3152a4 100644
> > --- a/net/ipv6/netfilter/ip6t_hbh.c
> > +++ b/net/ipv6/netfilter/ip6t_hbh.c
> 
> [ ... ]
> 
> > @@ -166,16 +144,16 @@ static int hbh_mt6_check(const struct xt_mtchk_param *par)
> >  	const struct ip6t_opts *optsinfo = par->matchinfo;
> >  
> >  	if (optsinfo->invflags & ~IP6T_OPTS_INV_MASK) {
> > -		pr_debug("unknown flags %X\n", optsinfo->invflags);
> > +		pr_info_ratelimited("unknown flags %X\n", optsinfo->invflags);
> >  		return -EINVAL;
> >  	}
> >  	if (optsinfo->optsnr > IP6T_OPTS_OPTSNR) {
> > -		pr_debug("too many supported opts specified\n");
> > +		pr_info_ratelimited("too many supported opts specified\n");
> >  		return -EINVAL;
> >  	}
> >  
> >  	if (optsinfo->flags & IP6T_OPTS_NSTRICT) {
> > -		pr_debug("Not strict - not implemented");
> > +		pr_info_ratelimited("Not strict - not implemented");
> >  		return -EINVAL;
> >  	}
> 
> [Severity: Low]
> Should this string get a trailing newline like its two siblings in
> hbh_mt6_check()?

Yes, this needs \n in all these pr_debug() to pr_info_ratelimited().