Re: [PATCH 7/7] netfilter: nf_ct_helper: better logging for dropped packets

On Mon, Feb 18, 2013 at 04:22:02PM -0800, Joe Perches wrote:

On Tue, 2013-02-19 at 01:10 +0100, pablo@netfilter.org wrote:

quoted

This patch modifies the existing code to provide more specific
error message in the scope of each helper to help users to debug
the reason why the packet has been dropped, ie:

[]

quoted

diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h

[]

quoted

@@ -100,6 +100,9 @@ struct nf_ct_helper_expectfn {
 	void (*expectfn)(struct nf_conn *ct, struct nf_conntrack_expect *exp);
 };
 
+extern void nf_ct_helper_log(struct sk_buff *skb, const struct nf_conn *,
+			     const char *fmt, ...);

this should be declared

__printf(3, 4)
void nf_ct_helper_log(etc...)

Fixed, thanks.

to get the compiler to verify format and arguments.

quoted

@@ -210,8 +212,11 @@ static int help(struct sk_buff *skb, unsigned int protoff,
 						 addr_beg_p - ib_ptr,
 						 addr_end_p - addr_beg_p,
 						 exp);
-			else if (nf_ct_expect_related(exp) != 0)
+			else if (nf_ct_expect_related(exp) != 0) {
+				nf_ct_helper_log(skb, ct, "cannot add "
+							  "expectation");

do please try to avoid splitting formats

				nf_ct_helper_log(skb, ct,
						 "cannot add expectation");

Done whenever possible, sometimes I see myself forced to split them to
fit 80-chars per column.