nft: More verbose extension comparison debugging

Dump extension data if it differs.

Signed-off-by: Phil Sutter <phil@nwl.cc>

diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
index 0cd082b5396d0d9fd04cd1c950c4b1ad9b69f825..34ca9d16569d0a329095518c964d9bbb8466c9c5 100644 (file)
--- a/iptables/nft-shared.c
+++ b/iptables/nft-shared.c
@@ -398,6 +398,8 @@ bool compare_matches(struct xtables_rule_match *mt1,
 
                if (memcmp(m1->data, m2->data, cmplen) != 0) {
                        DEBUGP("mismatch match data\n");
+                       DEBUG_HEXDUMP("m1->data", m1->data, cmplen);
+                       DEBUG_HEXDUMP("m2->data", m2->data, cmplen);
                        return false;
                }
        }

diff --git a/iptables/xshared.h b/iptables/xshared.h
index 0ed9f3c29c6004e4585c111c2ea342ba709f9d8d..a200e0d620ad37b5213ff3bb309526e42422b338 100644 (file)
--- a/iptables/xshared.h
+++ b/iptables/xshared.h
@@ -12,8 +12,15 @@
 
 #ifdef DEBUG
 #define DEBUGP(x, args...) fprintf(stderr, x, ## args)
+#define DEBUG_HEXDUMP(pfx, data, len)                                  \
+       for (int __i = 0; __i < (len); __i++) {                         \
+               if (__i % 16 == 0)                                      \
+                       printf("%s%s: ", __i ? "\n" : "", (pfx));       \
+               printf("%02x ", ((const unsigned char *)data)[__i]);    \
+       } printf("\n")
 #else
 #define DEBUGP(x, args...)
+#define DEBUG_HEXDUMP(pfx, data, len)
 #endif
 
 enum {