[PATCH] fwd: Don't log warnings when failing to bind "weak" ports, just debug messages

[PATCH] fwd: Don't log warnings when failing to bind "weak" ports, just debug messages

[Stefano Brivio]

When ports are forwarded by exclusion, we might fail to bind all
privileged ports (typically lower than 1024), but that's actually
expected, and we shouldn't log warnings just because of that.

Now, if those ports are automatically forwarded, and we have a
container binding some low ports, we'll log those warnings messages
every second, which is just unnecessary noise in the system log or
in log files.

Use LOG_DEBUG as severity for those messages, instead of LOG_WARNING,
so that they are only printed when --debug is given: that should be
convenient enough to investigate things, while avoiding excess noise
during regular operations.

There might be more sophisticated ways to limit this noise, but this
might be a significant regression in some setups, introduced by recent
changes in port forwarding handling, so I'm going for a somewhat
minimal fix for the moment, which can be improved later on if needed.

Reported-by: frajo <frajo@frajo.fi>
Link: https://bugs.passt.top/show_bug.cgi?id=213
Fixes: b223bec48213 ("fwd, tcp, udp: Set up listening sockets based on forward table")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
---
 fwd.c | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/fwd.c b/fwd.c
index 4ba0af3..5679a3d 100644
--- a/fwd.c
+++ b/fwd.c
@@ -392,17 +392,22 @@ static int fwd_sync_one(const struct ctx *c, uint8_t pif, unsigned idx,
 		fd = pif_listen(c, rule->proto, pif, addr, ifname, port, idx);
 		if (fd < 0) {
 			char astr[INANY_ADDRSTRLEN];
+			int pri = LOG_WARNING;
 
-			warn("Listen failed for %s %s port %s%s%s/%u: %s",
-			     pif_name(pif), ipproto_name(rule->proto),
-			     inany_ntop(addr, astr, sizeof(astr)),
-			     ifname ? "%" : "", ifname ? ifname : "",
-			     port, strerror_(-fd));
+			if (rule->flags & FWD_WEAK)
+				pri = LOG_DEBUG;
 
-			if (!(rule->flags & FWD_WEAK))
-				return -1;
+			logmsg(true, false, pri,
+			       "Listen failed for %s %s port %s%s%s/%u: %s",
+			       pif_name(pif), ipproto_name(rule->proto),
+			       inany_ntop(addr, astr, sizeof(astr)),
+			       ifname ? "%" : "", ifname ? ifname : "",
+			       port, strerror_(-fd));
 
-			continue;
+			if (rule->flags & FWD_WEAK)
+				continue;
+
+			return -1;
 		}
 
 		socks[port - rule->first] = fd;
-- 
2.43.0

Re: [PATCH] fwd: Don't log warnings when failing to bind "weak" ports, just debug messages

[David Gibson]

[-- Attachment #1: Type: text/plain, Size: 2819 bytes --]

On Mon, Jul 27, 2026 at 08:18:40AM +0200, Stefano Brivio wrote:
> When ports are forwarded by exclusion, we might fail to bind all
> privileged ports (typically lower than 1024), but that's actually
> expected, and we shouldn't log warnings just because of that.
> 
> Now, if those ports are automatically forwarded, and we have a
> container binding some low ports, we'll log those warnings messages
> every second, which is just unnecessary noise in the system log or
> in log files.
> 
> Use LOG_DEBUG as severity for those messages, instead of LOG_WARNING,
> so that they are only printed when --debug is given: that should be
> convenient enough to investigate things, while avoiding excess noise
> during regular operations.
> 
> There might be more sophisticated ways to limit this noise, but this
> might be a significant regression in some setups, introduced by recent
> changes in port forwarding handling, so I'm going for a somewhat
> minimal fix for the moment, which can be improved later on if needed.
> 
> Reported-by: frajo <frajo@frajo.fi>
> Link: https://bugs.passt.top/show_bug.cgi?id=213
> Fixes: b223bec48213 ("fwd, tcp, udp: Set up listening sockets based on forward table")
> Signed-off-by: Stefano Brivio <sbrivio@redhat.com>

Reviewed-by: David Gibson <david@gibson.dropbear.id.au>

> ---
>  fwd.c | 21 +++++++++++++--------
>  1 file changed, 13 insertions(+), 8 deletions(-)
> 
> diff --git a/fwd.c b/fwd.c
> index 4ba0af3..5679a3d 100644
> --- a/fwd.c
> +++ b/fwd.c
> @@ -392,17 +392,22 @@ static int fwd_sync_one(const struct ctx *c, uint8_t pif, unsigned idx,
>  		fd = pif_listen(c, rule->proto, pif, addr, ifname, port, idx);
>  		if (fd < 0) {
>  			char astr[INANY_ADDRSTRLEN];
> +			int pri = LOG_WARNING;
>  
> -			warn("Listen failed for %s %s port %s%s%s/%u: %s",
> -			     pif_name(pif), ipproto_name(rule->proto),
> -			     inany_ntop(addr, astr, sizeof(astr)),
> -			     ifname ? "%" : "", ifname ? ifname : "",
> -			     port, strerror_(-fd));
> +			if (rule->flags & FWD_WEAK)
> +				pri = LOG_DEBUG;
>  
> -			if (!(rule->flags & FWD_WEAK))
> -				return -1;
> +			logmsg(true, false, pri,
> +			       "Listen failed for %s %s port %s%s%s/%u: %s",
> +			       pif_name(pif), ipproto_name(rule->proto),
> +			       inany_ntop(addr, astr, sizeof(astr)),
> +			       ifname ? "%" : "", ifname ? ifname : "",
> +			       port, strerror_(-fd));
>  
> -			continue;
> +			if (rule->flags & FWD_WEAK)
> +				continue;
> +
> +			return -1;
>  		}
>  
>  		socks[port - rule->first] = fd;
> -- 
> 2.43.0
> 

-- 
David Gibson (he or they)	| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you, not the other way
				| around.
http://www.ozlabs.org/~dgibson

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]