Patchwork [RESEND,net-next] xfrm: add LINUX_MIB_XFRMACQUIREERROR statistic counter

login
register
mail settings
Submitter fan.du
Date May 20, 2013, 1:40 a.m.
Message ID <1369014025-19564-1-git-send-email-fan.du@windriver.com>
Download mbox | patch
Permalink /patch/244832/
State Changes Requested
Delegated to: David Miller
Headers show

Comments

fan.du - May 20, 2013, 1:40 a.m.
When host ping its peer, ICMP echo request packet triggers IPsec
policy, then host negotiates SA secret with its peer. After IKE
installed SA for OUT direction, but before SA for IN direction
installed, host get ICMP echo reply from its peer. At the time
being, the SA state for IN direction could be XFRM_STATE_ACQ,
then the received packet will be dropped after adding
LINUX_MIB_XFRMINSTATEINVALID statistic.

Adding a LINUX_MIB_XFRMACQUIREERROR statistic counter for such
scenario when SA in larval state is much clearer for user than
LINUX_MIB_XFRMINSTATEINVALID which indicates the SA is totally
bad.

Signed-off-by: Fan Du <fan.du@windriver.com>
---
 include/uapi/linux/snmp.h |    1 +
 net/xfrm/xfrm_input.c     |    5 +++++
 net/xfrm/xfrm_proc.c      |    1 +
 3 files changed, 7 insertions(+), 0 deletions(-)
Sergei Shtylyov - May 20, 2013, 2:11 p.m.
Hello.

On 20-05-2013 5:40, Fan Du wrote:

> When host ping its peer, ICMP echo request packet triggers IPsec
> policy, then host negotiates SA secret with its peer. After IKE
> installed SA for OUT direction, but before SA for IN direction
> installed, host get ICMP echo reply from its peer. At the time
> being, the SA state for IN direction could be XFRM_STATE_ACQ,
> then the received packet will be dropped after adding
> LINUX_MIB_XFRMINSTATEINVALID statistic.

> Adding a LINUX_MIB_XFRMACQUIREERROR statistic counter for such
> scenario when SA in larval state is much clearer for user than
> LINUX_MIB_XFRMINSTATEINVALID which indicates the SA is totally
> bad.

> Signed-off-by: Fan Du <fan.du@windriver.com>
> ---
>   include/uapi/linux/snmp.h |    1 +
>   net/xfrm/xfrm_input.c     |    5 +++++
>   net/xfrm/xfrm_proc.c      |    1 +
>   3 files changed, 7 insertions(+), 0 deletions(-)

> diff --git a/include/uapi/linux/snmp.h b/include/uapi/linux/snmp.h
> index df2e8b4..3d072bf 100644
> --- a/include/uapi/linux/snmp.h
> +++ b/include/uapi/linux/snmp.h
> @@ -287,6 +287,7 @@ enum
>   	LINUX_MIB_XFRMOUTPOLERROR,		/* XfrmOutPolError */
>   	LINUX_MIB_XFRMFWDHDRERROR,		/* XfrmFwdHdrError*/
>   	LINUX_MIB_XFRMOUTSTATEINVALID,		/* XfrmOutStateInvalid */
> +	LINUX_MIB_XFRMACQUIREERROR,     /* XfrmAcquireError*/

    Please indent the comment with tabs and align with the above ones.

WBR, Sergei

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
fan.du - May 21, 2013, 1:22 a.m.
Hi, Sergei

On 2013年05月20日 22:11, Sergei Shtylyov wrote:
> Hello.
>
> On 20-05-2013 5:40, Fan Du wrote:
>
>> When host ping its peer, ICMP echo request packet triggers IPsec
>> policy, then host negotiates SA secret with its peer. After IKE
>> installed SA for OUT direction, but before SA for IN direction
>> installed, host get ICMP echo reply from its peer. At the time
>> being, the SA state for IN direction could be XFRM_STATE_ACQ,
>> then the received packet will be dropped after adding
>> LINUX_MIB_XFRMINSTATEINVALID statistic.
>
>> Adding a LINUX_MIB_XFRMACQUIREERROR statistic counter for such
>> scenario when SA in larval state is much clearer for user than
>> LINUX_MIB_XFRMINSTATEINVALID which indicates the SA is totally
>> bad.
>
>> Signed-off-by: Fan Du <fan.du@windriver.com>
>> ---
>> include/uapi/linux/snmp.h | 1 +
>> net/xfrm/xfrm_input.c | 5 +++++
>> net/xfrm/xfrm_proc.c | 1 +
>> 3 files changed, 7 insertions(+), 0 deletions(-)
>
>> diff --git a/include/uapi/linux/snmp.h b/include/uapi/linux/snmp.h
>> index df2e8b4..3d072bf 100644
>> --- a/include/uapi/linux/snmp.h
>> +++ b/include/uapi/linux/snmp.h
>> @@ -287,6 +287,7 @@ enum
>> LINUX_MIB_XFRMOUTPOLERROR, /* XfrmOutPolError */
>> LINUX_MIB_XFRMFWDHDRERROR, /* XfrmFwdHdrError*/
>> LINUX_MIB_XFRMOUTSTATEINVALID, /* XfrmOutStateInvalid */
>> + LINUX_MIB_XFRMACQUIREERROR, /* XfrmAcquireError*/
>
> Please indent the comment with tabs and align with the above ones.

Thanks for the point, I will fix this in next round after reviewing from Steffen and others.

> WBR, Sergei
>
>
Steffen Klassert - June 4, 2013, 11:29 a.m.
On Tue, May 21, 2013 at 09:22:24AM +0800, Fan Du wrote:
> Hi, Sergei
> 
> On 2013年05月20日 22:11, Sergei Shtylyov wrote:
> >Hello.
> >
> >On 20-05-2013 5:40, Fan Du wrote:
> >
> >>When host ping its peer, ICMP echo request packet triggers IPsec
> >>policy, then host negotiates SA secret with its peer. After IKE
> >>installed SA for OUT direction, but before SA for IN direction
> >>installed, host get ICMP echo reply from its peer. At the time
> >>being, the SA state for IN direction could be XFRM_STATE_ACQ,
> >>then the received packet will be dropped after adding
> >>LINUX_MIB_XFRMINSTATEINVALID statistic.
> >
> >>Adding a LINUX_MIB_XFRMACQUIREERROR statistic counter for such
> >>scenario when SA in larval state is much clearer for user than
> >>LINUX_MIB_XFRMINSTATEINVALID which indicates the SA is totally
> >>bad.
> >
> >>Signed-off-by: Fan Du <fan.du@windriver.com>
> >>---
> >>include/uapi/linux/snmp.h | 1 +
> >>net/xfrm/xfrm_input.c | 5 +++++
> >>net/xfrm/xfrm_proc.c | 1 +
> >>3 files changed, 7 insertions(+), 0 deletions(-)
> >
> >>diff --git a/include/uapi/linux/snmp.h b/include/uapi/linux/snmp.h
> >>index df2e8b4..3d072bf 100644
> >>--- a/include/uapi/linux/snmp.h
> >>+++ b/include/uapi/linux/snmp.h
> >>@@ -287,6 +287,7 @@ enum
> >>LINUX_MIB_XFRMOUTPOLERROR, /* XfrmOutPolError */
> >>LINUX_MIB_XFRMFWDHDRERROR, /* XfrmFwdHdrError*/
> >>LINUX_MIB_XFRMOUTSTATEINVALID, /* XfrmOutStateInvalid */
> >>+ LINUX_MIB_XFRMACQUIREERROR, /* XfrmAcquireError*/
> >
> >Please indent the comment with tabs and align with the above ones.
> 
> Thanks for the point, I will fix this in next round after reviewing from Steffen and others.
> 

The patch looks ok to me, please fix the indent and resend.

Thanks!
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/include/uapi/linux/snmp.h b/include/uapi/linux/snmp.h
index df2e8b4..3d072bf 100644
--- a/include/uapi/linux/snmp.h
+++ b/include/uapi/linux/snmp.h
@@ -287,6 +287,7 @@  enum
 	LINUX_MIB_XFRMOUTPOLERROR,		/* XfrmOutPolError */
 	LINUX_MIB_XFRMFWDHDRERROR,		/* XfrmFwdHdrError*/
 	LINUX_MIB_XFRMOUTSTATEINVALID,		/* XfrmOutStateInvalid */
+	LINUX_MIB_XFRMACQUIREERROR,     /* XfrmAcquireError*/
 	__LINUX_MIB_XFRMMAX
 };
 
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index ab2bb42..8884399 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -163,6 +163,11 @@  int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
 		skb->sp->xvec[skb->sp->len++] = x;
 
 		spin_lock(&x->lock);
+		if (unlikely(x->km.state == XFRM_STATE_ACQ)) {
+			XFRM_INC_STATS(net, LINUX_MIB_XFRMACQUIREERROR);
+			goto drop_unlock;
+		}
+
 		if (unlikely(x->km.state != XFRM_STATE_VALID)) {
 			XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEINVALID);
 			goto drop_unlock;
diff --git a/net/xfrm/xfrm_proc.c b/net/xfrm/xfrm_proc.c
index c721b0d..80cd1e5 100644
--- a/net/xfrm/xfrm_proc.c
+++ b/net/xfrm/xfrm_proc.c
@@ -44,6 +44,7 @@  static const struct snmp_mib xfrm_mib_list[] = {
 	SNMP_MIB_ITEM("XfrmOutPolError", LINUX_MIB_XFRMOUTPOLERROR),
 	SNMP_MIB_ITEM("XfrmFwdHdrError", LINUX_MIB_XFRMFWDHDRERROR),
 	SNMP_MIB_ITEM("XfrmOutStateInvalid", LINUX_MIB_XFRMOUTSTATEINVALID),
+	SNMP_MIB_ITEM("XfrmAcquireError", LINUX_MIB_XFRMACQUIREERROR),
 	SNMP_MIB_SENTINEL
 };