[PATCH net-next v2 0/8] tunnels: add core and gre drop reasons

[Anton Danilov <littlesmilingcloud@gmail.com>]

Only vxlan reports drop reasons among the tunnel drivers today.
Everything else, on both the receive and the transmit side, ends in a
plain kfree_skb(), so a packet that a tunnel throws away is invisible
to dropwatch, drop_monitor and perf trace -e skb:kfree_skb. The device
counters group the failures coarsely: rx_errors and tx_errors each
cover half a dozen unrelated conditions.

This series covers the generic paths shared by ipip, sit, vti, gre and
their IPv6 counterparts, plus the GRE specific parsing, on both
directions. A later series will do the same for geneve, bareudp, fou
and the remaining IP in IP drivers.

Patches 1-2 convert the generic receive paths, ip_tunnel_rcv() and
__ip6_tnl_rcv(). Two reasons are added:

  TNL_OPT_MISMATCH  the options a packet carries do not match the
                    tunnel configuration
  TNL_OLD_SEQ       the sequence number is older than the one the
                    tunnel expects, next to the existing
                    TCP_OLD_SEQUENCE

The second one has a failure mode worth naming: when a peer reboots,
its outgoing sequence number restarts at zero and the receiver drops
everything until its own counter catches up. That is indistinguishable
from a misconfiguration by the counters alone.

Patches 3-5 do the GRE specific receive path. gre_parse_header()
returns -EINVAL for six different reasons, and the only detail its
callers could get was a csum_err flag that none of them read: both
ip_gre and ip6_gre declared it, passed it in and ignored it. It is
replaced by a drop reason. Three reasons are added, mirroring vxlan:
GRE_INVALID_HDR, GRE_CSUM and GRE_TUNNEL_NOT_FOUND.

Patches 6-8 do the transmit side, about forty failure paths across
ip_tunnel, ip_gre, ip6_tunnel and ip6_gre. One reason is added,
TNL_ENCAP, for a failure to build the encapsulation header.

The transmit side has its own case worth naming: tnl_update_pmtu()
returns -E2BIG after it has already sent an ICMP fragmentation needed
back, which is path MTU discovery working exactly as intended, yet the
drop lands in tx_errors next to genuine failures. An MTU black hole
cannot be told from a broken route by looking at the counters.

Drop reasons on transmit are not new: vxlan already reports several
from its xmit path, and ip_tunnel_core.c reports RECURSION_LIMIT.

Tested under virtme-ng with a script that builds tunnel pairs over
veth in network namespaces, makes each of them fail in one specific
way and reads the reason back from the skb:kfree_skb tracepoint:
twelve cases, each reporting the expected reason from the expected
function. Breaking the new mechanisms on purpose makes exactly the
corresponding cases fail. No DEBUG_NET splat from the
SKB_NOT_DROPPED_YET check in sk_skb_reason_drop(). v1 carried that
script as three selftest patches; they are dropped here.

Changes since v1:
- dropped the three selftest patches (Jakub)
- renamed IP_TUNNEL_CFG_OPTS_MISMATCH to TNL_OPT_MISMATCH (Jakub);
  renamed the other two reasons the series adds for the generic paths,
  IP_TUNNEL_OLD_SEQ and IP_TUNNEL_ENCAP, to TNL_OLD_SEQ and TNL_ENCAP
  so that the three do not end up under two prefixes
- documented the new @reason parameter of ip6_tnl_xmit() (Jakub)
- fixed the local variable ordering in the blocks this series adds
  declarations to (Jakub)
- rebased on current net-next
- v1: https://lore.kernel.org/netdev/20260831215137.549324-1-littlesmilingcloud@gmail.com/

Anton Danilov (8):
  ip_tunnel: add drop reasons to the generic RX path
  ip6_tunnel: add drop reasons to the generic RX path
  gre: make gre_parse_header() report a drop reason
  ip_gre: add drop reasons to the RX path
  ip6_gre: add drop reasons to the RX path
  ip_tunnel: add drop reasons to the transmit path
  ip_gre: add drop reasons to the transmit path
  ip6_tunnel: add drop reasons to the transmit path

 include/net/dropreason-core.h |  38 ++++++++
 include/net/gre.h             |   2 +-
 include/net/ip6_tunnel.h      |   3 +-
 net/ipv4/gre_demux.c          |  51 ++++++++---
 net/ipv4/ip_gre.c             | 144 +++++++++++++++++++++---------
 net/ipv4/ip_tunnel.c          |  60 ++++++++++---
 net/ipv6/ip6_gre.c            | 163 ++++++++++++++++++++++++----------
 net/ipv6/ip6_tunnel.c         |  96 ++++++++++++++------
 8 files changed, 415 insertions(+), 142 deletions(-)

-- 
2.47.3