Re: [PATCH net-next v1] net: add missing syncookie statistics for BPF custom syncookies

[Jiayuan Chen <jiayuan.chen@linux.dev>]

On 4/11/26 6:31 AM, Kuniyuki Iwashima wrote:
>> 1. Replace IS_ENABLED(CONFIG_BPF) with CONFIG_BPF_SYSCALL for
>>     cookie_bpf_ok() and cookie_bpf_check(). CONFIG_BPF is selected by
>>     CONFIG_NET unconditionally, so IS_ENABLED(CONFIG_BPF) is always
>>     true and provides no real guard. CONFIG_BPF_SYSCALL is the correct
>>     config for BPF program functionality.
>>
>> 2. Remove the CONFIG_BPF_SYSCALL guard around struct bpf_tcp_req_attrs.
>>     This struct is referenced by bpf_sk_assign_tcp_reqsk() in
>>     net/core/filter.c which is compiled unconditionally, so wrapping
>>     the definition in a config guard could cause build failures when
>>     CONFIG_BPF_SYSCALL=n.
>>
>> 3. Fix mismatched declaration of cookie_bpf_check() between the
>>     CONFIG_BPF_SYSCALL and stub paths: the real definition takes
>>     'struct net *net' but the declaration in the header did not.
>>     Add the net parameter to the declaration and all call sites.
>>
>> 4. Add missing LINUX_MIB_SYNCOOKIESRECV and LINUX_MIB_SYNCOOKIESFAILED
>>     statistics in cookie_bpf_check(), so that BPF custom syncookie
>>     validation is accounted for in SNMP counters just like the
>>     non-BPF path.
>>
>> Compile-tested with CONFIG_BPF_SYSCALL=y and CONFIG_BPF_SYSCALL
>> not set.
> Can you add SNMP test in tcp_custom_syncookie.c by checking
> the delta before connect_to_fd() and after accept() ?


Thanks for the suggestion. I've added the following to the existing test 
case and it works correctly:

+   recv_before = read_tcpext("SyncookiesRecv");
+   failed_before = read_tcpext("SyncookiesFailed");

    client = connect_to_fd(server, 0);
    if (!ASSERT_NEQ(client, -1, "connect_to_fd"))
          goto close_server;

    child = accept(server, NULL, 0);
    if (!ASSERT_NEQ(child, -1, "accept"))
          goto close_client;

+   recv_after = read_tcpext("SyncookiesRecv");
+   failed_after = read_tcpext("SyncookiesFailed");

+   ASSERT_EQ(recv_after - recv_before, 1, "SyncookiesRecv delta");
+   ASSERT_EQ(failed_after - failed_before, 0, "SyncookiesFailed delta");

Will include it in v2.