* [PATCH net-next v1] net: add missing syncookie statistics for BPF custom syncookies
@ 2026-04-09 12:41 Jiayuan Chen
2026-04-10 22:31 ` Kuniyuki Iwashima
0 siblings, 1 reply; 3+ messages in thread
From: Jiayuan Chen @ 2026-04-09 12:41 UTC (permalink / raw)
To: netdev
Cc: Jiayuan Chen, Eric Dumazet, Neal Cardwell, Kuniyuki Iwashima,
David S. Miller, Jakub Kicinski, Paolo Abeni, Simon Horman,
David Ahern, linux-kernel, bpf
1. Replace IS_ENABLED(CONFIG_BPF) with CONFIG_BPF_SYSCALL for
cookie_bpf_ok() and cookie_bpf_check(). CONFIG_BPF is selected by
CONFIG_NET unconditionally, so IS_ENABLED(CONFIG_BPF) is always
true and provides no real guard. CONFIG_BPF_SYSCALL is the correct
config for BPF program functionality.
2. Remove the CONFIG_BPF_SYSCALL guard around struct bpf_tcp_req_attrs.
This struct is referenced by bpf_sk_assign_tcp_reqsk() in
net/core/filter.c which is compiled unconditionally, so wrapping
the definition in a config guard could cause build failures when
CONFIG_BPF_SYSCALL=n.
3. Fix mismatched declaration of cookie_bpf_check() between the
CONFIG_BPF_SYSCALL and stub paths: the real definition takes
'struct net *net' but the declaration in the header did not.
Add the net parameter to the declaration and all call sites.
4. Add missing LINUX_MIB_SYNCOOKIESRECV and LINUX_MIB_SYNCOOKIESFAILED
statistics in cookie_bpf_check(), so that BPF custom syncookie
validation is accounted for in SNMP counters just like the
non-BPF path.
Compile-tested with CONFIG_BPF_SYSCALL=y and CONFIG_BPF_SYSCALL
not set.
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
No functional bug here — CONFIG_BPF is always enabled under
CONFIG_NET, so the existing code compiles and works correctly.
This is a cleanup and improvement, no backport needed.
---
include/net/tcp.h | 7 +++----
net/ipv4/syncookies.c | 10 +++++++---
net/ipv6/syncookies.c | 2 +-
3 files changed, 11 insertions(+), 8 deletions(-)
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 6156d1d068e1..570a8836c2ba 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -598,7 +598,6 @@ struct request_sock *cookie_tcp_reqsk_alloc(const struct request_sock_ops *ops,
struct tcp_options_received *tcp_opt,
int mss, u32 tsoff);
-#if IS_ENABLED(CONFIG_BPF)
struct bpf_tcp_req_attrs {
u32 rcv_tsval;
u32 rcv_tsecr;
@@ -612,7 +611,6 @@ struct bpf_tcp_req_attrs {
u8 usec_ts_ok;
u8 reserved[3];
};
-#endif
#ifdef CONFIG_SYN_COOKIES
@@ -715,13 +713,14 @@ static inline bool cookie_ecn_ok(const struct net *net, const struct dst_entry *
dst_feature(dst, RTAX_FEATURE_ECN);
}
-#if IS_ENABLED(CONFIG_BPF)
+#ifdef CONFIG_BPF_SYSCALL
static inline bool cookie_bpf_ok(struct sk_buff *skb)
{
return skb->sk;
}
-struct request_sock *cookie_bpf_check(struct sock *sk, struct sk_buff *skb);
+struct request_sock *cookie_bpf_check(struct net *net, struct sock *sk,
+ struct sk_buff *skb);
#else
static inline bool cookie_bpf_ok(struct sk_buff *skb)
{
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index f1474598d2c8..d685631438cb 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -295,8 +295,9 @@ static int cookie_tcp_reqsk_init(struct sock *sk, struct sk_buff *skb,
return 0;
}
-#if IS_ENABLED(CONFIG_BPF)
-struct request_sock *cookie_bpf_check(struct sock *sk, struct sk_buff *skb)
+#ifdef CONFIG_BPF_SYSCALL
+struct request_sock *cookie_bpf_check(struct net *net, struct sock *sk,
+ struct sk_buff *skb)
{
struct request_sock *req = inet_reqsk(skb->sk);
@@ -306,6 +307,9 @@ struct request_sock *cookie_bpf_check(struct sock *sk, struct sk_buff *skb)
if (cookie_tcp_reqsk_init(sk, skb, req)) {
reqsk_free(req);
req = NULL;
+ __NET_INC_STATS(net, LINUX_MIB_SYNCOOKIESFAILED);
+ } else {
+ __NET_INC_STATS(net, LINUX_MIB_SYNCOOKIESRECV);
}
return req;
@@ -419,7 +423,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
goto out;
if (cookie_bpf_ok(skb)) {
- req = cookie_bpf_check(sk, skb);
+ req = cookie_bpf_check(net, sk, skb);
} else {
req = cookie_tcp_check(net, sk, skb);
if (IS_ERR(req))
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 4f6f0d751d6c..111d7a41d957 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -190,7 +190,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
goto out;
if (cookie_bpf_ok(skb)) {
- req = cookie_bpf_check(sk, skb);
+ req = cookie_bpf_check(net, sk, skb);
} else {
req = cookie_tcp_check(net, sk, skb);
if (IS_ERR(req))
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH net-next v1] net: add missing syncookie statistics for BPF custom syncookies
2026-04-09 12:41 [PATCH net-next v1] net: add missing syncookie statistics for BPF custom syncookies Jiayuan Chen
@ 2026-04-10 22:31 ` Kuniyuki Iwashima
2026-04-11 1:05 ` Jiayuan Chen
0 siblings, 1 reply; 3+ messages in thread
From: Kuniyuki Iwashima @ 2026-04-10 22:31 UTC (permalink / raw)
To: Jiayuan Chen
Cc: netdev, Eric Dumazet, Neal Cardwell, David S. Miller,
Jakub Kicinski, Paolo Abeni, Simon Horman, David Ahern,
linux-kernel, bpf
On Thu, Apr 9, 2026 at 5:41 AM Jiayuan Chen <jiayuan.chen@linux.dev> wrote:
>
> 1. Replace IS_ENABLED(CONFIG_BPF) with CONFIG_BPF_SYSCALL for
> cookie_bpf_ok() and cookie_bpf_check(). CONFIG_BPF is selected by
> CONFIG_NET unconditionally, so IS_ENABLED(CONFIG_BPF) is always
> true and provides no real guard. CONFIG_BPF_SYSCALL is the correct
> config for BPF program functionality.
>
> 2. Remove the CONFIG_BPF_SYSCALL guard around struct bpf_tcp_req_attrs.
> This struct is referenced by bpf_sk_assign_tcp_reqsk() in
> net/core/filter.c which is compiled unconditionally, so wrapping
> the definition in a config guard could cause build failures when
> CONFIG_BPF_SYSCALL=n.
>
> 3. Fix mismatched declaration of cookie_bpf_check() between the
> CONFIG_BPF_SYSCALL and stub paths: the real definition takes
> 'struct net *net' but the declaration in the header did not.
> Add the net parameter to the declaration and all call sites.
>
> 4. Add missing LINUX_MIB_SYNCOOKIESRECV and LINUX_MIB_SYNCOOKIESFAILED
> statistics in cookie_bpf_check(), so that BPF custom syncookie
> validation is accounted for in SNMP counters just like the
> non-BPF path.
>
> Compile-tested with CONFIG_BPF_SYSCALL=y and CONFIG_BPF_SYSCALL
> not set.
Can you add SNMP test in tcp_custom_syncookie.c by checking
the delta before connect_to_fd() and after accept() ?
>
> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
> ---
> No functional bug here — CONFIG_BPF is always enabled under
> CONFIG_NET, so the existing code compiles and works correctly.
> This is a cleanup and improvement, no backport needed.
> ---
> include/net/tcp.h | 7 +++----
> net/ipv4/syncookies.c | 10 +++++++---
> net/ipv6/syncookies.c | 2 +-
> 3 files changed, 11 insertions(+), 8 deletions(-)
>
> diff --git a/include/net/tcp.h b/include/net/tcp.h
> index 6156d1d068e1..570a8836c2ba 100644
> --- a/include/net/tcp.h
> +++ b/include/net/tcp.h
> @@ -598,7 +598,6 @@ struct request_sock *cookie_tcp_reqsk_alloc(const struct request_sock_ops *ops,
> struct tcp_options_received *tcp_opt,
> int mss, u32 tsoff);
>
> -#if IS_ENABLED(CONFIG_BPF)
> struct bpf_tcp_req_attrs {
> u32 rcv_tsval;
> u32 rcv_tsecr;
> @@ -612,7 +611,6 @@ struct bpf_tcp_req_attrs {
> u8 usec_ts_ok;
> u8 reserved[3];
> };
> -#endif
>
> #ifdef CONFIG_SYN_COOKIES
>
> @@ -715,13 +713,14 @@ static inline bool cookie_ecn_ok(const struct net *net, const struct dst_entry *
> dst_feature(dst, RTAX_FEATURE_ECN);
> }
>
> -#if IS_ENABLED(CONFIG_BPF)
> +#ifdef CONFIG_BPF_SYSCALL
> static inline bool cookie_bpf_ok(struct sk_buff *skb)
> {
> return skb->sk;
> }
>
> -struct request_sock *cookie_bpf_check(struct sock *sk, struct sk_buff *skb);
> +struct request_sock *cookie_bpf_check(struct net *net, struct sock *sk,
> + struct sk_buff *skb);
> #else
> static inline bool cookie_bpf_ok(struct sk_buff *skb)
> {
> diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
> index f1474598d2c8..d685631438cb 100644
> --- a/net/ipv4/syncookies.c
> +++ b/net/ipv4/syncookies.c
> @@ -295,8 +295,9 @@ static int cookie_tcp_reqsk_init(struct sock *sk, struct sk_buff *skb,
> return 0;
> }
>
> -#if IS_ENABLED(CONFIG_BPF)
> -struct request_sock *cookie_bpf_check(struct sock *sk, struct sk_buff *skb)
> +#ifdef CONFIG_BPF_SYSCALL
> +struct request_sock *cookie_bpf_check(struct net *net, struct sock *sk,
> + struct sk_buff *skb)
> {
> struct request_sock *req = inet_reqsk(skb->sk);
>
> @@ -306,6 +307,9 @@ struct request_sock *cookie_bpf_check(struct sock *sk, struct sk_buff *skb)
> if (cookie_tcp_reqsk_init(sk, skb, req)) {
> reqsk_free(req);
> req = NULL;
> + __NET_INC_STATS(net, LINUX_MIB_SYNCOOKIESFAILED);
> + } else {
> + __NET_INC_STATS(net, LINUX_MIB_SYNCOOKIESRECV);
> }
>
> return req;
> @@ -419,7 +423,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
> goto out;
>
> if (cookie_bpf_ok(skb)) {
> - req = cookie_bpf_check(sk, skb);
> + req = cookie_bpf_check(net, sk, skb);
> } else {
> req = cookie_tcp_check(net, sk, skb);
> if (IS_ERR(req))
> diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
> index 4f6f0d751d6c..111d7a41d957 100644
> --- a/net/ipv6/syncookies.c
> +++ b/net/ipv6/syncookies.c
> @@ -190,7 +190,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
> goto out;
>
> if (cookie_bpf_ok(skb)) {
> - req = cookie_bpf_check(sk, skb);
> + req = cookie_bpf_check(net, sk, skb);
> } else {
> req = cookie_tcp_check(net, sk, skb);
> if (IS_ERR(req))
> --
> 2.43.0
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH net-next v1] net: add missing syncookie statistics for BPF custom syncookies
2026-04-10 22:31 ` Kuniyuki Iwashima
@ 2026-04-11 1:05 ` Jiayuan Chen
0 siblings, 0 replies; 3+ messages in thread
From: Jiayuan Chen @ 2026-04-11 1:05 UTC (permalink / raw)
To: Kuniyuki Iwashima
Cc: netdev, Eric Dumazet, Neal Cardwell, David S. Miller,
Jakub Kicinski, Paolo Abeni, Simon Horman, David Ahern,
linux-kernel, bpf
On 4/11/26 6:31 AM, Kuniyuki Iwashima wrote:
>> 1. Replace IS_ENABLED(CONFIG_BPF) with CONFIG_BPF_SYSCALL for
>> cookie_bpf_ok() and cookie_bpf_check(). CONFIG_BPF is selected by
>> CONFIG_NET unconditionally, so IS_ENABLED(CONFIG_BPF) is always
>> true and provides no real guard. CONFIG_BPF_SYSCALL is the correct
>> config for BPF program functionality.
>>
>> 2. Remove the CONFIG_BPF_SYSCALL guard around struct bpf_tcp_req_attrs.
>> This struct is referenced by bpf_sk_assign_tcp_reqsk() in
>> net/core/filter.c which is compiled unconditionally, so wrapping
>> the definition in a config guard could cause build failures when
>> CONFIG_BPF_SYSCALL=n.
>>
>> 3. Fix mismatched declaration of cookie_bpf_check() between the
>> CONFIG_BPF_SYSCALL and stub paths: the real definition takes
>> 'struct net *net' but the declaration in the header did not.
>> Add the net parameter to the declaration and all call sites.
>>
>> 4. Add missing LINUX_MIB_SYNCOOKIESRECV and LINUX_MIB_SYNCOOKIESFAILED
>> statistics in cookie_bpf_check(), so that BPF custom syncookie
>> validation is accounted for in SNMP counters just like the
>> non-BPF path.
>>
>> Compile-tested with CONFIG_BPF_SYSCALL=y and CONFIG_BPF_SYSCALL
>> not set.
> Can you add SNMP test in tcp_custom_syncookie.c by checking
> the delta before connect_to_fd() and after accept() ?
Thanks for the suggestion. I've added the following to the existing test
case and it works correctly:
+ recv_before = read_tcpext("SyncookiesRecv");
+ failed_before = read_tcpext("SyncookiesFailed");
client = connect_to_fd(server, 0);
if (!ASSERT_NEQ(client, -1, "connect_to_fd"))
goto close_server;
child = accept(server, NULL, 0);
if (!ASSERT_NEQ(child, -1, "accept"))
goto close_client;
+ recv_after = read_tcpext("SyncookiesRecv");
+ failed_after = read_tcpext("SyncookiesFailed");
+ ASSERT_EQ(recv_after - recv_before, 1, "SyncookiesRecv delta");
+ ASSERT_EQ(failed_after - failed_before, 0, "SyncookiesFailed delta");
Will include it in v2.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-04-11 1:05 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-09 12:41 [PATCH net-next v1] net: add missing syncookie statistics for BPF custom syncookies Jiayuan Chen
2026-04-10 22:31 ` Kuniyuki Iwashima
2026-04-11 1:05 ` Jiayuan Chen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox