[PATCH net-next 00/11] tunnels: add core and gre drop reasons

[Anton Danilov <littlesmilingcloud@gmail.com>]

Only vxlan reports drop reasons among the tunnel drivers today.
Everything else, on both the receive and the transmit side, ends in a
plain kfree_skb(), so a packet that a tunnel throws away is invisible
to dropwatch, drop_monitor and perf trace -e skb:kfree_skb. The device
counters group the failures coarsely: rx_errors and tx_errors each
cover half a dozen unrelated conditions.

This series covers the generic paths shared by ipip, sit, vti, gre and
their IPv6 counterparts, plus the GRE specific parsing, on both
directions. A later series will do the same for geneve, bareudp, fou
and the remaining IP in IP drivers.

Patches 1-3 convert the generic receive paths, ip_tunnel_rcv() and
__ip6_tnl_rcv(), and add a test for them. Two reasons are added:

  IP_TUNNEL_CFG_OPTS_MISMATCH  the options a packet carries do not
                               match the tunnel configuration
  IP_TUNNEL_OLD_SEQ            the sequence number is older than the
                               one the tunnel expects, next to the
                               existing TCP_OLD_SEQUENCE

The second one has a failure mode worth naming: when a peer reboots,
its outgoing sequence number restarts at zero and the receiver drops
everything until its own counter catches up. That is indistinguishable
from a misconfiguration by the counters alone.

Patches 4-7 do the GRE specific receive path. gre_parse_header()
returns -EINVAL for six different reasons, and the only detail its
callers could get was a csum_err flag that none of them read: both
ip_gre and ip6_gre declared it, passed it in and ignored it. It is
replaced by a drop reason. Three reasons are added, mirroring vxlan:
GRE_INVALID_HDR, GRE_CSUM and GRE_TUNNEL_NOT_FOUND.

Patches 8-11 do the transmit side, about forty failure paths across
ip_tunnel, ip_gre, ip6_tunnel and ip6_gre. One reason is added,
IP_TUNNEL_ENCAP, for a failure to build the encapsulation header.

The transmit side has its own case worth naming: tnl_update_pmtu()
returns -E2BIG after it has already sent an ICMP fragmentation needed
back, which is path MTU discovery working exactly as intended, yet the
drop lands in tx_errors next to genuine failures. An MTU black hole
cannot be told from a broken route by looking at the counters.

Drop reasons on transmit are not new: vxlan already reports several
from its xmit path, and ip_tunnel_core.c reports RECURSION_LIMIT.

Tested under virtme-ng. The selftest checks twelve cases by the end
of the series and passes, with no DEBUG_NET splat from the
SKB_NOT_DROPPED_YET check in sk_skb_reason_drop(). Breaking the new
mechanisms on purpose makes exactly the corresponding cases fail.

Not covered by the test: GRE_CSUM, which veth cannot trigger since it
hands the skb over with CHECKSUM_UNNECESSARY, and the NOMEM paths.

Anton Danilov (11):
  ip_tunnel: add drop reasons to the generic RX path
  ip6_tunnel: add drop reasons to the generic RX path
  selftests: net: add a test for the tunnel RX drop reasons
  gre: make gre_parse_header() report a drop reason
  ip_gre: add drop reasons to the RX path
  ip6_gre: add drop reasons to the RX path
  selftests: net: cover the GRE specific drop reasons
  ip_tunnel: add drop reasons to the transmit path
  ip_gre: add drop reasons to the transmit path
  ip6_tunnel: add drop reasons to the transmit path
  selftests: net: cover the tunnel transmit drop reasons

 include/net/dropreason-core.h                 |  38 ++
 include/net/gre.h                             |   2 +-
 include/net/ip6_tunnel.h                      |   3 +-
 net/ipv4/gre_demux.c                          |  51 ++-
 net/ipv4/ip_gre.c                             | 144 +++++---
 net/ipv4/ip_tunnel.c                          |  60 ++-
 net/ipv6/ip6_gre.c                            | 163 ++++++---
 net/ipv6/ip6_tunnel.c                         |  95 +++--
 tools/testing/selftests/net/Makefile          |   1 +
 tools/testing/selftests/net/config            |   1 +
 .../selftests/net/tunnel_drop_reasons.sh      | 346 ++++++++++++++++++
 11 files changed, 762 insertions(+), 142 deletions(-)
 create mode 100755 tools/testing/selftests/net/tunnel_drop_reasons.sh

-- 
2.47.3