netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] xfrm: add LINUX_MIB_XFRMACQUIREERROR statistic counter
@ 2013-05-03  7:50 Fan Du
  2013-05-03  8:17 ` David Miller
  0 siblings, 1 reply; 4+ messages in thread
From: Fan Du @ 2013-05-03  7:50 UTC (permalink / raw)
  To: steffen.klassert, herbert; +Cc: davem, netdev

When host ping its peer, ICMP echo request packet triggers IPsec
policy, then host negotiates SA secret with its peer. After IKE
installed SA for OUT direction, but before SA for IN direction
installed, host get ICMP echo reply from its peer. At the time
being, the SA state for IN direction could be XFRM_STATE_ACQ,
then the received packet will be dropped after adding
LINUX_MIB_XFRMINSTATEINVALID statistic.

Adding a LINUX_MIB_XFRMACQUIREERROR statistic counter for such
scenario when SA in larval state is much clearer for user than
LINUX_MIB_XFRMINSTATEINVALID which indicates the SA is totally
bad.

Signed-off-by: Fan Du <fan.du@windriver.com>
---
 include/uapi/linux/snmp.h |    1 +
 net/xfrm/xfrm_input.c     |    5 +++++
 net/xfrm/xfrm_proc.c      |    1 +
 3 files changed, 7 insertions(+), 0 deletions(-)

diff --git a/include/uapi/linux/snmp.h b/include/uapi/linux/snmp.h
index df2e8b4..3d072bf 100644
--- a/include/uapi/linux/snmp.h
+++ b/include/uapi/linux/snmp.h
@@ -287,6 +287,7 @@ enum
 	LINUX_MIB_XFRMOUTPOLERROR,		/* XfrmOutPolError */
 	LINUX_MIB_XFRMFWDHDRERROR,		/* XfrmFwdHdrError*/
 	LINUX_MIB_XFRMOUTSTATEINVALID,		/* XfrmOutStateInvalid */
+	LINUX_MIB_XFRMACQUIREERROR,     /* XfrmAcquireError*/
 	__LINUX_MIB_XFRMMAX
 };
 
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index ab2bb42..8884399 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -163,6 +163,11 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
 		skb->sp->xvec[skb->sp->len++] = x;
 
 		spin_lock(&x->lock);
+		if (unlikely(x->km.state == XFRM_STATE_ACQ)) {
+			XFRM_INC_STATS(net, LINUX_MIB_XFRMACQUIREERROR);
+			goto drop_unlock;
+		}
+
 		if (unlikely(x->km.state != XFRM_STATE_VALID)) {
 			XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEINVALID);
 			goto drop_unlock;
diff --git a/net/xfrm/xfrm_proc.c b/net/xfrm/xfrm_proc.c
index c721b0d..80cd1e5 100644
--- a/net/xfrm/xfrm_proc.c
+++ b/net/xfrm/xfrm_proc.c
@@ -44,6 +44,7 @@ static const struct snmp_mib xfrm_mib_list[] = {
 	SNMP_MIB_ITEM("XfrmOutPolError", LINUX_MIB_XFRMOUTPOLERROR),
 	SNMP_MIB_ITEM("XfrmFwdHdrError", LINUX_MIB_XFRMFWDHDRERROR),
 	SNMP_MIB_ITEM("XfrmOutStateInvalid", LINUX_MIB_XFRMOUTSTATEINVALID),
+	SNMP_MIB_ITEM("XfrmAcquireError", LINUX_MIB_XFRMACQUIREERROR),
 	SNMP_MIB_SENTINEL
 };
 
-- 
1.7.4.1

^ permalink raw reply related	[flat|nested] 4+ messages in thread
* pull request (net-next): ipsec-next 2013-06-26
@ 2013-06-26 12:01 Steffen Klassert
  2013-06-26 12:01 ` [PATCH] xfrm: add LINUX_MIB_XFRMACQUIREERROR statistic counter Steffen Klassert
  0 siblings, 1 reply; 4+ messages in thread
From: Steffen Klassert @ 2013-06-26 12:01 UTC (permalink / raw)
  To: David Miller; +Cc: Herbert Xu, Steffen Klassert, netdev

Just one patch this time.

1) Drop packets when the matching SA is in larval state and add a
   statistic counter for that. From Fan Du.

Please pull or let me know if there are problems.

Thanks!

The following changes since commit 5865fc1b6a99bc7dcf245770c2735577b8596b6e:

  tg3: remove redundant pm init code (2013-06-03 00:48:11 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git master

for you to fetch changes up to 4c4d41f200db375b2d2cc6d0a1de0606c8266398:

  xfrm: add LINUX_MIB_XFRMACQUIREERROR statistic counter (2013-06-06 06:45:55 +0200)

----------------------------------------------------------------
Fan Du (1):
      xfrm: add LINUX_MIB_XFRMACQUIREERROR statistic counter

 include/uapi/linux/snmp.h |    1 +
 net/xfrm/xfrm_input.c     |    5 +++++
 net/xfrm/xfrm_proc.c      |    1 +
 3 files changed, 7 insertions(+)

^ permalink raw reply	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2013-06-26 12:02 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-05-03  7:50 [PATCH] xfrm: add LINUX_MIB_XFRMACQUIREERROR statistic counter Fan Du
2013-05-03  8:17 ` David Miller
2013-05-03  8:29   ` Fan Du
  -- strict thread matches above, loose matches on Subject: below --
2013-06-26 12:01 pull request (net-next): ipsec-next 2013-06-26 Steffen Klassert
2013-06-26 12:01 ` [PATCH] xfrm: add LINUX_MIB_XFRMACQUIREERROR statistic counter Steffen Klassert

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).