xfrm: add LINUX_MIB_XFRMACQUIREERROR statistic counter (4c4d41f2) · Commits · 戴 / test

When host ping its peer, ICMP echo request packet triggers IPsec policy, then host negotiates SA secret with its peer. After IKE installed SA for OUT direction, but before SA for IN direction installed, host get ICMP echo reply from its peer. At the time being, the SA state for IN direction could be XFRM_STATE_ACQ, then the received packet will be dropped after adding LINUX_MIB_XFRMINSTATEINVALID statistic. Adding a LINUX_MIB_XFRMACQUIREERROR statistic counter for such scenario when SA in larval state is much clearer for user than LINUX_MIB_XFRMINSTATEINVALID which indicates the SA is totally bad. Signed-off-by:

Fan Du <fan.du@windriver.com> Signed-off-by:

Steffen Klassert <steffen.klassert@secunet.com>

include/uapi/linux/snmp.h

+1 −0

Original line number	Diff line number	Diff line
		@@ -287,6 +287,7 @@ enum
		LINUX_MIB_XFRMOUTPOLERROR, /* XfrmOutPolError */
		LINUX_MIB_XFRMFWDHDRERROR, /* XfrmFwdHdrError*/
		LINUX_MIB_XFRMOUTSTATEINVALID, /* XfrmOutStateInvalid */
		LINUX_MIB_XFRMACQUIREERROR, /* XfrmAcquireError */
		__LINUX_MIB_XFRMMAX
		};

net/xfrm/xfrm_input.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -163,6 +163,11 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
		skb->sp->xvec[skb->sp->len++] = x;

		spin_lock(&x->lock);
		if (unlikely(x->km.state == XFRM_STATE_ACQ)) {
		XFRM_INC_STATS(net, LINUX_MIB_XFRMACQUIREERROR);
		goto drop_unlock;
		}

		if (unlikely(x->km.state != XFRM_STATE_VALID)) {
		XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEINVALID);
		goto drop_unlock;

net/xfrm/xfrm_proc.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -44,6 +44,7 @@ static const struct snmp_mib xfrm_mib_list[] = {
		SNMP_MIB_ITEM("XfrmOutPolError", LINUX_MIB_XFRMOUTPOLERROR),
		SNMP_MIB_ITEM("XfrmFwdHdrError", LINUX_MIB_XFRMFWDHDRERROR),
		SNMP_MIB_ITEM("XfrmOutStateInvalid", LINUX_MIB_XFRMOUTSTATEINVALID),
		SNMP_MIB_ITEM("XfrmAcquireError", LINUX_MIB_XFRMACQUIREERROR),
		SNMP_MIB_SENTINEL
		};

Admin message