Commit b5f7e755 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

ipv4: add LINUX_MIB_IPRPFILTER snmp counter 



Christoph Lameter mentioned that packets could be dropped in input path
because of rp_filter settings, without any SNMP counter being
incremented. System administrator can have a hard time to track the
problem.

This patch introduces a new counter, LINUX_MIB_IPRPFILTER, incremented
each time we drop a packet because Reverse Path Filter triggers.

(We receive an IPv4 datagram on a given interface, and find the route to
send an answer would use another interface)

netstat -s | grep IPReversePathFilter
    IPReversePathFilter: 21714

Reported-by: default avatarChristoph Lameter <cl@linux-foundation.org>
Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 8cbccbe7

include/linux/snmp.h

+1 −0
Original line number Diff line number Diff line
@@ -229,6 +229,7 @@ enum 
	LINUX_MIB_TCPBACKLOGDROP,

	LINUX_MIB_TCPMINTTLDROP, /* RFC 5082 */

	LINUX_MIB_TCPDEFERACCEPTDROP,

	LINUX_MIB_IPRPFILTER, /* IP Reverse Path Filter (rp_filter) */

	__LINUX_MIB_MAX

};

net/ipv4/fib_frontend.c

+4 −2
Original line number Diff line number Diff line
@@ -284,7 +284,7 @@ int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif, 
	if (no_addr)

		goto last_resort;

	if (rpf == 1)

		goto e_inval;

		goto e_rpf;

	fl.oif = dev->ifindex;



	ret = 0;
@@ -299,7 +299,7 @@ int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif, 


last_resort:

	if (rpf)

		goto e_inval;

		goto e_rpf;

	*spec_dst = inet_select_addr(dev, 0, RT_SCOPE_UNIVERSE);

	*itag = 0;

	return 0;
@@ -308,6 +308,8 @@ e_inval_res: 
	fib_res_put(&res);

e_inval:

	return -EINVAL;

e_rpf:

	return -EXDEV;

}



static inline __be32 sk_extract_addr(struct sockaddr *addr)

net/ipv4/ip_input.c

+3 −0
Original line number Diff line number Diff line
@@ -340,6 +340,9 @@ static int ip_rcv_finish(struct sk_buff *skb) 
			else if (err == -ENETUNREACH)

				IP_INC_STATS_BH(dev_net(skb->dev),

						IPSTATS_MIB_INNOROUTES);

			else if (err == -EXDEV)

				NET_INC_STATS_BH(dev_net(skb->dev),

						 LINUX_MIB_IPRPFILTER);

			goto drop;

		}

	}

net/ipv4/proc.c

+1 −0
Original line number Diff line number Diff line
@@ -252,6 +252,7 @@ static const struct snmp_mib snmp4_net_list[] = { 
	SNMP_MIB_ITEM("TCPBacklogDrop", LINUX_MIB_TCPBACKLOGDROP),

	SNMP_MIB_ITEM("TCPMinTTLDrop", LINUX_MIB_TCPMINTTLDROP),

	SNMP_MIB_ITEM("TCPDeferAcceptDrop", LINUX_MIB_TCPDEFERACCEPTDROP),

	SNMP_MIB_ITEM("IPReversePathFilter", LINUX_MIB_IPRPFILTER),

	SNMP_MIB_SENTINEL

};

net/ipv4/route.c

+18 −13
Original line number Diff line number Diff line
@@ -1851,6 +1851,7 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr, 
	__be32 spec_dst;

	struct in_device *in_dev = in_dev_get(dev);

	u32 itag = 0;

	int err;



	/* Primary sanity checks. */
@@ -1865,10 +1866,12 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr, 
		if (!ipv4_is_local_multicast(daddr))

			goto e_inval;

		spec_dst = inet_select_addr(dev, 0, RT_SCOPE_LINK);

	} else if (fib_validate_source(saddr, 0, tos, 0,

					dev, &spec_dst, &itag, 0) < 0)

		goto e_inval;



	} else {

		err = fib_validate_source(saddr, 0, tos, 0, dev, &spec_dst,

					  &itag, 0);

		if (err < 0)

			goto e_err;

	}

	rth = dst_alloc(&ipv4_dst_ops);

	if (!rth)

		goto e_nobufs;
@@ -1920,8 +1923,10 @@ e_nobufs: 
	return -ENOBUFS;



e_inval:

	err = -EINVAL;

e_err:

	in_dev_put(in_dev);

	return -EINVAL;

	return err;

}
@@ -1985,7 +1990,6 @@ static int __mkroute_input(struct sk_buff *skb, 
		ip_handle_martian_source(in_dev->dev, in_dev, skb, daddr,

					 saddr);



		err = -EINVAL;

		goto cleanup;

	}
@@ -2157,13 +2161,12 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr, 
		goto brd_input;



	if (res.type == RTN_LOCAL) {

		int result;

		result = fib_validate_source(saddr, daddr, tos,

		err = fib_validate_source(saddr, daddr, tos,

					     net->loopback_dev->ifindex,

					     dev, &spec_dst, &itag, skb->mark);

		if (result < 0)

			goto martian_source;

		if (result)

		if (err < 0)

			goto martian_source_keep_err;

		if (err)

			flags |= RTCF_DIRECTSRC;

		spec_dst = daddr;

		goto local_input;
@@ -2191,7 +2194,7 @@ brd_input: 
		err = fib_validate_source(saddr, 0, tos, 0, dev, &spec_dst,

					  &itag, skb->mark);

		if (err < 0)

			goto martian_source;

			goto martian_source_keep_err;

		if (err)

			flags |= RTCF_DIRECTSRC;

	}
@@ -2272,8 +2275,10 @@ e_nobufs: 
	goto done;



martian_source:

	err = -EINVAL;

martian_source_keep_err:

	ip_handle_martian_source(dev, in_dev, skb, daddr, saddr);

	goto e_inval;

	goto done;

}



int ip_route_input_common(struct sk_buff *skb, __be32 daddr, __be32 saddr,

CRA Git | Maintained and supported by SUSTech CRA and CCSE