From f4e541b12e7dc0346eaadcd613771299922b05eb Mon Sep 17 00:00:00 2001 From: Masahide NAKAMURA Date: Mon, 14 May 2007 17:49:23 +0900 Subject: [PATCH] [PATCH] [XFRM]: Increment statistics. Signed-off-by: Masahide NAKAMURA --- net/ipv4/xfrm4_input.c | 48 +++++++++++++++++++++++++++--------- net/ipv4/xfrm4_output.c | 17 ++++++++++--- net/ipv6/xfrm6_input.c | 56 ++++++++++++++++++++++++++++++++---------- net/ipv6/xfrm6_output.c | 17 ++++++++++--- net/xfrm/xfrm_policy.c | 61 +++++++++++++++++++++++++++++++++++++--------- net/xfrm/xfrm_state.c | 6 ++++- 6 files changed, 158 insertions(+), 47 deletions(-) diff --git a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c index 2fa1082..8c3cc2c 100644 --- a/net/ipv4/xfrm4_input.c +++ b/net/ipv4/xfrm4_input.c @@ -55,35 +55,51 @@ static int xfrm4_rcv_encap(struct sk_buf int decaps = 0; int err = xfrm4_parse_spi(skb, ip_hdr(skb)->protocol, &spi, &seq); - if (err != 0) + if (err != 0) { + XFRM_INC_STATS(XFRM_MIB_INHDRERROR); goto drop; + } do { const struct iphdr *iph = ip_hdr(skb); - if (xfrm_nr == XFRM_MAX_DEPTH) + if (xfrm_nr == XFRM_MAX_DEPTH) { + XFRM_INC_STATS(XFRM_MIB_INBUFFERERROR); goto drop; + } x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, spi, iph->protocol != IPPROTO_IPV6 ? iph->protocol : IPPROTO_IPIP, AF_INET); - if (x == NULL) + if (x == NULL) { + XFRM_INC_STATS(XFRM_MIB_INNOSTATES); goto drop; + } spin_lock(&x->lock); - if (unlikely(x->km.state != XFRM_STATE_VALID)) + if (unlikely(x->km.state != XFRM_STATE_VALID)) { + XFRM_INC_STATS(XFRM_MIB_INSTATEINVALID); goto drop_unlock; + } - if ((x->encap ? x->encap->encap_type : 0) != encap_type) + if ((x->encap ? x->encap->encap_type : 0) != encap_type) { + XFRM_INC_STATS(XFRM_MIB_INSTATEMISMATCH); goto drop_unlock; + } - if (x->props.replay_window && xfrm_replay_check(x, seq)) + if (x->props.replay_window && xfrm_replay_check(x, seq)) { + XFRM_INC_STATS(XFRM_MIB_INSEQOUTOFWINDOW); goto drop_unlock; + } - if (xfrm_state_check_expire(x)) + if (xfrm_state_check_expire(x)) { + XFRM_INC_STATS(XFRM_MIB_INSTATEEXPIRED); goto drop_unlock; + } - if (x->type->input(x, skb)) + if (x->type->input(x, skb)) { + XFRM_INC_STATS(XFRM_MIB_INSTATEPROTOERROR); goto drop_unlock; + } /* only the first xfrm gets the encap type */ encap_type = 0; @@ -98,8 +114,10 @@ static int xfrm4_rcv_encap(struct sk_buf xfrm_vec[xfrm_nr++] = x; - if (x->mode->input(x, skb)) + if (x->mode->input(x, skb)) { + XFRM_INC_STATS(XFRM_MIB_INSTATEMODEERROR); goto drop; + } if (x->props.mode == XFRM_MODE_TUNNEL) { decaps = 1; @@ -107,8 +125,10 @@ static int xfrm4_rcv_encap(struct sk_buf } err = xfrm_parse_spi(skb, ip_hdr(skb)->protocol, &spi, &seq); - if (err < 0) + if (err < 0) { + XFRM_INC_STATS(XFRM_MIB_INHDRERROR); goto drop; + } } while (!err); /* Allocate new secpath or COW existing one. */ @@ -116,14 +136,18 @@ static int xfrm4_rcv_encap(struct sk_buf if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) { struct sec_path *sp; sp = secpath_dup(skb->sp); - if (!sp) + if (!sp) { + XFRM_INC_STATS(XFRM_MIB_INERROR); goto drop; + } if (skb->sp) secpath_put(skb->sp); skb->sp = sp; } - if (xfrm_nr + skb->sp->len > XFRM_MAX_DEPTH) + if (xfrm_nr + skb->sp->len > XFRM_MAX_DEPTH) { + XFRM_INC_STATS(XFRM_MIB_INBUFFERERROR); goto drop; + } memcpy(skb->sp->xvec + skb->sp->len, xfrm_vec, xfrm_nr * sizeof(xfrm_vec[0])); diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c index 44ef208..614caba 100644 --- a/net/ipv4/xfrm4_output.c +++ b/net/ipv4/xfrm4_output.c @@ -49,14 +49,18 @@ static int xfrm4_output_one(struct sk_bu if (skb->ip_summed == CHECKSUM_PARTIAL) { err = skb_checksum_help(skb); - if (err) + if (err) { + XFRM_INC_STATS(XFRM_MIB_OUTERROR); goto error_nolock; + } } if (x->props.mode == XFRM_MODE_TUNNEL) { err = xfrm4_tunnel_check_size(skb); - if (err) + if (err) { + XFRM_INC_STATS(XFRM_MIB_OUTLENGTHERROR); goto error_nolock; + } } do { @@ -66,12 +70,16 @@ static int xfrm4_output_one(struct sk_bu goto error; err = x->mode->output(x, skb); - if (err) + if (err) { + XFRM_INC_STATS(XFRM_MIB_OUTSTATEMODEERROR); goto error; + } err = x->type->output(x, skb); - if (err) + if (err) { + XFRM_INC_STATS(XFRM_MIB_OUTSTATEPROTOERROR); goto error; + } x->curlft.bytes += skb->len; x->curlft.packets++; @@ -79,6 +87,7 @@ static int xfrm4_output_one(struct sk_bu spin_unlock_bh(&x->lock); if (!(skb->dst = dst_pop(dst))) { + XFRM_INC_STATS(XFRM_MIB_OUTERROR); err = -EHOSTUNREACH; goto error_nolock; } diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c index c858537..53eeea5 100644 --- a/net/ipv6/xfrm6_input.c +++ b/net/ipv6/xfrm6_input.c @@ -31,32 +31,46 @@ int xfrm6_rcv_spi(struct sk_buff *skb, _ nexthdr = skb_network_header(skb)[nhoff]; seq = 0; - if (!spi && (err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) != 0) + if (!spi && (err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) != 0) { + XFRM_INC_STATS(XFRM_MIB_INHDRERROR); goto drop; + } do { struct ipv6hdr *iph = ipv6_hdr(skb); - if (xfrm_nr == XFRM_MAX_DEPTH) + if (xfrm_nr == XFRM_MAX_DEPTH) { + XFRM_INC_STATS(XFRM_MIB_INBUFFERERROR); goto drop; + } x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, spi, nexthdr != IPPROTO_IPIP ? nexthdr : IPPROTO_IPV6, AF_INET6); - if (x == NULL) + if (x == NULL) { + XFRM_INC_STATS(XFRM_MIB_INNOSTATES); goto drop; + } spin_lock(&x->lock); - if (unlikely(x->km.state != XFRM_STATE_VALID)) + if (unlikely(x->km.state != XFRM_STATE_VALID)) { + XFRM_INC_STATS(XFRM_MIB_INSTATEINVALID); goto drop_unlock; + } - if (x->props.replay_window && xfrm_replay_check(x, seq)) + if (x->props.replay_window && xfrm_replay_check(x, seq)) { + XFRM_INC_STATS(XFRM_MIB_INSEQOUTOFWINDOW); goto drop_unlock; + } - if (xfrm_state_check_expire(x)) + if (xfrm_state_check_expire(x)) { + XFRM_INC_STATS(XFRM_MIB_INSTATEEXPIRED); goto drop_unlock; + } nexthdr = x->type->input(x, skb); - if (nexthdr <= 0) + if (nexthdr <= 0) { + XFRM_INC_STATS(XFRM_MIB_INSTATEPROTOERROR); goto drop_unlock; + } skb_network_header(skb)[nhoff] = nexthdr; @@ -70,31 +84,39 @@ int xfrm6_rcv_spi(struct sk_buff *skb, _ xfrm_vec[xfrm_nr++] = x; - if (x->mode->input(x, skb)) + if (x->mode->input(x, skb)) { + XFRM_INC_STATS(XFRM_MIB_INSTATEMODEERROR); goto drop; + } if (x->props.mode == XFRM_MODE_TUNNEL) { /* XXX */ decaps = 1; break; } - if ((err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) < 0) + if ((err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) < 0) { + XFRM_INC_STATS(XFRM_MIB_INHDRERROR); goto drop; + } } while (!err); /* Allocate new secpath or COW existing one. */ if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) { struct sec_path *sp; sp = secpath_dup(skb->sp); - if (!sp) + if (!sp) { + XFRM_INC_STATS(XFRM_MIB_INERROR); goto drop; + } if (skb->sp) secpath_put(skb->sp); skb->sp = sp; } - if (xfrm_nr + skb->sp->len > XFRM_MAX_DEPTH) + if (xfrm_nr + skb->sp->len > XFRM_MAX_DEPTH) { + XFRM_INC_STATS(XFRM_MIB_INBUFFERERROR); goto drop; + } memcpy(skb->sp->xvec + skb->sp->len, xfrm_vec, xfrm_nr * sizeof(xfrm_vec[0])); @@ -219,22 +241,28 @@ int xfrm6_input_addr(struct sk_buff *skb break; } - if (!xfrm_vec_one) + if (!xfrm_vec_one) { + XFRM_INC_STATS(XFRM_MIB_INNOSTATES); goto drop; + } /* Allocate new secpath or COW existing one. */ if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) { struct sec_path *sp; sp = secpath_dup(skb->sp); - if (!sp) + if (!sp) { + XFRM_INC_STATS(XFRM_MIB_INERROR); goto drop; + } if (skb->sp) secpath_put(skb->sp); skb->sp = sp; } - if (1 + skb->sp->len > XFRM_MAX_DEPTH) + if (1 + skb->sp->len > XFRM_MAX_DEPTH) { + XFRM_INC_STATS(XFRM_MIB_INBUFFERERROR); goto drop; + } skb->sp->xvec[skb->sp->len] = xfrm_vec_one; skb->sp->len ++; diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c index 56364a5..72820ff 100644 --- a/net/ipv6/xfrm6_output.c +++ b/net/ipv6/xfrm6_output.c @@ -51,14 +51,18 @@ static int xfrm6_output_one(struct sk_bu if (skb->ip_summed == CHECKSUM_PARTIAL) { err = skb_checksum_help(skb); - if (err) + if (err) { + XFRM_INC_STATS(XFRM_MIB_OUTERROR); goto error_nolock; + } } if (x->props.mode == XFRM_MODE_TUNNEL) { err = xfrm6_tunnel_check_size(skb); - if (err) + if (err) { + XFRM_INC_STATS(XFRM_MIB_OUTLENGTHERROR); goto error_nolock; + } } do { @@ -68,12 +72,16 @@ static int xfrm6_output_one(struct sk_bu goto error; err = x->mode->output(x, skb); - if (err) + if (err) { + XFRM_INC_STATS(XFRM_MIB_OUTSTATEMODEERROR); goto error; + } err = x->type->output(x, skb); - if (err) + if (err) { + XFRM_INC_STATS(XFRM_MIB_OUTSTATEPROTOERROR); goto error; + } x->curlft.bytes += skb->len; x->curlft.packets++; @@ -85,6 +93,7 @@ static int xfrm6_output_one(struct sk_bu skb_reset_network_header(skb); if (!(skb->dst = dst_pop(dst))) { + XFRM_INC_STATS(XFRM_MIB_OUTERROR); err = -EHOSTUNREACH; goto error_nolock; } diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index ff95782..7d89795 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -1480,8 +1480,10 @@ restart: if (sk && sk->sk_policy[1]) { policy = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl); - if (IS_ERR(policy)) + if (IS_ERR(policy)) { + XFRM_INC_STATS(XFRM_MIB_OUTPOLERROR); return PTR_ERR(policy); + } } if (!policy) { @@ -1492,8 +1494,10 @@ restart: policy = flow_cache_lookup(fl, dst_orig->ops->family, dir, xfrm_policy_lookup); - if (IS_ERR(policy)) + if (IS_ERR(policy)) { + XFRM_INC_STATS(XFRM_MIB_OUTPOLERROR); return PTR_ERR(policy); + } } if (!policy) @@ -1508,6 +1512,7 @@ restart: switch (policy->action) { case XFRM_POLICY_BLOCK: /* Prohibit the flow */ + XFRM_INC_STATS(XFRM_MIB_OUTPOLBLOCK); err = -EPERM; goto error; @@ -1527,6 +1532,7 @@ #endif */ dst = xfrm_find_bundle(fl, policy, family); if (IS_ERR(dst)) { + XFRM_INC_STATS(XFRM_MIB_OUTBUNDLEERROR); err = PTR_ERR(dst); goto error; } @@ -1541,10 +1547,12 @@ #ifdef CONFIG_XFRM_SUB_POLICY XFRM_POLICY_OUT); if (pols[1]) { if (IS_ERR(pols[1])) { + XFRM_INC_STATS(XFRM_MIB_OUTPOLERROR); err = PTR_ERR(pols[1]); goto error; } if (pols[1]->action == XFRM_POLICY_BLOCK) { + XFRM_INC_STATS(XFRM_MIB_OUTPOLBLOCK); err = -EPERM; goto error; } @@ -1590,6 +1598,7 @@ #endif nx = xfrm_tmpl_resolve(pols, npols, fl, xfrm, family); if (nx == -EAGAIN && signal_pending(current)) { + XFRM_INC_STATS(XFRM_MIB_OUTNOSTATES); err = -ERESTART; goto error; } @@ -1600,8 +1609,10 @@ #endif } err = nx; } - if (err < 0) + if (err < 0) { + XFRM_INC_STATS(XFRM_MIB_OUTNOSTATES); goto error; + } } if (nx == 0) { /* Flow passes not transformed. */ @@ -1616,6 +1627,7 @@ #endif int i; for (i=0; ilock); if (dst) dst_free(dst); + XFRM_INC_STATS(XFRM_MIB_OUTBUNDLEERROR); goto error; } @@ -1793,8 +1807,11 @@ int __xfrm_policy_check(struct sock *sk, u8 fl_dir = policy_to_flow_dir(dir); int xerr_idx = -1; - if (xfrm_decode_session(skb, &fl, family) < 0) + if (xfrm_decode_session(skb, &fl, family) < 0) { + XFRM_INC_STATS(XFRM_MIB_INHDRERROR); return 0; + } + nf_nat_decode_session(skb, &fl, family); /* First, check used SA against their selectors. */ @@ -1803,28 +1820,35 @@ int __xfrm_policy_check(struct sock *sk, for (i=skb->sp->len-1; i>=0; i--) { struct xfrm_state *x = skb->sp->xvec[i]; - if (!xfrm_selector_match(&x->sel, &fl, family)) + if (!xfrm_selector_match(&x->sel, &fl, family)) { + XFRM_INC_STATS(XFRM_MIB_INSTATEMISMATCH); return 0; + } } } pol = NULL; if (sk && sk->sk_policy[dir]) { pol = xfrm_sk_policy_lookup(sk, dir, &fl); - if (IS_ERR(pol)) + if (IS_ERR(pol)) { + XFRM_INC_STATS(XFRM_MIB_INPOLERROR); return 0; + } } if (!pol) pol = flow_cache_lookup(&fl, family, fl_dir, xfrm_policy_lookup); - if (IS_ERR(pol)) + if (IS_ERR(pol)) { + XFRM_INC_STATS(XFRM_MIB_INPOLERROR); return 0; + } if (!pol) { if (skb->sp && secpath_has_nontransport(skb->sp, 0, &xerr_idx)) { xfrm_secpath_reject(xerr_idx, skb, &fl); + XFRM_INC_STATS(XFRM_MIB_INNOPOLS); return 0; } return 1; @@ -1840,8 +1864,10 @@ #ifdef CONFIG_XFRM_SUB_POLICY &fl, family, XFRM_POLICY_IN); if (pols[1]) { - if (IS_ERR(pols[1])) + if (IS_ERR(pols[1])) { + XFRM_INC_STATS(XFRM_MIB_INPOLERROR); return 0; + } pols[1]->curlft.use_time = get_seconds(); npols ++; } @@ -1862,10 +1888,14 @@ #endif for (pi = 0; pi < npols; pi++) { if (pols[pi] != pol && - pols[pi]->action != XFRM_POLICY_ALLOW) + pols[pi]->action != XFRM_POLICY_ALLOW) { + XFRM_INC_STATS(XFRM_MIB_INPOLBLOCK); goto reject; - if (ti + pols[pi]->xfrm_nr >= XFRM_MAX_DEPTH) + } + if (ti + pols[pi]->xfrm_nr >= XFRM_MAX_DEPTH) { + XFRM_INC_STATS(XFRM_MIB_INBUFFERERROR); goto reject_error; + } for (i = 0; i < pols[pi]->xfrm_nr; i++) tpp[ti++] = &pols[pi]->xfrm_vec[i]; } @@ -1887,16 +1917,20 @@ #endif if (k < -1) /* "-2 - errored_index" returned */ xerr_idx = -(2+k); + XFRM_INC_STATS(XFRM_MIB_INTMPLMISMATCH); goto reject; } } - if (secpath_has_nontransport(sp, k, &xerr_idx)) + if (secpath_has_nontransport(sp, k, &xerr_idx)) { + XFRM_INC_STATS(XFRM_MIB_INTMPLMISMATCH); goto reject; + } xfrm_pols_put(pols, npols); return 1; } + XFRM_INC_STATS(XFRM_MIB_INPOLBLOCK); reject: xfrm_secpath_reject(xerr_idx, skb, &fl); @@ -1910,8 +1944,11 @@ int __xfrm_route_forward(struct sk_buff { struct flowi fl; - if (xfrm_decode_session(skb, &fl, family) < 0) + if (xfrm_decode_session(skb, &fl, family) < 0) { + /* XXX: we should have something like FWDHDRERROR here. */ + XFRM_INC_STATS(XFRM_MIB_INHDRERROR); return 0; + } return xfrm_lookup(&skb->dst, &fl, NULL, 0) == 0; } diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index 31be405..66ae58d 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -1172,9 +1172,13 @@ static int xfrm_state_check_space(struct int xfrm_state_check(struct xfrm_state *x, struct sk_buff *skb) { int err = xfrm_state_check_expire(x); - if (err < 0) + if (err < 0) { + XFRM_INC_STATS(XFRM_MIB_OUTSTATEEXPIRED); goto err; + } err = xfrm_state_check_space(x, skb); + if (err) + XFRM_INC_STATS(XFRM_MIB_OUTLENGTHERROR); err: return err; } -- 1.4.3.GIT