ipv4: add LINUX_MIB_IPRPFILTER snmp counter

Christoph Lameter mentioned that packets could be dropped in input path
because of rp_filter settings, without any SNMP counter being
incremented. System administrator can have a hard time to track the
problem.

This patch introduces a new counter, LINUX_MIB_IPRPFILTER, incremented
each time we drop a packet because Reverse Path Filter triggers.

(We receive an IPv4 datagram on a given interface, and find the route to
send an answer would use another interface)

netstat -s | grep IPReversePathFilter
    IPReversePathFilter: 21714

Reported-by: Christoph Lameter <cl@linux-foundation.org>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/linux/snmp.h b/include/linux/snmp.h
index 5279771..ebb0c80 100644 (file)
--- a/include/linux/snmp.h
+++ b/include/linux/snmp.h
@@ -229,6 +229,7 @@ enum
        LINUX_MIB_TCPBACKLOGDROP,
        LINUX_MIB_TCPMINTTLDROP, /* RFC 5082 */
        LINUX_MIB_TCPDEFERACCEPTDROP,
+       LINUX_MIB_IPRPFILTER, /* IP Reverse Path Filter (rp_filter) */
        __LINUX_MIB_MAX
 };
 

diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 4f0ed45..e830f7a 100644 (file)
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -284,7 +284,7 @@ int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
        if (no_addr)
                goto last_resort;
        if (rpf == 1)
-               goto e_inval;
+               goto e_rpf;
        fl.oif = dev->ifindex;
 
        ret = 0;
@@ -299,7 +299,7 @@ int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
 
 last_resort:
        if (rpf)
-               goto e_inval;
+               goto e_rpf;
        *spec_dst = inet_select_addr(dev, 0, RT_SCOPE_UNIVERSE);
        *itag = 0;
        return 0;
@@ -308,6 +308,8 @@ e_inval_res:
        fib_res_put(&res);
 e_inval:
        return -EINVAL;
+e_rpf:
+       return -EXDEV;
 }
 
 static inline __be32 sk_extract_addr(struct sockaddr *addr)

diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index d930dc5..d52c9da 100644 (file)
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -340,6 +340,9 @@ static int ip_rcv_finish(struct sk_buff *skb)
                        else if (err == -ENETUNREACH)
                                IP_INC_STATS_BH(dev_net(skb->dev),
                                                IPSTATS_MIB_INNOROUTES);
+                       else if (err == -EXDEV)
+                               NET_INC_STATS_BH(dev_net(skb->dev),
+                                                LINUX_MIB_IPRPFILTER);
                        goto drop;
                }
        }

diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 3dc9914..e320ca6 100644 (file)
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -252,6 +252,7 @@ static const struct snmp_mib snmp4_net_list[] = {
        SNMP_MIB_ITEM("TCPBacklogDrop", LINUX_MIB_TCPBACKLOGDROP),
        SNMP_MIB_ITEM("TCPMinTTLDrop", LINUX_MIB_TCPMINTTLDROP),
        SNMP_MIB_ITEM("TCPDeferAcceptDrop", LINUX_MIB_TCPDEFERACCEPTDROP),
+       SNMP_MIB_ITEM("IPReversePathFilter", LINUX_MIB_IPRPFILTER),
        SNMP_MIB_SENTINEL
 };
 

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 8495bce..d377b45 100644 (file)
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1851,6 +1851,7 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
        __be32 spec_dst;
        struct in_device *in_dev = in_dev_get(dev);
        u32 itag = 0;
+       int err;
 
        /* Primary sanity checks. */
 
@@ -1865,10 +1866,12 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                if (!ipv4_is_local_multicast(daddr))
                        goto e_inval;
                spec_dst = inet_select_addr(dev, 0, RT_SCOPE_LINK);
-       } else if (fib_validate_source(saddr, 0, tos, 0,
-                                       dev, &spec_dst, &itag, 0) < 0)
-               goto e_inval;
-
+       } else {
+               err = fib_validate_source(saddr, 0, tos, 0, dev, &spec_dst,
+                                         &itag, 0);
+               if (err < 0)
+                       goto e_err;
+       }
        rth = dst_alloc(&ipv4_dst_ops);
        if (!rth)
                goto e_nobufs;
@@ -1920,8 +1923,10 @@ e_nobufs:
        return -ENOBUFS;
 
 e_inval:
+       err = -EINVAL;
+e_err:
        in_dev_put(in_dev);
-       return -EINVAL;
+       return err;
 }
 
 
@@ -1985,7 +1990,6 @@ static int __mkroute_input(struct sk_buff *skb,
                ip_handle_martian_source(in_dev->dev, in_dev, skb, daddr,
                                         saddr);
 
-               err = -EINVAL;
                goto cleanup;
        }
 
@@ -2157,13 +2161,12 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                goto brd_input;
 
        if (res.type == RTN_LOCAL) {
-               int result;
-               result = fib_validate_source(saddr, daddr, tos,
+               err = fib_validate_source(saddr, daddr, tos,
                                             net->loopback_dev->ifindex,
                                             dev, &spec_dst, &itag, skb->mark);
-               if (result < 0)
-                       goto martian_source;
-               if (result)
+               if (err < 0)
+                       goto martian_source_keep_err;
+               if (err)
                        flags |= RTCF_DIRECTSRC;
                spec_dst = daddr;
                goto local_input;
@@ -2191,7 +2194,7 @@ brd_input:
                err = fib_validate_source(saddr, 0, tos, 0, dev, &spec_dst,
                                          &itag, skb->mark);
                if (err < 0)
-                       goto martian_source;
+                       goto martian_source_keep_err;
                if (err)
                        flags |= RTCF_DIRECTSRC;
        }
@@ -2272,8 +2275,10 @@ e_nobufs:
        goto done;
 
 martian_source:
+       err = -EINVAL;
+martian_source_keep_err:
        ip_handle_martian_source(dev, in_dev, skb, daddr, saddr);
-       goto e_inval;
+       goto done;
 }
 
 int ip_route_input_common(struct sk_buff *skb, __be32 daddr, __be32 saddr,