netdev - Re: Fix "ipOutNoRoutes" counter error for TCP and UDP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Mon, 26 Feb 2007 17:08:32 -0800 (PST)
From:	David Miller <davem@...emloft.net>
To:	weid@...css.fujitsu.com
Cc:	netdev@...r.kernel.org
Subject: Re: Fix "ipOutNoRoutes" counter error for TCP and UDP

From: weidong <weid@...css.fujitsu.com>
Date: Wed, 14 Feb 2007 10:03:49 -0500

> Hi, All
>   When I tested Linux-2.6.20 and found that counter "ipOutNoRoutes" can
> not increase correctly.
>   The criteria is RFC2011
> 
> ipOutNoRoutes OBJECT-TYPE
>     SYNTAX      Counter32
>     MAX-ACCESS  read-only
>     STATUS      current
>     DESCRIPTION
>             "The number of IP datagrams discarded because no route could
>             be found to transmit them to their destination.  Note that
>             this counter includes any packets counted in ipForwDatagrams
>             which meet this `no-route' criterion.  Note that this
>             includes any datagrams which a host cannot route because all
>             of its default routers are down."
>     ::= { ip 12 }
> 
> In current Linux TCP/IP stack, maybe we should not increase this counter
> in "input path", but only increase it in "output path" due to the TCP/IP
> stack performance.
> 
> Now in "output path", when TCP client tries to connect to an unreachable
> server(net unreachable, so no route can be found), this counter has no
> increment. When we use UDP sending UDP datagram to an net unreachable
> address, this counter also has no increment.
> 
> Function need to fix:
> tcp_v4_connect(); ip4_datagram_connect(); udp_sendmsg();
> 
> The following patch can fix the problems mentioned above

Thank you for this patch.

I think we need to make these checks more carefully.

Route lookup can fail for several reasons other than
no route being available.  Two examples are:

1) Out of memory error while creating route
2) IPSEC disallows communication to that flow ID

As a result, we'll probably best limiting the counter
increment when the error is either -EHOSTUNREACH or
-ENETUNREACH.

Probably, since this logic will be duplicated to several
locations, you'll want to implement the test inside of
a helper inline function.
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html