netdev - Re: [RESEND PATCH net-next] xfrm: add LINUX_MIB

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <519A2F1A.3010703@cogentembedded.com>
Date:	Mon, 20 May 2013 18:11:38 +0400
From:	Sergei Shtylyov <sergei.shtylyov@...entembedded.com>
To:	Fan Du <fan.du@...driver.com>
CC:	steffen.klassert@...unet.com, herbert@...dor.hengli.com.au,
	davem@...emloft.net, netdev@...r.kernel.org
Subject: Re: [RESEND PATCH net-next] xfrm: add LINUX_MIB_XFRMACQUIREERROR
 statistic counter

Hello.

On 20-05-2013 5:40, Fan Du wrote:

> When host ping its peer, ICMP echo request packet triggers IPsec
> policy, then host negotiates SA secret with its peer. After IKE
> installed SA for OUT direction, but before SA for IN direction
> installed, host get ICMP echo reply from its peer. At the time
> being, the SA state for IN direction could be XFRM_STATE_ACQ,
> then the received packet will be dropped after adding
> LINUX_MIB_XFRMINSTATEINVALID statistic.

> Adding a LINUX_MIB_XFRMACQUIREERROR statistic counter for such
> scenario when SA in larval state is much clearer for user than
> LINUX_MIB_XFRMINSTATEINVALID which indicates the SA is totally
> bad.

> Signed-off-by: Fan Du <fan.du@...driver.com>
> ---
>   include/uapi/linux/snmp.h |    1 +
>   net/xfrm/xfrm_input.c     |    5 +++++
>   net/xfrm/xfrm_proc.c      |    1 +
>   3 files changed, 7 insertions(+), 0 deletions(-)

> diff --git a/include/uapi/linux/snmp.h b/include/uapi/linux/snmp.h
> index df2e8b4..3d072bf 100644
> --- a/include/uapi/linux/snmp.h
> +++ b/include/uapi/linux/snmp.h
> @@ -287,6 +287,7 @@ enum
>   	LINUX_MIB_XFRMOUTPOLERROR,		/* XfrmOutPolError */
>   	LINUX_MIB_XFRMFWDHDRERROR,		/* XfrmFwdHdrError*/
>   	LINUX_MIB_XFRMOUTSTATEINVALID,		/* XfrmOutStateInvalid */
> +	LINUX_MIB_XFRMACQUIREERROR,     /* XfrmAcquireError*/

    Please indent the comment with tabs and align with the above ones.

WBR, Sergei

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html