From nobody Fri Jun 12 15:30:50 2026 Received: from out-189.mta0.migadu.com (out-189.mta0.migadu.com [91.218.175.189]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0AA5D3B9DA8 for ; Thu, 14 May 2026 05:10:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.189 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778735441; cv=none; b=AFP9xZW3xpL79h9BWhSvodcCfDct7I3QAheZkc1QWrLKCTubiZTzrhRX+qjZcg3elUhIpaYjYKLCs4xktJyYz0iQTUjM0ZeMXH9Kdo5Bp4xM3fjE8tQFyVCnK0++7RkkDNNmabe7keazy9ycM8aQIzsdSMqM/i+u4ocxmRVkVsc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778735441; c=relaxed/simple; bh=HscCd40h4IXjgl6QvhloOnaj1tz+SpMNc1axYSXQjjk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=UZUa718V3AG/zkxiytYWSluV0jE/Oxra7i3n33TrWbWCBNP4KOpLb847UEs8hrgTJfsOkjgYflf/zFF4kLGYvUdQ0/qv9aVRgtNQqJh7RJiNiX1SIjldKS5V/IVCt+1RR2hBGNtUll1XXdsGKBuFgf/7ouJwACIlbBgQtwK9Q2E= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=MrEbvadi; arc=none smtp.client-ip=91.218.175.189 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="MrEbvadi" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1778735436; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=U0DhVK8ibYLXXtHt744ue2KCHhBHIPe4oMwlveBBIeI=; b=MrEbvadiWOwbxhclbAmgsiNemFCOrHDnxWFpAXYo1pKsuJL0M+8BvOJqnUr/1X7EXXd4rU RAelj39/DLE9e8p9lcQcnf8QhB1N83qGq0B0uzI2DK6EsIFqOavv6pGBTBExABlhjXmPD7 2GZJaY7FkgNfItbt7JVNHSy//2T4Ahw= From: Jiayuan Chen To: bpf@vger.kernel.org Cc: Jiayuan Chen , Kuniyuki Iwashima , Eric Dumazet , Neal Cardwell , "David S. Miller" , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrii Nakryiko , Eduard Zingerman , Alexei Starovoitov , Daniel Borkmann , Martin KaFai Lau , Kumar Kartikeya Dwivedi , Song Liu , Yonghong Song , Jiri Olsa , Shuah Khan , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org Subject: [PATCH bpf-next v4 1/2] net: add missing syncookie statistics for BPF custom syncookies Date: Thu, 14 May 2026 13:09:57 +0800 Message-ID: <20260514051015.177926-2-jiayuan.chen@linux.dev> In-Reply-To: <20260514051015.177926-1-jiayuan.chen@linux.dev> References: <20260514051015.177926-1-jiayuan.chen@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" 1. Replace IS_ENABLED(CONFIG_BPF) with CONFIG_BPF_SYSCALL for cookie_bpf_ok() and cookie_bpf_check(). CONFIG_BPF is selected by CONFIG_NET unconditionally, so IS_ENABLED(CONFIG_BPF) is always true and provides no real guard. CONFIG_BPF_SYSCALL is the correct config for BPF program functionality. 2. Remove the CONFIG_BPF guard around struct bpf_tcp_req_attrs. Since CONFIG_BPF is always selected by CONFIG_NET the guard is a no-op, and the struct is referenced by bpf_sk_assign_tcp_reqsk() in net/core/filter.c which is compiled unconditionally, so its visibility is not actually conditional on BPF being enabled. 3. Fix mismatched declaration of cookie_bpf_check() between the CONFIG_BPF_SYSCALL and stub paths: the real definition takes 'struct net *net' but the declaration in the header did not. Add the net parameter to the declaration and all call sites. 4. Add missing LINUX_MIB_SYNCOOKIESRECV and LINUX_MIB_SYNCOOKIESFAILED statistics in cookie_bpf_check(), so that BPF custom syncookie validation is accounted for in SNMP counters just like the non-BPF path. Compile-tested with CONFIG_BPF_SYSCALL=3Dy and CONFIG_BPF_SYSCALL not set. Signed-off-by: Jiayuan Chen Reviewed-by: Kuniyuki Iwashima --- To sashiko: We already called skb->sk =3D NULL before calling reqsk_free(req). So there is no worry about skb->sk becoming dangling pointer after cookie_tcp_reqsk_init() fails. --- include/net/tcp.h | 7 +++---- net/ipv4/syncookies.c | 10 +++++++--- net/ipv6/syncookies.c | 2 +- 3 files changed, 11 insertions(+), 8 deletions(-) diff --git a/include/net/tcp.h b/include/net/tcp.h index ecbadcb3a7446..7d87bc2d21d17 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -599,7 +599,6 @@ struct request_sock *cookie_tcp_reqsk_alloc(const struc= t request_sock_ops *ops, struct tcp_options_received *tcp_opt, int mss, u32 tsoff); =20 -#if IS_ENABLED(CONFIG_BPF) struct bpf_tcp_req_attrs { u32 rcv_tsval; u32 rcv_tsecr; @@ -613,7 +612,6 @@ struct bpf_tcp_req_attrs { u8 usec_ts_ok; u8 reserved[3]; }; -#endif =20 #ifdef CONFIG_SYN_COOKIES =20 @@ -716,13 +714,14 @@ static inline bool cookie_ecn_ok(const struct net *ne= t, const struct dst_entry * dst_feature(dst, RTAX_FEATURE_ECN); } =20 -#if IS_ENABLED(CONFIG_BPF) +#ifdef CONFIG_BPF_SYSCALL static inline bool cookie_bpf_ok(struct sk_buff *skb) { return skb->sk; } =20 -struct request_sock *cookie_bpf_check(struct sock *sk, struct sk_buff *skb= ); +struct request_sock *cookie_bpf_check(struct net *net, struct sock *sk, + struct sk_buff *skb); #else static inline bool cookie_bpf_ok(struct sk_buff *skb) { diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c index df479277fb801..9251d4a15c888 100644 --- a/net/ipv4/syncookies.c +++ b/net/ipv4/syncookies.c @@ -294,8 +294,9 @@ static int cookie_tcp_reqsk_init(struct sock *sk, struc= t sk_buff *skb, return 0; } =20 -#if IS_ENABLED(CONFIG_BPF) -struct request_sock *cookie_bpf_check(struct sock *sk, struct sk_buff *skb) +#ifdef CONFIG_BPF_SYSCALL +struct request_sock *cookie_bpf_check(struct net *net, struct sock *sk, + struct sk_buff *skb) { struct request_sock *req =3D inet_reqsk(skb->sk); =20 @@ -305,6 +306,9 @@ struct request_sock *cookie_bpf_check(struct sock *sk, = struct sk_buff *skb) if (cookie_tcp_reqsk_init(sk, skb, req)) { reqsk_free(req); req =3D NULL; + __NET_INC_STATS(net, LINUX_MIB_SYNCOOKIESFAILED); + } else { + __NET_INC_STATS(net, LINUX_MIB_SYNCOOKIESRECV); } =20 return req; @@ -419,7 +423,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk= _buff *skb) goto out; =20 if (cookie_bpf_ok(skb)) { - req =3D cookie_bpf_check(sk, skb); + req =3D cookie_bpf_check(net, sk, skb); } else { req =3D cookie_tcp_check(net, sk, skb); if (IS_ERR(req)) diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c index 4f6f0d751d6c5..111d7a41d9573 100644 --- a/net/ipv6/syncookies.c +++ b/net/ipv6/syncookies.c @@ -190,7 +190,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk= _buff *skb) goto out; =20 if (cookie_bpf_ok(skb)) { - req =3D cookie_bpf_check(sk, skb); + req =3D cookie_bpf_check(net, sk, skb); } else { req =3D cookie_tcp_check(net, sk, skb); if (IS_ERR(req)) --=20 2.43.0 From nobody Fri Jun 12 15:30:50 2026 Received: from out-183.mta0.migadu.com (out-183.mta0.migadu.com [91.218.175.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5A7253B9DAB for ; Thu, 14 May 2026 05:10:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.183 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778735451; cv=none; b=U8V9dYk3lrpWzM0Ytu8S4LZTMAWMC0/EYCl2fwrdFjSZYZHwfcnSL/+SRtTqGdQ7YAY6c3sSBiNis0LwH+ybt1XYKuHXoSYVMC8pq4mFGb5EPGJfZZyDdmZsD1hhjed6TQhXgLI3AvgN8ES6yeZwUtlgnI1gIGZP6ScxQJCD7+Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778735451; c=relaxed/simple; bh=q+zJyCGqjovaiIwt437MGOpY+gdYRqEuHxG+92IxJ4g=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=qKGlviK5xYk04C2lyVCHyKZBcGL9E7iLkowdylt/Pd9lgYiOOlQMZRySn4g3ix16NRTHBNdES9gJdZY9ngBHe0QY1YeZhjVflq+rQysz0nsD8N0C36egpTHr0TZ7lgTSWNj8Th6XqmF3q/v89a3Z9SFeCbtU9Z5MWbWmpQWCU3Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=dxydN7sb; arc=none smtp.client-ip=91.218.175.183 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="dxydN7sb" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1778735447; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=KfBmWLVLAOipY3O8m0a/fBCDqmiOi2Nx5QlLflxw4E0=; b=dxydN7sbiNIy8HQc7UmyMtvgBv3e5JAwv6K8Lr/cWgPPHvbprVEWJsSG9p9LXpN4dJ+k8N Qp+x9l2528f0ieQgpFC8oHebmqttNJ/VivNIQX7YlzH8uahIJy47nARSy2md3ONrIrwh8+ A8P+EyqmrNowraN/fgxzq+Y8hZckvNc= From: Jiayuan Chen To: bpf@vger.kernel.org Cc: Jiayuan Chen , Kuniyuki Iwashima , Eric Dumazet , Neal Cardwell , "David S. Miller" , Jakub Kicinski , Paolo Abeni , Simon Horman , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Kumar Kartikeya Dwivedi , Song Liu , Yonghong Song , Jiri Olsa , Shuah Khan , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org Subject: [PATCH bpf-next v4 2/2] selftests/bpf: verify syncookie statistics in tcp_custom_syncookie Date: Thu, 14 May 2026 13:09:58 +0800 Message-ID: <20260514051015.177926-3-jiayuan.chen@linux.dev> In-Reply-To: <20260514051015.177926-1-jiayuan.chen@linux.dev> References: <20260514051015.177926-1-jiayuan.chen@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" Add read_tcpext_snmp() helper to network_helpers which reads a TcpExt SNMP counter via nstat, and use it in the tcp_custom_syncookie test to verify that LINUX_MIB_SYNCOOKIESRECV is incremented and LINUX_MIB_SYNCOOKIESFAILED stays unchanged across a successful BPF custom syncookie validation. The delta is captured between start_server() and accept(), which covers the full SYN/ACK/cookie-check path for one connection. Signed-off-by: Jiayuan Chen Reviewed-by: Kuniyuki Iwashima --- tools/testing/selftests/bpf/network_helpers.c | 22 +++++++++++++++++++ tools/testing/selftests/bpf/network_helpers.h | 1 + .../bpf/prog_tests/tcp_custom_syncookie.c | 20 +++++++++++++++++ 3 files changed, 43 insertions(+) diff --git a/tools/testing/selftests/bpf/network_helpers.c b/tools/testing/= selftests/bpf/network_helpers.c index b82f572641b7d..4e3848f60261e 100644 --- a/tools/testing/selftests/bpf/network_helpers.c +++ b/tools/testing/selftests/bpf/network_helpers.c @@ -621,6 +621,28 @@ int get_socket_local_port(int sock_fd) return -1; } =20 +int read_tcpext_snmp(const char *name, unsigned long *val) +{ + char cmd[128], buf[128]; + int ret =3D 0; + FILE *f; + + snprintf(cmd, sizeof(cmd), + "nstat -azs TcpExt%s | awk '/TcpExt/ {print $2}'", name); + f =3D popen(cmd, "r"); + if (!f) + return -errno; + + if (!fgets(buf, sizeof(buf), f)) { + ret =3D ferror(f) ? -errno : -ENODATA; + goto out; + } + *val =3D strtoul(buf, NULL, 10); +out: + pclose(f); + return ret; +} + int get_hw_ring_size(char *ifname, struct ethtool_ringparam *ring_param) { struct ifreq ifr =3D {0}; diff --git a/tools/testing/selftests/bpf/network_helpers.h b/tools/testing/= selftests/bpf/network_helpers.h index 79a010c88e11c..c53cd781df6e6 100644 --- a/tools/testing/selftests/bpf/network_helpers.h +++ b/tools/testing/selftests/bpf/network_helpers.h @@ -84,6 +84,7 @@ int make_sockaddr(int family, const char *addr_str, __u16= port, struct sockaddr_storage *addr, socklen_t *len); char *ping_command(int family); int get_socket_local_port(int sock_fd); +int read_tcpext_snmp(const char *name, unsigned long *val); int get_hw_ring_size(char *ifname, struct ethtool_ringparam *ring_param); int set_hw_ring_size(char *ifname, struct ethtool_ringparam *ring_param); =20 diff --git a/tools/testing/selftests/bpf/prog_tests/tcp_custom_syncookie.c = b/tools/testing/selftests/bpf/prog_tests/tcp_custom_syncookie.c index eaf441dc7e79b..00d5c32674fc9 100644 --- a/tools/testing/selftests/bpf/prog_tests/tcp_custom_syncookie.c +++ b/tools/testing/selftests/bpf/prog_tests/tcp_custom_syncookie.c @@ -91,12 +91,21 @@ static void transfer_message(int sender, int receiver) =20 static void create_connection(struct test_tcp_custom_syncookie_case *test_= case) { + unsigned long failed_before, failed_after; + unsigned long recv_before, recv_after; int server, client, child; =20 server =3D start_server(test_case->family, test_case->type, test_case->ad= dr, 0, 0); if (!ASSERT_NEQ(server, -1, "start_server")) return; =20 + if (!ASSERT_OK(read_tcpext_snmp("SyncookiesRecv", &recv_before), + "read SyncookiesRecv before")) + goto close_server; + if (!ASSERT_OK(read_tcpext_snmp("SyncookiesFailed", &failed_before), + "read SyncookiesFailed before")) + goto close_server; + client =3D connect_to_fd(server, 0); if (!ASSERT_NEQ(client, -1, "connect_to_fd")) goto close_server; @@ -105,9 +114,20 @@ static void create_connection(struct test_tcp_custom_s= yncookie_case *test_case) if (!ASSERT_NEQ(child, -1, "accept")) goto close_client; =20 + if (!ASSERT_OK(read_tcpext_snmp("SyncookiesRecv", &recv_after), + "read SyncookiesRecv after")) + goto close_child; + if (!ASSERT_OK(read_tcpext_snmp("SyncookiesFailed", &failed_after), + "read SyncookiesFailed after")) + goto close_child; + + ASSERT_EQ(recv_after - recv_before, 1, "SyncookiesRecv delta"); + ASSERT_EQ(failed_after - failed_before, 0, "SyncookiesFailed delta"); + transfer_message(client, child); transfer_message(child, client); =20 +close_child: close(child); close_client: close(client); --=20 2.43.0