diff options
| author | Leon Romanovsky <leonro@nvidia.com> | 2023-10-04 14:58:37 +0300 |
|---|---|---|
| committer | Saeed Mahameed <saeedm@nvidia.com> | 2024-02-06 03:45:49 +0300 |
| commit | 6fb7f9408779d5153430f207785628f3e16a85fc (patch) | |
| tree | 6683fd809f7cc5aa97281b59dc906383e00ca343 /drivers/net/ethernet/mellanox | |
| parent | f9f221c98fd83df518fbb2f5ad33980cfedfe1bf (diff) | |
| download | linux-6fb7f9408779d5153430f207785628f3e16a85fc.tar.xz | |
net/mlx5e: Connect mlx5 IPsec statistics with XFRM core
Fill integrity, replay and bad trailer counters.
As an example, after simulating replay window attack with 5 packets:
[leonro@c ~]$ grep XfrmInStateSeqError /proc/net/xfrm_stat
XfrmInStateSeqError 5
[leonro@c ~]$ sudo ip -s x s
<...>
stats:
replay-window 0 replay 5 failed 0
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Diffstat (limited to 'drivers/net/ethernet/mellanox')
| -rw-r--r-- | drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 22 |
1 files changed, 20 insertions, 2 deletions
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c index 46cce4e38d84..c54fd01ea635 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c @@ -988,19 +988,37 @@ static void mlx5e_xfrm_update_stats(struct xfrm_state *x) { struct mlx5e_ipsec_sa_entry *sa_entry = to_ipsec_sa_entry(x); struct mlx5e_ipsec_rule *ipsec_rule = &sa_entry->ipsec_rule; + struct net *net = dev_net(x->xso.dev); u64 packets, bytes, lastuse; lockdep_assert(lockdep_is_held(&x->lock) || lockdep_is_held(&dev_net(x->xso.real_dev)->xfrm.xfrm_cfg_mutex) || lockdep_is_held(&dev_net(x->xso.real_dev)->xfrm.xfrm_state_lock)); - if (x->xso.flags & XFRM_DEV_OFFLOAD_FLAG_ACQ || - x->xso.type != XFRM_DEV_OFFLOAD_PACKET) + if (x->xso.flags & XFRM_DEV_OFFLOAD_FLAG_ACQ) + return; + + if (sa_entry->attrs.dir == XFRM_DEV_OFFLOAD_IN) { + mlx5_fc_query_cached(ipsec_rule->auth.fc, &bytes, &packets, &lastuse); + x->stats.integrity_failed += packets; + XFRM_ADD_STATS(net, LINUX_MIB_XFRMINSTATEPROTOERROR, packets); + + mlx5_fc_query_cached(ipsec_rule->trailer.fc, &bytes, &packets, &lastuse); + XFRM_ADD_STATS(net, LINUX_MIB_XFRMINHDRERROR, packets); + } + + if (x->xso.type != XFRM_DEV_OFFLOAD_PACKET) return; mlx5_fc_query_cached(ipsec_rule->fc, &bytes, &packets, &lastuse); x->curlft.packets += packets; x->curlft.bytes += bytes; + + if (sa_entry->attrs.dir == XFRM_DEV_OFFLOAD_IN) { + mlx5_fc_query_cached(ipsec_rule->replay.fc, &bytes, &packets, &lastuse); + x->stats.replay += packets; + XFRM_ADD_STATS(net, LINUX_MIB_XFRMINSTATESEQERROR, packets); + } } static int mlx5e_xfrm_validate_policy(struct mlx5_core_dev *mdev, |