tcp: MD5: Use MIB counter instead of warning for MD5 mismatch.

From a report by Matti Aarnio, and preliminary patch by Adam Langley.

Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/linux/snmp.h b/include/linux/snmp.h
index 5df62ef1280c176d2299d61dd6e3148161bd3b63..7a6e6bba4a71d5a3a18ac3151e61d4c28b82737f 100644 (file)
--- a/include/linux/snmp.h
+++ b/include/linux/snmp.h
@@ -214,6 +214,8 @@ enum
        LINUX_MIB_TCPDSACKIGNOREDOLD,           /* TCPSACKIgnoredOld */
        LINUX_MIB_TCPDSACKIGNOREDNOUNDO,        /* TCPSACKIgnoredNoUndo */
        LINUX_MIB_TCPSPURIOUSRTOS,              /* TCPSpuriousRTOs */
+       LINUX_MIB_TCPMD5NOTFOUND,               /* TCPMD5NotFound */
+       LINUX_MIB_TCPMD5UNEXPECTED,             /* TCPMD5Unexpected */
        __LINUX_MIB_MAX
 };
 

diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 834356ea99df92a0b9ffbc3d70d4c21e3b400889..8f5a403f6f6b9487b62eec845664d960c056bc8c 100644 (file)
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -232,6 +232,8 @@ static const struct snmp_mib snmp4_net_list[] = {
        SNMP_MIB_ITEM("TCPDSACKIgnoredOld", LINUX_MIB_TCPDSACKIGNOREDOLD),
        SNMP_MIB_ITEM("TCPDSACKIgnoredNoUndo", LINUX_MIB_TCPDSACKIGNOREDNOUNDO),
        SNMP_MIB_ITEM("TCPSpuriousRTOs", LINUX_MIB_TCPSPURIOUSRTOS),
+       SNMP_MIB_ITEM("TCPMD5NotFound", LINUX_MIB_TCPMD5NOTFOUND),
+       SNMP_MIB_ITEM("TCPMD5Unexpected", LINUX_MIB_TCPMD5UNEXPECTED),
        SNMP_MIB_SENTINEL
 };
 

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index a2b06d0cc26b70075a6cd649db7cb7c19451f76c..b3875c0d83c726943666cf3eadbf768d7662848e 100644 (file)
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1116,18 +1116,12 @@ static int tcp_v4_inbound_md5_hash(struct sock *sk, struct sk_buff *skb)
                return 0;
 
        if (hash_expected && !hash_location) {
-               LIMIT_NETDEBUG(KERN_INFO "MD5 Hash expected but NOT found "
-                              "(" NIPQUAD_FMT ", %d)->(" NIPQUAD_FMT ", %d)\n",
-                              NIPQUAD(iph->saddr), ntohs(th->source),
-                              NIPQUAD(iph->daddr), ntohs(th->dest));
+               NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
                return 1;
        }
 
        if (!hash_expected && hash_location) {
-               LIMIT_NETDEBUG(KERN_INFO "MD5 Hash NOT expected but found "
-                              "(" NIPQUAD_FMT ", %d)->(" NIPQUAD_FMT ", %d)\n",
-                              NIPQUAD(iph->saddr), ntohs(th->source),
-                              NIPQUAD(iph->daddr), ntohs(th->dest));
+               NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
                return 1;
        }
 

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index cff778b23a7feca249b9edab81c9d6afdee8597b..1db45216b2327fea71c3b78776ce608e8534d2ec 100644 (file)
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -849,28 +849,17 @@ static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
        hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
        hash_location = tcp_parse_md5sig_option(th);
 
-       /* do we have a hash as expected? */
-       if (!hash_expected) {
-               if (!hash_location)
-                       return 0;
-               if (net_ratelimit()) {
-                       printk(KERN_INFO "MD5 Hash NOT expected but found "
-                              "(" NIP6_FMT ", %u)->"
-                              "(" NIP6_FMT ", %u)\n",
-                              NIP6(ip6h->saddr), ntohs(th->source),
-                              NIP6(ip6h->daddr), ntohs(th->dest));
-               }
+       /* We've parsed the options - do we have a hash? */
+       if (!hash_expected && !hash_location)
+               return 0;
+
+       if (hash_expected && !hash_location) {
+               NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
                return 1;
        }
 
-       if (!hash_location) {
-               if (net_ratelimit()) {
-                       printk(KERN_INFO "MD5 Hash expected but NOT found "
-                              "(" NIP6_FMT ", %u)->"
-                              "(" NIP6_FMT ", %u)\n",
-                              NIP6(ip6h->saddr), ntohs(th->source),
-                              NIP6(ip6h->daddr), ntohs(th->dest));
-               }
+       if (!hash_expected && hash_location) {
+               NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
                return 1;
        }