Re: [PATCH net-next v1] net: add missing syncookie statistics for BPF custom syncookies

[Jiayuan Chen]

On 4/11/26 6:31 AM, Kuniyuki Iwashima wrote:
> > 1. Replace IS_ENABLED(CONFIG_BPF) with CONFIG_BPF_SYSCALL for
> >     cookie_bpf_ok() and cookie_bpf_check(). CONFIG_BPF is selected by
> >     CONFIG_NET unconditionally, so IS_ENABLED(CONFIG_BPF) is always
> >     true and provides no real guard. CONFIG_BPF_SYSCALL is the correct
> >     config for BPF program functionality.
> >
> > 2. Remove the CONFIG_BPF_SYSCALL guard around struct bpf_tcp_req_attrs.
> >     This struct is referenced by bpf_sk_assign_tcp_reqsk() in
> >     net/core/filter.c which is compiled unconditionally, so wrapping
> >     the definition in a config guard could cause build failures when
> >     CONFIG_BPF_SYSCALL=n.
> >
> > 3. Fix mismatched declaration of cookie_bpf_check() between the
> >     CONFIG_BPF_SYSCALL and stub paths: the real definition takes
> >     'struct net *net' but the declaration in the header did not.
> >     Add the net parameter to the declaration and all call sites.
> >
> > 4. Add missing LINUX_MIB_SYNCOOKIESRECV and LINUX_MIB_SYNCOOKIESFAILED
> >     statistics in cookie_bpf_check(), so that BPF custom syncookie
> >     validation is accounted for in SNMP counters just like the
> >     non-BPF path.
> >
> > Compile-tested with CONFIG_BPF_SYSCALL=y and CONFIG_BPF_SYSCALL
> > not set.
> Can you add SNMP test in tcp_custom_syncookie.c by checking
> the delta before connect_to_fd() and after accept() ?


Thanks for the suggestion. I've added the following to the existing test 
case and it works correctly:

+   recv_before = read_tcpext("SyncookiesRecv");
+   failed_before = read_tcpext("SyncookiesFailed");

   client = connect_to_fd(server, 0);
   if (!ASSERT_NEQ(client, -1, "connect_to_fd"))
         goto close_server;

   child = accept(server, NULL, 0);
   if (!ASSERT_NEQ(child, -1, "accept"))
         goto close_client;

+   recv_after = read_tcpext("SyncookiesRecv");
+   failed_after = read_tcpext("SyncookiesFailed");

+   ASSERT_EQ(recv_after - recv_before, 1, "SyncookiesRecv delta");
+   ASSERT_EQ(failed_after - failed_before, 0, "SyncookiesFailed delta");

Will include it in v2.