요약·해설과 원문, 전문 번역을 서로 분리했습니다. API 이름, symbol, source path는 원문 표기를 사용합니다.
1. 요약·해설
원문의 핵심 논리와 kernel programming 관점의 보충 설명입니다. 아래의 전문 번역과는 별도로 작성했습니다.
2. 영어 원문 전체
번역 기준이 된 Linux v6.18.37 원문입니다. 줄 번호는 이 버전의 파일 좌표입니다.
원문 전체 펼치기
1
.. SPDX-License-Identifier: GPL-2.0
3
==================================
4
XFRM proc - /proc/net/xfrm_* files
5
==================================
7
Masahide NAKAMURA <[email protected]>
10
Transformation Statistics
11
-------------------------
13
The xfrm_proc code is a set of statistics showing numbers of packets
14
dropped by the transformation code and why. These counters are defined
15
as part of the linux private MIB. These counters can be viewed in
16
/proc/net/xfrm_stat.
19
Inbound errors
20
~~~~~~~~~~~~~~
22
XfrmInError:
23
All errors which is not matched others
25
XfrmInBufferError:
26
No buffer is left
28
XfrmInHdrError:
29
Header error
31
XfrmInNoStates:
32
No state is found
33
i.e. Either inbound SPI, address, or IPsec protocol at SA is wrong
35
XfrmInStateProtoError:
36
Transformation protocol specific error
37
e.g. SA key is wrong
39
XfrmInStateModeError:
40
Transformation mode specific error
42
XfrmInStateSeqError:
43
Sequence error
44
i.e. Sequence number is out of window
46
XfrmInStateExpired:
47
State is expired
49
XfrmInStateMismatch:
50
State has mismatch option
51
e.g. UDP encapsulation type is mismatch
53
XfrmInStateInvalid:
54
State is invalid
56
XfrmInTmplMismatch:
57
No matching template for states
58
e.g. Inbound SAs are correct but SP rule is wrong
60
XfrmInNoPols:
61
No policy is found for states
62
e.g. Inbound SAs are correct but no SP is found
64
XfrmInPolBlock:
65
Policy discards
67
XfrmInPolError:
68
Policy error
70
XfrmAcquireError:
71
State hasn't been fully acquired before use
73
XfrmFwdHdrError:
74
Forward routing of a packet is not allowed
76
XfrmInStateDirError:
77
State direction mismatch (lookup found an output state on the input path, expected input or no direction)
79
Outbound errors
80
~~~~~~~~~~~~~~~
81
XfrmOutError:
82
All errors which is not matched others
84
XfrmOutBundleGenError:
85
Bundle generation error
87
XfrmOutBundleCheckError:
88
Bundle check error
90
XfrmOutNoStates:
91
No state is found
93
XfrmOutStateProtoError:
94
Transformation protocol specific error
96
XfrmOutStateModeError:
97
Transformation mode specific error
99
XfrmOutStateSeqError:
100
Sequence error
101
i.e. Sequence number overflow
103
XfrmOutStateExpired:
104
State is expired
106
XfrmOutPolBlock:
107
Policy discards
109
XfrmOutPolDead:
110
Policy is dead
112
XfrmOutPolError:
113
Policy error
115
XfrmOutStateInvalid:
116
State is invalid, perhaps expired
118
XfrmOutStateDirError:
119
State direction mismatch (lookup found an input state on the output path, expected output or no direction)
3. 한국어 전문 번역
영어 원문의 문단 순서와 의미를 유지한 전체 번역입니다. 코드, 함수명, symbol과 URL은 원문 표기를 유지합니다.
Transformation statistic 개요
1-18Masahide NAKAMURA가 작성한 이 문서는 XFRM proc statistic을 설명합니다.
`xfrm_proc` counter는 transformation code가 drop한 packet 수와 이유를 보여 줍니다. Linux private MIB의 일부로 정의되며 `/proc/net/xfrm_stat`에서 확인할 수 있습니다.
.. SPDX-License-Identifier: GPL-2.0
==================================
XFRM proc - /proc/net/xfrm_* files
==================================
Masahide NAKAMURA <[email protected]>
Transformation Statistics
-------------------------
The xfrm_proc code is a set of statistics showing numbers of packets
dropped by the transformation code and why. These counters are defined
as part of the linux private MIB. These counters can be viewed in
/proc/net/xfrm_stat.
Inbound error counter
19-78Inbound counter는 input transformation에서 buffer, header, SA lookup·state, replay sequence, template·policy와 direction 검사를 실패한 이유를 분류합니다.
Counter의미
XfrmInError다른 항목에 match하지 않는 모든 inbound error
XfrmInBufferError사용 가능한 buffer가 없음
XfrmInHdrErrorHeader error
XfrmInNoStatesState를 찾지 못함; inbound SPI, address 또는 SA의 IPsec protocol 오류
XfrmInStateProtoErrorTransformation protocol 고유 error; 예: 잘못된 SA key
XfrmInStateModeErrorTransformation mode 고유 error
XfrmInStateSeqErrorSequence number가 replay window 밖에 있음
XfrmInStateExpiredState가 만료됨
XfrmInStateMismatchState option mismatch; 예: UDP encapsulation type 불일치
XfrmInStateInvalidState가 invalid
XfrmInTmplMismatchState와 match하는 template 없음; SA는 맞지만 SP rule 오류
XfrmInNoPolsState에 대한 policy 없음; SA는 맞지만 SP를 찾지 못함
XfrmInPolBlockPolicy가 packet을 discard
XfrmInPolErrorPolicy error
XfrmAcquireError사용 전에 state acquisition이 끝나지 않음
XfrmFwdHdrErrorPacket forward routing이 허용되지 않음
XfrmInStateDirErrorInput path lookup이 output state를 찾음; input 또는 direction 없음이 필요
`/proc/net/xfrm_stat`의 inbound counter와 증가 조건입니다.
Inbound errors
~~~~~~~~~~~~~~
XfrmInError:
All errors which is not matched others
XfrmInBufferError:
No buffer is left
XfrmInHdrError:
Header error
XfrmInNoStates:
No state is found
i.e. Either inbound SPI, address, or IPsec protocol at SA is wrong
XfrmInStateProtoError:
Transformation protocol specific error
e.g. SA key is wrong
XfrmInStateModeError:
Transformation mode specific error
XfrmInStateSeqError:
Sequence error
i.e. Sequence number is out of window
XfrmInStateExpired:
State is expired
XfrmInStateMismatch:
State has mismatch option
e.g. UDP encapsulation type is mismatch
XfrmInStateInvalid:
State is invalid
XfrmInTmplMismatch:
No matching template for states
e.g. Inbound SAs are correct but SP rule is wrong
XfrmInNoPols:
No policy is found for states
e.g. Inbound SAs are correct but no SP is found
XfrmInPolBlock:
Policy discards
XfrmInPolError:
Policy error
XfrmAcquireError:
State hasn't been fully acquired before use
XfrmFwdHdrError:
Forward routing of a packet is not allowed
XfrmInStateDirError:
State direction mismatch (lookup found an output state on the input path, expected input or no direction)
Outbound error counter
79-119Outbound counter는 output transformation의 bundle 생성·검사, SA state, sequence overflow, policy와 direction 오류를 분류합니다.
Counter의미
XfrmOutError다른 항목에 match하지 않는 모든 outbound error
XfrmOutBundleGenErrorBundle generation error
XfrmOutBundleCheckErrorBundle check error
XfrmOutNoStatesState를 찾지 못함
XfrmOutStateProtoErrorTransformation protocol 고유 error
XfrmOutStateModeErrorTransformation mode 고유 error
XfrmOutStateSeqErrorSequence number overflow
XfrmOutStateExpiredState가 만료됨
XfrmOutPolBlockPolicy가 packet을 discard
XfrmOutPolDeadPolicy가 dead 상태
XfrmOutPolErrorPolicy error
XfrmOutStateInvalidState가 invalid이며 만료됐을 가능성 있음
XfrmOutStateDirErrorOutput path lookup이 input state를 찾음; output 또는 direction 없음이 필요
`/proc/net/xfrm_stat`의 outbound counter와 증가 조건입니다.
Outbound errors
~~~~~~~~~~~~~~~
XfrmOutError:
All errors which is not matched others
XfrmOutBundleGenError:
Bundle generation error
XfrmOutBundleCheckError:
Bundle check error
XfrmOutNoStates:
No state is found
XfrmOutStateProtoError:
Transformation protocol specific error
XfrmOutStateModeError:
Transformation mode specific error
XfrmOutStateSeqError:
Sequence error
i.e. Sequence number overflow
XfrmOutStateExpired:
State is expired
XfrmOutPolBlock:
Policy discards
XfrmOutPolDead:
Policy is dead
XfrmOutPolError:
Policy error
XfrmOutStateInvalid:
State is invalid, perhaps expired
XfrmOutStateDirError:
State direction mismatch (lookup found an input state on the output path, expected output or no direction)
요약·해설
xfrm_proc.rst:1-119`/proc/net/xfrm_stat`는 XFRM packet drop을 SA lookup, protocol·mode·sequence·expiry, template·policy, bundle과 direction 오류로 나눠 보여 줍니다. Counter 이름의 In/Out과 State/Pol/Tmpl 구분을 따라가면 실패 단계를 빠르게 찾을 수 있습니다.