From cc22f259b30a3b391b6dd4e774d29f1d073a5216 Mon Sep 17 00:00:00 2001
From: Red Bear OS <build@redbearos.org>
Date: Thu, 9 Jul 2026 10:19:08 +0300
Subject: [PATCH] conntrack: icmp_error_count counter + display in stats

ConntrackTable gains icmp_error_count: u64 field, incremented
whenever track_icmp_error() processes an ICMP error that doesn't
match an existing tracked connection.

Stats output now includes:
  icmp_errors: N

Useful for diagnosing ICMP error processing and detecting
anomalies in ICMP error rate.

All 31 tests pass.
---
 netstack/src/filter/conntrack.rs | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/netstack/src/filter/conntrack.rs b/netstack/src/filter/conntrack.rs
index 67403c2caf..d8c2673694 100644
--- a/netstack/src/filter/conntrack.rs
+++ b/netstack/src/filter/conntrack.rs
@@ -166,6 +166,7 @@ pub struct ConntrackTable {
     syn_rate_limits: BTreeMap<IpAddress, (u32, Instant)>,
     icmp_rate_limits: BTreeMap<IpAddress, (u32, Instant)>,
     over_limit_count: u64,
+    icmp_error_count: u64,
 }
 
 fn advance_entry_state(entry: &mut ConnEntry, is_orig: bool, ctx: &PacketContext, now: Instant) -> bool {
@@ -250,6 +251,7 @@ impl ConntrackTable {
             syn_rate_limits: BTreeMap::new(),
             icmp_rate_limits: BTreeMap::new(),
             over_limit_count: 0,
+            icmp_error_count: 0,
         }
     }
 
@@ -481,6 +483,7 @@ impl ConntrackTable {
         if self.entries.contains_key(&inner_key) {
             ConnState::Related
         } else {
+            self.icmp_error_count = self.icmp_error_count.saturating_add(1);
             ConnState::Error
         }
     }
@@ -552,6 +555,7 @@ impl ConntrackTable {
         out.push_str(&alloc::format!("udp_entries: {}\n", udp));
         out.push_str(&alloc::format!("icmp_entries: {}\n", icmp));
         out.push_str(&alloc::format!("over_limit: {}\n", self.over_limit_count));
+        out.push_str(&alloc::format!("icmp_errors: {}\n", self.icmp_error_count));
         out.push_str(&alloc::format!("total_entries: {}\n", self.entries.len()));
         out
     }