Download raw body.
pfctl show fragment info
Hi,
I would like to show pf fragment reassembly counters.
# pfctl -si -v
...
Fragments
current entries 26
searches 1055 0.3/s
inserts 1037 0.3/s
removals 1011 0.3/s
ok?
bluhm
Index: sys/net/pf_ioctl.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/net/pf_ioctl.c,v
diff -u -p -r1.415 pf_ioctl.c
--- sys/net/pf_ioctl.c 6 Jul 2023 04:55:05 -0000 1.415
+++ sys/net/pf_ioctl.c 19 Apr 2024 13:28:39 -0000
@@ -1955,6 +1955,11 @@ pfioctl(dev_t dev, u_long cmd, caddr_t a
struct pf_status *s = (struct pf_status *)addr;
NET_LOCK();
PF_LOCK();
+ PF_FRAG_LOCK();
+ pf_status.fragments = pf_nfrents;
+ memcpy(pf_status.ncounters, pf_nfrentcounters,
+ sizeof(pf_status.ncounters));
+ PF_FRAG_UNLOCK();
memcpy(s, &pf_status, sizeof(struct pf_status));
pfi_update_status(s->ifname, s);
PF_UNLOCK();
Index: sys/net/pf_norm.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/net/pf_norm.c,v
diff -u -p -r1.229 pf_norm.c
--- sys/net/pf_norm.c 10 Oct 2023 11:25:31 -0000 1.229
+++ sys/net/pf_norm.c 19 Apr 2024 13:44:40 -0000
@@ -150,13 +150,12 @@ int pf_reassemble6(struct mbuf **, st
/* Globals */
struct pool pf_frent_pl, pf_frag_pl, pf_frnode_pl;
struct pool pf_state_scrub_pl;
-int pf_nfrents;
+uint32_t pf_nfrents;
+uint64_t pf_nfrentcounters[NCNT_MAX];
struct mutex pf_frag_mtx;
#define PF_FRAG_LOCK_INIT() mtx_init(&pf_frag_mtx, IPL_SOFTNET)
-#define PF_FRAG_LOCK() mtx_enter(&pf_frag_mtx)
-#define PF_FRAG_UNLOCK() mtx_leave(&pf_frag_mtx)
void
pf_normalize_init(void)
@@ -233,7 +232,7 @@ void
pf_flush_fragments(void)
{
struct pf_fragment *frag;
- int goal;
+ u_int goal;
goal = pf_nfrents * 9 / 10;
DPFPRINTF(LOG_NOTICE, "trying to free > %d frents", pf_nfrents - goal);
@@ -268,6 +267,7 @@ pf_free_fragment(struct pf_fragment *fra
/* Free all fragment entries */
while ((frent = TAILQ_FIRST(&frag->fr_queue)) != NULL) {
TAILQ_REMOVE(&frag->fr_queue, frent, fr_next);
+ pf_nfrentcounters[NCNT_FRAG_REMOVALS]++;
m_freem(frent->fe_m);
pool_put(&pf_frent_pl, frent);
pf_nfrents--;
@@ -283,6 +283,7 @@ pf_find_fragment(struct pf_frnode *key,
u_int32_t stale;
frnode = RB_FIND(pf_frnode_tree, &pf_frnode_tree, key);
+ pf_nfrentcounters[NCNT_FRAG_SEARCH]++;
if (frnode == NULL)
return (NULL);
KASSERT(frnode->fn_fragments >= 1);
@@ -405,6 +406,7 @@ pf_frent_insert(struct pf_fragment *frag
KASSERT(prev->fe_off + prev->fe_len <= frent->fe_off);
TAILQ_INSERT_AFTER(&frag->fr_queue, prev, frent, fr_next);
}
+ pf_nfrentcounters[NCNT_FRAG_INSERT]++;
if (frag->fr_firstoff[index] == NULL) {
KASSERT(prev == NULL || pf_frent_index(prev) < index);
@@ -456,6 +458,7 @@ pf_frent_remove(struct pf_fragment *frag
}
TAILQ_REMOVE(&frag->fr_queue, frent, fr_next);
+ pf_nfrentcounters[NCNT_FRAG_REMOVALS]++;
KASSERT(frag->fr_entries[index] > 0);
frag->fr_entries[index]--;
@@ -742,6 +745,7 @@ pf_join_fragment(struct pf_fragment *fra
frent = TAILQ_FIRST(&frag->fr_queue);
TAILQ_REMOVE(&frag->fr_queue, frent, fr_next);
+ pf_nfrentcounters[NCNT_FRAG_REMOVALS]++;
m = frent->fe_m;
/* Strip off any trailing bytes */
@@ -756,6 +760,7 @@ pf_join_fragment(struct pf_fragment *fra
while ((frent = TAILQ_FIRST(&frag->fr_queue)) != NULL) {
TAILQ_REMOVE(&frag->fr_queue, frent, fr_next);
+ pf_nfrentcounters[NCNT_FRAG_REMOVALS]++;
m2 = frent->fe_m;
/* Strip off ip header */
m_adj(m2, frent->fe_hdrlen);
Index: sys/net/pfvar.h
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/net/pfvar.h,v
diff -u -p -r1.535 pfvar.h
--- sys/net/pfvar.h 1 Jan 2024 22:16:51 -0000 1.535
+++ sys/net/pfvar.h 19 Apr 2024 13:03:26 -0000
@@ -1192,6 +1192,11 @@ enum pfi_kif_refs {
#define SCNT_SRC_NODE_REMOVALS 2
#define SCNT_MAX 3
+#define NCNT_FRAG_SEARCH 0
+#define NCNT_FRAG_INSERT 1
+#define NCNT_FRAG_REMOVALS 2
+#define NCNT_MAX 3
+
#define REASON_SET(a, x) \
do { \
if ((void *)(a) != NULL) { \
@@ -1206,6 +1211,7 @@ struct pf_status {
u_int64_t lcounters[LCNT_MAX]; /* limit counters */
u_int64_t fcounters[FCNT_MAX];
u_int64_t scounters[SCNT_MAX];
+ u_int64_t ncounters[NCNT_MAX];
u_int64_t pcounters[2][2][3];
u_int64_t bcounters[2][2];
u_int64_t stateid;
@@ -1215,6 +1221,7 @@ struct pf_status {
u_int32_t states;
u_int32_t states_halfopen;
u_int32_t src_nodes;
+ u_int32_t fragments;
u_int32_t debug;
u_int32_t hostid;
u_int32_t reass; /* reassembly */
Index: sys/net/pfvar_priv.h
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/net/pfvar_priv.h,v
diff -u -p -r1.35 pfvar_priv.h
--- sys/net/pfvar_priv.h 1 Jan 2024 22:16:51 -0000 1.35
+++ sys/net/pfvar_priv.h 19 Apr 2024 13:21:00 -0000
@@ -368,8 +368,12 @@ extern struct timeout pf_purge_to;
struct pf_state *pf_state_ref(struct pf_state *);
void pf_state_unref(struct pf_state *);
+extern uint32_t pf_nfrents;
+extern uint64_t pf_nfrentcounters[];
+
extern struct rwlock pf_lock;
extern struct rwlock pf_state_lock;
+extern struct mutex pf_frag_mtx;
extern struct mutex pf_inp_mtx;
#define PF_LOCK() do { \
@@ -414,6 +418,9 @@ extern struct mutex pf_inp_mtx;
splassert_fail(RW_WRITE, \
rw_status(&pf_state_lock), __func__);\
} while (0)
+
+#define PF_FRAG_LOCK() mtx_enter(&pf_frag_mtx)
+#define PF_FRAG_UNLOCK() mtx_leave(&pf_frag_mtx)
/* for copies to/from network byte order */
void pf_state_peer_hton(const struct pf_state_peer *,
Index: sbin/pfctl/pfctl_parser.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sbin/pfctl/pfctl_parser.c,v
diff -u -p -r1.350 pfctl_parser.c
--- sbin/pfctl/pfctl_parser.c 7 Feb 2024 23:53:44 -0000 1.350
+++ sbin/pfctl/pfctl_parser.c 19 Apr 2024 12:53:03 -0000
@@ -519,7 +519,8 @@ print_pool(struct pf_pool *pool, u_int16
const char *pf_reasons[PFRES_MAX+1] = PFRES_NAMES;
const char *pf_lcounters[LCNT_MAX+1] = LCNT_NAMES;
const char *pf_fcounters[FCNT_MAX+1] = FCNT_NAMES;
-const char *pf_scounters[FCNT_MAX+1] = FCNT_NAMES;
+const char *pf_scounters[SCNT_MAX+1] = FCNT_NAMES;
+const char *pf_ncounters[NCNT_MAX+1] = FCNT_NAMES;
void
print_status(struct pf_status *s, struct pfctl_watermarks *synflwats, int opts)
@@ -613,6 +614,20 @@ print_status(struct pf_status *s, struct
if (runtime > 0)
printf("%14.1f/s\n",
(double)s->scounters[i] / (double)runtime);
+ else
+ printf("%14s\n", "");
+ }
+ }
+ if (opts & PF_OPT_VERBOSE) {
+ printf("Fragments\n");
+ printf(" %-25s %14u %14s\n", "current entries",
+ s->fragments, "");
+ for (i = 0; i < NCNT_MAX; i++) {
+ printf(" %-25s %14lld ", pf_ncounters[i],
+ s->ncounters[i]);
+ if (runtime > 0)
+ printf("%14.1f/s\n",
+ (double)s->ncounters[i] / (double)runtime);
else
printf("%14s\n", "");
}
pfctl show fragment info