From: Alexander Bluhm Subject: Re: pfctl show fragment info To: tech@openbsd.org Date: Fri, 19 Apr 2024 21:04:21 +0200 On Fri, Apr 19, 2024 at 08:45:56PM +0200, Alexander Bluhm wrote: > > Please also add it to systat(1) which uses sysctl and kern.pfstatus. Better use the counters in pf_status within fragment code instead of copying them in sysctl. We need the PF_FRAG_LOCK in sysctl and ioctl anyway. ok? bluhm Index: sys/net/pf_ioctl.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/net/pf_ioctl.c,v diff -u -p -r1.415 pf_ioctl.c --- sys/net/pf_ioctl.c 6 Jul 2023 04:55:05 -0000 1.415 +++ sys/net/pf_ioctl.c 19 Apr 2024 18:54:12 -0000 @@ -1955,7 +1955,9 @@ pfioctl(dev_t dev, u_long cmd, caddr_t a struct pf_status *s = (struct pf_status *)addr; NET_LOCK(); PF_LOCK(); + PF_FRAG_LOCK(); memcpy(s, &pf_status, sizeof(struct pf_status)); + PF_FRAG_UNLOCK(); pfi_update_status(s->ifname, s); PF_UNLOCK(); NET_UNLOCK(); @@ -1996,6 +1998,9 @@ pfioctl(dev_t dev, u_long cmd, caddr_t a memset(pf_status.counters, 0, sizeof(pf_status.counters)); memset(pf_status.fcounters, 0, sizeof(pf_status.fcounters)); memset(pf_status.scounters, 0, sizeof(pf_status.scounters)); + PF_FRAG_LOCK(); + memset(pf_status.ncounters, 0, sizeof(pf_status.ncounters)); + PF_FRAG_UNLOCK(); pf_status.since = getuptime(); PF_UNLOCK(); @@ -3271,7 +3276,9 @@ pf_sysctl(void *oldp, size_t *oldlenp, v NET_LOCK_SHARED(); PF_LOCK(); + PF_FRAG_LOCK(); memcpy(&pfs, &pf_status, sizeof(struct pf_status)); + PF_FRAG_UNLOCK(); pfi_update_status(pfs.ifname, &pfs); PF_UNLOCK(); NET_UNLOCK_SHARED(); Index: sys/net/pf_norm.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/net/pf_norm.c,v diff -u -p -r1.229 pf_norm.c --- sys/net/pf_norm.c 10 Oct 2023 11:25:31 -0000 1.229 +++ sys/net/pf_norm.c 19 Apr 2024 18:55:36 -0000 @@ -150,13 +150,10 @@ int pf_reassemble6(struct mbuf **, st /* Globals */ struct pool pf_frent_pl, pf_frag_pl, pf_frnode_pl; struct pool pf_state_scrub_pl; -int pf_nfrents; struct mutex pf_frag_mtx; #define PF_FRAG_LOCK_INIT() mtx_init(&pf_frag_mtx, IPL_SOFTNET) -#define PF_FRAG_LOCK() mtx_enter(&pf_frag_mtx) -#define PF_FRAG_UNLOCK() mtx_leave(&pf_frag_mtx) void pf_normalize_init(void) @@ -233,11 +230,12 @@ void pf_flush_fragments(void) { struct pf_fragment *frag; - int goal; + u_int goal; - goal = pf_nfrents * 9 / 10; - DPFPRINTF(LOG_NOTICE, "trying to free > %d frents", pf_nfrents - goal); - while (goal < pf_nfrents) { + goal = pf_status.fragments * 9 / 10; + DPFPRINTF(LOG_NOTICE, "trying to free > %d frents", + pf_status.fragments - goal); + while (goal < pf_status.fragments) { if ((frag = TAILQ_LAST(&pf_fragqueue, pf_fragqueue)) == NULL) break; pf_free_fragment(frag); @@ -268,9 +266,10 @@ pf_free_fragment(struct pf_fragment *fra /* Free all fragment entries */ while ((frent = TAILQ_FIRST(&frag->fr_queue)) != NULL) { TAILQ_REMOVE(&frag->fr_queue, frent, fr_next); + pf_status.ncounters[NCNT_FRAG_REMOVALS]++; m_freem(frent->fe_m); pool_put(&pf_frent_pl, frent); - pf_nfrents--; + pf_status.fragments--; } pool_put(&pf_frag_pl, frag); } @@ -283,6 +282,7 @@ pf_find_fragment(struct pf_frnode *key, u_int32_t stale; frnode = RB_FIND(pf_frnode_tree, &pf_frnode_tree, key); + pf_status.ncounters[NCNT_FRAG_SEARCH]++; if (frnode == NULL) return (NULL); KASSERT(frnode->fn_fragments >= 1); @@ -328,7 +328,7 @@ pf_create_fragment(u_short *reason) return (NULL); } } - pf_nfrents++; + pf_status.fragments++; return (frent); } @@ -405,6 +405,7 @@ pf_frent_insert(struct pf_fragment *frag KASSERT(prev->fe_off + prev->fe_len <= frent->fe_off); TAILQ_INSERT_AFTER(&frag->fr_queue, prev, frent, fr_next); } + pf_status.ncounters[NCNT_FRAG_INSERT]++; if (frag->fr_firstoff[index] == NULL) { KASSERT(prev == NULL || pf_frent_index(prev) < index); @@ -456,6 +457,7 @@ pf_frent_remove(struct pf_fragment *frag } TAILQ_REMOVE(&frag->fr_queue, frent, fr_next); + pf_status.ncounters[NCNT_FRAG_REMOVALS]++; KASSERT(frag->fr_entries[index] > 0); frag->fr_entries[index]--; @@ -689,7 +691,7 @@ pf_fillup_fragment(struct pf_frnode *key "fragment requeue limit exceeded"); m_freem(after->fe_m); pool_put(&pf_frent_pl, after); - pf_nfrents--; + pf_status.fragments--; /* There is not way to recover */ goto free_fragment; } @@ -703,7 +705,7 @@ pf_fillup_fragment(struct pf_frnode *key pf_frent_remove(frag, after); m_freem(after->fe_m); pool_put(&pf_frent_pl, after); - pf_nfrents--; + pf_status.fragments--; } /* If part of the queue gets too long, there is not way to recover. */ @@ -730,7 +732,7 @@ bad_fragment: REASON_SET(reason, PFRES_FRAG); drop_fragment: pool_put(&pf_frent_pl, frent); - pf_nfrents--; + pf_status.fragments--; return (NULL); } @@ -742,6 +744,7 @@ pf_join_fragment(struct pf_fragment *fra frent = TAILQ_FIRST(&frag->fr_queue); TAILQ_REMOVE(&frag->fr_queue, frent, fr_next); + pf_status.ncounters[NCNT_FRAG_REMOVALS]++; m = frent->fe_m; /* Strip off any trailing bytes */ @@ -752,10 +755,11 @@ pf_join_fragment(struct pf_fragment *fra m->m_next = NULL; m_cat(m, m2); pool_put(&pf_frent_pl, frent); - pf_nfrents--; + pf_status.fragments--; while ((frent = TAILQ_FIRST(&frag->fr_queue)) != NULL) { TAILQ_REMOVE(&frag->fr_queue, frent, fr_next); + pf_status.ncounters[NCNT_FRAG_REMOVALS]++; m2 = frent->fe_m; /* Strip off ip header */ m_adj(m2, frent->fe_hdrlen); @@ -763,7 +767,7 @@ pf_join_fragment(struct pf_fragment *fra if (frent->fe_len < m2->m_pkthdr.len) m_adj(m2, frent->fe_len - m2->m_pkthdr.len); pool_put(&pf_frent_pl, frent); - pf_nfrents--; + pf_status.fragments--; m_removehdr(m2); m_cat(m, m2); } Index: sys/net/pfvar.h =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/net/pfvar.h,v diff -u -p -r1.535 pfvar.h --- sys/net/pfvar.h 1 Jan 2024 22:16:51 -0000 1.535 +++ sys/net/pfvar.h 19 Apr 2024 18:18:21 -0000 @@ -1192,6 +1192,11 @@ enum pfi_kif_refs { #define SCNT_SRC_NODE_REMOVALS 2 #define SCNT_MAX 3 +#define NCNT_FRAG_SEARCH 0 +#define NCNT_FRAG_INSERT 1 +#define NCNT_FRAG_REMOVALS 2 +#define NCNT_MAX 3 + #define REASON_SET(a, x) \ do { \ if ((void *)(a) != NULL) { \ @@ -1206,6 +1211,7 @@ struct pf_status { u_int64_t lcounters[LCNT_MAX]; /* limit counters */ u_int64_t fcounters[FCNT_MAX]; u_int64_t scounters[SCNT_MAX]; + u_int64_t ncounters[NCNT_MAX]; u_int64_t pcounters[2][2][3]; u_int64_t bcounters[2][2]; u_int64_t stateid; @@ -1215,6 +1221,7 @@ struct pf_status { u_int32_t states; u_int32_t states_halfopen; u_int32_t src_nodes; + u_int32_t fragments; u_int32_t debug; u_int32_t hostid; u_int32_t reass; /* reassembly */ Index: sys/net/pfvar_priv.h =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/net/pfvar_priv.h,v diff -u -p -r1.35 pfvar_priv.h --- sys/net/pfvar_priv.h 1 Jan 2024 22:16:51 -0000 1.35 +++ sys/net/pfvar_priv.h 19 Apr 2024 19:03:13 -0000 @@ -370,6 +370,7 @@ void pf_state_unref(struct pf_state * extern struct rwlock pf_lock; extern struct rwlock pf_state_lock; +extern struct mutex pf_frag_mtx; extern struct mutex pf_inp_mtx; #define PF_LOCK() do { \ @@ -414,6 +415,9 @@ extern struct mutex pf_inp_mtx; splassert_fail(RW_WRITE, \ rw_status(&pf_state_lock), __func__);\ } while (0) + +#define PF_FRAG_LOCK() mtx_enter(&pf_frag_mtx) +#define PF_FRAG_UNLOCK() mtx_leave(&pf_frag_mtx) /* for copies to/from network byte order */ void pf_state_peer_hton(const struct pf_state_peer *, Index: sbin/pfctl/pfctl_parser.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sbin/pfctl/pfctl_parser.c,v diff -u -p -r1.350 pfctl_parser.c --- sbin/pfctl/pfctl_parser.c 7 Feb 2024 23:53:44 -0000 1.350 +++ sbin/pfctl/pfctl_parser.c 19 Apr 2024 12:53:03 -0000 @@ -519,7 +519,8 @@ print_pool(struct pf_pool *pool, u_int16 const char *pf_reasons[PFRES_MAX+1] = PFRES_NAMES; const char *pf_lcounters[LCNT_MAX+1] = LCNT_NAMES; const char *pf_fcounters[FCNT_MAX+1] = FCNT_NAMES; -const char *pf_scounters[FCNT_MAX+1] = FCNT_NAMES; +const char *pf_scounters[SCNT_MAX+1] = FCNT_NAMES; +const char *pf_ncounters[NCNT_MAX+1] = FCNT_NAMES; void print_status(struct pf_status *s, struct pfctl_watermarks *synflwats, int opts) @@ -613,6 +614,20 @@ print_status(struct pf_status *s, struct if (runtime > 0) printf("%14.1f/s\n", (double)s->scounters[i] / (double)runtime); + else + printf("%14s\n", ""); + } + } + if (opts & PF_OPT_VERBOSE) { + printf("Fragments\n"); + printf(" %-25s %14u %14s\n", "current entries", + s->fragments, ""); + for (i = 0; i < NCNT_MAX; i++) { + printf(" %-25s %14lld ", pf_ncounters[i], + s->ncounters[i]); + if (runtime > 0) + printf("%14.1f/s\n", + (double)s->ncounters[i] / (double)runtime); else printf("%14s\n", ""); } Index: usr.bin/systat/pf.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/usr.bin/systat/pf.c,v diff -u -p -r1.13 pf.c --- usr.bin/systat/pf.c 14 Sep 2020 11:15:30 -0000 1.13 +++ usr.bin/systat/pf.c 19 Apr 2024 18:31:07 -0000 @@ -44,7 +44,8 @@ void print_fld_double(field_def *, doubl const char *pf_reasons[PFRES_MAX+1] = PFRES_NAMES; const char *pf_lcounters[LCNT_MAX+1] = LCNT_NAMES; const char *pf_fcounters[FCNT_MAX+1] = FCNT_NAMES; -const char *pf_scounters[FCNT_MAX+1] = FCNT_NAMES; +const char *pf_scounters[SCNT_MAX+1] = FCNT_NAMES; +const char *pf_ncounters[NCNT_MAX+1] = FCNT_NAMES; static struct pf_status status; int num_pf = 0; @@ -104,6 +105,7 @@ read_pf(void) num_disp += FCNT_MAX + 2; num_disp += SCNT_MAX + 2; + num_disp += NCNT_MAX + 2; num_disp += PFRES_MAX + 1; num_disp += LCNT_MAX + 1; @@ -294,6 +296,17 @@ print_pf(void) (double)s->scounters[i] / (double)tm); else ADD_LINE_V("src track", pf_scounters[i], s->scounters[i]); + } + + ADD_EMPTY_LINE; + ADD_LINE_V("fragment", "Count", s->fragments); + + for (i = 0; i < NCNT_MAX; i++) { + if (tm > 0) + ADD_LINE_VR("fragment", pf_ncounters[i], s->ncounters[i], + (double)s->ncounters[i] / (double)tm); + else + ADD_LINE_V("fragment", pf_ncounters[i], s->ncounters[i]); } ADD_EMPTY_LINE;