The branch stable/14 has been updated by kp:
URL:
https://cgit.FreeBSD.org/src/commit/?id=94b8a547c53b675a775fa824b433e23e5a28aee6
commit 94b8a547c53b675a775fa824b433e23e5a28aee6
Author: Kristof Provost <k...@freebsd.org>
AuthorDate: 2023-11-06 21:20:32 +0000
Commit: Kristof Provost <k...@freebsd.org>
CommitDate: 2023-11-13 07:10:27 +0000
pf: expose more syncookie state information to userspace
Allow userspace to retrieve low and high water marks, as well as the
current number of half open states.
MFC after: 1 week
Sponsored by: Modirum MDPay
(cherry picked from commit a6173e94635b03aa7aab90a67785c8c3e7c6247b)
---
lib/libpfctl/libpfctl.c | 1 +
lib/libpfctl/libpfctl.h | 1 +
sbin/pfctl/pfctl_parser.c | 5 +++++
sys/netpfil/pf/pf_ioctl.c | 1 +
sys/netpfil/pf/pf_syncookies.c | 2 ++
5 files changed, 10 insertions(+)
diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c
index 03907698e7d2..72da534ac1df 100644
--- a/lib/libpfctl/libpfctl.c
+++ b/lib/libpfctl/libpfctl.c
@@ -1476,6 +1476,7 @@ pfctl_get_syncookies(int dev, struct pfctl_syncookies *s)
s->highwater = nvlist_get_number(nvl, "highwater") * 100 / state_limit;
s->lowwater = nvlist_get_number(nvl, "lowwater") * 100 / state_limit;
+ s->halfopen_states = nvlist_get_number(nvl, "halfopen_states");
nvlist_destroy(nvl);
diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h
index f436e722496f..edaffdd12118 100644
--- a/lib/libpfctl/libpfctl.h
+++ b/lib/libpfctl/libpfctl.h
@@ -381,6 +381,7 @@ struct pfctl_syncookies {
enum pfctl_syncookies_mode mode;
uint8_t highwater; /* Percent */
uint8_t lowwater; /* Percent */
+ uint32_t halfopen_states;
};
struct pfctl_status* pfctl_get_status(int dev);
diff --git a/sbin/pfctl/pfctl_parser.c b/sbin/pfctl/pfctl_parser.c
index 0268d1b07c79..cb307cd6ede5 100644
--- a/sbin/pfctl/pfctl_parser.c
+++ b/sbin/pfctl/pfctl_parser.c
@@ -628,6 +628,11 @@ print_status(struct pfctl_status *s, struct
pfctl_syncookies *cookies, int opts)
PFCTL_SYNCOOKIES_MODE_NAMES[cookies->mode]);
printf(" %-25s %s\n", "active",
s->syncookies_active ? "active" : "inactive");
+ if (opts & PF_OPT_VERBOSE2) {
+ printf(" %-25s %d %%\n", "highwater",
cookies->highwater);
+ printf(" %-25s %d %%\n", "lowwater",
cookies->lowwater);
+ printf(" %-25s %d\n", "halfopen states",
cookies->halfopen_states);
+ }
printf("Reassemble %24s %s\n",
s->reass & PF_REASS_ENABLED ? "yes" : "no",
s->reass & PF_REASS_NODF ? "no-df" : ""
diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c
index 6b8fbf77fd29..de43570176cb 100644
--- a/sys/netpfil/pf/pf_ioctl.c
+++ b/sys/netpfil/pf/pf_ioctl.c
@@ -5918,6 +5918,7 @@ pf_getstatus(struct pfioc_nv *nv)
nvlist_add_number(nvl, "reass", V_pf_status.reass);
nvlist_add_bool(nvl, "syncookies_active",
V_pf_status.syncookies_active);
+ nvlist_add_number(nvl, "halfopen_states", V_pf_status.states_halfopen);
/* counters */
error = pf_add_status_counters(nvl, "counters", V_pf_status.counters,
diff --git a/sys/netpfil/pf/pf_syncookies.c b/sys/netpfil/pf/pf_syncookies.c
index b5e59178e7e8..c5ee64c6aed0 100644
--- a/sys/netpfil/pf/pf_syncookies.c
+++ b/sys/netpfil/pf/pf_syncookies.c
@@ -162,6 +162,8 @@ pf_get_syncookies(struct pfioc_nv *nv)
V_pf_status.syncookies_mode == PF_SYNCOOKIES_ADAPTIVE);
nvlist_add_number(nvl, "highwater", V_pf_syncookie_status.hiwat);
nvlist_add_number(nvl, "lowwater", V_pf_syncookie_status.lowat);
+ nvlist_add_number(nvl, "halfopen_states",
+ atomic_load_32(&V_pf_status.states_halfopen));
nvlpacked = nvlist_pack(nvl, &nv->len);
if (nvlpacked == NULL)
