Re: [Ntop-misc] pf_ring: bug fix (rule inactivity)

[Alfredo Cardigliano]

Hi Amir
here you go:

https://github.com/ntop/PF_RING/commit/8d04b242b48902600393e12209a758c4a84ec825

Please send a pull request for the next patch.

Thank you
Alfredo

> On 18 Oct 2017, at 19:38, Amir Kaduri  wrote:
> 
> Hi Alfredo,
> 
> The attached patch includes a fix of a bug that relates to updating the last 
> time a hash rule was active. I assume that the pfring_purge_idle_hash_rules() 
> API doesn't work for this reason.
> I also added an enhancement of the API pfring_get_hash_filtering_rule_stats() 
> to return for how long a hash filtering rule is inactive.
> The patch is based on pfring 6.6.0.
> 
> Since the fix and the enhancement are pretty short, I put them together in 
> the same patch.
> 
> I'll appreciate getting a feedback on this fix (I already sent it over a 
> month ago).
> 
> Thanks,
> Amir
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc



signature.asc
Description: Message signed with OpenPGP
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

[Ntop-misc] pf_ring: bug fix (rule inactivity)

[Amir Kaduri]

Hi Alfredo,

The attached patch includes a fix of a bug that relates to updating the
last time a hash rule was active. I assume that the
pfring_purge_idle_hash_rules()
API doesn't work for this reason.
I also added an enhancement of the API pfring_get_hash_filtering_rule_stats()
to return for how long a hash filtering rule is inactive.
The patch is based on pfring 6.6.0.

Since the fix and the enhancement are pretty short, I put them together in
the same patch.

I'll appreciate getting a feedback on this fix (I already sent it over a
month ago).

Thanks,
Amir
diff -Naur PF_RING-6.6.0-clean/kernel/linux/pf_ring.h 
PF_RING-6.6.0-rule_inactivity/kernel/linux/pf_ring.h
--- PF_RING-6.6.0-clean/kernel/linux/pf_ring.h  2017-04-24 12:53:37.0 
+0300
+++ PF_RING-6.6.0-rule_inactivity/kernel/linux/pf_ring.h2017-09-19 
13:51:42.709946000 +0300
@@ -604,6 +604,7 @@
 typedef struct {
   u_int64_t match;
   u_int64_t miss;
+  u_int32_t rule_inactivity;
 } hash_filtering_rule_stats;
 
 /* * */
diff -Naur PF_RING-6.6.0-clean/kernel/pf_ring.c 
PF_RING-6.6.0-rule_inactivity/kernel/pf_ring.c
--- PF_RING-6.6.0-clean/kernel/pf_ring.c2017-04-24 12:53:37.0 
+0300
+++ PF_RING-6.6.0-rule_inactivity/kernel/pf_ring.c  2017-09-19 
14:04:11.680328000 +0300
@@ -2372,7 +2372,6 @@
 && (hash_bucket->rule.host4_peer_b == rule->host4_peer_a)
 && (hash_bucket->rule.port_peer_a == rule->port_peer_b)
 && (hash_bucket->rule.port_peer_b == rule->port_peer_a {
-hash_bucket->rule.internals.jiffies_last_match = jiffies;
 return(1);
   } else
 return(0);
@@ -3291,6 +3290,7 @@
   while(hash_bucket != NULL) {
 if(hash_bucket_match(hash_bucket, hdr, 0, 0)) {
   hash_bucket->match++;
+  hash_bucket->rule.internals.jiffies_last_match = jiffies;
   hash_found = 1;
   break;
 } else
@@ -7146,6 +7146,7 @@
   hash_filtering_rule_stats hfrs;
   hfrs.match = bucket->match;
   hfrs.miss = pfr->sw_filtering_hash_miss;
+  hfrs.rule_inactivity = (u_int32_t)(jiffies_to_msecs(jiffies - 
bucket->rule.internals.jiffies_last_match) / 1000);
  rc = sizeof(hash_filtering_rule_stats);
   if(copy_to_user(optval, , rc)) {
printk("[PF_RING] copy_to_user() failure\n");
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc