2010-07-03 13:32:39 +00:00
|
|
|
/*-
|
2017-11-27 15:23:17 +00:00
|
|
|
* SPDX-License-Identifier: BSD-2-Clause-FreeBSD
|
|
|
|
*
|
2010-11-12 00:44:18 +00:00
|
|
|
* Copyright (c) 2007-2009
|
|
|
|
* Swinburne University of Technology, Melbourne, Australia.
|
2010-07-03 13:32:39 +00:00
|
|
|
* Copyright (c) 2009-2010, The FreeBSD Foundation
|
|
|
|
* All rights reserved.
|
|
|
|
*
|
|
|
|
* Portions of this software were developed at the Centre for Advanced
|
|
|
|
* Internet Architectures, Swinburne University of Technology, Melbourne,
|
|
|
|
* Australia by Lawrence Stewart under sponsorship from the FreeBSD Foundation.
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
|
|
* documentation and/or other materials provided with the distribution.
|
|
|
|
*
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
|
|
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
|
|
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
|
|
* SUCH DAMAGE.
|
|
|
|
*/
|
|
|
|
|
|
|
|
/******************************************************
|
|
|
|
* Statistical Information For TCP Research (SIFTR)
|
|
|
|
*
|
|
|
|
* A FreeBSD kernel module that adds very basic intrumentation to the
|
|
|
|
* TCP stack, allowing internal stats to be recorded to a log file
|
|
|
|
* for experimental, debugging and performance analysis purposes.
|
|
|
|
*
|
|
|
|
* SIFTR was first released in 2007 by James Healy and Lawrence Stewart whilst
|
2011-04-12 08:13:18 +00:00
|
|
|
* working on the NewTCP research project at Swinburne University of
|
|
|
|
* Technology's Centre for Advanced Internet Architectures, Melbourne,
|
|
|
|
* Australia, which was made possible in part by a grant from the Cisco
|
|
|
|
* University Research Program Fund at Community Foundation Silicon Valley.
|
|
|
|
* More details are available at:
|
2010-07-03 13:32:39 +00:00
|
|
|
* http://caia.swin.edu.au/urp/newtcp/
|
|
|
|
*
|
|
|
|
* Work on SIFTR v1.2.x was sponsored by the FreeBSD Foundation as part of
|
|
|
|
* the "Enhancing the FreeBSD TCP Implementation" project 2008-2009.
|
|
|
|
* More details are available at:
|
|
|
|
* http://www.freebsdfoundation.org/
|
|
|
|
* http://caia.swin.edu.au/freebsd/etcp09/
|
|
|
|
*
|
|
|
|
* Lawrence Stewart is the current maintainer, and all contact regarding
|
|
|
|
* SIFTR should be directed to him via email: lastewart@swin.edu.au
|
|
|
|
*
|
|
|
|
* Initial release date: June 2007
|
2010-09-25 09:16:46 +00:00
|
|
|
* Most recent update: September 2010
|
2010-07-03 13:32:39 +00:00
|
|
|
******************************************************/
|
|
|
|
|
|
|
|
#include <sys/cdefs.h>
|
|
|
|
__FBSDID("$FreeBSD$");
|
|
|
|
|
|
|
|
#include <sys/param.h>
|
|
|
|
#include <sys/alq.h>
|
|
|
|
#include <sys/errno.h>
|
2013-10-28 07:29:16 +00:00
|
|
|
#include <sys/eventhandler.h>
|
2010-07-03 13:32:39 +00:00
|
|
|
#include <sys/hash.h>
|
|
|
|
#include <sys/kernel.h>
|
|
|
|
#include <sys/kthread.h>
|
|
|
|
#include <sys/lock.h>
|
|
|
|
#include <sys/mbuf.h>
|
|
|
|
#include <sys/module.h>
|
|
|
|
#include <sys/mutex.h>
|
|
|
|
#include <sys/pcpu.h>
|
|
|
|
#include <sys/proc.h>
|
|
|
|
#include <sys/sbuf.h>
|
2015-04-29 17:19:55 +00:00
|
|
|
#include <sys/sdt.h>
|
2010-07-03 13:32:39 +00:00
|
|
|
#include <sys/smp.h>
|
|
|
|
#include <sys/socket.h>
|
|
|
|
#include <sys/socketvar.h>
|
|
|
|
#include <sys/sysctl.h>
|
|
|
|
#include <sys/unistd.h>
|
|
|
|
|
|
|
|
#include <net/if.h>
|
2013-10-28 07:29:16 +00:00
|
|
|
#include <net/if_var.h>
|
2010-07-03 13:32:39 +00:00
|
|
|
#include <net/pfil.h>
|
|
|
|
|
|
|
|
#include <netinet/in.h>
|
2015-04-29 17:19:55 +00:00
|
|
|
#include <netinet/in_kdtrace.h>
|
2010-07-03 13:32:39 +00:00
|
|
|
#include <netinet/in_pcb.h>
|
|
|
|
#include <netinet/in_systm.h>
|
|
|
|
#include <netinet/in_var.h>
|
|
|
|
#include <netinet/ip.h>
|
New pfil(9) KPI together with newborn pfil API and control utility.
The KPI have been reviewed and cleansed of features that were planned
back 20 years ago and never implemented. The pfil(9) internals have
been made opaque to protocols with only returned types and function
declarations exposed. The KPI is made more strict, but at the same time
more extensible, as kernel uses same command structures that userland
ioctl uses.
In nutshell [KA]PI is about declaring filtering points, declaring
filters and linking and unlinking them together.
New [KA]PI makes it possible to reconfigure pfil(9) configuration:
change order of hooks, rehook filter from one filtering point to a
different one, disconnect a hook on output leaving it on input only,
prepend/append a filter to existing list of filters.
Now it possible for a single packet filter to provide multiple rulesets
that may be linked to different points. Think of per-interface ACLs in
Cisco or Juniper. None of existing packet filters yet support that,
however limited usage is already possible, e.g. default ruleset can
be moved to single interface, as soon as interface would pride their
filtering points.
Another future feature is possiblity to create pfil heads, that provide
not an mbuf pointer but just a memory pointer with length. That would
allow filtering at very early stages of a packet lifecycle, e.g. when
packet has just been received by a NIC and no mbuf was yet allocated.
Differential Revision: https://reviews.freebsd.org/D18951
2019-01-31 23:01:03 +00:00
|
|
|
#include <netinet/ip_var.h>
|
2010-07-03 13:32:39 +00:00
|
|
|
#include <netinet/tcp_var.h>
|
|
|
|
|
|
|
|
#ifdef SIFTR_IPV6
|
|
|
|
#include <netinet/ip6.h>
|
2021-11-04 00:31:13 +00:00
|
|
|
#include <netinet6/ip6_var.h>
|
2010-07-03 13:32:39 +00:00
|
|
|
#include <netinet6/in6_pcb.h>
|
|
|
|
#endif /* SIFTR_IPV6 */
|
|
|
|
|
|
|
|
#include <machine/in_cksum.h>
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Three digit version number refers to X.Y.Z where:
|
|
|
|
* X is the major version number
|
|
|
|
* Y is bumped to mark backwards incompatible changes
|
|
|
|
* Z is bumped to mark backwards compatible changes
|
|
|
|
*/
|
|
|
|
#define V_MAJOR 1
|
2023-04-24 07:45:47 +00:00
|
|
|
#define V_BACKBREAK 3
|
|
|
|
#define V_BACKCOMPAT 0
|
2010-07-03 13:32:39 +00:00
|
|
|
#define MODVERSION __CONCAT(V_MAJOR, __CONCAT(V_BACKBREAK, V_BACKCOMPAT))
|
|
|
|
#define MODVERSION_STR __XSTRING(V_MAJOR) "." __XSTRING(V_BACKBREAK) "." \
|
|
|
|
__XSTRING(V_BACKCOMPAT)
|
|
|
|
|
|
|
|
#define HOOK 0
|
|
|
|
#define UNHOOK 1
|
|
|
|
#define SIFTR_EXPECTED_MAX_TCP_FLOWS 65536
|
|
|
|
#define SYS_NAME "FreeBSD"
|
|
|
|
#define PACKET_TAG_SIFTR 100
|
|
|
|
#define PACKET_COOKIE_SIFTR 21749576
|
|
|
|
#define SIFTR_LOG_FILE_MODE 0644
|
|
|
|
#define SIFTR_DISABLE 0
|
|
|
|
#define SIFTR_ENABLE 1
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Hard upper limit on the length of log messages. Bump this up if you add new
|
|
|
|
* data fields such that the line length could exceed the below value.
|
|
|
|
*/
|
2022-04-07 09:12:33 +00:00
|
|
|
#define MAX_LOG_MSG_LEN 300
|
2010-07-03 13:32:39 +00:00
|
|
|
/* XXX: Make this a sysctl tunable. */
|
|
|
|
#define SIFTR_ALQ_BUFLEN (1000*MAX_LOG_MSG_LEN)
|
|
|
|
|
|
|
|
/*
|
|
|
|
* 1 byte for IP version
|
|
|
|
* IPv4: src/dst IP (4+4) + src/dst port (2+2) = 12 bytes
|
|
|
|
* IPv6: src/dst IP (16+16) + src/dst port (2+2) = 36 bytes
|
|
|
|
*/
|
|
|
|
#ifdef SIFTR_IPV6
|
|
|
|
#define FLOW_KEY_LEN 37
|
|
|
|
#else
|
|
|
|
#define FLOW_KEY_LEN 13
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#ifdef SIFTR_IPV6
|
|
|
|
#define SIFTR_IPMODE 6
|
|
|
|
#else
|
|
|
|
#define SIFTR_IPMODE 4
|
|
|
|
#endif
|
|
|
|
|
|
|
|
/* useful macros */
|
|
|
|
#define UPPER_SHORT(X) (((X) & 0xFFFF0000) >> 16)
|
|
|
|
#define LOWER_SHORT(X) ((X) & 0x0000FFFF)
|
|
|
|
|
|
|
|
#define FIRST_OCTET(X) (((X) & 0xFF000000) >> 24)
|
|
|
|
#define SECOND_OCTET(X) (((X) & 0x00FF0000) >> 16)
|
|
|
|
#define THIRD_OCTET(X) (((X) & 0x0000FF00) >> 8)
|
|
|
|
#define FOURTH_OCTET(X) ((X) & 0x000000FF)
|
|
|
|
|
2011-04-13 11:28:46 +00:00
|
|
|
static MALLOC_DEFINE(M_SIFTR, "siftr", "dynamic memory used by SIFTR");
|
|
|
|
static MALLOC_DEFINE(M_SIFTR_PKTNODE, "siftr_pktnode",
|
|
|
|
"SIFTR pkt_node struct");
|
|
|
|
static MALLOC_DEFINE(M_SIFTR_HASHNODE, "siftr_hashnode",
|
|
|
|
"SIFTR flow_hash_node struct");
|
2010-07-03 13:32:39 +00:00
|
|
|
|
|
|
|
/* Used as links in the pkt manager queue. */
|
|
|
|
struct pkt_node {
|
|
|
|
/* Timestamp of pkt as noted in the pfil hook. */
|
|
|
|
struct timeval tval;
|
2019-02-01 08:10:26 +00:00
|
|
|
/* Direction pkt is travelling. */
|
|
|
|
enum {
|
|
|
|
DIR_IN = 0,
|
|
|
|
DIR_OUT = 1,
|
|
|
|
} direction;
|
2010-07-03 13:32:39 +00:00
|
|
|
/* IP version pkt_node relates to; either INP_IPV4 or INP_IPV6. */
|
|
|
|
uint8_t ipver;
|
|
|
|
/* Local/foreign IP address. */
|
|
|
|
#ifdef SIFTR_IPV6
|
|
|
|
uint32_t ip_laddr[4];
|
|
|
|
uint32_t ip_faddr[4];
|
|
|
|
#else
|
|
|
|
uint8_t ip_laddr[4];
|
|
|
|
uint8_t ip_faddr[4];
|
|
|
|
#endif
|
|
|
|
/* Local TCP port. */
|
|
|
|
uint16_t tcp_localport;
|
|
|
|
/* Foreign TCP port. */
|
|
|
|
uint16_t tcp_foreignport;
|
|
|
|
/* Congestion Window (bytes). */
|
2022-04-07 09:12:33 +00:00
|
|
|
uint32_t snd_cwnd;
|
2010-07-03 13:32:39 +00:00
|
|
|
/* Sending Window (bytes). */
|
2022-04-07 09:12:33 +00:00
|
|
|
uint32_t snd_wnd;
|
2010-07-03 13:32:39 +00:00
|
|
|
/* Receive Window (bytes). */
|
2022-04-07 09:12:33 +00:00
|
|
|
uint32_t rcv_wnd;
|
|
|
|
/* More tcpcb flags storage */
|
|
|
|
uint32_t t_flags2;
|
2010-07-03 13:32:39 +00:00
|
|
|
/* Slow Start Threshold (bytes). */
|
2022-04-07 09:12:33 +00:00
|
|
|
uint32_t snd_ssthresh;
|
2010-07-03 13:32:39 +00:00
|
|
|
/* Current state of the TCP FSM. */
|
|
|
|
int conn_state;
|
|
|
|
/* Max Segment Size (bytes). */
|
|
|
|
u_int max_seg_size;
|
Change the unit of srtt and rto to usec, inspired by these in struct "tcp_info". Therefore, no need hz and tcp_rtt_scale in the headline of the log. Update the man page as well.
Summary: Simplify srtt and rto values in siftr log.
Test Plan:
Tested in Emulab testbed:
cc@s1:~ % sudo sysctl net.inet.siftr
net.inet.siftr.port_filter: 0
net.inet.siftr.genhashes: 0
net.inet.siftr.ppl: 1
net.inet.siftr.logfile: /var/log/siftr.log
net.inet.siftr.enabled: 0
cc@s1:~ % sudo sysctl net.inet.siftr.port_filter=5001
net.inet.siftr.port_filter: 0 -> 5001
cc@s1:~ % sudo sysctl net.inet.siftr.enabled=1
net.inet.siftr.enabled: 0 -> 1
cc@s1:~ %
cc@s1:~ % iperf -c r1 -n 1M
------------------------------------------------------------
Client connecting to r1, TCP port 5001
TCP window size: 32.0 KByte (default)
------------------------------------------------------------
[ 1] local 10.1.1.2 port 33817 connected with 10.1.1.3 port 5001
[ ID] Interval Transfer Bandwidth
[ 1] 0.00-0.91 sec 1.00 MBytes 9.22 Mbits/sec
cc@s1:~ % sudo sysctl net.inet.siftr.enabled=0
net.inet.siftr.enabled: 1 -> 0
cc@s1:~ % ll /var/log/siftr.log
-rw-r--r-- 1 root wheel 91K Apr 25 09:38 /var/log/siftr.log
cc@s1:~ % cat /var/log/siftr.log
enable_time_secs=1682437111 enable_time_usecs=121115 siftrver=1.3.0 sysname=FreeBSD sysver=1400088 ipmode=4
o,0x00000000,1682437125.907343,10.1.1.2,33817,10.1.1.3,5001,1073725440,1073725440,2,0,0,0,0,2,536,0,1,672,1000000,32768,0,65536,0,0,0,0,0
i,0x00000000,1682437126.106759,10.1.1.2,33817,10.1.1.3,5001,1073725440,1073725440,2,0,0,0,0,2,536,0,1,672,1000000,32768,0,65536,0,1,0,0,0
o,0x00000000,1682437126.106767,10.1.1.2,33817,10.1.1.3,5001,1073725440,14480,2,65535,65700,9,9,4,1460,201000,1,16778209,803000,33580,0,65700,0,0,0,0,0
o,0x00000000,1682437126.107141,10.1.1.2,33817,10.1.1.3,5001,1073725440,14480,2,65535,65700,9,9,4,1460,201000,1,16778208,803000,33580,60,65700,0,0,0,0,0
...
i,0x00000000,1682437127.016754,10.1.1.2,33817,10.1.1.3,5001,1073725440,606109,1030,748544,66048,9,9,9,1460,100812,1,1008,303000,475948,0,65700,0,0,0,0,0
o,0x00000000,1682437127.016759,10.1.1.2,33817,10.1.1.3,5001,1073725440,606109,1030,748544,66048,9,9,10,1460,100812,1,1011,303000,475948,0,65700,0,0,0,0,0
disable_time_secs=1682437131 disable_time_usecs=767582 num_inbound_tcp_pkts=371 num_outbound_tcp_pkts=186 total_tcp_pkts=557 num_inbound_skipped_pkts_malloc=0 num_outbound_skipped_pkts_malloc=0 num_inbound_skipped_pkts_tcpcb=0 num_outbound_skipped_pkts_tcpcb=0 num_inbound_skipped_pkts_inpcb=0 num_outbound_skipped_pkts_inpcb=0 total_skipped_tcp_pkts=0 flow_list=10.1.1.2;33817-10.1.1.3;5001,
Reviewers: rscheff, tuexen
Approved by: rscheff, tuexen
Subscribers: imp, melifaro, glebius
Differential Revision: https://reviews.freebsd.org/D39803
2023-04-25 11:52:28 +00:00
|
|
|
/* Smoothed RTT (usecs). */
|
|
|
|
uint32_t srtt;
|
2010-07-03 13:32:39 +00:00
|
|
|
/* Is SACK enabled? */
|
|
|
|
u_char sack_enabled;
|
|
|
|
/* Window scaling for snd window. */
|
|
|
|
u_char snd_scale;
|
|
|
|
/* Window scaling for recv window. */
|
|
|
|
u_char rcv_scale;
|
|
|
|
/* TCP control block flags. */
|
|
|
|
u_int flags;
|
Change the unit of srtt and rto to usec, inspired by these in struct "tcp_info". Therefore, no need hz and tcp_rtt_scale in the headline of the log. Update the man page as well.
Summary: Simplify srtt and rto values in siftr log.
Test Plan:
Tested in Emulab testbed:
cc@s1:~ % sudo sysctl net.inet.siftr
net.inet.siftr.port_filter: 0
net.inet.siftr.genhashes: 0
net.inet.siftr.ppl: 1
net.inet.siftr.logfile: /var/log/siftr.log
net.inet.siftr.enabled: 0
cc@s1:~ % sudo sysctl net.inet.siftr.port_filter=5001
net.inet.siftr.port_filter: 0 -> 5001
cc@s1:~ % sudo sysctl net.inet.siftr.enabled=1
net.inet.siftr.enabled: 0 -> 1
cc@s1:~ %
cc@s1:~ % iperf -c r1 -n 1M
------------------------------------------------------------
Client connecting to r1, TCP port 5001
TCP window size: 32.0 KByte (default)
------------------------------------------------------------
[ 1] local 10.1.1.2 port 33817 connected with 10.1.1.3 port 5001
[ ID] Interval Transfer Bandwidth
[ 1] 0.00-0.91 sec 1.00 MBytes 9.22 Mbits/sec
cc@s1:~ % sudo sysctl net.inet.siftr.enabled=0
net.inet.siftr.enabled: 1 -> 0
cc@s1:~ % ll /var/log/siftr.log
-rw-r--r-- 1 root wheel 91K Apr 25 09:38 /var/log/siftr.log
cc@s1:~ % cat /var/log/siftr.log
enable_time_secs=1682437111 enable_time_usecs=121115 siftrver=1.3.0 sysname=FreeBSD sysver=1400088 ipmode=4
o,0x00000000,1682437125.907343,10.1.1.2,33817,10.1.1.3,5001,1073725440,1073725440,2,0,0,0,0,2,536,0,1,672,1000000,32768,0,65536,0,0,0,0,0
i,0x00000000,1682437126.106759,10.1.1.2,33817,10.1.1.3,5001,1073725440,1073725440,2,0,0,0,0,2,536,0,1,672,1000000,32768,0,65536,0,1,0,0,0
o,0x00000000,1682437126.106767,10.1.1.2,33817,10.1.1.3,5001,1073725440,14480,2,65535,65700,9,9,4,1460,201000,1,16778209,803000,33580,0,65700,0,0,0,0,0
o,0x00000000,1682437126.107141,10.1.1.2,33817,10.1.1.3,5001,1073725440,14480,2,65535,65700,9,9,4,1460,201000,1,16778208,803000,33580,60,65700,0,0,0,0,0
...
i,0x00000000,1682437127.016754,10.1.1.2,33817,10.1.1.3,5001,1073725440,606109,1030,748544,66048,9,9,9,1460,100812,1,1008,303000,475948,0,65700,0,0,0,0,0
o,0x00000000,1682437127.016759,10.1.1.2,33817,10.1.1.3,5001,1073725440,606109,1030,748544,66048,9,9,10,1460,100812,1,1011,303000,475948,0,65700,0,0,0,0,0
disable_time_secs=1682437131 disable_time_usecs=767582 num_inbound_tcp_pkts=371 num_outbound_tcp_pkts=186 total_tcp_pkts=557 num_inbound_skipped_pkts_malloc=0 num_outbound_skipped_pkts_malloc=0 num_inbound_skipped_pkts_tcpcb=0 num_outbound_skipped_pkts_tcpcb=0 num_inbound_skipped_pkts_inpcb=0 num_outbound_skipped_pkts_inpcb=0 total_skipped_tcp_pkts=0 flow_list=10.1.1.2;33817-10.1.1.3;5001,
Reviewers: rscheff, tuexen
Approved by: rscheff, tuexen
Subscribers: imp, melifaro, glebius
Differential Revision: https://reviews.freebsd.org/D39803
2023-04-25 11:52:28 +00:00
|
|
|
/* Retransmission timeout (usec). */
|
|
|
|
uint32_t rto;
|
2010-07-03 13:32:39 +00:00
|
|
|
/* Size of the TCP send buffer in bytes. */
|
|
|
|
u_int snd_buf_hiwater;
|
|
|
|
/* Current num bytes in the send socket buffer. */
|
|
|
|
u_int snd_buf_cc;
|
|
|
|
/* Size of the TCP receive buffer in bytes. */
|
|
|
|
u_int rcv_buf_hiwater;
|
|
|
|
/* Current num bytes in the receive socket buffer. */
|
|
|
|
u_int rcv_buf_cc;
|
|
|
|
/* Number of bytes inflight that we are waiting on ACKs for. */
|
|
|
|
u_int sent_inflight_bytes;
|
2010-09-25 09:16:46 +00:00
|
|
|
/* Number of segments currently in the reassembly queue. */
|
|
|
|
int t_segqlen;
|
2015-03-18 23:24:25 +00:00
|
|
|
/* Flowid for the connection. */
|
2020-02-12 13:31:36 +00:00
|
|
|
u_int flowid;
|
2015-03-19 00:23:16 +00:00
|
|
|
/* Flow type for the connection. */
|
2020-02-12 13:31:36 +00:00
|
|
|
u_int flowtype;
|
2010-07-03 13:32:39 +00:00
|
|
|
/* Link to next pkt_node in the list. */
|
|
|
|
STAILQ_ENTRY(pkt_node) nodes;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct flow_hash_node
|
|
|
|
{
|
|
|
|
uint16_t counter;
|
|
|
|
uint8_t key[FLOW_KEY_LEN];
|
|
|
|
LIST_ENTRY(flow_hash_node) nodes;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct siftr_stats
|
|
|
|
{
|
|
|
|
/* # TCP pkts seen by the SIFTR PFIL hooks, including any skipped. */
|
|
|
|
uint64_t n_in;
|
|
|
|
uint64_t n_out;
|
|
|
|
/* # pkts skipped due to failed malloc calls. */
|
|
|
|
uint32_t nskip_in_malloc;
|
|
|
|
uint32_t nskip_out_malloc;
|
|
|
|
/* # pkts skipped due to failed inpcb lookups. */
|
|
|
|
uint32_t nskip_in_inpcb;
|
|
|
|
uint32_t nskip_out_inpcb;
|
|
|
|
/* # pkts skipped due to failed tcpcb lookups. */
|
|
|
|
uint32_t nskip_in_tcpcb;
|
|
|
|
uint32_t nskip_out_tcpcb;
|
|
|
|
/* # pkts skipped due to stack reinjection. */
|
|
|
|
uint32_t nskip_in_dejavu;
|
|
|
|
uint32_t nskip_out_dejavu;
|
|
|
|
};
|
|
|
|
|
2018-07-05 17:13:37 +00:00
|
|
|
DPCPU_DEFINE_STATIC(struct siftr_stats, ss);
|
2010-07-03 13:32:39 +00:00
|
|
|
|
|
|
|
static volatile unsigned int siftr_exit_pkt_manager_thread = 0;
|
|
|
|
static unsigned int siftr_enabled = 0;
|
|
|
|
static unsigned int siftr_pkts_per_log = 1;
|
2019-01-30 17:44:30 +00:00
|
|
|
static uint16_t siftr_port_filter = 0;
|
2010-07-03 13:32:39 +00:00
|
|
|
/* static unsigned int siftr_binary_log = 0; */
|
|
|
|
static char siftr_logfile[PATH_MAX] = "/var/log/siftr.log";
|
2014-10-28 12:00:39 +00:00
|
|
|
static char siftr_logfile_shadow[PATH_MAX] = "/var/log/siftr.log";
|
2010-07-03 13:32:39 +00:00
|
|
|
static u_long siftr_hashmask;
|
|
|
|
STAILQ_HEAD(pkthead, pkt_node) pkt_queue = STAILQ_HEAD_INITIALIZER(pkt_queue);
|
|
|
|
LIST_HEAD(listhead, flow_hash_node) *counter_hash;
|
|
|
|
static int wait_for_pkt;
|
|
|
|
static struct alq *siftr_alq = NULL;
|
|
|
|
static struct mtx siftr_pkt_queue_mtx;
|
|
|
|
static struct mtx siftr_pkt_mgr_mtx;
|
|
|
|
static struct thread *siftr_pkt_manager_thr = NULL;
|
2019-02-01 08:10:26 +00:00
|
|
|
static char direction[2] = {'i','o'};
|
2010-07-03 13:32:39 +00:00
|
|
|
|
|
|
|
/* Required function prototypes. */
|
|
|
|
static int siftr_sysctl_enabled_handler(SYSCTL_HANDLER_ARGS);
|
|
|
|
static int siftr_sysctl_logfile_name_handler(SYSCTL_HANDLER_ARGS);
|
|
|
|
|
|
|
|
/* Declare the net.inet.siftr sysctl tree and populate it. */
|
|
|
|
|
|
|
|
SYSCTL_DECL(_net_inet_siftr);
|
|
|
|
|
2020-02-26 14:26:36 +00:00
|
|
|
SYSCTL_NODE(_net_inet, OID_AUTO, siftr, CTLFLAG_RW | CTLFLAG_MPSAFE, NULL,
|
2010-07-03 13:32:39 +00:00
|
|
|
"siftr related settings");
|
|
|
|
|
2020-02-26 14:26:36 +00:00
|
|
|
SYSCTL_PROC(_net_inet_siftr, OID_AUTO, enabled,
|
|
|
|
CTLTYPE_UINT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
|
2010-07-03 13:32:39 +00:00
|
|
|
&siftr_enabled, 0, &siftr_sysctl_enabled_handler, "IU",
|
|
|
|
"switch siftr module operations on/off");
|
|
|
|
|
2020-02-26 14:26:36 +00:00
|
|
|
SYSCTL_PROC(_net_inet_siftr, OID_AUTO, logfile,
|
|
|
|
CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_NEEDGIANT, &siftr_logfile_shadow,
|
|
|
|
sizeof(siftr_logfile_shadow), &siftr_sysctl_logfile_name_handler, "A",
|
|
|
|
"file to save siftr log messages to");
|
2010-07-03 13:32:39 +00:00
|
|
|
|
|
|
|
SYSCTL_UINT(_net_inet_siftr, OID_AUTO, ppl, CTLFLAG_RW,
|
|
|
|
&siftr_pkts_per_log, 1,
|
|
|
|
"number of packets between generating a log message");
|
|
|
|
|
2019-01-30 17:44:30 +00:00
|
|
|
SYSCTL_U16(_net_inet_siftr, OID_AUTO, port_filter, CTLFLAG_RW,
|
|
|
|
&siftr_port_filter, 0,
|
|
|
|
"enable packet filter on a TCP port");
|
|
|
|
|
2010-07-03 13:32:39 +00:00
|
|
|
/* XXX: TODO
|
|
|
|
SYSCTL_UINT(_net_inet_siftr, OID_AUTO, binary, CTLFLAG_RW,
|
|
|
|
&siftr_binary_log, 0,
|
|
|
|
"write log files in binary instead of ascii");
|
|
|
|
*/
|
|
|
|
|
|
|
|
/* Begin functions. */
|
|
|
|
|
|
|
|
static void
|
|
|
|
siftr_process_pkt(struct pkt_node * pkt_node)
|
|
|
|
{
|
|
|
|
struct flow_hash_node *hash_node;
|
|
|
|
struct listhead *counter_list;
|
|
|
|
struct siftr_stats *ss;
|
|
|
|
struct ale *log_buf;
|
|
|
|
uint8_t key[FLOW_KEY_LEN];
|
|
|
|
uint8_t found_match, key_offset;
|
|
|
|
|
|
|
|
hash_node = NULL;
|
|
|
|
ss = DPCPU_PTR(ss);
|
|
|
|
found_match = 0;
|
|
|
|
key_offset = 1;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Create the key that will be used to create a hash index
|
|
|
|
* into our hash table. Our key consists of:
|
|
|
|
* ipversion, localip, localport, foreignip, foreignport
|
|
|
|
*/
|
|
|
|
key[0] = pkt_node->ipver;
|
|
|
|
memcpy(key + key_offset, &pkt_node->ip_laddr,
|
|
|
|
sizeof(pkt_node->ip_laddr));
|
|
|
|
key_offset += sizeof(pkt_node->ip_laddr);
|
|
|
|
memcpy(key + key_offset, &pkt_node->tcp_localport,
|
|
|
|
sizeof(pkt_node->tcp_localport));
|
|
|
|
key_offset += sizeof(pkt_node->tcp_localport);
|
|
|
|
memcpy(key + key_offset, &pkt_node->ip_faddr,
|
|
|
|
sizeof(pkt_node->ip_faddr));
|
|
|
|
key_offset += sizeof(pkt_node->ip_faddr);
|
|
|
|
memcpy(key + key_offset, &pkt_node->tcp_foreignport,
|
|
|
|
sizeof(pkt_node->tcp_foreignport));
|
|
|
|
|
|
|
|
counter_list = counter_hash +
|
|
|
|
(hash32_buf(key, sizeof(key), 0) & siftr_hashmask);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* If the list is not empty i.e. the hash index has
|
|
|
|
* been used by another flow previously.
|
|
|
|
*/
|
|
|
|
if (LIST_FIRST(counter_list) != NULL) {
|
|
|
|
/*
|
|
|
|
* Loop through the hash nodes in the list.
|
|
|
|
* There should normally only be 1 hash node in the list,
|
|
|
|
* except if there have been collisions at the hash index
|
|
|
|
* computed by hash32_buf().
|
|
|
|
*/
|
|
|
|
LIST_FOREACH(hash_node, counter_list, nodes) {
|
|
|
|
/*
|
|
|
|
* Check if the key for the pkt we are currently
|
|
|
|
* processing is the same as the key stored in the
|
|
|
|
* hash node we are currently processing.
|
|
|
|
* If they are the same, then we've found the
|
|
|
|
* hash node that stores the counter for the flow
|
|
|
|
* the pkt belongs to.
|
|
|
|
*/
|
|
|
|
if (memcmp(hash_node->key, key, sizeof(key)) == 0) {
|
|
|
|
found_match = 1;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* If this flow hash hasn't been seen before or we have a collision. */
|
|
|
|
if (hash_node == NULL || !found_match) {
|
|
|
|
/* Create a new hash node to store the flow's counter. */
|
|
|
|
hash_node = malloc(sizeof(struct flow_hash_node),
|
|
|
|
M_SIFTR_HASHNODE, M_WAITOK);
|
|
|
|
|
|
|
|
if (hash_node != NULL) {
|
|
|
|
/* Initialise our new hash node list entry. */
|
|
|
|
hash_node->counter = 0;
|
|
|
|
memcpy(hash_node->key, key, sizeof(key));
|
|
|
|
LIST_INSERT_HEAD(counter_list, hash_node, nodes);
|
|
|
|
} else {
|
|
|
|
/* Malloc failed. */
|
2019-02-01 08:10:26 +00:00
|
|
|
if (pkt_node->direction == DIR_IN)
|
2010-07-03 13:32:39 +00:00
|
|
|
ss->nskip_in_malloc++;
|
|
|
|
else
|
|
|
|
ss->nskip_out_malloc++;
|
|
|
|
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
} else if (siftr_pkts_per_log > 1) {
|
|
|
|
/*
|
|
|
|
* Taking the remainder of the counter divided
|
|
|
|
* by the current value of siftr_pkts_per_log
|
|
|
|
* and storing that in counter provides a neat
|
|
|
|
* way to modulate the frequency of log
|
|
|
|
* messages being written to the log file.
|
|
|
|
*/
|
|
|
|
hash_node->counter = (hash_node->counter + 1) %
|
|
|
|
siftr_pkts_per_log;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* If we have not seen enough packets since the last time
|
|
|
|
* we wrote a log message for this connection, return.
|
|
|
|
*/
|
|
|
|
if (hash_node->counter > 0)
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
log_buf = alq_getn(siftr_alq, MAX_LOG_MSG_LEN, ALQ_WAITOK);
|
|
|
|
|
|
|
|
if (log_buf == NULL)
|
|
|
|
return; /* Should only happen if the ALQ is shutting down. */
|
|
|
|
|
|
|
|
#ifdef SIFTR_IPV6
|
|
|
|
pkt_node->ip_laddr[3] = ntohl(pkt_node->ip_laddr[3]);
|
|
|
|
pkt_node->ip_faddr[3] = ntohl(pkt_node->ip_faddr[3]);
|
|
|
|
|
|
|
|
if (pkt_node->ipver == INP_IPV6) { /* IPv6 packet */
|
|
|
|
pkt_node->ip_laddr[0] = ntohl(pkt_node->ip_laddr[0]);
|
|
|
|
pkt_node->ip_laddr[1] = ntohl(pkt_node->ip_laddr[1]);
|
|
|
|
pkt_node->ip_laddr[2] = ntohl(pkt_node->ip_laddr[2]);
|
|
|
|
pkt_node->ip_faddr[0] = ntohl(pkt_node->ip_faddr[0]);
|
|
|
|
pkt_node->ip_faddr[1] = ntohl(pkt_node->ip_faddr[1]);
|
|
|
|
pkt_node->ip_faddr[2] = ntohl(pkt_node->ip_faddr[2]);
|
|
|
|
|
|
|
|
/* Construct an IPv6 log message. */
|
|
|
|
log_buf->ae_bytesused = snprintf(log_buf->ae_data,
|
|
|
|
MAX_LOG_MSG_LEN,
|
2023-04-26 11:18:01 +00:00
|
|
|
"%c,%zd.%06ld,%x:%x:%x:%x:%x:%x:%x:%x,%u,%x:%x:%x:"
|
2022-04-07 09:12:33 +00:00
|
|
|
"%x:%x:%x:%x:%x,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,"
|
Change the unit of srtt and rto to usec, inspired by these in struct "tcp_info". Therefore, no need hz and tcp_rtt_scale in the headline of the log. Update the man page as well.
Summary: Simplify srtt and rto values in siftr log.
Test Plan:
Tested in Emulab testbed:
cc@s1:~ % sudo sysctl net.inet.siftr
net.inet.siftr.port_filter: 0
net.inet.siftr.genhashes: 0
net.inet.siftr.ppl: 1
net.inet.siftr.logfile: /var/log/siftr.log
net.inet.siftr.enabled: 0
cc@s1:~ % sudo sysctl net.inet.siftr.port_filter=5001
net.inet.siftr.port_filter: 0 -> 5001
cc@s1:~ % sudo sysctl net.inet.siftr.enabled=1
net.inet.siftr.enabled: 0 -> 1
cc@s1:~ %
cc@s1:~ % iperf -c r1 -n 1M
------------------------------------------------------------
Client connecting to r1, TCP port 5001
TCP window size: 32.0 KByte (default)
------------------------------------------------------------
[ 1] local 10.1.1.2 port 33817 connected with 10.1.1.3 port 5001
[ ID] Interval Transfer Bandwidth
[ 1] 0.00-0.91 sec 1.00 MBytes 9.22 Mbits/sec
cc@s1:~ % sudo sysctl net.inet.siftr.enabled=0
net.inet.siftr.enabled: 1 -> 0
cc@s1:~ % ll /var/log/siftr.log
-rw-r--r-- 1 root wheel 91K Apr 25 09:38 /var/log/siftr.log
cc@s1:~ % cat /var/log/siftr.log
enable_time_secs=1682437111 enable_time_usecs=121115 siftrver=1.3.0 sysname=FreeBSD sysver=1400088 ipmode=4
o,0x00000000,1682437125.907343,10.1.1.2,33817,10.1.1.3,5001,1073725440,1073725440,2,0,0,0,0,2,536,0,1,672,1000000,32768,0,65536,0,0,0,0,0
i,0x00000000,1682437126.106759,10.1.1.2,33817,10.1.1.3,5001,1073725440,1073725440,2,0,0,0,0,2,536,0,1,672,1000000,32768,0,65536,0,1,0,0,0
o,0x00000000,1682437126.106767,10.1.1.2,33817,10.1.1.3,5001,1073725440,14480,2,65535,65700,9,9,4,1460,201000,1,16778209,803000,33580,0,65700,0,0,0,0,0
o,0x00000000,1682437126.107141,10.1.1.2,33817,10.1.1.3,5001,1073725440,14480,2,65535,65700,9,9,4,1460,201000,1,16778208,803000,33580,60,65700,0,0,0,0,0
...
i,0x00000000,1682437127.016754,10.1.1.2,33817,10.1.1.3,5001,1073725440,606109,1030,748544,66048,9,9,9,1460,100812,1,1008,303000,475948,0,65700,0,0,0,0,0
o,0x00000000,1682437127.016759,10.1.1.2,33817,10.1.1.3,5001,1073725440,606109,1030,748544,66048,9,9,10,1460,100812,1,1011,303000,475948,0,65700,0,0,0,0,0
disable_time_secs=1682437131 disable_time_usecs=767582 num_inbound_tcp_pkts=371 num_outbound_tcp_pkts=186 total_tcp_pkts=557 num_inbound_skipped_pkts_malloc=0 num_outbound_skipped_pkts_malloc=0 num_inbound_skipped_pkts_tcpcb=0 num_outbound_skipped_pkts_tcpcb=0 num_inbound_skipped_pkts_inpcb=0 num_outbound_skipped_pkts_inpcb=0 total_skipped_tcp_pkts=0 flow_list=10.1.1.2;33817-10.1.1.3;5001,
Reviewers: rscheff, tuexen
Approved by: rscheff, tuexen
Subscribers: imp, melifaro, glebius
Differential Revision: https://reviews.freebsd.org/D39803
2023-04-25 11:52:28 +00:00
|
|
|
"%u,%u,%u,%u,%u,%u,%u,%u,%u,%u\n",
|
2010-07-03 13:32:39 +00:00
|
|
|
direction[pkt_node->direction],
|
|
|
|
pkt_node->tval.tv_sec,
|
|
|
|
pkt_node->tval.tv_usec,
|
|
|
|
UPPER_SHORT(pkt_node->ip_laddr[0]),
|
|
|
|
LOWER_SHORT(pkt_node->ip_laddr[0]),
|
|
|
|
UPPER_SHORT(pkt_node->ip_laddr[1]),
|
|
|
|
LOWER_SHORT(pkt_node->ip_laddr[1]),
|
|
|
|
UPPER_SHORT(pkt_node->ip_laddr[2]),
|
|
|
|
LOWER_SHORT(pkt_node->ip_laddr[2]),
|
|
|
|
UPPER_SHORT(pkt_node->ip_laddr[3]),
|
|
|
|
LOWER_SHORT(pkt_node->ip_laddr[3]),
|
|
|
|
ntohs(pkt_node->tcp_localport),
|
|
|
|
UPPER_SHORT(pkt_node->ip_faddr[0]),
|
|
|
|
LOWER_SHORT(pkt_node->ip_faddr[0]),
|
|
|
|
UPPER_SHORT(pkt_node->ip_faddr[1]),
|
|
|
|
LOWER_SHORT(pkt_node->ip_faddr[1]),
|
|
|
|
UPPER_SHORT(pkt_node->ip_faddr[2]),
|
|
|
|
LOWER_SHORT(pkt_node->ip_faddr[2]),
|
|
|
|
UPPER_SHORT(pkt_node->ip_faddr[3]),
|
|
|
|
LOWER_SHORT(pkt_node->ip_faddr[3]),
|
|
|
|
ntohs(pkt_node->tcp_foreignport),
|
|
|
|
pkt_node->snd_ssthresh,
|
|
|
|
pkt_node->snd_cwnd,
|
2022-04-07 09:12:33 +00:00
|
|
|
pkt_node->t_flags2,
|
2010-07-03 13:32:39 +00:00
|
|
|
pkt_node->snd_wnd,
|
|
|
|
pkt_node->rcv_wnd,
|
|
|
|
pkt_node->snd_scale,
|
|
|
|
pkt_node->rcv_scale,
|
|
|
|
pkt_node->conn_state,
|
|
|
|
pkt_node->max_seg_size,
|
Change the unit of srtt and rto to usec, inspired by these in struct "tcp_info". Therefore, no need hz and tcp_rtt_scale in the headline of the log. Update the man page as well.
Summary: Simplify srtt and rto values in siftr log.
Test Plan:
Tested in Emulab testbed:
cc@s1:~ % sudo sysctl net.inet.siftr
net.inet.siftr.port_filter: 0
net.inet.siftr.genhashes: 0
net.inet.siftr.ppl: 1
net.inet.siftr.logfile: /var/log/siftr.log
net.inet.siftr.enabled: 0
cc@s1:~ % sudo sysctl net.inet.siftr.port_filter=5001
net.inet.siftr.port_filter: 0 -> 5001
cc@s1:~ % sudo sysctl net.inet.siftr.enabled=1
net.inet.siftr.enabled: 0 -> 1
cc@s1:~ %
cc@s1:~ % iperf -c r1 -n 1M
------------------------------------------------------------
Client connecting to r1, TCP port 5001
TCP window size: 32.0 KByte (default)
------------------------------------------------------------
[ 1] local 10.1.1.2 port 33817 connected with 10.1.1.3 port 5001
[ ID] Interval Transfer Bandwidth
[ 1] 0.00-0.91 sec 1.00 MBytes 9.22 Mbits/sec
cc@s1:~ % sudo sysctl net.inet.siftr.enabled=0
net.inet.siftr.enabled: 1 -> 0
cc@s1:~ % ll /var/log/siftr.log
-rw-r--r-- 1 root wheel 91K Apr 25 09:38 /var/log/siftr.log
cc@s1:~ % cat /var/log/siftr.log
enable_time_secs=1682437111 enable_time_usecs=121115 siftrver=1.3.0 sysname=FreeBSD sysver=1400088 ipmode=4
o,0x00000000,1682437125.907343,10.1.1.2,33817,10.1.1.3,5001,1073725440,1073725440,2,0,0,0,0,2,536,0,1,672,1000000,32768,0,65536,0,0,0,0,0
i,0x00000000,1682437126.106759,10.1.1.2,33817,10.1.1.3,5001,1073725440,1073725440,2,0,0,0,0,2,536,0,1,672,1000000,32768,0,65536,0,1,0,0,0
o,0x00000000,1682437126.106767,10.1.1.2,33817,10.1.1.3,5001,1073725440,14480,2,65535,65700,9,9,4,1460,201000,1,16778209,803000,33580,0,65700,0,0,0,0,0
o,0x00000000,1682437126.107141,10.1.1.2,33817,10.1.1.3,5001,1073725440,14480,2,65535,65700,9,9,4,1460,201000,1,16778208,803000,33580,60,65700,0,0,0,0,0
...
i,0x00000000,1682437127.016754,10.1.1.2,33817,10.1.1.3,5001,1073725440,606109,1030,748544,66048,9,9,9,1460,100812,1,1008,303000,475948,0,65700,0,0,0,0,0
o,0x00000000,1682437127.016759,10.1.1.2,33817,10.1.1.3,5001,1073725440,606109,1030,748544,66048,9,9,10,1460,100812,1,1011,303000,475948,0,65700,0,0,0,0,0
disable_time_secs=1682437131 disable_time_usecs=767582 num_inbound_tcp_pkts=371 num_outbound_tcp_pkts=186 total_tcp_pkts=557 num_inbound_skipped_pkts_malloc=0 num_outbound_skipped_pkts_malloc=0 num_inbound_skipped_pkts_tcpcb=0 num_outbound_skipped_pkts_tcpcb=0 num_inbound_skipped_pkts_inpcb=0 num_outbound_skipped_pkts_inpcb=0 total_skipped_tcp_pkts=0 flow_list=10.1.1.2;33817-10.1.1.3;5001,
Reviewers: rscheff, tuexen
Approved by: rscheff, tuexen
Subscribers: imp, melifaro, glebius
Differential Revision: https://reviews.freebsd.org/D39803
2023-04-25 11:52:28 +00:00
|
|
|
pkt_node->srtt,
|
2010-07-03 13:32:39 +00:00
|
|
|
pkt_node->sack_enabled,
|
|
|
|
pkt_node->flags,
|
Change the unit of srtt and rto to usec, inspired by these in struct "tcp_info". Therefore, no need hz and tcp_rtt_scale in the headline of the log. Update the man page as well.
Summary: Simplify srtt and rto values in siftr log.
Test Plan:
Tested in Emulab testbed:
cc@s1:~ % sudo sysctl net.inet.siftr
net.inet.siftr.port_filter: 0
net.inet.siftr.genhashes: 0
net.inet.siftr.ppl: 1
net.inet.siftr.logfile: /var/log/siftr.log
net.inet.siftr.enabled: 0
cc@s1:~ % sudo sysctl net.inet.siftr.port_filter=5001
net.inet.siftr.port_filter: 0 -> 5001
cc@s1:~ % sudo sysctl net.inet.siftr.enabled=1
net.inet.siftr.enabled: 0 -> 1
cc@s1:~ %
cc@s1:~ % iperf -c r1 -n 1M
------------------------------------------------------------
Client connecting to r1, TCP port 5001
TCP window size: 32.0 KByte (default)
------------------------------------------------------------
[ 1] local 10.1.1.2 port 33817 connected with 10.1.1.3 port 5001
[ ID] Interval Transfer Bandwidth
[ 1] 0.00-0.91 sec 1.00 MBytes 9.22 Mbits/sec
cc@s1:~ % sudo sysctl net.inet.siftr.enabled=0
net.inet.siftr.enabled: 1 -> 0
cc@s1:~ % ll /var/log/siftr.log
-rw-r--r-- 1 root wheel 91K Apr 25 09:38 /var/log/siftr.log
cc@s1:~ % cat /var/log/siftr.log
enable_time_secs=1682437111 enable_time_usecs=121115 siftrver=1.3.0 sysname=FreeBSD sysver=1400088 ipmode=4
o,0x00000000,1682437125.907343,10.1.1.2,33817,10.1.1.3,5001,1073725440,1073725440,2,0,0,0,0,2,536,0,1,672,1000000,32768,0,65536,0,0,0,0,0
i,0x00000000,1682437126.106759,10.1.1.2,33817,10.1.1.3,5001,1073725440,1073725440,2,0,0,0,0,2,536,0,1,672,1000000,32768,0,65536,0,1,0,0,0
o,0x00000000,1682437126.106767,10.1.1.2,33817,10.1.1.3,5001,1073725440,14480,2,65535,65700,9,9,4,1460,201000,1,16778209,803000,33580,0,65700,0,0,0,0,0
o,0x00000000,1682437126.107141,10.1.1.2,33817,10.1.1.3,5001,1073725440,14480,2,65535,65700,9,9,4,1460,201000,1,16778208,803000,33580,60,65700,0,0,0,0,0
...
i,0x00000000,1682437127.016754,10.1.1.2,33817,10.1.1.3,5001,1073725440,606109,1030,748544,66048,9,9,9,1460,100812,1,1008,303000,475948,0,65700,0,0,0,0,0
o,0x00000000,1682437127.016759,10.1.1.2,33817,10.1.1.3,5001,1073725440,606109,1030,748544,66048,9,9,10,1460,100812,1,1011,303000,475948,0,65700,0,0,0,0,0
disable_time_secs=1682437131 disable_time_usecs=767582 num_inbound_tcp_pkts=371 num_outbound_tcp_pkts=186 total_tcp_pkts=557 num_inbound_skipped_pkts_malloc=0 num_outbound_skipped_pkts_malloc=0 num_inbound_skipped_pkts_tcpcb=0 num_outbound_skipped_pkts_tcpcb=0 num_inbound_skipped_pkts_inpcb=0 num_outbound_skipped_pkts_inpcb=0 total_skipped_tcp_pkts=0 flow_list=10.1.1.2;33817-10.1.1.3;5001,
Reviewers: rscheff, tuexen
Approved by: rscheff, tuexen
Subscribers: imp, melifaro, glebius
Differential Revision: https://reviews.freebsd.org/D39803
2023-04-25 11:52:28 +00:00
|
|
|
pkt_node->rto,
|
2010-07-03 13:32:39 +00:00
|
|
|
pkt_node->snd_buf_hiwater,
|
|
|
|
pkt_node->snd_buf_cc,
|
|
|
|
pkt_node->rcv_buf_hiwater,
|
|
|
|
pkt_node->rcv_buf_cc,
|
2010-09-25 09:16:46 +00:00
|
|
|
pkt_node->sent_inflight_bytes,
|
2015-03-18 23:24:25 +00:00
|
|
|
pkt_node->t_segqlen,
|
2015-03-19 00:23:16 +00:00
|
|
|
pkt_node->flowid,
|
|
|
|
pkt_node->flowtype);
|
2010-07-03 13:32:39 +00:00
|
|
|
} else { /* IPv4 packet */
|
|
|
|
pkt_node->ip_laddr[0] = FIRST_OCTET(pkt_node->ip_laddr[3]);
|
|
|
|
pkt_node->ip_laddr[1] = SECOND_OCTET(pkt_node->ip_laddr[3]);
|
|
|
|
pkt_node->ip_laddr[2] = THIRD_OCTET(pkt_node->ip_laddr[3]);
|
|
|
|
pkt_node->ip_laddr[3] = FOURTH_OCTET(pkt_node->ip_laddr[3]);
|
|
|
|
pkt_node->ip_faddr[0] = FIRST_OCTET(pkt_node->ip_faddr[3]);
|
|
|
|
pkt_node->ip_faddr[1] = SECOND_OCTET(pkt_node->ip_faddr[3]);
|
|
|
|
pkt_node->ip_faddr[2] = THIRD_OCTET(pkt_node->ip_faddr[3]);
|
|
|
|
pkt_node->ip_faddr[3] = FOURTH_OCTET(pkt_node->ip_faddr[3]);
|
|
|
|
#endif /* SIFTR_IPV6 */
|
|
|
|
|
|
|
|
/* Construct an IPv4 log message. */
|
|
|
|
log_buf->ae_bytesused = snprintf(log_buf->ae_data,
|
|
|
|
MAX_LOG_MSG_LEN,
|
2023-04-26 11:18:01 +00:00
|
|
|
"%c,%jd.%06ld,%u.%u.%u.%u,%u,%u.%u.%u.%u,%u,%u,%u,"
|
Change the unit of srtt and rto to usec, inspired by these in struct "tcp_info". Therefore, no need hz and tcp_rtt_scale in the headline of the log. Update the man page as well.
Summary: Simplify srtt and rto values in siftr log.
Test Plan:
Tested in Emulab testbed:
cc@s1:~ % sudo sysctl net.inet.siftr
net.inet.siftr.port_filter: 0
net.inet.siftr.genhashes: 0
net.inet.siftr.ppl: 1
net.inet.siftr.logfile: /var/log/siftr.log
net.inet.siftr.enabled: 0
cc@s1:~ % sudo sysctl net.inet.siftr.port_filter=5001
net.inet.siftr.port_filter: 0 -> 5001
cc@s1:~ % sudo sysctl net.inet.siftr.enabled=1
net.inet.siftr.enabled: 0 -> 1
cc@s1:~ %
cc@s1:~ % iperf -c r1 -n 1M
------------------------------------------------------------
Client connecting to r1, TCP port 5001
TCP window size: 32.0 KByte (default)
------------------------------------------------------------
[ 1] local 10.1.1.2 port 33817 connected with 10.1.1.3 port 5001
[ ID] Interval Transfer Bandwidth
[ 1] 0.00-0.91 sec 1.00 MBytes 9.22 Mbits/sec
cc@s1:~ % sudo sysctl net.inet.siftr.enabled=0
net.inet.siftr.enabled: 1 -> 0
cc@s1:~ % ll /var/log/siftr.log
-rw-r--r-- 1 root wheel 91K Apr 25 09:38 /var/log/siftr.log
cc@s1:~ % cat /var/log/siftr.log
enable_time_secs=1682437111 enable_time_usecs=121115 siftrver=1.3.0 sysname=FreeBSD sysver=1400088 ipmode=4
o,0x00000000,1682437125.907343,10.1.1.2,33817,10.1.1.3,5001,1073725440,1073725440,2,0,0,0,0,2,536,0,1,672,1000000,32768,0,65536,0,0,0,0,0
i,0x00000000,1682437126.106759,10.1.1.2,33817,10.1.1.3,5001,1073725440,1073725440,2,0,0,0,0,2,536,0,1,672,1000000,32768,0,65536,0,1,0,0,0
o,0x00000000,1682437126.106767,10.1.1.2,33817,10.1.1.3,5001,1073725440,14480,2,65535,65700,9,9,4,1460,201000,1,16778209,803000,33580,0,65700,0,0,0,0,0
o,0x00000000,1682437126.107141,10.1.1.2,33817,10.1.1.3,5001,1073725440,14480,2,65535,65700,9,9,4,1460,201000,1,16778208,803000,33580,60,65700,0,0,0,0,0
...
i,0x00000000,1682437127.016754,10.1.1.2,33817,10.1.1.3,5001,1073725440,606109,1030,748544,66048,9,9,9,1460,100812,1,1008,303000,475948,0,65700,0,0,0,0,0
o,0x00000000,1682437127.016759,10.1.1.2,33817,10.1.1.3,5001,1073725440,606109,1030,748544,66048,9,9,10,1460,100812,1,1011,303000,475948,0,65700,0,0,0,0,0
disable_time_secs=1682437131 disable_time_usecs=767582 num_inbound_tcp_pkts=371 num_outbound_tcp_pkts=186 total_tcp_pkts=557 num_inbound_skipped_pkts_malloc=0 num_outbound_skipped_pkts_malloc=0 num_inbound_skipped_pkts_tcpcb=0 num_outbound_skipped_pkts_tcpcb=0 num_inbound_skipped_pkts_inpcb=0 num_outbound_skipped_pkts_inpcb=0 total_skipped_tcp_pkts=0 flow_list=10.1.1.2;33817-10.1.1.3;5001,
Reviewers: rscheff, tuexen
Approved by: rscheff, tuexen
Subscribers: imp, melifaro, glebius
Differential Revision: https://reviews.freebsd.org/D39803
2023-04-25 11:52:28 +00:00
|
|
|
"%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u\n",
|
2010-07-03 13:32:39 +00:00
|
|
|
direction[pkt_node->direction],
|
|
|
|
(intmax_t)pkt_node->tval.tv_sec,
|
|
|
|
pkt_node->tval.tv_usec,
|
|
|
|
pkt_node->ip_laddr[0],
|
|
|
|
pkt_node->ip_laddr[1],
|
|
|
|
pkt_node->ip_laddr[2],
|
|
|
|
pkt_node->ip_laddr[3],
|
|
|
|
ntohs(pkt_node->tcp_localport),
|
|
|
|
pkt_node->ip_faddr[0],
|
|
|
|
pkt_node->ip_faddr[1],
|
|
|
|
pkt_node->ip_faddr[2],
|
|
|
|
pkt_node->ip_faddr[3],
|
|
|
|
ntohs(pkt_node->tcp_foreignport),
|
|
|
|
pkt_node->snd_ssthresh,
|
|
|
|
pkt_node->snd_cwnd,
|
2022-04-07 09:12:33 +00:00
|
|
|
pkt_node->t_flags2,
|
2010-07-03 13:32:39 +00:00
|
|
|
pkt_node->snd_wnd,
|
|
|
|
pkt_node->rcv_wnd,
|
|
|
|
pkt_node->snd_scale,
|
|
|
|
pkt_node->rcv_scale,
|
|
|
|
pkt_node->conn_state,
|
|
|
|
pkt_node->max_seg_size,
|
Change the unit of srtt and rto to usec, inspired by these in struct "tcp_info". Therefore, no need hz and tcp_rtt_scale in the headline of the log. Update the man page as well.
Summary: Simplify srtt and rto values in siftr log.
Test Plan:
Tested in Emulab testbed:
cc@s1:~ % sudo sysctl net.inet.siftr
net.inet.siftr.port_filter: 0
net.inet.siftr.genhashes: 0
net.inet.siftr.ppl: 1
net.inet.siftr.logfile: /var/log/siftr.log
net.inet.siftr.enabled: 0
cc@s1:~ % sudo sysctl net.inet.siftr.port_filter=5001
net.inet.siftr.port_filter: 0 -> 5001
cc@s1:~ % sudo sysctl net.inet.siftr.enabled=1
net.inet.siftr.enabled: 0 -> 1
cc@s1:~ %
cc@s1:~ % iperf -c r1 -n 1M
------------------------------------------------------------
Client connecting to r1, TCP port 5001
TCP window size: 32.0 KByte (default)
------------------------------------------------------------
[ 1] local 10.1.1.2 port 33817 connected with 10.1.1.3 port 5001
[ ID] Interval Transfer Bandwidth
[ 1] 0.00-0.91 sec 1.00 MBytes 9.22 Mbits/sec
cc@s1:~ % sudo sysctl net.inet.siftr.enabled=0
net.inet.siftr.enabled: 1 -> 0
cc@s1:~ % ll /var/log/siftr.log
-rw-r--r-- 1 root wheel 91K Apr 25 09:38 /var/log/siftr.log
cc@s1:~ % cat /var/log/siftr.log
enable_time_secs=1682437111 enable_time_usecs=121115 siftrver=1.3.0 sysname=FreeBSD sysver=1400088 ipmode=4
o,0x00000000,1682437125.907343,10.1.1.2,33817,10.1.1.3,5001,1073725440,1073725440,2,0,0,0,0,2,536,0,1,672,1000000,32768,0,65536,0,0,0,0,0
i,0x00000000,1682437126.106759,10.1.1.2,33817,10.1.1.3,5001,1073725440,1073725440,2,0,0,0,0,2,536,0,1,672,1000000,32768,0,65536,0,1,0,0,0
o,0x00000000,1682437126.106767,10.1.1.2,33817,10.1.1.3,5001,1073725440,14480,2,65535,65700,9,9,4,1460,201000,1,16778209,803000,33580,0,65700,0,0,0,0,0
o,0x00000000,1682437126.107141,10.1.1.2,33817,10.1.1.3,5001,1073725440,14480,2,65535,65700,9,9,4,1460,201000,1,16778208,803000,33580,60,65700,0,0,0,0,0
...
i,0x00000000,1682437127.016754,10.1.1.2,33817,10.1.1.3,5001,1073725440,606109,1030,748544,66048,9,9,9,1460,100812,1,1008,303000,475948,0,65700,0,0,0,0,0
o,0x00000000,1682437127.016759,10.1.1.2,33817,10.1.1.3,5001,1073725440,606109,1030,748544,66048,9,9,10,1460,100812,1,1011,303000,475948,0,65700,0,0,0,0,0
disable_time_secs=1682437131 disable_time_usecs=767582 num_inbound_tcp_pkts=371 num_outbound_tcp_pkts=186 total_tcp_pkts=557 num_inbound_skipped_pkts_malloc=0 num_outbound_skipped_pkts_malloc=0 num_inbound_skipped_pkts_tcpcb=0 num_outbound_skipped_pkts_tcpcb=0 num_inbound_skipped_pkts_inpcb=0 num_outbound_skipped_pkts_inpcb=0 total_skipped_tcp_pkts=0 flow_list=10.1.1.2;33817-10.1.1.3;5001,
Reviewers: rscheff, tuexen
Approved by: rscheff, tuexen
Subscribers: imp, melifaro, glebius
Differential Revision: https://reviews.freebsd.org/D39803
2023-04-25 11:52:28 +00:00
|
|
|
pkt_node->srtt,
|
2010-07-03 13:32:39 +00:00
|
|
|
pkt_node->sack_enabled,
|
|
|
|
pkt_node->flags,
|
Change the unit of srtt and rto to usec, inspired by these in struct "tcp_info". Therefore, no need hz and tcp_rtt_scale in the headline of the log. Update the man page as well.
Summary: Simplify srtt and rto values in siftr log.
Test Plan:
Tested in Emulab testbed:
cc@s1:~ % sudo sysctl net.inet.siftr
net.inet.siftr.port_filter: 0
net.inet.siftr.genhashes: 0
net.inet.siftr.ppl: 1
net.inet.siftr.logfile: /var/log/siftr.log
net.inet.siftr.enabled: 0
cc@s1:~ % sudo sysctl net.inet.siftr.port_filter=5001
net.inet.siftr.port_filter: 0 -> 5001
cc@s1:~ % sudo sysctl net.inet.siftr.enabled=1
net.inet.siftr.enabled: 0 -> 1
cc@s1:~ %
cc@s1:~ % iperf -c r1 -n 1M
------------------------------------------------------------
Client connecting to r1, TCP port 5001
TCP window size: 32.0 KByte (default)
------------------------------------------------------------
[ 1] local 10.1.1.2 port 33817 connected with 10.1.1.3 port 5001
[ ID] Interval Transfer Bandwidth
[ 1] 0.00-0.91 sec 1.00 MBytes 9.22 Mbits/sec
cc@s1:~ % sudo sysctl net.inet.siftr.enabled=0
net.inet.siftr.enabled: 1 -> 0
cc@s1:~ % ll /var/log/siftr.log
-rw-r--r-- 1 root wheel 91K Apr 25 09:38 /var/log/siftr.log
cc@s1:~ % cat /var/log/siftr.log
enable_time_secs=1682437111 enable_time_usecs=121115 siftrver=1.3.0 sysname=FreeBSD sysver=1400088 ipmode=4
o,0x00000000,1682437125.907343,10.1.1.2,33817,10.1.1.3,5001,1073725440,1073725440,2,0,0,0,0,2,536,0,1,672,1000000,32768,0,65536,0,0,0,0,0
i,0x00000000,1682437126.106759,10.1.1.2,33817,10.1.1.3,5001,1073725440,1073725440,2,0,0,0,0,2,536,0,1,672,1000000,32768,0,65536,0,1,0,0,0
o,0x00000000,1682437126.106767,10.1.1.2,33817,10.1.1.3,5001,1073725440,14480,2,65535,65700,9,9,4,1460,201000,1,16778209,803000,33580,0,65700,0,0,0,0,0
o,0x00000000,1682437126.107141,10.1.1.2,33817,10.1.1.3,5001,1073725440,14480,2,65535,65700,9,9,4,1460,201000,1,16778208,803000,33580,60,65700,0,0,0,0,0
...
i,0x00000000,1682437127.016754,10.1.1.2,33817,10.1.1.3,5001,1073725440,606109,1030,748544,66048,9,9,9,1460,100812,1,1008,303000,475948,0,65700,0,0,0,0,0
o,0x00000000,1682437127.016759,10.1.1.2,33817,10.1.1.3,5001,1073725440,606109,1030,748544,66048,9,9,10,1460,100812,1,1011,303000,475948,0,65700,0,0,0,0,0
disable_time_secs=1682437131 disable_time_usecs=767582 num_inbound_tcp_pkts=371 num_outbound_tcp_pkts=186 total_tcp_pkts=557 num_inbound_skipped_pkts_malloc=0 num_outbound_skipped_pkts_malloc=0 num_inbound_skipped_pkts_tcpcb=0 num_outbound_skipped_pkts_tcpcb=0 num_inbound_skipped_pkts_inpcb=0 num_outbound_skipped_pkts_inpcb=0 total_skipped_tcp_pkts=0 flow_list=10.1.1.2;33817-10.1.1.3;5001,
Reviewers: rscheff, tuexen
Approved by: rscheff, tuexen
Subscribers: imp, melifaro, glebius
Differential Revision: https://reviews.freebsd.org/D39803
2023-04-25 11:52:28 +00:00
|
|
|
pkt_node->rto,
|
2010-07-03 13:32:39 +00:00
|
|
|
pkt_node->snd_buf_hiwater,
|
|
|
|
pkt_node->snd_buf_cc,
|
|
|
|
pkt_node->rcv_buf_hiwater,
|
|
|
|
pkt_node->rcv_buf_cc,
|
2010-09-25 09:16:46 +00:00
|
|
|
pkt_node->sent_inflight_bytes,
|
2015-03-18 23:24:25 +00:00
|
|
|
pkt_node->t_segqlen,
|
2015-03-19 00:23:16 +00:00
|
|
|
pkt_node->flowid,
|
|
|
|
pkt_node->flowtype);
|
2010-07-03 13:32:39 +00:00
|
|
|
#ifdef SIFTR_IPV6
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
alq_post_flags(siftr_alq, log_buf, 0);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
siftr_pkt_manager_thread(void *arg)
|
|
|
|
{
|
|
|
|
STAILQ_HEAD(pkthead, pkt_node) tmp_pkt_queue =
|
|
|
|
STAILQ_HEAD_INITIALIZER(tmp_pkt_queue);
|
|
|
|
struct pkt_node *pkt_node, *pkt_node_temp;
|
|
|
|
uint8_t draining;
|
|
|
|
|
|
|
|
draining = 2;
|
|
|
|
|
|
|
|
mtx_lock(&siftr_pkt_mgr_mtx);
|
|
|
|
|
|
|
|
/* draining == 0 when queue has been flushed and it's safe to exit. */
|
|
|
|
while (draining) {
|
|
|
|
/*
|
|
|
|
* Sleep until we are signalled to wake because thread has
|
|
|
|
* been told to exit or until 1 tick has passed.
|
|
|
|
*/
|
|
|
|
mtx_sleep(&wait_for_pkt, &siftr_pkt_mgr_mtx, PWAIT, "pktwait",
|
|
|
|
1);
|
|
|
|
|
|
|
|
/* Gain exclusive access to the pkt_node queue. */
|
|
|
|
mtx_lock(&siftr_pkt_queue_mtx);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Move pkt_queue to tmp_pkt_queue, which leaves
|
|
|
|
* pkt_queue empty and ready to receive more pkt_nodes.
|
|
|
|
*/
|
|
|
|
STAILQ_CONCAT(&tmp_pkt_queue, &pkt_queue);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* We've finished making changes to the list. Unlock it
|
|
|
|
* so the pfil hooks can continue queuing pkt_nodes.
|
|
|
|
*/
|
|
|
|
mtx_unlock(&siftr_pkt_queue_mtx);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* We can't hold a mutex whilst calling siftr_process_pkt
|
|
|
|
* because ALQ might sleep waiting for buffer space.
|
|
|
|
*/
|
|
|
|
mtx_unlock(&siftr_pkt_mgr_mtx);
|
|
|
|
|
|
|
|
/* Flush all pkt_nodes to the log file. */
|
|
|
|
STAILQ_FOREACH_SAFE(pkt_node, &tmp_pkt_queue, nodes,
|
|
|
|
pkt_node_temp) {
|
|
|
|
siftr_process_pkt(pkt_node);
|
|
|
|
STAILQ_REMOVE_HEAD(&tmp_pkt_queue, nodes);
|
|
|
|
free(pkt_node, M_SIFTR_PKTNODE);
|
|
|
|
}
|
|
|
|
|
|
|
|
KASSERT(STAILQ_EMPTY(&tmp_pkt_queue),
|
|
|
|
("SIFTR tmp_pkt_queue not empty after flush"));
|
|
|
|
|
|
|
|
mtx_lock(&siftr_pkt_mgr_mtx);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* If siftr_exit_pkt_manager_thread gets set during the window
|
|
|
|
* where we are draining the tmp_pkt_queue above, there might
|
|
|
|
* still be pkts in pkt_queue that need to be drained.
|
|
|
|
* Allow one further iteration to occur after
|
|
|
|
* siftr_exit_pkt_manager_thread has been set to ensure
|
|
|
|
* pkt_queue is completely empty before we kill the thread.
|
|
|
|
*
|
|
|
|
* siftr_exit_pkt_manager_thread is set only after the pfil
|
|
|
|
* hooks have been removed, so only 1 extra iteration
|
|
|
|
* is needed to drain the queue.
|
|
|
|
*/
|
|
|
|
if (siftr_exit_pkt_manager_thread)
|
|
|
|
draining--;
|
|
|
|
}
|
|
|
|
|
|
|
|
mtx_unlock(&siftr_pkt_mgr_mtx);
|
|
|
|
|
|
|
|
/* Calls wakeup on this thread's struct thread ptr. */
|
|
|
|
kthread_exit();
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Check if a given mbuf has the SIFTR mbuf tag. If it does, log the fact that
|
|
|
|
* it's a reinjected packet and return. If it doesn't, tag the mbuf and return.
|
|
|
|
* Return value >0 means the caller should skip processing this mbuf.
|
|
|
|
*/
|
|
|
|
static inline int
|
|
|
|
siftr_chkreinject(struct mbuf *m, int dir, struct siftr_stats *ss)
|
|
|
|
{
|
|
|
|
if (m_tag_locate(m, PACKET_COOKIE_SIFTR, PACKET_TAG_SIFTR, NULL)
|
|
|
|
!= NULL) {
|
|
|
|
if (dir == PFIL_IN)
|
|
|
|
ss->nskip_in_dejavu++;
|
|
|
|
else
|
|
|
|
ss->nskip_out_dejavu++;
|
|
|
|
|
|
|
|
return (1);
|
|
|
|
} else {
|
|
|
|
struct m_tag *tag = m_tag_alloc(PACKET_COOKIE_SIFTR,
|
|
|
|
PACKET_TAG_SIFTR, 0, M_NOWAIT);
|
|
|
|
if (tag == NULL) {
|
|
|
|
if (dir == PFIL_IN)
|
|
|
|
ss->nskip_in_malloc++;
|
|
|
|
else
|
|
|
|
ss->nskip_out_malloc++;
|
|
|
|
|
|
|
|
return (1);
|
|
|
|
}
|
|
|
|
|
|
|
|
m_tag_prepend(m, tag);
|
|
|
|
}
|
|
|
|
|
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Look up an inpcb for a packet. Return the inpcb pointer if found, or NULL
|
|
|
|
* otherwise.
|
|
|
|
*/
|
|
|
|
static inline struct inpcb *
|
|
|
|
siftr_findinpcb(int ipver, struct ip *ip, struct mbuf *m, uint16_t sport,
|
|
|
|
uint16_t dport, int dir, struct siftr_stats *ss)
|
|
|
|
{
|
|
|
|
struct inpcb *inp;
|
|
|
|
|
|
|
|
/* We need the tcbinfo lock. */
|
2018-10-01 10:46:00 +00:00
|
|
|
INP_INFO_WUNLOCK_ASSERT(&V_tcbinfo);
|
2010-07-03 13:32:39 +00:00
|
|
|
|
|
|
|
if (dir == PFIL_IN)
|
|
|
|
inp = (ipver == INP_IPV4 ?
|
Decompose the current single inpcbinfo lock into two locks:
- The existing ipi_lock continues to protect the global inpcb list and
inpcb counter. This lock is now relegated to a small number of
allocation and free operations, and occasional operations that walk
all connections (including, awkwardly, certain UDP multicast receive
operations -- something to revisit).
- A new ipi_hash_lock protects the two inpcbinfo hash tables for
looking up connections and bound sockets, manipulated using new
INP_HASH_*() macros. This lock, combined with inpcb locks, protects
the 4-tuple address space.
Unlike the current ipi_lock, ipi_hash_lock follows the individual inpcb
connection locks, so may be acquired while manipulating a connection on
which a lock is already held, avoiding the need to acquire the inpcbinfo
lock preemptively when a binding change might later be required. As a
result, however, lookup operations necessarily go through a reference
acquire while holding the lookup lock, later acquiring an inpcb lock --
if required.
A new function in_pcblookup() looks up connections, and accepts flags
indicating how to return the inpcb. Due to lock order changes, callers
no longer need acquire locks before performing a lookup: the lookup
routine will acquire the ipi_hash_lock as needed. In the future, it will
also be able to use alternative lookup and locking strategies
transparently to callers, such as pcbgroup lookup. New lookup flags are,
supplementing the existing INPLOOKUP_WILDCARD flag:
INPLOOKUP_RLOCKPCB - Acquire a read lock on the returned inpcb
INPLOOKUP_WLOCKPCB - Acquire a write lock on the returned inpcb
Callers must pass exactly one of these flags (for the time being).
Some notes:
- All protocols are updated to work within the new regime; especially,
TCP, UDPv4, and UDPv6. pcbinfo ipi_lock acquisitions are largely
eliminated, and global hash lock hold times are dramatically reduced
compared to previous locking.
- The TCP syncache still relies on the pcbinfo lock, something that we
may want to revisit.
- Support for reverting to the FreeBSD 7.x locking strategy in TCP input
is no longer available -- hash lookup locks are now held only very
briefly during inpcb lookup, rather than for potentially extended
periods. However, the pcbinfo ipi_lock will still be acquired if a
connection state might change such that a connection is added or
removed.
- Raw IP sockets continue to use the pcbinfo ipi_lock for protection,
due to maintaining their own hash tables.
- The interface in6_pcblookup_hash_locked() is maintained, which allows
callers to acquire hash locks and perform one or more lookups atomically
with 4-tuple allocation: this is required only for TCPv6, as there is no
in6_pcbconnect_setup(), which there should be.
- UDPv6 locking remains significantly more conservative than UDPv4
locking, which relates to source address selection. This needs
attention, as it likely significantly reduces parallelism in this code
for multithreaded socket use (such as in BIND).
- In the UDPv4 and UDPv6 multicast cases, we need to revisit locking
somewhat, as they relied on ipi_lock to stablise 4-tuple matches, which
is no longer sufficient. A second check once the inpcb lock is held
should do the trick, keeping the general case from requiring the inpcb
lock for every inpcb visited.
- This work reminds us that we need to revisit locking of the v4/v6 flags,
which may be accessed lock-free both before and after this change.
- Right now, a single lock name is used for the pcbhash lock -- this is
undesirable, and probably another argument is required to take care of
this (or a char array name field in the pcbinfo?).
This is not an MFC candidate for 8.x due to its impact on lookup and
locking semantics. It's possible some of these issues could be worked
around with compatibility wrappers, if necessary.
Reviewed by: bz
Sponsored by: Juniper Networks, Inc.
2011-05-30 09:43:55 +00:00
|
|
|
in_pcblookup(&V_tcbinfo, ip->ip_src, sport, ip->ip_dst,
|
|
|
|
dport, INPLOOKUP_RLOCKPCB, m->m_pkthdr.rcvif)
|
2010-07-03 13:32:39 +00:00
|
|
|
:
|
|
|
|
#ifdef SIFTR_IPV6
|
Decompose the current single inpcbinfo lock into two locks:
- The existing ipi_lock continues to protect the global inpcb list and
inpcb counter. This lock is now relegated to a small number of
allocation and free operations, and occasional operations that walk
all connections (including, awkwardly, certain UDP multicast receive
operations -- something to revisit).
- A new ipi_hash_lock protects the two inpcbinfo hash tables for
looking up connections and bound sockets, manipulated using new
INP_HASH_*() macros. This lock, combined with inpcb locks, protects
the 4-tuple address space.
Unlike the current ipi_lock, ipi_hash_lock follows the individual inpcb
connection locks, so may be acquired while manipulating a connection on
which a lock is already held, avoiding the need to acquire the inpcbinfo
lock preemptively when a binding change might later be required. As a
result, however, lookup operations necessarily go through a reference
acquire while holding the lookup lock, later acquiring an inpcb lock --
if required.
A new function in_pcblookup() looks up connections, and accepts flags
indicating how to return the inpcb. Due to lock order changes, callers
no longer need acquire locks before performing a lookup: the lookup
routine will acquire the ipi_hash_lock as needed. In the future, it will
also be able to use alternative lookup and locking strategies
transparently to callers, such as pcbgroup lookup. New lookup flags are,
supplementing the existing INPLOOKUP_WILDCARD flag:
INPLOOKUP_RLOCKPCB - Acquire a read lock on the returned inpcb
INPLOOKUP_WLOCKPCB - Acquire a write lock on the returned inpcb
Callers must pass exactly one of these flags (for the time being).
Some notes:
- All protocols are updated to work within the new regime; especially,
TCP, UDPv4, and UDPv6. pcbinfo ipi_lock acquisitions are largely
eliminated, and global hash lock hold times are dramatically reduced
compared to previous locking.
- The TCP syncache still relies on the pcbinfo lock, something that we
may want to revisit.
- Support for reverting to the FreeBSD 7.x locking strategy in TCP input
is no longer available -- hash lookup locks are now held only very
briefly during inpcb lookup, rather than for potentially extended
periods. However, the pcbinfo ipi_lock will still be acquired if a
connection state might change such that a connection is added or
removed.
- Raw IP sockets continue to use the pcbinfo ipi_lock for protection,
due to maintaining their own hash tables.
- The interface in6_pcblookup_hash_locked() is maintained, which allows
callers to acquire hash locks and perform one or more lookups atomically
with 4-tuple allocation: this is required only for TCPv6, as there is no
in6_pcbconnect_setup(), which there should be.
- UDPv6 locking remains significantly more conservative than UDPv4
locking, which relates to source address selection. This needs
attention, as it likely significantly reduces parallelism in this code
for multithreaded socket use (such as in BIND).
- In the UDPv4 and UDPv6 multicast cases, we need to revisit locking
somewhat, as they relied on ipi_lock to stablise 4-tuple matches, which
is no longer sufficient. A second check once the inpcb lock is held
should do the trick, keeping the general case from requiring the inpcb
lock for every inpcb visited.
- This work reminds us that we need to revisit locking of the v4/v6 flags,
which may be accessed lock-free both before and after this change.
- Right now, a single lock name is used for the pcbhash lock -- this is
undesirable, and probably another argument is required to take care of
this (or a char array name field in the pcbinfo?).
This is not an MFC candidate for 8.x due to its impact on lookup and
locking semantics. It's possible some of these issues could be worked
around with compatibility wrappers, if necessary.
Reviewed by: bz
Sponsored by: Juniper Networks, Inc.
2011-05-30 09:43:55 +00:00
|
|
|
in6_pcblookup(&V_tcbinfo,
|
2010-07-03 13:32:39 +00:00
|
|
|
&((struct ip6_hdr *)ip)->ip6_src, sport,
|
Decompose the current single inpcbinfo lock into two locks:
- The existing ipi_lock continues to protect the global inpcb list and
inpcb counter. This lock is now relegated to a small number of
allocation and free operations, and occasional operations that walk
all connections (including, awkwardly, certain UDP multicast receive
operations -- something to revisit).
- A new ipi_hash_lock protects the two inpcbinfo hash tables for
looking up connections and bound sockets, manipulated using new
INP_HASH_*() macros. This lock, combined with inpcb locks, protects
the 4-tuple address space.
Unlike the current ipi_lock, ipi_hash_lock follows the individual inpcb
connection locks, so may be acquired while manipulating a connection on
which a lock is already held, avoiding the need to acquire the inpcbinfo
lock preemptively when a binding change might later be required. As a
result, however, lookup operations necessarily go through a reference
acquire while holding the lookup lock, later acquiring an inpcb lock --
if required.
A new function in_pcblookup() looks up connections, and accepts flags
indicating how to return the inpcb. Due to lock order changes, callers
no longer need acquire locks before performing a lookup: the lookup
routine will acquire the ipi_hash_lock as needed. In the future, it will
also be able to use alternative lookup and locking strategies
transparently to callers, such as pcbgroup lookup. New lookup flags are,
supplementing the existing INPLOOKUP_WILDCARD flag:
INPLOOKUP_RLOCKPCB - Acquire a read lock on the returned inpcb
INPLOOKUP_WLOCKPCB - Acquire a write lock on the returned inpcb
Callers must pass exactly one of these flags (for the time being).
Some notes:
- All protocols are updated to work within the new regime; especially,
TCP, UDPv4, and UDPv6. pcbinfo ipi_lock acquisitions are largely
eliminated, and global hash lock hold times are dramatically reduced
compared to previous locking.
- The TCP syncache still relies on the pcbinfo lock, something that we
may want to revisit.
- Support for reverting to the FreeBSD 7.x locking strategy in TCP input
is no longer available -- hash lookup locks are now held only very
briefly during inpcb lookup, rather than for potentially extended
periods. However, the pcbinfo ipi_lock will still be acquired if a
connection state might change such that a connection is added or
removed.
- Raw IP sockets continue to use the pcbinfo ipi_lock for protection,
due to maintaining their own hash tables.
- The interface in6_pcblookup_hash_locked() is maintained, which allows
callers to acquire hash locks and perform one or more lookups atomically
with 4-tuple allocation: this is required only for TCPv6, as there is no
in6_pcbconnect_setup(), which there should be.
- UDPv6 locking remains significantly more conservative than UDPv4
locking, which relates to source address selection. This needs
attention, as it likely significantly reduces parallelism in this code
for multithreaded socket use (such as in BIND).
- In the UDPv4 and UDPv6 multicast cases, we need to revisit locking
somewhat, as they relied on ipi_lock to stablise 4-tuple matches, which
is no longer sufficient. A second check once the inpcb lock is held
should do the trick, keeping the general case from requiring the inpcb
lock for every inpcb visited.
- This work reminds us that we need to revisit locking of the v4/v6 flags,
which may be accessed lock-free both before and after this change.
- Right now, a single lock name is used for the pcbhash lock -- this is
undesirable, and probably another argument is required to take care of
this (or a char array name field in the pcbinfo?).
This is not an MFC candidate for 8.x due to its impact on lookup and
locking semantics. It's possible some of these issues could be worked
around with compatibility wrappers, if necessary.
Reviewed by: bz
Sponsored by: Juniper Networks, Inc.
2011-05-30 09:43:55 +00:00
|
|
|
&((struct ip6_hdr *)ip)->ip6_dst, dport, INPLOOKUP_RLOCKPCB,
|
2010-07-03 13:32:39 +00:00
|
|
|
m->m_pkthdr.rcvif)
|
|
|
|
#else
|
|
|
|
NULL
|
|
|
|
#endif
|
|
|
|
);
|
|
|
|
|
|
|
|
else
|
|
|
|
inp = (ipver == INP_IPV4 ?
|
Decompose the current single inpcbinfo lock into two locks:
- The existing ipi_lock continues to protect the global inpcb list and
inpcb counter. This lock is now relegated to a small number of
allocation and free operations, and occasional operations that walk
all connections (including, awkwardly, certain UDP multicast receive
operations -- something to revisit).
- A new ipi_hash_lock protects the two inpcbinfo hash tables for
looking up connections and bound sockets, manipulated using new
INP_HASH_*() macros. This lock, combined with inpcb locks, protects
the 4-tuple address space.
Unlike the current ipi_lock, ipi_hash_lock follows the individual inpcb
connection locks, so may be acquired while manipulating a connection on
which a lock is already held, avoiding the need to acquire the inpcbinfo
lock preemptively when a binding change might later be required. As a
result, however, lookup operations necessarily go through a reference
acquire while holding the lookup lock, later acquiring an inpcb lock --
if required.
A new function in_pcblookup() looks up connections, and accepts flags
indicating how to return the inpcb. Due to lock order changes, callers
no longer need acquire locks before performing a lookup: the lookup
routine will acquire the ipi_hash_lock as needed. In the future, it will
also be able to use alternative lookup and locking strategies
transparently to callers, such as pcbgroup lookup. New lookup flags are,
supplementing the existing INPLOOKUP_WILDCARD flag:
INPLOOKUP_RLOCKPCB - Acquire a read lock on the returned inpcb
INPLOOKUP_WLOCKPCB - Acquire a write lock on the returned inpcb
Callers must pass exactly one of these flags (for the time being).
Some notes:
- All protocols are updated to work within the new regime; especially,
TCP, UDPv4, and UDPv6. pcbinfo ipi_lock acquisitions are largely
eliminated, and global hash lock hold times are dramatically reduced
compared to previous locking.
- The TCP syncache still relies on the pcbinfo lock, something that we
may want to revisit.
- Support for reverting to the FreeBSD 7.x locking strategy in TCP input
is no longer available -- hash lookup locks are now held only very
briefly during inpcb lookup, rather than for potentially extended
periods. However, the pcbinfo ipi_lock will still be acquired if a
connection state might change such that a connection is added or
removed.
- Raw IP sockets continue to use the pcbinfo ipi_lock for protection,
due to maintaining their own hash tables.
- The interface in6_pcblookup_hash_locked() is maintained, which allows
callers to acquire hash locks and perform one or more lookups atomically
with 4-tuple allocation: this is required only for TCPv6, as there is no
in6_pcbconnect_setup(), which there should be.
- UDPv6 locking remains significantly more conservative than UDPv4
locking, which relates to source address selection. This needs
attention, as it likely significantly reduces parallelism in this code
for multithreaded socket use (such as in BIND).
- In the UDPv4 and UDPv6 multicast cases, we need to revisit locking
somewhat, as they relied on ipi_lock to stablise 4-tuple matches, which
is no longer sufficient. A second check once the inpcb lock is held
should do the trick, keeping the general case from requiring the inpcb
lock for every inpcb visited.
- This work reminds us that we need to revisit locking of the v4/v6 flags,
which may be accessed lock-free both before and after this change.
- Right now, a single lock name is used for the pcbhash lock -- this is
undesirable, and probably another argument is required to take care of
this (or a char array name field in the pcbinfo?).
This is not an MFC candidate for 8.x due to its impact on lookup and
locking semantics. It's possible some of these issues could be worked
around with compatibility wrappers, if necessary.
Reviewed by: bz
Sponsored by: Juniper Networks, Inc.
2011-05-30 09:43:55 +00:00
|
|
|
in_pcblookup(&V_tcbinfo, ip->ip_dst, dport, ip->ip_src,
|
|
|
|
sport, INPLOOKUP_RLOCKPCB, m->m_pkthdr.rcvif)
|
2010-07-03 13:32:39 +00:00
|
|
|
:
|
|
|
|
#ifdef SIFTR_IPV6
|
Decompose the current single inpcbinfo lock into two locks:
- The existing ipi_lock continues to protect the global inpcb list and
inpcb counter. This lock is now relegated to a small number of
allocation and free operations, and occasional operations that walk
all connections (including, awkwardly, certain UDP multicast receive
operations -- something to revisit).
- A new ipi_hash_lock protects the two inpcbinfo hash tables for
looking up connections and bound sockets, manipulated using new
INP_HASH_*() macros. This lock, combined with inpcb locks, protects
the 4-tuple address space.
Unlike the current ipi_lock, ipi_hash_lock follows the individual inpcb
connection locks, so may be acquired while manipulating a connection on
which a lock is already held, avoiding the need to acquire the inpcbinfo
lock preemptively when a binding change might later be required. As a
result, however, lookup operations necessarily go through a reference
acquire while holding the lookup lock, later acquiring an inpcb lock --
if required.
A new function in_pcblookup() looks up connections, and accepts flags
indicating how to return the inpcb. Due to lock order changes, callers
no longer need acquire locks before performing a lookup: the lookup
routine will acquire the ipi_hash_lock as needed. In the future, it will
also be able to use alternative lookup and locking strategies
transparently to callers, such as pcbgroup lookup. New lookup flags are,
supplementing the existing INPLOOKUP_WILDCARD flag:
INPLOOKUP_RLOCKPCB - Acquire a read lock on the returned inpcb
INPLOOKUP_WLOCKPCB - Acquire a write lock on the returned inpcb
Callers must pass exactly one of these flags (for the time being).
Some notes:
- All protocols are updated to work within the new regime; especially,
TCP, UDPv4, and UDPv6. pcbinfo ipi_lock acquisitions are largely
eliminated, and global hash lock hold times are dramatically reduced
compared to previous locking.
- The TCP syncache still relies on the pcbinfo lock, something that we
may want to revisit.
- Support for reverting to the FreeBSD 7.x locking strategy in TCP input
is no longer available -- hash lookup locks are now held only very
briefly during inpcb lookup, rather than for potentially extended
periods. However, the pcbinfo ipi_lock will still be acquired if a
connection state might change such that a connection is added or
removed.
- Raw IP sockets continue to use the pcbinfo ipi_lock for protection,
due to maintaining their own hash tables.
- The interface in6_pcblookup_hash_locked() is maintained, which allows
callers to acquire hash locks and perform one or more lookups atomically
with 4-tuple allocation: this is required only for TCPv6, as there is no
in6_pcbconnect_setup(), which there should be.
- UDPv6 locking remains significantly more conservative than UDPv4
locking, which relates to source address selection. This needs
attention, as it likely significantly reduces parallelism in this code
for multithreaded socket use (such as in BIND).
- In the UDPv4 and UDPv6 multicast cases, we need to revisit locking
somewhat, as they relied on ipi_lock to stablise 4-tuple matches, which
is no longer sufficient. A second check once the inpcb lock is held
should do the trick, keeping the general case from requiring the inpcb
lock for every inpcb visited.
- This work reminds us that we need to revisit locking of the v4/v6 flags,
which may be accessed lock-free both before and after this change.
- Right now, a single lock name is used for the pcbhash lock -- this is
undesirable, and probably another argument is required to take care of
this (or a char array name field in the pcbinfo?).
This is not an MFC candidate for 8.x due to its impact on lookup and
locking semantics. It's possible some of these issues could be worked
around with compatibility wrappers, if necessary.
Reviewed by: bz
Sponsored by: Juniper Networks, Inc.
2011-05-30 09:43:55 +00:00
|
|
|
in6_pcblookup(&V_tcbinfo,
|
2010-07-03 13:32:39 +00:00
|
|
|
&((struct ip6_hdr *)ip)->ip6_dst, dport,
|
Decompose the current single inpcbinfo lock into two locks:
- The existing ipi_lock continues to protect the global inpcb list and
inpcb counter. This lock is now relegated to a small number of
allocation and free operations, and occasional operations that walk
all connections (including, awkwardly, certain UDP multicast receive
operations -- something to revisit).
- A new ipi_hash_lock protects the two inpcbinfo hash tables for
looking up connections and bound sockets, manipulated using new
INP_HASH_*() macros. This lock, combined with inpcb locks, protects
the 4-tuple address space.
Unlike the current ipi_lock, ipi_hash_lock follows the individual inpcb
connection locks, so may be acquired while manipulating a connection on
which a lock is already held, avoiding the need to acquire the inpcbinfo
lock preemptively when a binding change might later be required. As a
result, however, lookup operations necessarily go through a reference
acquire while holding the lookup lock, later acquiring an inpcb lock --
if required.
A new function in_pcblookup() looks up connections, and accepts flags
indicating how to return the inpcb. Due to lock order changes, callers
no longer need acquire locks before performing a lookup: the lookup
routine will acquire the ipi_hash_lock as needed. In the future, it will
also be able to use alternative lookup and locking strategies
transparently to callers, such as pcbgroup lookup. New lookup flags are,
supplementing the existing INPLOOKUP_WILDCARD flag:
INPLOOKUP_RLOCKPCB - Acquire a read lock on the returned inpcb
INPLOOKUP_WLOCKPCB - Acquire a write lock on the returned inpcb
Callers must pass exactly one of these flags (for the time being).
Some notes:
- All protocols are updated to work within the new regime; especially,
TCP, UDPv4, and UDPv6. pcbinfo ipi_lock acquisitions are largely
eliminated, and global hash lock hold times are dramatically reduced
compared to previous locking.
- The TCP syncache still relies on the pcbinfo lock, something that we
may want to revisit.
- Support for reverting to the FreeBSD 7.x locking strategy in TCP input
is no longer available -- hash lookup locks are now held only very
briefly during inpcb lookup, rather than for potentially extended
periods. However, the pcbinfo ipi_lock will still be acquired if a
connection state might change such that a connection is added or
removed.
- Raw IP sockets continue to use the pcbinfo ipi_lock for protection,
due to maintaining their own hash tables.
- The interface in6_pcblookup_hash_locked() is maintained, which allows
callers to acquire hash locks and perform one or more lookups atomically
with 4-tuple allocation: this is required only for TCPv6, as there is no
in6_pcbconnect_setup(), which there should be.
- UDPv6 locking remains significantly more conservative than UDPv4
locking, which relates to source address selection. This needs
attention, as it likely significantly reduces parallelism in this code
for multithreaded socket use (such as in BIND).
- In the UDPv4 and UDPv6 multicast cases, we need to revisit locking
somewhat, as they relied on ipi_lock to stablise 4-tuple matches, which
is no longer sufficient. A second check once the inpcb lock is held
should do the trick, keeping the general case from requiring the inpcb
lock for every inpcb visited.
- This work reminds us that we need to revisit locking of the v4/v6 flags,
which may be accessed lock-free both before and after this change.
- Right now, a single lock name is used for the pcbhash lock -- this is
undesirable, and probably another argument is required to take care of
this (or a char array name field in the pcbinfo?).
This is not an MFC candidate for 8.x due to its impact on lookup and
locking semantics. It's possible some of these issues could be worked
around with compatibility wrappers, if necessary.
Reviewed by: bz
Sponsored by: Juniper Networks, Inc.
2011-05-30 09:43:55 +00:00
|
|
|
&((struct ip6_hdr *)ip)->ip6_src, sport, INPLOOKUP_RLOCKPCB,
|
2010-07-03 13:32:39 +00:00
|
|
|
m->m_pkthdr.rcvif)
|
|
|
|
#else
|
|
|
|
NULL
|
|
|
|
#endif
|
|
|
|
);
|
|
|
|
|
|
|
|
/* If we can't find the inpcb, bail. */
|
|
|
|
if (inp == NULL) {
|
|
|
|
if (dir == PFIL_IN)
|
|
|
|
ss->nskip_in_inpcb++;
|
|
|
|
else
|
|
|
|
ss->nskip_out_inpcb++;
|
|
|
|
}
|
|
|
|
|
|
|
|
return (inp);
|
|
|
|
}
|
|
|
|
|
2010-07-18 05:09:10 +00:00
|
|
|
static inline void
|
|
|
|
siftr_siftdata(struct pkt_node *pn, struct inpcb *inp, struct tcpcb *tp,
|
|
|
|
int ipver, int dir, int inp_locally_locked)
|
|
|
|
{
|
|
|
|
#ifdef SIFTR_IPV6
|
|
|
|
if (ipver == INP_IPV4) {
|
|
|
|
pn->ip_laddr[3] = inp->inp_laddr.s_addr;
|
|
|
|
pn->ip_faddr[3] = inp->inp_faddr.s_addr;
|
|
|
|
#else
|
|
|
|
*((uint32_t *)pn->ip_laddr) = inp->inp_laddr.s_addr;
|
|
|
|
*((uint32_t *)pn->ip_faddr) = inp->inp_faddr.s_addr;
|
|
|
|
#endif
|
|
|
|
#ifdef SIFTR_IPV6
|
|
|
|
} else {
|
|
|
|
pn->ip_laddr[0] = inp->in6p_laddr.s6_addr32[0];
|
|
|
|
pn->ip_laddr[1] = inp->in6p_laddr.s6_addr32[1];
|
|
|
|
pn->ip_laddr[2] = inp->in6p_laddr.s6_addr32[2];
|
|
|
|
pn->ip_laddr[3] = inp->in6p_laddr.s6_addr32[3];
|
|
|
|
pn->ip_faddr[0] = inp->in6p_faddr.s6_addr32[0];
|
|
|
|
pn->ip_faddr[1] = inp->in6p_faddr.s6_addr32[1];
|
|
|
|
pn->ip_faddr[2] = inp->in6p_faddr.s6_addr32[2];
|
|
|
|
pn->ip_faddr[3] = inp->in6p_faddr.s6_addr32[3];
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
pn->tcp_localport = inp->inp_lport;
|
|
|
|
pn->tcp_foreignport = inp->inp_fport;
|
|
|
|
pn->snd_cwnd = tp->snd_cwnd;
|
|
|
|
pn->snd_wnd = tp->snd_wnd;
|
|
|
|
pn->rcv_wnd = tp->rcv_wnd;
|
2022-04-07 09:12:33 +00:00
|
|
|
pn->t_flags2 = tp->t_flags2;
|
2010-07-18 05:09:10 +00:00
|
|
|
pn->snd_ssthresh = tp->snd_ssthresh;
|
|
|
|
pn->snd_scale = tp->snd_scale;
|
|
|
|
pn->rcv_scale = tp->rcv_scale;
|
|
|
|
pn->conn_state = tp->t_state;
|
|
|
|
pn->max_seg_size = tp->t_maxseg;
|
Change the unit of srtt and rto to usec, inspired by these in struct "tcp_info". Therefore, no need hz and tcp_rtt_scale in the headline of the log. Update the man page as well.
Summary: Simplify srtt and rto values in siftr log.
Test Plan:
Tested in Emulab testbed:
cc@s1:~ % sudo sysctl net.inet.siftr
net.inet.siftr.port_filter: 0
net.inet.siftr.genhashes: 0
net.inet.siftr.ppl: 1
net.inet.siftr.logfile: /var/log/siftr.log
net.inet.siftr.enabled: 0
cc@s1:~ % sudo sysctl net.inet.siftr.port_filter=5001
net.inet.siftr.port_filter: 0 -> 5001
cc@s1:~ % sudo sysctl net.inet.siftr.enabled=1
net.inet.siftr.enabled: 0 -> 1
cc@s1:~ %
cc@s1:~ % iperf -c r1 -n 1M
------------------------------------------------------------
Client connecting to r1, TCP port 5001
TCP window size: 32.0 KByte (default)
------------------------------------------------------------
[ 1] local 10.1.1.2 port 33817 connected with 10.1.1.3 port 5001
[ ID] Interval Transfer Bandwidth
[ 1] 0.00-0.91 sec 1.00 MBytes 9.22 Mbits/sec
cc@s1:~ % sudo sysctl net.inet.siftr.enabled=0
net.inet.siftr.enabled: 1 -> 0
cc@s1:~ % ll /var/log/siftr.log
-rw-r--r-- 1 root wheel 91K Apr 25 09:38 /var/log/siftr.log
cc@s1:~ % cat /var/log/siftr.log
enable_time_secs=1682437111 enable_time_usecs=121115 siftrver=1.3.0 sysname=FreeBSD sysver=1400088 ipmode=4
o,0x00000000,1682437125.907343,10.1.1.2,33817,10.1.1.3,5001,1073725440,1073725440,2,0,0,0,0,2,536,0,1,672,1000000,32768,0,65536,0,0,0,0,0
i,0x00000000,1682437126.106759,10.1.1.2,33817,10.1.1.3,5001,1073725440,1073725440,2,0,0,0,0,2,536,0,1,672,1000000,32768,0,65536,0,1,0,0,0
o,0x00000000,1682437126.106767,10.1.1.2,33817,10.1.1.3,5001,1073725440,14480,2,65535,65700,9,9,4,1460,201000,1,16778209,803000,33580,0,65700,0,0,0,0,0
o,0x00000000,1682437126.107141,10.1.1.2,33817,10.1.1.3,5001,1073725440,14480,2,65535,65700,9,9,4,1460,201000,1,16778208,803000,33580,60,65700,0,0,0,0,0
...
i,0x00000000,1682437127.016754,10.1.1.2,33817,10.1.1.3,5001,1073725440,606109,1030,748544,66048,9,9,9,1460,100812,1,1008,303000,475948,0,65700,0,0,0,0,0
o,0x00000000,1682437127.016759,10.1.1.2,33817,10.1.1.3,5001,1073725440,606109,1030,748544,66048,9,9,10,1460,100812,1,1011,303000,475948,0,65700,0,0,0,0,0
disable_time_secs=1682437131 disable_time_usecs=767582 num_inbound_tcp_pkts=371 num_outbound_tcp_pkts=186 total_tcp_pkts=557 num_inbound_skipped_pkts_malloc=0 num_outbound_skipped_pkts_malloc=0 num_inbound_skipped_pkts_tcpcb=0 num_outbound_skipped_pkts_tcpcb=0 num_inbound_skipped_pkts_inpcb=0 num_outbound_skipped_pkts_inpcb=0 total_skipped_tcp_pkts=0 flow_list=10.1.1.2;33817-10.1.1.3;5001,
Reviewers: rscheff, tuexen
Approved by: rscheff, tuexen
Subscribers: imp, melifaro, glebius
Differential Revision: https://reviews.freebsd.org/D39803
2023-04-25 11:52:28 +00:00
|
|
|
pn->srtt = ((u_int64_t)tp->t_srtt * tick) >> TCP_RTT_SHIFT;
|
2010-07-18 05:09:10 +00:00
|
|
|
pn->sack_enabled = (tp->t_flags & TF_SACK_PERMIT) != 0;
|
|
|
|
pn->flags = tp->t_flags;
|
Change the unit of srtt and rto to usec, inspired by these in struct "tcp_info". Therefore, no need hz and tcp_rtt_scale in the headline of the log. Update the man page as well.
Summary: Simplify srtt and rto values in siftr log.
Test Plan:
Tested in Emulab testbed:
cc@s1:~ % sudo sysctl net.inet.siftr
net.inet.siftr.port_filter: 0
net.inet.siftr.genhashes: 0
net.inet.siftr.ppl: 1
net.inet.siftr.logfile: /var/log/siftr.log
net.inet.siftr.enabled: 0
cc@s1:~ % sudo sysctl net.inet.siftr.port_filter=5001
net.inet.siftr.port_filter: 0 -> 5001
cc@s1:~ % sudo sysctl net.inet.siftr.enabled=1
net.inet.siftr.enabled: 0 -> 1
cc@s1:~ %
cc@s1:~ % iperf -c r1 -n 1M
------------------------------------------------------------
Client connecting to r1, TCP port 5001
TCP window size: 32.0 KByte (default)
------------------------------------------------------------
[ 1] local 10.1.1.2 port 33817 connected with 10.1.1.3 port 5001
[ ID] Interval Transfer Bandwidth
[ 1] 0.00-0.91 sec 1.00 MBytes 9.22 Mbits/sec
cc@s1:~ % sudo sysctl net.inet.siftr.enabled=0
net.inet.siftr.enabled: 1 -> 0
cc@s1:~ % ll /var/log/siftr.log
-rw-r--r-- 1 root wheel 91K Apr 25 09:38 /var/log/siftr.log
cc@s1:~ % cat /var/log/siftr.log
enable_time_secs=1682437111 enable_time_usecs=121115 siftrver=1.3.0 sysname=FreeBSD sysver=1400088 ipmode=4
o,0x00000000,1682437125.907343,10.1.1.2,33817,10.1.1.3,5001,1073725440,1073725440,2,0,0,0,0,2,536,0,1,672,1000000,32768,0,65536,0,0,0,0,0
i,0x00000000,1682437126.106759,10.1.1.2,33817,10.1.1.3,5001,1073725440,1073725440,2,0,0,0,0,2,536,0,1,672,1000000,32768,0,65536,0,1,0,0,0
o,0x00000000,1682437126.106767,10.1.1.2,33817,10.1.1.3,5001,1073725440,14480,2,65535,65700,9,9,4,1460,201000,1,16778209,803000,33580,0,65700,0,0,0,0,0
o,0x00000000,1682437126.107141,10.1.1.2,33817,10.1.1.3,5001,1073725440,14480,2,65535,65700,9,9,4,1460,201000,1,16778208,803000,33580,60,65700,0,0,0,0,0
...
i,0x00000000,1682437127.016754,10.1.1.2,33817,10.1.1.3,5001,1073725440,606109,1030,748544,66048,9,9,9,1460,100812,1,1008,303000,475948,0,65700,0,0,0,0,0
o,0x00000000,1682437127.016759,10.1.1.2,33817,10.1.1.3,5001,1073725440,606109,1030,748544,66048,9,9,10,1460,100812,1,1011,303000,475948,0,65700,0,0,0,0,0
disable_time_secs=1682437131 disable_time_usecs=767582 num_inbound_tcp_pkts=371 num_outbound_tcp_pkts=186 total_tcp_pkts=557 num_inbound_skipped_pkts_malloc=0 num_outbound_skipped_pkts_malloc=0 num_inbound_skipped_pkts_tcpcb=0 num_outbound_skipped_pkts_tcpcb=0 num_inbound_skipped_pkts_inpcb=0 num_outbound_skipped_pkts_inpcb=0 total_skipped_tcp_pkts=0 flow_list=10.1.1.2;33817-10.1.1.3;5001,
Reviewers: rscheff, tuexen
Approved by: rscheff, tuexen
Subscribers: imp, melifaro, glebius
Differential Revision: https://reviews.freebsd.org/D39803
2023-04-25 11:52:28 +00:00
|
|
|
pn->rto = tp->t_rxtcur * tick;
|
2010-07-18 05:09:10 +00:00
|
|
|
pn->snd_buf_hiwater = inp->inp_socket->so_snd.sb_hiwat;
|
2014-11-12 09:57:15 +00:00
|
|
|
pn->snd_buf_cc = sbused(&inp->inp_socket->so_snd);
|
2010-07-18 05:09:10 +00:00
|
|
|
pn->rcv_buf_hiwater = inp->inp_socket->so_rcv.sb_hiwat;
|
2014-11-12 09:57:15 +00:00
|
|
|
pn->rcv_buf_cc = sbused(&inp->inp_socket->so_rcv);
|
2010-07-18 05:09:10 +00:00
|
|
|
pn->sent_inflight_bytes = tp->snd_max - tp->snd_una;
|
2010-09-25 09:16:46 +00:00
|
|
|
pn->t_segqlen = tp->t_segqlen;
|
2015-03-18 23:24:25 +00:00
|
|
|
pn->flowid = inp->inp_flowid;
|
2015-03-19 00:23:16 +00:00
|
|
|
pn->flowtype = inp->inp_flowtype;
|
2010-07-18 05:09:10 +00:00
|
|
|
|
|
|
|
/* We've finished accessing the tcb so release the lock. */
|
|
|
|
if (inp_locally_locked)
|
|
|
|
INP_RUNLOCK(inp);
|
|
|
|
|
|
|
|
pn->ipver = ipver;
|
2019-02-01 08:10:26 +00:00
|
|
|
pn->direction = (dir == PFIL_IN ? DIR_IN : DIR_OUT);
|
2010-07-18 05:09:10 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Significantly more accurate than using getmicrotime(), but slower!
|
|
|
|
* Gives true microsecond resolution at the expense of a hit to
|
|
|
|
* maximum pps throughput processing when SIFTR is loaded and enabled.
|
|
|
|
*/
|
|
|
|
microtime(&pn->tval);
|
2015-04-30 17:43:40 +00:00
|
|
|
TCP_PROBE1(siftr, &pn);
|
|
|
|
|
2010-07-18 05:09:10 +00:00
|
|
|
}
|
|
|
|
|
2010-07-03 13:32:39 +00:00
|
|
|
/*
|
|
|
|
* pfil hook that is called for each IPv4 packet making its way through the
|
|
|
|
* stack in either direction.
|
|
|
|
* The pfil subsystem holds a non-sleepable mutex somewhere when
|
|
|
|
* calling our hook function, so we can't sleep at all.
|
|
|
|
* It's very important to use the M_NOWAIT flag with all function calls
|
|
|
|
* that support it so that they won't sleep, otherwise you get a panic.
|
|
|
|
*/
|
New pfil(9) KPI together with newborn pfil API and control utility.
The KPI have been reviewed and cleansed of features that were planned
back 20 years ago and never implemented. The pfil(9) internals have
been made opaque to protocols with only returned types and function
declarations exposed. The KPI is made more strict, but at the same time
more extensible, as kernel uses same command structures that userland
ioctl uses.
In nutshell [KA]PI is about declaring filtering points, declaring
filters and linking and unlinking them together.
New [KA]PI makes it possible to reconfigure pfil(9) configuration:
change order of hooks, rehook filter from one filtering point to a
different one, disconnect a hook on output leaving it on input only,
prepend/append a filter to existing list of filters.
Now it possible for a single packet filter to provide multiple rulesets
that may be linked to different points. Think of per-interface ACLs in
Cisco or Juniper. None of existing packet filters yet support that,
however limited usage is already possible, e.g. default ruleset can
be moved to single interface, as soon as interface would pride their
filtering points.
Another future feature is possiblity to create pfil heads, that provide
not an mbuf pointer but just a memory pointer with length. That would
allow filtering at very early stages of a packet lifecycle, e.g. when
packet has just been received by a NIC and no mbuf was yet allocated.
Differential Revision: https://reviews.freebsd.org/D18951
2019-01-31 23:01:03 +00:00
|
|
|
static pfil_return_t
|
|
|
|
siftr_chkpkt(struct mbuf **m, struct ifnet *ifp, int flags,
|
|
|
|
void *ruleset __unused, struct inpcb *inp)
|
2010-07-03 13:32:39 +00:00
|
|
|
{
|
2010-07-18 05:09:10 +00:00
|
|
|
struct pkt_node *pn;
|
2010-07-03 13:32:39 +00:00
|
|
|
struct ip *ip;
|
|
|
|
struct tcphdr *th;
|
|
|
|
struct tcpcb *tp;
|
|
|
|
struct siftr_stats *ss;
|
|
|
|
unsigned int ip_hl;
|
New pfil(9) KPI together with newborn pfil API and control utility.
The KPI have been reviewed and cleansed of features that were planned
back 20 years ago and never implemented. The pfil(9) internals have
been made opaque to protocols with only returned types and function
declarations exposed. The KPI is made more strict, but at the same time
more extensible, as kernel uses same command structures that userland
ioctl uses.
In nutshell [KA]PI is about declaring filtering points, declaring
filters and linking and unlinking them together.
New [KA]PI makes it possible to reconfigure pfil(9) configuration:
change order of hooks, rehook filter from one filtering point to a
different one, disconnect a hook on output leaving it on input only,
prepend/append a filter to existing list of filters.
Now it possible for a single packet filter to provide multiple rulesets
that may be linked to different points. Think of per-interface ACLs in
Cisco or Juniper. None of existing packet filters yet support that,
however limited usage is already possible, e.g. default ruleset can
be moved to single interface, as soon as interface would pride their
filtering points.
Another future feature is possiblity to create pfil heads, that provide
not an mbuf pointer but just a memory pointer with length. That would
allow filtering at very early stages of a packet lifecycle, e.g. when
packet has just been received by a NIC and no mbuf was yet allocated.
Differential Revision: https://reviews.freebsd.org/D18951
2019-01-31 23:01:03 +00:00
|
|
|
int inp_locally_locked, dir;
|
2010-07-03 13:32:39 +00:00
|
|
|
|
|
|
|
inp_locally_locked = 0;
|
New pfil(9) KPI together with newborn pfil API and control utility.
The KPI have been reviewed and cleansed of features that were planned
back 20 years ago and never implemented. The pfil(9) internals have
been made opaque to protocols with only returned types and function
declarations exposed. The KPI is made more strict, but at the same time
more extensible, as kernel uses same command structures that userland
ioctl uses.
In nutshell [KA]PI is about declaring filtering points, declaring
filters and linking and unlinking them together.
New [KA]PI makes it possible to reconfigure pfil(9) configuration:
change order of hooks, rehook filter from one filtering point to a
different one, disconnect a hook on output leaving it on input only,
prepend/append a filter to existing list of filters.
Now it possible for a single packet filter to provide multiple rulesets
that may be linked to different points. Think of per-interface ACLs in
Cisco or Juniper. None of existing packet filters yet support that,
however limited usage is already possible, e.g. default ruleset can
be moved to single interface, as soon as interface would pride their
filtering points.
Another future feature is possiblity to create pfil heads, that provide
not an mbuf pointer but just a memory pointer with length. That would
allow filtering at very early stages of a packet lifecycle, e.g. when
packet has just been received by a NIC and no mbuf was yet allocated.
Differential Revision: https://reviews.freebsd.org/D18951
2019-01-31 23:01:03 +00:00
|
|
|
dir = PFIL_DIR(flags);
|
2010-07-03 13:32:39 +00:00
|
|
|
ss = DPCPU_PTR(ss);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* m_pullup is not required here because ip_{input|output}
|
|
|
|
* already do the heavy lifting for us.
|
|
|
|
*/
|
|
|
|
|
|
|
|
ip = mtod(*m, struct ip *);
|
|
|
|
|
|
|
|
/* Only continue processing if the packet is TCP. */
|
|
|
|
if (ip->ip_p != IPPROTO_TCP)
|
|
|
|
goto ret;
|
|
|
|
|
2022-10-06 23:31:48 +00:00
|
|
|
/*
|
|
|
|
* Create a tcphdr struct starting at the correct offset
|
|
|
|
* in the IP packet. ip->ip_hl gives the ip header length
|
|
|
|
* in 4-byte words, so multiply it to get the size in bytes.
|
|
|
|
*/
|
|
|
|
ip_hl = (ip->ip_hl << 2);
|
|
|
|
th = (struct tcphdr *)((caddr_t)ip + ip_hl);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Only pkts selected by the tcp port filter
|
|
|
|
* can be inserted into the pkt_queue
|
|
|
|
*/
|
|
|
|
if ((siftr_port_filter != 0) &&
|
|
|
|
(siftr_port_filter != ntohs(th->th_sport)) &&
|
|
|
|
(siftr_port_filter != ntohs(th->th_dport))) {
|
|
|
|
goto ret;
|
|
|
|
}
|
|
|
|
|
2010-07-03 13:32:39 +00:00
|
|
|
/*
|
|
|
|
* If a kernel subsystem reinjects packets into the stack, our pfil
|
|
|
|
* hook will be called multiple times for the same packet.
|
|
|
|
* Make sure we only process unique packets.
|
|
|
|
*/
|
|
|
|
if (siftr_chkreinject(*m, dir, ss))
|
|
|
|
goto ret;
|
|
|
|
|
|
|
|
if (dir == PFIL_IN)
|
|
|
|
ss->n_in++;
|
|
|
|
else
|
|
|
|
ss->n_out++;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* If the pfil hooks don't provide a pointer to the
|
|
|
|
* inpcb, we need to find it ourselves and lock it.
|
|
|
|
*/
|
|
|
|
if (!inp) {
|
|
|
|
/* Find the corresponding inpcb for this pkt. */
|
|
|
|
inp = siftr_findinpcb(INP_IPV4, ip, *m, th->th_sport,
|
|
|
|
th->th_dport, dir, ss);
|
|
|
|
|
|
|
|
if (inp == NULL)
|
|
|
|
goto ret;
|
|
|
|
else
|
|
|
|
inp_locally_locked = 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
INP_LOCK_ASSERT(inp);
|
|
|
|
|
|
|
|
/* Find the TCP control block that corresponds with this packet */
|
|
|
|
tp = intotcpcb(inp);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* If we can't find the TCP control block (happens occasionaly for a
|
2022-10-07 02:22:23 +00:00
|
|
|
* packet sent during the shutdown phase of a TCP connection), bail
|
2010-07-03 13:32:39 +00:00
|
|
|
*/
|
2022-10-07 02:22:23 +00:00
|
|
|
if (tp == NULL) {
|
2010-07-03 13:32:39 +00:00
|
|
|
if (dir == PFIL_IN)
|
|
|
|
ss->nskip_in_tcpcb++;
|
|
|
|
else
|
|
|
|
ss->nskip_out_tcpcb++;
|
|
|
|
|
|
|
|
goto inp_unlock;
|
|
|
|
}
|
|
|
|
|
2019-01-30 17:44:30 +00:00
|
|
|
|
2010-07-18 05:09:10 +00:00
|
|
|
pn = malloc(sizeof(struct pkt_node), M_SIFTR_PKTNODE, M_NOWAIT|M_ZERO);
|
2010-07-03 13:32:39 +00:00
|
|
|
|
2010-07-18 05:09:10 +00:00
|
|
|
if (pn == NULL) {
|
|
|
|
if (dir == PFIL_IN)
|
|
|
|
ss->nskip_in_malloc++;
|
|
|
|
else
|
|
|
|
ss->nskip_out_malloc++;
|
2010-07-03 13:32:39 +00:00
|
|
|
|
2010-07-18 05:09:10 +00:00
|
|
|
goto inp_unlock;
|
|
|
|
}
|
2010-07-03 13:32:39 +00:00
|
|
|
|
2010-07-18 05:09:10 +00:00
|
|
|
siftr_siftdata(pn, inp, tp, INP_IPV4, dir, inp_locally_locked);
|
2010-07-03 13:32:39 +00:00
|
|
|
|
|
|
|
mtx_lock(&siftr_pkt_queue_mtx);
|
2010-07-18 05:09:10 +00:00
|
|
|
STAILQ_INSERT_TAIL(&pkt_queue, pn, nodes);
|
2010-07-03 13:32:39 +00:00
|
|
|
mtx_unlock(&siftr_pkt_queue_mtx);
|
|
|
|
goto ret;
|
|
|
|
|
|
|
|
inp_unlock:
|
|
|
|
if (inp_locally_locked)
|
|
|
|
INP_RUNLOCK(inp);
|
|
|
|
|
|
|
|
ret:
|
New pfil(9) KPI together with newborn pfil API and control utility.
The KPI have been reviewed and cleansed of features that were planned
back 20 years ago and never implemented. The pfil(9) internals have
been made opaque to protocols with only returned types and function
declarations exposed. The KPI is made more strict, but at the same time
more extensible, as kernel uses same command structures that userland
ioctl uses.
In nutshell [KA]PI is about declaring filtering points, declaring
filters and linking and unlinking them together.
New [KA]PI makes it possible to reconfigure pfil(9) configuration:
change order of hooks, rehook filter from one filtering point to a
different one, disconnect a hook on output leaving it on input only,
prepend/append a filter to existing list of filters.
Now it possible for a single packet filter to provide multiple rulesets
that may be linked to different points. Think of per-interface ACLs in
Cisco or Juniper. None of existing packet filters yet support that,
however limited usage is already possible, e.g. default ruleset can
be moved to single interface, as soon as interface would pride their
filtering points.
Another future feature is possiblity to create pfil heads, that provide
not an mbuf pointer but just a memory pointer with length. That would
allow filtering at very early stages of a packet lifecycle, e.g. when
packet has just been received by a NIC and no mbuf was yet allocated.
Differential Revision: https://reviews.freebsd.org/D18951
2019-01-31 23:01:03 +00:00
|
|
|
return (PFIL_PASS);
|
2010-07-03 13:32:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
#ifdef SIFTR_IPV6
|
2021-11-04 00:31:13 +00:00
|
|
|
static pfil_return_t
|
|
|
|
siftr_chkpkt6(struct mbuf **m, struct ifnet *ifp, int flags,
|
|
|
|
void *ruleset __unused, struct inpcb *inp)
|
2010-07-03 13:32:39 +00:00
|
|
|
{
|
2010-07-18 05:09:10 +00:00
|
|
|
struct pkt_node *pn;
|
2010-07-03 13:32:39 +00:00
|
|
|
struct ip6_hdr *ip6;
|
|
|
|
struct tcphdr *th;
|
|
|
|
struct tcpcb *tp;
|
|
|
|
struct siftr_stats *ss;
|
|
|
|
unsigned int ip6_hl;
|
New pfil(9) KPI together with newborn pfil API and control utility.
The KPI have been reviewed and cleansed of features that were planned
back 20 years ago and never implemented. The pfil(9) internals have
been made opaque to protocols with only returned types and function
declarations exposed. The KPI is made more strict, but at the same time
more extensible, as kernel uses same command structures that userland
ioctl uses.
In nutshell [KA]PI is about declaring filtering points, declaring
filters and linking and unlinking them together.
New [KA]PI makes it possible to reconfigure pfil(9) configuration:
change order of hooks, rehook filter from one filtering point to a
different one, disconnect a hook on output leaving it on input only,
prepend/append a filter to existing list of filters.
Now it possible for a single packet filter to provide multiple rulesets
that may be linked to different points. Think of per-interface ACLs in
Cisco or Juniper. None of existing packet filters yet support that,
however limited usage is already possible, e.g. default ruleset can
be moved to single interface, as soon as interface would pride their
filtering points.
Another future feature is possiblity to create pfil heads, that provide
not an mbuf pointer but just a memory pointer with length. That would
allow filtering at very early stages of a packet lifecycle, e.g. when
packet has just been received by a NIC and no mbuf was yet allocated.
Differential Revision: https://reviews.freebsd.org/D18951
2019-01-31 23:01:03 +00:00
|
|
|
int inp_locally_locked, dir;
|
2010-07-03 13:32:39 +00:00
|
|
|
|
|
|
|
inp_locally_locked = 0;
|
New pfil(9) KPI together with newborn pfil API and control utility.
The KPI have been reviewed and cleansed of features that were planned
back 20 years ago and never implemented. The pfil(9) internals have
been made opaque to protocols with only returned types and function
declarations exposed. The KPI is made more strict, but at the same time
more extensible, as kernel uses same command structures that userland
ioctl uses.
In nutshell [KA]PI is about declaring filtering points, declaring
filters and linking and unlinking them together.
New [KA]PI makes it possible to reconfigure pfil(9) configuration:
change order of hooks, rehook filter from one filtering point to a
different one, disconnect a hook on output leaving it on input only,
prepend/append a filter to existing list of filters.
Now it possible for a single packet filter to provide multiple rulesets
that may be linked to different points. Think of per-interface ACLs in
Cisco or Juniper. None of existing packet filters yet support that,
however limited usage is already possible, e.g. default ruleset can
be moved to single interface, as soon as interface would pride their
filtering points.
Another future feature is possiblity to create pfil heads, that provide
not an mbuf pointer but just a memory pointer with length. That would
allow filtering at very early stages of a packet lifecycle, e.g. when
packet has just been received by a NIC and no mbuf was yet allocated.
Differential Revision: https://reviews.freebsd.org/D18951
2019-01-31 23:01:03 +00:00
|
|
|
dir = PFIL_DIR(flags);
|
2010-07-03 13:32:39 +00:00
|
|
|
ss = DPCPU_PTR(ss);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* m_pullup is not required here because ip6_{input|output}
|
|
|
|
* already do the heavy lifting for us.
|
|
|
|
*/
|
|
|
|
|
|
|
|
ip6 = mtod(*m, struct ip6_hdr *);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Only continue processing if the packet is TCP
|
|
|
|
* XXX: We should follow the next header fields
|
|
|
|
* as shown on Pg 6 RFC 2460, but right now we'll
|
|
|
|
* only check pkts that have no extension headers.
|
|
|
|
*/
|
|
|
|
if (ip6->ip6_nxt != IPPROTO_TCP)
|
|
|
|
goto ret6;
|
|
|
|
|
2022-10-06 23:31:48 +00:00
|
|
|
/*
|
|
|
|
* Create a tcphdr struct starting at the correct offset
|
|
|
|
* in the ipv6 packet.
|
|
|
|
*/
|
|
|
|
ip6_hl = sizeof(struct ip6_hdr);
|
|
|
|
th = (struct tcphdr *)((caddr_t)ip6 + ip6_hl);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Only pkts selected by the tcp port filter
|
|
|
|
* can be inserted into the pkt_queue
|
|
|
|
*/
|
|
|
|
if ((siftr_port_filter != 0) &&
|
|
|
|
(siftr_port_filter != ntohs(th->th_sport)) &&
|
|
|
|
(siftr_port_filter != ntohs(th->th_dport))) {
|
|
|
|
goto ret6;
|
|
|
|
}
|
|
|
|
|
2010-07-03 13:32:39 +00:00
|
|
|
/*
|
|
|
|
* If a kernel subsystem reinjects packets into the stack, our pfil
|
|
|
|
* hook will be called multiple times for the same packet.
|
|
|
|
* Make sure we only process unique packets.
|
|
|
|
*/
|
|
|
|
if (siftr_chkreinject(*m, dir, ss))
|
|
|
|
goto ret6;
|
|
|
|
|
|
|
|
if (dir == PFIL_IN)
|
|
|
|
ss->n_in++;
|
|
|
|
else
|
|
|
|
ss->n_out++;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* For inbound packets, the pfil hooks don't provide a pointer to the
|
|
|
|
* inpcb, so we need to find it ourselves and lock it.
|
|
|
|
*/
|
|
|
|
if (!inp) {
|
|
|
|
/* Find the corresponding inpcb for this pkt. */
|
|
|
|
inp = siftr_findinpcb(INP_IPV6, (struct ip *)ip6, *m,
|
|
|
|
th->th_sport, th->th_dport, dir, ss);
|
|
|
|
|
|
|
|
if (inp == NULL)
|
|
|
|
goto ret6;
|
|
|
|
else
|
|
|
|
inp_locally_locked = 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Find the TCP control block that corresponds with this packet. */
|
|
|
|
tp = intotcpcb(inp);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* If we can't find the TCP control block (happens occasionaly for a
|
2022-10-07 02:22:23 +00:00
|
|
|
* packet sent during the shutdown phase of a TCP connection), bail
|
2010-07-03 13:32:39 +00:00
|
|
|
*/
|
2022-10-07 02:22:23 +00:00
|
|
|
if (tp == NULL) {
|
2010-07-03 13:32:39 +00:00
|
|
|
if (dir == PFIL_IN)
|
|
|
|
ss->nskip_in_tcpcb++;
|
|
|
|
else
|
|
|
|
ss->nskip_out_tcpcb++;
|
|
|
|
|
|
|
|
goto inp_unlock6;
|
|
|
|
}
|
|
|
|
|
2019-01-30 17:44:30 +00:00
|
|
|
|
2010-07-18 05:09:10 +00:00
|
|
|
pn = malloc(sizeof(struct pkt_node), M_SIFTR_PKTNODE, M_NOWAIT|M_ZERO);
|
2010-07-03 13:32:39 +00:00
|
|
|
|
2010-07-18 05:09:10 +00:00
|
|
|
if (pn == NULL) {
|
|
|
|
if (dir == PFIL_IN)
|
|
|
|
ss->nskip_in_malloc++;
|
|
|
|
else
|
|
|
|
ss->nskip_out_malloc++;
|
2010-07-03 13:32:39 +00:00
|
|
|
|
2010-07-18 05:09:10 +00:00
|
|
|
goto inp_unlock6;
|
|
|
|
}
|
2010-07-03 13:32:39 +00:00
|
|
|
|
2010-07-18 05:09:10 +00:00
|
|
|
siftr_siftdata(pn, inp, tp, INP_IPV6, dir, inp_locally_locked);
|
2010-07-03 13:32:39 +00:00
|
|
|
|
2010-07-18 05:09:10 +00:00
|
|
|
/* XXX: Figure out how to generate hashes for IPv6 packets. */
|
2010-07-03 13:32:39 +00:00
|
|
|
|
|
|
|
mtx_lock(&siftr_pkt_queue_mtx);
|
2010-07-18 05:09:10 +00:00
|
|
|
STAILQ_INSERT_TAIL(&pkt_queue, pn, nodes);
|
2010-07-03 13:32:39 +00:00
|
|
|
mtx_unlock(&siftr_pkt_queue_mtx);
|
|
|
|
goto ret6;
|
|
|
|
|
|
|
|
inp_unlock6:
|
|
|
|
if (inp_locally_locked)
|
|
|
|
INP_RUNLOCK(inp);
|
|
|
|
|
|
|
|
ret6:
|
2022-09-12 17:05:35 +00:00
|
|
|
return (PFIL_PASS);
|
2010-07-03 13:32:39 +00:00
|
|
|
}
|
|
|
|
#endif /* #ifdef SIFTR_IPV6 */
|
|
|
|
|
New pfil(9) KPI together with newborn pfil API and control utility.
The KPI have been reviewed and cleansed of features that were planned
back 20 years ago and never implemented. The pfil(9) internals have
been made opaque to protocols with only returned types and function
declarations exposed. The KPI is made more strict, but at the same time
more extensible, as kernel uses same command structures that userland
ioctl uses.
In nutshell [KA]PI is about declaring filtering points, declaring
filters and linking and unlinking them together.
New [KA]PI makes it possible to reconfigure pfil(9) configuration:
change order of hooks, rehook filter from one filtering point to a
different one, disconnect a hook on output leaving it on input only,
prepend/append a filter to existing list of filters.
Now it possible for a single packet filter to provide multiple rulesets
that may be linked to different points. Think of per-interface ACLs in
Cisco or Juniper. None of existing packet filters yet support that,
however limited usage is already possible, e.g. default ruleset can
be moved to single interface, as soon as interface would pride their
filtering points.
Another future feature is possiblity to create pfil heads, that provide
not an mbuf pointer but just a memory pointer with length. That would
allow filtering at very early stages of a packet lifecycle, e.g. when
packet has just been received by a NIC and no mbuf was yet allocated.
Differential Revision: https://reviews.freebsd.org/D18951
2019-01-31 23:01:03 +00:00
|
|
|
VNET_DEFINE_STATIC(pfil_hook_t, siftr_inet_hook);
|
|
|
|
#define V_siftr_inet_hook VNET(siftr_inet_hook)
|
2021-11-04 00:31:13 +00:00
|
|
|
#ifdef SIFTR_IPV6
|
New pfil(9) KPI together with newborn pfil API and control utility.
The KPI have been reviewed and cleansed of features that were planned
back 20 years ago and never implemented. The pfil(9) internals have
been made opaque to protocols with only returned types and function
declarations exposed. The KPI is made more strict, but at the same time
more extensible, as kernel uses same command structures that userland
ioctl uses.
In nutshell [KA]PI is about declaring filtering points, declaring
filters and linking and unlinking them together.
New [KA]PI makes it possible to reconfigure pfil(9) configuration:
change order of hooks, rehook filter from one filtering point to a
different one, disconnect a hook on output leaving it on input only,
prepend/append a filter to existing list of filters.
Now it possible for a single packet filter to provide multiple rulesets
that may be linked to different points. Think of per-interface ACLs in
Cisco or Juniper. None of existing packet filters yet support that,
however limited usage is already possible, e.g. default ruleset can
be moved to single interface, as soon as interface would pride their
filtering points.
Another future feature is possiblity to create pfil heads, that provide
not an mbuf pointer but just a memory pointer with length. That would
allow filtering at very early stages of a packet lifecycle, e.g. when
packet has just been received by a NIC and no mbuf was yet allocated.
Differential Revision: https://reviews.freebsd.org/D18951
2019-01-31 23:01:03 +00:00
|
|
|
VNET_DEFINE_STATIC(pfil_hook_t, siftr_inet6_hook);
|
|
|
|
#define V_siftr_inet6_hook VNET(siftr_inet6_hook)
|
|
|
|
#endif
|
2010-07-03 13:32:39 +00:00
|
|
|
static int
|
|
|
|
siftr_pfil(int action)
|
|
|
|
{
|
2023-02-14 18:02:49 +00:00
|
|
|
struct pfil_hook_args pha = {
|
|
|
|
.pa_version = PFIL_VERSION,
|
|
|
|
.pa_flags = PFIL_IN | PFIL_OUT,
|
|
|
|
.pa_modname = "siftr",
|
|
|
|
.pa_rulname = "default",
|
|
|
|
};
|
|
|
|
struct pfil_link_args pla = {
|
|
|
|
.pa_version = PFIL_VERSION,
|
|
|
|
.pa_flags = PFIL_IN | PFIL_OUT | PFIL_HEADPTR | PFIL_HOOKPTR,
|
|
|
|
};
|
New pfil(9) KPI together with newborn pfil API and control utility.
The KPI have been reviewed and cleansed of features that were planned
back 20 years ago and never implemented. The pfil(9) internals have
been made opaque to protocols with only returned types and function
declarations exposed. The KPI is made more strict, but at the same time
more extensible, as kernel uses same command structures that userland
ioctl uses.
In nutshell [KA]PI is about declaring filtering points, declaring
filters and linking and unlinking them together.
New [KA]PI makes it possible to reconfigure pfil(9) configuration:
change order of hooks, rehook filter from one filtering point to a
different one, disconnect a hook on output leaving it on input only,
prepend/append a filter to existing list of filters.
Now it possible for a single packet filter to provide multiple rulesets
that may be linked to different points. Think of per-interface ACLs in
Cisco or Juniper. None of existing packet filters yet support that,
however limited usage is already possible, e.g. default ruleset can
be moved to single interface, as soon as interface would pride their
filtering points.
Another future feature is possiblity to create pfil heads, that provide
not an mbuf pointer but just a memory pointer with length. That would
allow filtering at very early stages of a packet lifecycle, e.g. when
packet has just been received by a NIC and no mbuf was yet allocated.
Differential Revision: https://reviews.freebsd.org/D18951
2019-01-31 23:01:03 +00:00
|
|
|
|
2010-11-20 07:36:43 +00:00
|
|
|
VNET_ITERATOR_DECL(vnet_iter);
|
2010-07-03 13:32:39 +00:00
|
|
|
|
2010-11-20 07:36:43 +00:00
|
|
|
VNET_LIST_RLOCK();
|
|
|
|
VNET_FOREACH(vnet_iter) {
|
|
|
|
CURVNET_SET(vnet_iter);
|
|
|
|
|
|
|
|
if (action == HOOK) {
|
2023-02-14 18:02:49 +00:00
|
|
|
pha.pa_mbuf_chk = siftr_chkpkt;
|
New pfil(9) KPI together with newborn pfil API and control utility.
The KPI have been reviewed and cleansed of features that were planned
back 20 years ago and never implemented. The pfil(9) internals have
been made opaque to protocols with only returned types and function
declarations exposed. The KPI is made more strict, but at the same time
more extensible, as kernel uses same command structures that userland
ioctl uses.
In nutshell [KA]PI is about declaring filtering points, declaring
filters and linking and unlinking them together.
New [KA]PI makes it possible to reconfigure pfil(9) configuration:
change order of hooks, rehook filter from one filtering point to a
different one, disconnect a hook on output leaving it on input only,
prepend/append a filter to existing list of filters.
Now it possible for a single packet filter to provide multiple rulesets
that may be linked to different points. Think of per-interface ACLs in
Cisco or Juniper. None of existing packet filters yet support that,
however limited usage is already possible, e.g. default ruleset can
be moved to single interface, as soon as interface would pride their
filtering points.
Another future feature is possiblity to create pfil heads, that provide
not an mbuf pointer but just a memory pointer with length. That would
allow filtering at very early stages of a packet lifecycle, e.g. when
packet has just been received by a NIC and no mbuf was yet allocated.
Differential Revision: https://reviews.freebsd.org/D18951
2019-01-31 23:01:03 +00:00
|
|
|
pha.pa_type = PFIL_TYPE_IP4;
|
|
|
|
V_siftr_inet_hook = pfil_add_hook(&pha);
|
|
|
|
pla.pa_hook = V_siftr_inet_hook;
|
|
|
|
pla.pa_head = V_inet_pfil_head;
|
|
|
|
(void)pfil_link(&pla);
|
2010-11-20 07:36:43 +00:00
|
|
|
#ifdef SIFTR_IPV6
|
2023-02-14 18:02:49 +00:00
|
|
|
pha.pa_mbuf_chk = siftr_chkpkt6;
|
New pfil(9) KPI together with newborn pfil API and control utility.
The KPI have been reviewed and cleansed of features that were planned
back 20 years ago and never implemented. The pfil(9) internals have
been made opaque to protocols with only returned types and function
declarations exposed. The KPI is made more strict, but at the same time
more extensible, as kernel uses same command structures that userland
ioctl uses.
In nutshell [KA]PI is about declaring filtering points, declaring
filters and linking and unlinking them together.
New [KA]PI makes it possible to reconfigure pfil(9) configuration:
change order of hooks, rehook filter from one filtering point to a
different one, disconnect a hook on output leaving it on input only,
prepend/append a filter to existing list of filters.
Now it possible for a single packet filter to provide multiple rulesets
that may be linked to different points. Think of per-interface ACLs in
Cisco or Juniper. None of existing packet filters yet support that,
however limited usage is already possible, e.g. default ruleset can
be moved to single interface, as soon as interface would pride their
filtering points.
Another future feature is possiblity to create pfil heads, that provide
not an mbuf pointer but just a memory pointer with length. That would
allow filtering at very early stages of a packet lifecycle, e.g. when
packet has just been received by a NIC and no mbuf was yet allocated.
Differential Revision: https://reviews.freebsd.org/D18951
2019-01-31 23:01:03 +00:00
|
|
|
pha.pa_type = PFIL_TYPE_IP6;
|
|
|
|
V_siftr_inet6_hook = pfil_add_hook(&pha);
|
|
|
|
pla.pa_hook = V_siftr_inet6_hook;
|
|
|
|
pla.pa_head = V_inet6_pfil_head;
|
|
|
|
(void)pfil_link(&pla);
|
2010-11-20 07:36:43 +00:00
|
|
|
#endif
|
|
|
|
} else if (action == UNHOOK) {
|
New pfil(9) KPI together with newborn pfil API and control utility.
The KPI have been reviewed and cleansed of features that were planned
back 20 years ago and never implemented. The pfil(9) internals have
been made opaque to protocols with only returned types and function
declarations exposed. The KPI is made more strict, but at the same time
more extensible, as kernel uses same command structures that userland
ioctl uses.
In nutshell [KA]PI is about declaring filtering points, declaring
filters and linking and unlinking them together.
New [KA]PI makes it possible to reconfigure pfil(9) configuration:
change order of hooks, rehook filter from one filtering point to a
different one, disconnect a hook on output leaving it on input only,
prepend/append a filter to existing list of filters.
Now it possible for a single packet filter to provide multiple rulesets
that may be linked to different points. Think of per-interface ACLs in
Cisco or Juniper. None of existing packet filters yet support that,
however limited usage is already possible, e.g. default ruleset can
be moved to single interface, as soon as interface would pride their
filtering points.
Another future feature is possiblity to create pfil heads, that provide
not an mbuf pointer but just a memory pointer with length. That would
allow filtering at very early stages of a packet lifecycle, e.g. when
packet has just been received by a NIC and no mbuf was yet allocated.
Differential Revision: https://reviews.freebsd.org/D18951
2019-01-31 23:01:03 +00:00
|
|
|
pfil_remove_hook(V_siftr_inet_hook);
|
2010-07-03 13:32:39 +00:00
|
|
|
#ifdef SIFTR_IPV6
|
New pfil(9) KPI together with newborn pfil API and control utility.
The KPI have been reviewed and cleansed of features that were planned
back 20 years ago and never implemented. The pfil(9) internals have
been made opaque to protocols with only returned types and function
declarations exposed. The KPI is made more strict, but at the same time
more extensible, as kernel uses same command structures that userland
ioctl uses.
In nutshell [KA]PI is about declaring filtering points, declaring
filters and linking and unlinking them together.
New [KA]PI makes it possible to reconfigure pfil(9) configuration:
change order of hooks, rehook filter from one filtering point to a
different one, disconnect a hook on output leaving it on input only,
prepend/append a filter to existing list of filters.
Now it possible for a single packet filter to provide multiple rulesets
that may be linked to different points. Think of per-interface ACLs in
Cisco or Juniper. None of existing packet filters yet support that,
however limited usage is already possible, e.g. default ruleset can
be moved to single interface, as soon as interface would pride their
filtering points.
Another future feature is possiblity to create pfil heads, that provide
not an mbuf pointer but just a memory pointer with length. That would
allow filtering at very early stages of a packet lifecycle, e.g. when
packet has just been received by a NIC and no mbuf was yet allocated.
Differential Revision: https://reviews.freebsd.org/D18951
2019-01-31 23:01:03 +00:00
|
|
|
pfil_remove_hook(V_siftr_inet6_hook);
|
2010-07-03 13:32:39 +00:00
|
|
|
#endif
|
2010-11-20 07:36:43 +00:00
|
|
|
}
|
|
|
|
CURVNET_RESTORE();
|
2010-07-03 13:32:39 +00:00
|
|
|
}
|
2010-11-20 07:36:43 +00:00
|
|
|
VNET_LIST_RUNLOCK();
|
2010-07-03 13:32:39 +00:00
|
|
|
|
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
siftr_sysctl_logfile_name_handler(SYSCTL_HANDLER_ARGS)
|
|
|
|
{
|
|
|
|
struct alq *new_alq;
|
|
|
|
int error;
|
|
|
|
|
2014-10-28 12:00:39 +00:00
|
|
|
error = sysctl_handle_string(oidp, arg1, arg2, req);
|
2010-07-03 13:32:39 +00:00
|
|
|
|
2014-10-28 12:00:39 +00:00
|
|
|
/* Check for error or same filename */
|
|
|
|
if (error != 0 || req->newptr == NULL ||
|
|
|
|
strncmp(siftr_logfile, arg1, arg2) == 0)
|
|
|
|
goto done;
|
2010-07-03 13:32:39 +00:00
|
|
|
|
2014-10-28 12:00:39 +00:00
|
|
|
/* Filname changed */
|
|
|
|
error = alq_open(&new_alq, arg1, curthread->td_ucred,
|
|
|
|
SIFTR_LOG_FILE_MODE, SIFTR_ALQ_BUFLEN, 0);
|
|
|
|
if (error != 0)
|
|
|
|
goto done;
|
2010-07-03 13:32:39 +00:00
|
|
|
|
2014-10-28 12:00:39 +00:00
|
|
|
/*
|
|
|
|
* If disabled, siftr_alq == NULL so we simply close
|
|
|
|
* the alq as we've proved it can be opened.
|
|
|
|
* If enabled, close the existing alq and switch the old
|
|
|
|
* for the new.
|
|
|
|
*/
|
|
|
|
if (siftr_alq == NULL) {
|
|
|
|
alq_close(new_alq);
|
|
|
|
} else {
|
|
|
|
alq_close(siftr_alq);
|
|
|
|
siftr_alq = new_alq;
|
2010-07-03 13:32:39 +00:00
|
|
|
}
|
|
|
|
|
2014-10-28 12:00:39 +00:00
|
|
|
/* Update filename upon success */
|
|
|
|
strlcpy(siftr_logfile, arg1, arg2);
|
|
|
|
done:
|
|
|
|
return (error);
|
2010-07-03 13:32:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
siftr_manage_ops(uint8_t action)
|
|
|
|
{
|
|
|
|
struct siftr_stats totalss;
|
|
|
|
struct timeval tval;
|
|
|
|
struct flow_hash_node *counter, *tmp_counter;
|
|
|
|
struct sbuf *s;
|
2018-05-19 05:56:21 +00:00
|
|
|
int i, key_index, error;
|
2010-07-03 13:32:39 +00:00
|
|
|
uint32_t bytes_to_write, total_skipped_pkts;
|
|
|
|
uint16_t lport, fport;
|
2018-05-19 05:56:21 +00:00
|
|
|
uint8_t *key, ipver __unused;
|
2010-07-03 13:32:39 +00:00
|
|
|
|
|
|
|
#ifdef SIFTR_IPV6
|
|
|
|
uint32_t laddr[4];
|
|
|
|
uint32_t faddr[4];
|
|
|
|
#else
|
|
|
|
uint8_t laddr[4];
|
|
|
|
uint8_t faddr[4];
|
|
|
|
#endif
|
|
|
|
|
|
|
|
error = 0;
|
|
|
|
total_skipped_pkts = 0;
|
|
|
|
|
|
|
|
/* Init an autosizing sbuf that initially holds 200 chars. */
|
|
|
|
if ((s = sbuf_new(NULL, NULL, 200, SBUF_AUTOEXTEND)) == NULL)
|
|
|
|
return (-1);
|
|
|
|
|
2019-01-18 21:46:38 +00:00
|
|
|
if (action == SIFTR_ENABLE && siftr_pkt_manager_thr == NULL) {
|
2010-07-03 13:32:39 +00:00
|
|
|
/*
|
|
|
|
* Create our alq
|
|
|
|
* XXX: We should abort if alq_open fails!
|
|
|
|
*/
|
|
|
|
alq_open(&siftr_alq, siftr_logfile, curthread->td_ucred,
|
|
|
|
SIFTR_LOG_FILE_MODE, SIFTR_ALQ_BUFLEN, 0);
|
|
|
|
|
|
|
|
STAILQ_INIT(&pkt_queue);
|
|
|
|
|
2010-07-13 08:23:46 +00:00
|
|
|
DPCPU_ZERO(ss);
|
|
|
|
|
2010-07-03 13:32:39 +00:00
|
|
|
siftr_exit_pkt_manager_thread = 0;
|
|
|
|
|
2018-05-19 05:56:21 +00:00
|
|
|
kthread_add(&siftr_pkt_manager_thread, NULL, NULL,
|
2010-07-03 13:32:39 +00:00
|
|
|
&siftr_pkt_manager_thr, RFNOWAIT, 0,
|
|
|
|
"siftr_pkt_manager_thr");
|
|
|
|
|
|
|
|
siftr_pfil(HOOK);
|
|
|
|
|
|
|
|
microtime(&tval);
|
|
|
|
|
|
|
|
sbuf_printf(s,
|
|
|
|
"enable_time_secs=%jd\tenable_time_usecs=%06ld\t"
|
Change the unit of srtt and rto to usec, inspired by these in struct "tcp_info". Therefore, no need hz and tcp_rtt_scale in the headline of the log. Update the man page as well.
Summary: Simplify srtt and rto values in siftr log.
Test Plan:
Tested in Emulab testbed:
cc@s1:~ % sudo sysctl net.inet.siftr
net.inet.siftr.port_filter: 0
net.inet.siftr.genhashes: 0
net.inet.siftr.ppl: 1
net.inet.siftr.logfile: /var/log/siftr.log
net.inet.siftr.enabled: 0
cc@s1:~ % sudo sysctl net.inet.siftr.port_filter=5001
net.inet.siftr.port_filter: 0 -> 5001
cc@s1:~ % sudo sysctl net.inet.siftr.enabled=1
net.inet.siftr.enabled: 0 -> 1
cc@s1:~ %
cc@s1:~ % iperf -c r1 -n 1M
------------------------------------------------------------
Client connecting to r1, TCP port 5001
TCP window size: 32.0 KByte (default)
------------------------------------------------------------
[ 1] local 10.1.1.2 port 33817 connected with 10.1.1.3 port 5001
[ ID] Interval Transfer Bandwidth
[ 1] 0.00-0.91 sec 1.00 MBytes 9.22 Mbits/sec
cc@s1:~ % sudo sysctl net.inet.siftr.enabled=0
net.inet.siftr.enabled: 1 -> 0
cc@s1:~ % ll /var/log/siftr.log
-rw-r--r-- 1 root wheel 91K Apr 25 09:38 /var/log/siftr.log
cc@s1:~ % cat /var/log/siftr.log
enable_time_secs=1682437111 enable_time_usecs=121115 siftrver=1.3.0 sysname=FreeBSD sysver=1400088 ipmode=4
o,0x00000000,1682437125.907343,10.1.1.2,33817,10.1.1.3,5001,1073725440,1073725440,2,0,0,0,0,2,536,0,1,672,1000000,32768,0,65536,0,0,0,0,0
i,0x00000000,1682437126.106759,10.1.1.2,33817,10.1.1.3,5001,1073725440,1073725440,2,0,0,0,0,2,536,0,1,672,1000000,32768,0,65536,0,1,0,0,0
o,0x00000000,1682437126.106767,10.1.1.2,33817,10.1.1.3,5001,1073725440,14480,2,65535,65700,9,9,4,1460,201000,1,16778209,803000,33580,0,65700,0,0,0,0,0
o,0x00000000,1682437126.107141,10.1.1.2,33817,10.1.1.3,5001,1073725440,14480,2,65535,65700,9,9,4,1460,201000,1,16778208,803000,33580,60,65700,0,0,0,0,0
...
i,0x00000000,1682437127.016754,10.1.1.2,33817,10.1.1.3,5001,1073725440,606109,1030,748544,66048,9,9,9,1460,100812,1,1008,303000,475948,0,65700,0,0,0,0,0
o,0x00000000,1682437127.016759,10.1.1.2,33817,10.1.1.3,5001,1073725440,606109,1030,748544,66048,9,9,10,1460,100812,1,1011,303000,475948,0,65700,0,0,0,0,0
disable_time_secs=1682437131 disable_time_usecs=767582 num_inbound_tcp_pkts=371 num_outbound_tcp_pkts=186 total_tcp_pkts=557 num_inbound_skipped_pkts_malloc=0 num_outbound_skipped_pkts_malloc=0 num_inbound_skipped_pkts_tcpcb=0 num_outbound_skipped_pkts_tcpcb=0 num_inbound_skipped_pkts_inpcb=0 num_outbound_skipped_pkts_inpcb=0 total_skipped_tcp_pkts=0 flow_list=10.1.1.2;33817-10.1.1.3;5001,
Reviewers: rscheff, tuexen
Approved by: rscheff, tuexen
Subscribers: imp, melifaro, glebius
Differential Revision: https://reviews.freebsd.org/D39803
2023-04-25 11:52:28 +00:00
|
|
|
"siftrver=%s\tsysname=%s\tsysver=%u\tipmode=%u\n",
|
|
|
|
(intmax_t)tval.tv_sec, tval.tv_usec, MODVERSION_STR,
|
|
|
|
SYS_NAME, __FreeBSD_version, SIFTR_IPMODE);
|
2010-07-03 13:32:39 +00:00
|
|
|
|
|
|
|
sbuf_finish(s);
|
|
|
|
alq_writen(siftr_alq, sbuf_data(s), sbuf_len(s), ALQ_WAITOK);
|
|
|
|
|
|
|
|
} else if (action == SIFTR_DISABLE && siftr_pkt_manager_thr != NULL) {
|
|
|
|
/*
|
|
|
|
* Remove the pfil hook functions. All threads currently in
|
|
|
|
* the hook functions are allowed to exit before siftr_pfil()
|
|
|
|
* returns.
|
|
|
|
*/
|
|
|
|
siftr_pfil(UNHOOK);
|
|
|
|
|
|
|
|
/* This will block until the pkt manager thread unlocks it. */
|
|
|
|
mtx_lock(&siftr_pkt_mgr_mtx);
|
|
|
|
|
|
|
|
/* Tell the pkt manager thread that it should exit now. */
|
|
|
|
siftr_exit_pkt_manager_thread = 1;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Wake the pkt_manager thread so it realises that
|
|
|
|
* siftr_exit_pkt_manager_thread == 1 and exits gracefully.
|
|
|
|
* The wakeup won't be delivered until we unlock
|
|
|
|
* siftr_pkt_mgr_mtx so this isn't racy.
|
|
|
|
*/
|
|
|
|
wakeup(&wait_for_pkt);
|
|
|
|
|
|
|
|
/* Wait for the pkt_manager thread to exit. */
|
|
|
|
mtx_sleep(siftr_pkt_manager_thr, &siftr_pkt_mgr_mtx, PWAIT,
|
|
|
|
"thrwait", 0);
|
|
|
|
|
|
|
|
siftr_pkt_manager_thr = NULL;
|
|
|
|
mtx_unlock(&siftr_pkt_mgr_mtx);
|
|
|
|
|
2010-07-13 07:00:57 +00:00
|
|
|
totalss.n_in = DPCPU_VARSUM(ss, n_in);
|
|
|
|
totalss.n_out = DPCPU_VARSUM(ss, n_out);
|
|
|
|
totalss.nskip_in_malloc = DPCPU_VARSUM(ss, nskip_in_malloc);
|
|
|
|
totalss.nskip_out_malloc = DPCPU_VARSUM(ss, nskip_out_malloc);
|
|
|
|
totalss.nskip_in_tcpcb = DPCPU_VARSUM(ss, nskip_in_tcpcb);
|
|
|
|
totalss.nskip_out_tcpcb = DPCPU_VARSUM(ss, nskip_out_tcpcb);
|
|
|
|
totalss.nskip_in_inpcb = DPCPU_VARSUM(ss, nskip_in_inpcb);
|
|
|
|
totalss.nskip_out_inpcb = DPCPU_VARSUM(ss, nskip_out_inpcb);
|
2010-07-03 13:32:39 +00:00
|
|
|
|
|
|
|
total_skipped_pkts = totalss.nskip_in_malloc +
|
2023-04-24 07:45:47 +00:00
|
|
|
totalss.nskip_out_malloc + totalss.nskip_in_tcpcb +
|
2010-07-03 13:32:39 +00:00
|
|
|
totalss.nskip_out_tcpcb + totalss.nskip_in_inpcb +
|
|
|
|
totalss.nskip_out_inpcb;
|
|
|
|
|
|
|
|
microtime(&tval);
|
|
|
|
|
|
|
|
sbuf_printf(s,
|
|
|
|
"disable_time_secs=%jd\tdisable_time_usecs=%06ld\t"
|
|
|
|
"num_inbound_tcp_pkts=%ju\tnum_outbound_tcp_pkts=%ju\t"
|
|
|
|
"total_tcp_pkts=%ju\tnum_inbound_skipped_pkts_malloc=%u\t"
|
|
|
|
"num_outbound_skipped_pkts_malloc=%u\t"
|
|
|
|
"num_inbound_skipped_pkts_tcpcb=%u\t"
|
|
|
|
"num_outbound_skipped_pkts_tcpcb=%u\t"
|
|
|
|
"num_inbound_skipped_pkts_inpcb=%u\t"
|
|
|
|
"num_outbound_skipped_pkts_inpcb=%u\t"
|
|
|
|
"total_skipped_tcp_pkts=%u\tflow_list=",
|
|
|
|
(intmax_t)tval.tv_sec,
|
|
|
|
tval.tv_usec,
|
|
|
|
(uintmax_t)totalss.n_in,
|
|
|
|
(uintmax_t)totalss.n_out,
|
|
|
|
(uintmax_t)(totalss.n_in + totalss.n_out),
|
|
|
|
totalss.nskip_in_malloc,
|
|
|
|
totalss.nskip_out_malloc,
|
|
|
|
totalss.nskip_in_tcpcb,
|
|
|
|
totalss.nskip_out_tcpcb,
|
|
|
|
totalss.nskip_in_inpcb,
|
|
|
|
totalss.nskip_out_inpcb,
|
|
|
|
total_skipped_pkts);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Iterate over the flow hash, printing a summary of each
|
|
|
|
* flow seen and freeing any malloc'd memory.
|
|
|
|
* The hash consists of an array of LISTs (man 3 queue).
|
|
|
|
*/
|
2013-03-07 04:42:20 +00:00
|
|
|
for (i = 0; i <= siftr_hashmask; i++) {
|
2010-07-03 13:32:39 +00:00
|
|
|
LIST_FOREACH_SAFE(counter, counter_hash + i, nodes,
|
|
|
|
tmp_counter) {
|
|
|
|
key = counter->key;
|
|
|
|
key_index = 1;
|
|
|
|
|
|
|
|
ipver = key[0];
|
|
|
|
|
|
|
|
memcpy(laddr, key + key_index, sizeof(laddr));
|
|
|
|
key_index += sizeof(laddr);
|
|
|
|
memcpy(&lport, key + key_index, sizeof(lport));
|
|
|
|
key_index += sizeof(lport);
|
|
|
|
memcpy(faddr, key + key_index, sizeof(faddr));
|
|
|
|
key_index += sizeof(faddr);
|
|
|
|
memcpy(&fport, key + key_index, sizeof(fport));
|
|
|
|
|
|
|
|
#ifdef SIFTR_IPV6
|
|
|
|
laddr[3] = ntohl(laddr[3]);
|
|
|
|
faddr[3] = ntohl(faddr[3]);
|
|
|
|
|
|
|
|
if (ipver == INP_IPV6) {
|
|
|
|
laddr[0] = ntohl(laddr[0]);
|
|
|
|
laddr[1] = ntohl(laddr[1]);
|
|
|
|
laddr[2] = ntohl(laddr[2]);
|
|
|
|
faddr[0] = ntohl(faddr[0]);
|
|
|
|
faddr[1] = ntohl(faddr[1]);
|
|
|
|
faddr[2] = ntohl(faddr[2]);
|
|
|
|
|
|
|
|
sbuf_printf(s,
|
|
|
|
"%x:%x:%x:%x:%x:%x:%x:%x;%u-"
|
|
|
|
"%x:%x:%x:%x:%x:%x:%x:%x;%u,",
|
|
|
|
UPPER_SHORT(laddr[0]),
|
|
|
|
LOWER_SHORT(laddr[0]),
|
|
|
|
UPPER_SHORT(laddr[1]),
|
|
|
|
LOWER_SHORT(laddr[1]),
|
|
|
|
UPPER_SHORT(laddr[2]),
|
|
|
|
LOWER_SHORT(laddr[2]),
|
|
|
|
UPPER_SHORT(laddr[3]),
|
|
|
|
LOWER_SHORT(laddr[3]),
|
|
|
|
ntohs(lport),
|
|
|
|
UPPER_SHORT(faddr[0]),
|
|
|
|
LOWER_SHORT(faddr[0]),
|
|
|
|
UPPER_SHORT(faddr[1]),
|
|
|
|
LOWER_SHORT(faddr[1]),
|
|
|
|
UPPER_SHORT(faddr[2]),
|
|
|
|
LOWER_SHORT(faddr[2]),
|
|
|
|
UPPER_SHORT(faddr[3]),
|
|
|
|
LOWER_SHORT(faddr[3]),
|
|
|
|
ntohs(fport));
|
|
|
|
} else {
|
|
|
|
laddr[0] = FIRST_OCTET(laddr[3]);
|
|
|
|
laddr[1] = SECOND_OCTET(laddr[3]);
|
|
|
|
laddr[2] = THIRD_OCTET(laddr[3]);
|
|
|
|
laddr[3] = FOURTH_OCTET(laddr[3]);
|
|
|
|
faddr[0] = FIRST_OCTET(faddr[3]);
|
|
|
|
faddr[1] = SECOND_OCTET(faddr[3]);
|
|
|
|
faddr[2] = THIRD_OCTET(faddr[3]);
|
|
|
|
faddr[3] = FOURTH_OCTET(faddr[3]);
|
|
|
|
#endif
|
|
|
|
sbuf_printf(s,
|
|
|
|
"%u.%u.%u.%u;%u-%u.%u.%u.%u;%u,",
|
|
|
|
laddr[0],
|
|
|
|
laddr[1],
|
|
|
|
laddr[2],
|
|
|
|
laddr[3],
|
|
|
|
ntohs(lport),
|
|
|
|
faddr[0],
|
|
|
|
faddr[1],
|
|
|
|
faddr[2],
|
|
|
|
faddr[3],
|
|
|
|
ntohs(fport));
|
|
|
|
#ifdef SIFTR_IPV6
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
free(counter, M_SIFTR_HASHNODE);
|
|
|
|
}
|
|
|
|
|
|
|
|
LIST_INIT(counter_hash + i);
|
|
|
|
}
|
|
|
|
|
|
|
|
sbuf_printf(s, "\n");
|
|
|
|
sbuf_finish(s);
|
|
|
|
|
|
|
|
i = 0;
|
|
|
|
do {
|
|
|
|
bytes_to_write = min(SIFTR_ALQ_BUFLEN, sbuf_len(s)-i);
|
|
|
|
alq_writen(siftr_alq, sbuf_data(s)+i, bytes_to_write, ALQ_WAITOK);
|
|
|
|
i += bytes_to_write;
|
|
|
|
} while (i < sbuf_len(s));
|
|
|
|
|
|
|
|
alq_close(siftr_alq);
|
|
|
|
siftr_alq = NULL;
|
2019-01-18 21:46:38 +00:00
|
|
|
} else
|
|
|
|
error = EINVAL;
|
2010-07-03 13:32:39 +00:00
|
|
|
|
|
|
|
sbuf_delete(s);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* XXX: Should be using ret to check if any functions fail
|
|
|
|
* and set error appropriately
|
|
|
|
*/
|
|
|
|
|
|
|
|
return (error);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
siftr_sysctl_enabled_handler(SYSCTL_HANDLER_ARGS)
|
|
|
|
{
|
2018-12-15 15:06:22 +00:00
|
|
|
int error;
|
|
|
|
uint32_t new;
|
|
|
|
|
|
|
|
new = siftr_enabled;
|
|
|
|
error = sysctl_handle_int(oidp, &new, 0, req);
|
2019-01-18 21:46:38 +00:00
|
|
|
if (error == 0 && req->newptr != NULL) {
|
2018-12-15 15:06:22 +00:00
|
|
|
if (new > 1)
|
|
|
|
return (EINVAL);
|
|
|
|
else if (new != siftr_enabled) {
|
2019-01-18 21:46:38 +00:00
|
|
|
if ((error = siftr_manage_ops(new)) == 0) {
|
|
|
|
siftr_enabled = new;
|
|
|
|
} else {
|
2018-12-15 15:06:22 +00:00
|
|
|
siftr_manage_ops(SIFTR_DISABLE);
|
2019-01-18 21:46:38 +00:00
|
|
|
}
|
2010-07-03 13:32:39 +00:00
|
|
|
}
|
2018-12-15 15:06:22 +00:00
|
|
|
}
|
2010-07-03 13:32:39 +00:00
|
|
|
|
2018-12-15 15:06:22 +00:00
|
|
|
return (error);
|
2010-07-03 13:32:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
siftr_shutdown_handler(void *arg)
|
|
|
|
{
|
2019-01-18 21:46:38 +00:00
|
|
|
if (siftr_enabled == 1) {
|
|
|
|
siftr_manage_ops(SIFTR_DISABLE);
|
|
|
|
}
|
2010-07-03 13:32:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Module is being unloaded or machine is shutting down. Take care of cleanup.
|
|
|
|
*/
|
|
|
|
static int
|
|
|
|
deinit_siftr(void)
|
|
|
|
{
|
|
|
|
/* Cleanup. */
|
|
|
|
siftr_manage_ops(SIFTR_DISABLE);
|
|
|
|
hashdestroy(counter_hash, M_SIFTR, siftr_hashmask);
|
|
|
|
mtx_destroy(&siftr_pkt_queue_mtx);
|
|
|
|
mtx_destroy(&siftr_pkt_mgr_mtx);
|
|
|
|
|
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Module has just been loaded into the kernel.
|
|
|
|
*/
|
|
|
|
static int
|
|
|
|
init_siftr(void)
|
|
|
|
{
|
|
|
|
EVENTHANDLER_REGISTER(shutdown_pre_sync, siftr_shutdown_handler, NULL,
|
|
|
|
SHUTDOWN_PRI_FIRST);
|
|
|
|
|
|
|
|
/* Initialise our flow counter hash table. */
|
|
|
|
counter_hash = hashinit(SIFTR_EXPECTED_MAX_TCP_FLOWS, M_SIFTR,
|
|
|
|
&siftr_hashmask);
|
|
|
|
|
|
|
|
mtx_init(&siftr_pkt_queue_mtx, "siftr_pkt_queue_mtx", NULL, MTX_DEF);
|
|
|
|
mtx_init(&siftr_pkt_mgr_mtx, "siftr_pkt_mgr_mtx", NULL, MTX_DEF);
|
|
|
|
|
|
|
|
/* Print message to the user's current terminal. */
|
|
|
|
uprintf("\nStatistical Information For TCP Research (SIFTR) %s\n"
|
|
|
|
" http://caia.swin.edu.au/urp/newtcp\n\n",
|
|
|
|
MODVERSION_STR);
|
|
|
|
|
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* This is the function that is called to load and unload the module.
|
|
|
|
* When the module is loaded, this function is called once with
|
|
|
|
* "what" == MOD_LOAD
|
|
|
|
* When the module is unloaded, this function is called twice with
|
|
|
|
* "what" = MOD_QUIESCE first, followed by "what" = MOD_UNLOAD second
|
|
|
|
* When the system is shut down e.g. CTRL-ALT-DEL or using the shutdown command,
|
|
|
|
* this function is called once with "what" = MOD_SHUTDOWN
|
|
|
|
* When the system is shut down, the handler isn't called until the very end
|
|
|
|
* of the shutdown sequence i.e. after the disks have been synced.
|
|
|
|
*/
|
|
|
|
static int
|
|
|
|
siftr_load_handler(module_t mod, int what, void *arg)
|
|
|
|
{
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
switch (what) {
|
|
|
|
case MOD_LOAD:
|
|
|
|
ret = init_siftr();
|
|
|
|
break;
|
|
|
|
|
|
|
|
case MOD_QUIESCE:
|
|
|
|
case MOD_SHUTDOWN:
|
|
|
|
ret = deinit_siftr();
|
|
|
|
break;
|
|
|
|
|
|
|
|
case MOD_UNLOAD:
|
|
|
|
ret = 0;
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
ret = EINVAL;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
return (ret);
|
|
|
|
}
|
|
|
|
|
|
|
|
static moduledata_t siftr_mod = {
|
|
|
|
.name = "siftr",
|
|
|
|
.evhand = siftr_load_handler,
|
|
|
|
};
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Param 1: name of the kernel module
|
|
|
|
* Param 2: moduledata_t struct containing info about the kernel module
|
|
|
|
* and the execution entry point for the module
|
|
|
|
* Param 3: From sysinit_sub_id enumeration in /usr/include/sys/kernel.h
|
|
|
|
* Defines the module initialisation order
|
|
|
|
* Param 4: From sysinit_elem_order enumeration in /usr/include/sys/kernel.h
|
|
|
|
* Defines the initialisation order of this kld relative to others
|
|
|
|
* within the same subsystem as defined by param 3
|
|
|
|
*/
|
2016-03-11 23:18:06 +00:00
|
|
|
DECLARE_MODULE(siftr, siftr_mod, SI_SUB_LAST, SI_ORDER_ANY);
|
2010-07-03 13:32:39 +00:00
|
|
|
MODULE_DEPEND(siftr, alq, 1, 1, 1);
|
|
|
|
MODULE_VERSION(siftr, MODVERSION);
|