d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add new ICMPv6 counters for Anti-DoS limits.

Browse Source 
Add four new counters for ND6 related Anti-DoS measures.
We split these out into a separate upfront commit so that we only
change the struct size one time.  Implementations using them will
follow.

PR:		157410
Reviewed by:	melifaro
MFC after:	2 weeks
X-MFC:		cannot really MFC this without breaking netstat
Sponsored by:	Netflix (initially)
Differential Revision:	https://reviews.freebsd.org/D22711
This commit is contained in:
Bjoern A. Zeeb 2020-03-04 16:20:59 +00:00
parent c8cea9f5b7
commit d2b8fd0da1
2 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/netinet/icmp6.h
View File

@ -635,6 +635,10 @@ struct icmp6stat {
uint64_t icp6s_badrs; /* bad router solicitation */
uint64_t icp6s_badra; /* bad router advertisement */
uint64_t icp6s_badredirect; /* bad redirect message */
uint64_t icp6s_overflowdefrtr; /* Too many default routers. */
uint64_t icp6s_overflowprfx; /* Too many prefixes. */
uint64_t icp6s_overflownndp; /* Too many neighbour entries. */
uint64_t icp6s_overflowredirect;/* Too many redirects. */
};
#ifdef _KERNEL

8
usr.bin/netstat/inet6.c
View File

@ -1055,6 +1055,14 @@ icmp6_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
"{N:/bad router advertisement message%s}\n");
p(icp6s_badredirect, "\t{:bad-redirect/%ju} "
"{N:/bad redirect message%s}\n");
p(icp6s_overflowdefrtr, "\t{:default-routers-overflows/%ju} "
"{N:/default routers overflow%s}\n");
p(icp6s_overflowprfx, "\t{:prefixes-overflows/%ju} "
"{N:/prefix overflow%s}\n");
p(icp6s_overflownndp, "\t{:neighbour-entries-overflows/%ju} "
"{N:/neighbour entries overflow%s}\n");
p(icp6s_overflowredirect, "\t{:redirect-overflows/%ju} "
"{N:/redirect overflow%s}\n");
xo_close_container("errors");
p(icp6s_pmtuchg, "\t{:path-mtu-changes/%ju} {N:/path MTU change%s}\n");
#undef p