Fix issue with updating IPv6 client stats and rename map names.
This commit is contained in:
@@ -155,49 +155,49 @@ int main(int argc, char *argv[])
|
|||||||
LogMsg(&cfg, 2, 0, "Retrieving BPF map FDs...");
|
LogMsg(&cfg, 2, 0, "Retrieving BPF map FDs...");
|
||||||
|
|
||||||
// Retrieve BPF maps.
|
// Retrieve BPF maps.
|
||||||
int filters_map = FindMapFd(prog, "filters_map");
|
int map_filters = FindMapFd(prog, "map_filters");
|
||||||
|
|
||||||
// Check for valid maps.
|
// Check for valid maps.
|
||||||
if (filters_map < 0)
|
if (map_filters < 0)
|
||||||
{
|
{
|
||||||
LogMsg(&cfg, 0, 1, "[ERROR] Failed to find 'filters_map' BPF map.\n");
|
LogMsg(&cfg, 0, 1, "[ERROR] Failed to find 'map_filters' BPF map.\n");
|
||||||
|
|
||||||
return EXIT_FAILURE;
|
return EXIT_FAILURE;
|
||||||
}
|
}
|
||||||
|
|
||||||
LogMsg(&cfg, 3, 0, "filters_map FD => %d.", filters_map);
|
LogMsg(&cfg, 3, 0, "map_filters FD => %d.", map_filters);
|
||||||
|
|
||||||
int stats_map = FindMapFd(prog, "stats_map");
|
int map_stats = FindMapFd(prog, "map_stats");
|
||||||
|
|
||||||
if (stats_map < 0)
|
if (map_stats < 0)
|
||||||
{
|
{
|
||||||
LogMsg(&cfg, 0, 1, "[ERROR] Failed to find 'stats_map' BPF map.\n");
|
LogMsg(&cfg, 0, 1, "[ERROR] Failed to find 'map_stats' BPF map.\n");
|
||||||
|
|
||||||
return EXIT_FAILURE;
|
return EXIT_FAILURE;
|
||||||
}
|
}
|
||||||
|
|
||||||
#ifdef ENABLE_FILTER_LOGGING
|
#ifdef ENABLE_FILTER_LOGGING
|
||||||
int filter_log_map = FindMapFd(prog, "filter_log_map");
|
int map_filter_log = FindMapFd(prog, "map_filter_log");
|
||||||
struct ring_buffer* rb = NULL;
|
struct ring_buffer* rb = NULL;
|
||||||
|
|
||||||
if (filter_log_map < 0)
|
if (map_filter_log < 0)
|
||||||
{
|
{
|
||||||
LogMsg(&cfg, 1, 0, "[WARNING] Failed to find 'filter_log_map' BPF map. Filter logging will be disabled...");
|
LogMsg(&cfg, 1, 0, "[WARNING] Failed to find 'map_filter_log' BPF map. Filter logging will be disabled...");
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
{
|
{
|
||||||
LogMsg(&cfg, 3, 0, "filter_log_map FD => %d.", filter_log_map);
|
LogMsg(&cfg, 3, 0, "map_filter_log FD => %d.", map_filter_log);
|
||||||
|
|
||||||
rb = ring_buffer__new(filter_log_map, HandleRbEvent, &cfg, NULL);
|
rb = ring_buffer__new(map_filter_log, HandleRbEvent, &cfg, NULL);
|
||||||
}
|
}
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
LogMsg(&cfg, 3, 0, "stats_map FD => %d.", stats_map);
|
LogMsg(&cfg, 3, 0, "map_stats FD => %d.", map_stats);
|
||||||
|
|
||||||
LogMsg(&cfg, 2, 0, "Updating filters...");
|
LogMsg(&cfg, 2, 0, "Updating filters...");
|
||||||
|
|
||||||
// Update BPF maps.
|
// Update BPF maps.
|
||||||
UpdateFilters(filters_map, &cfg);
|
UpdateFilters(map_filters, &cfg);
|
||||||
|
|
||||||
// Signal.
|
// Signal.
|
||||||
signal(SIGINT, SignalHndl);
|
signal(SIGINT, SignalHndl);
|
||||||
@@ -247,7 +247,7 @@ int main(int argc, char *argv[])
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Update BPF maps.
|
// Update BPF maps.
|
||||||
UpdateFilters(filters_map, &cfg);
|
UpdateFilters(map_filters, &cfg);
|
||||||
|
|
||||||
// Update timer
|
// Update timer
|
||||||
last_config_check = time(NULL);
|
last_config_check = time(NULL);
|
||||||
@@ -266,9 +266,9 @@ int main(int argc, char *argv[])
|
|||||||
// Calculate and display stats if enabled.
|
// Calculate and display stats if enabled.
|
||||||
if (!cfg.no_stats)
|
if (!cfg.no_stats)
|
||||||
{
|
{
|
||||||
if (CalculateStats(stats_map, cpus, cfg.stats_per_second))
|
if (CalculateStats(map_stats, cpus, cfg.stats_per_second))
|
||||||
{
|
{
|
||||||
LogMsg(&cfg, 1, 0, "[WARNING] Failed to calculate packet stats. Stats map FD => %d...\n", stats_map);
|
LogMsg(&cfg, 1, 0, "[WARNING] Failed to calculate packet stats. Stats map FD => %d...\n", map_stats);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -305,7 +305,7 @@ int ReadCfg(config__t *cfg, config_overrides_t* overrides)
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// Read filters in filters_map structure.
|
// Read filters in map_filters structure.
|
||||||
setting = config_lookup(&conf, "filters");
|
setting = config_lookup(&conf, "filters");
|
||||||
|
|
||||||
// Check if filters map is valid. If not, not a biggie since they aren't required.
|
// Check if filters map is valid. If not, not a biggie since they aren't required.
|
||||||
|
|||||||
@@ -9,13 +9,13 @@ u64 last_passed = 0;
|
|||||||
/**
|
/**
|
||||||
* Calculates and displays packet counters/stats.
|
* Calculates and displays packet counters/stats.
|
||||||
*
|
*
|
||||||
* @param stats_map The stats map BPF FD.
|
* @param map_stats The stats map BPF FD.
|
||||||
* @param cpus The amount of CPUs the host has.
|
* @param cpus The amount of CPUs the host has.
|
||||||
* @param per_second Calculate packet counters per second (PPS).
|
* @param per_second Calculate packet counters per second (PPS).
|
||||||
*
|
*
|
||||||
* @return 0 on success or 1 on failure.
|
* @return 0 on success or 1 on failure.
|
||||||
*/
|
*/
|
||||||
int CalculateStats(int stats_map, int cpus, int per_second)
|
int CalculateStats(int map_stats, int cpus, int per_second)
|
||||||
{
|
{
|
||||||
u32 key = 0;
|
u32 key = 0;
|
||||||
|
|
||||||
@@ -26,7 +26,7 @@ int CalculateStats(int stats_map, int cpus, int per_second)
|
|||||||
u64 dropped = 0;
|
u64 dropped = 0;
|
||||||
u64 passed = 0;
|
u64 passed = 0;
|
||||||
|
|
||||||
if (bpf_map_lookup_elem(stats_map, &key, stats) != 0)
|
if (bpf_map_lookup_elem(map_stats, &key, stats) != 0)
|
||||||
{
|
{
|
||||||
return EXIT_FAILURE;
|
return EXIT_FAILURE;
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -10,4 +10,4 @@
|
|||||||
|
|
||||||
#include <time.h>
|
#include <time.h>
|
||||||
|
|
||||||
int CalculateStats(int stats_map, int cpus, int per_second);
|
int CalculateStats(int map_stats, int cpus, int per_second);
|
||||||
@@ -179,12 +179,12 @@ int AttachXdp(struct xdp_program *prog, char** mode, int ifidx, u8 detach, cmdli
|
|||||||
/**
|
/**
|
||||||
* Updates the filter's BPF map with current config settings.
|
* Updates the filter's BPF map with current config settings.
|
||||||
*
|
*
|
||||||
* @param filters_map The filter's BPF map FD.
|
* @param map_filters The filter's BPF map FD.
|
||||||
* @param cfg A pointer to the config structure.
|
* @param cfg A pointer to the config structure.
|
||||||
*
|
*
|
||||||
* @return Void
|
* @return Void
|
||||||
*/
|
*/
|
||||||
void UpdateFilters(int filters_map, config__t *cfg)
|
void UpdateFilters(int map_filters, config__t *cfg)
|
||||||
{
|
{
|
||||||
int ret;
|
int ret;
|
||||||
int cur_idx = 0;
|
int cur_idx = 0;
|
||||||
@@ -198,7 +198,7 @@ void UpdateFilters(int filters_map, config__t *cfg)
|
|||||||
// We do this in the case rules were edited and were put out of order since the key doesn't uniquely map to a specific rule.
|
// We do this in the case rules were edited and were put out of order since the key doesn't uniquely map to a specific rule.
|
||||||
u32 key = i;
|
u32 key = i;
|
||||||
|
|
||||||
bpf_map_delete_elem(filters_map, &key);
|
bpf_map_delete_elem(map_filters, &key);
|
||||||
|
|
||||||
// Only insert set and enabled filters.
|
// Only insert set and enabled filters.
|
||||||
if (!filter->set || !filter->enabled)
|
if (!filter->set || !filter->enabled)
|
||||||
@@ -216,7 +216,7 @@ void UpdateFilters(int filters_map, config__t *cfg)
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Attempt to update BPF map.
|
// Attempt to update BPF map.
|
||||||
if ((ret = bpf_map_update_elem(filters_map, &cur_idx, &filter_cpus, BPF_ANY)) != 0)
|
if ((ret = bpf_map_update_elem(map_filters, &cur_idx, &filter_cpus, BPF_ANY)) != 0)
|
||||||
{
|
{
|
||||||
fprintf(stderr, "[WARNING] Failed to update filter #%d due to BPF update error (%d)...\n", i, ret);
|
fprintf(stderr, "[WARNING] Failed to update filter #%d due to BPF update error (%d)...\n", i, ret);
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -14,4 +14,4 @@ int FindMapFd(struct xdp_program *prog, const char *map_name);
|
|||||||
void SetLibBPFLogMode(int silent);
|
void SetLibBPFLogMode(int silent);
|
||||||
struct xdp_program *LoadBpfObj(const char *file_name);
|
struct xdp_program *LoadBpfObj(const char *file_name);
|
||||||
int AttachXdp(struct xdp_program *prog, char** mode, int ifidx, u8 detach, cmdline_t *cmd);
|
int AttachXdp(struct xdp_program *prog, char** mode, int ifidx, u8 detach, cmdline_t *cmd);
|
||||||
void UpdateFilters(int filters_map, config__t *cfg);
|
void UpdateFilters(int map_filters, config__t *cfg);
|
||||||
@@ -82,7 +82,7 @@ int xdp_prog_main(struct xdp_md *ctx)
|
|||||||
|
|
||||||
// Get stats map.
|
// Get stats map.
|
||||||
u32 key = 0;
|
u32 key = 0;
|
||||||
stats_t*stats = bpf_map_lookup_elem(&stats_map, &key);
|
stats_t*stats = bpf_map_lookup_elem(&map_stats, &key);
|
||||||
|
|
||||||
u64 now = bpf_ktime_get_ns();
|
u64 now = bpf_ktime_get_ns();
|
||||||
|
|
||||||
@@ -91,11 +91,11 @@ int xdp_prog_main(struct xdp_md *ctx)
|
|||||||
|
|
||||||
if (iph6)
|
if (iph6)
|
||||||
{
|
{
|
||||||
blocked = bpf_map_lookup_elem(&ip6_blacklist_map, &src_ip6);
|
blocked = bpf_map_lookup_elem(&map_ip6_blacklist, &src_ip6);
|
||||||
}
|
}
|
||||||
else if (iph)
|
else if (iph)
|
||||||
{
|
{
|
||||||
blocked = bpf_map_lookup_elem(&ip_blacklist_map, &iph->saddr);
|
blocked = bpf_map_lookup_elem(&map_ip_blacklist, &iph->saddr);
|
||||||
}
|
}
|
||||||
|
|
||||||
if (blocked != NULL && *blocked > 0)
|
if (blocked != NULL && *blocked > 0)
|
||||||
@@ -105,11 +105,11 @@ int xdp_prog_main(struct xdp_md *ctx)
|
|||||||
// Remove element from map.
|
// Remove element from map.
|
||||||
if (iph6)
|
if (iph6)
|
||||||
{
|
{
|
||||||
bpf_map_delete_elem(&ip6_blacklist_map, &src_ip6);
|
bpf_map_delete_elem(&map_ip6_blacklist, &src_ip6);
|
||||||
}
|
}
|
||||||
else if (iph)
|
else if (iph)
|
||||||
{
|
{
|
||||||
bpf_map_delete_elem(&ip_blacklist_map, &iph->saddr);
|
bpf_map_delete_elem(&map_ip_blacklist, &iph->saddr);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
@@ -272,7 +272,7 @@ int xdp_prog_main(struct xdp_md *ctx)
|
|||||||
{
|
{
|
||||||
u32 key = i;
|
u32 key = i;
|
||||||
|
|
||||||
filter_t *filter = bpf_map_lookup_elem(&filters_map, &key);
|
filter_t *filter = bpf_map_lookup_elem(&map_filters, &key);
|
||||||
|
|
||||||
// Check if ID is above 0 (if 0, it's an invalid rule).
|
// Check if ID is above 0 (if 0, it's an invalid rule).
|
||||||
if (!filter || !filter->set)
|
if (!filter || !filter->set)
|
||||||
@@ -561,11 +561,11 @@ int xdp_prog_main(struct xdp_md *ctx)
|
|||||||
|
|
||||||
if (iph6)
|
if (iph6)
|
||||||
{
|
{
|
||||||
bpf_map_update_elem(&ip6_blacklist_map, &src_ip6, &new_time, BPF_ANY);
|
bpf_map_update_elem(&map_ip6_blacklist, &src_ip6, &new_time, BPF_ANY);
|
||||||
}
|
}
|
||||||
else if (iph)
|
else if (iph)
|
||||||
{
|
{
|
||||||
bpf_map_update_elem(&ip_blacklist_map, &iph->saddr, &new_time, BPF_ANY);
|
bpf_map_update_elem(&map_ip_blacklist, &iph->saddr, &new_time, BPF_ANY);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -21,7 +21,7 @@
|
|||||||
*/
|
*/
|
||||||
static __always_inline int LogFilterMsg(struct iphdr* iph, struct ipv6hdr* iph6, u16 src_port, u16 dst_port, u8 protocol, u64 now, u64 pps, u64 bps, int filter_id)
|
static __always_inline int LogFilterMsg(struct iphdr* iph, struct ipv6hdr* iph6, u16 src_port, u16 dst_port, u8 protocol, u64 now, u64 pps, u64 bps, int filter_id)
|
||||||
{
|
{
|
||||||
filter_log_event_t* e = bpf_ringbuf_reserve(&filter_log_map, sizeof(*e), 0);
|
filter_log_event_t* e = bpf_ringbuf_reserve(&map_filter_log, sizeof(*e), 0);
|
||||||
|
|
||||||
if (e)
|
if (e)
|
||||||
{
|
{
|
||||||
|
|||||||
@@ -11,7 +11,7 @@ struct
|
|||||||
__uint(max_entries, MAX_FILTERS);
|
__uint(max_entries, MAX_FILTERS);
|
||||||
__type(key, u32);
|
__type(key, u32);
|
||||||
__type(value, filter_t);
|
__type(value, filter_t);
|
||||||
} filters_map SEC(".maps");
|
} map_filters SEC(".maps");
|
||||||
|
|
||||||
struct
|
struct
|
||||||
{
|
{
|
||||||
@@ -19,7 +19,7 @@ struct
|
|||||||
__uint(max_entries, 1);
|
__uint(max_entries, 1);
|
||||||
__type(key, u32);
|
__type(key, u32);
|
||||||
__type(value, stats_t);
|
__type(value, stats_t);
|
||||||
} stats_map SEC(".maps");
|
} map_stats SEC(".maps");
|
||||||
|
|
||||||
struct
|
struct
|
||||||
{
|
{
|
||||||
@@ -31,7 +31,7 @@ struct
|
|||||||
__type(key, u32);
|
__type(key, u32);
|
||||||
#endif
|
#endif
|
||||||
__type(value, ip_stats_t);
|
__type(value, ip_stats_t);
|
||||||
} ip_stats_map SEC(".maps");
|
} map_ip_stats SEC(".maps");
|
||||||
|
|
||||||
struct
|
struct
|
||||||
{
|
{
|
||||||
@@ -39,7 +39,7 @@ struct
|
|||||||
__uint(max_entries, MAX_TRACK_IPS);
|
__uint(max_entries, MAX_TRACK_IPS);
|
||||||
__type(key, u32);
|
__type(key, u32);
|
||||||
__type(value, u64);
|
__type(value, u64);
|
||||||
} ip_blacklist_map SEC(".maps");
|
} map_ip_blacklist SEC(".maps");
|
||||||
|
|
||||||
struct
|
struct
|
||||||
{
|
{
|
||||||
@@ -51,7 +51,7 @@ struct
|
|||||||
__type(key, u128);
|
__type(key, u128);
|
||||||
#endif
|
#endif
|
||||||
__type(value, ip_stats_t);
|
__type(value, ip_stats_t);
|
||||||
} ip6_stats_map SEC(".maps");
|
} map_ip6_stats SEC(".maps");
|
||||||
|
|
||||||
struct
|
struct
|
||||||
{
|
{
|
||||||
@@ -59,12 +59,12 @@ struct
|
|||||||
__uint(max_entries, MAX_TRACK_IPS);
|
__uint(max_entries, MAX_TRACK_IPS);
|
||||||
__type(key, u128);
|
__type(key, u128);
|
||||||
__type(value, u64);
|
__type(value, u64);
|
||||||
} ip6_blacklist_map SEC(".maps");
|
} map_ip6_blacklist SEC(".maps");
|
||||||
|
|
||||||
#ifdef ENABLE_FILTER_LOGGING
|
#ifdef ENABLE_FILTER_LOGGING
|
||||||
struct
|
struct
|
||||||
{
|
{
|
||||||
__uint(type, BPF_MAP_TYPE_RINGBUF);
|
__uint(type, BPF_MAP_TYPE_RINGBUF);
|
||||||
__uint(max_entries, 1 << 16);
|
__uint(max_entries, 1 << 16);
|
||||||
} filter_log_map SEC(".maps");
|
} map_filter_log SEC(".maps");
|
||||||
#endif
|
#endif
|
||||||
@@ -21,9 +21,9 @@ static __always_inline void UpdateIpStats(u64 *pps, u64 *bps, u32 ip, u16 port,
|
|||||||
key.port = port;
|
key.port = port;
|
||||||
key.protocol = protocol;
|
key.protocol = protocol;
|
||||||
|
|
||||||
ip_stats_t *ip_stats = bpf_map_lookup_elem(&ip_stats_map, &key);
|
ip_stats_t *ip_stats = bpf_map_lookup_elem(&map_ip_stats, &key);
|
||||||
#else
|
#else
|
||||||
ip_stats_t *ip_stats = bpf_map_lookup_elem(&ip_stats_map, &ip);
|
ip_stats_t *ip_stats = bpf_map_lookup_elem(&map_ip_stats, &ip);
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
if (ip_stats)
|
if (ip_stats)
|
||||||
@@ -58,9 +58,9 @@ static __always_inline void UpdateIpStats(u64 *pps, u64 *bps, u32 ip, u16 port,
|
|||||||
*bps = new.bps;
|
*bps = new.bps;
|
||||||
|
|
||||||
#ifdef USE_FLOW_RL
|
#ifdef USE_FLOW_RL
|
||||||
bpf_map_update_elem(&ip_stats_map, &key, &new, BPF_ANY);
|
bpf_map_update_elem(&map_ip_stats, &key, &new, BPF_ANY);
|
||||||
#else
|
#else
|
||||||
bpf_map_update_elem(&ip_stats_map, &ip, &new, BPF_ANY);
|
bpf_map_update_elem(&map_ip_stats, &ip, &new, BPF_ANY);
|
||||||
#endif
|
#endif
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@@ -86,9 +86,9 @@ static __always_inline void UpdateIp6Stats(u64 *pps, u64 *bps, u128 *ip, u16 por
|
|||||||
key.port = port;
|
key.port = port;
|
||||||
key.protocol = protocol;
|
key.protocol = protocol;
|
||||||
|
|
||||||
ip_stats_t *ip_stats = bpf_map_lookup_elem(&ip_stats_map, &key);
|
ip_stats_t *ip_stats = bpf_map_lookup_elem(&map_ip6_stats, &key);
|
||||||
#else
|
#else
|
||||||
ip_stats_t *ip_stats = bpf_map_lookup_elem(&ip_stats_map, ip);
|
ip_stats_t *ip_stats = bpf_map_lookup_elem(&map_ip6_stats, ip);
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
if (ip_stats)
|
if (ip_stats)
|
||||||
@@ -123,9 +123,9 @@ static __always_inline void UpdateIp6Stats(u64 *pps, u64 *bps, u128 *ip, u16 por
|
|||||||
*bps = new.bps;
|
*bps = new.bps;
|
||||||
|
|
||||||
#ifdef USE_FLOW_RL
|
#ifdef USE_FLOW_RL
|
||||||
bpf_map_update_elem(&ip_stats_map, &key, &new, BPF_ANY);
|
bpf_map_update_elem(&map_ip6_stats, &key, &new, BPF_ANY);
|
||||||
#else
|
#else
|
||||||
bpf_map_update_elem(&ip_stats_map, ip, &new, BPF_ANY);
|
bpf_map_update_elem(&map_ip6_stats, ip, &new, BPF_ANY);
|
||||||
#endif
|
#endif
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
Reference in New Issue
Block a user