kaffa/XDP-Firewall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Change stats map into per CPU map for performance.

Browse Source
This commit is contained in:
gamemann
2021-11-12 15:49:09 +00:00
parent 3d0fd68074
commit ee61f2d783
2 changed files with 19 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/xdpfw_kern.c
View File

@@ -59,7 +59,7 @@ struct bpf_map_def SEC("maps") filters_map =
struct bpf_map_def SEC("maps") stats_map = struct bpf_map_def SEC("maps") stats_map =
{ {
.type = BPF_MAP_TYPE_ARRAY, .type = BPF_MAP_TYPE_PERCPU_ARRAY,
.key_size = sizeof(uint32_t), .key_size = sizeof(uint32_t),
.value_size = sizeof(struct xdpfw_stats), .value_size = sizeof(struct xdpfw_stats),
.max_entries = 1 .max_entries = 1
@@ -200,7 +200,7 @@ int xdp_prog_main(struct xdp_md *ctx)
// Increase blocked stats entry. // Increase blocked stats entry.
if (stats) if (stats)
{ {
__sync_fetch_and_add(&stats->blocked, 1); stats->blocked++;
} }
#endif #endif
@@ -634,7 +634,7 @@ int xdp_prog_main(struct xdp_md *ctx)
if (stats) if (stats)
{ {
__sync_fetch_and_add(&stats->blocked, 1); stats->blocked++;
} }
return XDP_DROP; return XDP_DROP;
@@ -643,7 +643,7 @@ int xdp_prog_main(struct xdp_md *ctx)
{ {
if (stats) if (stats)
{ {
__sync_fetch_and_add(&stats->allowed, 1); stats->allowed++;
} }
} }

17
src/xdpfw_loader.c
View File

@@ -8,6 +8,7 @@
#include <time.h> #include <time.h>
#include <getopt.h> #include <getopt.h>
#include <sys/resource.h> #include <sys/resource.h>
#include <sys/sysinfo.h>
#include <net/if.h> #include <net/if.h>
#include <linux/if_link.h> #include <linux/if_link.h>
@@ -446,6 +447,9 @@ int main(int argc, char *argv[])
// Signal. // Signal.
signal(SIGINT, signalHndl); signal(SIGINT, signalHndl);
// Receive CPU count for stats map parsing.
int cpus = get_nprocs_conf();
while (cont) while (cont)
{ {
// Get current time. // Get current time.
@@ -468,12 +472,21 @@ int main(int argc, char *argv[])
if ((curTime - statsLastUpdated) > 2 && !conf->nostats) if ((curTime - statsLastUpdated) > 2 && !conf->nostats)
{ {
uint32_t key = 0; uint32_t key = 0;
struct xdpfw_stats stats; struct xdpfw_stats stats[cpus];
uint64_t allowed = 0;
uint64_t dropped = 0;
bpf_map_lookup_elem(stats_map_fd, &key, &stats); bpf_map_lookup_elem(stats_map_fd, &key, &stats);
for (int i = 0; i < cpus; i++)
{
allowed += stats[i].allowed;
dropped += stats[i].blocked;
}
fflush(stdout); fflush(stdout);
fprintf(stdout, "\rPackets Allowed: %" PRIu64 " | Packets Blocked: %" PRIu64, stats.allowed, stats.blocked); fprintf(stdout, "\rPackets Allowed: %" PRIu64 " | Packets Blocked: %" PRIu64, allowed, dropped);
statsLastUpdated = time(NULL); statsLastUpdated = time(NULL);
} }