git: 94b8a547c53b - stable/14 - pf: expose more syncookie state information to userspace

The branch stable/14 has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=94b8a547c53b675a775fa824b433e23e5a28aee6

commit 94b8a547c53b675a775fa824b433e23e5a28aee6
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2023-11-06 21:20:32 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2023-11-13 07:10:27 +0000

    pf: expose more syncookie state information to userspace
    
    Allow userspace to retrieve low and high water marks, as well as the
    current number of half open states.
    
    MFC after:      1 week
    Sponsored by:   Modirum MDPay
    
    (cherry picked from commit a6173e94635b03aa7aab90a67785c8c3e7c6247b)
---
 lib/libpfctl/libpfctl.c        | 1 +
 lib/libpfctl/libpfctl.h        | 1 +
 sbin/pfctl/pfctl_parser.c      | 5 +++++
 sys/netpfil/pf/pf_ioctl.c      | 1 +
 sys/netpfil/pf/pf_syncookies.c | 2 ++
 5 files changed, 10 insertions(+)

diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c
index 03907698e7d2..72da534ac1df 100644
--- a/lib/libpfctl/libpfctl.c
+++ b/lib/libpfctl/libpfctl.c
@@ -1476,6 +1476,7 @@ pfctl_get_syncookies(int dev, struct pfctl_syncookies *s)
 
 	s->highwater = nvlist_get_number(nvl, "highwater") * 100 / state_limit;
 	s->lowwater = nvlist_get_number(nvl, "lowwater") * 100 / state_limit;
+	s->halfopen_states = nvlist_get_number(nvl, "halfopen_states");
 
 	nvlist_destroy(nvl);
 
diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h
index f436e722496f..edaffdd12118 100644
--- a/lib/libpfctl/libpfctl.h
+++ b/lib/libpfctl/libpfctl.h
@@ -381,6 +381,7 @@ struct pfctl_syncookies {
 	enum pfctl_syncookies_mode	mode;
 	uint8_t				highwater;	/* Percent */
 	uint8_t				lowwater;	/* Percent */
+	uint32_t			halfopen_states;
 };
 
 struct pfctl_status* pfctl_get_status(int dev);
diff --git a/sbin/pfctl/pfctl_parser.c b/sbin/pfctl/pfctl_parser.c
index 0268d1b07c79..cb307cd6ede5 100644
--- a/sbin/pfctl/pfctl_parser.c
+++ b/sbin/pfctl/pfctl_parser.c
@@ -628,6 +628,11 @@ print_status(struct pfctl_status *s, struct pfctl_syncookies *cookies, int opts)
 		    PFCTL_SYNCOOKIES_MODE_NAMES[cookies->mode]);
 		printf("  %-25s %s\n", "active",
 		    s->syncookies_active ? "active" : "inactive");
+		if (opts & PF_OPT_VERBOSE2) {
+			printf("  %-25s %d %%\n", "highwater", cookies->highwater);
+			printf("  %-25s %d %%\n", "lowwater", cookies->lowwater);
+			printf("  %-25s %d\n", "halfopen states", cookies->halfopen_states);
+		}
 		printf("Reassemble %24s %s\n",
 		    s->reass & PF_REASS_ENABLED ? "yes" : "no",
 		    s->reass & PF_REASS_NODF ? "no-df" : ""
diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c
index 6b8fbf77fd29..de43570176cb 100644
--- a/sys/netpfil/pf/pf_ioctl.c
+++ b/sys/netpfil/pf/pf_ioctl.c
@@ -5918,6 +5918,7 @@ pf_getstatus(struct pfioc_nv *nv)
 	nvlist_add_number(nvl, "reass", V_pf_status.reass);
 	nvlist_add_bool(nvl, "syncookies_active",
 	    V_pf_status.syncookies_active);
+	nvlist_add_number(nvl, "halfopen_states", V_pf_status.states_halfopen);
 
 	/* counters */
 	error = pf_add_status_counters(nvl, "counters", V_pf_status.counters,
diff --git a/sys/netpfil/pf/pf_syncookies.c b/sys/netpfil/pf/pf_syncookies.c
index b5e59178e7e8..c5ee64c6aed0 100644
--- a/sys/netpfil/pf/pf_syncookies.c
+++ b/sys/netpfil/pf/pf_syncookies.c
@@ -162,6 +162,8 @@ pf_get_syncookies(struct pfioc_nv *nv)
 	    V_pf_status.syncookies_mode == PF_SYNCOOKIES_ADAPTIVE);
 	nvlist_add_number(nvl, "highwater", V_pf_syncookie_status.hiwat);
 	nvlist_add_number(nvl, "lowwater", V_pf_syncookie_status.lowat);
+	nvlist_add_number(nvl, "halfopen_states",
+	    atomic_load_32(&V_pf_status.states_halfopen));
 
 	nvlpacked = nvlist_pack(nvl, &nv->len);
 	if (nvlpacked == NULL)