git: 221a60a426d7 - stable/13 - pf: expose more syncookie state information to userspace

The branch stable/13 has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=221a60a426d7f73dc4ef021821bf81dd269ba943

commit 221a60a426d7f73dc4ef021821bf81dd269ba943
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2023-11-06 21:20:32 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2023-11-13 07:10:47 +0000

    pf: expose more syncookie state information to userspace
    
    Allow userspace to retrieve low and high water marks, as well as the
    current number of half open states.
    
    MFC after:      1 week
    Sponsored by:   Modirum MDPay
    
    (cherry picked from commit a6173e94635b03aa7aab90a67785c8c3e7c6247b)
---
 lib/libpfctl/libpfctl.c        | 1 +
 lib/libpfctl/libpfctl.h        | 1 +
 sbin/pfctl/pfctl_parser.c      | 5 +++++
 sys/netpfil/pf/pf_ioctl.c      | 1 +
 sys/netpfil/pf/pf_syncookies.c | 2 ++
 5 files changed, 10 insertions(+)

diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c
index 4dec539e250b..7fc22734994b 100644
--- a/lib/libpfctl/libpfctl.c
+++ b/lib/libpfctl/libpfctl.c
@@ -1145,6 +1145,7 @@ pfctl_get_syncookies(int dev, struct pfctl_syncookies *s)
 
 	s->highwater = nvlist_get_number(nvl, "highwater") * 100 / state_limit;
 	s->lowwater = nvlist_get_number(nvl, "lowwater") * 100 / state_limit;
+	s->halfopen_states = nvlist_get_number(nvl, "halfopen_states");
 
 	nvlist_destroy(nvl);
 
diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h
index 32cd408c5919..78d981c2d769 100644
--- a/lib/libpfctl/libpfctl.h
+++ b/lib/libpfctl/libpfctl.h
@@ -286,6 +286,7 @@ struct pfctl_syncookies {
 	enum pfctl_syncookies_mode	mode;
 	uint8_t				highwater;	/* Percent */
 	uint8_t				lowwater;	/* Percent */
+	uint32_t			halfopen_states;
 };
 
 struct pfctl_status* pfctl_get_status(int dev);
diff --git a/sbin/pfctl/pfctl_parser.c b/sbin/pfctl/pfctl_parser.c
index ed152eca0010..74cb365d2370 100644
--- a/sbin/pfctl/pfctl_parser.c
+++ b/sbin/pfctl/pfctl_parser.c
@@ -627,6 +627,11 @@ print_status(struct pfctl_status *s, struct pfctl_syncookies *cookies, int opts)
 		    PFCTL_SYNCOOKIES_MODE_NAMES[cookies->mode]);
 		printf("  %-25s %s\n", "active",
 		    s->syncookies_active ? "active" : "inactive");
+		if (opts & PF_OPT_VERBOSE2) {
+			printf("  %-25s %d %%\n", "highwater", cookies->highwater);
+			printf("  %-25s %d %%\n", "lowwater", cookies->lowwater);
+			printf("  %-25s %d\n", "halfopen states", cookies->halfopen_states);
+		}
 	}
 }
 
diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c
index 44b0bccc7489..639c2462fe75 100644
--- a/sys/netpfil/pf/pf_ioctl.c
+++ b/sys/netpfil/pf/pf_ioctl.c
@@ -4979,6 +4979,7 @@ pf_getstatus(struct pfioc_nv *nv)
 	nvlist_add_number(nvl, "src_nodes", V_pf_status.src_nodes);
 	nvlist_add_bool(nvl, "syncookies_active",
 	    V_pf_status.syncookies_active);
+	nvlist_add_number(nvl, "halfopen_states", V_pf_status.states_halfopen);
 
 	/* counters */
 	error = pf_add_status_counters(nvl, "counters", V_pf_status.counters,
diff --git a/sys/netpfil/pf/pf_syncookies.c b/sys/netpfil/pf/pf_syncookies.c
index fb81f59097fb..17f5803e18f5 100644
--- a/sys/netpfil/pf/pf_syncookies.c
+++ b/sys/netpfil/pf/pf_syncookies.c
@@ -155,6 +155,8 @@ pf_get_syncookies(struct pfioc_nv *nv)
 	    V_pf_status.syncookies_mode == PF_SYNCOOKIES_ADAPTIVE);
 	nvlist_add_number(nvl, "highwater", V_pf_syncookie_status.hiwat);
 	nvlist_add_number(nvl, "lowwater", V_pf_syncookie_status.lowat);
+	nvlist_add_number(nvl, "halfopen_states",
+	    atomic_load_32(&V_pf_status.states_halfopen));
 
 	nvlpacked = nvlist_pack(nvl, &nv->len);
 	if (nvlpacked == NULL)