From 109e2f9ca7608102bbb276296a2cf8389e22c5cb Mon Sep 17 00:00:00 2001 From: Matt Corallo Date: Sat, 23 Oct 2021 16:10:20 +0000 Subject: [PATCH] Fix/better handling of no-stats-tracking rules --- genrules.py | 14 ++++++++------ install.sh | 4 ++-- xdp.c | 4 ++-- 3 files changed, 12 insertions(+), 10 deletions(-) diff --git a/genrules.py b/genrules.py index 3f901e1..7e71d75 100755 --- a/genrules.py +++ b/genrules.py @@ -294,7 +294,7 @@ with open("rules.h", "w") as out: rules6 = "" rules4 = "" use_v6_frags = False - rulecnt = 0 + stats_rulecnt = 0 ratelimitcnt = 0 v4persrcratelimits = [] v5persrcratelimits = [] @@ -369,7 +369,7 @@ with open("rules.h", "w") as out: # Now write the match handling! first_action = None - stats_action = None + stats_action = "" last_action = None for community in line.split("("): if not community.startswith("generic, "): @@ -467,7 +467,7 @@ with open("rules.h", "w") as out: if low_bytes & 1 == 0: last_action = "return XDP_PASS;" if low_bytes & 2 == 2: - stats_action = f"const uint32_t ruleidx = STATIC_RULE_CNT + {rulecnt};\n" + stats_action = f"const uint32_t ruleidx = STATIC_RULE_CNT + {stats_rulecnt};\n" stats_action += "INCREMENT_MATCH(ruleidx);" elif ty == "0x8008": assert False # We do not implement the redirect action @@ -487,7 +487,7 @@ with open("rules.h", "w") as out: write_rule("ip6->flow_lbl[0] = (ip6->flow_lbl[0] & 0x3f) | " + str((low_bytes & 3) << 6) + ";") if first_action is not None: write_rule(first_action.replace("{stats_replace}", stats_action)) - if stats_action is not None and (first_action is None or "{stats_replace}" not in first_action): + if stats_action != "" and (first_action is None or "{stats_replace}" not in first_action): write_rule(stats_action) if last_action is not None: write_rule(last_action) @@ -495,11 +495,13 @@ with open("rules.h", "w") as out: rules6 += "\t} while(0);\\\n" else: rules4 += "\t} while(0);\\\n" - rulecnt += 1 + if stats_action != "": + print(rule) + stats_rulecnt += 1 lastrule = None out.write("\n") - out.write(f"#define RULECNT {rulecnt}\n") + out.write(f"#define STATS_RULECNT {stats_rulecnt}\n") if ratelimitcnt != 0: out.write(f"#define RATE_CNT {ratelimitcnt}\n") if rules4 != "": diff --git a/install.sh b/install.sh index b8f83ab..8106def 100755 --- a/install.sh +++ b/install.sh @@ -17,7 +17,7 @@ $(birdc show route table flowspec6 primary all)" echo "const uint8_t COMPILE_TIME_RAND[] = { $(dd if=/dev/urandom of=/dev/stdout bs=1 count=8 2>/dev/null | hexdump -e '4/1 "0x%02x, "') };" > rand.h -echo "$RULES" | ./genrules.py --8021q=drop-vlan --v6frag=ignore-parse-if-rule --ihl=parse-options +STATS_RULES="$(echo "$RULES" | ./genrules.py --8021q=drop-vlan --v6frag=ignore-parse-if-rule --ihl=parse-options)" clang $CLANG_ARGS -g -std=c99 -pedantic -Wall -Wextra -Wno-pointer-arith -Wno-unused-variable -Wno-unused-function -O3 -emit-llvm -c xdp.c -o xdp.bc if [ "$2" != "" ]; then clang $4 -g -std=c99 -pedantic -Wall -Wextra -Wno-pointer-arith -O3 -emit-llvm -c "$2" -o wrapper.bc @@ -37,4 +37,4 @@ ip link set "$1" xdpoffload obj xdp sec $XDP_SECTION || ( echo "Failed to install in driver, using generic..." && ip link set "$1" xdpgeneric obj xdp sec $XDP_SECTION ) ) -echo "$RULES" | grep "^flow. {" > installed-rules.txt +echo "$STATS_RULES" > installed-rules.txt diff --git a/xdp.c b/xdp.c index 62120d2..e63bec3 100644 --- a/xdp.c +++ b/xdp.c @@ -151,7 +151,7 @@ struct xdp_md { static const int XDP_PASS = 0; static const int XDP_DROP = 1; -static long drop_cnt_map[RULECNT + STATIC_RULE_CNT]; +static long drop_cnt_map[STATS_RULECNT + STATIC_RULE_CNT]; #define INCREMENT_MATCH(reason) { drop_cnt_map[reason] += 1; drop_cnt_map[reason] += data_end - pktdata; } #else /* TEST */ @@ -164,7 +164,7 @@ struct match_counter { }; struct { __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); - __uint(max_entries, RULECNT + STATIC_RULE_CNT); + __uint(max_entries, STATS_RULECNT + STATIC_RULE_CNT); __u32 *key; struct match_counter *value; } drop_cnt_map SEC(".maps"); -- 2.39.5