[WIP] openbsd: stats from pf

Makefile.in

@@ -30,6 +30,8 @@ acct.c		\
 addr.c		\
 bsd.c		\
 cap.c		\
+cache.c		\
+pf.c		\
 conv.c		\
 darkstat.c	\
 daylog.c	\
@@ -159,10 +161,13 @@ addr.o: addr.c addr.h
 bsd.o: bsd.c bsd.h config.h cdefs.h
 cap.o: cap.c acct.h cdefs.h cap.h config.h conv.h decode.h addr.h err.h \
  hosts_db.h linktypes.h localip.h now.h opt.h queue.h str.h
+cache.o: cache.c cache.h
+pf.o: pf.c pf.h acct.h cdefs.h config.h conv.h decode.h addr.h err.h \
+ hosts_db.h localip.h now.h opt.h queue.h str.h cache.h
 conv.o: conv.c conv.h err.h cdefs.h
 darkstat.o: darkstat.c acct.h cap.h cdefs.h config.h conv.h daylog.h \
- graph_db.h db.h dns.h err.h hosts_db.h addr.h http.h localip.h ncache.h \
- now.h pidfile.h str.h
+ graph_db.h db.h dns.h err.h hosts_db.h addr.h http.h localip.h \
+ ncache.h now.h pidfile.h str.h pf.h
 daylog.o: daylog.c cdefs.h err.h daylog.h graph_db.h str.h now.h
 db.o: db.c err.h cdefs.h hosts_db.h addr.h graph_db.h db.h
 decode.o: decode.c cdefs.h decode.h addr.h err.h opt.h

acct.c

@@ -174,7 +174,7 @@ void acct_for(const struct pktsummary * const sm,
 #endif
 
    /* Totals. */
-   acct_total_packets++;
+   acct_total_packets += sm->packets;
    acct_total_bytes += sm->len;
 
    /* Graphs. */

cache.c

@@ -0,0 +1,208 @@
+/* $OpenBSD: cache.c,v 1.8 2019/01/17 05:56:29 tedu Exp $ */
+/*
+ * Copyright (c) 2001, 2007 Can Erkin Acar <canacar@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifdef __OpenBSD__
+
+#include <sys/types.h>
+#include <sys/ioctl.h>
+#include <sys/socket.h>
+
+#include <net/if.h>
+#include <netinet/in.h>
+
+#include <netinet/tcp_fsm.h>
+#ifdef TEST_COMPAT
+#include "pfvarmux.h"
+#else
+#include <net/pfvar.h>
+#endif
+#include <arpa/inet.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>
+
+#include <assert.h>
+
+#include "cache.h"
+
+/* prototypes */
+void update_state(struct sc_ent *, struct pfsync_state *);
+struct sc_ent *cache_state(struct pfsync_state *);
+static __inline int sc_cmp(struct sc_ent *s1, struct sc_ent *s2);
+
+/* initialize the tree and queue */
+RB_HEAD(sc_tree, sc_ent) sctree;
+TAILQ_HEAD(sc_queue, sc_ent) scq1, scq2, scq_free;
+RB_GENERATE(sc_tree, sc_ent, tlink, sc_cmp)
+
+struct sc_queue *scq_act = NULL;
+struct sc_queue *scq_exp = NULL;
+
+int cache_max = 0;
+int cache_size = 0;
+
+struct sc_ent *sc_store = NULL;
+
+/* preallocate the cache and insert into the 'free' queue */
+int
+cache_init(int max)
+{
+	int n;
+	static int initialized = 0;
+
+	if (max < 0 || initialized)
+		return (1);
+
+	if (max == 0) {
+		sc_store = NULL;
+	} else {
+		sc_store = reallocarray(NULL, max, sizeof(struct sc_ent));
+		if (sc_store == NULL)
+			return (1);
+	}
+
+	RB_INIT(&sctree);
+	TAILQ_INIT(&scq1);
+	TAILQ_INIT(&scq2);
+	TAILQ_INIT(&scq_free);
+
+	scq_act = &scq1;
+	scq_exp = &scq2;
+
+	for (n = 0; n < max; n++)
+		TAILQ_INSERT_HEAD(&scq_free, sc_store + n, qlink);
+
+	cache_size = cache_max = max;
+	initialized++;
+
+	return (0);
+}
+
+void
+update_state(struct sc_ent *prev, struct pfsync_state *new)
+{
+	assert (prev != NULL && new != NULL);
+
+	u_int64_t bytes[2] = { COUNTER(new->bytes[0]), COUNTER(new->bytes[1]) };
+	prev->bytes_delta[0] = bytes[0] - prev->bytes[0];
+	prev->bytes_delta[1] = bytes[1] - prev->bytes[1];
+	prev->bytes[0] = bytes[0];
+	prev->bytes[1] = bytes[1];
+
+	u_int64_t packets[2] = { COUNTER(new->packets[0]), COUNTER(new->packets[1]) };
+	prev->packets_delta[0] = packets[0] - prev->packets[0];
+	prev->packets_delta[1] = packets[1] - prev->packets[1];
+	prev->packets[0] = packets[0];
+	prev->packets[1] = packets[1];
+}
+
+void
+add_state(struct pfsync_state *st)
+{
+	struct sc_ent *ent;
+	assert(st != NULL);
+
+	if (cache_max == 0)
+		return;
+
+	if (TAILQ_EMPTY(&scq_free))
+		return;
+
+	ent = TAILQ_FIRST(&scq_free);
+	TAILQ_REMOVE(&scq_free, ent, qlink);
+
+	cache_size--;
+
+	ent->id = st->id;
+	ent->creatorid = st->creatorid;
+	ent->bytes[0] = COUNTER(st->bytes[0]);
+	ent->bytes[1] = COUNTER(st->bytes[1]);
+	ent->packets[0] = COUNTER(st->packets[0]);
+	ent->packets[1] = COUNTER(st->packets[1]);
+
+	RB_INSERT(sc_tree, &sctree, ent);
+	TAILQ_INSERT_HEAD(scq_act, ent, qlink);
+}
+
+/* must be called only once for each state before cache_endupdate */
+struct sc_ent *
+cache_state(struct pfsync_state *st)
+{
+	struct sc_ent ent, *old;
+
+	if (cache_max == 0)
+		return (NULL);
+
+	ent.id = st->id;
+	ent.creatorid = st->creatorid;
+	old = RB_FIND(sc_tree, &sctree, &ent);
+
+	if (old == NULL) {
+		add_state(st);
+		return (NULL);
+	}
+
+	if (COUNTER(st->bytes[0]) < old->bytes[0] || COUNTER(st->bytes[1]) < old->bytes[1])
+		return (NULL);
+
+	update_state(old, st);
+
+	/* move to active queue */
+	TAILQ_REMOVE(scq_exp, old, qlink);
+	TAILQ_INSERT_HEAD(scq_act, old, qlink);
+
+	return (old);
+}
+
+/* remove the states that are not updated in this cycle */
+void
+cache_endupdate(void)
+{
+	struct sc_queue *tmp;
+	struct sc_ent *ent;
+
+	while (! TAILQ_EMPTY(scq_exp)) {
+		ent = TAILQ_FIRST(scq_exp);
+		TAILQ_REMOVE(scq_exp, ent, qlink);
+		RB_REMOVE(sc_tree, &sctree, ent);
+		TAILQ_INSERT_HEAD(&scq_free, ent, qlink);
+		cache_size++;
+	}
+
+	tmp = scq_act;
+	scq_act = scq_exp;
+	scq_exp = tmp;
+}
+
+static __inline int
+sc_cmp(struct sc_ent *a, struct sc_ent *b)
+{
+	if (a->id > b->id)
+		return (1);
+	if (a->id < b->id)
+		return (-1);
+	if (a->creatorid > b->creatorid)
+		return (1);
+	if (a->creatorid < b->creatorid)
+		return (-1);
+	return (0);
+}
+
+#endif
+
+/* vim:set ts=3 sw=3 tw=78 expandtab: */

cache.h

@@ -0,0 +1,49 @@
+/* $OpenBSD: cache.h,v 1.6 2019/01/17 05:56:29 tedu Exp $ */
+/*
+ * Copyright (c) 2001, 2007 Can Erkin Acar <canacar@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _CACHE_H_
+#define _CACHE_H_
+
+#include <net/if.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
+#include <netinet/tcp_fsm.h>
+#include <arpa/inet.h>
+#include <sys/types.h>
+#include <sys/queue.h>
+#include <sys/tree.h>
+#include <net/pfvar.h>
+
+struct sc_ent {
+	RB_ENTRY(sc_ent)    tlink;
+	TAILQ_ENTRY(sc_ent) qlink;
+	u_int64_t	    id;
+	u_int32_t	    creatorid;
+	u_int64_t	    bytes[2];
+	u_int64_t	    bytes_delta[2];
+	u_int64_t	    packets[2];
+	u_int64_t	    packets_delta[2];
+};
+
+int cache_init(int);
+void cache_endupdate(void);
+struct sc_ent *cache_state(struct pfsync_state *);
+extern int cache_max, cache_size;
+
+#define COUNTER(c) ((((u_int64_t) ntohl(c[0]))<<32) + ntohl(c[1]))
+
+#endif

cap.c

@@ -391,6 +391,7 @@ static void callback(u_char *user,
    if (opt_want_hexdump)
       hexdump(pdata, pheader->caplen, iface->linkhdr);
    memset(&sm, 0, sizeof(sm));
+   sm.packets = 1;
    if (iface->linkhdr->decoder(pheader, pdata, &sm))
       acct_for(&sm, &iface->local_ips);
 }