Introduce new sysctl variable: net.bpf.stats. This sysctl variable can

be used to pass statistics regarding dropped, matched and received
packet counts from the kernel to user-space. While we are here
introduce a new counter for filtered or matched packets. We currently
keep track of packets received or dropped by the bpf device, but not
how many packets actually matched the bpf filter.

-Introduce net.bpf.stats sysctl OID
-Move sysctl variables after the function prototypes so we can
 reference bpf_stats_sysctl(9) without build errors.
-Introduce bpf descriptor counter which is used mainly for sizing
 of the xbpf_d array.
-Introduce a xbpf_d structure which will act as an external
 representation of the bpf_d structure.
-Add a the following members to the bpfd structure:

	bd_fcount	- Number of packets which matched bpf filter
	bd_pid		- PID which opened the bpf device
	bd_pcomm	- Process name which opened the device.

It should be noted that it's possible that the process which opened
the device could be long gone at the time of stats collection. An
example might be a process that opens the bpf device forks then exits
leaving the child process with the bpf fd.

Reviewed by:	mdodd

1 files changed, 26 insertions, 0 deletions

diff --git a/sys/net/bpfdesc.h b/sys/net/bpfdesc.h
index 5e0eca4..63f8987 100644
--- a/sys/net/bpfdesc.h
+++ b/sys/net/bpfdesc.h
@@ -42,6 +42,8 @@
 #include <sys/callout.h>
 #include <sys/selinfo.h>
 #include <sys/queue.h>
+#include <sys/conf.h>
+#include <net/if.h>
 
 /*
  * Descriptor associated with each open bpf file.
@@ -90,6 +92,9 @@ struct bpf_d {
 	struct mtx	bd_mtx;		/* mutex for this descriptor */
 	struct callout	bd_callout;	/* for BPF timeouts with select */
 	struct label	*bd_label;	/* MAC label for descriptor */
+	u_long		bd_fcount;	/* number of packets which matched filter */
+	pid_t		bd_pid;		/* PID which created descriptor */
+	char		bd_pcomm[MAXCOMLEN + 1];
 };
 
 /* Values for bd_state */
@@ -123,6 +128,27 @@ struct bpf_if {
 	struct mtx	bif_mtx;	/* mutex for interface */
 };
 
+/*
+ * External representation of the bpf descriptor
+ */
+struct xbpf_d {
+	u_char		bd_promisc;
+	u_char		bd_immediate;
+	int		bd_hdrcmplt;
+	int		bd_seesent;
+	int		bd_async;
+	u_long		bd_rcount;
+	u_long		bd_dcount;
+	u_long		bd_fcount;
+	int		bd_sig;
+	int		bd_slen;
+	int		bd_hlen;
+	int		bd_bufsize;
+	pid_t		bd_pid;
+	char		bd_ifname[IFNAMSIZ];
+	char		bd_pcomm[MAXCOMLEN + 1];
+};
+
 #define BPFIF_LOCK(bif)		mtx_lock(&(bif)->bif_mtx)
 #define BPFIF_UNLOCK(bif)	mtx_unlock(&(bif)->bif_mtx)