diff options
| author | Alexander V. Chernikov <melifaro@FreeBSD.org> | 2023-09-15 10:06:59 +0000 |
|---|---|---|
| committer | Kristof Provost <kp@FreeBSD.org> | 2023-10-10 09:48:21 +0000 |
| commit | 2cef62886dc7c33ca01f70ca712845da1e55b470 (patch) | |
| tree | b6aded113d9bd0d1107d58ac49583acd745cace0 /include | |
| parent | 5bdd74cc05e6c7d110688feacdbd22b6dffe5d72 (diff) | |
| download | src-2cef62886dc7c33ca01f70ca712845da1e55b470.tar.gz src-2cef62886dc7c33ca01f70ca712845da1e55b470.zip | |
pf: convert state retrieval to netlink
Use netlink to export pf's state table.
The primary motivation is to improve how we deal with very large state
stables. With the previous implementation we had to build the entire
list (both in the kernel and in userspace) before we could start
processing. With netlink we start to get data in userspace while the
kernel is still generating more. This reduces peak memory consumption
(which can get to the GB range once we hit millions of states).
Netlink also makes future extension easier, in that we can easily add
fields to the state export without breaking userspace. In that regard
it's similar to an nvlist-based approach, except that it also deals
with transport to userspace and that it performs significantly better
than nvlists. Testing has failed to measure a performance difference
between the previous struct-copy based ioctl and the netlink approach.
Differential Revision: https://reviews.freebsd.org/D38888
Diffstat (limited to 'include')
| -rw-r--r-- | include/Makefile | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/include/Makefile b/include/Makefile index 736a47854534..5a3cb66eb3e3 100644 --- a/include/Makefile +++ b/include/Makefile @@ -215,7 +215,8 @@ IPFILTERDIR= ${INCLUDEDIR}/netinet .PATH: ${SRCTOP}/sys/netpfil/pf PF= pf.h \ pf_altq.h \ - pf_mtag.h + pf_mtag.h \ + pf_nl.h PFPACKAGE= pf PFDIR= ${INCLUDEDIR}/netpfil/pf |