dropmon config options hw_unknown=on|off (match all) and hw_function=…

…on|off (include raw string in sFlow feed)

hsflowd.spec

@@ -1,6 +1,6 @@
 Summary: host sFlow daemon
 Name: hsflowd
-Version: 2.0.42
+Version: 2.0.43
 Release: 1
 License: http://sflow.net/license.html
 Group: Applications/Internet

src/Linux/Makefile

@@ -628,7 +628,7 @@ clean:
 
 #########  dependencies  #########
 
-.c.o: $(HEADERS)
+.c.o:
 	$(CC) $(CFLAGS) -c $*.c
 
 util.o: util.c $(HEADERS)

src/Linux/hsflowconfig.c

@@ -1346,6 +1346,8 @@ extern "C" {
 	    sp->dropmon.max = 100000;
 	    sp->dropmon.sw = YES;
 	    sp->dropmon.hw = YES;
+	    sp->dropmon.hw_unknown = NO;
+	    sp->dropmon.hw_function = NO;
 	    level[++depth] = HSPOBJ_DROPMON;
 	    break;
 	  case HSPTOKEN_PCAP:
@@ -1693,7 +1695,12 @@ extern "C" {
 	  {
 	    switch(tok->stok) {
 	    case HSPTOKEN_GROUP:
-	      // deprecated, ignored
+	      // deprecated, ignore as long as it is well-formed. Must still
+	      // parse to consume the arg.
+	      {
+		uint32_t ignore;
+		if((tok = expectInteger32(sp, tok, &ignore, 1, 0xFFFFFFFF)) == NULL) return NO;
+	      }
 	      break;
 	    case HSPTOKEN_START:
 	      if((tok = expectONOFF(sp, tok, &sp->dropmon.start)) == NULL) return NO;
@@ -1704,6 +1711,12 @@ extern "C" {
 	    case HSPTOKEN_HW:
 	      if((tok = expectONOFF(sp, tok, &sp->dropmon.hw)) == NULL) return NO;
 	      break;
+	    case HSPTOKEN_HW_UNKNOWN:
+	      if((tok = expectONOFF(sp, tok, &sp->dropmon.hw_unknown)) == NULL) return NO;
+	      break;
+	    case HSPTOKEN_HW_FUNCTION:
+	      if((tok = expectONOFF(sp, tok, &sp->dropmon.hw_function)) == NULL) return NO;
+	      break;
 	    case HSPTOKEN_LIMIT:
 	      if((tok = expectInteger32(sp, tok, &sp->dropmon.limit, 1, HSP_MAX_NOTIFY_RATELIMIT)) == NULL) return NO;
 	      break;

src/Linux/hsflowd.h

@@ -605,6 +605,8 @@ extern "C" {
       bool hw;
       uint32_t limit;
       uint32_t max;
+      bool hw_unknown;
+      bool hw_function;
     } dropmon;
     struct {
       bool pcap;

src/Linux/hsflowtokens.h

@@ -78,6 +78,8 @@ HSPTOKEN_DATA( HSPTOKEN_START, "start", HSPTOKENTYPE_ATTRIB, NULL)
 HSPTOKEN_DATA( HSPTOKEN_LIMIT, "limit", HSPTOKENTYPE_ATTRIB, NULL)
 HSPTOKEN_DATA( HSPTOKEN_SW, "sw", HSPTOKENTYPE_ATTRIB, NULL)
 HSPTOKEN_DATA( HSPTOKEN_HW, "hw", HSPTOKENTYPE_ATTRIB, NULL)
+HSPTOKEN_DATA( HSPTOKEN_HW_UNKNOWN, "hw_unknown", HSPTOKENTYPE_ATTRIB, NULL)
+HSPTOKEN_DATA( HSPTOKEN_HW_FUNCTION, "hw_function", HSPTOKENTYPE_ATTRIB, NULL)
 HSPTOKEN_DATA( HSPTOKEN_TUNNEL, "tunnel", HSPTOKENTYPE_ATTRIB, NULL)
 HSPTOKEN_DATA( HSPTOKEN_MAX, "max", HSPTOKENTYPE_ATTRIB, NULL)
 HSPTOKEN_DATA( HSPTOKEN_UNIXSOCK, "unixsock", HSPTOKENTYPE_ATTRIB, NULL)

src/Linux/mod_dropmon.c

@@ -242,6 +242,7 @@ extern "C" {
     UTARRAY_WALK(mdata->dropPatterns_hw, dp) {
       if(fnmatch(dp->dropPoint, dropPointStr, FNM_CASEFOLD) == 0) {
 	// yes - add the direct lookup to the hash table for next time
+	myDebug(1, "dropPoint pattern %s matched grp=%s str=%s", dp->dropPoint, group, dropPointStr);
 	dp = newDropPoint(dropPointStr, NO, dp->reason);
 	addDropPoint_hw(mod, dp);
 	return dp;
@@ -339,6 +340,15 @@ extern "C" {
 	if(dp)
 	  addDropPoint_hw(mod, dp);
       }
+      if(sp->dropmon.hw_unknown) {
+	// Option to match everything that falls through the classifier. This
+	// is the same as including "HSP_DROPPOINT(*=,*,unknown)" in dropPoints_hw.h
+	// except that we can turn it on/off in the config.
+	HSPDropPointLoader dplAll = { "*=", "*", "unknown" };
+	HSPDropPoint *dp = buildDropPoint(&dplAll);
+	if(dp)
+	  addDropPoint_hw(mod, dp);
+      }
     }
   }
 
@@ -611,7 +621,9 @@ That would allow everything to stay on the stack as it does here, which has nice
     char *hw_group=NULL;
     char *hw_name=NULL;
     char *sw_symbol=NULL;
-
+    // space to assemble hw_function if included
+    char hwFnBuf[SFL_MAX_FUNCTION_SYMBOL_LEN+1];
+
     struct nlattr *attr = (struct nlattr *)(msg + GENL_HDRLEN);
     int len = msglen - GENL_HDRLEN;
     while(UTNLA_OK(attr, len)) {
@@ -792,6 +804,16 @@ That would allow everything to stay on the stack as it does here, which has nice
       fnElem.flowType.function.symbol.len = my_strlen(dp->dropPoint);
       SFLADD_ELEMENT(&discard, &fnElem);
     }
+    else if(sp->dropmon.hw_function) {
+      // This option (off by default) is to help with discovering (not missing)
+      // new codes that do not map to defined drop reason codes.
+      // This formatting assumes there is no space in the hw_name but it's not serious
+      // if there is because the string, if used, will likely be taken as a whole.
+      snprintf(hwFnBuf, SFL_MAX_FUNCTION_SYMBOL_LEN, "%s %s", hw_name ?: "-", hw_group ?: "-"); 
+      fnElem.flowType.function.symbol.str = hwFnBuf;
+      fnElem.flowType.function.symbol.len = my_strlen(hwFnBuf);
+      SFLADD_ELEMENT(&discard, &fnElem);
+    }
 
     SEMLOCK_DO(sp->sync_agent) {
       sfl_notifier_writeEventSample(notifier, &discard);

src/Linux/scripts/hsflowd.conf

@@ -50,7 +50,7 @@ sflow {
   # PSAMPLE config via tc:
   #   dent { sw=on switchport=enp.* egress=on }
   # packet drop monitoring:
-  #   dropmon { group=1 start=on limit=50 }
+  #   dropmon { start=on limit=50 }
   # Nvidia NVML GPU monitoring:
   #   nvml { }
   # Xen hypervisor and VM monitoring:

src/Linux/scripts/hsflowd.conf.cumulus

@@ -7,7 +7,7 @@ sflow {
   # psample { group=1 }
   # systemd {}
   # nflog { group=1 }
-  # dropmon { group=1 start=off limit=1000 }
+  # dropmon { start=off limit=1000 }
 
   # ====== Sampling/Polling/Collectors ======
   # EITHER: automatic (DNS SRV+TXT from _sflow._udp):

src/Linux/scripts/hsflowd.conf.dent

@@ -36,6 +36,6 @@ sflow {
   # systemd {}
   #
   # monitor dropped packets:
-  # dropmon { group=1 start=off limit=1000 }
+  # dropmon { start=off limit=1000 }
 }