14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 *
27 * $SourceForge: ng_netflow.c,v 1.30 2004/09/05 11:37:43 glebius Exp $
28 */
29
30static const char rcs_id[] =
|
32
33#include <sys/param.h>
34#include <sys/systm.h>
35#include <sys/kernel.h>
36#include <sys/mbuf.h>
37#include <sys/socket.h>
38#include <sys/ctype.h>
39
40#include <net/if.h>
41#include <net/ethernet.h>
42#include <net/if_arp.h>
43#include <net/if_var.h>
44#include <net/bpf.h>
45#include <netinet/in.h>
46#include <netinet/in_systm.h>
47#include <netinet/ip.h>
48
49#include <netgraph/ng_message.h>
50#include <netgraph/ng_parse.h>
51#include <netgraph/netgraph.h>
52#include <netgraph/netflow/netflow.h>
53#include <netgraph/netflow/ng_netflow.h>
54
55/* Netgraph methods */
56static ng_constructor_t ng_netflow_constructor;
57static ng_rcvmsg_t ng_netflow_rcvmsg;
58static ng_close_t ng_netflow_close;
59static ng_shutdown_t ng_netflow_rmnode;
60static ng_newhook_t ng_netflow_newhook;
61static ng_rcvdata_t ng_netflow_rcvdata;
62static ng_disconnect_t ng_netflow_disconnect;
63
64/* Parse type for struct ng_netflow_info */
65static const struct ng_parse_struct_field ng_netflow_info_type_fields[]
66 = NG_NETFLOW_INFO_TYPE;
67static const struct ng_parse_type ng_netflow_info_type = {
68 &ng_parse_struct_type,
69 &ng_netflow_info_type_fields
70};
71
72/* Parse type for struct ng_netflow_ifinfo */
73static const struct ng_parse_struct_field ng_netflow_ifinfo_type_fields[]
74 = NG_NETFLOW_IFINFO_TYPE;
75static const struct ng_parse_type ng_netflow_ifinfo_type = {
76 &ng_parse_struct_type,
77 &ng_netflow_ifinfo_type_fields
78};
79
80/* Parse type for struct ng_netflow_setdlt */
81static const struct ng_parse_struct_field ng_netflow_setdlt_type_fields[]
82 = NG_NETFLOW_SETDLT_TYPE;
83static const struct ng_parse_type ng_netflow_setdlt_type = {
84 &ng_parse_struct_type,
85 &ng_netflow_setdlt_type_fields
86};
87
88/* Parse type for ng_netflow_setifindex */
89static const struct ng_parse_struct_field ng_netflow_setifindex_type_fields[]
90 = NG_NETFLOW_SETIFINDEX_TYPE;
91static const struct ng_parse_type ng_netflow_setifindex_type = {
92 &ng_parse_struct_type,
93 &ng_netflow_setifindex_type_fields
94};
95
96/* Parse type for ng_netflow_settimeouts */
97static const struct ng_parse_struct_field ng_netflow_settimeouts_type_fields[]
98 = NG_NETFLOW_SETTIMEOUTS_TYPE;
99static const struct ng_parse_type ng_netflow_settimeouts_type = {
100 &ng_parse_struct_type,
101 &ng_netflow_settimeouts_type_fields
102};
103
104/* List of commands and how to convert arguments to/from ASCII */
105static const struct ng_cmdlist ng_netflow_cmds[] = {
106 {
107 NGM_NETFLOW_COOKIE,
108 NGM_NETFLOW_INFO,
109 "info",
110 NULL,
111 &ng_netflow_info_type
112 },
113 {
114 NGM_NETFLOW_COOKIE,
115 NGM_NETFLOW_IFINFO,
116 "ifinfo",
117 &ng_parse_uint8_type,
118 &ng_netflow_ifinfo_type
119 },
120 {
121 NGM_NETFLOW_COOKIE,
122 NGM_NETFLOW_SETDLT,
123 "setdlt",
124 &ng_netflow_setdlt_type,
125 NULL
126 },
127 {
128 NGM_NETFLOW_COOKIE,
129 NGM_NETFLOW_SETIFINDEX,
130 "setifindex",
131 &ng_netflow_setifindex_type,
132 NULL
133 },
134 {
135 NGM_NETFLOW_COOKIE,
136 NGM_NETFLOW_SETTIMEOUTS,
137 "settimeouts",
138 &ng_netflow_settimeouts_type,
139 NULL
140 },
141 { 0 }
142};
143
144
145/* Netgraph node type descriptor */
146static struct ng_type ng_netflow_typestruct = {
147 .version = NG_ABI_VERSION,
148 .name = NG_NETFLOW_NODE_TYPE,
149 .constructor = ng_netflow_constructor,
150 .rcvmsg = ng_netflow_rcvmsg,
151 .close = ng_netflow_close,
152 .shutdown = ng_netflow_rmnode,
153 .newhook = ng_netflow_newhook,
154 .rcvdata = ng_netflow_rcvdata,
155 .disconnect = ng_netflow_disconnect,
156 .cmdlist = ng_netflow_cmds,
157};
158NETGRAPH_INIT(netflow, &ng_netflow_typestruct);
159
160/* Called at node creation */
161static int
162ng_netflow_constructor (node_p node)
163{
164 priv_p priv;
165 int error = 0;
166
167 /* Initialize private data */
168 MALLOC(priv, priv_p, sizeof(*priv), M_NETGRAPH, M_NOWAIT);
169 if (priv == NULL)
170 return (ENOMEM);
171 bzero(priv, sizeof(*priv));
172
173 /* Make node and its data point at each other */
174 NG_NODE_SET_PRIVATE(node, priv);
175 priv->node = node;
176
177 /* Initialize timeouts to default values */
178 priv->info.nfinfo_inact_t = INACTIVE_TIMEOUT;
179 priv->info.nfinfo_act_t = ACTIVE_TIMEOUT;
180
181 /* Initialize callout handle */
182 callout_init(&priv->exp_callout, 1);
183
184 /* Allocate memory and set up flow cache */
185 if ((error = ng_netflow_cache_init(priv)))
186 return (error);
187
188 priv->dgram.header.version = htons(NETFLOW_V5);
189
190 return (0);
191}
192
193/*
194 * ng_netflow supports two hooks: data and export.
195 * Incoming traffic is expected on data, and expired
196 * netflow datagrams are sent to export.
197 */
198static int
199ng_netflow_newhook(node_p node, hook_p hook, const char *name)
200{
201 const priv_p priv = NG_NODE_PRIVATE(node);
202
203 if (strncmp(name, NG_NETFLOW_HOOK_DATA, /* an iface hook? */
204 strlen(NG_NETFLOW_HOOK_DATA)) == 0) {
205 iface_p iface;
206 int ifnum = -1;
207 const char *cp;
208 char *eptr;
209
210 cp = name + strlen(NG_NETFLOW_HOOK_DATA);
211 if (!isdigit(*cp) || (cp[0] == '0' && cp[1] != '\0'))
212 return (EINVAL);
213
214 ifnum = (int)strtoul(cp, &eptr, 10);
215 if (*eptr != '\0' || ifnum < 0 || ifnum >= NG_NETFLOW_MAXIFACES)
216 return (EINVAL);
217
218 /* See if hook is already connected */
219 if (priv->ifaces[ifnum].hook != NULL)
220 return (EISCONN);
221
222 iface = &priv->ifaces[ifnum];
223
224 /* Link private info and hook together */
225 NG_HOOK_SET_PRIVATE(hook, iface);
226 iface->hook = hook;
227
228 /*
229 * In most cases traffic accounting is done on an
230 * Ethernet interface, so default data link type
231 * will be DLT_EN10MB.
232 */
233 iface->info.ifinfo_dlt = DLT_EN10MB;
234
235 } else if (strcmp(name, NG_NETFLOW_HOOK_EXPORT) == 0) {
236
237 if (priv->export != NULL)
238 return (EISCONN);
239
240 priv->export = hook;
241
242 /* Exporter is ready. Let's schedule expiry. */
243 callout_reset(&priv->exp_callout, (1*hz), &ng_netflow_expire,
244 (void *)priv);
245 } else
246 return (EINVAL);
247
248 return (0);
249}
250
251/* Get a netgraph control message. */
252static int
253ng_netflow_rcvmsg (node_p node, item_p item, hook_p lasthook)
254{
255 const priv_p priv = NG_NODE_PRIVATE(node);
256 struct ng_mesg *resp = NULL;
257 int error = 0;
258 struct ng_mesg *msg;
259
260 NGI_GET_MSG(item, msg);
261
262 /* Deal with message according to cookie and command */
263 switch (msg->header.typecookie) {
264 case NGM_NETFLOW_COOKIE:
265 switch (msg->header.cmd) {
266 case NGM_NETFLOW_INFO:
267 {
268 struct ng_netflow_info *i;
269
270 NG_MKRESPONSE(resp, msg, sizeof(struct ng_netflow_info),
271 M_NOWAIT);
272 i = (struct ng_netflow_info *)resp->data;
273 ng_netflow_copyinfo(priv, i);
274
275 break;
276 }
277 case NGM_NETFLOW_IFINFO:
278 {
279 struct ng_netflow_ifinfo *i;
280 const uint8_t *index;
281
282 if (msg->header.arglen != sizeof(uint8_t))
283 ERROUT(EINVAL);
284
285 index = (uint8_t *)msg->data;
286
287 /* connected iface? */
288 if (priv->ifaces[*index].hook == NULL)
289 ERROUT(EINVAL);
290
291 NG_MKRESPONSE(resp, msg,
292 sizeof(struct ng_netflow_ifinfo), M_NOWAIT);
293 i = (struct ng_netflow_ifinfo *)resp->data;
294 memcpy((void *)i, (void *)&priv->ifaces[*index].info,
295 sizeof(priv->ifaces[*index].info));
296
297 break;
298 }
299 case NGM_NETFLOW_SETDLT:
300 {
301 struct ng_netflow_setdlt *set;
302 struct ng_netflow_iface *iface;
303
304 if (msg->header.arglen != sizeof(struct ng_netflow_setdlt))
305 ERROUT(EINVAL);
306
307 set = (struct ng_netflow_setdlt *)msg->data;
308 iface = &priv->ifaces[set->iface];
309
310 /* connected iface? */
311 if (iface->hook == NULL)
312 ERROUT(EINVAL);
313
314 switch (set->dlt) {
315 case DLT_EN10MB:
316 iface->info.ifinfo_dlt = DLT_EN10MB;
317 break;
318 case DLT_RAW:
319 iface->info.ifinfo_dlt = DLT_RAW;
320 break;
321 default:
322 ERROUT(EINVAL);
323 }
324 break;
325 }
326 case NGM_NETFLOW_SETIFINDEX:
327 {
328 struct ng_netflow_setifindex *set;
329 struct ng_netflow_iface *iface;
330
331 if (msg->header.arglen != sizeof(struct ng_netflow_setifindex))
332 ERROUT(EINVAL);
333
334 set = (struct ng_netflow_setifindex *)msg->data;
335 iface = &priv->ifaces[set->iface];
336
337 /* connected iface? */
338 if (iface->hook == NULL)
339 ERROUT(EINVAL);
340
341 iface->info.ifinfo_index = set->index;
342
343 break;
344 }
345 case NGM_NETFLOW_SETTIMEOUTS:
346 {
347 struct ng_netflow_settimeouts *set;
348
349 if (msg->header.arglen != sizeof(struct ng_netflow_settimeouts))
350 ERROUT(EINVAL);
351
352 set = (struct ng_netflow_settimeouts *)msg->data;
353
354 priv->info.nfinfo_inact_t = set->inactive_timeout;
355 priv->info.nfinfo_act_t = set->active_timeout;
356
357 break;
358 }
359 case NGM_NETFLOW_SHOW:
360 {
361 uint32_t *last;
362
363 if (msg->header.arglen != sizeof(uint32_t))
364 ERROUT(EINVAL);
365
366 last = (uint32_t *)msg->data;
367
368 NG_MKRESPONSE(resp, msg, NGRESP_SIZE, M_NOWAIT);
369
370 if (!resp)
371 ERROUT(ENOMEM);
372
373 error = ng_netflow_flow_show(priv, *last, resp);
374
375 break;
376 }
377 default:
378 ERROUT(EINVAL); /* unknown command */
379 break;
380 }
381 break;
382 default:
383 ERROUT(EINVAL); /* incorrect cookie */
384 break;
385 }
386
387 /*
388 * Take care of synchronous response, if any.
389 * Free memory and return.
390 */
391done:
392 NG_RESPOND_MSG(error, node, item, resp);
393 NG_FREE_MSG(msg);
394
395 return (error);
396}
397
398/* Receive data on hook. */
399static int
400ng_netflow_rcvdata (hook_p hook, item_p item)
401{
402 const node_p node = NG_HOOK_NODE(hook);
403 const priv_p priv = NG_NODE_PRIVATE(node);
404 const iface_p iface = NG_HOOK_PRIVATE(hook);
405 struct mbuf *m;
406 int error = 0;
407
408 NGI_GET_M(item, m);
409 if (hook == priv->export) {
410 /*
411 * Data arrived on export hook.
412 * This must not happen.
413 */
414 printf("ng_netflow: incoming data on export hook!\n");
415 ERROUT(EINVAL);
416 };
417
418 /* increase counters */
419 iface->info.ifinfo_packets++;
420
421 switch (iface->info.ifinfo_dlt) {
422 case DLT_EN10MB: /* Ethernet */
423 {
424 struct ether_header *eh;
425 uint16_t etype;
426
427 if (CHECK_MLEN(m, (sizeof(struct ether_header))))
428 ERROUT(EINVAL);
429
430 if (CHECK_PULLUP(m, (sizeof(struct ether_header))))
431 ERROUT(ENOBUFS);
432
433 eh = mtod(m, struct ether_header *);
434
435 /* make sure this is IP frame */
436 etype = ntohs(eh->ether_type);
437 switch (etype) {
438 case ETHERTYPE_IP:
439 m_adj(m, sizeof(struct ether_header));
440 break;
441 default:
442 ERROUT(EINVAL); /* ignore this frame */
443 }
444
445 break;
446 }
447 case DLT_RAW:
448 break;
449 default:
450 ERROUT(EINVAL);
451 break;
452 }
453
454 if (CHECK_MLEN(m, sizeof(struct ip)))
455 ERROUT(EINVAL);
456
457 if (CHECK_PULLUP(m, sizeof(struct ip)))
458 ERROUT(ENOBUFS);
459
460 error = ng_netflow_flow_add(priv, &m, iface);
461
462done:
463 if (m) {
464 if (item)
465 NG_FREE_ITEM(item);
466 NG_FREE_M(m);
467 }
468
469 return (error);
470}
471
472/* We will be shut down in a moment */
473static int
474ng_netflow_close(node_p node)
475{
476 const priv_p priv = NG_NODE_PRIVATE(node);
477
478 callout_drain(&priv->exp_callout);
479 ng_netflow_cache_flush(priv);
480
481 return (0);
482}
483
484/* Do local shutdown processing. */
485static int
486ng_netflow_rmnode(node_p node)
487{
488 const priv_p priv = NG_NODE_PRIVATE(node);
489
490 NG_NODE_SET_PRIVATE(node, NULL);
491 NG_NODE_UNREF(priv->node);
492
493 FREE(priv, M_NETGRAPH);
494
495 return (0);
496}
497
498/* Hook disconnection. */
499static int
500ng_netflow_disconnect(hook_p hook)
501{
502 node_p node = NG_HOOK_NODE(hook);
503 priv_p priv = NG_NODE_PRIVATE(node);
504 iface_p iface = NG_HOOK_PRIVATE(hook);
505
506 if (iface != NULL)
507 iface->hook = NULL;
508
509 /* if export hook disconnected stop running expire(). */
510 if (hook == priv->export) {
511 callout_drain(&priv->exp_callout);
512 priv->export = NULL;
513 }
514
515 /* Removal of the last link destroys the node. */
516 if (NG_NODE_NUMHOOKS(node) == 0)
517 ng_rmnode_self(node);
518
519 return (0);
520}
|