14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 *
27 * $SourceForge: ng_netflow.h,v 1.26 2004/09/04 15:44:55 glebius Exp $
|
29 */
30
31#ifndef _NG_NETFLOW_H_
32#define _NG_NETFLOW_H_
33
34#define NG_NETFLOW_NODE_TYPE "netflow"
35#define NGM_NETFLOW_COOKIE 1095355665
36
37#define NG_NETFLOW_MAXIFACES 64
38
39/* Hook names */
40
41#define NG_NETFLOW_HOOK_DATA "iface"
42#define NG_NETFLOW_HOOK_EXPORT "export"
43
44/* Netgraph commands understood by netflow node */
45enum {
46 NGM_NETFLOW_INFO = 1, /* get node info */
47 NGM_NETFLOW_IFINFO, /* get iface info */
48 NGM_NETFLOW_SHOW, /* show ip cache flow */
49 NGM_NETFLOW_SETDLT, /* set data-link type */
50 NGM_NETFLOW_SETIFINDEX, /* set interface index */
51 NGM_NETFLOW_SETTIMEOUTS, /* set active/inactive flow timeouts */
52};
53
54/* This structure is returned by the NGM_NETFLOW_INFO message */
55struct ng_netflow_info {
56 uint64_t nfinfo_bytes; /* total number of accounted bytes */
57 uint32_t nfinfo_packets; /* total number of accounted packets */
58 uint32_t nfinfo_used; /* number of used cache records */
59 uint32_t nfinfo_free; /* number of free records */
60 uint32_t nfinfo_inact_t; /* flow inactive timeout */
61 uint32_t nfinfo_act_t; /* flow active timeout */
62};
63
64/* This structure is returned by the NGM_NETFLOW_IFINFO message */
65struct ng_netflow_ifinfo {
66 uint32_t ifinfo_packets; /* number of packets for this iface */
67 uint8_t ifinfo_dlt; /* Data Link Type, DLT_XXX */
68#define MAXDLTNAMELEN 20
69 u_int16_t ifinfo_index; /* connected iface index */
70};
71
72
73/* This structure is passed to NGM_NETFLOW_SETDLT message */
74struct ng_netflow_setdlt {
75 uint16_t iface; /* which iface dlt change */
76 uint8_t dlt; /* DLT_XXX from bpf.h */
77};
78
79/* This structure is passed to NGM_NETFLOW_SETIFINDEX */
80struct ng_netflow_setifindex {
81 u_int16_t iface; /* which iface index change */
82 u_int16_t index; /* new index */
83};
84
85/* This structure is passed to NGM_NETFLOW_SETTIMEOUTS */
86struct ng_netflow_settimeouts {
87 uint32_t inactive_timeout; /* flow inactive timeout */
88 uint32_t active_timeout; /* flow active timeout */
89};
90
91/* This is unique data, which identifies flow */
92struct flow_rec {
93 struct in_addr r_src;
94 struct in_addr r_dst;
95 union {
96 struct {
97 uint16_t s_port; /* source TCP/UDP port */
98 uint16_t d_port; /* destination TCP/UDP port */
99 } dir;
100 uint32_t both;
101 } ports;
102 union {
103 struct {
104 u_char prot; /* IP protocol */
105 u_char tos; /* IP TOS */
106 uint16_t i_ifx; /* input interface index */
107 } i;
108 uint32_t all;
109 } misc;
110};
111
112#define r_ip_p misc.i.prot
113#define r_tos misc.i.tos
114#define r_i_ifx misc.i.i_ifx
115#define r_misc misc.all
116#define r_ports ports.both
117#define r_sport ports.dir.s_port
118#define r_dport ports.dir.d_port
119
120/* A flow entry which accumulates statistics */
121struct flow_entry_data {
122 struct flow_rec r;
123 struct in_addr next_hop;
124 uint16_t fle_o_ifx; /* output interface index */
125#define fle_i_ifx r.misc.i.i_ifx
126 uint8_t dst_mask; /* destination route mask bits */
127 uint8_t src_mask; /* source route mask bits */
128 u_long packets;
129 u_long bytes;
130 long first; /* uptime on first packet */
131 long last; /* uptime on last packet */
132 u_char tcp_flags; /* cumulative OR */
133};
134
135/*
136 * How many flow records we will transfer at once
137 * without overflowing socket receive buffer
138 */
139#define NREC_AT_ONCE 1000
140#define NGRESP_SIZE (sizeof(struct ngnf_flows) + (NREC_AT_ONCE * \
141 sizeof(struct flow_entry_data)))
142#define SORCVBUF_SIZE (NGRESP_SIZE + 2 * sizeof(struct ng_mesg))
143
144/* This struct is returned to userland, when "show cache ip flow" */
145struct ngnf_flows {
146 uint32_t nentries;
147 uint32_t last;
148 struct flow_entry_data entries[0];
149};
150
151/* Everything below is for kernel */
152
153#ifdef _KERNEL
154
155struct flow_entry {
156 struct flow_entry_data f;
157
158 LIST_ENTRY(flow_entry) fle_hash; /* entries in one hash item */
159 TAILQ_ENTRY(flow_entry) fle_work; /* entries in work queue*/
160 SLIST_ENTRY(flow_entry) fle_free; /* entries in free stack */
161};
162
163/* Parsing declarations */
164
165/* Parse the info structure */
166#define NG_NETFLOW_INFO_TYPE { \
167 { "Bytes", &ng_parse_uint64_type }, \
168 { "Packets", &ng_parse_uint32_type }, \
169 { "Records used", &ng_parse_uint32_type },\
170 { "Records free", &ng_parse_uint32_type },\
171 { "Inactive timeout", &ng_parse_uint32_type },\
172 { "Active timeout", &ng_parse_uint32_type },\
173 { NULL } \
174}
175
176/* Parse the ifinfo structure */
177#define NG_NETFLOW_IFINFO_TYPE { \
178 { "packets", &ng_parse_uint32_type }, \
179 { "data link type", &ng_parse_uint8_type }, \
180 { "index", &ng_parse_uint16_type }, \
181 { NULL } \
182}
183
184/* Parse the setdlt structure */
185#define NG_NETFLOW_SETDLT_TYPE { \
186 { "iface", &ng_parse_uint16_type }, \
187 { "dlt", &ng_parse_uint8_type }, \
188 { NULL } \
189}
190
191/* Parse the setifindex structure */
192#define NG_NETFLOW_SETIFINDEX_TYPE { \
193 { "iface", &ng_parse_uint16_type }, \
194 { "index", &ng_parse_uint16_type }, \
195 { NULL } \
196}
197
198/* Parse the settimeouts structure */
199#define NG_NETFLOW_SETTIMEOUTS_TYPE { \
200 { "inactive", &ng_parse_uint32_type }, \
201 { "active", &ng_parse_uint32_type }, \
202 { NULL } \
203}
204
205/* Private hook data */
206struct ng_netflow_iface {
207 hook_p hook; /* NULL when disconnected */
208 struct ng_netflow_ifinfo info;
209};
210
211typedef struct ng_netflow_iface *iface_p;
212typedef struct ng_netflow_ifinfo *ifinfo_p;
213
214/* Structure describing our flow engine */
215struct netflow {
216 node_p node; /* link to the node itself */
217
218 struct ng_netflow_iface ifaces[NG_NETFLOW_MAXIFACES]; /* incoming */
219 hook_p export; /* export data goes there */
220
221 struct ng_netflow_info info;
222 uint32_t flow_seq; /* current flow sequence */
223
224 struct callout exp_callout;
225
226 /* Flow cache is a big chunk of memory referenced by 'cache'.
227 * Accounting engine searches for its record using hashing index
228 * 'hash'. Expiry engine searches for its record from begining of
229 * tail queue 'expire_q'. Allocation is performed using last free
230 * stack held in singly linked list 'free_l' */
231#define CACHESIZE 65536
232#define CACHELOWAT (CACHESIZE * 3/4)
233#define CACHEHIGHWAT (CACHESIZE * 9/10)
234 struct flow_entry *cache;
235 struct flow_hash_entry *hash;
236 TAILQ_HEAD( , flow_entry) work_queue;
237 SLIST_HEAD( , flow_entry) free_list;
238 SLIST_HEAD( , flow_entry) expire_list;
239
240 /* Mutexes to protect above lists */
241 struct mtx work_mtx;
242 struct mtx free_mtx;
243 struct mtx expire_mtx;
244
245 /* ng_netflow_export_send() forms its datagram here. */
246 struct netflow_export_dgram {
247 struct netflow_v5_header header;
248 struct netflow_v5_record r[NETFLOW_V5_MAX_RECORDS];
249 } __attribute__((__packed__)) dgram;
250};
251
252typedef struct netflow *priv_p;
253
254/* Header of a small list in hash cell */
255struct flow_hash_entry {
256 LIST_HEAD( ,flow_entry) head;
257};
258
259/* Make sure packet large enough to contain len bytes */
260#define CHECK_MLEN(m, length) ((m)->m_pkthdr.len < (length))
261#define CHECK_PULLUP(m, length) ((m)->m_len < (length) && \
262 (((m) = m_pullup((m),(length))) == NULL))
263
264#define ERROUT(x) { error = (x); goto done; }
265
266/* Prototypes for netflow.c */
267int ng_netflow_cache_init(priv_p);
268void ng_netflow_cache_flush(priv_p);
269void ng_netflow_copyinfo(priv_p, struct ng_netflow_info *);
270timeout_t ng_netflow_expire;
271int ng_netflow_flow_add(priv_p, struct mbuf **, iface_p);
272int ng_netflow_flow_show(priv_p, uint32_t last, struct ng_mesg *);
273
274#endif /* _KERNEL */
275#endif /* _NG_NETFLOW_H_ */
|