ng_netflow.h revision 135400 
1/*-
2 * Copyright (c) 2004 Gleb Smirnoff <glebius@FreeBSD.org>
3 * Copyright (c) 2001-2003 Roman V. Palagin <romanp@unshadow.net>
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 *
27 *	 $SourceForge: ng_netflow.h,v 1.26 2004/09/04 15:44:55 glebius Exp $
28 *	 $FreeBSD: head/sys/netgraph/netflow/ng_netflow.h 135400 2004-09-17 19:58:03Z glebius $
29 */
30
31#ifndef	_NG_NETFLOW_H_
32#define	_NG_NETFLOW_H_
33
34#define NG_NETFLOW_NODE_TYPE	"netflow"
35#define NGM_NETFLOW_COOKIE	1095355665
36
37#define	NG_NETFLOW_MAXIFACES	64
38
39/* Hook names */
40
41#define	NG_NETFLOW_HOOK_DATA	"iface"
42#define NG_NETFLOW_HOOK_EXPORT	"export"
43
44/* Netgraph commands understood by netflow node */
45enum {
46    NGM_NETFLOW_INFO = 1,	/* get node info */
47    NGM_NETFLOW_IFINFO,		/* get iface info */
48    NGM_NETFLOW_SHOW,		/* show ip cache flow */
49    NGM_NETFLOW_SETDLT,		/* set data-link type */
50    NGM_NETFLOW_SETIFINDEX, 	/* set interface index */
51    NGM_NETFLOW_SETTIMEOUTS, 	/* set active/inactive flow timeouts */
52};
53
54/* This structure is returned by the NGM_NETFLOW_INFO message */
55struct ng_netflow_info {
56	uint64_t	nfinfo_bytes;	/* total number of accounted bytes */
57	uint32_t	nfinfo_packets;	/* total number of accounted packets */
58	uint32_t	nfinfo_used;	/* number of used cache records */
59	uint32_t	nfinfo_free;	/* number of free records */
60	uint32_t	nfinfo_inact_t;	/* flow inactive timeout */
61	uint32_t	nfinfo_act_t;	/* flow active timeout */
62};
63
64/* This structure is returned by the NGM_NETFLOW_IFINFO message */
65struct ng_netflow_ifinfo {
66	uint32_t	ifinfo_packets;	/* number of packets for this iface */
67	uint8_t		ifinfo_dlt;	/* Data Link Type, DLT_XXX */
68#define	MAXDLTNAMELEN	20
69	u_int16_t	ifinfo_index;	/* connected iface index */
70};
71
72
73/* This structure is passed to NGM_NETFLOW_SETDLT message */
74struct ng_netflow_setdlt {
75	uint16_t iface;		/* which iface dlt change */
76	uint8_t  dlt;			/* DLT_XXX from bpf.h */
77};
78
79/* This structure is passed to NGM_NETFLOW_SETIFINDEX */
80struct ng_netflow_setifindex {
81	u_int16_t iface;		/* which iface index change */
82	u_int16_t index;		/* new index */
83};
84
85/* This structure is passed to NGM_NETFLOW_SETTIMEOUTS */
86struct ng_netflow_settimeouts {
87	uint32_t	inactive_timeout;	/* flow inactive timeout */
88	uint32_t	active_timeout;		/* flow active timeout */
89};
90
91/* This is unique data, which identifies flow */
92struct flow_rec {
93	struct in_addr	r_src;
94	struct in_addr	r_dst;
95	union {
96		struct {
97			uint16_t	s_port;	/* source TCP/UDP port */
98			uint16_t	d_port; /* destination TCP/UDP port */
99		} dir;
100		uint32_t both;
101	} ports;
102	union {
103		struct {
104			u_char		prot;	/* IP protocol */
105			u_char		tos;	/* IP TOS */
106			uint16_t	i_ifx;	/* input interface index */
107		} i;
108		uint32_t all;
109	} misc;
110};
111
112#define	r_ip_p	misc.i.prot
113#define	r_tos	misc.i.tos
114#define	r_i_ifx	misc.i.i_ifx
115#define r_misc	misc.all
116#define r_ports	ports.both
117#define r_sport	ports.dir.s_port
118#define r_dport	ports.dir.d_port
119
120/* A flow entry which accumulates statistics */
121struct flow_entry_data {
122	struct flow_rec		r;
123	struct in_addr		next_hop;
124	uint16_t		fle_o_ifx;	/* output interface index */
125#define				fle_i_ifx	r.misc.i.i_ifx
126	uint8_t		dst_mask;	/* destination route mask bits */
127	uint8_t		src_mask;	/* source route mask bits */
128	u_long			packets;
129	u_long			bytes;
130	long			first;	/* uptime on first packet */
131	long			last;	/* uptime on last packet */
132	u_char			tcp_flags;	/* cumulative OR */
133};
134
135/*
136 * How many flow records we will transfer at once
137 * without overflowing socket receive buffer
138 */
139#define NREC_AT_ONCE		1000
140#define NGRESP_SIZE		(sizeof(struct ngnf_flows) + (NREC_AT_ONCE * \
141				sizeof(struct flow_entry_data)))
142#define SORCVBUF_SIZE		(NGRESP_SIZE + 2 * sizeof(struct ng_mesg))
143
144/* This struct is returned to userland, when "show cache ip flow" */
145struct ngnf_flows {
146	uint32_t		nentries;
147	uint32_t		last;
148	struct flow_entry_data	entries[0];
149};
150
151/* Everything below is for kernel */
152
153#ifdef _KERNEL
154
155struct flow_entry {
156	struct flow_entry_data	f;
157
158	LIST_ENTRY(flow_entry)	fle_hash;	/* entries in one hash item */
159	TAILQ_ENTRY(flow_entry)	fle_work;	/* entries in work queue*/
160	SLIST_ENTRY(flow_entry)	fle_free;	/* entries in free stack */
161};
162
163/* Parsing declarations */
164
165/* Parse the info structure */
166#define	NG_NETFLOW_INFO_TYPE	{			\
167	{ "Bytes",	&ng_parse_uint64_type },	\
168	{ "Packets",	&ng_parse_uint32_type },	\
169	{ "Records used",	&ng_parse_uint32_type },\
170	{ "Records free",	&ng_parse_uint32_type },\
171	{ "Inactive timeout",	&ng_parse_uint32_type },\
172	{ "Active timeout",	&ng_parse_uint32_type },\
173	{ NULL }					\
174}
175
176/* Parse the ifinfo structure */
177#define NG_NETFLOW_IFINFO_TYPE	{			\
178	{ "packets",	&ng_parse_uint32_type },	\
179	{ "data link type", &ng_parse_uint8_type },	\
180	{ "index", &ng_parse_uint16_type },		\
181	{ NULL }					\
182}
183
184/* Parse the setdlt structure */
185#define	NG_NETFLOW_SETDLT_TYPE {			\
186	{ "iface",	&ng_parse_uint16_type },	\
187	{ "dlt",	&ng_parse_uint8_type  },	\
188	{ NULL }					\
189}
190
191/* Parse the setifindex structure */
192#define	NG_NETFLOW_SETIFINDEX_TYPE {			\
193	{ "iface",	&ng_parse_uint16_type },	\
194	{ "index",	&ng_parse_uint16_type },	\
195	{ NULL }					\
196}
197
198/* Parse the settimeouts structure */
199#define NG_NETFLOW_SETTIMEOUTS_TYPE {			\
200	{ "inactive",	&ng_parse_uint32_type },	\
201	{ "active",	&ng_parse_uint32_type },	\
202	{ NULL }					\
203}
204
205/* Private hook data */
206struct ng_netflow_iface {
207	hook_p		hook;		/* NULL when disconnected */
208	struct ng_netflow_ifinfo	info;
209};
210
211typedef struct ng_netflow_iface *iface_p;
212typedef struct ng_netflow_ifinfo *ifinfo_p;
213
214/* Structure describing our flow engine */
215struct netflow {
216	node_p			node;		/* link to the node itself */
217
218	struct ng_netflow_iface	ifaces[NG_NETFLOW_MAXIFACES];	/* incoming */
219	hook_p			export;		/* export data goes there */
220
221	struct ng_netflow_info	info;
222	uint32_t		flow_seq;	/* current flow sequence */
223
224	struct callout		exp_callout;
225
226	/* Flow cache is a big chunk of memory referenced by 'cache'.
227	 * Accounting engine searches for its record using hashing index
228	 * 'hash'. Expiry engine searches for its record from begining of
229	 * tail queue 'expire_q'. Allocation is performed using last free
230	 * stack held in singly linked list 'free_l' */
231#define	CACHESIZE			65536
232#define	CACHELOWAT			(CACHESIZE * 3/4)
233#define	CACHEHIGHWAT			(CACHESIZE * 9/10)
234	struct flow_entry		*cache;
235	struct flow_hash_entry		*hash;
236	TAILQ_HEAD( , flow_entry)	work_queue;
237	SLIST_HEAD( , flow_entry)	free_list;
238	SLIST_HEAD( , flow_entry)	expire_list;
239
240	/* Mutexes to protect above lists */
241	struct mtx			work_mtx;
242	struct mtx			free_mtx;
243	struct mtx			expire_mtx;
244
245	/* ng_netflow_export_send() forms its datagram here. */
246	struct netflow_export_dgram {
247		struct netflow_v5_header	header;
248		struct netflow_v5_record	r[NETFLOW_V5_MAX_RECORDS];
249	} __attribute__((__packed__)) dgram;
250};
251
252typedef struct netflow *priv_p;
253
254/* Header of a small list in hash cell */
255struct flow_hash_entry {
256	LIST_HEAD( ,flow_entry) head;
257};
258
259/* Make sure packet large enough to contain len bytes */
260#define	CHECK_MLEN(m, length)	((m)->m_pkthdr.len < (length))
261#define CHECK_PULLUP(m, length)	((m)->m_len < (length) && \
262				(((m) = m_pullup((m),(length))) == NULL))
263
264#define	ERROUT(x)	{ error = (x); goto done; }
265
266/* Prototypes for netflow.c */
267int	ng_netflow_cache_init(priv_p);
268void	ng_netflow_cache_flush(priv_p);
269void	ng_netflow_copyinfo(priv_p, struct ng_netflow_info *);
270timeout_t ng_netflow_expire;
271int	ng_netflow_flow_add(priv_p, struct mbuf **, iface_p);
272int	ng_netflow_flow_show(priv_p, uint32_t last, struct ng_mesg *);
273
274#endif	/* _KERNEL */
275#endif	/* _NG_NETFLOW_H_ */
276