netflow.c revision 137115
1/*- 2 * Copyright (c) 2004 Gleb Smirnoff <glebius@FreeBSD.org> 3 * Copyright (c) 2001-2003 Roman V. Palagin <romanp@unshadow.net> 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25 * SUCH DAMAGE. 26 * 27 * $SourceForge: netflow.c,v 1.41 2004/09/05 11:41:10 glebius Exp $ 28 */ 29 30static const char rcs_id[] = 31 "@(#) $FreeBSD: head/sys/netgraph/netflow/netflow.c 137115 2004-11-01 20:52:24Z glebius $"; 32 33#include <sys/param.h> 34#include <sys/kernel.h> 35#include <sys/limits.h> 36#include <sys/mbuf.h> 37#include <sys/systm.h> 38#include <sys/socket.h> 39 40#include <net/if.h> 41#include <net/if_var.h> 42#include <net/if_dl.h> 43#include <net/route.h> 44#include <netinet/in.h> 45#include <netinet/in_systm.h> 46#include <netinet/ip.h> 47#include <netinet/tcp.h> 48#include <netinet/udp.h> 49 50#include <netgraph/ng_message.h> 51#include <netgraph/netgraph.h> 52 53#include <netgraph/netflow/netflow.h> 54#include <netgraph/netflow/ng_netflow.h> 55 56#define NBUCKETS (4096) /* must be power of 2 */ 57 58/* This hash is for TCP or UDP packets */ 59#define FULL_HASH(addr1,addr2,port1,port2)\ 60 (((addr1 >> 16) ^ \ 61 (addr2 & 0x00FF) ^ \ 62 ((port1 ^ port2) << 8) )& \ 63 (NBUCKETS - 1)) 64 65/* This hash for all other IP packets */ 66#define ADDR_HASH(addr1,addr2)\ 67 (((addr1 >> 16) ^ \ 68 (addr2 & 0x00FF) )& \ 69 (NBUCKETS - 1)) 70 71/* Macros to shorten logical constructions */ 72/* XXX: priv must exist in namespace */ 73#define INACTIVE(fle) (time_uptime - fle->f.last > priv->info.nfinfo_inact_t) 74#define AGED(fle) (time_uptime - fle->f.first > priv->info.nfinfo_act_t) 75#define ISFREE(fle) (fle->f.packets == 0) 76 77/* 78 * 4 is a magical number: statistically number of 4-packet flows is 79 * bigger than 5,6,7...-packet flows by an order of magnitude. Most UDP/ICMP 80 * scans are 1 packet (~ 90% of flow cache). TCP scans are 2-packet in case 81 * of reachable host and 4-packet otherwise. 82 */ 83#define SMALL(fle) (fle->f.packets <= 4) 84 85MALLOC_DECLARE(M_NETFLOW); 86MALLOC_DEFINE(M_NETFLOW, "NetFlow", "flow cache"); 87 88static int export_add(priv_p , struct flow_entry *); 89static int export_send(priv_p ); 90 91/* Generate hash for a given flow record */ 92static __inline uint32_t 93ip_hash(struct flow_rec *r) 94{ 95 switch (r->r_ip_p) { 96 case IPPROTO_TCP: 97 case IPPROTO_UDP: 98 return FULL_HASH(r->r_src.s_addr, r->r_dst.s_addr, 99 r->r_sport, r->r_dport); 100 default: 101 return ADDR_HASH(r->r_src.s_addr, r->r_dst.s_addr); 102 } 103} 104 105/* Lookup for record in given slot */ 106static __inline struct flow_entry * 107hash_lookup(struct flow_hash_entry *h, int slot, struct flow_rec *r) 108{ 109 struct flow_entry *fle; 110 111 LIST_FOREACH(fle, &(h[slot].head), fle_hash) 112 if (bcmp(r, &fle->f.r, sizeof(struct flow_rec)) == 0) 113 return (fle); 114 115 return (NULL); 116} 117 118/* Get a flow entry from free list */ 119static __inline struct flow_entry * 120alloc_flow(priv_p priv, int *flows) 121{ 122 register struct flow_entry *fle; 123 124 mtx_lock(&priv->free_mtx); 125 126 if (SLIST_EMPTY(&priv->free_list)) { 127 mtx_unlock(&priv->free_mtx); 128 return(NULL); 129 } 130 131 fle = SLIST_FIRST(&priv->free_list); 132 SLIST_REMOVE_HEAD(&priv->free_list, fle_free); 133 134 priv->info.nfinfo_used++; 135 priv->info.nfinfo_free--; 136 137 if (flows != NULL) 138 *flows = priv->info.nfinfo_used; 139 140 mtx_unlock(&priv->free_mtx); 141 142 return (fle); 143} 144 145/* Insert flow entry into a free list. */ 146static __inline int 147free_flow(priv_p priv, struct flow_entry *fle) 148{ 149 int flows; 150 151 mtx_lock(&priv->free_mtx); 152 fle->f.packets = 0; 153 SLIST_INSERT_HEAD(&priv->free_list, fle, fle_free); 154 flows = priv->info.nfinfo_used--; 155 priv->info.nfinfo_free++; 156 mtx_unlock(&priv->free_mtx); 157 158 return flows; 159} 160 161#define NGNF_GETUSED(priv, rval) do { \ 162 mtx_lock(&priv->free_mtx); \ 163 rval = priv->info.nfinfo_used; \ 164 mtx_unlock(&priv->free_mtx); \ 165 } while (0) 166 167/* Insert flow entry into expire list. */ 168/* XXX: Flow must be detached from work queue, but not from cache */ 169static __inline void 170expire_flow(priv_p priv, struct flow_entry *fle) 171{ 172 mtx_assert(&priv->work_mtx, MA_OWNED); 173 LIST_REMOVE(fle, fle_hash); 174 175 mtx_lock(&priv->expire_mtx); 176 SLIST_INSERT_HEAD(&priv->expire_list, fle, fle_free); 177 mtx_unlock(&priv->expire_mtx); 178} 179 180/* Get a snapshot of node statistics */ 181void 182ng_netflow_copyinfo(priv_p priv, struct ng_netflow_info *i) 183{ 184 mtx_lock(&priv->free_mtx); 185 memcpy((void *)i, (void *)&priv->info, sizeof(priv->info)); 186 mtx_unlock(&priv->free_mtx); 187} 188 189/* Calculate number of bits in netmask */ 190#define g21 0x55555555ul /* = 0101_0101_0101_0101_0101_0101_0101_0101 */ 191#define g22 0x33333333ul /* = 0011_0011_0011_0011_0011_0011_0011_0011 */ 192#define g23 0x0f0f0f0ful /* = 0000_1111_0000_1111_0000_1111_0000_1111 */ 193static __inline u_char 194bit_count(uint32_t v) 195{ 196 v = (v & g21) + ((v >> 1) & g21); 197 v = (v & g22) + ((v >> 2) & g22); 198 v = (v + (v >> 4)) & g23; 199 return (v + (v >> 8) + (v >> 16) + (v >> 24)) & 0x3f; 200} 201 202/* 203 * Insert a record into defined slot. 204 * 205 * First we get for us a free flow entry, then fill in all 206 * possible fields in it. Then obtain lock on flow cache 207 * and insert flow entry. 208 */ 209static __inline int 210hash_insert(priv_p priv, int slot, struct flow_rec *r, int plen) 211{ 212 struct flow_hash_entry *h = priv->hash; 213 struct flow_entry *fle; 214 struct route ro; 215 struct sockaddr_in *sin; 216 217 fle = alloc_flow(priv, NULL); 218 if (fle == NULL) 219 return (ENOMEM); 220 221 /* 222 * Now fle is totally ours. It is detached from all lists, 223 * we can safely edit it. 224 */ 225 226 bcopy(r, &fle->f.r, sizeof(struct flow_rec)); 227 fle->f.bytes = plen; 228 fle->f.packets = 1; 229 230 priv->info.nfinfo_bytes += plen; 231 232 fle->f.first = fle->f.last = time_uptime; 233 234 /* 235 * First we do route table lookup on destination address. So we can 236 * fill in out_ifx, dst_mask, nexthop, and dst_as in future releases. 237 */ 238 bzero((caddr_t)&ro, sizeof(ro)); 239 sin = (struct sockaddr_in *)&ro.ro_dst; 240 sin->sin_len = sizeof(*sin); 241 sin->sin_family = AF_INET; 242 sin->sin_addr = fle->f.r.r_dst; 243 rtalloc_ign(&ro, RTF_CLONING); 244 if (ro.ro_rt != NULL) { 245 struct rtentry *rt = ro.ro_rt; 246 247 fle->f.fle_o_ifx = rt->rt_ifp->if_index; 248 249 if (rt->rt_flags & RTF_GATEWAY && 250 rt->rt_gateway->sa_family == AF_INET) 251 fle->f.next_hop = 252 ((struct sockaddr_in *)(rt->rt_gateway))->sin_addr; 253 254 if (rt_mask(rt)) 255 fle->f.dst_mask = 256 bit_count(((struct sockaddr_in *)rt_mask(rt))->sin_addr.s_addr); 257 else if (rt->rt_flags & RTF_HOST) 258 /* Give up. We can't determine mask :( */ 259 fle->f.dst_mask = 32; 260 261 RTFREE(ro.ro_rt); 262 } 263 264 /* Do route lookup on source address, to fill in src_mask. */ 265 266 bzero((caddr_t)&ro, sizeof(ro)); 267 sin = (struct sockaddr_in *)&ro.ro_dst; 268 sin->sin_len = sizeof(*sin); 269 sin->sin_family = AF_INET; 270 sin->sin_addr = fle->f.r.r_src; 271 rtalloc_ign(&ro, RTF_CLONING); 272 if (ro.ro_rt != NULL) { 273 struct rtentry *rt = ro.ro_rt; 274 275 if (rt_mask(rt)) 276 fle->f.src_mask = 277 bit_count(((struct sockaddr_in *)rt_mask(rt))->sin_addr.s_addr); 278 else if (rt->rt_flags & RTF_HOST) 279 /* Give up. We can't determine mask :( */ 280 fle->f.src_mask = 32; 281 282 RTFREE(ro.ro_rt); 283 } 284 285 /* Push new flow entry into flow cache */ 286 mtx_lock(&priv->work_mtx); 287 LIST_INSERT_HEAD(&(h[slot].head), fle, fle_hash); 288 TAILQ_INSERT_TAIL(&priv->work_queue, fle, fle_work); 289 mtx_unlock(&priv->work_mtx); 290 291 return (0); 292} 293 294static __inline int 295make_flow_rec(struct mbuf **m, int *plen, struct flow_rec *r, uint8_t *tcp_flags, 296 u_int16_t i_ifx) 297{ 298 register struct ip *ip; 299 int hlen; 300 int error = 0; 301 302 ip = mtod(*m, struct ip*); 303 304 /* check version */ 305 if (ip->ip_v != IPVERSION) 306 return (EINVAL); 307 308 /* verify min header length */ 309 hlen = ip->ip_hl << 2; 310 311 if (hlen < sizeof(struct ip)) 312 return (EINVAL); 313 314 r->r_src = ip->ip_src; 315 r->r_dst = ip->ip_dst; 316 317 /* save packet length */ 318 *plen = ntohs(ip->ip_len); 319 320 r->r_ip_p = ip->ip_p; 321 r->r_tos = ip->ip_tos; 322 323 if ((*m)->m_pkthdr.rcvif) 324 r->r_i_ifx = (*m)->m_pkthdr.rcvif->if_index; 325 else 326 r->r_i_ifx = i_ifx; 327 328 /* 329 * XXX NOTE: only first fragment of fragmented TCP, UDP and 330 * ICMP packet will be recorded with proper s_port and d_port. 331 * Following fragments will be recorded simply as IP packet with 332 * ip_proto = ip->ip_p and s_port, d_port set to zero. 333 * I know, it looks like bug. But I don't want to re-implement 334 * ip packet assebmling here. Anyway, (in)famous trafd works this way - 335 * and nobody complains yet :) 336 */ 337 if(ip->ip_off & htons(IP_OFFMASK)) 338 return (0); 339 340 /* skip IP header */ 341 m_adj(*m, hlen); 342 343 switch(r->r_ip_p) { 344 case IPPROTO_TCP: 345 { 346 register struct tcphdr *tcp; 347 348 /* verify that packet is not truncated */ 349 if (CHECK_MLEN(*m, sizeof(struct tcphdr))) 350 ERROUT(EINVAL); 351 352 if (CHECK_PULLUP(*m, sizeof(struct tcphdr))) 353 ERROUT(ENOBUFS); 354 355 tcp = mtod(*m, struct tcphdr*); 356 r->r_sport = tcp->th_sport; 357 r->r_dport = tcp->th_dport; 358 *tcp_flags = tcp->th_flags; 359 break; 360 } 361 case IPPROTO_UDP: 362 /* verify that packet is not truncated */ 363 if (CHECK_MLEN(*m, sizeof(struct udphdr))) 364 ERROUT(EINVAL); 365 366 if (CHECK_PULLUP(*m, sizeof(struct udphdr))) 367 ERROUT(ENOBUFS); 368 369 r->r_ports = *(mtod(*m, uint32_t *)); 370 break; 371 } 372 373done: 374 return (error); 375} 376 377/* 378 * Non-static functions called from ng_netflow.c 379 */ 380 381/* Allocate memory and set up flow cache */ 382int 383ng_netflow_cache_init(priv_p priv) 384{ 385 struct flow_entry *fle; 386 int i; 387 388 /* allocate cache */ 389 MALLOC(priv->cache, struct flow_entry *, 390 CACHESIZE * sizeof(struct flow_entry), 391 M_NETFLOW, M_WAITOK | M_ZERO); 392 393 if (priv->cache == NULL) 394 return (ENOMEM); 395 396 /* allocate hash */ 397 MALLOC(priv->hash, struct flow_hash_entry *, 398 NBUCKETS * sizeof(struct flow_hash_entry), 399 M_NETFLOW, M_WAITOK | M_ZERO); 400 401 if (priv->hash == NULL) 402 return (ENOMEM); 403 404 TAILQ_INIT(&priv->work_queue); 405 SLIST_INIT(&priv->free_list); 406 SLIST_INIT(&priv->expire_list); 407 408 mtx_init(&priv->work_mtx, "ng_netflow cache mutex", NULL, MTX_DEF); 409 mtx_init(&priv->free_mtx, "ng_netflow free mutex", NULL, MTX_DEF); 410 mtx_init(&priv->expire_mtx, "ng_netflow expire mutex", NULL, MTX_DEF); 411 412 /* build free list */ 413 for (i = 0, fle = priv->cache; i < CACHESIZE; i++, fle++) 414 SLIST_INSERT_HEAD(&priv->free_list, fle, fle_free); 415 416 priv->info.nfinfo_free = CACHESIZE; 417 418 return (0); 419} 420 421/* Free all flow cache memory. Called from node close method. */ 422void 423ng_netflow_cache_flush(priv_p priv) 424{ 425 register struct flow_entry *fle; 426 int i; 427 428 /* 429 * We are going to free probably billable data. 430 * Expire everything before freeing it. 431 * No locking is required since callout is already drained. 432 */ 433 434 for (i = 0, fle = priv->cache; i < CACHESIZE; i++, fle++) 435 if (!ISFREE(fle)) 436 /* ignore errors now */ 437 (void )export_add(priv, fle); 438 439 mtx_destroy(&priv->work_mtx); 440 mtx_destroy(&priv->free_mtx); 441 mtx_destroy(&priv->expire_mtx); 442 443 /* free hash memory */ 444 if (priv->hash) 445 FREE(priv->hash, M_NETFLOW); 446 447 /* free flow cache */ 448 if (priv->cache) 449 FREE(priv->cache, M_NETFLOW); 450 451} 452 453/* Insert packet from &m into flow cache. */ 454int 455ng_netflow_flow_add(priv_p priv, struct mbuf **m, iface_p iface) 456{ 457 struct flow_hash_entry *h = priv->hash; 458 register struct flow_entry *fle; 459 struct flow_rec r; 460 int plen; 461 int error = 1; 462 uint32_t slot; 463 uint8_t tcp_flags = 0; 464 465 priv->info.nfinfo_packets ++; 466 467 /* Try to fill *rec */ 468 bzero(&r, sizeof(r)); 469 if ((error = make_flow_rec(m, &plen, &r, &tcp_flags, iface->info.ifinfo_index))) 470 return (error); 471 472 slot = ip_hash(&r); 473 474 mtx_lock(&priv->work_mtx); 475 fle = hash_lookup(h, slot, &r); /* New flow entry or existent? */ 476 477 if (fle) { /* an existent entry */ 478 479 TAILQ_REMOVE(&priv->work_queue, fle, fle_work); 480 481 fle->f.bytes += plen; 482 fle->f.packets ++; 483 fle->f.tcp_flags |= tcp_flags; 484 fle->f.last = time_uptime; 485 486 /* 487 * We have the following reasons to expire flow in active way: 488 * - it hit active timeout 489 * - a TCP connection closed 490 * - it is going to overflow counter 491 */ 492 if (tcp_flags & TH_FIN || tcp_flags & TH_RST || AGED(fle) || 493 (fle->f.bytes >= (UINT_MAX - IF_MAXMTU)) ) 494 expire_flow(priv, fle); 495 else 496 TAILQ_INSERT_TAIL(&priv->work_queue, fle, fle_work); 497 498 mtx_unlock(&priv->work_mtx); 499 priv->info.nfinfo_bytes += plen; 500 501 } else { /* a new flow entry */ 502 503 mtx_unlock(&priv->work_mtx); 504 return hash_insert(priv, slot, &r, plen); 505 506 } 507 508 mtx_assert(&priv->work_mtx, MA_NOTOWNED); 509 mtx_assert(&priv->expire_mtx, MA_NOTOWNED); 510 mtx_assert(&priv->free_mtx, MA_NOTOWNED); 511 return (0); 512} 513 514/* 515 * Return records from cache. netgraph(4) guarantees us that we 516 * are locked against ng_netflow_rcvdata(). However we can 517 * work with ng_netflow_expire() in parrallel. XXX: Is it dangerous? 518 * 519 * TODO: matching particular IP should be done in kernel, here. 520 */ 521int 522ng_netflow_flow_show(priv_p priv, uint32_t last, struct ng_mesg *resp) 523{ 524 struct flow_entry *fle; 525 struct ngnf_flows *data; 526 527 data = (struct ngnf_flows *)resp->data; 528 data->last = 0; 529 data->nentries = 0; 530 531 /* Check if this is a first run */ 532 if (last == 0) 533 fle = priv->cache; 534 else { 535 if (last > CACHESIZE-1) 536 return (EINVAL); 537 fle = priv->cache + last; 538 } 539 540 /* 541 * We will transfer not more than NREC_AT_ONCE. More data 542 * will come in next message. 543 * We send current stop point to userland, and userland should return 544 * it back to us. 545 */ 546 for (; last < CACHESIZE; fle++, last++) { 547 if (ISFREE(fle)) 548 continue; 549 bcopy(&fle->f, &(data->entries[data->nentries]), sizeof(fle->f)); 550 data->nentries ++; 551 if (data->nentries == NREC_AT_ONCE) { 552 if (++last < CACHESIZE) 553 data->last = (++fle - priv->cache); 554 return (0); 555 } 556 } 557 558 return (0); 559} 560 561/* We have full datagram in privdata. Send it to export hook. */ 562static int 563export_send(priv_p priv) 564{ 565 struct netflow_v5_header *header = &priv->dgram.header; 566 struct timespec ts; 567 struct mbuf *m; 568 int error = 0; 569 int mlen; 570 571 header->sys_uptime = htonl(time_uptime); 572 573 getnanotime(&ts); 574 header->unix_secs = htonl(ts.tv_sec); 575 header->unix_nsecs = htonl(ts.tv_nsec); 576 577 /* Flow sequence contains number of first record */ 578 header->flow_seq = htonl(priv->flow_seq - header->count); 579 580 mlen = sizeof(struct netflow_v5_header) + 581 sizeof(struct netflow_v5_record) * header->count; 582 583 header->count = htons(header->count); 584 if ((m = m_devget((caddr_t)header, mlen, 0, NULL, NULL)) == NULL) { 585 printf("ng_netflow: m_devget() failed, losing export dgram\n"); 586 header->count = 0; 587 return(ENOBUFS); 588 } 589 590 header->count = 0; 591 592 /* Giant is required in sosend() at this moment. */ 593 NET_LOCK_GIANT(); 594 NG_SEND_DATA_ONLY(error, priv->export, m); 595 NET_UNLOCK_GIANT(); 596 597 if (error) 598 NG_FREE_M(m); 599 600 return (error); 601} 602 603 604/* Create export datagram. */ 605static int 606export_add(priv_p priv, struct flow_entry *fle) 607{ 608 struct netflow_v5_header *header = &priv->dgram.header; 609 struct netflow_v5_record *rec; 610 611 if (header->count == 0 ) { /* first record */ 612 rec = &priv->dgram.r[0]; 613 header->count = 1; 614 } else { /* continue filling datagram */ 615 rec = &priv->dgram.r[header->count]; 616 header->count ++; 617 } 618 619 /* Fill in export record */ 620 rec->src_addr = fle->f.r.r_src.s_addr; 621 rec->dst_addr = fle->f.r.r_dst.s_addr; 622 rec->next_hop = fle->f.next_hop.s_addr; 623 rec->i_ifx = htons(fle->f.fle_i_ifx); 624 rec->o_ifx = htons(fle->f.fle_o_ifx); 625 rec->packets = htonl(fle->f.packets); 626 rec->octets = htonl(fle->f.bytes); 627 rec->first = htonl(fle->f.first); 628 rec->last = htonl(fle->f.last); 629 rec->s_port = fle->f.r.r_sport; 630 rec->d_port = fle->f.r.r_dport; 631 rec->flags = fle->f.tcp_flags; 632 rec->prot = fle->f.r.r_ip_p; 633 rec->tos = fle->f.r.r_tos; 634 rec->dst_mask = fle->f.dst_mask; 635 rec->src_mask = fle->f.src_mask; 636 637 priv->flow_seq++; 638 639 if (header->count == NETFLOW_V5_MAX_RECORDS) /* end of datagram */ 640 return export_send(priv); 641 642 return (0); 643} 644 645/* Periodic flow expiry run. */ 646void 647ng_netflow_expire(void *arg) 648{ 649 register struct flow_entry *fle, *fle1; 650 priv_p priv = (priv_p )arg; 651 uint32_t used; 652 int error = 0; 653 654 /* First pack actively expired entries */ 655 mtx_lock(&priv->expire_mtx); 656 while (!SLIST_EMPTY(&(priv->expire_list))) { 657 fle = SLIST_FIRST(&(priv->expire_list)); 658 SLIST_REMOVE_HEAD(&(priv->expire_list), fle_free); 659 mtx_unlock(&priv->expire_mtx); 660 661 /* 662 * While we have dropped the lock, expire_flow() may 663 * insert another flow into top of the list. 664 * This is not harmful for us, since we have already 665 * detached our own. 666 */ 667 668 if ((error = export_add(priv, fle)) != 0) 669 printf("ng_netflow: export_add() failed: %u\n", error); 670 (void )free_flow(priv, fle); 671 672 mtx_lock(&priv->expire_mtx); 673 } 674 mtx_unlock(&priv->expire_mtx); 675 676 NGNF_GETUSED(priv, used); 677 mtx_lock(&priv->work_mtx); 678 TAILQ_FOREACH_SAFE(fle, &(priv->work_queue), fle_work, fle1) { 679 /* 680 * When cache size has not reached CACHELOWAT yet, we keep both 681 * inactive and active flows in cache. Doing this, we reduce number 682 * of exports, since many inactive flows may wake up and continue 683 * their life. However, we make an exclusion for scans. It is very 684 * rare situation that inactive 1-packet flow will wake up. 685 * When cache has reached CACHELOWAT, we expire all inactive flows, 686 * until cache gets of sane size. 687 */ 688 if (used <= CACHELOWAT && !INACTIVE(fle)) 689 goto finish; 690 691 if (INACTIVE(fle) && (SMALL(fle) || (used > CACHELOWAT))) { 692 693 /* Detach flow entry from cache */ 694 LIST_REMOVE(fle, fle_hash); 695 TAILQ_REMOVE(&priv->work_queue, fle, fle_work); 696 697 /* 698 * While we are sending to collector, unlock cache. 699 * XXX: it can happen, however with a small probability, 700 * that item, we are holding now, can be moved to the top 701 * of flow cache by node thread. In this case our expire 702 * thread stops checking. Since this is not fatal we will 703 * just ignore it now. 704 */ 705 mtx_unlock(&priv->work_mtx); 706 707 if ((error = export_add(priv, fle)) != 0) 708 printf("ng_netflow: export_add() failed: %u\n", 709 error); 710 711 used = free_flow(priv, fle); 712 713 mtx_lock(&priv->work_mtx); 714 } 715 } 716 717finish: 718 mtx_unlock(&priv->work_mtx); 719 720 mtx_assert(&priv->expire_mtx, MA_NOTOWNED); 721 mtx_assert(&priv->free_mtx, MA_NOTOWNED); 722 723 /* schedule next expire */ 724 callout_reset(&priv->exp_callout, (1*hz), &ng_netflow_expire, 725 (void *)priv); 726 727} 728