netflow.c revision 140511
1/*- 2 * Copyright (c) 2004 Gleb Smirnoff <glebius@FreeBSD.org> 3 * Copyright (c) 2001-2003 Roman V. Palagin <romanp@unshadow.net> 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25 * SUCH DAMAGE. 26 * 27 * $SourceForge: netflow.c,v 1.41 2004/09/05 11:41:10 glebius Exp $ 28 */ 29 30static const char rcs_id[] = 31 "@(#) $FreeBSD: head/sys/netgraph/netflow/netflow.c 140511 2005-01-20 13:28:39Z glebius $"; 32 33#include <sys/param.h> 34#include <sys/kernel.h> 35#include <sys/limits.h> 36#include <sys/mbuf.h> 37#include <sys/syslog.h> 38#include <sys/systm.h> 39#include <sys/socket.h> 40 41#include <net/if.h> 42#include <net/if_var.h> 43#include <net/if_dl.h> 44#include <net/route.h> 45#include <netinet/in.h> 46#include <netinet/in_systm.h> 47#include <netinet/ip.h> 48#include <netinet/tcp.h> 49#include <netinet/udp.h> 50 51#include <netgraph/ng_message.h> 52#include <netgraph/netgraph.h> 53 54#include <netgraph/netflow/netflow.h> 55#include <netgraph/netflow/ng_netflow.h> 56 57#define NBUCKETS (4096) /* must be power of 2 */ 58 59/* This hash is for TCP or UDP packets */ 60#define FULL_HASH(addr1,addr2,port1,port2)\ 61 (((addr1 >> 16) ^ \ 62 (addr2 & 0x00FF) ^ \ 63 ((port1 ^ port2) << 8) )& \ 64 (NBUCKETS - 1)) 65 66/* This hash for all other IP packets */ 67#define ADDR_HASH(addr1,addr2)\ 68 (((addr1 >> 16) ^ \ 69 (addr2 & 0x00FF) )& \ 70 (NBUCKETS - 1)) 71 72/* Macros to shorten logical constructions */ 73/* XXX: priv must exist in namespace */ 74#define INACTIVE(fle) (time_uptime - fle->f.last > priv->info.nfinfo_inact_t) 75#define AGED(fle) (time_uptime - fle->f.first > priv->info.nfinfo_act_t) 76#define ISFREE(fle) (fle->f.packets == 0) 77 78/* 79 * 4 is a magical number: statistically number of 4-packet flows is 80 * bigger than 5,6,7...-packet flows by an order of magnitude. Most UDP/ICMP 81 * scans are 1 packet (~ 90% of flow cache). TCP scans are 2-packet in case 82 * of reachable host and 4-packet otherwise. 83 */ 84#define SMALL(fle) (fle->f.packets <= 4) 85 86MALLOC_DECLARE(M_NETFLOW); 87MALLOC_DEFINE(M_NETFLOW, "NetFlow", "flow cache"); 88 89static int export_add(priv_p , struct flow_entry *); 90static int export_send(priv_p ); 91 92/* Generate hash for a given flow record */ 93static __inline uint32_t 94ip_hash(struct flow_rec *r) 95{ 96 switch (r->r_ip_p) { 97 case IPPROTO_TCP: 98 case IPPROTO_UDP: 99 return FULL_HASH(r->r_src.s_addr, r->r_dst.s_addr, 100 r->r_sport, r->r_dport); 101 default: 102 return ADDR_HASH(r->r_src.s_addr, r->r_dst.s_addr); 103 } 104} 105 106/* Lookup for record in given slot */ 107static __inline struct flow_entry * 108hash_lookup(struct flow_hash_entry *h, int slot, struct flow_rec *r) 109{ 110 struct flow_entry *fle; 111 112 LIST_FOREACH(fle, &(h[slot].head), fle_hash) 113 if (bcmp(r, &fle->f.r, sizeof(struct flow_rec)) == 0) 114 return (fle); 115 116 return (NULL); 117} 118 119/* Get a flow entry from free list */ 120static __inline struct flow_entry * 121alloc_flow(priv_p priv, int *flows) 122{ 123 register struct flow_entry *fle; 124 125 mtx_lock(&priv->free_mtx); 126 127 if (SLIST_EMPTY(&priv->free_list)) { 128 mtx_unlock(&priv->free_mtx); 129 return(NULL); 130 } 131 132 fle = SLIST_FIRST(&priv->free_list); 133 SLIST_REMOVE_HEAD(&priv->free_list, fle_free); 134 135 priv->info.nfinfo_used++; 136 priv->info.nfinfo_free--; 137 138 if (flows != NULL) 139 *flows = priv->info.nfinfo_used; 140 141 mtx_unlock(&priv->free_mtx); 142 143 return (fle); 144} 145 146/* Insert flow entry into a free list. */ 147static __inline int 148free_flow(priv_p priv, struct flow_entry *fle) 149{ 150 int flows; 151 152 mtx_lock(&priv->free_mtx); 153 fle->f.packets = 0; 154 SLIST_INSERT_HEAD(&priv->free_list, fle, fle_free); 155 flows = priv->info.nfinfo_used--; 156 priv->info.nfinfo_free++; 157 mtx_unlock(&priv->free_mtx); 158 159 return flows; 160} 161 162#define NGNF_GETUSED(priv, rval) do { \ 163 mtx_lock(&priv->free_mtx); \ 164 rval = priv->info.nfinfo_used; \ 165 mtx_unlock(&priv->free_mtx); \ 166 } while (0) 167 168/* Insert flow entry into expire list. */ 169/* XXX: Flow must be detached from work queue, but not from cache */ 170static __inline void 171expire_flow(priv_p priv, struct flow_entry *fle) 172{ 173 mtx_assert(&priv->work_mtx, MA_OWNED); 174 LIST_REMOVE(fle, fle_hash); 175 176 mtx_lock(&priv->expire_mtx); 177 SLIST_INSERT_HEAD(&priv->expire_list, fle, fle_free); 178 mtx_unlock(&priv->expire_mtx); 179} 180 181/* Get a snapshot of node statistics */ 182void 183ng_netflow_copyinfo(priv_p priv, struct ng_netflow_info *i) 184{ 185 mtx_lock(&priv->free_mtx); 186 memcpy((void *)i, (void *)&priv->info, sizeof(priv->info)); 187 mtx_unlock(&priv->free_mtx); 188} 189 190/* Calculate number of bits in netmask */ 191#define g21 0x55555555ul /* = 0101_0101_0101_0101_0101_0101_0101_0101 */ 192#define g22 0x33333333ul /* = 0011_0011_0011_0011_0011_0011_0011_0011 */ 193#define g23 0x0f0f0f0ful /* = 0000_1111_0000_1111_0000_1111_0000_1111 */ 194static __inline u_char 195bit_count(uint32_t v) 196{ 197 v = (v & g21) + ((v >> 1) & g21); 198 v = (v & g22) + ((v >> 2) & g22); 199 v = (v + (v >> 4)) & g23; 200 return (v + (v >> 8) + (v >> 16) + (v >> 24)) & 0x3f; 201} 202 203/* 204 * Insert a record into defined slot. 205 * 206 * First we get for us a free flow entry, then fill in all 207 * possible fields in it. Then obtain lock on flow cache 208 * and insert flow entry. 209 */ 210static __inline int 211hash_insert(priv_p priv, int slot, struct flow_rec *r, int plen) 212{ 213 struct flow_hash_entry *h = priv->hash; 214 struct flow_entry *fle; 215 struct route ro; 216 struct sockaddr_in *sin; 217 218 fle = alloc_flow(priv, NULL); 219 if (fle == NULL) 220 return (ENOMEM); 221 222 /* 223 * Now fle is totally ours. It is detached from all lists, 224 * we can safely edit it. 225 */ 226 227 bcopy(r, &fle->f.r, sizeof(struct flow_rec)); 228 fle->f.bytes = plen; 229 fle->f.packets = 1; 230 231 priv->info.nfinfo_bytes += plen; 232 233 fle->f.first = fle->f.last = time_uptime; 234 235 /* 236 * First we do route table lookup on destination address. So we can 237 * fill in out_ifx, dst_mask, nexthop, and dst_as in future releases. 238 */ 239 bzero((caddr_t)&ro, sizeof(ro)); 240 sin = (struct sockaddr_in *)&ro.ro_dst; 241 sin->sin_len = sizeof(*sin); 242 sin->sin_family = AF_INET; 243 sin->sin_addr = fle->f.r.r_dst; 244 rtalloc_ign(&ro, RTF_CLONING); 245 if (ro.ro_rt != NULL) { 246 struct rtentry *rt = ro.ro_rt; 247 248 fle->f.fle_o_ifx = rt->rt_ifp->if_index; 249 250 if (rt->rt_flags & RTF_GATEWAY && 251 rt->rt_gateway->sa_family == AF_INET) 252 fle->f.next_hop = 253 ((struct sockaddr_in *)(rt->rt_gateway))->sin_addr; 254 255 if (rt_mask(rt)) 256 fle->f.dst_mask = 257 bit_count(((struct sockaddr_in *)rt_mask(rt))->sin_addr.s_addr); 258 else if (rt->rt_flags & RTF_HOST) 259 /* Give up. We can't determine mask :( */ 260 fle->f.dst_mask = 32; 261 262 RTFREE(ro.ro_rt); 263 } 264 265 /* Do route lookup on source address, to fill in src_mask. */ 266 267 bzero((caddr_t)&ro, sizeof(ro)); 268 sin = (struct sockaddr_in *)&ro.ro_dst; 269 sin->sin_len = sizeof(*sin); 270 sin->sin_family = AF_INET; 271 sin->sin_addr = fle->f.r.r_src; 272 rtalloc_ign(&ro, RTF_CLONING); 273 if (ro.ro_rt != NULL) { 274 struct rtentry *rt = ro.ro_rt; 275 276 if (rt_mask(rt)) 277 fle->f.src_mask = 278 bit_count(((struct sockaddr_in *)rt_mask(rt))->sin_addr.s_addr); 279 else if (rt->rt_flags & RTF_HOST) 280 /* Give up. We can't determine mask :( */ 281 fle->f.src_mask = 32; 282 283 RTFREE(ro.ro_rt); 284 } 285 286 /* Push new flow entry into flow cache */ 287 mtx_lock(&priv->work_mtx); 288 LIST_INSERT_HEAD(&(h[slot].head), fle, fle_hash); 289 TAILQ_INSERT_TAIL(&priv->work_queue, fle, fle_work); 290 mtx_unlock(&priv->work_mtx); 291 292 return (0); 293} 294 295static __inline int 296make_flow_rec(struct mbuf **m, int *plen, struct flow_rec *r, uint8_t *tcp_flags, 297 u_int16_t i_ifx) 298{ 299 register struct ip *ip; 300 int hlen; 301 int error = 0; 302 303 ip = mtod(*m, struct ip*); 304 305 /* check version */ 306 if (ip->ip_v != IPVERSION) 307 return (EINVAL); 308 309 /* verify min header length */ 310 hlen = ip->ip_hl << 2; 311 312 if (hlen < sizeof(struct ip)) 313 return (EINVAL); 314 315 r->r_src = ip->ip_src; 316 r->r_dst = ip->ip_dst; 317 318 /* save packet length */ 319 *plen = ntohs(ip->ip_len); 320 321 r->r_ip_p = ip->ip_p; 322 r->r_tos = ip->ip_tos; 323 324 if ((*m)->m_pkthdr.rcvif) 325 r->r_i_ifx = (*m)->m_pkthdr.rcvif->if_index; 326 else 327 r->r_i_ifx = i_ifx; 328 329 /* 330 * XXX NOTE: only first fragment of fragmented TCP, UDP and 331 * ICMP packet will be recorded with proper s_port and d_port. 332 * Following fragments will be recorded simply as IP packet with 333 * ip_proto = ip->ip_p and s_port, d_port set to zero. 334 * I know, it looks like bug. But I don't want to re-implement 335 * ip packet assebmling here. Anyway, (in)famous trafd works this way - 336 * and nobody complains yet :) 337 */ 338 if(ip->ip_off & htons(IP_OFFMASK)) 339 return (0); 340 341 /* skip IP header */ 342 m_adj(*m, hlen); 343 344 switch(r->r_ip_p) { 345 case IPPROTO_TCP: 346 { 347 register struct tcphdr *tcp; 348 349 /* verify that packet is not truncated */ 350 if (CHECK_MLEN(*m, sizeof(struct tcphdr))) 351 ERROUT(EINVAL); 352 353 if (CHECK_PULLUP(*m, sizeof(struct tcphdr))) 354 ERROUT(ENOBUFS); 355 356 tcp = mtod(*m, struct tcphdr*); 357 r->r_sport = tcp->th_sport; 358 r->r_dport = tcp->th_dport; 359 *tcp_flags = tcp->th_flags; 360 break; 361 } 362 case IPPROTO_UDP: 363 /* verify that packet is not truncated */ 364 if (CHECK_MLEN(*m, sizeof(struct udphdr))) 365 ERROUT(EINVAL); 366 367 if (CHECK_PULLUP(*m, sizeof(struct udphdr))) 368 ERROUT(ENOBUFS); 369 370 r->r_ports = *(mtod(*m, uint32_t *)); 371 break; 372 } 373 374done: 375 return (error); 376} 377 378/* 379 * Non-static functions called from ng_netflow.c 380 */ 381 382/* Allocate memory and set up flow cache */ 383int 384ng_netflow_cache_init(priv_p priv) 385{ 386 struct flow_entry *fle; 387 int i; 388 389 /* allocate cache */ 390 MALLOC(priv->cache, struct flow_entry *, 391 CACHESIZE * sizeof(struct flow_entry), 392 M_NETFLOW, M_WAITOK | M_ZERO); 393 394 if (priv->cache == NULL) 395 return (ENOMEM); 396 397 /* allocate hash */ 398 MALLOC(priv->hash, struct flow_hash_entry *, 399 NBUCKETS * sizeof(struct flow_hash_entry), 400 M_NETFLOW, M_WAITOK | M_ZERO); 401 402 if (priv->hash == NULL) { 403 FREE(priv->cache, M_NETFLOW); 404 return (ENOMEM); 405 } 406 407 TAILQ_INIT(&priv->work_queue); 408 SLIST_INIT(&priv->free_list); 409 SLIST_INIT(&priv->expire_list); 410 411 mtx_init(&priv->work_mtx, "ng_netflow cache mutex", NULL, MTX_DEF); 412 mtx_init(&priv->free_mtx, "ng_netflow free mutex", NULL, MTX_DEF); 413 mtx_init(&priv->expire_mtx, "ng_netflow expire mutex", NULL, MTX_DEF); 414 415 /* build free list */ 416 for (i = 0, fle = priv->cache; i < CACHESIZE; i++, fle++) 417 SLIST_INSERT_HEAD(&priv->free_list, fle, fle_free); 418 419 priv->info.nfinfo_free = CACHESIZE; 420 421 return (0); 422} 423 424/* Free all flow cache memory. Called from node close method. */ 425void 426ng_netflow_cache_flush(priv_p priv) 427{ 428 register struct flow_entry *fle; 429 int i; 430 431 /* 432 * We are going to free probably billable data. 433 * Expire everything before freeing it. 434 * No locking is required since callout is already drained. 435 */ 436 437 for (i = 0, fle = priv->cache; i < CACHESIZE; i++, fle++) 438 if (!ISFREE(fle)) 439 /* ignore errors now */ 440 (void )export_add(priv, fle); 441 442 mtx_destroy(&priv->work_mtx); 443 mtx_destroy(&priv->free_mtx); 444 mtx_destroy(&priv->expire_mtx); 445 446 /* free hash memory */ 447 if (priv->hash) 448 FREE(priv->hash, M_NETFLOW); 449 450 /* free flow cache */ 451 if (priv->cache) 452 FREE(priv->cache, M_NETFLOW); 453 454} 455 456/* Insert packet from &m into flow cache. */ 457int 458ng_netflow_flow_add(priv_p priv, struct mbuf **m, iface_p iface) 459{ 460 struct flow_hash_entry *h = priv->hash; 461 register struct flow_entry *fle; 462 struct flow_rec r; 463 int plen; 464 int error = 0; 465 uint32_t slot; 466 uint8_t tcp_flags = 0; 467 468 /* Try to fill *rec */ 469 bzero(&r, sizeof(r)); 470 if ((error = make_flow_rec(m, &plen, &r, &tcp_flags, iface->info.ifinfo_index))) 471 return (error); 472 473 slot = ip_hash(&r); 474 475 mtx_lock(&priv->work_mtx); 476 477 /* Update node statistics. */ 478 priv->info.nfinfo_packets ++; 479 priv->info.nfinfo_bytes += plen; 480 481 fle = hash_lookup(h, slot, &r); /* New flow entry or existent? */ 482 483 if (fle) { /* an existent entry */ 484 485 TAILQ_REMOVE(&priv->work_queue, fle, fle_work); 486 487 fle->f.bytes += plen; 488 fle->f.packets ++; 489 fle->f.tcp_flags |= tcp_flags; 490 fle->f.last = time_uptime; 491 492 /* 493 * We have the following reasons to expire flow in active way: 494 * - it hit active timeout 495 * - a TCP connection closed 496 * - it is going to overflow counter 497 */ 498 if (tcp_flags & TH_FIN || tcp_flags & TH_RST || AGED(fle) || 499 (fle->f.bytes >= (UINT_MAX - IF_MAXMTU)) ) 500 expire_flow(priv, fle); 501 else 502 TAILQ_INSERT_TAIL(&priv->work_queue, fle, fle_work); 503 504 mtx_unlock(&priv->work_mtx); 505 506 } else { /* a new flow entry */ 507 508 mtx_unlock(&priv->work_mtx); 509 return hash_insert(priv, slot, &r, plen); 510 511 } 512 513 mtx_assert(&priv->work_mtx, MA_NOTOWNED); 514 mtx_assert(&priv->expire_mtx, MA_NOTOWNED); 515 mtx_assert(&priv->free_mtx, MA_NOTOWNED); 516 517 return (0); 518} 519 520/* 521 * Return records from cache. netgraph(4) guarantees us that we 522 * are locked against ng_netflow_rcvdata(). However we can 523 * work with ng_netflow_expire() in parrallel. XXX: Is it dangerous? 524 * 525 * TODO: matching particular IP should be done in kernel, here. 526 */ 527int 528ng_netflow_flow_show(priv_p priv, uint32_t last, struct ng_mesg *resp) 529{ 530 struct flow_entry *fle; 531 struct ngnf_flows *data; 532 533 data = (struct ngnf_flows *)resp->data; 534 data->last = 0; 535 data->nentries = 0; 536 537 /* Check if this is a first run */ 538 if (last == 0) 539 fle = priv->cache; 540 else { 541 if (last > CACHESIZE-1) 542 return (EINVAL); 543 fle = priv->cache + last; 544 } 545 546 /* 547 * We will transfer not more than NREC_AT_ONCE. More data 548 * will come in next message. 549 * We send current stop point to userland, and userland should return 550 * it back to us. 551 */ 552 for (; last < CACHESIZE; fle++, last++) { 553 if (ISFREE(fle)) 554 continue; 555 bcopy(&fle->f, &(data->entries[data->nentries]), sizeof(fle->f)); 556 data->nentries ++; 557 if (data->nentries == NREC_AT_ONCE) { 558 if (++last < CACHESIZE) 559 data->last = (++fle - priv->cache); 560 return (0); 561 } 562 } 563 564 return (0); 565} 566 567/* We have full datagram in privdata. Send it to export hook. */ 568static int 569export_send(priv_p priv) 570{ 571 struct netflow_v5_header *header = &priv->dgram.header; 572 struct timespec ts; 573 struct mbuf *m; 574 int error = 0; 575 int mlen; 576 577 header->sys_uptime = htonl(time_uptime); 578 579 getnanotime(&ts); 580 header->unix_secs = htonl(ts.tv_sec); 581 header->unix_nsecs = htonl(ts.tv_nsec); 582 583 /* Flow sequence contains number of first record */ 584 header->flow_seq = htonl(priv->flow_seq - header->count); 585 586 mlen = sizeof(struct netflow_v5_header) + 587 sizeof(struct netflow_v5_record) * header->count; 588 589 header->count = htons(header->count); 590 if ((m = m_devget((caddr_t)header, mlen, 0, NULL, NULL)) == NULL) { 591 log(LOG_CRIT, "ng_netflow: m_devget() failed, losing export " 592 "dgram\n"); 593 header->count = 0; 594 return(ENOBUFS); 595 } 596 597 header->count = 0; 598 599 /* Giant is required in sosend() at this moment. */ 600 NET_LOCK_GIANT(); 601 NG_SEND_DATA_ONLY(error, priv->export, m); 602 NET_UNLOCK_GIANT(); 603 604 if (error) 605 NG_FREE_M(m); 606 607 return (error); 608} 609 610 611/* Create export datagram. */ 612static int 613export_add(priv_p priv, struct flow_entry *fle) 614{ 615 struct netflow_v5_header *header = &priv->dgram.header; 616 struct netflow_v5_record *rec; 617 618 if (header->count == 0 ) { /* first record */ 619 rec = &priv->dgram.r[0]; 620 header->count = 1; 621 } else { /* continue filling datagram */ 622 rec = &priv->dgram.r[header->count]; 623 header->count ++; 624 } 625 626 /* Fill in export record */ 627 rec->src_addr = fle->f.r.r_src.s_addr; 628 rec->dst_addr = fle->f.r.r_dst.s_addr; 629 rec->next_hop = fle->f.next_hop.s_addr; 630 rec->i_ifx = htons(fle->f.fle_i_ifx); 631 rec->o_ifx = htons(fle->f.fle_o_ifx); 632 rec->packets = htonl(fle->f.packets); 633 rec->octets = htonl(fle->f.bytes); 634 rec->first = htonl(fle->f.first); 635 rec->last = htonl(fle->f.last); 636 rec->s_port = fle->f.r.r_sport; 637 rec->d_port = fle->f.r.r_dport; 638 rec->flags = fle->f.tcp_flags; 639 rec->prot = fle->f.r.r_ip_p; 640 rec->tos = fle->f.r.r_tos; 641 rec->dst_mask = fle->f.dst_mask; 642 rec->src_mask = fle->f.src_mask; 643 644 priv->flow_seq++; 645 646 if (header->count == NETFLOW_V5_MAX_RECORDS) /* end of datagram */ 647 return export_send(priv); 648 649 return (0); 650} 651 652/* Periodic flow expiry run. */ 653void 654ng_netflow_expire(void *arg) 655{ 656 register struct flow_entry *fle, *fle1; 657 priv_p priv = (priv_p )arg; 658 uint32_t used; 659 int error = 0; 660 661 /* First pack actively expired entries */ 662 mtx_lock(&priv->expire_mtx); 663 while (!SLIST_EMPTY(&(priv->expire_list))) { 664 fle = SLIST_FIRST(&(priv->expire_list)); 665 SLIST_REMOVE_HEAD(&(priv->expire_list), fle_free); 666 mtx_unlock(&priv->expire_mtx); 667 668 /* 669 * While we have dropped the lock, expire_flow() may 670 * insert another flow into top of the list. 671 * This is not harmful for us, since we have already 672 * detached our own. 673 */ 674 675 if ((error = export_add(priv, fle)) != 0) 676 log(LOG_CRIT, "ng_netflow: export_add() failed: %u\n", 677 error); 678 (void )free_flow(priv, fle); 679 680 mtx_lock(&priv->expire_mtx); 681 } 682 mtx_unlock(&priv->expire_mtx); 683 684 NGNF_GETUSED(priv, used); 685 mtx_lock(&priv->work_mtx); 686 TAILQ_FOREACH_SAFE(fle, &(priv->work_queue), fle_work, fle1) { 687 /* 688 * When cache size has not reached CACHELOWAT yet, we keep both 689 * inactive and active flows in cache. Doing this, we reduce number 690 * of exports, since many inactive flows may wake up and continue 691 * their life. However, we make an exclusion for scans. It is very 692 * rare situation that inactive 1-packet flow will wake up. 693 * When cache has reached CACHELOWAT, we expire all inactive flows, 694 * until cache gets of sane size. 695 */ 696 if (used <= CACHELOWAT && !INACTIVE(fle)) 697 goto finish; 698 699 if (INACTIVE(fle) && (SMALL(fle) || (used > CACHELOWAT))) { 700 701 /* Detach flow entry from cache */ 702 LIST_REMOVE(fle, fle_hash); 703 TAILQ_REMOVE(&priv->work_queue, fle, fle_work); 704 705 /* 706 * While we are sending to collector, unlock cache. 707 * XXX: it can happen, however with a small probability, 708 * that item, we are holding now, can be moved to the top 709 * of flow cache by node thread. In this case our expire 710 * thread stops checking. Since this is not fatal we will 711 * just ignore it now. 712 */ 713 mtx_unlock(&priv->work_mtx); 714 715 if ((error = export_add(priv, fle)) != 0) 716 log(LOG_CRIT, "ng_netflow: export_add() " 717 "failed: %u\n", error); 718 719 used = free_flow(priv, fle); 720 721 mtx_lock(&priv->work_mtx); 722 } 723 } 724 725finish: 726 mtx_unlock(&priv->work_mtx); 727 728 mtx_assert(&priv->expire_mtx, MA_NOTOWNED); 729 mtx_assert(&priv->free_mtx, MA_NOTOWNED); 730 731 /* schedule next expire */ 732 callout_reset(&priv->exp_callout, (1*hz), &ng_netflow_expire, 733 (void *)priv); 734 735} 736