netflow.c revision 141112
1/*- 2 * Copyright (c) 2004 Gleb Smirnoff <glebius@FreeBSD.org> 3 * Copyright (c) 2001-2003 Roman V. Palagin <romanp@unshadow.net> 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25 * SUCH DAMAGE. 26 * 27 * $SourceForge: netflow.c,v 1.41 2004/09/05 11:41:10 glebius Exp $ 28 */ 29 30static const char rcs_id[] = 31 "@(#) $FreeBSD: head/sys/netgraph/netflow/netflow.c 141112 2005-02-01 14:07:05Z glebius $"; 32 33#include <sys/param.h> 34#include <sys/kernel.h> 35#include <sys/limits.h> 36#include <sys/mbuf.h> 37#include <sys/syslog.h> 38#include <sys/systm.h> 39#include <sys/socket.h> 40 41#include <net/if.h> 42#include <net/if_var.h> 43#include <net/if_dl.h> 44#include <net/route.h> 45#include <netinet/in.h> 46#include <netinet/in_systm.h> 47#include <netinet/ip.h> 48#include <netinet/tcp.h> 49#include <netinet/udp.h> 50 51#include <netgraph/ng_message.h> 52#include <netgraph/netgraph.h> 53 54#include <netgraph/netflow/netflow.h> 55#include <netgraph/netflow/ng_netflow.h> 56 57#define NBUCKETS (4096) /* must be power of 2 */ 58 59/* This hash is for TCP or UDP packets */ 60#define FULL_HASH(addr1,addr2,port1,port2)\ 61 (((addr1 >> 16) ^ \ 62 (addr2 & 0x00FF) ^ \ 63 ((port1 ^ port2) << 8) )& \ 64 (NBUCKETS - 1)) 65 66/* This hash for all other IP packets */ 67#define ADDR_HASH(addr1,addr2)\ 68 (((addr1 >> 16) ^ \ 69 (addr2 & 0x00FF) )& \ 70 (NBUCKETS - 1)) 71 72/* Macros to shorten logical constructions */ 73/* XXX: priv must exist in namespace */ 74#define INACTIVE(fle) (time_uptime - fle->f.last > priv->info.nfinfo_inact_t) 75#define AGED(fle) (time_uptime - fle->f.first > priv->info.nfinfo_act_t) 76#define ISFREE(fle) (fle->f.packets == 0) 77 78/* 79 * 4 is a magical number: statistically number of 4-packet flows is 80 * bigger than 5,6,7...-packet flows by an order of magnitude. Most UDP/ICMP 81 * scans are 1 packet (~ 90% of flow cache). TCP scans are 2-packet in case 82 * of reachable host and 4-packet otherwise. 83 */ 84#define SMALL(fle) (fle->f.packets <= 4) 85 86MALLOC_DECLARE(M_NETFLOW); 87MALLOC_DEFINE(M_NETFLOW, "NetFlow", "flow cache"); 88 89static int export_add(priv_p , struct flow_entry *); 90static int export_send(priv_p ); 91 92/* Generate hash for a given flow record */ 93static __inline uint32_t 94ip_hash(struct flow_rec *r) 95{ 96 switch (r->r_ip_p) { 97 case IPPROTO_TCP: 98 case IPPROTO_UDP: 99 return FULL_HASH(r->r_src.s_addr, r->r_dst.s_addr, 100 r->r_sport, r->r_dport); 101 default: 102 return ADDR_HASH(r->r_src.s_addr, r->r_dst.s_addr); 103 } 104} 105 106/* Lookup for record in given slot */ 107static __inline struct flow_entry * 108hash_lookup(struct flow_hash_entry *h, int slot, struct flow_rec *r) 109{ 110 struct flow_entry *fle; 111 112 LIST_FOREACH(fle, &(h[slot].head), fle_hash) 113 if (bcmp(r, &fle->f.r, sizeof(struct flow_rec)) == 0) 114 return (fle); 115 116 return (NULL); 117} 118 119/* Get a flow entry from free list */ 120static __inline struct flow_entry * 121alloc_flow(priv_p priv, int *flows) 122{ 123 register struct flow_entry *fle; 124 125 mtx_lock(&priv->free_mtx); 126 127 if (SLIST_EMPTY(&priv->free_list)) { 128 mtx_unlock(&priv->free_mtx); 129 return(NULL); 130 } 131 132 fle = SLIST_FIRST(&priv->free_list); 133 SLIST_REMOVE_HEAD(&priv->free_list, fle_free); 134 135 priv->info.nfinfo_used++; 136 priv->info.nfinfo_free--; 137 138 if (flows != NULL) 139 *flows = priv->info.nfinfo_used; 140 141 mtx_unlock(&priv->free_mtx); 142 143 return (fle); 144} 145 146/* Insert flow entry into a free list. */ 147static __inline int 148free_flow(priv_p priv, struct flow_entry *fle) 149{ 150 int flows; 151 152 mtx_lock(&priv->free_mtx); 153 fle->f.packets = 0; 154 SLIST_INSERT_HEAD(&priv->free_list, fle, fle_free); 155 flows = priv->info.nfinfo_used--; 156 priv->info.nfinfo_free++; 157 mtx_unlock(&priv->free_mtx); 158 159 return flows; 160} 161 162#define NGNF_GETUSED(priv, rval) do { \ 163 mtx_lock(&priv->free_mtx); \ 164 rval = priv->info.nfinfo_used; \ 165 mtx_unlock(&priv->free_mtx); \ 166 } while (0) 167 168/* Insert flow entry into expire list. */ 169/* XXX: Flow must be detached from work queue, but not from cache */ 170static __inline void 171expire_flow(priv_p priv, struct flow_entry *fle) 172{ 173 mtx_assert(&priv->work_mtx, MA_OWNED); 174 LIST_REMOVE(fle, fle_hash); 175 176 mtx_lock(&priv->expire_mtx); 177 SLIST_INSERT_HEAD(&priv->expire_list, fle, fle_free); 178 mtx_unlock(&priv->expire_mtx); 179} 180 181/* Get a snapshot of node statistics */ 182void 183ng_netflow_copyinfo(priv_p priv, struct ng_netflow_info *i) 184{ 185 mtx_lock(&priv->free_mtx); 186 memcpy((void *)i, (void *)&priv->info, sizeof(priv->info)); 187 mtx_unlock(&priv->free_mtx); 188} 189 190/* Calculate number of bits in netmask */ 191#define g21 0x55555555ul /* = 0101_0101_0101_0101_0101_0101_0101_0101 */ 192#define g22 0x33333333ul /* = 0011_0011_0011_0011_0011_0011_0011_0011 */ 193#define g23 0x0f0f0f0ful /* = 0000_1111_0000_1111_0000_1111_0000_1111 */ 194static __inline u_char 195bit_count(uint32_t v) 196{ 197 v = (v & g21) + ((v >> 1) & g21); 198 v = (v & g22) + ((v >> 2) & g22); 199 v = (v + (v >> 4)) & g23; 200 return (v + (v >> 8) + (v >> 16) + (v >> 24)) & 0x3f; 201} 202 203/* 204 * Insert a record into defined slot. 205 * 206 * First we get for us a free flow entry, then fill in all 207 * possible fields in it. Then obtain lock on flow cache 208 * and insert flow entry. 209 */ 210static __inline int 211hash_insert(priv_p priv, int slot, struct flow_rec *r, int plen) 212{ 213 struct flow_hash_entry *h = priv->hash; 214 struct flow_entry *fle; 215 struct route ro; 216 struct sockaddr_in *sin; 217 218 fle = alloc_flow(priv, NULL); 219 if (fle == NULL) 220 return (ENOMEM); 221 222 /* 223 * Now fle is totally ours. It is detached from all lists, 224 * we can safely edit it. 225 */ 226 227 bcopy(r, &fle->f.r, sizeof(struct flow_rec)); 228 fle->f.bytes = plen; 229 fle->f.packets = 1; 230 231 priv->info.nfinfo_bytes += plen; 232 233 fle->f.first = fle->f.last = time_uptime; 234 235 /* 236 * First we do route table lookup on destination address. So we can 237 * fill in out_ifx, dst_mask, nexthop, and dst_as in future releases. 238 */ 239 bzero((caddr_t)&ro, sizeof(ro)); 240 sin = (struct sockaddr_in *)&ro.ro_dst; 241 sin->sin_len = sizeof(*sin); 242 sin->sin_family = AF_INET; 243 sin->sin_addr = fle->f.r.r_dst; 244 rtalloc_ign(&ro, RTF_CLONING); 245 if (ro.ro_rt != NULL) { 246 struct rtentry *rt = ro.ro_rt; 247 248 fle->f.fle_o_ifx = rt->rt_ifp->if_index; 249 250 if (rt->rt_flags & RTF_GATEWAY && 251 rt->rt_gateway->sa_family == AF_INET) 252 fle->f.next_hop = 253 ((struct sockaddr_in *)(rt->rt_gateway))->sin_addr; 254 255 if (rt_mask(rt)) 256 fle->f.dst_mask = 257 bit_count(((struct sockaddr_in *)rt_mask(rt))->sin_addr.s_addr); 258 else if (rt->rt_flags & RTF_HOST) 259 /* Give up. We can't determine mask :( */ 260 fle->f.dst_mask = 32; 261 262 RTFREE(ro.ro_rt); 263 } 264 265 /* Do route lookup on source address, to fill in src_mask. */ 266 267 bzero((caddr_t)&ro, sizeof(ro)); 268 sin = (struct sockaddr_in *)&ro.ro_dst; 269 sin->sin_len = sizeof(*sin); 270 sin->sin_family = AF_INET; 271 sin->sin_addr = fle->f.r.r_src; 272 rtalloc_ign(&ro, RTF_CLONING); 273 if (ro.ro_rt != NULL) { 274 struct rtentry *rt = ro.ro_rt; 275 276 if (rt_mask(rt)) 277 fle->f.src_mask = 278 bit_count(((struct sockaddr_in *)rt_mask(rt))->sin_addr.s_addr); 279 else if (rt->rt_flags & RTF_HOST) 280 /* Give up. We can't determine mask :( */ 281 fle->f.src_mask = 32; 282 283 RTFREE(ro.ro_rt); 284 } 285 286 /* Push new flow entry into flow cache */ 287 mtx_lock(&priv->work_mtx); 288 LIST_INSERT_HEAD(&(h[slot].head), fle, fle_hash); 289 TAILQ_INSERT_TAIL(&priv->work_queue, fle, fle_work); 290 mtx_unlock(&priv->work_mtx); 291 292 return (0); 293} 294 295static __inline int 296make_flow_rec(struct mbuf **m, int *plen, struct flow_rec *r, uint8_t *tcp_flags, 297 u_int16_t i_ifx) 298{ 299 register struct ip *ip; 300 int hlen; 301 int error = 0; 302 303 ip = mtod(*m, struct ip*); 304 305 /* check version */ 306 if (ip->ip_v != IPVERSION) 307 return (EINVAL); 308 309 /* verify min header length */ 310 hlen = ip->ip_hl << 2; 311 312 if (hlen < sizeof(struct ip)) 313 return (EINVAL); 314 315 r->r_src = ip->ip_src; 316 r->r_dst = ip->ip_dst; 317 318 /* save packet length */ 319 *plen = ntohs(ip->ip_len); 320 321 r->r_ip_p = ip->ip_p; 322 r->r_tos = ip->ip_tos; 323 324 /* Configured in_ifx overrides mbuf's */ 325 if (i_ifx == 0) { 326 if ((*m)->m_pkthdr.rcvif) 327 r->r_i_ifx = (*m)->m_pkthdr.rcvif->if_index; 328 } else 329 r->r_i_ifx = i_ifx; 330 331 /* 332 * XXX NOTE: only first fragment of fragmented TCP, UDP and 333 * ICMP packet will be recorded with proper s_port and d_port. 334 * Following fragments will be recorded simply as IP packet with 335 * ip_proto = ip->ip_p and s_port, d_port set to zero. 336 * I know, it looks like bug. But I don't want to re-implement 337 * ip packet assebmling here. Anyway, (in)famous trafd works this way - 338 * and nobody complains yet :) 339 */ 340 if(ip->ip_off & htons(IP_OFFMASK)) 341 return (0); 342 343 /* skip IP header */ 344 m_adj(*m, hlen); 345 346 switch(r->r_ip_p) { 347 case IPPROTO_TCP: 348 { 349 register struct tcphdr *tcp; 350 351 /* verify that packet is not truncated */ 352 if (CHECK_MLEN(*m, sizeof(struct tcphdr))) 353 ERROUT(EINVAL); 354 355 if (CHECK_PULLUP(*m, sizeof(struct tcphdr))) 356 ERROUT(ENOBUFS); 357 358 tcp = mtod(*m, struct tcphdr*); 359 r->r_sport = tcp->th_sport; 360 r->r_dport = tcp->th_dport; 361 *tcp_flags = tcp->th_flags; 362 break; 363 } 364 case IPPROTO_UDP: 365 /* verify that packet is not truncated */ 366 if (CHECK_MLEN(*m, sizeof(struct udphdr))) 367 ERROUT(EINVAL); 368 369 if (CHECK_PULLUP(*m, sizeof(struct udphdr))) 370 ERROUT(ENOBUFS); 371 372 r->r_ports = *(mtod(*m, uint32_t *)); 373 break; 374 } 375 376done: 377 return (error); 378} 379 380/* 381 * Non-static functions called from ng_netflow.c 382 */ 383 384/* Allocate memory and set up flow cache */ 385int 386ng_netflow_cache_init(priv_p priv) 387{ 388 struct flow_entry *fle; 389 int i; 390 391 /* allocate cache */ 392 MALLOC(priv->cache, struct flow_entry *, 393 CACHESIZE * sizeof(struct flow_entry), 394 M_NETFLOW, M_WAITOK | M_ZERO); 395 396 if (priv->cache == NULL) 397 return (ENOMEM); 398 399 /* allocate hash */ 400 MALLOC(priv->hash, struct flow_hash_entry *, 401 NBUCKETS * sizeof(struct flow_hash_entry), 402 M_NETFLOW, M_WAITOK | M_ZERO); 403 404 if (priv->hash == NULL) { 405 FREE(priv->cache, M_NETFLOW); 406 return (ENOMEM); 407 } 408 409 TAILQ_INIT(&priv->work_queue); 410 SLIST_INIT(&priv->free_list); 411 SLIST_INIT(&priv->expire_list); 412 413 mtx_init(&priv->work_mtx, "ng_netflow cache mutex", NULL, MTX_DEF); 414 mtx_init(&priv->free_mtx, "ng_netflow free mutex", NULL, MTX_DEF); 415 mtx_init(&priv->expire_mtx, "ng_netflow expire mutex", NULL, MTX_DEF); 416 417 /* build free list */ 418 for (i = 0, fle = priv->cache; i < CACHESIZE; i++, fle++) 419 SLIST_INSERT_HEAD(&priv->free_list, fle, fle_free); 420 421 priv->info.nfinfo_free = CACHESIZE; 422 423 return (0); 424} 425 426/* Free all flow cache memory. Called from node close method. */ 427void 428ng_netflow_cache_flush(priv_p priv) 429{ 430 register struct flow_entry *fle; 431 int i; 432 433 /* 434 * We are going to free probably billable data. 435 * Expire everything before freeing it. 436 * No locking is required since callout is already drained. 437 */ 438 439 for (i = 0, fle = priv->cache; i < CACHESIZE; i++, fle++) 440 if (!ISFREE(fle)) 441 /* ignore errors now */ 442 (void )export_add(priv, fle); 443 444 mtx_destroy(&priv->work_mtx); 445 mtx_destroy(&priv->free_mtx); 446 mtx_destroy(&priv->expire_mtx); 447 448 /* free hash memory */ 449 if (priv->hash) 450 FREE(priv->hash, M_NETFLOW); 451 452 /* free flow cache */ 453 if (priv->cache) 454 FREE(priv->cache, M_NETFLOW); 455 456} 457 458/* Insert packet from &m into flow cache. */ 459int 460ng_netflow_flow_add(priv_p priv, struct mbuf **m, iface_p iface) 461{ 462 struct flow_hash_entry *h = priv->hash; 463 register struct flow_entry *fle; 464 struct flow_rec r; 465 int plen; 466 int error = 0; 467 uint32_t slot; 468 uint8_t tcp_flags = 0; 469 470 /* Try to fill *rec */ 471 bzero(&r, sizeof(r)); 472 if ((error = make_flow_rec(m, &plen, &r, &tcp_flags, iface->info.ifinfo_index))) 473 return (error); 474 475 slot = ip_hash(&r); 476 477 mtx_lock(&priv->work_mtx); 478 479 /* Update node statistics. */ 480 priv->info.nfinfo_packets ++; 481 priv->info.nfinfo_bytes += plen; 482 483 fle = hash_lookup(h, slot, &r); /* New flow entry or existent? */ 484 485 if (fle) { /* an existent entry */ 486 487 TAILQ_REMOVE(&priv->work_queue, fle, fle_work); 488 489 fle->f.bytes += plen; 490 fle->f.packets ++; 491 fle->f.tcp_flags |= tcp_flags; 492 fle->f.last = time_uptime; 493 494 /* 495 * We have the following reasons to expire flow in active way: 496 * - it hit active timeout 497 * - a TCP connection closed 498 * - it is going to overflow counter 499 */ 500 if (tcp_flags & TH_FIN || tcp_flags & TH_RST || AGED(fle) || 501 (fle->f.bytes >= (UINT_MAX - IF_MAXMTU)) ) 502 expire_flow(priv, fle); 503 else 504 TAILQ_INSERT_TAIL(&priv->work_queue, fle, fle_work); 505 506 mtx_unlock(&priv->work_mtx); 507 508 } else { /* a new flow entry */ 509 510 mtx_unlock(&priv->work_mtx); 511 return hash_insert(priv, slot, &r, plen); 512 513 } 514 515 mtx_assert(&priv->work_mtx, MA_NOTOWNED); 516 mtx_assert(&priv->expire_mtx, MA_NOTOWNED); 517 mtx_assert(&priv->free_mtx, MA_NOTOWNED); 518 519 return (0); 520} 521 522/* 523 * Return records from cache. netgraph(4) guarantees us that we 524 * are locked against ng_netflow_rcvdata(). However we can 525 * work with ng_netflow_expire() in parrallel. XXX: Is it dangerous? 526 * 527 * TODO: matching particular IP should be done in kernel, here. 528 */ 529int 530ng_netflow_flow_show(priv_p priv, uint32_t last, struct ng_mesg *resp) 531{ 532 struct flow_entry *fle; 533 struct ngnf_flows *data; 534 535 data = (struct ngnf_flows *)resp->data; 536 data->last = 0; 537 data->nentries = 0; 538 539 /* Check if this is a first run */ 540 if (last == 0) 541 fle = priv->cache; 542 else { 543 if (last > CACHESIZE-1) 544 return (EINVAL); 545 fle = priv->cache + last; 546 } 547 548 /* 549 * We will transfer not more than NREC_AT_ONCE. More data 550 * will come in next message. 551 * We send current stop point to userland, and userland should return 552 * it back to us. 553 */ 554 for (; last < CACHESIZE; fle++, last++) { 555 if (ISFREE(fle)) 556 continue; 557 bcopy(&fle->f, &(data->entries[data->nentries]), sizeof(fle->f)); 558 data->nentries ++; 559 if (data->nentries == NREC_AT_ONCE) { 560 if (++last < CACHESIZE) 561 data->last = (++fle - priv->cache); 562 return (0); 563 } 564 } 565 566 return (0); 567} 568 569/* We have full datagram in privdata. Send it to export hook. */ 570static int 571export_send(priv_p priv) 572{ 573 struct netflow_v5_header *header = &priv->dgram.header; 574 struct timespec ts; 575 struct mbuf *m; 576 int error = 0; 577 int mlen; 578 579 header->sys_uptime = htonl(time_uptime); 580 581 getnanotime(&ts); 582 header->unix_secs = htonl(ts.tv_sec); 583 header->unix_nsecs = htonl(ts.tv_nsec); 584 585 /* Flow sequence contains number of first record */ 586 header->flow_seq = htonl(priv->flow_seq - header->count); 587 588 mlen = sizeof(struct netflow_v5_header) + 589 sizeof(struct netflow_v5_record) * header->count; 590 591 header->count = htons(header->count); 592 if ((m = m_devget((caddr_t)header, mlen, 0, NULL, NULL)) == NULL) { 593 log(LOG_CRIT, "ng_netflow: m_devget() failed, losing export " 594 "dgram\n"); 595 header->count = 0; 596 return(ENOBUFS); 597 } 598 599 header->count = 0; 600 601 /* Giant is required in sosend() at this moment. */ 602 NET_LOCK_GIANT(); 603 NG_SEND_DATA_ONLY(error, priv->export, m); 604 NET_UNLOCK_GIANT(); 605 606 if (error) 607 NG_FREE_M(m); 608 609 return (error); 610} 611 612 613/* Create export datagram. */ 614static int 615export_add(priv_p priv, struct flow_entry *fle) 616{ 617 struct netflow_v5_header *header = &priv->dgram.header; 618 struct netflow_v5_record *rec; 619 620 if (header->count == 0 ) { /* first record */ 621 rec = &priv->dgram.r[0]; 622 header->count = 1; 623 } else { /* continue filling datagram */ 624 rec = &priv->dgram.r[header->count]; 625 header->count ++; 626 } 627 628 /* Fill in export record */ 629 rec->src_addr = fle->f.r.r_src.s_addr; 630 rec->dst_addr = fle->f.r.r_dst.s_addr; 631 rec->next_hop = fle->f.next_hop.s_addr; 632 rec->i_ifx = htons(fle->f.fle_i_ifx); 633 rec->o_ifx = htons(fle->f.fle_o_ifx); 634 rec->packets = htonl(fle->f.packets); 635 rec->octets = htonl(fle->f.bytes); 636 rec->first = htonl(fle->f.first); 637 rec->last = htonl(fle->f.last); 638 rec->s_port = fle->f.r.r_sport; 639 rec->d_port = fle->f.r.r_dport; 640 rec->flags = fle->f.tcp_flags; 641 rec->prot = fle->f.r.r_ip_p; 642 rec->tos = fle->f.r.r_tos; 643 rec->dst_mask = fle->f.dst_mask; 644 rec->src_mask = fle->f.src_mask; 645 646 priv->flow_seq++; 647 648 if (header->count == NETFLOW_V5_MAX_RECORDS) /* end of datagram */ 649 return export_send(priv); 650 651 return (0); 652} 653 654/* Periodic flow expiry run. */ 655void 656ng_netflow_expire(void *arg) 657{ 658 register struct flow_entry *fle, *fle1; 659 priv_p priv = (priv_p )arg; 660 uint32_t used; 661 int error = 0; 662 663 /* First pack actively expired entries */ 664 mtx_lock(&priv->expire_mtx); 665 while (!SLIST_EMPTY(&(priv->expire_list))) { 666 fle = SLIST_FIRST(&(priv->expire_list)); 667 SLIST_REMOVE_HEAD(&(priv->expire_list), fle_free); 668 mtx_unlock(&priv->expire_mtx); 669 670 /* 671 * While we have dropped the lock, expire_flow() may 672 * insert another flow into top of the list. 673 * This is not harmful for us, since we have already 674 * detached our own. 675 */ 676 677 if ((error = export_add(priv, fle)) != 0) 678 log(LOG_CRIT, "ng_netflow: export_add() failed: %u\n", 679 error); 680 (void )free_flow(priv, fle); 681 682 mtx_lock(&priv->expire_mtx); 683 } 684 mtx_unlock(&priv->expire_mtx); 685 686 NGNF_GETUSED(priv, used); 687 mtx_lock(&priv->work_mtx); 688 TAILQ_FOREACH_SAFE(fle, &(priv->work_queue), fle_work, fle1) { 689 /* 690 * When cache size has not reached CACHELOWAT yet, we keep both 691 * inactive and active flows in cache. Doing this, we reduce number 692 * of exports, since many inactive flows may wake up and continue 693 * their life. However, we make an exclusion for scans. It is very 694 * rare situation that inactive 1-packet flow will wake up. 695 * When cache has reached CACHELOWAT, we expire all inactive flows, 696 * until cache gets of sane size. 697 */ 698 if (used <= CACHELOWAT && !INACTIVE(fle)) 699 goto finish; 700 701 if (INACTIVE(fle) && (SMALL(fle) || (used > CACHELOWAT))) { 702 703 /* Detach flow entry from cache */ 704 LIST_REMOVE(fle, fle_hash); 705 TAILQ_REMOVE(&priv->work_queue, fle, fle_work); 706 707 /* 708 * While we are sending to collector, unlock cache. 709 * XXX: it can happen, however with a small probability, 710 * that item, we are holding now, can be moved to the top 711 * of flow cache by node thread. In this case our expire 712 * thread stops checking. Since this is not fatal we will 713 * just ignore it now. 714 */ 715 mtx_unlock(&priv->work_mtx); 716 717 if ((error = export_add(priv, fle)) != 0) 718 log(LOG_CRIT, "ng_netflow: export_add() " 719 "failed: %u\n", error); 720 721 used = free_flow(priv, fle); 722 723 mtx_lock(&priv->work_mtx); 724 } 725 } 726 727finish: 728 mtx_unlock(&priv->work_mtx); 729 730 mtx_assert(&priv->expire_mtx, MA_NOTOWNED); 731 mtx_assert(&priv->free_mtx, MA_NOTOWNED); 732 733 /* schedule next expire */ 734 callout_reset(&priv->exp_callout, (1*hz), &ng_netflow_expire, 735 (void *)priv); 736 737} 738