netflow9.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391
  1. /*
  2. * Copyright 2002 Damien Miller <djm@mindrot.org> All rights reserved.
  3. *
  4. * Redistribution and use in source and binary forms, with or without
  5. * modification, are permitted provided that the following conditions
  6. * are met:
  7. * 1. Redistributions of source code must retain the above copyright
  8. * notice, this list of conditions and the following disclaimer.
  9. * 2. Redistributions in binary form must reproduce the above copyright
  10. * notice, this list of conditions and the following disclaimer in the
  11. * documentation and/or other materials provided with the distribution.
  12. *
  13. * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  14. * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  15. * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  16. * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  17. * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  18. * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  19. * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  20. * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  21. * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  22. * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  23. */
  24. /* $Id$ */
  25. #include "common.h"
  26. #include "log.h"
  27. #include "treetype.h"
  28. #include "softflowd.h"
  29. RCSID("$Id$");
  30. /* Netflow v.9 */
  31. struct NF9_HEADER {
  32. u_int16_t version, flows;
  33. u_int32_t uptime_ms, time_sec;
  34. u_int32_t package_sequence, source_id;
  35. } __packed;
  36. struct NF9_FLOWSET_HEADER_COMMON {
  37. u_int16_t flowset_id, length;
  38. } __packed;
  39. struct NF9_TEMPLATE_FLOWSET_HEADER {
  40. struct NF9_FLOWSET_HEADER_COMMON c;
  41. u_int16_t template_id, count;
  42. } __packed;
  43. struct NF9_TEMPLATE_FLOWSET_RECORD {
  44. u_int16_t type, length;
  45. } __packed;
  46. struct NF9_DATA_FLOWSET_HEADER {
  47. struct NF9_FLOWSET_HEADER_COMMON c;
  48. } __packed;
  49. #define NF9_TEMPLATE_FLOWSET_ID 0
  50. #define NF9_OPTIONS_FLOWSET_ID 1
  51. #define NF9_MIN_RECORD_FLOWSET_ID 256
  52. /* Flowset record types the we care about */
  53. #define NF9_IN_BYTES 1
  54. #define NF9_IN_PACKETS 2
  55. /* ... */
  56. #define NF9_IN_PROTOCOL 4
  57. /* ... */
  58. #define NF9_TCP_FLAGS 6
  59. #define NF9_L4_SRC_PORT 7
  60. #define NF9_IPV4_SRC_ADDR 8
  61. /* ... */
  62. #define NF9_IF_INDEX_IN 10
  63. #define NF9_L4_DST_PORT 11
  64. #define NF9_IPV4_DST_ADDR 12
  65. /* ... */
  66. #define NF9_IF_INDEX_OUT 14
  67. /* ... */
  68. #define NF9_LAST_SWITCHED 21
  69. #define NF9_FIRST_SWITCHED 22
  70. /* ... */
  71. #define NF9_IPV6_SRC_ADDR 27
  72. #define NF9_IPV6_DST_ADDR 28
  73. /* ... */
  74. #define NF9_IP_PROTOCOL_VERSION 60
  75. /* Stuff pertaining to the templates that softflowd uses */
  76. #define NF9_SOFTFLOWD_TEMPLATE_NRECORDS 11
  77. struct NF9_SOFTFLOWD_TEMPLATE {
  78. struct NF9_TEMPLATE_FLOWSET_HEADER h;
  79. struct NF9_TEMPLATE_FLOWSET_RECORD r[NF9_SOFTFLOWD_TEMPLATE_NRECORDS];
  80. } __packed;
  81. /* softflowd data flowset types */
  82. struct NF9_SOFTFLOWD_DATA_COMMON {
  83. u_int32_t last_switched, first_switched;
  84. u_int32_t bytes, packets;
  85. u_int32_t if_index_in, if_index_out;
  86. u_int16_t src_port, dst_port;
  87. u_int8_t protocol, tcp_flags, ipproto;
  88. } __packed;
  89. struct NF9_SOFTFLOWD_DATA_V4 {
  90. u_int32_t src_addr, dst_addr;
  91. struct NF9_SOFTFLOWD_DATA_COMMON c;
  92. } __packed;
  93. struct NF9_SOFTFLOWD_DATA_V6 {
  94. u_int8_t src_addr[16], dst_addr[16];
  95. struct NF9_SOFTFLOWD_DATA_COMMON c;
  96. } __packed;
  97. /* Local data: templates and counters */
  98. #define NF9_SOFTFLOWD_MAX_PACKET_SIZE 512
  99. #define NF9_SOFTFLOWD_V4_TEMPLATE_ID 1024
  100. #define NF9_SOFTFLOWD_V6_TEMPLATE_ID 2048
  101. #define NF9_DEFAULT_TEMPLATE_INTERVAL 16
  102. static struct NF9_SOFTFLOWD_TEMPLATE v4_template;
  103. static struct NF9_SOFTFLOWD_TEMPLATE v6_template;
  104. static int nf9_pkts_until_template = -1;
  105. static void
  106. nf9_init_template(void)
  107. {
  108. bzero(&v4_template, sizeof(v4_template));
  109. v4_template.h.c.flowset_id = htons(0);
  110. v4_template.h.c.length = htons(sizeof(v4_template));
  111. v4_template.h.template_id = htons(NF9_SOFTFLOWD_V4_TEMPLATE_ID);
  112. v4_template.h.count = htons(NF9_SOFTFLOWD_TEMPLATE_NRECORDS);
  113. v4_template.r[0].type = htons(NF9_IPV4_SRC_ADDR);
  114. v4_template.r[0].length = htons(4);
  115. v4_template.r[1].type = htons(NF9_IPV4_DST_ADDR);
  116. v4_template.r[1].length = htons(4);
  117. v4_template.r[2].type = htons(NF9_LAST_SWITCHED);
  118. v4_template.r[2].length = htons(4);
  119. v4_template.r[3].type = htons(NF9_FIRST_SWITCHED);
  120. v4_template.r[3].length = htons(4);
  121. v4_template.r[4].type = htons(NF9_IN_BYTES);
  122. v4_template.r[4].length = htons(4);
  123. v4_template.r[5].type = htons(NF9_IN_PACKETS);
  124. v4_template.r[5].length = htons(4);
  125. v4_template.r[6].type = htons(NF9_IF_INDEX_IN);
  126. v4_template.r[6].length = htons(4);
  127. v4_template.r[7].type = htons(NF9_IF_INDEX_OUT);
  128. v4_template.r[7].length = htons(4);
  129. v4_template.r[8].type = htons(NF9_L4_SRC_PORT);
  130. v4_template.r[8].length = htons(2);
  131. v4_template.r[9].type = htons(NF9_L4_DST_PORT);
  132. v4_template.r[9].length = htons(2);
  133. v4_template.r[10].type = htons(NF9_IN_PROTOCOL);
  134. v4_template.r[10].length = htons(1);
  135. v4_template.r[11].type = htons(NF9_TCP_FLAGS);
  136. v4_template.r[11].length = htons(1);
  137. v4_template.r[12].type = htons(NF9_IP_PROTOCOL_VERSION);
  138. v4_template.r[12].length = htons(1);
  139. bzero(&v6_template, sizeof(v6_template));
  140. v6_template.h.c.flowset_id = htons(0);
  141. v6_template.h.c.length = htons(sizeof(v6_template));
  142. v6_template.h.template_id = htons(NF9_SOFTFLOWD_V6_TEMPLATE_ID);
  143. v6_template.h.count = htons(NF9_SOFTFLOWD_TEMPLATE_NRECORDS);
  144. v6_template.r[0].type = htons(NF9_IPV6_SRC_ADDR);
  145. v6_template.r[0].length = htons(16);
  146. v6_template.r[1].type = htons(NF9_IPV6_DST_ADDR);
  147. v6_template.r[1].length = htons(16);
  148. v6_template.r[2].type = htons(NF9_LAST_SWITCHED);
  149. v6_template.r[2].length = htons(4);
  150. v6_template.r[3].type = htons(NF9_FIRST_SWITCHED);
  151. v6_template.r[3].length = htons(4);
  152. v6_template.r[4].type = htons(NF9_IN_BYTES);
  153. v6_template.r[4].length = htons(4);
  154. v6_template.r[5].type = htons(NF9_IN_PACKETS);
  155. v6_template.r[5].length = htons(4);
  156. v4_template.r[6].type = htons(NF9_IF_INDEX_IN);
  157. v4_template.r[6].length = htons(4);
  158. v4_template.r[7].type = htons(NF9_IF_INDEX_OUT);
  159. v4_template.r[7].length = htons(4);
  160. v6_template.r[8].type = htons(NF9_L4_SRC_PORT);
  161. v6_template.r[8].length = htons(2);
  162. v6_template.r[9].type = htons(NF9_L4_DST_PORT);
  163. v6_template.r[9].length = htons(2);
  164. v6_template.r[10].type = htons(NF9_IN_PROTOCOL);
  165. v6_template.r[10].length = htons(1);
  166. v6_template.r[11].type = htons(NF9_TCP_FLAGS);
  167. v6_template.r[11].length = htons(1);
  168. v6_template.r[12].type = htons(NF9_IP_PROTOCOL_VERSION);
  169. v6_template.r[12].length = htons(1);
  170. }
  171. static int
  172. nf_flow_to_flowset(const struct FLOW *flow, u_char *packet, u_int len,
  173. u_int16_t ifidx, const struct timeval *system_boot_time, u_int *len_used)
  174. {
  175. union {
  176. struct NF9_SOFTFLOWD_DATA_V4 d4;
  177. struct NF9_SOFTFLOWD_DATA_V6 d6;
  178. } d[2];
  179. struct NF9_SOFTFLOWD_DATA_COMMON *dc[2];
  180. u_int freclen, ret_len, nflows;
  181. bzero(d, sizeof(d));
  182. *len_used = nflows = ret_len = 0;
  183. switch (flow->af) {
  184. case AF_INET:
  185. freclen = sizeof(struct NF9_SOFTFLOWD_DATA_V4);
  186. memcpy(&d[0].d4.src_addr, &flow->addr[0].v4, 4);
  187. memcpy(&d[0].d4.dst_addr, &flow->addr[1].v4, 4);
  188. memcpy(&d[1].d4.src_addr, &flow->addr[1].v4, 4);
  189. memcpy(&d[1].d4.dst_addr, &flow->addr[0].v4, 4);
  190. dc[0] = &d[0].d4.c;
  191. dc[1] = &d[1].d4.c;
  192. dc[0]->ipproto = dc[1]->ipproto = 4;
  193. break;
  194. case AF_INET6:
  195. freclen = sizeof(struct NF9_SOFTFLOWD_DATA_V6);
  196. memcpy(&d[0].d6.src_addr, &flow->addr[0].v6, 16);
  197. memcpy(&d[0].d6.dst_addr, &flow->addr[1].v6, 16);
  198. memcpy(&d[1].d6.src_addr, &flow->addr[1].v6, 16);
  199. memcpy(&d[1].d6.dst_addr, &flow->addr[0].v6, 16);
  200. dc[0] = &d[0].d6.c;
  201. dc[1] = &d[1].d6.c;
  202. dc[0]->ipproto = dc[1]->ipproto = 6;
  203. break;
  204. default:
  205. return (-1);
  206. }
  207. dc[0]->first_switched = dc[1]->first_switched =
  208. htonl(timeval_sub_ms(&flow->flow_start, system_boot_time));
  209. dc[0]->last_switched = dc[1]->last_switched =
  210. htonl(timeval_sub_ms(&flow->flow_last, system_boot_time));
  211. dc[0]->bytes = htonl(flow->octets[0]);
  212. dc[1]->bytes = htonl(flow->octets[1]);
  213. dc[0]->packets = htonl(flow->packets[0]);
  214. dc[1]->packets = htonl(flow->packets[1]);
  215. dc[0]->if_index_in = dc[0]->if_index_out = htonl(ifidx);
  216. dc[1]->if_index_in = dc[1]->if_index_out = htonl(ifidx);
  217. dc[0]->src_port = dc[1]->dst_port = flow->port[0];
  218. dc[1]->src_port = dc[0]->dst_port = flow->port[1];
  219. dc[0]->protocol = dc[1]->protocol = flow->protocol;
  220. dc[0]->tcp_flags = flow->tcp_flags[0];
  221. dc[1]->tcp_flags = flow->tcp_flags[1];
  222. if (flow->octets[0] > 0) {
  223. if (ret_len + freclen > len)
  224. return (-1);
  225. memcpy(packet + ret_len, &d[0], freclen);
  226. ret_len += freclen;
  227. nflows++;
  228. }
  229. if (flow->octets[1] > 0) {
  230. if (ret_len + freclen > len)
  231. return (-1);
  232. memcpy(packet + ret_len, &d[1], freclen);
  233. ret_len += freclen;
  234. nflows++;
  235. }
  236. *len_used = ret_len;
  237. return (nflows);
  238. }
  239. /*
  240. * Given an array of expired flows, send netflow v9 report packets
  241. * Returns number of packets sent or -1 on error
  242. */
  243. int
  244. send_netflow_v9(struct FLOW **flows, int num_flows, int nfsock, u_int16_t ifidx,
  245. u_int64_t *flows_exported, struct timeval *system_boot_time,
  246. int verbose_flag)
  247. {
  248. struct NF9_HEADER *nf9;
  249. struct NF9_DATA_FLOWSET_HEADER *dh;
  250. struct timeval now;
  251. u_int offset, last_af, i, j, num_packets, inc, last_valid;
  252. socklen_t errsz;
  253. int err, r;
  254. u_char packet[NF9_SOFTFLOWD_MAX_PACKET_SIZE];
  255. gettimeofday(&now, NULL);
  256. if (nf9_pkts_until_template == -1) {
  257. nf9_init_template();
  258. nf9_pkts_until_template = 0;
  259. }
  260. last_valid = num_packets = 0;
  261. for (j = 0; j < num_flows;) {
  262. bzero(packet, sizeof(packet));
  263. nf9 = (struct NF9_HEADER *)packet;
  264. nf9->version = htons(9);
  265. nf9->flows = 0; /* Filled as we go, htons at end */
  266. nf9->uptime_ms = htonl(timeval_sub_ms(&now, system_boot_time));
  267. nf9->time_sec = htonl(time(NULL));
  268. nf9->package_sequence = htonl(*flows_exported + j);
  269. nf9->source_id = 0;
  270. offset = sizeof(*nf9);
  271. /* Refresh template headers if we need to */
  272. if (nf9_pkts_until_template <= 0) {
  273. memcpy(packet + offset, &v4_template,
  274. sizeof(v4_template));
  275. offset += sizeof(v4_template);
  276. memcpy(packet + offset, &v6_template,
  277. sizeof(v6_template));
  278. offset += sizeof(v6_template);
  279. nf9_pkts_until_template = NF9_DEFAULT_TEMPLATE_INTERVAL;
  280. }
  281. dh = NULL;
  282. last_af = 0;
  283. for (i = 0; i + j < num_flows; i++) {
  284. if (dh == NULL || flows[i + j]->af != last_af) {
  285. if (dh != NULL) {
  286. if (offset % 4 != 0) {
  287. /* Pad to multiple of 4 */
  288. dh->c.length += 4 - (offset % 4);
  289. offset += 4 - (offset % 4);
  290. }
  291. /* Finalise last header */
  292. dh->c.length = htons(dh->c.length);
  293. }
  294. if (offset + sizeof(*dh) > sizeof(packet)) {
  295. /* Mark header is finished */
  296. dh = NULL;
  297. break;
  298. }
  299. dh = (struct NF9_DATA_FLOWSET_HEADER *)
  300. (packet + offset);
  301. dh->c.flowset_id =
  302. (flows[i + j]->af == AF_INET) ?
  303. v4_template.h.template_id :
  304. v6_template.h.template_id;
  305. last_af = flows[i + j]->af;
  306. last_valid = offset;
  307. dh->c.length = sizeof(*dh); /* Filled as we go */
  308. offset += sizeof(*dh);
  309. }
  310. r = nf_flow_to_flowset(flows[i + j], packet + offset,
  311. sizeof(packet) - offset, ifidx, system_boot_time, &inc);
  312. if (r <= 0) {
  313. /* yank off data header, if we had to go back */
  314. if (last_valid)
  315. offset = last_valid;
  316. break;
  317. }
  318. offset += inc;
  319. dh->c.length += inc;
  320. nf9->flows += r;
  321. last_valid = 0; /* Don't clobber this header now */
  322. if (verbose_flag) {
  323. logit(LOG_DEBUG, "Flow %d/%d: "
  324. "r %d offset %d type %04x len %d(0x%04x) "
  325. "flows %d", r, i, j, offset,
  326. dh->c.flowset_id, dh->c.length,
  327. dh->c.length, nf9->flows);
  328. }
  329. }
  330. /* Don't finish header if it has already been done */
  331. if (dh != NULL) {
  332. if (offset % 4 != 0) {
  333. /* Pad to multiple of 4 */
  334. dh->c.length += 4 - (offset % 4);
  335. offset += 4 - (offset % 4);
  336. }
  337. /* Finalise last header */
  338. dh->c.length = htons(dh->c.length);
  339. }
  340. nf9->flows = htons(nf9->flows);
  341. if (verbose_flag)
  342. logit(LOG_DEBUG, "Sending flow packet len = %d", offset);
  343. errsz = sizeof(err);
  344. /* Clear ICMP errors */
  345. getsockopt(nfsock, SOL_SOCKET, SO_ERROR, &err, &errsz);
  346. if (send(nfsock, packet, (size_t)offset, 0) == -1)
  347. return (-1);
  348. num_packets++;
  349. nf9_pkts_until_template--;
  350. j += i;
  351. }
  352. *flows_exported += j;
  353. return (num_packets);
  354. }
  355. void
  356. netflow9_resend_template(void)
  357. {
  358. if (nf9_pkts_until_template > 0)
  359. nf9_pkts_until_template = 0;
  360. }