netflow5.c 5.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174
  1. /*
  2. * Copyright 2002 Damien Miller <djm@mindrot.org> All rights reserved.
  3. *
  4. * Redistribution and use in source and binary forms, with or without
  5. * modification, are permitted provided that the following conditions
  6. * are met:
  7. * 1. Redistributions of source code must retain the above copyright
  8. * notice, this list of conditions and the following disclaimer.
  9. * 2. Redistributions in binary form must reproduce the above copyright
  10. * notice, this list of conditions and the following disclaimer in the
  11. * documentation and/or other materials provided with the distribution.
  12. *
  13. * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  14. * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  15. * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  16. * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  17. * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  18. * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  19. * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  20. * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  21. * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  22. * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  23. */
  24. #include "common.h"
  25. #include "log.h"
  26. #include "treetype.h"
  27. #include "softflowd.h"
  28. /*
  29. * This is the Cisco Netflow(tm) version 5 packet format
  30. * Based on:
  31. * http://www.cisco.com/en/US/products/sw/netmgtsw/ps1964/products_implementation_design_guide09186a00800d6a11.html
  32. */
  33. struct NF5_HEADER {
  34. u_int16_t version, flows;
  35. u_int32_t uptime_ms, time_sec, time_nanosec, flow_sequence;
  36. u_int8_t engine_type, engine_id;
  37. u_int16_t sampling_interval;
  38. };
  39. struct NF5_FLOW {
  40. u_int32_t src_ip, dest_ip, nexthop_ip;
  41. u_int16_t if_index_in, if_index_out;
  42. u_int32_t flow_packets, flow_octets;
  43. u_int32_t flow_start, flow_finish;
  44. u_int16_t src_port, dest_port;
  45. u_int8_t pad1;
  46. u_int8_t tcp_flags, protocol, tos;
  47. u_int16_t src_as, dest_as;
  48. u_int8_t src_mask, dst_mask;
  49. u_int16_t pad2;
  50. };
  51. #define NF5_MAXFLOWS 30
  52. #define NF5_MAXPACKET_SIZE (sizeof(struct NF5_HEADER) + \
  53. (NF5_MAXFLOWS * sizeof(struct NF5_FLOW)))
  54. /*
  55. * Given an array of expired flows, send netflow v5 report packets
  56. * Returns number of packets sent or -1 on error
  57. */
  58. int
  59. send_netflow_v5(struct FLOW **flows, int num_flows, int nfsock, u_int16_t ifidx,
  60. u_int64_t *flows_exported, struct timeval *system_boot_time,
  61. int verbose_flag, struct OPTION *option)
  62. {
  63. struct timeval now;
  64. u_int32_t uptime_ms;
  65. u_int8_t packet[NF5_MAXPACKET_SIZE]; /* Maximum allowed packet size (24 flows) */
  66. struct NF5_HEADER *hdr = NULL;
  67. struct NF5_FLOW *flw = NULL;
  68. int i, j, offset, num_packets, err;
  69. socklen_t errsz;
  70. gettimeofday(&now, NULL);
  71. uptime_ms = timeval_sub_ms(&now, system_boot_time);
  72. hdr = (struct NF5_HEADER *)packet;
  73. for (num_packets = offset = j = i = 0; i < num_flows; i++) {
  74. if (j >= NF5_MAXFLOWS - 1) {
  75. if (verbose_flag)
  76. logit(LOG_DEBUG, "Sending flow packet len = %d", offset);
  77. hdr->flows = htons(hdr->flows);
  78. errsz = sizeof(err);
  79. getsockopt(nfsock, SOL_SOCKET, SO_ERROR,
  80. &err, &errsz); /* Clear ICMP errors */
  81. if (send(nfsock, packet, (size_t)offset, 0) == -1)
  82. return (-1);
  83. *flows_exported += j;
  84. j = 0;
  85. num_packets++;
  86. }
  87. if (j == 0) {
  88. memset(&packet, '\0', sizeof(packet));
  89. hdr->version = htons(5);
  90. hdr->flows = 0; /* Filled in as we go */
  91. hdr->uptime_ms = htonl(uptime_ms);
  92. hdr->time_sec = htonl(now.tv_sec);
  93. hdr->time_nanosec = htonl(now.tv_usec * 1000);
  94. hdr->flow_sequence = htonl(*flows_exported);
  95. if (option->sample > 0) {
  96. hdr->sampling_interval =
  97. htons(0x01 << 14 | option->sample & 0x3FFF);
  98. }
  99. /* Other fields are left zero */
  100. offset = sizeof(*hdr);
  101. }
  102. flw = (struct NF5_FLOW *)(packet + offset);
  103. flw->if_index_in = flw->if_index_out = htons(ifidx);
  104. /* NetFlow v.5 doesn't do IPv6 */
  105. if (flows[i]->af != AF_INET)
  106. continue;
  107. if (flows[i]->octets[0] > 0) {
  108. flw->src_ip = flows[i]->addr[0].v4.s_addr;
  109. flw->dest_ip = flows[i]->addr[1].v4.s_addr;
  110. flw->src_port = flows[i]->port[0];
  111. flw->dest_port = flows[i]->port[1];
  112. flw->flow_packets = htonl(flows[i]->packets[0]);
  113. flw->flow_octets = htonl(flows[i]->octets[0]);
  114. flw->flow_start =
  115. htonl(timeval_sub_ms(&flows[i]->flow_start,
  116. system_boot_time));
  117. flw->flow_finish =
  118. htonl(timeval_sub_ms(&flows[i]->flow_last,
  119. system_boot_time));
  120. flw->tcp_flags = flows[i]->tcp_flags[0];
  121. flw->protocol = flows[i]->protocol;
  122. offset += sizeof(*flw);
  123. j++;
  124. hdr->flows++;
  125. }
  126. flw = (struct NF5_FLOW *)(packet + offset);
  127. flw->if_index_in = flw->if_index_out = htons(ifidx);
  128. if (flows[i]->octets[1] > 0) {
  129. flw->src_ip = flows[i]->addr[1].v4.s_addr;
  130. flw->dest_ip = flows[i]->addr[0].v4.s_addr;
  131. flw->src_port = flows[i]->port[1];
  132. flw->dest_port = flows[i]->port[0];
  133. flw->flow_packets = htonl(flows[i]->packets[1]);
  134. flw->flow_octets = htonl(flows[i]->octets[1]);
  135. flw->flow_start =
  136. htonl(timeval_sub_ms(&flows[i]->flow_start,
  137. system_boot_time));
  138. flw->flow_finish =
  139. htonl(timeval_sub_ms(&flows[i]->flow_last,
  140. system_boot_time));
  141. flw->tcp_flags = flows[i]->tcp_flags[1];
  142. flw->protocol = flows[i]->protocol;
  143. offset += sizeof(*flw);
  144. j++;
  145. hdr->flows++;
  146. }
  147. }
  148. /* Send any leftovers */
  149. if (j != 0) {
  150. if (verbose_flag)
  151. logit(LOG_DEBUG, "Sending v5 flow packet len = %d",
  152. offset);
  153. hdr->flows = htons(hdr->flows);
  154. errsz = sizeof(err);
  155. getsockopt(nfsock, SOL_SOCKET, SO_ERROR,
  156. &err, &errsz); /* Clear ICMP errors */
  157. if (send(nfsock, packet, (size_t)offset, 0) == -1)
  158. return (-1);
  159. num_packets++;
  160. }
  161. *flows_exported += j;
  162. return (num_packets);
  163. }