netflow1.c 5.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167
  1. /*
  2. * Copyright 2002 Damien Miller <djm@mindrot.org> All rights reserved.
  3. *
  4. * Redistribution and use in source and binary forms, with or without
  5. * modification, are permitted provided that the following conditions
  6. * are met:
  7. * 1. Redistributions of source code must retain the above copyright
  8. * notice, this list of conditions and the following disclaimer.
  9. * 2. Redistributions in binary form must reproduce the above copyright
  10. * notice, this list of conditions and the following disclaimer in the
  11. * documentation and/or other materials provided with the distribution.
  12. *
  13. * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  14. * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  15. * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  16. * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  17. * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  18. * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  19. * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  20. * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  21. * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  22. * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  23. */
  24. #include "common.h"
  25. #include "log.h"
  26. #include "treetype.h"
  27. #include "softflowd.h"
  28. /*
  29. * This is the Cisco Netflow(tm) version 1 packet format
  30. * Based on:
  31. * http://www.cisco.com/en/US/products/sw/netmgtsw/ps1964/products_implementation_design_guide09186a00800d6a11.html
  32. */
  33. struct NF1_HEADER {
  34. u_int16_t version, flows;
  35. u_int32_t uptime_ms, time_sec, time_nanosec;
  36. };
  37. struct NF1_FLOW {
  38. u_int32_t src_ip, dest_ip, nexthop_ip;
  39. u_int16_t if_index_in, if_index_out;
  40. u_int32_t flow_packets, flow_octets;
  41. u_int32_t flow_start, flow_finish;
  42. u_int16_t src_port, dest_port;
  43. u_int16_t pad1;
  44. u_int8_t protocol, tos, tcp_flags;
  45. u_int8_t pad2, pad3, pad4;
  46. u_int32_t reserved1;
  47. #if 0
  48. u_int8_t reserved2; /* XXX: no longer used */
  49. #endif
  50. };
  51. /* Maximum of 24 flows per packet */
  52. #define NF1_MAXFLOWS 24
  53. #define NF1_MAXPACKET_SIZE (sizeof(struct NF1_HEADER) + \
  54. (NF1_MAXFLOWS * sizeof(struct NF1_FLOW)))
  55. /*
  56. * Given an array of expired flows, send netflow v1 report packets
  57. * Returns number of packets sent or -1 on error
  58. */
  59. int
  60. send_netflow_v1(struct FLOW **flows, int num_flows, int nfsock, u_int16_t ifidx,
  61. u_int64_t *flows_exported, struct timeval *system_boot_time,
  62. int verbose_flag, struct OPTION *option)
  63. {
  64. struct timeval now;
  65. u_int32_t uptime_ms;
  66. u_int8_t packet[NF1_MAXPACKET_SIZE]; /* Maximum allowed packet size (24 flows) */
  67. struct NF1_HEADER *hdr = NULL;
  68. struct NF1_FLOW *flw = NULL;
  69. int i, j, offset, num_packets, err;
  70. socklen_t errsz;
  71. gettimeofday(&now, NULL);
  72. uptime_ms = timeval_sub_ms(&now, system_boot_time);
  73. hdr = (struct NF1_HEADER *)packet;
  74. for(num_packets = offset = j = i = 0; i < num_flows; i++) {
  75. if (j >= NF1_MAXFLOWS - 1) {
  76. if (verbose_flag)
  77. logit(LOG_DEBUG, "Sending flow packet len = %d", offset);
  78. hdr->flows = htons(hdr->flows);
  79. errsz = sizeof(err);
  80. getsockopt(nfsock, SOL_SOCKET, SO_ERROR,
  81. &err, &errsz); /* Clear ICMP errors */
  82. if (send(nfsock, packet, (size_t)offset, 0) == -1)
  83. return (-1);
  84. *flows_exported += j;
  85. j = 0;
  86. num_packets++;
  87. }
  88. if (j == 0) {
  89. memset(&packet, '\0', sizeof(packet));
  90. hdr->version = htons(1);
  91. hdr->flows = 0; /* Filled in as we go */
  92. hdr->uptime_ms = htonl(uptime_ms);
  93. hdr->time_sec = htonl(now.tv_sec);
  94. hdr->time_nanosec = htonl(now.tv_usec * 1000);
  95. offset = sizeof(*hdr);
  96. }
  97. flw = (struct NF1_FLOW *)(packet + offset);
  98. flw->if_index_in = flw->if_index_out = htons(ifidx);
  99. /* NetFlow v.1 doesn't do IPv6 */
  100. if (flows[i]->af != AF_INET)
  101. continue;
  102. if (flows[i]->octets[0] > 0) {
  103. flw->src_ip = flows[i]->addr[0].v4.s_addr;
  104. flw->dest_ip = flows[i]->addr[1].v4.s_addr;
  105. flw->src_port = flows[i]->port[0];
  106. flw->dest_port = flows[i]->port[1];
  107. flw->flow_packets = htonl(flows[i]->packets[0]);
  108. flw->flow_octets = htonl(flows[i]->octets[0]);
  109. flw->flow_start =
  110. htonl(timeval_sub_ms(&flows[i]->flow_start,
  111. system_boot_time));
  112. flw->flow_finish =
  113. htonl(timeval_sub_ms(&flows[i]->flow_last,
  114. system_boot_time));
  115. flw->protocol = flows[i]->protocol;
  116. flw->tcp_flags = flows[i]->tcp_flags[0];
  117. offset += sizeof(*flw);
  118. j++;
  119. hdr->flows++;
  120. }
  121. flw = (struct NF1_FLOW *)(packet + offset);
  122. flw->if_index_in = flw->if_index_out = htons(ifidx);
  123. if (flows[i]->octets[1] > 0) {
  124. flw->src_ip = flows[i]->addr[1].v4.s_addr;
  125. flw->dest_ip = flows[i]->addr[0].v4.s_addr;
  126. flw->src_port = flows[i]->port[1];
  127. flw->dest_port = flows[i]->port[0];
  128. flw->flow_packets = htonl(flows[i]->packets[1]);
  129. flw->flow_octets = htonl(flows[i]->octets[1]);
  130. flw->flow_start =
  131. htonl(timeval_sub_ms(&flows[i]->flow_start,
  132. system_boot_time));
  133. flw->flow_finish =
  134. htonl(timeval_sub_ms(&flows[i]->flow_last,
  135. system_boot_time));
  136. flw->protocol = flows[i]->protocol;
  137. flw->tcp_flags = flows[i]->tcp_flags[1];
  138. offset += sizeof(*flw);
  139. j++;
  140. hdr->flows++;
  141. }
  142. }
  143. /* Send any leftovers */
  144. if (j != 0) {
  145. if (verbose_flag)
  146. logit(LOG_DEBUG, "Sending flow packet len = %d", offset);
  147. hdr->flows = htons(hdr->flows);
  148. errsz = sizeof(err);
  149. getsockopt(nfsock, SOL_SOCKET, SO_ERROR,
  150. &err, &errsz); /* Clear ICMP errors */
  151. if (send(nfsock, packet, (size_t)offset, 0) == -1)
  152. return (-1);
  153. num_packets++;
  154. }
  155. *flows_exported += j;
  156. return (num_packets);
  157. }