softflowd.c 53 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994
  1. /*
  2. * Copyright 2002 Damien Miller <djm@mindrot.org> All rights reserved.
  3. *
  4. * Redistribution and use in source and binary forms, with or without
  5. * modification, are permitted provided that the following conditions
  6. * are met:
  7. * 1. Redistributions of source code must retain the above copyright
  8. * notice, this list of conditions and the following disclaimer.
  9. * 2. Redistributions in binary form must reproduce the above copyright
  10. * notice, this list of conditions and the following disclaimer in the
  11. * documentation and/or other materials provided with the distribution.
  12. *
  13. * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  14. * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  15. * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  16. * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  17. * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  18. * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  19. * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  20. * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  21. * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  22. * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  23. */
  24. /* $Id$ */
  25. /*
  26. * This is software implementation of Cisco's NetFlow(tm) traffic
  27. * reporting system. It operates by listening (via libpcap) on a
  28. * promiscuous interface and tracking traffic flows.
  29. *
  30. * Traffic flows are recorded by source/destination/protocol
  31. * IP address or, in the case of TCP and UDP, by
  32. * src_addr:src_port/dest_addr:dest_port/protocol
  33. *
  34. * Flows expire automatically after a period of inactivity (default: 1
  35. * hour) They may also be evicted (in order of age) in situations where
  36. * there are more flows than slots available.
  37. *
  38. * Netflow compatible packets are sent to a specified target host upon
  39. * flow expiry.
  40. *
  41. * As this implementation watches traffic promiscuously, it is likely to
  42. * place significant load on hosts or gateways on which it is installed.
  43. */
  44. #include "common.h"
  45. #include "sys-tree.h"
  46. #include "convtime.h"
  47. #include "softflowd.h"
  48. #include "treetype.h"
  49. #include "freelist.h"
  50. #include "log.h"
  51. #include <pcap.h>
  52. RCSID("$Id$");
  53. /* Global variables */
  54. static int verbose_flag = 0; /* Debugging flag */
  55. static u_int16_t if_index = 0; /* "manual" interface index */
  56. /* Signal handler flags */
  57. static volatile sig_atomic_t graceful_shutdown_request = 0;
  58. /* Context for libpcap callback functions */
  59. struct CB_CTXT {
  60. struct FLOWTRACK *ft;
  61. int linktype;
  62. int fatal;
  63. int want_v6;
  64. };
  65. /* Describes a datalink header and how to extract v4/v6 frames from it */
  66. struct DATALINK {
  67. int dlt; /* BPF datalink type */
  68. int skiplen; /* Number of bytes to skip datalink header */
  69. int ft_off; /* Datalink frametype offset */
  70. int ft_len; /* Datalink frametype length */
  71. int ft_is_be; /* Set if frametype is big-endian */
  72. u_int32_t ft_mask; /* Mask applied to frametype */
  73. u_int32_t ft_v4; /* IPv4 frametype */
  74. u_int32_t ft_v6; /* IPv6 frametype */
  75. };
  76. /* Datalink types that we know about */
  77. static const struct DATALINK lt[] = {
  78. { DLT_EN10MB, 14, 12, 2, 1, 0xffffffff, 0x0800, 0x86dd },
  79. { DLT_PPP, 5, 3, 2, 1, 0xffffffff, 0x0021, 0x0057 },
  80. #ifdef DLT_LINUX_SLL
  81. { DLT_LINUX_SLL,16, 14, 2, 1, 0xffffffff, 0x0800, 0x86dd },
  82. #endif
  83. { DLT_RAW, 0, 0, 1, 1, 0x000000f0, 0x0040, 0x0060 },
  84. { DLT_NULL, 4, 0, 4, 0, 0xffffffff, AF_INET, AF_INET6 },
  85. #ifdef DLT_LOOP
  86. { DLT_LOOP, 4, 0, 4, 1, 0xffffffff, AF_INET, AF_INET6 },
  87. #endif
  88. { -1, -1, -1, -1, -1, 0x00000000, 0xffff, 0xffff },
  89. };
  90. /* Netflow send functions */
  91. typedef int (netflow_send_func_t)(struct FLOW **, int, int, u_int16_t,
  92. u_int64_t *, struct timeval *, int);
  93. struct NETFLOW_SENDER {
  94. int version;
  95. netflow_send_func_t *func;
  96. int v6_capable;
  97. };
  98. /* Array of NetFlow export function that we know of. NB. nf[0] is default */
  99. static const struct NETFLOW_SENDER nf[] = {
  100. { 5, send_netflow_v5, 0 },
  101. { 1, send_netflow_v1, 0 },
  102. { 9, send_netflow_v9, 1 },
  103. { -1, NULL, 0 },
  104. };
  105. /* Describes a location where we send NetFlow packets to */
  106. struct NETFLOW_TARGET {
  107. int fd;
  108. const struct NETFLOW_SENDER *dialect;
  109. };
  110. /* Signal handlers */
  111. static void sighand_graceful_shutdown(int signum)
  112. {
  113. graceful_shutdown_request = signum;
  114. }
  115. static void sighand_other(int signum)
  116. {
  117. /* XXX: this may not be completely safe */
  118. logit(LOG_WARNING, "Exiting immediately on unexpected signal %d",
  119. signum);
  120. _exit(0);
  121. }
  122. /*
  123. * This is the flow comparison function.
  124. */
  125. static int
  126. flow_compare(struct FLOW *a, struct FLOW *b)
  127. {
  128. /* Be careful to avoid signed vs unsigned issues here */
  129. int r;
  130. if (a->af != b->af)
  131. return (a->af > b->af ? 1 : -1);
  132. if ((r = memcmp(&a->addr[0], &b->addr[0], sizeof(a->addr[0]))) != 0)
  133. return (r > 0 ? 1 : -1);
  134. if ((r = memcmp(&a->addr[1], &b->addr[1], sizeof(a->addr[1]))) != 0)
  135. return (r > 0 ? 1 : -1);
  136. #ifdef notyet
  137. if (a->ip6_flowlabel[0] != 0 && b->ip6_flowlabel[0] != 0 &&
  138. a->ip6_flowlabel[0] != b->ip6_flowlabel[0])
  139. return (a->ip6_flowlabel[0] > b->ip6_flowlabel[0] ? 1 : -1);
  140. if (a->ip6_flowlabel[1] != 0 && b->ip6_flowlabel[1] != 0 &&
  141. a->ip6_flowlabel[1] != b->ip6_flowlabel[1])
  142. return (a->ip6_flowlabel[1] > b->ip6_flowlabel[1] ? 1 : -1);
  143. #endif
  144. if (a->protocol != b->protocol)
  145. return (a->protocol > b->protocol ? 1 : -1);
  146. if (a->port[0] != b->port[0])
  147. return (ntohs(a->port[0]) > ntohs(b->port[0]) ? 1 : -1);
  148. if (a->port[1] != b->port[1])
  149. return (ntohs(a->port[1]) > ntohs(b->port[1]) ? 1 : -1);
  150. return (0);
  151. }
  152. /* Generate functions for flow tree */
  153. FLOW_PROTOTYPE(FLOWS, FLOW, trp, flow_compare);
  154. FLOW_GENERATE(FLOWS, FLOW, trp, flow_compare);
  155. /*
  156. * This is the expiry comparison function.
  157. */
  158. static int
  159. expiry_compare(struct EXPIRY *a, struct EXPIRY *b)
  160. {
  161. if (a->expires_at != b->expires_at)
  162. return (a->expires_at > b->expires_at ? 1 : -1);
  163. /* Make expiry entries unique by comparing flow sequence */
  164. if (a->flow->flow_seq != b->flow->flow_seq)
  165. return (a->flow->flow_seq > b->flow->flow_seq ? 1 : -1);
  166. return (0);
  167. }
  168. /* Generate functions for flow tree */
  169. EXPIRY_PROTOTYPE(EXPIRIES, EXPIRY, trp, expiry_compare);
  170. EXPIRY_GENERATE(EXPIRIES, EXPIRY, trp, expiry_compare);
  171. static struct FLOW *
  172. flow_get(struct FLOWTRACK *ft)
  173. {
  174. return freelist_get(&ft->flow_freelist);
  175. }
  176. static void
  177. flow_put(struct FLOWTRACK *ft, struct FLOW *flow)
  178. {
  179. return freelist_put(&ft->flow_freelist, flow);
  180. }
  181. static struct EXPIRY *
  182. expiry_get(struct FLOWTRACK *ft)
  183. {
  184. return freelist_get(&ft->expiry_freelist);
  185. }
  186. static void
  187. expiry_put(struct FLOWTRACK *ft, struct EXPIRY *expiry)
  188. {
  189. return freelist_put(&ft->expiry_freelist, expiry);
  190. }
  191. #if 0
  192. /* Dump a packet */
  193. static void
  194. dump_packet(const u_int8_t *p, int len)
  195. {
  196. char buf[1024], tmp[3];
  197. int i;
  198. for (*buf = '\0', i = 0; i < len; i++) {
  199. snprintf(tmp, sizeof(tmp), "%02x%s", p[i], i % 2 ? " " : "");
  200. if (strlcat(buf, tmp, sizeof(buf) - 4) >= sizeof(buf) - 4) {
  201. strlcat(buf, "...", sizeof(buf));
  202. break;
  203. }
  204. }
  205. logit(LOG_INFO, "packet len %d: %s", len, buf);
  206. }
  207. #endif
  208. /* Format a time in an ISOish format */
  209. static const char *
  210. format_time(time_t t)
  211. {
  212. struct tm *tm;
  213. static char buf[32];
  214. tm = gmtime(&t);
  215. strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S", tm);
  216. return (buf);
  217. }
  218. /* Format a flow in a verbose and ugly way */
  219. static const char *
  220. format_flow(struct FLOW *flow)
  221. {
  222. char addr1[64], addr2[64], stime[32], ftime[32];
  223. static char buf[1024];
  224. inet_ntop(flow->af, &flow->addr[0], addr1, sizeof(addr1));
  225. inet_ntop(flow->af, &flow->addr[1], addr2, sizeof(addr2));
  226. snprintf(stime, sizeof(ftime), "%s",
  227. format_time(flow->flow_start.tv_sec));
  228. snprintf(ftime, sizeof(ftime), "%s",
  229. format_time(flow->flow_last.tv_sec));
  230. snprintf(buf, sizeof(buf), "seq:%llu [%s]:%hu <> [%s]:%hu proto:%u "
  231. "octets>:%u packets>:%u octets<:%u packets<:%u "
  232. "start:%s.%03ld finish:%s.%03ld tcp>:%02x tcp<:%02x "
  233. "flowlabel>:%08x flowlabel<:%08x ",
  234. flow->flow_seq,
  235. addr1, ntohs(flow->port[0]), addr2, ntohs(flow->port[1]),
  236. (int)flow->protocol,
  237. flow->octets[0], flow->packets[0],
  238. flow->octets[1], flow->packets[1],
  239. stime, (flow->flow_start.tv_usec + 500) / 1000,
  240. ftime, (flow->flow_last.tv_usec + 500) / 1000,
  241. flow->tcp_flags[0], flow->tcp_flags[1],
  242. flow->ip6_flowlabel[0], flow->ip6_flowlabel[1]);
  243. return (buf);
  244. }
  245. /* Format a flow in a brief way */
  246. static const char *
  247. format_flow_brief(struct FLOW *flow)
  248. {
  249. char addr1[64], addr2[64];
  250. static char buf[1024];
  251. inet_ntop(flow->af, &flow->addr[0], addr1, sizeof(addr1));
  252. inet_ntop(flow->af, &flow->addr[1], addr2, sizeof(addr2));
  253. snprintf(buf, sizeof(buf),
  254. "seq:%llu [%s]:%hu <> [%s]:%hu proto:%u",
  255. flow->flow_seq,
  256. addr1, ntohs(flow->port[0]), addr2, ntohs(flow->port[1]),
  257. (int)flow->protocol);
  258. return (buf);
  259. }
  260. /* Fill in transport-layer (tcp/udp) portions of flow record */
  261. static int
  262. transport_to_flowrec(struct FLOW *flow, const u_int8_t *pkt,
  263. const size_t caplen, int isfrag, int protocol, int ndx)
  264. {
  265. const struct tcphdr *tcp = (const struct tcphdr *)pkt;
  266. const struct udphdr *udp = (const struct udphdr *)pkt;
  267. const struct icmp *icmp = (const struct icmp *)pkt;
  268. /*
  269. * XXX to keep flow in proper canonical format, it may be necessary to
  270. * swap the array slots based on the order of the port numbers does
  271. * this matter in practice??? I don't think so - return flows will
  272. * always match, because of their symmetrical addr/ports
  273. */
  274. switch (protocol) {
  275. case IPPROTO_TCP:
  276. /* Check for runt packet, but don't error out on short frags */
  277. if (caplen < sizeof(*tcp))
  278. return (isfrag ? 0 : 1);
  279. flow->port[ndx] = tcp->th_sport;
  280. flow->port[ndx ^ 1] = tcp->th_dport;
  281. flow->tcp_flags[ndx] |= tcp->th_flags;
  282. break;
  283. case IPPROTO_UDP:
  284. /* Check for runt packet, but don't error out on short frags */
  285. if (caplen < sizeof(*udp))
  286. return (isfrag ? 0 : 1);
  287. flow->port[ndx] = udp->uh_sport;
  288. flow->port[ndx ^ 1] = udp->uh_dport;
  289. break;
  290. case IPPROTO_ICMP:
  291. /*
  292. * Encode ICMP type * 256 + code into dest port like
  293. * Cisco routers
  294. */
  295. flow->port[ndx] = 0;
  296. flow->port[ndx ^ 1] = htons(icmp->icmp_type * 256 +
  297. icmp->icmp_code);
  298. break;
  299. }
  300. return (0);
  301. }
  302. /* Convert a IPv4 packet to a partial flow record (used for comparison) */
  303. static int
  304. ipv4_to_flowrec(struct FLOW *flow, const u_int8_t *pkt, size_t caplen,
  305. size_t len, int *isfrag, int af)
  306. {
  307. const struct ip *ip = (const struct ip *)pkt;
  308. int ndx;
  309. if (caplen < 20 || caplen < ip->ip_hl * 4)
  310. return (-1); /* Runt packet */
  311. if (ip->ip_v != 4)
  312. return (-1); /* Unsupported IP version */
  313. /* Prepare to store flow in canonical format */
  314. ndx = memcmp(&ip->ip_src, &ip->ip_dst, sizeof(ip->ip_src)) > 0 ? 1 : 0;
  315. flow->af = af;
  316. flow->addr[ndx].v4 = ip->ip_src;
  317. flow->addr[ndx ^ 1].v4 = ip->ip_dst;
  318. flow->protocol = ip->ip_p;
  319. flow->octets[ndx] = len;
  320. flow->packets[ndx] = 1;
  321. *isfrag = (ntohs(ip->ip_off) & (IP_OFFMASK|IP_MF)) ? 1 : 0;
  322. /* Don't try to examine higher level headers if not first fragment */
  323. if (*isfrag && (ntohs(ip->ip_off) & IP_OFFMASK) != 0)
  324. return (0);
  325. return (transport_to_flowrec(flow, pkt + (ip->ip_hl * 4),
  326. caplen - (ip->ip_hl * 4), *isfrag, ip->ip_p, ndx));
  327. }
  328. /* Convert a IPv6 packet to a partial flow record (used for comparison) */
  329. static int
  330. ipv6_to_flowrec(struct FLOW *flow, const u_int8_t *pkt, size_t caplen,
  331. size_t len, int *isfrag, int af)
  332. {
  333. const struct ip6_hdr *ip6 = (const struct ip6_hdr *)pkt;
  334. const struct ip6_ext *eh6;
  335. const struct ip6_frag *fh6;
  336. int ndx, nxt;
  337. if (caplen < sizeof(*ip6))
  338. return (-1); /* Runt packet */
  339. if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION)
  340. return (-1); /* Unsupported IPv6 version */
  341. /* Prepare to store flow in canonical format */
  342. ndx = memcmp(&ip6->ip6_src, &ip6->ip6_dst,
  343. sizeof(ip6->ip6_src)) > 0 ? 1 : 0;
  344. flow->af = af;
  345. flow->ip6_flowlabel[ndx] = ip6->ip6_flow & IPV6_FLOWLABEL_MASK;
  346. flow->addr[ndx].v6 = ip6->ip6_src;
  347. flow->addr[ndx ^ 1].v6 = ip6->ip6_dst;
  348. flow->octets[ndx] = len;
  349. flow->packets[ndx] = 1;
  350. *isfrag = 0;
  351. nxt = ip6->ip6_nxt;
  352. pkt += sizeof(*ip6);
  353. caplen -= sizeof(*ip6);
  354. /* Now loop through headers, looking for transport header */
  355. for (;;) {
  356. eh6 = (const struct ip6_ext *)pkt;
  357. if (nxt == IPPROTO_HOPOPTS ||
  358. nxt == IPPROTO_ROUTING ||
  359. nxt == IPPROTO_DSTOPTS) {
  360. if (caplen < sizeof(*eh6) ||
  361. caplen < (eh6->ip6e_len + 1) << 3)
  362. return (1); /* Runt */
  363. nxt = eh6->ip6e_nxt;
  364. pkt += (eh6->ip6e_len + 1) << 3;
  365. caplen -= (eh6->ip6e_len + 1) << 3;
  366. } else if (nxt == IPPROTO_FRAGMENT) {
  367. *isfrag = 1;
  368. fh6 = (const struct ip6_frag *)eh6;
  369. if (caplen < sizeof(*fh6))
  370. return (1); /* Runt */
  371. /*
  372. * Don't try to examine higher level headers if
  373. * not first fragment
  374. */
  375. if ((fh6->ip6f_offlg & IP6F_OFF_MASK) != 0)
  376. return (0);
  377. nxt = fh6->ip6f_nxt;
  378. pkt += sizeof(*fh6);
  379. caplen -= sizeof(*fh6);
  380. } else
  381. break;
  382. }
  383. flow->protocol = nxt;
  384. return (transport_to_flowrec(flow, pkt, caplen, *isfrag, nxt, ndx));
  385. }
  386. static void
  387. flow_update_expiry(struct FLOWTRACK *ft, struct FLOW *flow)
  388. {
  389. EXPIRY_REMOVE(EXPIRIES, &ft->expiries, flow->expiry);
  390. /* Flows over 2 GiB traffic */
  391. if (flow->octets[0] > (1U << 31) || flow->octets[1] > (1U << 31)) {
  392. flow->expiry->expires_at = 0;
  393. flow->expiry->reason = R_OVERBYTES;
  394. goto out;
  395. }
  396. /* Flows over maximum life seconds */
  397. if (ft->maximum_lifetime != 0 &&
  398. flow->flow_last.tv_sec - flow->flow_start.tv_sec >
  399. ft->maximum_lifetime) {
  400. flow->expiry->expires_at = 0;
  401. flow->expiry->reason = R_MAXLIFE;
  402. goto out;
  403. }
  404. if (flow->protocol == IPPROTO_TCP) {
  405. /* Reset TCP flows */
  406. if (ft->tcp_rst_timeout != 0 &&
  407. ((flow->tcp_flags[0] & TH_RST) ||
  408. (flow->tcp_flags[1] & TH_RST))) {
  409. flow->expiry->expires_at = flow->flow_last.tv_sec +
  410. ft->tcp_rst_timeout;
  411. flow->expiry->reason = R_TCP_RST;
  412. goto out;
  413. }
  414. /* Finished TCP flows */
  415. if (ft->tcp_fin_timeout != 0 &&
  416. ((flow->tcp_flags[0] & TH_FIN) &&
  417. (flow->tcp_flags[1] & TH_FIN))) {
  418. flow->expiry->expires_at = flow->flow_last.tv_sec +
  419. ft->tcp_fin_timeout;
  420. flow->expiry->reason = R_TCP_FIN;
  421. goto out;
  422. }
  423. /* TCP flows */
  424. if (ft->tcp_timeout != 0) {
  425. flow->expiry->expires_at = flow->flow_last.tv_sec +
  426. ft->tcp_timeout;
  427. flow->expiry->reason = R_TCP;
  428. goto out;
  429. }
  430. }
  431. if (ft->udp_timeout != 0 && flow->protocol == IPPROTO_UDP) {
  432. /* UDP flows */
  433. flow->expiry->expires_at = flow->flow_last.tv_sec +
  434. ft->udp_timeout;
  435. flow->expiry->reason = R_UDP;
  436. goto out;
  437. }
  438. if (ft->icmp_timeout != 0 &&
  439. ((flow->af == AF_INET && flow->protocol == IPPROTO_ICMP) ||
  440. ((flow->af == AF_INET6 && flow->protocol == IPPROTO_ICMPV6)))) {
  441. /* ICMP flows */
  442. flow->expiry->expires_at = flow->flow_last.tv_sec +
  443. ft->icmp_timeout;
  444. flow->expiry->reason = R_ICMP;
  445. goto out;
  446. }
  447. /* Everything else */
  448. flow->expiry->expires_at = flow->flow_last.tv_sec +
  449. ft->general_timeout;
  450. flow->expiry->reason = R_GENERAL;
  451. out:
  452. if (ft->maximum_lifetime != 0 && flow->expiry->expires_at != 0) {
  453. flow->expiry->expires_at = MIN(flow->expiry->expires_at,
  454. flow->flow_start.tv_sec + ft->maximum_lifetime);
  455. }
  456. EXPIRY_INSERT(EXPIRIES, &ft->expiries, flow->expiry);
  457. }
  458. /* Return values from process_packet */
  459. #define PP_OK 0
  460. #define PP_BAD_PACKET -2
  461. #define PP_MALLOC_FAIL -3
  462. /*
  463. * Main per-packet processing function. Take a packet (provided by
  464. * libpcap) and attempt to find a matching flow. If no such flow exists,
  465. * then create one.
  466. *
  467. * Also marks flows for fast expiry, based on flow or packet attributes
  468. * (the actual expiry is performed elsewhere)
  469. */
  470. static int
  471. process_packet(struct FLOWTRACK *ft, const u_int8_t *pkt, int af,
  472. const u_int32_t caplen, const u_int32_t len,
  473. const struct timeval *received_time)
  474. {
  475. struct FLOW tmp, *flow;
  476. int frag;
  477. ft->total_packets++;
  478. /* Convert the IP packet to a flow identity */
  479. memset(&tmp, 0, sizeof(tmp));
  480. switch (af) {
  481. case AF_INET:
  482. if (ipv4_to_flowrec(&tmp, pkt, caplen, len, &frag, af) == -1)
  483. goto bad;
  484. break;
  485. case AF_INET6:
  486. if (ipv6_to_flowrec(&tmp, pkt, caplen, len, &frag, af) == -1)
  487. goto bad;
  488. break;
  489. default:
  490. bad:
  491. ft->bad_packets++;
  492. return (PP_BAD_PACKET);
  493. }
  494. if (frag)
  495. ft->frag_packets++;
  496. /* Zero out bits of the flow that aren't relevant to tracking level */
  497. switch (ft->track_level) {
  498. case TRACK_IP_ONLY:
  499. tmp.protocol = 0;
  500. /* FALLTHROUGH */
  501. case TRACK_IP_PROTO:
  502. tmp.port[0] = tmp.port[1] = 0;
  503. tmp.tcp_flags[0] = tmp.tcp_flags[1] = 0;
  504. /* FALLTHROUGH */
  505. case TRACK_FULL:
  506. break;
  507. }
  508. /* If a matching flow does not exist, create and insert one */
  509. if ((flow = FLOW_FIND(FLOWS, &ft->flows, &tmp)) == NULL) {
  510. /* Allocate and fill in the flow */
  511. if ((flow = flow_get(ft)) == NULL) {
  512. logit(LOG_ERR, "process_packet: flow_get failed",
  513. sizeof(*flow));
  514. return (PP_MALLOC_FAIL);
  515. }
  516. memcpy(flow, &tmp, sizeof(*flow));
  517. memcpy(&flow->flow_start, received_time,
  518. sizeof(flow->flow_start));
  519. flow->flow_seq = ft->next_flow_seq++;
  520. FLOW_INSERT(FLOWS, &ft->flows, flow);
  521. /* Allocate and fill in the associated expiry event */
  522. if ((flow->expiry = expiry_get(ft)) == NULL) {
  523. logit(LOG_ERR, "process_packet: expiry_get failed",
  524. sizeof(*flow->expiry));
  525. return (PP_MALLOC_FAIL);
  526. }
  527. flow->expiry->flow = flow;
  528. /* Must be non-zero (0 means expire immediately) */
  529. flow->expiry->expires_at = 1;
  530. flow->expiry->reason = R_GENERAL;
  531. EXPIRY_INSERT(EXPIRIES, &ft->expiries, flow->expiry);
  532. ft->num_flows++;
  533. if (verbose_flag)
  534. logit(LOG_DEBUG, "ADD FLOW %s",
  535. format_flow_brief(flow));
  536. } else {
  537. /* Update flow statistics */
  538. flow->packets[0] += tmp.packets[0];
  539. flow->octets[0] += tmp.octets[0];
  540. flow->tcp_flags[0] |= tmp.tcp_flags[0];
  541. flow->packets[1] += tmp.packets[1];
  542. flow->octets[1] += tmp.octets[1];
  543. flow->tcp_flags[1] |= tmp.tcp_flags[1];
  544. }
  545. memcpy(&flow->flow_last, received_time, sizeof(flow->flow_last));
  546. if (flow->expiry->expires_at != 0)
  547. flow_update_expiry(ft, flow);
  548. return (PP_OK);
  549. }
  550. /*
  551. * Subtract two timevals. Returns (t1 - t2) in milliseconds.
  552. */
  553. u_int32_t
  554. timeval_sub_ms(const struct timeval *t1, const struct timeval *t2)
  555. {
  556. struct timeval res;
  557. res.tv_sec = t1->tv_sec - t2->tv_sec;
  558. res.tv_usec = t1->tv_usec - t2->tv_usec;
  559. if (res.tv_usec < 0) {
  560. res.tv_usec += 1000000L;
  561. res.tv_sec--;
  562. }
  563. return ((u_int32_t)res.tv_sec * 1000 + (u_int32_t)res.tv_usec / 1000);
  564. }
  565. static void
  566. update_statistic(struct STATISTIC *s, double new, double n)
  567. {
  568. if (n == 1.0) {
  569. s->min = s->mean = s->max = new;
  570. return;
  571. }
  572. s->min = MIN(s->min, new);
  573. s->max = MAX(s->max, new);
  574. s->mean = s->mean + ((new - s->mean) / n);
  575. }
  576. /* Update global statistics */
  577. static void
  578. update_statistics(struct FLOWTRACK *ft, struct FLOW *flow)
  579. {
  580. double tmp;
  581. static double n = 1.0;
  582. ft->flows_expired++;
  583. ft->flows_pp[flow->protocol % 256]++;
  584. tmp = (double)flow->flow_last.tv_sec +
  585. ((double)flow->flow_last.tv_usec / 1000000.0);
  586. tmp -= (double)flow->flow_start.tv_sec +
  587. ((double)flow->flow_start.tv_usec / 1000000.0);
  588. if (tmp < 0.0)
  589. tmp = 0.0;
  590. update_statistic(&ft->duration, tmp, n);
  591. update_statistic(&ft->duration_pp[flow->protocol], tmp,
  592. (double)ft->flows_pp[flow->protocol % 256]);
  593. tmp = flow->octets[0] + flow->octets[1];
  594. update_statistic(&ft->octets, tmp, n);
  595. ft->octets_pp[flow->protocol % 256] += tmp;
  596. tmp = flow->packets[0] + flow->packets[1];
  597. update_statistic(&ft->packets, tmp, n);
  598. ft->packets_pp[flow->protocol % 256] += tmp;
  599. n++;
  600. }
  601. static void
  602. update_expiry_stats(struct FLOWTRACK *ft, struct EXPIRY *e)
  603. {
  604. switch (e->reason) {
  605. case R_GENERAL:
  606. ft->expired_general++;
  607. break;
  608. case R_TCP:
  609. ft->expired_tcp++;
  610. break;
  611. case R_TCP_RST:
  612. ft->expired_tcp_rst++;
  613. break;
  614. case R_TCP_FIN:
  615. ft->expired_tcp_fin++;
  616. break;
  617. case R_UDP:
  618. ft->expired_udp++;
  619. break;
  620. case R_ICMP:
  621. ft->expired_icmp++;
  622. break;
  623. case R_MAXLIFE:
  624. ft->expired_maxlife++;
  625. break;
  626. case R_OVERBYTES:
  627. ft->expired_overbytes++;
  628. break;
  629. case R_OVERFLOWS:
  630. ft->expired_maxflows++;
  631. break;
  632. case R_FLUSH:
  633. ft->expired_flush++;
  634. break;
  635. }
  636. }
  637. /* How long before the next expiry event in millisecond */
  638. static int
  639. next_expire(struct FLOWTRACK *ft)
  640. {
  641. struct EXPIRY *expiry;
  642. struct timeval now;
  643. u_int32_t expires_at, ret, fudge;
  644. gettimeofday(&now, NULL);
  645. if ((expiry = EXPIRY_MIN(EXPIRIES, &ft->expiries)) == NULL)
  646. return (-1); /* indefinite */
  647. expires_at = expiry->expires_at;
  648. /* Don't cluster urgent expiries */
  649. if (expires_at == 0 && (expiry->reason == R_OVERBYTES ||
  650. expiry->reason == R_OVERFLOWS || expiry->reason == R_FLUSH))
  651. return (0); /* Now */
  652. /* Cluster expiries by expiry_interval */
  653. if (ft->expiry_interval > 1) {
  654. if ((fudge = expires_at % ft->expiry_interval) > 0)
  655. expires_at += ft->expiry_interval - fudge;
  656. }
  657. if (expires_at < now.tv_sec)
  658. return (0); /* Now */
  659. ret = 999 + (expires_at - now.tv_sec) * 1000;
  660. return (ret);
  661. }
  662. /*
  663. * Scan the tree of expiry events and process expired flows. If zap_all
  664. * is set, then forcibly expire all flows.
  665. */
  666. #define CE_EXPIRE_NORMAL 0 /* Normal expiry processing */
  667. #define CE_EXPIRE_ALL -1 /* Expire all flows immediately */
  668. #define CE_EXPIRE_FORCED 1 /* Only expire force-expired flows */
  669. static int
  670. check_expired(struct FLOWTRACK *ft, struct NETFLOW_TARGET *target, int ex)
  671. {
  672. struct FLOW **expired_flows, **oldexp;
  673. int num_expired, i, r;
  674. struct timeval now;
  675. struct EXPIRY *expiry, *nexpiry;
  676. gettimeofday(&now, NULL);
  677. r = 0;
  678. num_expired = 0;
  679. expired_flows = NULL;
  680. if (verbose_flag)
  681. logit(LOG_DEBUG, "Starting expiry scan: mode %d", ex);
  682. for(expiry = EXPIRY_MIN(EXPIRIES, &ft->expiries);
  683. expiry != NULL;
  684. expiry = nexpiry) {
  685. nexpiry = EXPIRY_NEXT(EXPIRIES, &ft->expiries, expiry);
  686. if ((expiry->expires_at == 0) || (ex == CE_EXPIRE_ALL) ||
  687. (ex != CE_EXPIRE_FORCED &&
  688. (expiry->expires_at < now.tv_sec))) {
  689. /* Flow has expired */
  690. if (ft->maximum_lifetime != 0 &&
  691. expiry->flow->flow_last.tv_sec -
  692. expiry->flow->flow_start.tv_sec >=
  693. ft->maximum_lifetime)
  694. expiry->reason = R_MAXLIFE;
  695. if (verbose_flag)
  696. logit(LOG_DEBUG,
  697. "Queuing flow seq:%llu (%p) for expiry "
  698. "reason %d", expiry->flow->flow_seq,
  699. expiry->flow, expiry->reason);
  700. /* Add to array of expired flows */
  701. oldexp = expired_flows;
  702. expired_flows = realloc(expired_flows,
  703. sizeof(*expired_flows) * (num_expired + 1));
  704. /* Don't fatal on realloc failures */
  705. if (expired_flows == NULL)
  706. expired_flows = oldexp;
  707. else {
  708. expired_flows[num_expired] = expiry->flow;
  709. num_expired++;
  710. }
  711. if (ex == CE_EXPIRE_ALL)
  712. expiry->reason = R_FLUSH;
  713. update_expiry_stats(ft, expiry);
  714. /* Remove from flow tree, destroy expiry event */
  715. FLOW_REMOVE(FLOWS, &ft->flows, expiry->flow);
  716. EXPIRY_REMOVE(EXPIRIES, &ft->expiries, expiry);
  717. expiry->flow->expiry = NULL;
  718. expiry_put(ft, expiry);
  719. ft->num_flows--;
  720. }
  721. }
  722. if (verbose_flag)
  723. logit(LOG_DEBUG, "Finished scan %d flow(s) to be evicted",
  724. num_expired);
  725. /* Processing for expired flows */
  726. if (num_expired > 0) {
  727. if (target != NULL && target->fd != -1) {
  728. r = target->dialect->func(expired_flows, num_expired,
  729. target->fd, if_index, &ft->flows_exported,
  730. &ft->system_boot_time, verbose_flag);
  731. if (verbose_flag)
  732. logit(LOG_DEBUG, "sent %d netflow packets", r);
  733. if (r > 0) {
  734. ft->packets_sent += r;
  735. /* XXX what if r < num_expired * 2 ? */
  736. } else {
  737. ft->flows_dropped += num_expired * 2;
  738. }
  739. }
  740. for (i = 0; i < num_expired; i++) {
  741. if (verbose_flag) {
  742. logit(LOG_DEBUG, "EXPIRED: %s (%p)",
  743. format_flow(expired_flows[i]),
  744. expired_flows[i]);
  745. }
  746. update_statistics(ft, expired_flows[i]);
  747. flow_put(ft, expired_flows[i]);
  748. }
  749. free(expired_flows);
  750. }
  751. return (r == -1 ? -1 : num_expired);
  752. }
  753. /*
  754. * Force expiry of num_to_expire flows (e.g. when flow table overfull)
  755. */
  756. static void
  757. force_expire(struct FLOWTRACK *ft, u_int32_t num_to_expire)
  758. {
  759. struct EXPIRY *expiry, **expiryv;
  760. int i;
  761. /* XXX move all overflow processing here (maybe) */
  762. if (verbose_flag)
  763. logit(LOG_INFO, "Forcing expiry of %d flows",
  764. num_to_expire);
  765. /*
  766. * Do this in two steps, as it is dangerous to change a key on
  767. * a tree entry without first removing it and then re-adding it.
  768. * It is even worse when this has to be done during a FOREACH :)
  769. * To get around this, we make a list of expired flows and _then_
  770. * alter them
  771. */
  772. if ((expiryv = calloc(num_to_expire, sizeof(*expiryv))) == NULL) {
  773. /*
  774. * On malloc failure, expire ALL flows. I assume that
  775. * setting all the keys in a tree to the same value is
  776. * safe.
  777. */
  778. logit(LOG_ERR, "Out of memory while expiring flows - "
  779. "all flows expired");
  780. EXPIRY_FOREACH(expiry, EXPIRIES, &ft->expiries) {
  781. expiry->expires_at = 0;
  782. expiry->reason = R_OVERFLOWS;
  783. ft->flows_force_expired++;
  784. }
  785. return;
  786. }
  787. /* Make the list of flows to expire */
  788. i = 0;
  789. EXPIRY_FOREACH(expiry, EXPIRIES, &ft->expiries) {
  790. if (i >= num_to_expire)
  791. break;
  792. expiryv[i++] = expiry;
  793. }
  794. if (i < num_to_expire) {
  795. logit(LOG_ERR, "Needed to expire %d flows, "
  796. "but only %d active", num_to_expire, i);
  797. num_to_expire = i;
  798. }
  799. for(i = 0; i < num_to_expire; i++) {
  800. EXPIRY_REMOVE(EXPIRIES, &ft->expiries, expiryv[i]);
  801. expiryv[i]->expires_at = 0;
  802. expiryv[i]->reason = R_OVERFLOWS;
  803. EXPIRY_INSERT(EXPIRIES, &ft->expiries, expiryv[i]);
  804. }
  805. ft->flows_force_expired += num_to_expire;
  806. free(expiryv);
  807. /* XXX - this is overcomplicated, perhaps use a separate queue */
  808. }
  809. /* Delete all flows that we know about without processing */
  810. static int
  811. delete_all_flows(struct FLOWTRACK *ft)
  812. {
  813. struct FLOW *flow, *nflow;
  814. int i;
  815. i = 0;
  816. for(flow = FLOW_MIN(FLOWS, &ft->flows); flow != NULL; flow = nflow) {
  817. nflow = FLOW_NEXT(FLOWS, &ft->flows, flow);
  818. FLOW_REMOVE(FLOWS, &ft->flows, flow);
  819. EXPIRY_REMOVE(EXPIRIES, &ft->expiries, flow->expiry);
  820. expiry_put(ft, flow->expiry);
  821. ft->num_flows--;
  822. flow_put(ft, flow);
  823. i++;
  824. }
  825. return (i);
  826. }
  827. /*
  828. * Log our current status.
  829. * Includes summary counters and (in verbose mode) the list of current flows
  830. * and the tree of expiry events.
  831. */
  832. static int
  833. statistics(struct FLOWTRACK *ft, FILE *out, pcap_t *pcap)
  834. {
  835. int i;
  836. struct protoent *pe;
  837. char proto[32];
  838. struct pcap_stat ps;
  839. fprintf(out, "Number of active flows: %d\n", ft->num_flows);
  840. fprintf(out, "Packets processed: %llu\n", ft->total_packets);
  841. fprintf(out, "Fragments: %llu\n", ft->frag_packets);
  842. fprintf(out, "Ignored packets: %llu (%llu non-IP, %llu too short)\n",
  843. ft->non_ip_packets + ft->bad_packets, ft->non_ip_packets, ft->bad_packets);
  844. fprintf(out, "Flows expired: %llu (%llu forced)\n",
  845. ft->flows_expired, ft->flows_force_expired);
  846. fprintf(out, "Flows exported: %llu in %llu packets (%llu failures)\n",
  847. ft->flows_exported, ft->packets_sent, ft->flows_dropped);
  848. if (pcap_stats(pcap, &ps) == 0) {
  849. fprintf(out, "Packets received by libpcap: %lu\n",
  850. (unsigned long)ps.ps_recv);
  851. fprintf(out, "Packets dropped by libpcap: %lu\n",
  852. (unsigned long)ps.ps_drop);
  853. fprintf(out, "Packets dropped by interface: %lu\n",
  854. (unsigned long)ps.ps_ifdrop);
  855. }
  856. fprintf(out, "\n");
  857. if (ft->flows_expired != 0) {
  858. fprintf(out, "Expired flow statistics: minimum average maximum\n");
  859. fprintf(out, " Flow bytes: %12.0f %12.0f %12.0f\n",
  860. ft->octets.min, ft->octets.mean, ft->octets.max);
  861. fprintf(out, " Flow packets: %12.0f %12.0f %12.0f\n",
  862. ft->packets.min, ft->packets.mean, ft->packets.max);
  863. fprintf(out, " Duration: %12.2fs %12.2fs %12.2fs\n",
  864. ft->duration.min, ft->duration.mean, ft->duration.max);
  865. fprintf(out, "\n");
  866. fprintf(out, "Expired flow reasons:\n");
  867. fprintf(out, " tcp = %9llu tcp.rst = %9llu "
  868. "tcp.fin = %9llu\n", ft->expired_tcp, ft->expired_tcp_rst,
  869. ft->expired_tcp_fin);
  870. fprintf(out, " udp = %9llu icmp = %9llu "
  871. "general = %9llu\n", ft->expired_udp, ft->expired_icmp,
  872. ft->expired_general);
  873. fprintf(out, " maxlife = %9llu\n", ft->expired_maxlife);
  874. fprintf(out, "over 2 GiB = %9llu\n", ft->expired_overbytes);
  875. fprintf(out, " maxflows = %9llu\n", ft->expired_maxflows);
  876. fprintf(out, " flushed = %9llu\n", ft->expired_flush);
  877. fprintf(out, "\n");
  878. fprintf(out, "Per-protocol statistics: Octets "
  879. "Packets Avg Life Max Life\n");
  880. for(i = 0; i < 256; i++) {
  881. if (ft->packets_pp[i]) {
  882. pe = getprotobynumber(i);
  883. snprintf(proto, sizeof(proto), "%s (%d)",
  884. pe != NULL ? pe->p_name : "Unknown", i);
  885. fprintf(out, " %17s: %14llu %12llu %8.2fs "
  886. "%10.2fs\n", proto,
  887. ft->octets_pp[i],
  888. ft->packets_pp[i],
  889. ft->duration_pp[i].mean,
  890. ft->duration_pp[i].max);
  891. }
  892. }
  893. }
  894. return (0);
  895. }
  896. static void
  897. dump_flows(struct FLOWTRACK *ft, FILE *out)
  898. {
  899. struct EXPIRY *expiry;
  900. time_t now;
  901. now = time(NULL);
  902. EXPIRY_FOREACH(expiry, EXPIRIES, &ft->expiries) {
  903. fprintf(out, "ACTIVE %s\n", format_flow(expiry->flow));
  904. if ((long int) expiry->expires_at - now < 0) {
  905. fprintf(out,
  906. "EXPIRY EVENT for flow %llu now%s\n",
  907. expiry->flow->flow_seq,
  908. expiry->expires_at == 0 ? " (FORCED)": "");
  909. } else {
  910. fprintf(out,
  911. "EXPIRY EVENT for flow %llu in %ld seconds\n",
  912. expiry->flow->flow_seq,
  913. (long int) expiry->expires_at - now);
  914. }
  915. fprintf(out, "\n");
  916. }
  917. }
  918. /*
  919. * Figure out how many bytes to skip from front of packet to get past
  920. * datalink headers. If pkt is specified, also check whether determine
  921. * whether or not it is one that we are interested in (IPv4 or IPv6 for now)
  922. *
  923. * Returns number of bytes to skip or -1 to indicate that entire
  924. * packet should be skipped
  925. */
  926. static int
  927. datalink_check(int linktype, const u_int8_t *pkt, u_int32_t caplen, int *af)
  928. {
  929. int i, j;
  930. u_int32_t frametype;
  931. static const struct DATALINK *dl = NULL;
  932. /* Try to cache last used linktype */
  933. if (dl == NULL || dl->dlt != linktype) {
  934. for (i = 0; lt[i].dlt != linktype && lt[i].dlt != -1; i++)
  935. ;
  936. dl = &lt[i];
  937. }
  938. if (dl->dlt == -1 || pkt == NULL)
  939. return (dl->dlt);
  940. if (caplen <= dl->skiplen)
  941. return (-1);
  942. /* Suck out the frametype */
  943. frametype = 0;
  944. if (dl->ft_is_be) {
  945. for (j = 0; j < dl->ft_len; j++) {
  946. frametype <<= 8;
  947. frametype |= pkt[j + dl->ft_off];
  948. }
  949. } else {
  950. for (j = dl->ft_len - 1; j >= 0 ; j--) {
  951. frametype <<= 8;
  952. frametype |= pkt[j + dl->ft_off];
  953. }
  954. }
  955. frametype &= dl->ft_mask;
  956. if (frametype == dl->ft_v4)
  957. *af = AF_INET;
  958. else if (frametype == dl->ft_v6)
  959. *af = AF_INET6;
  960. else
  961. return (-1);
  962. return (dl->skiplen);
  963. }
  964. /*
  965. * Per-packet callback function from libpcap. Pass the packet (if it is IP)
  966. * sans datalink headers to process_packet.
  967. */
  968. static void
  969. flow_cb(u_char *user_data, const struct pcap_pkthdr* phdr,
  970. const u_char *pkt)
  971. {
  972. int s, af;
  973. struct CB_CTXT *cb_ctxt = (struct CB_CTXT *)user_data;
  974. struct timeval tv;
  975. s = datalink_check(cb_ctxt->linktype, pkt, phdr->caplen, &af);
  976. if (s < 0 || (!cb_ctxt->want_v6 && af == AF_INET6)) {
  977. cb_ctxt->ft->non_ip_packets++;
  978. } else {
  979. tv.tv_sec = phdr->ts.tv_sec;
  980. tv.tv_usec = phdr->ts.tv_usec;
  981. if (process_packet(cb_ctxt->ft, pkt + s, af,
  982. phdr->caplen - s, phdr->len - s, &tv) == PP_MALLOC_FAIL)
  983. cb_ctxt->fatal = 1;
  984. }
  985. }
  986. static void
  987. print_timeouts(struct FLOWTRACK *ft, FILE *out)
  988. {
  989. fprintf(out, " TCP timeout: %ds\n", ft->tcp_timeout);
  990. fprintf(out, " TCP post-RST timeout: %ds\n", ft->tcp_rst_timeout);
  991. fprintf(out, " TCP post-FIN timeout: %ds\n", ft->tcp_fin_timeout);
  992. fprintf(out, " UDP timeout: %ds\n", ft->udp_timeout);
  993. fprintf(out, " ICMP timeout: %ds\n", ft->icmp_timeout);
  994. fprintf(out, " General timeout: %ds\n", ft->general_timeout);
  995. fprintf(out, " Maximum lifetime: %ds\n", ft->maximum_lifetime);
  996. fprintf(out, " Expiry interval: %ds\n", ft->expiry_interval);
  997. }
  998. static int
  999. accept_control(int lsock, struct NETFLOW_TARGET *target, struct FLOWTRACK *ft,
  1000. pcap_t *pcap, int *exit_request, int *stop_collection_flag)
  1001. {
  1002. unsigned char buf[64], *p;
  1003. FILE *ctlf;
  1004. int fd, ret;
  1005. if ((fd = accept(lsock, NULL, NULL)) == -1) {
  1006. logit(LOG_ERR, "ctl accept: %s - exiting",
  1007. strerror(errno));
  1008. return(-1);
  1009. }
  1010. if ((ctlf = fdopen(fd, "r+")) == NULL) {
  1011. logit(LOG_ERR, "fdopen: %s - exiting\n",
  1012. strerror(errno));
  1013. close(fd);
  1014. return (-1);
  1015. }
  1016. setlinebuf(ctlf);
  1017. if (fgets(buf, sizeof(buf), ctlf) == NULL) {
  1018. logit(LOG_ERR, "Control socket yielded no data");
  1019. return (0);
  1020. }
  1021. if ((p = strchr(buf, '\n')) != NULL)
  1022. *p = '\0';
  1023. if (verbose_flag)
  1024. logit(LOG_DEBUG, "Control socket \"%s\"", buf);
  1025. /* XXX - use dispatch table */
  1026. ret = -1;
  1027. if (strcmp(buf, "help") == 0) {
  1028. fprintf(ctlf, "Valid control words are:\n");
  1029. fprintf(ctlf, "\tdebug+ debug- delete-all dump-flows exit "
  1030. "expire-all\n");
  1031. fprintf(ctlf, "\tshutdown start-gather statistics stop-gather "
  1032. "timeouts\n");
  1033. fprintf(ctlf, "\tsend-template\n");
  1034. ret = 0;
  1035. } else if (strcmp(buf, "shutdown") == 0) {
  1036. fprintf(ctlf, "softflowd[%u]: Shutting down gracefully...\n",
  1037. getpid());
  1038. graceful_shutdown_request = 1;
  1039. ret = 1;
  1040. } else if (strcmp(buf, "exit") == 0) {
  1041. fprintf(ctlf, "softflowd[%u]: Exiting now...\n", getpid());
  1042. *exit_request = 1;
  1043. ret = 1;
  1044. } else if (strcmp(buf, "expire-all") == 0) {
  1045. netflow9_resend_template();
  1046. fprintf(ctlf, "softflowd[%u]: Expired %d flows.\n", getpid(),
  1047. check_expired(ft, target, CE_EXPIRE_ALL));
  1048. ret = 0;
  1049. } else if (strcmp(buf, "send-template") == 0) {
  1050. netflow9_resend_template();
  1051. fprintf(ctlf, "softflowd[%u]: Template will be sent at "
  1052. "next flow export\n", getpid());
  1053. ret = 0;
  1054. } else if (strcmp(buf, "delete-all") == 0) {
  1055. fprintf(ctlf, "softflowd[%u]: Deleted %d flows.\n", getpid(),
  1056. delete_all_flows(ft));
  1057. ret = 0;
  1058. } else if (strcmp(buf, "statistics") == 0) {
  1059. fprintf(ctlf, "softflowd[%u]: Accumulated statistics "
  1060. "since %s UTC:\n", getpid(),
  1061. format_time(ft->system_boot_time.tv_sec));
  1062. statistics(ft, ctlf, pcap);
  1063. ret = 0;
  1064. } else if (strcmp(buf, "debug+") == 0) {
  1065. fprintf(ctlf, "softflowd[%u]: Debug level increased.\n",
  1066. getpid());
  1067. verbose_flag = 1;
  1068. ret = 0;
  1069. } else if (strcmp(buf, "debug-") == 0) {
  1070. fprintf(ctlf, "softflowd[%u]: Debug level decreased.\n",
  1071. getpid());
  1072. verbose_flag = 0;
  1073. ret = 0;
  1074. } else if (strcmp(buf, "stop-gather") == 0) {
  1075. fprintf(ctlf, "softflowd[%u]: Data collection stopped.\n",
  1076. getpid());
  1077. *stop_collection_flag = 1;
  1078. ret = 0;
  1079. } else if (strcmp(buf, "start-gather") == 0) {
  1080. fprintf(ctlf, "softflowd[%u]: Data collection resumed.\n",
  1081. getpid());
  1082. *stop_collection_flag = 0;
  1083. ret = 0;
  1084. } else if (strcmp(buf, "dump-flows") == 0) {
  1085. fprintf(ctlf, "softflowd[%u]: Dumping flow data:\n",
  1086. getpid());
  1087. dump_flows(ft, ctlf);
  1088. ret = 0;
  1089. } else if (strcmp(buf, "timeouts") == 0) {
  1090. fprintf(ctlf, "softflowd[%u]: Printing timeouts:\n",
  1091. getpid());
  1092. print_timeouts(ft, ctlf);
  1093. ret = 0;
  1094. } else {
  1095. fprintf(ctlf, "Unknown control commmand \"%s\"\n", buf);
  1096. ret = 0;
  1097. }
  1098. fclose(ctlf);
  1099. close(fd);
  1100. return (ret);
  1101. }
  1102. static int
  1103. connsock(struct sockaddr_storage *addr, socklen_t len, int hoplimit)
  1104. {
  1105. int s;
  1106. unsigned int h6;
  1107. unsigned char h4;
  1108. struct sockaddr_in *in4 = (struct sockaddr_in *)addr;
  1109. struct sockaddr_in6 *in6 = (struct sockaddr_in6 *)addr;
  1110. if ((s = socket(addr->ss_family, SOCK_DGRAM, 0)) == -1) {
  1111. fprintf(stderr, "socket() error: %s\n",
  1112. strerror(errno));
  1113. exit(1);
  1114. }
  1115. if (connect(s, (struct sockaddr*)addr, len) == -1) {
  1116. fprintf(stderr, "connect() error: %s\n",
  1117. strerror(errno));
  1118. exit(1);
  1119. }
  1120. switch (addr->ss_family) {
  1121. case AF_INET:
  1122. /* Default to link-local TTL for multicast addresses */
  1123. if (hoplimit == -1 && IN_MULTICAST(in4->sin_addr.s_addr))
  1124. hoplimit = 1;
  1125. if (hoplimit == -1)
  1126. break;
  1127. h4 = hoplimit;
  1128. if (setsockopt(s, IPPROTO_IP, IP_MULTICAST_TTL,
  1129. &h4, sizeof(h4)) == -1) {
  1130. fprintf(stderr, "setsockopt(IP_MULTICAST_TTL, "
  1131. "%u): %s\n", h4, strerror(errno));
  1132. exit(1);
  1133. }
  1134. break;
  1135. case AF_INET6:
  1136. /* Default to link-local hoplimit for multicast addresses */
  1137. if (hoplimit == -1 && IN6_IS_ADDR_MULTICAST(&in6->sin6_addr))
  1138. hoplimit = 1;
  1139. if (hoplimit == -1)
  1140. break;
  1141. h6 = hoplimit;
  1142. if (setsockopt(s, IPPROTO_IPV6, IPV6_MULTICAST_HOPS,
  1143. &h6, sizeof(h6)) == -1) {
  1144. fprintf(stderr, "setsockopt(IPV6_MULTICAST_HOPS, %u): "
  1145. "%s\n", h6, strerror(errno));
  1146. exit(1);
  1147. }
  1148. }
  1149. return(s);
  1150. }
  1151. static int
  1152. unix_listener(const char *path)
  1153. {
  1154. struct sockaddr_un addr;
  1155. socklen_t addrlen;
  1156. int s;
  1157. memset(&addr, '\0', sizeof(addr));
  1158. addr.sun_family = AF_UNIX;
  1159. if (strlcpy(addr.sun_path, path, sizeof(addr.sun_path)) >=
  1160. sizeof(addr.sun_path)) {
  1161. fprintf(stderr, "control socket path too long\n");
  1162. exit(1);
  1163. }
  1164. addr.sun_path[sizeof(addr.sun_path) - 1] = '\0';
  1165. addrlen = offsetof(struct sockaddr_un, sun_path) + strlen(path) + 1;
  1166. #ifdef SOCK_HAS_LEN
  1167. addr.sun_len = addrlen;
  1168. #endif
  1169. if ((s = socket(PF_UNIX, SOCK_STREAM, 0)) < 0) {
  1170. fprintf(stderr, "unix domain socket() error: %s\n",
  1171. strerror(errno));
  1172. exit(1);
  1173. }
  1174. unlink(path);
  1175. if (bind(s, (struct sockaddr*)&addr, addrlen) == -1) {
  1176. fprintf(stderr, "unix domain bind(\"%s\") error: %s\n",
  1177. addr.sun_path, strerror(errno));
  1178. exit(1);
  1179. }
  1180. if (listen(s, 64) == -1) {
  1181. fprintf(stderr, "unix domain listen() error: %s\n",
  1182. strerror(errno));
  1183. exit(1);
  1184. }
  1185. return (s);
  1186. }
  1187. static void
  1188. setup_packet_capture(struct pcap **pcap, int *linktype,
  1189. char *dev, char *capfile, char *bpf_prog, int need_v6)
  1190. {
  1191. char ebuf[PCAP_ERRBUF_SIZE];
  1192. struct bpf_program prog_c;
  1193. u_int32_t bpf_mask, bpf_net;
  1194. /* Open pcap */
  1195. if (dev != NULL) {
  1196. if ((*pcap = pcap_open_live(dev,
  1197. need_v6 ? LIBPCAP_SNAPLEN_V6 : LIBPCAP_SNAPLEN_V4,
  1198. 1, 0, ebuf)) == NULL) {
  1199. fprintf(stderr, "pcap_open_live: %s\n", ebuf);
  1200. exit(1);
  1201. }
  1202. if (pcap_lookupnet(dev, &bpf_net, &bpf_mask, ebuf) == -1)
  1203. bpf_net = bpf_mask = 0;
  1204. } else {
  1205. if ((*pcap = pcap_open_offline(capfile, ebuf)) == NULL) {
  1206. fprintf(stderr, "pcap_open_offline(%s): %s\n",
  1207. capfile, ebuf);
  1208. exit(1);
  1209. }
  1210. bpf_net = bpf_mask = 0;
  1211. }
  1212. *linktype = pcap_datalink(*pcap);
  1213. if (datalink_check(*linktype, NULL, 0, NULL) == -1) {
  1214. fprintf(stderr, "Unsupported datalink type %d\n", *linktype);
  1215. exit(1);
  1216. }
  1217. /* Attach BPF filter, if specified */
  1218. if (bpf_prog != NULL) {
  1219. if (pcap_compile(*pcap, &prog_c, bpf_prog, 1, bpf_mask) == -1) {
  1220. fprintf(stderr, "pcap_compile(\"%s\"): %s\n",
  1221. bpf_prog, pcap_geterr(*pcap));
  1222. exit(1);
  1223. }
  1224. if (pcap_setfilter(*pcap, &prog_c) == -1) {
  1225. fprintf(stderr, "pcap_setfilter: %s\n",
  1226. pcap_geterr(*pcap));
  1227. exit(1);
  1228. }
  1229. }
  1230. #ifdef BIOCLOCK
  1231. /*
  1232. * If we are reading from an device (not a file), then
  1233. * lock the underlying BPF device to prevent changes in the
  1234. * unprivileged child
  1235. */
  1236. if (dev != NULL && ioctl(pcap_fileno(*pcap), BIOCLOCK) < 0) {
  1237. fprintf(stderr, "ioctl(BIOCLOCK) failed: %s\n",
  1238. strerror(errno));
  1239. exit(1);
  1240. }
  1241. #endif
  1242. }
  1243. static void
  1244. init_flowtrack(struct FLOWTRACK *ft)
  1245. {
  1246. /* Set up flow-tracking structure */
  1247. memset(ft, '\0', sizeof(*ft));
  1248. ft->next_flow_seq = 1;
  1249. FLOW_INIT(&ft->flows);
  1250. EXPIRY_INIT(&ft->expiries);
  1251. freelist_init(&ft->flow_freelist, sizeof(struct FLOW));
  1252. freelist_init(&ft->expiry_freelist, sizeof(struct EXPIRY));
  1253. ft->max_flows = DEFAULT_MAX_FLOWS;
  1254. ft->track_level = TRACK_FULL;
  1255. ft->tcp_timeout = DEFAULT_TCP_TIMEOUT;
  1256. ft->tcp_rst_timeout = DEFAULT_TCP_RST_TIMEOUT;
  1257. ft->tcp_fin_timeout = DEFAULT_TCP_FIN_TIMEOUT;
  1258. ft->udp_timeout = DEFAULT_UDP_TIMEOUT;
  1259. ft->icmp_timeout = DEFAULT_ICMP_TIMEOUT;
  1260. ft->general_timeout = DEFAULT_GENERAL_TIMEOUT;
  1261. ft->maximum_lifetime = DEFAULT_MAXIMUM_LIFETIME;
  1262. ft->expiry_interval = DEFAULT_EXPIRY_INTERVAL;
  1263. }
  1264. static char *
  1265. argv_join(int argc, char **argv)
  1266. {
  1267. int i;
  1268. size_t ret_len;
  1269. char *ret;
  1270. ret_len = 0;
  1271. ret = NULL;
  1272. for (i = 0; i < argc; i++) {
  1273. ret_len += strlen(argv[i]);
  1274. if ((ret = realloc(ret, ret_len + 2)) == NULL) {
  1275. fprintf(stderr, "Memory allocation failed.\n");
  1276. exit(1);
  1277. }
  1278. if (i == 0)
  1279. ret[0] = '\0';
  1280. else {
  1281. ret_len++; /* Make room for ' ' */
  1282. strlcat(ret, " ", ret_len + 1);
  1283. }
  1284. strlcat(ret, argv[i], ret_len + 1);
  1285. }
  1286. return (ret);
  1287. }
  1288. /* Display commandline usage information */
  1289. static void
  1290. usage(void)
  1291. {
  1292. fprintf(stderr,
  1293. "Usage: %s [options] [bpf_program]\n"
  1294. "This is %s version %s. Valid commandline options:\n"
  1295. " -i [idx:]interface Specify interface to listen on\n"
  1296. " -r pcap_file Specify packet capture file to read\n"
  1297. " -t timeout=time Specify named timeout\n"
  1298. " -m max_flows Specify maximum number of flows to track (default %d)\n"
  1299. " -n host:port Send Cisco NetFlow(tm)-compatible packets to host:port\n"
  1300. " -p pidfile Record pid in specified file\n"
  1301. " (default: %s)\n"
  1302. " -c pidfile Location of control socket\n"
  1303. " (default: %s)\n"
  1304. " -v 1|5|9 NetFlow export packet version\n"
  1305. " -L hoplimit Set TTL/hoplimit for export datagrams\n"
  1306. " -T full|proto|ip Set flow tracking level (default: full)\n"
  1307. " -6 Track IPv6 flows, regardless of whether selected \n"
  1308. " NetFlow export protocol supports it\n"
  1309. " -d Don't daemonise (run in foreground)\n"
  1310. " -D Debug mode: foreground + verbosity + track v6 flows\n"
  1311. " -h Display this help\n"
  1312. "\n"
  1313. "Valid timeout names and default values:\n"
  1314. " tcp (default %6d)"
  1315. " tcp.rst (default %6d)"
  1316. " tcp.fin (default %6d)\n"
  1317. " udp (default %6d)"
  1318. " icmp (default %6d)"
  1319. " general (default %6d)\n"
  1320. " maxlife (default %6d)"
  1321. " expint (default %6d)\n"
  1322. "\n" ,
  1323. PROGNAME, PROGNAME, PROGVER, DEFAULT_MAX_FLOWS, DEFAULT_PIDFILE,
  1324. DEFAULT_CTLSOCK, DEFAULT_TCP_TIMEOUT, DEFAULT_TCP_RST_TIMEOUT,
  1325. DEFAULT_TCP_FIN_TIMEOUT, DEFAULT_UDP_TIMEOUT, DEFAULT_ICMP_TIMEOUT,
  1326. DEFAULT_GENERAL_TIMEOUT, DEFAULT_MAXIMUM_LIFETIME,
  1327. DEFAULT_EXPIRY_INTERVAL);
  1328. }
  1329. static void
  1330. set_timeout(struct FLOWTRACK *ft, const char *to_spec)
  1331. {
  1332. char *name, *value;
  1333. int timeout;
  1334. if ((name = strdup(to_spec)) == NULL) {
  1335. fprintf(stderr, "Out of memory\n");
  1336. exit(1);
  1337. }
  1338. if ((value = strchr(name, '=')) == NULL ||
  1339. *(++value) == '\0') {
  1340. fprintf(stderr, "Invalid -t option \"%s\".\n", name);
  1341. usage();
  1342. exit(1);
  1343. }
  1344. *(value - 1) = '\0';
  1345. timeout = convtime(value);
  1346. if (timeout < 0) {
  1347. fprintf(stderr, "Invalid -t timeout.\n");
  1348. usage();
  1349. exit(1);
  1350. }
  1351. if (strcmp(name, "tcp") == 0)
  1352. ft->tcp_timeout = timeout;
  1353. else if (strcmp(name, "tcp.rst") == 0)
  1354. ft->tcp_rst_timeout = timeout;
  1355. else if (strcmp(name, "tcp.fin") == 0)
  1356. ft->tcp_fin_timeout = timeout;
  1357. else if (strcmp(name, "udp") == 0)
  1358. ft->udp_timeout = timeout;
  1359. else if (strcmp(name, "icmp") == 0)
  1360. ft->icmp_timeout = timeout;
  1361. else if (strcmp(name, "general") == 0)
  1362. ft->general_timeout = timeout;
  1363. else if (strcmp(name, "maxlife") == 0)
  1364. ft->maximum_lifetime = timeout;
  1365. else if (strcmp(name, "expint") == 0)
  1366. ft->expiry_interval = timeout;
  1367. else {
  1368. fprintf(stderr, "Invalid -t name.\n");
  1369. usage();
  1370. exit(1);
  1371. }
  1372. if (ft->general_timeout == 0) {
  1373. fprintf(stderr, "\"general\" flow timeout must be "
  1374. "greater than zero\n");
  1375. exit(1);
  1376. }
  1377. free(name);
  1378. }
  1379. static void
  1380. parse_hostport(const char *s, struct sockaddr *addr, socklen_t *len)
  1381. {
  1382. char *orig, *host, *port;
  1383. struct addrinfo hints, *res;
  1384. int herr;
  1385. if ((host = orig = strdup(s)) == NULL) {
  1386. fprintf(stderr, "Out of memory\n");
  1387. exit(1);
  1388. }
  1389. if ((port = strrchr(host, ':')) == NULL ||
  1390. *(++port) == '\0' || *host == '\0') {
  1391. fprintf(stderr, "Invalid -n argument.\n");
  1392. usage();
  1393. exit(1);
  1394. }
  1395. *(port - 1) = '\0';
  1396. /* Accept [host]:port for numeric IPv6 addresses */
  1397. if (*host == '[' && *(port - 2) == ']') {
  1398. host++;
  1399. *(port - 2) = '\0';
  1400. }
  1401. memset(&hints, '\0', sizeof(hints));
  1402. hints.ai_socktype = SOCK_DGRAM;
  1403. if ((herr = getaddrinfo(host, port, &hints, &res)) == -1) {
  1404. fprintf(stderr, "Address lookup failed: %s\n",
  1405. gai_strerror(herr));
  1406. exit(1);
  1407. }
  1408. if (res == NULL || res->ai_addr == NULL) {
  1409. fprintf(stderr, "No addresses found for [%s]:%s\n", host, port);
  1410. exit(1);
  1411. }
  1412. if (res->ai_addrlen > *len) {
  1413. fprintf(stderr, "Address too long\n");
  1414. exit(1);
  1415. }
  1416. memcpy(addr, res->ai_addr, res->ai_addrlen);
  1417. free(orig);
  1418. *len = res->ai_addrlen;
  1419. }
  1420. /*
  1421. * Drop privileges and chroot, will exit on failure
  1422. */
  1423. static void
  1424. drop_privs(void)
  1425. {
  1426. struct passwd *pw;
  1427. if ((pw = getpwnam(PRIVDROP_USER)) == NULL) {
  1428. logit(LOG_ERR, "Unable to find unprivileged user \"%s\"",
  1429. PRIVDROP_USER);
  1430. exit(1);
  1431. }
  1432. if (chdir(PRIVDROP_CHROOT_DIR) != 0) {
  1433. logit(LOG_ERR, "Unable to chdir to chroot directory \"%s\": %s",
  1434. PRIVDROP_CHROOT_DIR, strerror(errno));
  1435. exit(1);
  1436. }
  1437. if (chroot(PRIVDROP_CHROOT_DIR) != 0) {
  1438. logit(LOG_ERR, "Unable to chroot to directory \"%s\": %s",
  1439. PRIVDROP_CHROOT_DIR, strerror(errno));
  1440. exit(1);
  1441. }
  1442. if (chdir("/") != 0) {
  1443. logit(LOG_ERR, "Unable to chdir to chroot root: %s",
  1444. strerror(errno));
  1445. exit(1);
  1446. }
  1447. if (setgroups(1, &pw->pw_gid) != 0) {
  1448. logit(LOG_ERR, "Couldn't setgroups (%u): %s",
  1449. (unsigned int)pw->pw_gid, strerror(errno));
  1450. exit(1);
  1451. }
  1452. #if defined(HAVE_SETRESGID)
  1453. if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) == -1) {
  1454. #elif defined(HAVE_SETREGID)
  1455. if (setregid(pw->pw_gid, pw->pw_gid) == -1) {
  1456. #else
  1457. if (setegid(pw->pw_gid) == -1 || setgid(pw->pw_gid) == -1) {
  1458. #endif
  1459. logit(LOG_ERR, "Couldn't set gid (%u): %s",
  1460. (unsigned int)pw->pw_gid, strerror(errno));
  1461. exit(1);
  1462. }
  1463. #if defined(HAVE_SETRESUID)
  1464. if (setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) == -1) {
  1465. #elif defined(HAVE_SETREUID)
  1466. if (setreuid(pw->pw_uid, pw->pw_uid) == -1) {
  1467. #else
  1468. if (seteuid(pw->pw_uid) == -1 || setuid(pw->pw_uid) == -1) {
  1469. #endif
  1470. logit(LOG_ERR, "Couldn't set uid (%u): %s",
  1471. (unsigned int)pw->pw_uid, strerror(errno));
  1472. exit(1);
  1473. }
  1474. }
  1475. int
  1476. main(int argc, char **argv)
  1477. {
  1478. char *dev, *capfile, *bpf_prog, dest_addr[256], dest_serv[256];
  1479. const char *pidfile_path, *ctlsock_path;
  1480. extern char *optarg;
  1481. extern int optind;
  1482. int ch, dontfork_flag, linktype, ctlsock, i, err, always_v6, r;
  1483. int stop_collection_flag, exit_request, hoplimit;
  1484. pcap_t *pcap = NULL;
  1485. struct sockaddr_storage dest;
  1486. struct FLOWTRACK flowtrack;
  1487. socklen_t dest_len;
  1488. struct NETFLOW_TARGET target;
  1489. struct CB_CTXT cb_ctxt;
  1490. struct pollfd pl[2];
  1491. closefrom(STDERR_FILENO + 1);
  1492. init_flowtrack(&flowtrack);
  1493. memset(&dest, '\0', sizeof(dest));
  1494. dest_len = 0;
  1495. memset(&target, '\0', sizeof(target));
  1496. target.fd = -1;
  1497. target.dialect = &nf[0];
  1498. hoplimit = -1;
  1499. bpf_prog = NULL;
  1500. ctlsock = -1;
  1501. dev = capfile = NULL;
  1502. pidfile_path = DEFAULT_PIDFILE;
  1503. ctlsock_path = DEFAULT_CTLSOCK;
  1504. dontfork_flag = 0;
  1505. always_v6 = 0;
  1506. while ((ch = getopt(argc, argv, "6hdDL:T:i:r:f:t:n:m:p:c:v:")) != -1) {
  1507. switch (ch) {
  1508. case '6':
  1509. always_v6 = 1;
  1510. break;
  1511. case 'h':
  1512. usage();
  1513. return (0);
  1514. case 'D':
  1515. verbose_flag = 1;
  1516. always_v6 = 1;
  1517. /* FALLTHROUGH */
  1518. case 'd':
  1519. dontfork_flag = 1;
  1520. break;
  1521. case 'i':
  1522. if (capfile != NULL || dev != NULL) {
  1523. fprintf(stderr, "Packet source already "
  1524. "specified.\n\n");
  1525. usage();
  1526. exit(1);
  1527. }
  1528. dev = strsep(&optarg, ":");
  1529. if (optarg != NULL) {
  1530. if_index = (u_int16_t) atoi(dev);
  1531. dev = optarg;
  1532. }
  1533. if (verbose_flag)
  1534. fprintf(stderr, "Using %s (idx: %d)\n", dev, if_index);
  1535. break;
  1536. case 'r':
  1537. if (capfile != NULL || dev != NULL) {
  1538. fprintf(stderr, "Packet source already "
  1539. "specified.\n\n");
  1540. usage();
  1541. exit(1);
  1542. }
  1543. capfile = optarg;
  1544. dontfork_flag = 1;
  1545. ctlsock_path = NULL;
  1546. break;
  1547. case 't':
  1548. /* Will exit on failure */
  1549. set_timeout(&flowtrack, optarg);
  1550. break;
  1551. case 'T':
  1552. if (strcasecmp(optarg, "full") == 0)
  1553. flowtrack.track_level = TRACK_FULL;
  1554. else if (strcasecmp(optarg, "proto") == 0)
  1555. flowtrack.track_level = TRACK_IP_PROTO;
  1556. else if (strcasecmp(optarg, "ip") == 0)
  1557. flowtrack.track_level = TRACK_IP_ONLY;
  1558. else {
  1559. fprintf(stderr, "Unknown flow tracking "
  1560. "level\n");
  1561. usage();
  1562. exit(1);
  1563. }
  1564. break;
  1565. case 'L':
  1566. hoplimit = atoi(optarg);
  1567. if (hoplimit < 0 || hoplimit > 255) {
  1568. fprintf(stderr, "Invalid hop limit\n\n");
  1569. usage();
  1570. exit(1);
  1571. }
  1572. break;
  1573. case 'm':
  1574. if ((flowtrack.max_flows = atoi(optarg)) < 0) {
  1575. fprintf(stderr, "Invalid maximum flows\n\n");
  1576. usage();
  1577. exit(1);
  1578. }
  1579. break;
  1580. case 'n':
  1581. /* Will exit on failure */
  1582. dest_len = sizeof(dest);
  1583. parse_hostport(optarg, (struct sockaddr *)&dest,
  1584. &dest_len);
  1585. break;
  1586. case 'p':
  1587. pidfile_path = optarg;
  1588. break;
  1589. case 'c':
  1590. if (strcmp(optarg, "none") == 0)
  1591. ctlsock_path = NULL;
  1592. else
  1593. ctlsock_path = optarg;
  1594. break;
  1595. case 'v':
  1596. for(i = 0, r = atoi(optarg); nf[i].version != -1; i++) {
  1597. if (nf[i].version == r)
  1598. break;
  1599. }
  1600. if (nf[i].version == -1) {
  1601. fprintf(stderr, "Invalid NetFlow version\n");
  1602. exit(1);
  1603. }
  1604. target.dialect = &nf[i];
  1605. break;
  1606. default:
  1607. fprintf(stderr, "Invalid commandline option.\n");
  1608. usage();
  1609. exit(1);
  1610. }
  1611. }
  1612. if (capfile == NULL && dev == NULL) {
  1613. fprintf(stderr, "-i or -r option not specified.\n");
  1614. usage();
  1615. exit(1);
  1616. }
  1617. /* join remaining arguments (if any) into bpf program */
  1618. bpf_prog = argv_join(argc - optind, argv + optind);
  1619. /* Will exit on failure */
  1620. setup_packet_capture(&pcap, &linktype, dev, capfile, bpf_prog,
  1621. target.dialect->v6_capable || always_v6);
  1622. /* Netflow send socket */
  1623. if (dest.ss_family != 0) {
  1624. if ((err = getnameinfo((struct sockaddr *)&dest,
  1625. dest_len, dest_addr, sizeof(dest_addr),
  1626. dest_serv, sizeof(dest_serv), NI_NUMERICHOST)) == -1) {
  1627. fprintf(stderr, "getnameinfo: %d\n", err);
  1628. exit(1);
  1629. }
  1630. target.fd = connsock(&dest, dest_len, hoplimit);
  1631. }
  1632. /* Control socket */
  1633. if (ctlsock_path != NULL)
  1634. ctlsock = unix_listener(ctlsock_path); /* Will exit on fail */
  1635. if (dontfork_flag) {
  1636. loginit(PROGNAME, 1);
  1637. } else {
  1638. FILE *pidfile;
  1639. daemon(0, 0);
  1640. loginit(PROGNAME, 0);
  1641. if ((pidfile = fopen(pidfile_path, "w")) == NULL) {
  1642. fprintf(stderr, "Couldn't open pidfile %s: %s\n",
  1643. pidfile_path, strerror(errno));
  1644. exit(1);
  1645. }
  1646. fprintf(pidfile, "%u\n", getpid());
  1647. fclose(pidfile);
  1648. signal(SIGINT, sighand_graceful_shutdown);
  1649. signal(SIGTERM, sighand_graceful_shutdown);
  1650. signal(SIGSEGV, sighand_other);
  1651. setprotoent(1);
  1652. drop_privs();
  1653. }
  1654. logit(LOG_NOTICE, "%s v%s starting data collection",
  1655. PROGNAME, PROGVER);
  1656. if (dest.ss_family != 0) {
  1657. logit(LOG_NOTICE, "Exporting flows to [%s]:%s",
  1658. dest_addr, dest_serv);
  1659. }
  1660. /* Main processing loop */
  1661. gettimeofday(&flowtrack.system_boot_time, NULL);
  1662. stop_collection_flag = 0;
  1663. memset(&cb_ctxt, '\0', sizeof(cb_ctxt));
  1664. cb_ctxt.ft = &flowtrack;
  1665. cb_ctxt.linktype = linktype;
  1666. cb_ctxt.want_v6 = target.dialect->v6_capable || always_v6;
  1667. for (r = 0; graceful_shutdown_request == 0; r = 0) {
  1668. /*
  1669. * Silly libpcap's timeout function doesn't work, so we
  1670. * do it here (only if we are reading live)
  1671. */
  1672. if (capfile == NULL) {
  1673. memset(pl, '\0', sizeof(pl));
  1674. /* This can only be set via the control socket */
  1675. if (!stop_collection_flag) {
  1676. pl[0].events = POLLIN|POLLERR|POLLHUP;
  1677. pl[0].fd = pcap_fileno(pcap);
  1678. }
  1679. if (ctlsock != -1) {
  1680. pl[1].fd = ctlsock;
  1681. pl[1].events = POLLIN|POLLERR|POLLHUP;
  1682. }
  1683. r = poll(pl, (ctlsock == -1) ? 1 : 2,
  1684. next_expire(&flowtrack));
  1685. if (r == -1 && errno != EINTR) {
  1686. logit(LOG_ERR, "Exiting on poll: %s",
  1687. strerror(errno));
  1688. break;
  1689. }
  1690. }
  1691. /* Accept connection on control socket if present */
  1692. if (ctlsock != -1 && pl[1].revents != 0) {
  1693. if (accept_control(ctlsock, &target, &flowtrack, pcap,
  1694. &exit_request, &stop_collection_flag) != 0)
  1695. break;
  1696. }
  1697. /* If we have data, run it through libpcap */
  1698. if (!stop_collection_flag &&
  1699. (capfile != NULL || pl[0].revents != 0)) {
  1700. r = pcap_dispatch(pcap, flowtrack.max_flows, flow_cb,
  1701. (void*)&cb_ctxt);
  1702. if (r == -1) {
  1703. logit(LOG_ERR, "Exiting on pcap_dispatch: %s",
  1704. pcap_geterr(pcap));
  1705. break;
  1706. } else if (r == 0) {
  1707. logit(LOG_NOTICE, "Shutting down after "
  1708. "pcap EOF");
  1709. graceful_shutdown_request = 1;
  1710. break;
  1711. }
  1712. }
  1713. r = 0;
  1714. /* Fatal error from per-packet functions */
  1715. if (cb_ctxt.fatal) {
  1716. logit(LOG_WARNING, "Fatal error - exiting immediately");
  1717. break;
  1718. }
  1719. /*
  1720. * Expiry processing happens every recheck_rate seconds
  1721. * or whenever we have exceeded the maximum number of active
  1722. * flows
  1723. */
  1724. if (flowtrack.num_flows > flowtrack.max_flows ||
  1725. next_expire(&flowtrack) == 0) {
  1726. expiry_check:
  1727. /*
  1728. * If we are reading from a capture file, we never
  1729. * expire flows based on time - instead we only
  1730. * expire flows when the flow table is full.
  1731. */
  1732. if (check_expired(&flowtrack, &target,
  1733. capfile == NULL ? CE_EXPIRE_NORMAL :
  1734. CE_EXPIRE_FORCED) < 0)
  1735. logit(LOG_WARNING, "Unable to export flows");
  1736. /*
  1737. * If we are over max_flows, force-expire the oldest
  1738. * out first and immediately reprocess to evict them
  1739. */
  1740. if (flowtrack.num_flows > flowtrack.max_flows) {
  1741. force_expire(&flowtrack,
  1742. flowtrack.num_flows - flowtrack.max_flows);
  1743. goto expiry_check;
  1744. }
  1745. }
  1746. }
  1747. /* Flags set by signal handlers or control socket */
  1748. if (graceful_shutdown_request) {
  1749. logit(LOG_WARNING, "Shutting down on user request");
  1750. check_expired(&flowtrack, &target, CE_EXPIRE_ALL);
  1751. } else if (exit_request)
  1752. logit(LOG_WARNING, "Exiting immediately on user request");
  1753. else
  1754. logit(LOG_ERR, "Exiting immediately on internal error");
  1755. if (capfile != NULL && dontfork_flag)
  1756. statistics(&flowtrack, stdout, pcap);
  1757. pcap_close(pcap);
  1758. if (target.fd != -1)
  1759. close(target.fd);
  1760. unlink(pidfile_path);
  1761. if (ctlsock_path != NULL)
  1762. unlink(ctlsock_path);
  1763. return(r == 0 ? 0 : 1);
  1764. }