softflowd.c 73 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389
  1. /*
  2. * Copyright 2002 Damien Miller <djm@mindrot.org> All rights reserved.
  3. *
  4. * Redistribution and use in source and binary forms, with or without
  5. * modification, are permitted provided that the following conditions
  6. * are met:
  7. * 1. Redistributions of source code must retain the above copyright
  8. * notice, this list of conditions and the following disclaimer.
  9. * 2. Redistributions in binary form must reproduce the above copyright
  10. * notice, this list of conditions and the following disclaimer in the
  11. * documentation and/or other materials provided with the distribution.
  12. *
  13. * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  14. * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  15. * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  16. * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  17. * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  18. * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  19. * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  20. * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  21. * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  22. * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  23. */
  24. /*
  25. * This is software implementation of Cisco's NetFlow(tm) traffic
  26. * reporting system. It operates by listening (via libpcap) on a
  27. * promiscuous interface and tracking traffic flows.
  28. *
  29. * Traffic flows are recorded by source/destination/protocol
  30. * IP address or, in the case of TCP and UDP, by
  31. * src_addr:src_port/dest_addr:dest_port/protocol
  32. *
  33. * Flows expire automatically after a period of inactivity (default: 1
  34. * hour) They may also be evicted (in order of age) in situations where
  35. * there are more flows than slots available.
  36. *
  37. * Netflow compatible packets are sent to a specified target host upon
  38. * flow expiry.
  39. *
  40. * As this implementation watches traffic promiscuously, it is likely to
  41. * place significant load on hosts or gateways on which it is installed.
  42. */
  43. #include "common.h"
  44. #include "sys-tree.h"
  45. #include "convtime.h"
  46. #include "softflowd.h"
  47. #include "treetype.h"
  48. #include "freelist.h"
  49. #include "log.h"
  50. #include "netflow9.h"
  51. #include "ipfix.h"
  52. #include "psamp.h"
  53. #include <pcap.h>
  54. #define IPFIX_PORT 4739
  55. /* Global variables */
  56. static int verbose_flag = 0; /* Debugging flag */
  57. static u_int16_t if_index = 0; /* "manual" interface index */
  58. static int track_level;
  59. static int snaplen = 0;
  60. #ifdef ENABLE_PTHREAD
  61. pthread_mutex_t read_mutex;
  62. pthread_cond_t read_cond;
  63. int use_thread;
  64. u_char packet_data[1500];
  65. struct pcap_pkthdr packet_header;
  66. struct FLOW *send_expired_flows;
  67. #endif /* ENABLE_PTHREAD */
  68. /* Signal handler flags */
  69. static volatile sig_atomic_t graceful_shutdown_request = 0;
  70. /* Describes a datalink header and how to extract v4/v6 frames from it */
  71. struct DATALINK {
  72. int dlt; /* BPF datalink type */
  73. int skiplen; /* Number of bytes to skip datalink header */
  74. int ft_off; /* Datalink frametype offset */
  75. int ft_len; /* Datalink frametype length */
  76. int ft_is_be; /* Set if frametype is big-endian */
  77. u_int32_t ft_mask; /* Mask applied to frametype */
  78. u_int32_t ft_v4; /* IPv4 frametype */
  79. u_int32_t ft_v6; /* IPv6 frametype */
  80. };
  81. /* Datalink types that we know about */
  82. static const struct DATALINK lt[] = {
  83. {DLT_EN10MB, 14, 12, 2, 1, 0xffffffff, 0x0800, 0x86dd},
  84. {DLT_PPP, 5, 3, 2, 1, 0xffffffff, 0x0021, 0x0057},
  85. #ifdef DLT_LINUX_SLL
  86. {DLT_LINUX_SLL, 16, 14, 2, 1, 0xffffffff, 0x0800, 0x86dd},
  87. #endif
  88. {DLT_RAW, 0, 0, 1, 1, 0x000000f0, 0x0040, 0x0060},
  89. {DLT_NULL, 4, 0, 4, 0, 0xffffffff, AF_INET, AF_INET6},
  90. #ifdef DLT_LOOP
  91. {DLT_LOOP, 4, 0, 4, 1, 0xffffffff, AF_INET, AF_INET6},
  92. #endif
  93. #ifdef DLT_PFLOG
  94. {DLT_PFLOG, 48, 1, 1, 0, 0x000000ff, AF_INET, AF_INET6},
  95. #endif
  96. {-1, -1, -1, -1, -1, 0x00000000, 0xffff, 0xffff},
  97. };
  98. /* Netflow send functions */
  99. typedef int (netflow_send_func_t) (struct SENDPARAMETER);
  100. struct NETFLOW_SENDER {
  101. int version;
  102. netflow_send_func_t *func;
  103. netflow_send_func_t *bidir_func;
  104. int v6_capable;
  105. };
  106. /* Array of NetFlow export function that we know of. NB. nf[0] is default */
  107. static const struct NETFLOW_SENDER nf[] = {
  108. {5, send_netflow_v5, NULL, 0},
  109. {1, send_netflow_v1, NULL, 0},
  110. #ifdef ENABLE_LEGACY
  111. {9, send_netflow_v9, NULL, 1},
  112. #else /* ENABLE_LEGACY */
  113. {9, send_nflow9, NULL, 1},
  114. #endif /* ENABLE_LEGACY */
  115. {NF_VERSION_IPFIX, send_ipfix, send_ipfix_bi, 1},
  116. #ifdef ENABLE_NTOPNG
  117. {SOFTFLOWD_NF_VERSION_NTOPNG, send_ntopng, NULL, 1},
  118. #endif
  119. };
  120. static const struct NETFLOW_SENDER *
  121. lookup_netflow_sender (int version) {
  122. int i, r;
  123. for (i = 0, r = version; i < sizeof (nf) / sizeof (struct NETFLOW_SENDER);
  124. i++) {
  125. if (nf[i].version == r)
  126. return &nf[i];
  127. }
  128. return NULL;
  129. }
  130. /* Signal handlers */
  131. static void
  132. sighand_graceful_shutdown (int signum) {
  133. graceful_shutdown_request = signum;
  134. }
  135. static void
  136. sighand_other (int signum) {
  137. /* XXX: this may not be completely safe */
  138. logit (LOG_WARNING, "Exiting immediately on unexpected signal %d", signum);
  139. _exit (0);
  140. }
  141. /*
  142. * This is the flow comparison function.
  143. */
  144. static int
  145. flow_compare (struct FLOW *a, struct FLOW *b) {
  146. /* Be careful to avoid signed vs unsigned issues here */
  147. int r;
  148. if (track_level == TRACK_FULL_VLAN || track_level == TRACK_FULL_VLAN_ETHER) {
  149. if (a->vlanid[0] != b->vlanid[0])
  150. return (a->vlanid[0] > b->vlanid[0] ? 1 : -1);
  151. if (a->vlanid[1] != b->vlanid[1])
  152. return (a->vlanid[1] > b->vlanid[1] ? 1 : -1);
  153. }
  154. if (track_level == TRACK_FULL_VLAN_ETHER) {
  155. if ((r = memcmp (&a->ethermac[0], &b->ethermac[0], 6)) != 0)
  156. return (r > 0 ? 1 : -1);
  157. if ((r = memcmp (&a->ethermac[1], &b->ethermac[1], 6)) != 0)
  158. return (r > 0 ? 1 : -1);
  159. }
  160. if (a->af != b->af)
  161. return (a->af > b->af ? 1 : -1);
  162. if ((r = memcmp (&a->addr[0], &b->addr[0], sizeof (a->addr[0]))) != 0)
  163. return (r > 0 ? 1 : -1);
  164. if ((r = memcmp (&a->addr[1], &b->addr[1], sizeof (a->addr[1]))) != 0)
  165. return (r > 0 ? 1 : -1);
  166. #ifdef notyet
  167. if (a->ip6_flowlabel[0] != 0 && b->ip6_flowlabel[0] != 0 &&
  168. a->ip6_flowlabel[0] != b->ip6_flowlabel[0])
  169. return (a->ip6_flowlabel[0] > b->ip6_flowlabel[0] ? 1 : -1);
  170. if (a->ip6_flowlabel[1] != 0 && b->ip6_flowlabel[1] != 0 &&
  171. a->ip6_flowlabel[1] != b->ip6_flowlabel[1])
  172. return (a->ip6_flowlabel[1] > b->ip6_flowlabel[1] ? 1 : -1);
  173. #endif
  174. if (a->protocol != b->protocol)
  175. return (a->protocol > b->protocol ? 1 : -1);
  176. if (a->port[0] != b->port[0])
  177. return (ntohs (a->port[0]) > ntohs (b->port[0]) ? 1 : -1);
  178. if (a->port[1] != b->port[1])
  179. return (ntohs (a->port[1]) > ntohs (b->port[1]) ? 1 : -1);
  180. return (0);
  181. }
  182. /* Generate functions for flow tree */
  183. FLOW_PROTOTYPE (FLOWS, FLOW, trp, flow_compare);
  184. FLOW_GENERATE (FLOWS, FLOW, trp, flow_compare);
  185. /*
  186. * This is the expiry comparison function.
  187. */
  188. static int
  189. expiry_compare (struct EXPIRY *a, struct EXPIRY *b) {
  190. if (a->expires_at != b->expires_at)
  191. return (a->expires_at > b->expires_at ? 1 : -1);
  192. /* Make expiry entries unique by comparing flow sequence */
  193. if (a->flow->flow_seq != b->flow->flow_seq)
  194. return (a->flow->flow_seq > b->flow->flow_seq ? 1 : -1);
  195. return (0);
  196. }
  197. /* Generate functions for flow tree */
  198. EXPIRY_PROTOTYPE (EXPIRIES, EXPIRY, trp, expiry_compare);
  199. EXPIRY_GENERATE (EXPIRIES, EXPIRY, trp, expiry_compare);
  200. static struct FLOW *
  201. flow_get (struct FLOWTRACK *ft) {
  202. return freelist_get (&ft->flow_freelist);
  203. }
  204. static void
  205. flow_put (struct FLOWTRACK *ft, struct FLOW *flow) {
  206. return freelist_put (&ft->flow_freelist, flow);
  207. }
  208. static struct EXPIRY *
  209. expiry_get (struct FLOWTRACK *ft) {
  210. return freelist_get (&ft->expiry_freelist);
  211. }
  212. static void
  213. expiry_put (struct FLOWTRACK *ft, struct EXPIRY *expiry) {
  214. return freelist_put (&ft->expiry_freelist, expiry);
  215. }
  216. #if 0
  217. /* Dump a packet */
  218. static void
  219. dump_packet (const u_int8_t * p, int len) {
  220. char buf[1024], tmp[3];
  221. int i;
  222. for (*buf = '\0', i = 0; i < len; i++) {
  223. snprintf (tmp, sizeof (tmp), "%02x%s", p[i], i % 2 ? " " : "");
  224. if (strlcat (buf, tmp, sizeof (buf) - 4) >= sizeof (buf) - 4) {
  225. strlcat (buf, "...", sizeof (buf));
  226. break;
  227. }
  228. }
  229. logit (LOG_INFO, "packet len %d: %s", len, buf);
  230. }
  231. #endif
  232. /* Format a time in an ISOish format */
  233. static const char *
  234. format_time (time_t t) {
  235. struct tm *tm;
  236. static char buf[32];
  237. tm = gmtime (&t);
  238. strftime (buf, sizeof (buf), "%Y-%m-%dT%H:%M:%S", tm);
  239. return (buf);
  240. }
  241. static const char *
  242. format_ethermac (uint8_t ethermac[6]) {
  243. static char buf[1024];
  244. snprintf (buf, sizeof (buf), "%.2x:%.2x:%.2x:%.2x:%.2x:%.2x",
  245. ethermac[0], ethermac[1], ethermac[2], ethermac[3],
  246. ethermac[4], ethermac[5]);
  247. return buf;
  248. }
  249. /* Format a flow in a verbose and ugly way */
  250. static const char *
  251. format_flow (struct FLOW *flow) {
  252. char addr1[64], addr2[64], start_time[32], fin_time[32];
  253. static char buf[1024];
  254. inet_ntop (flow->af, &flow->addr[0], addr1, sizeof (addr1));
  255. inet_ntop (flow->af, &flow->addr[1], addr2, sizeof (addr2));
  256. snprintf (start_time, sizeof (start_time), "%s",
  257. format_time (flow->flow_start.tv_sec));
  258. snprintf (fin_time, sizeof (fin_time), "%s",
  259. format_time (flow->flow_last.tv_sec));
  260. snprintf (buf, sizeof (buf),
  261. "seq:%" PRIu64 " [%s]:%hu <> [%s]:%hu proto:%u "
  262. "octets>:%u packets>:%u octets<:%u packets<:%u "
  263. "start:%s.%03ld finish:%s.%03ld tcp>:%02x tcp<:%02x "
  264. "flowlabel>:%08x flowlabel<:%08x "
  265. "vlan>:%u vlan<:%u ether:%s <> %s", flow->flow_seq, addr1,
  266. ntohs (flow->port[0]), addr2, ntohs (flow->port[1]),
  267. (int) flow->protocol, flow->octets[0], flow->packets[0],
  268. flow->octets[1], flow->packets[1], start_time,
  269. (flow->flow_start.tv_usec + 500) / 1000, fin_time,
  270. (flow->flow_last.tv_usec + 500) / 1000, flow->tcp_flags[0],
  271. flow->tcp_flags[1], flow->ip6_flowlabel[0],
  272. flow->ip6_flowlabel[1], flow->vlanid[0], flow->vlanid[1],
  273. format_ethermac (flow->ethermac[0]),
  274. format_ethermac (flow->ethermac[1]));
  275. return (buf);
  276. }
  277. /* Format a flow in a brief way */
  278. static const char *
  279. format_flow_brief (struct FLOW *flow) {
  280. char addr1[64], addr2[64];
  281. static char buf[1024];
  282. inet_ntop (flow->af, &flow->addr[0], addr1, sizeof (addr1));
  283. inet_ntop (flow->af, &flow->addr[1], addr2, sizeof (addr2));
  284. snprintf (buf, sizeof (buf),
  285. "seq:%" PRIu64 " [%s]:%hu <> [%s]:%hu proto:%u "
  286. "vlan>:%u vlan<:%u ether:%s <> %s ",
  287. flow->flow_seq,
  288. addr1, ntohs (flow->port[0]), addr2, ntohs (flow->port[1]),
  289. (int) flow->protocol, flow->vlanid[0], flow->vlanid[1],
  290. format_ethermac (flow->ethermac[0]),
  291. format_ethermac (flow->ethermac[1]));
  292. return (buf);
  293. }
  294. /* Fill in transport-layer (tcp/udp) portions of flow record */
  295. static int
  296. transport_to_flowrec (struct FLOW *flow, const u_int8_t * pkt,
  297. const size_t caplen, int isfrag, int protocol, int ndx)
  298. {
  299. const struct tcphdr *tcp = (const struct tcphdr *) pkt;
  300. const struct udphdr *udp = (const struct udphdr *) pkt;
  301. const struct icmp *icmp = (const struct icmp *) pkt;
  302. /*
  303. * XXX to keep flow in proper canonical format, it may be necessary to
  304. * swap the array slots based on the order of the port numbers does
  305. * this matter in practice??? I don't think so - return flows will
  306. * always match, because of their symmetrical addr/ports
  307. */
  308. switch (protocol) {
  309. case IPPROTO_TCP:
  310. /* Check for runt packet, but don't error out on short frags */
  311. if (caplen < sizeof (*tcp))
  312. return (isfrag ? 0 : 1);
  313. flow->port[ndx] = tcp->th_sport;
  314. flow->port[ndx ^ 1] = tcp->th_dport;
  315. flow->tcp_flags[ndx] |= tcp->th_flags;
  316. break;
  317. case IPPROTO_UDP:
  318. /* Check for runt packet, but don't error out on short frags */
  319. if (caplen < sizeof (*udp))
  320. return (isfrag ? 0 : 1);
  321. flow->port[ndx] = udp->uh_sport;
  322. flow->port[ndx ^ 1] = udp->uh_dport;
  323. break;
  324. case IPPROTO_ICMP:
  325. case IPPROTO_ICMPV6:
  326. /*
  327. * Encode ICMP type * 256 + code into dest port like
  328. * Cisco routers
  329. */
  330. flow->port[ndx] = 0;
  331. flow->port[ndx ^ 1] = htons (icmp->icmp_type * 256 + icmp->icmp_code);
  332. break;
  333. }
  334. return (0);
  335. }
  336. static int
  337. make_ndx_ipv4 (const struct ip *ip, size_t caplen) {
  338. if (caplen < 20 || caplen < ip->ip_hl * 4)
  339. return (-1); /* Runt packet */
  340. if (ip->ip_v != 4)
  341. return (-1); /* Unsupported IP version */
  342. /* Prepare to store flow in canonical format */
  343. return (memcmp (&ip->ip_src, &ip->ip_dst, sizeof (ip->ip_src)) > 0 ? 1 : 0);
  344. }
  345. /* Convert a IPv4 packet to a partial flow record (used for comparison) */
  346. static int
  347. ipv4_to_flowrec (struct FLOW *flow, const u_int8_t * pkt, size_t caplen,
  348. size_t len, int *isfrag, int af, int ndx) {
  349. const struct ip *ip = (const struct ip *) pkt;
  350. //int ndx = make_ndx_ipv4 (ip, caplen);
  351. if (ndx < 0)
  352. return (-1);
  353. flow->af = af;
  354. flow->addr[ndx].v4 = ip->ip_src;
  355. flow->addr[ndx ^ 1].v4 = ip->ip_dst;
  356. flow->protocol = ip->ip_p;
  357. flow->octets[ndx] = len;
  358. flow->packets[ndx] = 1;
  359. flow->tos[ndx] = ip->ip_tos;
  360. *isfrag = (ntohs (ip->ip_off) & (IP_OFFMASK | IP_MF)) ? 1 : 0;
  361. /* Don't try to examine higher level headers if not first fragment */
  362. if (*isfrag && (ntohs (ip->ip_off) & IP_OFFMASK) != 0)
  363. return (0);
  364. return (transport_to_flowrec (flow, pkt + (ip->ip_hl * 4),
  365. caplen - (ip->ip_hl * 4), *isfrag, ip->ip_p,
  366. ndx));
  367. }
  368. static int
  369. make_ndx_ipv6 (const struct ip6_hdr *ip6, size_t caplen) {
  370. if (caplen < sizeof (*ip6))
  371. return (-1); /* Runt packet */
  372. if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION)
  373. return (-1); /* Unsupported IPv6 version */
  374. /* Prepare to store flow in canonical format */
  375. return (memcmp (&ip6->ip6_src, &ip6->ip6_dst,
  376. sizeof (ip6->ip6_src)) > 0 ? 1 : 0);
  377. }
  378. /* Convert a IPv6 packet to a partial flow record (used for comparison) */
  379. static int
  380. ipv6_to_flowrec (struct FLOW *flow, const u_int8_t * pkt, size_t caplen,
  381. size_t len, int *isfrag, int af, int ndx) {
  382. const struct ip6_hdr *ip6 = (const struct ip6_hdr *) pkt;
  383. const struct ip6_ext *eh6;
  384. const struct ip6_frag *fh6;
  385. int nxt;
  386. if (ndx < 0)
  387. return (-1);
  388. flow->af = af;
  389. flow->ip6_flowlabel[ndx] = ip6->ip6_flow & IPV6_FLOWLABEL_MASK;
  390. flow->addr[ndx].v6 = ip6->ip6_src;
  391. flow->addr[ndx ^ 1].v6 = ip6->ip6_dst;
  392. flow->octets[ndx] = len;
  393. flow->packets[ndx] = 1;
  394. flow->tos[ndx] = (ntohl (ip6->ip6_flow) & ntohl (0x0ff00000)) >> 20;
  395. *isfrag = 0;
  396. nxt = ip6->ip6_nxt;
  397. pkt += sizeof (*ip6);
  398. caplen -= sizeof (*ip6);
  399. /* Now loop through headers, looking for transport header */
  400. for (;;) {
  401. eh6 = (const struct ip6_ext *) pkt;
  402. if (nxt == IPPROTO_HOPOPTS ||
  403. nxt == IPPROTO_ROUTING || nxt == IPPROTO_DSTOPTS) {
  404. if (caplen < sizeof (*eh6) || caplen < (eh6->ip6e_len + 1) << 3)
  405. return (1); /* Runt */
  406. nxt = eh6->ip6e_nxt;
  407. pkt += (eh6->ip6e_len + 1) << 3;
  408. caplen -= (eh6->ip6e_len + 1) << 3;
  409. } else if (nxt == IPPROTO_FRAGMENT) {
  410. *isfrag = 1;
  411. fh6 = (const struct ip6_frag *) eh6;
  412. if (caplen < sizeof (*fh6))
  413. return (1); /* Runt */
  414. /*
  415. * Don't try to examine higher level headers if
  416. * not first fragment
  417. */
  418. if ((fh6->ip6f_offlg & IP6F_OFF_MASK) != 0)
  419. return (0);
  420. nxt = fh6->ip6f_nxt;
  421. pkt += sizeof (*fh6);
  422. caplen -= sizeof (*fh6);
  423. } else
  424. break;
  425. }
  426. flow->protocol = nxt;
  427. return (transport_to_flowrec (flow, pkt, caplen, *isfrag, nxt, ndx));
  428. }
  429. static int
  430. vlan_to_flowrec (struct FLOW *flow, u_int16_t vlanid, int ndx) {
  431. if (ndx < 0)
  432. return (-1);
  433. return (flow->vlanid[ndx] = vlanid);
  434. }
  435. static int
  436. ether_to_flowrec (struct FLOW *flow, struct ether_header *ether, int ndx) {
  437. if (ndx < 0)
  438. return (-1);
  439. if (ether == NULL)
  440. return (-1);
  441. memcpy (flow->ethermac[ndx], ether->ether_shost, ETH_ALEN);
  442. memcpy (flow->ethermac[ndx ^ 1], ether->ether_dhost, ETH_ALEN);
  443. return (1);
  444. }
  445. static void
  446. flow_update_expiry (struct FLOWTRACK *ft, struct FLOW *flow) {
  447. EXPIRY_REMOVE (EXPIRIES, &ft->expiries, flow->expiry);
  448. /* Flows over 2 GiB traffic */
  449. if (flow->octets[0] > (1U << 31) || flow->octets[1] > (1U << 31)) {
  450. flow->expiry->expires_at = 0;
  451. flow->expiry->reason = R_OVERBYTES;
  452. goto out;
  453. }
  454. /* Flows over maximum life seconds */
  455. if (ft->param.maximum_lifetime != 0 &&
  456. flow->flow_last.tv_sec - flow->flow_start.tv_sec >
  457. ft->param.maximum_lifetime) {
  458. flow->expiry->expires_at = 0;
  459. flow->expiry->reason = R_MAXLIFE;
  460. goto out;
  461. }
  462. if (flow->protocol == IPPROTO_TCP) {
  463. /* Reset TCP flows */
  464. if (ft->param.tcp_rst_timeout != 0 &&
  465. ((flow->tcp_flags[0] & TH_RST) || (flow->tcp_flags[1] & TH_RST))) {
  466. flow->expiry->expires_at = flow->flow_last.tv_sec +
  467. ft->param.tcp_rst_timeout;
  468. flow->expiry->reason = R_TCP_RST;
  469. goto out;
  470. }
  471. /* Finished TCP flows */
  472. if (ft->param.tcp_fin_timeout != 0 &&
  473. ((flow->tcp_flags[0] & TH_FIN) && (flow->tcp_flags[1] & TH_FIN))) {
  474. flow->expiry->expires_at = flow->flow_last.tv_sec +
  475. ft->param.tcp_fin_timeout;
  476. flow->expiry->reason = R_TCP_FIN;
  477. goto out;
  478. }
  479. /* TCP flows */
  480. if (ft->param.tcp_timeout != 0) {
  481. flow->expiry->expires_at = flow->flow_last.tv_sec +
  482. ft->param.tcp_timeout;
  483. flow->expiry->reason = R_TCP;
  484. goto out;
  485. }
  486. }
  487. if (ft->param.udp_timeout != 0 && flow->protocol == IPPROTO_UDP) {
  488. /* UDP flows */
  489. flow->expiry->expires_at = flow->flow_last.tv_sec + ft->param.udp_timeout;
  490. flow->expiry->reason = R_UDP;
  491. goto out;
  492. }
  493. if (ft->param.icmp_timeout != 0 &&
  494. ((flow->af == AF_INET && flow->protocol == IPPROTO_ICMP) ||
  495. ((flow->af == AF_INET6 && flow->protocol == IPPROTO_ICMPV6)))) {
  496. /* ICMP flows */
  497. flow->expiry->expires_at = flow->flow_last.tv_sec +
  498. ft->param.icmp_timeout;
  499. flow->expiry->reason = R_ICMP;
  500. goto out;
  501. }
  502. /* Everything else */
  503. flow->expiry->expires_at = flow->flow_last.tv_sec +
  504. ft->param.general_timeout;
  505. flow->expiry->reason = R_GENERAL;
  506. out:
  507. if (ft->param.maximum_lifetime != 0 && flow->expiry->expires_at != 0) {
  508. flow->expiry->expires_at = MIN (flow->expiry->expires_at,
  509. flow->flow_start.tv_sec +
  510. ft->param.maximum_lifetime);
  511. }
  512. EXPIRY_INSERT (EXPIRIES, &ft->expiries, flow->expiry);
  513. }
  514. /* Return values from process_packet */
  515. #define PP_OK 0
  516. #define PP_BAD_PACKET -2
  517. #define PP_MALLOC_FAIL -3
  518. /*
  519. * Main per-packet processing function. Take a packet (provided by
  520. * libpcap) and attempt to find a matching flow. If no such flow exists,
  521. * then create one.
  522. *
  523. * Also marks flows for fast expiry, based on flow or packet attributes
  524. * (the actual expiry is performed elsewhere)
  525. */
  526. static int
  527. process_packet (struct FLOWTRACK *ft, const u_int8_t * pkt, int af,
  528. const u_int32_t caplen, const u_int32_t len,
  529. struct ether_header *ether, u_int16_t vlanid,
  530. const struct timeval *received_time) {
  531. struct FLOW tmp, *flow;
  532. int frag, ndx;
  533. /* Convert the IP packet to a flow identity */
  534. memset (&tmp, 0, sizeof (tmp));
  535. switch (af) {
  536. case AF_INET:
  537. ndx = make_ndx_ipv4 ((const struct ip *) pkt, caplen);
  538. if (ipv4_to_flowrec (&tmp, pkt, caplen, len, &frag, af, ndx) == -1)
  539. goto bad;
  540. break;
  541. case AF_INET6:
  542. ndx = make_ndx_ipv6 ((const struct ip6_hdr *) pkt, caplen);
  543. if (ipv6_to_flowrec (&tmp, pkt, caplen, len, &frag, af, ndx) == -1)
  544. goto bad;
  545. break;
  546. default:
  547. bad:
  548. ft->param.bad_packets++;
  549. return (PP_BAD_PACKET);
  550. }
  551. if (frag)
  552. ft->param.frag_packets++;
  553. /* Zero out bits of the flow that aren't relevant to tracking level */
  554. switch (ft->param.track_level) {
  555. case TRACK_IP_ONLY:
  556. tmp.protocol = 0;
  557. /* FALLTHROUGH */
  558. case TRACK_IP_PROTO:
  559. tmp.port[0] = tmp.port[1] = 0;
  560. tmp.tcp_flags[0] = tmp.tcp_flags[1] = 0;
  561. /* FALLTHROUGH */
  562. case TRACK_FULL:
  563. tmp.vlanid[0] = tmp.vlanid[1] = 0;
  564. break;
  565. case TRACK_FULL_VLAN_ETHER:
  566. ether_to_flowrec (&tmp, ether, ndx);
  567. /* FALLTHROUGH */
  568. case TRACK_FULL_VLAN:
  569. vlan_to_flowrec (&tmp, vlanid, ndx);
  570. break;
  571. }
  572. /* If a matching flow does not exist, create and insert one */
  573. if ((flow = FLOW_FIND (FLOWS, &ft->flows, &tmp)) == NULL) {
  574. /* Allocate and fill in the flow */
  575. if ((flow = flow_get (ft)) == NULL) {
  576. logit (LOG_ERR, "process_packet: flow_get failed", sizeof (*flow));
  577. return (PP_MALLOC_FAIL);
  578. }
  579. memcpy (flow, &tmp, sizeof (*flow));
  580. memcpy (&flow->flow_start, received_time, sizeof (flow->flow_start));
  581. flow->flow_seq = ft->param.next_flow_seq++;
  582. FLOW_INSERT (FLOWS, &ft->flows, flow);
  583. /* Allocate and fill in the associated expiry event */
  584. if ((flow->expiry = expiry_get (ft)) == NULL) {
  585. logit (LOG_ERR, "process_packet: expiry_get failed",
  586. sizeof (*flow->expiry));
  587. return (PP_MALLOC_FAIL);
  588. }
  589. flow->expiry->flow = flow;
  590. /* Must be non-zero (0 means expire immediately) */
  591. flow->expiry->expires_at = 1;
  592. flow->expiry->reason = R_GENERAL;
  593. EXPIRY_INSERT (EXPIRIES, &ft->expiries, flow->expiry);
  594. ft->param.num_flows++;
  595. if (verbose_flag)
  596. logit (LOG_DEBUG, "ADD FLOW %s", format_flow_brief (flow));
  597. } else {
  598. /* Update flow statistics */
  599. flow->packets[0] += tmp.packets[0];
  600. flow->octets[0] += tmp.octets[0];
  601. flow->tcp_flags[0] |= tmp.tcp_flags[0];
  602. flow->packets[1] += tmp.packets[1];
  603. flow->octets[1] += tmp.octets[1];
  604. flow->tcp_flags[1] |= tmp.tcp_flags[1];
  605. }
  606. memcpy (&flow->flow_last, received_time, sizeof (flow->flow_last));
  607. if (flow->expiry->expires_at != 0)
  608. flow_update_expiry (ft, flow);
  609. return (PP_OK);
  610. }
  611. /*
  612. * Subtract two timevals. Returns (t1 - t2) in milliseconds.
  613. */
  614. u_int32_t
  615. timeval_sub_ms (const struct timeval * t1, const struct timeval * t2) {
  616. struct timeval res;
  617. res.tv_sec = t1->tv_sec - t2->tv_sec;
  618. res.tv_usec = t1->tv_usec - t2->tv_usec;
  619. if (res.tv_usec < 0) {
  620. res.tv_usec += 1000000L;
  621. res.tv_sec--;
  622. }
  623. return ((u_int32_t) res.tv_sec * 1000 + (u_int32_t) res.tv_usec / 1000);
  624. }
  625. int
  626. send_multi_destinations (int num_destinations,
  627. struct DESTINATION *destinations,
  628. u_int8_t is_loadbalance, u_int8_t * packet,
  629. int size) {
  630. struct DESTINATION *dest;
  631. int i, err;
  632. socklen_t errsz;
  633. static u_int64_t sent = 0;
  634. for (i = 0; i < num_destinations; i++) {
  635. if (!is_loadbalance || (is_loadbalance && (sent % num_destinations == i))) {
  636. dest = &destinations[i];
  637. errsz = sizeof (err);
  638. getsockopt (dest->sock, SOL_SOCKET, SO_ERROR, &err, &errsz); // Clear ICMP errors
  639. if (send (dest->sock, packet, (size_t) size, 0) == -1)
  640. return (-1);
  641. }
  642. }
  643. sent++;
  644. return is_loadbalance ? 1 : i;
  645. }
  646. static void
  647. update_statistic (struct STATISTIC *s, double new, double n) {
  648. if (n == 1.0) {
  649. s->min = s->mean = s->max = new;
  650. return;
  651. }
  652. s->min = MIN (s->min, new);
  653. s->max = MAX (s->max, new);
  654. s->mean = s->mean + ((new - s->mean) / n);
  655. }
  656. /* Update global statistics */
  657. static void
  658. update_statistics (struct FLOWTRACK *ft, struct FLOW *flow) {
  659. double tmp;
  660. static double n = 1.0;
  661. ft->param.flows_expired++;
  662. ft->param.flows_pp[flow->protocol % 256]++;
  663. tmp = (double) flow->flow_last.tv_sec +
  664. ((double) flow->flow_last.tv_usec / 1000000.0);
  665. tmp -= (double) flow->flow_start.tv_sec +
  666. ((double) flow->flow_start.tv_usec / 1000000.0);
  667. if (tmp < 0.0)
  668. tmp = 0.0;
  669. update_statistic (&ft->param.duration, tmp, n);
  670. update_statistic (&ft->param.duration_pp[flow->protocol], tmp,
  671. (double) ft->param.flows_pp[flow->protocol % 256]);
  672. tmp = flow->octets[0] + flow->octets[1];
  673. update_statistic (&ft->param.octets, tmp, n);
  674. ft->param.octets_pp[flow->protocol % 256] += tmp;
  675. tmp = flow->packets[0] + flow->packets[1];
  676. update_statistic (&ft->param.packets, tmp, n);
  677. ft->param.packets_pp[flow->protocol % 256] += tmp;
  678. n++;
  679. }
  680. static void
  681. update_expiry_stats (struct FLOWTRACK *ft, struct EXPIRY *e) {
  682. switch (e->reason) {
  683. case R_GENERAL:
  684. ft->param.expired_general++;
  685. break;
  686. case R_TCP:
  687. ft->param.expired_tcp++;
  688. break;
  689. case R_TCP_RST:
  690. ft->param.expired_tcp_rst++;
  691. break;
  692. case R_TCP_FIN:
  693. ft->param.expired_tcp_fin++;
  694. break;
  695. case R_UDP:
  696. ft->param.expired_udp++;
  697. break;
  698. case R_ICMP:
  699. ft->param.expired_icmp++;
  700. break;
  701. case R_MAXLIFE:
  702. ft->param.expired_maxlife++;
  703. break;
  704. case R_OVERBYTES:
  705. ft->param.expired_overbytes++;
  706. break;
  707. case R_OVERFLOWS:
  708. ft->param.expired_maxflows++;
  709. break;
  710. case R_FLUSH:
  711. ft->param.expired_flush++;
  712. break;
  713. }
  714. }
  715. /* How long before the next expiry event in millisecond */
  716. static int
  717. next_expire (struct FLOWTRACK *ft) {
  718. struct EXPIRY *expiry;
  719. struct timeval now;
  720. u_int32_t expires_at, ret, fudge;
  721. if (ft->param.adjust_time)
  722. now = ft->param.last_packet_time;
  723. else
  724. gettimeofday (&now, NULL);
  725. if ((expiry = EXPIRY_MIN (EXPIRIES, &ft->expiries)) == NULL)
  726. return (-1); /* indefinite */
  727. expires_at = expiry->expires_at;
  728. /* Don't cluster urgent expiries */
  729. if (expires_at == 0 && (expiry->reason == R_OVERBYTES ||
  730. expiry->reason == R_OVERFLOWS
  731. || expiry->reason == R_FLUSH))
  732. return (0); /* Now */
  733. /* Cluster expiries by expiry_interval */
  734. if (ft->param.expiry_interval > 1) {
  735. if ((fudge = expires_at % ft->param.expiry_interval) > 0)
  736. expires_at += ft->param.expiry_interval - fudge;
  737. }
  738. if (expires_at < now.tv_sec)
  739. return (0); /* Now */
  740. ret = 999 + (expires_at - now.tv_sec) * 1000;
  741. return (ret);
  742. }
  743. /*
  744. * Scan the tree of expiry events and process expired flows. If zap_all
  745. * is set, then forcibly expire all flows.
  746. */
  747. #define CE_EXPIRE_NORMAL 0 /* Normal expiry processing */
  748. #define CE_EXPIRE_ALL -1 /* Expire all flows immediately */
  749. #define CE_EXPIRE_FORCED 1 /* Only expire force-expired flows */
  750. static int
  751. check_expired (struct FLOWTRACK *ft, struct NETFLOW_TARGET *target, int ex) {
  752. struct FLOW **expired_flows, **oldexp;
  753. int num_expired, i, r;
  754. struct timeval now;
  755. struct EXPIRY *expiry, *nexpiry;
  756. if (ft->param.adjust_time)
  757. now = ft->param.last_packet_time;
  758. else
  759. gettimeofday (&now, NULL);
  760. r = 0;
  761. num_expired = 0;
  762. expired_flows = NULL;
  763. if (verbose_flag)
  764. logit (LOG_DEBUG, "Starting expiry scan: mode %d", ex);
  765. for (expiry = EXPIRY_MIN (EXPIRIES, &ft->expiries);
  766. expiry != NULL; expiry = nexpiry) {
  767. nexpiry = EXPIRY_NEXT (EXPIRIES, &ft->expiries, expiry);
  768. if ((expiry->expires_at == 0) || (ex == CE_EXPIRE_ALL) ||
  769. (ex != CE_EXPIRE_FORCED && (expiry->expires_at < now.tv_sec))) {
  770. /* Flow has expired */
  771. if (ft->param.maximum_lifetime != 0 &&
  772. expiry->flow->flow_last.tv_sec -
  773. expiry->flow->flow_start.tv_sec >= ft->param.maximum_lifetime)
  774. expiry->reason = R_MAXLIFE;
  775. if (verbose_flag)
  776. logit (LOG_DEBUG,
  777. "Queuing flow seq:%" PRIu64 " (%p) for expiry "
  778. "reason %d", expiry->flow->flow_seq,
  779. expiry->flow, expiry->reason);
  780. /* Add to array of expired flows */
  781. oldexp = expired_flows;
  782. expired_flows = realloc (expired_flows,
  783. sizeof (*expired_flows) * (num_expired + 1));
  784. /* Don't fatal on realloc failures */
  785. if (expired_flows == NULL)
  786. expired_flows = oldexp;
  787. else {
  788. expired_flows[num_expired] = expiry->flow;
  789. num_expired++;
  790. }
  791. if (ex == CE_EXPIRE_ALL)
  792. expiry->reason = R_FLUSH;
  793. update_expiry_stats (ft, expiry);
  794. /* Remove from flow tree, destroy expiry event */
  795. FLOW_REMOVE (FLOWS, &ft->flows, expiry->flow);
  796. EXPIRY_REMOVE (EXPIRIES, &ft->expiries, expiry);
  797. expiry->flow->expiry = NULL;
  798. expiry_put (ft, expiry);
  799. ft->param.num_flows--;
  800. }
  801. }
  802. if (verbose_flag)
  803. logit (LOG_DEBUG, "Finished scan %d flow(s) to be evicted", num_expired);
  804. /* Processing for expired flows */
  805. if (num_expired > 0) {
  806. if (target != NULL) {
  807. struct SENDPARAMETER sp =
  808. { expired_flows, num_expired, target, if_index, &ft->param,
  809. verbose_flag
  810. };
  811. netflow_send_func_t *func =
  812. ft->param.bidirection ==
  813. 1 ? target->dialect->bidir_func : target->dialect->func;
  814. if (func == NULL) {
  815. func = target->dialect->func;
  816. }
  817. #ifdef ENABLE_PTHREAD
  818. if (use_thread) {
  819. pthread_t write_thread = 0;
  820. sp.flows = calloc (num_expired, sizeof (struct FLOW));
  821. memcpy (sp.flows, expired_flows, sizeof (struct FLOW) * num_expired);
  822. if (pthread_create (&write_thread, NULL, (void *) func, (void *) &sp)
  823. < 0) {
  824. perror ("pthread_create error");
  825. exit (1);
  826. }
  827. if (pthread_detach (write_thread) != 0) {
  828. perror ("pthread_detach error");
  829. exit (1);
  830. }
  831. r = 1;
  832. } else
  833. #endif /* ENABLE_PTHREAD */
  834. r = func (sp);
  835. if (verbose_flag)
  836. logit (LOG_DEBUG, "sent %d netflow packets", r);
  837. if (r <= 0)
  838. ft->param.flows_dropped += num_expired * 2; /* XXX what if r < num_expired * 2 ? */
  839. }
  840. for (i = 0; i < num_expired; i++) {
  841. if (verbose_flag) {
  842. logit (LOG_DEBUG, "EXPIRED: %s (%p)",
  843. format_flow (expired_flows[i]), expired_flows[i]);
  844. }
  845. update_statistics (ft, expired_flows[i]);
  846. flow_put (ft, expired_flows[i]);
  847. }
  848. free (expired_flows);
  849. }
  850. return (r == -1 ? -1 : num_expired);
  851. }
  852. /*
  853. * Force expiry of num_to_expire flows (e.g. when flow table overfull)
  854. */
  855. static void
  856. force_expire (struct FLOWTRACK *ft, u_int32_t num_to_expire) {
  857. struct EXPIRY *expiry, **expiryv;
  858. int i;
  859. /* XXX move all overflow processing here (maybe) */
  860. if (verbose_flag)
  861. logit (LOG_INFO, "Forcing expiry of %d flows", num_to_expire);
  862. /*
  863. * Do this in two steps, as it is dangerous to change a key on
  864. * a tree entry without first removing it and then re-adding it.
  865. * It is even worse when this has to be done during a FOREACH :)
  866. * To get around this, we make a list of expired flows and _then_
  867. * alter them
  868. */
  869. if ((expiryv = calloc (num_to_expire, sizeof (*expiryv))) == NULL) {
  870. /*
  871. * On malloc failure, expire ALL flows. I assume that
  872. * setting all the keys in a tree to the same value is
  873. * safe.
  874. */
  875. logit (LOG_ERR, "Out of memory while expiring flows - "
  876. "all flows expired");
  877. EXPIRY_FOREACH (expiry, EXPIRIES, &ft->expiries) {
  878. expiry->expires_at = 0;
  879. expiry->reason = R_OVERFLOWS;
  880. ft->param.flows_force_expired++;
  881. }
  882. return;
  883. }
  884. /* Make the list of flows to expire */
  885. i = 0;
  886. EXPIRY_FOREACH (expiry, EXPIRIES, &ft->expiries) {
  887. if (i >= num_to_expire)
  888. break;
  889. expiryv[i++] = expiry;
  890. }
  891. if (i < num_to_expire) {
  892. logit (LOG_ERR, "Needed to expire %d flows, "
  893. "but only %d active", num_to_expire, i);
  894. num_to_expire = i;
  895. }
  896. for (i = 0; i < num_to_expire; i++) {
  897. EXPIRY_REMOVE (EXPIRIES, &ft->expiries, expiryv[i]);
  898. expiryv[i]->expires_at = 0;
  899. expiryv[i]->reason = R_OVERFLOWS;
  900. EXPIRY_INSERT (EXPIRIES, &ft->expiries, expiryv[i]);
  901. }
  902. ft->param.flows_force_expired += num_to_expire;
  903. free (expiryv);
  904. /* XXX - this is overcomplicated, perhaps use a separate queue */
  905. }
  906. /* Delete all flows that we know about without processing */
  907. static int
  908. delete_all_flows (struct FLOWTRACK *ft) {
  909. struct FLOW *flow, *nflow;
  910. int i;
  911. i = 0;
  912. for (flow = FLOW_MIN (FLOWS, &ft->flows); flow != NULL; flow = nflow) {
  913. nflow = FLOW_NEXT (FLOWS, &ft->flows, flow);
  914. FLOW_REMOVE (FLOWS, &ft->flows, flow);
  915. EXPIRY_REMOVE (EXPIRIES, &ft->expiries, flow->expiry);
  916. expiry_put (ft, flow->expiry);
  917. ft->param.num_flows--;
  918. flow_put (ft, flow);
  919. i++;
  920. }
  921. return (i);
  922. }
  923. /*
  924. * Log our current status.
  925. * Includes summary counters and (in verbose mode) the list of current flows
  926. * and the tree of expiry events.
  927. */
  928. static int
  929. statistics (struct FLOWTRACK *ft, FILE * out, pcap_t * pcap) {
  930. int i;
  931. struct protoent *pe;
  932. char proto[32];
  933. struct pcap_stat ps;
  934. fprintf (out, "Number of active flows: %d\n", ft->param.num_flows);
  935. fprintf (out, "Packets processed: %" PRIu64 "\n", ft->param.total_packets);
  936. if (ft->param.non_sampled_packets)
  937. fprintf (out, "Packets non-sampled: %" PRIu64 "\n",
  938. ft->param.non_sampled_packets);
  939. fprintf (out, "Fragments: %" PRIu64 "\n", ft->param.frag_packets);
  940. fprintf (out,
  941. "Ignored packets: %" PRIu64 " (%" PRIu64 " non-IP, %" PRIu64
  942. " too short)\n", ft->param.non_ip_packets + ft->param.bad_packets,
  943. ft->param.non_ip_packets, ft->param.bad_packets);
  944. fprintf (out, "Flows expired: %" PRIu64 " (%" PRIu64 " forced)\n",
  945. ft->param.flows_expired, ft->param.flows_force_expired);
  946. fprintf (out,
  947. "Flows exported: %" PRIu64 " (%" PRIu64 " records) in %" PRIu64
  948. " packets (%" PRIu64 " failures)\n", ft->param.flows_exported,
  949. ft->param.records_sent, ft->param.packets_sent,
  950. ft->param.flows_dropped);
  951. if (pcap_stats (pcap, &ps) == 0) {
  952. fprintf (out, "Packets received by libpcap: %lu\n",
  953. (unsigned long) ps.ps_recv);
  954. fprintf (out, "Packets dropped by libpcap: %lu\n",
  955. (unsigned long) ps.ps_drop);
  956. fprintf (out, "Packets dropped by interface: %lu\n",
  957. (unsigned long) ps.ps_ifdrop);
  958. }
  959. fprintf (out, "\n");
  960. if (ft->param.flows_expired != 0) {
  961. fprintf (out,
  962. "Expired flow statistics: minimum average maximum\n");
  963. fprintf (out, " Flow bytes: %12.0f %12.0f %12.0f\n",
  964. ft->param.octets.min, ft->param.octets.mean,
  965. ft->param.octets.max);
  966. fprintf (out, " Flow packets: %12.0f %12.0f %12.0f\n",
  967. ft->param.packets.min, ft->param.packets.mean,
  968. ft->param.packets.max);
  969. fprintf (out, " Duration: %12.2fs %12.2fs %12.2fs\n",
  970. ft->param.duration.min, ft->param.duration.mean,
  971. ft->param.duration.max);
  972. fprintf (out, "\n");
  973. fprintf (out, "Expired flow reasons:\n");
  974. fprintf (out, " tcp = %9" PRIu64 " tcp.rst = %9" PRIu64 " "
  975. "tcp.fin = %9" PRIu64 "\n", ft->param.expired_tcp,
  976. ft->param.expired_tcp_rst, ft->param.expired_tcp_fin);
  977. fprintf (out,
  978. " udp = %9" PRIu64 " icmp = %9" PRIu64 " "
  979. "general = %9" PRIu64 "\n", ft->param.expired_udp,
  980. ft->param.expired_icmp, ft->param.expired_general);
  981. fprintf (out, " maxlife = %9" PRIu64 "\n", ft->param.expired_maxlife);
  982. fprintf (out, "over 2 GiB = %9" PRIu64 "\n", ft->param.expired_overbytes);
  983. fprintf (out, " maxflows = %9" PRIu64 "\n", ft->param.expired_maxflows);
  984. fprintf (out, " flushed = %9" PRIu64 "\n", ft->param.expired_flush);
  985. fprintf (out, "\n");
  986. fprintf (out, "Per-protocol statistics: Octets "
  987. "Packets Avg Life Max Life\n");
  988. for (i = 0; i < 256; i++) {
  989. if (ft->param.packets_pp[i]) {
  990. pe = getprotobynumber (i);
  991. snprintf (proto, sizeof (proto), "%s (%d)",
  992. pe != NULL ? pe->p_name : "Unknown", i);
  993. fprintf (out, " %17s: %14" PRIu64 " %12" PRIu64 " %8.2fs "
  994. "%10.2fs\n", proto,
  995. ft->param.octets_pp[i],
  996. ft->param.packets_pp[i],
  997. ft->param.duration_pp[i].mean, ft->param.duration_pp[i].max);
  998. }
  999. }
  1000. }
  1001. return (0);
  1002. }
  1003. static void
  1004. dump_flows (struct FLOWTRACK *ft, FILE * out) {
  1005. struct EXPIRY *expiry;
  1006. time_t now;
  1007. now = time (NULL);
  1008. EXPIRY_FOREACH (expiry, EXPIRIES, &ft->expiries) {
  1009. fprintf (out, "ACTIVE %s\n", format_flow (expiry->flow));
  1010. if ((long int) expiry->expires_at - now < 0) {
  1011. fprintf (out,
  1012. "EXPIRY EVENT for flow %" PRIu64 " now%s\n",
  1013. expiry->flow->flow_seq,
  1014. expiry->expires_at == 0 ? " (FORCED)" : "");
  1015. } else {
  1016. fprintf (out,
  1017. "EXPIRY EVENT for flow %" PRIu64 " in %ld seconds\n",
  1018. expiry->flow->flow_seq, (long int) expiry->expires_at - now);
  1019. }
  1020. fprintf (out, "\n");
  1021. }
  1022. }
  1023. /*
  1024. * Figure out how many bytes to skip from front of packet to get past
  1025. * datalink headers. If pkt is specified, also check whether determine
  1026. * whether or not it is one that we are interested in (IPv4 or IPv6 for now)
  1027. *
  1028. * Returns number of bytes to skip or -1 to indicate that entire
  1029. * packet should be skipped
  1030. */
  1031. static int
  1032. datalink_check (int linktype, const u_int8_t * pkt, u_int32_t caplen, int *af,
  1033. struct ether_header **ether, u_int16_t * vlanid) {
  1034. int i, j;
  1035. u_int32_t frametype;
  1036. int vlan_size = 0;
  1037. static const struct DATALINK *dl = NULL;
  1038. /* Try to cache last used linktype */
  1039. if (dl == NULL || dl->dlt != linktype) {
  1040. for (i = 0; lt[i].dlt != linktype && lt[i].dlt != -1; i++);
  1041. dl = &lt[i];
  1042. }
  1043. if (dl->dlt == -1 || pkt == NULL)
  1044. return (dl->dlt);
  1045. if (caplen <= dl->skiplen)
  1046. return (-1);
  1047. /* Suck out the frametype */
  1048. frametype = 0;
  1049. /* Processing 802.1Q vlan in ethernet */
  1050. if (linktype == DLT_EN10MB) {
  1051. if (ether != NULL)
  1052. *ether = (struct ether_header *) pkt;
  1053. for (j = 0; j < dl->ft_len; j++) {
  1054. frametype <<= 8;
  1055. frametype |= pkt[j + dl->ft_off];
  1056. }
  1057. frametype &= dl->ft_mask;
  1058. if (frametype == ETHERTYPE_VLAN) {
  1059. for (j = 0; j < 2; j++) {
  1060. *vlanid <<= 8;
  1061. *vlanid |= pkt[j + dl->skiplen];
  1062. }
  1063. vlan_size = 4;
  1064. }
  1065. }
  1066. frametype = 0;
  1067. if (dl->ft_is_be) {
  1068. for (j = 0; j < dl->ft_len; j++) {
  1069. frametype <<= 8;
  1070. frametype |= pkt[j + dl->ft_off + vlan_size];
  1071. }
  1072. } else {
  1073. for (j = dl->ft_len - 1; j >= 0; j--) {
  1074. frametype <<= 8;
  1075. frametype |= pkt[j + dl->ft_off + vlan_size];
  1076. }
  1077. }
  1078. frametype &= dl->ft_mask;
  1079. if (frametype == dl->ft_v4)
  1080. *af = AF_INET;
  1081. else if (frametype == dl->ft_v6)
  1082. *af = AF_INET6;
  1083. else
  1084. return (-1);
  1085. return (dl->skiplen + vlan_size);
  1086. }
  1087. /*
  1088. * Per-packet callback function from libpcap. Pass the packet (if it is IP)
  1089. * sans datalink headers to process_packet.
  1090. */
  1091. void
  1092. flow_cb (u_char * user_data, const struct pcap_pkthdr *phdr,
  1093. const u_char * pkt) {
  1094. int s, af = 0;
  1095. struct CB_CTXT *cb_ctxt = (struct CB_CTXT *) user_data;
  1096. struct timeval tv;
  1097. u_int16_t vlanid = 0;
  1098. struct ether_header *ether = NULL;
  1099. if (cb_ctxt->ft->param.total_packets == 0) {
  1100. if (cb_ctxt->ft->param.adjust_time) {
  1101. cb_ctxt->ft->param.system_boot_time = phdr->ts;
  1102. }
  1103. }
  1104. if (cb_ctxt->ft->param.option.sample &&
  1105. (cb_ctxt->ft->param.total_packets +
  1106. cb_ctxt->ft->param.non_sampled_packets) %
  1107. cb_ctxt->ft->param.option.sample > 0) {
  1108. cb_ctxt->ft->param.non_sampled_packets++;
  1109. return;
  1110. }
  1111. cb_ctxt->ft->param.total_packets++;
  1112. if (cb_ctxt->ft->param.is_psamp) {
  1113. send_psamp (pkt, phdr->caplen, phdr->ts, cb_ctxt->target,
  1114. cb_ctxt->ft->param.total_packets);
  1115. return;
  1116. }
  1117. s = datalink_check (cb_ctxt->linktype, pkt, phdr->caplen, &af, &ether,
  1118. &vlanid);
  1119. if (s < 0 || (!cb_ctxt->want_v6 && af == AF_INET6)) {
  1120. cb_ctxt->ft->param.non_ip_packets++;
  1121. cb_ctxt->ft->param.total_packets--;
  1122. } else {
  1123. tv.tv_sec = phdr->ts.tv_sec;
  1124. tv.tv_usec = phdr->ts.tv_usec;
  1125. if (process_packet (cb_ctxt->ft, pkt + s, af, phdr->caplen - s,
  1126. phdr->len - s, ether, vlanid, &tv) == PP_MALLOC_FAIL)
  1127. cb_ctxt->fatal = 1;
  1128. }
  1129. if (cb_ctxt->ft->param.adjust_time)
  1130. cb_ctxt->ft->param.last_packet_time = phdr->ts;
  1131. }
  1132. #ifdef ENABLE_PTHREAD
  1133. static void
  1134. pcap_memcpy (u_char * user_data, const struct pcap_pkthdr *phdr,
  1135. const u_char * pkt) {
  1136. pthread_mutex_lock (&read_mutex);
  1137. memcpy (&packet_header, phdr, sizeof (struct pcap_pkthdr));
  1138. memcpy (&packet_data, pkt, sizeof (packet_data));
  1139. pthread_mutex_unlock (&read_mutex);
  1140. pthread_cond_signal (&read_cond);
  1141. }
  1142. void *
  1143. process_packet_loop (void *arg) {
  1144. while (!graceful_shutdown_request) {
  1145. pthread_mutex_lock (&read_mutex);
  1146. pthread_cond_wait (&read_cond, &read_mutex);
  1147. if (graceful_shutdown_request)
  1148. break;
  1149. flow_cb ((u_char *) arg, &packet_header, (u_char *) & packet_data);
  1150. pthread_mutex_unlock (&read_mutex);
  1151. }
  1152. }
  1153. #endif /* ENABLE_PTHREAD */
  1154. static void
  1155. print_timeouts (struct FLOWTRACK *ft, FILE * out) {
  1156. fprintf (out, " TCP timeout: %ds\n", ft->param.tcp_timeout);
  1157. fprintf (out, " TCP post-RST timeout: %ds\n", ft->param.tcp_rst_timeout);
  1158. fprintf (out, " TCP post-FIN timeout: %ds\n", ft->param.tcp_fin_timeout);
  1159. fprintf (out, " UDP timeout: %ds\n", ft->param.udp_timeout);
  1160. fprintf (out, " ICMP timeout: %ds\n", ft->param.icmp_timeout);
  1161. fprintf (out, " General timeout: %ds\n", ft->param.general_timeout);
  1162. fprintf (out, " Maximum lifetime: %ds\n", ft->param.maximum_lifetime);
  1163. fprintf (out, " Expiry interval: %ds\n", ft->param.expiry_interval);
  1164. }
  1165. static int
  1166. accept_control (int lsock, struct NETFLOW_TARGET *target,
  1167. struct FLOWTRACK *ft, pcap_t * pcap, int *exit_request,
  1168. int *stop_collection_flag) {
  1169. char buf[64], *p;
  1170. FILE *ctlf;
  1171. int fd, ret;
  1172. if ((fd = accept (lsock, NULL, NULL)) == -1) {
  1173. logit (LOG_ERR, "ctl accept: %s - exiting", strerror (errno));
  1174. return (-1);
  1175. }
  1176. if ((ctlf = fdopen (fd, "r+")) == NULL) {
  1177. logit (LOG_ERR, "fdopen: %s - exiting\n", strerror (errno));
  1178. close (fd);
  1179. return (-1);
  1180. }
  1181. setlinebuf (ctlf);
  1182. if (fgets (buf, sizeof (buf), ctlf) == NULL) {
  1183. logit (LOG_ERR, "Control socket yielded no data");
  1184. return (0);
  1185. }
  1186. if ((p = strchr (buf, '\n')) != NULL)
  1187. *p = '\0';
  1188. if (verbose_flag)
  1189. logit (LOG_DEBUG, "Control socket \"%s\"", buf);
  1190. /* XXX - use dispatch table */
  1191. ret = -1;
  1192. if (strcmp (buf, "help") == 0) {
  1193. fprintf (ctlf, "Valid control words are:\n");
  1194. fprintf (ctlf, "\tdebug+ debug- delete-all dump-flows exit "
  1195. "expire-all\n");
  1196. fprintf (ctlf, "\tshutdown start-gather statistics stop-gather "
  1197. "timeouts\n");
  1198. fprintf (ctlf, "\tsend-template\n");
  1199. ret = 0;
  1200. } else if (strcmp (buf, "shutdown") == 0) {
  1201. fprintf (ctlf, "softflowd[%u]: Shutting down gracefully...\n",
  1202. (unsigned int) getpid ());
  1203. graceful_shutdown_request = 1;
  1204. ret = 1;
  1205. } else if (strcmp (buf, "exit") == 0) {
  1206. fprintf (ctlf, "softflowd[%u]: Exiting now...\n",
  1207. (unsigned int) getpid ());
  1208. *exit_request = 1;
  1209. ret = 1;
  1210. } else if (strcmp (buf, "expire-all") == 0) {
  1211. #ifdef ENABLE_LEGACY
  1212. netflow9_resend_template ();
  1213. #else /* ENABLE_LEGACY */
  1214. ipfix_resend_template ();
  1215. #endif /* ENABLE_LEGACY */
  1216. fprintf (ctlf, "softflowd[%u]: Expired %d flows.\n",
  1217. (unsigned int) getpid (), check_expired (ft, target,
  1218. CE_EXPIRE_ALL));
  1219. ret = 0;
  1220. } else if (strcmp (buf, "send-template") == 0) {
  1221. #ifdef ENABLE_LEGACY
  1222. netflow9_resend_template ();
  1223. #else /* ENABLE_LEGACY */
  1224. ipfix_resend_template ();
  1225. #endif /* ENABLE_LEGACY */
  1226. fprintf (ctlf, "softflowd[%u]: Template will be sent at "
  1227. "next flow export\n", (unsigned int) getpid ());
  1228. ret = 0;
  1229. } else if (strcmp (buf, "delete-all") == 0) {
  1230. fprintf (ctlf, "softflowd[%u]: Deleted %d flows.\n",
  1231. (unsigned int) getpid (), delete_all_flows (ft));
  1232. ret = 0;
  1233. } else if (strcmp (buf, "statistics") == 0) {
  1234. fprintf (ctlf, "softflowd[%u]: Accumulated statistics "
  1235. "since %s UTC:\n", (unsigned int) getpid (),
  1236. format_time (ft->param.system_boot_time.tv_sec));
  1237. statistics (ft, ctlf, pcap);
  1238. ret = 0;
  1239. } else if (strcmp (buf, "debug+") == 0) {
  1240. fprintf (ctlf, "softflowd[%u]: Debug level increased.\n",
  1241. (unsigned int) getpid ());
  1242. verbose_flag = 1;
  1243. ret = 0;
  1244. } else if (strcmp (buf, "debug-") == 0) {
  1245. fprintf (ctlf, "softflowd[%u]: Debug level decreased.\n",
  1246. (unsigned int) getpid ());
  1247. verbose_flag = 0;
  1248. ret = 0;
  1249. } else if (strcmp (buf, "stop-gather") == 0) {
  1250. fprintf (ctlf, "softflowd[%u]: Data collection stopped.\n",
  1251. (unsigned int) getpid ());
  1252. *stop_collection_flag = 1;
  1253. ret = 0;
  1254. } else if (strcmp (buf, "start-gather") == 0) {
  1255. fprintf (ctlf, "softflowd[%u]: Data collection resumed.\n",
  1256. (unsigned int) getpid ());
  1257. *stop_collection_flag = 0;
  1258. ret = 0;
  1259. } else if (strcmp (buf, "dump-flows") == 0) {
  1260. fprintf (ctlf, "softflowd[%u]: Dumping flow data:\n",
  1261. (unsigned int) getpid ());
  1262. dump_flows (ft, ctlf);
  1263. ret = 0;
  1264. } else if (strcmp (buf, "timeouts") == 0) {
  1265. fprintf (ctlf, "softflowd[%u]: Printing timeouts:\n",
  1266. (unsigned int) getpid ());
  1267. print_timeouts (ft, ctlf);
  1268. ret = 0;
  1269. } else {
  1270. fprintf (ctlf, "Unknown control command \"%s\"\n", buf);
  1271. ret = 0;
  1272. }
  1273. fclose (ctlf);
  1274. close (fd);
  1275. return (ret);
  1276. }
  1277. static int
  1278. recvsock (uint16_t portnumber) {
  1279. struct sockaddr_in addr;
  1280. int rsock = socket (AF_INET, SOCK_DGRAM, 0);
  1281. if (rsock < 0) {
  1282. perror ("socket");
  1283. return rsock;
  1284. }
  1285. addr.sin_family = AF_INET;
  1286. addr.sin_port = htons (portnumber);
  1287. addr.sin_addr.s_addr = INADDR_ANY;
  1288. if (bind (rsock, (struct sockaddr *) &addr, sizeof (addr)) < 0) {
  1289. perror ("bind");
  1290. return -1;
  1291. };
  1292. return rsock;
  1293. }
  1294. static int
  1295. connsock (struct sockaddr_storage *addr, socklen_t len, int hoplimit,
  1296. int protocol) {
  1297. int s;
  1298. unsigned int h6;
  1299. unsigned char h4;
  1300. struct sockaddr_in *in4 = (struct sockaddr_in *) addr;
  1301. struct sockaddr_in6 *in6 = (struct sockaddr_in6 *) addr;
  1302. if ((s =
  1303. socket (addr->ss_family,
  1304. protocol == IPPROTO_UDP ? SOCK_DGRAM : SOCK_STREAM,
  1305. protocol)) == -1) {
  1306. fprintf (stderr, "socket() error: %s\n", strerror (errno));
  1307. exit (1);
  1308. }
  1309. if (connect (s, (struct sockaddr *) addr, len) == -1) {
  1310. fprintf (stderr, "connect() error: %s\n", strerror (errno));
  1311. exit (1);
  1312. }
  1313. switch (addr->ss_family) {
  1314. case AF_INET:
  1315. /* Default to link-local TTL for multicast addresses */
  1316. if (hoplimit == -1 && IN_MULTICAST (in4->sin_addr.s_addr))
  1317. hoplimit = 1;
  1318. if (hoplimit == -1)
  1319. break;
  1320. h4 = hoplimit;
  1321. if (setsockopt (s, IPPROTO_IP, IP_MULTICAST_TTL, &h4, sizeof (h4)) == -1) {
  1322. fprintf (stderr, "setsockopt(IP_MULTICAST_TTL, "
  1323. "%u): %s\n", h4, strerror (errno));
  1324. exit (1);
  1325. }
  1326. break;
  1327. case AF_INET6:
  1328. /* Default to link-local hoplimit for multicast addresses */
  1329. if (hoplimit == -1 && IN6_IS_ADDR_MULTICAST (&in6->sin6_addr))
  1330. hoplimit = 1;
  1331. if (hoplimit == -1)
  1332. break;
  1333. h6 = hoplimit;
  1334. if (setsockopt (s, IPPROTO_IPV6, IPV6_MULTICAST_HOPS,
  1335. &h6, sizeof (h6)) == -1) {
  1336. fprintf (stderr, "setsockopt(IPV6_MULTICAST_HOPS, %u): "
  1337. "%s\n", h6, strerror (errno));
  1338. exit (1);
  1339. }
  1340. }
  1341. return (s);
  1342. }
  1343. static int
  1344. unix_listener (const char *path) {
  1345. struct sockaddr_un addr;
  1346. socklen_t addrlen;
  1347. int s;
  1348. memset (&addr, '\0', sizeof (addr));
  1349. addr.sun_family = AF_UNIX;
  1350. if (strlcpy (addr.sun_path, path, sizeof (addr.sun_path)) >=
  1351. sizeof (addr.sun_path)) {
  1352. fprintf (stderr, "control socket path too long\n");
  1353. exit (1);
  1354. }
  1355. addr.sun_path[sizeof (addr.sun_path) - 1] = '\0';
  1356. addrlen = offsetof (struct sockaddr_un, sun_path) + strlen (path) + 1;
  1357. #ifdef SOCK_HAS_LEN
  1358. addr.sun_len = addrlen;
  1359. #endif
  1360. if ((s = socket (PF_UNIX, SOCK_STREAM, 0)) < 0) {
  1361. fprintf (stderr, "unix domain socket() error: %s\n", strerror (errno));
  1362. exit (1);
  1363. }
  1364. unlink (path);
  1365. if (bind (s, (struct sockaddr *) &addr, addrlen) == -1) {
  1366. fprintf (stderr, "unix domain bind(\"%s\") error: %s\n",
  1367. addr.sun_path, strerror (errno));
  1368. exit (1);
  1369. }
  1370. if (listen (s, 64) == -1) {
  1371. fprintf (stderr, "unix domain listen() error: %s\n", strerror (errno));
  1372. exit (1);
  1373. }
  1374. return (s);
  1375. }
  1376. static void
  1377. setup_packet_capture (struct pcap **pcap, int *linktype,
  1378. char *dev, char *capfile, char *bpf_prog, int need_v6) {
  1379. char ebuf[PCAP_ERRBUF_SIZE];
  1380. struct bpf_program prog_c;
  1381. u_int32_t bpf_mask, bpf_net;
  1382. /* Open pcap */
  1383. if (dev != NULL) {
  1384. if (!snaplen)
  1385. snaplen = need_v6 ? LIBPCAP_SNAPLEN_V6 : LIBPCAP_SNAPLEN_V4;
  1386. if ((*pcap = pcap_open_live (dev, snaplen, 1, 0, ebuf)) == NULL) {
  1387. fprintf (stderr, "pcap_open_live: %s\n", ebuf);
  1388. exit (1);
  1389. }
  1390. if (pcap_lookupnet (dev, &bpf_net, &bpf_mask, ebuf) == -1)
  1391. bpf_net = bpf_mask = 0;
  1392. } else {
  1393. if ((*pcap = pcap_open_offline (capfile, ebuf)) == NULL) {
  1394. fprintf (stderr, "pcap_open_offline(%s): %s\n", capfile, ebuf);
  1395. exit (1);
  1396. }
  1397. bpf_net = bpf_mask = 0;
  1398. }
  1399. *linktype = pcap_datalink (*pcap);
  1400. if (datalink_check (*linktype, NULL, 0, NULL, NULL, NULL) == -1) {
  1401. fprintf (stderr, "Unsupported datalink type %d\n", *linktype);
  1402. exit (1);
  1403. }
  1404. /* Attach BPF filter, if specified */
  1405. if (bpf_prog != NULL) {
  1406. if (pcap_compile (*pcap, &prog_c, bpf_prog, 1, bpf_mask) == -1) {
  1407. fprintf (stderr, "pcap_compile(\"%s\"): %s\n",
  1408. bpf_prog, pcap_geterr (*pcap));
  1409. exit (1);
  1410. }
  1411. if (pcap_setfilter (*pcap, &prog_c) == -1) {
  1412. fprintf (stderr, "pcap_setfilter: %s\n", pcap_geterr (*pcap));
  1413. exit (1);
  1414. }
  1415. }
  1416. #ifdef BIOCLOCK
  1417. /*
  1418. * If we are reading from an device (not a file), then
  1419. * lock the underlying BPF device to prevent changes in the
  1420. * unprivileged child
  1421. */
  1422. if (dev != NULL && ioctl (pcap_fileno (*pcap), BIOCLOCK) < 0) {
  1423. fprintf (stderr, "ioctl(BIOCLOCK) failed: %s\n", strerror (errno));
  1424. exit (1);
  1425. }
  1426. #endif
  1427. }
  1428. static void
  1429. init_flowtrack (struct FLOWTRACK *ft) {
  1430. /* Set up flow-tracking structure */
  1431. memset (ft, '\0', sizeof (*ft));
  1432. ft->param.next_flow_seq = 1;
  1433. FLOW_INIT (&ft->flows);
  1434. EXPIRY_INIT (&ft->expiries);
  1435. freelist_init (&ft->flow_freelist, sizeof (struct FLOW));
  1436. freelist_init (&ft->expiry_freelist, sizeof (struct EXPIRY));
  1437. ft->param.max_flows = DEFAULT_MAX_FLOWS;
  1438. track_level = ft->param.track_level = TRACK_FULL;
  1439. ft->param.tcp_timeout = DEFAULT_TCP_TIMEOUT;
  1440. ft->param.tcp_rst_timeout = DEFAULT_TCP_RST_TIMEOUT;
  1441. ft->param.tcp_fin_timeout = DEFAULT_TCP_FIN_TIMEOUT;
  1442. ft->param.udp_timeout = DEFAULT_UDP_TIMEOUT;
  1443. ft->param.icmp_timeout = DEFAULT_ICMP_TIMEOUT;
  1444. ft->param.general_timeout = DEFAULT_GENERAL_TIMEOUT;
  1445. ft->param.maximum_lifetime = DEFAULT_MAXIMUM_LIFETIME;
  1446. ft->param.expiry_interval = DEFAULT_EXPIRY_INTERVAL;
  1447. }
  1448. static char *
  1449. argv_join (int argc, char **argv) {
  1450. int i;
  1451. size_t ret_len;
  1452. char *ret;
  1453. ret_len = 0;
  1454. ret = NULL;
  1455. for (i = 0; i < argc; i++) {
  1456. ret_len += strlen (argv[i]);
  1457. if ((ret = realloc (ret, ret_len + 2)) == NULL) {
  1458. fprintf (stderr, "Memory allocation failed.\n");
  1459. exit (1);
  1460. }
  1461. if (i == 0)
  1462. ret[0] = '\0';
  1463. else {
  1464. ret_len++; /* Make room for ' ' */
  1465. strlcat (ret, " ", ret_len + 1);
  1466. }
  1467. strlcat (ret, argv[i], ret_len + 1);
  1468. }
  1469. return (ret);
  1470. }
  1471. /* Display commandline usage information */
  1472. static void
  1473. usage (void) {
  1474. fprintf (stderr,
  1475. "Usage: %s [options] [bpf_program]\n"
  1476. "This is %s version %s. Valid commandline options:\n"
  1477. " -i [idx:]interface Specify interface to listen on\n"
  1478. " -r pcap_file Specify packet capture file to read\n"
  1479. " -t timeout=time Specify named timeout\n"
  1480. " -m max_flows Specify maximum number of flows to track (default %d)\n"
  1481. " -n host:port Send Cisco NetFlow(tm)-compatible packets to host:port\n"
  1482. " -p pidfile Record pid in specified file\n"
  1483. " (default: %s)\n"
  1484. " -c socketfile Location of control socket\n"
  1485. " (default: %s)\n"
  1486. " -v 1|5|9|10|psamp NetFlow export packet version\n"
  1487. " 10 means IPFIX and psamp means PSAMP (packet sampling)\n"
  1488. #ifdef ENABLE_NTOPNG
  1489. " ntopng ntopng means direct injection to NTOPNG (if supported).\n"
  1490. #endif
  1491. " -L hoplimit Set TTL/hoplimit for export datagrams\n"
  1492. " -T full|port|proto|ip| Set flow tracking level (default: full)\n"
  1493. " vlan (\"vlan\" tracking means \"full\" tracking with vlanid)\n"
  1494. " ether (\"ether\" tracking means \"vlan\" tracking with ether header)\n"
  1495. " -6 Track IPv6 flows, regardless of whether selected \n"
  1496. " NetFlow export protocol supports it\n"
  1497. " -d Don't daemonise (run in foreground)\n"
  1498. " -D Debug mode: foreground + verbosity + track v6 flows\n"
  1499. " -P udp|tcp|sctp Specify transport layer protocol for exporting packets\n"
  1500. " -A sec|milli|micro|nano Specify absolute time format form exporting records\n"
  1501. " -s sampling_rate Specify periodical sampling rate (denominator)\n"
  1502. " -b Bidirectional mode in IPFIX (-b work with -v 10)\n"
  1503. " -a Adjusting time for reading pcap file (-a work with -r)\n"
  1504. " -C capture_length Specify length for packet capture (snaplen)\n"
  1505. " -l Load balancing mode for multiple destinations\n"
  1506. " -R receive_port Specify port number for PSAMP receive mode\n"
  1507. #ifdef ENABLE_PTHREAD
  1508. " -M Enable multithread\n"
  1509. #endif /* ENABLE_PTHREAD */
  1510. " -h Display this help\n"
  1511. "\n"
  1512. "Valid timeout names and default values:\n"
  1513. " tcp (default %6d)"
  1514. " tcp.rst (default %6d)"
  1515. " tcp.fin (default %6d)\n"
  1516. " udp (default %6d)"
  1517. " icmp (default %6d)"
  1518. " general (default %6d)\n"
  1519. " maxlife (default %6d)"
  1520. " expint (default %6d)\n"
  1521. "\n",
  1522. PROGNAME, PROGNAME, PROGVER, DEFAULT_MAX_FLOWS, DEFAULT_PIDFILE,
  1523. DEFAULT_CTLSOCK,
  1524. DEFAULT_TCP_TIMEOUT, DEFAULT_TCP_RST_TIMEOUT,
  1525. DEFAULT_TCP_FIN_TIMEOUT, DEFAULT_UDP_TIMEOUT, DEFAULT_ICMP_TIMEOUT,
  1526. DEFAULT_GENERAL_TIMEOUT, DEFAULT_MAXIMUM_LIFETIME,
  1527. DEFAULT_EXPIRY_INTERVAL);
  1528. }
  1529. static void
  1530. set_timeout (struct FLOWTRACK *ft, const char *to_spec) {
  1531. char *name, *value;
  1532. int timeout;
  1533. if ((name = strdup (to_spec)) == NULL) {
  1534. fprintf (stderr, "Out of memory\n");
  1535. exit (1);
  1536. }
  1537. if ((value = strchr (name, '=')) == NULL || *(++value) == '\0') {
  1538. fprintf (stderr, "Invalid -t option \"%s\".\n", name);
  1539. usage ();
  1540. exit (1);
  1541. }
  1542. *(value - 1) = '\0';
  1543. timeout = convtime (value);
  1544. if (timeout < 0) {
  1545. fprintf (stderr, "Invalid -t timeout.\n");
  1546. usage ();
  1547. exit (1);
  1548. }
  1549. if (strcmp (name, "tcp") == 0)
  1550. ft->param.tcp_timeout = timeout;
  1551. else if (strcmp (name, "tcp.rst") == 0)
  1552. ft->param.tcp_rst_timeout = timeout;
  1553. else if (strcmp (name, "tcp.fin") == 0)
  1554. ft->param.tcp_fin_timeout = timeout;
  1555. else if (strcmp (name, "udp") == 0)
  1556. ft->param.udp_timeout = timeout;
  1557. else if (strcmp (name, "icmp") == 0)
  1558. ft->param.icmp_timeout = timeout;
  1559. else if (strcmp (name, "general") == 0)
  1560. ft->param.general_timeout = timeout;
  1561. else if (strcmp (name, "maxlife") == 0)
  1562. ft->param.maximum_lifetime = timeout;
  1563. else if (strcmp (name, "expint") == 0)
  1564. ft->param.expiry_interval = timeout;
  1565. else {
  1566. fprintf (stderr, "Invalid -t name.\n");
  1567. usage ();
  1568. exit (1);
  1569. }
  1570. if (ft->param.general_timeout == 0) {
  1571. fprintf (stderr, "\"general\" flow timeout must be "
  1572. "greater than zero\n");
  1573. exit (1);
  1574. }
  1575. free (name);
  1576. }
  1577. static void
  1578. parse_hostport (const char *s, struct sockaddr *addr, socklen_t * len) {
  1579. char *orig, *host, *port;
  1580. struct addrinfo hints, *res;
  1581. int herr;
  1582. if ((host = orig = strdup (s)) == NULL) {
  1583. fprintf (stderr, "Out of memory\n");
  1584. exit (1);
  1585. }
  1586. if ((port = strrchr (host, ':')) == NULL ||
  1587. *(++port) == '\0' || *host == '\0') {
  1588. fprintf (stderr, "Invalid -n argument.\n");
  1589. usage ();
  1590. exit (1);
  1591. }
  1592. *(port - 1) = '\0';
  1593. /* Accept [host]:port for numeric IPv6 addresses */
  1594. if (*host == '[' && *(port - 2) == ']') {
  1595. host++;
  1596. *(port - 2) = '\0';
  1597. }
  1598. memset (&hints, '\0', sizeof (hints));
  1599. hints.ai_socktype = SOCK_DGRAM;
  1600. if ((herr = getaddrinfo (host, port, &hints, &res)) == -1) {
  1601. fprintf (stderr, "Address lookup failed: %s\n", gai_strerror (herr));
  1602. exit (1);
  1603. }
  1604. if (res == NULL || res->ai_addr == NULL) {
  1605. fprintf (stderr, "No addresses found for [%s]:%s\n", host, port);
  1606. exit (1);
  1607. }
  1608. if (res->ai_addrlen > *len) {
  1609. fprintf (stderr, "Address too long\n");
  1610. exit (1);
  1611. }
  1612. memcpy (addr, res->ai_addr, res->ai_addrlen);
  1613. free (orig);
  1614. *len = res->ai_addrlen;
  1615. }
  1616. static int
  1617. parse_hostports (const char *s, struct DESTINATION *dest, int max_dest) {
  1618. int i = 0;
  1619. char *hostport;
  1620. for (hostport = strsep ((char **) &s, ",");
  1621. hostport != NULL && i < max_dest;
  1622. hostport = strsep ((char **) &s, ",")) {
  1623. dest[i].sslen = sizeof (dest[i].ss);
  1624. parse_hostport (hostport, (struct sockaddr *) &dest[i].ss,
  1625. &dest[i].sslen);
  1626. i++;
  1627. }
  1628. return i;
  1629. }
  1630. /*
  1631. * Drop privileges and chroot, will exit on failure
  1632. */
  1633. static void
  1634. drop_privs (void) {
  1635. struct passwd *pw;
  1636. if ((pw = getpwnam (PRIVDROP_USER)) == NULL) {
  1637. logit (LOG_ERR, "Unable to find unprivileged user \"%s\"", PRIVDROP_USER);
  1638. exit (1);
  1639. }
  1640. if (chdir (PRIVDROP_CHROOT_DIR) != 0) {
  1641. logit (LOG_ERR, "Unable to chdir to chroot directory \"%s\": %s",
  1642. PRIVDROP_CHROOT_DIR, strerror (errno));
  1643. exit (1);
  1644. }
  1645. if (chroot (PRIVDROP_CHROOT_DIR) != 0) {
  1646. logit (LOG_ERR, "Unable to chroot to directory \"%s\": %s",
  1647. PRIVDROP_CHROOT_DIR, strerror (errno));
  1648. exit (1);
  1649. }
  1650. if (chdir ("/") != 0) {
  1651. logit (LOG_ERR, "Unable to chdir to chroot root: %s", strerror (errno));
  1652. exit (1);
  1653. }
  1654. if (setgroups (1, &pw->pw_gid) != 0) {
  1655. logit (LOG_ERR, "Couldn't setgroups (%u): %s",
  1656. (unsigned int) pw->pw_gid, strerror (errno));
  1657. exit (1);
  1658. }
  1659. #if defined(HAVE_SETRESGID)
  1660. if (setresgid (pw->pw_gid, pw->pw_gid, pw->pw_gid) == -1) {
  1661. #elif defined(HAVE_SETREGID)
  1662. if (setregid (pw->pw_gid, pw->pw_gid) == -1) {
  1663. #else
  1664. if (setegid (pw->pw_gid) == -1 || setgid (pw->pw_gid) == -1) {
  1665. #endif
  1666. logit (LOG_ERR, "Couldn't set gid (%u): %s",
  1667. (unsigned int) pw->pw_gid, strerror (errno));
  1668. exit (1);
  1669. }
  1670. #if defined(HAVE_SETRESUID)
  1671. if (setresuid (pw->pw_uid, pw->pw_uid, pw->pw_uid) == -1) {
  1672. #elif defined(HAVE_SETREUID)
  1673. if (setreuid (pw->pw_uid, pw->pw_uid) == -1) {
  1674. #else
  1675. if (seteuid (pw->pw_uid) == -1 || setuid (pw->pw_uid) == -1) {
  1676. #endif
  1677. logit (LOG_ERR, "Couldn't set uid (%u): %s",
  1678. (unsigned int) pw->pw_uid, strerror (errno));
  1679. exit (1);
  1680. }
  1681. }
  1682. int
  1683. main (int argc, char **argv) {
  1684. char *dev, *capfile, *bpf_prog;
  1685. const char *pidfile_path, *ctlsock_path;
  1686. extern char *optarg;
  1687. extern int optind;
  1688. int ch, dontfork_flag, linktype, ctlsock, err, always_v6, r, dest_idx;
  1689. int stop_collection_flag, exit_request, hoplimit;
  1690. pcap_t *pcap = NULL;
  1691. struct FLOWTRACK flowtrack;
  1692. struct NETFLOW_TARGET target;
  1693. struct CB_CTXT cb_ctxt;
  1694. struct pollfd pl[2];
  1695. struct DESTINATION *dest;
  1696. int protocol = IPPROTO_UDP;
  1697. int version = 0;
  1698. int rsock = 0, recvport = IPFIX_PORT, recvloop = 0;
  1699. #ifdef ENABLE_PTHREAD
  1700. int use_thread = 0;
  1701. pthread_t read_thread = 0;
  1702. pthread_mutex_init (&read_mutex, NULL);
  1703. pthread_cond_init (&read_cond, NULL);
  1704. #endif /* ENABLE_PTHREAD */
  1705. closefrom (STDERR_FILENO + 1);
  1706. init_flowtrack (&flowtrack);
  1707. memset (&target, '\0', sizeof (target));
  1708. target.dialect = &nf[0];
  1709. hoplimit = -1;
  1710. bpf_prog = NULL;
  1711. ctlsock = -1;
  1712. dev = capfile = NULL;
  1713. pidfile_path = DEFAULT_PIDFILE;
  1714. ctlsock_path = DEFAULT_CTLSOCK;
  1715. dontfork_flag = 0;
  1716. always_v6 = 0;
  1717. while ((ch =
  1718. getopt (argc, argv,
  1719. "6hdDL:T:i:r:f:t:n:m:p:c:v:s:P:A:baC:lR:M")) != -1) {
  1720. switch (ch) {
  1721. case '6':
  1722. always_v6 = 1;
  1723. break;
  1724. case 'h':
  1725. usage ();
  1726. return (0);
  1727. case 'D':
  1728. verbose_flag = 1;
  1729. always_v6 = 1;
  1730. /* FALLTHROUGH */
  1731. case 'd':
  1732. dontfork_flag = 1;
  1733. break;
  1734. case 'i':
  1735. if (capfile != NULL || dev != NULL) {
  1736. fprintf (stderr, "Packet source already " "specified.\n\n");
  1737. usage ();
  1738. exit (1);
  1739. }
  1740. #if defined(HAVE_STRSEP)
  1741. dev = strsep (&optarg, ":");
  1742. #else /* defined(HAVE_STRSEP) */
  1743. dev = strtok (optarg, ":");
  1744. #endif /* defined(HAVE_STRSEP) */
  1745. if (optarg != NULL) {
  1746. if (strlen (dev) > 0) {
  1747. if_index = (u_int16_t) atoi (dev);
  1748. }
  1749. dev = optarg;
  1750. }
  1751. if (strlen (dev) == 0) {
  1752. fprintf (stderr, "Wrong interface is specified.\n\n");
  1753. usage ();
  1754. exit (1);
  1755. }
  1756. if (verbose_flag)
  1757. fprintf (stderr, "Using %s (idx: %d)\n", dev, if_index);
  1758. break;
  1759. case 'r':
  1760. if (capfile != NULL || dev != NULL) {
  1761. fprintf (stderr, "Packet source already " "specified.\n\n");
  1762. usage ();
  1763. exit (1);
  1764. }
  1765. capfile = optarg;
  1766. dontfork_flag = 1;
  1767. ctlsock_path = NULL;
  1768. break;
  1769. case 't':
  1770. /* Will exit on failure */
  1771. set_timeout (&flowtrack, optarg);
  1772. break;
  1773. case 'T':
  1774. if (strcasecmp (optarg, "full") == 0)
  1775. flowtrack.param.track_level = TRACK_FULL;
  1776. else if (strcasecmp (optarg, "port") == 0)
  1777. flowtrack.param.track_level = TRACK_IP_PROTO_PORT;
  1778. else if (strcasecmp (optarg, "proto") == 0)
  1779. flowtrack.param.track_level = TRACK_IP_PROTO;
  1780. else if (strcasecmp (optarg, "ip") == 0)
  1781. flowtrack.param.track_level = TRACK_IP_ONLY;
  1782. else if (strcasecmp (optarg, "vlan") == 0)
  1783. flowtrack.param.track_level = TRACK_FULL_VLAN;
  1784. else if (strcasecmp (optarg, "ether") == 0)
  1785. flowtrack.param.track_level = TRACK_FULL_VLAN_ETHER;
  1786. else {
  1787. fprintf (stderr, "Unknown flow tracking " "level\n");
  1788. usage ();
  1789. exit (1);
  1790. }
  1791. track_level = flowtrack.param.track_level;
  1792. break;
  1793. case 'L':
  1794. hoplimit = atoi (optarg);
  1795. if (hoplimit < 0 || hoplimit > 255) {
  1796. fprintf (stderr, "Invalid hop limit\n\n");
  1797. usage ();
  1798. exit (1);
  1799. }
  1800. break;
  1801. case 'm':
  1802. if ((flowtrack.param.max_flows = atoi (optarg)) < 0) {
  1803. fprintf (stderr, "Invalid maximum flows\n\n");
  1804. usage ();
  1805. exit (1);
  1806. }
  1807. break;
  1808. case 'n':
  1809. /* Will exit on failure */
  1810. target.num_destinations =
  1811. parse_hostports (optarg, target.destinations,
  1812. SOFTFLOWD_MAX_DESTINATIONS);
  1813. break;
  1814. case 'p':
  1815. pidfile_path = optarg;
  1816. break;
  1817. case 'c':
  1818. if (strcmp (optarg, "none") == 0)
  1819. ctlsock_path = NULL;
  1820. else
  1821. ctlsock_path = optarg;
  1822. break;
  1823. case 'v':
  1824. if (!strncmp (optarg, "psamp", sizeof ("psamp"))) {
  1825. flowtrack.param.is_psamp = 1;
  1826. break;
  1827. }
  1828. #ifdef ENABLE_NTOPNG
  1829. if (!strncmp (optarg, SOFTFLOWD_NF_VERSION_NTOPNG_STRING,
  1830. sizeof (SOFTFLOWD_NF_VERSION_NTOPNG_STRING))) {
  1831. version = SOFTFLOWD_NF_VERSION_NTOPNG;
  1832. }
  1833. #endif /* ENABLE_NTOPNG */
  1834. version = version ? version : atoi (optarg);
  1835. target.dialect = lookup_netflow_sender (version);
  1836. if (target.dialect == NULL) {
  1837. fprintf (stderr, "Invalid NetFlow version\n");
  1838. exit (1);
  1839. }
  1840. break;
  1841. case 's':
  1842. flowtrack.param.option.sample = atoi (optarg);
  1843. if (flowtrack.param.option.sample < 2) {
  1844. flowtrack.param.option.sample = 0;
  1845. }
  1846. break;
  1847. case 'P':
  1848. if (strcasecmp (optarg, "udp") == 0)
  1849. protocol = IPPROTO_UDP;
  1850. else if (strcasecmp (optarg, "tcp") == 0)
  1851. protocol = IPPROTO_TCP;
  1852. #ifdef IPPROTO_SCTP
  1853. else if (strcasecmp (optarg, "sctp") == 0)
  1854. protocol = IPPROTO_SCTP;
  1855. #endif
  1856. else {
  1857. fprintf (stderr, "Unknown transport layer protocol" "\n");
  1858. usage ();
  1859. exit (1);
  1860. }
  1861. break;
  1862. case 'A':
  1863. if (strcasecmp (optarg, "sec") == 0)
  1864. flowtrack.param.time_format = 's';
  1865. else if (strcasecmp (optarg, "milli") == 0)
  1866. flowtrack.param.time_format = 'm';
  1867. else if (strcasecmp (optarg, "micro") == 0)
  1868. flowtrack.param.time_format = 'M';
  1869. else if (strcasecmp (optarg, "nano") == 0)
  1870. flowtrack.param.time_format = 'n';
  1871. else {
  1872. fprintf (stderr, "Unknown time format" "\n");
  1873. usage ();
  1874. exit (1);
  1875. }
  1876. break;
  1877. case 'b':
  1878. flowtrack.param.bidirection = 1;
  1879. break;
  1880. case 'a':
  1881. flowtrack.param.adjust_time = 1;
  1882. break;
  1883. case 'C': /* Capture Length */
  1884. snaplen = atoi (optarg);
  1885. break;
  1886. case 'l': // load balancing
  1887. target.is_loadbalance = 1;
  1888. break;
  1889. case 'R':
  1890. recvport = atoi (optarg);
  1891. if (recvport < 0 && recvport > 65535)
  1892. recvport = IPFIX_PORT;
  1893. rsock = recvsock ((uint16_t) recvport);
  1894. break;
  1895. case 'M':
  1896. #ifdef ENABLE_PTHREAD
  1897. use_thread = 1;
  1898. #endif /* ENABLE_PTHREAD */
  1899. break;
  1900. default:
  1901. fprintf (stderr, "Invalid commandline option.\n");
  1902. usage ();
  1903. exit (1);
  1904. }
  1905. }
  1906. if (capfile == NULL && dev == NULL && rsock <= 0) {
  1907. fprintf (stderr, "-i, -r or -R option not specified.\n");
  1908. usage ();
  1909. exit (1);
  1910. }
  1911. /* join remaining arguments (if any) into bpf program */
  1912. bpf_prog = argv_join (argc - optind, argv + optind);
  1913. /* Will exit on failure */
  1914. if (capfile != NULL || dev != NULL)
  1915. setup_packet_capture (&pcap, &linktype, dev, capfile, bpf_prog,
  1916. target.dialect->v6_capable || always_v6);
  1917. else if (rsock > 0)
  1918. linktype = 1; //LINKTYPE_ETHERNET
  1919. /* Netflow send socket */
  1920. for (dest_idx = 0; dest_idx < target.num_destinations; dest_idx++) {
  1921. dest = &target.destinations[dest_idx];
  1922. if (dest->ss.ss_family != 0) {
  1923. if ((err = getnameinfo ((struct sockaddr *) &dest->ss, dest->sslen,
  1924. dest->hostname, sizeof (dest->hostname),
  1925. dest->servname, sizeof (dest->servname),
  1926. NI_NUMERICHOST | NI_NUMERICSERV)) == -1) {
  1927. fprintf (stderr, "getnameinfo: %d\n", err);
  1928. exit (1);
  1929. }
  1930. #ifdef ENABLE_NTOPNG
  1931. if (target.dialect->version == SOFTFLOWD_NF_VERSION_NTOPNG) {
  1932. int rc = connect_ntopng (dest->hostname, dest->servname, &dest->zmq);
  1933. if (rc) {
  1934. fprintf (stderr,
  1935. "Could not create ZeroMQ socket for %s:%s: (%d) %s\n",
  1936. dest->hostname, dest->servname, rc, strerror (rc));
  1937. exit (1);
  1938. }
  1939. } else
  1940. #endif
  1941. dest->sock = connsock (&dest->ss, dest->sslen, hoplimit, protocol);
  1942. }
  1943. }
  1944. /* Control socket */
  1945. if (ctlsock_path != NULL)
  1946. ctlsock = unix_listener (ctlsock_path); /* Will exit on fail */
  1947. if (dontfork_flag) {
  1948. loginit (PROGNAME, 1);
  1949. } else {
  1950. FILE *pidfile;
  1951. r = daemon (0, 0);
  1952. loginit (PROGNAME, 0);
  1953. if ((pidfile = fopen (pidfile_path, "r")) != NULL) {
  1954. int pid;
  1955. if (fscanf (pidfile, "%u", &pid) == EOF) {
  1956. //fscanf error
  1957. if (ferror (pidfile)) {
  1958. perror ("fscanf");
  1959. }
  1960. }
  1961. fclose (pidfile);
  1962. /* Check if the pid exists */
  1963. int pidfree = (kill (pid, 0) && errno == ESRCH);
  1964. if (!pidfree) {
  1965. fprintf (stderr, "Already running under pid %u\n", pid);
  1966. exit (1);
  1967. }
  1968. }
  1969. if ((pidfile = fopen (pidfile_path, "w")) == NULL) {
  1970. fprintf (stderr, "Couldn't open pidfile %s: %s\n",
  1971. pidfile_path, strerror (errno));
  1972. exit (1);
  1973. }
  1974. fprintf (pidfile, "%u\n", (unsigned int) getpid ());
  1975. fclose (pidfile);
  1976. signal (SIGINT, sighand_graceful_shutdown);
  1977. signal (SIGTERM, sighand_graceful_shutdown);
  1978. signal (SIGSEGV, sighand_other);
  1979. setprotoent (1);
  1980. drop_privs ();
  1981. }
  1982. logit (LOG_NOTICE, "%s v%s starting data collection", PROGNAME, PROGVER);
  1983. for (dest_idx = 0; dest_idx < target.num_destinations; dest_idx++) {
  1984. dest = &target.destinations[dest_idx];
  1985. if (dest->ss.ss_family != 0) {
  1986. logit (LOG_NOTICE, "Exporting flows to [%s]:%s", dest->hostname,
  1987. dest->servname);
  1988. }
  1989. }
  1990. flowtrack.param.option.meteringProcessId = getpid ();
  1991. /* Main processing loop */
  1992. gettimeofday (&flowtrack.param.system_boot_time, NULL);
  1993. stop_collection_flag = 0;
  1994. memset (&cb_ctxt, '\0', sizeof (cb_ctxt));
  1995. cb_ctxt.ft = &flowtrack;
  1996. cb_ctxt.target = &target;
  1997. cb_ctxt.linktype = linktype;
  1998. cb_ctxt.want_v6 = target.dialect->v6_capable || always_v6;
  1999. #ifdef ENABLE_PTHREAD
  2000. if (use_thread) {
  2001. if (pthread_create
  2002. (&read_thread, NULL, process_packet_loop, (void *) &cb_ctxt) < 0) {
  2003. perror ("pthread_create error");
  2004. exit (1);
  2005. }
  2006. }
  2007. #endif /* ENABLE_PTHREAD */
  2008. for (r = 0; graceful_shutdown_request == 0; r = 0) {
  2009. /*
  2010. * Silly libpcap's timeout function doesn't work, so we
  2011. * do it here (only if we are reading live)
  2012. */
  2013. if (capfile == NULL && (dev != NULL || rsock > 0)) { //online
  2014. memset (pl, '\0', sizeof (pl));
  2015. /* This can only be set via the control socket */
  2016. if (!stop_collection_flag && dev != NULL) {
  2017. pl[0].events = POLLIN | POLLERR | POLLHUP;
  2018. pl[0].fd = pcap_fileno (pcap);
  2019. } else if (!stop_collection_flag && rsock > 0) {
  2020. pl[0].fd = rsock;
  2021. pl[0].events = POLLIN | POLLERR | POLLHUP;
  2022. }
  2023. if (ctlsock != -1) {
  2024. pl[1].fd = ctlsock;
  2025. pl[1].events = POLLIN | POLLERR | POLLHUP;
  2026. }
  2027. r = poll (pl, (ctlsock == -1) ? 1 : 2, next_expire (&flowtrack));
  2028. if (r == -1 && errno != EINTR) {
  2029. logit (LOG_ERR, "Exiting on poll: %s", strerror (errno));
  2030. break;
  2031. }
  2032. }
  2033. /* Accept connection on control socket if present */
  2034. if (ctlsock != -1 && pl[1].revents != 0) {
  2035. if (accept_control (ctlsock, &target, &flowtrack, pcap,
  2036. &exit_request, &stop_collection_flag) != 0)
  2037. break;
  2038. }
  2039. /* If we have data, run it through libpcap */
  2040. if (!stop_collection_flag && (capfile != NULL || pl[0].revents != 0)) {
  2041. if (capfile != NULL || dev != NULL) {
  2042. #ifdef ENABLE_PTHREAD
  2043. if (use_thread)
  2044. r =
  2045. pcap_dispatch (pcap, flowtrack.param.max_flows, pcap_memcpy,
  2046. NULL);
  2047. else
  2048. #endif /* ENABLE_PTHREAD */
  2049. r = pcap_dispatch (pcap, flowtrack.param.max_flows, flow_cb,
  2050. (void *) &cb_ctxt);
  2051. if (r == -1) {
  2052. logit (LOG_ERR, "Exiting on pcap_dispatch: %s", pcap_geterr (pcap));
  2053. break;
  2054. } else if (r == 0 && capfile != NULL) {
  2055. logit (LOG_NOTICE, "Shutting down after " "pcap EOF");
  2056. graceful_shutdown_request = 1;
  2057. break;
  2058. }
  2059. } else if (rsock > 0) {
  2060. for (recvloop = 0;
  2061. recvloop < flowtrack.param.max_flows && pl[0].revents != 0;
  2062. recvloop++) {
  2063. r = recv_psamp (rsock, &cb_ctxt);
  2064. if (r == -1) {
  2065. logit (LOG_ERR, "recv_psamp error");
  2066. break;
  2067. }
  2068. if (recvloop + 1 == flowtrack.param.max_flows) {
  2069. r = poll (pl, 1, next_expire (&flowtrack));
  2070. if (r == -1 && errno != EINTR) {
  2071. logit (LOG_ERR, "Exiting on poll: %s", strerror (errno));
  2072. break;
  2073. }
  2074. }
  2075. }
  2076. }
  2077. }
  2078. r = 0;
  2079. /* Fatal error from per-packet functions */
  2080. if (cb_ctxt.fatal) {
  2081. logit (LOG_WARNING, "Fatal error - exiting immediately");
  2082. break;
  2083. }
  2084. /*
  2085. * Expiry processing happens every recheck_rate seconds
  2086. * or whenever we have exceeded the maximum number of active
  2087. * flows
  2088. */
  2089. if (flowtrack.param.num_flows > flowtrack.param.max_flows ||
  2090. next_expire (&flowtrack) == 0) {
  2091. expiry_check:
  2092. /*
  2093. * If we are reading from a capture file, we never
  2094. * expire flows based on time - instead we only
  2095. * expire flows when the flow table is full.
  2096. */
  2097. if (check_expired (&flowtrack, &target,
  2098. capfile == NULL ? CE_EXPIRE_NORMAL :
  2099. CE_EXPIRE_FORCED) < 0)
  2100. logit (LOG_WARNING, "Unable to export flows");
  2101. /*
  2102. * If we are over max_flows, force-expire the oldest
  2103. * out first and immediately reprocess to evict them
  2104. */
  2105. if (flowtrack.param.num_flows > flowtrack.param.max_flows) {
  2106. force_expire (&flowtrack,
  2107. flowtrack.param.num_flows - flowtrack.param.max_flows);
  2108. goto expiry_check;
  2109. }
  2110. }
  2111. }
  2112. /* Flags set by signal handlers or control socket */
  2113. if (graceful_shutdown_request) {
  2114. logit (LOG_WARNING, "Shutting down on user request");
  2115. check_expired (&flowtrack, &target, CE_EXPIRE_ALL);
  2116. } else if (exit_request)
  2117. logit (LOG_WARNING, "Exiting immediately on user request");
  2118. else
  2119. logit (LOG_ERR, "Exiting immediately on internal error");
  2120. if (capfile != NULL && dontfork_flag)
  2121. statistics (&flowtrack, stdout, pcap);
  2122. #ifdef ENABLE_PTHREAD
  2123. if (use_thread) {
  2124. pthread_cond_signal (&read_cond);
  2125. pthread_join (read_thread, NULL);
  2126. }
  2127. #endif /* ENABLE_PTHREAD */
  2128. pcap_close (pcap);
  2129. for (dest_idx = 0; dest_idx < target.num_destinations; dest_idx++) {
  2130. dest = &target.destinations[dest_idx];
  2131. if (dest->sock != -1)
  2132. close (dest->sock);
  2133. }
  2134. unlink (pidfile_path);
  2135. if (ctlsock_path != NULL)
  2136. unlink (ctlsock_path);
  2137. if (rsock > 0)
  2138. close (rsock);
  2139. return (r == 0 ? 0 : 1);
  2140. }