123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302 |
- /*
- * Copyright (c) 2002 Damien Miller. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
- #ifndef _SOFTFLOWD_H
- #define _SOFTFLOWD_H
- #include "common.h"
- #include "sys-tree.h"
- #include "freelist.h"
- #include "treetype.h"
- #include <pcap.h>
- #ifdef ENABLE_PTHREAD
- #include <pthread.h>
- extern int use_thread;
- #endif /* ENABLE_PTHREAD */
- #ifdef ENABLE_NTOPNG
- #include <zmq.h>
- // The version field in NetFow and IPFIX headers is 16 bits unsiged int.
- // If the version number is over 0x7fff0000, it is unique number in softflowd.
- #define SOFTFLOWD_NF_VERSION_NTOPNG (0x7fff0001)
- #define SOFTFLOWD_NF_VERSION_NTOPNG_STRING "ntopng"
- struct ZMQ {
- void *context;
- void *socket;
- };
- #endif /* ENABLE_NTOPNG */
- /* User to setuid to and directory to chroot to when we drop privs */
- #ifndef PRIVDROP_USER
- #define PRIVDROP_USER "nobody"
- #endif
- #ifndef PRIVDROP_CHROOT_DIR
- #define PRIVDROP_CHROOT_DIR "/var/empty"
- #endif
- /*
- * Capture length for libpcap: Must fit the link layer header, plus
- * a maximally sized ip/ipv6 header and most of a TCP header
- */
- #define LIBPCAP_SNAPLEN_V4 96
- #define LIBPCAP_SNAPLEN_V6 160
- /*
- * Timeouts
- */
- #define DEFAULT_TCP_TIMEOUT 3600
- #define DEFAULT_TCP_RST_TIMEOUT 120
- #define DEFAULT_TCP_FIN_TIMEOUT 300
- #define DEFAULT_UDP_TIMEOUT 300
- #define DEFAULT_ICMP_TIMEOUT 300
- #define DEFAULT_GENERAL_TIMEOUT 3600
- #define DEFAULT_MAXIMUM_LIFETIME (3600*24*7)
- #define DEFAULT_EXPIRY_INTERVAL 60
- /*
- * Default maximum number of flow to track simultaneously
- * 8192 corresponds to just under 1Mb of flow data
- */
- #define DEFAULT_MAX_FLOWS 8192
- #define NF_VERSION_IPFIX 10
- /* Store a couple of statistics, maybe more in the future */
- struct STATISTIC {
- double min, mean, max;
- };
- /* Flow tracking levels */
- #define TRACK_FULL 1 /* src/dst/addr/port/proto/tos 6-tuple */
- #define TRACK_IP_PROTO_PORT 2 /* src/dst/addr/port/proto 5-tuple */
- #define TRACK_IP_PROTO 3 /* src/dst/proto 3-tuple */
- #define TRACK_IP_ONLY 4 /* src/dst tuple */
- #define TRACK_FULL_VLAN 5 /* src/dst/addr/port/proto/tos/vlanid 7-tuple */
- #define TRACK_FULL_VLAN_ETHER 6 /* src/dst/addr/port/proto/tos/vlanid/src-mac/dst-mac 9-tuple */
- #define SOFTFLOWD_MAX_DESTINATIONS 16
- /*
- * This structure contains optional information carried by Option Data
- * Record.
- */
- struct OPTION {
- uint32_t sample;
- pid_t meteringProcessId;
- };
- struct FLOWTRACKPARAMETERS {
- unsigned int num_flows; /* # of active flows */
- unsigned int max_flows; /* Max # of active flows */
- u_int64_t next_flow_seq; /* Next flow ID */
- /* Stuff related to flow export */
- struct timeval system_boot_time; /* SysUptime */
- int track_level; /* See TRACK_* above */
- /* Flow timeouts */
- int tcp_timeout; /* Open TCP connections */
- int tcp_rst_timeout; /* TCP flows after RST */
- int tcp_fin_timeout; /* TCP flows after bidi FIN */
- int udp_timeout; /* UDP flows */
- int icmp_timeout; /* ICMP flows */
- int general_timeout; /* Everything else */
- int maximum_lifetime; /* Maximum life for flows */
- int expiry_interval; /* Interval between expiries */
- /* Statistics */
- u_int64_t total_packets; /* # of good packets */
- u_int64_t non_sampled_packets; /* # of not sampled packets */
- u_int64_t frag_packets; /* # of fragmented packets */
- u_int64_t non_ip_packets; /* # of not-IP packets */
- u_int64_t bad_packets; /* # of bad packets */
- u_int64_t flows_expired; /* # expired */
- u_int64_t flows_exported; /* # of flows sent */
- u_int64_t flows_dropped; /* # of flows dropped */
- u_int64_t flows_force_expired; /* # of flows forced out */
- u_int64_t packets_sent; /* # netflow packets sent */
- u_int64_t records_sent; /* # netflow records sent */
- struct STATISTIC duration; /* Flow duration */
- struct STATISTIC octets; /* Bytes (bidir) */
- struct STATISTIC packets; /* Packets (bidir) */
- /* Per protocol statistics */
- u_int64_t flows_pp[256];
- u_int64_t octets_pp[256];
- u_int64_t packets_pp[256];
- struct STATISTIC duration_pp[256];
- /* Timeout statistics */
- u_int64_t expired_general;
- u_int64_t expired_tcp;
- u_int64_t expired_tcp_rst;
- u_int64_t expired_tcp_fin;
- u_int64_t expired_udp;
- u_int64_t expired_icmp;
- u_int64_t expired_maxlife;
- u_int64_t expired_overbytes;
- u_int64_t expired_maxflows;
- u_int64_t expired_flush;
- /* Optional information */
- struct OPTION option;
- char time_format;
- u_int8_t bidirection;
- u_int8_t adjust_time;
- u_int8_t is_psamp;
- struct timeval last_packet_time;
- };
- /*
- * This structure is the root of the flow tracking system.
- * It holds the root of the tree of active flows and the head of the
- * tree of expiry events. It also collects miscellaneous statistics
- */
- struct FLOWTRACK {
- /* The flows and their expiry events */
- FLOW_HEAD (FLOWS, FLOW) flows; /* Top of flow tree */
- EXPIRY_HEAD (EXPIRIES, EXPIRY) expiries; /* Top of expiries tree */
- struct freelist flow_freelist; /* Freelist for flows */
- struct freelist expiry_freelist; /* Freelist for expiry events */
- struct FLOWTRACKPARAMETERS param;
- };
- /*
- * This structure is an entry in the tree of flows that we are
- * currently tracking.
- *
- * Because flows are matched _bi-directionally_, they must be stored in
- * a canonical format: the numerically lowest address and port number must
- * be stored in the first address and port array slot respectively.
- */
- struct FLOW {
- /* Housekeeping */
- struct EXPIRY *expiry; /* Pointer to expiry record */
- FLOW_ENTRY (FLOW) trp; /* Tree pointer */
- /* Per-flow statistics (all in _host_ byte order) */
- u_int64_t flow_seq; /* Flow ID */
- struct timeval flow_start; /* Time of creation */
- struct timeval flow_last; /* Time of last traffic */
- /* Per-endpoint statistics (all in _host_ byte order) */
- u_int32_t octets[2]; /* Octets so far */
- u_int32_t packets[2]; /* Packets so far */
- /* Flow identity (all are in network byte order) */
- int af; /* Address family of flow */
- u_int32_t ip6_flowlabel[2]; /* IPv6 Flowlabel */
- union {
- struct in_addr v4;
- struct in6_addr v6;
- } addr[2]; /* Endpoint addresses */
- u_int16_t port[2]; /* Endpoint ports */
- u_int8_t tcp_flags[2]; /* Cumulative OR of flags */
- u_int8_t tos[2]; /* Tos */
- u_int16_t vlanid[2]; /* vlanid */
- uint8_t ethermac[2][6];
- u_int8_t protocol; /* Protocol */
- };
- /*
- * This is an entry in the tree of expiry events. The tree is used to
- * avoid traversion the whole tree of active flows looking for ones to
- * expire. "expires_at" is the time at which the flow should be discarded,
- * or zero if it is scheduled for immediate disposal.
- *
- * When a flow which hasn't been scheduled for immediate expiry registers
- * traffic, it is deleted from its current position in the tree and
- * re-inserted (subject to its updated timeout).
- *
- * Expiry scans operate by starting at the head of the tree and expiring
- * each entry with expires_at < now
- *
- */
- struct EXPIRY {
- EXPIRY_ENTRY (EXPIRY) trp; /* Tree pointer */
- struct FLOW *flow; /* pointer to flow */
- u_int32_t expires_at; /* time_t */
- enum {
- R_GENERAL, R_TCP, R_TCP_RST, R_TCP_FIN, R_UDP, R_ICMP,
- R_MAXLIFE, R_OVERBYTES, R_OVERFLOWS, R_FLUSH
- } reason;
- };
- struct DESTINATION {
- char *arg;
- int sock;
- struct sockaddr_storage ss;
- socklen_t sslen;
- char hostname[NI_MAXHOST];
- char servname[NI_MAXSERV];
- #ifdef ENABLE_NTOPNG
- struct ZMQ zmq;
- #endif
- };
- /* Describes a location where we send NetFlow packets to */
- struct NETFLOW_TARGET {
- int num_destinations;
- struct DESTINATION destinations[SOFTFLOWD_MAX_DESTINATIONS];
- const struct NETFLOW_SENDER *dialect;
- u_int8_t is_loadbalance;
- };
- struct SENDPARAMETER {
- struct FLOW **flows;
- int num_flows;
- struct NETFLOW_TARGET *target;
- u_int16_t ifidx;
- struct FLOWTRACKPARAMETERS *param;
- int verbose_flag;
- };
- /* Context for libpcap callback functions */
- struct CB_CTXT {
- struct FLOWTRACK *ft;
- struct NETFLOW_TARGET *target;
- int linktype;
- int fatal;
- int want_v6;
- };
- /* Prototype for functions shared from softflowd.c */
- u_int32_t timeval_sub_ms (const struct timeval *t1, const struct timeval *t2);
- int send_multi_destinations (int num_destinations,
- struct DESTINATION *destinations,
- u_int8_t is_loadbalnce, u_int8_t * packet,
- int size);
- void flow_cb (u_char * user_data, const struct pcap_pkthdr *phdr,
- const u_char * pkt);
- /* Prototypes for functions to send NetFlow packets, from netflow*.c */
- int send_netflow_v1 (struct SENDPARAMETER sp);
- int send_netflow_v5 (struct SENDPARAMETER sp);
- #ifdef ENABLE_NTOPNG
- /* Protypes for ntopng.c */
- int connect_ntopng (const char *host, const char *port, struct ZMQ *zmq);
- int send_ntopng (struct SENDPARAMETER sp);
- #endif /* ENABLE_NTOPNG */
- #endif /* _SOFTFLOWD_H */
|