1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3 *
4 * Copyright (c) 2010-2011 Alexander V. Chernikov <melifaro@ipfw.ru>
5 * Copyright (c) 2004-2005 Gleb Smirnoff <glebius@FreeBSD.org>
6 * Copyright (c) 2001-2003 Roman V. Palagin <romanp@unshadow.net>
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * SUCH DAMAGE.
29 *
30 * $SourceForge: ng_netflow.h,v 1.26 2004/09/04 15:44:55 glebius Exp $
31 * $FreeBSD: releng/12.0/sys/netgraph/netflow/ng_netflow.h 326272 2017-11-27 15:23:17Z pfg $
32 */
33
34 #ifndef _NG_NETFLOW_H_
35 #define _NG_NETFLOW_H_
36
37 #define NG_NETFLOW_NODE_TYPE "netflow"
38 #define NGM_NETFLOW_COOKIE 1365756954
39 #define NGM_NETFLOW_V9_COOKIE 1349865386
40
41 #define NG_NETFLOW_MAXIFACES USHRT_MAX
42
43 /* Hook names */
44
45 #define NG_NETFLOW_HOOK_DATA "iface"
46 #define NG_NETFLOW_HOOK_OUT "out"
47 #define NG_NETFLOW_HOOK_EXPORT "export"
48 #define NG_NETFLOW_HOOK_EXPORT9 "export9"
49
50 /* This define effectively disable (v5) netflow export hook! */
51 /* #define COUNTERS_64 */
52
53 /* Netgraph commands understood by netflow node */
54 enum {
55 NGM_NETFLOW_INFO = 1|NGM_READONLY|NGM_HASREPLY, /* get node info */
56 NGM_NETFLOW_IFINFO = 2|NGM_READONLY|NGM_HASREPLY, /* get iface info */
57 NGM_NETFLOW_SHOW = 3|NGM_READONLY|NGM_HASREPLY, /* show ip cache flow */
58 NGM_NETFLOW_SETDLT = 4, /* set data-link type */
59 NGM_NETFLOW_SETIFINDEX = 5, /* set interface index */
60 NGM_NETFLOW_SETTIMEOUTS = 6, /* set active/inactive flow timeouts */
61 NGM_NETFLOW_SETCONFIG = 7, /* set flow generation options */
62 NGM_NETFLOW_SETTEMPLATE = 8, /* set v9 flow template periodic */
63 NGM_NETFLOW_SETMTU = 9, /* set outgoing interface MTU */
64 NGM_NETFLOW_V9INFO = 10|NGM_READONLY|NGM_HASREPLY, /* get v9 info */
65 };
66
67 /* This structure is returned by the NGM_NETFLOW_INFO message */
68 struct ng_netflow_info {
69 uint64_t nfinfo_bytes; /* accounted IPv4 bytes */
70 uint64_t nfinfo_packets; /* accounted IPv4 packets */
71 uint64_t nfinfo_bytes6; /* accounted IPv6 bytes */
72 uint64_t nfinfo_packets6; /* accounted IPv6 packets */
73 uint64_t nfinfo_sbytes; /* skipped IPv4 bytes */
74 uint64_t nfinfo_spackets; /* skipped IPv4 packets */
75 uint64_t nfinfo_sbytes6; /* skipped IPv6 bytes */
76 uint64_t nfinfo_spackets6; /* skipped IPv6 packets */
77 uint64_t nfinfo_act_exp; /* active expiries */
78 uint64_t nfinfo_inact_exp; /* inactive expiries */
79 uint32_t nfinfo_used; /* used cache records */
80 uint32_t nfinfo_used6; /* used IPv6 cache records */
81 uint32_t nfinfo_alloc_failed; /* failed allocations */
82 uint32_t nfinfo_export_failed; /* failed exports */
83 uint32_t nfinfo_export9_failed; /* failed exports */
84 uint32_t nfinfo_realloc_mbuf; /* reallocated mbufs */
85 uint32_t nfinfo_alloc_fibs; /* fibs allocated */
86 uint32_t nfinfo_inact_t; /* flow inactive timeout */
87 uint32_t nfinfo_act_t; /* flow active timeout */
88 };
89
90 /* Parse the info structure */
91 #define NG_NETFLOW_INFO_TYPE { \
92 { "IPv4 bytes", &ng_parse_uint64_type },\
93 { "IPv4 packets", &ng_parse_uint64_type },\
94 { "IPv6 bytes", &ng_parse_uint64_type },\
95 { "IPv6 packets", &ng_parse_uint64_type },\
96 { "IPv4 skipped bytes", &ng_parse_uint64_type },\
97 { "IPv4 skipped packets", &ng_parse_uint64_type },\
98 { "IPv6 skipped bytes", &ng_parse_uint64_type },\
99 { "IPv6 skipped packets", &ng_parse_uint64_type },\
100 { "Active expiries", &ng_parse_uint64_type },\
101 { "Inactive expiries", &ng_parse_uint64_type },\
102 { "IPv4 records used", &ng_parse_uint32_type },\
103 { "IPv6 records used", &ng_parse_uint32_type },\
104 { "Failed allocations", &ng_parse_uint32_type },\
105 { "V5 failed exports", &ng_parse_uint32_type },\
106 { "V9 failed exports", &ng_parse_uint32_type },\
107 { "mbuf reallocations", &ng_parse_uint32_type },\
108 { "fibs allocated", &ng_parse_uint32_type },\
109 { "Inactive timeout", &ng_parse_uint32_type },\
110 { "Active timeout", &ng_parse_uint32_type },\
111 { NULL } \
112 }
113
114
115 /* This structure is returned by the NGM_NETFLOW_IFINFO message */
116 struct ng_netflow_ifinfo {
117 uint32_t ifinfo_packets; /* number of packets for this iface */
118 uint8_t ifinfo_dlt; /* Data Link Type, DLT_XXX */
119 #define MAXDLTNAMELEN 20
120 uint16_t ifinfo_index; /* connected iface index */
121 uint32_t conf;
122 };
123
124
125 /* This structure is passed to NGM_NETFLOW_SETDLT message */
126 struct ng_netflow_setdlt {
127 uint16_t iface; /* which iface dlt change */
128 uint8_t dlt; /* DLT_XXX from bpf.h */
129 };
130
131 /* This structure is passed to NGM_NETFLOW_SETIFINDEX */
132 struct ng_netflow_setifindex {
133 uint16_t iface; /* which iface index change */
134 uint16_t index; /* new index */
135 };
136
137 /* This structure is passed to NGM_NETFLOW_SETTIMEOUTS */
138 struct ng_netflow_settimeouts {
139 uint32_t inactive_timeout; /* flow inactive timeout */
140 uint32_t active_timeout; /* flow active timeout */
141 };
142
143 #define NG_NETFLOW_CONF_INGRESS 0x01 /* Account on ingress */
144 #define NG_NETFLOW_CONF_EGRESS 0x02 /* Account on egress */
145 #define NG_NETFLOW_CONF_ONCE 0x04 /* Add tag to account only once */
146 #define NG_NETFLOW_CONF_THISONCE 0x08 /* Account once in current node */
147 #define NG_NETFLOW_CONF_NOSRCLOOKUP 0x10 /* No radix lookup on src */
148 #define NG_NETFLOW_CONF_NODSTLOOKUP 0x20 /* No radix lookup on dst */
149
150 #define NG_NETFLOW_IS_FRAG 0x01
151 #define NG_NETFLOW_FLOW_FLAGS (NG_NETFLOW_CONF_NOSRCLOOKUP|\
152 NG_NETFLOW_CONF_NODSTLOOKUP)
153
154 /* This structure is passed to NGM_NETFLOW_SETCONFIG */
155 struct ng_netflow_setconfig {
156 uint16_t iface; /* which iface config change */
157 uint32_t conf; /* new config */
158 };
159
160 /* This structure is passed to NGM_NETFLOW_SETTEMPLATE */
161 struct ng_netflow_settemplate {
162 uint16_t time; /* max time between announce */
163 uint16_t packets; /* max packets between announce */
164 };
165
166 /* This structure is passed to NGM_NETFLOW_SETMTU */
167 struct ng_netflow_setmtu {
168 uint16_t mtu; /* MTU for packet */
169 };
170
171 /* This structure is used in NGM_NETFLOW_SHOW request/response */
172 struct ngnf_show_header {
173 u_char version; /* IPv4 or IPv6 */
174 uint32_t hash_id; /* current hash index */
175 uint32_t list_id; /* current record number in hash */
176 uint32_t nentries; /* number of records in response */
177 };
178
179 /* This structure is used in NGM_NETFLOW_V9INFO message */
180 struct ng_netflow_v9info {
181 uint16_t templ_packets; /* v9 template packets */
182 uint16_t templ_time; /* v9 template time */
183 uint16_t mtu; /* v9 MTU */
184 };
185
186 /* XXXGL
187 * Somewhere flow_rec6 is casted to flow_rec, and flow6_entry_data is
188 * casted to flow_entry_data. After casting, fle->r.fib is accessed.
189 * So beginning of these structs up to fib should be kept common.
190 */
191
192 /* This is unique data, which identifies flow */
193 struct flow_rec {
194 uint16_t flow_type;
195 uint16_t fib;
196 struct in_addr r_src;
197 struct in_addr r_dst;
198 union {
199 struct {
200 uint16_t s_port; /* source TCP/UDP port */
201 uint16_t d_port; /* destination TCP/UDP port */
202 } dir;
203 uint32_t both;
204 } ports;
205 union {
206 struct {
207 u_char prot; /* IP protocol */
208 u_char tos; /* IP TOS */
209 uint16_t i_ifx; /* input interface index */
210 } i;
211 uint32_t all;
212 } misc;
213 };
214
215 /* This is unique data, which identifies flow */
216 struct flow6_rec {
217 uint16_t flow_type;
218 uint16_t fib;
219 union {
220 struct in_addr r_src;
221 struct in6_addr r_src6;
222 } src;
223 union {
224 struct in_addr r_dst;
225 struct in6_addr r_dst6;
226 } dst;
227 union {
228 struct {
229 uint16_t s_port; /* source TCP/UDP port */
230 uint16_t d_port; /* destination TCP/UDP port */
231 } dir;
232 uint32_t both;
233 } ports;
234 union {
235 struct {
236 u_char prot; /* IP protocol */
237 u_char tos; /* IP TOS */
238 uint16_t i_ifx; /* input interface index */
239 } i;
240 uint32_t all;
241 } misc;
242 };
243
244 #define r_ip_p misc.i.prot
245 #define r_tos misc.i.tos
246 #define r_i_ifx misc.i.i_ifx
247 #define r_misc misc.all
248 #define r_ports ports.both
249 #define r_sport ports.dir.s_port
250 #define r_dport ports.dir.d_port
251
252 /* A flow entry which accumulates statistics */
253 struct flow_entry_data {
254 uint16_t version; /* Protocol version */
255 struct flow_rec r;
256 struct in_addr next_hop;
257 uint16_t fle_o_ifx; /* output interface index */
258 #define fle_i_ifx r.misc.i.i_ifx
259 uint8_t dst_mask; /* destination route mask bits */
260 uint8_t src_mask; /* source route mask bits */
261 u_long packets;
262 u_long bytes;
263 long first; /* uptime on first packet */
264 long last; /* uptime on last packet */
265 u_char tcp_flags; /* cumulative OR */
266 };
267
268 struct flow6_entry_data {
269 uint16_t version; /* Protocol version */
270 struct flow6_rec r;
271 union {
272 struct in_addr next_hop;
273 struct in6_addr next_hop6;
274 } n;
275 uint16_t fle_o_ifx; /* output interface index */
276 #define fle_i_ifx r.misc.i.i_ifx
277 uint8_t dst_mask; /* destination route mask bits */
278 uint8_t src_mask; /* source route mask bits */
279 u_long packets;
280 u_long bytes;
281 long first; /* uptime on first packet */
282 long last; /* uptime on last packet */
283 u_char tcp_flags; /* cumulative OR */
284 };
285
286 /*
287 * How many flow records we will transfer at once
288 * without overflowing socket receive buffer
289 */
290 #define NREC_AT_ONCE 1000
291 #define NREC6_AT_ONCE (NREC_AT_ONCE * sizeof(struct flow_entry_data) / \
292 sizeof(struct flow6_entry_data))
293 #define NGRESP_SIZE (sizeof(struct ngnf_show_header) + (NREC_AT_ONCE * \
294 sizeof(struct flow_entry_data)))
295 #define SORCVBUF_SIZE (NGRESP_SIZE + 2 * sizeof(struct ng_mesg))
296
297 /* Everything below is for kernel */
298
299 #ifdef _KERNEL
300
301 struct flow_entry {
302 TAILQ_ENTRY(flow_entry) fle_hash; /* entries in hash slot */
303 struct flow_entry_data f;
304 };
305
306 struct flow6_entry {
307 TAILQ_ENTRY(flow_entry) fle_hash; /* entries in hash slot */
308 struct flow6_entry_data f;
309 };
310 /* Parsing declarations */
311
312 /* Parse the ifinfo structure */
313 #define NG_NETFLOW_IFINFO_TYPE { \
314 { "packets", &ng_parse_uint32_type },\
315 { "data link type", &ng_parse_uint8_type }, \
316 { "index", &ng_parse_uint16_type },\
317 { "conf", &ng_parse_uint32_type },\
318 { NULL } \
319 }
320
321 /* Parse the setdlt structure */
322 #define NG_NETFLOW_SETDLT_TYPE { \
323 { "iface", &ng_parse_uint16_type }, \
324 { "dlt", &ng_parse_uint8_type }, \
325 { NULL } \
326 }
327
328 /* Parse the setifindex structure */
329 #define NG_NETFLOW_SETIFINDEX_TYPE { \
330 { "iface", &ng_parse_uint16_type }, \
331 { "index", &ng_parse_uint16_type }, \
332 { NULL } \
333 }
334
335 /* Parse the settimeouts structure */
336 #define NG_NETFLOW_SETTIMEOUTS_TYPE { \
337 { "inactive", &ng_parse_uint32_type }, \
338 { "active", &ng_parse_uint32_type }, \
339 { NULL } \
340 }
341
342 /* Parse the setifindex structure */
343 #define NG_NETFLOW_SETCONFIG_TYPE { \
344 { "iface", &ng_parse_uint16_type }, \
345 { "conf", &ng_parse_uint32_type }, \
346 { NULL } \
347 }
348
349 /* Parse the settemplate structure */
350 #define NG_NETFLOW_SETTEMPLATE_TYPE { \
351 { "time", &ng_parse_uint16_type }, \
352 { "packets", &ng_parse_uint16_type }, \
353 { NULL } \
354 }
355
356 /* Parse the setmtu structure */
357 #define NG_NETFLOW_SETMTU_TYPE { \
358 { "mtu", &ng_parse_uint16_type }, \
359 { NULL } \
360 }
361
362 /* Parse the v9info structure */
363 #define NG_NETFLOW_V9INFO_TYPE { \
364 { "v9 template packets", &ng_parse_uint16_type },\
365 { "v9 template time", &ng_parse_uint16_type },\
366 { "v9 MTU", &ng_parse_uint16_type },\
367 { NULL } \
368 }
369
370 /* Private hook data */
371 struct ng_netflow_iface {
372 hook_p hook; /* NULL when disconnected */
373 hook_p out; /* NULL when no bypass hook */
374 struct ng_netflow_ifinfo info;
375 };
376
377 typedef struct ng_netflow_iface *iface_p;
378 typedef struct ng_netflow_ifinfo *ifinfo_p;
379
380 struct netflow_export_item {
381 item_p item;
382 item_p item9;
383 struct netflow_v9_packet_opt *item9_opt;
384 };
385
386 /* Structure contatining fib-specific data */
387 struct fib_export {
388 uint32_t fib; /* kernel fib id */
389
390 /* Various data used for export */
391 struct netflow_export_item exp;
392
393 struct mtx export_mtx; /* exp.item mutex */
394 struct mtx export9_mtx; /* exp.item9 mutex */
395 uint32_t flow_seq; /* current V5 flow sequence */
396 uint32_t flow9_seq; /* current V9 flow sequence */
397 uint32_t domain_id; /* Observartion domain id */
398 /* Netflow V9 counters */
399 uint32_t templ_last_ts; /* unixtime of last template announce */
400 uint32_t templ_last_pkt; /* packet count on last announce */
401 uint32_t sent_packets; /* packets sent by exporter; */
402
403 /* Current packet specific options */
404 struct netflow_v9_packet_opt *export9_opt;
405 };
406
407 typedef struct fib_export *fib_export_p;
408
409 /* Structure describing our flow engine */
410 struct netflow {
411 node_p node; /* link to the node itself */
412 hook_p export; /* export data goes there */
413 hook_p export9; /* Netflow V9 export data goes there */
414 struct callout exp_callout; /* expiry periodic job */
415
416 /*
417 * Flow entries are allocated in uma(9) zone zone. They are
418 * indexed by hash hash. Each hash element consist of tailqueue
419 * head and mutex to protect this element.
420 */
421 #define CACHESIZE (65536*16)
422 #define CACHELOWAT (CACHESIZE * 3/4)
423 #define CACHEHIGHWAT (CACHESIZE * 9/10)
424 uma_zone_t zone;
425 struct flow_hash_entry *hash;
426
427 /*
428 * NetFlow data export
429 *
430 * export_item is a data item, it has an mbuf with cluster
431 * attached to it. A thread detaches export_item from priv
432 * and works with it. If the export is full it is sent, and
433 * a new one is allocated. Before exiting thread re-attaches
434 * its current item back to priv. If there is item already,
435 * current incomplete datagram is sent.
436 * export_mtx is used for attaching/detaching.
437 */
438
439 /* IPv6 support */
440 #ifdef INET6
441 uma_zone_t zone6;
442 struct flow_hash_entry *hash6;
443 #endif
444
445 /* Statistics. */
446 counter_u64_t nfinfo_bytes; /* accounted IPv4 bytes */
447 counter_u64_t nfinfo_packets; /* accounted IPv4 packets */
448 counter_u64_t nfinfo_bytes6; /* accounted IPv6 bytes */
449 counter_u64_t nfinfo_packets6; /* accounted IPv6 packets */
450 counter_u64_t nfinfo_sbytes; /* skipped IPv4 bytes */
451 counter_u64_t nfinfo_spackets; /* skipped IPv4 packets */
452 counter_u64_t nfinfo_sbytes6; /* skipped IPv6 bytes */
453 counter_u64_t nfinfo_spackets6; /* skipped IPv6 packets */
454 counter_u64_t nfinfo_act_exp; /* active expiries */
455 counter_u64_t nfinfo_inact_exp; /* inactive expiries */
456 uint32_t nfinfo_alloc_failed; /* failed allocations */
457 uint32_t nfinfo_export_failed; /* failed exports */
458 uint32_t nfinfo_export9_failed; /* failed exports */
459 uint32_t nfinfo_realloc_mbuf; /* reallocated mbufs */
460 uint32_t nfinfo_alloc_fibs; /* fibs allocated */
461 uint32_t nfinfo_inact_t; /* flow inactive timeout */
462 uint32_t nfinfo_act_t; /* flow active timeout */
463
464 /* Multiple FIB support */
465 fib_export_p *fib_data; /* vector to per-fib data */
466 uint16_t maxfibs; /* number of allocated fibs */
467
468 /* Netflow v9 configuration options */
469 /*
470 * RFC 3954 clause 7.3
471 * "Both options MUST be configurable by the user on the Exporter."
472 */
473 uint16_t templ_time; /* time between sending templates */
474 uint16_t templ_packets; /* packets between sending templates */
475 #define NETFLOW_V9_MAX_FLOWSETS 2
476 u_char flowsets_count; /* current flowsets used */
477
478 /* Count of records in each flowset */
479 u_char flowset_records[NETFLOW_V9_MAX_FLOWSETS - 1];
480 uint16_t mtu; /* export interface MTU */
481
482 /* Pointers to pre-compiled flowsets */
483 struct netflow_v9_flowset_header
484 *v9_flowsets[NETFLOW_V9_MAX_FLOWSETS - 1];
485
486 struct ng_netflow_iface ifaces[NG_NETFLOW_MAXIFACES];
487 };
488
489 typedef struct netflow *priv_p;
490
491 /* Header of a small list in hash cell */
492 struct flow_hash_entry {
493 struct mtx mtx;
494 TAILQ_HEAD(fhead, flow_entry) head;
495 };
496
497 #define ERROUT(x) { error = (x); goto done; }
498
499 #define MTAG_NETFLOW 1221656444
500 #define MTAG_NETFLOW_CALLED 0
501
502 #define m_pktlen(m) ((m)->m_pkthdr.len)
503 #define IP6VERSION 6
504
505 #define priv_to_fib(priv, fib) (priv)->fib_data[(fib)]
506
507 /*
508 * Cisco uses milliseconds for uptime. Bad idea, since it overflows
509 * every 48+ days. But we will do same to keep compatibility. This macro
510 * does overflowable multiplication to 1000.
511 */
512 #define MILLIUPTIME(t) (((t) << 9) + /* 512 */ \
513 ((t) << 8) + /* 256 */ \
514 ((t) << 7) + /* 128 */ \
515 ((t) << 6) + /* 64 */ \
516 ((t) << 5) + /* 32 */ \
517 ((t) << 3)) /* 8 */
518
519 /* Prototypes for netflow.c */
520 void ng_netflow_cache_init(priv_p);
521 void ng_netflow_cache_flush(priv_p);
522 int ng_netflow_fib_init(priv_p priv, int fib);
523 void ng_netflow_copyinfo(priv_p, struct ng_netflow_info *);
524 void ng_netflow_copyv9info(priv_p, struct ng_netflow_v9info *);
525 timeout_t ng_netflow_expire;
526 int ng_netflow_flow_add(priv_p, fib_export_p, struct ip *, caddr_t,
527 uint8_t, uint8_t, unsigned int);
528 int ng_netflow_flow6_add(priv_p, fib_export_p, struct ip6_hdr *, caddr_t,
529 uint8_t, uint8_t, unsigned int);
530 int ng_netflow_flow_show(priv_p, struct ngnf_show_header *req,
531 struct ngnf_show_header *resp);
532 void ng_netflow_v9_cache_init(priv_p);
533 void ng_netflow_v9_cache_flush(priv_p);
534 item_p get_export9_dgram(priv_p, fib_export_p,
535 struct netflow_v9_packet_opt **);
536 void return_export9_dgram(priv_p, fib_export_p, item_p,
537 struct netflow_v9_packet_opt *, int);
538 int export9_add(item_p, struct netflow_v9_packet_opt *,
539 struct flow_entry *);
540 int export9_send(priv_p, fib_export_p, item_p,
541 struct netflow_v9_packet_opt *, int);
542
543 #endif /* _KERNEL */
544 #endif /* _NG_NETFLOW_H_ */
Cache object: e9c35500ccd7a3a7459ff79b09e611eb
|