1 /*-
2 * Copyright (c) 2010-2011 Alexander V. Chernikov <melifaro@ipfw.ru>
3 * Copyright (c) 2004-2005 Gleb Smirnoff <glebius@FreeBSD.org>
4 * Copyright (c) 2001-2003 Roman V. Palagin <romanp@unshadow.net>
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 *
28 * $SourceForge: ng_netflow.h,v 1.26 2004/09/04 15:44:55 glebius Exp $
29 * $FreeBSD$
30 */
31
32 #ifndef _NG_NETFLOW_H_
33 #define _NG_NETFLOW_H_
34
35 #define NG_NETFLOW_NODE_TYPE "netflow"
36 #define NGM_NETFLOW_COOKIE 1309868867
37
38 #define NG_NETFLOW_MAXIFACES USHRT_MAX
39
40 /* Hook names */
41
42 #define NG_NETFLOW_HOOK_DATA "iface"
43 #define NG_NETFLOW_HOOK_OUT "out"
44 #define NG_NETFLOW_HOOK_EXPORT "export"
45 #define NG_NETFLOW_HOOK_EXPORT9 "export9"
46
47 /* This define effectively disable (v5) netflow export hook! */
48 /* #define COUNTERS_64 */
49
50 /* Netgraph commands understood by netflow node */
51 enum {
52 NGM_NETFLOW_INFO = 1|NGM_READONLY|NGM_HASREPLY, /* get node info */
53 NGM_NETFLOW_IFINFO = 2|NGM_READONLY|NGM_HASREPLY, /* get iface info */
54 NGM_NETFLOW_SHOW = 3|NGM_READONLY|NGM_HASREPLY, /* show ip cache flow */
55 NGM_NETFLOW_SETDLT = 4, /* set data-link type */
56 NGM_NETFLOW_SETIFINDEX = 5, /* set interface index */
57 NGM_NETFLOW_SETTIMEOUTS = 6, /* set active/inactive flow timeouts */
58 NGM_NETFLOW_SETCONFIG = 7, /* set flow generation options */
59 NGM_NETFLOW_SETTEMPLATE = 8, /* set v9 flow template periodic */
60 NGM_NETFLOW_SETMTU = 9, /* set outgoing interface MTU */
61 };
62
63 /* This structure is returned by the NGM_NETFLOW_INFO message */
64 struct ng_netflow_info {
65 uint64_t nfinfo_bytes; /* accounted IPv4 bytes */
66 uint32_t nfinfo_packets; /* accounted IPv4 packets */
67 uint64_t nfinfo_bytes6; /* accounted IPv6 bytes */
68 uint32_t nfinfo_packets6; /* accounted IPv6 packets */
69 uint64_t nfinfo_sbytes; /* skipped IPv4 bytes */
70 uint32_t nfinfo_spackets; /* skipped IPv4 packets */
71 uint64_t nfinfo_sbytes6; /* skipped IPv6 bytes */
72 uint32_t nfinfo_spackets6; /* skipped IPv6 packets */
73 uint32_t nfinfo_used; /* used cache records */
74 uint32_t nfinfo_used6; /* used IPv6 cache records */
75 uint32_t nfinfo_alloc_failed; /* failed allocations */
76 uint32_t nfinfo_export_failed; /* failed exports */
77 uint32_t nfinfo_export9_failed; /* failed exports */
78 uint32_t nfinfo_realloc_mbuf; /* reallocated mbufs */
79 uint32_t nfinfo_alloc_fibs; /* fibs allocated */
80 uint32_t nfinfo_act_exp; /* active expiries */
81 uint32_t nfinfo_inact_exp; /* inactive expiries */
82 uint32_t nfinfo_inact_t; /* flow inactive timeout */
83 uint32_t nfinfo_act_t; /* flow active timeout */
84 };
85
86 /* This structure is returned by the NGM_NETFLOW_IFINFO message */
87 struct ng_netflow_ifinfo {
88 uint32_t ifinfo_packets; /* number of packets for this iface */
89 uint8_t ifinfo_dlt; /* Data Link Type, DLT_XXX */
90 #define MAXDLTNAMELEN 20
91 u_int16_t ifinfo_index; /* connected iface index */
92 uint32_t conf;
93 };
94
95
96 /* This structure is passed to NGM_NETFLOW_SETDLT message */
97 struct ng_netflow_setdlt {
98 uint16_t iface; /* which iface dlt change */
99 uint8_t dlt; /* DLT_XXX from bpf.h */
100 };
101
102 /* This structure is passed to NGM_NETFLOW_SETIFINDEX */
103 struct ng_netflow_setifindex {
104 u_int16_t iface; /* which iface index change */
105 u_int16_t index; /* new index */
106 };
107
108 /* This structure is passed to NGM_NETFLOW_SETTIMEOUTS */
109 struct ng_netflow_settimeouts {
110 uint32_t inactive_timeout; /* flow inactive timeout */
111 uint32_t active_timeout; /* flow active timeout */
112 };
113
114 #define NG_NETFLOW_CONF_INGRESS 0x01 /* Account on ingress */
115 #define NG_NETFLOW_CONF_EGRESS 0x02 /* Account on egress */
116 #define NG_NETFLOW_CONF_ONCE 0x04 /* Add tag to account only once */
117 #define NG_NETFLOW_CONF_THISONCE 0x08 /* Account once in current node */
118 #define NG_NETFLOW_CONF_NOSRCLOOKUP 0x10 /* No radix lookup on src */
119 #define NG_NETFLOW_CONF_NODSTLOOKUP 0x20 /* No radix lookup on dst */
120
121 #define NG_NETFLOW_IS_FRAG 0x01
122 #define NG_NETFLOW_FLOW_FLAGS (NG_NETFLOW_CONF_NOSRCLOOKUP|\
123 NG_NETFLOW_CONF_NODSTLOOKUP)
124
125 /* This structure is passed to NGM_NETFLOW_SETCONFIG */
126 struct ng_netflow_setconfig {
127 u_int16_t iface; /* which iface config change */
128 u_int32_t conf; /* new config */
129 };
130
131 /* This structure is passed to NGM_NETFLOW_SETTEMPLATE */
132 struct ng_netflow_settemplate {
133 uint16_t time; /* max time between announce */
134 uint16_t packets; /* max packets between announce */
135 };
136
137 /* This structure is passed to NGM_NETFLOW_SETMTU */
138 struct ng_netflow_setmtu {
139 uint16_t mtu; /* MTU for packet */
140 };
141
142 /* This structure is used in NGM_NETFLOW_SHOW request/responce */
143 struct ngnf_show_header {
144 u_char version; /* IPv4 or IPv6 */
145 uint32_t hash_id; /* current hash index */
146 uint32_t list_id; /* current record number in given hash */
147 uint32_t nentries; /* number of records in response */
148 };
149
150 /* XXXGL
151 * Somewhere flow_rec6 is casted to flow_rec, and flow6_entry_data is
152 * casted to flow_entry_data. After casting, fle->r.fib is accessed.
153 * So beginning of these structs up to fib should be kept common.
154 */
155
156 /* This is unique data, which identifies flow */
157 struct flow_rec {
158 uint16_t flow_type; /* IPv4 L4/L3 flow, see NETFLOW_V9_FLOW* */
159 uint16_t fib;
160 struct in_addr r_src;
161 struct in_addr r_dst;
162 union {
163 struct {
164 uint16_t s_port; /* source TCP/UDP port */
165 uint16_t d_port; /* destination TCP/UDP port */
166 } dir;
167 uint32_t both;
168 } ports;
169 union {
170 struct {
171 u_char prot; /* IP protocol */
172 u_char tos; /* IP TOS */
173 uint16_t i_ifx; /* input interface index */
174 } i;
175 uint32_t all;
176 } misc;
177 };
178
179 /* This is unique data, which identifies flow */
180 struct flow6_rec {
181 uint16_t flow_type; /* IPv4 L4/L3 Ipv6 L4/L3 flow, see NETFLOW_V9_FLOW* */
182 uint16_t fib;
183 union {
184 struct in_addr r_src;
185 struct in6_addr r_src6;
186 } src;
187 union {
188 struct in_addr r_dst;
189 struct in6_addr r_dst6;
190 } dst;
191 union {
192 struct {
193 uint16_t s_port; /* source TCP/UDP port */
194 uint16_t d_port; /* destination TCP/UDP port */
195 } dir;
196 uint32_t both;
197 } ports;
198 union {
199 struct {
200 u_char prot; /* IP protocol */
201 u_char tos; /* IP TOS */
202 uint16_t i_ifx; /* input interface index */
203 } i;
204 uint32_t all;
205 } misc;
206 };
207
208 #define r_ip_p misc.i.prot
209 #define r_tos misc.i.tos
210 #define r_i_ifx misc.i.i_ifx
211 #define r_misc misc.all
212 #define r_ports ports.both
213 #define r_sport ports.dir.s_port
214 #define r_dport ports.dir.d_port
215
216 /* A flow entry which accumulates statistics */
217 struct flow_entry_data {
218 uint16_t version; /* Protocol version */
219 struct flow_rec r;
220 struct in_addr next_hop;
221 uint16_t fle_o_ifx; /* output interface index */
222 #define fle_i_ifx r.misc.i.i_ifx
223 uint8_t dst_mask; /* destination route mask bits */
224 uint8_t src_mask; /* source route mask bits */
225 u_long packets;
226 u_long bytes;
227 long first; /* uptime on first packet */
228 long last; /* uptime on last packet */
229 u_char tcp_flags; /* cumulative OR */
230 };
231
232 struct flow6_entry_data {
233 uint16_t version; /* Protocol version */
234 struct flow6_rec r;
235 union {
236 struct in_addr next_hop;
237 struct in6_addr next_hop6;
238 } n;
239 uint16_t fle_o_ifx; /* output interface index */
240 #define fle_i_ifx r.misc.i.i_ifx
241 uint8_t dst_mask; /* destination route mask bits */
242 uint8_t src_mask; /* source route mask bits */
243 u_long packets;
244 u_long bytes;
245 long first; /* uptime on first packet */
246 long last; /* uptime on last packet */
247 u_char tcp_flags; /* cumulative OR */
248 };
249
250 /*
251 * How many flow records we will transfer at once
252 * without overflowing socket receive buffer
253 */
254 #define NREC_AT_ONCE 1000
255 #define NREC6_AT_ONCE (NREC_AT_ONCE * sizeof(struct flow_entry_data) / \
256 sizeof(struct flow6_entry_data))
257 #define NGRESP_SIZE (sizeof(struct ngnf_show_header) + (NREC_AT_ONCE * \
258 sizeof(struct flow_entry_data)))
259 #define SORCVBUF_SIZE (NGRESP_SIZE + 2 * sizeof(struct ng_mesg))
260
261 /* Everything below is for kernel */
262
263 #ifdef _KERNEL
264
265 struct flow_entry {
266 TAILQ_ENTRY(flow_entry) fle_hash; /* entries in hash slot */
267 struct flow_entry_data f;
268 };
269
270 struct flow6_entry {
271 TAILQ_ENTRY(flow_entry) fle_hash; /* entries in hash slot */
272 struct flow6_entry_data f;
273 };
274 /* Parsing declarations */
275
276 /* Parse the info structure */
277 #define NG_NETFLOW_INFO_TYPE { \
278 { "IPv4 bytes", &ng_parse_uint64_type }, \
279 { "IPv4 packets", &ng_parse_uint32_type }, \
280 { "IPv6 bytes", &ng_parse_uint64_type }, \
281 { "IPv6 packets", &ng_parse_uint32_type }, \
282 { "IPv4 skipped bytes", &ng_parse_uint64_type }, \
283 { "IPv4 skipped packets", &ng_parse_uint32_type }, \
284 { "IPv6 skipped bytes", &ng_parse_uint64_type }, \
285 { "IPv6 skipped packets", &ng_parse_uint32_type }, \
286 { "IPv4 records used", &ng_parse_uint32_type },\
287 { "IPv6 records used", &ng_parse_uint32_type },\
288 { "Failed allocations", &ng_parse_uint32_type },\
289 { "V5 failed exports", &ng_parse_uint32_type },\
290 { "V9 failed exports", &ng_parse_uint32_type },\
291 { "mbuf reallocations", &ng_parse_uint32_type },\
292 { "fibs allocated", &ng_parse_uint32_type },\
293 { "Active expiries", &ng_parse_uint32_type },\
294 { "Inactive expiries", &ng_parse_uint32_type },\
295 { "Inactive timeout", &ng_parse_uint32_type },\
296 { "Active timeout", &ng_parse_uint32_type },\
297 { NULL } \
298 }
299
300 /* Parse the ifinfo structure */
301 #define NG_NETFLOW_IFINFO_TYPE { \
302 { "packets", &ng_parse_uint32_type }, \
303 { "data link type", &ng_parse_uint8_type }, \
304 { "index", &ng_parse_uint16_type }, \
305 { "conf", &ng_parse_uint32_type }, \
306 { NULL } \
307 }
308
309 /* Parse the setdlt structure */
310 #define NG_NETFLOW_SETDLT_TYPE { \
311 { "iface", &ng_parse_uint16_type }, \
312 { "dlt", &ng_parse_uint8_type }, \
313 { NULL } \
314 }
315
316 /* Parse the setifindex structure */
317 #define NG_NETFLOW_SETIFINDEX_TYPE { \
318 { "iface", &ng_parse_uint16_type }, \
319 { "index", &ng_parse_uint16_type }, \
320 { NULL } \
321 }
322
323 /* Parse the settimeouts structure */
324 #define NG_NETFLOW_SETTIMEOUTS_TYPE { \
325 { "inactive", &ng_parse_uint32_type }, \
326 { "active", &ng_parse_uint32_type }, \
327 { NULL } \
328 }
329
330 /* Parse the setifindex structure */
331 #define NG_NETFLOW_SETCONFIG_TYPE { \
332 { "iface", &ng_parse_uint16_type }, \
333 { "conf", &ng_parse_uint32_type }, \
334 { NULL } \
335 }
336
337 /* Parse the settemplate structure */
338 #define NG_NETFLOW_SETTEMPLATE_TYPE { \
339 { "time", &ng_parse_uint16_type }, \
340 { "packets", &ng_parse_uint16_type }, \
341 { NULL } \
342 }
343
344 /* Parse the setmtu structure */
345 #define NG_NETFLOW_SETMTU_TYPE { \
346 { "mtu", &ng_parse_uint16_type }, \
347 { NULL } \
348 }
349
350 /* Private hook data */
351 struct ng_netflow_iface {
352 hook_p hook; /* NULL when disconnected */
353 hook_p out; /* NULL when no bypass hook */
354 struct ng_netflow_ifinfo info;
355 };
356
357 typedef struct ng_netflow_iface *iface_p;
358 typedef struct ng_netflow_ifinfo *ifinfo_p;
359
360 struct netflow_export_item {
361 item_p item;
362 item_p item9;
363 struct netflow_v9_packet_opt *item9_opt;
364 };
365
366 /* Structure contatining fib-specific data */
367 struct fib_export {
368 uint32_t fib; /* kernel fib id */
369 struct netflow_export_item exp; /* Various data used for export */
370 struct mtx export_mtx; /* exp.item mutex */
371 struct mtx export9_mtx; /* exp.item9 mutex */
372 uint32_t flow_seq; /* current V5 flow sequence */
373 uint32_t flow9_seq; /* current V9 flow sequence */
374 uint32_t domain_id; /* Observartion domain id */
375 /* Netflow V9 counters */
376 uint32_t templ_last_ts; /* unixtime of last template announce */
377 uint32_t templ_last_pkt; /* packets count on last template announce */
378 uint32_t sent_packets; /* packets sent by exporter; */
379 struct netflow_v9_packet_opt *export9_opt; /* current packet specific options */
380 };
381
382 typedef struct fib_export *fib_export_p;
383
384 /* Structure describing our flow engine */
385 struct netflow {
386 node_p node; /* link to the node itself */
387 hook_p export; /* export data goes there */
388 hook_p export9; /* Netflow V9 export data goes there */
389
390 struct ng_netflow_info info;
391 struct callout exp_callout; /* expiry periodic job */
392
393 /*
394 * Flow entries are allocated in uma(9) zone zone. They are
395 * indexed by hash hash. Each hash element consist of tailqueue
396 * head and mutex to protect this element.
397 */
398 #define CACHESIZE (65536*4)
399 #define CACHELOWAT (CACHESIZE * 3/4)
400 #define CACHEHIGHWAT (CACHESIZE * 9/10)
401 uma_zone_t zone;
402 struct flow_hash_entry *hash;
403
404 /*
405 * NetFlow data export
406 *
407 * export_item is a data item, it has an mbuf with cluster
408 * attached to it. A thread detaches export_item from priv
409 * and works with it. If the export is full it is sent, and
410 * a new one is allocated. Before exiting thread re-attaches
411 * its current item back to priv. If there is item already,
412 * current incomplete datagram is sent.
413 * export_mtx is used for attaching/detaching.
414 */
415
416 /* IPv6 support */
417 #ifdef INET6
418 uma_zone_t zone6;
419 struct flow_hash_entry *hash6;
420 #endif
421 /* Multiple FIB support */
422 fib_export_p *fib_data; /* array of pointers to per-fib data */
423 uint16_t maxfibs; /* number of allocated fibs */
424
425 /*
426 * RFC 3954 clause 7.3
427 * "Both options MUST be configurable by the user on the Exporter."
428 */
429 uint16_t templ_time; /* time between sending templates */
430 uint16_t templ_packets; /* packets between sending templates */
431 #define NETFLOW_V9_MAX_FLOWSETS 2
432 u_char flowsets_count; /* current flowsets used */
433 u_char flowset_records[NETFLOW_V9_MAX_FLOWSETS - 1]; /* Count of records in each flowset */
434 uint16_t mtu; /* export interface MTU */
435 struct netflow_v9_flowset_header *v9_flowsets[NETFLOW_V9_MAX_FLOWSETS - 1]; /* Pointers to pre-compiled flowsets */
436
437 struct ng_netflow_iface ifaces[NG_NETFLOW_MAXIFACES];
438 };
439
440 typedef struct netflow *priv_p;
441
442 /* Header of a small list in hash cell */
443 struct flow_hash_entry {
444 struct mtx mtx;
445 TAILQ_HEAD(fhead, flow_entry) head;
446 };
447
448 #define ERROUT(x) { error = (x); goto done; }
449
450 #define MTAG_NETFLOW 1221656444
451 #define MTAG_NETFLOW_CALLED 0
452
453 #define m_pktlen(m) ((m)->m_pkthdr.len)
454 #define IP6VERSION 6
455
456 #define priv_to_fib(priv, fib) (priv)->fib_data[(fib)]
457
458 /*
459 * Cisco uses milliseconds for uptime. Bad idea, since it overflows
460 * every 48+ days. But we will do same to keep compatibility. This macro
461 * does overflowable multiplication to 1000.
462 */
463 #define MILLIUPTIME(t) (((t) << 9) + /* 512 */ \
464 ((t) << 8) + /* 256 */ \
465 ((t) << 7) + /* 128 */ \
466 ((t) << 6) + /* 64 */ \
467 ((t) << 5) + /* 32 */ \
468 ((t) << 3)) /* 8 */
469
470 /* Prototypes for netflow.c */
471 void ng_netflow_cache_init(priv_p);
472 void ng_netflow_cache_flush(priv_p);
473 int ng_netflow_fib_init(priv_p priv, int fib);
474 void ng_netflow_copyinfo(priv_p, struct ng_netflow_info *);
475 timeout_t ng_netflow_expire;
476 int ng_netflow_flow_add(priv_p, fib_export_p, struct ip *, caddr_t, uint8_t, uint8_t, unsigned int);
477 int ng_netflow_flow6_add(priv_p, fib_export_p, struct ip6_hdr *, caddr_t , uint8_t, uint8_t, unsigned int);
478 int ng_netflow_flow_show(priv_p, struct ngnf_show_header *req, struct ngnf_show_header *resp);
479
480 void ng_netflow_v9_cache_init(priv_p);
481 void ng_netflow_v9_cache_flush(priv_p);
482 item_p get_export9_dgram(priv_p, fib_export_p, struct netflow_v9_packet_opt **);
483 void return_export9_dgram(priv_p, fib_export_p, item_p,
484 struct netflow_v9_packet_opt *, int);
485 int export9_add(item_p, struct netflow_v9_packet_opt *, struct flow_entry *);
486 int export9_send(priv_p, fib_export_p, item_p, struct netflow_v9_packet_opt *,
487 int);
488
489 #endif /* _KERNEL */
490 #endif /* _NG_NETFLOW_H_ */
Cache object: 2da9d9f567e576121b6549cecdd8c473
|