1 /*- 2 * Copyright (c) 2010-2011 Alexander V. Chernikov <melifaro@ipfw.ru> 3 * Copyright (c) 2004-2005 Gleb Smirnoff <glebius@FreeBSD.org> 4 * Copyright (c) 2001-2003 Roman V. Palagin <romanp@unshadow.net> 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 * 28 * $SourceForge: netflow.c,v 1.41 2004/09/05 11:41:10 glebius Exp $ 29 */ 30 31 #include <sys/cdefs.h> 32 __FBSDID("$FreeBSD$"); 33 34 #include "opt_inet6.h" 35 #include "opt_route.h" 36 #include <sys/param.h> 37 #include <sys/systm.h> 38 #include <sys/counter.h> 39 #include <sys/kernel.h> 40 #include <sys/ktr.h> 41 #include <sys/limits.h> 42 #include <sys/mbuf.h> 43 #include <sys/syslog.h> 44 #include <sys/socket.h> 45 #include <vm/uma.h> 46 47 #include <net/if.h> 48 #include <net/if_dl.h> 49 #include <net/if_var.h> 50 #include <net/route.h> 51 #include <net/ethernet.h> 52 #include <netinet/in.h> 53 #include <netinet/in_systm.h> 54 #include <netinet/ip.h> 55 #include <netinet/ip6.h> 56 #include <netinet/tcp.h> 57 #include <netinet/udp.h> 58 59 #include <netgraph/ng_message.h> 60 #include <netgraph/netgraph.h> 61 62 #include <netgraph/netflow/netflow.h> 63 #include <netgraph/netflow/netflow_v9.h> 64 #include <netgraph/netflow/ng_netflow.h> 65 66 #define NBUCKETS (65536) /* must be power of 2 */ 67 68 /* This hash is for TCP or UDP packets. */ 69 #define FULL_HASH(addr1, addr2, port1, port2) \ 70 (((addr1 ^ (addr1 >> 16) ^ \ 71 htons(addr2 ^ (addr2 >> 16))) ^ \ 72 port1 ^ htons(port2)) & \ 73 (NBUCKETS - 1)) 74 75 /* This hash is for all other IP packets. */ 76 #define ADDR_HASH(addr1, addr2) \ 77 ((addr1 ^ (addr1 >> 16) ^ \ 78 htons(addr2 ^ (addr2 >> 16))) & \ 79 (NBUCKETS - 1)) 80 81 /* Macros to shorten logical constructions */ 82 /* XXX: priv must exist in namespace */ 83 #define INACTIVE(fle) (time_uptime - fle->f.last > priv->nfinfo_inact_t) 84 #define AGED(fle) (time_uptime - fle->f.first > priv->nfinfo_act_t) 85 #define ISFREE(fle) (fle->f.packets == 0) 86 87 /* 88 * 4 is a magical number: statistically number of 4-packet flows is 89 * bigger than 5,6,7...-packet flows by an order of magnitude. Most UDP/ICMP 90 * scans are 1 packet (~ 90% of flow cache). TCP scans are 2-packet in case 91 * of reachable host and 4-packet otherwise. 92 */ 93 #define SMALL(fle) (fle->f.packets <= 4) 94 95 MALLOC_DEFINE(M_NETFLOW_HASH, "netflow_hash", "NetFlow hash"); 96 97 static int export_add(item_p, struct flow_entry *); 98 static int export_send(priv_p, fib_export_p, item_p, int); 99 100 static int hash_insert(priv_p, struct flow_hash_entry *, struct flow_rec *, 101 int, uint8_t, uint8_t); 102 #ifdef INET6 103 static int hash6_insert(priv_p, struct flow_hash_entry *, struct flow6_rec *, 104 int, uint8_t, uint8_t); 105 #endif 106 107 static void expire_flow(priv_p, fib_export_p, struct flow_entry *, int); 108 109 /* 110 * Generate hash for a given flow record. 111 * 112 * FIB is not used here, because: 113 * most VRFS will carry public IPv4 addresses which are unique even 114 * without FIB private addresses can overlap, but this is worked out 115 * via flow_rec bcmp() containing fib id. In IPv6 world addresses are 116 * all globally unique (it's not fully true, there is FC00::/7 for example, 117 * but chances of address overlap are MUCH smaller) 118 */ 119 static inline uint32_t 120 ip_hash(struct flow_rec *r) 121 { 122 123 switch (r->r_ip_p) { 124 case IPPROTO_TCP: 125 case IPPROTO_UDP: 126 return FULL_HASH(r->r_src.s_addr, r->r_dst.s_addr, 127 r->r_sport, r->r_dport); 128 default: 129 return ADDR_HASH(r->r_src.s_addr, r->r_dst.s_addr); 130 } 131 } 132 133 #ifdef INET6 134 /* Generate hash for a given flow6 record. Use lower 4 octets from v6 addresses */ 135 static inline uint32_t 136 ip6_hash(struct flow6_rec *r) 137 { 138 139 switch (r->r_ip_p) { 140 case IPPROTO_TCP: 141 case IPPROTO_UDP: 142 return FULL_HASH(r->src.r_src6.__u6_addr.__u6_addr32[3], 143 r->dst.r_dst6.__u6_addr.__u6_addr32[3], r->r_sport, 144 r->r_dport); 145 default: 146 return ADDR_HASH(r->src.r_src6.__u6_addr.__u6_addr32[3], 147 r->dst.r_dst6.__u6_addr.__u6_addr32[3]); 148 } 149 } 150 #endif 151 152 /* 153 * Detach export datagram from priv, if there is any. 154 * If there is no, allocate a new one. 155 */ 156 static item_p 157 get_export_dgram(priv_p priv, fib_export_p fe) 158 { 159 item_p item = NULL; 160 161 mtx_lock(&fe->export_mtx); 162 if (fe->exp.item != NULL) { 163 item = fe->exp.item; 164 fe->exp.item = NULL; 165 } 166 mtx_unlock(&fe->export_mtx); 167 168 if (item == NULL) { 169 struct netflow_v5_export_dgram *dgram; 170 struct mbuf *m; 171 172 m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR); 173 if (m == NULL) 174 return (NULL); 175 item = ng_package_data(m, NG_NOFLAGS); 176 if (item == NULL) 177 return (NULL); 178 dgram = mtod(m, struct netflow_v5_export_dgram *); 179 dgram->header.count = 0; 180 dgram->header.version = htons(NETFLOW_V5); 181 dgram->header.pad = 0; 182 } 183 184 return (item); 185 } 186 187 /* 188 * Re-attach incomplete datagram back to priv. 189 * If there is already another one, then send incomplete. */ 190 static void 191 return_export_dgram(priv_p priv, fib_export_p fe, item_p item, int flags) 192 { 193 194 /* 195 * It may happen on SMP, that some thread has already 196 * put its item there, in this case we bail out and 197 * send what we have to collector. 198 */ 199 mtx_lock(&fe->export_mtx); 200 if (fe->exp.item == NULL) { 201 fe->exp.item = item; 202 mtx_unlock(&fe->export_mtx); 203 } else { 204 mtx_unlock(&fe->export_mtx); 205 export_send(priv, fe, item, flags); 206 } 207 } 208 209 /* 210 * The flow is over. Call export_add() and free it. If datagram is 211 * full, then call export_send(). 212 */ 213 static void 214 expire_flow(priv_p priv, fib_export_p fe, struct flow_entry *fle, int flags) 215 { 216 struct netflow_export_item exp; 217 uint16_t version = fle->f.version; 218 219 if ((priv->export != NULL) && (version == IPVERSION)) { 220 exp.item = get_export_dgram(priv, fe); 221 if (exp.item == NULL) { 222 priv->nfinfo_export_failed++; 223 if (priv->export9 != NULL) 224 priv->nfinfo_export9_failed++; 225 /* fle definitely contains IPv4 flow. */ 226 uma_zfree_arg(priv->zone, fle, priv); 227 return; 228 } 229 230 if (export_add(exp.item, fle) > 0) 231 export_send(priv, fe, exp.item, flags); 232 else 233 return_export_dgram(priv, fe, exp.item, NG_QUEUE); 234 } 235 236 if (priv->export9 != NULL) { 237 exp.item9 = get_export9_dgram(priv, fe, &exp.item9_opt); 238 if (exp.item9 == NULL) { 239 priv->nfinfo_export9_failed++; 240 if (version == IPVERSION) 241 uma_zfree_arg(priv->zone, fle, priv); 242 #ifdef INET6 243 else if (version == IP6VERSION) 244 uma_zfree_arg(priv->zone6, fle, priv); 245 #endif 246 else 247 panic("ng_netflow: Unknown IP proto: %d", 248 version); 249 return; 250 } 251 252 if (export9_add(exp.item9, exp.item9_opt, fle) > 0) 253 export9_send(priv, fe, exp.item9, exp.item9_opt, flags); 254 else 255 return_export9_dgram(priv, fe, exp.item9, 256 exp.item9_opt, NG_QUEUE); 257 } 258 259 if (version == IPVERSION) 260 uma_zfree_arg(priv->zone, fle, priv); 261 #ifdef INET6 262 else if (version == IP6VERSION) 263 uma_zfree_arg(priv->zone6, fle, priv); 264 #endif 265 } 266 267 /* Get a snapshot of node statistics */ 268 void 269 ng_netflow_copyinfo(priv_p priv, struct ng_netflow_info *i) 270 { 271 272 i->nfinfo_bytes = counter_u64_fetch(priv->nfinfo_bytes); 273 i->nfinfo_packets = counter_u64_fetch(priv->nfinfo_packets); 274 i->nfinfo_bytes6 = counter_u64_fetch(priv->nfinfo_bytes6); 275 i->nfinfo_packets6 = counter_u64_fetch(priv->nfinfo_packets6); 276 i->nfinfo_sbytes = counter_u64_fetch(priv->nfinfo_sbytes); 277 i->nfinfo_spackets = counter_u64_fetch(priv->nfinfo_spackets); 278 i->nfinfo_sbytes6 = counter_u64_fetch(priv->nfinfo_sbytes6); 279 i->nfinfo_spackets6 = counter_u64_fetch(priv->nfinfo_spackets6); 280 i->nfinfo_act_exp = counter_u64_fetch(priv->nfinfo_act_exp); 281 i->nfinfo_inact_exp = counter_u64_fetch(priv->nfinfo_inact_exp); 282 283 i->nfinfo_used = uma_zone_get_cur(priv->zone); 284 #ifdef INET6 285 i->nfinfo_used6 = uma_zone_get_cur(priv->zone6); 286 #endif 287 288 i->nfinfo_alloc_failed = priv->nfinfo_alloc_failed; 289 i->nfinfo_export_failed = priv->nfinfo_export_failed; 290 i->nfinfo_export9_failed = priv->nfinfo_export9_failed; 291 i->nfinfo_realloc_mbuf = priv->nfinfo_realloc_mbuf; 292 i->nfinfo_alloc_fibs = priv->nfinfo_alloc_fibs; 293 i->nfinfo_inact_t = priv->nfinfo_inact_t; 294 i->nfinfo_act_t = priv->nfinfo_act_t; 295 } 296 297 /* 298 * Insert a record into defined slot. 299 * 300 * First we get for us a free flow entry, then fill in all 301 * possible fields in it. 302 * 303 * TODO: consider dropping hash mutex while filling in datagram, 304 * as this was done in previous version. Need to test & profile 305 * to be sure. 306 */ 307 static int 308 hash_insert(priv_p priv, struct flow_hash_entry *hsh, struct flow_rec *r, 309 int plen, uint8_t flags, uint8_t tcp_flags) 310 { 311 struct flow_entry *fle; 312 struct sockaddr_in sin, sin_mask; 313 struct sockaddr_dl rt_gateway; 314 struct rt_addrinfo info; 315 316 mtx_assert(&hsh->mtx, MA_OWNED); 317 318 fle = uma_zalloc_arg(priv->zone, priv, M_NOWAIT); 319 if (fle == NULL) { 320 priv->nfinfo_alloc_failed++; 321 return (ENOMEM); 322 } 323 324 /* 325 * Now fle is totally ours. It is detached from all lists, 326 * we can safely edit it. 327 */ 328 fle->f.version = IPVERSION; 329 bcopy(r, &fle->f.r, sizeof(struct flow_rec)); 330 fle->f.bytes = plen; 331 fle->f.packets = 1; 332 fle->f.tcp_flags = tcp_flags; 333 334 fle->f.first = fle->f.last = time_uptime; 335 336 /* 337 * First we do route table lookup on destination address. So we can 338 * fill in out_ifx, dst_mask, nexthop, and dst_as in future releases. 339 */ 340 if ((flags & NG_NETFLOW_CONF_NODSTLOOKUP) == 0) { 341 bzero(&sin, sizeof(sin)); 342 sin.sin_len = sizeof(struct sockaddr_in); 343 sin.sin_family = AF_INET; 344 sin.sin_addr = fle->f.r.r_dst; 345 346 rt_gateway.sdl_len = sizeof(rt_gateway); 347 sin_mask.sin_len = sizeof(struct sockaddr_in); 348 bzero(&info, sizeof(info)); 349 350 info.rti_info[RTAX_GATEWAY] = (struct sockaddr *)&rt_gateway; 351 info.rti_info[RTAX_NETMASK] = (struct sockaddr *)&sin_mask; 352 353 if (rib_lookup_info(r->fib, (struct sockaddr *)&sin, NHR_REF, 0, 354 &info) == 0) { 355 fle->f.fle_o_ifx = info.rti_ifp->if_index; 356 357 if (info.rti_flags & RTF_GATEWAY && 358 rt_gateway.sdl_family == AF_INET) 359 fle->f.next_hop = 360 ((struct sockaddr_in *)&rt_gateway)->sin_addr; 361 362 if (info.rti_addrs & RTA_NETMASK) 363 fle->f.dst_mask = bitcount32(sin_mask.sin_addr.s_addr); 364 else if (info.rti_flags & RTF_HOST) 365 /* Give up. We can't determine mask :( */ 366 fle->f.dst_mask = 32; 367 368 rib_free_info(&info); 369 } 370 } 371 372 /* Do route lookup on source address, to fill in src_mask. */ 373 if ((flags & NG_NETFLOW_CONF_NOSRCLOOKUP) == 0) { 374 bzero(&sin, sizeof(sin)); 375 sin.sin_len = sizeof(struct sockaddr_in); 376 sin.sin_family = AF_INET; 377 sin.sin_addr = fle->f.r.r_src; 378 379 sin_mask.sin_len = sizeof(struct sockaddr_in); 380 bzero(&info, sizeof(info)); 381 382 info.rti_info[RTAX_NETMASK] = (struct sockaddr *)&sin_mask; 383 384 if (rib_lookup_info(r->fib, (struct sockaddr *)&sin, 0, 0, 385 &info) == 0) { 386 if (info.rti_addrs & RTA_NETMASK) 387 fle->f.src_mask = 388 bitcount32(sin_mask.sin_addr.s_addr); 389 else if (info.rti_flags & RTF_HOST) 390 /* Give up. We can't determine mask :( */ 391 fle->f.src_mask = 32; 392 } 393 } 394 395 /* Push new flow at the and of hash. */ 396 TAILQ_INSERT_TAIL(&hsh->head, fle, fle_hash); 397 398 return (0); 399 } 400 401 #ifdef INET6 402 /* XXX: make normal function, instead of.. */ 403 #define ipv6_masklen(x) bitcount32((x).__u6_addr.__u6_addr32[0]) + \ 404 bitcount32((x).__u6_addr.__u6_addr32[1]) + \ 405 bitcount32((x).__u6_addr.__u6_addr32[2]) + \ 406 bitcount32((x).__u6_addr.__u6_addr32[3]) 407 static int 408 hash6_insert(priv_p priv, struct flow_hash_entry *hsh6, struct flow6_rec *r, 409 int plen, uint8_t flags, uint8_t tcp_flags) 410 { 411 struct flow6_entry *fle6; 412 struct sockaddr_in6 sin6, sin6_mask; 413 struct sockaddr_dl rt_gateway; 414 struct rt_addrinfo info; 415 416 mtx_assert(&hsh6->mtx, MA_OWNED); 417 418 fle6 = uma_zalloc_arg(priv->zone6, priv, M_NOWAIT); 419 if (fle6 == NULL) { 420 priv->nfinfo_alloc_failed++; 421 return (ENOMEM); 422 } 423 424 /* 425 * Now fle is totally ours. It is detached from all lists, 426 * we can safely edit it. 427 */ 428 429 fle6->f.version = IP6VERSION; 430 bcopy(r, &fle6->f.r, sizeof(struct flow6_rec)); 431 fle6->f.bytes = plen; 432 fle6->f.packets = 1; 433 fle6->f.tcp_flags = tcp_flags; 434 435 fle6->f.first = fle6->f.last = time_uptime; 436 437 /* 438 * First we do route table lookup on destination address. So we can 439 * fill in out_ifx, dst_mask, nexthop, and dst_as in future releases. 440 */ 441 if ((flags & NG_NETFLOW_CONF_NODSTLOOKUP) == 0) { 442 bzero(&sin6, sizeof(struct sockaddr_in6)); 443 sin6.sin6_len = sizeof(struct sockaddr_in6); 444 sin6.sin6_family = AF_INET6; 445 sin6.sin6_addr = r->dst.r_dst6; 446 447 rt_gateway.sdl_len = sizeof(rt_gateway); 448 sin6_mask.sin6_len = sizeof(struct sockaddr_in6); 449 bzero(&info, sizeof(info)); 450 451 info.rti_info[RTAX_GATEWAY] = (struct sockaddr *)&rt_gateway; 452 info.rti_info[RTAX_NETMASK] = (struct sockaddr *)&sin6_mask; 453 454 if (rib_lookup_info(r->fib, (struct sockaddr *)&sin6, NHR_REF, 455 0, &info) == 0) { 456 fle6->f.fle_o_ifx = info.rti_ifp->if_index; 457 458 if (info.rti_flags & RTF_GATEWAY && 459 rt_gateway.sdl_family == AF_INET6) 460 fle6->f.n.next_hop6 = 461 ((struct sockaddr_in6 *)&rt_gateway)->sin6_addr; 462 463 if (info.rti_addrs & RTA_NETMASK) 464 fle6->f.dst_mask = 465 ipv6_masklen(sin6_mask.sin6_addr); 466 else 467 fle6->f.dst_mask = 128; 468 469 rib_free_info(&info); 470 } 471 } 472 473 if ((flags & NG_NETFLOW_CONF_NOSRCLOOKUP) == 0) { 474 /* Do route lookup on source address, to fill in src_mask. */ 475 bzero(&sin6, sizeof(struct sockaddr_in6)); 476 sin6.sin6_len = sizeof(struct sockaddr_in6); 477 sin6.sin6_family = AF_INET6; 478 sin6.sin6_addr = r->src.r_src6; 479 480 sin6_mask.sin6_len = sizeof(struct sockaddr_in6); 481 bzero(&info, sizeof(info)); 482 483 info.rti_info[RTAX_NETMASK] = (struct sockaddr *)&sin6_mask; 484 485 if (rib_lookup_info(r->fib, (struct sockaddr *)&sin6, 0, 0, 486 &info) == 0) { 487 if (info.rti_addrs & RTA_NETMASK) 488 fle6->f.src_mask = 489 ipv6_masklen(sin6_mask.sin6_addr); 490 else 491 fle6->f.src_mask = 128; 492 } 493 } 494 495 /* Push new flow at the and of hash. */ 496 TAILQ_INSERT_TAIL(&hsh6->head, (struct flow_entry *)fle6, fle_hash); 497 498 return (0); 499 } 500 #undef ipv6_masklen 501 #endif 502 503 504 /* 505 * Non-static functions called from ng_netflow.c 506 */ 507 508 /* Allocate memory and set up flow cache */ 509 void 510 ng_netflow_cache_init(priv_p priv) 511 { 512 struct flow_hash_entry *hsh; 513 int i; 514 515 /* Initialize cache UMA zone. */ 516 priv->zone = uma_zcreate("NetFlow IPv4 cache", 517 sizeof(struct flow_entry), NULL, NULL, NULL, NULL, 518 UMA_ALIGN_CACHE, 0); 519 uma_zone_set_max(priv->zone, CACHESIZE); 520 #ifdef INET6 521 priv->zone6 = uma_zcreate("NetFlow IPv6 cache", 522 sizeof(struct flow6_entry), NULL, NULL, NULL, NULL, 523 UMA_ALIGN_CACHE, 0); 524 uma_zone_set_max(priv->zone6, CACHESIZE); 525 #endif 526 527 /* Allocate hash. */ 528 priv->hash = malloc(NBUCKETS * sizeof(struct flow_hash_entry), 529 M_NETFLOW_HASH, M_WAITOK | M_ZERO); 530 531 /* Initialize hash. */ 532 for (i = 0, hsh = priv->hash; i < NBUCKETS; i++, hsh++) { 533 mtx_init(&hsh->mtx, "hash mutex", NULL, MTX_DEF); 534 TAILQ_INIT(&hsh->head); 535 } 536 537 #ifdef INET6 538 /* Allocate hash. */ 539 priv->hash6 = malloc(NBUCKETS * sizeof(struct flow_hash_entry), 540 M_NETFLOW_HASH, M_WAITOK | M_ZERO); 541 542 /* Initialize hash. */ 543 for (i = 0, hsh = priv->hash6; i < NBUCKETS; i++, hsh++) { 544 mtx_init(&hsh->mtx, "hash mutex", NULL, MTX_DEF); 545 TAILQ_INIT(&hsh->head); 546 } 547 #endif 548 549 priv->nfinfo_bytes = counter_u64_alloc(M_WAITOK); 550 priv->nfinfo_packets = counter_u64_alloc(M_WAITOK); 551 priv->nfinfo_bytes6 = counter_u64_alloc(M_WAITOK); 552 priv->nfinfo_packets6 = counter_u64_alloc(M_WAITOK); 553 priv->nfinfo_sbytes = counter_u64_alloc(M_WAITOK); 554 priv->nfinfo_spackets = counter_u64_alloc(M_WAITOK); 555 priv->nfinfo_sbytes6 = counter_u64_alloc(M_WAITOK); 556 priv->nfinfo_spackets6 = counter_u64_alloc(M_WAITOK); 557 priv->nfinfo_act_exp = counter_u64_alloc(M_WAITOK); 558 priv->nfinfo_inact_exp = counter_u64_alloc(M_WAITOK); 559 560 ng_netflow_v9_cache_init(priv); 561 CTR0(KTR_NET, "ng_netflow startup()"); 562 } 563 564 /* Initialize new FIB table for v5 and v9 */ 565 int 566 ng_netflow_fib_init(priv_p priv, int fib) 567 { 568 fib_export_p fe = priv_to_fib(priv, fib); 569 570 CTR1(KTR_NET, "ng_netflow(): fib init: %d", fib); 571 572 if (fe != NULL) 573 return (0); 574 575 if ((fe = malloc(sizeof(struct fib_export), M_NETGRAPH, 576 M_NOWAIT | M_ZERO)) == NULL) 577 return (ENOMEM); 578 579 mtx_init(&fe->export_mtx, "export dgram lock", NULL, MTX_DEF); 580 mtx_init(&fe->export9_mtx, "export9 dgram lock", NULL, MTX_DEF); 581 fe->fib = fib; 582 fe->domain_id = fib; 583 584 if (atomic_cmpset_ptr((volatile uintptr_t *)&priv->fib_data[fib], 585 (uintptr_t)NULL, (uintptr_t)fe) == 0) { 586 /* FIB already set up by other ISR */ 587 CTR3(KTR_NET, "ng_netflow(): fib init: %d setup %p but got %p", 588 fib, fe, priv_to_fib(priv, fib)); 589 mtx_destroy(&fe->export_mtx); 590 mtx_destroy(&fe->export9_mtx); 591 free(fe, M_NETGRAPH); 592 } else { 593 /* Increase counter for statistics */ 594 CTR3(KTR_NET, "ng_netflow(): fib %d setup to %p (%p)", 595 fib, fe, priv_to_fib(priv, fib)); 596 priv->nfinfo_alloc_fibs++; 597 } 598 599 return (0); 600 } 601 602 /* Free all flow cache memory. Called from node close method. */ 603 void 604 ng_netflow_cache_flush(priv_p priv) 605 { 606 struct flow_entry *fle, *fle1; 607 struct flow_hash_entry *hsh; 608 struct netflow_export_item exp; 609 fib_export_p fe; 610 int i; 611 612 bzero(&exp, sizeof(exp)); 613 614 /* 615 * We are going to free probably billable data. 616 * Expire everything before freeing it. 617 * No locking is required since callout is already drained. 618 */ 619 for (hsh = priv->hash, i = 0; i < NBUCKETS; hsh++, i++) 620 TAILQ_FOREACH_SAFE(fle, &hsh->head, fle_hash, fle1) { 621 TAILQ_REMOVE(&hsh->head, fle, fle_hash); 622 fe = priv_to_fib(priv, fle->f.r.fib); 623 expire_flow(priv, fe, fle, NG_QUEUE); 624 } 625 #ifdef INET6 626 for (hsh = priv->hash6, i = 0; i < NBUCKETS; hsh++, i++) 627 TAILQ_FOREACH_SAFE(fle, &hsh->head, fle_hash, fle1) { 628 TAILQ_REMOVE(&hsh->head, fle, fle_hash); 629 fe = priv_to_fib(priv, fle->f.r.fib); 630 expire_flow(priv, fe, fle, NG_QUEUE); 631 } 632 #endif 633 634 uma_zdestroy(priv->zone); 635 /* Destroy hash mutexes. */ 636 for (i = 0, hsh = priv->hash; i < NBUCKETS; i++, hsh++) 637 mtx_destroy(&hsh->mtx); 638 639 /* Free hash memory. */ 640 if (priv->hash != NULL) 641 free(priv->hash, M_NETFLOW_HASH); 642 #ifdef INET6 643 uma_zdestroy(priv->zone6); 644 /* Destroy hash mutexes. */ 645 for (i = 0, hsh = priv->hash6; i < NBUCKETS; i++, hsh++) 646 mtx_destroy(&hsh->mtx); 647 648 /* Free hash memory. */ 649 if (priv->hash6 != NULL) 650 free(priv->hash6, M_NETFLOW_HASH); 651 #endif 652 653 for (i = 0; i < priv->maxfibs; i++) { 654 if ((fe = priv_to_fib(priv, i)) == NULL) 655 continue; 656 657 if (fe->exp.item != NULL) 658 export_send(priv, fe, fe->exp.item, NG_QUEUE); 659 660 if (fe->exp.item9 != NULL) 661 export9_send(priv, fe, fe->exp.item9, 662 fe->exp.item9_opt, NG_QUEUE); 663 664 mtx_destroy(&fe->export_mtx); 665 mtx_destroy(&fe->export9_mtx); 666 free(fe, M_NETGRAPH); 667 } 668 669 counter_u64_free(priv->nfinfo_bytes); 670 counter_u64_free(priv->nfinfo_packets); 671 counter_u64_free(priv->nfinfo_bytes6); 672 counter_u64_free(priv->nfinfo_packets6); 673 counter_u64_free(priv->nfinfo_sbytes); 674 counter_u64_free(priv->nfinfo_spackets); 675 counter_u64_free(priv->nfinfo_sbytes6); 676 counter_u64_free(priv->nfinfo_spackets6); 677 counter_u64_free(priv->nfinfo_act_exp); 678 counter_u64_free(priv->nfinfo_inact_exp); 679 680 ng_netflow_v9_cache_flush(priv); 681 } 682 683 /* Insert packet from into flow cache. */ 684 int 685 ng_netflow_flow_add(priv_p priv, fib_export_p fe, struct ip *ip, 686 caddr_t upper_ptr, uint8_t upper_proto, uint8_t flags, 687 unsigned int src_if_index) 688 { 689 struct flow_entry *fle, *fle1; 690 struct flow_hash_entry *hsh; 691 struct flow_rec r; 692 int hlen, plen; 693 int error = 0; 694 uint16_t eproto; 695 uint8_t tcp_flags = 0; 696 697 bzero(&r, sizeof(r)); 698 699 if (ip->ip_v != IPVERSION) 700 return (EINVAL); 701 702 hlen = ip->ip_hl << 2; 703 if (hlen < sizeof(struct ip)) 704 return (EINVAL); 705 706 eproto = ETHERTYPE_IP; 707 /* Assume L4 template by default */ 708 r.flow_type = NETFLOW_V9_FLOW_V4_L4; 709 710 r.r_src = ip->ip_src; 711 r.r_dst = ip->ip_dst; 712 r.fib = fe->fib; 713 714 plen = ntohs(ip->ip_len); 715 716 r.r_ip_p = ip->ip_p; 717 r.r_tos = ip->ip_tos; 718 719 r.r_i_ifx = src_if_index; 720 721 /* 722 * XXX NOTE: only first fragment of fragmented TCP, UDP and 723 * ICMP packet will be recorded with proper s_port and d_port. 724 * Following fragments will be recorded simply as IP packet with 725 * ip_proto = ip->ip_p and s_port, d_port set to zero. 726 * I know, it looks like bug. But I don't want to re-implement 727 * ip packet assebmling here. Anyway, (in)famous trafd works this way - 728 * and nobody complains yet :) 729 */ 730 if ((ip->ip_off & htons(IP_OFFMASK)) == 0) 731 switch(r.r_ip_p) { 732 case IPPROTO_TCP: 733 { 734 struct tcphdr *tcp; 735 736 tcp = (struct tcphdr *)((caddr_t )ip + hlen); 737 r.r_sport = tcp->th_sport; 738 r.r_dport = tcp->th_dport; 739 tcp_flags = tcp->th_flags; 740 break; 741 } 742 case IPPROTO_UDP: 743 r.r_ports = *(uint32_t *)((caddr_t )ip + hlen); 744 break; 745 } 746 747 counter_u64_add(priv->nfinfo_packets, 1); 748 counter_u64_add(priv->nfinfo_bytes, plen); 749 750 /* Find hash slot. */ 751 hsh = &priv->hash[ip_hash(&r)]; 752 753 mtx_lock(&hsh->mtx); 754 755 /* 756 * Go through hash and find our entry. If we encounter an 757 * entry, that should be expired, purge it. We do a reverse 758 * search since most active entries are first, and most 759 * searches are done on most active entries. 760 */ 761 TAILQ_FOREACH_REVERSE_SAFE(fle, &hsh->head, fhead, fle_hash, fle1) { 762 if (bcmp(&r, &fle->f.r, sizeof(struct flow_rec)) == 0) 763 break; 764 if ((INACTIVE(fle) && SMALL(fle)) || AGED(fle)) { 765 TAILQ_REMOVE(&hsh->head, fle, fle_hash); 766 expire_flow(priv, priv_to_fib(priv, fle->f.r.fib), 767 fle, NG_QUEUE); 768 counter_u64_add(priv->nfinfo_act_exp, 1); 769 } 770 } 771 772 if (fle) { /* An existent entry. */ 773 774 fle->f.bytes += plen; 775 fle->f.packets ++; 776 fle->f.tcp_flags |= tcp_flags; 777 fle->f.last = time_uptime; 778 779 /* 780 * We have the following reasons to expire flow in active way: 781 * - it hit active timeout 782 * - a TCP connection closed 783 * - it is going to overflow counter 784 */ 785 if (tcp_flags & TH_FIN || tcp_flags & TH_RST || AGED(fle) || 786 (fle->f.bytes >= (CNTR_MAX - IF_MAXMTU)) ) { 787 TAILQ_REMOVE(&hsh->head, fle, fle_hash); 788 expire_flow(priv, priv_to_fib(priv, fle->f.r.fib), 789 fle, NG_QUEUE); 790 counter_u64_add(priv->nfinfo_act_exp, 1); 791 } else { 792 /* 793 * It is the newest, move it to the tail, 794 * if it isn't there already. Next search will 795 * locate it quicker. 796 */ 797 if (fle != TAILQ_LAST(&hsh->head, fhead)) { 798 TAILQ_REMOVE(&hsh->head, fle, fle_hash); 799 TAILQ_INSERT_TAIL(&hsh->head, fle, fle_hash); 800 } 801 } 802 } else /* A new flow entry. */ 803 error = hash_insert(priv, hsh, &r, plen, flags, tcp_flags); 804 805 mtx_unlock(&hsh->mtx); 806 807 return (error); 808 } 809 810 #ifdef INET6 811 /* Insert IPv6 packet from into flow cache. */ 812 int 813 ng_netflow_flow6_add(priv_p priv, fib_export_p fe, struct ip6_hdr *ip6, 814 caddr_t upper_ptr, uint8_t upper_proto, uint8_t flags, 815 unsigned int src_if_index) 816 { 817 struct flow_entry *fle = NULL, *fle1; 818 struct flow6_entry *fle6; 819 struct flow_hash_entry *hsh; 820 struct flow6_rec r; 821 int plen; 822 int error = 0; 823 uint8_t tcp_flags = 0; 824 825 /* check version */ 826 if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) 827 return (EINVAL); 828 829 bzero(&r, sizeof(r)); 830 831 r.src.r_src6 = ip6->ip6_src; 832 r.dst.r_dst6 = ip6->ip6_dst; 833 r.fib = fe->fib; 834 835 /* Assume L4 template by default */ 836 r.flow_type = NETFLOW_V9_FLOW_V6_L4; 837 838 plen = ntohs(ip6->ip6_plen) + sizeof(struct ip6_hdr); 839 840 #if 0 841 /* XXX: set DSCP/CoS value */ 842 r.r_tos = ip->ip_tos; 843 #endif 844 if ((flags & NG_NETFLOW_IS_FRAG) == 0) { 845 switch(upper_proto) { 846 case IPPROTO_TCP: 847 { 848 struct tcphdr *tcp; 849 850 tcp = (struct tcphdr *)upper_ptr; 851 r.r_ports = *(uint32_t *)upper_ptr; 852 tcp_flags = tcp->th_flags; 853 break; 854 } 855 case IPPROTO_UDP: 856 case IPPROTO_SCTP: 857 r.r_ports = *(uint32_t *)upper_ptr; 858 break; 859 } 860 } 861 862 r.r_ip_p = upper_proto; 863 r.r_i_ifx = src_if_index; 864 865 counter_u64_add(priv->nfinfo_packets6, 1); 866 counter_u64_add(priv->nfinfo_bytes6, plen); 867 868 /* Find hash slot. */ 869 hsh = &priv->hash6[ip6_hash(&r)]; 870 871 mtx_lock(&hsh->mtx); 872 873 /* 874 * Go through hash and find our entry. If we encounter an 875 * entry, that should be expired, purge it. We do a reverse 876 * search since most active entries are first, and most 877 * searches are done on most active entries. 878 */ 879 TAILQ_FOREACH_REVERSE_SAFE(fle, &hsh->head, fhead, fle_hash, fle1) { 880 if (fle->f.version != IP6VERSION) 881 continue; 882 fle6 = (struct flow6_entry *)fle; 883 if (bcmp(&r, &fle6->f.r, sizeof(struct flow6_rec)) == 0) 884 break; 885 if ((INACTIVE(fle6) && SMALL(fle6)) || AGED(fle6)) { 886 TAILQ_REMOVE(&hsh->head, fle, fle_hash); 887 expire_flow(priv, priv_to_fib(priv, fle->f.r.fib), fle, 888 NG_QUEUE); 889 counter_u64_add(priv->nfinfo_act_exp, 1); 890 } 891 } 892 893 if (fle != NULL) { /* An existent entry. */ 894 fle6 = (struct flow6_entry *)fle; 895 896 fle6->f.bytes += plen; 897 fle6->f.packets ++; 898 fle6->f.tcp_flags |= tcp_flags; 899 fle6->f.last = time_uptime; 900 901 /* 902 * We have the following reasons to expire flow in active way: 903 * - it hit active timeout 904 * - a TCP connection closed 905 * - it is going to overflow counter 906 */ 907 if (tcp_flags & TH_FIN || tcp_flags & TH_RST || AGED(fle6) || 908 (fle6->f.bytes >= (CNTR_MAX - IF_MAXMTU)) ) { 909 TAILQ_REMOVE(&hsh->head, fle, fle_hash); 910 expire_flow(priv, priv_to_fib(priv, fle->f.r.fib), fle, 911 NG_QUEUE); 912 counter_u64_add(priv->nfinfo_act_exp, 1); 913 } else { 914 /* 915 * It is the newest, move it to the tail, 916 * if it isn't there already. Next search will 917 * locate it quicker. 918 */ 919 if (fle != TAILQ_LAST(&hsh->head, fhead)) { 920 TAILQ_REMOVE(&hsh->head, fle, fle_hash); 921 TAILQ_INSERT_TAIL(&hsh->head, fle, fle_hash); 922 } 923 } 924 } else /* A new flow entry. */ 925 error = hash6_insert(priv, hsh, &r, plen, flags, tcp_flags); 926 927 mtx_unlock(&hsh->mtx); 928 929 return (error); 930 } 931 #endif 932 933 /* 934 * Return records from cache to userland. 935 * 936 * TODO: matching particular IP should be done in kernel, here. 937 */ 938 int 939 ng_netflow_flow_show(priv_p priv, struct ngnf_show_header *req, 940 struct ngnf_show_header *resp) 941 { 942 struct flow_hash_entry *hsh; 943 struct flow_entry *fle; 944 struct flow_entry_data *data = (struct flow_entry_data *)(resp + 1); 945 #ifdef INET6 946 struct flow6_entry_data *data6 = (struct flow6_entry_data *)(resp + 1); 947 #endif 948 int i, max; 949 950 i = req->hash_id; 951 if (i > NBUCKETS-1) 952 return (EINVAL); 953 954 #ifdef INET6 955 if (req->version == 6) { 956 resp->version = 6; 957 hsh = priv->hash6 + i; 958 max = NREC6_AT_ONCE; 959 } else 960 #endif 961 if (req->version == 4) { 962 resp->version = 4; 963 hsh = priv->hash + i; 964 max = NREC_AT_ONCE; 965 } else 966 return (EINVAL); 967 968 /* 969 * We will transfer not more than NREC_AT_ONCE. More data 970 * will come in next message. 971 * We send current hash index and current record number in list 972 * to userland, and userland should return it back to us. 973 * Then, we will restart with new entry. 974 * 975 * The resulting cache snapshot can be inaccurate if flow expiration 976 * is taking place on hash item between userland data requests for 977 * this hash item id. 978 */ 979 resp->nentries = 0; 980 for (; i < NBUCKETS; hsh++, i++) { 981 int list_id; 982 983 if (mtx_trylock(&hsh->mtx) == 0) { 984 /* 985 * Requested hash index is not available, 986 * relay decision to skip or re-request data 987 * to userland. 988 */ 989 resp->hash_id = i; 990 resp->list_id = 0; 991 return (0); 992 } 993 994 list_id = 0; 995 TAILQ_FOREACH(fle, &hsh->head, fle_hash) { 996 if (hsh->mtx.mtx_lock & MTX_CONTESTED) { 997 resp->hash_id = i; 998 resp->list_id = list_id; 999 mtx_unlock(&hsh->mtx); 1000 return (0); 1001 } 1002 1003 list_id++; 1004 /* Search for particular record in list. */ 1005 if (req->list_id > 0) { 1006 if (list_id < req->list_id) 1007 continue; 1008 1009 /* Requested list position found. */ 1010 req->list_id = 0; 1011 } 1012 #ifdef INET6 1013 if (req->version == 6) { 1014 struct flow6_entry *fle6; 1015 1016 fle6 = (struct flow6_entry *)fle; 1017 bcopy(&fle6->f, data6 + resp->nentries, 1018 sizeof(fle6->f)); 1019 } else 1020 #endif 1021 bcopy(&fle->f, data + resp->nentries, 1022 sizeof(fle->f)); 1023 resp->nentries++; 1024 if (resp->nentries == max) { 1025 resp->hash_id = i; 1026 /* 1027 * If it was the last item in list 1028 * we simply skip to next hash_id. 1029 */ 1030 resp->list_id = list_id + 1; 1031 mtx_unlock(&hsh->mtx); 1032 return (0); 1033 } 1034 } 1035 mtx_unlock(&hsh->mtx); 1036 } 1037 1038 resp->hash_id = resp->list_id = 0; 1039 1040 return (0); 1041 } 1042 1043 /* We have full datagram in privdata. Send it to export hook. */ 1044 static int 1045 export_send(priv_p priv, fib_export_p fe, item_p item, int flags) 1046 { 1047 struct mbuf *m = NGI_M(item); 1048 struct netflow_v5_export_dgram *dgram = mtod(m, 1049 struct netflow_v5_export_dgram *); 1050 struct netflow_v5_header *header = &dgram->header; 1051 struct timespec ts; 1052 int error = 0; 1053 1054 /* Fill mbuf header. */ 1055 m->m_len = m->m_pkthdr.len = sizeof(struct netflow_v5_record) * 1056 header->count + sizeof(struct netflow_v5_header); 1057 1058 /* Fill export header. */ 1059 header->sys_uptime = htonl(MILLIUPTIME(time_uptime)); 1060 getnanotime(&ts); 1061 header->unix_secs = htonl(ts.tv_sec); 1062 header->unix_nsecs = htonl(ts.tv_nsec); 1063 header->engine_type = 0; 1064 header->engine_id = fe->domain_id; 1065 header->pad = 0; 1066 header->flow_seq = htonl(atomic_fetchadd_32(&fe->flow_seq, 1067 header->count)); 1068 header->count = htons(header->count); 1069 1070 if (priv->export != NULL) 1071 NG_FWD_ITEM_HOOK_FLAGS(error, item, priv->export, flags); 1072 else 1073 NG_FREE_ITEM(item); 1074 1075 return (error); 1076 } 1077 1078 1079 /* Add export record to dgram. */ 1080 static int 1081 export_add(item_p item, struct flow_entry *fle) 1082 { 1083 struct netflow_v5_export_dgram *dgram = mtod(NGI_M(item), 1084 struct netflow_v5_export_dgram *); 1085 struct netflow_v5_header *header = &dgram->header; 1086 struct netflow_v5_record *rec; 1087 1088 rec = &dgram->r[header->count]; 1089 header->count ++; 1090 1091 KASSERT(header->count <= NETFLOW_V5_MAX_RECORDS, 1092 ("ng_netflow: export too big")); 1093 1094 /* Fill in export record. */ 1095 rec->src_addr = fle->f.r.r_src.s_addr; 1096 rec->dst_addr = fle->f.r.r_dst.s_addr; 1097 rec->next_hop = fle->f.next_hop.s_addr; 1098 rec->i_ifx = htons(fle->f.fle_i_ifx); 1099 rec->o_ifx = htons(fle->f.fle_o_ifx); 1100 rec->packets = htonl(fle->f.packets); 1101 rec->octets = htonl(fle->f.bytes); 1102 rec->first = htonl(MILLIUPTIME(fle->f.first)); 1103 rec->last = htonl(MILLIUPTIME(fle->f.last)); 1104 rec->s_port = fle->f.r.r_sport; 1105 rec->d_port = fle->f.r.r_dport; 1106 rec->flags = fle->f.tcp_flags; 1107 rec->prot = fle->f.r.r_ip_p; 1108 rec->tos = fle->f.r.r_tos; 1109 rec->dst_mask = fle->f.dst_mask; 1110 rec->src_mask = fle->f.src_mask; 1111 rec->pad1 = 0; 1112 rec->pad2 = 0; 1113 1114 /* Not supported fields. */ 1115 rec->src_as = rec->dst_as = 0; 1116 1117 if (header->count == NETFLOW_V5_MAX_RECORDS) 1118 return (1); /* end of datagram */ 1119 else 1120 return (0); 1121 } 1122 1123 /* Periodic flow expiry run. */ 1124 void 1125 ng_netflow_expire(void *arg) 1126 { 1127 struct flow_entry *fle, *fle1; 1128 struct flow_hash_entry *hsh; 1129 priv_p priv = (priv_p )arg; 1130 int used, i; 1131 1132 /* 1133 * Going through all the cache. 1134 */ 1135 used = uma_zone_get_cur(priv->zone); 1136 for (hsh = priv->hash, i = 0; i < NBUCKETS; hsh++, i++) { 1137 /* 1138 * Skip entries, that are already being worked on. 1139 */ 1140 if (mtx_trylock(&hsh->mtx) == 0) 1141 continue; 1142 1143 TAILQ_FOREACH_SAFE(fle, &hsh->head, fle_hash, fle1) { 1144 /* 1145 * Interrupt thread wants this entry! 1146 * Quick! Quick! Bail out! 1147 */ 1148 if (hsh->mtx.mtx_lock & MTX_CONTESTED) 1149 break; 1150 1151 /* 1152 * Don't expire aggressively while hash collision 1153 * ratio is predicted small. 1154 */ 1155 if (used <= (NBUCKETS*2) && !INACTIVE(fle)) 1156 break; 1157 1158 if ((INACTIVE(fle) && (SMALL(fle) || 1159 (used > (NBUCKETS*2)))) || AGED(fle)) { 1160 TAILQ_REMOVE(&hsh->head, fle, fle_hash); 1161 expire_flow(priv, priv_to_fib(priv, 1162 fle->f.r.fib), fle, NG_NOFLAGS); 1163 used--; 1164 counter_u64_add(priv->nfinfo_inact_exp, 1); 1165 } 1166 } 1167 mtx_unlock(&hsh->mtx); 1168 } 1169 1170 #ifdef INET6 1171 used = uma_zone_get_cur(priv->zone6); 1172 for (hsh = priv->hash6, i = 0; i < NBUCKETS; hsh++, i++) { 1173 struct flow6_entry *fle6; 1174 1175 /* 1176 * Skip entries, that are already being worked on. 1177 */ 1178 if (mtx_trylock(&hsh->mtx) == 0) 1179 continue; 1180 1181 TAILQ_FOREACH_SAFE(fle, &hsh->head, fle_hash, fle1) { 1182 fle6 = (struct flow6_entry *)fle; 1183 /* 1184 * Interrupt thread wants this entry! 1185 * Quick! Quick! Bail out! 1186 */ 1187 if (hsh->mtx.mtx_lock & MTX_CONTESTED) 1188 break; 1189 1190 /* 1191 * Don't expire aggressively while hash collision 1192 * ratio is predicted small. 1193 */ 1194 if (used <= (NBUCKETS*2) && !INACTIVE(fle6)) 1195 break; 1196 1197 if ((INACTIVE(fle6) && (SMALL(fle6) || 1198 (used > (NBUCKETS*2)))) || AGED(fle6)) { 1199 TAILQ_REMOVE(&hsh->head, fle, fle_hash); 1200 expire_flow(priv, priv_to_fib(priv, 1201 fle->f.r.fib), fle, NG_NOFLAGS); 1202 used--; 1203 counter_u64_add(priv->nfinfo_inact_exp, 1); 1204 } 1205 } 1206 mtx_unlock(&hsh->mtx); 1207 } 1208 #endif 1209 1210 /* Schedule next expire. */ 1211 callout_reset(&priv->exp_callout, (1*hz), &ng_netflow_expire, 1212 (void *)priv); 1213 } 1214