1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2010-2011 Alexander V. Chernikov <melifaro@ipfw.ru> 5 * Copyright (c) 2004-2005 Gleb Smirnoff <glebius@FreeBSD.org> 6 * Copyright (c) 2001-2003 Roman V. Palagin <romanp@unshadow.net> 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28 * SUCH DAMAGE. 29 * 30 * $SourceForge: netflow.c,v 1.41 2004/09/05 11:41:10 glebius Exp $ 31 */ 32 33 #include <sys/cdefs.h> 34 #include "opt_inet.h" 35 #include "opt_inet6.h" 36 #include <sys/param.h> 37 #include <sys/bitstring.h> 38 #include <sys/systm.h> 39 #include <sys/counter.h> 40 #include <sys/kernel.h> 41 #include <sys/ktr.h> 42 #include <sys/limits.h> 43 #include <sys/mbuf.h> 44 #include <sys/syslog.h> 45 #include <sys/socket.h> 46 #include <vm/uma.h> 47 48 #include <net/if.h> 49 #include <net/if_dl.h> 50 #include <net/if_var.h> 51 #include <net/if_private.h> 52 #include <net/route.h> 53 #include <net/route/nhop.h> 54 #include <net/route/route_ctl.h> 55 #include <net/ethernet.h> 56 #include <netinet/in.h> 57 #include <netinet/in_fib.h> 58 #include <netinet/in_systm.h> 59 #include <netinet/ip.h> 60 #include <netinet/ip6.h> 61 #include <netinet/tcp.h> 62 #include <netinet/udp.h> 63 64 #include <netinet6/in6_fib.h> 65 66 #include <netgraph/ng_message.h> 67 #include <netgraph/netgraph.h> 68 69 #include <netgraph/netflow/netflow.h> 70 #include <netgraph/netflow/netflow_v9.h> 71 #include <netgraph/netflow/ng_netflow.h> 72 73 #define NBUCKETS (65536) /* must be power of 2 */ 74 75 /* This hash is for TCP or UDP packets. */ 76 #define FULL_HASH(addr1, addr2, port1, port2) \ 77 (((addr1 ^ (addr1 >> 16) ^ \ 78 htons(addr2 ^ (addr2 >> 16))) ^ \ 79 port1 ^ htons(port2)) & \ 80 (NBUCKETS - 1)) 81 82 /* This hash is for all other IP packets. */ 83 #define ADDR_HASH(addr1, addr2) \ 84 ((addr1 ^ (addr1 >> 16) ^ \ 85 htons(addr2 ^ (addr2 >> 16))) & \ 86 (NBUCKETS - 1)) 87 88 /* Macros to shorten logical constructions */ 89 /* XXX: priv must exist in namespace */ 90 #define INACTIVE(fle) (time_uptime - fle->f.last > priv->nfinfo_inact_t) 91 #define AGED(fle) (time_uptime - fle->f.first > priv->nfinfo_act_t) 92 #define ISFREE(fle) (fle->f.packets == 0) 93 94 /* 95 * 4 is a magical number: statistically number of 4-packet flows is 96 * bigger than 5,6,7...-packet flows by an order of magnitude. Most UDP/ICMP 97 * scans are 1 packet (~ 90% of flow cache). TCP scans are 2-packet in case 98 * of reachable host and 4-packet otherwise. 99 */ 100 #define SMALL(fle) (fle->f.packets <= 4) 101 102 MALLOC_DEFINE(M_NETFLOW_HASH, "netflow_hash", "NetFlow hash"); 103 104 static int export_add(item_p, struct flow_entry *); 105 static int export_send(priv_p, fib_export_p, item_p, int); 106 107 #ifdef INET 108 static int hash_insert(priv_p, struct flow_hash_entry *, struct flow_rec *, 109 int, uint8_t, uint16_t); 110 #endif 111 #ifdef INET6 112 static int hash6_insert(priv_p, struct flow_hash_entry *, struct flow6_rec *, 113 int, uint8_t, uint16_t); 114 #endif 115 116 static void expire_flow(priv_p, fib_export_p, struct flow_entry *, int); 117 118 #ifdef INET 119 /* 120 * Generate hash for a given flow record. 121 * 122 * FIB is not used here, because: 123 * most VRFS will carry public IPv4 addresses which are unique even 124 * without FIB private addresses can overlap, but this is worked out 125 * via flow_rec bcmp() containing fib id. In IPv6 world addresses are 126 * all globally unique (it's not fully true, there is FC00::/7 for example, 127 * but chances of address overlap are MUCH smaller) 128 */ 129 static inline uint32_t 130 ip_hash(struct flow_rec *r) 131 { 132 133 switch (r->r_ip_p) { 134 case IPPROTO_TCP: 135 case IPPROTO_UDP: 136 return FULL_HASH(r->r_src.s_addr, r->r_dst.s_addr, 137 r->r_sport, r->r_dport); 138 default: 139 return ADDR_HASH(r->r_src.s_addr, r->r_dst.s_addr); 140 } 141 } 142 #endif 143 144 #ifdef INET6 145 /* Generate hash for a given flow6 record. Use lower 4 octets from v6 addresses */ 146 static inline uint32_t 147 ip6_hash(struct flow6_rec *r) 148 { 149 150 switch (r->r_ip_p) { 151 case IPPROTO_TCP: 152 case IPPROTO_UDP: 153 return FULL_HASH(r->src.r_src6.__u6_addr.__u6_addr32[3], 154 r->dst.r_dst6.__u6_addr.__u6_addr32[3], r->r_sport, 155 r->r_dport); 156 default: 157 return ADDR_HASH(r->src.r_src6.__u6_addr.__u6_addr32[3], 158 r->dst.r_dst6.__u6_addr.__u6_addr32[3]); 159 } 160 } 161 162 #endif 163 164 /* 165 * Detach export datagram from priv, if there is any. 166 * If there is no, allocate a new one. 167 */ 168 static item_p 169 get_export_dgram(priv_p priv, fib_export_p fe) 170 { 171 item_p item = NULL; 172 173 mtx_lock(&fe->export_mtx); 174 if (fe->exp.item != NULL) { 175 item = fe->exp.item; 176 fe->exp.item = NULL; 177 } 178 mtx_unlock(&fe->export_mtx); 179 180 if (item == NULL) { 181 struct netflow_v5_export_dgram *dgram; 182 struct mbuf *m; 183 184 m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR); 185 if (m == NULL) 186 return (NULL); 187 item = ng_package_data(m, NG_NOFLAGS); 188 if (item == NULL) 189 return (NULL); 190 dgram = mtod(m, struct netflow_v5_export_dgram *); 191 dgram->header.count = 0; 192 dgram->header.version = htons(NETFLOW_V5); 193 dgram->header.pad = 0; 194 } 195 196 return (item); 197 } 198 199 /* 200 * Re-attach incomplete datagram back to priv. 201 * If there is already another one, then send incomplete. */ 202 static void 203 return_export_dgram(priv_p priv, fib_export_p fe, item_p item, int flags) 204 { 205 206 /* 207 * It may happen on SMP, that some thread has already 208 * put its item there, in this case we bail out and 209 * send what we have to collector. 210 */ 211 mtx_lock(&fe->export_mtx); 212 if (fe->exp.item == NULL) { 213 fe->exp.item = item; 214 mtx_unlock(&fe->export_mtx); 215 } else { 216 mtx_unlock(&fe->export_mtx); 217 export_send(priv, fe, item, flags); 218 } 219 } 220 221 /* 222 * The flow is over. Call export_add() and free it. If datagram is 223 * full, then call export_send(). 224 */ 225 static void 226 expire_flow(priv_p priv, fib_export_p fe, struct flow_entry *fle, int flags) 227 { 228 struct netflow_export_item exp; 229 uint16_t version = fle->f.version; 230 231 if ((priv->export != NULL) && (version == IPVERSION)) { 232 exp.item = get_export_dgram(priv, fe); 233 if (exp.item == NULL) { 234 priv->nfinfo_export_failed++; 235 if (priv->export9 != NULL) 236 priv->nfinfo_export9_failed++; 237 /* fle definitely contains IPv4 flow. */ 238 uma_zfree_arg(priv->zone, fle, priv); 239 return; 240 } 241 242 if (export_add(exp.item, fle) > 0) 243 export_send(priv, fe, exp.item, flags); 244 else 245 return_export_dgram(priv, fe, exp.item, NG_QUEUE); 246 } 247 248 if (priv->export9 != NULL) { 249 exp.item9 = get_export9_dgram(priv, fe, &exp.item9_opt); 250 if (exp.item9 == NULL) { 251 priv->nfinfo_export9_failed++; 252 if (version == IPVERSION) 253 uma_zfree_arg(priv->zone, fle, priv); 254 #ifdef INET6 255 else if (version == IP6VERSION) 256 uma_zfree_arg(priv->zone6, fle, priv); 257 #endif 258 else 259 panic("ng_netflow: Unknown IP proto: %d", 260 version); 261 return; 262 } 263 264 if (export9_add(exp.item9, exp.item9_opt, fle) > 0) 265 export9_send(priv, fe, exp.item9, exp.item9_opt, flags); 266 else 267 return_export9_dgram(priv, fe, exp.item9, 268 exp.item9_opt, NG_QUEUE); 269 } 270 271 if (version == IPVERSION) 272 uma_zfree_arg(priv->zone, fle, priv); 273 #ifdef INET6 274 else if (version == IP6VERSION) 275 uma_zfree_arg(priv->zone6, fle, priv); 276 #endif 277 } 278 279 /* Get a snapshot of node statistics */ 280 void 281 ng_netflow_copyinfo(priv_p priv, struct ng_netflow_info *i) 282 { 283 284 i->nfinfo_bytes = counter_u64_fetch(priv->nfinfo_bytes); 285 i->nfinfo_packets = counter_u64_fetch(priv->nfinfo_packets); 286 i->nfinfo_bytes6 = counter_u64_fetch(priv->nfinfo_bytes6); 287 i->nfinfo_packets6 = counter_u64_fetch(priv->nfinfo_packets6); 288 i->nfinfo_sbytes = counter_u64_fetch(priv->nfinfo_sbytes); 289 i->nfinfo_spackets = counter_u64_fetch(priv->nfinfo_spackets); 290 i->nfinfo_sbytes6 = counter_u64_fetch(priv->nfinfo_sbytes6); 291 i->nfinfo_spackets6 = counter_u64_fetch(priv->nfinfo_spackets6); 292 i->nfinfo_act_exp = counter_u64_fetch(priv->nfinfo_act_exp); 293 i->nfinfo_inact_exp = counter_u64_fetch(priv->nfinfo_inact_exp); 294 295 i->nfinfo_used = uma_zone_get_cur(priv->zone); 296 #ifdef INET6 297 i->nfinfo_used6 = uma_zone_get_cur(priv->zone6); 298 #endif 299 300 i->nfinfo_alloc_failed = priv->nfinfo_alloc_failed; 301 i->nfinfo_export_failed = priv->nfinfo_export_failed; 302 i->nfinfo_export9_failed = priv->nfinfo_export9_failed; 303 i->nfinfo_realloc_mbuf = priv->nfinfo_realloc_mbuf; 304 i->nfinfo_alloc_fibs = priv->nfinfo_alloc_fibs; 305 i->nfinfo_inact_t = priv->nfinfo_inact_t; 306 i->nfinfo_act_t = priv->nfinfo_act_t; 307 } 308 309 /* 310 * Insert a record into defined slot. 311 * 312 * First we get for us a free flow entry, then fill in all 313 * possible fields in it. 314 * 315 * TODO: consider dropping hash mutex while filling in datagram, 316 * as this was done in previous version. Need to test & profile 317 * to be sure. 318 */ 319 #ifdef INET 320 static int 321 hash_insert(priv_p priv, struct flow_hash_entry *hsh, struct flow_rec *r, 322 int plen, uint8_t flags, uint16_t tcp_flags) 323 { 324 struct flow_entry *fle; 325 326 mtx_assert(&hsh->mtx, MA_OWNED); 327 328 fle = uma_zalloc_arg(priv->zone, priv, M_NOWAIT); 329 if (fle == NULL) { 330 priv->nfinfo_alloc_failed++; 331 return (ENOMEM); 332 } 333 334 /* 335 * Now fle is totally ours. It is detached from all lists, 336 * we can safely edit it. 337 */ 338 fle->f.version = IPVERSION; 339 bcopy(r, &fle->f.r, sizeof(struct flow_rec)); 340 fle->f.bytes = plen; 341 fle->f.packets = 1; 342 fle->f.tcp_flags = tcp_flags; 343 344 fle->f.first = fle->f.last = time_uptime; 345 346 /* 347 * First we do route table lookup on destination address. So we can 348 * fill in out_ifx, dst_mask, nexthop, and dst_as in future releases. 349 */ 350 if ((flags & NG_NETFLOW_CONF_NODSTLOOKUP) == 0) { 351 struct rtentry *rt; 352 struct route_nhop_data rnd; 353 354 rt = fib4_lookup_rt(r->fib, fle->f.r.r_dst, 0, NHR_NONE, &rnd); 355 if (rt != NULL) { 356 struct in_addr addr; 357 uint32_t scopeid; 358 struct nhop_object *nh = nhop_select_func(rnd.rnd_nhop, 0); 359 int plen; 360 361 rt_get_inet_prefix_plen(rt, &addr, &plen, &scopeid); 362 fle->f.fle_o_ifx = nh->nh_ifp->if_index; 363 if (nh->gw_sa.sa_family == AF_INET) 364 fle->f.next_hop = nh->gw4_sa.sin_addr; 365 /* 366 * XXX we're leaving an empty gateway here for 367 * IPv6 nexthops. 368 */ 369 fle->f.dst_mask = plen; 370 } 371 } 372 373 /* Do route lookup on source address, to fill in src_mask. */ 374 if ((flags & NG_NETFLOW_CONF_NOSRCLOOKUP) == 0) { 375 struct rtentry *rt; 376 struct route_nhop_data rnd; 377 378 rt = fib4_lookup_rt(r->fib, fle->f.r.r_src, 0, NHR_NONE, &rnd); 379 if (rt != NULL) { 380 struct in_addr addr; 381 uint32_t scopeid; 382 int plen; 383 384 rt_get_inet_prefix_plen(rt, &addr, &plen, &scopeid); 385 fle->f.src_mask = plen; 386 } 387 } 388 389 /* Push new flow at the and of hash. */ 390 TAILQ_INSERT_TAIL(&hsh->head, fle, fle_hash); 391 392 return (0); 393 } 394 #endif 395 396 #ifdef INET6 397 static int 398 hash6_insert(priv_p priv, struct flow_hash_entry *hsh6, struct flow6_rec *r, 399 int plen, uint8_t flags, uint16_t tcp_flags) 400 { 401 struct flow6_entry *fle6; 402 403 mtx_assert(&hsh6->mtx, MA_OWNED); 404 405 fle6 = uma_zalloc_arg(priv->zone6, priv, M_NOWAIT); 406 if (fle6 == NULL) { 407 priv->nfinfo_alloc_failed++; 408 return (ENOMEM); 409 } 410 411 /* 412 * Now fle is totally ours. It is detached from all lists, 413 * we can safely edit it. 414 */ 415 416 fle6->f.version = IP6VERSION; 417 bcopy(r, &fle6->f.r, sizeof(struct flow6_rec)); 418 fle6->f.bytes = plen; 419 fle6->f.packets = 1; 420 fle6->f.tcp_flags = tcp_flags; 421 422 fle6->f.first = fle6->f.last = time_uptime; 423 424 /* 425 * First we do route table lookup on destination address. So we can 426 * fill in out_ifx, dst_mask, nexthop, and dst_as in future releases. 427 */ 428 if ((flags & NG_NETFLOW_CONF_NODSTLOOKUP) == 0) { 429 struct rtentry *rt; 430 struct route_nhop_data rnd; 431 432 rt = fib6_lookup_rt(r->fib, &fle6->f.r.dst.r_dst6, 0, NHR_NONE, &rnd); 433 if (rt != NULL) { 434 struct in6_addr addr; 435 uint32_t scopeid; 436 struct nhop_object *nh = nhop_select_func(rnd.rnd_nhop, 0); 437 int plen; 438 439 rt_get_inet6_prefix_plen(rt, &addr, &plen, &scopeid); 440 fle6->f.fle_o_ifx = nh->nh_ifp->if_index; 441 if (nh->gw_sa.sa_family == AF_INET6) 442 fle6->f.n.next_hop6 = nh->gw6_sa.sin6_addr; 443 fle6->f.dst_mask = plen; 444 } 445 } 446 447 if ((flags & NG_NETFLOW_CONF_NOSRCLOOKUP) == 0) { 448 /* Do route lookup on source address, to fill in src_mask. */ 449 struct rtentry *rt; 450 struct route_nhop_data rnd; 451 452 rt = fib6_lookup_rt(r->fib, &fle6->f.r.src.r_src6, 0, NHR_NONE, &rnd); 453 if (rt != NULL) { 454 struct in6_addr addr; 455 uint32_t scopeid; 456 int plen; 457 458 rt_get_inet6_prefix_plen(rt, &addr, &plen, &scopeid); 459 fle6->f.src_mask = plen; 460 } 461 } 462 463 /* Push new flow at the and of hash. */ 464 TAILQ_INSERT_TAIL(&hsh6->head, (struct flow_entry *)fle6, fle_hash); 465 466 return (0); 467 } 468 #endif 469 470 /* 471 * Non-static functions called from ng_netflow.c 472 */ 473 474 /* Allocate memory and set up flow cache */ 475 void 476 ng_netflow_cache_init(priv_p priv) 477 { 478 struct flow_hash_entry *hsh; 479 int i; 480 481 /* Initialize cache UMA zone. */ 482 priv->zone = uma_zcreate("NetFlow IPv4 cache", 483 sizeof(struct flow_entry), NULL, NULL, NULL, NULL, 484 UMA_ALIGN_CACHE, 0); 485 uma_zone_set_max(priv->zone, CACHESIZE); 486 #ifdef INET6 487 priv->zone6 = uma_zcreate("NetFlow IPv6 cache", 488 sizeof(struct flow6_entry), NULL, NULL, NULL, NULL, 489 UMA_ALIGN_CACHE, 0); 490 uma_zone_set_max(priv->zone6, CACHESIZE); 491 #endif 492 493 /* Allocate hash. */ 494 priv->hash = malloc(NBUCKETS * sizeof(struct flow_hash_entry), 495 M_NETFLOW_HASH, M_WAITOK | M_ZERO); 496 497 /* Initialize hash. */ 498 for (i = 0, hsh = priv->hash; i < NBUCKETS; i++, hsh++) { 499 mtx_init(&hsh->mtx, "hash mutex", NULL, MTX_DEF); 500 TAILQ_INIT(&hsh->head); 501 } 502 503 #ifdef INET6 504 /* Allocate hash. */ 505 priv->hash6 = malloc(NBUCKETS * sizeof(struct flow_hash_entry), 506 M_NETFLOW_HASH, M_WAITOK | M_ZERO); 507 508 /* Initialize hash. */ 509 for (i = 0, hsh = priv->hash6; i < NBUCKETS; i++, hsh++) { 510 mtx_init(&hsh->mtx, "hash mutex", NULL, MTX_DEF); 511 TAILQ_INIT(&hsh->head); 512 } 513 #endif 514 515 priv->nfinfo_bytes = counter_u64_alloc(M_WAITOK); 516 priv->nfinfo_packets = counter_u64_alloc(M_WAITOK); 517 priv->nfinfo_bytes6 = counter_u64_alloc(M_WAITOK); 518 priv->nfinfo_packets6 = counter_u64_alloc(M_WAITOK); 519 priv->nfinfo_sbytes = counter_u64_alloc(M_WAITOK); 520 priv->nfinfo_spackets = counter_u64_alloc(M_WAITOK); 521 priv->nfinfo_sbytes6 = counter_u64_alloc(M_WAITOK); 522 priv->nfinfo_spackets6 = counter_u64_alloc(M_WAITOK); 523 priv->nfinfo_act_exp = counter_u64_alloc(M_WAITOK); 524 priv->nfinfo_inact_exp = counter_u64_alloc(M_WAITOK); 525 526 ng_netflow_v9_cache_init(priv); 527 CTR0(KTR_NET, "ng_netflow startup()"); 528 } 529 530 /* Initialize new FIB table for v5 and v9 */ 531 int 532 ng_netflow_fib_init(priv_p priv, int fib) 533 { 534 fib_export_p fe = priv_to_fib(priv, fib); 535 536 CTR1(KTR_NET, "ng_netflow(): fib init: %d", fib); 537 538 if (fe != NULL) 539 return (0); 540 541 if ((fe = malloc(sizeof(struct fib_export), M_NETGRAPH, 542 M_NOWAIT | M_ZERO)) == NULL) 543 return (ENOMEM); 544 545 mtx_init(&fe->export_mtx, "export dgram lock", NULL, MTX_DEF); 546 mtx_init(&fe->export9_mtx, "export9 dgram lock", NULL, MTX_DEF); 547 fe->fib = fib; 548 fe->domain_id = fib; 549 550 if (atomic_cmpset_ptr((volatile uintptr_t *)&priv->fib_data[fib], 551 (uintptr_t)NULL, (uintptr_t)fe) == 0) { 552 /* FIB already set up by other ISR */ 553 CTR3(KTR_NET, "ng_netflow(): fib init: %d setup %p but got %p", 554 fib, fe, priv_to_fib(priv, fib)); 555 mtx_destroy(&fe->export_mtx); 556 mtx_destroy(&fe->export9_mtx); 557 free(fe, M_NETGRAPH); 558 } else { 559 /* Increase counter for statistics */ 560 CTR3(KTR_NET, "ng_netflow(): fib %d setup to %p (%p)", 561 fib, fe, priv_to_fib(priv, fib)); 562 priv->nfinfo_alloc_fibs++; 563 } 564 565 return (0); 566 } 567 568 /* Free all flow cache memory. Called from node close method. */ 569 void 570 ng_netflow_cache_flush(priv_p priv) 571 { 572 struct flow_entry *fle, *fle1; 573 struct flow_hash_entry *hsh; 574 struct netflow_export_item exp; 575 fib_export_p fe; 576 int i; 577 578 bzero(&exp, sizeof(exp)); 579 580 /* 581 * We are going to free probably billable data. 582 * Expire everything before freeing it. 583 * No locking is required since callout is already drained. 584 */ 585 for (hsh = priv->hash, i = 0; i < NBUCKETS; hsh++, i++) 586 TAILQ_FOREACH_SAFE(fle, &hsh->head, fle_hash, fle1) { 587 TAILQ_REMOVE(&hsh->head, fle, fle_hash); 588 fe = priv_to_fib(priv, fle->f.r.fib); 589 expire_flow(priv, fe, fle, NG_QUEUE); 590 } 591 #ifdef INET6 592 for (hsh = priv->hash6, i = 0; i < NBUCKETS; hsh++, i++) 593 TAILQ_FOREACH_SAFE(fle, &hsh->head, fle_hash, fle1) { 594 TAILQ_REMOVE(&hsh->head, fle, fle_hash); 595 fe = priv_to_fib(priv, fle->f.r.fib); 596 expire_flow(priv, fe, fle, NG_QUEUE); 597 } 598 #endif 599 600 uma_zdestroy(priv->zone); 601 /* Destroy hash mutexes. */ 602 for (i = 0, hsh = priv->hash; i < NBUCKETS; i++, hsh++) 603 mtx_destroy(&hsh->mtx); 604 605 /* Free hash memory. */ 606 if (priv->hash != NULL) 607 free(priv->hash, M_NETFLOW_HASH); 608 #ifdef INET6 609 uma_zdestroy(priv->zone6); 610 /* Destroy hash mutexes. */ 611 for (i = 0, hsh = priv->hash6; i < NBUCKETS; i++, hsh++) 612 mtx_destroy(&hsh->mtx); 613 614 /* Free hash memory. */ 615 if (priv->hash6 != NULL) 616 free(priv->hash6, M_NETFLOW_HASH); 617 #endif 618 619 for (i = 0; i < priv->maxfibs; i++) { 620 if ((fe = priv_to_fib(priv, i)) == NULL) 621 continue; 622 623 if (fe->exp.item != NULL) 624 export_send(priv, fe, fe->exp.item, NG_QUEUE); 625 626 if (fe->exp.item9 != NULL) 627 export9_send(priv, fe, fe->exp.item9, 628 fe->exp.item9_opt, NG_QUEUE); 629 630 mtx_destroy(&fe->export_mtx); 631 mtx_destroy(&fe->export9_mtx); 632 free(fe, M_NETGRAPH); 633 } 634 635 counter_u64_free(priv->nfinfo_bytes); 636 counter_u64_free(priv->nfinfo_packets); 637 counter_u64_free(priv->nfinfo_bytes6); 638 counter_u64_free(priv->nfinfo_packets6); 639 counter_u64_free(priv->nfinfo_sbytes); 640 counter_u64_free(priv->nfinfo_spackets); 641 counter_u64_free(priv->nfinfo_sbytes6); 642 counter_u64_free(priv->nfinfo_spackets6); 643 counter_u64_free(priv->nfinfo_act_exp); 644 counter_u64_free(priv->nfinfo_inact_exp); 645 646 ng_netflow_v9_cache_flush(priv); 647 } 648 649 #ifdef INET 650 /* Insert packet from into flow cache. */ 651 int 652 ng_netflow_flow_add(priv_p priv, fib_export_p fe, struct ip *ip, 653 caddr_t upper_ptr, uint8_t upper_proto, uint8_t flags, 654 unsigned int src_if_index) 655 { 656 struct flow_entry *fle, *fle1; 657 struct flow_hash_entry *hsh; 658 struct flow_rec r; 659 int hlen, plen; 660 int error = 0; 661 uint16_t tcp_flags = 0; 662 663 bzero(&r, sizeof(r)); 664 665 if (ip->ip_v != IPVERSION) 666 return (EINVAL); 667 668 hlen = ip->ip_hl << 2; 669 if (hlen < sizeof(struct ip)) 670 return (EINVAL); 671 672 /* Assume L4 template by default */ 673 r.flow_type = NETFLOW_V9_FLOW_V4_L4; 674 675 r.r_src = ip->ip_src; 676 r.r_dst = ip->ip_dst; 677 r.fib = fe->fib; 678 679 plen = ntohs(ip->ip_len); 680 681 r.r_ip_p = ip->ip_p; 682 r.r_tos = ip->ip_tos; 683 684 r.r_i_ifx = src_if_index; 685 686 /* 687 * XXX NOTE: only first fragment of fragmented TCP, UDP and 688 * ICMP packet will be recorded with proper s_port and d_port. 689 * Following fragments will be recorded simply as IP packet with 690 * ip_proto = ip->ip_p and s_port, d_port set to zero. 691 * I know, it looks like bug. But I don't want to re-implement 692 * ip packet assebmling here. Anyway, (in)famous trafd works this way - 693 * and nobody complains yet :) 694 */ 695 if ((ip->ip_off & htons(IP_OFFMASK)) == 0) 696 switch(r.r_ip_p) { 697 case IPPROTO_TCP: 698 { 699 struct tcphdr *tcp; 700 701 tcp = (struct tcphdr *)((caddr_t )ip + hlen); 702 r.r_sport = tcp->th_sport; 703 r.r_dport = tcp->th_dport; 704 tcp_flags = tcp_get_flags(tcp); 705 break; 706 } 707 case IPPROTO_UDP: 708 r.r_ports = *(uint32_t *)((caddr_t )ip + hlen); 709 break; 710 } 711 712 counter_u64_add(priv->nfinfo_packets, 1); 713 counter_u64_add(priv->nfinfo_bytes, plen); 714 715 /* Find hash slot. */ 716 hsh = &priv->hash[ip_hash(&r)]; 717 718 mtx_lock(&hsh->mtx); 719 720 /* 721 * Go through hash and find our entry. If we encounter an 722 * entry, that should be expired, purge it. We do a reverse 723 * search since most active entries are first, and most 724 * searches are done on most active entries. 725 */ 726 TAILQ_FOREACH_REVERSE_SAFE(fle, &hsh->head, fhead, fle_hash, fle1) { 727 if (bcmp(&r, &fle->f.r, sizeof(struct flow_rec)) == 0) 728 break; 729 if ((INACTIVE(fle) && SMALL(fle)) || AGED(fle)) { 730 TAILQ_REMOVE(&hsh->head, fle, fle_hash); 731 expire_flow(priv, priv_to_fib(priv, fle->f.r.fib), 732 fle, NG_QUEUE); 733 counter_u64_add(priv->nfinfo_act_exp, 1); 734 } 735 } 736 737 if (fle) { /* An existent entry. */ 738 739 fle->f.bytes += plen; 740 fle->f.packets ++; 741 fle->f.tcp_flags |= tcp_flags; 742 fle->f.last = time_uptime; 743 744 /* 745 * We have the following reasons to expire flow in active way: 746 * - it hit active timeout 747 * - a TCP connection closed 748 * - it is going to overflow counter 749 */ 750 if (tcp_flags & TH_FIN || tcp_flags & TH_RST || AGED(fle) || 751 (fle->f.bytes >= (CNTR_MAX - IF_MAXMTU)) ) { 752 TAILQ_REMOVE(&hsh->head, fle, fle_hash); 753 expire_flow(priv, priv_to_fib(priv, fle->f.r.fib), 754 fle, NG_QUEUE); 755 counter_u64_add(priv->nfinfo_act_exp, 1); 756 } else { 757 /* 758 * It is the newest, move it to the tail, 759 * if it isn't there already. Next search will 760 * locate it quicker. 761 */ 762 if (fle != TAILQ_LAST(&hsh->head, fhead)) { 763 TAILQ_REMOVE(&hsh->head, fle, fle_hash); 764 TAILQ_INSERT_TAIL(&hsh->head, fle, fle_hash); 765 } 766 } 767 } else /* A new flow entry. */ 768 error = hash_insert(priv, hsh, &r, plen, flags, tcp_flags); 769 770 mtx_unlock(&hsh->mtx); 771 772 return (error); 773 } 774 #endif 775 776 #ifdef INET6 777 /* Insert IPv6 packet from into flow cache. */ 778 int 779 ng_netflow_flow6_add(priv_p priv, fib_export_p fe, struct ip6_hdr *ip6, 780 caddr_t upper_ptr, uint8_t upper_proto, uint8_t flags, 781 unsigned int src_if_index) 782 { 783 struct flow_entry *fle = NULL, *fle1; 784 struct flow6_entry *fle6; 785 struct flow_hash_entry *hsh; 786 struct flow6_rec r; 787 int plen; 788 int error = 0; 789 uint16_t tcp_flags = 0; 790 791 /* check version */ 792 if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) 793 return (EINVAL); 794 795 bzero(&r, sizeof(r)); 796 797 r.src.r_src6 = ip6->ip6_src; 798 r.dst.r_dst6 = ip6->ip6_dst; 799 r.fib = fe->fib; 800 801 /* Assume L4 template by default */ 802 r.flow_type = NETFLOW_V9_FLOW_V6_L4; 803 804 plen = ntohs(ip6->ip6_plen) + sizeof(struct ip6_hdr); 805 806 #if 0 807 /* XXX: set DSCP/CoS value */ 808 r.r_tos = ip->ip_tos; 809 #endif 810 if ((flags & NG_NETFLOW_IS_FRAG) == 0) { 811 switch(upper_proto) { 812 case IPPROTO_TCP: 813 { 814 struct tcphdr *tcp; 815 816 tcp = (struct tcphdr *)upper_ptr; 817 r.r_ports = *(uint32_t *)upper_ptr; 818 tcp_flags = tcp_get_flags(tcp); 819 break; 820 } 821 case IPPROTO_UDP: 822 case IPPROTO_SCTP: 823 r.r_ports = *(uint32_t *)upper_ptr; 824 break; 825 } 826 } 827 828 r.r_ip_p = upper_proto; 829 r.r_i_ifx = src_if_index; 830 831 counter_u64_add(priv->nfinfo_packets6, 1); 832 counter_u64_add(priv->nfinfo_bytes6, plen); 833 834 /* Find hash slot. */ 835 hsh = &priv->hash6[ip6_hash(&r)]; 836 837 mtx_lock(&hsh->mtx); 838 839 /* 840 * Go through hash and find our entry. If we encounter an 841 * entry, that should be expired, purge it. We do a reverse 842 * search since most active entries are first, and most 843 * searches are done on most active entries. 844 */ 845 TAILQ_FOREACH_REVERSE_SAFE(fle, &hsh->head, fhead, fle_hash, fle1) { 846 if (fle->f.version != IP6VERSION) 847 continue; 848 fle6 = (struct flow6_entry *)fle; 849 if (bcmp(&r, &fle6->f.r, sizeof(struct flow6_rec)) == 0) 850 break; 851 if ((INACTIVE(fle6) && SMALL(fle6)) || AGED(fle6)) { 852 TAILQ_REMOVE(&hsh->head, fle, fle_hash); 853 expire_flow(priv, priv_to_fib(priv, fle->f.r.fib), fle, 854 NG_QUEUE); 855 counter_u64_add(priv->nfinfo_act_exp, 1); 856 } 857 } 858 859 if (fle != NULL) { /* An existent entry. */ 860 fle6 = (struct flow6_entry *)fle; 861 862 fle6->f.bytes += plen; 863 fle6->f.packets ++; 864 fle6->f.tcp_flags |= tcp_flags; 865 fle6->f.last = time_uptime; 866 867 /* 868 * We have the following reasons to expire flow in active way: 869 * - it hit active timeout 870 * - a TCP connection closed 871 * - it is going to overflow counter 872 */ 873 if (tcp_flags & TH_FIN || tcp_flags & TH_RST || AGED(fle6) || 874 (fle6->f.bytes >= (CNTR_MAX - IF_MAXMTU)) ) { 875 TAILQ_REMOVE(&hsh->head, fle, fle_hash); 876 expire_flow(priv, priv_to_fib(priv, fle->f.r.fib), fle, 877 NG_QUEUE); 878 counter_u64_add(priv->nfinfo_act_exp, 1); 879 } else { 880 /* 881 * It is the newest, move it to the tail, 882 * if it isn't there already. Next search will 883 * locate it quicker. 884 */ 885 if (fle != TAILQ_LAST(&hsh->head, fhead)) { 886 TAILQ_REMOVE(&hsh->head, fle, fle_hash); 887 TAILQ_INSERT_TAIL(&hsh->head, fle, fle_hash); 888 } 889 } 890 } else /* A new flow entry. */ 891 error = hash6_insert(priv, hsh, &r, plen, flags, tcp_flags); 892 893 mtx_unlock(&hsh->mtx); 894 895 return (error); 896 } 897 #endif 898 899 /* 900 * Return records from cache to userland. 901 * 902 * TODO: matching particular IP should be done in kernel, here. 903 */ 904 int 905 ng_netflow_flow_show(priv_p priv, struct ngnf_show_header *req, 906 struct ngnf_show_header *resp) 907 { 908 struct flow_hash_entry *hsh; 909 struct flow_entry *fle; 910 struct flow_entry_data *data = (struct flow_entry_data *)(resp + 1); 911 #ifdef INET6 912 struct flow6_entry_data *data6 = (struct flow6_entry_data *)(resp + 1); 913 #endif 914 int i, max; 915 916 i = req->hash_id; 917 if (i > NBUCKETS-1) 918 return (EINVAL); 919 920 #ifdef INET6 921 if (req->version == 6) { 922 resp->version = 6; 923 hsh = priv->hash6 + i; 924 max = NREC6_AT_ONCE; 925 } else 926 #endif 927 if (req->version == 4) { 928 resp->version = 4; 929 hsh = priv->hash + i; 930 max = NREC_AT_ONCE; 931 } else 932 return (EINVAL); 933 934 /* 935 * We will transfer not more than NREC_AT_ONCE. More data 936 * will come in next message. 937 * We send current hash index and current record number in list 938 * to userland, and userland should return it back to us. 939 * Then, we will restart with new entry. 940 * 941 * The resulting cache snapshot can be inaccurate if flow expiration 942 * is taking place on hash item between userland data requests for 943 * this hash item id. 944 */ 945 resp->nentries = 0; 946 for (; i < NBUCKETS; hsh++, i++) { 947 int list_id; 948 949 if (mtx_trylock(&hsh->mtx) == 0) { 950 /* 951 * Requested hash index is not available, 952 * relay decision to skip or re-request data 953 * to userland. 954 */ 955 resp->hash_id = i; 956 resp->list_id = 0; 957 return (0); 958 } 959 960 list_id = 0; 961 TAILQ_FOREACH(fle, &hsh->head, fle_hash) { 962 if (hsh->mtx.mtx_lock & MTX_WAITERS) { 963 resp->hash_id = i; 964 resp->list_id = list_id; 965 mtx_unlock(&hsh->mtx); 966 return (0); 967 } 968 969 list_id++; 970 /* Search for particular record in list. */ 971 if (req->list_id > 0) { 972 if (list_id < req->list_id) 973 continue; 974 975 /* Requested list position found. */ 976 req->list_id = 0; 977 } 978 #ifdef INET6 979 if (req->version == 6) { 980 struct flow6_entry *fle6; 981 982 fle6 = (struct flow6_entry *)fle; 983 bcopy(&fle6->f, data6 + resp->nentries, 984 sizeof(fle6->f)); 985 } else 986 #endif 987 bcopy(&fle->f, data + resp->nentries, 988 sizeof(fle->f)); 989 resp->nentries++; 990 if (resp->nentries == max) { 991 resp->hash_id = i; 992 /* 993 * If it was the last item in list 994 * we simply skip to next hash_id. 995 */ 996 resp->list_id = list_id + 1; 997 mtx_unlock(&hsh->mtx); 998 return (0); 999 } 1000 } 1001 mtx_unlock(&hsh->mtx); 1002 } 1003 1004 resp->hash_id = resp->list_id = 0; 1005 1006 return (0); 1007 } 1008 1009 /* We have full datagram in privdata. Send it to export hook. */ 1010 static int 1011 export_send(priv_p priv, fib_export_p fe, item_p item, int flags) 1012 { 1013 struct mbuf *m = NGI_M(item); 1014 struct netflow_v5_export_dgram *dgram = mtod(m, 1015 struct netflow_v5_export_dgram *); 1016 struct netflow_v5_header *header = &dgram->header; 1017 struct timespec ts; 1018 int error = 0; 1019 1020 /* Fill mbuf header. */ 1021 m->m_len = m->m_pkthdr.len = sizeof(struct netflow_v5_record) * 1022 header->count + sizeof(struct netflow_v5_header); 1023 1024 /* Fill export header. */ 1025 header->sys_uptime = htonl(MILLIUPTIME(time_uptime)); 1026 getnanotime(&ts); 1027 header->unix_secs = htonl(ts.tv_sec); 1028 header->unix_nsecs = htonl(ts.tv_nsec); 1029 header->engine_type = 0; 1030 header->engine_id = fe->domain_id; 1031 header->pad = 0; 1032 header->flow_seq = htonl(atomic_fetchadd_32(&fe->flow_seq, 1033 header->count)); 1034 header->count = htons(header->count); 1035 1036 if (priv->export != NULL) 1037 NG_FWD_ITEM_HOOK_FLAGS(error, item, priv->export, flags); 1038 else 1039 NG_FREE_ITEM(item); 1040 1041 return (error); 1042 } 1043 1044 /* Add export record to dgram. */ 1045 static int 1046 export_add(item_p item, struct flow_entry *fle) 1047 { 1048 struct netflow_v5_export_dgram *dgram = mtod(NGI_M(item), 1049 struct netflow_v5_export_dgram *); 1050 struct netflow_v5_header *header = &dgram->header; 1051 struct netflow_v5_record *rec; 1052 1053 rec = &dgram->r[header->count]; 1054 header->count ++; 1055 1056 KASSERT(header->count <= NETFLOW_V5_MAX_RECORDS, 1057 ("ng_netflow: export too big")); 1058 1059 /* Fill in export record. */ 1060 rec->src_addr = fle->f.r.r_src.s_addr; 1061 rec->dst_addr = fle->f.r.r_dst.s_addr; 1062 rec->next_hop = fle->f.next_hop.s_addr; 1063 rec->i_ifx = htons(fle->f.fle_i_ifx); 1064 rec->o_ifx = htons(fle->f.fle_o_ifx); 1065 rec->packets = htonl(fle->f.packets); 1066 rec->octets = htonl(fle->f.bytes); 1067 rec->first = htonl(MILLIUPTIME(fle->f.first)); 1068 rec->last = htonl(MILLIUPTIME(fle->f.last)); 1069 rec->s_port = fle->f.r.r_sport; 1070 rec->d_port = fle->f.r.r_dport; 1071 rec->flags = fle->f.tcp_flags; 1072 rec->prot = fle->f.r.r_ip_p; 1073 rec->tos = fle->f.r.r_tos; 1074 rec->dst_mask = fle->f.dst_mask; 1075 rec->src_mask = fle->f.src_mask; 1076 rec->pad1 = 0; 1077 rec->pad2 = 0; 1078 1079 /* Not supported fields. */ 1080 rec->src_as = rec->dst_as = 0; 1081 1082 if (header->count == NETFLOW_V5_MAX_RECORDS) 1083 return (1); /* end of datagram */ 1084 else 1085 return (0); 1086 } 1087 1088 /* Periodic flow expiry run. */ 1089 void 1090 ng_netflow_expire(void *arg) 1091 { 1092 struct flow_entry *fle, *fle1; 1093 struct flow_hash_entry *hsh; 1094 priv_p priv = (priv_p )arg; 1095 int used, i; 1096 1097 /* 1098 * Going through all the cache. 1099 */ 1100 used = uma_zone_get_cur(priv->zone); 1101 for (hsh = priv->hash, i = 0; i < NBUCKETS; hsh++, i++) { 1102 /* 1103 * Skip entries, that are already being worked on. 1104 */ 1105 if (mtx_trylock(&hsh->mtx) == 0) 1106 continue; 1107 1108 TAILQ_FOREACH_SAFE(fle, &hsh->head, fle_hash, fle1) { 1109 /* 1110 * Interrupt thread wants this entry! 1111 * Quick! Quick! Bail out! 1112 */ 1113 if (hsh->mtx.mtx_lock & MTX_WAITERS) 1114 break; 1115 1116 /* 1117 * Don't expire aggressively while hash collision 1118 * ratio is predicted small. 1119 */ 1120 if (used <= (NBUCKETS*2) && !INACTIVE(fle)) 1121 break; 1122 1123 if ((INACTIVE(fle) && (SMALL(fle) || 1124 (used > (NBUCKETS*2)))) || AGED(fle)) { 1125 TAILQ_REMOVE(&hsh->head, fle, fle_hash); 1126 expire_flow(priv, priv_to_fib(priv, 1127 fle->f.r.fib), fle, NG_NOFLAGS); 1128 used--; 1129 counter_u64_add(priv->nfinfo_inact_exp, 1); 1130 } 1131 } 1132 mtx_unlock(&hsh->mtx); 1133 } 1134 1135 #ifdef INET6 1136 used = uma_zone_get_cur(priv->zone6); 1137 for (hsh = priv->hash6, i = 0; i < NBUCKETS; hsh++, i++) { 1138 struct flow6_entry *fle6; 1139 1140 /* 1141 * Skip entries, that are already being worked on. 1142 */ 1143 if (mtx_trylock(&hsh->mtx) == 0) 1144 continue; 1145 1146 TAILQ_FOREACH_SAFE(fle, &hsh->head, fle_hash, fle1) { 1147 fle6 = (struct flow6_entry *)fle; 1148 /* 1149 * Interrupt thread wants this entry! 1150 * Quick! Quick! Bail out! 1151 */ 1152 if (hsh->mtx.mtx_lock & MTX_WAITERS) 1153 break; 1154 1155 /* 1156 * Don't expire aggressively while hash collision 1157 * ratio is predicted small. 1158 */ 1159 if (used <= (NBUCKETS*2) && !INACTIVE(fle6)) 1160 break; 1161 1162 if ((INACTIVE(fle6) && (SMALL(fle6) || 1163 (used > (NBUCKETS*2)))) || AGED(fle6)) { 1164 TAILQ_REMOVE(&hsh->head, fle, fle_hash); 1165 expire_flow(priv, priv_to_fib(priv, 1166 fle->f.r.fib), fle, NG_NOFLAGS); 1167 used--; 1168 counter_u64_add(priv->nfinfo_inact_exp, 1); 1169 } 1170 } 1171 mtx_unlock(&hsh->mtx); 1172 } 1173 #endif 1174 1175 /* Schedule next expire. */ 1176 callout_reset(&priv->exp_callout, (1*hz), &ng_netflow_expire, 1177 (void *)priv); 1178 } 1179