1 /*- 2 * Copyright (c) 2010-2011 Alexander V. Chernikov <melifaro@ipfw.ru> 3 * Copyright (c) 2004-2005 Gleb Smirnoff <glebius@FreeBSD.org> 4 * Copyright (c) 2001-2003 Roman V. Palagin <romanp@unshadow.net> 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 * 28 * $SourceForge: ng_netflow.c,v 1.30 2004/09/05 11:37:43 glebius Exp $ 29 */ 30 31 static const char rcs_id[] = 32 "@(#) $FreeBSD$"; 33 34 #include "opt_inet6.h" 35 #include "opt_route.h" 36 37 #include <sys/param.h> 38 #include <sys/systm.h> 39 #include <sys/kernel.h> 40 #include <sys/limits.h> 41 #include <sys/mbuf.h> 42 #include <sys/socket.h> 43 #include <sys/syslog.h> 44 #include <sys/ctype.h> 45 46 #include <net/if.h> 47 #include <net/ethernet.h> 48 #include <net/route.h> 49 #include <net/if_arp.h> 50 #include <net/if_var.h> 51 #include <net/if_vlan_var.h> 52 #include <net/bpf.h> 53 #include <netinet/in.h> 54 #include <netinet/in_systm.h> 55 #include <netinet/ip.h> 56 #include <netinet/ip6.h> 57 #include <netinet/tcp.h> 58 #include <netinet/udp.h> 59 #include <netinet/sctp.h> 60 61 #include <netgraph/ng_message.h> 62 #include <netgraph/ng_parse.h> 63 #include <netgraph/netgraph.h> 64 #include <netgraph/netflow/netflow.h> 65 #include <netgraph/netflow/netflow_v9.h> 66 #include <netgraph/netflow/ng_netflow.h> 67 68 /* Netgraph methods */ 69 static ng_constructor_t ng_netflow_constructor; 70 static ng_rcvmsg_t ng_netflow_rcvmsg; 71 static ng_close_t ng_netflow_close; 72 static ng_shutdown_t ng_netflow_rmnode; 73 static ng_newhook_t ng_netflow_newhook; 74 static ng_rcvdata_t ng_netflow_rcvdata; 75 static ng_disconnect_t ng_netflow_disconnect; 76 77 /* Parse type for struct ng_netflow_info */ 78 static const struct ng_parse_struct_field ng_netflow_info_type_fields[] 79 = NG_NETFLOW_INFO_TYPE; 80 static const struct ng_parse_type ng_netflow_info_type = { 81 &ng_parse_struct_type, 82 &ng_netflow_info_type_fields 83 }; 84 85 /* Parse type for struct ng_netflow_ifinfo */ 86 static const struct ng_parse_struct_field ng_netflow_ifinfo_type_fields[] 87 = NG_NETFLOW_IFINFO_TYPE; 88 static const struct ng_parse_type ng_netflow_ifinfo_type = { 89 &ng_parse_struct_type, 90 &ng_netflow_ifinfo_type_fields 91 }; 92 93 /* Parse type for struct ng_netflow_setdlt */ 94 static const struct ng_parse_struct_field ng_netflow_setdlt_type_fields[] 95 = NG_NETFLOW_SETDLT_TYPE; 96 static const struct ng_parse_type ng_netflow_setdlt_type = { 97 &ng_parse_struct_type, 98 &ng_netflow_setdlt_type_fields 99 }; 100 101 /* Parse type for ng_netflow_setifindex */ 102 static const struct ng_parse_struct_field ng_netflow_setifindex_type_fields[] 103 = NG_NETFLOW_SETIFINDEX_TYPE; 104 static const struct ng_parse_type ng_netflow_setifindex_type = { 105 &ng_parse_struct_type, 106 &ng_netflow_setifindex_type_fields 107 }; 108 109 /* Parse type for ng_netflow_settimeouts */ 110 static const struct ng_parse_struct_field ng_netflow_settimeouts_type_fields[] 111 = NG_NETFLOW_SETTIMEOUTS_TYPE; 112 static const struct ng_parse_type ng_netflow_settimeouts_type = { 113 &ng_parse_struct_type, 114 &ng_netflow_settimeouts_type_fields 115 }; 116 117 /* Parse type for ng_netflow_setconfig */ 118 static const struct ng_parse_struct_field ng_netflow_setconfig_type_fields[] 119 = NG_NETFLOW_SETCONFIG_TYPE; 120 static const struct ng_parse_type ng_netflow_setconfig_type = { 121 &ng_parse_struct_type, 122 &ng_netflow_setconfig_type_fields 123 }; 124 125 /* Parse type for ng_netflow_settemplate */ 126 static const struct ng_parse_struct_field ng_netflow_settemplate_type_fields[] 127 = NG_NETFLOW_SETTEMPLATE_TYPE; 128 static const struct ng_parse_type ng_netflow_settemplate_type = { 129 &ng_parse_struct_type, 130 &ng_netflow_settemplate_type_fields 131 }; 132 133 /* Parse type for ng_netflow_setmtu */ 134 static const struct ng_parse_struct_field ng_netflow_setmtu_type_fields[] 135 = NG_NETFLOW_SETMTU_TYPE; 136 static const struct ng_parse_type ng_netflow_setmtu_type = { 137 &ng_parse_struct_type, 138 &ng_netflow_setmtu_type_fields 139 }; 140 141 /* Parse type for struct ng_netflow_v9info */ 142 static const struct ng_parse_struct_field ng_netflow_v9info_type_fields[] 143 = NG_NETFLOW_V9INFO_TYPE; 144 static const struct ng_parse_type ng_netflow_v9info_type = { 145 &ng_parse_struct_type, 146 &ng_netflow_v9info_type_fields 147 }; 148 149 /* List of commands and how to convert arguments to/from ASCII */ 150 static const struct ng_cmdlist ng_netflow_cmds[] = { 151 { 152 NGM_NETFLOW_COOKIE, 153 NGM_NETFLOW_INFO, 154 "info", 155 NULL, 156 &ng_netflow_info_type 157 }, 158 { 159 NGM_NETFLOW_COOKIE, 160 NGM_NETFLOW_IFINFO, 161 "ifinfo", 162 &ng_parse_uint16_type, 163 &ng_netflow_ifinfo_type 164 }, 165 { 166 NGM_NETFLOW_COOKIE, 167 NGM_NETFLOW_SETDLT, 168 "setdlt", 169 &ng_netflow_setdlt_type, 170 NULL 171 }, 172 { 173 NGM_NETFLOW_COOKIE, 174 NGM_NETFLOW_SETIFINDEX, 175 "setifindex", 176 &ng_netflow_setifindex_type, 177 NULL 178 }, 179 { 180 NGM_NETFLOW_COOKIE, 181 NGM_NETFLOW_SETTIMEOUTS, 182 "settimeouts", 183 &ng_netflow_settimeouts_type, 184 NULL 185 }, 186 { 187 NGM_NETFLOW_COOKIE, 188 NGM_NETFLOW_SETCONFIG, 189 "setconfig", 190 &ng_netflow_setconfig_type, 191 NULL 192 }, 193 { 194 NGM_NETFLOW_COOKIE, 195 NGM_NETFLOW_SETTEMPLATE, 196 "settemplate", 197 &ng_netflow_settemplate_type, 198 NULL 199 }, 200 { 201 NGM_NETFLOW_COOKIE, 202 NGM_NETFLOW_SETMTU, 203 "setmtu", 204 &ng_netflow_setmtu_type, 205 NULL 206 }, 207 { 208 NGM_NETFLOW_COOKIE, 209 NGM_NETFLOW_V9INFO, 210 "v9info", 211 NULL, 212 &ng_netflow_v9info_type 213 }, 214 { 0 } 215 }; 216 217 218 /* Netgraph node type descriptor */ 219 static struct ng_type ng_netflow_typestruct = { 220 .version = NG_ABI_VERSION, 221 .name = NG_NETFLOW_NODE_TYPE, 222 .constructor = ng_netflow_constructor, 223 .rcvmsg = ng_netflow_rcvmsg, 224 .close = ng_netflow_close, 225 .shutdown = ng_netflow_rmnode, 226 .newhook = ng_netflow_newhook, 227 .rcvdata = ng_netflow_rcvdata, 228 .disconnect = ng_netflow_disconnect, 229 .cmdlist = ng_netflow_cmds, 230 }; 231 NETGRAPH_INIT(netflow, &ng_netflow_typestruct); 232 233 /* Called at node creation */ 234 static int 235 ng_netflow_constructor(node_p node) 236 { 237 priv_p priv; 238 int i; 239 240 /* Initialize private data */ 241 priv = malloc(sizeof(*priv), M_NETGRAPH, M_WAITOK | M_ZERO); 242 243 /* Initialize fib data */ 244 priv->maxfibs = rt_numfibs; 245 priv->fib_data = malloc(sizeof(fib_export_p) * priv->maxfibs, 246 M_NETGRAPH, M_WAITOK | M_ZERO); 247 248 /* Make node and its data point at each other */ 249 NG_NODE_SET_PRIVATE(node, priv); 250 priv->node = node; 251 252 /* Initialize timeouts to default values */ 253 priv->info.nfinfo_inact_t = INACTIVE_TIMEOUT; 254 priv->info.nfinfo_act_t = ACTIVE_TIMEOUT; 255 256 /* Set default config */ 257 for (i = 0; i < NG_NETFLOW_MAXIFACES; i++) 258 priv->ifaces[i].info.conf = NG_NETFLOW_CONF_INGRESS; 259 260 /* Initialize callout handle */ 261 callout_init(&priv->exp_callout, CALLOUT_MPSAFE); 262 263 /* Allocate memory and set up flow cache */ 264 ng_netflow_cache_init(priv); 265 266 return (0); 267 } 268 269 /* 270 * ng_netflow supports two hooks: data and export. 271 * Incoming traffic is expected on data, and expired 272 * netflow datagrams are sent to export. 273 */ 274 static int 275 ng_netflow_newhook(node_p node, hook_p hook, const char *name) 276 { 277 const priv_p priv = NG_NODE_PRIVATE(node); 278 279 if (strncmp(name, NG_NETFLOW_HOOK_DATA, /* an iface hook? */ 280 strlen(NG_NETFLOW_HOOK_DATA)) == 0) { 281 iface_p iface; 282 int ifnum = -1; 283 const char *cp; 284 char *eptr; 285 286 cp = name + strlen(NG_NETFLOW_HOOK_DATA); 287 if (!isdigit(*cp) || (cp[0] == '0' && cp[1] != '\0')) 288 return (EINVAL); 289 290 ifnum = (int)strtoul(cp, &eptr, 10); 291 if (*eptr != '\0' || ifnum < 0 || ifnum >= NG_NETFLOW_MAXIFACES) 292 return (EINVAL); 293 294 /* See if hook is already connected */ 295 if (priv->ifaces[ifnum].hook != NULL) 296 return (EISCONN); 297 298 iface = &priv->ifaces[ifnum]; 299 300 /* Link private info and hook together */ 301 NG_HOOK_SET_PRIVATE(hook, iface); 302 iface->hook = hook; 303 304 /* 305 * In most cases traffic accounting is done on an 306 * Ethernet interface, so default data link type 307 * will be DLT_EN10MB. 308 */ 309 iface->info.ifinfo_dlt = DLT_EN10MB; 310 311 } else if (strncmp(name, NG_NETFLOW_HOOK_OUT, 312 strlen(NG_NETFLOW_HOOK_OUT)) == 0) { 313 iface_p iface; 314 int ifnum = -1; 315 const char *cp; 316 char *eptr; 317 318 cp = name + strlen(NG_NETFLOW_HOOK_OUT); 319 if (!isdigit(*cp) || (cp[0] == '0' && cp[1] != '\0')) 320 return (EINVAL); 321 322 ifnum = (int)strtoul(cp, &eptr, 10); 323 if (*eptr != '\0' || ifnum < 0 || ifnum >= NG_NETFLOW_MAXIFACES) 324 return (EINVAL); 325 326 /* See if hook is already connected */ 327 if (priv->ifaces[ifnum].out != NULL) 328 return (EISCONN); 329 330 iface = &priv->ifaces[ifnum]; 331 332 /* Link private info and hook together */ 333 NG_HOOK_SET_PRIVATE(hook, iface); 334 iface->out = hook; 335 336 } else if (strcmp(name, NG_NETFLOW_HOOK_EXPORT) == 0) { 337 338 if (priv->export != NULL) 339 return (EISCONN); 340 341 /* Netflow version 5 supports 32-bit counters only */ 342 if (CNTR_MAX == UINT64_MAX) 343 return (EINVAL); 344 345 priv->export = hook; 346 347 /* Exporter is ready. Let's schedule expiry. */ 348 callout_reset(&priv->exp_callout, (1*hz), &ng_netflow_expire, 349 (void *)priv); 350 } else if (strcmp(name, NG_NETFLOW_HOOK_EXPORT9) == 0) { 351 352 if (priv->export9 != NULL) 353 return (EISCONN); 354 355 priv->export9 = hook; 356 357 /* Exporter is ready. Let's schedule expiry. */ 358 callout_reset(&priv->exp_callout, (1*hz), &ng_netflow_expire, 359 (void *)priv); 360 } else 361 return (EINVAL); 362 363 return (0); 364 } 365 366 /* Get a netgraph control message. */ 367 static int 368 ng_netflow_rcvmsg (node_p node, item_p item, hook_p lasthook) 369 { 370 const priv_p priv = NG_NODE_PRIVATE(node); 371 struct ng_mesg *resp = NULL; 372 int error = 0; 373 struct ng_mesg *msg; 374 375 NGI_GET_MSG(item, msg); 376 377 /* Deal with message according to cookie and command */ 378 switch (msg->header.typecookie) { 379 case NGM_NETFLOW_COOKIE: 380 switch (msg->header.cmd) { 381 case NGM_NETFLOW_INFO: 382 { 383 struct ng_netflow_info *i; 384 385 NG_MKRESPONSE(resp, msg, sizeof(struct ng_netflow_info), 386 M_NOWAIT); 387 i = (struct ng_netflow_info *)resp->data; 388 ng_netflow_copyinfo(priv, i); 389 390 break; 391 } 392 case NGM_NETFLOW_IFINFO: 393 { 394 struct ng_netflow_ifinfo *i; 395 const uint16_t *index; 396 397 if (msg->header.arglen != sizeof(uint16_t)) 398 ERROUT(EINVAL); 399 400 index = (uint16_t *)msg->data; 401 if (*index >= NG_NETFLOW_MAXIFACES) 402 ERROUT(EINVAL); 403 404 /* connected iface? */ 405 if (priv->ifaces[*index].hook == NULL) 406 ERROUT(EINVAL); 407 408 NG_MKRESPONSE(resp, msg, 409 sizeof(struct ng_netflow_ifinfo), M_NOWAIT); 410 i = (struct ng_netflow_ifinfo *)resp->data; 411 memcpy((void *)i, (void *)&priv->ifaces[*index].info, 412 sizeof(priv->ifaces[*index].info)); 413 414 break; 415 } 416 case NGM_NETFLOW_SETDLT: 417 { 418 struct ng_netflow_setdlt *set; 419 struct ng_netflow_iface *iface; 420 421 if (msg->header.arglen != sizeof(struct ng_netflow_setdlt)) 422 ERROUT(EINVAL); 423 424 set = (struct ng_netflow_setdlt *)msg->data; 425 if (set->iface >= NG_NETFLOW_MAXIFACES) 426 ERROUT(EINVAL); 427 iface = &priv->ifaces[set->iface]; 428 429 /* connected iface? */ 430 if (iface->hook == NULL) 431 ERROUT(EINVAL); 432 433 switch (set->dlt) { 434 case DLT_EN10MB: 435 iface->info.ifinfo_dlt = DLT_EN10MB; 436 break; 437 case DLT_RAW: 438 iface->info.ifinfo_dlt = DLT_RAW; 439 break; 440 default: 441 ERROUT(EINVAL); 442 } 443 break; 444 } 445 case NGM_NETFLOW_SETIFINDEX: 446 { 447 struct ng_netflow_setifindex *set; 448 struct ng_netflow_iface *iface; 449 450 if (msg->header.arglen != sizeof(struct ng_netflow_setifindex)) 451 ERROUT(EINVAL); 452 453 set = (struct ng_netflow_setifindex *)msg->data; 454 if (set->iface >= NG_NETFLOW_MAXIFACES) 455 ERROUT(EINVAL); 456 iface = &priv->ifaces[set->iface]; 457 458 /* connected iface? */ 459 if (iface->hook == NULL) 460 ERROUT(EINVAL); 461 462 iface->info.ifinfo_index = set->index; 463 464 break; 465 } 466 case NGM_NETFLOW_SETTIMEOUTS: 467 { 468 struct ng_netflow_settimeouts *set; 469 470 if (msg->header.arglen != sizeof(struct ng_netflow_settimeouts)) 471 ERROUT(EINVAL); 472 473 set = (struct ng_netflow_settimeouts *)msg->data; 474 475 priv->info.nfinfo_inact_t = set->inactive_timeout; 476 priv->info.nfinfo_act_t = set->active_timeout; 477 478 break; 479 } 480 case NGM_NETFLOW_SETCONFIG: 481 { 482 struct ng_netflow_setconfig *set; 483 484 if (msg->header.arglen != sizeof(struct ng_netflow_setconfig)) 485 ERROUT(EINVAL); 486 487 set = (struct ng_netflow_setconfig *)msg->data; 488 489 if (set->iface >= NG_NETFLOW_MAXIFACES) 490 ERROUT(EINVAL); 491 492 priv->ifaces[set->iface].info.conf = set->conf; 493 494 break; 495 } 496 case NGM_NETFLOW_SETTEMPLATE: 497 { 498 struct ng_netflow_settemplate *set; 499 500 if (msg->header.arglen != sizeof(struct ng_netflow_settemplate)) 501 ERROUT(EINVAL); 502 503 set = (struct ng_netflow_settemplate *)msg->data; 504 505 priv->templ_packets = set->packets; 506 priv->templ_time = set->time; 507 508 break; 509 } 510 case NGM_NETFLOW_SETMTU: 511 { 512 struct ng_netflow_setmtu *set; 513 514 if (msg->header.arglen != sizeof(struct ng_netflow_setmtu)) 515 ERROUT(EINVAL); 516 517 set = (struct ng_netflow_setmtu *)msg->data; 518 if ((set->mtu < MIN_MTU) || (set->mtu > MAX_MTU)) 519 ERROUT(EINVAL); 520 521 priv->mtu = set->mtu; 522 523 break; 524 } 525 case NGM_NETFLOW_SHOW: 526 { 527 if (msg->header.arglen != sizeof(struct ngnf_show_header)) 528 ERROUT(EINVAL); 529 530 NG_MKRESPONSE(resp, msg, NGRESP_SIZE, M_NOWAIT); 531 532 if (!resp) 533 ERROUT(ENOMEM); 534 535 error = ng_netflow_flow_show(priv, 536 (struct ngnf_show_header *)msg->data, 537 (struct ngnf_show_header *)resp->data); 538 539 if (error) 540 NG_FREE_MSG(resp); 541 542 break; 543 } 544 case NGM_NETFLOW_V9INFO: 545 { 546 struct ng_netflow_v9info *i; 547 548 NG_MKRESPONSE(resp, msg, sizeof(struct ng_netflow_v9info), 549 M_NOWAIT); 550 i = (struct ng_netflow_v9info *)resp->data; 551 ng_netflow_copyv9info(priv, i); 552 553 break; 554 } 555 default: 556 ERROUT(EINVAL); /* unknown command */ 557 break; 558 } 559 break; 560 default: 561 ERROUT(EINVAL); /* incorrect cookie */ 562 break; 563 } 564 565 /* 566 * Take care of synchronous response, if any. 567 * Free memory and return. 568 */ 569 done: 570 NG_RESPOND_MSG(error, node, item, resp); 571 NG_FREE_MSG(msg); 572 573 return (error); 574 } 575 576 /* Receive data on hook. */ 577 static int 578 ng_netflow_rcvdata (hook_p hook, item_p item) 579 { 580 const node_p node = NG_HOOK_NODE(hook); 581 const priv_p priv = NG_NODE_PRIVATE(node); 582 const iface_p iface = NG_HOOK_PRIVATE(hook); 583 hook_p out; 584 struct mbuf *m = NULL, *m_old = NULL; 585 struct ip *ip = NULL; 586 struct ip6_hdr *ip6 = NULL; 587 struct m_tag *mtag; 588 int pullup_len = 0, off; 589 uint8_t acct = 0, bypass = 0, flags = 0, upper_proto = 0; 590 int error = 0, l3_off = 0; 591 unsigned int src_if_index; 592 caddr_t upper_ptr = NULL; 593 fib_export_p fe; 594 uint32_t fib; 595 596 if ((hook == priv->export) || (hook == priv->export9)) { 597 /* 598 * Data arrived on export hook. 599 * This must not happen. 600 */ 601 log(LOG_ERR, "ng_netflow: incoming data on export hook!\n"); 602 ERROUT(EINVAL); 603 }; 604 605 if (hook == iface->hook) { 606 if ((iface->info.conf & NG_NETFLOW_CONF_INGRESS) == 0) 607 bypass = 1; 608 out = iface->out; 609 } else if (hook == iface->out) { 610 if ((iface->info.conf & NG_NETFLOW_CONF_EGRESS) == 0) 611 bypass = 1; 612 out = iface->hook; 613 } else 614 ERROUT(EINVAL); 615 616 if ((!bypass) && 617 (iface->info.conf & (NG_NETFLOW_CONF_ONCE | NG_NETFLOW_CONF_THISONCE))) { 618 mtag = m_tag_locate(NGI_M(item), MTAG_NETFLOW, 619 MTAG_NETFLOW_CALLED, NULL); 620 while (mtag != NULL) { 621 if ((iface->info.conf & NG_NETFLOW_CONF_ONCE) || 622 ((ng_ID_t *)(mtag + 1))[0] == NG_NODE_ID(node)) { 623 bypass = 1; 624 break; 625 } 626 mtag = m_tag_locate(NGI_M(item), MTAG_NETFLOW, 627 MTAG_NETFLOW_CALLED, mtag); 628 } 629 } 630 631 if (bypass) { 632 if (out == NULL) 633 ERROUT(ENOTCONN); 634 635 NG_FWD_ITEM_HOOK(error, item, out); 636 return (error); 637 } 638 639 if (iface->info.conf & (NG_NETFLOW_CONF_ONCE | NG_NETFLOW_CONF_THISONCE)) { 640 mtag = m_tag_alloc(MTAG_NETFLOW, MTAG_NETFLOW_CALLED, 641 sizeof(ng_ID_t), M_NOWAIT); 642 if (mtag) { 643 ((ng_ID_t *)(mtag + 1))[0] = NG_NODE_ID(node); 644 m_tag_prepend(NGI_M(item), mtag); 645 } 646 } 647 648 /* Import configuration flags related to flow creation */ 649 flags = iface->info.conf & NG_NETFLOW_FLOW_FLAGS; 650 651 NGI_GET_M(item, m); 652 m_old = m; 653 654 /* Increase counters. */ 655 iface->info.ifinfo_packets++; 656 657 /* 658 * Depending on interface data link type and packet contents 659 * we pullup enough data, so that ng_netflow_flow_add() does not 660 * need to know about mbuf at all. We keep current length of data 661 * needed to be contiguous in pullup_len. mtod() is done at the 662 * very end one more time, since m can had changed after pulluping. 663 * 664 * In case of unrecognized data we don't return error, but just 665 * pass data to downstream hook, if it is available. 666 */ 667 668 #define M_CHECK(length) do { \ 669 pullup_len += length; \ 670 if (((m)->m_pkthdr.len < (pullup_len)) || \ 671 ((pullup_len) > MHLEN)) { \ 672 error = EINVAL; \ 673 goto bypass; \ 674 } \ 675 if ((m)->m_len < (pullup_len) && \ 676 (((m) = m_pullup((m),(pullup_len))) == NULL)) { \ 677 error = ENOBUFS; \ 678 goto done; \ 679 } \ 680 } while (0) 681 682 switch (iface->info.ifinfo_dlt) { 683 case DLT_EN10MB: /* Ethernet */ 684 { 685 struct ether_header *eh; 686 uint16_t etype; 687 688 M_CHECK(sizeof(struct ether_header)); 689 eh = mtod(m, struct ether_header *); 690 691 /* Make sure this is IP frame. */ 692 etype = ntohs(eh->ether_type); 693 switch (etype) { 694 case ETHERTYPE_IP: 695 M_CHECK(sizeof(struct ip)); 696 eh = mtod(m, struct ether_header *); 697 ip = (struct ip *)(eh + 1); 698 l3_off = sizeof(struct ether_header); 699 break; 700 #ifdef INET6 701 case ETHERTYPE_IPV6: 702 /* 703 * m_pullup() called by M_CHECK() pullups 704 * kern.ipc.max_protohdr (default 60 bytes) which is enough 705 */ 706 M_CHECK(sizeof(struct ip6_hdr)); 707 eh = mtod(m, struct ether_header *); 708 ip6 = (struct ip6_hdr *)(eh + 1); 709 l3_off = sizeof(struct ether_header); 710 break; 711 #endif 712 case ETHERTYPE_VLAN: 713 { 714 struct ether_vlan_header *evh; 715 716 M_CHECK(sizeof(struct ether_vlan_header) - 717 sizeof(struct ether_header)); 718 evh = mtod(m, struct ether_vlan_header *); 719 etype = ntohs(evh->evl_proto); 720 l3_off = sizeof(struct ether_vlan_header); 721 722 if (etype == ETHERTYPE_IP) { 723 M_CHECK(sizeof(struct ip)); 724 ip = (struct ip *)(evh + 1); 725 break; 726 #ifdef INET6 727 } else if (etype == ETHERTYPE_IPV6) { 728 M_CHECK(sizeof(struct ip6_hdr)); 729 ip6 = (struct ip6_hdr *)(evh + 1); 730 break; 731 #endif 732 } 733 } 734 default: 735 goto bypass; /* pass this frame */ 736 } 737 break; 738 } 739 case DLT_RAW: /* IP packets */ 740 M_CHECK(sizeof(struct ip)); 741 ip = mtod(m, struct ip *); 742 /* l3_off is already zero */ 743 #ifdef INET6 744 /* If INET6 is not defined IPv6 packets will be discarded in ng_netflow_flow_add() */ 745 if (ip->ip_v == IP6VERSION) { 746 /* IPv6 packet */ 747 ip = NULL; 748 M_CHECK(sizeof(struct ip6_hdr) - sizeof(struct ip)); 749 ip6 = mtod(m, struct ip6_hdr *); 750 } 751 #endif 752 break; 753 default: 754 goto bypass; 755 break; 756 } 757 758 off = pullup_len; 759 760 if ((ip != NULL) && ((ip->ip_off & htons(IP_OFFMASK)) == 0)) { 761 if ((ip->ip_v != IPVERSION) || 762 ((ip->ip_hl << 2) < sizeof(struct ip))) 763 goto bypass; 764 /* 765 * In case of IPv4 header with options, we haven't pulled 766 * up enough, yet. 767 */ 768 M_CHECK((ip->ip_hl << 2) - sizeof(struct ip)); 769 770 /* Save upper layer offset and proto */ 771 off = pullup_len; 772 upper_proto = ip->ip_p; 773 774 /* 775 * XXX: in case of wrong upper layer header we will forward this packet 776 * but skip this record in netflow 777 */ 778 switch (ip->ip_p) { 779 case IPPROTO_TCP: 780 M_CHECK(sizeof(struct tcphdr)); 781 break; 782 case IPPROTO_UDP: 783 M_CHECK(sizeof(struct udphdr)); 784 break; 785 case IPPROTO_SCTP: 786 M_CHECK(sizeof(struct sctphdr)); 787 break; 788 } 789 } else if (ip != NULL) { 790 /* Nothing to save except upper layer proto, since this is packet fragment */ 791 flags |= NG_NETFLOW_IS_FRAG; 792 upper_proto = ip->ip_p; 793 if ((ip->ip_v != IPVERSION) || 794 ((ip->ip_hl << 2) < sizeof(struct ip))) 795 goto bypass; 796 #ifdef INET6 797 } else if (ip6 != NULL) { 798 /* Check if we can export */ 799 if (priv->export9 == NULL) 800 goto bypass; 801 802 /* Loop thru IPv6 extended headers to get upper layer header / frag */ 803 int cur = ip6->ip6_nxt, hdr_off = 0; 804 struct ip6_ext *ip6e; 805 struct ip6_frag *ip6f; 806 807 /* Save upper layer info */ 808 off = pullup_len; 809 upper_proto = cur; 810 811 if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) 812 goto bypass; 813 814 while (42) { 815 switch (cur) { 816 /* 817 * Same as in IPv4, we can forward 'bad' packet without accounting 818 */ 819 case IPPROTO_TCP: 820 M_CHECK(sizeof(struct tcphdr)); 821 goto loopend; 822 case IPPROTO_UDP: 823 M_CHECK(sizeof(struct udphdr)); 824 goto loopend; 825 case IPPROTO_SCTP: 826 M_CHECK(sizeof(struct sctphdr)); 827 goto loopend; 828 829 /* Loop until 'real' upper layer headers */ 830 case IPPROTO_HOPOPTS: 831 case IPPROTO_ROUTING: 832 case IPPROTO_DSTOPTS: 833 M_CHECK(sizeof(struct ip6_ext)); 834 ip6e = (struct ip6_ext *)(mtod(m, caddr_t) + off); 835 upper_proto = ip6e->ip6e_nxt; 836 hdr_off = (ip6e->ip6e_len + 1) << 3; 837 break; 838 839 /* RFC4302, can be before DSTOPTS */ 840 case IPPROTO_AH: 841 M_CHECK(sizeof(struct ip6_ext)); 842 ip6e = (struct ip6_ext *)(mtod(m, caddr_t) + off); 843 upper_proto = ip6e->ip6e_nxt; 844 hdr_off = (ip6e->ip6e_len + 2) << 2; 845 break; 846 847 case IPPROTO_FRAGMENT: 848 M_CHECK(sizeof(struct ip6_frag)); 849 ip6f = (struct ip6_frag *)(mtod(m, caddr_t) + off); 850 upper_proto = ip6f->ip6f_nxt; 851 hdr_off = sizeof(struct ip6_frag); 852 off += hdr_off; 853 flags |= NG_NETFLOW_IS_FRAG; 854 goto loopend; 855 856 #if 0 857 case IPPROTO_NONE: 858 goto loopend; 859 #endif 860 /* 861 * Any unknown header (new extension or IPv6/IPv4 862 * header for tunnels) ends loop. 863 */ 864 default: 865 goto loopend; 866 } 867 868 off += hdr_off; 869 cur = upper_proto; 870 } 871 #endif 872 } 873 #undef M_CHECK 874 875 #ifdef INET6 876 loopend: 877 #endif 878 /* Just in case of real reallocation in M_CHECK() / m_pullup() */ 879 if (m != m_old) { 880 atomic_fetchadd_32(&priv->info.nfinfo_realloc_mbuf, 1); 881 /* Restore ip/ipv6 pointer */ 882 if (ip != NULL) 883 ip = (struct ip *)(mtod(m, caddr_t) + l3_off); 884 else if (ip6 != NULL) 885 ip6 = (struct ip6_hdr *)(mtod(m, caddr_t) + l3_off); 886 } 887 888 upper_ptr = (caddr_t)(mtod(m, caddr_t) + off); 889 890 /* Determine packet input interface. Prefer configured. */ 891 src_if_index = 0; 892 if (hook == iface->out || iface->info.ifinfo_index == 0) { 893 if (m->m_pkthdr.rcvif != NULL) 894 src_if_index = m->m_pkthdr.rcvif->if_index; 895 } else 896 src_if_index = iface->info.ifinfo_index; 897 898 /* Check packet FIB */ 899 fib = M_GETFIB(m); 900 if (fib >= priv->maxfibs) { 901 CTR2(KTR_NET, "ng_netflow_rcvdata(): packet fib %d is out of " 902 "range of available fibs: 0 .. %d", 903 fib, priv->maxfibs); 904 goto bypass; 905 } 906 907 if ((fe = priv_to_fib(priv, fib)) == NULL) { 908 /* Setup new FIB */ 909 if (ng_netflow_fib_init(priv, fib) != 0) { 910 /* malloc() failed */ 911 goto bypass; 912 } 913 914 fe = priv_to_fib(priv, fib); 915 } 916 917 if (ip != NULL) 918 error = ng_netflow_flow_add(priv, fe, ip, upper_ptr, upper_proto, flags, src_if_index); 919 #ifdef INET6 920 else if (ip6 != NULL) 921 error = ng_netflow_flow6_add(priv, fe, ip6, upper_ptr, upper_proto, flags, src_if_index); 922 #endif 923 else 924 goto bypass; 925 926 acct = 1; 927 bypass: 928 if (out != NULL) { 929 if (acct == 0) { 930 /* Accounting failure */ 931 if (ip != NULL) { 932 atomic_fetchadd_32(&priv->info.nfinfo_spackets, 1); 933 priv->info.nfinfo_sbytes += m_length(m, NULL); 934 } else if (ip6 != NULL) { 935 atomic_fetchadd_32(&priv->info.nfinfo_spackets6, 1); 936 priv->info.nfinfo_sbytes6 += m_length(m, NULL); 937 } 938 } 939 940 /* XXX: error gets overwritten here */ 941 NG_FWD_NEW_DATA(error, item, out, m); 942 return (error); 943 } 944 done: 945 if (item) 946 NG_FREE_ITEM(item); 947 if (m) 948 NG_FREE_M(m); 949 950 return (error); 951 } 952 953 /* We will be shut down in a moment */ 954 static int 955 ng_netflow_close(node_p node) 956 { 957 const priv_p priv = NG_NODE_PRIVATE(node); 958 959 callout_drain(&priv->exp_callout); 960 ng_netflow_cache_flush(priv); 961 962 return (0); 963 } 964 965 /* Do local shutdown processing. */ 966 static int 967 ng_netflow_rmnode(node_p node) 968 { 969 const priv_p priv = NG_NODE_PRIVATE(node); 970 971 NG_NODE_SET_PRIVATE(node, NULL); 972 NG_NODE_UNREF(priv->node); 973 974 free(priv->fib_data, M_NETGRAPH); 975 free(priv, M_NETGRAPH); 976 977 return (0); 978 } 979 980 /* Hook disconnection. */ 981 static int 982 ng_netflow_disconnect(hook_p hook) 983 { 984 node_p node = NG_HOOK_NODE(hook); 985 priv_p priv = NG_NODE_PRIVATE(node); 986 iface_p iface = NG_HOOK_PRIVATE(hook); 987 988 if (iface != NULL) { 989 if (iface->hook == hook) 990 iface->hook = NULL; 991 if (iface->out == hook) 992 iface->out = NULL; 993 } 994 995 /* if export hook disconnected stop running expire(). */ 996 if (hook == priv->export) { 997 if (priv->export9 == NULL) 998 callout_drain(&priv->exp_callout); 999 priv->export = NULL; 1000 } 1001 1002 if (hook == priv->export9) { 1003 if (priv->export == NULL) 1004 callout_drain(&priv->exp_callout); 1005 priv->export9 = NULL; 1006 } 1007 1008 /* Removal of the last link destroys the node. */ 1009 if (NG_NODE_NUMHOOKS(node) == 0) 1010 ng_rmnode_self(node); 1011 1012 return (0); 1013 } 1014