1 /*- 2 * Copyright (c) 2010-2011 Alexander V. Chernikov <melifaro@ipfw.ru> 3 * Copyright (c) 2004-2005 Gleb Smirnoff <glebius@FreeBSD.org> 4 * Copyright (c) 2001-2003 Roman V. Palagin <romanp@unshadow.net> 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 * 28 * $SourceForge: ng_netflow.h,v 1.26 2004/09/04 15:44:55 glebius Exp $ 29 * $FreeBSD$ 30 */ 31 32 #ifndef _NG_NETFLOW_H_ 33 #define _NG_NETFLOW_H_ 34 35 #define NG_NETFLOW_NODE_TYPE "netflow" 36 #define NGM_NETFLOW_COOKIE 1299079728 37 38 #define NG_NETFLOW_MAXIFACES USHRT_MAX 39 40 /* Hook names */ 41 42 #define NG_NETFLOW_HOOK_DATA "iface" 43 #define NG_NETFLOW_HOOK_OUT "out" 44 #define NG_NETFLOW_HOOK_EXPORT "export" 45 #define NG_NETFLOW_HOOK_EXPORT9 "export9" 46 47 /* This define effectively disable (v5) netflow export hook! */ 48 /* #define COUNTERS_64 */ 49 50 /* Netgraph commands understood by netflow node */ 51 enum { 52 NGM_NETFLOW_INFO = 1|NGM_READONLY|NGM_HASREPLY, /* get node info */ 53 NGM_NETFLOW_IFINFO = 2|NGM_READONLY|NGM_HASREPLY, /* get iface info */ 54 NGM_NETFLOW_SHOW = 3|NGM_READONLY|NGM_HASREPLY, /* show ip cache flow */ 55 NGM_NETFLOW_SETDLT = 4, /* set data-link type */ 56 NGM_NETFLOW_SETIFINDEX = 5, /* set interface index */ 57 NGM_NETFLOW_SETTIMEOUTS = 6, /* set active/inactive flow timeouts */ 58 NGM_NETFLOW_SETCONFIG = 7, /* set flow generation options */ 59 NGM_NETFLOW_SETTEMPLATE = 8, /* set v9 flow template periodic */ 60 NGM_NETFLOW_SETMTU = 9, /* set outgoing interface MTU */ 61 }; 62 63 /* This structure is returned by the NGM_NETFLOW_INFO message */ 64 struct ng_netflow_info { 65 uint64_t nfinfo_bytes; /* accounted IPv4 bytes */ 66 uint32_t nfinfo_packets; /* accounted IPv4 packets */ 67 uint64_t nfinfo_bytes6; /* accounted IPv6 bytes */ 68 uint32_t nfinfo_packets6; /* accounted IPv6 packets */ 69 uint64_t nfinfo_sbytes; /* skipped IPv4 bytes */ 70 uint32_t nfinfo_spackets; /* skipped IPv4 packets */ 71 uint64_t nfinfo_sbytes6; /* skipped IPv6 bytes */ 72 uint32_t nfinfo_spackets6; /* skipped IPv6 packets */ 73 uint32_t nfinfo_used; /* used cache records */ 74 uint32_t nfinfo_used6; /* used IPv6 cache records */ 75 uint32_t nfinfo_alloc_failed; /* failed allocations */ 76 uint32_t nfinfo_export_failed; /* failed exports */ 77 uint32_t nfinfo_export9_failed; /* failed exports */ 78 uint32_t nfinfo_realloc_mbuf; /* reallocated mbufs */ 79 uint32_t nfinfo_alloc_fibs; /* fibs allocated */ 80 uint32_t nfinfo_act_exp; /* active expiries */ 81 uint32_t nfinfo_inact_exp; /* inactive expiries */ 82 uint32_t nfinfo_inact_t; /* flow inactive timeout */ 83 uint32_t nfinfo_act_t; /* flow active timeout */ 84 }; 85 86 /* This structure is returned by the NGM_NETFLOW_IFINFO message */ 87 struct ng_netflow_ifinfo { 88 uint32_t ifinfo_packets; /* number of packets for this iface */ 89 uint8_t ifinfo_dlt; /* Data Link Type, DLT_XXX */ 90 #define MAXDLTNAMELEN 20 91 u_int16_t ifinfo_index; /* connected iface index */ 92 uint32_t conf; 93 }; 94 95 96 /* This structure is passed to NGM_NETFLOW_SETDLT message */ 97 struct ng_netflow_setdlt { 98 uint16_t iface; /* which iface dlt change */ 99 uint8_t dlt; /* DLT_XXX from bpf.h */ 100 }; 101 102 /* This structure is passed to NGM_NETFLOW_SETIFINDEX */ 103 struct ng_netflow_setifindex { 104 u_int16_t iface; /* which iface index change */ 105 u_int16_t index; /* new index */ 106 }; 107 108 /* This structure is passed to NGM_NETFLOW_SETTIMEOUTS */ 109 struct ng_netflow_settimeouts { 110 uint32_t inactive_timeout; /* flow inactive timeout */ 111 uint32_t active_timeout; /* flow active timeout */ 112 }; 113 114 #define NG_NETFLOW_CONF_INGRESS 1 115 #define NG_NETFLOW_CONF_EGRESS 2 116 #define NG_NETFLOW_CONF_ONCE 4 117 #define NG_NETFLOW_CONF_THISONCE 8 118 119 /* This structure is passed to NGM_NETFLOW_SETCONFIG */ 120 struct ng_netflow_setconfig { 121 u_int16_t iface; /* which iface config change */ 122 u_int32_t conf; /* new config */ 123 }; 124 125 /* This structure is passed to NGM_NETFLOW_SETTEMPLATE */ 126 struct ng_netflow_settemplate { 127 uint16_t time; /* max time between announce */ 128 uint16_t packets; /* max packets between announce */ 129 }; 130 131 /* This structure is passed to NGM_NETFLOW_SETMTU */ 132 struct ng_netflow_setmtu { 133 uint16_t mtu; /* MTU for packet */ 134 }; 135 136 137 /* This is unique data, which identifies flow */ 138 struct flow_rec { 139 uint16_t flow_type; /* IPv4 L4/L3 flow, see NETFLOW_V9_FLOW* */ 140 uint16_t fib; 141 struct in_addr r_src; 142 struct in_addr r_dst; 143 union { 144 struct { 145 uint16_t s_port; /* source TCP/UDP port */ 146 uint16_t d_port; /* destination TCP/UDP port */ 147 } dir; 148 uint32_t both; 149 } ports; 150 union { 151 struct { 152 u_char prot; /* IP protocol */ 153 u_char tos; /* IP TOS */ 154 uint16_t i_ifx; /* input interface index */ 155 } i; 156 uint32_t all; 157 } misc; 158 }; 159 160 /* This is unique data, which identifies flow */ 161 struct flow6_rec { 162 uint16_t flow_type; /* IPv4 L4/L3 Ipv6 L4/L3 flow, see NETFLOW_V9_FLOW* */ 163 uint16_t fib; 164 union { 165 struct in_addr r_src; 166 struct in6_addr r_src6; 167 } src; 168 union { 169 struct in_addr r_dst; 170 struct in6_addr r_dst6; 171 } dst; 172 union { 173 struct { 174 uint16_t s_port; /* source TCP/UDP port */ 175 uint16_t d_port; /* destination TCP/UDP port */ 176 } dir; 177 uint32_t both; 178 } ports; 179 union { 180 struct { 181 u_char prot; /* IP protocol */ 182 u_char tos; /* IP TOS */ 183 uint16_t i_ifx; /* input interface index */ 184 } i; 185 uint32_t all; 186 } misc; 187 }; 188 189 #define r_ip_p misc.i.prot 190 #define r_tos misc.i.tos 191 #define r_i_ifx misc.i.i_ifx 192 #define r_misc misc.all 193 #define r_ports ports.both 194 #define r_sport ports.dir.s_port 195 #define r_dport ports.dir.d_port 196 197 /* A flow entry which accumulates statistics */ 198 struct flow_entry_data { 199 uint16_t version; /* Protocol version */ 200 struct flow_rec r; 201 struct in_addr next_hop; 202 uint16_t fle_o_ifx; /* output interface index */ 203 #define fle_i_ifx r.misc.i.i_ifx 204 uint8_t dst_mask; /* destination route mask bits */ 205 uint8_t src_mask; /* source route mask bits */ 206 u_long packets; 207 u_long bytes; 208 long first; /* uptime on first packet */ 209 long last; /* uptime on last packet */ 210 u_char tcp_flags; /* cumulative OR */ 211 }; 212 213 struct flow6_entry_data { 214 uint16_t version; /* Protocol version */ 215 struct flow6_rec r; 216 union { 217 struct in_addr next_hop; 218 struct in6_addr next_hop6; 219 } n; 220 uint16_t fle_o_ifx; /* output interface index */ 221 #define fle_i_ifx r.misc.i.i_ifx 222 uint8_t dst_mask; /* destination route mask bits */ 223 uint8_t src_mask; /* source route mask bits */ 224 u_long packets; 225 u_long bytes; 226 long first; /* uptime on first packet */ 227 long last; /* uptime on last packet */ 228 u_char tcp_flags; /* cumulative OR */ 229 }; 230 231 /* 232 * How many flow records we will transfer at once 233 * without overflowing socket receive buffer 234 */ 235 #define NREC_AT_ONCE 1000 236 #define NGRESP_SIZE (sizeof(struct ngnf_flows) + (NREC_AT_ONCE * \ 237 sizeof(struct flow_entry_data))) 238 #define SORCVBUF_SIZE (NGRESP_SIZE + 2 * sizeof(struct ng_mesg)) 239 240 /* This struct is returned to userland, when "show cache ip flow" */ 241 struct ngnf_flows { 242 uint32_t nentries; 243 uint32_t last; 244 struct flow_entry_data entries[0]; 245 }; 246 247 /* Everything below is for kernel */ 248 249 #ifdef _KERNEL 250 251 struct flow_entry { 252 struct flow_entry_data f; 253 TAILQ_ENTRY(flow_entry) fle_hash; /* entries in hash slot */ 254 }; 255 256 struct flow6_entry { 257 struct flow6_entry_data f; 258 TAILQ_ENTRY(flow6_entry) fle6_hash; /* entries in hash slot */ 259 }; 260 /* Parsing declarations */ 261 262 /* Parse the info structure */ 263 #define NG_NETFLOW_INFO_TYPE { \ 264 { "IPv4 bytes", &ng_parse_uint64_type }, \ 265 { "IPv4 packets", &ng_parse_uint32_type }, \ 266 { "IPv6 bytes", &ng_parse_uint64_type }, \ 267 { "IPv6 packets", &ng_parse_uint32_type }, \ 268 { "IPv4 skipped bytes", &ng_parse_uint64_type }, \ 269 { "IPv4 skipped packets", &ng_parse_uint32_type }, \ 270 { "IPv6 skipped bytes", &ng_parse_uint64_type }, \ 271 { "IPv6 skipped packets", &ng_parse_uint32_type }, \ 272 { "IPv4 records used", &ng_parse_uint32_type },\ 273 { "IPv6 records used", &ng_parse_uint32_type },\ 274 { "Failed allocations", &ng_parse_uint32_type },\ 275 { "V5 failed exports", &ng_parse_uint32_type },\ 276 { "V9 failed exports", &ng_parse_uint32_type },\ 277 { "mbuf reallocations", &ng_parse_uint32_type },\ 278 { "fibs allocated", &ng_parse_uint32_type },\ 279 { "Active expiries", &ng_parse_uint32_type },\ 280 { "Inactive expiries", &ng_parse_uint32_type },\ 281 { "Inactive timeout", &ng_parse_uint32_type },\ 282 { "Active timeout", &ng_parse_uint32_type },\ 283 { NULL } \ 284 } 285 286 /* Parse the ifinfo structure */ 287 #define NG_NETFLOW_IFINFO_TYPE { \ 288 { "packets", &ng_parse_uint32_type }, \ 289 { "data link type", &ng_parse_uint8_type }, \ 290 { "index", &ng_parse_uint16_type }, \ 291 { "conf", &ng_parse_uint32_type }, \ 292 { NULL } \ 293 } 294 295 /* Parse the setdlt structure */ 296 #define NG_NETFLOW_SETDLT_TYPE { \ 297 { "iface", &ng_parse_uint16_type }, \ 298 { "dlt", &ng_parse_uint8_type }, \ 299 { NULL } \ 300 } 301 302 /* Parse the setifindex structure */ 303 #define NG_NETFLOW_SETIFINDEX_TYPE { \ 304 { "iface", &ng_parse_uint16_type }, \ 305 { "index", &ng_parse_uint16_type }, \ 306 { NULL } \ 307 } 308 309 /* Parse the settimeouts structure */ 310 #define NG_NETFLOW_SETTIMEOUTS_TYPE { \ 311 { "inactive", &ng_parse_uint32_type }, \ 312 { "active", &ng_parse_uint32_type }, \ 313 { NULL } \ 314 } 315 316 /* Parse the setifindex structure */ 317 #define NG_NETFLOW_SETCONFIG_TYPE { \ 318 { "iface", &ng_parse_uint16_type }, \ 319 { "conf", &ng_parse_uint32_type }, \ 320 { NULL } \ 321 } 322 323 /* Parse the settemplate structure */ 324 #define NG_NETFLOW_SETTEMPLATE_TYPE { \ 325 { "time", &ng_parse_uint16_type }, \ 326 { "packets", &ng_parse_uint16_type }, \ 327 { NULL } \ 328 } 329 330 /* Parse the setmtu structure */ 331 #define NG_NETFLOW_SETMTU_TYPE { \ 332 { "mtu", &ng_parse_uint16_type }, \ 333 { NULL } \ 334 } 335 336 /* Private hook data */ 337 struct ng_netflow_iface { 338 hook_p hook; /* NULL when disconnected */ 339 hook_p out; /* NULL when no bypass hook */ 340 struct ng_netflow_ifinfo info; 341 }; 342 343 typedef struct ng_netflow_iface *iface_p; 344 typedef struct ng_netflow_ifinfo *ifinfo_p; 345 346 struct netflow_export_item { 347 item_p item; 348 item_p item9; 349 struct netflow_v9_packet_opt *item9_opt; 350 }; 351 352 /* Structure contatining fib-specific data */ 353 struct fib_export { 354 uint32_t fib; /* kernel fib id */ 355 struct netflow_export_item exp; /* Various data used for export */ 356 struct mtx export_mtx; /* exp.item mutex */ 357 struct mtx export9_mtx; /* exp.item9 mutex */ 358 uint32_t flow_seq; /* current V5 flow sequence */ 359 uint32_t flow9_seq; /* current V9 flow sequence */ 360 uint32_t domain_id; /* Observartion domain id */ 361 /* Netflow V9 counters */ 362 uint32_t templ_last_ts; /* unixtime of last template announce */ 363 uint32_t templ_last_pkt; /* packets count on last template announce */ 364 uint32_t sent_packets; /* packets sent by exporter; */ 365 struct netflow_v9_packet_opt *export9_opt; /* current packet specific options */ 366 }; 367 368 typedef struct fib_export *fib_export_p; 369 370 /* Structure describing our flow engine */ 371 struct netflow { 372 node_p node; /* link to the node itself */ 373 hook_p export; /* export data goes there */ 374 hook_p export9; /* Netflow V9 export data goes there */ 375 376 struct ng_netflow_info info; 377 struct callout exp_callout; /* expiry periodic job */ 378 379 /* 380 * Flow entries are allocated in uma(9) zone zone. They are 381 * indexed by hash hash. Each hash element consist of tailqueue 382 * head and mutex to protect this element. 383 */ 384 #define CACHESIZE (65536*4) 385 #define CACHELOWAT (CACHESIZE * 3/4) 386 #define CACHEHIGHWAT (CACHESIZE * 9/10) 387 uma_zone_t zone; 388 struct flow_hash_entry *hash; 389 390 /* 391 * NetFlow data export 392 * 393 * export_item is a data item, it has an mbuf with cluster 394 * attached to it. A thread detaches export_item from priv 395 * and works with it. If the export is full it is sent, and 396 * a new one is allocated. Before exiting thread re-attaches 397 * its current item back to priv. If there is item already, 398 * current incomplete datagram is sent. 399 * export_mtx is used for attaching/detaching. 400 */ 401 402 /* IPv6 support */ 403 #ifdef INET6 404 uma_zone_t zone6; 405 struct flow6_hash_entry *hash6; 406 #endif 407 /* Multiple FIB support */ 408 fib_export_p fib_data[RT_NUMFIBS]; /* array of pointers to fib-specific data */ 409 410 /* 411 * RFC 3954 clause 7.3 412 * "Both options MUST be configurable by the user on the Exporter." 413 */ 414 uint16_t templ_time; /* time between sending templates */ 415 uint16_t templ_packets; /* packets between sending templates */ 416 #define NETFLOW_V9_MAX_FLOWSETS 2 417 u_char flowsets_count; /* current flowsets used */ 418 u_char flowset_records[NETFLOW_V9_MAX_FLOWSETS - 1]; /* Count of records in each flowset */ 419 uint16_t mtu; /* export interface MTU */ 420 struct netflow_v9_flowset_header *v9_flowsets[NETFLOW_V9_MAX_FLOWSETS - 1]; /* Pointers to pre-compiled flowsets */ 421 422 struct ng_netflow_iface ifaces[NG_NETFLOW_MAXIFACES]; 423 }; 424 425 typedef struct netflow *priv_p; 426 427 /* Header of a small list in hash cell */ 428 struct flow_hash_entry { 429 struct mtx mtx; 430 TAILQ_HEAD(fhead, flow_entry) head; 431 }; 432 433 struct flow6_hash_entry { 434 struct mtx mtx; 435 TAILQ_HEAD(f6head, flow6_entry) head; 436 }; 437 438 #define ERROUT(x) { error = (x); goto done; } 439 440 #define MTAG_NETFLOW 1221656444 441 #define MTAG_NETFLOW_CALLED 0 442 443 #define m_pktlen(m) ((m)->m_pkthdr.len) 444 #define IP6VERSION 6 445 446 #define priv_to_fib(priv, fib) (priv)->fib_data[(fib)] 447 448 /* 449 * Cisco uses milliseconds for uptime. Bad idea, since it overflows 450 * every 48+ days. But we will do same to keep compatibility. This macro 451 * does overflowable multiplication to 1000. 452 */ 453 #define MILLIUPTIME(t) (((t) << 9) + /* 512 */ \ 454 ((t) << 8) + /* 256 */ \ 455 ((t) << 7) + /* 128 */ \ 456 ((t) << 6) + /* 64 */ \ 457 ((t) << 5) + /* 32 */ \ 458 ((t) << 3)) /* 8 */ 459 460 /* Prototypes for netflow.c */ 461 void ng_netflow_cache_init(priv_p); 462 void ng_netflow_cache_flush(priv_p); 463 int ng_netflow_fib_init(priv_p priv, int fib); 464 void ng_netflow_copyinfo(priv_p, struct ng_netflow_info *); 465 timeout_t ng_netflow_expire; 466 int ng_netflow_flow_add(priv_p, fib_export_p, struct ip *, caddr_t, uint8_t, uint8_t, unsigned int); 467 int ng_netflow_flow6_add(priv_p, fib_export_p, struct ip6_hdr *, caddr_t , uint8_t, uint8_t, unsigned int); 468 int ng_netflow_flow_show(priv_p, uint32_t last, struct ng_mesg *); 469 470 void ng_netflow_v9_cache_init(priv_p); 471 void ng_netflow_v9_cache_flush(priv_p); 472 item_p get_export9_dgram(priv_p, fib_export_p, struct netflow_v9_packet_opt **); 473 void return_export9_dgram(priv_p, fib_export_p, item_p, 474 struct netflow_v9_packet_opt *, int); 475 int export9_add(item_p, struct netflow_v9_packet_opt *, struct flow_entry *); 476 int export9_send(priv_p, fib_export_p, item_p, struct netflow_v9_packet_opt *, 477 int); 478 479 #endif /* _KERNEL */ 480 #endif /* _NG_NETFLOW_H_ */ 481