1 /*- 2 * Copyright (c) 2010-2011 Alexander V. Chernikov <melifaro@ipfw.ru> 3 * Copyright (c) 2004-2005 Gleb Smirnoff <glebius@FreeBSD.org> 4 * Copyright (c) 2001-2003 Roman V. Palagin <romanp@unshadow.net> 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 * 28 * $SourceForge: ng_netflow.h,v 1.26 2004/09/04 15:44:55 glebius Exp $ 29 * $FreeBSD$ 30 */ 31 32 #ifndef _NG_NETFLOW_H_ 33 #define _NG_NETFLOW_H_ 34 35 #define NG_NETFLOW_NODE_TYPE "netflow" 36 #define NGM_NETFLOW_COOKIE 1309868867 37 #define NGM_NETFLOW_V9_COOKIE 1349865386 38 39 #define NG_NETFLOW_MAXIFACES USHRT_MAX 40 41 /* Hook names */ 42 43 #define NG_NETFLOW_HOOK_DATA "iface" 44 #define NG_NETFLOW_HOOK_OUT "out" 45 #define NG_NETFLOW_HOOK_EXPORT "export" 46 #define NG_NETFLOW_HOOK_EXPORT9 "export9" 47 48 /* This define effectively disable (v5) netflow export hook! */ 49 /* #define COUNTERS_64 */ 50 51 /* Netgraph commands understood by netflow node */ 52 enum { 53 NGM_NETFLOW_INFO = 1|NGM_READONLY|NGM_HASREPLY, /* get node info */ 54 NGM_NETFLOW_IFINFO = 2|NGM_READONLY|NGM_HASREPLY, /* get iface info */ 55 NGM_NETFLOW_SHOW = 3|NGM_READONLY|NGM_HASREPLY, /* show ip cache flow */ 56 NGM_NETFLOW_SETDLT = 4, /* set data-link type */ 57 NGM_NETFLOW_SETIFINDEX = 5, /* set interface index */ 58 NGM_NETFLOW_SETTIMEOUTS = 6, /* set active/inactive flow timeouts */ 59 NGM_NETFLOW_SETCONFIG = 7, /* set flow generation options */ 60 NGM_NETFLOW_SETTEMPLATE = 8, /* set v9 flow template periodic */ 61 NGM_NETFLOW_SETMTU = 9, /* set outgoing interface MTU */ 62 NGM_NETFLOW_V9INFO = 10|NGM_READONLY|NGM_HASREPLY, /* get v9 info */ 63 }; 64 65 /* This structure is returned by the NGM_NETFLOW_INFO message */ 66 struct ng_netflow_info { 67 uint64_t nfinfo_bytes; /* accounted IPv4 bytes */ 68 uint32_t nfinfo_packets; /* accounted IPv4 packets */ 69 uint64_t nfinfo_bytes6; /* accounted IPv6 bytes */ 70 uint32_t nfinfo_packets6; /* accounted IPv6 packets */ 71 uint64_t nfinfo_sbytes; /* skipped IPv4 bytes */ 72 uint32_t nfinfo_spackets; /* skipped IPv4 packets */ 73 uint64_t nfinfo_sbytes6; /* skipped IPv6 bytes */ 74 uint32_t nfinfo_spackets6; /* skipped IPv6 packets */ 75 uint32_t nfinfo_used; /* used cache records */ 76 uint32_t nfinfo_used6; /* used IPv6 cache records */ 77 uint32_t nfinfo_alloc_failed; /* failed allocations */ 78 uint32_t nfinfo_export_failed; /* failed exports */ 79 uint32_t nfinfo_export9_failed; /* failed exports */ 80 uint32_t nfinfo_realloc_mbuf; /* reallocated mbufs */ 81 uint32_t nfinfo_alloc_fibs; /* fibs allocated */ 82 uint32_t nfinfo_act_exp; /* active expiries */ 83 uint32_t nfinfo_inact_exp; /* inactive expiries */ 84 uint32_t nfinfo_inact_t; /* flow inactive timeout */ 85 uint32_t nfinfo_act_t; /* flow active timeout */ 86 }; 87 88 /* This structure is returned by the NGM_NETFLOW_IFINFO message */ 89 struct ng_netflow_ifinfo { 90 uint32_t ifinfo_packets; /* number of packets for this iface */ 91 uint8_t ifinfo_dlt; /* Data Link Type, DLT_XXX */ 92 #define MAXDLTNAMELEN 20 93 uint16_t ifinfo_index; /* connected iface index */ 94 uint32_t conf; 95 }; 96 97 98 /* This structure is passed to NGM_NETFLOW_SETDLT message */ 99 struct ng_netflow_setdlt { 100 uint16_t iface; /* which iface dlt change */ 101 uint8_t dlt; /* DLT_XXX from bpf.h */ 102 }; 103 104 /* This structure is passed to NGM_NETFLOW_SETIFINDEX */ 105 struct ng_netflow_setifindex { 106 uint16_t iface; /* which iface index change */ 107 uint16_t index; /* new index */ 108 }; 109 110 /* This structure is passed to NGM_NETFLOW_SETTIMEOUTS */ 111 struct ng_netflow_settimeouts { 112 uint32_t inactive_timeout; /* flow inactive timeout */ 113 uint32_t active_timeout; /* flow active timeout */ 114 }; 115 116 #define NG_NETFLOW_CONF_INGRESS 0x01 /* Account on ingress */ 117 #define NG_NETFLOW_CONF_EGRESS 0x02 /* Account on egress */ 118 #define NG_NETFLOW_CONF_ONCE 0x04 /* Add tag to account only once */ 119 #define NG_NETFLOW_CONF_THISONCE 0x08 /* Account once in current node */ 120 #define NG_NETFLOW_CONF_NOSRCLOOKUP 0x10 /* No radix lookup on src */ 121 #define NG_NETFLOW_CONF_NODSTLOOKUP 0x20 /* No radix lookup on dst */ 122 123 #define NG_NETFLOW_IS_FRAG 0x01 124 #define NG_NETFLOW_FLOW_FLAGS (NG_NETFLOW_CONF_NOSRCLOOKUP|\ 125 NG_NETFLOW_CONF_NODSTLOOKUP) 126 127 /* This structure is passed to NGM_NETFLOW_SETCONFIG */ 128 struct ng_netflow_setconfig { 129 uint16_t iface; /* which iface config change */ 130 uint32_t conf; /* new config */ 131 }; 132 133 /* This structure is passed to NGM_NETFLOW_SETTEMPLATE */ 134 struct ng_netflow_settemplate { 135 uint16_t time; /* max time between announce */ 136 uint16_t packets; /* max packets between announce */ 137 }; 138 139 /* This structure is passed to NGM_NETFLOW_SETMTU */ 140 struct ng_netflow_setmtu { 141 uint16_t mtu; /* MTU for packet */ 142 }; 143 144 /* This structure is used in NGM_NETFLOW_SHOW request/responce */ 145 struct ngnf_show_header { 146 u_char version; /* IPv4 or IPv6 */ 147 uint32_t hash_id; /* current hash index */ 148 uint32_t list_id; /* current record number in hash */ 149 uint32_t nentries; /* number of records in response */ 150 }; 151 152 /* This structure is used in NGM_NETFLOW_V9INFO message */ 153 struct ng_netflow_v9info { 154 uint16_t templ_packets; /* v9 template packets */ 155 uint16_t templ_time; /* v9 template time */ 156 uint16_t mtu; /* v9 MTU */ 157 }; 158 159 /* XXXGL 160 * Somewhere flow_rec6 is casted to flow_rec, and flow6_entry_data is 161 * casted to flow_entry_data. After casting, fle->r.fib is accessed. 162 * So beginning of these structs up to fib should be kept common. 163 */ 164 165 /* This is unique data, which identifies flow */ 166 struct flow_rec { 167 uint16_t flow_type; 168 uint16_t fib; 169 struct in_addr r_src; 170 struct in_addr r_dst; 171 union { 172 struct { 173 uint16_t s_port; /* source TCP/UDP port */ 174 uint16_t d_port; /* destination TCP/UDP port */ 175 } dir; 176 uint32_t both; 177 } ports; 178 union { 179 struct { 180 u_char prot; /* IP protocol */ 181 u_char tos; /* IP TOS */ 182 uint16_t i_ifx; /* input interface index */ 183 } i; 184 uint32_t all; 185 } misc; 186 }; 187 188 /* This is unique data, which identifies flow */ 189 struct flow6_rec { 190 uint16_t flow_type; 191 uint16_t fib; 192 union { 193 struct in_addr r_src; 194 struct in6_addr r_src6; 195 } src; 196 union { 197 struct in_addr r_dst; 198 struct in6_addr r_dst6; 199 } dst; 200 union { 201 struct { 202 uint16_t s_port; /* source TCP/UDP port */ 203 uint16_t d_port; /* destination TCP/UDP port */ 204 } dir; 205 uint32_t both; 206 } ports; 207 union { 208 struct { 209 u_char prot; /* IP protocol */ 210 u_char tos; /* IP TOS */ 211 uint16_t i_ifx; /* input interface index */ 212 } i; 213 uint32_t all; 214 } misc; 215 }; 216 217 #define r_ip_p misc.i.prot 218 #define r_tos misc.i.tos 219 #define r_i_ifx misc.i.i_ifx 220 #define r_misc misc.all 221 #define r_ports ports.both 222 #define r_sport ports.dir.s_port 223 #define r_dport ports.dir.d_port 224 225 /* A flow entry which accumulates statistics */ 226 struct flow_entry_data { 227 uint16_t version; /* Protocol version */ 228 struct flow_rec r; 229 struct in_addr next_hop; 230 uint16_t fle_o_ifx; /* output interface index */ 231 #define fle_i_ifx r.misc.i.i_ifx 232 uint8_t dst_mask; /* destination route mask bits */ 233 uint8_t src_mask; /* source route mask bits */ 234 u_long packets; 235 u_long bytes; 236 long first; /* uptime on first packet */ 237 long last; /* uptime on last packet */ 238 u_char tcp_flags; /* cumulative OR */ 239 }; 240 241 struct flow6_entry_data { 242 uint16_t version; /* Protocol version */ 243 struct flow6_rec r; 244 union { 245 struct in_addr next_hop; 246 struct in6_addr next_hop6; 247 } n; 248 uint16_t fle_o_ifx; /* output interface index */ 249 #define fle_i_ifx r.misc.i.i_ifx 250 uint8_t dst_mask; /* destination route mask bits */ 251 uint8_t src_mask; /* source route mask bits */ 252 u_long packets; 253 u_long bytes; 254 long first; /* uptime on first packet */ 255 long last; /* uptime on last packet */ 256 u_char tcp_flags; /* cumulative OR */ 257 }; 258 259 /* 260 * How many flow records we will transfer at once 261 * without overflowing socket receive buffer 262 */ 263 #define NREC_AT_ONCE 1000 264 #define NREC6_AT_ONCE (NREC_AT_ONCE * sizeof(struct flow_entry_data) / \ 265 sizeof(struct flow6_entry_data)) 266 #define NGRESP_SIZE (sizeof(struct ngnf_show_header) + (NREC_AT_ONCE * \ 267 sizeof(struct flow_entry_data))) 268 #define SORCVBUF_SIZE (NGRESP_SIZE + 2 * sizeof(struct ng_mesg)) 269 270 /* Everything below is for kernel */ 271 272 #ifdef _KERNEL 273 274 struct flow_entry { 275 TAILQ_ENTRY(flow_entry) fle_hash; /* entries in hash slot */ 276 struct flow_entry_data f; 277 }; 278 279 struct flow6_entry { 280 TAILQ_ENTRY(flow_entry) fle_hash; /* entries in hash slot */ 281 struct flow6_entry_data f; 282 }; 283 /* Parsing declarations */ 284 285 /* Parse the info structure */ 286 #define NG_NETFLOW_INFO_TYPE { \ 287 { "IPv4 bytes", &ng_parse_uint64_type },\ 288 { "IPv4 packets", &ng_parse_uint32_type },\ 289 { "IPv6 bytes", &ng_parse_uint64_type },\ 290 { "IPv6 packets", &ng_parse_uint32_type },\ 291 { "IPv4 skipped bytes", &ng_parse_uint64_type },\ 292 { "IPv4 skipped packets", &ng_parse_uint32_type },\ 293 { "IPv6 skipped bytes", &ng_parse_uint64_type },\ 294 { "IPv6 skipped packets", &ng_parse_uint32_type },\ 295 { "IPv4 records used", &ng_parse_uint32_type },\ 296 { "IPv6 records used", &ng_parse_uint32_type },\ 297 { "Failed allocations", &ng_parse_uint32_type },\ 298 { "V5 failed exports", &ng_parse_uint32_type },\ 299 { "V9 failed exports", &ng_parse_uint32_type },\ 300 { "mbuf reallocations", &ng_parse_uint32_type },\ 301 { "fibs allocated", &ng_parse_uint32_type },\ 302 { "Active expiries", &ng_parse_uint32_type },\ 303 { "Inactive expiries", &ng_parse_uint32_type },\ 304 { "Inactive timeout", &ng_parse_uint32_type },\ 305 { "Active timeout", &ng_parse_uint32_type },\ 306 { NULL } \ 307 } 308 309 /* Parse the ifinfo structure */ 310 #define NG_NETFLOW_IFINFO_TYPE { \ 311 { "packets", &ng_parse_uint32_type },\ 312 { "data link type", &ng_parse_uint8_type }, \ 313 { "index", &ng_parse_uint16_type },\ 314 { "conf", &ng_parse_uint32_type },\ 315 { NULL } \ 316 } 317 318 /* Parse the setdlt structure */ 319 #define NG_NETFLOW_SETDLT_TYPE { \ 320 { "iface", &ng_parse_uint16_type }, \ 321 { "dlt", &ng_parse_uint8_type }, \ 322 { NULL } \ 323 } 324 325 /* Parse the setifindex structure */ 326 #define NG_NETFLOW_SETIFINDEX_TYPE { \ 327 { "iface", &ng_parse_uint16_type }, \ 328 { "index", &ng_parse_uint16_type }, \ 329 { NULL } \ 330 } 331 332 /* Parse the settimeouts structure */ 333 #define NG_NETFLOW_SETTIMEOUTS_TYPE { \ 334 { "inactive", &ng_parse_uint32_type }, \ 335 { "active", &ng_parse_uint32_type }, \ 336 { NULL } \ 337 } 338 339 /* Parse the setifindex structure */ 340 #define NG_NETFLOW_SETCONFIG_TYPE { \ 341 { "iface", &ng_parse_uint16_type }, \ 342 { "conf", &ng_parse_uint32_type }, \ 343 { NULL } \ 344 } 345 346 /* Parse the settemplate structure */ 347 #define NG_NETFLOW_SETTEMPLATE_TYPE { \ 348 { "time", &ng_parse_uint16_type }, \ 349 { "packets", &ng_parse_uint16_type }, \ 350 { NULL } \ 351 } 352 353 /* Parse the setmtu structure */ 354 #define NG_NETFLOW_SETMTU_TYPE { \ 355 { "mtu", &ng_parse_uint16_type }, \ 356 { NULL } \ 357 } 358 359 /* Parse the v9info structure */ 360 #define NG_NETFLOW_V9INFO_TYPE { \ 361 { "v9 template packets", &ng_parse_uint16_type },\ 362 { "v9 template time", &ng_parse_uint16_type },\ 363 { "v9 MTU", &ng_parse_uint16_type },\ 364 { NULL } \ 365 } 366 367 /* Private hook data */ 368 struct ng_netflow_iface { 369 hook_p hook; /* NULL when disconnected */ 370 hook_p out; /* NULL when no bypass hook */ 371 struct ng_netflow_ifinfo info; 372 }; 373 374 typedef struct ng_netflow_iface *iface_p; 375 typedef struct ng_netflow_ifinfo *ifinfo_p; 376 377 struct netflow_export_item { 378 item_p item; 379 item_p item9; 380 struct netflow_v9_packet_opt *item9_opt; 381 }; 382 383 /* Structure contatining fib-specific data */ 384 struct fib_export { 385 uint32_t fib; /* kernel fib id */ 386 387 /* Various data used for export */ 388 struct netflow_export_item exp; 389 390 struct mtx export_mtx; /* exp.item mutex */ 391 struct mtx export9_mtx; /* exp.item9 mutex */ 392 uint32_t flow_seq; /* current V5 flow sequence */ 393 uint32_t flow9_seq; /* current V9 flow sequence */ 394 uint32_t domain_id; /* Observartion domain id */ 395 /* Netflow V9 counters */ 396 uint32_t templ_last_ts; /* unixtime of last template announce */ 397 uint32_t templ_last_pkt; /* packet count on last announce */ 398 uint32_t sent_packets; /* packets sent by exporter; */ 399 400 /* Current packet specific options */ 401 struct netflow_v9_packet_opt *export9_opt; 402 }; 403 404 typedef struct fib_export *fib_export_p; 405 406 /* Structure describing our flow engine */ 407 struct netflow { 408 node_p node; /* link to the node itself */ 409 hook_p export; /* export data goes there */ 410 hook_p export9; /* Netflow V9 export data goes there */ 411 struct ng_netflow_info info; 412 struct callout exp_callout; /* expiry periodic job */ 413 414 /* 415 * Flow entries are allocated in uma(9) zone zone. They are 416 * indexed by hash hash. Each hash element consist of tailqueue 417 * head and mutex to protect this element. 418 */ 419 #define CACHESIZE (65536*16) 420 #define CACHELOWAT (CACHESIZE * 3/4) 421 #define CACHEHIGHWAT (CACHESIZE * 9/10) 422 uma_zone_t zone; 423 struct flow_hash_entry *hash; 424 425 /* 426 * NetFlow data export 427 * 428 * export_item is a data item, it has an mbuf with cluster 429 * attached to it. A thread detaches export_item from priv 430 * and works with it. If the export is full it is sent, and 431 * a new one is allocated. Before exiting thread re-attaches 432 * its current item back to priv. If there is item already, 433 * current incomplete datagram is sent. 434 * export_mtx is used for attaching/detaching. 435 */ 436 437 /* IPv6 support */ 438 #ifdef INET6 439 uma_zone_t zone6; 440 struct flow_hash_entry *hash6; 441 #endif 442 443 /* Multiple FIB support */ 444 fib_export_p *fib_data; /* vector to per-fib data */ 445 uint16_t maxfibs; /* number of allocated fibs */ 446 447 /* Netflow v9 configuration options */ 448 /* 449 * RFC 3954 clause 7.3 450 * "Both options MUST be configurable by the user on the Exporter." 451 */ 452 uint16_t templ_time; /* time between sending templates */ 453 uint16_t templ_packets; /* packets between sending templates */ 454 #define NETFLOW_V9_MAX_FLOWSETS 2 455 u_char flowsets_count; /* current flowsets used */ 456 457 /* Count of records in each flowset */ 458 u_char flowset_records[NETFLOW_V9_MAX_FLOWSETS - 1]; 459 uint16_t mtu; /* export interface MTU */ 460 461 /* Pointers to pre-compiled flowsets */ 462 struct netflow_v9_flowset_header 463 *v9_flowsets[NETFLOW_V9_MAX_FLOWSETS - 1]; 464 465 struct ng_netflow_iface ifaces[NG_NETFLOW_MAXIFACES]; 466 }; 467 468 typedef struct netflow *priv_p; 469 470 /* Header of a small list in hash cell */ 471 struct flow_hash_entry { 472 struct mtx mtx; 473 TAILQ_HEAD(fhead, flow_entry) head; 474 }; 475 476 #define ERROUT(x) { error = (x); goto done; } 477 478 #define MTAG_NETFLOW 1221656444 479 #define MTAG_NETFLOW_CALLED 0 480 481 #define m_pktlen(m) ((m)->m_pkthdr.len) 482 #define IP6VERSION 6 483 484 #define priv_to_fib(priv, fib) (priv)->fib_data[(fib)] 485 486 /* 487 * Cisco uses milliseconds for uptime. Bad idea, since it overflows 488 * every 48+ days. But we will do same to keep compatibility. This macro 489 * does overflowable multiplication to 1000. 490 */ 491 #define MILLIUPTIME(t) (((t) << 9) + /* 512 */ \ 492 ((t) << 8) + /* 256 */ \ 493 ((t) << 7) + /* 128 */ \ 494 ((t) << 6) + /* 64 */ \ 495 ((t) << 5) + /* 32 */ \ 496 ((t) << 3)) /* 8 */ 497 498 /* Prototypes for netflow.c */ 499 void ng_netflow_cache_init(priv_p); 500 void ng_netflow_cache_flush(priv_p); 501 int ng_netflow_fib_init(priv_p priv, int fib); 502 void ng_netflow_copyinfo(priv_p, struct ng_netflow_info *); 503 void ng_netflow_copyv9info(priv_p, struct ng_netflow_v9info *); 504 timeout_t ng_netflow_expire; 505 int ng_netflow_flow_add(priv_p, fib_export_p, struct ip *, caddr_t, 506 uint8_t, uint8_t, unsigned int); 507 int ng_netflow_flow6_add(priv_p, fib_export_p, struct ip6_hdr *, caddr_t, 508 uint8_t, uint8_t, unsigned int); 509 int ng_netflow_flow_show(priv_p, struct ngnf_show_header *req, 510 struct ngnf_show_header *resp); 511 void ng_netflow_v9_cache_init(priv_p); 512 void ng_netflow_v9_cache_flush(priv_p); 513 item_p get_export9_dgram(priv_p, fib_export_p, 514 struct netflow_v9_packet_opt **); 515 void return_export9_dgram(priv_p, fib_export_p, item_p, 516 struct netflow_v9_packet_opt *, int); 517 int export9_add(item_p, struct netflow_v9_packet_opt *, 518 struct flow_entry *); 519 int export9_send(priv_p, fib_export_p, item_p, 520 struct netflow_v9_packet_opt *, int); 521 522 #endif /* _KERNEL */ 523 #endif /* _NG_NETFLOW_H_ */ 524