1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 3 * 4 * Copyright (c) 2010 Alexander V. Chernikov <melifaro@ipfw.ru> 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 * 28 * $FreeBSD$ 29 */ 30 31 #include <sys/cdefs.h> 32 __FBSDID("$FreeBSD$"); 33 34 #include "opt_inet6.h" 35 #include "opt_route.h" 36 #include <sys/param.h> 37 #include <sys/systm.h> 38 #include <sys/counter.h> 39 #include <sys/kernel.h> 40 #include <sys/ktr.h> 41 #include <sys/limits.h> 42 #include <sys/malloc.h> 43 #include <sys/mbuf.h> 44 #include <sys/syslog.h> 45 #include <sys/socket.h> 46 #include <vm/uma.h> 47 48 #include <net/if.h> 49 #include <net/route.h> 50 #include <net/ethernet.h> 51 #include <netinet/in.h> 52 #include <netinet/in_systm.h> 53 #include <netinet/ip.h> 54 #include <netinet/ip6.h> 55 #include <netinet/tcp.h> 56 #include <netinet/udp.h> 57 58 #include <netgraph/ng_message.h> 59 #include <netgraph/netgraph.h> 60 61 #include <netgraph/netflow/netflow.h> 62 #include <netgraph/netflow/ng_netflow.h> 63 #include <netgraph/netflow/netflow_v9.h> 64 65 MALLOC_DECLARE(M_NETFLOW_GENERAL); 66 MALLOC_DEFINE(M_NETFLOW_GENERAL, "netflow_general", "plog, V9 templates data"); 67 68 /* 69 * Base V9 templates for L4+ IPv4/IPv6 protocols 70 */ 71 struct netflow_v9_template _netflow_v9_record_ipv4_tcp[] = 72 { 73 { NETFLOW_V9_FIELD_IPV4_SRC_ADDR, 4}, 74 { NETFLOW_V9_FIELD_IPV4_DST_ADDR, 4}, 75 { NETFLOW_V9_FIELD_IPV4_NEXT_HOP, 4}, 76 { NETFLOW_V9_FIELD_INPUT_SNMP, 2}, 77 { NETFLOW_V9_FIELD_OUTPUT_SNMP, 2}, 78 { NETFLOW_V9_FIELD_IN_PKTS, sizeof(CNTR)}, 79 { NETFLOW_V9_FIELD_IN_BYTES, sizeof(CNTR)}, 80 { NETFLOW_V9_FIELD_OUT_PKTS, sizeof(CNTR)}, 81 { NETFLOW_V9_FIELD_OUT_BYTES, sizeof(CNTR)}, 82 { NETFLOW_V9_FIELD_FIRST_SWITCHED, 4}, 83 { NETFLOW_V9_FIELD_LAST_SWITCHED, 4}, 84 { NETFLOW_V9_FIELD_L4_SRC_PORT, 2}, 85 { NETFLOW_V9_FIELD_L4_DST_PORT, 2}, 86 { NETFLOW_V9_FIELD_TCP_FLAGS, 1}, 87 { NETFLOW_V9_FIELD_PROTOCOL, 1}, 88 { NETFLOW_V9_FIELD_TOS, 1}, 89 { NETFLOW_V9_FIELD_SRC_AS, 4}, 90 { NETFLOW_V9_FIELD_DST_AS, 4}, 91 { NETFLOW_V9_FIELD_SRC_MASK, 1}, 92 { NETFLOW_V9_FIELD_DST_MASK, 1}, 93 {0, 0} 94 }; 95 96 struct netflow_v9_template _netflow_v9_record_ipv6_tcp[] = 97 { 98 { NETFLOW_V9_FIELD_IPV6_SRC_ADDR, 16}, 99 { NETFLOW_V9_FIELD_IPV6_DST_ADDR, 16}, 100 { NETFLOW_V9_FIELD_IPV6_NEXT_HOP, 16}, 101 { NETFLOW_V9_FIELD_INPUT_SNMP, 2}, 102 { NETFLOW_V9_FIELD_OUTPUT_SNMP, 2}, 103 { NETFLOW_V9_FIELD_IN_PKTS, sizeof(CNTR)}, 104 { NETFLOW_V9_FIELD_IN_BYTES, sizeof(CNTR)}, 105 { NETFLOW_V9_FIELD_OUT_PKTS, sizeof(CNTR)}, 106 { NETFLOW_V9_FIELD_OUT_BYTES, sizeof(CNTR)}, 107 { NETFLOW_V9_FIELD_FIRST_SWITCHED, 4}, 108 { NETFLOW_V9_FIELD_LAST_SWITCHED, 4}, 109 { NETFLOW_V9_FIELD_L4_SRC_PORT, 2}, 110 { NETFLOW_V9_FIELD_L4_DST_PORT, 2}, 111 { NETFLOW_V9_FIELD_TCP_FLAGS, 1}, 112 { NETFLOW_V9_FIELD_PROTOCOL, 1}, 113 { NETFLOW_V9_FIELD_TOS, 1}, 114 { NETFLOW_V9_FIELD_SRC_AS, 4}, 115 { NETFLOW_V9_FIELD_DST_AS, 4}, 116 { NETFLOW_V9_FIELD_SRC_MASK, 1}, 117 { NETFLOW_V9_FIELD_DST_MASK, 1}, 118 {0, 0} 119 }; 120 121 /* 122 * Pre-compiles flow exporter for all possible FlowSets 123 * so we can add flowset to packet via simple memcpy() 124 */ 125 static void 126 generate_v9_templates(priv_p priv) 127 { 128 uint16_t *p, *template_fields_cnt; 129 int cnt; 130 131 int flowset_size = sizeof(struct netflow_v9_flowset_header) + 132 _NETFLOW_V9_TEMPLATE_SIZE(_netflow_v9_record_ipv4_tcp) + /* netflow_v9_record_ipv4_tcp */ 133 _NETFLOW_V9_TEMPLATE_SIZE(_netflow_v9_record_ipv6_tcp); /* netflow_v9_record_ipv6_tcp */ 134 135 priv->v9_flowsets[0] = malloc(flowset_size, M_NETFLOW_GENERAL, M_WAITOK | M_ZERO); 136 137 if (flowset_size % 4) 138 flowset_size += 4 - (flowset_size % 4); /* Padding to 4-byte boundary */ 139 140 priv->flowsets_count = 1; 141 p = (uint16_t *)priv->v9_flowsets[0]; 142 *p++ = 0; /* Flowset ID, 0 is reserved for Template FlowSets */ 143 *p++ = htons(flowset_size); /* Total FlowSet length */ 144 145 /* 146 * Most common TCP/UDP IPv4 template, ID = 256 147 */ 148 *p++ = htons(NETFLOW_V9_MAX_RESERVED_FLOWSET + NETFLOW_V9_FLOW_V4_L4); 149 template_fields_cnt = p++; 150 for (cnt = 0; _netflow_v9_record_ipv4_tcp[cnt].field_id != 0; cnt++) { 151 *p++ = htons(_netflow_v9_record_ipv4_tcp[cnt].field_id); 152 *p++ = htons(_netflow_v9_record_ipv4_tcp[cnt].field_length); 153 } 154 *template_fields_cnt = htons(cnt); 155 156 /* 157 * TCP/UDP IPv6 template, ID = 257 158 */ 159 *p++ = htons(NETFLOW_V9_MAX_RESERVED_FLOWSET + NETFLOW_V9_FLOW_V6_L4); 160 template_fields_cnt = p++; 161 for (cnt = 0; _netflow_v9_record_ipv6_tcp[cnt].field_id != 0; cnt++) { 162 *p++ = htons(_netflow_v9_record_ipv6_tcp[cnt].field_id); 163 *p++ = htons(_netflow_v9_record_ipv6_tcp[cnt].field_length); 164 } 165 *template_fields_cnt = htons(cnt); 166 167 priv->flowset_records[0] = 2; 168 } 169 170 /* Closes current data flowset */ 171 static void inline 172 close_flowset(struct mbuf *m, struct netflow_v9_packet_opt *t) 173 { 174 struct mbuf *m_old; 175 uint32_t zero = 0; 176 int offset = 0; 177 uint16_t *flowset_length, len; 178 179 /* Hack to ensure we are not crossing mbuf boundary, length is uint16_t */ 180 m_old = m_getptr(m, t->flow_header + offsetof(struct netflow_v9_flowset_header, length), &offset); 181 flowset_length = (uint16_t *)(mtod(m_old, char *) + offset); 182 183 len = (uint16_t)(m_pktlen(m) - t->flow_header); 184 /* Align on 4-byte boundary (RFC 3954, Clause 5.3) */ 185 if (len % 4) { 186 if (m_append(m, 4 - (len % 4), (void *)&zero) != 1) 187 panic("ng_netflow: m_append() failed!"); 188 189 len += 4 - (len % 4); 190 } 191 192 *flowset_length = htons(len); 193 } 194 195 /* 196 * Non-static functions called from ng_netflow.c 197 */ 198 199 /* We have full datagram in fib data. Send it to export hook. */ 200 int 201 export9_send(priv_p priv, fib_export_p fe, item_p item, struct netflow_v9_packet_opt *t, int flags) 202 { 203 struct mbuf *m = NGI_M(item); 204 struct netflow_v9_export_dgram *dgram = mtod(m, 205 struct netflow_v9_export_dgram *); 206 struct netflow_v9_header *header = &dgram->header; 207 struct timespec ts; 208 int error = 0; 209 210 if (t == NULL) { 211 CTR0(KTR_NET, "export9_send(): V9 export packet without tag"); 212 NG_FREE_ITEM(item); 213 return (0); 214 } 215 216 /* Close flowset if not closed already */ 217 if (m_pktlen(m) != t->flow_header) 218 close_flowset(m, t); 219 220 /* Fill export header. */ 221 header->count = t->count; 222 header->sys_uptime = htonl(MILLIUPTIME(time_uptime)); 223 getnanotime(&ts); 224 header->unix_secs = htonl(ts.tv_sec); 225 header->seq_num = htonl(atomic_fetchadd_32(&fe->flow9_seq, 1)); 226 header->count = htons(t->count); 227 header->source_id = htonl(fe->domain_id); 228 229 if (priv->export9 != NULL) 230 NG_FWD_ITEM_HOOK_FLAGS(error, item, priv->export9, flags); 231 else 232 NG_FREE_ITEM(item); 233 234 free(t, M_NETFLOW_GENERAL); 235 236 return (error); 237 } 238 239 240 241 /* Add V9 record to dgram. */ 242 int 243 export9_add(item_p item, struct netflow_v9_packet_opt *t, struct flow_entry *fle) 244 { 245 size_t len = 0; 246 struct netflow_v9_flowset_header fsh; 247 struct netflow_v9_record_general rg; 248 struct mbuf *m = NGI_M(item); 249 uint16_t flow_type; 250 struct flow_entry_data *fed; 251 #ifdef INET6 252 struct flow6_entry_data *fed6; 253 #endif 254 if (t == NULL) { 255 CTR0(KTR_NET, "ng_netflow: V9 export packet without tag!"); 256 return (0); 257 } 258 259 /* Prepare flow record */ 260 fed = (struct flow_entry_data *)&fle->f; 261 #ifdef INET6 262 fed6 = (struct flow6_entry_data *)&fle->f; 263 #endif 264 /* We can use flow_type field since fle6 offset is equal to fle */ 265 flow_type = fed->r.flow_type; 266 267 switch (flow_type) { 268 case NETFLOW_V9_FLOW_V4_L4: 269 { 270 /* IPv4 TCP/UDP/[SCTP] */ 271 struct netflow_v9_record_ipv4_tcp *rec = &rg.rec.v4_tcp; 272 273 rec->src_addr = fed->r.r_src.s_addr; 274 rec->dst_addr = fed->r.r_dst.s_addr; 275 rec->next_hop = fed->next_hop.s_addr; 276 rec->i_ifx = htons(fed->fle_i_ifx); 277 rec->o_ifx = htons(fed->fle_o_ifx); 278 rec->i_packets = htonl(fed->packets); 279 rec->i_octets = htonl(fed->bytes); 280 rec->o_packets = htonl(0); 281 rec->o_octets = htonl(0); 282 rec->first = htonl(MILLIUPTIME(fed->first)); 283 rec->last = htonl(MILLIUPTIME(fed->last)); 284 rec->s_port = fed->r.r_sport; 285 rec->d_port = fed->r.r_dport; 286 rec->flags = fed->tcp_flags; 287 rec->prot = fed->r.r_ip_p; 288 rec->tos = fed->r.r_tos; 289 rec->dst_mask = fed->dst_mask; 290 rec->src_mask = fed->src_mask; 291 292 /* Not supported fields. */ 293 rec->src_as = rec->dst_as = 0; 294 295 len = sizeof(struct netflow_v9_record_ipv4_tcp); 296 break; 297 } 298 #ifdef INET6 299 case NETFLOW_V9_FLOW_V6_L4: 300 { 301 /* IPv6 TCP/UDP/[SCTP] */ 302 struct netflow_v9_record_ipv6_tcp *rec = &rg.rec.v6_tcp; 303 304 rec->src_addr = fed6->r.src.r_src6; 305 rec->dst_addr = fed6->r.dst.r_dst6; 306 rec->next_hop = fed6->n.next_hop6; 307 rec->i_ifx = htons(fed6->fle_i_ifx); 308 rec->o_ifx = htons(fed6->fle_o_ifx); 309 rec->i_packets = htonl(fed6->packets); 310 rec->i_octets = htonl(fed6->bytes); 311 rec->o_packets = htonl(0); 312 rec->o_octets = htonl(0); 313 rec->first = htonl(MILLIUPTIME(fed6->first)); 314 rec->last = htonl(MILLIUPTIME(fed6->last)); 315 rec->s_port = fed6->r.r_sport; 316 rec->d_port = fed6->r.r_dport; 317 rec->flags = fed6->tcp_flags; 318 rec->prot = fed6->r.r_ip_p; 319 rec->tos = fed6->r.r_tos; 320 rec->dst_mask = fed6->dst_mask; 321 rec->src_mask = fed6->src_mask; 322 323 /* Not supported fields. */ 324 rec->src_as = rec->dst_as = 0; 325 326 len = sizeof(struct netflow_v9_record_ipv6_tcp); 327 break; 328 } 329 #endif 330 default: 331 { 332 CTR1(KTR_NET, "export9_add(): Don't know what to do with %d flow type!", flow_type); 333 return (0); 334 } 335 } 336 337 /* Check if new records has the same template */ 338 if (flow_type != t->flow_type) { 339 /* close old flowset */ 340 if (t->flow_type != 0) 341 close_flowset(m, t); 342 343 t->flow_type = flow_type; 344 t->flow_header = m_pktlen(m); 345 346 /* Generate data flowset ID */ 347 fsh.id = htons(NETFLOW_V9_MAX_RESERVED_FLOWSET + flow_type); 348 fsh.length = 0; 349 350 /* m_append should not fail since all data is already allocated */ 351 if (m_append(m, sizeof(fsh), (void *)&fsh) != 1) 352 panic("ng_netflow: m_append() failed"); 353 354 } 355 356 if (m_append(m, len, (void *)&rg.rec) != 1) 357 panic("ng_netflow: m_append() failed"); 358 359 t->count++; 360 361 if (m_pktlen(m) + sizeof(struct netflow_v9_record_general) + sizeof(struct netflow_v9_flowset_header) >= _NETFLOW_V9_MAX_SIZE(t->mtu)) 362 return (1); /* end of datagram */ 363 return (0); 364 } 365 366 /* 367 * Detach export datagram from fib instance, if there is any. 368 * If there is no, allocate a new one. 369 */ 370 item_p 371 get_export9_dgram(priv_p priv, fib_export_p fe, struct netflow_v9_packet_opt **tt) 372 { 373 item_p item = NULL; 374 struct netflow_v9_packet_opt *t = NULL; 375 376 mtx_lock(&fe->export9_mtx); 377 if (fe->exp.item9 != NULL) { 378 item = fe->exp.item9; 379 fe->exp.item9 = NULL; 380 t = fe->exp.item9_opt; 381 fe->exp.item9_opt = NULL; 382 } 383 mtx_unlock(&fe->export9_mtx); 384 385 if (item == NULL) { 386 struct netflow_v9_export_dgram *dgram; 387 struct mbuf *m; 388 uint16_t mtu = priv->mtu; 389 390 /* Allocate entire packet at once, allowing easy m_append() calls */ 391 m = m_getm(NULL, mtu, M_NOWAIT, MT_DATA); 392 if (m == NULL) 393 return (NULL); 394 395 t = malloc(sizeof(struct netflow_v9_packet_opt), M_NETFLOW_GENERAL, M_NOWAIT | M_ZERO); 396 if (t == NULL) { 397 m_free(m); 398 return (NULL); 399 } 400 401 item = ng_package_data(m, NG_NOFLAGS); 402 if (item == NULL) { 403 free(t, M_NETFLOW_GENERAL); 404 return (NULL); 405 } 406 407 dgram = mtod(m, struct netflow_v9_export_dgram *); 408 dgram->header.count = 0; 409 dgram->header.version = htons(NETFLOW_V9); 410 /* Set mbuf current data length */ 411 m->m_len = m->m_pkthdr.len = sizeof(struct netflow_v9_header); 412 413 t->count = 0; 414 t->mtu = mtu; 415 t->flow_header = m->m_len; 416 417 /* 418 * Check if we need to insert templates into packet 419 */ 420 421 struct netflow_v9_flowset_header *fl; 422 423 if ((time_uptime >= priv->templ_time + fe->templ_last_ts) || 424 (fe->sent_packets >= priv->templ_packets + fe->templ_last_pkt)) { 425 426 fe->templ_last_ts = time_uptime; 427 fe->templ_last_pkt = fe->sent_packets; 428 429 fl = priv->v9_flowsets[0]; 430 m_append(m, ntohs(fl->length), (void *)fl); 431 t->flow_header = m->m_len; 432 t->count += priv->flowset_records[0]; 433 } 434 435 } 436 437 *tt = t; 438 return (item); 439 } 440 441 /* 442 * Re-attach incomplete datagram back to fib instance. 443 * If there is already another one, then send incomplete. 444 */ 445 void 446 return_export9_dgram(priv_p priv, fib_export_p fe, item_p item, struct netflow_v9_packet_opt *t, int flags) 447 { 448 /* 449 * It may happen on SMP, that some thread has already 450 * put its item there, in this case we bail out and 451 * send what we have to collector. 452 */ 453 mtx_lock(&fe->export9_mtx); 454 if (fe->exp.item9 == NULL) { 455 fe->exp.item9 = item; 456 fe->exp.item9_opt = t; 457 mtx_unlock(&fe->export9_mtx); 458 } else { 459 mtx_unlock(&fe->export9_mtx); 460 export9_send(priv, fe, item, t, flags); 461 } 462 } 463 464 /* Allocate memory and set up flow cache */ 465 void 466 ng_netflow_v9_cache_init(priv_p priv) 467 { 468 generate_v9_templates(priv); 469 470 priv->templ_time = NETFLOW_V9_MAX_TIME_TEMPL; 471 priv->templ_packets = NETFLOW_V9_MAX_PACKETS_TEMPL; 472 priv->mtu = BASE_MTU; 473 } 474 475 /* Free all flow cache memory. Called from ng_netflow_cache_flush() */ 476 void 477 ng_netflow_v9_cache_flush(priv_p priv) 478 { 479 int i; 480 481 /* Free flowsets*/ 482 for (i = 0; i < priv->flowsets_count; i++) 483 free(priv->v9_flowsets[i], M_NETFLOW_GENERAL); 484 } 485 486 /* Get a snapshot of NetFlow v9 settings */ 487 void 488 ng_netflow_copyv9info(priv_p priv, struct ng_netflow_v9info *i) 489 { 490 491 i->templ_time = priv->templ_time; 492 i->templ_packets = priv->templ_packets; 493 i->mtu = priv->mtu; 494 } 495 496