Context Navigation

dataFlowSet.c @ 25

Revision 25, 26.9 KB (checked in by andreu, 16 years ago)
aggregation feature : prefix selection even if no routed subnet
Property svn:eol-style set to `native`

Rev	Line
[2]	1	/*
	2	* File: dataFlowSet.c
	3	*
[15]	4	* Authors: ANDREU Francois-Xavier
[2]	5	*
	6	* Copyright (C) 2005 GIP RENATER
	7	*/
	8
	9	/ This file is part of renetcol.*
	10	*
	11	* renetcol is free software; you can redistribute it and/or modify
	12	* it under the terms of the GNU General Public License as published by
	13	* the Free Software Foundation; either version 2 of the License, or
	14	* (at your option) any later version.
	15	*
	16	* renetcol is distributed in the hope that it will be useful,
	17	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	18	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	19	* GNU General Public License for more details.
	20	*
	21	* You should have received a copy of the GNU General Public License
	22	* along with renetcol; if not, write to the Free Software
	23	* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
	24	*/
	25
	26	#include "dataFlowSet.h"
	27
	28	/*
[22]	29	* Check Data FlowSet
[2]	30	*
	31	*/
	32	unsigned short
[23]	33	checkDataFlowSet(unsigned short shift,
	34	struct MyPtrs *myPtrs,
	35	int myQueue,
	36	struct PrefixV4 *V4PTab,
	37	size_t nbPV4
	38	)
[2]	39	{
	40	TplFlowSetPtr tmp;
	41	FieldPtr pftmp;
	42	FieldPtr secondPftmp;
	43	unsigned short data_length = 0;
	44	unsigned short flow_size = 0;
[23]	45	unsigned short oldOffset = *myPtrs->offsetV9Ptr;
[2]	46	unsigned short secondOffset = 0;
	47	unsigned short secondOldOffset = 0;
[14]	48	int moreIsNecessary = 1;
[2]	49	int field_size = 0;
	50	int cpt = 0;
	51	int secondCpt = 0;
	52	int overflow = 0;
	53	int noEnd = 1;
[16]	54	int i = 0;
	55	int j = 0;
[2]	56	int pos = 0;
	57	unsigned char buffer1;
	58	unsigned char buffer2[2];
	59	unsigned char buffer4[4];
[23]	60	RulesPtr tmpRuleList = myPtrs->rulesListPtr;
[2]	61	msgType myMsg;
	62	char *msgTextIndex;
	63	unsigned short tplMsgType = 11;
[16]	64	struct PrefixV4 prefixKey, res; /* for bsearch /
	65	struct AggCache agCache;
[22]	66	int bool = 0; / in IPV4 Agg mode enabled, we need to now if it's an IPv4 /
	67	/ flow, we test on the field and then put bool at 1 /
[20]	68	#ifdef CRIHAN
[22]	69	struct IPFLowCache ipFirstCache;
	70	struct MPLSFlowCache mplsFirstCache;
	71	unsigned long firstTime = 0;
	72	unsigned long lastTime = 0;
[2]	73
[18]	74	ipFirstCache.ipProt = 0;
	75	ipFirstCache.bytes = 0;
	76	ipFirstCache.pkts = 0;
	77	ipFirstCache.inSnmp = 0;
	78	ipFirstCache.outSnmp = 0;
	79	ipFirstCache.v4AdS = 0;
	80	ipFirstCache.v4AdD = 0;
	81	ipFirstCache.tProt = 0;
	82	ipFirstCache.sPort = 0;
	83	ipFirstCache.dPort = 0;
	84	ipFirstCache.maskD = 0;
	85	ipFirstCache.maskS = 0;
	86	ipFirstCache.routerAd = 0;
	87	ipFirstCache.liveTime = 0;
	88	mplsFirstCache.ipProt = 0;
	89	mplsFirstCache.v4AdS = 0;
	90	mplsFirstCache.v4AdD = 0;
	91	mplsFirstCache.routerAd = 0;
	92	mplsFirstCache.mplsLabel1 = 0;
[20]	93	#endif / CRIHAN /
[19]	94
[23]	95	buffer2[1] = (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));(*myPtrs->offsetV9Ptr)++;
	96	buffer2[0] = (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));(*myPtrs->offsetV9Ptr)++;
	97	(myPtrs->currentFlowsetIdPtr) = ((unsigned short*)&buffer2);
	98	buffer2[1] = (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));(*myPtrs->offsetV9Ptr)++;
	99	buffer2[0] = (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));(*myPtrs->offsetV9Ptr)++;
[2]	100	data_length = ((unsigned* short*)&buffer2);
[23]	101	if ((tmp=existTplId(myPtrs->currentRouterPtr, myPtrs->currentHeaderV9Ptr->sourceId,
	102	(*myPtrs->currentFlowsetIdPtr)))!=NULL) {
[2]	103	pftmp = tmp->lastField;
	104	for (; pftmp; pftmp = pftmp->prev) {
	105	flow_size += pftmp->fieldLength;
	106	}
	107	if ( data_length%flow_size >= 9 ) {
[23]	108	(*myPtrs->currentFlowsetNumberPtr) = myPtrs->currentHeaderV9Ptr->count;
[2]	109	syslog(LOG_INFO, "data flowset length not match with length from template definition, wrong template definition suspected; all next informations of this data flowset are not considered! flowset ID: %hu, from router: %lu.%lu.%lu.%lu",
[23]	110	(*myPtrs->currentFlowsetIdPtr),
	111	(myPtrs->pcktPtr->ipH->srcAdd>>24),
	112	(myPtrs->pcktPtr->ipH->srcAdd<<8>>24),
	113	(myPtrs->pcktPtr->ipH->srcAdd<<16>>24),
	114	(myPtrs->pcktPtr->ipH->srcAdd<<24>>24));
[2]	115	return (data_length+shift);
	116	}
[22]	117	#ifdef IPV4AGG
[23]	118	agCache.routerAd = myPtrs->pcktPtr->ipH->srcAdd;
[22]	119	#endif
[18]	120
[20]	121	#ifdef CRIHAN
[23]	122	ipFirstCache.routerAd = myPtrs->pcktPtr->ipH->srcAdd;
	123	mplsFirstCache.routerAd = myPtrs->pcktPtr->ipH->srcAdd;
[20]	124	#endif / CRIHAN /
[18]	125
[2]	126	pftmp = tmp->lastField;
	127	secondPftmp = tmp->lastField;
[23]	128	secondOffset = *myPtrs->offsetV9Ptr;
[2]	129	secondOldOffset = secondOffset;
[23]	130	while ( (((*myPtrs->offsetV9Ptr)-48-shift) <= data_length) && (overflow!=1) ) {
[2]	131	/*
	132	* progression in a flow Set
	133	* notes:
	134	* 48=header ip + header netf
	135	* shift = shift if there is a template declaration
	136	*/
	137	cpt++;
	138	j=0;
	139	pos = (pftmp->fieldType)*10+j;
	140	field_size = (int) pftmp->fieldLength;
	141	/*
	142	* Comparaison between the field value and the rules
	143	* ... if one rule exist
	144	*/
[23]	145	if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos))) != NULL) {
	146	oldOffset = *myPtrs->offsetV9Ptr;
	147	while (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos))) != NULL){
[2]	148	/*
	149	* while on one cache table line
	150	*/
[23]	151	*myPtrs->offsetV9Ptr = oldOffset;
[2]	152	switch ((int)
[23]	153	(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->operator)){
[2]	154	case 2:
	155	switch (field_size) {
	156	case 1:
[23]	157	buffer1 = (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
[17]	158	/ rule check /
[23]	159	if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.cvalue
[2]	160	== ((unsigned* char*)&buffer1)) {
[23]	161	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
[16]	162	}
[17]	163	/ end rule check /
[22]	164	#ifdef IPV4AGG
	165	if ((pftmp->fieldType==9)\|\|(pftmp->fieldType==29)){
	166	agCache.maskS = ((unsigned* char*)&buffer1);
	167	}
	168	if ((pftmp->fieldType==13)\|\|(pftmp->fieldType==30)){
	169	agCache.maskD = ((unsigned* char*)&buffer1);
	170	}
	171	if (pftmp->fieldType==60){
	172	agCache.ipProt = ((unsigned* char*)&buffer1);
	173	}
	174	if (pftmp->fieldType==4){
	175	agCache.tProt = ((unsigned* char*)&buffer1);
	176	}
	177	if (pftmp->fieldType==61){
	178	agCache.sens = ((unsigned* char*)&buffer1);
	179	}
	180	if (pftmp->fieldType==5){
	181	agCache.dscp = ((unsigned* char*)&buffer1);
	182	}
	183	#endif
[20]	184	#ifdef CRIHAN
[17]	185	if ((pftmp->fieldType==9)\|\|(pftmp->fieldType==29)){
[18]	186	ipFirstCache.maskS = ((unsigned* char*)&buffer1);
[17]	187	}
	188	if ((pftmp->fieldType==13)\|\|(pftmp->fieldType==30)){
[18]	189	ipFirstCache.maskD = ((unsigned* char*)&buffer1);
[17]	190	}
[18]	191	if (pftmp->fieldType==60){
	192	ipFirstCache.ipProt = ((unsigned* char*)&buffer1);
	193	mplsFirstCache.ipProt = ((unsigned* char*)&buffer1);
	194	}
	195	if (pftmp->fieldType==4){
	196	ipFirstCache.tProt = ((unsigned* char*)&buffer1);
	197	}
[22]	198	#endif
[2]	199	break;
	200	case 2:
[23]	201	buffer2[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	202	buffer2[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	203	if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.svalue
[2]	204	== ((unsigned* short*)&buffer2))
[23]	205	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
[22]	206	#ifdef IPV4AGG
	207	if (pftmp->fieldType==10){
	208	agCache.idSnmp = ((unsigned* short*)&buffer2);
	209	}
	210	#endif
[20]	211	#ifdef CRIHAN
[17]	212	if (pftmp->fieldType==10){
[18]	213	ipFirstCache.inSnmp = ((unsigned* short*)&buffer2);
[17]	214	}
[18]	215	if (pftmp->fieldType==14){
	216	ipFirstCache.outSnmp = ((unsigned* short*)&buffer2);
	217	}
	218	if (pftmp->fieldType==7){
	219	ipFirstCache.sPort = ((unsigned* short*)&buffer2);
	220	}
	221	if (pftmp->fieldType==11){
	222	ipFirstCache.dPort = ((unsigned* short*)&buffer2);
	223	}
[22]	224	#endif
[2]	225	break;
[17]	226	case 3:
	227	buffer4[3]= 0;
[23]	228	buffer4[2]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	229	buffer4[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	230	buffer4[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	231	if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue
[17]	232	== ((unsigned* long*)&buffer4))
[23]	233	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
[17]	234	/ aggregation /
	235	/ end aggregation /
[20]	236	#ifdef CRIHAN
[18]	237	if (pftmp->fieldType==70){
	238	mplsFirstCache.mplsLabel1 = (((unsigned* long*)&buffer4))>>4;
	239	}
[22]	240	#endif
[17]	241	break;
[2]	242	case 4:
[23]	243	buffer4[3]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	244	buffer4[2]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	245	buffer4[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	246	buffer4[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
[15]	247	/ FIXME : here , add a check on the field type /
[16]	248	if ((pftmp->fieldType==8)\|\|(pftmp->fieldType==12)){
[23]	249	if ((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue)
	250	== (((unsigned* long)&buffer4))>>(32-((RuleDefPtr)((myPtrs->rulesAddressPtr+pos)))->value->mask)<<(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask) )
[16]	251	{
[23]	252	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
[16]	253	}
	254	}
[22]	255	#ifdef IPV4AGG
	256	if ((pftmp->fieldType==8)){
	257	agCache.v4AdS = ((unsigned* long*)&buffer4);
	258	}
	259	if ((pftmp->fieldType==12)){
	260	agCache.v4AdD = ((unsigned* long*)&buffer4);
	261	}
	262	if (pftmp->fieldType==1){
	263	agCache.bytes = ((unsigned* long*)&buffer4);
	264	}
	265	if (pftmp->fieldType==2){
	266	agCache.pkts = ((unsigned* long*)&buffer4);
	267	}
	268	#endif
[20]	269	#ifdef CRIHAN
[18]	270	if (pftmp->fieldType==8){
	271	ipFirstCache.v4AdS = ((unsigned* long*)&buffer4);
[19]	272	mplsFirstCache.v4AdS = ((unsigned* long*)&buffer4);
[17]	273	}
[18]	274	if (pftmp->fieldType==12){
	275	ipFirstCache.v4AdD = ((unsigned* long*)&buffer4);
[19]	276	mplsFirstCache.v4AdD = ((unsigned* long*)&buffer4);
[17]	277	}
	278	if (pftmp->fieldType==1){
[18]	279	ipFirstCache.bytes = ((unsigned* long*)&buffer4);
[17]	280	}
	281	if (pftmp->fieldType==2){
[18]	282	ipFirstCache.pkts = ((unsigned* long*)&buffer4);
[17]	283	}
[18]	284	if (pftmp->fieldType==22){
	285	firstTime = ((unsigned* long*)&buffer4);
	286	}
	287	if (pftmp->fieldType==21){
	288	lastTime = ((unsigned* long*)&buffer4);
	289	}
[22]	290	#endif
[2]	291	break;
	292	case 16:
	293	for (i=0; i<4; i++) {
[23]	294	buffer4[3]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	295	buffer4[2]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	296	buffer4[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	297	buffer4[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
[14]	298	if (1==moreIsNecessary){
	299	switch(i){
	300	case 0:
[23]	301	if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 32){
	302	if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
[14]	303	==
[23]	304	(((unsigned* long)&buffer4))>>(32-((RuleDefPtr)((myPtrs->rulesAddressPtr+pos)))->value->mask)<<(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)
[14]	305	)
	306	{
[23]	307	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
[14]	308	moreIsNecessary = 0;
	309	} else {
[23]	310	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0;
[14]	311	moreIsNecessary = 0;
	312	}
[2]	313	} else {
[23]	314	if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
[14]	315	==
	316	(((unsigned* long*)&buffer4))
	317	)
	318	{
[23]	319	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
[14]	320	} else {
[23]	321	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0;
[14]	322	moreIsNecessary = 0;
	323	}
[2]	324	}
[14]	325	break;
	326	case 1:
[23]	327	if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 64){
	328	if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
[14]	329	==
[23]	330	(((unsigned* long)&buffer4))>>(64-((RuleDefPtr)((myPtrs->rulesAddressPtr+pos)))->value->mask)<<(64-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)
[14]	331	)
	332	{
[23]	333	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check =
	334	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1;
[14]	335	moreIsNecessary = 0;
	336	} else {
[23]	337	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0;
[14]	338	moreIsNecessary = 0;
	339	}
	340	} else {
[23]	341	if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
[14]	342	==
	343	(((unsigned* long*)&buffer4))
	344	)
	345	{
[23]	346	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check =
	347	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1;
[14]	348	} else {
[23]	349	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0;
[14]	350	moreIsNecessary = 0;
	351	}
	352	}
	353	break;
	354	case 2:
[23]	355	if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 96){
	356	if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
[14]	357	==
[23]	358	(((unsigned* long)&buffer4))>>(96-((RuleDefPtr)((myPtrs->rulesAddressPtr+pos)))->value->mask)<<(96-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)
[14]	359	)
	360	{
[23]	361	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check =
	362	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1;
[14]	363	moreIsNecessary = 0;
	364	} else {
[23]	365	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0;
[14]	366	moreIsNecessary = 0;
	367	}
	368	} else {
[23]	369	if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
[14]	370	==
	371	(((unsigned* long*)&buffer4))
	372	)
	373	{
[23]	374	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check =
	375	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1;
[14]	376	} else {
[23]	377	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0;
[14]	378	moreIsNecessary = 0;
	379	}
	380	}
	381	break;
	382	case 3:
[23]	383	if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 128){
	384	if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
[14]	385	==
[23]	386	(((unsigned* long)&buffer4))>>(128-((RuleDefPtr)((myPtrs->rulesAddressPtr+pos)))->value->mask)<<(128-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)
[14]	387	)
	388	{
[23]	389	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check =
	390	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1;
[14]	391	} else {
[23]	392	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0;
[14]	393	moreIsNecessary = 0;
	394	}
	395	} else {
[23]	396	if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
[14]	397	==
	398	(((unsigned* long*)&buffer4))
	399	)
	400	{
[23]	401	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check =
	402	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1;
[14]	403	} else {
[23]	404	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0;
[14]	405	moreIsNecessary = 0;
	406	}
	407	}
	408	break;
	409	default:
	410	break;
	411	} / end of switch(i) /
	412	} / end of if moreIsNecessary /
[2]	413	}
[14]	414	moreIsNecessary = 1;
[22]	415	/ aggregation for IPv6 flows /
[16]	416
	417	/ end aggregation /
[2]	418	break;
	419	default:
	420	syslog(LOG_INFO, "Field size not known: %d\n", field_size);
	421	for (i=0; i<field_size; i++){
[23]	422	(*myPtrs->offsetV9Ptr)++;
[2]	423	}
	424	break;
	425	}
	426	break;
	427	default:
	428	syslog(LOG_INFO, "Operator not known: %d\n",
[23]	429	(int)(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->operator));
[2]	430	break;
	431	}
	432	j++;
	433	pos = (pftmp->fieldType)*10+j;
[23]	434	} / end while myPtrs->rulesAddressPtr /
[2]	435	} else {
	436	/*
[22]	437	* no rule within this field type, but we must read the value
[2]	438	*/
	439	switch (field_size) {
	440	case 1:
[23]	441	buffer1 = (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
[22]	442	#ifdef IPV4AGG
	443	if ((pftmp->fieldType==9)\|\|(pftmp->fieldType==29)){
	444	agCache.maskS = ((unsigned* char*)&buffer1);
	445	}
	446	if ((pftmp->fieldType==13)\|\|(pftmp->fieldType==30)){
	447	agCache.maskD = ((unsigned* char*)&buffer1);
	448	}
	449	if (pftmp->fieldType==60){
	450	agCache.ipProt = ((unsigned* char*)&buffer1);
	451	}
	452	if (pftmp->fieldType==4){
	453	agCache.tProt = ((unsigned* char*)&buffer1);
	454	}
	455	if (pftmp->fieldType==61){
	456	agCache.sens = ((unsigned* char*)&buffer1);
	457	}
	458	if (pftmp->fieldType==5){
	459	agCache.dscp = ((unsigned* char*)&buffer1);
	460	}
	461	#endif
[20]	462	#ifdef CRIHAN
[17]	463	if ((pftmp->fieldType==9)\|\|(pftmp->fieldType==29)){
[18]	464	ipFirstCache.maskS = ((unsigned* char*)&buffer1);
[17]	465	}
	466	if ((pftmp->fieldType==13)\|\|(pftmp->fieldType==30)){
[18]	467	ipFirstCache.maskD = ((unsigned* char*)&buffer1);
[17]	468	}
[18]	469	if (pftmp->fieldType==60){
	470	ipFirstCache.ipProt = ((unsigned* char*)&buffer1);
	471	mplsFirstCache.ipProt = ((unsigned* char*)&buffer1);
[17]	472	}
[18]	473	if (pftmp->fieldType==4){
	474	ipFirstCache.tProt = ((unsigned* char*)&buffer1);
[17]	475	}
[22]	476	#endif
[2]	477	break;
	478	case 2:
[23]	479	buffer2[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	480	buffer2[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
[22]	481	#ifdef IPV4AGG
[17]	482	if (pftmp->fieldType==10){
	483	agCache.idSnmp = ((unsigned* short*)&buffer2);
	484	}
[22]	485	#endif
[20]	486	#ifdef CRIHAN
[18]	487	if (pftmp->fieldType==10){
	488	ipFirstCache.inSnmp = ((unsigned* short*)&buffer2);
	489	}
	490	if (pftmp->fieldType==14){
	491	ipFirstCache.outSnmp = ((unsigned* short*)&buffer2);
	492	}
	493	if (pftmp->fieldType==7){
	494	ipFirstCache.sPort = ((unsigned* short*)&buffer2);
	495	}
	496	if (pftmp->fieldType==11){
	497	ipFirstCache.dPort = ((unsigned* short*)&buffer2);
	498	}
[22]	499	#endif
[2]	500	break;
[17]	501	case 3:
	502	buffer4[3]= 0;
[23]	503	buffer4[2]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	504	buffer4[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	505	buffer4[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
[17]	506	/ aggregation /
	507	/ end aggregation /
[20]	508	#ifdef CRIHAN
[18]	509	if (pftmp->fieldType==70){
	510	mplsFirstCache.mplsLabel1 = (((unsigned* long*)&buffer4))>>4;
	511	}
[22]	512	#endif
[17]	513	break;
[2]	514	case 4:
[23]	515	buffer4[3]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	516	buffer4[2]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	517	buffer4[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	518	buffer4[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
[22]	519	#ifdef IPV4AGG
	520	if ((pftmp->fieldType==8)){
	521	bool = 1;
	522	agCache.v4AdS = ((unsigned* long*)&buffer4);
	523	} else if ((pftmp->fieldType==12)){
	524	agCache.v4AdD = ((unsigned* long*)&buffer4);
	525	} else if (pftmp->fieldType==1){
	526	agCache.bytes = ((unsigned* long*)&buffer4);
	527	} else if (pftmp->fieldType==2){
	528	agCache.pkts = ((unsigned* long*)&buffer4);
	529	}
	530	#endif
[20]	531	#ifdef CRIHAN
[18]	532	if (pftmp->fieldType==8){
	533	ipFirstCache.v4AdS = ((unsigned* long*)&buffer4);
[19]	534	mplsFirstCache.v4AdS = ((unsigned* long*)&buffer4);
[17]	535	}
[18]	536	if (pftmp->fieldType==12){
	537	ipFirstCache.v4AdD = ((unsigned* long*)&buffer4);
[19]	538	mplsFirstCache.v4AdD = ((unsigned* long*)&buffer4);
[18]	539	}
	540	if (pftmp->fieldType==1){
	541	ipFirstCache.bytes = ((unsigned* long*)&buffer4);
	542	}
	543	if (pftmp->fieldType==2){
	544	ipFirstCache.pkts = ((unsigned* long*)&buffer4);
	545	}
	546	if (pftmp->fieldType==22){
	547	firstTime = ((unsigned* long*)&buffer4);
	548	}
	549	if (pftmp->fieldType==21){
	550	lastTime = ((unsigned* long*)&buffer4);
	551	}
[22]	552	#endif
[2]	553	break;
	554	case 16:
	555	for (i=0; i<4; i++) {
[23]	556	buffer2[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	557	buffer2[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	558	buffer2[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	559	buffer2[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
[2]	560	}
[22]	561	/ aggregation IPv6 /
[16]	562	/ end aggregation /
[2]	563	break;
	564	default:
	565	syslog(LOG_INFO,"UNKNOWN FIELDS LENGTH: %d ", field_size);
	566	for (i=0; i<field_size; i++){
[23]	567	(*myPtrs->offsetV9Ptr)++;
[2]	568	}
	569	}
	570	} / end if one cache table line existence /
	571	if (cpt==tmp->fieldCount) {
	572	/*
	573	* end of one flow (not the flowset)
	574	*/
[20]	575	#ifdef CRIHAN
[18]	576	if ( mplsFirstCache.mplsLabel1 == 0 ) {
[23]	577	(myPtrs->tabIPPtr+(*myPtrs->ipNbPtr))->ipProt = ipFirstCache.ipProt;
[18]	578	ipFirstCache.ipProt = 0;
[23]	579	(myPtrs->tabIPPtr+(*myPtrs->ipNbPtr))->bytes = ipFirstCache.bytes;
[18]	580	ipFirstCache.bytes = 0;
[23]	581	(myPtrs->tabIPPtr+(*myPtrs->ipNbPtr))->pkts = ipFirstCache.pkts;
[18]	582	ipFirstCache.pkts = 0;
[23]	583	(myPtrs->tabIPPtr+(*myPtrs->ipNbPtr))->inSnmp = ipFirstCache.inSnmp;
[18]	584	ipFirstCache.inSnmp = 0;
[23]	585	(myPtrs->tabIPPtr+(*myPtrs->ipNbPtr))->outSnmp = ipFirstCache.outSnmp;
[18]	586	ipFirstCache.outSnmp = 0;
[23]	587	(myPtrs->tabIPPtr+(*myPtrs->ipNbPtr))->v4AdS = ipFirstCache.v4AdS;
[18]	588	ipFirstCache.outSnmp = 0;
[23]	589	(myPtrs->tabIPPtr+(*myPtrs->ipNbPtr))->v4AdD = ipFirstCache.v4AdD;
[18]	590	ipFirstCache.v4AdD = 0;
[23]	591	(myPtrs->tabIPPtr+(*myPtrs->ipNbPtr))->tProt = ipFirstCache.tProt;
[18]	592	ipFirstCache.tProt = 0;
[23]	593	(myPtrs->tabIPPtr+(*myPtrs->ipNbPtr))->sPort = ipFirstCache.sPort;
[18]	594	ipFirstCache.sPort = 0;
[23]	595	(myPtrs->tabIPPtr+(*myPtrs->ipNbPtr))->dPort = ipFirstCache.dPort;
[18]	596	ipFirstCache.dPort = 0;
[23]	597	(myPtrs->tabIPPtr+(*myPtrs->ipNbPtr))->maskD = ipFirstCache.maskD;
[18]	598	ipFirstCache.maskD = 0;
[23]	599	(myPtrs->tabIPPtr+(*myPtrs->ipNbPtr))->maskS = ipFirstCache.maskS;
[18]	600	ipFirstCache.maskS = 0;
[23]	601	(myPtrs->tabIPPtr+(*myPtrs->ipNbPtr))->routerAd = ipFirstCache.routerAd;
	602	(myPtrs->tabIPPtr+(*myPtrs->ipNbPtr))->liveTime = lastTime - firstTime;
[18]	603	firstTime = 0; lastTime = 0;
[23]	604	(*myPtrs->ipNbPtr)++;
[18]	605	} else {
[23]	606	(myPtrs->tabMPLSPtr+(*myPtrs->mplsNbPtr))->ipProt = mplsFirstCache.ipProt;
[18]	607	mplsFirstCache.ipProt = 0;
[23]	608	(myPtrs->tabMPLSPtr+(*myPtrs->mplsNbPtr))->v4AdS = mplsFirstCache.v4AdS;
[18]	609	mplsFirstCache.v4AdS = 0;
[23]	610	(myPtrs->tabMPLSPtr+(*myPtrs->mplsNbPtr))->v4AdD = mplsFirstCache.v4AdD;
[18]	611	mplsFirstCache.v4AdD = 0;
[23]	612	(myPtrs->tabMPLSPtr+(*myPtrs->mplsNbPtr))->routerAd = mplsFirstCache.routerAd;
	613	(myPtrs->tabMPLSPtr+(*myPtrs->mplsNbPtr))->mplsLabel1 = mplsFirstCache.mplsLabel1;
[18]	614	mplsFirstCache.mplsLabel1 = 0;
[23]	615	(*myPtrs->mplsNbPtr)++;
[18]	616	}
[22]	617	#endif
	618	/ put aggregation cache information to IPv4 Prefixes table /
[23]	619	/ Aggregation mode must be enable in ./configure options /
	620	/ first we must know if the address belong to our prefix /
[22]	621	#ifdef IPV4AGG
	622	if (bool == 1){
	623	prefixKey.beginning = agCache.v4AdS>>(32-agCache.maskS)<<(32-agCache.maskS);
	624	res = bsearch(&prefixKey, V4PTab, nbPV4,
	625	sizeof(struct PrefixV4), prefCmp);
[25]	626	if (res!=NULL){
	627	/ OUT ("traffic from the prefix/subnet") /
[23]	628	res->bytesNbOUT += agCache.bytes;
	629	res->pktsNbOUT += agCache.pkts;
	630	(res->flowNbOUT)++;
	631	switch (agCache.tProt) {
[22]	632	case 1:
[23]	633	res->icmpBytesNbOUT += agCache.bytes;
	634	res->icmpPktsNbOUT += agCache.pkts;
	635	(res->icmpFlowNbOUT)++;
[22]	636	break;
	637	case 6:
[23]	638	res->tcpBytesNbOUT += agCache.bytes;
	639	res->tcpPktsNbOUT += agCache.pkts;
	640	(res->tcpFlowNbOUT)++;
[22]	641	break;
	642	case 17:
[23]	643	res->udpBytesNbOUT += agCache.bytes;
	644	res->udpPktsNbOUT += agCache.pkts;
	645	(res->udpFlowNbOUT)++;
[22]	646	break;
	647	default:
[23]	648	res->othersBytesNbOUT += agCache.bytes;
	649	res->othersPktsNbOUT += agCache.pkts;
	650	(res->othersFlowNbOUT)++;
[22]	651	}
[23]	652	} else {
	653	prefixKey.beginning = agCache.v4AdD>>(32-agCache.maskD)<<(32-agCache.maskD);
	654	res = bsearch(&prefixKey, V4PTab, nbPV4,
	655	sizeof(struct PrefixV4), prefCmp);
	656	if (res!=NULL){ / IN ("traffic to the prefix") /
	657	res->bytesNbIN += agCache.bytes;
	658	res->pktsNbIN += agCache.pkts;
	659	(res->flowNbIN)++;
	660	switch (agCache.tProt) {
	661	case 1:
	662	res->icmpBytesNbIN += agCache.bytes;
	663	res->icmpPktsNbIN += agCache.pkts;
	664	(res->icmpFlowNbIN)++;
	665	break;
	666	case 6:
	667	res->tcpBytesNbIN += agCache.bytes;
	668	res->tcpPktsNbIN += agCache.pkts;
	669	(res->tcpFlowNbIN)++;
	670	break;
	671	case 17:
	672	res->udpBytesNbIN += agCache.bytes;
	673	res->udpPktsNbIN += agCache.pkts;
	674	(res->udpFlowNbIN)++;
	675	break;
	676	default:
	677	res->othersBytesNbIN += agCache.bytes;
	678	res->othersPktsNbIN += agCache.pkts;
	679	(res->othersFlowNbIN)++;
	680	}
	681	} else {
	682	/ HERE : we are in the cases of the address/mask don't /
	683	/ belong to a prefix listed in the IPv4 prefix file /
	684	/ possibilities : /
	685	/ - prefix not referenced but allowed to be routed /
	686	/ - prefix not referenced but not allowed to be routed /
	687	/ - spoofing /
	688	/ fprintf(stderr, "%lu.%lu.%lu.%lu/%hu -> %lu.%lu.%lu.%lu/%hu R:%lu.%lu.%lu.%lu \n", /
	689	/ (agCache.v4AdS>>24), /
	690	/ (agCache.v4AdS<<8>>24), /
	691	/ (agCache.v4AdS<<16>>24), /
	692	/ (agCache.v4AdS<<24>>24), /
	693	/ (agCache.maskS), /
	694	/ (agCache.v4AdD>>24), /
	695	/ (agCache.v4AdD<<8>>24), /
	696	/ (agCache.v4AdD<<16>>24), /
	697	/ (agCache.v4AdD<<24>>24), /
	698	/ (agCache.maskD), /
	699	/ (myPtrs->pcktPtr->ipH->srcAdd>>24), /
	700	/ (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), /
	701	/ (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), /
	702	/ (myPtrs->pcktPtr->ipH->srcAdd<<24>>24) /
	703	/ ); /
	704	}
	705	}
[22]	706	}
	707	bool = 0;
	708	#endif
[2]	709	/*
	710	* Redirection if needed
	711	* switch the rules definition (check & fieldToRecord),
[18]	712	* we send the flow or a part of the flow to a remote host or a file
[2]	713	*/
[23]	714	tmpRuleList = myPtrs->rulesListPtr;
[2]	715	while (tmpRuleList){
	716	unsigned short check = 1;
	717	RuleDefPtr tmpRuleDefList = tmpRuleList->def;
	718	secondOffset = secondOldOffset;
	719	while (tmpRuleDefList){
	720	check = check && tmpRuleDefList->check;
	721	tmpRuleDefList->check = 0;
	722	tmpRuleDefList = tmpRuleDefList->next;
	723	}
	724	if ( (tmpRuleList->def != NULL) && (check == 1)) {
	725	/ msg building /
	726	secondPftmp = tmp->lastField;
[23]	727	/ memcpy(myMsg.text, (char)(myPtrs->ptr_buffer+secondOffset),flow_size); /*
[2]	728	msgTextIndex = mempcpy(mempcpy(mempcpy(myMsg.text,
	729	&tplMsgType,
	730	sizeof(unsigned short)
	731	),
	732	&tmpRuleList->id,
	733	sizeof(tmpRuleList->id)
	734	),
[23]	735	&myPtrs->currentRouterPtr->IpAddress,
[2]	736	sizeof(unsigned long)
	737	);
	738	msgTextIndex = mempcpy(mempcpy(mempcpy(msgTextIndex,
	739	&tmp->sourceId,
	740	sizeof(unsigned long)
	741	),
	742	&tmp->templateFlowSetId,
	743	sizeof(tmp->templateFlowSetId)
	744	),
[23]	745	myPtrs->ptr_buffer+secondOffset,
[2]	746	flow_size
	747	);
	748	myMsg.type = 1;
	749	msgSend( myQueue, myMsg);
	750	noEnd = 1;
	751	secondCpt=0;
	752	} / end if check /
	753	tmpRuleList = tmpRuleList->next;
	754	secondPftmp = tmp->lastField;
	755	} / end while tmpRuleList /
	756	/*
	757	* end redirection
	758	*/
[23]	759	secondOffset = *myPtrs->offsetV9Ptr;
[2]	760	secondOldOffset = secondOffset;
	761	pftmp = tmp->lastField;
	762	cpt=0;
[23]	763	(myPtrs->currentFlowsetNumberPtr)++; /* pointer on the flows number /
	764	if (((*myPtrs->offsetV9Ptr)-48-shift+flow_size) > data_length){
[2]	765	overflow = 1; / buffer index not correct /
	766	}
	767	} else {
	768	/ not the flow end, progress in field list /
	769	pftmp = pftmp->prev;
	770	}
	771	} / end of the while on one flow record /
	772	}else{
	773	/*
	774	* template unknown, we skip this all the data
	775	*/
[23]	776	(*myPtrs->offsetV9Ptr)+=(data_length-4);
	777	(*myPtrs->currentFlowsetNumberPtr) = myPtrs->currentHeaderV9Ptr->count;
[2]	778	}
[23]	779	while ( ((*myPtrs->offsetV9Ptr)-48-shift) < data_length ) {
	780	(myPtrs->offsetV9Ptr)++; /* if padding /
[2]	781	}
[23]	782	while ( (*myPtrs->offsetV9Ptr)-48-shift > data_length ) {
	783	(myPtrs->offsetV9Ptr)--; /* crazy loop (when bug appears in template def) /
[2]	784	}
	785	return (data_length+shift);
	786	}

Note: See TracBrowser for help on using the browser.

Context Navigation

root/trunk/src/dataFlowSet.c @ 25

Download in other formats: