Changeset 27 for trunk/src/dataFlowSet.c
- Timestamp:
- 04/05/07 18:10:36 (16 years ago)
- Files:
-
- 1 modified
Legend:
- Unmodified
- Added
- Removed
-
trunk/src/dataFlowSet.c
r25 r27 30 30 * 31 31 */ 32 unsignedshort33 checkDataFlowSet( unsignedshort shift,32 short 33 checkDataFlowSet(short shift, 34 34 struct MyPtrs *myPtrs, 35 35 int myQueue, … … 66 66 int bool = 0; /* in IPV4 Agg mode enabled, we need to now if it's an IPv4 */ 67 67 /* flow, we test on the field and then put bool at 1 */ 68 int isMplsFlow = 0; 69 int paddingCounter = 0; 70 int crazyCounter = 0; 71 68 72 #ifdef CRIHAN 69 73 struct IPFLowCache ipFirstCache; … … 115 119 return (data_length+shift); 116 120 } 121 if ( data_length >= 1452 ) { 122 syslog(LOG_INFO, "data flowset length too raised; all next informations of this data flowset are not considered! flowset ID: %hu, from router: %lu.%lu.%lu.%lu", 123 (*myPtrs->currentFlowsetIdPtr), 124 (myPtrs->pcktPtr->ipH->srcAdd>>24), 125 (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), 126 (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), 127 (myPtrs->pcktPtr->ipH->srcAdd<<24>>24)); 128 return (-1); 129 } 117 130 #ifdef IPV4AGG 118 131 agCache.routerAd = myPtrs->pcktPtr->ipH->srcAdd; … … 136 149 */ 137 150 cpt++; 138 j =0;151 j = 0; 139 152 pos = (pftmp->fieldType)*10+j; 140 153 field_size = (int) pftmp->fieldLength; 154 155 /* special case: check yes on all flows from one router (phantom field nb 0) */ 156 while ( ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+j))) != NULL ) { 157 if ( (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+j)))->value->stor.lvalue) 158 == myPtrs->pcktPtr->ipH->srcAdd ) 159 { 160 ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+j)))->check = 1; 161 } 162 j++; 163 } 164 j = 0; 165 141 166 /* 142 167 * Comparaison between the field value and the rules 143 168 * ... if one rule exist 169 * FIXME : warning, if no rules, no accounting ? 144 170 */ 145 171 if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos))) != NULL) { … … 153 179 (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->operator)){ 154 180 case 2: 181 /* operator: "=" */ 155 182 switch (field_size) { 156 183 case 1: … … 234 261 /* aggregation */ 235 262 /* end aggregation */ 263 if (pftmp->fieldType==70){ 264 isMplsFlow = 1; 265 } 236 266 #ifdef CRIHAN 237 267 if (pftmp->fieldType==70){ … … 255 285 #ifdef IPV4AGG 256 286 if ((pftmp->fieldType==8)){ 287 bool = 1; /* very important, test if we have an IPv4 flow for Agg */ 257 288 agCache.v4AdS = *((unsigned long*)&buffer4); 258 289 } … … 506 537 /* aggregation */ 507 538 /* end aggregation */ 539 if (pftmp->fieldType==70){ 540 isMplsFlow = 1; 541 } 508 542 #ifdef CRIHAN 509 543 if (pftmp->fieldType==70){ … … 620 654 /* first we must know if the address belong to our prefix */ 621 655 #ifdef IPV4AGG 622 if ( bool == 1){656 if ( (bool == 1) && (isMplsFlow == 0) ){ 623 657 prefixKey.beginning = agCache.v4AdS>>(32-agCache.maskS)<<(32-agCache.maskS); 624 658 res = bsearch(&prefixKey, V4PTab, nbPV4, 625 sizeof(struct PrefixV4), prefCmp); 626 if (res!=NULL){ 627 /* OUT ("traffic from the prefix/subnet") */ 628 res->bytesNbOUT += agCache.bytes; 629 res->pktsNbOUT += agCache.pkts; 630 (res->flowNbOUT)++; 631 switch (agCache.tProt) { 632 case 1: 633 res->icmpBytesNbOUT += agCache.bytes; 634 res->icmpPktsNbOUT += agCache.pkts; 635 (res->icmpFlowNbOUT)++; 636 break; 637 case 6: 638 res->tcpBytesNbOUT += agCache.bytes; 639 res->tcpPktsNbOUT += agCache.pkts; 640 (res->tcpFlowNbOUT)++; 641 break; 642 case 17: 643 res->udpBytesNbOUT += agCache.bytes; 644 res->udpPktsNbOUT += agCache.pkts; 645 (res->udpFlowNbOUT)++; 646 break; 647 default: 648 res->othersBytesNbOUT += agCache.bytes; 649 res->othersPktsNbOUT += agCache.pkts; 650 (res->othersFlowNbOUT)++; 659 sizeof(struct PrefixV4), prefGlobalCmp); 660 if (res!=NULL){ 661 if ( myPtrs->routersID[res->routerNb] == agCache.routerAd ) { 662 /* OUT ("traffic from the prefix/subnet") */ 663 res->bytesNbOUT += agCache.bytes; 664 res->pktsNbOUT += agCache.pkts; 665 (res->flowNbOUT)++; 666 } else { 667 /* doublon or bad reference in prefix list */ 651 668 } 652 669 } else { 653 670 prefixKey.beginning = agCache.v4AdD>>(32-agCache.maskD)<<(32-agCache.maskD); 654 671 res = bsearch(&prefixKey, V4PTab, nbPV4, 655 sizeof(struct PrefixV4), prefCmp); 656 if (res!=NULL){ /* IN ("traffic to the prefix") */ 657 res->bytesNbIN += agCache.bytes; 658 res->pktsNbIN += agCache.pkts; 659 (res->flowNbIN)++; 660 switch (agCache.tProt) { 661 case 1: 662 res->icmpBytesNbIN += agCache.bytes; 663 res->icmpPktsNbIN += agCache.pkts; 664 (res->icmpFlowNbIN)++; 665 break; 666 case 6: 667 res->tcpBytesNbIN += agCache.bytes; 668 res->tcpPktsNbIN += agCache.pkts; 669 (res->tcpFlowNbIN)++; 670 break; 671 case 17: 672 res->udpBytesNbIN += agCache.bytes; 673 res->udpPktsNbIN += agCache.pkts; 674 (res->udpFlowNbIN)++; 675 break; 676 default: 677 res->othersBytesNbIN += agCache.bytes; 678 res->othersPktsNbIN += agCache.pkts; 679 (res->othersFlowNbIN)++; 672 sizeof(struct PrefixV4), prefGlobalCmp); 673 if (res!=NULL){ 674 if ( myPtrs->routersID[res->routerNb] == agCache.routerAd ) { 675 /* IN ("traffic to the prefix") */ 676 res->bytesNbIN += agCache.bytes; 677 res->pktsNbIN += agCache.pkts; 678 (res->flowNbIN)++; 679 } else { 680 /* doublon or bad reference in prefix list */ 681 682 /* fprintf(stderr, "IN NC: %lu.%lu.%lu.%lu/%hu -> %lu.%lu.%lu.%lu/%hu R:%lu.%lu.%lu.%lu \n", */ 683 /* (agCache.v4AdS>>24), */ 684 /* (agCache.v4AdS<<8>>24), */ 685 /* (agCache.v4AdS<<16>>24), */ 686 /* (agCache.v4AdS<<24>>24), */ 687 /* (agCache.maskS), */ 688 /* (agCache.v4AdD>>24), */ 689 /* (agCache.v4AdD<<8>>24), */ 690 /* (agCache.v4AdD<<16>>24), */ 691 /* (agCache.v4AdD<<24>>24), */ 692 /* (agCache.maskD), */ 693 /* (myPtrs->pcktPtr->ipH->srcAdd>>24), */ 694 /* (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), */ 695 /* (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), */ 696 /* (myPtrs->pcktPtr->ipH->srcAdd<<24>>24) */ 697 /* ); */ 680 698 } 681 699 } else { … … 706 724 } 707 725 bool = 0; 726 isMplsFlow = 0; 708 727 #endif 709 728 /* 710 729 * Redirection if needed 711 730 * switch the rules definition (check & fieldToRecord), 712 * we send the flow or a part of the flow to a remote host or a file 731 * we send the flow or a part of the flow to a remote host or a file. 732 * In a first time (until release 0.0.7, the information was sent via 733 * the process renetcolSender with an IPC message queue. But, the perf 734 * of IPC Msg was very bad with a system compilation by default. 735 * So now, we send information directly from here. 713 736 */ 714 737 tmpRuleList = myPtrs->rulesListPtr; 715 738 while (tmpRuleList){ 739 RulesPtr tmpRuleList_for_to = myPtrs->rulesListPtr; 740 RuleDefPtr tmpRuleDefList = tmpRuleList->def; 716 741 unsigned short check = 1; 717 RuleDefPtr tmpRuleDefList = tmpRuleList->def;742 int s=0; 718 743 secondOffset = secondOldOffset; 719 744 while (tmpRuleDefList){ … … 725 750 /* msg building */ 726 751 secondPftmp = tmp->lastField; 727 /* memcpy(myMsg.text, (char*)(myPtrs->ptr_buffer+secondOffset),flow_size); */728 752 msgTextIndex = mempcpy(mempcpy(mempcpy(myMsg.text, 729 753 &tplMsgType, … … 747 771 ); 748 772 myMsg.type = 1; 773 /* OLD transfert type */ 749 774 msgSend( myQueue, myMsg); 775 /* NEW transfert type */ 776 /* for ( ; tmpRuleList_for_to; tmpRuleList_for_to=tmpRuleList_for_to->next){ */ 777 /* fprintf(stderr, "?\n"); */ 778 /* if (tmpRuleList_for_to->id == tmpRuleList->id){ */ 779 /* fprintf(stderr, "y\n"); */ 780 /* s = sendMessage(tmpRuleList_for_to->host->sockId, &(myMsg.text), sizeof(myMsg.text), */ 781 /* tmpRuleList_for_to->host->hostAddressPtr); */ 782 /* fprintf(stderr, "o\n"); */ 783 /* } */ 784 /* } */ 785 /* FIXME : perhaps check "s" */ 750 786 noEnd = 1; 751 787 secondCpt=0; … … 776 812 (*myPtrs->offsetV9Ptr)+=(data_length-4); 777 813 (*myPtrs->currentFlowsetNumberPtr) = myPtrs->currentHeaderV9Ptr->count; 814 fprintf(stderr, "\n unknown template \n"); 778 815 } 779 816 while ( ((*myPtrs->offsetV9Ptr)-48-shift) < data_length ) { 780 817 (*myPtrs->offsetV9Ptr)++; /* if padding */ 818 paddingCounter++; 819 fprintf(stderr, "\n padding \n"); 820 if ( paddingCounter > 8 ) { 821 syslog(LOG_INFO,"padding too high: %d ", paddingCounter); 822 return (-1); 823 } 781 824 } 782 825 while ( (*myPtrs->offsetV9Ptr)-48-shift > data_length ) { 783 826 (*myPtrs->offsetV9Ptr)--; /* crazy loop (when bug appears in template def) */ 827 crazyCounter++; 784 828 } 829 if (crazyCounter!=0) { syslog(LOG_INFO,"crazyCounter: %d ", crazyCounter);} 785 830 return (data_length+shift); 786 831 }