108 | | fprintf(stderr, |
109 | | "{d id: %hu, lg %hu", |
110 | | (*myPtrs->currentFlowsetIdPtr), |
111 | | data_length); |
112 | | if ( (*myPtrs->currentFlowsetIdPtr) > TRESHOLD_TEMPLATE_ID ) { |
113 | | /* fprintf(stderr,"Bad TID from router: %lu.%lu.%lu.%lu\n", */ |
114 | | /* (*myPtrs->currentFlowsetIdPtr), */ |
115 | | /* (myPtrs->pcktPtr->ipH->srcAdd>>24), */ |
116 | | /* (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), */ |
117 | | /* (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), */ |
118 | | /* (myPtrs->pcktPtr->ipH->srcAdd<<24>>24)); */ |
119 | | /* fprintf(stderr," Bytes : \n"); */ |
120 | | /* while ( ( myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr) ) > (myPtrs->ptr_buffer+1416) ){ */ |
121 | | /* buffer1= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));(*myPtrs->offsetV9Ptr)++; */ |
122 | | /* tmp = *((unsigned char*)&buffer1); */ |
123 | | /* fprintf (stderr, " %s ", tmp); */ |
124 | | /* } */ |
125 | | /* exit(-1); */ |
126 | | return (data_length+shift); |
127 | | } |
128 | | #endif |
129 | | pftmp = tmp->lastField; |
130 | | for (; pftmp; pftmp = pftmp->prev) { |
131 | | flow_size += pftmp->fieldLength; |
132 | | } |
133 | | if ( data_length%flow_size >= 9 ) { |
134 | | (*myPtrs->currentFlowsetNumberPtr) = myPtrs->currentHeaderV9Ptr->count; |
135 | | syslog(LOG_INFO, "data flowset length not match with length from template definition, wrong template definition suspected; all next informations of this data flowset are not considered! flowset ID: %hu, from router: %lu.%lu.%lu.%lu", |
136 | | (*myPtrs->currentFlowsetIdPtr), |
137 | | (myPtrs->pcktPtr->ipH->srcAdd>>24), |
138 | | (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), |
139 | | (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), |
140 | | (myPtrs->pcktPtr->ipH->srcAdd<<24>>24)); |
141 | | return (data_length+shift); |
142 | | } |
143 | | if ( data_length >= 1452 ) { |
144 | | syslog(LOG_INFO, "data flowset length too raised; all next informations of this data flowset are not considered! flowset ID: %hu, from router: %lu.%lu.%lu.%lu", |
145 | | (*myPtrs->currentFlowsetIdPtr), |
146 | | (myPtrs->pcktPtr->ipH->srcAdd>>24), |
147 | | (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), |
148 | | (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), |
149 | | (myPtrs->pcktPtr->ipH->srcAdd<<24>>24)); |
150 | | return (-1); |
151 | | } |
| 108 | fprintf(stderr, |
| 109 | "{d id: %hu, lg %hu", |
| 110 | (*myPtrs->currentFlowsetIdPtr), |
| 111 | data_length); |
| 112 | if ( (*myPtrs->currentFlowsetIdPtr) > TRESHOLD_TEMPLATE_ID ) { |
| 113 | /* fprintf(stderr,"Bad TID from router: %lu.%lu.%lu.%lu\n", */ |
| 114 | /* (*myPtrs->currentFlowsetIdPtr), */ |
| 115 | /* (myPtrs->pcktPtr->ipH->srcAdd>>24), */ |
| 116 | /* (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), */ |
| 117 | /* (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), */ |
| 118 | /* (myPtrs->pcktPtr->ipH->srcAdd<<24>>24)); */ |
| 119 | /* fprintf(stderr," Bytes : \n"); */ |
| 120 | /* while ( ( myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr) ) > (myPtrs->ptr_buffer+1416) ){ */ |
| 121 | /* buffer1= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));(*myPtrs->offsetV9Ptr)++; */ |
| 122 | /* tmp = *((unsigned char*)&buffer1); */ |
| 123 | /* fprintf (stderr, " %s ", tmp); */ |
| 124 | /* } */ |
| 125 | /* exit(-1); */ |
| 126 | return (data_length+shift); |
| 127 | } |
| 128 | #endif |
| 129 | pftmp = tmp->lastField; |
| 130 | for (; pftmp; pftmp = pftmp->prev) { |
| 131 | flow_size += pftmp->fieldLength; |
| 132 | } |
| 133 | if ( data_length%flow_size >= 9 ) { |
| 134 | (*myPtrs->currentFlowsetNumberPtr) = myPtrs->currentHeaderV9Ptr->count; |
| 135 | syslog(LOG_INFO, "data flowset length not match with length from template definition, wrong template definition suspected; all next informations of this data flowset are not considered! flowset ID: %hu, from router: %lu.%lu.%lu.%lu", |
| 136 | (*myPtrs->currentFlowsetIdPtr), |
| 137 | (myPtrs->pcktPtr->ipH->srcAdd>>24), |
| 138 | (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), |
| 139 | (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), |
| 140 | (myPtrs->pcktPtr->ipH->srcAdd<<24>>24)); |
| 141 | return (data_length+shift); |
| 142 | } |
| 143 | if ( data_length >= 1452 ) { |
| 144 | syslog(LOG_INFO, "data flowset length too raised; all next informations of this data flowset are not considered! flowset ID: %hu, from router: %lu.%lu.%lu.%lu", |
| 145 | (*myPtrs->currentFlowsetIdPtr), |
| 146 | (myPtrs->pcktPtr->ipH->srcAdd>>24), |
| 147 | (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), |
| 148 | (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), |
| 149 | (myPtrs->pcktPtr->ipH->srcAdd<<24>>24)); |
| 150 | return (-1); |
| 151 | } |
251 | | if (pftmp->fieldType==16){ |
252 | | agCache.asS = *((unsigned short*)&buffer2); |
253 | | } |
254 | | if (pftmp->fieldType==17){ |
255 | | agCache.asD = *((unsigned short*)&buffer2); |
256 | | } |
257 | | #endif |
258 | | break; |
259 | | case 3: |
260 | | buffer4[3]= 0; |
261 | | buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
262 | | (*myPtrs->offsetV9Ptr)++; |
263 | | buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
264 | | (*myPtrs->offsetV9Ptr)++; |
265 | | buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
266 | | (*myPtrs->offsetV9Ptr)++; |
267 | | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue |
268 | | == *((unsigned long*)&buffer4)) |
269 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
270 | | /* aggregation */ |
271 | | /* end aggregation */ |
272 | | if (pftmp->fieldType==70){ |
273 | | isMplsFlow = 1; |
274 | | } |
275 | | break; |
276 | | case 4: |
277 | | buffer4[3]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
278 | | (*myPtrs->offsetV9Ptr)++; |
279 | | buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
280 | | (*myPtrs->offsetV9Ptr)++; |
281 | | buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
282 | | (*myPtrs->offsetV9Ptr)++; |
283 | | buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
284 | | (*myPtrs->offsetV9Ptr)++; |
285 | | /* FIXME : here , add a check on the field type */ |
286 | | if ((pftmp->fieldType==8)||(pftmp->fieldType==12) |
287 | | ||(pftmp->fieldType==15)||(pftmp->fieldType==18)){ |
288 | | if ((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue) |
289 | | == (*((unsigned long*)&buffer4))>>(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)<<(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask) ) |
290 | | { |
291 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
292 | | } |
293 | | } |
294 | | if (pftmp->fieldType==1){ |
295 | | agCache.bytes = *((unsigned long*)&buffer4); |
296 | | if ( |
297 | | ((unsigned long)((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue) + ( (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue)*10/100)) |
298 | | >= (*((unsigned long*)&buffer4))) |
299 | | && |
300 | | ( (unsigned long)((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue) - ( (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue)*10/100)) |
301 | | <= (*((unsigned long*)&buffer4)) ) |
302 | | ) |
303 | | { |
304 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
305 | | } |
306 | | } |
| 251 | if (pftmp->fieldType==16){ |
| 252 | agCache.asS = *((unsigned short*)&buffer2); |
| 253 | } |
| 254 | if (pftmp->fieldType==17){ |
| 255 | agCache.asD = *((unsigned short*)&buffer2); |
| 256 | } |
| 257 | #endif |
| 258 | break; |
| 259 | case 3: |
| 260 | buffer4[3]= 0; |
| 261 | buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 262 | (*myPtrs->offsetV9Ptr)++; |
| 263 | buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 264 | (*myPtrs->offsetV9Ptr)++; |
| 265 | buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 266 | (*myPtrs->offsetV9Ptr)++; |
| 267 | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue |
| 268 | == *((unsigned long*)&buffer4)) |
| 269 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
| 270 | /* aggregation */ |
| 271 | /* end aggregation */ |
| 272 | if (pftmp->fieldType==70){ |
| 273 | isMplsFlow = 1; |
| 274 | } |
| 275 | break; |
| 276 | case 4: |
| 277 | buffer4[3]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 278 | (*myPtrs->offsetV9Ptr)++; |
| 279 | buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 280 | (*myPtrs->offsetV9Ptr)++; |
| 281 | buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 282 | (*myPtrs->offsetV9Ptr)++; |
| 283 | buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 284 | (*myPtrs->offsetV9Ptr)++; |
| 285 | /* FIXME : here , add a check on the field type */ |
| 286 | if ((pftmp->fieldType==8)||(pftmp->fieldType==12) |
| 287 | ||(pftmp->fieldType==15)||(pftmp->fieldType==18)){ |
| 288 | if ((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue) |
| 289 | == (*((unsigned long*)&buffer4))>>(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)<<(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask) ) |
| 290 | { |
| 291 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
| 292 | } |
| 293 | } |
| 294 | if ((pftmp->fieldType==10)||(pftmp->fieldType==14)){ |
| 295 | if ((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue) |
| 296 | == (*((unsigned long*)&buffer4))) |
| 297 | { |
| 298 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
| 299 | } |
| 300 | } |
| 301 | if (pftmp->fieldType==1){ |
| 302 | agCache.bytes = *((unsigned long*)&buffer4); |
| 303 | if ( |
| 304 | ((unsigned long)((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue) + ( (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue)*10/100)) |
| 305 | >= (*((unsigned long*)&buffer4))) |
| 306 | && |
| 307 | ( (unsigned long)((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue) - ( (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue)*10/100)) |
| 308 | <= (*((unsigned long*)&buffer4)) ) |
| 309 | ) |
| 310 | { |
| 311 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
| 312 | } |
| 313 | } |
308 | | if ((pftmp->fieldType==8)){ |
309 | | bool = 1; /* very important, test if we have an IPv4 flow for Agg */ |
310 | | agCache.v4AdS = *((unsigned long*)&buffer4); |
311 | | } |
312 | | if ((pftmp->fieldType==12)){ |
313 | | agCache.v4AdD = *((unsigned long*)&buffer4); |
314 | | } |
315 | | if (pftmp->fieldType==1){ |
316 | | agCache.bytes = *((unsigned long*)&buffer4); |
317 | | } |
318 | | if (pftmp->fieldType==2){ |
319 | | agCache.pkts = *((unsigned long*)&buffer4); |
320 | | } |
321 | | #endif |
322 | | break; |
323 | | case 16: |
324 | | for (i=0; i<4; i++) { |
325 | | buffer4[3]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
326 | | (*myPtrs->offsetV9Ptr)++; |
327 | | buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
328 | | (*myPtrs->offsetV9Ptr)++; |
329 | | buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
330 | | (*myPtrs->offsetV9Ptr)++; |
331 | | buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
332 | | (*myPtrs->offsetV9Ptr)++; |
333 | | if (1==moreIsNecessary){ |
334 | | switch(i){ |
335 | | case 0: |
336 | | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 32){ |
337 | | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
338 | | == |
339 | | (*((unsigned long*)&buffer4))>>(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)<<(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask) |
340 | | ) |
341 | | { |
342 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
343 | | moreIsNecessary = 0; |
| 315 | if ((pftmp->fieldType==8)){ |
| 316 | bool = 1; /* very important, test if we have an IPv4 flow for Agg */ |
| 317 | agCache.v4AdS = *((unsigned long*)&buffer4); |
| 318 | } |
| 319 | if ((pftmp->fieldType==12)){ |
| 320 | agCache.v4AdD = *((unsigned long*)&buffer4); |
| 321 | } |
| 322 | if (pftmp->fieldType==1){ |
| 323 | agCache.bytes = *((unsigned long*)&buffer4); |
| 324 | } |
| 325 | if (pftmp->fieldType==2){ |
| 326 | agCache.pkts = *((unsigned long*)&buffer4); |
| 327 | } |
| 328 | #endif |
| 329 | break; |
| 330 | case 16: |
| 331 | for (i=0; i<4; i++) { |
| 332 | buffer4[3]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 333 | (*myPtrs->offsetV9Ptr)++; |
| 334 | buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 335 | (*myPtrs->offsetV9Ptr)++; |
| 336 | buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 337 | (*myPtrs->offsetV9Ptr)++; |
| 338 | buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 339 | (*myPtrs->offsetV9Ptr)++; |
| 340 | if (1==moreIsNecessary){ |
| 341 | switch(i){ |
| 342 | case 0: |
| 343 | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 32){ |
| 344 | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
| 345 | == |
| 346 | (*((unsigned long*)&buffer4))>>(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)<<(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask) |
| 347 | ) |
| 348 | { |
| 349 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
| 350 | moreIsNecessary = 0; |
| 351 | } else { |
| 352 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
| 353 | moreIsNecessary = 0; |
| 354 | } |
| 355 | } else { |
| 356 | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
| 357 | == |
| 358 | (*((unsigned long*)&buffer4)) |
| 359 | ) |
| 360 | { |
| 361 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
| 362 | } else { |
| 363 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
| 364 | moreIsNecessary = 0; |
| 365 | } |
| 366 | } |
| 367 | break; |
| 368 | case 1: |
| 369 | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 64){ |
| 370 | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
| 371 | == |
| 372 | (*((unsigned long*)&buffer4))>>(64-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)<<(64-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask) |
| 373 | ) |
| 374 | { |
| 375 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = |
| 376 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1; |
| 377 | moreIsNecessary = 0; |
| 378 | } else { |
| 379 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
| 380 | moreIsNecessary = 0; |
| 381 | } |
| 382 | } else { |
| 383 | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
| 384 | == |
| 385 | (*((unsigned long*)&buffer4)) |
| 386 | ) |
| 387 | { |
| 388 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = |
| 389 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1; |
| 390 | } else { |
| 391 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
| 392 | moreIsNecessary = 0; |
| 393 | } |
| 394 | } |
| 395 | break; |
| 396 | case 2: |
| 397 | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 96){ |
| 398 | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
| 399 | == |
| 400 | (*((unsigned long*)&buffer4))>>(96-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)<<(96-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask) |
| 401 | ) |
| 402 | { |
| 403 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = |
| 404 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1; |
| 405 | moreIsNecessary = 0; |
| 406 | } else { |
| 407 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
| 408 | moreIsNecessary = 0; |
| 409 | } |
| 410 | } else { |
| 411 | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
| 412 | == |
| 413 | (*((unsigned long*)&buffer4)) |
| 414 | ) |
| 415 | { |
| 416 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = |
| 417 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1; |
| 418 | } else { |
| 419 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
| 420 | moreIsNecessary = 0; |
| 421 | } |
| 422 | } |
| 423 | break; |
| 424 | case 3: |
| 425 | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 128){ |
| 426 | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
| 427 | == |
| 428 | (*((unsigned long*)&buffer4))>>(128-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)<<(128-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask) |
| 429 | ) |
| 430 | { |
| 431 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = |
| 432 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1; |
| 433 | } else { |
| 434 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
| 435 | moreIsNecessary = 0; |
| 436 | } |
| 437 | } else { |
| 438 | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
| 439 | == |
| 440 | (*((unsigned long*)&buffer4)) |
| 441 | ) |
| 442 | { |
| 443 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = |
| 444 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1; |
| 445 | } else { |
| 446 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
| 447 | moreIsNecessary = 0; |
| 448 | } |
| 449 | } |
| 450 | break; |
| 451 | default: |
| 452 | break; |
| 453 | } /* end of switch(i) */ |
| 454 | } /* end of if moreIsNecessary */ |
| 455 | } |
| 456 | moreIsNecessary = 1; |
| 457 | /* aggregation for IPv6 flows */ |
| 458 | |
| 459 | /* end aggregation */ |
| 460 | break; |
| 461 | default: |
| 462 | syslog(LOG_INFO, "Field size not known: %d\n", field_size); |
| 463 | for (i=0; i<field_size; i++){ |
| 464 | (*myPtrs->offsetV9Ptr)++; |
| 465 | } |
| 466 | break; |
| 467 | } |
| 468 | break; |
| 469 | default: |
| 470 | syslog(LOG_INFO, "Operator not known: %d\n", |
| 471 | (int)(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->operator)); |
| 472 | break; |
| 473 | } |
| 474 | j++; |
| 475 | pos = (pftmp->fieldType)*10+j; |
| 476 | } /* end while myPtrs->rulesAddressPtr */ |
345 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
346 | | moreIsNecessary = 0; |
| 478 | /* |
| 479 | * no rule within this field type, but we must read the value |
| 480 | */ |
| 481 | switch (field_size) { |
| 482 | case 1: |
| 483 | buffer1 = *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 484 | (*myPtrs->offsetV9Ptr)++; |
| 485 | #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP) |
| 486 | if ((pftmp->fieldType==9)||(pftmp->fieldType==29)){ |
| 487 | agCache.maskS = *((unsigned char*)&buffer1); |
| 488 | } |
| 489 | if ((pftmp->fieldType==13)||(pftmp->fieldType==30)){ |
| 490 | agCache.maskD = *((unsigned char*)&buffer1); |
| 491 | } |
| 492 | if (pftmp->fieldType==60){ |
| 493 | agCache.ipProt = *((unsigned char*)&buffer1); |
| 494 | } |
| 495 | if (pftmp->fieldType==4){ |
| 496 | agCache.tProt = *((unsigned char*)&buffer1); |
| 497 | } |
| 498 | if (pftmp->fieldType==61){ |
| 499 | agCache.sens = *((unsigned char*)&buffer1); |
| 500 | } |
| 501 | if (pftmp->fieldType==5){ |
| 502 | agCache.dscp = *((unsigned char*)&buffer1); |
| 503 | } |
| 504 | #endif |
| 505 | break; |
| 506 | case 2: |
| 507 | buffer2[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 508 | (*myPtrs->offsetV9Ptr)++; |
| 509 | buffer2[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 510 | (*myPtrs->offsetV9Ptr)++; |
| 511 | #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP) |
| 512 | if (pftmp->fieldType==10){ |
| 513 | agCache.inputSnmp = *((unsigned short*)&buffer2); |
| 514 | } |
| 515 | if (pftmp->fieldType==14){ |
| 516 | agCache.outputSnmp = *((unsigned short*)&buffer2); |
| 517 | } |
| 518 | #endif |
| 519 | #ifdef ASACC |
| 520 | if (pftmp->fieldType==16){ |
| 521 | agCache.asS = *((unsigned short*)&buffer2); |
| 522 | } |
| 523 | if (pftmp->fieldType==17){ |
| 524 | agCache.asD = *((unsigned short*)&buffer2); |
| 525 | } |
| 526 | #endif |
| 527 | break; |
| 528 | case 3: |
| 529 | buffer4[3]= 0; |
| 530 | buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 531 | (*myPtrs->offsetV9Ptr)++; |
| 532 | buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 533 | (*myPtrs->offsetV9Ptr)++; |
| 534 | buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 535 | (*myPtrs->offsetV9Ptr)++; |
| 536 | /* aggregation */ |
| 537 | /* end aggregation */ |
| 538 | if (pftmp->fieldType==70){ |
| 539 | isMplsFlow = 1; |
| 540 | } |
| 541 | break; |
| 542 | case 4: |
| 543 | buffer4[3]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 544 | (*myPtrs->offsetV9Ptr)++; |
| 545 | buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 546 | (*myPtrs->offsetV9Ptr)++; |
| 547 | buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 548 | (*myPtrs->offsetV9Ptr)++; |
| 549 | buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 550 | (*myPtrs->offsetV9Ptr)++; |
| 551 | #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP) |
| 552 | if ((pftmp->fieldType==8)){ |
| 553 | bool = 1; |
| 554 | agCache.v4AdS = *((unsigned long*)&buffer4); |
| 555 | } else if ((pftmp->fieldType==12)){ |
| 556 | agCache.v4AdD = *((unsigned long*)&buffer4); |
| 557 | } else if (pftmp->fieldType==1){ |
| 558 | agCache.bytes = *((unsigned long*)&buffer4); |
| 559 | } else if (pftmp->fieldType==2){ |
| 560 | agCache.pkts = *((unsigned long*)&buffer4); |
| 561 | } |
| 562 | #endif |
| 563 | break; |
| 564 | case 16: |
| 565 | for (i=0; i<4; i++) { |
| 566 | buffer2[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 567 | (*myPtrs->offsetV9Ptr)++; |
| 568 | buffer2[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 569 | (*myPtrs->offsetV9Ptr)++; |
| 570 | buffer2[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 571 | (*myPtrs->offsetV9Ptr)++; |
| 572 | buffer2[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 573 | (*myPtrs->offsetV9Ptr)++; |
| 574 | } |
| 575 | /* aggregation IPv6 */ |
| 576 | /* end aggregation */ |
| 577 | break; |
| 578 | default: |
| 579 | syslog(LOG_INFO,"UNKNOWN FIELDS LENGTH: %d ", field_size); |
| 580 | for (i=0; i<field_size; i++){ |
| 581 | (*myPtrs->offsetV9Ptr)++; |
| 582 | } |
| 583 | } |
| 584 | } /* end if one cache table line existence */ |
| 585 | if (cpt==tmp->fieldCount) { |
| 586 | /* |
| 587 | * end of one flow (not the flowset) |
| 588 | */ |
| 589 | |
| 590 | /* put aggregation cache information to IPv4 Prefixes table */ |
| 591 | /* Aggregation mode must be enable in ./configure options */ |
| 592 | /* first we must know if the address belong to our prefix */ |
| 593 | /* |
| 594 | * AS ACCOUNTING |
| 595 | */ |
| 596 | #if defined(ASACC) && defined(IPV4AGGIDSNMP) |
| 597 | if ( (bool == 1) && (isMplsFlow == 0) ){ |
| 598 | asKey.as = agCache.asS; |
| 599 | asres = bsearch(&asKey, myPtrs->currentASTab, myPtrs->asNb, sizeof(struct AS), asGlobalCmp); |
| 600 | if (asres != NULL) { |
| 601 | if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1 ) { |
| 602 | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
| 603 | /* OUT ("traffic from the AS") */ |
| 604 | asres->bytesNbOUT += agCache.bytes; |
| 605 | asres->pktsNbOUT += agCache.pkts; |
| 606 | (asres->flowNbOUT)++; |
| 607 | } |
| 608 | if (asres->sampling == 0 |
| 609 | && myPtrs->currentRouterPtr->sampled != 0){ |
| 610 | asres->sampling = myPtrs->currentRouterPtr->sampled; |
| 611 | } |
| 612 | asres = NULL; |
| 613 | asKey.as = agCache.asD; |
| 614 | asres = bsearch(&asKey, myPtrs->currentASTab, myPtrs->asNb, sizeof(struct AS), asGlobalCmp); |
| 615 | if (asres!=NULL){ |
| 616 | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
| 617 | /* IN ("traffic to the AS") */ |
| 618 | asres->bytesNbIN += agCache.bytes; |
| 619 | asres->pktsNbIN += agCache.pkts; |
| 620 | (asres->flowNbIN)++; |
| 621 | } |
| 622 | if (asres->sampling == 0 |
| 623 | && myPtrs->currentRouterPtr->sampled != 0){ |
| 624 | asres->sampling = myPtrs->currentRouterPtr->sampled; |
| 625 | } |
| 626 | asres = NULL; |
| 627 | } |
| 628 | } |
| 629 | } else { |
| 630 | asres = NULL; |
| 631 | asKey.as = agCache.asD; |
| 632 | asres = bsearch(&asKey, myPtrs->currentASTab, myPtrs->asNb, sizeof(struct AS), asGlobalCmp); |
| 633 | if (asres!=NULL){ |
| 634 | if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1 ) { |
| 635 | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
| 636 | /* IN ("traffic to the AS") */ |
| 637 | asres->bytesNbIN += agCache.bytes; |
| 638 | asres->pktsNbIN += agCache.pkts; |
| 639 | (asres->flowNbIN)++; |
| 640 | } |
| 641 | if (asres->sampling == 0 |
| 642 | && myPtrs->currentRouterPtr->sampled != 0){ |
| 643 | asres->sampling = myPtrs->currentRouterPtr->sampled; |
| 644 | } |
| 645 | } |
| 646 | } |
| 647 | } |
| 648 | } |
| 649 | #endif |
| 650 | /* |
| 651 | * PREFIX &/or MATRIX ACCOUNTING |
| 652 | */ |
| 653 | #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP) |
| 654 | if ( (bool == 1) && (isMplsFlow == 0) ){ |
| 655 | prefixKey.beginning = agCache.v4AdS>>(32-agCache.maskS)<<(32-agCache.maskS); |
| 656 | res = bsearch(&prefixKey, V4PTab, nbPV4, |
| 657 | sizeof(struct PrefixV4), prefGlobalCmp); |
| 658 | if (res!=NULL){ |
| 659 | /* res is supernet or subnet ? */ |
| 660 | if (res->hasSubnet == 1) { |
| 661 | resSub = NULL; |
| 662 | resSub = bsearch(&prefixKey, V4STab, nbSV4, |
| 663 | sizeof(struct PrefixV4), prefGlobalCmp); |
| 664 | if (resSub != NULL) { |
| 665 | res = resSub; |
| 666 | resSub = NULL; |
| 667 | } |
| 668 | } |
| 669 | #if defined(IPV4AGGIDR) |
| 670 | if ( myPtrs->routersID[res->routerNb] == agCache.routerAd ) { |
| 671 | #elif defined(IPV4AGGIDSNMP) |
| 672 | if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1 ) { |
| 673 | #endif |
| 674 | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
| 675 | /* OUT ("traffic from the prefix/subnet") */ |
| 676 | res->bytesNbOUT += agCache.bytes; |
| 677 | res->pktsNbOUT += agCache.pkts; |
| 678 | (res->flowNbOUT)++; |
| 679 | } |
| 680 | if (res->sampling == 0 |
| 681 | && myPtrs->currentRouterPtr->sampled != 0){ |
| 682 | res->sampling = myPtrs->currentRouterPtr->sampled; |
| 683 | } |
| 684 | #if defined(IPV4AGGIDSNMP) |
| 685 | prefixKey.beginning = agCache.v4AdD>>(32-agCache.maskD)<<(32-agCache.maskD); |
| 686 | res3 = bsearch(&prefixKey, V4PTab, nbPV4, |
| 687 | sizeof(struct PrefixV4), prefGlobalCmp); |
| 688 | if (res3!=NULL){ |
| 689 | /* res is supernet or subnet ? */ |
| 690 | if (res3->hasSubnet == 1) { |
| 691 | resSub = NULL; |
| 692 | resSub = bsearch(&prefixKey, V4STab, nbSV4, |
| 693 | sizeof(struct PrefixV4), prefGlobalCmp); |
| 694 | if (resSub != NULL) { |
| 695 | res3 = resSub; |
| 696 | resSub = NULL; |
| 697 | } |
| 698 | } |
| 699 | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
| 700 | /* IN ("traffic to the prefix/subnet") */ |
| 701 | res3->bytesNbIN += agCache.bytes; |
| 702 | res3->pktsNbIN += agCache.pkts; |
| 703 | (res3->flowNbIN)++; |
| 704 | } |
| 705 | if (res3->sampling == 0 |
| 706 | && myPtrs->currentRouterPtr->sampled != 0){ |
| 707 | res3->sampling = myPtrs->currentRouterPtr->sampled; |
| 708 | } |
| 709 | } |
| 710 | #endif |
| 711 | #if defined(MATRIX) && defined(IPV4AGGIDR) |
| 712 | /* inter-pop matrix Accounting */ |
| 713 | prefixKey.beginning = agCache.v4AdD>>(32-agCache.maskD)<<(32-agCache.maskD); |
| 714 | res2 = bsearch(&prefixKey, V4PTab, nbPV4, |
| 715 | sizeof(struct PrefixV4), prefGlobalCmp); |
| 716 | if (res2!=NULL){ |
| 717 | ((struct POP *)((myPtrs->matrixPOP) |
| 718 | +((res->routerNb)*ROUTER_INDEX_MAX) |
| 719 | +((res2->routerNb))))->pktsNb += agCache.pkts; |
| 720 | ((struct POP *)((myPtrs->matrixPOP) |
| 721 | +((res->routerNb)*ROUTER_INDEX_MAX) |
| 722 | +((res2->routerNb))))->bytesNb += agCache.bytes; |
| 723 | ((struct POP *)((myPtrs->matrixPOP) |
| 724 | +((res->routerNb)*ROUTER_INDEX_MAX) |
| 725 | +((res2->routerNb))))->flowNb++; |
| 726 | } else { |
| 727 | ( |
| 728 | ((struct POP *)(myPtrs->matrixPOP) |
| 729 | +((res->routerNb)*ROUTER_INDEX_MAX) |
| 730 | +((ROUTER_INDEX_MAX-1))))->pktsNb += agCache.pkts; |
| 731 | ( |
| 732 | ((struct POP *)(myPtrs->matrixPOP) |
| 733 | +((res->routerNb)*ROUTER_INDEX_MAX) |
| 734 | +((ROUTER_INDEX_MAX-1))))->bytesNb += agCache.bytes; |
| 735 | ( |
| 736 | ((struct POP *)(myPtrs->matrixPOP) |
| 737 | +((res->routerNb)*ROUTER_INDEX_MAX) |
| 738 | +((ROUTER_INDEX_MAX-1))))->flowNb++; |
| 739 | } |
| 740 | /* end interpop matrix accounting */ |
| 741 | #endif /* matrix */ |
| 742 | } else { |
| 743 | /* doublon or bad reference in prefix list */ |
| 744 | } |
| 745 | } else { /* res==NULL, the prefix in source don't exist in your prefix list */ |
| 746 | prefixKey.beginning = agCache.v4AdD>>(32-agCache.maskD)<<(32-agCache.maskD); |
| 747 | res = bsearch(&prefixKey, V4PTab, nbPV4, |
| 748 | sizeof(struct PrefixV4), prefGlobalCmp); |
| 749 | if (res!=NULL){ |
| 750 | /* res is supernet or subnet ? */ |
| 751 | if (res->hasSubnet == 1) { |
| 752 | resSub = NULL; |
| 753 | resSub = bsearch(&prefixKey, V4STab, nbSV4, |
| 754 | sizeof(struct PrefixV4), prefGlobalCmp); |
| 755 | if (resSub != NULL) { |
| 756 | res = resSub; |
| 757 | resSub = NULL; |
| 758 | } |
| 759 | } |
| 760 | if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1 ) { |
| 761 | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
| 762 | /* IN ("traffic to the prefix/subnet") */ |
| 763 | res->bytesNbIN += agCache.bytes; |
| 764 | res->pktsNbIN += agCache.pkts; |
| 765 | (res->flowNbIN)++; |
| 766 | } |
| 767 | #if defined(IPV4AGGIDR) |
| 768 | if ( myPtrs->routersID[res->routerNb] == agCache.routerAd ) { |
| 769 | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
| 770 | /* IN ("traffic to the prefix") */ |
| 771 | res->bytesNbIN += agCache.bytes; |
| 772 | res->pktsNbIN += agCache.pkts; |
| 773 | (res->flowNbIN)++; |
| 774 | } |
| 775 | #endif |
| 776 | if (res->sampling == 0 |
| 777 | && myPtrs->currentRouterPtr->sampled != 0 ){ |
| 778 | res->sampling = myPtrs->currentRouterPtr->sampled; |
| 779 | } |
| 780 | } else { |
| 781 | /* doublon or bad reference in prefix list */ |
| 782 | } |
| 783 | } else { |
| 784 | /* UNKNOW SUBNET CASE */ |
| 785 | /* */ |
| 786 | /* HERE : we are in the cases of the address/mask don't */ |
| 787 | /* belong to a prefix listed in the IPv4 prefix file */ |
| 788 | /* possibilities : */ |
| 789 | /* - prefix not referenced but allowed to be routed */ |
| 790 | /* - prefix not referenced but not allowed to be routed */ |
| 791 | /* - spoofing */ |
| 792 | #ifdef PRINTUNKNOWNSUBNET |
| 793 | fprintf(stderr, "%lu.%lu.%lu.%lu/%hu -> %lu.%lu.%lu.%lu/%hu (R:%lu.%lu.%lu.%lu) \n", |
| 794 | (agCache.v4AdS>>24), |
| 795 | (agCache.v4AdS<<8>>24), |
| 796 | (agCache.v4AdS<<16>>24), |
| 797 | (agCache.v4AdS<<24>>24), |
| 798 | (agCache.maskS), |
| 799 | (agCache.v4AdD>>24), |
| 800 | (agCache.v4AdD<<8>>24), |
| 801 | (agCache.v4AdD<<16>>24), |
| 802 | (agCache.v4AdD<<24>>24), |
| 803 | (agCache.maskD), |
| 804 | (myPtrs->pcktPtr->ipH->srcAdd>>24), |
| 805 | (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), |
| 806 | (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), |
| 807 | (myPtrs->pcktPtr->ipH->srcAdd<<24>>24) |
| 808 | ); |
| 809 | #endif /* PRINTUNKNOWNSUBNET */ |
| 810 | } |
| 811 | } |
| 812 | } |
| 813 | bool = 0; |
| 814 | isMplsFlow = 0; |
| 815 | #endif /* (IPV4AGGIDR) || (IPV4AGGIDSNMP) */ |
| 816 | /* |
| 817 | * |
| 818 | * SOCKET OUTPUT TO A REMOTE CLIENT |
| 819 | * |
| 820 | * switch the rules definition (check & fieldToRecord), |
| 821 | * we send the flow or a part of the flow to a remote host or a file. |
| 822 | * In a first time (until release 0.0.7, the information was sent via |
| 823 | * the process renetcolSender with an IPC message queue. But, the perf |
| 824 | * of IPC Msg was very bad with a default system compilation. |
| 825 | * So, now, we send information directly from here through sockets. |
| 826 | */ |
| 827 | tmpRuleList = myPtrs->rulesListPtr; |
| 828 | tmpRL = myPtrs->rulesListPtr; |
| 829 | while (tmpRuleList){ |
| 830 | RuleDefPtr tmpRuleDefList = tmpRuleList->def; |
| 831 | unsigned short check = 1; |
| 832 | int s=0; |
| 833 | secondOffset = secondOldOffset; |
| 834 | while (tmpRuleDefList){ |
| 835 | check = check && tmpRuleDefList->check; |
| 836 | tmpRuleDefList->check = 0; |
| 837 | tmpRuleDefList = tmpRuleDefList->next; |
| 838 | } |
| 839 | if ( (tmpRuleList->def != NULL) && (check == 1)) { |
| 840 | /* msg building */ |
| 841 | secondPftmp = tmp->lastField; |
| 842 | msgTextIndex = mempcpy(mempcpy(mempcpy(myMsg.text, |
| 843 | &tplMsgType, |
| 844 | sizeof(unsigned short) |
| 845 | ), |
| 846 | &tmpRuleList->id, |
| 847 | sizeof(tmpRuleList->id) |
| 848 | ), |
| 849 | &myPtrs->currentRouterPtr->IpAddress, |
| 850 | sizeof(unsigned long) |
| 851 | ); |
| 852 | msgTextIndex = mempcpy(mempcpy(mempcpy(msgTextIndex, |
| 853 | &tmp->sourceId, |
| 854 | sizeof(unsigned long) |
| 855 | ), |
| 856 | &tmp->templateFlowSetId, |
| 857 | sizeof(tmp->templateFlowSetId) |
| 858 | ), |
| 859 | myPtrs->ptr_buffer+secondOffset, |
| 860 | flow_size |
| 861 | ); |
| 862 | myMsg.type = 1; |
| 863 | |
| 864 | |
| 865 | /* NEW transfert type */ |
| 866 | for ( ; tmpRL; tmpRL=tmpRL->next){ |
| 867 | if (tmpRL->id == tmpRuleList->id){ |
| 868 | s = sendMessage(tmpRL->host->sockId, myMsg.text, sizeof(myMsg.text), |
| 869 | tmpRL->host->hostAddressPtr); |
| 870 | } |
| 871 | } |
| 872 | /* FIXME : perhaps check "s" */ |
| 873 | noEnd = 1; |
| 874 | secondCpt=0; |
| 875 | } /* end if check */ |
| 876 | tmpRuleList = tmpRuleList->next; |
| 877 | tmpRL = myPtrs->rulesListPtr; /* ticket #11 */ |
| 878 | secondPftmp = tmp->lastField; |
| 879 | } /* end while tmpRuleList */ |
| 880 | /* |
| 881 | * end redirection |
| 882 | */ |
| 883 | secondOffset = *myPtrs->offsetV9Ptr; |
| 884 | secondOldOffset = secondOffset; |
| 885 | pftmp = tmp->lastField; |
| 886 | cpt=0; |
| 887 | (*myPtrs->currentFlowsetNumberPtr)++; /* pointer on the flows number */ |
| 888 | if (((*myPtrs->offsetV9Ptr)-48-shift+flow_size) > data_length){ |
| 889 | overflow = 1; /* buffer index not correct */ |
| 890 | } |
| 891 | } else { |
| 892 | /* not the flow end, progress in field list */ |
| 893 | pftmp = pftmp->prev; |
| 894 | } |
| 895 | } /* end of the while on one flow record */ |
| 896 | |
| 897 | while ( ((*myPtrs->offsetV9Ptr)-48-shift) < data_length ) { |
| 898 | (*myPtrs->offsetV9Ptr)++; /* if padding */ |
| 899 | paddingCounter++; |
| 900 | if ( paddingCounter > 8 ) { |
| 901 | #ifdef DEBUG |
| 902 | fprintf(stderr," padding too high: %d ", paddingCounter); |
| 903 | #endif |
| 904 | syslog(LOG_INFO,"padding too high: %d ", paddingCounter); |
| 905 | return (-1); |
| 906 | } |
| 907 | } |
| 908 | while ( (*myPtrs->offsetV9Ptr)-48-shift > data_length ) { |
| 909 | (*myPtrs->offsetV9Ptr)--; /* crazy loop (when bug appears in template def) */ |
| 910 | crazyCounter++; |
| 911 | } |
| 912 | #ifdef DEBUG |
| 913 | if (crazyCounter != 0){ fprintf(stderr," crazyCounter: %d ", crazyCounter); } |
| 914 | #endif |
| 915 | if (crazyCounter!=0) { syslog(LOG_INFO,"crazyCounter: %d ", crazyCounter);} |
| 916 | |
| 917 | #ifdef DEBUG |
| 918 | fprintf(stderr,"}"); |
| 919 | #endif |
| 920 | |
| 921 | return (data_length+shift); |
| 922 | /* end new place */ |
| 923 | |
| 924 | }else{ |
| 925 | /* |
| 926 | * |
| 927 | * |
| 928 | * OPTIONAL TEMPLATE |
| 929 | * |
| 930 | * |
| 931 | */ |
| 932 | if ((tmpOpt=existTplOptId(myPtrs->currentRouterPtr, myPtrs->currentHeaderV9Ptr->sourceId, |
| 933 | (*myPtrs->currentFlowsetIdPtr)))!=NULL) { |
| 934 | #ifdef DEBUG |
| 935 | fprintf(stderr,"<d id: %hu, lg %hu", (*myPtrs->currentFlowsetIdPtr), data_length); |
| 936 | #endif |
| 937 | for ( i=0; i<(tmpOpt->optionScopeLg/4); i++){ |
| 938 | /* FIXME : today we skip the scope fields, it's bad :( */ |
| 939 | if ((pftmp=tmpOpt->lastField)!=NULL) { |
| 940 | for (j=0; j<pftmp->fieldLength; j++) { |
| 941 | (*myPtrs->offsetV9Ptr)++; |
| 942 | } |
| 943 | pftmp = pftmp->prev; |
| 944 | } |
| 945 | } |
| 946 | while (pftmp != NULL) { |
| 947 | if (pftmp->fieldLength==1){ |
| 948 | buffer1 = *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++; |
| 949 | } |
| 950 | if (pftmp->fieldLength==2){ |
| 951 | buffer2[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++; |
| 952 | buffer2[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++; |
| 953 | } |
| 954 | if (pftmp->fieldLength==4){ |
| 955 | buffer4[3]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++; |
| 956 | buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++; |
| 957 | buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++; |
| 958 | buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++; |
| 959 | if (pftmp->fieldType==34){ |
| 960 | if ((*((unsigned long*)&buffer4)==1) |
| 961 | || (*((unsigned long*)&buffer4)==10) |
| 962 | || (*((unsigned long*)&buffer4)==100) |
| 963 | || (*((unsigned long*)&buffer4)==1000)) { |
| 964 | if (myPtrs->currentRouterPtr->sampled != *((unsigned long*)&buffer4) ) { |
| 965 | #ifdef DEBUGAGG |
| 966 | fprintf(stderr,"\n SV (p) %lu != %lu (r)", *((unsigned long*)&buffer4), |
| 967 | myPtrs->currentRouterPtr->sampled); |
| 968 | #endif |
| 969 | syslog(LOG_INFO,"Sampling value change for router : %lu.%lu.%lu.%lu, old: %lu, new: %lu", |
| 970 | (myPtrs->pcktPtr->ipH->srcAdd>>24), |
| 971 | (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), |
| 972 | (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), |
| 973 | (myPtrs->pcktPtr->ipH->srcAdd<<24>>24), |
| 974 | myPtrs->currentRouterPtr->sampled, |
| 975 | *((unsigned long*)&buffer4) |
| 976 | ); |
| 977 | myPtrs->currentRouterPtr->sampled = *((unsigned long*)&buffer4); |
| 978 | } |
| 979 | }else{ |
| 980 | syslog(LOG_INFO,"Sampling value not standard for router : %lu.%lu.%lu.%lu, value : %lu", |
| 981 | (myPtrs->pcktPtr->ipH->srcAdd>>24), |
| 982 | (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), |
| 983 | (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), |
| 984 | (myPtrs->pcktPtr->ipH->srcAdd<<24>>24), |
| 985 | *((unsigned long*)&buffer4) |
| 986 | ); |
| 987 | } |
| 988 | } |
| 989 | } |
| 990 | pftmp = pftmp->prev; |
| 991 | } |
| 992 | if ( pftmp == NULL ) { |
| 993 | while ((*myPtrs->offsetV9Ptr)%4 != 0) { |
| 994 | (*myPtrs->offsetV9Ptr)++; |
| 995 | #ifdef DEBUG |
| 996 | fprintf(stderr," p "); |
| 997 | #endif |
| 998 | } |
| 999 | } else { |
| 1000 | fprintf(stderr,"PB "); |
| 1001 | } |
| 1002 | #ifdef DEBUG |
| 1003 | fprintf(stderr,">"); |
| 1004 | #endif |
| 1005 | return (data_length+shift); |
| 1006 | } else { |
| 1007 | /* |
| 1008 | * template unknown, we skip this all the data |
| 1009 | */ |
| 1010 | (*myPtrs->offsetV9Ptr)+=(data_length-4); |
| 1011 | (*myPtrs->currentFlowsetNumberPtr) = myPtrs->currentHeaderV9Ptr->count; |
| 1012 | #ifdef DEBUG |
| 1013 | fprintf(stderr, " U, r: %lu.%lu.%lu.%lu, sourceId: %lu, TID: %hu", |
| 1014 | (myPtrs->pcktPtr->ipH->srcAdd>>24), |
| 1015 | (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), |
| 1016 | (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), |
| 1017 | (myPtrs->pcktPtr->ipH->srcAdd<<24>>24), |
| 1018 | myPtrs->currentHeaderV9Ptr->sourceId, |
| 1019 | (*myPtrs->currentFlowsetIdPtr) |
| 1020 | ); |
| 1021 | #endif |
| 1022 | return (data_length+shift); |
| 1023 | } |
348 | | } else { |
349 | | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
350 | | == |
351 | | (*((unsigned long*)&buffer4)) |
352 | | ) |
353 | | { |
354 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
355 | | } else { |
356 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
357 | | moreIsNecessary = 0; |
358 | | } |
359 | | } |
360 | | break; |
361 | | case 1: |
362 | | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 64){ |
363 | | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
364 | | == |
365 | | (*((unsigned long*)&buffer4))>>(64-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)<<(64-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask) |
366 | | ) |
367 | | { |
368 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = |
369 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1; |
370 | | moreIsNecessary = 0; |
371 | | } else { |
372 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
373 | | moreIsNecessary = 0; |
374 | | } |
375 | | } else { |
376 | | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
377 | | == |
378 | | (*((unsigned long*)&buffer4)) |
379 | | ) |
380 | | { |
381 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = |
382 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1; |
383 | | } else { |
384 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
385 | | moreIsNecessary = 0; |
386 | | } |
387 | | } |
388 | | break; |
389 | | case 2: |
390 | | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 96){ |
391 | | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
392 | | == |
393 | | (*((unsigned long*)&buffer4))>>(96-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)<<(96-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask) |
394 | | ) |
395 | | { |
396 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = |
397 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1; |
398 | | moreIsNecessary = 0; |
399 | | } else { |
400 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
401 | | moreIsNecessary = 0; |
402 | | } |
403 | | } else { |
404 | | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
405 | | == |
406 | | (*((unsigned long*)&buffer4)) |
407 | | ) |
408 | | { |
409 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = |
410 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1; |
411 | | } else { |
412 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
413 | | moreIsNecessary = 0; |
414 | | } |
415 | | } |
416 | | break; |
417 | | case 3: |
418 | | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 128){ |
419 | | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
420 | | == |
421 | | (*((unsigned long*)&buffer4))>>(128-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)<<(128-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask) |
422 | | ) |
423 | | { |
424 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = |
425 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1; |
426 | | } else { |
427 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
428 | | moreIsNecessary = 0; |
429 | | } |
430 | | } else { |
431 | | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
432 | | == |
433 | | (*((unsigned long*)&buffer4)) |
434 | | ) |
435 | | { |
436 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = |
437 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1; |
438 | | } else { |
439 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
440 | | moreIsNecessary = 0; |
441 | | } |
442 | | } |
443 | | break; |
444 | | default: |
445 | | break; |
446 | | } /* end of switch(i) */ |
447 | | } /* end of if moreIsNecessary */ |
448 | | } |
449 | | moreIsNecessary = 1; |
450 | | /* aggregation for IPv6 flows */ |
451 | | |
452 | | /* end aggregation */ |
453 | | break; |
454 | | default: |
455 | | syslog(LOG_INFO, "Field size not known: %d\n", field_size); |
456 | | for (i=0; i<field_size; i++){ |
457 | | (*myPtrs->offsetV9Ptr)++; |
458 | | } |
459 | | break; |
460 | | } |
461 | | break; |
462 | | default: |
463 | | syslog(LOG_INFO, "Operator not known: %d\n", |
464 | | (int)(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->operator)); |
465 | | break; |
466 | | } |
467 | | j++; |
468 | | pos = (pftmp->fieldType)*10+j; |
469 | | } /* end while myPtrs->rulesAddressPtr */ |
470 | | } else { |
471 | | /* |
472 | | * no rule within this field type, but we must read the value |
473 | | */ |
474 | | switch (field_size) { |
475 | | case 1: |
476 | | buffer1 = *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
477 | | (*myPtrs->offsetV9Ptr)++; |
478 | | #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP) |
479 | | if ((pftmp->fieldType==9)||(pftmp->fieldType==29)){ |
480 | | agCache.maskS = *((unsigned char*)&buffer1); |
481 | | } |
482 | | if ((pftmp->fieldType==13)||(pftmp->fieldType==30)){ |
483 | | agCache.maskD = *((unsigned char*)&buffer1); |
484 | | } |
485 | | if (pftmp->fieldType==60){ |
486 | | agCache.ipProt = *((unsigned char*)&buffer1); |
487 | | } |
488 | | if (pftmp->fieldType==4){ |
489 | | agCache.tProt = *((unsigned char*)&buffer1); |
490 | | } |
491 | | if (pftmp->fieldType==61){ |
492 | | agCache.sens = *((unsigned char*)&buffer1); |
493 | | } |
494 | | if (pftmp->fieldType==5){ |
495 | | agCache.dscp = *((unsigned char*)&buffer1); |
496 | | } |
497 | | #endif |
498 | | break; |
499 | | case 2: |
500 | | buffer2[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
501 | | (*myPtrs->offsetV9Ptr)++; |
502 | | buffer2[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
503 | | (*myPtrs->offsetV9Ptr)++; |
504 | | #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP) |
505 | | if (pftmp->fieldType==10){ |
506 | | agCache.inputSnmp = *((unsigned short*)&buffer2); |
507 | | } |
508 | | if (pftmp->fieldType==14){ |
509 | | agCache.outputSnmp = *((unsigned short*)&buffer2); |
510 | | } |
511 | | #endif |
512 | | #ifdef ASACC |
513 | | if (pftmp->fieldType==16){ |
514 | | agCache.asS = *((unsigned short*)&buffer2); |
515 | | } |
516 | | if (pftmp->fieldType==17){ |
517 | | agCache.asD = *((unsigned short*)&buffer2); |
518 | | } |
519 | | #endif |
520 | | break; |
521 | | case 3: |
522 | | buffer4[3]= 0; |
523 | | buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
524 | | (*myPtrs->offsetV9Ptr)++; |
525 | | buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
526 | | (*myPtrs->offsetV9Ptr)++; |
527 | | buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
528 | | (*myPtrs->offsetV9Ptr)++; |
529 | | /* aggregation */ |
530 | | /* end aggregation */ |
531 | | if (pftmp->fieldType==70){ |
532 | | isMplsFlow = 1; |
533 | | } |
534 | | break; |
535 | | case 4: |
536 | | buffer4[3]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
537 | | (*myPtrs->offsetV9Ptr)++; |
538 | | buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
539 | | (*myPtrs->offsetV9Ptr)++; |
540 | | buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
541 | | (*myPtrs->offsetV9Ptr)++; |
542 | | buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
543 | | (*myPtrs->offsetV9Ptr)++; |
544 | | #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP) |
545 | | if ((pftmp->fieldType==8)){ |
546 | | bool = 1; |
547 | | agCache.v4AdS = *((unsigned long*)&buffer4); |
548 | | } else if ((pftmp->fieldType==12)){ |
549 | | agCache.v4AdD = *((unsigned long*)&buffer4); |
550 | | } else if (pftmp->fieldType==1){ |
551 | | agCache.bytes = *((unsigned long*)&buffer4); |
552 | | } else if (pftmp->fieldType==2){ |
553 | | agCache.pkts = *((unsigned long*)&buffer4); |
554 | | } |
555 | | #endif |
556 | | break; |
557 | | case 16: |
558 | | for (i=0; i<4; i++) { |
559 | | buffer2[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
560 | | (*myPtrs->offsetV9Ptr)++; |
561 | | buffer2[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
562 | | (*myPtrs->offsetV9Ptr)++; |
563 | | buffer2[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
564 | | (*myPtrs->offsetV9Ptr)++; |
565 | | buffer2[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
566 | | (*myPtrs->offsetV9Ptr)++; |
567 | | } |
568 | | /* aggregation IPv6 */ |
569 | | /* end aggregation */ |
570 | | break; |
571 | | default: |
572 | | syslog(LOG_INFO,"UNKNOWN FIELDS LENGTH: %d ", field_size); |
573 | | for (i=0; i<field_size; i++){ |
574 | | (*myPtrs->offsetV9Ptr)++; |
575 | | } |
576 | | } |
577 | | } /* end if one cache table line existence */ |
578 | | if (cpt==tmp->fieldCount) { |
579 | | /* |
580 | | * end of one flow (not the flowset) |
581 | | */ |
582 | | |
583 | | /* put aggregation cache information to IPv4 Prefixes table */ |
584 | | /* Aggregation mode must be enable in ./configure options */ |
585 | | /* first we must know if the address belong to our prefix */ |
586 | | /* |
587 | | * AS ACCOUNTING |
588 | | */ |
589 | | #if defined(ASACC) && defined(IPV4AGGIDSNMP) |
590 | | if ( (bool == 1) && (isMplsFlow == 0) ){ |
591 | | asKey.as = agCache.asS; |
592 | | asres = bsearch(&asKey, myPtrs->currentASTab, myPtrs->asNb, sizeof(struct AS), asGlobalCmp); |
593 | | if (asres != NULL) { |
594 | | if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1 ) { |
595 | | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
596 | | /* OUT ("traffic from the AS") */ |
597 | | asres->bytesNbOUT += agCache.bytes; |
598 | | asres->pktsNbOUT += agCache.pkts; |
599 | | (asres->flowNbOUT)++; |
600 | | } |
601 | | if (asres->sampling == 0 |
602 | | && myPtrs->currentRouterPtr->sampled != 0){ |
603 | | asres->sampling = myPtrs->currentRouterPtr->sampled; |
604 | | } |
605 | | asres = NULL; |
606 | | asKey.as = agCache.asD; |
607 | | asres = bsearch(&asKey, myPtrs->currentASTab, myPtrs->asNb, sizeof(struct AS), asGlobalCmp); |
608 | | if (asres!=NULL){ |
609 | | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
610 | | /* IN ("traffic to the AS") */ |
611 | | asres->bytesNbIN += agCache.bytes; |
612 | | asres->pktsNbIN += agCache.pkts; |
613 | | (asres->flowNbIN)++; |
615 | | if (asres->sampling == 0 |
616 | | && myPtrs->currentRouterPtr->sampled != 0){ |
617 | | asres->sampling = myPtrs->currentRouterPtr->sampled; |
618 | | } |
619 | | asres = NULL; |
620 | | } |
621 | | } |
622 | | } else { |
623 | | asres = NULL; |
624 | | asKey.as = agCache.asD; |
625 | | asres = bsearch(&asKey, myPtrs->currentASTab, myPtrs->asNb, sizeof(struct AS), asGlobalCmp); |
626 | | if (asres!=NULL){ |
627 | | if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1 ) { |
628 | | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
629 | | /* IN ("traffic to the AS") */ |
630 | | asres->bytesNbIN += agCache.bytes; |
631 | | asres->pktsNbIN += agCache.pkts; |
632 | | (asres->flowNbIN)++; |
633 | | } |
634 | | if (asres->sampling == 0 |
635 | | && myPtrs->currentRouterPtr->sampled != 0){ |
636 | | asres->sampling = myPtrs->currentRouterPtr->sampled; |
637 | | } |
638 | | } |
639 | | } |
640 | | } |
641 | | } |
642 | | #endif |
643 | | /* |
644 | | * PREFIX &/or MATRIX ACCOUNTING |
645 | | */ |
646 | | #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP) |
647 | | if ( (bool == 1) && (isMplsFlow == 0) ){ |
648 | | prefixKey.beginning = agCache.v4AdS>>(32-agCache.maskS)<<(32-agCache.maskS); |
649 | | res = bsearch(&prefixKey, V4PTab, nbPV4, |
650 | | sizeof(struct PrefixV4), prefGlobalCmp); |
651 | | if (res!=NULL){ |
652 | | /* res is supernet or subnet ? */ |
653 | | if (res->hasSubnet == 1) { |
654 | | resSub = NULL; |
655 | | resSub = bsearch(&prefixKey, V4STab, nbSV4, |
656 | | sizeof(struct PrefixV4), prefGlobalCmp); |
657 | | if (resSub != NULL) { |
658 | | res = resSub; |
659 | | resSub = NULL; |
660 | | } |
661 | | } |
662 | | #if defined(IPV4AGGIDR) |
663 | | if ( myPtrs->routersID[res->routerNb] == agCache.routerAd ) { |
664 | | #elif defined(IPV4AGGIDSNMP) |
665 | | if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1 ) { |
666 | | #endif |
667 | | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
668 | | /* OUT ("traffic from the prefix/subnet") */ |
669 | | res->bytesNbOUT += agCache.bytes; |
670 | | res->pktsNbOUT += agCache.pkts; |
671 | | (res->flowNbOUT)++; |
672 | | } |
673 | | if (res->sampling == 0 |
674 | | && myPtrs->currentRouterPtr->sampled != 0){ |
675 | | res->sampling = myPtrs->currentRouterPtr->sampled; |
676 | | } |
677 | | #if defined(IPV4AGGIDSNMP) |
678 | | prefixKey.beginning = agCache.v4AdD>>(32-agCache.maskD)<<(32-agCache.maskD); |
679 | | res3 = bsearch(&prefixKey, V4PTab, nbPV4, |
680 | | sizeof(struct PrefixV4), prefGlobalCmp); |
681 | | if (res3!=NULL){ |
682 | | /* res is supernet or subnet ? */ |
683 | | if (res3->hasSubnet == 1) { |
684 | | resSub = NULL; |
685 | | resSub = bsearch(&prefixKey, V4STab, nbSV4, |
686 | | sizeof(struct PrefixV4), prefGlobalCmp); |
687 | | if (resSub != NULL) { |
688 | | res3 = resSub; |
689 | | resSub = NULL; |
690 | | } |
691 | | } |
692 | | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
693 | | /* IN ("traffic to the prefix/subnet") */ |
694 | | res3->bytesNbIN += agCache.bytes; |
695 | | res3->pktsNbIN += agCache.pkts; |
696 | | (res3->flowNbIN)++; |
697 | | } |
698 | | if (res3->sampling == 0 |
699 | | && myPtrs->currentRouterPtr->sampled != 0){ |
700 | | res3->sampling = myPtrs->currentRouterPtr->sampled; |
701 | | } |
702 | | } |
703 | | #endif |
704 | | #if defined(MATRIX) && defined(IPV4AGGIDR) |
705 | | /* inter-pop matrix Accounting */ |
706 | | prefixKey.beginning = agCache.v4AdD>>(32-agCache.maskD)<<(32-agCache.maskD); |
707 | | res2 = bsearch(&prefixKey, V4PTab, nbPV4, |
708 | | sizeof(struct PrefixV4), prefGlobalCmp); |
709 | | if (res2!=NULL){ |
710 | | ((struct POP *)((myPtrs->matrixPOP) |
711 | | +((res->routerNb)*ROUTER_INDEX_MAX) |
712 | | +((res2->routerNb))))->pktsNb += agCache.pkts; |
713 | | ((struct POP *)((myPtrs->matrixPOP) |
714 | | +((res->routerNb)*ROUTER_INDEX_MAX) |
715 | | +((res2->routerNb))))->bytesNb += agCache.bytes; |
716 | | ((struct POP *)((myPtrs->matrixPOP) |
717 | | +((res->routerNb)*ROUTER_INDEX_MAX) |
718 | | +((res2->routerNb))))->flowNb++; |
719 | | } else { |
720 | | ( |
721 | | ((struct POP *)(myPtrs->matrixPOP) |
722 | | +((res->routerNb)*ROUTER_INDEX_MAX) |
723 | | +((ROUTER_INDEX_MAX-1))))->pktsNb += agCache.pkts; |
724 | | ( |
725 | | ((struct POP *)(myPtrs->matrixPOP) |
726 | | +((res->routerNb)*ROUTER_INDEX_MAX) |
727 | | +((ROUTER_INDEX_MAX-1))))->bytesNb += agCache.bytes; |
728 | | ( |
729 | | ((struct POP *)(myPtrs->matrixPOP) |
730 | | +((res->routerNb)*ROUTER_INDEX_MAX) |
731 | | +((ROUTER_INDEX_MAX-1))))->flowNb++; |
732 | | } |
733 | | /* end interpop matrix accounting */ |
734 | | #endif /* matrix */ |
735 | | } else { |
736 | | /* doublon or bad reference in prefix list */ |
737 | | } |
738 | | } else { /* res==NULL, the prefix in source don't exist in your prefix list */ |
739 | | prefixKey.beginning = agCache.v4AdD>>(32-agCache.maskD)<<(32-agCache.maskD); |
740 | | res = bsearch(&prefixKey, V4PTab, nbPV4, |
741 | | sizeof(struct PrefixV4), prefGlobalCmp); |
742 | | if (res!=NULL){ |
743 | | /* res is supernet or subnet ? */ |
744 | | if (res->hasSubnet == 1) { |
745 | | resSub = NULL; |
746 | | resSub = bsearch(&prefixKey, V4STab, nbSV4, |
747 | | sizeof(struct PrefixV4), prefGlobalCmp); |
748 | | if (resSub != NULL) { |
749 | | res = resSub; |
750 | | resSub = NULL; |
751 | | } |
752 | | } |
753 | | if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1 ) { |
754 | | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
755 | | /* IN ("traffic to the prefix/subnet") */ |
756 | | res->bytesNbIN += agCache.bytes; |
757 | | res->pktsNbIN += agCache.pkts; |
758 | | (res->flowNbIN)++; |
759 | | } |
760 | | #if defined(IPV4AGGIDR) |
761 | | if ( myPtrs->routersID[res->routerNb] == agCache.routerAd ) { |
762 | | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
763 | | /* IN ("traffic to the prefix") */ |
764 | | res->bytesNbIN += agCache.bytes; |
765 | | res->pktsNbIN += agCache.pkts; |
766 | | (res->flowNbIN)++; |
767 | | } |
768 | | #endif |
769 | | if (res->sampling == 0 |
770 | | && myPtrs->currentRouterPtr->sampled != 0 ){ |
771 | | res->sampling = myPtrs->currentRouterPtr->sampled; |
772 | | } |
773 | | } else { |
774 | | /* doublon or bad reference in prefix list */ |
775 | | } |
776 | | } else { |
777 | | /* UNKNOW SUBNET CASE */ |
778 | | /* */ |
779 | | /* HERE : we are in the cases of the address/mask don't */ |
780 | | /* belong to a prefix listed in the IPv4 prefix file */ |
781 | | /* possibilities : */ |
782 | | /* - prefix not referenced but allowed to be routed */ |
783 | | /* - prefix not referenced but not allowed to be routed */ |
784 | | /* - spoofing */ |
785 | | #ifdef PRINTUNKNOWNSUBNET |
786 | | fprintf(stderr, "%lu.%lu.%lu.%lu/%hu -> %lu.%lu.%lu.%lu/%hu (R:%lu.%lu.%lu.%lu) \n", |
787 | | (agCache.v4AdS>>24), |
788 | | (agCache.v4AdS<<8>>24), |
789 | | (agCache.v4AdS<<16>>24), |
790 | | (agCache.v4AdS<<24>>24), |
791 | | (agCache.maskS), |
792 | | (agCache.v4AdD>>24), |
793 | | (agCache.v4AdD<<8>>24), |
794 | | (agCache.v4AdD<<16>>24), |
795 | | (agCache.v4AdD<<24>>24), |
796 | | (agCache.maskD), |
797 | | (myPtrs->pcktPtr->ipH->srcAdd>>24), |
798 | | (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), |
799 | | (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), |
800 | | (myPtrs->pcktPtr->ipH->srcAdd<<24>>24) |
801 | | ); |
802 | | #endif /* PRINTUNKNOWNSUBNET */ |
803 | | } |
804 | | } |
805 | | } |
806 | | bool = 0; |
807 | | isMplsFlow = 0; |
808 | | #endif /* (IPV4AGGIDR) || (IPV4AGGIDSNMP) */ |
809 | | /* |
810 | | * |
811 | | * SOCKET OUTPUT TO A REMOTE CLIENT |
812 | | * |
813 | | * switch the rules definition (check & fieldToRecord), |
814 | | * we send the flow or a part of the flow to a remote host or a file. |
815 | | * In a first time (until release 0.0.7, the information was sent via |
816 | | * the process renetcolSender with an IPC message queue. But, the perf |
817 | | * of IPC Msg was very bad with a default system compilation. |
818 | | * So, now, we send information directly from here through sockets. |
819 | | */ |
820 | | tmpRuleList = myPtrs->rulesListPtr; |
821 | | tmpRL = myPtrs->rulesListPtr; |
822 | | while (tmpRuleList){ |
823 | | RuleDefPtr tmpRuleDefList = tmpRuleList->def; |
824 | | unsigned short check = 1; |
825 | | int s=0; |
826 | | secondOffset = secondOldOffset; |
827 | | while (tmpRuleDefList){ |
828 | | check = check && tmpRuleDefList->check; |
829 | | tmpRuleDefList->check = 0; |
830 | | tmpRuleDefList = tmpRuleDefList->next; |
831 | | } |
832 | | if ( (tmpRuleList->def != NULL) && (check == 1)) { |
833 | | /* msg building */ |
834 | | secondPftmp = tmp->lastField; |
835 | | msgTextIndex = mempcpy(mempcpy(mempcpy(myMsg.text, |
836 | | &tplMsgType, |
837 | | sizeof(unsigned short) |
838 | | ), |
839 | | &tmpRuleList->id, |
840 | | sizeof(tmpRuleList->id) |
841 | | ), |
842 | | &myPtrs->currentRouterPtr->IpAddress, |
843 | | sizeof(unsigned long) |
844 | | ); |
845 | | msgTextIndex = mempcpy(mempcpy(mempcpy(msgTextIndex, |
846 | | &tmp->sourceId, |
847 | | sizeof(unsigned long) |
848 | | ), |
849 | | &tmp->templateFlowSetId, |
850 | | sizeof(tmp->templateFlowSetId) |
851 | | ), |
852 | | myPtrs->ptr_buffer+secondOffset, |
853 | | flow_size |
854 | | ); |
855 | | myMsg.type = 1; |
856 | | |
857 | | |
858 | | /* NEW transfert type */ |
859 | | for ( ; tmpRL; tmpRL=tmpRL->next){ |
860 | | if (tmpRL->id == tmpRuleList->id){ |
861 | | s = sendMessage(tmpRL->host->sockId, myMsg.text, sizeof(myMsg.text), |
862 | | tmpRL->host->hostAddressPtr); |
863 | | } |
864 | | } |
865 | | /* FIXME : perhaps check "s" */ |
866 | | noEnd = 1; |
867 | | secondCpt=0; |
868 | | } /* end if check */ |
869 | | tmpRuleList = tmpRuleList->next; |
870 | | tmpRL = myPtrs->rulesListPtr; /* ticket #11 */ |
871 | | secondPftmp = tmp->lastField; |
872 | | } /* end while tmpRuleList */ |
873 | | /* |
874 | | * end redirection |
875 | | */ |
876 | | secondOffset = *myPtrs->offsetV9Ptr; |
877 | | secondOldOffset = secondOffset; |
878 | | pftmp = tmp->lastField; |
879 | | cpt=0; |
880 | | (*myPtrs->currentFlowsetNumberPtr)++; /* pointer on the flows number */ |
881 | | if (((*myPtrs->offsetV9Ptr)-48-shift+flow_size) > data_length){ |
882 | | overflow = 1; /* buffer index not correct */ |
883 | | } |
884 | | } else { |
885 | | /* not the flow end, progress in field list */ |
886 | | pftmp = pftmp->prev; |
887 | | } |
888 | | } /* end of the while on one flow record */ |
889 | | |
890 | | while ( ((*myPtrs->offsetV9Ptr)-48-shift) < data_length ) { |
891 | | (*myPtrs->offsetV9Ptr)++; /* if padding */ |
892 | | paddingCounter++; |
893 | | if ( paddingCounter > 8 ) { |
894 | | #ifdef DEBUG |
895 | | fprintf(stderr," padding too high: %d ", paddingCounter); |
896 | | #endif |
897 | | syslog(LOG_INFO,"padding too high: %d ", paddingCounter); |
898 | | return (-1); |
899 | | } |
900 | | } |
901 | | while ( (*myPtrs->offsetV9Ptr)-48-shift > data_length ) { |
902 | | (*myPtrs->offsetV9Ptr)--; /* crazy loop (when bug appears in template def) */ |
903 | | crazyCounter++; |
904 | | } |
905 | | #ifdef DEBUG |
906 | | if (crazyCounter != 0){ fprintf(stderr," crazyCounter: %d ", crazyCounter); } |
907 | | #endif |
908 | | if (crazyCounter!=0) { syslog(LOG_INFO,"crazyCounter: %d ", crazyCounter);} |
909 | | |
910 | | #ifdef DEBUG |
911 | | fprintf(stderr,"}"); |
912 | | #endif |
913 | | |
914 | | return (data_length+shift); |
915 | | /* end new place */ |
916 | | |
917 | | }else{ |
918 | | /* |
919 | | * |
920 | | * |
921 | | * OPTIONAL TEMPLATE |
922 | | * |
923 | | * |
924 | | */ |
925 | | if ((tmpOpt=existTplOptId(myPtrs->currentRouterPtr, myPtrs->currentHeaderV9Ptr->sourceId, |
926 | | (*myPtrs->currentFlowsetIdPtr)))!=NULL) { |
927 | | #ifdef DEBUG |
928 | | fprintf(stderr,"<d id: %hu, lg %hu", (*myPtrs->currentFlowsetIdPtr), data_length); |
929 | | #endif |
930 | | for ( i=0; i<(tmpOpt->optionScopeLg/4); i++){ |
931 | | /* FIXME : today we skip the scope fields, it's bad :( */ |
932 | | if ((pftmp=tmpOpt->lastField)!=NULL) { |
933 | | for (j=0; j<pftmp->fieldLength; j++) { |
934 | | (*myPtrs->offsetV9Ptr)++; |
935 | | } |
936 | | pftmp = pftmp->prev; |
937 | | } |
938 | | } |
939 | | while (pftmp != NULL) { |
940 | | if (pftmp->fieldLength==1){ |
941 | | buffer1 = *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++; |
942 | | } |
943 | | if (pftmp->fieldLength==2){ |
944 | | buffer2[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++; |
945 | | buffer2[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++; |
946 | | } |
947 | | if (pftmp->fieldLength==4){ |
948 | | buffer4[3]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++; |
949 | | buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++; |
950 | | buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++; |
951 | | buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++; |
952 | | if (pftmp->fieldType==34){ |
953 | | if ((*((unsigned long*)&buffer4)==1) |
954 | | || (*((unsigned long*)&buffer4)==10) |
955 | | || (*((unsigned long*)&buffer4)==100) |
956 | | || (*((unsigned long*)&buffer4)==1000)) { |
957 | | if (myPtrs->currentRouterPtr->sampled != *((unsigned long*)&buffer4) ) { |
958 | | #ifdef DEBUGAGG |
959 | | fprintf(stderr,"\n SV (p) %lu != %lu (r)", *((unsigned long*)&buffer4), |
960 | | myPtrs->currentRouterPtr->sampled); |
961 | | #endif |
962 | | syslog(LOG_INFO,"Sampling value change for router : %lu.%lu.%lu.%lu, old: %lu, new: %lu", |
963 | | (myPtrs->pcktPtr->ipH->srcAdd>>24), |
964 | | (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), |
965 | | (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), |
966 | | (myPtrs->pcktPtr->ipH->srcAdd<<24>>24), |
967 | | myPtrs->currentRouterPtr->sampled, |
968 | | *((unsigned long*)&buffer4) |
969 | | ); |
970 | | myPtrs->currentRouterPtr->sampled = *((unsigned long*)&buffer4); |
971 | | } |
972 | | }else{ |
973 | | syslog(LOG_INFO,"Sampling value not standard for router : %lu.%lu.%lu.%lu, value : %lu", |
974 | | (myPtrs->pcktPtr->ipH->srcAdd>>24), |
975 | | (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), |
976 | | (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), |
977 | | (myPtrs->pcktPtr->ipH->srcAdd<<24>>24), |
978 | | *((unsigned long*)&buffer4) |
979 | | ); |
980 | | } |
981 | | } |
982 | | } |
983 | | pftmp = pftmp->prev; |
984 | | } |
985 | | if ( pftmp == NULL ) { |
986 | | while ((*myPtrs->offsetV9Ptr)%4 != 0) { |
987 | | (*myPtrs->offsetV9Ptr)++; |
988 | | #ifdef DEBUG |
989 | | fprintf(stderr," p "); |
990 | | #endif |
991 | | } |
992 | | } else { |
993 | | fprintf(stderr,"PB "); |
994 | | } |
995 | | #ifdef DEBUG |
996 | | fprintf(stderr,">"); |
997 | | #endif |
998 | | return (data_length+shift); |
999 | | } else { |
1000 | | /* |
1001 | | * template unknown, we skip this all the data |
1002 | | */ |
1003 | | (*myPtrs->offsetV9Ptr)+=(data_length-4); |
1004 | | (*myPtrs->currentFlowsetNumberPtr) = myPtrs->currentHeaderV9Ptr->count; |
1005 | | #ifdef DEBUG |
1006 | | fprintf(stderr, " U, r: %lu.%lu.%lu.%lu, sourceId: %lu, TID: %hu", |
1007 | | (myPtrs->pcktPtr->ipH->srcAdd>>24), |
1008 | | (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), |
1009 | | (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), |
1010 | | (myPtrs->pcktPtr->ipH->srcAdd<<24>>24), |
1011 | | myPtrs->currentHeaderV9Ptr->sourceId, |
1012 | | (*myPtrs->currentFlowsetIdPtr) |
1013 | | ); |
1014 | | #endif |
1015 | | return (data_length+shift); |
1016 | | } |
1017 | | } |
1018 | | } |