74 | | struct AS asKey, *asres; /* for bsearch */ |
75 | | #endif |
76 | | struct AggCache agCache; |
77 | | int bool = 0; /* in IPV4 Agg mode enabled, we need to now if it's an IPv4 */ |
78 | | /* flow, we test on the field and then put bool at 1 */ |
79 | | int isMplsFlow = 0; |
80 | | int paddingCounter = 0; |
81 | | int crazyCounter = 0; |
82 | | |
83 | | buffer2[1] = *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
84 | | (*myPtrs->offsetV9Ptr)++; |
85 | | buffer2[0] = *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
86 | | (*myPtrs->offsetV9Ptr)++; |
87 | | (*myPtrs->currentFlowsetIdPtr) = *((unsigned short*)&buffer2); |
88 | | buffer2[1] = *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
89 | | (*myPtrs->offsetV9Ptr)++; |
90 | | buffer2[0] = *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
91 | | (*myPtrs->offsetV9Ptr)++; |
92 | | data_length = *((unsigned short*)&buffer2); |
93 | | if (data_length == 0) { |
94 | | syslog(LOG_INFO, "data flowset length null; all next informations of this data flowset are not considered! flowset ID: %hu, from router: %lu.%lu.%lu.%lu", |
95 | | (*myPtrs->currentFlowsetIdPtr), |
96 | | (myPtrs->pcktPtr->ipH->srcAdd>>24), |
97 | | (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), |
98 | | (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), |
99 | | (myPtrs->pcktPtr->ipH->srcAdd<<24>>24)); |
100 | | return (-1); |
101 | | |
| 74 | struct AS asKey, *asres; /* for bsearch */ |
| 75 | #endif |
| 76 | struct AggCache agCache; |
| 77 | int bool = 0; /* in IPV4 Agg mode enabled, we need to now if it's an IPv4 */ |
| 78 | /* flow, we test on the field and then put bool at 1 */ |
| 79 | int isMplsFlow = 0; |
| 80 | int paddingCounter = 0; |
| 81 | int crazyCounter = 0; |
| 82 | |
| 83 | buffer2[1] = *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 84 | (*myPtrs->offsetV9Ptr)++; |
| 85 | buffer2[0] = *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 86 | (*myPtrs->offsetV9Ptr)++; |
| 87 | (*myPtrs->currentFlowsetIdPtr) = *((unsigned short*)&buffer2); |
| 88 | buffer2[1] = *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 89 | (*myPtrs->offsetV9Ptr)++; |
| 90 | buffer2[0] = *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 91 | (*myPtrs->offsetV9Ptr)++; |
| 92 | data_length = *((unsigned short*)&buffer2); |
| 93 | if (data_length == 0) { |
| 94 | syslog(LOG_INFO, "data flowset length null; all next informations of this data flowset are not considered! flowset ID: %hu, from router: %lu.%lu.%lu.%lu", |
| 95 | (*myPtrs->currentFlowsetIdPtr), |
| 96 | (myPtrs->pcktPtr->ipH->srcAdd>>24), |
| 97 | (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), |
| 98 | (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), |
| 99 | (myPtrs->pcktPtr->ipH->srcAdd<<24>>24)); |
| 100 | return (-1); |
| 101 | |
| 102 | } |
| 103 | |
| 104 | if ( (tmp=existTplId(myPtrs->currentRouterPtr, |
| 105 | myPtrs->currentHeaderV9Ptr->sourceId, |
| 106 | (*myPtrs->currentFlowsetIdPtr)))!=NULL ) { |
| 107 | #ifdef DEBUG |
| 108 | fprintf(stderr, |
| 109 | "{d id: %hu, lg %hu", |
| 110 | (*myPtrs->currentFlowsetIdPtr), |
| 111 | data_length); |
| 112 | if ( (*myPtrs->currentFlowsetIdPtr) > TRESHOLD_TEMPLATE_ID ) { |
| 113 | /* fprintf(stderr,"Bad TID from router: %lu.%lu.%lu.%lu\n", */ |
| 114 | /* (*myPtrs->currentFlowsetIdPtr), */ |
| 115 | /* (myPtrs->pcktPtr->ipH->srcAdd>>24), */ |
| 116 | /* (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), */ |
| 117 | /* (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), */ |
| 118 | /* (myPtrs->pcktPtr->ipH->srcAdd<<24>>24)); */ |
| 119 | /* fprintf(stderr," Bytes : \n"); */ |
| 120 | /* while ( ( myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr) ) > (myPtrs->ptr_buffer+1416) ){ */ |
| 121 | /* buffer1= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));(*myPtrs->offsetV9Ptr)++; */ |
| 122 | /* tmp = *((unsigned char*)&buffer1); */ |
| 123 | /* fprintf (stderr, " %s ", tmp); */ |
| 124 | /* } */ |
| 125 | /* exit(-1); */ |
| 126 | return (data_length+shift); |
| 127 | } |
| 128 | #endif |
| 129 | pftmp = tmp->lastField; |
| 130 | for (; pftmp; pftmp = pftmp->prev) { |
| 131 | flow_size += pftmp->fieldLength; |
| 132 | } |
| 133 | if ( data_length%flow_size >= 9 ) { |
| 134 | (*myPtrs->currentFlowsetNumberPtr) = myPtrs->currentHeaderV9Ptr->count; |
| 135 | syslog(LOG_INFO, "data flowset length not match with length from template definition, wrong template definition suspected; all next informations of this data flowset are not considered! flowset ID: %hu, from router: %lu.%lu.%lu.%lu", |
| 136 | (*myPtrs->currentFlowsetIdPtr), |
| 137 | (myPtrs->pcktPtr->ipH->srcAdd>>24), |
| 138 | (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), |
| 139 | (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), |
| 140 | (myPtrs->pcktPtr->ipH->srcAdd<<24>>24)); |
| 141 | return (data_length+shift); |
| 142 | } |
| 143 | if ( data_length >= 1452 ) { |
| 144 | syslog(LOG_INFO, "data flowset length too raised; all next informations of this data flowset are not considered! flowset ID: %hu, from router: %lu.%lu.%lu.%lu", |
| 145 | (*myPtrs->currentFlowsetIdPtr), |
| 146 | (myPtrs->pcktPtr->ipH->srcAdd>>24), |
| 147 | (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), |
| 148 | (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), |
| 149 | (myPtrs->pcktPtr->ipH->srcAdd<<24>>24)); |
| 150 | return (-1); |
| 151 | } |
| 152 | #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP) |
| 153 | agCache.routerAd = myPtrs->pcktPtr->ipH->srcAdd; |
| 154 | #endif |
| 155 | |
| 156 | pftmp = tmp->lastField; |
| 157 | secondPftmp = tmp->lastField; |
| 158 | secondOffset = *myPtrs->offsetV9Ptr; |
| 159 | secondOldOffset = secondOffset; |
| 160 | while ( (((*myPtrs->offsetV9Ptr)-48-shift) <= data_length) |
| 161 | && (overflow!=1) ) { |
| 162 | /* |
| 163 | * progression in a data flow Set |
| 164 | * notes: |
| 165 | * 48= IP header size + NetFlow header size |
| 166 | * shift = shift because we have a template declaration |
| 167 | * inside data templates |
| 168 | */ |
| 169 | cpt++; |
| 170 | j = 0; |
| 171 | pos = (pftmp->fieldType)*MAX_RULES_PER_FIELD+j; |
| 172 | field_size = (int) pftmp->fieldLength; |
| 173 | |
| 174 | /* special case: check yes on all flows from one router */ |
| 175 | /* (phantom field nb 0) */ |
| 176 | /* FIXME : this code is repeated, perhaps past before */ |
| 177 | while ( ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+j))) != NULL ) { |
| 178 | if ( (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+j)))->value->stor.lvalue) |
| 179 | == myPtrs->pcktPtr->ipH->srcAdd ) |
| 180 | { |
| 181 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+j)))->check = 1; |
| 182 | } |
| 183 | j++; |
| 184 | } |
| 185 | j = 0; |
| 186 | |
| 187 | /* |
| 188 | * Comparaison between the field value and the rules |
| 189 | * ... if one rule exist |
| 190 | * FIXME : warning, if no rules, no accounting ? |
| 191 | */ |
| 192 | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos))) != NULL) { |
| 193 | oldOffset = *myPtrs->offsetV9Ptr; |
| 194 | while (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos))) != NULL){ |
| 195 | /* |
| 196 | * while on one cache table line |
| 197 | */ |
| 198 | *myPtrs->offsetV9Ptr = oldOffset; |
| 199 | switch ((int) |
| 200 | (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->operator)){ |
| 201 | case 2: |
| 202 | /* operator: "=" */ |
| 203 | switch (field_size) { |
| 204 | case 1: |
| 205 | buffer1 = *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 206 | (*myPtrs->offsetV9Ptr)++; |
| 207 | /* rule check */ |
| 208 | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.cvalue |
| 209 | == *((unsigned char*)&buffer1)) { |
| 210 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
| 211 | } |
| 212 | /* end rule check */ |
| 213 | #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP) |
| 214 | if ((pftmp->fieldType==9)||(pftmp->fieldType==29)){ |
| 215 | agCache.maskS = *((unsigned char*)&buffer1); |
| 216 | } |
| 217 | if ((pftmp->fieldType==13)||(pftmp->fieldType==30)){ |
| 218 | agCache.maskD = *((unsigned char*)&buffer1); |
| 219 | } |
| 220 | if (pftmp->fieldType==60){ |
| 221 | agCache.ipProt = *((unsigned char*)&buffer1); |
| 222 | } |
| 223 | if (pftmp->fieldType==4){ |
| 224 | agCache.tProt = *((unsigned char*)&buffer1); |
| 225 | } |
| 226 | if (pftmp->fieldType==61){ |
| 227 | agCache.sens = *((unsigned char*)&buffer1); |
| 228 | } |
| 229 | if (pftmp->fieldType==5){ |
| 230 | agCache.dscp = *((unsigned char*)&buffer1); |
| 231 | } |
| 232 | #endif |
| 233 | break; |
| 234 | case 2: |
| 235 | buffer2[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 236 | (*myPtrs->offsetV9Ptr)++; |
| 237 | buffer2[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 238 | (*myPtrs->offsetV9Ptr)++; |
| 239 | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.svalue |
| 240 | == *((unsigned short*)&buffer2)) |
| 241 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
| 242 | #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP) |
| 243 | if (pftmp->fieldType==10){ |
| 244 | agCache.inputSnmp = *((unsigned short*)&buffer2); |
| 245 | } |
| 246 | if (pftmp->fieldType==14){ |
| 247 | agCache.outputSnmp = *((unsigned short*)&buffer2); |
| 248 | } |
| 249 | #endif |
| 250 | #ifdef ASACC |
| 251 | if (pftmp->fieldType==16){ |
| 252 | agCache.asS = *((unsigned short*)&buffer2); |
| 253 | } |
| 254 | if (pftmp->fieldType==17){ |
| 255 | agCache.asD = *((unsigned short*)&buffer2); |
| 256 | } |
| 257 | #endif |
| 258 | break; |
| 259 | case 3: |
| 260 | buffer4[3]= 0; |
| 261 | buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 262 | (*myPtrs->offsetV9Ptr)++; |
| 263 | buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 264 | (*myPtrs->offsetV9Ptr)++; |
| 265 | buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 266 | (*myPtrs->offsetV9Ptr)++; |
| 267 | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue |
| 268 | == *((unsigned long*)&buffer4)) |
| 269 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
| 270 | /* aggregation */ |
| 271 | /* end aggregation */ |
| 272 | if (pftmp->fieldType==70){ |
| 273 | isMplsFlow = 1; |
| 274 | } |
| 275 | break; |
| 276 | case 4: |
| 277 | buffer4[3]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 278 | (*myPtrs->offsetV9Ptr)++; |
| 279 | buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 280 | (*myPtrs->offsetV9Ptr)++; |
| 281 | buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 282 | (*myPtrs->offsetV9Ptr)++; |
| 283 | buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 284 | (*myPtrs->offsetV9Ptr)++; |
| 285 | /* FIXME : here , add a check on the field type */ |
| 286 | if ((pftmp->fieldType==8)||(pftmp->fieldType==12) |
| 287 | ||(pftmp->fieldType==15)||(pftmp->fieldType==18)){ |
| 288 | if ((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue) |
| 289 | == (*((unsigned long*)&buffer4))>>(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)<<(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask) ) |
| 290 | { |
| 291 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
| 292 | } |
| 293 | } |
| 294 | if ((pftmp->fieldType==10)||(pftmp->fieldType==14)){ |
| 295 | if ((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue) |
| 296 | == (*((unsigned long*)&buffer4))) |
| 297 | { |
| 298 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
| 299 | } |
| 300 | } |
| 301 | if (pftmp->fieldType==1){ |
| 302 | agCache.bytes = *((unsigned long*)&buffer4); |
| 303 | if ( |
| 304 | ((unsigned long)((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue) + ( (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue)*10/100)) |
| 305 | >= (*((unsigned long*)&buffer4))) |
| 306 | && |
| 307 | ( (unsigned long)((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue) - ( (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue)*10/100)) |
| 308 | <= (*((unsigned long*)&buffer4)) ) |
| 309 | ) |
| 310 | { |
| 311 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
| 312 | } |
| 313 | } |
| 314 | #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP) |
| 315 | if ((pftmp->fieldType==8)){ |
| 316 | bool = 1; /* very important, test if we have an IPv4 flow for Agg */ |
| 317 | agCache.v4AdS = *((unsigned long*)&buffer4); |
| 318 | } |
| 319 | if ((pftmp->fieldType==12)){ |
| 320 | agCache.v4AdD = *((unsigned long*)&buffer4); |
| 321 | } |
| 322 | if (pftmp->fieldType==1){ |
| 323 | agCache.bytes = *((unsigned long*)&buffer4); |
| 324 | } |
| 325 | if (pftmp->fieldType==2){ |
| 326 | agCache.pkts = *((unsigned long*)&buffer4); |
| 327 | } |
| 328 | #endif |
| 329 | break; |
| 330 | case 16: |
| 331 | for (i=0; i<4; i++) { |
| 332 | buffer4[3]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 333 | (*myPtrs->offsetV9Ptr)++; |
| 334 | buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 335 | (*myPtrs->offsetV9Ptr)++; |
| 336 | buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 337 | (*myPtrs->offsetV9Ptr)++; |
| 338 | buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 339 | (*myPtrs->offsetV9Ptr)++; |
| 340 | if (1==moreIsNecessary){ |
| 341 | switch(i){ |
| 342 | case 0: |
| 343 | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 32){ |
| 344 | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
| 345 | == |
| 346 | (*((unsigned long*)&buffer4))>>(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)<<(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask) |
| 347 | ) |
| 348 | { |
| 349 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
| 350 | moreIsNecessary = 0; |
| 351 | } else { |
| 352 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
| 353 | moreIsNecessary = 0; |
| 354 | } |
| 355 | } else { |
| 356 | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
| 357 | == |
| 358 | (*((unsigned long*)&buffer4)) |
| 359 | ) |
| 360 | { |
| 361 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
| 362 | } else { |
| 363 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
| 364 | moreIsNecessary = 0; |
| 365 | } |
| 366 | } |
| 367 | break; |
| 368 | case 1: |
| 369 | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 64){ |
| 370 | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
| 371 | == |
| 372 | (*((unsigned long*)&buffer4))>>(64-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)<<(64-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask) |
| 373 | ) |
| 374 | { |
| 375 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = |
| 376 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1; |
| 377 | moreIsNecessary = 0; |
| 378 | } else { |
| 379 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
| 380 | moreIsNecessary = 0; |
| 381 | } |
| 382 | } else { |
| 383 | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
| 384 | == |
| 385 | (*((unsigned long*)&buffer4)) |
| 386 | ) |
| 387 | { |
| 388 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = |
| 389 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1; |
| 390 | } else { |
| 391 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
| 392 | moreIsNecessary = 0; |
| 393 | } |
| 394 | } |
| 395 | break; |
| 396 | case 2: |
| 397 | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 96){ |
| 398 | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
| 399 | == |
| 400 | (*((unsigned long*)&buffer4))>>(96-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)<<(96-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask) |
| 401 | ) |
| 402 | { |
| 403 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = |
| 404 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1; |
| 405 | moreIsNecessary = 0; |
| 406 | } else { |
| 407 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
| 408 | moreIsNecessary = 0; |
| 409 | } |
| 410 | } else { |
| 411 | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
| 412 | == |
| 413 | (*((unsigned long*)&buffer4)) |
| 414 | ) |
| 415 | { |
| 416 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = |
| 417 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1; |
| 418 | } else { |
| 419 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
| 420 | moreIsNecessary = 0; |
| 421 | } |
| 422 | } |
| 423 | break; |
| 424 | case 3: |
| 425 | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 128){ |
| 426 | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
| 427 | == |
| 428 | (*((unsigned long*)&buffer4))>>(128-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)<<(128-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask) |
| 429 | ) |
| 430 | { |
| 431 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = |
| 432 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1; |
| 433 | } else { |
| 434 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
| 435 | moreIsNecessary = 0; |
| 436 | } |
| 437 | } else { |
| 438 | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
| 439 | == |
| 440 | (*((unsigned long*)&buffer4)) |
| 441 | ) |
| 442 | { |
| 443 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = |
| 444 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1; |
| 445 | } else { |
| 446 | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
| 447 | moreIsNecessary = 0; |
| 448 | } |
| 449 | } |
| 450 | break; |
| 451 | default: |
| 452 | break; |
| 453 | } /* end of switch(i) */ |
| 454 | } /* end of if moreIsNecessary */ |
| 455 | } |
| 456 | moreIsNecessary = 1; |
| 457 | /* aggregation for IPv6 flows */ |
| 458 | |
| 459 | /* end aggregation */ |
| 460 | break; |
| 461 | default: |
| 462 | syslog(LOG_INFO, "Field size not known: %d\n", field_size); |
| 463 | for (i=0; i<field_size; i++){ |
| 464 | (*myPtrs->offsetV9Ptr)++; |
| 465 | } |
| 466 | break; |
| 467 | } |
| 468 | break; |
| 469 | default: |
| 470 | syslog(LOG_INFO, "Operator not known: %d\n", |
| 471 | (int)(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->operator)); |
| 472 | break; |
| 473 | } |
| 474 | j++; |
| 475 | pos = (pftmp->fieldType)*10+j; |
| 476 | } /* end while myPtrs->rulesAddressPtr */ |
| 477 | } else { |
| 478 | /* |
| 479 | * no rule within this field type, but we must read the value |
| 480 | */ |
| 481 | switch (field_size) { |
| 482 | case 1: |
| 483 | buffer1 = *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 484 | (*myPtrs->offsetV9Ptr)++; |
| 485 | #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP) |
| 486 | if ((pftmp->fieldType==9)||(pftmp->fieldType==29)){ |
| 487 | agCache.maskS = *((unsigned char*)&buffer1); |
| 488 | } |
| 489 | if ((pftmp->fieldType==13)||(pftmp->fieldType==30)){ |
| 490 | agCache.maskD = *((unsigned char*)&buffer1); |
| 491 | } |
| 492 | if (pftmp->fieldType==60){ |
| 493 | agCache.ipProt = *((unsigned char*)&buffer1); |
| 494 | } |
| 495 | if (pftmp->fieldType==4){ |
| 496 | agCache.tProt = *((unsigned char*)&buffer1); |
| 497 | } |
| 498 | if (pftmp->fieldType==61){ |
| 499 | agCache.sens = *((unsigned char*)&buffer1); |
| 500 | } |
| 501 | if (pftmp->fieldType==5){ |
| 502 | agCache.dscp = *((unsigned char*)&buffer1); |
| 503 | } |
| 504 | #endif |
| 505 | break; |
| 506 | case 2: |
| 507 | buffer2[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 508 | (*myPtrs->offsetV9Ptr)++; |
| 509 | buffer2[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 510 | (*myPtrs->offsetV9Ptr)++; |
| 511 | #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP) |
| 512 | if (pftmp->fieldType==10){ |
| 513 | agCache.inputSnmp = *((unsigned short*)&buffer2); |
| 514 | } |
| 515 | if (pftmp->fieldType==14){ |
| 516 | agCache.outputSnmp = *((unsigned short*)&buffer2); |
| 517 | } |
| 518 | #endif |
| 519 | #ifdef ASACC |
| 520 | if (pftmp->fieldType==16){ |
| 521 | agCache.asS = *((unsigned short*)&buffer2); |
| 522 | } |
| 523 | if (pftmp->fieldType==17){ |
| 524 | agCache.asD = *((unsigned short*)&buffer2); |
| 525 | } |
| 526 | #endif |
| 527 | break; |
| 528 | case 3: |
| 529 | buffer4[3]= 0; |
| 530 | buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 531 | (*myPtrs->offsetV9Ptr)++; |
| 532 | buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 533 | (*myPtrs->offsetV9Ptr)++; |
| 534 | buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 535 | (*myPtrs->offsetV9Ptr)++; |
| 536 | /* aggregation */ |
| 537 | /* end aggregation */ |
| 538 | if (pftmp->fieldType==70){ |
| 539 | isMplsFlow = 1; |
| 540 | } |
| 541 | break; |
| 542 | case 4: |
| 543 | buffer4[3]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 544 | (*myPtrs->offsetV9Ptr)++; |
| 545 | buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 546 | (*myPtrs->offsetV9Ptr)++; |
| 547 | buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 548 | (*myPtrs->offsetV9Ptr)++; |
| 549 | buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 550 | (*myPtrs->offsetV9Ptr)++; |
| 551 | #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP) |
| 552 | if ((pftmp->fieldType==8)){ |
| 553 | bool = 1; |
| 554 | agCache.v4AdS = *((unsigned long*)&buffer4); |
| 555 | } else if ((pftmp->fieldType==12)){ |
| 556 | agCache.v4AdD = *((unsigned long*)&buffer4); |
| 557 | } else if (pftmp->fieldType==1){ |
| 558 | agCache.bytes = *((unsigned long*)&buffer4); |
| 559 | } else if (pftmp->fieldType==2){ |
| 560 | agCache.pkts = *((unsigned long*)&buffer4); |
| 561 | } |
| 562 | #endif |
| 563 | break; |
| 564 | case 16: |
| 565 | for (i=0; i<4; i++) { |
| 566 | buffer2[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 567 | (*myPtrs->offsetV9Ptr)++; |
| 568 | buffer2[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 569 | (*myPtrs->offsetV9Ptr)++; |
| 570 | buffer2[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 571 | (*myPtrs->offsetV9Ptr)++; |
| 572 | buffer2[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
| 573 | (*myPtrs->offsetV9Ptr)++; |
| 574 | } |
| 575 | /* aggregation IPv6 */ |
| 576 | /* end aggregation */ |
| 577 | break; |
| 578 | default: |
| 579 | syslog(LOG_INFO,"UNKNOWN FIELDS LENGTH: %d ", field_size); |
| 580 | for (i=0; i<field_size; i++){ |
| 581 | (*myPtrs->offsetV9Ptr)++; |
| 582 | } |
103 | | |
104 | | if ( (tmp=existTplId(myPtrs->currentRouterPtr, |
105 | | myPtrs->currentHeaderV9Ptr->sourceId, |
106 | | (*myPtrs->currentFlowsetIdPtr)))!=NULL ) { |
| 584 | } /* end if one cache table line existence */ |
| 585 | if (cpt==tmp->fieldCount) { |
| 586 | /* |
| 587 | * end of one flow (not the flowset) |
| 588 | */ |
| 589 | |
| 590 | /* put aggregation cache information to IPv4 Prefixes table */ |
| 591 | /* Aggregation mode must be enable in ./configure options */ |
| 592 | /* first we must know if the address belong to our prefix */ |
| 593 | /* |
| 594 | * AS ACCOUNTING |
| 595 | */ |
| 596 | #if defined(ASACC) && defined(IPV4AGGIDSNMP) |
| 597 | if ( (bool == 1) && (isMplsFlow == 0) ){ |
| 598 | asKey.as = agCache.asS; |
| 599 | asres = bsearch(&asKey, myPtrs->currentASTab, myPtrs->asNb, sizeof(struct AS), asGlobalCmp); |
| 600 | if (asres != NULL) { |
| 601 | if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1 ) { |
| 602 | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
| 603 | /* OUT ("traffic from the AS") */ |
| 604 | asres->bytesNbOUT += agCache.bytes; |
| 605 | asres->pktsNbOUT += agCache.pkts; |
| 606 | (asres->flowNbOUT)++; |
| 607 | } |
| 608 | if (asres->sampling == 0 |
| 609 | && myPtrs->currentRouterPtr->sampled != 0){ |
| 610 | asres->sampling = myPtrs->currentRouterPtr->sampled; |
| 611 | } |
| 612 | asres = NULL; |
| 613 | asKey.as = agCache.asD; |
| 614 | asres = bsearch(&asKey, myPtrs->currentASTab, myPtrs->asNb, sizeof(struct AS), asGlobalCmp); |
| 615 | if (asres!=NULL){ |
| 616 | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
| 617 | /* IN ("traffic to the AS") */ |
| 618 | asres->bytesNbIN += agCache.bytes; |
| 619 | asres->pktsNbIN += agCache.pkts; |
| 620 | (asres->flowNbIN)++; |
| 621 | } |
| 622 | if (asres->sampling == 0 |
| 623 | && myPtrs->currentRouterPtr->sampled != 0){ |
| 624 | asres->sampling = myPtrs->currentRouterPtr->sampled; |
| 625 | } |
| 626 | asres = NULL; |
| 627 | } |
| 628 | } |
| 629 | } else { |
| 630 | asres = NULL; |
| 631 | asKey.as = agCache.asD; |
| 632 | asres = bsearch(&asKey, myPtrs->currentASTab, myPtrs->asNb, sizeof(struct AS), asGlobalCmp); |
| 633 | if (asres!=NULL){ |
| 634 | if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1 ) { |
| 635 | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
| 636 | /* IN ("traffic to the AS") */ |
| 637 | asres->bytesNbIN += agCache.bytes; |
| 638 | asres->pktsNbIN += agCache.pkts; |
| 639 | (asres->flowNbIN)++; |
| 640 | } |
| 641 | if (asres->sampling == 0 |
| 642 | && myPtrs->currentRouterPtr->sampled != 0){ |
| 643 | asres->sampling = myPtrs->currentRouterPtr->sampled; |
| 644 | } |
| 645 | } |
| 646 | } |
| 647 | } |
| 648 | } |
| 649 | #endif |
| 650 | /* |
| 651 | * PREFIX &/or MATRIX ACCOUNTING |
| 652 | */ |
| 653 | #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP) |
| 654 | if ( (bool == 1) && (isMplsFlow == 0) ){ |
| 655 | prefixKey.beginning = agCache.v4AdS>>(32-agCache.maskS)<<(32-agCache.maskS); |
| 656 | res = bsearch(&prefixKey, V4PTab, nbPV4, |
| 657 | sizeof(struct PrefixV4), prefGlobalCmp); |
| 658 | if (res!=NULL){ |
| 659 | /* res is supernet or subnet ? */ |
| 660 | if (res->hasSubnet == 1) { |
| 661 | resSub = NULL; |
| 662 | resSub = bsearch(&prefixKey, V4STab, nbSV4, |
| 663 | sizeof(struct PrefixV4), prefGlobalCmp); |
| 664 | if (resSub != NULL) { |
| 665 | res = resSub; |
| 666 | resSub = NULL; |
| 667 | } |
| 668 | } |
| 669 | #if defined(IPV4AGGIDR) |
| 670 | if ( myPtrs->routersID[res->routerNb] == agCache.routerAd ) { |
| 671 | #elif defined(IPV4AGGIDSNMP) |
| 672 | if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1 ) { |
| 673 | #endif |
| 674 | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
| 675 | /* OUT ("traffic from the prefix/subnet") */ |
| 676 | res->bytesNbOUT += agCache.bytes; |
| 677 | res->pktsNbOUT += agCache.pkts; |
| 678 | (res->flowNbOUT)++; |
| 679 | } |
| 680 | if (res->sampling == 0 |
| 681 | && myPtrs->currentRouterPtr->sampled != 0){ |
| 682 | res->sampling = myPtrs->currentRouterPtr->sampled; |
| 683 | } |
| 684 | #if defined(IPV4AGGIDSNMP) |
| 685 | prefixKey.beginning = agCache.v4AdD>>(32-agCache.maskD)<<(32-agCache.maskD); |
| 686 | res3 = bsearch(&prefixKey, V4PTab, nbPV4, |
| 687 | sizeof(struct PrefixV4), prefGlobalCmp); |
| 688 | if (res3!=NULL){ |
| 689 | /* res is supernet or subnet ? */ |
| 690 | if (res3->hasSubnet == 1) { |
| 691 | resSub = NULL; |
| 692 | resSub = bsearch(&prefixKey, V4STab, nbSV4, |
| 693 | sizeof(struct PrefixV4), prefGlobalCmp); |
| 694 | if (resSub != NULL) { |
| 695 | res3 = resSub; |
| 696 | resSub = NULL; |
| 697 | } |
| 698 | } |
| 699 | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
| 700 | /* IN ("traffic to the prefix/subnet") */ |
| 701 | res3->bytesNbIN += agCache.bytes; |
| 702 | res3->pktsNbIN += agCache.pkts; |
| 703 | (res3->flowNbIN)++; |
| 704 | } |
| 705 | if (res3->sampling == 0 |
| 706 | && myPtrs->currentRouterPtr->sampled != 0){ |
| 707 | res3->sampling = myPtrs->currentRouterPtr->sampled; |
| 708 | } |
| 709 | } |
| 710 | #endif |
| 711 | #if defined(MATRIX) && defined(IPV4AGGIDR) |
| 712 | /* inter-pop matrix Accounting */ |
| 713 | prefixKey.beginning = agCache.v4AdD>>(32-agCache.maskD)<<(32-agCache.maskD); |
| 714 | res2 = bsearch(&prefixKey, V4PTab, nbPV4, |
| 715 | sizeof(struct PrefixV4), prefGlobalCmp); |
| 716 | if (res2!=NULL){ |
| 717 | ((struct POP *)((myPtrs->matrixPOP) |
| 718 | +((res->routerNb)*ROUTER_INDEX_MAX) |
| 719 | +((res2->routerNb))))->pktsNb += agCache.pkts; |
| 720 | ((struct POP *)((myPtrs->matrixPOP) |
| 721 | +((res->routerNb)*ROUTER_INDEX_MAX) |
| 722 | +((res2->routerNb))))->bytesNb += agCache.bytes; |
| 723 | ((struct POP *)((myPtrs->matrixPOP) |
| 724 | +((res->routerNb)*ROUTER_INDEX_MAX) |
| 725 | +((res2->routerNb))))->flowNb++; |
| 726 | } else { |
| 727 | ( |
| 728 | ((struct POP *)(myPtrs->matrixPOP) |
| 729 | +((res->routerNb)*ROUTER_INDEX_MAX) |
| 730 | +((ROUTER_INDEX_MAX-1))))->pktsNb += agCache.pkts; |
| 731 | ( |
| 732 | ((struct POP *)(myPtrs->matrixPOP) |
| 733 | +((res->routerNb)*ROUTER_INDEX_MAX) |
| 734 | +((ROUTER_INDEX_MAX-1))))->bytesNb += agCache.bytes; |
| 735 | ( |
| 736 | ((struct POP *)(myPtrs->matrixPOP) |
| 737 | +((res->routerNb)*ROUTER_INDEX_MAX) |
| 738 | +((ROUTER_INDEX_MAX-1))))->flowNb++; |
| 739 | } |
| 740 | /* end interpop matrix accounting */ |
| 741 | #endif /* matrix */ |
| 742 | } else { |
| 743 | /* doublon or bad reference in prefix list */ |
| 744 | #if defined(IPV4AGGIDR) |
| 745 | } |
| 746 | #elif defined(IPV4AGGIDSNMP) |
| 747 | } |
| 748 | #endif |
| 749 | } else { /* res==NULL, the prefix in source don't exist in your prefix list */ |
| 750 | prefixKey.beginning = agCache.v4AdD>>(32-agCache.maskD)<<(32-agCache.maskD); |
| 751 | res = bsearch(&prefixKey, V4PTab, nbPV4, |
| 752 | sizeof(struct PrefixV4), prefGlobalCmp); |
| 753 | if (res!=NULL){ |
| 754 | /* res is supernet or subnet ? */ |
| 755 | if (res->hasSubnet == 1) { |
| 756 | resSub = NULL; |
| 757 | resSub = bsearch(&prefixKey, V4STab, nbSV4, |
| 758 | sizeof(struct PrefixV4), prefGlobalCmp); |
| 759 | if (resSub != NULL) { |
| 760 | res = resSub; |
| 761 | resSub = NULL; |
| 762 | } |
| 763 | } |
| 764 | #if defined(IPV4AGGIDSNMP) |
| 765 | if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1 ) { |
| 766 | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
| 767 | /* IN ("traffic to the prefix/subnet") */ |
| 768 | res->bytesNbIN += agCache.bytes; |
| 769 | res->pktsNbIN += agCache.pkts; |
| 770 | (res->flowNbIN)++; |
| 771 | } |
| 772 | } |
| 773 | #endif |
| 774 | #if defined(IPV4AGGIDR) |
| 775 | if ( myPtrs->routersID[res->routerNb] == agCache.routerAd ) { |
| 776 | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
| 777 | /* IN ("traffic to the prefix") */ |
| 778 | res->bytesNbIN += agCache.bytes; |
| 779 | res->pktsNbIN += agCache.pkts; |
| 780 | (res->flowNbIN)++; |
| 781 | } |
| 782 | } |
| 783 | #endif |
| 784 | if (res->sampling == 0 |
| 785 | && myPtrs->currentRouterPtr->sampled != 0 ){ |
| 786 | res->sampling = myPtrs->currentRouterPtr->sampled; |
| 787 | } |
| 788 | } else { |
| 789 | /* UNKNOW SUBNET CASE */ |
| 790 | /* */ |
| 791 | /* HERE : we are in the cases of the address/mask don't */ |
| 792 | /* belong to a prefix listed in the IPv4 prefix file */ |
| 793 | /* possibilities : */ |
| 794 | /* - prefix not referenced but allowed to be routed */ |
| 795 | /* - prefix not referenced but not allowed to be routed */ |
| 796 | /* - spoofing */ |
| 797 | #ifdef PRINTUNKNOWNSUBNET |
| 798 | fprintf(stderr, "%lu.%lu.%lu.%lu/%hu -> %lu.%lu.%lu.%lu/%hu (R:%lu.%lu.%lu.%lu) \n", |
| 799 | (agCache.v4AdS>>24), |
| 800 | (agCache.v4AdS<<8>>24), |
| 801 | (agCache.v4AdS<<16>>24), |
| 802 | (agCache.v4AdS<<24>>24), |
| 803 | (agCache.maskS), |
| 804 | (agCache.v4AdD>>24), |
| 805 | (agCache.v4AdD<<8>>24), |
| 806 | (agCache.v4AdD<<16>>24), |
| 807 | (agCache.v4AdD<<24>>24), |
| 808 | (agCache.maskD), |
| 809 | (myPtrs->pcktPtr->ipH->srcAdd>>24), |
| 810 | (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), |
| 811 | (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), |
| 812 | (myPtrs->pcktPtr->ipH->srcAdd<<24>>24) |
| 813 | ); |
| 814 | #endif /* PRINTUNKNOWNSUBNET */ |
| 815 | } |
| 816 | } /* end of the Destination prefix is in our list */ |
| 817 | } /* end of the prefix is in our list */ |
| 818 | bool = 0; |
| 819 | isMplsFlow = 0; |
| 820 | #endif /* (IPV4AGGIDR) || (IPV4AGGIDSNMP) */ |
| 821 | /* |
| 822 | * |
| 823 | * SOCKET OUTPUT TO A REMOTE CLIENT |
| 824 | * |
| 825 | * switch the rules definition (check & fieldToRecord), |
| 826 | * we send the flow or a part of the flow to a remote host or a file. |
| 827 | * In a first time (until release 0.0.7, the information was sent via |
| 828 | * the process renetcolSender with an IPC message queue. But, the perf |
| 829 | * of IPC Msg was very bad with a default system compilation. |
| 830 | * So, now, we send information directly from here through sockets. |
| 831 | */ |
| 832 | tmpRuleList = myPtrs->rulesListPtr; |
| 833 | tmpRL = myPtrs->rulesListPtr; |
| 834 | while (tmpRuleList){ |
| 835 | RuleDefPtr tmpRuleDefList = tmpRuleList->def; |
| 836 | unsigned short check = 1; |
| 837 | int s=0; |
| 838 | secondOffset = secondOldOffset; |
| 839 | while (tmpRuleDefList){ |
| 840 | check = check && tmpRuleDefList->check; |
| 841 | tmpRuleDefList->check = 0; |
| 842 | tmpRuleDefList = tmpRuleDefList->next; |
| 843 | } |
| 844 | if ( (tmpRuleList->def != NULL) && (check == 1)) { |
| 845 | /* msg building */ |
| 846 | secondPftmp = tmp->lastField; |
| 847 | msgTextIndex = mempcpy(mempcpy(mempcpy(myMsg.text, |
| 848 | &tplMsgType, |
| 849 | sizeof(unsigned short) |
| 850 | ), |
| 851 | &tmpRuleList->id, |
| 852 | sizeof(tmpRuleList->id) |
| 853 | ), |
| 854 | &myPtrs->currentRouterPtr->IpAddress, |
| 855 | sizeof(unsigned long) |
| 856 | ); |
| 857 | msgTextIndex = mempcpy(mempcpy(mempcpy(msgTextIndex, |
| 858 | &tmp->sourceId, |
| 859 | sizeof(unsigned long) |
| 860 | ), |
| 861 | &tmp->templateFlowSetId, |
| 862 | sizeof(tmp->templateFlowSetId) |
| 863 | ), |
| 864 | myPtrs->ptr_buffer+secondOffset, |
| 865 | flow_size |
| 866 | ); |
| 867 | myMsg.type = 1; |
| 868 | |
| 869 | |
| 870 | /* NEW transfert type */ |
| 871 | for ( ; tmpRL; tmpRL=tmpRL->next){ |
| 872 | if (tmpRL->id == tmpRuleList->id){ |
| 873 | s = sendMessage(tmpRL->host->sockId, myMsg.text, sizeof(myMsg.text), |
| 874 | tmpRL->host->hostAddressPtr); |
| 875 | } |
| 876 | } |
| 877 | /* FIXME : perhaps check "s" */ |
| 878 | noEnd = 1; |
| 879 | secondCpt=0; |
| 880 | } /* end if check */ |
| 881 | tmpRuleList = tmpRuleList->next; |
| 882 | tmpRL = myPtrs->rulesListPtr; /* ticket #11 */ |
| 883 | secondPftmp = tmp->lastField; |
| 884 | } /* end while tmpRuleList */ |
| 885 | /* |
| 886 | * end redirection |
| 887 | */ |
| 888 | secondOffset = *myPtrs->offsetV9Ptr; |
| 889 | secondOldOffset = secondOffset; |
| 890 | pftmp = tmp->lastField; |
| 891 | cpt=0; |
| 892 | (*myPtrs->currentFlowsetNumberPtr)++; /* pointer on the flows number */ |
| 893 | if (((*myPtrs->offsetV9Ptr)-48-shift+flow_size) > data_length){ |
| 894 | overflow = 1; /* buffer index not correct */ |
| 895 | } |
| 896 | } else { |
| 897 | /* not the flow end, progress in field list */ |
| 898 | pftmp = pftmp->prev; |
| 899 | } |
| 900 | } /* end of the while on one flow record */ |
| 901 | |
| 902 | while ( ((*myPtrs->offsetV9Ptr)-48-shift) < data_length ) { |
| 903 | (*myPtrs->offsetV9Ptr)++; /* if padding */ |
| 904 | paddingCounter++; |
| 905 | if ( paddingCounter > 8 ) { |
108 | | fprintf(stderr, |
109 | | "{d id: %hu, lg %hu", |
110 | | (*myPtrs->currentFlowsetIdPtr), |
111 | | data_length); |
112 | | if ( (*myPtrs->currentFlowsetIdPtr) > TRESHOLD_TEMPLATE_ID ) { |
113 | | /* fprintf(stderr,"Bad TID from router: %lu.%lu.%lu.%lu\n", */ |
114 | | /* (*myPtrs->currentFlowsetIdPtr), */ |
115 | | /* (myPtrs->pcktPtr->ipH->srcAdd>>24), */ |
116 | | /* (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), */ |
117 | | /* (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), */ |
118 | | /* (myPtrs->pcktPtr->ipH->srcAdd<<24>>24)); */ |
119 | | /* fprintf(stderr," Bytes : \n"); */ |
120 | | /* while ( ( myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr) ) > (myPtrs->ptr_buffer+1416) ){ */ |
121 | | /* buffer1= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));(*myPtrs->offsetV9Ptr)++; */ |
122 | | /* tmp = *((unsigned char*)&buffer1); */ |
123 | | /* fprintf (stderr, " %s ", tmp); */ |
124 | | /* } */ |
125 | | /* exit(-1); */ |
126 | | return (data_length+shift); |
127 | | } |
128 | | #endif |
129 | | pftmp = tmp->lastField; |
130 | | for (; pftmp; pftmp = pftmp->prev) { |
131 | | flow_size += pftmp->fieldLength; |
132 | | } |
133 | | if ( data_length%flow_size >= 9 ) { |
134 | | (*myPtrs->currentFlowsetNumberPtr) = myPtrs->currentHeaderV9Ptr->count; |
135 | | syslog(LOG_INFO, "data flowset length not match with length from template definition, wrong template definition suspected; all next informations of this data flowset are not considered! flowset ID: %hu, from router: %lu.%lu.%lu.%lu", |
136 | | (*myPtrs->currentFlowsetIdPtr), |
137 | | (myPtrs->pcktPtr->ipH->srcAdd>>24), |
138 | | (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), |
139 | | (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), |
140 | | (myPtrs->pcktPtr->ipH->srcAdd<<24>>24)); |
141 | | return (data_length+shift); |
142 | | } |
143 | | if ( data_length >= 1452 ) { |
144 | | syslog(LOG_INFO, "data flowset length too raised; all next informations of this data flowset are not considered! flowset ID: %hu, from router: %lu.%lu.%lu.%lu", |
145 | | (*myPtrs->currentFlowsetIdPtr), |
146 | | (myPtrs->pcktPtr->ipH->srcAdd>>24), |
147 | | (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), |
148 | | (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), |
149 | | (myPtrs->pcktPtr->ipH->srcAdd<<24>>24)); |
150 | | return (-1); |
151 | | } |
152 | | #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP) |
153 | | agCache.routerAd = myPtrs->pcktPtr->ipH->srcAdd; |
154 | | #endif |
155 | | |
156 | | pftmp = tmp->lastField; |
157 | | secondPftmp = tmp->lastField; |
158 | | secondOffset = *myPtrs->offsetV9Ptr; |
159 | | secondOldOffset = secondOffset; |
160 | | while ( (((*myPtrs->offsetV9Ptr)-48-shift) <= data_length) |
161 | | && (overflow!=1) ) { |
162 | | /* |
163 | | * progression in a data flow Set |
164 | | * notes: |
165 | | * 48= IP header size + NetFlow header size |
166 | | * shift = shift because we have a template declaration |
167 | | * inside data templates |
168 | | */ |
169 | | cpt++; |
170 | | j = 0; |
171 | | pos = (pftmp->fieldType)*MAX_RULES_PER_FIELD+j; |
172 | | field_size = (int) pftmp->fieldLength; |
173 | | |
174 | | /* special case: check yes on all flows from one router */ |
175 | | /* (phantom field nb 0) */ |
176 | | /* FIXME : this code is repeated, perhaps past before */ |
177 | | while ( ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+j))) != NULL ) { |
178 | | if ( (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+j)))->value->stor.lvalue) |
179 | | == myPtrs->pcktPtr->ipH->srcAdd ) |
180 | | { |
181 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+j)))->check = 1; |
182 | | } |
183 | | j++; |
184 | | } |
185 | | j = 0; |
186 | | |
187 | | /* |
188 | | * Comparaison between the field value and the rules |
189 | | * ... if one rule exist |
190 | | * FIXME : warning, if no rules, no accounting ? |
191 | | */ |
192 | | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos))) != NULL) { |
193 | | oldOffset = *myPtrs->offsetV9Ptr; |
194 | | while (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos))) != NULL){ |
195 | | /* |
196 | | * while on one cache table line |
197 | | */ |
198 | | *myPtrs->offsetV9Ptr = oldOffset; |
199 | | switch ((int) |
200 | | (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->operator)){ |
201 | | case 2: |
202 | | /* operator: "=" */ |
203 | | switch (field_size) { |
204 | | case 1: |
205 | | buffer1 = *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
206 | | (*myPtrs->offsetV9Ptr)++; |
207 | | /* rule check */ |
208 | | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.cvalue |
209 | | == *((unsigned char*)&buffer1)) { |
210 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
211 | | } |
212 | | /* end rule check */ |
213 | | #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP) |
214 | | if ((pftmp->fieldType==9)||(pftmp->fieldType==29)){ |
215 | | agCache.maskS = *((unsigned char*)&buffer1); |
216 | | } |
217 | | if ((pftmp->fieldType==13)||(pftmp->fieldType==30)){ |
218 | | agCache.maskD = *((unsigned char*)&buffer1); |
219 | | } |
220 | | if (pftmp->fieldType==60){ |
221 | | agCache.ipProt = *((unsigned char*)&buffer1); |
222 | | } |
223 | | if (pftmp->fieldType==4){ |
224 | | agCache.tProt = *((unsigned char*)&buffer1); |
225 | | } |
226 | | if (pftmp->fieldType==61){ |
227 | | agCache.sens = *((unsigned char*)&buffer1); |
228 | | } |
229 | | if (pftmp->fieldType==5){ |
230 | | agCache.dscp = *((unsigned char*)&buffer1); |
231 | | } |
232 | | #endif |
233 | | break; |
234 | | case 2: |
235 | | buffer2[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
236 | | (*myPtrs->offsetV9Ptr)++; |
237 | | buffer2[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
238 | | (*myPtrs->offsetV9Ptr)++; |
239 | | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.svalue |
240 | | == *((unsigned short*)&buffer2)) |
241 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
242 | | #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP) |
243 | | if (pftmp->fieldType==10){ |
244 | | agCache.inputSnmp = *((unsigned short*)&buffer2); |
245 | | } |
246 | | if (pftmp->fieldType==14){ |
247 | | agCache.outputSnmp = *((unsigned short*)&buffer2); |
248 | | } |
249 | | #endif |
250 | | #ifdef ASACC |
251 | | if (pftmp->fieldType==16){ |
252 | | agCache.asS = *((unsigned short*)&buffer2); |
253 | | } |
254 | | if (pftmp->fieldType==17){ |
255 | | agCache.asD = *((unsigned short*)&buffer2); |
256 | | } |
257 | | #endif |
258 | | break; |
259 | | case 3: |
260 | | buffer4[3]= 0; |
261 | | buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
262 | | (*myPtrs->offsetV9Ptr)++; |
263 | | buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
264 | | (*myPtrs->offsetV9Ptr)++; |
265 | | buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
266 | | (*myPtrs->offsetV9Ptr)++; |
267 | | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue |
268 | | == *((unsigned long*)&buffer4)) |
269 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
270 | | /* aggregation */ |
271 | | /* end aggregation */ |
272 | | if (pftmp->fieldType==70){ |
273 | | isMplsFlow = 1; |
274 | | } |
275 | | break; |
276 | | case 4: |
277 | | buffer4[3]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
278 | | (*myPtrs->offsetV9Ptr)++; |
279 | | buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
280 | | (*myPtrs->offsetV9Ptr)++; |
281 | | buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
282 | | (*myPtrs->offsetV9Ptr)++; |
283 | | buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
284 | | (*myPtrs->offsetV9Ptr)++; |
285 | | /* FIXME : here , add a check on the field type */ |
286 | | if ((pftmp->fieldType==8)||(pftmp->fieldType==12) |
287 | | ||(pftmp->fieldType==15)||(pftmp->fieldType==18)){ |
288 | | if ((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue) |
289 | | == (*((unsigned long*)&buffer4))>>(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)<<(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask) ) |
290 | | { |
291 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
292 | | } |
293 | | } |
294 | | if ((pftmp->fieldType==10)||(pftmp->fieldType==14)){ |
295 | | if ((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue) |
296 | | == (*((unsigned long*)&buffer4))) |
297 | | { |
298 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
299 | | } |
300 | | } |
301 | | if (pftmp->fieldType==1){ |
302 | | agCache.bytes = *((unsigned long*)&buffer4); |
303 | | if ( |
304 | | ((unsigned long)((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue) + ( (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue)*10/100)) |
305 | | >= (*((unsigned long*)&buffer4))) |
306 | | && |
307 | | ( (unsigned long)((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue) - ( (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue)*10/100)) |
308 | | <= (*((unsigned long*)&buffer4)) ) |
309 | | ) |
310 | | { |
311 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
312 | | } |
313 | | } |
314 | | #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP) |
315 | | if ((pftmp->fieldType==8)){ |
316 | | bool = 1; /* very important, test if we have an IPv4 flow for Agg */ |
317 | | agCache.v4AdS = *((unsigned long*)&buffer4); |
318 | | } |
319 | | if ((pftmp->fieldType==12)){ |
320 | | agCache.v4AdD = *((unsigned long*)&buffer4); |
321 | | } |
322 | | if (pftmp->fieldType==1){ |
323 | | agCache.bytes = *((unsigned long*)&buffer4); |
324 | | } |
325 | | if (pftmp->fieldType==2){ |
326 | | agCache.pkts = *((unsigned long*)&buffer4); |
327 | | } |
328 | | #endif |
329 | | break; |
330 | | case 16: |
331 | | for (i=0; i<4; i++) { |
332 | | buffer4[3]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
333 | | (*myPtrs->offsetV9Ptr)++; |
334 | | buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
335 | | (*myPtrs->offsetV9Ptr)++; |
336 | | buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
337 | | (*myPtrs->offsetV9Ptr)++; |
338 | | buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
339 | | (*myPtrs->offsetV9Ptr)++; |
340 | | if (1==moreIsNecessary){ |
341 | | switch(i){ |
342 | | case 0: |
343 | | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 32){ |
344 | | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
345 | | == |
346 | | (*((unsigned long*)&buffer4))>>(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)<<(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask) |
347 | | ) |
348 | | { |
349 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
350 | | moreIsNecessary = 0; |
351 | | } else { |
352 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
353 | | moreIsNecessary = 0; |
354 | | } |
355 | | } else { |
356 | | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
357 | | == |
358 | | (*((unsigned long*)&buffer4)) |
359 | | ) |
360 | | { |
361 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1; |
362 | | } else { |
363 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
364 | | moreIsNecessary = 0; |
365 | | } |
366 | | } |
367 | | break; |
368 | | case 1: |
369 | | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 64){ |
370 | | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
371 | | == |
372 | | (*((unsigned long*)&buffer4))>>(64-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)<<(64-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask) |
373 | | ) |
374 | | { |
375 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = |
376 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1; |
377 | | moreIsNecessary = 0; |
378 | | } else { |
379 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
380 | | moreIsNecessary = 0; |
381 | | } |
382 | | } else { |
383 | | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
384 | | == |
385 | | (*((unsigned long*)&buffer4)) |
386 | | ) |
387 | | { |
388 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = |
389 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1; |
390 | | } else { |
391 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
392 | | moreIsNecessary = 0; |
393 | | } |
394 | | } |
395 | | break; |
396 | | case 2: |
397 | | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 96){ |
398 | | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
399 | | == |
400 | | (*((unsigned long*)&buffer4))>>(96-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)<<(96-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask) |
401 | | ) |
402 | | { |
403 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = |
404 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1; |
405 | | moreIsNecessary = 0; |
406 | | } else { |
407 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
408 | | moreIsNecessary = 0; |
409 | | } |
410 | | } else { |
411 | | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
412 | | == |
413 | | (*((unsigned long*)&buffer4)) |
414 | | ) |
415 | | { |
416 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = |
417 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1; |
418 | | } else { |
419 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
420 | | moreIsNecessary = 0; |
421 | | } |
422 | | } |
423 | | break; |
424 | | case 3: |
425 | | if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 128){ |
426 | | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
427 | | == |
428 | | (*((unsigned long*)&buffer4))>>(128-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)<<(128-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask) |
429 | | ) |
430 | | { |
431 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = |
432 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1; |
433 | | } else { |
434 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
435 | | moreIsNecessary = 0; |
436 | | } |
437 | | } else { |
438 | | if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) |
439 | | == |
440 | | (*((unsigned long*)&buffer4)) |
441 | | ) |
442 | | { |
443 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = |
444 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1; |
445 | | } else { |
446 | | ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0; |
447 | | moreIsNecessary = 0; |
448 | | } |
449 | | } |
450 | | break; |
451 | | default: |
452 | | break; |
453 | | } /* end of switch(i) */ |
454 | | } /* end of if moreIsNecessary */ |
455 | | } |
456 | | moreIsNecessary = 1; |
457 | | /* aggregation for IPv6 flows */ |
458 | | |
459 | | /* end aggregation */ |
460 | | break; |
461 | | default: |
462 | | syslog(LOG_INFO, "Field size not known: %d\n", field_size); |
463 | | for (i=0; i<field_size; i++){ |
464 | | (*myPtrs->offsetV9Ptr)++; |
465 | | } |
466 | | break; |
467 | | } |
468 | | break; |
469 | | default: |
470 | | syslog(LOG_INFO, "Operator not known: %d\n", |
471 | | (int)(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->operator)); |
472 | | break; |
473 | | } |
474 | | j++; |
475 | | pos = (pftmp->fieldType)*10+j; |
476 | | } /* end while myPtrs->rulesAddressPtr */ |
477 | | } else { |
478 | | /* |
479 | | * no rule within this field type, but we must read the value |
480 | | */ |
481 | | switch (field_size) { |
482 | | case 1: |
483 | | buffer1 = *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
484 | | (*myPtrs->offsetV9Ptr)++; |
485 | | #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP) |
486 | | if ((pftmp->fieldType==9)||(pftmp->fieldType==29)){ |
487 | | agCache.maskS = *((unsigned char*)&buffer1); |
488 | | } |
489 | | if ((pftmp->fieldType==13)||(pftmp->fieldType==30)){ |
490 | | agCache.maskD = *((unsigned char*)&buffer1); |
491 | | } |
492 | | if (pftmp->fieldType==60){ |
493 | | agCache.ipProt = *((unsigned char*)&buffer1); |
494 | | } |
495 | | if (pftmp->fieldType==4){ |
496 | | agCache.tProt = *((unsigned char*)&buffer1); |
497 | | } |
498 | | if (pftmp->fieldType==61){ |
499 | | agCache.sens = *((unsigned char*)&buffer1); |
500 | | } |
501 | | if (pftmp->fieldType==5){ |
502 | | agCache.dscp = *((unsigned char*)&buffer1); |
503 | | } |
504 | | #endif |
505 | | break; |
506 | | case 2: |
507 | | buffer2[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
508 | | (*myPtrs->offsetV9Ptr)++; |
509 | | buffer2[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
510 | | (*myPtrs->offsetV9Ptr)++; |
511 | | #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP) |
512 | | if (pftmp->fieldType==10){ |
513 | | agCache.inputSnmp = *((unsigned short*)&buffer2); |
514 | | } |
515 | | if (pftmp->fieldType==14){ |
516 | | agCache.outputSnmp = *((unsigned short*)&buffer2); |
517 | | } |
518 | | #endif |
519 | | #ifdef ASACC |
520 | | if (pftmp->fieldType==16){ |
521 | | agCache.asS = *((unsigned short*)&buffer2); |
522 | | } |
523 | | if (pftmp->fieldType==17){ |
524 | | agCache.asD = *((unsigned short*)&buffer2); |
525 | | } |
526 | | #endif |
527 | | break; |
528 | | case 3: |
529 | | buffer4[3]= 0; |
530 | | buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
531 | | (*myPtrs->offsetV9Ptr)++; |
532 | | buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
533 | | (*myPtrs->offsetV9Ptr)++; |
534 | | buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
535 | | (*myPtrs->offsetV9Ptr)++; |
536 | | /* aggregation */ |
537 | | /* end aggregation */ |
538 | | if (pftmp->fieldType==70){ |
539 | | isMplsFlow = 1; |
540 | | } |
541 | | break; |
542 | | case 4: |
543 | | buffer4[3]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
544 | | (*myPtrs->offsetV9Ptr)++; |
545 | | buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
546 | | (*myPtrs->offsetV9Ptr)++; |
547 | | buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
548 | | (*myPtrs->offsetV9Ptr)++; |
549 | | buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
550 | | (*myPtrs->offsetV9Ptr)++; |
551 | | #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP) |
552 | | if ((pftmp->fieldType==8)){ |
553 | | bool = 1; |
554 | | agCache.v4AdS = *((unsigned long*)&buffer4); |
555 | | } else if ((pftmp->fieldType==12)){ |
556 | | agCache.v4AdD = *((unsigned long*)&buffer4); |
557 | | } else if (pftmp->fieldType==1){ |
558 | | agCache.bytes = *((unsigned long*)&buffer4); |
559 | | } else if (pftmp->fieldType==2){ |
560 | | agCache.pkts = *((unsigned long*)&buffer4); |
561 | | } |
562 | | #endif |
563 | | break; |
564 | | case 16: |
565 | | for (i=0; i<4; i++) { |
566 | | buffer2[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
567 | | (*myPtrs->offsetV9Ptr)++; |
568 | | buffer2[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
569 | | (*myPtrs->offsetV9Ptr)++; |
570 | | buffer2[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
571 | | (*myPtrs->offsetV9Ptr)++; |
572 | | buffer2[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); |
573 | | (*myPtrs->offsetV9Ptr)++; |
574 | | } |
575 | | /* aggregation IPv6 */ |
576 | | /* end aggregation */ |
577 | | break; |
578 | | default: |
579 | | syslog(LOG_INFO,"UNKNOWN FIELDS LENGTH: %d ", field_size); |
580 | | for (i=0; i<field_size; i++){ |
581 | | (*myPtrs->offsetV9Ptr)++; |
582 | | } |
583 | | } |
584 | | } /* end if one cache table line existence */ |
585 | | if (cpt==tmp->fieldCount) { |
586 | | /* |
587 | | * end of one flow (not the flowset) |
588 | | */ |
589 | | |
590 | | /* put aggregation cache information to IPv4 Prefixes table */ |
591 | | /* Aggregation mode must be enable in ./configure options */ |
592 | | /* first we must know if the address belong to our prefix */ |
593 | | /* |
594 | | * AS ACCOUNTING |
595 | | */ |
596 | | #if defined(ASACC) && defined(IPV4AGGIDSNMP) |
597 | | if ( (bool == 1) && (isMplsFlow == 0) ){ |
598 | | asKey.as = agCache.asS; |
599 | | asres = bsearch(&asKey, myPtrs->currentASTab, myPtrs->asNb, sizeof(struct AS), asGlobalCmp); |
600 | | if (asres != NULL) { |
601 | | if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1 ) { |
602 | | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
603 | | /* OUT ("traffic from the AS") */ |
604 | | asres->bytesNbOUT += agCache.bytes; |
605 | | asres->pktsNbOUT += agCache.pkts; |
606 | | (asres->flowNbOUT)++; |
607 | | } |
608 | | if (asres->sampling == 0 |
609 | | && myPtrs->currentRouterPtr->sampled != 0){ |
610 | | asres->sampling = myPtrs->currentRouterPtr->sampled; |
611 | | } |
612 | | asres = NULL; |
613 | | asKey.as = agCache.asD; |
614 | | asres = bsearch(&asKey, myPtrs->currentASTab, myPtrs->asNb, sizeof(struct AS), asGlobalCmp); |
615 | | if (asres!=NULL){ |
616 | | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
617 | | /* IN ("traffic to the AS") */ |
618 | | asres->bytesNbIN += agCache.bytes; |
619 | | asres->pktsNbIN += agCache.pkts; |
620 | | (asres->flowNbIN)++; |
621 | | } |
622 | | if (asres->sampling == 0 |
623 | | && myPtrs->currentRouterPtr->sampled != 0){ |
624 | | asres->sampling = myPtrs->currentRouterPtr->sampled; |
625 | | } |
626 | | asres = NULL; |
627 | | } |
628 | | } |
629 | | } else { |
630 | | asres = NULL; |
631 | | asKey.as = agCache.asD; |
632 | | asres = bsearch(&asKey, myPtrs->currentASTab, myPtrs->asNb, sizeof(struct AS), asGlobalCmp); |
633 | | if (asres!=NULL){ |
634 | | if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1 ) { |
635 | | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
636 | | /* IN ("traffic to the AS") */ |
637 | | asres->bytesNbIN += agCache.bytes; |
638 | | asres->pktsNbIN += agCache.pkts; |
639 | | (asres->flowNbIN)++; |
640 | | } |
641 | | if (asres->sampling == 0 |
642 | | && myPtrs->currentRouterPtr->sampled != 0){ |
643 | | asres->sampling = myPtrs->currentRouterPtr->sampled; |
644 | | } |
645 | | } |
646 | | } |
647 | | } |
648 | | } |
649 | | #endif |
650 | | /* |
651 | | * PREFIX &/or MATRIX ACCOUNTING |
652 | | */ |
653 | | #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP) |
654 | | if ( (bool == 1) && (isMplsFlow == 0) ){ |
655 | | prefixKey.beginning = agCache.v4AdS>>(32-agCache.maskS)<<(32-agCache.maskS); |
656 | | res = bsearch(&prefixKey, V4PTab, nbPV4, |
657 | | sizeof(struct PrefixV4), prefGlobalCmp); |
658 | | if (res!=NULL){ |
659 | | /* res is supernet or subnet ? */ |
660 | | if (res->hasSubnet == 1) { |
661 | | resSub = NULL; |
662 | | resSub = bsearch(&prefixKey, V4STab, nbSV4, |
663 | | sizeof(struct PrefixV4), prefGlobalCmp); |
664 | | if (resSub != NULL) { |
665 | | res = resSub; |
666 | | resSub = NULL; |
667 | | } |
668 | | } |
669 | | #if defined(IPV4AGGIDR) |
670 | | if ( myPtrs->routersID[res->routerNb] == agCache.routerAd ) { |
671 | | #elif defined(IPV4AGGIDSNMP) |
672 | | if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1 ) { |
673 | | #endif |
674 | | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
675 | | /* OUT ("traffic from the prefix/subnet") */ |
676 | | res->bytesNbOUT += agCache.bytes; |
677 | | res->pktsNbOUT += agCache.pkts; |
678 | | (res->flowNbOUT)++; |
679 | | } |
680 | | if (res->sampling == 0 |
681 | | && myPtrs->currentRouterPtr->sampled != 0){ |
682 | | res->sampling = myPtrs->currentRouterPtr->sampled; |
683 | | } |
684 | | #if defined(IPV4AGGIDSNMP) |
685 | | prefixKey.beginning = agCache.v4AdD>>(32-agCache.maskD)<<(32-agCache.maskD); |
686 | | res3 = bsearch(&prefixKey, V4PTab, nbPV4, |
687 | | sizeof(struct PrefixV4), prefGlobalCmp); |
688 | | if (res3!=NULL){ |
689 | | /* res is supernet or subnet ? */ |
690 | | if (res3->hasSubnet == 1) { |
691 | | resSub = NULL; |
692 | | resSub = bsearch(&prefixKey, V4STab, nbSV4, |
693 | | sizeof(struct PrefixV4), prefGlobalCmp); |
694 | | if (resSub != NULL) { |
695 | | res3 = resSub; |
696 | | resSub = NULL; |
697 | | } |
698 | | } |
699 | | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
700 | | /* IN ("traffic to the prefix/subnet") */ |
701 | | res3->bytesNbIN += agCache.bytes; |
702 | | res3->pktsNbIN += agCache.pkts; |
703 | | (res3->flowNbIN)++; |
704 | | } |
705 | | if (res3->sampling == 0 |
706 | | && myPtrs->currentRouterPtr->sampled != 0){ |
707 | | res3->sampling = myPtrs->currentRouterPtr->sampled; |
708 | | } |
709 | | } |
710 | | #endif |
711 | | #if defined(MATRIX) && defined(IPV4AGGIDR) |
712 | | /* inter-pop matrix Accounting */ |
713 | | prefixKey.beginning = agCache.v4AdD>>(32-agCache.maskD)<<(32-agCache.maskD); |
714 | | res2 = bsearch(&prefixKey, V4PTab, nbPV4, |
715 | | sizeof(struct PrefixV4), prefGlobalCmp); |
716 | | if (res2!=NULL){ |
717 | | ((struct POP *)((myPtrs->matrixPOP) |
718 | | +((res->routerNb)*ROUTER_INDEX_MAX) |
719 | | +((res2->routerNb))))->pktsNb += agCache.pkts; |
720 | | ((struct POP *)((myPtrs->matrixPOP) |
721 | | +((res->routerNb)*ROUTER_INDEX_MAX) |
722 | | +((res2->routerNb))))->bytesNb += agCache.bytes; |
723 | | ((struct POP *)((myPtrs->matrixPOP) |
724 | | +((res->routerNb)*ROUTER_INDEX_MAX) |
725 | | +((res2->routerNb))))->flowNb++; |
726 | | } else { |
727 | | ( |
728 | | ((struct POP *)(myPtrs->matrixPOP) |
729 | | +((res->routerNb)*ROUTER_INDEX_MAX) |
730 | | +((ROUTER_INDEX_MAX-1))))->pktsNb += agCache.pkts; |
731 | | ( |
732 | | ((struct POP *)(myPtrs->matrixPOP) |
733 | | +((res->routerNb)*ROUTER_INDEX_MAX) |
734 | | +((ROUTER_INDEX_MAX-1))))->bytesNb += agCache.bytes; |
735 | | ( |
736 | | ((struct POP *)(myPtrs->matrixPOP) |
737 | | +((res->routerNb)*ROUTER_INDEX_MAX) |
738 | | +((ROUTER_INDEX_MAX-1))))->flowNb++; |
739 | | } |
740 | | /* end interpop matrix accounting */ |
741 | | #endif /* matrix */ |
742 | | } else { |
743 | | /* doublon or bad reference in prefix list */ |
744 | | } |
745 | | } else { /* res==NULL, the prefix in source don't exist in your prefix list */ |
746 | | prefixKey.beginning = agCache.v4AdD>>(32-agCache.maskD)<<(32-agCache.maskD); |
747 | | res = bsearch(&prefixKey, V4PTab, nbPV4, |
748 | | sizeof(struct PrefixV4), prefGlobalCmp); |
749 | | if (res!=NULL){ |
750 | | /* res is supernet or subnet ? */ |
751 | | if (res->hasSubnet == 1) { |
752 | | resSub = NULL; |
753 | | resSub = bsearch(&prefixKey, V4STab, nbSV4, |
754 | | sizeof(struct PrefixV4), prefGlobalCmp); |
755 | | if (resSub != NULL) { |
756 | | res = resSub; |
757 | | resSub = NULL; |
758 | | } |
759 | | } |
760 | | if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1 ) { |
761 | | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
762 | | /* IN ("traffic to the prefix/subnet") */ |
763 | | res->bytesNbIN += agCache.bytes; |
764 | | res->pktsNbIN += agCache.pkts; |
765 | | (res->flowNbIN)++; |
766 | | } |
767 | | #if defined(IPV4AGGIDR) |
768 | | if ( myPtrs->routersID[res->routerNb] == agCache.routerAd ) { |
769 | | if (myPtrs->currentRouterPtr->sampled != 0 ){ |
770 | | /* IN ("traffic to the prefix") */ |
771 | | res->bytesNbIN += agCache.bytes; |
772 | | res->pktsNbIN += agCache.pkts; |
773 | | (res->flowNbIN)++; |
774 | | } |
775 | | #endif |
776 | | if (res->sampling == 0 |
777 | | && myPtrs->currentRouterPtr->sampled != 0 ){ |
778 | | res->sampling = myPtrs->currentRouterPtr->sampled; |
779 | | } |
780 | | } else { |
781 | | /* doublon or bad reference in prefix list */ |
782 | | } |
783 | | } else { |
784 | | /* UNKNOW SUBNET CASE */ |
785 | | /* */ |
786 | | /* HERE : we are in the cases of the address/mask don't */ |
787 | | /* belong to a prefix listed in the IPv4 prefix file */ |
788 | | /* possibilities : */ |
789 | | /* - prefix not referenced but allowed to be routed */ |
790 | | /* - prefix not referenced but not allowed to be routed */ |
791 | | /* - spoofing */ |
792 | | #ifdef PRINTUNKNOWNSUBNET |
793 | | fprintf(stderr, "%lu.%lu.%lu.%lu/%hu -> %lu.%lu.%lu.%lu/%hu (R:%lu.%lu.%lu.%lu) \n", |
794 | | (agCache.v4AdS>>24), |
795 | | (agCache.v4AdS<<8>>24), |
796 | | (agCache.v4AdS<<16>>24), |
797 | | (agCache.v4AdS<<24>>24), |
798 | | (agCache.maskS), |
799 | | (agCache.v4AdD>>24), |
800 | | (agCache.v4AdD<<8>>24), |
801 | | (agCache.v4AdD<<16>>24), |
802 | | (agCache.v4AdD<<24>>24), |
803 | | (agCache.maskD), |
804 | | (myPtrs->pcktPtr->ipH->srcAdd>>24), |
805 | | (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), |
806 | | (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), |
807 | | (myPtrs->pcktPtr->ipH->srcAdd<<24>>24) |
808 | | ); |
809 | | #endif /* PRINTUNKNOWNSUBNET */ |
810 | | } |
811 | | } |
812 | | } |
813 | | bool = 0; |
814 | | isMplsFlow = 0; |
815 | | #endif /* (IPV4AGGIDR) || (IPV4AGGIDSNMP) */ |
816 | | /* |
817 | | * |
818 | | * SOCKET OUTPUT TO A REMOTE CLIENT |
819 | | * |
820 | | * switch the rules definition (check & fieldToRecord), |
821 | | * we send the flow or a part of the flow to a remote host or a file. |
822 | | * In a first time (until release 0.0.7, the information was sent via |
823 | | * the process renetcolSender with an IPC message queue. But, the perf |
824 | | * of IPC Msg was very bad with a default system compilation. |
825 | | * So, now, we send information directly from here through sockets. |
826 | | */ |
827 | | tmpRuleList = myPtrs->rulesListPtr; |
828 | | tmpRL = myPtrs->rulesListPtr; |
829 | | while (tmpRuleList){ |
830 | | RuleDefPtr tmpRuleDefList = tmpRuleList->def; |
831 | | unsigned short check = 1; |
832 | | int s=0; |
833 | | secondOffset = secondOldOffset; |
834 | | while (tmpRuleDefList){ |
835 | | check = check && tmpRuleDefList->check; |
836 | | tmpRuleDefList->check = 0; |
837 | | tmpRuleDefList = tmpRuleDefList->next; |
838 | | } |
839 | | if ( (tmpRuleList->def != NULL) && (check == 1)) { |
840 | | /* msg building */ |
841 | | secondPftmp = tmp->lastField; |
842 | | msgTextIndex = mempcpy(mempcpy(mempcpy(myMsg.text, |
843 | | &tplMsgType, |
844 | | sizeof(unsigned short) |
845 | | ), |
846 | | &tmpRuleList->id, |
847 | | sizeof(tmpRuleList->id) |
848 | | ), |
849 | | &myPtrs->currentRouterPtr->IpAddress, |
850 | | sizeof(unsigned long) |
851 | | ); |
852 | | msgTextIndex = mempcpy(mempcpy(mempcpy(msgTextIndex, |
853 | | &tmp->sourceId, |
854 | | sizeof(unsigned long) |
855 | | ), |
856 | | &tmp->templateFlowSetId, |
857 | | sizeof(tmp->templateFlowSetId) |
858 | | ), |
859 | | myPtrs->ptr_buffer+secondOffset, |
860 | | flow_size |
861 | | ); |
862 | | myMsg.type = 1; |
863 | | |
864 | | |
865 | | /* NEW transfert type */ |
866 | | for ( ; tmpRL; tmpRL=tmpRL->next){ |
867 | | if (tmpRL->id == tmpRuleList->id){ |
868 | | s = sendMessage(tmpRL->host->sockId, myMsg.text, sizeof(myMsg.text), |
869 | | tmpRL->host->hostAddressPtr); |
870 | | } |
871 | | } |
872 | | /* FIXME : perhaps check "s" */ |
873 | | noEnd = 1; |
874 | | secondCpt=0; |
875 | | } /* end if check */ |
876 | | tmpRuleList = tmpRuleList->next; |
877 | | tmpRL = myPtrs->rulesListPtr; /* ticket #11 */ |
878 | | secondPftmp = tmp->lastField; |
879 | | } /* end while tmpRuleList */ |
880 | | /* |
881 | | * end redirection |
882 | | */ |
883 | | secondOffset = *myPtrs->offsetV9Ptr; |
884 | | secondOldOffset = secondOffset; |
885 | | pftmp = tmp->lastField; |
886 | | cpt=0; |
887 | | (*myPtrs->currentFlowsetNumberPtr)++; /* pointer on the flows number */ |
888 | | if (((*myPtrs->offsetV9Ptr)-48-shift+flow_size) > data_length){ |
889 | | overflow = 1; /* buffer index not correct */ |
890 | | } |
891 | | } else { |
892 | | /* not the flow end, progress in field list */ |
893 | | pftmp = pftmp->prev; |
894 | | } |
895 | | } /* end of the while on one flow record */ |
896 | | |
897 | | while ( ((*myPtrs->offsetV9Ptr)-48-shift) < data_length ) { |
898 | | (*myPtrs->offsetV9Ptr)++; /* if padding */ |
899 | | paddingCounter++; |
900 | | if ( paddingCounter > 8 ) { |
| 907 | fprintf(stderr," padding too high: %d ", paddingCounter); |
| 908 | #endif |
| 909 | syslog(LOG_INFO,"padding too high: %d ", paddingCounter); |
| 910 | return (-1); |
| 911 | } |
| 912 | } |
| 913 | while ( (*myPtrs->offsetV9Ptr)-48-shift > data_length ) { |
| 914 | (*myPtrs->offsetV9Ptr)--; /* crazy loop (when bug appears in template def) */ |
| 915 | crazyCounter++; |
| 916 | } |