1 /* $OpenBSD: if_pflow.h,v 1.6 2012/02/02 12:34:37 benno Exp $ */ 2 3 /* 4 * Copyright (c) 2008 Henning Brauer <henning@openbsd.org> 5 * Copyright (c) 2008 Joerg Goltermann <jg@osn.de> 6 * 7 * Permission to use, copy, modify, and distribute this software for any 8 * purpose with or without fee is hereby granted, provided that the above 9 * copyright notice and this permission notice appear in all copies. 10 * 11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 15 * WHATSOEVER RESULTING FROM LOSS OF MIND, USE, DATA OR PROFITS, WHETHER IN 16 * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT 17 * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 */ 19 20 #ifndef _NET_IF_PFLOW_H_ 21 #define _NET_IF_PFLOW_H_ 22 23 #define PFLOW_ID_LEN sizeof(u_int64_t) 24 25 #define PFLOW_MAXFLOWS 30 26 #define PFLOW_ENGINE_TYPE 42 27 #define PFLOW_ENGINE_ID 42 28 #define PFLOW_MAXBYTES 0xffffffff 29 #define PFLOW_TIMEOUT 30 30 #define PFLOW_TMPL_TIMEOUT 30 /* rfc 5101 10.3.6 (p.40) recommends 600 */ 31 32 #define PFLOW_V9_TMPL_SET_ID 0 33 #define PFLOW_V10_TMPL_SET_ID 2 34 35 /* RFC 5102 Information Element Identifiers */ 36 37 #define PFIX_IE_octetDeltaCount 1 38 #define PFIX_IE_packetDeltaCount 2 39 #define PFIX_IE_protocolIdentifier 4 40 #define PFIX_IE_ipClassOfService 5 41 #define PFIX_IE_sourceTransportPort 7 42 #define PFIX_IE_sourceIPv4Address 8 43 #define PFIX_IE_destinationTransportPort 11 44 #define PFIX_IE_destinationIPv4Address 12 45 #define PFIX_IE_flowEndSysUpTime 21 46 #define PFIX_IE_flowStartSysUpTime 22 47 #define PFIX_IE_sourceIPv6Address 27 48 #define PFIX_IE_destinationIPv6Address 28 49 50 struct pflow_flow { 51 u_int32_t src_ip; 52 u_int32_t dest_ip; 53 u_int32_t nexthop_ip; 54 u_int16_t if_index_in; 55 u_int16_t if_index_out; 56 u_int32_t flow_packets; 57 u_int32_t flow_octets; 58 u_int32_t flow_start; 59 u_int32_t flow_finish; 60 u_int16_t src_port; 61 u_int16_t dest_port; 62 u_int8_t pad1; 63 u_int8_t tcp_flags; 64 u_int8_t protocol; 65 u_int8_t tos; 66 u_int16_t src_as; 67 u_int16_t dest_as; 68 u_int8_t src_mask; 69 u_int8_t dest_mask; 70 u_int16_t pad2; 71 } __packed; 72 73 struct pflow_set_header { 74 u_int16_t set_id; 75 u_int16_t set_length; /* total length of the set, 76 in octets, including the set header */ 77 } __packed; 78 79 #define PFLOW_SET_HDRLEN sizeof(struct pflow_set_header) 80 81 struct pflow_tmpl_hdr { 82 u_int16_t tmpl_id; 83 u_int16_t field_count; 84 } __packed; 85 86 /* field specifier rfc5101 sec 3.2, v9 uses the same format*/ 87 struct pflow_tmpl_fspec { 88 u_int16_t field_id; 89 u_int16_t len; 90 } __packed; 91 92 /* update pflow_clone_create() when changing pflow_v10_tmpl_v4 */ 93 struct pflow_tmpl_ipv4 { 94 struct pflow_tmpl_hdr h; 95 struct pflow_tmpl_fspec src_ip; 96 struct pflow_tmpl_fspec dest_ip; 97 struct pflow_tmpl_fspec packets; 98 struct pflow_tmpl_fspec octets; 99 struct pflow_tmpl_fspec start; 100 struct pflow_tmpl_fspec finish; 101 struct pflow_tmpl_fspec src_port; 102 struct pflow_tmpl_fspec dest_port; 103 struct pflow_tmpl_fspec tos; 104 struct pflow_tmpl_fspec protocol; 105 #define PFLOW_TMPL_IPV4_FIELD_COUNT 10 106 #define PFLOW_TMPL_IPV4_ID 256 107 } __packed; 108 109 /* update pflow_clone_create() when changing pflow_v10_tmpl_v6 */ 110 struct pflow_tmpl_ipv6 { 111 struct pflow_tmpl_hdr h; 112 struct pflow_tmpl_fspec src_ip; 113 struct pflow_tmpl_fspec dest_ip; 114 struct pflow_tmpl_fspec packets; 115 struct pflow_tmpl_fspec octets; 116 struct pflow_tmpl_fspec start; 117 struct pflow_tmpl_fspec finish; 118 struct pflow_tmpl_fspec src_port; 119 struct pflow_tmpl_fspec dest_port; 120 struct pflow_tmpl_fspec tos; 121 struct pflow_tmpl_fspec protocol; 122 #define PFLOW_TMPL_IPV6_FIELD_COUNT 10 123 #define PFLOW_TMPL_IPV6_ID 257 124 } __packed; 125 126 struct pflow_tmpl { 127 struct pflow_set_header set_header; 128 struct pflow_tmpl_ipv4 ipv4_tmpl; 129 struct pflow_tmpl_ipv6 ipv6_tmpl; 130 } __packed; 131 132 struct pflow_flow4 { 133 u_int32_t src_ip; /* sourceIPv4Address*/ 134 u_int32_t dest_ip; /* destinationIPv4Address */ 135 u_int64_t flow_packets; /* packetDeltaCount */ 136 u_int64_t flow_octets; /* octetDeltaCount */ 137 u_int32_t flow_start; /* flowStartSysUpTime */ 138 u_int32_t flow_finish; /* flowEndSysUpTime */ 139 u_int16_t src_port; /* sourceTransportPort */ 140 u_int16_t dest_port; /* destinationTransportPort */ 141 u_int8_t tos; /* ipClassOfService */ 142 u_int8_t protocol; /* protocolIdentifier */ 143 /* XXX padding needed? */ 144 } __packed; 145 146 struct pflow_flow6 { 147 struct in6_addr src_ip; /* sourceIPv6Address */ 148 struct in6_addr dest_ip; /* destinationIPv6Address */ 149 u_int64_t flow_packets; /* packetDeltaCount */ 150 u_int64_t flow_octets; /* octetDeltaCount */ 151 u_int32_t flow_start; /* flowStartSysUpTime */ 152 u_int32_t flow_finish; /* flowEndSysUpTime */ 153 u_int16_t src_port; /* sourceTransportPort */ 154 u_int16_t dest_port; /* destinationTransportPort */ 155 u_int8_t tos; /* ipClassOfService */ 156 u_int8_t protocol; /* protocolIdentifier */ 157 /* XXX padding needed? */ 158 } __packed; 159 160 #ifdef _KERNEL 161 162 extern int pflow_ok; 163 164 struct pflow_softc { 165 struct ifnet sc_if; 166 struct ifnet *sc_pflow_ifp; 167 168 unsigned int sc_count; 169 unsigned int sc_count4; 170 unsigned int sc_count6; 171 unsigned int sc_maxcount; 172 unsigned int sc_maxcount4; 173 unsigned int sc_maxcount6; 174 u_int64_t sc_gcounter; 175 struct ip_moptions sc_imo; 176 struct timeout sc_tmo; 177 struct timeout sc_tmo6; 178 struct timeout sc_tmo_tmpl; 179 struct in_addr sc_sender_ip; 180 u_int16_t sc_sender_port; 181 struct in_addr sc_receiver_ip; 182 u_int16_t sc_receiver_port; 183 u_char sc_send_templates; 184 struct pflow_tmpl sc_tmpl; 185 u_int8_t sc_version; 186 struct mbuf *sc_mbuf; /* current cumulative mbuf */ 187 struct mbuf *sc_mbuf6; /* current cumulative mbuf */ 188 SLIST_ENTRY(pflow_softc) sc_next; 189 }; 190 191 extern struct pflow_softc *pflowif; 192 193 #endif /* _KERNEL */ 194 195 struct pflow_header { 196 u_int16_t version; 197 u_int16_t count; 198 u_int32_t uptime_ms; 199 u_int32_t time_sec; 200 u_int32_t time_nanosec; 201 u_int32_t flow_sequence; 202 u_int8_t engine_type; 203 u_int8_t engine_id; 204 u_int8_t reserved1; 205 u_int8_t reserved2; 206 } __packed; 207 208 #define PFLOW_HDRLEN sizeof(struct pflow_header) 209 210 struct pflow_v10_header { 211 u_int16_t version; 212 u_int16_t length; 213 u_int32_t time_sec; 214 u_int32_t flow_sequence; 215 u_int32_t observation_dom; 216 } __packed; 217 218 #define PFLOW_V10_HDRLEN sizeof(struct pflow_v10_header) 219 220 struct pflow_v9_header { 221 u_int16_t version; 222 u_int16_t count; 223 u_int32_t uptime_ms; 224 u_int32_t time_sec; 225 u_int32_t flow_sequence; 226 u_int32_t observation_dom; 227 } __packed; 228 229 #define PFLOW_V9_HDRLEN sizeof(struct pflow_v9_header) 230 231 struct pflowstats { 232 u_int64_t pflow_flows; 233 u_int64_t pflow_packets; 234 u_int64_t pflow_onomem; 235 u_int64_t pflow_oerrors; 236 }; 237 238 /* Supported flow protocols */ 239 #define PFLOW_PROTO_5 5 /* original pflow */ 240 #define PFLOW_PROTO_9 9 /* version 9 */ 241 #define PFLOW_PROTO_10 10 /* ipfix */ 242 #define PFLOW_PROTO_MAX 11 243 244 #define PFLOW_PROTO_DEFAULT PFLOW_PROTO_5 245 246 struct pflow_protos { 247 const char *ppr_name; 248 u_int8_t ppr_proto; 249 }; 250 251 #define PFLOW_PROTOS { \ 252 { "5", PFLOW_PROTO_5 }, \ 253 { "9", PFLOW_PROTO_9 }, \ 254 { "10", PFLOW_PROTO_10 }, \ 255 } 256 257 /* 258 * Configuration structure for SIOCSETPFLOW SIOCGETPFLOW 259 */ 260 struct pflowreq { 261 struct in_addr sender_ip; 262 struct in_addr receiver_ip; 263 u_int16_t receiver_port; 264 u_int16_t addrmask; 265 u_int8_t version; 266 #define PFLOW_MASK_SRCIP 0x01 267 #define PFLOW_MASK_DSTIP 0x02 268 #define PFLOW_MASK_DSTPRT 0x04 269 #define PFLOW_MASK_VERSION 0x08 270 }; 271 272 #ifdef _KERNEL 273 int export_pflow(struct pf_state *); 274 int pflow_sysctl(int *, u_int, void *, size_t *, void *, size_t); 275 #endif /* _KERNEL */ 276 277 #endif /* _NET_IF_PFLOW_H_ */ 278