187 lines
5.5 KiB
C
Executable File
187 lines
5.5 KiB
C
Executable File
/*
|
|
* Copyright (c) 2017, Peter Haag
|
|
* Copyright (c) 2014, Peter Haag
|
|
* Copyright (c) 2009, Peter Haag
|
|
* Copyright (c) 2008, SWITCH - Teleinformatikdienste fuer Lehre und Forschung
|
|
* All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions are met:
|
|
*
|
|
* * Redistributions of source code must retain the above copyright notice,
|
|
* this list of conditions and the following disclaimer.
|
|
* * Redistributions in binary form must reproduce the above copyright notice,
|
|
* this list of conditions and the following disclaimer in the documentation
|
|
* and/or other materials provided with the distribution.
|
|
* * Neither the name of the author nor the names of its contributors may be
|
|
* used to endorse or promote products derived from this software without
|
|
* specific prior written permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
|
|
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
|
|
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
|
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
|
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
|
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
* POSSIBILITY OF SUCH DAMAGE.
|
|
*
|
|
*/
|
|
|
|
#ifndef _COLLECTOR_H
|
|
#define _COLLECTOR_H 1
|
|
|
|
#include "config.h"
|
|
|
|
#include <sys/types.h>
|
|
#ifdef HAVE_STDINT_H
|
|
#include <stdint.h>
|
|
#endif
|
|
#include <sys/socket.h>
|
|
|
|
#include "bookkeeper.h"
|
|
#include "nffile.h"
|
|
|
|
#define FNAME_SIZE 256
|
|
#define IDENT_SIZE 32
|
|
|
|
typedef struct srecord_s {
|
|
char fname[FNAME_SIZE]; // file name
|
|
char subdir[FNAME_SIZE]; // subdir name
|
|
char tstring[16]; // actually 12 needed e.g. 200411011230
|
|
time_t tstamp; // UNIX time stamp
|
|
int failed; // in case of an error
|
|
} srecord_t;
|
|
|
|
// common_record_t defines ext_map as uint_8, so max 256 extension maps allowed.
|
|
// should be enough anyway
|
|
|
|
typedef struct option_offset_s {
|
|
struct option_offset_s *next;
|
|
uint32_t id; // table id
|
|
uint32_t flags; // info about this map
|
|
|
|
// sampling offsets
|
|
#define HAS_SAMPLER_DATA 1
|
|
uint16_t offset_id;
|
|
uint16_t sampler_id_length;
|
|
uint16_t offset_mode;
|
|
uint16_t offset_interval;
|
|
|
|
#define HAS_STD_SAMPLER_DATA 2
|
|
uint16_t offset_std_sampler_interval;
|
|
uint16_t offset_std_sampler_algorithm;
|
|
|
|
} option_offset_t;
|
|
|
|
typedef struct generic_sampler_s {
|
|
struct generic_sampler_s *next;
|
|
sampler_info_record_t info;
|
|
} generic_sampler_t;
|
|
|
|
typedef struct generic_exporter_s {
|
|
// link chain
|
|
struct generic_exporter_s *next;
|
|
|
|
// generic exporter information
|
|
exporter_info_record_t info;
|
|
|
|
uint64_t packets; // number of packets sent by this exporter
|
|
uint64_t flows; // number of flow records sent by this exporter
|
|
uint32_t sequence_failure; // number of sequence failues
|
|
|
|
generic_sampler_t *sampler;
|
|
|
|
} generic_exporter_t;
|
|
|
|
typedef struct FlowSource_s {
|
|
// link
|
|
struct FlowSource_s *next;
|
|
|
|
// exporter identifiers
|
|
char Ident[IDENTLEN];
|
|
ip_addr_t ip;
|
|
uint32_t sa_family;
|
|
|
|
int any_source;
|
|
bookkeeper_t *bookkeeper;
|
|
|
|
// all about data storage
|
|
char *datadir; // where to store data for this source
|
|
char *current; // current file name - typically nfcad.current.pid
|
|
nffile_t *nffile; // the writing file handle
|
|
|
|
// statistical data per source
|
|
uint32_t bad_packets;
|
|
uint64_t first_seen; // in msec
|
|
uint64_t last_seen; // in msec
|
|
|
|
// Any exporter specific data
|
|
generic_exporter_t *exporter_data;
|
|
uint32_t exporter_count;
|
|
struct timeval received;
|
|
|
|
// extension map list
|
|
struct {
|
|
#define BLOCK_SIZE 16
|
|
int next_free;
|
|
int max_maps;
|
|
int num_maps;
|
|
extension_map_t **maps;
|
|
} extension_map_list;
|
|
|
|
option_offset_t *option_offset_table;
|
|
|
|
} FlowSource_t;
|
|
|
|
/* input buffer size, to read data from the network */
|
|
#define NETWORK_INPUT_BUFF_SIZE 65535 // Maximum UDP message size
|
|
|
|
// prototypes
|
|
int AddFlowSource(FlowSource_t **FlowSource, char *ident);
|
|
|
|
int AddDefaultFlowSource(FlowSource_t **FlowSource, char *ident, char *path);
|
|
|
|
int SetDynamicSourcesDir(FlowSource_t **FlowSource, char *dir);
|
|
|
|
FlowSource_t *AddDynamicSource(FlowSource_t **FlowSource, struct sockaddr_storage *ss);
|
|
|
|
int InitExtensionMapList(FlowSource_t *fs);
|
|
|
|
int ReInitExtensionMapList(FlowSource_t *fs);
|
|
|
|
int RemoveExtensionMap(FlowSource_t *fs, extension_map_t *map);
|
|
|
|
int AddExtensionMap(FlowSource_t *fs, extension_map_t *map);
|
|
|
|
void FlushStdRecords(FlowSource_t *fs);
|
|
|
|
void FlushExporterStats(FlowSource_t *fs);
|
|
|
|
int FlushInfoExporter(FlowSource_t *fs, exporter_info_record_t *exporter);
|
|
|
|
int FlushInfoSampler(FlowSource_t *fs, sampler_info_record_t *sampler);
|
|
|
|
int HasOptionTable(FlowSource_t *fs, uint16_t id );
|
|
|
|
void launcher (char *commbuff, FlowSource_t *FlowSource, char *process, int expire);
|
|
|
|
/* Default time window in seconds to rotate files */
|
|
#define TIME_WINDOW 300
|
|
|
|
/* overdue time:
|
|
* if nfcapd does not get any data, wake up the receive system call
|
|
* at least after OVERDUE_TIME seconds after the time window
|
|
*/
|
|
#define OVERDUE_TIME 10
|
|
|
|
// time nfcapd will wait for launcher to terminate
|
|
#define LAUNCHER_TIMEOUT 60
|
|
|
|
#define SYSLOG_FACILITY "daemon"
|
|
|
|
#endif //_COLLECTOR_H
|