2 * copyright (c) 2001-2011 Emil Mikulic.
4 * acct.c: traffic accounting
6 * Permission to use, copy, modify, and distribute this file for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
30 #include <netinet/tcp.h>
31 #include <sys/socket.h>
33 #include <ctype.h> /* for isdigit */
34 #include <netdb.h> /* for gai_strerror */
35 #include <stdlib.h> /* for free */
36 #include <string.h> /* for memcpy */
38 uint64_t acct_total_packets
= 0, acct_total_bytes
= 0;
40 static int using_localnet4
= 0, using_localnet6
= 0;
41 static struct addr localnet4
, localmask4
, localnet6
, localmask6
;
43 /* Parse the net/mask specification into two IPs or die trying. */
45 acct_init_localnet(const char *spec
)
48 unsigned int num_tokens
;
50 int pfxlen
, octets
, remainder
;
51 struct addr localnet
, localmask
;
53 tokens
= split('/', spec
, &num_tokens
);
55 errx(1, "expecting network/netmask, got \"%s\"", spec
);
57 if ((ret
= str_to_addr(tokens
[0], &localnet
)) != 0)
58 errx(1, "couldn't parse \"%s\": %s", tokens
[0], gai_strerror(ret
));
60 /* Detect a purely numeric argument. */
63 const char *p
= tokens
[1];
77 if ((ret
= str_to_addr(tokens
[1], &localmask
)) != 0)
78 errx(1, "couldn't parse \"%s\": %s", tokens
[1], gai_strerror(ret
));
79 if (localmask
.family
!= localnet
.family
)
80 errx(1, "family mismatch between net and mask");
85 localmask
.family
= localnet
.family
;
87 /* Compute the prefix length. */
88 pfxlen
= (unsigned int)strtol(tokens
[1], &endptr
, 10);
91 ((localnet
.family
== IPv6
) && (pfxlen
> 128)) ||
92 ((localnet
.family
== IPv4
) && (pfxlen
> 32)) ||
93 (tokens
[1][0] == '\0') ||
95 errx(1, "invalid network prefix length \"%s\"", tokens
[1]);
97 /* Construct the network mask. */
99 remainder
= pfxlen
% 8;
100 p
= (localnet
.family
== IPv6
) ? (localmask
.ip
.v6
.s6_addr
)
101 : ((uint8_t *) &(localmask
.ip
.v4
));
103 if (localnet
.family
== IPv6
)
108 for (j
= 0; j
< octets
; ++j
)
111 frac
= (uint8_t)(0xff << (8 - remainder
));
113 p
[j
] = frac
; /* Have contribution for next position. */
120 /* Register the correct netmask and calculate the correct net. */
121 addr_mask(&localnet
, &localmask
);
122 if (localnet
.family
== IPv6
) {
124 localnet6
= localnet
;
125 localmask6
= localmask
;
128 localnet4
= localnet
;
129 localmask4
= localmask
;
132 verbosef("local network address: %s", addr_to_str(&localnet
));
133 verbosef(" local network mask: %s", addr_to_str(&localmask
));
137 addr_is_local(const struct addr
* const a
)
139 if (a
->family
== IPv4
) {
140 if (using_localnet4
) {
141 if (addr_inside(a
, &localnet4
, &localmask4
))
144 if (addr_equal(a
, &localip4
))
148 assert(a
->family
== IPv6
);
149 if (using_localnet6
) {
150 if (addr_inside(a
, &localnet6
, &localmask6
))
153 if (addr_equal(a
, &localip6
))
160 /* Account for the given packet summary. */
162 acct_for(const struct pktsummary
* const sm
)
164 struct bucket
*hs
= NULL
, *hd
= NULL
;
165 struct bucket
*ps
, *pd
;
168 #if 0 /* WANT_CHATTY? */
169 printf("%15s > ", addr_to_str(&sm
->src
));
170 printf("%15s ", addr_to_str(&sm
->dst
));
171 printf("len %4d proto %2d", sm
->len
, sm
->proto
);
173 if (sm
->proto
== IPPROTO_TCP
|| sm
->proto
== IPPROTO_UDP
)
174 printf(" port %5d : %5d", sm
->src_port
, sm
->dst_port
);
175 if (sm
->proto
== IPPROTO_TCP
)
176 printf(" %s%s%s%s%s%s",
177 (sm
->tcp_flags
& TH_FIN
)?"F":"",
178 (sm
->tcp_flags
& TH_SYN
)?"S":"",
179 (sm
->tcp_flags
& TH_RST
)?"R":"",
180 (sm
->tcp_flags
& TH_PUSH
)?"P":"",
181 (sm
->tcp_flags
& TH_ACK
)?"A":"",
182 (sm
->tcp_flags
& TH_URG
)?"U":""
188 acct_total_packets
++;
189 acct_total_bytes
+= sm
->len
;
192 dir_out
= addr_is_local(&(sm
->src
));
193 dir_in
= addr_is_local(&(sm
->dst
));
195 /* Traffic staying within the network isn't counted. */
196 if (dir_in
== 1 && dir_out
== 1)
197 dir_in
= dir_out
= 0;
200 daylog_acct((uint64_t)sm
->len
, GRAPH_OUT
);
201 graph_acct((uint64_t)sm
->len
, GRAPH_OUT
);
204 daylog_acct((uint64_t)sm
->len
, GRAPH_IN
);
205 graph_acct((uint64_t)sm
->len
, GRAPH_IN
);
208 if (opt_hosts_max
== 0) return; /* skip per-host accounting */
212 if (!opt_want_local_only
|| addr_is_local(&sm
->src
)) {
213 hs
= host_get(&(sm
->src
));
215 hs
->total
+= sm
->len
;
216 memcpy(hs
->u
.host
.mac_addr
, sm
->src_mac
, sizeof(sm
->src_mac
));
217 hs
->u
.host
.lastseen
= now
;
220 if (!opt_want_local_only
|| addr_is_local(&sm
->dst
)) {
221 hd
= host_get(&(sm
->dst
));
223 hd
->total
+= sm
->len
;
224 memcpy(hd
->u
.host
.mac_addr
, sm
->dst_mac
, sizeof(sm
->dst_mac
));
226 * Don't update recipient's last seen time, we don't know that
227 * they received successfully.
232 if (sm
->proto
!= IPPROTO_INVALID
) {
234 ps
= host_get_ip_proto(hs
, sm
->proto
);
236 ps
->total
+= sm
->len
;
239 pd
= host_get_ip_proto(hd
, sm
->proto
);
241 pd
->total
+= sm
->len
;
245 if (opt_ports_max
== 0) return; /* skip ports accounting */
250 if ((sm
->src_port
<= opt_highest_port
) && hs
) {
251 ps
= host_get_port_tcp(hs
, sm
->src_port
);
253 ps
->total
+= sm
->len
;
255 if ((sm
->dst_port
<= opt_highest_port
) && hd
) {
256 pd
= host_get_port_tcp(hd
, sm
->dst_port
);
258 pd
->total
+= sm
->len
;
259 if (sm
->tcp_flags
== TH_SYN
)
260 pd
->u
.port_tcp
.syn
++;
265 if ((sm
->src_port
<= opt_highest_port
) && hs
) {
266 ps
= host_get_port_udp(hs
, sm
->src_port
);
268 ps
->total
+= sm
->len
;
270 if ((sm
->dst_port
<= opt_highest_port
) && hd
) {
271 pd
= host_get_port_udp(hd
, sm
->dst_port
);
273 pd
->total
+= sm
->len
;
282 /* known protocol, don't complain about it */
286 verbosef("unknown IP proto (%04x)", sm
->proto
);
290 /* vim:set ts=3 sw=3 tw=78 expandtab: */