2 * copyright (c) 2001-2008 Emil Mikulic.
4 * acct.c: traffic accounting
6 * Permission to use, copy, modify, and distribute this file for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
30 #include <arpa/inet.h> /* for inet_aton() */
32 #include <netinet/tcp.h>
33 #include <sys/socket.h>
35 #include <ctype.h> /* for isdigit */
36 #include <netdb.h> /* for gai_strerror */
37 #include <stdlib.h> /* for free */
38 #include <string.h> /* for memcpy */
40 uint64_t acct_total_packets
= 0, acct_total_bytes
= 0;
42 static int using_localnet4
= 0, using_localnet6
= 0;
43 static struct addr localnet4
, localmask4
, localnet6
, localmask6
;
45 /* Parse the net/mask specification into two IPs or die trying. */
47 acct_init_localnet(const char *spec
)
50 unsigned int num_tokens
;
52 int pfxlen
, octets
, remainder
;
53 struct addr localnet
, localmask
;
55 tokens
= split('/', spec
, &num_tokens
);
57 errx(1, "expecting network/netmask, got \"%s\"", spec
);
59 if ((ret
= str_to_addr(tokens
[0], &localnet
)) != 0)
60 errx(1, "couldn't parse \"%s\": %s", tokens
[0], gai_strerror(ret
));
62 /* Detect a purely numeric argument. */
65 const char *p
= tokens
[1];
79 if ((ret
= str_to_addr(tokens
[1], &localmask
)) != 0)
80 errx(1, "couldn't parse \"%s\": %s", tokens
[1], gai_strerror(ret
));
81 if (localmask
.family
!= localnet
.family
)
82 errx(1, "family mismatch between net and mask");
86 localmask
.family
= localnet
.family
;
88 /* Compute the prefix length. */
89 pfxlen
= (int)strtonum(tokens
[1], 1,
90 (localnet
.family
== IPv6
) ? 128 : 32, NULL
);
93 errx(1, "invalid network prefix length \"%s\"", tokens
[1]);
95 /* Construct the network mask. */
97 remainder
= pfxlen
% 8;
98 p
= (localnet
.family
== IPv6
) ? (localmask
.ip
.v6
.s6_addr
)
99 : ((uint8_t *) &(localmask
.ip
.v4
));
101 if (localnet
.family
== IPv6
)
106 for (j
= 0; j
< octets
; ++j
)
109 frac
= (uint8_t)(0xff << (8 - remainder
));
111 p
[j
] = frac
; /* Have contribution for next position. */
118 /* Register the correct netmask and calculate the correct net. */
119 addr_mask(&localnet
, &localmask
);
120 if (localnet
.family
== IPv6
) {
122 localnet6
= localnet
;
123 localmask6
= localmask
;
126 localnet4
= localnet
;
127 localmask4
= localmask
;
130 verbosef("local network address: %s", addr_to_str(&localnet
));
131 verbosef(" local network mask: %s", addr_to_str(&localmask
));
135 addr_is_local(const struct addr
* const a
)
137 if (a
->family
== IPv4
) {
138 if (using_localnet4
) {
139 if (addr_inside(a
, &localnet4
, &localmask4
))
142 if (addr_equal(a
, &localip4
))
146 assert(a
->family
== IPv6
);
147 if (using_localnet6
) {
148 if (addr_inside(a
, &localnet6
, &localmask6
))
151 if (addr_equal(a
, &localip6
))
158 /* Account for the given packet summary. */
160 acct_for(const struct pktsummary
* const sm
)
162 struct bucket
*hs
= NULL
, *hd
= NULL
;
163 struct bucket
*ps
, *pd
;
166 #if 0 /* WANT_CHATTY? */
167 printf("%15s > ", addr_to_str(&sm
->src
));
168 printf("%15s ", addr_to_str(&sm
->dst
));
169 printf("len %4d proto %2d", sm
->len
, sm
->proto
);
171 if (sm
->proto
== IPPROTO_TCP
|| sm
->proto
== IPPROTO_UDP
)
172 printf(" port %5d : %5d", sm
->src_port
, sm
->dst_port
);
173 if (sm
->proto
== IPPROTO_TCP
)
174 printf(" %s%s%s%s%s%s",
175 (sm
->tcp_flags
& TH_FIN
)?"F":"",
176 (sm
->tcp_flags
& TH_SYN
)?"S":"",
177 (sm
->tcp_flags
& TH_RST
)?"R":"",
178 (sm
->tcp_flags
& TH_PUSH
)?"P":"",
179 (sm
->tcp_flags
& TH_ACK
)?"A":"",
180 (sm
->tcp_flags
& TH_URG
)?"U":""
186 acct_total_packets
++;
187 acct_total_bytes
+= sm
->len
;
190 dir_out
= addr_is_local(&(sm
->src
));
191 dir_in
= addr_is_local(&(sm
->dst
));
193 /* Traffic staying within the network isn't counted. */
194 if (dir_in
== 1 && dir_out
== 1)
195 dir_in
= dir_out
= 0;
198 daylog_acct((uint64_t)sm
->len
, GRAPH_OUT
);
199 graph_acct((uint64_t)sm
->len
, GRAPH_OUT
);
202 daylog_acct((uint64_t)sm
->len
, GRAPH_IN
);
203 graph_acct((uint64_t)sm
->len
, GRAPH_IN
);
206 if (opt_hosts_max
== 0) return; /* skip per-host accounting */
210 hs
= host_get(&(sm
->src
));
212 hs
->total
+= sm
->len
;
213 memcpy(hs
->u
.host
.mac_addr
, sm
->src_mac
, sizeof(sm
->src_mac
));
214 hs
->u
.host
.last_seen
= now
;
216 hd
= host_get(&(sm
->dst
));
218 hd
->total
+= sm
->len
;
219 memcpy(hd
->u
.host
.mac_addr
, sm
->dst_mac
, sizeof(sm
->dst_mac
));
220 hd
->u
.host
.last_seen
= now
;
223 if (sm
->proto
!= IPPROTO_INVALID
) {
224 ps
= host_get_ip_proto(hs
, sm
->proto
);
226 ps
->total
+= sm
->len
;
228 pd
= host_get_ip_proto(hd
, sm
->proto
);
230 pd
->total
+= sm
->len
;
233 if (opt_ports_max
== 0) return; /* skip ports accounting */
238 if (sm
->src_port
<= opt_highest_port
) {
239 ps
= host_get_port_tcp(hs
, sm
->src_port
);
241 ps
->total
+= sm
->len
;
244 if (sm
->dst_port
<= opt_highest_port
) {
245 pd
= host_get_port_tcp(hd
, sm
->dst_port
);
247 pd
->total
+= sm
->len
;
248 if (sm
->tcp_flags
== TH_SYN
)
249 pd
->u
.port_tcp
.syn
++;
254 if (sm
->src_port
<= opt_highest_port
) {
255 ps
= host_get_port_udp(hs
, sm
->src_port
);
257 ps
->total
+= sm
->len
;
260 if (sm
->dst_port
<= opt_highest_port
) {
261 pd
= host_get_port_udp(hd
, sm
->dst_port
);
263 pd
->total
+= sm
->len
;
272 /* known protocol, don't complain about it */
276 verbosef("unknown IP proto (%04x)", sm
->proto
);
280 /* vim:set ts=3 sw=3 tw=78 expandtab: */