2 * copyright (c) 2001-2008 Emil Mikulic.
4 * acct.c: traffic accounting
6 * Permission to use, copy, modify, and distribute this file for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
29 #include <arpa/inet.h> /* for inet_aton() */
31 #include <netinet/tcp.h>
32 #include <sys/socket.h>
34 #include <ctype.h> /* for isdigit */
35 #include <netdb.h> /* for gai_strerror */
36 #include <stdlib.h> /* for free */
37 #include <string.h> /* for memcpy */
39 uint64_t total_packets
= 0, total_bytes
= 0;
41 static int using_localnet4
= 0, using_localnet6
= 0;
42 static struct addr localnet4
, localmask4
, localnet6
, localmask6
;
44 /* Parse the net/mask specification into two IPs or die trying. */
46 acct_init_localnet(const char *spec
)
49 int num_tokens
, isnum
, j
, ret
;
50 int pfxlen
, octets
, remainder
;
51 struct addr localnet
, localmask
;
53 tokens
= split('/', spec
, &num_tokens
);
55 errx(1, "expecting network/netmask, got \"%s\"", spec
);
57 if ((ret
= str_to_addr(tokens
[0], &localnet
)) != 0)
58 errx(1, "couldn't parse \"%s\": %s", tokens
[0], gai_strerror(ret
));
60 /* Detect a purely numeric argument. */
63 const char *p
= tokens
[1];
77 if ((ret
= str_to_addr(tokens
[1], &localmask
)) != 0)
78 errx(1, "couldn't parse \"%s\": %s", tokens
[1], gai_strerror(ret
));
79 if (localmask
.family
!= localnet
.family
)
80 errx(1, "family mismatch between net and mask");
84 localmask
.family
= localnet
.family
;
86 /* Compute the prefix length. */
87 pfxlen
= strtonum(tokens
[1], 1,
88 (localnet
.family
== IPv6
) ? 128 : 32, NULL
);
90 errx(1, "invalid network prefix length \"%s\"", tokens
[1]);
92 /* Construct the network mask. */
94 remainder
= pfxlen
% 8;
95 p
= (localnet
.family
== IPv6
) ? (localmask
.ip
.v6
.s6_addr
)
96 : ((uint8_t *) &(localmask
.ip
.v4
));
98 if (localnet
.family
== IPv6
)
103 for (j
= 0; j
< octets
; ++j
)
106 frac
= 0xff << (8 - remainder
);
108 p
[j
] = frac
; /* Have contribution for next position. */
115 /* Register the correct netmask and calculate the correct net. */
116 addr_mask(&localnet
, &localmask
);
117 if (localnet
.family
== IPv6
) {
119 localnet6
= localnet
;
120 localmask6
= localmask
;
123 localnet4
= localnet
;
124 localmask4
= localmask
;
127 verbosef("local network address: %s", addr_to_str(&localnet
));
128 verbosef(" local network mask: %s", addr_to_str(&localmask
));
132 addr_is_local(const struct addr
* const a
)
134 if (a
->family
== IPv4
) {
135 if (using_localnet4
) {
136 if (addr_inside(a
, &localnet4
, &localmask4
))
139 if (addr_equal(a
, &localip4
))
143 assert(a
->family
== IPv6
);
144 if (using_localnet6
) {
145 if (addr_inside(a
, &localnet6
, &localmask6
))
148 if (addr_equal(a
, &localip6
))
155 /* Account for the given packet summary. */
157 acct_for(const struct pktsummary
* const sm
)
159 struct bucket
*hs
= NULL
, *hd
= NULL
;
160 struct bucket
*ps
, *pd
;
163 #if 0 /* WANT_CHATTY? */
164 printf("%15s > ", addr_to_str(&sm
->src
));
165 printf("%15s ", addr_to_str(&sm
->dst
));
166 printf("len %4d proto %2d", sm
->len
, sm
->proto
);
168 if (sm
->proto
== IPPROTO_TCP
|| sm
->proto
== IPPROTO_UDP
)
169 printf(" port %5d : %5d", sm
->src_port
, sm
->dst_port
);
170 if (sm
->proto
== IPPROTO_TCP
)
171 printf(" %s%s%s%s%s%s",
172 (sm
->tcp_flags
& TH_FIN
)?"F":"",
173 (sm
->tcp_flags
& TH_SYN
)?"S":"",
174 (sm
->tcp_flags
& TH_RST
)?"R":"",
175 (sm
->tcp_flags
& TH_PUSH
)?"P":"",
176 (sm
->tcp_flags
& TH_ACK
)?"A":"",
177 (sm
->tcp_flags
& TH_URG
)?"U":""
184 total_bytes
+= sm
->len
;
187 dir_out
= addr_is_local(&(sm
->src
));
188 dir_in
= addr_is_local(&(sm
->dst
));
190 /* Traffic staying within the network isn't counted. */
191 if (dir_in
== 1 && dir_out
== 1)
192 dir_in
= dir_out
= 0;
195 daylog_acct((uint64_t)sm
->len
, GRAPH_OUT
);
196 graph_acct((uint64_t)sm
->len
, GRAPH_OUT
);
199 daylog_acct((uint64_t)sm
->len
, GRAPH_IN
);
200 graph_acct((uint64_t)sm
->len
, GRAPH_IN
);
203 if (hosts_max
== 0) return; /* skip per-host accounting */
206 hs
= host_get(&(sm
->src
));
208 hs
->total
+= sm
->len
;
209 memcpy(hs
->u
.host
.mac_addr
, sm
->src_mac
, sizeof(sm
->src_mac
));
210 hs
->u
.host
.last_seen
= now
;
212 hd
= host_get(&(sm
->dst
)); /* this can invalidate hs! */
214 hd
->total
+= sm
->len
;
215 memcpy(hd
->u
.host
.mac_addr
, sm
->dst_mac
, sizeof(sm
->dst_mac
));
216 hd
->u
.host
.last_seen
= now
;
219 hs
= host_find(&(sm
->src
));
221 ps
= host_get_ip_proto(hs
, sm
->proto
);
223 ps
->total
+= sm
->len
;
226 pd
= host_get_ip_proto(hd
, sm
->proto
);
228 pd
->total
+= sm
->len
;
230 if (ports_max
== 0) return; /* skip ports accounting */
236 if ((sm
->src_port
<= highest_port
) && (hs
!= NULL
))
238 ps
= host_get_port_tcp(hs
, sm
->src_port
);
240 ps
->total
+= sm
->len
;
243 if (sm
->dst_port
<= highest_port
)
245 pd
= host_get_port_tcp(hd
, sm
->dst_port
);
247 pd
->total
+= sm
->len
;
248 if (sm
->tcp_flags
== TH_SYN
)
249 pd
->u
.port_tcp
.syn
++;
254 if ((sm
->src_port
<= highest_port
) && (hs
!= NULL
))
256 ps
= host_get_port_udp(hs
, sm
->src_port
);
258 ps
->total
+= sm
->len
;
261 if (sm
->dst_port
<= highest_port
)
263 pd
= host_get_port_udp(hd
, sm
->dst_port
);
265 pd
->total
+= sm
->len
;
274 /* known protocol, don't complain about it */
278 verbosef("unknown IP proto (%04x)", sm
->proto
);
282 /* vim:set ts=3 sw=3 tw=78 expandtab: */