2 * copyright (c) 2001-2011 Emil Mikulic.
4 * acct.c: traffic accounting
6 * Permission to use, copy, modify, and distribute this file for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
29 #include <arpa/inet.h> /* for inet_aton() */
31 #include <netinet/tcp.h>
32 #include <sys/socket.h>
34 #include <ctype.h> /* for isdigit */
35 #include <netdb.h> /* for gai_strerror */
36 #include <stdlib.h> /* for free */
37 #include <string.h> /* for memcpy */
39 uint64_t acct_total_packets
= 0, acct_total_bytes
= 0;
41 static int using_localnet4
= 0, using_localnet6
= 0;
42 static struct addr localnet4
, localmask4
, localnet6
, localmask6
;
44 /* Parse the net/mask specification into two IPs or die trying. */
46 acct_init_localnet(const char *spec
)
49 unsigned int num_tokens
;
51 int pfxlen
, octets
, remainder
;
52 struct addr localnet
, localmask
;
54 tokens
= split('/', spec
, &num_tokens
);
56 errx(1, "expecting network/netmask, got \"%s\"", spec
);
58 if ((ret
= str_to_addr(tokens
[0], &localnet
)) != 0)
59 errx(1, "couldn't parse \"%s\": %s", tokens
[0], gai_strerror(ret
));
61 /* Detect a purely numeric argument. */
64 const char *p
= tokens
[1];
78 if ((ret
= str_to_addr(tokens
[1], &localmask
)) != 0)
79 errx(1, "couldn't parse \"%s\": %s", tokens
[1], gai_strerror(ret
));
80 if (localmask
.family
!= localnet
.family
)
81 errx(1, "family mismatch between net and mask");
86 localmask
.family
= localnet
.family
;
88 /* Compute the prefix length. */
89 pfxlen
= (unsigned int)strtol(tokens
[1], &endptr
, 10);
92 ((localnet
.family
== IPv6
) && (pfxlen
> 128)) ||
93 ((localnet
.family
== IPv4
) && (pfxlen
> 32)) ||
94 (tokens
[1][0] == '\0') ||
96 errx(1, "invalid network prefix length \"%s\"", tokens
[1]);
98 /* Construct the network mask. */
100 remainder
= pfxlen
% 8;
101 p
= (localnet
.family
== IPv6
) ? (localmask
.ip
.v6
.s6_addr
)
102 : ((uint8_t *) &(localmask
.ip
.v4
));
104 if (localnet
.family
== IPv6
)
109 for (j
= 0; j
< octets
; ++j
)
112 frac
= (uint8_t)(0xff << (8 - remainder
));
114 p
[j
] = frac
; /* Have contribution for next position. */
121 /* Register the correct netmask and calculate the correct net. */
122 addr_mask(&localnet
, &localmask
);
123 if (localnet
.family
== IPv6
) {
125 localnet6
= localnet
;
126 localmask6
= localmask
;
129 localnet4
= localnet
;
130 localmask4
= localmask
;
133 verbosef("local network address: %s", addr_to_str(&localnet
));
134 verbosef(" local network mask: %s", addr_to_str(&localmask
));
138 addr_is_local(const struct addr
* const a
)
140 if (a
->family
== IPv4
) {
141 if (using_localnet4
) {
142 if (addr_inside(a
, &localnet4
, &localmask4
))
145 if (addr_equal(a
, &localip4
))
149 assert(a
->family
== IPv6
);
150 if (using_localnet6
) {
151 if (addr_inside(a
, &localnet6
, &localmask6
))
154 if (addr_equal(a
, &localip6
))
161 /* Account for the given packet summary. */
163 acct_for(const struct pktsummary
* const sm
)
165 struct bucket
*hs
= NULL
, *hd
= NULL
;
166 struct bucket
*ps
, *pd
;
169 #if 0 /* WANT_CHATTY? */
170 printf("%15s > ", addr_to_str(&sm
->src
));
171 printf("%15s ", addr_to_str(&sm
->dst
));
172 printf("len %4d proto %2d", sm
->len
, sm
->proto
);
174 if (sm
->proto
== IPPROTO_TCP
|| sm
->proto
== IPPROTO_UDP
)
175 printf(" port %5d : %5d", sm
->src_port
, sm
->dst_port
);
176 if (sm
->proto
== IPPROTO_TCP
)
177 printf(" %s%s%s%s%s%s",
178 (sm
->tcp_flags
& TH_FIN
)?"F":"",
179 (sm
->tcp_flags
& TH_SYN
)?"S":"",
180 (sm
->tcp_flags
& TH_RST
)?"R":"",
181 (sm
->tcp_flags
& TH_PUSH
)?"P":"",
182 (sm
->tcp_flags
& TH_ACK
)?"A":"",
183 (sm
->tcp_flags
& TH_URG
)?"U":""
189 acct_total_packets
++;
190 acct_total_bytes
+= sm
->len
;
193 dir_out
= addr_is_local(&(sm
->src
));
194 dir_in
= addr_is_local(&(sm
->dst
));
196 /* Traffic staying within the network isn't counted. */
197 if (dir_in
== 1 && dir_out
== 1)
198 dir_in
= dir_out
= 0;
201 daylog_acct((uint64_t)sm
->len
, GRAPH_OUT
);
202 graph_acct((uint64_t)sm
->len
, GRAPH_OUT
);
205 daylog_acct((uint64_t)sm
->len
, GRAPH_IN
);
206 graph_acct((uint64_t)sm
->len
, GRAPH_IN
);
209 if (opt_hosts_max
== 0) return; /* skip per-host accounting */
213 hs
= host_get(&(sm
->src
));
215 hs
->total
+= sm
->len
;
216 memcpy(hs
->u
.host
.mac_addr
, sm
->src_mac
, sizeof(sm
->src_mac
));
217 hs
->u
.host
.lastseen
= now
;
219 hd
= host_get(&(sm
->dst
));
221 hd
->total
+= sm
->len
;
222 memcpy(hd
->u
.host
.mac_addr
, sm
->dst_mac
, sizeof(sm
->dst_mac
));
224 * Don't update recipient's last seen time, we don't know that
225 * they received successfully.
229 if (sm
->proto
!= IPPROTO_INVALID
) {
230 ps
= host_get_ip_proto(hs
, sm
->proto
);
232 ps
->total
+= sm
->len
;
234 pd
= host_get_ip_proto(hd
, sm
->proto
);
236 pd
->total
+= sm
->len
;
239 if (opt_ports_max
== 0) return; /* skip ports accounting */
244 if (sm
->src_port
<= opt_highest_port
) {
245 ps
= host_get_port_tcp(hs
, sm
->src_port
);
247 ps
->total
+= sm
->len
;
250 if (sm
->dst_port
<= opt_highest_port
) {
251 pd
= host_get_port_tcp(hd
, sm
->dst_port
);
253 pd
->total
+= sm
->len
;
254 if (sm
->tcp_flags
== TH_SYN
)
255 pd
->u
.port_tcp
.syn
++;
260 if (sm
->src_port
<= opt_highest_port
) {
261 ps
= host_get_port_udp(hs
, sm
->src_port
);
263 ps
->total
+= sm
->len
;
266 if (sm
->dst_port
<= opt_highest_port
) {
267 pd
= host_get_port_udp(hd
, sm
->dst_port
);
269 pd
->total
+= sm
->len
;
278 /* known protocol, don't complain about it */
282 verbosef("unknown IP proto (%04x)", sm
->proto
);
286 /* vim:set ts=3 sw=3 tw=78 expandtab: */