Index: itignore =================================================================== --- .gitignore (revision 6ccf909157f91183a7790e6f8544755b2a6b4768) +++ (revision ) @@ -1,6 +1,0 @@ -*.o -*.swp -netslow -bin/ -obj/ -readme/ Index: nfig.cpp =================================================================== --- Config.cpp (revision 6ccf909157f91183a7790e6f8544755b2a6b4768) +++ (revision ) @@ -1,174 +1,0 @@ -#include "Config.h" - -#include -#include -#include -using namespace std; - -#include "Log.h" - -Config::Config(string name, string parentDebugInfo) { - debugInfo = parentDebugInfo + ", " + name; -} - -Config::Config(string configFile, char** envp) { - while (*envp) { - string envEntry = *envp; - size_t pos = envEntry.find('='); - if (pos != string::npos) { - string name = envEntry.substr(0, pos); - string value = envEntry.substr(pos+1, string::npos); - envSymbols[name] = value; - logDebug(cout << "environment symbol: '" << name << "' = '" << value << "'" << endl); - } - ++envp; - } - - debugInfo = configFile; - groupStack.push_front(this); - - FILE* in = fopen(configFile.c_str(), "r"); - if (!in) { - cerr << "cannot open input file '" << configFile << "'" << endl; - exit(2); - } - - char buff[1024]; - while (fgets(buff, 1024, in)) { - - string line=buff; - if ( (line.length() > 2) && (line[0] != '#') && (line.find(')') == string::npos) ) { - string name; - string value; - split(line, name, value, '='); - - if (value == "(") { - logDebug(cout << " config: new group '" << name << "'" << endl); - Config* newGroup = new Config(name, debugInfo); - groupStack.front()->groups[name] = newGroup; - groupStack.push_front(newGroup); - } else { - for (list::reverse_iterator i = groupStack.rbegin(); i != groupStack.rend(); ++i) { - (*i)->symbolExpand(value); - } - envSymbolExpand(value); - logDebug(cout << " config: name = '" << name << "', value = '" << value << "'" << endl); - groupStack.front()->add(name, value); - } - } - if ( (line.length() > 0) && (line[0] != '#') && (line.find(')') != string::npos) ) { - logDebug(cout << " end of group" << endl); - groupStack.pop_front(); - } - } - - fclose(in); -} - -Config::~Config() { - for (map::iterator i = groups.begin(); i != groups.end(); ++i) { - delete i->second; - } -} - -void Config::add(string name, string value) { - symbols[name] = value; -} - -void Config::split(string in, string& left, string& right, char c) { - size_t pos = in.find_first_of(c); - if(pos == string::npos) { - left = in; - trim(left); - right = ""; - } else if (pos <= 1) { - left = ""; - right = in.substr(pos+1, string::npos); - trim(right); - } else { - left = in.substr(0, pos-1); - trim(left); - right = in.substr(pos+1, string::npos); - trim(right); - } -} - -void Config::trim(string& s) { - while ( (s.length() > 1) && ( (s[0] == ' ') || (s[0] =='\t') ) ) { - s = s.substr(1, string::npos); - } - while ( (s.length() > 1) && - ( (s[s.length()-1] == ' ') || - (s[s.length()-1] == '\t') || - (s[s.length()-1] == '\n') || - (s[s.length()-1] == '\r') ) ) { - s = s.substr(0, s.length()-1); - } - if ( (s.length() > 1) && (s[0] == '"') ) { - s = s.substr(1, string::npos); - } - if ( (s.length() > 1) && (s[s.length()-1] == '"') ) { - s = s.substr(0, s.length()-1); - } -} - -void Config::symbolExpand(string& s) { - symbolExpand(symbols, s); -} - -void Config::envSymbolExpand(string& s) { - symbolExpand(envSymbols, s); -} - -void Config::symbolExpand(map& symbols, string& s) { - bool expanded; - do { - expanded = false; - for (map::iterator i = symbols.begin(); i != symbols.end(); ++i) { - string search = "%" + i->first + "%"; - string replace = i->second; - size_t pos = s.find(search); - if (pos != string::npos) { - expanded = true; - s.replace(pos, search.length(), replace); - } - } - } while (expanded); -} - -string Config::pString(string name) { - map::iterator i = symbols.find(name); - if (i == symbols.end()) { - logError(cout << "access of missing property '" << name << "' (" << debugInfo << ")" << endl); - exit(4); - } - return i->second; -} - -bool Config::pBool(string name) { - string val = pString(name); - - if ( (val == "yes") || - (val == "Yes") || - (val == "YES") || - (val == "true") || - (val == "True") || - (val == "TRUE")) - { - return true; - } - - return false; -} - -double Config::pDouble(string name) { - string val = pString(name); - - return atof(val.c_str()); -} - -int Config::pInt(string name) { - string val = pString(name); - - return atoi(val.c_str()); -} Index: nfig.h =================================================================== --- Config.h (revision 6ccf909157f91183a7790e6f8544755b2a6b4768) +++ (revision ) @@ -1,101 +1,0 @@ -#ifndef IncConfig -#define IncConfig - -#include -#include -#include -using namespace std; - -/* - Config - - Parse structured config files - - Config files contains lines with name-value assignements in the form " = ". - Trailing and leading whitespace is stripped. Parsed config entries are stored in - a symbol map. - - Lines beginning with '#' are a comment and ignored. - - Config files may be structured (to arbitrary depth). To start a new config sub group - (or sub section) use a line in the form of " = (". - Subsequent entries are stured in the sub group, until a line containing ")" is found. - - Values may reuse already defined names as a variable which gets expanded during - the parsing process. Names for expansion are searched from the current sub group - upwards. Finally the process environment is searched, so also environment - variables may be used as expansion symbols in the config file. - - Errors and warnings are handled by emitting logging messages (see log.h/log.cpp) - or by calling exit() for severe errors. Depending on project needs this may be replaced - by exeptions, error return codes, ... - */ - -class Config { - public: - /* Parse config file 'configFile'. If the process environment - * is provided, environment variables can be used as expansion symbols. - */ - Config(string configFile, char** envp = 0); - - ~Config(); - - // get string config entry - string pString(string name); - - /* get boolean config entry - * A value of Yes/yes/YES/true/True/TRUE leads to true, - * all other values leads to false. - */ - bool pBool(string name); - - // get double config entry; value is parsed using atof() - double pDouble(string name); - - // get int config entry; value is parsed using atoi() - int pInt(string name); - - // get the symbol map (e.g. for iterating over all symbols) - inline map& getSymbols() { - return symbols; - } - - // get config sub group - inline Config* group(string name) { - return groups[name]; - } - - // get config sub group map (e.g. for iterating over all groups) - inline map& getGroups() { - return groups; - } - - private: - // private constructor for sub groups - Config(string name, string parentDebugInfo); - - // helper functions for parsing - void add(string name, string value); - void split(string in, string& left, string& right, char c); - void trim(string& s); - void symbolExpand(string& s); - void symbolExpand(map& symbols, string& s); - void envSymbolExpand(string& s); - - // config group symbol map - map symbols; - - // environment symbol map - map envSymbols; - - // config sub group map - map groups; - - // stack of config groups for parsing (only used in top config element) - list groupStack; - - // debug info used for logging messages - string debugInfo; -}; - -#endif Index: owSet.cpp =================================================================== --- FlowSet.cpp (revision 6ccf909157f91183a7790e6f8544755b2a6b4768) +++ (revision ) @@ -1,31 +1,0 @@ -#include "FlowSet.h" - -FlowSet::FlowSet(char remoteIPStr[]) { - srcIpStr = remoteIPStr; - return; -} - -FlowSet::~FlowSet() { - int i = 0; - for (i =0; i - -#ifndef FLOWSET -#define FLOWSET - -class FlowSet { - - - public: - - //Constructor (id, length) - FlowSet(char remoteIPStr[]); - ~FlowSet(); - - void AddFlowSetRecord(FlowSetRecord *data); - FlowSetRecord* GetRecord(unsigned short index); - unsigned short GetCount(); - - private: - - char *srcIpStr; - std::vector FlowSetRecords; - -}; - -#endif Index: owSetRecord.cpp =================================================================== --- FlowSetRecord.cpp (revision 6ccf909157f91183a7790e6f8544755b2a6b4768) +++ (revision ) @@ -1,36 +1,0 @@ -#include "FlowSetRecord.h" - -FlowSetRecord::FlowSetRecord(unsigned short _count) { - //do stuff - count = _count; - Field = new Field_t[count]; - return; -} - -FlowSetRecord::~FlowSetRecord() { - int i = 0; - for (i = 0 ; i < count ; i++) { - delete Field[i].data; - } - delete Field; -} - -FlowSetRecord::FlowSetRecord() { -} - -void FlowSetRecord::AddRecord(unsigned short code, unsigned short length, unsigned char *data) { - Field[currentField].code = code; - Field[currentField].length = length; - Field[currentField].data = new unsigned char[length]; - memcpy(Field[currentField].data, data, length); - currentField++; - return; -} - -FlowSetRecord::Field_t FlowSetRecord::GetRecord(unsigned short index) { - return Field[index]; -} - -unsigned short FlowSetRecord::GetCount() { - return count; -} Index: owSetRecord.h =================================================================== --- FlowSetRecord.h (revision 6ccf909157f91183a7790e6f8544755b2a6b4768) +++ (revision ) @@ -1,37 +1,0 @@ -#include - -#ifndef FLOWSETRECORD -#define FLOWSETRECORD - -class FlowSetRecord { - - - public: - - struct _Field { - unsigned short code; - unsigned short length; - unsigned char *data; - }; - typedef struct _Field Field_t; - - //Constructor (id, length) - FlowSetRecord(unsigned short _count); - FlowSetRecord(); - ~FlowSetRecord(); - - void AddRecord(unsigned short code, unsigned short length, unsigned char *data); - Field_t GetRecord(unsigned short index); - unsigned short GetCount(); - - - - private: - - Field_t *Field; - unsigned short count=0; - unsigned short currentField=0; - -}; - -#endif Index: g.cpp =================================================================== --- Log.cpp (revision 6ccf909157f91183a7790e6f8544755b2a6b4768) +++ (revision ) @@ -1,3 +1,0 @@ -#include "Log.h" - -LogLevel logLevel = LOG_INFO; Index: g.h =================================================================== --- Log.h (revision 6ccf909157f91183a7790e6f8544755b2a6b4768) +++ (revision ) @@ -1,14 +1,0 @@ -#ifndef IncLog -#define IncLog - -enum LogLevel { LOG_QUIET, LOG_ERROR, LOG_INFO, LOG_DEBUG }; - -extern LogLevel logLevel; - -#define logError(A) ((logLevel >= LOG_ERROR)?((A),0):(0)) -#define logInfo(A) ((logLevel >= LOG_INFO)?((A),0):(0)) -#define logDebug(A) ((logLevel >= LOG_DEBUG)?((A),0):(0)) - -void debugBreak(); - -#endif Index: Makefile =================================================================== --- Makefile (revision 6ccf909157f91183a7790e6f8544755b2a6b4768) +++ Makefile (revision c0066d923a2cbc240981ea5743959934e4be7fb1) @@ -1,21 +1,15 @@ CC=g++ -CFLAGS = -g -DLINUX -CXXFLAGS = -g -std=c++11 -pthread -LIBS = -pthread -lmongoclient -lboost_thread -lboost_system -lssl -lcrypto +CFLAGS = -g +# uncomment this for SunOS +# LIBS = -lsocket -lnsl all: netslow -netslow: netslow.o NetFlow9Processor.o NetFlowDataTemplateCache.o NetFlowDataTemplate.o FlowSet.o FlowSetRecord.o Config.o Log.o - $(CC) -o netslow netslow.o NetFlow9Processor.o NetFlowDataTemplateCache.o NetFlowDataTemplate.o FlowSet.o FlowSetRecord.o Config.o Log.o $(LIBS) +netslow: netslow.o NetFlow9Processor.o + $(CC) -o netslow netslow.o NetFlow9Processor.o $(LIBS) -netslow.o: netslow.cpp +netslow.o: netslow.cpp port.h NetFlow9Processor.o: NetFlow9Processor.cpp -NetFlowDataTemplateCache.o: NetFlowDataTemplateCache.cpp -NetFlowDataTemplate.o: NetFlowDataTemplate.cpp -FlowSet.o: FlowSet.cpp -FlowSetRecord.o: FlowSetRecord.cpp -Config.o: Config.cpp -Log.o: Log.cpp clean: Index: NetFlow9Processor.cpp =================================================================== --- NetFlow9Processor.cpp (revision 6ccf909157f91183a7790e6f8544755b2a6b4768) +++ NetFlow9Processor.cpp (revision c0066d923a2cbc240981ea5743959934e4be7fb1) @@ -1,224 +1,13 @@ #include "NetFlow9Processor.h" -unsigned int NetFlow9Processor::ByteTouInt32(unsigned char bytes[], int base) { - //TODO: Check for out of range muppets - //TODO: Endianess issues? - return (bytes[base] << 24) + (bytes[base+1] << 16) + (bytes[base+2] << 8) + bytes[base+3]; +int NetFlow9Processor::ProcessPacket(unsigned char b[], int l) { + if ( l < 2) { + return 255; + } + int version = (b[0] << 8 ) + b [1]; + if (version != 9) { + return 253; + } + int count; + return version; } - -unsigned short NetFlow9Processor::ByteTouInt16(unsigned char bytes[], int base) { - //TODO: Check for out of range muppets - //TODO: Endianess issues? - return (bytes[base] << 8) + bytes[base+1]; -} - - -NetFlow9Processor::NetFlow9Processor(struct sockaddr *remoteAddress, socklen_t *addressLength) { - dataTemplateCache = new NetFlowDataTemplateCache(); - switch (remoteAddress->sa_family) { - case AF_INET: - //set IP - inet_ntop(AF_INET, &((sockaddr_in *)remoteAddress)->sin_addr, remoteIPStr, INET_ADDRSTRLEN); - break; - case AF_INET6: - //set IP - break; - default: - //uhoh - break; - } - name = "undefined"; - -} - -FlowSet* NetFlow9Processor::ProcessPacket(unsigned char buffer[], int bufferLength) { - - int nextIndex = 0; // Next byte in the buffer - int version = 0; // NetFlow version - int count = 0; // Records in the packet - unsigned short flowSetID = 0; // ID of the current FlowSet - unsigned short flowSetLength = 0; // Bytes in the current FlowSet - unsigned int uptime = 0; // Router uptime in miliseconds - unsigned int packetTime = 0; // Time sent by router (Unix seconds) - unsigned int sequenceID = 0; // Incremented by one for each packet sent - unsigned int sourceID = 0; // Locally significant source ID - FlowSet* processedFlowSet = nullptr; - - if ( bufferLength < 24) { - //Packet is too short to contain a header - return processedFlowSet; - } - - //First 2 bytes (0 and 1) are the version - version = (buffer[0] << 8 ) + buffer [1]; - if (version != 9) { - //Not a NetFlow v9 packet - return processedFlowSet; - } - - //Bytes 2 and 3 are the count of records in the packet - count = (buffer[2] << 8 ) + buffer [3]; - - if (count < 1) { - //Not a NetFlow v9 packet - return processedFlowSet; - } - - nextIndex = 4; - uptime = ByteTouInt32(buffer,nextIndex); - nextIndex += 4; - packetTime = ByteTouInt32(buffer,nextIndex); - nextIndex += 4; - sequenceID = ByteTouInt32(buffer,nextIndex); - nextIndex += 4; - sourceID = ByteTouInt32(buffer,nextIndex); - nextIndex += 4; - - do { - flowSetID = ByteTouInt16(buffer,nextIndex); - flowSetLength = ByteTouInt16(buffer,nextIndex+2); - if (nextIndex + flowSetLength > bufferLength) { - //Invalid/unsupported packet - return processedFlowSet; - } - if (flowSetID > 255) { - //DATA FlowSet - printf(" -> Found data flowSetID %d, length %d.\n", flowSetID, flowSetLength); - processedFlowSet = processDataFlowSet(buffer,nextIndex,flowSetID,flowSetLength, remoteIPStr); - } - else if (flowSetID == 0) { - //TEMPLATE FlowSet - printf(" -> Found template flowSetID %d, length %d.\n", flowSetID, flowSetLength); - processTemplateFlowSet(buffer,nextIndex,flowSetLength); - } - else if (flowSetID == 1) { - //OPTIONS FlowSet - printf(" -> Found options flowSetID %d, length %d.\n", flowSetID, flowSetLength); - } - else { - //Invalid/unsupported packet - return processedFlowSet; - } - nextIndex += flowSetLength; - } - while ( nextIndex < bufferLength); - - return processedFlowSet; -} - -FlowSet* NetFlow9Processor::processDataFlowSet(unsigned char buffer[], int startIndex, unsigned short flowSetID, unsigned short flowSetLength, char strRemoteIP[]) { - int nextIndex = startIndex + 4; // Next place to look (skip 4 header bytes already parsed) - int endIndex = startIndex + flowSetLength ; // End the loop at the end of the template - NetFlowDataTemplate *dataTemplate; // Data Template object - NetFlowDataTemplate::Field_t field; - FlowSet *Flowset; - int recordsExpected = 0; - int dataTemplateRecordLength = 0; - int lengthOfAllRecords = 0; - int count = 0; - - dataTemplate = dataTemplateCache->GetDataTemplate(flowSetID); - if (!dataTemplate) { - printf(" -> Template ID %d doesn't exist in the cache... skipping\n", flowSetID); - return nullptr; - } - - dataTemplateRecordLength = dataTemplate->recordLength(); - recordsExpected = flowSetLength / dataTemplateRecordLength; - lengthOfAllRecords = recordsExpected * dataTemplateRecordLength; - - if (lengthOfAllRecords>flowSetLength) { - printf(" -> Length of all record expected in the FlowSet exceeds the length reported\n"); - return nullptr; - } - - printf(" -> FS Length %d, FSR Length: %d, FSRs expected: %d, recalculated length: %d\n", dataTemplateRecordLength, flowSetLength, recordsExpected, lengthOfAllRecords); - - Flowset = new FlowSet(strRemoteIP); - - for (count = 0; count < recordsExpected; count++) { - - printf(" -> Parsing record %d.\n", count); - - FlowSetRecord *record = new FlowSetRecord(dataTemplate->Fields.size()); - - for (std::list::iterator it=dataTemplate->Fields.begin(); it != dataTemplate->Fields.end(); ++it) { - field = *it; - printf(" -> Code: %d, length: %d\n", field.code, field.length); - - //Form a standard record and return it - - unsigned char recordBuffer[field.length]; - std::copy(buffer + nextIndex, buffer + nextIndex + field.length, recordBuffer); - record->AddRecord(field.code, field.length, recordBuffer); - - nextIndex += field.length; - } - - Flowset->AddFlowSetRecord(record); - } - - return Flowset; -} - -void NetFlow9Processor::processTemplateFlowSet(unsigned char buffer[], int startIndex, unsigned short flowSetLength) { - - int nextIndex = startIndex + 4; // Next place to look (skip 4 header bytes already parsed) - int endIndex = startIndex + flowSetLength ; // End the loop at the end of the template - unsigned short count = 0; // Count of fields to extract - unsigned short id = 0; // ID the template applies to - NetFlowDataTemplate *dataTemplate; // Data Template object - NetFlowDataTemplate *existingDataTemplate; // Data Template object if it already exists - NetFlowDataTemplate::Field_t field; - - do { - - //Lets get the Template ID and the count of fields - id = ByteTouInt16(buffer,nextIndex); - count = ByteTouInt16(buffer,nextIndex+2); - - printf(" -> Template ID %d\n", id); - - //Increment nextIndex to skip the 4 bytes of the header already parsed - nextIndex += 4; - - dataTemplate = new NetFlowDataTemplate(id, count); - - int i; - - for (i=0; i < count; i++) { - field.code = ByteTouInt16(buffer,nextIndex); - field.length = ByteTouInt16(buffer,nextIndex+2); - printf(" -> Field %d. Field Code %d, length %d\n", i, field.code, field.length ); - dataTemplate->Fields.push_back( field ); - nextIndex += 4; - } - - //Check if ID is in cache - if ( dataTemplateCache->ExistsDataTemplate(id) ) { - //Yes --> Update - printf(" -> Template ID %d in cache.\n", id); - existingDataTemplate = dataTemplateCache->DeleteDataTemplate(id); - delete existingDataTemplate; - if ( dataTemplateCache->AddDataTemplate(id, dataTemplate) ) { - printf(" -> Template ID %d updated.\n", id); - } - else { - printf(" -> ERROR: Failed to update Template ID %d.\n", id); - } - } - else { - //No --> Add - if ( dataTemplateCache->AddDataTemplate(id, dataTemplate) ) { - printf(" -> Template ID %d added.\n", id); - } - else { - printf(" -> ERROR: Failed to add Template ID %d.\n", id); - } - } - - - } - while ( nextIndex < endIndex ); - -} Index: NetFlow9Processor.h =================================================================== --- NetFlow9Processor.h (revision 6ccf909157f91183a7790e6f8544755b2a6b4768) +++ NetFlow9Processor.h (revision c0066d923a2cbc240981ea5743959934e4be7fb1) @@ -1,37 +1,6 @@ -#include -#include -#include -#include -#include -#include -#include "NetFlowDataTemplateCache.h" -#include "FlowSet.h" - -#ifndef NETFLOW9PROCESSOR -#define NETFLOW9PROCESSOR class NetFlow9Processor{ - public: - - NetFlow9Processor(struct sockaddr *remoteAddress, socklen_t *addressLength); - FlowSet* ProcessPacket(unsigned char buffer[], int bufferLength); - - - protected: - - NetFlowDataTemplateCache *dataTemplateCache; - char remoteIPStr[INET6_ADDRSTRLEN]; - unsigned char remoteIPBytes[16]; - std::string name; -// NetFlowDataTemplate::DataTemplateItem_t *strtest; - - unsigned int ByteTouInt32(unsigned char bytes[], int base); - unsigned short ByteTouInt16(unsigned char bytes[], int base); - FlowSet* processDataFlowSet(unsigned char buffer[], int nextIndex, unsigned short flowSetID, unsigned short flowSetLength, char strRemoteIP[]); - void processTemplateFlowSet(unsigned char buffer[], int nextIndex, unsigned short flowSetLength); - + int ProcessPacket(unsigned char b[], int l); }; - -#endif Index: tFlowDataTemplate.cpp =================================================================== --- NetFlowDataTemplate.cpp (revision 6ccf909157f91183a7790e6f8544755b2a6b4768) +++ (revision ) @@ -1,15 +1,0 @@ -#include "NetFlowDataTemplate.h" - -NetFlowDataTemplate::NetFlowDataTemplate(unsigned short templateID, unsigned short fieldCount) { - _id = templateID; - _count = fieldCount; -} - -int NetFlowDataTemplate::recordLength() { - int total = 0; - for (std::list::iterator it = Fields.begin(); it != Fields.end(); ++it) { - Field_t field = *it; - total += field.length; - } - return total; -} Index: tFlowDataTemplate.h =================================================================== --- NetFlowDataTemplate.h (revision 6ccf909157f91183a7790e6f8544755b2a6b4768) +++ (revision ) @@ -1,30 +1,0 @@ -#include - -#ifndef NETFLOWDATATEMPLATE -#define NETFLOWDATATEMPLATE - -class NetFlowDataTemplate { - - - public: - - struct Field { - unsigned short code; - unsigned short length; - }; - typedef struct Field Field_t; - - std::list Fields; - - //Constructor (templateID, fieldCount) - NetFlowDataTemplate(unsigned short templateID, unsigned short fieldCount); - int recordLength(); - - private: - - unsigned short _id; - unsigned short _count; - -}; - -#endif Index: tFlowDataTemplateCache.cpp =================================================================== --- NetFlowDataTemplateCache.cpp (revision 6ccf909157f91183a7790e6f8544755b2a6b4768) +++ (revision ) @@ -1,71 +1,0 @@ -#include "NetFlowDataTemplateCache.h" - -NetFlowDataTemplateCache::NetFlowDataTemplateCache(void) { -} - -bool NetFlowDataTemplateCache::AddDataTemplate (unsigned short templateID, NetFlowDataTemplate* dataTemplate) { - NetFlowDataTemplate *test; - printf(" -> Adding DataTemplate ID %d.\n", templateID); - try { - printf(" -> Trying to fetch %d.\n", templateID); - test = _Cache.at(templateID); - } - catch (const std::out_of_range oor) { - //Out of range --> Not in Cache - Great! - printf(" -> Not found - adding.\n"); - _Cache[templateID] = dataTemplate; - return true; - } - //Uh-oh - this ID is already in the cache - printf(" -> Already in the cache - fail.\n", templateID); - return 0; -} - -bool NetFlowDataTemplateCache::ExistsDataTemplate (unsigned short templateID) { - NetFlowDataTemplate *test; - printf(" -> Checking for DataTemplate ID %d.\n", templateID); - try { - printf(" -> Trying to fetch %d.\n", templateID); - test = _Cache.at(templateID); - } - catch (const std::out_of_range oor) { - printf(" -> Not found.\n"); - //Out of range --> Not in Cache - return 0; - } - printf(" -> Found.\n"); - return 1; -} - -NetFlowDataTemplate* NetFlowDataTemplateCache::GetDataTemplate (unsigned short templateID) { - NetFlowDataTemplate *dataTemplate; - printf(" -> Getting DataTemplate ID %d.\n", templateID); - try { - printf(" -> Trying to fetch %d.\n", templateID); - dataTemplate = _Cache.at(templateID); - } - catch (const std::out_of_range oor) { - printf(" -> Not found.\n"); - //Out of range --> Not in Cache - return 0; - } - printf(" -> Found.\n"); - return dataTemplate; -} - -NetFlowDataTemplate* NetFlowDataTemplateCache::DeleteDataTemplate (unsigned short templateID) { - NetFlowDataTemplate *dataTemplate; - printf(" -> Deleting DataTemplate ID %d.\n", templateID); - try { - printf(" -> Trying to fetch %d.\n", templateID); - dataTemplate = _Cache.at(templateID); - _Cache.erase(templateID); - } - catch (const std::out_of_range oor) { - printf(" -> Not found.\n"); - //Out of range --> Not in Cache - return 0; - } - printf(" -> Deleted.\n"); - return dataTemplate; -} Index: tFlowDataTemplateCache.h =================================================================== --- NetFlowDataTemplateCache.h (revision 6ccf909157f91183a7790e6f8544755b2a6b4768) +++ (revision ) @@ -1,27 +1,0 @@ -#include -#include -#include -#include -#include "NetFlowDataTemplate.h" - -#ifndef NETFLOWDATATEMPLATECACHE -#define NETFLOWDATATEMPLATECACHE - -class NetFlowDataTemplateCache{ - - public: - - NetFlowDataTemplateCache(void); - bool AddDataTemplate(unsigned short templateID, NetFlowDataTemplate*); - bool ExistsDataTemplate(unsigned short templateID); - NetFlowDataTemplate* DeleteDataTemplate(unsigned short templateID); - NetFlowDataTemplate* GetDataTemplate(unsigned short templateID); - - - private: - std::map _Cache; - - -}; - -#endif Index: tSlow.sln =================================================================== --- NetSlow.sln (revision 6ccf909157f91183a7790e6f8544755b2a6b4768) +++ (revision ) @@ -1,37 +1,0 @@ - -Microsoft Visual Studio Solution File, Format Version 12.00 -# Visual Studio 15 -VisualStudioVersion = 15.0.26730.10 -MinimumVisualStudioVersion = 10.0.40219.1 -Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "NetSlow", "NetSlow.vcxproj", "{61C638FD-8058-4EBB-9CC2-49142D72E171}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|ARM = Debug|ARM - Debug|x64 = Debug|x64 - Debug|x86 = Debug|x86 - Release|ARM = Release|ARM - Release|x64 = Release|x64 - Release|x86 = Release|x86 - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {61C638FD-8058-4EBB-9CC2-49142D72E171}.Debug|ARM.ActiveCfg = Debug|ARM - {61C638FD-8058-4EBB-9CC2-49142D72E171}.Debug|ARM.Build.0 = Debug|ARM - {61C638FD-8058-4EBB-9CC2-49142D72E171}.Debug|x64.ActiveCfg = Debug|x64 - {61C638FD-8058-4EBB-9CC2-49142D72E171}.Debug|x64.Build.0 = Debug|x64 - {61C638FD-8058-4EBB-9CC2-49142D72E171}.Debug|x86.ActiveCfg = Debug|x86 - {61C638FD-8058-4EBB-9CC2-49142D72E171}.Debug|x86.Build.0 = Debug|x86 - {61C638FD-8058-4EBB-9CC2-49142D72E171}.Release|ARM.ActiveCfg = Release|ARM - {61C638FD-8058-4EBB-9CC2-49142D72E171}.Release|ARM.Build.0 = Release|ARM - {61C638FD-8058-4EBB-9CC2-49142D72E171}.Release|x64.ActiveCfg = Release|x64 - {61C638FD-8058-4EBB-9CC2-49142D72E171}.Release|x64.Build.0 = Release|x64 - {61C638FD-8058-4EBB-9CC2-49142D72E171}.Release|x86.ActiveCfg = Release|x86 - {61C638FD-8058-4EBB-9CC2-49142D72E171}.Release|x86.Build.0 = Release|x86 - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection - GlobalSection(ExtensibilityGlobals) = postSolution - SolutionGuid = {DE5D604A-9922-4530-A645-BA2D1D98954C} - EndGlobalSection -EndGlobal Index: tSlow.vcxproj =================================================================== --- NetSlow.vcxproj (revision 6ccf909157f91183a7790e6f8544755b2a6b4768) +++ (revision ) @@ -1,99 +1,0 @@ - - - - - Debug - ARM - - - Release - ARM - - - Debug - x86 - - - Release - x86 - - - Debug - x64 - - - Release - x64 - - - - {61c638fd-8058-4ebb-9cc2-49142d72e171} - Linux - NetSlow - 15.0 - Linux - 1.0 - Generic - {D51BCBC9-82E9-4017-911E-C93873C4EA2B} - - - - true - - - false - - - true - - - false - - - true - - - false - - - - - - - - ..\include\x86_64-linux-gnu;..\include;$(IncludePath) - @(SourcesToCopyRemotely) - netslow.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - true - - - - - - Index: tSlow.vcxproj.user =================================================================== --- NetSlow.vcxproj.user (revision 6ccf909157f91183a7790e6f8544755b2a6b4768) +++ (revision ) @@ -1,4 +1,0 @@ - - - - Index: tslow.conf =================================================================== --- netslow.conf (revision 6ccf909157f91183a7790e6f8544755b2a6b4768) +++ (revision ) @@ -1,44 +1,0 @@ -# Example netslow config file - -# Define the IP address to bind to -# (use 0.0.0.0 for all IPs) -bind_ip = 0.0.0.0 - -# Define the port to bind to -bind_port = 9997 - -# The most efficient way to run the program is with one router -# reporting to one IP/port combination so that very few checks -# are required on each packet. In this mode each router will -# require it's own instance of netslow. -# -# Define whether to use single router mode -single_router = yes - -# The program can autodetect which IP(s) to listen for, -# assuming they all run the same reporting protocol. Please -# ensure upstream filtering is applied to prevent DoS by -# mallicious actors (eg good firewall rules) -auto_learn = no -auto_protocol = NF9 - -# Define manually configured routers. In single router mode -# only router1 is used -router1 = ( - -# Define a name (optional) - name = BNG2 - -# Define the IP address of the router to listen for - ip = 8.8.8.8 - -# Define the protocol used by the router - protocol = NF9 -) - -# Define multiple routers if required -router2 = ( - name = BNG1 - ip = 8.8.4.4 - protocol = NF9 -) Index: netslow.cpp =================================================================== --- netslow.cpp (revision 6ccf909157f91183a7790e6f8544755b2a6b4768) +++ netslow.cpp (revision c0066d923a2cbc240981ea5743959934e4be7fb1) @@ -5,31 +5,22 @@ #include #include -#include "mongo/client/dbclient.h" +#include "port.h" #include "NetFlow9Processor.h" -#include "FlowSet.h" -#include "Config.h" -//TODO: Base this on the MTU of the interface -#define BUFSIZE 2048 /* Assuming we're using a 1500MTU */ +#define BUFSIZE 2048 -int main(int argc, char **argv, char* envp[]) { +int +main(int argc, char **argv) +{ + struct sockaddr_in myaddr; /* our address */ + struct sockaddr_in remaddr; /* remote address */ + socklen_t addrlen = sizeof(remaddr);/* length of addresses */ + int recvlen; /* # bytes received */ + int fd; /* our socket */ + unsigned char buf[BUFSIZE]; /* receive buffer */ + NetFlow9Processor *NetFlow9; /* Processor do the hard work */ + int retval; /*Return value from processor */ - struct sockaddr_in localAddress; /* Address to bind */ - struct sockaddr_in remoteAddress; /* Remote address to listen for */ - struct sockaddr_in remotePacketAddress; /* Remote packet address */ - socklen_t addressLength = sizeof(remoteAddress);/* Length of addresses */ - int bytesReceived; /* Number of bytes received */ - int fd; /* Our socket */ - unsigned char buffer[BUFSIZE]; /* Receive buffer */ - NetFlow9Processor *NetFlow9; /* Processor do the hard work */ - int retval; /* Return value from processor */ - FlowSet *processedFlowSet; /* Returned flowset after processing */ - string filename = "/home/ian/projects/NetSlow/netslow.conf"; /* Configuration file - TODO: Add to CLI Arguments */ - std::string name; - mongo::DBClientConnection c; - - Config *config = new Config(filename, envp); - - //TODO: Error/syntax checking + NetFlow9 = new NetFlow9Processor(); //Create a UDP socket - currently IPv4 only @@ -41,72 +32,36 @@ } - //Bind the socket to IP address and port defined in the config file - //TODO: Also support IPv6 - memset((char *)&localAddress, 0, sizeof(localAddress)); - localAddress.sin_family = AF_INET; - inet_pton(AF_INET, config->pString("bind_ip").c_str(), &(localAddress.sin_addr)); - localAddress.sin_port = htons(config->pInt("bind_port")); + //Bind the socket to any valid IP address and the port defined in the header + //TODO: Move to CLI args for interfaces/IPs/ports - if (bind(fd, (struct sockaddr *)&localAddress, sizeof(localAddress)) < 0) { + memset((char *)&myaddr, 0, sizeof(myaddr)); + myaddr.sin_family = AF_INET; + myaddr.sin_addr.s_addr = htonl(INADDR_ANY); + myaddr.sin_port = htons(SERVICE_PORT); + + if (bind(fd, (struct sockaddr *)&myaddr, sizeof(myaddr)) < 0) { perror("bind failed"); return 0; } - try { - c.connect("localhost"); - } - catch (const mongo::DBException &e ) { - perror("DB Open failed"); - return 255; - } - - if (config->pBool("single_router")) { - - remoteAddress.sin_family = AF_INET; - //TODO: Support IPv6 - inet_pton(AF_INET, config->group("router1")->pString("ip").c_str(), &(remoteAddress.sin_addr)); - NetFlow9 = new NetFlow9Processor((struct sockaddr *)&remoteAddress, &addressLength); - - if (config->group("router1")->pString("name").c_str()) { - //TODO: Assign to processor - name = config->group("router1")->pString("name"); - } - - //NetFlow is very simple, so we can simply loop over all packets - //received. - for (;;) { - // printf("waiting on port %d\n", SERVICE_PORT); - bytesReceived = recvfrom(fd, buffer, BUFSIZE, 0, (struct sockaddr *)&remotePacketAddress, &addressLength); - - if (remotePacketAddress.sin_family != AF_INET || remotePacketAddress.sin_addr.s_addr != remoteAddress.sin_addr.s_addr) { - continue; //Ooops something wrong with this packet or it's not from the correct router - } - - // printf("received %d bytes\n", bytesReceived); - if (bytesReceived > 2) { - int version = (buffer[0] << 8) + buffer[1]; - - - switch (version) { + //NetFlow is very simple, so we can simply loop over all packets + //received. + for (;;) { + printf("waiting on port %d\n", SERVICE_PORT); + recvlen = recvfrom(fd, buf, BUFSIZE, 0, (struct sockaddr *)&remaddr, &addrlen); + printf("received %d bytes\n", recvlen); + if (recvlen > 2) { + int version = (buf[0] << 8 ) + buf [1]; + switch (version) { case 9: //NFv9 -// printf("Len: %d... Running NetFlow9Packet Processor\n", bytesReceived); - processedFlowSet = NetFlow9->ProcessPacket(buffer, bytesReceived); - if (processedFlowSet == nullptr) { - printf("Possible error in NF9Processor - invalid pointer\n"); - } - else { - printf("PacketProcessor returned %d flow set records\n", processedFlowSet->GetCount()); - printf("FSR 0, record 6, code %x, length %d, value: ", processedFlowSet->GetRecord(0)->GetRecord(6).code, processedFlowSet->GetRecord(0)->GetRecord(6).length); - for (int i = 0; i < processedFlowSet->GetRecord(0)->GetRecord(6).length; i++) { printf("%02X", processedFlowSet->GetRecord(0)->GetRecord(6).data[i]); } - printf("\n"); - delete processedFlowSet; - } + printf("Len: %d... Running NetFlow9Packet Processor\n", recvlen); + retval = NetFlow9->ProcessPacket(buf,recvlen); break; default: return 254; - } + } - } + printf("PacketProcessor returned %d\n",retval); } } Index: port.h =================================================================== --- port.h (revision c0066d923a2cbc240981ea5743959934e4be7fb1) +++ port.h (revision c0066d923a2cbc240981ea5743959934e4be7fb1) @@ -0,0 +1,9 @@ + +/* SERVIVE_PORT defines the default port number for this service + * replace the number with a unique number > 1024 + * a reasonable number may be obtained from, say, four + * digits of your id + 1024 + */ + +#define SERVICE_PORT 9995 /* hard-coded port number */ +