ftfile.c

netflow,抓包

/*
 * Copyright (c) 2001 Mark Fullmer and The Ohio State University
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 *      $Id: ftfile.c,v 1.24 2003/02/13 02:38:42 maf Exp $
 */

#include "ftconfig.h"
#include "ftlib.h"

#include <sys/time.h>
#include <sys/types.h>
#include <sys/uio.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <dirent.h>
#include <errno.h>
#include <syslog.h>
#include <limits.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <fcntl.h>

#if HAVE_STRINGS_H
 #include <strings.h>
#endif
#if HAVE_STRING_H
  #include <string.h>
#endif

int load_dir(char *prefix, struct ftfile_entries *fte, int flags, int *depth);

extern int debug;

/*
 * function: ftfile_entry_new
 * 
 * allocate ftfile_entry struct.  see also ftfile_entry_free
*/
struct ftfile_entry *ftfile_entry_new(int len)
{
  struct ftfile_entry *e;

  if (!(e = (struct ftfile_entry*)malloc(sizeof (struct ftfile_entry))))
    return (struct ftfile_entry*)0L;

  bzero(e, sizeof *e);

  if (!(e->name = (char*)malloc(len+1))) {
    free (e);
    return (struct ftfile_entry*)0L;
  }

  return e;

} /* ftfile_entry_new */

/*
 * function: ftfile_entry_free
 * 
 * deallocate ftfile_entry struct allocated by ftfile_entry_new()
*/
void ftfile_entry_free(struct ftfile_entry *entry)
{
  free(entry->name);
  free(entry);
} /* ftfile_entry_free */

/*
 * function: ftfile_loadfile
 * 
 * Load filename into the file entries data structures
 * Files that do not match the flow-tools naming convention or
 * do not have the correct magic word in the header are not loaded
 * to prevent accidental removal.
 *
 * returns: < 0 error
 *          >= 0 ok
 */
int ftfile_loadfile(struct ftfile_entries *fte, char *fname, int flags)
{
  struct stat sb;
  struct ftfile_entry *n1, *n2;
  struct ftiheader head;
  int fd, done, len;

  if (flags & FT_FILE_INIT)
    FT_TAILQ_INIT(&fte->head);

  if (fname[0]) {

    /* skip anything that doesn't begin with "ft" "cf" and "tmp" */
    if (flags & FT_FILE_CHECKNAMES)
      if ((strncmp(fname, "ft", 2)) &&
         (strncmp(fname, "cf", 2)) &&
         (strncmp(fname, "tmp", 3))) {
        fterr_warnx("ignoring: %s", fname);
        return 0;
      }

      /* skip tmp files? */
      if (flags & FT_FILE_SKIPTMP)
        if (!strncmp(fname, "tmp", 3))
          return 0;

    /* make sure the file is actually a flow file */
    if ((fd = open (fname,  O_RDONLY, 0)) == -1) {
      fterr_warn("open(%s)", fname);
      return 0;
    }

    if (fstat(fd, &sb) < 0) {
      fterr_warn("fstat(%s)", fname);
      close(fd);
      return -1;
    }

    if (ftiheader_read(fd, &head) < 0) {
      fterr_warnx("ftiheader_read(%s): Failed, ignoring file.", fname);
      close(fd);
      return 0;
    }

    close (fd);

  } else { /* empty filename -- stdin */

    bzero(&head, sizeof head);
    bzero(&sb, sizeof sb);

  }

  len = strlen(fname);

  /* insert the entry in the list sorted by start time of flow file */
  done = 0;

  if (flags & FT_FILE_SORT) {

    FT_TAILQ_FOREACH(n1, &fte->head, chain) {

      if (n1->start > head.cap_start) {

        if (!(n2 = ftfile_entry_new(len))) {
          fterr_warnx("ftfile_entry_new(): failed");
          return -1;
        }

        n2->size = sb.st_size;
        n2->start = head.cap_start;
        strcpy(n2->name, fname);

        FT_TAILQ_INSERT_BEFORE(n1, n2, chain);
        done = 1;
        break;
      }
    } /* FT_TAILQ_FOREACH */
  } /* FT_FILE_SORT */

  if ((!done) || (!(flags & FT_FILE_SORT))) {

    if (!(n2 = ftfile_entry_new(len))) {
      fterr_warnx("ftfile_entry_new(): failed");
      return -1;
    }

    n2->size = sb.st_size;
    n2->start = head.cap_start;
    strcpy(n2->name, fname);
    FT_TAILQ_INSERT_TAIL(&fte->head, n2, chain);

  } /* !done or !FT_FILE_SORT */

  fte->num_bytes += sb.st_size;
  fte->num_files ++;

  return 0;

} /* ftfile_loadfile */

/*
 * function: ftfile_loaddir
 * 
 * Load directory contents into the file entries data structures
 * Files that do not match the flow-tools naming convention or
 * do not have the correct magic word in the header are not loaded
 * to prevent accidental removal.
 *
 * returns: < 0 error
 *          >= 0 ok
 */
int ftfile_loaddir(struct ftfile_entries *fte, char *dir, int flags)
{
  int depth, here;
  DIR *dirp;

  depth = 0;

  if (flags & FT_FILE_INIT)
    FT_TAILQ_INIT(&fte->head);

  /* remember current dir */
  if (!(dirp = opendir("."))) {
    fterr_warn("opendir(.)");
    return -1;
  }

  if ((here = open(".", O_RDONLY, 0)) < 0) {
    fterr_warn("open(.)");
    return -1;
  }

  /* go to working dir */
  if (chdir (dir) < 0) {
    fterr_warn("chdir(%s)", dir);
    close(here);
    closedir(dirp);
    return -1;
  }

  /* load entries */
  if (load_dir(dir, fte, flags, &depth)) {
    fterr_warn("load_dir(): failed");
    fchdir(here);
    close(here);
    closedir(dirp);
    return -1;
  }

  if (debug)
    fterr_info("ftfile_loaddir(): loaded %lu files", fte->num_files);

  /* return */
  if (fchdir(here) < 0) {
    fterr_warn("fchdir()");
    close(here);
    closedir(dirp);
    return -1;
  }

  closedir(dirp);
  close(here);
  return 0;

} /* ftfile_loaddir */

/*
 * function: ftfile_add_tail
 *
 * Add a file to the end of the list
 *
 * returns: < 0 error
 *          >= 0 ok
*/
int ftfile_add_tail(struct ftfile_entries *fte, char *fname, off_t size,
  u_int32 start)
{
  struct ftfile_entry *n1;

  if (!(n1 = ftfile_entry_new(strlen(fname)))) {
    fterr_warnx("ftfile_entry_new(): failed");
    return -1;
  }

  n1->size = size;
  n1->start = start;
  strcpy(n1->name, fname);

  FT_TAILQ_INSERT_TAIL(&fte->head, n1, chain);
  fte->num_files ++;
  fte->num_bytes += size;

  return 0;

} /* ftfile_add_tail */

/*
 * function: ftfile_expire
 *
 * If doit is set, and the directory has exceeded the maximum size
 * of files, or maximum storage size remove files until the limits
 * are under the mark.  curbytes is a hint (fudge factor) to account
 * for the existing open flow export.
 *
 * returns: < 0 error
 *          >= 0 ok
*/
int ftfile_expire (struct ftfile_entries *fte, int doit, int curbytes)
{
  u_int i;
  struct ftfile_entry *n1;
  u_int64 bytes;

  /*
   * if max_files is set, remove files starting at the head of the list until
   * max_files <= num_files.  update num_files, num_bytes
   */

  i = 0;
  bytes = 0;

  if (fte->max_files && (fte->num_files > fte->max_files)) {
    FT_TAILQ_FOREACH(n1, &fte->head, chain) {
      fterr_info("remove/1 %s", n1->name);
      bytes += n1->size;
      ++i;
      if (doit) {
        FT_TAILQ_REMOVE(&fte->head, n1, chain);
        if (unlink(n1->name) == -1) 
          fterr_warn("unlink(%s)", n1->name);
        ftfile_entry_free(n1);
      } /* doit */
      if ((fte->num_files - i) <= fte->max_files)
        break;
    } /* FT_TAILQ_FOREACH */
    if (doit) {
      fte->num_files -= i;
      fte->num_bytes -= bytes;
    } /* doit */
  } /* if */

  if (debug)
    fterr_info("remove/1 %u files", i);

  i = 0;
  bytes = 0;

  /*
   * if max_bytes is set, remove files starting at the head of the list until
   * max_bytes <= num_bytes
   */

  if (fte->max_bytes && (fte->num_bytes+curbytes > fte->max_bytes)) {
    FT_TAILQ_FOREACH(n1, &fte->head, chain) {
      fterr_info("remove/2 %s", n1->name);
      bytes += n1->size;
      ++i;
      if (doit) {
        FT_TAILQ_REMOVE(&fte->head, n1, chain);
        if (unlink(n1->name) == -1) 
          fterr_warn("unlink(%s)", n1->name);
        ftfile_entry_free(n1);
      } /* doit */
      if ((fte->num_bytes+curbytes - bytes) <= fte->max_bytes)
        break;
    } /* FT_TAILQ_FOREACH */
    if (doit) {
      fte->num_files -= i;
      fte->num_bytes -= bytes;
    } /* doit */
  } /* if */

  if (debug)
    fterr_info("remove/2 %u files", i);

  return 0;

} /* ftfile_expire */

/*
 * function: ftfile_dump
 *
 * Dump the contents of the file entries data struct.
 *
 * returns: < 0 error