flow-export.c

netflow,抓包

  if (xfield & FT_XFIELD_SRC_AS) {
    if (comma) strcat(buf, ",");
    strcat(buf, FT_XFIELD_ASC_SRC_AS);
    comma = 1;
  }

  if (xfield & FT_XFIELD_DST_AS) {
    if (comma) strcat(buf, ",");
    strcat(buf, FT_XFIELD_ASC_DST_AS);
    comma = 1;
  }

  if (xfield & FT_XFIELD_IN_ENCAPS) {
    if (comma) strcat(buf, ",");
    strcat(buf, FT_XFIELD_ASC_IN_ENCAPS);
    comma = 1;
  }

  if (xfield & FT_XFIELD_OUT_ENCAPS) {
    if (comma) strcat(buf, ",");
    strcat(buf, FT_XFIELD_ASC_OUT_ENCAPS);
    comma = 1;
  }

  if (xfield & FT_XFIELD_PEER_NEXTHOP) {
    if (comma) strcat(buf, ",");
    strcat(buf, FT_XFIELD_ASC_NEXTHOP);
    comma = 1;
  }

  if (xfield & FT_XFIELD_ROUTER_SC) {
    if (comma) strcat(buf, ",");
    strcat(buf, FT_XFIELD_ASC_ROUTER_SC);
    comma = 1;
  }

  if (xfield & FT_XFIELD_EXTRA_PKTS) {
    if (comma) strcat(buf, ",");
    strcat(buf, FT_XFIELD_ASC_EXTRA_PKTS);
    comma = 1;
  }

  if (xfield & FT_XFIELD_MARKED_TOS) {
    if (comma) strcat(buf, ",");
    strcat(buf, FT_XFIELD_ASC_MARKED_TOS);
    comma = 1;
  }

  if (xfield & FT_XFIELD_SRC_TAG) {
    if (comma) strcat(buf, ",");
    strcat(buf, FT_XFIELD_ASC_SRC_TAG);
    comma = 1;
  }

  if (xfield & FT_XFIELD_DST_TAG) {
    if (comma) strcat(buf, ",");
    strcat(buf, FT_XFIELD_ASC_DST_TAG);
    comma = 1;
  }

  return strlen(buf);

} /* fmt_xfields_type */


int fmt_xfields_val(char *fmt_buf, char *rec, struct fts3rec_offsets *fo,
  u_int64 xfields, int quote)
{
  int comma, len;

  fmt_buf[0] = 0;

  len = comma = 0;

  if (xfields & FT_XFIELD_UNIX_SECS) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint32(fmt_buf+len, *((u_int32*)(rec+fo->unix_secs)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_UNIX_NSECS) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint32(fmt_buf+len, *((u_int32*)(rec+fo->unix_nsecs)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_SYSUPTIME) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint32(fmt_buf+len, *((u_int32*)(rec+fo->sysUpTime)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_EXADDR) {
    if (comma) fmt_buf[len++] = ',';
    if (quote) fmt_buf[len++] = '"';
    len += fmt_ipv4(fmt_buf+len, *((u_int32*)(rec+fo->exaddr)),
      FMT_JUST_LEFT);
    if (quote) fmt_buf[len++] = '"';
    comma = 1;
  }

  if (xfields & FT_XFIELD_DFLOWS) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint32(fmt_buf+len, *((u_int32*)(rec+fo->dFlows)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_DPKTS) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint32(fmt_buf+len, *((u_int32*)(rec+fo->dPkts)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_DOCTETS) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint32(fmt_buf+len, *((u_int32*)(rec+fo->dOctets)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_FIRST) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint32(fmt_buf+len, *((u_int32*)(rec+fo->First)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_LAST) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint32(fmt_buf+len, *((u_int32*)(rec+fo->Last)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_ENGINE_TYPE) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint8(fmt_buf+len, *((u_int8*)(rec+fo->engine_type)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_ENGINE_ID) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint8(fmt_buf+len, *((u_int8*)(rec+fo->engine_id)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_SRCADDR) {
    if (comma) fmt_buf[len++] = ',';
    if (quote) fmt_buf[len++] = '"';
    len += fmt_ipv4(fmt_buf+len, *((u_int32*)(rec+fo->srcaddr)),
      FMT_JUST_LEFT);
    if (quote) fmt_buf[len++] = '"';
    comma = 1;
  }

  if (xfields & FT_XFIELD_DSTADDR) {
    if (comma) fmt_buf[len++] = ',';
    if (quote) fmt_buf[len++] = '"';
    len += fmt_ipv4(fmt_buf+len, *((u_int32*)(rec+fo->dstaddr)),
      FMT_JUST_LEFT);
    if (quote) fmt_buf[len++] = '"';
    comma = 1;
  }

  if (xfields & FT_XFIELD_NEXTHOP) {
    if (comma) fmt_buf[len++] = ',';
    if (quote) fmt_buf[len++] = '"';
    len += fmt_ipv4(fmt_buf+len, *((u_int32*)(rec+fo->nexthop)),
      FMT_JUST_LEFT);
    if (quote) fmt_buf[len++] = '"';
    comma = 1;
  }

  if (xfields & FT_XFIELD_INPUT) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint16(fmt_buf+len, *((u_int16*)(rec+fo->input)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_OUTPUT) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint16(fmt_buf+len, *((u_int16*)(rec+fo->output)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_SRCPORT) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint16(fmt_buf+len, *((u_int16*)(rec+fo->srcport)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_DSTPORT) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint16(fmt_buf+len, *((u_int16*)(rec+fo->dstport)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_PROT) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint8(fmt_buf+len, *((u_int8*)(rec+fo->prot)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_TOS) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint8(fmt_buf+len, *((u_int8*)(rec+fo->tos)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_TCP_FLAGS) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint8(fmt_buf+len, *((u_int8*)(rec+fo->tcp_flags)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_SRC_MASK) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint8(fmt_buf+len, *((u_int8*)(rec+fo->src_mask)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_DST_MASK) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint8(fmt_buf+len, *((u_int8*)(rec+fo->dst_mask)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_SRC_AS) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint16(fmt_buf+len, *((u_int16*)(rec+fo->src_as)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_DST_AS) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint16(fmt_buf+len, *((u_int16*)(rec+fo->dst_as)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_IN_ENCAPS) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint8(fmt_buf+len, *((u_int8*)(rec+fo->in_encaps)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_OUT_ENCAPS) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint8(fmt_buf+len, *((u_int8*)(rec+fo->out_encaps)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_PEER_NEXTHOP) {
    if (comma) fmt_buf[len++] = ',';
    if (quote) fmt_buf[len++] = '"';
    len += fmt_ipv4(fmt_buf+len, *((u_int32*)(rec+fo->peer_nexthop)),
      FMT_JUST_LEFT);
    if (quote) fmt_buf[len++] = '"';
    comma = 1;
  }

  if (xfields & FT_XFIELD_ROUTER_SC) {
    if (comma) fmt_buf[len++] = ',';
    if (quote) fmt_buf[len++] = '"';
    len += fmt_ipv4(fmt_buf+len, *((u_int32*)(rec+fo->router_sc)),
      FMT_JUST_LEFT);
    if (quote) fmt_buf[len++] = '"';
    comma = 1;
  }

  if (xfields & FT_XFIELD_MARKED_TOS) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint8(fmt_buf+len, *((u_int8*)(rec+fo->marked_tos)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_EXTRA_PKTS) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint32(fmt_buf+len, *((u_int32*)(rec+fo->extra_pkts)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_SRC_TAG) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint32(fmt_buf+len, *((u_int32*)(rec+fo->src_tag)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  if (xfields & FT_XFIELD_DST_TAG) {
    if (comma) fmt_buf[len++] = ',';
    len += fmt_uint32(fmt_buf+len, *((u_int32*)(rec+fo->dst_tag)),
      FMT_JUST_LEFT);
    comma = 1;
  }

  return strlen(fmt_buf);

} /* fmt_xfields_val */

void usage(void) {

  fprintf(stderr, "Usage: flow-export [-h] [-d debug_level] [-f format] [-m mask_fields] -u [mySQL URI]\n");
  fprintf(stderr, "\n%s version %s: built by %s\n", PACKAGE, VERSION, FT_PROG_BUILD);


} /* usage */

/*
 * function ftxfield_tocflow
 *    
 * convert flow-tools xfield bits to cflowd bits
 *
 * returns 0:  ok
 *         <0  fail
 */
int ftxfield_tocflow(u_int64 xfields, u_int32 *cfmask)
{
  int droptime;

  droptime = 0;

  if (xfields & FT_XFIELD_EXADDR) {
    xfields &= ~FT_XFIELD_EXADDR;
    *cfmask |= CF_ROUTERMASK;
  }

  if (xfields & FT_XFIELD_SRCADDR) {
    xfields &= ~FT_XFIELD_SRCADDR;
    *cfmask |= CF_SRCIPADDRMASK;
  }

  if (xfields & FT_XFIELD_DSTADDR) {
    xfields &= ~FT_XFIELD_DSTADDR;
    *cfmask |= CF_DSTIPADDRMASK;
  }

  if (xfields & FT_XFIELD_INPUT) {
    xfields &= ~FT_XFIELD_INPUT;
    *cfmask |= CF_INPUTIFINDEXMASK;
  }

  if (xfields & FT_XFIELD_OUTPUT) {
    xfields &= ~FT_XFIELD_OUTPUT;
    *cfmask |= CF_OUTPUTIFINDEXMASK;
  }

  if (xfields & FT_XFIELD_SRCPORT) {
    xfields &= ~FT_XFIELD_SRCPORT;
    *cfmask |= CF_SRCPORTMASK;
  }

  if (xfields & FT_XFIELD_DSTPORT) {
    xfields &= ~FT_XFIELD_DSTPORT;
    *cfmask |= CF_DSTPORTMASK;
  }

  if (xfields & FT_XFIELD_DPKTS) {
    xfields &= ~FT_XFIELD_DPKTS;
    *cfmask |= CF_PKTSMASK;
  }

  if (xfields & FT_XFIELD_DOCTETS) {
    xfields &= ~FT_XFIELD_DOCTETS;
    *cfmask |= CF_BYTESMASK;
  }

  if (xfields & FT_XFIELD_NEXTHOP) {
    xfields &= ~FT_XFIELD_NEXTHOP;
    *cfmask |= CF_IPNEXTHOPMASK;
  }

  if ((xfields &
    (FT_XFIELD_UNIX_SECS|FT_XFIELD_UNIX_NSECS|FT_XFIELD_SYSUPTIME|
    FT_XFIELD_FIRST)) == 
    (FT_XFIELD_UNIX_SECS|FT_XFIELD_UNIX_NSECS|FT_XFIELD_SYSUPTIME|
    FT_XFIELD_FIRST)) {
    xfields &= ~FT_XFIELD_NEXTHOP;
    droptime = 1;
    *cfmask |= CF_STARTTIMEMASK;
  }

  if ((xfields &
    (FT_XFIELD_UNIX_SECS|FT_XFIELD_UNIX_NSECS|FT_XFIELD_SYSUPTIME|
    FT_XFIELD_LAST)) == 
    (FT_XFIELD_UNIX_SECS|FT_XFIELD_UNIX_NSECS|FT_XFIELD_SYSUPTIME|
    FT_XFIELD_LAST)) {
    xfields &= ~FT_XFIELD_NEXTHOP;
    droptime = 1;
    *cfmask |= CF_ENDTIMEMASK;
  }

  if (droptime)
    xfields &= ~(FT_XFIELD_UNIX_SECS|FT_XFIELD_UNIX_NSECS|FT_XFIELD_SYSUPTIME);

  if (xfields & FT_XFIELD_PROT) {
    xfields &= ~FT_XFIELD_PROT;
    *cfmask |= CF_PROTOCOLMASK;
  }

  if (xfields & FT_XFIELD_TOS) {
    xfields &= ~FT_XFIELD_TOS;
    *cfmask |= CF_TOSMASK;
  }

  if (xfields & FT_XFIELD_SRC_AS) {
    xfields &= ~FT_XFIELD_SRC_AS;
    *cfmask |= CF_SRCASMASK;
  }

  if (xfields & FT_XFIELD_DST_AS) {
    xfields &= ~FT_XFIELD_DST_AS;
    *cfmask |= CF_DSTASMASK;
  }

  if (xfields & FT_XFIELD_SRC_MASK) {
    xfields &= ~FT_XFIELD_SRC_MASK;
    *cfmask |= CF_SRCMASKLENMASK;
  }

  if (xfields & FT_XFIELD_DST_MASK) {
    xfields &= ~FT_XFIELD_DST_MASK;
    *cfmask |= CF_DSTMASKLENMASK;
  }

  if (xfields & FT_XFIELD_TCP_FLAGS) {
    xfields &= ~FT_XFIELD_TCP_FLAGS ;
    *cfmask |= CF_TCPFLAGSMASK;
  }

  if (xfields & FT_XFIELD_IN_ENCAPS) {
    xfields &= ~FT_XFIELD_IN_ENCAPS ;
    *cfmask |= CF_INPUTENCAPMASK;
  }

  if (xfields & FT_XFIELD_OUT_ENCAPS) {
    xfields &= ~FT_XFIELD_OUT_ENCAPS ;
    *cfmask |= CF_OUTPUTENCAPMASK;
  }

  if (xfields & FT_XFIELD_PEER_NEXTHOP) {
    xfields &= ~FT_XFIELD_PEER_NEXTHOP ;
    *cfmask |= CF_PEERNEXTHOPMASK;
  }

  if (xfields & FT_XFIELD_ENGINE_TYPE) {
    xfields &= ~FT_XFIELD_ENGINE_TYPE ;
    *cfmask |= CF_ENGINETYPEMASK;
  }

  if (xfields & FT_XFIELD_ENGINE_ID) {
    xfields &= ~FT_XFIELD_ENGINE_ID ;
    *cfmask |= CF_ENGINEIDMASK;
  }

  if (xfields) {
    fterr_warnx("xfields contains fields after conversion to cflow mask 0x%llX",
      xfields);
    return -1;
  }

  return 0;
 
} /* ftxfield_tocflow */