wread_util.c

该软件根据网络数据生成NetFlow记录。NetFlow可用于网络规划、负载均衡、安全监控等

  FILE *f = file->file;

#if 0
#ifdef SWIG
  fail_rec->indx = file->indx - 1;
#endif /* SWIG */
#endif

  GET_STRUCT(f, fail_rec, net_device_stats_t);

  return 0;
}

/*****************************************************************************/

/*
 * Periodic report specific 
 */

int 
_read_period_report(struct np_file *file, period_report_t *prep, 
		    np_rusage_t *rup)
{
  FILE *f = file->file;
  int rec_type;

#if 0
#ifdef SWIG
  prep->indx = file->indx - 1;
#endif /* SWIG */
#endif

  GET_STRUCT(f, prep, period_report_t);

  if (rup)
    {
      /*
       * Should be followed by a rusage report - get that too
       */

      rec_type = _next_rec(file, REC_ALL);
      
      if (rec_type == REC_RUSAGE)
	{
	  /* got it */
	  _read_rusage(file, rup);
	  return 0;
	}
      else if (rec_type == -1)
	{
	  /* EOF */
	  return -1;
	}
      else
	{
	  /* wasn't one - rewind over rec hdr */
	  if (fseek(file->file, - sizeof(struct rep_rec_hdr), SEEK_CUR) != 0)
	    ERROR("_read_period_reort(): fseek()");
	  file->indx--;
	  file->curr_offset -= sizeof(struct rep_rec_hdr);
	  return 1;
	}
    }
  else
    {
      return 0;
    }
  
  /* NOT REACHED */;
}

/*****************************************************************************/

/*
 * Rusage report specific 
 */

int 
_read_rusage(struct np_file *file, np_rusage_t *ru)
{
  FILE *f = file->file;

  GET_STRUCT(f, ru, np_rusage_t);

  return 0;
}

/*****************************************************************************/

/*
 * `Interesting' specific 
 */

int 
_read_interesting(struct np_file *file, flow_inner_t *flowp, int *wayp, char *s)
{
  FILE *f = file->file;
  GET_STRUCT(f, flowp, flow_inner_t);
  GET_INT(f, wayp, int);
  GET_STRING(f, s);

  return 0;
}

int 
_read_inform(struct np_file *file, char *s)
{
  GET_STRING(file->file, s);

  return 0;
}

/*****************************************************************************/

/*
 * 'Wrapper' record type 
 */

int 
_read_wrapper(struct np_file *file, wrapper_record_t *wrapper)
{
  FILE *f = file->file;
  GET_STRUCT(f, wrapper, wrapper_record_t);

  return 0;
}

/*****************************************************************************/

/*
 * Procstat record type 
 */

int 
_read_procstats(struct np_file *file, procstat_rec_t *prp)
{
  FILE *f = file->file;
  GET_STRUCT(f, prp, procstat_rec_t);

  return 0;
}
  

/*****************************************************************************/

/*
 * Sundry stuff 
 */


/*
 * Copy record at offset off to file fd renumbering as n - return new offset
 */

int _copy_rec(struct np_file *file, long int off, int fd, int n)
{
  struct rep_rec_hdr hdr;
  FILE *thisf = file->file;
  char *recbuf;
  int len;
  long int new_off;
  
  
  _seek(file, off-sizeof(struct rep_rec_hdr));
  if (fread(&hdr, sizeof(struct rep_rec_hdr), 1, thisf) != 1)
    {
      if (feof(thisf))
	{
	  fprintf(stderr, "copy_rec: fread() hdr - %s EOF reached", file->fnm);
	  exit (1);
	}
      else if (ferror(thisf))
	{
	  fprintf(stderr, "copy_rec: fread() hdr - %s EOF error", file->fnm);
	  exit (1);
	}
      else
	{
	  fprintf(stderr, "copy_rec: fread() hdr - %s error", file->fnm);
	  exit (1);
	}
    } 
  
  hdr.indx = n;
  len = hdr.len - sizeof(struct rep_rec_hdr);

  if (write(fd, &hdr, sizeof(struct rep_rec_hdr)) != sizeof(struct rep_rec_hdr))
    {
      perror("copy_rec: write hdr");
      exit (1);
    }

  if ((new_off = lseek(fd, 0, SEEK_CUR)) == -1)
    {
      fprintf(stderr, "copy_rec: lseek() error");
      exit (1);
    }

  if ((recbuf = (char *)malloc(len)) == NULL)
    {
      fprintf(stderr, "copy_rec: malloc error");
      exit (1);
    }

  if (fread(recbuf, len, 1, thisf) != 1)
    {
      if (feof(thisf))
	{
	  fprintf(stderr, "copy_rec: fread() rec - %s EOF reached", file->fnm);
	  exit (1);
	}
      else if (ferror(thisf))
	{
	  fprintf(stderr, "copy_rec: fread() rec - %s EOF error", file->fnm);
	  exit (1);
	}
      else
	{
	  fprintf(stderr, "copy_rec: fread() rec - %s error", file->fnm);
	  exit (1);
	}
    }

  if (write(fd, recbuf, len) != len)
    {
      perror("copy_rec: write rec");
      exit (1);
    }

  return (int) new_off;
}

/*
 * Adapt counters and write to new rep file
 */

void _write_pseudocounters(int fd, int reci, counters_t *counters)
{
  rep_rec_hdr_t rhdr;
  fhdr_t hdr, *fhdr = &counters->fh;

  memset(&hdr, '\0', sizeof(fhdr_t));
  
  hdr.magic = fhdr->magic;
  hdr.vers_pre = fhdr->vers_pre;
  hdr.vers_n = fhdr->vers_n;
  
  memset(counters, '\0', sizeof(counters_t));
  memcpy(fhdr, &hdr, sizeof(fhdr_t));

  rhdr.magic = REC_HDR_MAGIC;
  rhdr.type = REC_COUNTERS;
  rhdr.indx = reci;
  rhdr.len = sizeof(counters_t) + sizeof(rep_rec_hdr_t);
  

  if (write(fd, &rhdr, sizeof(rep_rec_hdr_t)) != sizeof(rep_rec_hdr_t))
    {
      perror(" _write_pseudocounters(): write counters");
      exit (1);
    }
  

  if (write(fd, counters, sizeof(counters_t)) != sizeof(counters_t))
    {
      perror(" _write_pseudocounters(): write counters");
      exit (1);
    }

  return;
}

  
  

/* Parse CL record type arg */

unsigned char 
_parse_type(char *ts)
{
  unsigned char wanted = REC_ALL;
  char *endp;

  long code;

  while (*ts == ' ')
    ts++;

  code = strtol(ts, &endp, 0);
  if (endp != ts)
    {
      if (code > REC_MAX)
	{
	  fprintf(stderr, "Record type specified (%ld) > highest allowed (%d)\n", code, REC_MAX);
	  exit(1);
	}
      else
	{
	  return (unsigned char)code;
	}
    }

  if (strlen(ts) == 1)
    {
      if (*ts == 'i')
	wanted = REC_IP;
      if (*ts == 't')
	wanted = REC_TCP_ALL;
      else if (*ts == 'u')
	wanted = REC_UDP_ALL;
      else if (*ts == 'o')
	wanted = REC_OTHER_ALL;
      else if (*ts == 'I')
	wanted = REC_INTERESTING;
      else if (*ts == 'P')
	wanted = REC_PERIOD_REPORT;
      else if (*ts == 'R')
	wanted = REC_RUSAGE;
    }

  if (wanted)
    ts++;

  while (*ts == ' ')
    ts++;	

  if (!strlen(ts))
    {
      return wanted;
    }
  else
    {
      if (!strcmp(ts, "all"))
	{
	  return REC_ALL;
	}
      else if (!strcmp(ts, "tcp"))
	{
	  return REC_TCP_ALL;
	}
      else if (!strcmp(ts, "udp"))
	{
	  return REC_UDP_ALL;
	}
      else if (!strcmp(ts, "ip"))
	{
	  return REC_IP;
	}
      else if (!strcmp(ts, "other"))
	{
	  return REC_OTHER_ALL;
	}
      /* specific TCP */
      else if (!strcmp(ts, "test"))
	{
	  return REC_TCP_TEST;
	}
      else if (!strcmp(ts, "http"))
	{
	  return REC_TCP_HTTP;
	}
      else if (!strcmp(ts, "ftp"))
	{
	  return REC_TCP_FTP;
	}
      else if (!strcmp(ts, "ftp-data"))
	{
	  return REC_TCP_FTP_DATA;
	}
      else if (!strcmp(ts, "rtsp"))
	{
	  return REC_TCP_RTSP;
	}
      else if (!strcmp(ts, "pnm"))
	{
	  return REC_TCP_PNM;
	}
	  /* specific UDP */
      else if (!strcmp(ts, "nfs"))
	{
	  return REC_UDP_NFS;
	}
      else if (!strcmp(ts, "dns"))
	{
	  return REC_UDP_DNS;
	}
	  /* specific ICMP */
      else if (!strcmp(ts, "icmp"))
	{
	  return REC_ICMP_ALL;
	}
	  /* specific OTHER */
      else if (!strcmp(ts, "fails"))
	{
	  return REC_BUF_ALLOC_FAIL;
	}
      else if (!strcmp(ts, "nic"))
	{
	  return REC_NIC_FAIL;
	}
      else if (!strcmp(ts, "rep"))
	{
	  return REC_PERIOD_REPORT;
	}
      else if (!strcmp(ts, "rus"))
	{
	  return REC_RUSAGE;
	}
      else if (!strcmp(ts, "PW"))
	{
	  return REC_WIRE_PERIOD_REPORT;
	}
      else if (!strcmp(ts, "PP"))
	{
	  return REC_OTHER_PROCSTAT;
	}
      else if (!strcmp(ts, "tmp"))
	{
	  return REC_OTHER_WRAPPER;
	}
      else if (!strcmp(ts, "bgp"))
	{
	  return REC_TCP_BGP;
	}
      else if (!strcmp(ts, "inform"))
	{
	  return REC_INFORM;
	}
	  /* other sub-type of TCP/UDP/OTHER */
      else if (!strcmp(ts, "other"))
	{
	  if (wanted == REC_TCP_ALL)
	    return REC_TCP_OTHER;
	  else if (wanted == REC_UDP_ALL)
	    return REC_UDP_OTHER;
	  else if (wanted == REC_OTHER_ALL)
	    return REC_OTHER_OTHER;
	}
      else
	{
	  return  REC_ALL;
	}
    }
  return wanted;
}

/*****************************************************************************/

int 
_http_print_like_squidlog(http_trans_t *trans, tcp_conn_t *tconn, int code)
{
  us_clock_t trans_start = trans->inner.cinf.reqstart_us + tconn->flow_inner.first_arr_tm;
  us_clock_t trans_end = trans->inner.sinf.repend_us + tconn->flow_inner.first_arr_tm;
  unsigned int rep_time_us;
  struct timeval transtime;
  unsigned int len;
  int rel_url = 0;

  /* Check times are ok - will not have got here if trans_start not valid */
  assert(trans_start != 0ULL);
  if (trans_end != 0)
    rep_time_us = trans_end - trans_start;
  else
    rep_time_us = 999999999;

  /* 
   * Check code
   * -1 = valid
   *  0 = not valid - shouldn't have got here
   * >1 = inferred valid
   *     1 - 4 = known body length
   *     > 4 = assume nil (or invalid) body length XXX FIX THIS
   */

  assert (code != 0);
#if 0
  if (code < 5)
    len = trans->inner.hserver.recd_len;
  else
    len = 0UL;
#endif

  len = trans->inner.hserver.recd_len;

  /* check URL */
  if (strncmp(trans->req, "http://", strlen("http://")))
    {
      rel_url++;
      printf("# Relative URL\n");
    }

  transtime.tv_sec = trans_start/US_IN_S;
  transtime.tv_usec = trans_start % US_IN_S;

  printf("%lu.%.3lu ", transtime.tv_sec, transtime.tv_usec/1000);
  printf("%7lu ", rep_time_us/1000);

#if 0
  printf("%s (%s/%s) ", get_hname(&tconn->flow_inner.srcaddr), 
	 tcpport_string(ntohs(tconn->flow_inner.srcport)),
	 tcpport_string(ntohs(tconn->flow_inner.dstport)));
#endif

  printf("%s ", get_hname((char *)&tconn->flow_inner.srcaddr));
  printf("TCP_MISS/%u ", trans->inner.sinf.status_code);
  printf("%lu ", len);
  printf("%s ", method_string(trans->inner.cinf.method));
	 
  if (rel_url)
    printf("http://%s", get_hname((char *)&tconn->flow_inner.dstaddr));

    printf("%s ", trans->req);

  printf("- ");
  printf("DIRECT/");
  printf("%s ", get_hname((char *)&tconn->flow_inner.dstaddr));
  
  if (trans->inner.hserver.content_type == CT_UNKNOWN)
    printf("- ");
  else
    printf("%s ", content_type_string(trans->inner.hserver.content_type));

  printf("-\n");

  return 0;
}


/*****************************************************************************/

  

/*
 * End wread_util.c 
 */