int main(int argc, char **argv) { struct ftio ftio; char cc; /* comment character */ int i, debug; /* init fterr */ fterr_setid(argv[0]); debug = 0; cc = '#'; while ((i = getopt(argc, argv, "c:d:h?")) != -1) switch (i) { case 'c': /* comment character */ cc = optarg[0]; break; case 'd': /* debug */ debug = atoi(optarg); break; case 'h': /* help */ case '?': usage(); exit (0); break; default: usage(); exit (1); break; } /* switch */ if (argc - optind) fterr_errx(1, "Extra arguments starting with %s.", argv[optind]); /* read from stdin */ if (ftio_init(&ftio, 0, FT_IO_FLAG_READ | FT_IO_FLAG_MMAP) < 0) fterr_errx(1, "ftio_init(): failed"); ftio_header_print(&ftio, stdout, cc); return ftio_close(&ftio); } /* main */
int main(int argc, char **argv) { struct ftio ftio; struct ftprof ftp; struct ftstat ftstat; struct ftstat_def *ftsd; struct ftver ftv; struct ftvar ftvar; struct ftset ftset; struct fts3rec_offsets fo; char *rec; const char *fname, *dname; uint32_t total_flows; int i, split, done; int usage_call; /* init fterr */ fterr_setid(argv[0]); bzero(&ftv, sizeof ftv); bzero(&ftvar, sizeof ftvar); total_flows = 0; usage_call = 0; /* init var binding */ if (ftvar_new(&ftvar) < 0) fterr_errx(1, "ftvar_new(): failed"); fname = FT_PATH_CFG_STAT; dname = "default"; /* configure signal handler */ if (mysignal(SIGPIPE, sig_pipe) == SIG_ERR) fterr_err(1, "signal(SIGPIPE)"); /* defaults + no compression */ ftset_init(&ftset, 0); while ((i = getopt(argc, argv, "b:C:d:h?s:S:kz:v:")) != -1) switch (i) { case 'd': /* debug */ debug = atoi(optarg); break; case 's': /* stat file name */ fname = optarg; break; case 'S': /* stat definition name */ dname = optarg; break; case 'v': /* variable */ if (ftvar_pset(&ftvar, optarg) < 0) fterr_errx(1, "ftvar_pset(%s): failed", optarg); break; case 'h': /* help */ case '?': usage(); ++usage_call; break; default: usage(); exit(1); break; } /* switch */ if (argc - optind) fterr_errx(1, "Extra arguments starting with %s.", argv[optind]); if (usage_call) exit(0); /* initialize and load stats config */ if (ftstat_load(&ftstat, &ftvar, fname)) fterr_errx(1, "ftstat_load(): failed"); if (!(ftsd = ftstat_def_find(&ftstat, dname))) fterr_errx(1, "ftstat_find_def(%s): failed", dname); /* input is stdin */ if (ftio_init(&ftio, 0, FT_IO_FLAG_READ) < 0) fterr_errx(1, "ftio_init(): failed"); ftio_get_ver(&ftio, &ftv); if (ftstat_def_test_xfields(ftsd, ftrec_xfield(&ftv))) fterr_errx(1, "Report definition references a field not in flow."); fts3rec_compute_offsets(&fo, &ftv); /* profile */ ftprof_start (&ftp); if (ftstat_def_new(ftsd)) { fterr_errx(1, "ftstat_new(%s): failed.",ftsd->name); } while ((rec = ftio_read(&ftio))) { ++total_flows; done = 0; if ((split = ftstat_def_accum(ftsd, rec, &fo)) < 0) { fterr_errx(1, "ftstat_eval(%s): failed.",ftsd->name); } if (split) { if (ftstat_def_calc(ftsd)) { fterr_errx(1, "ftstat_dump(%s): failed.",ftsd->name); } if (ftstat_def_dump(&ftio, ftsd)) { fterr_errx(1, "ftstat_dump(%s): failed.",ftsd->name); } if (ftstat_def_reset(ftsd)) { fterr_errx(1, "ftstat_def_reset(%s): failed.",ftsd->name); } if ((split = ftstat_def_accum(ftsd, rec, &fo)) < 0) { fterr_errx(1, "ftstat_eval(%s): failed.",ftsd->name); } if (split == 1) fterr_errx(1, "ftstat_def_accum(): looping on split"); } /* split */ } /* while more flows */ if (ftstat_def_calc(ftsd)) { fterr_errx(1, "ftstat_dump(%s): failed.",ftsd->name); } if (ftstat_def_dump(&ftio, ftsd)) { fterr_errx(1, "ftstat_dump(%s): failed.",ftsd->name); } if (ftstat_def_free(ftsd)) { fterr_errx(1, "ftstat_def_free(%s): failed.",ftsd->name); } if (ftio_close(&ftio) < 0) fterr_errx(1, "ftio_close(): failed"); if (debug > 0) { ftprof_end (&ftp, total_flows); ftprof_print(&ftp, argv[0], stderr); } ftstat_free(&ftstat); ftvar_free(&ftvar); return 0; } /* main */
int main(int argc, char **argv) { struct ftio ftio; extension_info_t *extension_info; struct stat statbuf; uint32_t limitflows; int i, extended, printmap, ret, fd, compress;; char *ftfile, *wfile; /* init fterr */ fterr_setid(argv[0]); extended = 0; printmap = 0; limitflows = 0; ftfile = NULL; wfile = "-"; compress = NOT_COMPRESSED; while ((i = getopt(argc, argv, "jzEVc:hmr:w:?")) != -1) switch (i) { case 'h': /* help */ case '?': usage(argv[0]); exit (0); break; case 'V': printf("%s: Version: %s\n",argv[0], nfdump_version); exit(0); break; case 'E': extended = 1; break; case 'c': limitflows = atoi(optarg); if ( !limitflows ) { fprintf(stderr, "Option -c needs a number > 0\n"); exit(255); } break; case 'm': printmap = 1; break; case 'j': compress = LZO_COMPRESSED; break; case 'z': compress = BZ2_COMPRESSED; break; case 'r': ftfile = optarg; if ( (stat(ftfile, &statbuf) < 0 ) || !(statbuf.st_mode & S_IFREG) ) { fprintf(stderr, "No such file: '%s'\n", ftfile); exit(255); } break; case 'w': wfile = optarg; break; default: usage(argv[0]); exit (1); break; } /* switch */ // End while if (argc - optind) fterr_errx(1, "Extra arguments starting with %s.", argv[optind]); if ( ftfile ) { fd = open(ftfile, O_RDONLY, 0); if ( fd < 0 ) { fprintf(stderr, "Can't open file '%s': %s.", ftfile, strerror(errno)); exit(255); } } else { fd = 0; } /* read from fd */ if (ftio_init(&ftio, fd, FT_IO_FLAG_READ) < 0) fterr_errx(1, "ftio_init(): failed"); extension_info = GenExtensionMap(&ftio); if ( !extension_info ) exit(255); if ( printmap ) { PrintExtensionMap(extension_info->map); exit(255); } ret = flows2nfdump(&ftio, wfile, compress, extension_info, extended, limitflows); return ret; } // End of main
int main(int argc, char **argv) { struct fts3rec_all cur; struct fts3rec_offsets fo; struct ftio ftio_in, ftio_out; struct ftset ftset; struct ftver ftv; struct ftprof ftp; uint32_t time_start, time_end, exaddr; int i, ret; char *acl_fname, *acl_std_src_name, *acl_std_dst_name; char *acl_std_nexthop_name; char *acl_ext_name, *str, *strm; int acl_std_src_index, acl_std_src_index2; int acl_std_dst_index, acl_std_dst_index2; int acl_std_nexthop_index, acl_std_nexthop_index2; int acl_ext_index, acl_ext_index2; struct acl_ip_ext_entry tmp_ext; int keep_input_time; int filter_input, filter_output, filter_srcport, filter_dstport; int filter_prot, filter_srcas, filter_dstas, filter_tos, filter_tcp_flags; int filter_exaddr; char in_tbl[65536], out_tbl[65536], src_tbl[65536], dst_tbl[65536]; char srcas_tbl[65536], dstas_tbl[65536], tos_tbl[65536]; char tcp_flags_tbl[65536]; char prot_tbl[256]; u_char tos_mask, tos, tcp_flags_mask, tcp_flags; uint64_t total_flows, xflag; char *rec; int first_match = 0; /* init fterr */ fterr_setid(argv[0]); bzero(&ftv, sizeof ftv); /* defaults + no compression */ ftset_init(&ftset, 0); /* init */ bzero(&acl_list, sizeof acl_list); acl_fname = acl_std_src_name = acl_std_dst_name = (char*)0L; acl_std_nexthop_name = (char*)0L; acl_ext_name = (char*)0L; acl_std_src_index = acl_std_dst_index = -1; acl_std_nexthop_index = -1; acl_ext_index = -1; bzero(&tmp_ext, sizeof tmp_ext); total_flows = 0; tos_mask = 0xff; tcp_flags_mask = 0xff; keep_input_time = 0; filter_input = filter_output = filter_srcport = filter_dstport = 0; filter_prot = filter_srcas = filter_dstas = filter_tos = filter_exaddr = 0; filter_tcp_flags = 0; while ((i = getopt(argc, argv, "a:A:b:C:d:D:e:E:f:i:I:kop:P:r:S:t:T:x:z:")) != -1) switch (i) { case 'a': /* src AS filter list */ if (load_lookup(optarg, 65536, srcas_tbl)) fterr_errx(1, "load_lookup(): failed"); filter_srcas = 1; break; case 'A': /* dst AS filter list */ if (load_lookup(optarg, 65536, dstas_tbl)) fterr_errx(1, "load_lookup(): failed"); filter_dstas = 1; break; case 'b': /* output byte order */ if (!strcasecmp(optarg, "little")) ftset.byte_order = FT_HEADER_LITTLE_ENDIAN; else if (!strcasecmp(optarg, "big")) ftset.byte_order = FT_HEADER_BIG_ENDIAN; else fterr_errx(1, "expecting \"big\" or \"little\""); break; case 'C': /* comment field */ ftset.comments = optarg; break; case 'D': /* dst ip standard access list filter */ acl_std_dst_name = optarg; break; case 'd': /* debug */ debug = atoi(optarg); break; case 'e': /* export IP address */ filter_exaddr = 1; exaddr = scan_ip(optarg); break; case 'E': /* extended access list filter */ acl_ext_name = optarg; break; case 'f': /* acl file name */ acl_fname = optarg; break; case 'i': /* input filter interface list */ if (load_lookup(optarg, 65536, in_tbl)) fterr_errx(1, "load_lookup(): failed"); filter_input = 1; break; case 'I': /* output filter interface list */ if (load_lookup(optarg, 65536, out_tbl)) fterr_errx(1, "load_lookup(): failed"); filter_output = 1; break; case 'k': /* keep the start/end time from the input */ keep_input_time = 1; break; case 'o': /* do logical OR between different statements (first match) */ first_match = 1; break; case 'P': /* filter dstport */ if (load_lookup(optarg, 65536, dst_tbl)) fterr_errx(1, "load_lookup(): failed"); filter_dstport = 1; break; case 'p': /* filter srcport */ if (load_lookup(optarg, 65536, src_tbl)) fterr_errx(1, "load_lookup(): failed"); filter_srcport = 1; break; case 'r': /* filter protocol */ if (load_lookup(optarg, 256, prot_tbl)) fterr_errx(1, "load_lookup(): failed"); filter_prot = 1; break; case 'S': /* src ip standard access list filter */ acl_std_src_name = optarg; break; case 't': /* ToS Filter */ if (!(str = malloc(strlen(optarg+1)))) fterr_err(1, "malloc()"); strcpy(str, optarg); /* search for mask option */ if ((strm = index(str, '/'))) { ++strm; tos_mask = (u_char)strtol(strm, (char**)0L, 0); --strm; *strm = 0; } if (load_lookup(str, 65536, tos_tbl)) { free(str); fterr_errx(1, "load_lookup(): failed"); } free(str); filter_tos = 1; break; case 'T': /* tcp flags filter */ if (!(str = malloc(strlen(optarg+1)))) fterr_err(1, "malloc()"); strcpy(str, optarg); /* search for mask option */ if ((strm = index(str, '/'))) { ++strm; tcp_flags_mask = (u_char)strtol(strm, (char**)0L, 0); --strm; *strm = 0; } if (load_lookup(str, 65536, tcp_flags_tbl)) { free(str); fterr_errx(1, "load_lookup(): failed"); } free(str); filter_tcp_flags = 1; break; case 'x': /* nexthop ip standard access list filter */ acl_std_nexthop_name = optarg; break; case 'h': /* help */ case '?': usage(); exit (0); break; case 'z': /* compress level */ ftset.z_level = atoi(optarg); if ((ftset.z_level < 0) || (ftset.z_level > 9)) fterr_errx(1, "Compression level must be between 0 and 9"); break; default: usage(); exit (1); break; } /* switch */ if (argc - optind) fterr_errx(1, "Extra arguments starting with %s.", argv[optind]); /* input from stdin */ if (ftio_init(&ftio_in, 0, FT_IO_FLAG_READ) < 0) fterr_errx(1, "ftio_init(): failed"); ftio_get_ver(&ftio_in, &ftv); ftv.s_version = FT_IO_SVERSION; xflag = 0; if (filter_input) xflag |= FT_XFIELD_INPUT; if (filter_output) xflag |= FT_XFIELD_OUTPUT; if (filter_srcport) xflag |= FT_XFIELD_SRCPORT; if (filter_dstport) xflag |= FT_XFIELD_DSTPORT; if (filter_exaddr) xflag |= FT_XFIELD_EXADDR; if (filter_prot) xflag |= FT_XFIELD_PROT; if (filter_srcas) xflag |= FT_XFIELD_SRC_AS; if (filter_dstas) xflag |= FT_XFIELD_DST_AS; if (filter_tos) xflag |= FT_XFIELD_TOS; if (filter_tcp_flags) xflag |= FT_XFIELD_TCP_FLAGS; if (acl_std_nexthop_name) xflag |= FT_XFIELD_NEXTHOP; if (acl_std_src_name) xflag |= FT_XFIELD_SRCADDR; if (acl_std_dst_name) xflag |= FT_XFIELD_DSTADDR; if (acl_ext_name) xflag |= (FT_XFIELD_SRCADDR | FT_XFIELD_DSTADDR); if (ftio_check_xfield(&ftio_in, xflag)) { fterr_warnx("Flow record missing required field for format."); exit (1); } fts3rec_compute_offsets(&fo, &ftv); /* output to stdout */ if (ftio_init(&ftio_out, 1, FT_IO_FLAG_WRITE | ((ftset.z_level) ? FT_IO_FLAG_ZINIT : 0) ) < 0) fterr_errx(1, "ftio_init(): failed"); /* preserve start/end time from input stream? */ if (keep_input_time) { time_start = ftio_get_cap_start(&ftio_in); time_end = ftio_get_cap_end(&ftio_in); if (time_start && time_end) { ftio_set_preloaded(&ftio_out, 1); ftio_set_cap_time(&ftio_out, time_start, time_end); } } /* keep_input_time */ ftio_set_comment(&ftio_out, ftset.comments); ftio_set_byte_order(&ftio_out, ftset.byte_order); ftio_set_z_level(&ftio_out, ftset.z_level); ftio_set_streaming(&ftio_out, 1); ftio_set_debug(&ftio_out, debug); if (ftio_set_ver(&ftio_out, &ftv) < 0) fterr_errx(1, "ftio_set_ver(): failed"); /* * load acl's * XXX add fname check and close */ if ((yyin = fopen(acl_fname ? acl_fname : "flow.acl", "r"))) while (!feof(yyin)) yyparse(); /* * normalize masks */ /* XXX TODO */ if (debug > 5) acl_dump(acl_list); if (acl_std_src_name) { if ((acl_std_src_index = acl_find(acl_list, acl_std_src_name)) == -1) fterr_errx(1, "Couldn't find list %s\n", acl_std_src_name); acl_std_src_index2 = acl_list.names[acl_std_src_index].num; } if (acl_std_dst_name) { if ((acl_std_dst_index = acl_find(acl_list, acl_std_dst_name)) == -1) fterr_errx(1, "Couldn't find list %s\n", acl_std_dst_name); acl_std_dst_index2 = acl_list.names[acl_std_dst_index].num; } if (acl_ext_name) { if ((acl_ext_index = acl_find(acl_list, acl_ext_name)) == -1) fterr_errx(1, "Couldn't find list %s\n", acl_ext_name); acl_ext_index2 = acl_list.names[acl_ext_index].num; } if (acl_std_nexthop_name) { if ((acl_std_nexthop_index = acl_find(acl_list, acl_std_nexthop_name)) == -1) fterr_errx(1, "Couldn't find list %s\n", acl_std_nexthop_name); acl_std_nexthop_index2 = acl_list.names[acl_std_nexthop_index].num; } /* header first */ if (ftio_write_header(&ftio_out) < 0) fterr_errx(1, "ftio_write_header(): failed"); /* profile */ ftprof_start (&ftp); /* grab 1 flow */ while ((rec = ftio_read(&ftio_in))) { cur.srcaddr = ((uint32_t*)(rec+fo.srcaddr)); cur.dstaddr = ((uint32_t*)(rec+fo.dstaddr)); cur.exaddr = ((uint32_t*)(rec+fo.exaddr)); cur.nexthop = ((uint32_t*)(rec+fo.nexthop)); cur.input = ((uint16_t*)(rec+fo.input)); cur.output = ((uint16_t*)(rec+fo.output)); cur.srcport = ((uint16_t*)(rec+fo.srcport)); cur.dstport = ((uint16_t*)(rec+fo.dstport)); cur.src_as = ((uint16_t*)(rec+fo.src_as)); cur.dst_as = ((uint16_t*)(rec+fo.dst_as)); cur.prot = ((uint8_t*)(rec+fo.prot)); cur.tcp_flags = ((uint8_t*)(rec+fo.tcp_flags)); cur.tos = ((uint8_t*)(rec+fo.tos)); ++ total_flows; /* filter on input interface */ if (filter_input) { if (!in_tbl[*cur.input]) { if (!first_match) continue; } else if (first_match) { goto found; } } /* filter on output interface */ if (filter_output) { if (!out_tbl[*cur.output]) { if (!first_match) continue; } else if (first_match) { goto found; } } /* filter on src port */ if (filter_srcport) { if (!src_tbl[*cur.srcport]) { if (!first_match) continue; } else if (first_match) { goto found; } } /* filter on dst port */ if (filter_dstport) { if (!dst_tbl[*cur.dstport]) { if (!first_match) continue; } else if (first_match) { goto found; } } /* filter on exporter addr */ if (filter_exaddr) { if (*cur.exaddr != exaddr) { if (!first_match) continue; } else if (first_match) { goto found; } } /* filter on protocol */ if (filter_prot) { if (!prot_tbl[*cur.prot]) { if (!first_match) continue; } else if (first_match) { goto found; } } /* filter on ToS */ if (filter_tos) { tos = *cur.tos & tos_mask; if (!tos_tbl[tos]) { if (!first_match) continue; } else if (first_match) { goto found; } } /* filter on tcp_flags */ if (filter_tcp_flags && (*cur.prot == IPPROTO_TCP)) { tcp_flags = *cur.tcp_flags & tcp_flags_mask; if (!tcp_flags_tbl[tcp_flags]) { if (!first_match) continue; } else if (first_match) { goto found; } } if (filter_srcas) { if (!srcas_tbl[*cur.src_as]) { if (!first_match) continue; } else if (first_match) { goto found; } } /* filter on src AS */ if (filter_dstas) { if (!dstas_tbl[*cur.dst_as]) { if (!first_match) continue; } else if (first_match) { goto found; } } /* eval flow nexthop addr and nexthop standard acl */ if (acl_std_nexthop_index != -1) { ret = acl_eval_std(acl_list, acl_std_nexthop_index2, *cur.nexthop); if (ret == 1) { if (!first_match) continue; } else if (first_match) { goto found; } } /* eval flow src addr and source standard acl */ if (acl_std_src_index != -1) { ret = acl_eval_std(acl_list, acl_std_src_index2, *cur.srcaddr); if (ret == 1) { if (!first_match) continue; } else if (first_match) { goto found; } } /* eval flow dst addr and destination standard acl */ if (acl_std_dst_index != -1) { ret = acl_eval_std(acl_list, acl_std_dst_index2, *cur.dstaddr); if (ret == 1) { if (!first_match) continue; } else if (first_match) { goto found; } } /* eval flow and extended acl */ if (acl_ext_index != -1) { tmp_ext.protocol = *cur.prot; tmp_ext.tos = *cur.tos; /* XXX */ tmp_ext.type = 0; tmp_ext.type_code = 0; tmp_ext.message = 0; tmp_ext.src_addr = *cur.srcaddr; tmp_ext.src_port = *cur.srcport; tmp_ext.dst_addr = *cur.dstaddr; tmp_ext.dst_port = *cur.dstport; ret = acl_eval_ext(acl_list, acl_ext_index2, tmp_ext); if (ret == 1) { if (!first_match) continue; } else if (first_match) { goto found; } } if (first_match) /* No matches yet? next try.. */ continue; /* * made it by the filters, write it */ found: if (ftio_write(&ftio_out, rec) < 0) fterr_errx(1, "ftio_write(): failed"); } /* while more flows to read */ if (ftio_close(&ftio_in) < 0) fterr_errx(1, "ftio_close(): failed"); if (ftio_close(&ftio_out) < 0) fterr_errx(1, "ftio_close(): failed"); if (debug > 0) { ftprof_end (&ftp, total_flows); ftprof_print(&ftp, argv[0], stderr); } if (debug > 1) { acl_dump_std(acl_list, acl_std_src_index); acl_dump_std(acl_list, acl_std_dst_index); acl_dump_std(acl_list, acl_std_nexthop_index); } return 0; } /* main */
int main(int argc, char **argv) { int i, format_index, ret, ascii_mask; struct ftio ftio; struct ftprof ftp; struct options opt; /* init fterr */ fterr_setid(argv[0]); debug = 0; format_index = 0; bzero(&opt, sizeof opt); ascii_mask = 0; opt.cflowd_mask = 0xFFFFFFFFL; opt.ft_mask = 0xFFFFFFFFFFFFFFFFLL; /* profile */ ftprof_start (&ftp); while ((i = getopt(argc, argv, "h?d:f:m:u:")) != -1) switch (i) { case 'd': /* debug */ debug = atoi(optarg); break; case 'f': /* format */ format_index = atoi(optarg); break; case 'h': /* help */ case '?': usage(); exit (0); break; case 'm': /* cflowd mask */ if (isalpha((int)optarg[0])) { ascii_mask = 1; if (ftxfield_parse(optarg, &opt.ft_mask) < 0) fterr_errx(1, "ftxfield_parse(): failed"); } else { opt.cflowd_mask = strtoul(optarg, (char **)0L, 0); opt.ft_mask = strtoull(optarg, (char **)0L, 0); } break; case 'u': /* db URI */ if (strlen(optarg) >= sizeof (opt.dbaseURI)) fterr_errx(1, "dbaseURI string too long."); strcpy(opt.dbaseURI, optarg); break; default: usage(); exit (1); break; } /* switch */ if (argc - optind) fterr_errx(1, "Extra arguments starting with %s.", argv[optind]); if (format_index >= NFORMATS) fterr_errx(1, "No such format, %d", format_index); if ((format_index == 0) && ascii_mask) { opt.cflowd_mask = 0; if (ftxfield_tocflow(opt.ft_mask, &opt.cflowd_mask) < 0) { fterr_errx(1, "ftxfield_tocflow(): failed"); } } if (ftio_init(&ftio, 0, FT_IO_FLAG_READ) < 0) fterr_errx(1, "ftio_init(): failed"); ret = format[format_index].where(&ftio, &opt); if ((!ret) && (debug > 0)) { ftprof_end(&ftp, ftio_get_rec_total(&ftio)); ftprof_print(&ftp, argv[0], stderr); } fprintf(stderr, "%s: Exported %lu records\n", argv[0], opt.records); return ret; } /* main */