Function ng_netflow_flow_add

freebsd/netgraph/netflow/netflow.c:647–771

Insert packet from into flow cache. */

#ifdef INET
/* Insert packet from into flow cache. */
int
ng_netflow_flow_add(priv_p priv, fib_export_p fe, struct ip *ip,
    caddr_t upper_ptr, uint8_t upper_proto, uint8_t flags,
    unsigned int src_if_index)
{
	struct flow_entry	*fle, *fle1;
	struct flow_hash_entry	*hsh;
	struct flow_rec		r;
	int			hlen, plen;
	int			error = 0;
	uint16_t		eproto;
	uint8_t			tcp_flags = 0;

	bzero(&r, sizeof(r));

	if (ip->ip_v != IPVERSION)
		return (EINVAL);

	hlen = ip->ip_hl << 2;
	if (hlen < sizeof(struct ip))
		return (EINVAL);

	eproto = ETHERTYPE_IP;
	/* Assume L4 template by default */
	r.flow_type = NETFLOW_V9_FLOW_V4_L4;

	r.r_src = ip->ip_src;
	r.r_dst = ip->ip_dst;
	r.fib = fe->fib;

	plen = ntohs(ip->ip_len);

	r.r_ip_p = ip->ip_p;
	r.r_tos = ip->ip_tos;

	r.r_i_ifx = src_if_index;

	/*
	 * XXX NOTE: only first fragment of fragmented TCP, UDP and
	 * ICMP packet will be recorded with proper s_port and d_port.
	 * Following fragments will be recorded simply as IP packet with
	 * ip_proto = ip->ip_p and s_port, d_port set to zero.
	 * I know, it looks like bug. But I don't want to re-implement
	 * ip packet assebmling here. Anyway, (in)famous trafd works this way -
	 * and nobody complains yet :)
	 */
	if ((ip->ip_off & htons(IP_OFFMASK)) == 0)
		switch(r.r_ip_p) {
		case IPPROTO_TCP:
		    {
			struct tcphdr *tcp;

			tcp = (struct tcphdr *)((caddr_t )ip + hlen);
			r.r_sport = tcp->th_sport;
			r.r_dport = tcp->th_dport;
			tcp_flags = tcp->th_flags;
			break;
		    }