WebSVN – ALCASAR – Diff – /rpms/ipt-netflow-2.2.tgz


ipt-netflow-2.2/0000755000000000000000000000000013213006644012322 5ustar  rootrootipt-netflow-2.2/Makefile.in0000644000000000000000000000671013213006644014373 0ustar  rootroot# Edit Makefile.in and run ./configure
 
KVERSION = @KVERSION@
KDIR = @KDIR@
KINSTDIR = $(shell dirname @KDIR@)
KOPTS = @KOPTS@
IPTABLES_CFLAGS = @IPTABLES_CFLAGS@
IPTABLES_MODULES = @IPTABLES_MODULES@
DEPMOD = /sbin/depmod -a
CARGS = @CARGS@
SNMPTGSO = /usr/lib/snmp/dlmod/snmp_NETFLOW.so
SNMPCONF = /etc/snmp/snmpd.conf
SNMPLINE = dlmod netflow $(SNMPTGSO)
CC = gcc
 
# https://www.kernel.org/doc/Documentation/kbuild/modules.txt
# https://www.kernel.org/doc/Documentation/kbuild/makefiles.txt
obj-m = ipt_NETFLOW.o
ccflags-y = @KOPTS@
 
all: ipt_NETFLOW.ko libipt_NETFLOW.so libip6t_NETFLOW.so @SNMPTARGET@
 
ipt_NETFLOW.ko: version.h ipt_NETFLOW.c ipt_NETFLOW.h compat.h Makefile
	@echo Compiling for kernel $(KVERSION)
	make -C $(KDIR) M=$(CURDIR) modules CONFIG_DEBUG_INFO=y
	@touch $@
sparse: | version.h ipt_NETFLOW.c ipt_NETFLOW.h compat.h Makefile
	@rm -f ipt_NETFLOW.ko ipt_NETFLOW.o
	@echo Compiling for kernel $(KVERSION)
	make -C $(KDIR) M=$(CURDIR) modules C=1
	@touch ipt_NETFLOW.ko
coverity:
	coverity-submit -v
 
minstall: | ipt_NETFLOW.ko
	@echo " *"
	make -C $(KDIR) M=$(CURDIR) modules_install INSTALL_MOD_PATH=$(DESTDIR)
	$(DEPMOD)
mclean:
	make -C $(KDIR) M=$(CURDIR) clean
lclean:
	-rm -f *.so *_sh.o
clean: mclean lclean
	-rm -f *.so *.o modules.order version.h
 
snmp_NETFLOW.so: snmp_NETFLOW.c
	$(CC) -fPIC -shared -o $@ $< -lnetsnmp
 
sinstall: | snmp_NETFLOW.so IPT-NETFLOW-MIB.my
	@echo " *"
	install -D IPT-NETFLOW-MIB.my $(DESTDIR)/usr/share/snmp/mibs/IPT-NETFLOW-MIB.my
	install -D snmp_NETFLOW.so $(DESTDIR)$(SNMPTGSO)
	@if ! egrep -qs "^ *$(SNMPLINE)" $(SNMPCONF); then \
	echo " *"; \
	echo " *  Add this line to $(SNMPCONF) to enable IPT-NETFLOW-MIB:"; \
	echo " *"; \
	echo " *     $(SNMPLINE)"; \
	echo " *"; \
	fi
	@if killall -0 snmpd >/dev/null 2>&1; then \
	  echo " *  (snmpd needs restart for changes to take effect.)"; \
	else \
	  echo " *  (snmpd is not started.)"; \
	fi
 
%_sh.o: libipt_NETFLOW.c
	$(CC) $(CFLAGS) -O2 -Wall -Wunused $(IPTABLES_CFLAGS) -fPIC -o $@ -c libipt_NETFLOW.c
 
%.so: %_sh.o
	$(CC) -shared -o $@ $<
 
version.h: ipt_NETFLOW.c ipt_NETFLOW.h compat.h Makefile
	@./version.sh --define > version.h
 
linstall: | libipt_NETFLOW.so libip6t_NETFLOW.so
	@echo " *"
	install -D libipt_NETFLOW.so $(DESTDIR)$(IPTABLES_MODULES)/libipt_NETFLOW.so
	install -D libip6t_NETFLOW.so $(DESTDIR)$(IPTABLES_MODULES)/libip6t_NETFLOW.so
 
dinstall:
	@echo " *"
	@./install-dkms.sh --install
 
install: minstall linstall @DKMSINSTALL@ @SNMPINSTALL@
 
uninstall:
	-rm -f $(DESTDIR)$(IPTABLES_MODULES)/libipt_NETFLOW.so
	-rm -f $(DESTDIR)$(IPTABLES_MODULES)/libip6t_NETFLOW.so
	-rm -f $(DESTDIR)/usr/share/snmp/mibs/IPT-NETFLOW-MIB.my
	-rm -f $(DESTDIR)$(SNMPTGSO)
	@if egrep -qs "^ *$(SNMPLINE)" $(SNMPCONF); then \
	echo " *"; \
	echo " *  Remove this line from $(SNMPCONF):"; \
	echo " *"; \
	echo " *     "`egrep "^ *$(SNMPLINE)" $(SNMPCONF)`; \
	echo " *"; \
	fi
	@if [ "@DKMSINSTALL@" = dinstall ]; then ./install-dkms.sh --uninstall; fi
	-rm -f $(DESTDIR)$(KINSTDIR)/extra/ipt_NETFLOW.ko
 
Makefile: Makefile.in configure
	./configure --make ${CARGS}
 
load: all
	-insmod ipt_NETFLOW.ko active_timeout=5 protocol=9
	-iptables -I OUTPUT -j NETFLOW
	-iptables -I INPUT -j NETFLOW
	-ip6tables -I OUTPUT -j NETFLOW
	-ip6tables -I INPUT -j NETFLOW
 
unload:
	-iptables -D OUTPUT -j NETFLOW
	-iptables -D INPUT -j NETFLOW
	-ip6tables -D OUTPUT -j NETFLOW
	-ip6tables -D INPUT -j NETFLOW
	-rmmod ipt_NETFLOW.ko
 
reload: unload load
 
ChangeLog:
	gitlog-to-changelog > ChangeLog
.PHONY: ChangeLog
 
ipt-netflow-2.2/raw_promisc_debian_squeeze6.patch0000644000000000000000000000225513213006644021025 0ustar  rootroot
 Short manual and patch for Debian Squeeze
 suggested by Pavel Odintsov:
 
On Thu, Dec 27, 2012 at 07:46:30PM +0400, Pavel Odintsov wrote:
>
> ËÒÁÔËÉÊ ÍÁÎÕÁÌ ÄÌÑ ÐÁÔÞÉÎÇÁ Debian Squeeze ÑÄÒÁ ÐÁÔÞÅÍ promisc.
> 
> cd /usr/src
> apt-get install -y dpkg-dev
> apt-get build-dep  linux-image-2.6.32-5-amd64
> cd linux-2.6-2.6.32/
> apt-get source  linux-image-2.6.32-5-amd64
> 
> wget .... /root/raw_promisc_debian_squeeze6.patch
> patch -p1 < raw_promisc_debian_squeeze6.patch
> îÁËÌÁÄÙ×ÁÅÍ ÐÁÔÞÉ ÄÅÂÉÑÎÁ:
> debian/rules source
> 
> úÁÐÕÓËÁÅÍ ÓÂÏÒËÕ:
> debian/rules binary
> 
 
diff -rupN linux-2.6-2.6.32/net/ipv4/ip_input.c linux-2.6-2.6.32_promisc_raw//net/ipv4/ip_input.c
--- linux-2.6-2.6.32/net/ipv4/ip_input.c	2009-12-03 04:51:21.000000000 +0100
+++ linux-2.6-2.6.32_promisc_raw//net/ipv4/ip_input.c	2012-06-25 19:13:49.000000000 +0200
@@ -383,8 +383,8 @@ int ip_rcv(struct sk_buff *skb, struct n
 	/* When the interface is in promisc. mode, drop all the crap
 	 * that it receives, do not try to analyse it.
 	 */
-	if (skb->pkt_type == PACKET_OTHERHOST)
-		goto drop;
+	//if (skb->pkt_type == PACKET_OTHERHOST)
+	//	goto drop;
 
 
 	IP_UPD_PO_STATS_BH(dev_net(dev), IPSTATS_MIB_IN, skb->len);
ipt-netflow-2.2/compat.h0000644000000000000000000003557413213006644013774 0ustar  rootroot/* This code is derived from the Linux Kernel sources intended
 * to maintain compatibility with different Kernel versions.
 * Copyright of original source is of respective Linux Kernel authors.
 * License is GPLv2.
 */
 
#ifndef COMPAT_NETFLOW_H
#define COMPAT_NETFLOW_H
 
 
#ifndef NIPQUAD
# define NIPQUAD(addr) \
	((unsigned char *)&addr)[0], \
	((unsigned char *)&addr)[1], \
	((unsigned char *)&addr)[2], \
	((unsigned char *)&addr)[3]
#endif
#ifndef HIPQUAD
# if defined(__LITTLE_ENDIAN)
#  define HIPQUAD(addr) \
	((unsigned char *)&addr)[3], \
	((unsigned char *)&addr)[2], \
	((unsigned char *)&addr)[1], \
	((unsigned char *)&addr)[0]
# elif defined(__BIG_ENDIAN)
#  define HIPQUAD NIPQUAD
# else
#  error "Please fix asm/byteorder.h"
# endif /* __LITTLE_ENDIAN */
#endif
 
#ifndef IPT_CONTINUE
# define IPT_CONTINUE XT_CONTINUE
# define ipt_target xt_target
#endif
 
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,25)
union nf_inet_addr {
	__be32		ip;
	__be32		ip6[4];
	struct in_addr	in;
	struct in6_addr	in6;
};
#endif
 
#ifndef list_first_entry
#define list_first_entry(ptr, type, member) \
	list_entry((ptr)->next, type, member)
#endif
 
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24)
# define INIT_NET(x) x
#else
# define INIT_NET(x) init_net.x
#endif
 
#ifndef ETH_P_8021AD
# define ETH_P_8021AD	0x88A8	/* 802.1ad Service VLAN */
#endif
 
#ifndef ETH_P_QINQ1
# define ETH_P_QINQ1	0x9100	/* deprecated QinQ VLAN */
# define ETH_P_QINQ2	0x9200	/* deprecated QinQ VLAN */
# define ETH_P_QINQ3	0x9300	/* deprecated QinQ VLAN */
#endif
 
#ifndef IPPROTO_MH
# define IPPROTO_MH	135
#endif
 
#ifdef CONFIG_SYSCTL
# if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,32)
#  define BEFORE2632(x,y) x,y
# else /* since 2.6.32 */
#  define BEFORE2632(x,y)
# endif
 
# if LINUX_VERSION_CODE >= KERNEL_VERSION(3,17,0)
#  define ctl_table struct ctl_table
# endif
 
# ifndef HAVE_GRSECURITY_H
#  define ctl_table_no_const ctl_table
# endif
#endif
 
#if LINUX_VERSION_CODE < KERNEL_VERSION(3,9,0)
# define compat_hlist_for_each_entry			hlist_for_each_entry
# define compat_hlist_for_each_entry_safe		hlist_for_each_entry_safe
#else /* since 3.9.0 */
# define compat_hlist_for_each_entry(a,pos,c,d)		hlist_for_each_entry(a,c,d)
# define compat_hlist_for_each_entry_safe(a,pos,c,d,e)	hlist_for_each_entry_safe(a,c,d,e)
#endif
 
#ifndef WARN_ONCE
#define WARN_ONCE(x,fmt...) ({ if (x) printk(KERN_WARNING fmt); })
#endif
 
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20)
# define IPPROTO_UDPLITE 136
#endif
 
#ifndef time_is_before_jiffies
# define time_is_before_jiffies(a) time_after(jiffies, a)
#endif
#ifndef time_is_after_jiffies
# define time_is_after_jiffies(a) time_before(jiffies, a)
#endif
 
#if LINUX_VERSION_CODE < KERNEL_VERSION(3,14,0)
# if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
#  define prandom_u32 get_random_int
# elif LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0)
#  define prandom_u32 random32
#endif
#define prandom_u32_max compat_prandom_u32_max
static inline u32 prandom_u32_max(u32 ep_ro)
{
	return (u32)(((u64) prandom_u32() * ep_ro) >> 32);
}
#endif
 
#ifndef min_not_zero
# define min_not_zero(x, y) ({			\
	typeof(x) __x = (x);			\
	typeof(y) __y = (y);			\
	__x == 0 ? __y : ((__y == 0) ? __x : min(__x, __y)); })
#endif
 
#if LINUX_VERSION_CODE < KERNEL_VERSION(3,2,0)
static int __ethtool_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
{
	ASSERT_RTNL();
 
	if (!dev->ethtool_ops->get_settings)
		return -EOPNOTSUPP;
 
	memset(cmd, 0, sizeof(struct ethtool_cmd));
	cmd->cmd = ETHTOOL_GSET;
	return dev->ethtool_ops->get_settings(dev, cmd);
}
#endif
 
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,27)
# define ethtool_cmd_speed(x) (x)->speed
#endif
 
#ifndef ARPHRD_PHONET
# define ARPHRD_PHONET		820
# define ARPHRD_PHONET_PIPE	821
#endif
#ifndef ARPHRD_IEEE802154
# define ARPHRD_IEEE802154	804
#endif
 
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,22)
# define for_each_netdev_ns(net, dev) for (dev = dev_base; dev; dev = dev->next)
#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24)
# define for_each_netdev_ns(net, d) for_each_netdev(d)
#else
# define for_each_netdev_ns(net, d) for_each_netdev(net, d)
#endif
 
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35)
# define CHECK_FAIL	0
# define CHECK_OK	1
#else
# define CHECK_FAIL	-EINVAL
# define CHECK_OK	0
#endif
 
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35)
# define use_module	ref_module
#endif
 
#ifndef NF_IP_LOCAL_IN /* 2.6.25 */
# define NF_IP_PRE_ROUTING	NF_INET_PRE_ROUTING
# define NF_IP_LOCAL_IN		NF_INET_LOCAL_IN
# define NF_IP_FORWARD		NF_INET_FORWARD
# define NF_IP_LOCAL_OUT	NF_INET_LOCAL_OUT
# define NF_IP_POST_ROUTING	NF_INET_POST_ROUTING
#endif
 
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
/* net/netfilter/x_tables.c */
static void xt_unregister_targets(struct xt_target *target, unsigned int n)
{
	unsigned int i;
 
	for (i = 0; i < n; i++)
		xt_unregister_target(&target[i]);
}
static int xt_register_targets(struct xt_target *target, unsigned int n)
{
	unsigned int i;
 
	int err = 0;
	for (i = 0; i < n; i++)
		if ((err = xt_register_target(&target[i])))
			goto err;
	return err;
err:
	if (i > 0)
		xt_unregister_targets(target, i);
	return err;
}
#endif
 
#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,11,0)
#define num_physpages	totalram_pages
#endif
 
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35)
# ifdef ktime_to_timeval
/* ktime_to_timeval is defined on 64bit and inline on 32bit cpu */
/* when it's defined it calls ns_to_timeval, which is not exported */
struct timeval portable_ns_to_timeval(const s64 nsec)
{
	struct timespec ts = ns_to_timespec(nsec);
	struct timeval tv;
 
	tv.tv_sec = ts.tv_sec;
	tv.tv_usec = (suseconds_t) ts.tv_nsec / 1000;
 
	return tv;
}
# define ns_to_timeval portable_ns_to_timeval
# endif
 
static inline s64 portable_ktime_to_ms(const ktime_t kt)
{
	struct timeval tv = ktime_to_timeval(kt);
	return (s64) tv.tv_sec * MSEC_PER_SEC + tv.tv_usec / USEC_PER_MSEC;
}
# define ktime_to_ms portable_ktime_to_ms
#endif /* before 2.6.35 */
 
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,22)
static inline s64 portable_ktime_to_us(const ktime_t kt)
{
	struct timeval tv = ktime_to_timeval(kt);
	return (s64) tv.tv_sec * USEC_PER_SEC + tv.tv_usec;
}
#define ktime_to_us portable_ktime_to_us
#endif
 
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,26)
static inline void put_unaligned_be16(u16 val, void *p)
{
	put_unaligned(cpu_to_be16(val), (__be16 *)p);
}
static inline void put_unaligned_be32(u32 val, void *p)
{
	put_unaligned(cpu_to_be32(val), (__be32 *)p);
}
static inline void put_unaligned_be64(u64 val, void *p)
{
	put_unaligned(cpu_to_be64(val), (__be64 *)p);
}
#endif
 
#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,24) && !defined(RHEL_MAJOR)
static void *__seq_open_private(struct file *f, struct seq_operations *ops,
    int psize)
{
	int rc;
	void *private;
	struct seq_file *seq;
 
	private = kzalloc(psize, GFP_KERNEL);
	if (private == NULL)
		goto out;
 
	rc = seq_open(f, ops);
	if (rc < 0)
		goto out_free;
 
	seq = f->private_data;
	seq->private = private;
	return private;
 
out_free:
	kfree(private);
out:
	return NULL;
}
#endif
 
/* disappeared in v3.19 */
#ifndef __get_cpu_var
#define __get_cpu_var(var)	(*this_cpu_ptr(&(var)))
#endif
 
#ifndef MPLS_HLEN
#define MPLS_HLEN 4
static inline int eth_p_mpls(__be16 eth_type)
{
	return eth_type == htons(ETH_P_MPLS_UC) ||
		eth_type == htons(ETH_P_MPLS_MC);
}
#endif
#ifndef MPLS_LS_S_MASK
struct mpls_label {
	__be32 entry;
};
#define MPLS_LS_S_MASK		0x00000100
 
#endif
 
/* sockaddr comparison functions is from fs/nfs/client.c */
static int sockaddr_match_ipaddr6(const struct sockaddr *sa1, const struct sockaddr *sa2)
{
	const struct sockaddr_in6 *sin1 = (const struct sockaddr_in6 *)sa1;
	const struct sockaddr_in6 *sin2 = (const struct sockaddr_in6 *)sa2;
 
	if (!ipv6_addr_equal(&sin1->sin6_addr, &sin2->sin6_addr))
		return 0;
#if 0
	else if (ipv6_addr_type(&sin1->sin6_addr) & IPV6_ADDR_LINKLOCAL)
		return sin1->sin6_scope_id == sin2->sin6_scope_id;
#endif
	return 1;
}
 
static int sockaddr_match_ipaddr4(const struct sockaddr *sa1, const struct sockaddr *sa2)
{
	const struct sockaddr_in *sin1 = (const struct sockaddr_in *)sa1;
	const struct sockaddr_in *sin2 = (const struct sockaddr_in *)sa2;
 
	return sin1->sin_addr.s_addr == sin2->sin_addr.s_addr;
}
 
static int sockaddr_cmp_ip6(const struct sockaddr *sa1, const struct sockaddr *sa2)
{
	const struct sockaddr_in6 *sin1 = (const struct sockaddr_in6 *)sa1;
	const struct sockaddr_in6 *sin2 = (const struct sockaddr_in6 *)sa2;
 
	return sockaddr_match_ipaddr6(sa1, sa2) &&
		(sin1->sin6_port == sin2->sin6_port);
}
 
static int sockaddr_cmp_ip4(const struct sockaddr *sa1, const struct sockaddr *sa2)
{
	const struct sockaddr_in *sin1 = (const struct sockaddr_in *)sa1;
	const struct sockaddr_in *sin2 = (const struct sockaddr_in *)sa2;
 
	return sockaddr_match_ipaddr4(sa1, sa2) &&
		(sin1->sin_port == sin2->sin_port);
}
 
static int sockaddr_cmp(const struct sockaddr_storage *sa1, const struct sockaddr_storage *sa2)
{
	const struct sockaddr *s1 = (const struct sockaddr *)sa1;
	const struct sockaddr *s2 = (const struct sockaddr *)sa2;
 
	if (sa1->ss_family != sa2->ss_family)
		return 0;
 
	switch (sa1->ss_family) {
	case AF_INET:
		return sockaddr_cmp_ip4(s1, s2);
	case AF_INET6:
		return sockaddr_cmp_ip6(s1, s2);
	}
	return 0;
}
 
#ifndef IN6PTON_XDIGIT
#define hex_to_bin compat_hex_to_bin
/* lib/hexdump.c */
int hex_to_bin(char ch)
{
	if ((ch >= '0') && (ch <= '9'))
		return ch - '0';
	ch = tolower(ch);
	if ((ch >= 'a') && (ch <= 'f'))
		return ch - 'a' + 10;
	return -1;
}
 
/* net/core/utils.c */
#define IN6PTON_XDIGIT		0x00010000
#define IN6PTON_DIGIT		0x00020000
#define IN6PTON_COLON_MASK	0x00700000
#define IN6PTON_COLON_1		0x00100000	/* single : requested */
#define IN6PTON_COLON_2		0x00200000	/* second : requested */
#define IN6PTON_COLON_1_2	0x00400000	/* :: requested */
#define IN6PTON_DOT		0x00800000	/* . */
#define IN6PTON_DELIM		0x10000000
#define IN6PTON_NULL		0x20000000	/* first/tail */
#define IN6PTON_UNKNOWN		0x40000000
 
static inline int xdigit2bin(char c, int delim)
{
	int val;
 
	if (c == delim || c == '\0')
		return IN6PTON_DELIM;
	if (c == ':')
		return IN6PTON_COLON_MASK;
	if (c == '.')
		return IN6PTON_DOT;
 
	val = hex_to_bin(c);
	if (val >= 0)
		return val | IN6PTON_XDIGIT | (val < 10 ? IN6PTON_DIGIT : 0);
 
	if (delim == -1)
		return IN6PTON_DELIM;
	return IN6PTON_UNKNOWN;
}
 
int in4_pton(const char *src, int srclen,
	     u8 *dst,
	     int delim, const char **end)
{
	const char *s;
	u8 *d;
	u8 dbuf[4];
	int ret = 0;
	int i;
	int w = 0;
 
	if (srclen < 0)
		srclen = strlen(src);
	s = src;
	d = dbuf;
	i = 0;
	while(1) {
		int c;
		c = xdigit2bin(srclen > 0 ? *s : '\0', delim);
		if (!(c & (IN6PTON_DIGIT | IN6PTON_DOT | IN6PTON_DELIM | IN6PTON_COLON_MASK))) {
			goto out;
		}
		if (c & (IN6PTON_DOT | IN6PTON_DELIM | IN6PTON_COLON_MASK)) {
			if (w == 0)
				goto out;
			*d++ = w & 0xff;
			w = 0;
			i++;
			if (c & (IN6PTON_DELIM | IN6PTON_COLON_MASK)) {
				if (i != 4)
					goto out;
				break;
			}
			goto cont;
		}
		w = (w * 10) + c;
		if ((w & 0xffff) > 255) {
			goto out;
		}
cont:
		if (i >= 4)
			goto out;
		s++;
		srclen--;
	}
	ret = 1;
	memcpy(dst, dbuf, sizeof(dbuf));
out:
	if (end)
		*end = s;
	return ret;
}
 
int in6_pton(const char *src, int srclen,
	     u8 *dst,
	     int delim, const char **end)
{
	const char *s, *tok = NULL;
	u8 *d, *dc = NULL;
	u8 dbuf[16];
	int ret = 0;
	int i;
	int state = IN6PTON_COLON_1_2 | IN6PTON_XDIGIT | IN6PTON_NULL;
	int w = 0;
 
	memset(dbuf, 0, sizeof(dbuf));
 
	s = src;
	d = dbuf;
	if (srclen < 0)
		srclen = strlen(src);
 
	while (1) {
		int c;
 
		c = xdigit2bin(srclen > 0 ? *s : '\0', delim);
		if (!(c & state))
			goto out;
		if (c & (IN6PTON_DELIM | IN6PTON_COLON_MASK)) {
			/* process one 16-bit word */
			if (!(state & IN6PTON_NULL)) {
				*d++ = (w >> 8) & 0xff;
				*d++ = w & 0xff;
			}
			w = 0;
			if (c & IN6PTON_DELIM) {
				/* We've processed last word */
				break;
			}
			/*
			 * COLON_1 => XDIGIT
			 * COLON_2 => XDIGIT|DELIM
			 * COLON_1_2 => COLON_2
			 */
			switch (state & IN6PTON_COLON_MASK) {
			case IN6PTON_COLON_2:
				dc = d;
				state = IN6PTON_XDIGIT | IN6PTON_DELIM;
				if (dc - dbuf >= sizeof(dbuf))
					state |= IN6PTON_NULL;
				break;
			case IN6PTON_COLON_1|IN6PTON_COLON_1_2:
				state = IN6PTON_XDIGIT | IN6PTON_COLON_2;
				break;
			case IN6PTON_COLON_1:
				state = IN6PTON_XDIGIT;
				break;
			case IN6PTON_COLON_1_2:
				state = IN6PTON_COLON_2;
				break;
			default:
				state = 0;
			}
			tok = s + 1;
			goto cont;
		}
 
		if (c & IN6PTON_DOT) {
			ret = in4_pton(tok ? tok : s, srclen + (int)(s - tok), d, delim, &s);
			if (ret > 0) {
				d += 4;
				break;
			}
			goto out;
		}
 
		w = (w << 4) | (0xff & c);
		state = IN6PTON_COLON_1 | IN6PTON_DELIM;
		if (!(w & 0xf000)) {
			state |= IN6PTON_XDIGIT;
		}
		if (!dc && d + 2 < dbuf + sizeof(dbuf)) {
			state |= IN6PTON_COLON_1_2;
			state &= ~IN6PTON_DELIM;
		}
		if (d + 2 >= dbuf + sizeof(dbuf)) {
			state &= ~(IN6PTON_COLON_1|IN6PTON_COLON_1_2);
		}
cont:
		if ((dc && d + 4 < dbuf + sizeof(dbuf)) ||
		    d + 4 == dbuf + sizeof(dbuf)) {
			state |= IN6PTON_DOT;
		}
		if (d >= dbuf + sizeof(dbuf)) {
			state &= ~(IN6PTON_XDIGIT|IN6PTON_COLON_MASK);
		}
		s++;
		srclen--;
	}
 
	i = 15; d--;
 
	if (dc) {
		while(d >= dc)
			dst[i--] = *d--;
		while(i >= dc - dbuf)
			dst[i--] = 0;
		while(i >= 0)
			dst[i--] = *d--;
	} else
		memcpy(dst, dbuf, sizeof(dbuf));
 
	ret = 1;
out:
	if (end)
		*end = s;
	return ret;
}
#endif /* IN6PTON_XDIGIT */
 
#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,2,0)
# define sock_create_kern(f, t, p, s) sock_create_kern(&init_net, f, t, p, s)
#endif
 
#if !defined(vlan_tx_tag_get) && defined(skb_vlan_tag_get)
# define vlan_tx_tag_get skb_vlan_tag_get
# define vlan_tx_tag_present skb_vlan_tag_present
#endif
 
#ifndef SPEED_UNKNOWN
# define SPEED_UNKNOWN		-1
#endif
 
#if !defined __GNUC_PREREQ && defined __GNUC__ && defined __GNUC_MINOR__
# define __GNUC_PREREQ(maj, min) \
	((__GNUC__ << 16) + __GNUC_MINOR__ >= ((maj) << 16) + (min))
#else
# define __GNUC_PREREQ(maj, min) 0
#endif
 
/* ktime is not union anymore, since 2456e855354415bfaeb7badaa14e11b3e02c8466 */
#if LINUX_VERSION_CODE < KERNEL_VERSION(4,10,0)
# define first_tv64	first.tv64
# define last_tv64	last.tv64
#else
# define first_tv64	first
# define last_tv64	last
#endif
 
/* Offset changes made in 613dbd95723aee7abd16860745691b6c7bda20dc */
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28) && LINUX_VERSION_CODE < KERNEL_VERSION(4,10,0)
# if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35)
#  define xt_action_param xt_target_param
# endif
static inline u_int8_t xt_family(const struct xt_action_param *par)
{
	return par->family;
}
static inline const struct net_device *xt_in(const struct xt_action_param *par)
{
	return par->in;
}
static inline const struct net_device *xt_out(const struct xt_action_param *par)
{
	return par->out;
}
static inline unsigned int xt_hooknum(const struct xt_action_param *par)
{
	return par->hooknum;
}
#endif
 
#ifndef SK_CAN_REUSE
# define SK_CAN_REUSE   1
#endif
 
#if LINUX_VERSION_CODE < KERNEL_VERSION(4,13,0)
# define compat_refcount_read atomic_read
#else
# define compat_refcount_read refcount_read
#endif
 
#endif /* COMPAT_NETFLOW_H */
ipt-netflow-2.2/IPT-NETFLOW-MIB.my0000644000000000000000000004327713213006644015063 0ustar  rootroot-- IPT-NETFLOW-MIB.my
 
IPT-NETFLOW-MIB DEFINITIONS ::= BEGIN
 
IMPORTS
    MODULE-IDENTITY, OBJECT-TYPE, Counter64,
    Gauge32, Integer32, Counter32, enterprises
	FROM SNMPv2-SMI
    OBJECT-GROUP, MODULE-COMPLIANCE
	FROM SNMPv2-CONF
    CounterBasedGauge64
	FROM HCNUM-TC
    TEXTUAL-CONVENTION, DisplayString, DateAndTime
	FROM SNMPv2-TC;
 
iptNetflowMIB MODULE-IDENTITY
    LAST-UPDATED "201409120000Z"
    ORGANIZATION "ABC"
    CONTACT-INFO
	"Author's email: abc at telekom.ru
 
	Latest version should be obtained from
	https://raw.githubusercontent.com/aabc/ipt-netflow/master/IPT-NETFLOW-MIB.my"
 
    DESCRIPTION
	"The IPT-NETFLOW-MIB defines managed objects
	for ipt_NETFLOW kernel module, which is high
	performance NetFlow/IPFIX probe for Linux.
 
	Copyright (c) 2014 <abc at telekom.ru>.
 
	License: GPL"
 
    REVISION	"201409110000Z"
    DESCRIPTION "Initial revision."
 
    ::= { enterprises 37476 9000 10 1 }
 
-- Top Level --
iptNetflowObjects	OBJECT IDENTIFIER ::= { iptNetflowMIB 1 }
iptNetflowStatistics	OBJECT IDENTIFIER ::= { iptNetflowMIB 2 }
iptNetflowConformance	OBJECT IDENTIFIER ::= { iptNetflowMIB 3 }
 
-- Objects --
 
-- modinfo
iptNetflowModule	OBJECT IDENTIFIER ::= { iptNetflowObjects 1 }
-- sysctl net.netflow
iptNetflowSysctl	OBJECT IDENTIFIER ::= { iptNetflowObjects 2 }
 
-- Modinfo Objects --
 
name OBJECT-TYPE
    SYNTAX	DisplayString
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	"Module name."
    ::= { iptNetflowModule 1 }
 
version OBJECT-TYPE
    SYNTAX	DisplayString
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	"Software version of the module."
    ::= { iptNetflowModule 2 }
 
srcversion OBJECT-TYPE
    SYNTAX	DisplayString
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	 "Binary version of the module."
    ::= { iptNetflowModule 3 }
 
loadTime OBJECT-TYPE
    SYNTAX	DateAndTime
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	 "Module load date-time."
    ::= { iptNetflowModule 4 }
 
refcnt OBJECT-TYPE
    SYNTAX	Integer32
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	 "Module usage by other kernel objects."
    ::= { iptNetflowModule 5 }
 
-- RW Sysctl objects --
 
protocol OBJECT-TYPE
    SYNTAX	INTEGER {
	netflow5(5),
	netflow9(9),
	ipfix(10)
    }
    MAX-ACCESS	read-write
    STATUS	current
    DESCRIPTION
	"Protocol version (5, 9, 10=IPFIX)."
    ::= { iptNetflowSysctl 1 }
 
hashsize OBJECT-TYPE
    SYNTAX	Integer32
    UNITS	"buckets"
    MAX-ACCESS	read-write
    STATUS	current
    DESCRIPTION
	"Hash table size of flows cache."
    ::= { iptNetflowSysctl 2 }
 
maxflows OBJECT-TYPE
    SYNTAX	Integer32
    UNITS	"flows"
    MAX-ACCESS	read-write
    STATUS	current
    DESCRIPTION
	"Max flows limit. This limit is used for DoS protection."
    ::= { iptNetflowSysctl 3 }
 
active-timeout OBJECT-TYPE
    SYNTAX	Integer32
    UNITS	"minutes"
    MAX-ACCESS	read-write
    STATUS	current
    DESCRIPTION
	"Active flows timeout value."
    ::= { iptNetflowSysctl 4 }
 
inactive-timeout OBJECT-TYPE
    SYNTAX	Integer32
    UNITS	"minutes"
    MAX-ACCESS	read-write
    STATUS	current
    DESCRIPTION
	"Inactive flows timeout value."
    ::= { iptNetflowSysctl 5 }
 
sndbuf OBJECT-TYPE
    SYNTAX	Integer32
    UNITS	"bytes"
    MAX-ACCESS	read-write
    STATUS	current
    DESCRIPTION
	"Sockets SNDBUF size."
    ::= { iptNetflowSysctl 6 }
 
destination OBJECT-TYPE
    SYNTAX	DisplayString
    MAX-ACCESS	read-write
    STATUS	current
    DESCRIPTION
	"Export destination parameter."
    ::= { iptNetflowSysctl 7 }
 
aggregation OBJECT-TYPE
    SYNTAX	DisplayString
    MAX-ACCESS	read-write
    STATUS	current
    DESCRIPTION
	"Aggregation parameters."
    ::= { iptNetflowSysctl 8 }
 
sampler OBJECT-TYPE
    SYNTAX	DisplayString
    MAX-ACCESS	read-write
    STATUS	current
    DESCRIPTION
	"Sampler parameters: sampling mode:sampling interval.
	Where samplign modes: deterministic, random, hash."
    ::= { iptNetflowSysctl 9 }
 
natevents OBJECT-TYPE
    SYNTAX	INTEGER {
	disabled(0),
	enabled(1)
    }
    MAX-ACCESS	read-write
    STATUS	current
    DESCRIPTION
	"Natevents (NEL) controlling parameter."
    ::= { iptNetflowSysctl 10 }
 
promisc OBJECT-TYPE
    SYNTAX	INTEGER {
	disabled(0),
	enabled(1)
    }
    MAX-ACCESS	read-write
    STATUS	current
    DESCRIPTION
	"Promisc hack controlling parameter."
    ::= { iptNetflowSysctl 11 }
 
snmp-rules OBJECT-TYPE
    SYNTAX	DisplayString
    MAX-ACCESS	read-write
    STATUS	current
    DESCRIPTION
	"SNMP-index translation rules."
    ::= { iptNetflowSysctl 12 }
 
scan-min OBJECT-TYPE
    SYNTAX	Integer32
    MAX-ACCESS	read-write
    STATUS	current
    DESCRIPTION
	"scan-min parameter."
    ::= { iptNetflowSysctl 13 }
 
-- Statistics Objects --
 
iptNetflowTotals	OBJECT IDENTIFIER ::= { iptNetflowStatistics 1 }
 
inBitRate OBJECT-TYPE
    SYNTAX      CounterBasedGauge64
    UNITS       "bits/second"
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
	"Total incoming bits per second."
::= { iptNetflowTotals 1 }
 
inPacketRate OBJECT-TYPE
    SYNTAX      Gauge32
    UNITS       "packets/second"
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
	"Total incoming packets per second."
::= { iptNetflowTotals 2 }
 
inFlows OBJECT-TYPE
    SYNTAX      Counter64
    UNITS       "flows"
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
	"Total observed (metered) flows."
::= { iptNetflowTotals 3 }
 
inPackets OBJECT-TYPE
    SYNTAX      Counter64
    UNITS       "packets"
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
	"Total metered packets. Not couning dropped packets."
::= { iptNetflowTotals 4 }
 
inBytes OBJECT-TYPE
    SYNTAX      Counter64
    UNITS       "bytes"
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
	"Total metered bytes in inPackets."
::= { iptNetflowTotals 5 }
 
FixedDiv100 ::= TEXTUAL-CONVENTION
    DISPLAY-HINT "d-2"
    STATUS	current
    DESCRIPTION "Fixed point, two decimals."
    SYNTAX	Gauge32
 
hashMetric OBJECT-TYPE
    SYNTAX      FixedDiv100
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
	"Measure of performance of hash table. When optimal should
	attract to 1.0, when non-optimal will be highly above of 1."
::= { iptNetflowTotals 6 }
 
hashMemory OBJECT-TYPE
    SYNTAX      Gauge32
    UNITS       "bytes"
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
	"How much system memory is used by the hash table."
::= { iptNetflowTotals 7 }
 
hashFlows OBJECT-TYPE
    SYNTAX      Gauge32
    UNITS       "flows"
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
	"Flows currently residing in the hash table and not
	exported yet."
::= { iptNetflowTotals 8 }
 
hashPackets OBJECT-TYPE
    SYNTAX      Gauge32
    UNITS       "packets"
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
	"Packets in flows currently residing in the hash table."
::= { iptNetflowTotals 9 }
 
hashBytes OBJECT-TYPE
    SYNTAX      CounterBasedGauge64
    UNITS       "bytes"
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
	"Bytes in flows currently residing in the hash table."
::= { iptNetflowTotals 10 }
 
dropPackets OBJECT-TYPE
    SYNTAX      Counter64
    UNITS       "packets"
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
	"Total packets dropped by metering process."
::= { iptNetflowTotals 11 }
 
dropBytes OBJECT-TYPE
    SYNTAX      Counter64
    UNITS       "bytes"
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
	"Total bytes in packets dropped by metering process."
::= { iptNetflowTotals 12 }
 
outByteRate OBJECT-TYPE
    SYNTAX      Gauge32
    UNITS       "bytes/second"
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
	"Total exporter output bytes per second."
::= { iptNetflowTotals 13 }
 
outFlows OBJECT-TYPE
    SYNTAX      Counter64
    UNITS       "flows"
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
	"Total exported flow data records."
::= { iptNetflowTotals 14 }
 
outPackets OBJECT-TYPE
    SYNTAX      Counter64
    UNITS       "packets"
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
	"Total exported packets of netflow stream itself."
::= { iptNetflowTotals 15 }
 
outBytes OBJECT-TYPE
    SYNTAX      Counter64
    UNITS       "bytes"
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
	"Total exported bytes of netflow stream itself."
::= { iptNetflowTotals 16 }
 
lostFlows OBJECT-TYPE
    SYNTAX      Counter64
    UNITS       "flows"
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
	"Total of accounted flows that are lost by exporting process
	 due to socket errors. This value will not include asynchronous
	 errors (cberr), these will be counted in errTotal."
::= { iptNetflowTotals 17 }
 
lostPackets OBJECT-TYPE
    SYNTAX      Counter64
    UNITS       "packets"
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
	"Total metered packets lost by exporting process.
	 See lostFlows for details."
::= { iptNetflowTotals 18 }
 
lostBytes OBJECT-TYPE
    SYNTAX      Counter64
    UNITS       "bytes"
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
	"Total bytes in packets lost by exporting process.
	 See lostFlows for details."
::= { iptNetflowTotals 19 }
 
errTotal OBJECT-TYPE
    SYNTAX      Counter32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
	"Total exporting sockets errors (including cberr)."
::= { iptNetflowTotals 20 }
 
sndbufPeak OBJECT-TYPE
    SYNTAX      Counter32
    UNITS       "bytes"
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
	"Global maximum value of socket sndbuf. Sort of output
	queue length."
::= { iptNetflowTotals 21 }
 
-- Per CPU statistics --
 
iptNetflowCpuTable OBJECT-TYPE
    SYNTAX	SEQUENCE OF IptNetflowCpuEntry
    MAX-ACCESS	not-accessible
    STATUS	current
    DESCRIPTION
	"Per-CPU statistics."
    ::= { iptNetflowStatistics 2 }
 
iptNetflowCpuEntry OBJECT-TYPE
    SYNTAX	IptNetflowCpuEntry
    MAX-ACCESS	not-accessible
    STATUS	current
    DESCRIPTION
	"Defines an entry in the iptNetflowCpuTable."
    INDEX	{ cpuIndex }
    ::= { iptNetflowCpuTable 1 }
 
IptNetflowCpuEntry ::=
    SEQUENCE {
      cpuIndex		INTEGER,
      cpuInPacketRate	Gauge32,
      cpuInFlows	Counter64,
      cpuInPackets	Counter64,
      cpuInBytes	Counter64,
      cpuHashMetric	FixedDiv100,
      cpuDropPackets	Counter64,
      cpuDropBytes	Counter64,
      cpuErrTrunc	Counter32,
      cpuErrFrag	Counter32,
      cpuErrAlloc	Counter32,
      cpuErrMaxflows	Counter32
    }
 
cpuIndex OBJECT-TYPE
    SYNTAX	Integer32 (0..4096)
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	"Index of this cpu."
    ::= { iptNetflowCpuEntry 1 }
 
cpuInPacketRate OBJECT-TYPE
    SYNTAX	Gauge32
    UNITS	"packets/second"
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	"Incoming packets per second for this cpu."
    ::= { iptNetflowCpuEntry 2 }
 
cpuInFlows OBJECT-TYPE
    SYNTAX	Counter64
    UNITS	"flows"
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	"Flows metered on this cpu."
    ::= { iptNetflowCpuEntry 3 }
 
cpuInPackets OBJECT-TYPE
    SYNTAX	Counter64
    UNITS	"packets"
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	"Packets metered for cpuIndex."
    ::= { iptNetflowCpuEntry 4 }
 
cpuInBytes OBJECT-TYPE
    SYNTAX	Counter64
    UNITS	"bytes"
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	"Bytes metered on this cpu."
    ::= { iptNetflowCpuEntry 5 }
 
cpuHashMetric OBJECT-TYPE
    SYNTAX	FixedDiv100
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	"Measure of performance of hash table on this cpu."
    ::= { iptNetflowCpuEntry 6 }
 
cpuDropPackets OBJECT-TYPE
    SYNTAX	Counter64
    UNITS	"packets"
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	"Packets dropped by metering process on this cpu."
    ::= { iptNetflowCpuEntry 7 }
 
cpuDropBytes OBJECT-TYPE
    SYNTAX	Counter64
    UNITS	"bytes"
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	"Bytes in cpuDropPackets for this cpu."
    ::= { iptNetflowCpuEntry 8 }
 
cpuErrTrunc OBJECT-TYPE
    SYNTAX	Counter32
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	"Truncated packets dropped for this cpu."
    ::= { iptNetflowCpuEntry 9 }
 
cpuErrFrag OBJECT-TYPE
    SYNTAX	Counter32
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	"Fragmented packets dropped for this cpu."
    ::= { iptNetflowCpuEntry 10 }
 
cpuErrAlloc OBJECT-TYPE
    SYNTAX	Counter32
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	"Packets dropped due to memory allocation errors."
    ::= { iptNetflowCpuEntry 11 }
 
cpuErrMaxflows OBJECT-TYPE
    SYNTAX	Counter32
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	"Packets dropped due to maxflows limit being reached."
    ::= { iptNetflowCpuEntry 12 }
 
-- Per Socket statistics --
 
iptNetflowSockTable OBJECT-TYPE
    SYNTAX	SEQUENCE OF IptNetflowSockEntry
    MAX-ACCESS	not-accessible
    STATUS	current
    DESCRIPTION
	"Per socket statistics."
    ::= { iptNetflowStatistics 3 }
 
iptNetflowSockEntry OBJECT-TYPE
    SYNTAX	IptNetflowSockEntry
    MAX-ACCESS	not-accessible
    STATUS	current
    DESCRIPTION
	"Defines an entry in the iptNetflowSockTable."
    INDEX	{ sockIndex }
    ::= { iptNetflowSockTable 1 }
 
IptNetflowSockEntry ::=
    SEQUENCE {
      sockIndex		INTEGER,
      sockDestination	DisplayString,
      sockActive	INTEGER,
      sockErrConnect	Counter32,
      sockErrFull	Counter32,
      sockErrCberr	Counter32,
      sockErrOther	Counter32,
      sockSndbuf	Gauge32,
      sockSndbufFill	Gauge32,
      sockSndbufPeak	Gauge32
    }
 
sockIndex OBJECT-TYPE
    SYNTAX	Integer32 (0..4096)
    MAX-ACCESS	not-accessible
    STATUS	current
    DESCRIPTION
	"Exporting socket index."
    ::= { iptNetflowSockEntry 1 }
 
sockDestination OBJECT-TYPE
    SYNTAX	DisplayString
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	"Exporting connection destination of this socket."
    ::= { iptNetflowSockEntry 2 }
 
sockActive OBJECT-TYPE
    SYNTAX	INTEGER {
	  inactive(0),
	  active(1)
    }
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	"Connection state of this socket."
    ::= { iptNetflowSockEntry 3 }
 
sockErrConnect OBJECT-TYPE
    SYNTAX	Counter32
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	"Connections attempt count. High value usually mean
	that network is not set up properly, or module is loaded
	before network is up, in this case it is not dangerous
	and should be ignored."
    ::= { iptNetflowSockEntry 4 }
 
sockErrFull OBJECT-TYPE
    SYNTAX	Counter32
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	"Socket full errors on this socket. Usually mean sndbuf
	value is too small."
    ::= { iptNetflowSockEntry 5 }
 
sockErrCberr OBJECT-TYPE
    SYNTAX	Counter32
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	"Asynchronous callback errors on this socket. Usually mean
	that there is 'connection refused' errors on UDP socket
	reported via ICMP messages."
    ::= { iptNetflowSockEntry 6 }
 
sockErrOther OBJECT-TYPE
    SYNTAX	Counter32
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	"All other possible errors on this socket."
    ::= { iptNetflowSockEntry 7 }
 
sockSndbuf OBJECT-TYPE
    SYNTAX	Gauge32
    UNITS	"bytes"
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	"Sndbuf value for this socket. Higher value allows accommodate
	(exporting) traffic bursts."
    ::= { iptNetflowSockEntry 8 }
 
sockSndbufFill OBJECT-TYPE
    SYNTAX	Gauge32
    UNITS	"bytes"
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	"Amount of data currently in socket buffers. When this value
	will reach size sndbuf, packet loss will occur."
    ::= { iptNetflowSockEntry 9 }
 
sockSndbufPeak OBJECT-TYPE
    SYNTAX	Gauge32
    UNITS	"bytes"
    MAX-ACCESS	read-only
    STATUS	current
    DESCRIPTION
	"Historical peak amount of data in socket buffers. Useful to
	evaluate sndbuf size, because sockSndbufFill is transient."
    ::= { iptNetflowSockEntry 10 }
 
-- Conformance Information --
 
iptNetflowCompliances	OBJECT IDENTIFIER ::= { iptNetflowConformance 1 }
iptNetflowGroups	OBJECT IDENTIFIER ::= { iptNetflowConformance 2 }
 
iptNetflowCompliance MODULE-COMPLIANCE
    STATUS current
    DESCRIPTION "iptNetflowCompliance"
    MODULE
    MANDATORY-GROUPS {
	iptNetflowModuleGroup,
	iptNetflowSysctlGroup,
	iptNetflowTotalsGroup,
	iptNetflowCpuGroup,
	iptNetflowSockGroup
    }
    ::= { iptNetflowCompliances 1 }
 
iptNetflowModuleGroup OBJECT-GROUP
    OBJECTS {
	name,
	version,
	srcversion,
	loadTime,
	refcnt
    }
    STATUS	current
    DESCRIPTION "Modinfo."
    ::= { iptNetflowGroups 1 }
 
iptNetflowSysctlGroup OBJECT-GROUP
    OBJECTS {
	hashsize,
	maxflows,
	protocol,
	active-timeout,
	inactive-timeout,
	sndbuf,
	destination,
	aggregation,
	sampler,
	natevents,
	promisc,
	snmp-rules,
	scan-min
    }
    STATUS	current
    DESCRIPTION "Read-write objects accessed via sysctl"
    ::= { iptNetflowGroups 2 }
 
iptNetflowTotalsGroup OBJECT-GROUP
    OBJECTS {
	inBitRate,
	inPacketRate,
	inFlows,
	inPackets,
	inBytes,
	hashMetric,
	hashMemory,
	hashFlows,
	hashPackets,
	hashBytes,
	dropPackets,
	dropBytes,
	outByteRate,
	outFlows,
	outPackets,
	outBytes,
	lostFlows,
	lostPackets,
	lostBytes,
	errTotal,
	sndbufPeak
    }
    STATUS	current
    DESCRIPTION "Statistics totals."
    ::= { iptNetflowGroups 3 }
 
iptNetflowCpuGroup OBJECT-GROUP
    OBJECTS {
	cpuIndex,
	cpuInPacketRate,
	cpuInFlows,
	cpuInPackets,
	cpuInBytes,
	cpuHashMetric,
	cpuDropPackets,
	cpuDropBytes,
	cpuErrTrunc,
	cpuErrFrag,
	cpuErrAlloc,
	cpuErrMaxflows
    }
    STATUS	current
    DESCRIPTION "Per CPU statistics."
    ::= { iptNetflowGroups 4 }
 
iptNetflowSockGroup OBJECT-GROUP
    OBJECTS {
	sockDestination,
	sockActive,
	sockErrConnect,
	sockErrFull,
	sockErrCberr,
	sockErrOther,
	sockSndbuf,
	sockSndbufFill,
	sockSndbufPeak
    }
    STATUS	current
    DESCRIPTION "Per socket statistics."
    ::= { iptNetflowGroups 5 }
 
END
ipt-netflow-2.2/install-dkms.sh0000755000000000000000000000522413213006644015266 0ustar  rootroot#!/bin/bash
# This script cleanly re-install module into DKMS tree.
 
PATH=$PATH:/bin:/usr/bin:/usr/sbin:/sbin:/usr/local/sbin
 
if [ "$1" = --uninstall ]; then
  echo "Uninstalling from DKMS..."
elif [ "$1" = --install ]; then
  echo "Installing into DKMS..."
else
  exit 1
fi
 
if ! which dkms >/dev/null 2>&1; then
  echo "! You don't have DKMS accessible in system."
  exit 1
fi
 
if [ ! -e dkms.conf ]; then
  echo "! You don't have DKMS configured for this module."
  exit 1
fi
 
MVERSION=`./version.sh`
 
contains() { for e in "${@:2}"; do [[ "$e" = "$1" ]] && return 0; done; return 1; }
 
D=() # to be list of installed versions
OLDIFS="$IFS"
IFS=$'\n' A=(`dkms status | grep ^ipt-netflow`)
IFS="$OLDIFS"
 
for i in "${A[@]}"; do
  z=($i)
  v=${z[1]}
  v=${v%,}
  v=${v%:}
  if ! contains "$v" "${D[@]}"; then
    D+=($v)
  fi
done
 
if [ ${#D[@]} -eq 1 ]; then
  # single version is already installed.
  if [ $D = "$MVERSION" ]; then
    echo "! You have same version of module already installed into DKMS."
  else
    echo "! You have different version of module installed into DKMS."
  fi
  if [ ! -d /usr/src/ipt-netflow-$D ]; then
    echo "! Can not find DKMS dir for it, that's plain weird."
  elif [ -e /usr/src/ipt-netflow-$D/.automatic ]; then
    echo "! That version was automatically installed by this script,"
    echo "! thus, is safe to remove. No worries."
  else
    echo "! That version was manually installed by you."
  fi
 
  nodepmod=
  if grep -qs no-depmod `which dkms`; then
    nodepmod=--no-depmod
  fi
  echo "! Removing from dkms..."
  dkms $nodepmod remove ipt-netflow/$D --all
 
  if [ -d "/usr/src/ipt-netflow-$D" ]; then
    echo "! Removing source tree from /usr/src/ipt-netflow-$D"
    rm -rf "/usr/src/ipt-netflow-$D"
  fi
 
elif [ ${#D[@]} -gt 1 ]; then
  # multiple versions are installed.
  echo "! You have multiple versions of module already installed in DKMS."
  echo "! Please remove them manually to avoid conflict."
  echo "! 'dkms status' output:"
  dkms status
  echo "! Suggested commands to remove them:"
  for i in ${D[@]}; do
    echo "!   root# dkms remove ipt-netflow/$i --all"
  done
  exit 1
fi
 
if [ "$1" = --uninstall ]; then
  exit 0
fi
 
if [ "$PWD" = "/usr/src/ipt-netflow-$MVERSION" ]; then
  echo "! You are already in DKMS dir."
  dkms add -m ipt-netflow -v $MVERSION
  exit $?
fi
 
echo "! Installing $MVERSION into DKMS..."
rm -rf /usr/src/ipt-netflow-$MVERSION
 
mkdir -p /usr/src/ipt-netflow-$MVERSION
cp -p *.[ch] Make* READ* conf* irq* *.sh *.conf /usr/src/ipt-netflow-$MVERSION/
if [ -d .git ]; then
  cp -pr .git /usr/src/ipt-netflow-$MVERSION/
fi
touch /usr/src/ipt-netflow-$MVERSION/.automatic
 
dkms add -m ipt-netflow -v $MVERSION
exit $?
 
ipt-netflow-2.2/ipt_NETFLOW.c0000644000000000000000000046327313213006644014477 0ustar  rootroot/*
 * This is NetFlow exporting module (NETFLOW target) for linux
 * (c) 2008-2016 <abc@telekom.ru>
 *
 *
 *   This program is free software: you can redistribute it and/or modify
 *   it under the terms of the GNU General Public License as published by
 *   the Free Software Foundation, either version 2 of the License, or
 *   (at your option) any later version.
 *
 *   This program is distributed in the hope that it will be useful,
 *   but WITHOUT ANY WARRANTY; without even the implied warranty of
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *   GNU General Public License for more details.
 *
 *   You should have received a copy of the GNU General Public License
 *   along with this program.  If not, see <http://www.gnu.org/licenses/>.
 *
 */
 
#include <linux/module.h>
#include <linux/ctype.h>
#include <linux/skbuff.h>
#include <linux/proc_fs.h>
#include <linux/vmalloc.h>
#include <linux/seq_file.h>
#include <linux/random.h>
#include <linux/in6.h>
#include <linux/inet.h>
#include <linux/kernel.h>
#include <linux/ip.h>
#include <linux/udp.h>
#include <linux/icmp.h>
#include <linux/igmp.h>
#include <linux/inetdevice.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
#include <linux/ethtool.h>
#include <linux/hash.h>
#include <linux/delay.h>
#include <linux/spinlock_types.h>
#include <linux/ktime.h>
#include <linux/if_arp.h>
#include <net/icmp.h>
#include <net/ip.h>
#include <net/ipv6.h>
#include <net/tcp.h>
#include <net/route.h>
#include <net/ip6_fib.h>
#include <net/addrconf.h>
#include <net/dst.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#ifndef ENABLE_NAT
# undef CONFIG_NF_NAT_NEEDED
#endif
#if defined(ENABLE_VLAN) || defined(ENABLE_PROMISC)
# include <linux/if_vlan.h>
#endif
#ifdef ENABLE_MAC
# include <linux/if_ether.h>
# include <linux/etherdevice.h>
#endif
#if defined(CONFIG_NF_NAT_NEEDED)
# include <linux/notifier.h>
# include <net/netfilter/nf_conntrack.h>
# include <net/netfilter/nf_conntrack_core.h>
#endif
#include <linux/version.h>
#include <asm/unaligned.h>
#ifdef HAVE_LLIST
	/* llist.h is officially defined since linux 3.1,
	 * but centos6 have it backported on its 2.6.32.el6 */
# include <linux/llist.h>
#endif
#include "compat.h"
#include "ipt_NETFLOW.h"
#include "murmur3.h"
#ifdef CONFIG_BRIDGE_NETFILTER
# include <linux/netfilter_bridge.h>
#endif
#ifdef CONFIG_SYSCTL
# include <linux/sysctl.h>
#endif
#ifndef CONFIG_NF_CONNTRACK_EVENTS
/* No conntrack events in the kernel imply no natevents. */
# undef CONFIG_NF_NAT_NEEDED
#endif
 
#define IPT_NETFLOW_VERSION "2.2"   /* Note that if you are using git, you
				       will see version in other format. */
#include "version.h"
#ifdef GITVERSION
#undef IPT_NETFLOW_VERSION
#define IPT_NETFLOW_VERSION GITVERSION
#endif
 
MODULE_LICENSE("GPL");
MODULE_AUTHOR("<abc@telekom.ru>");
MODULE_DESCRIPTION("iptables NETFLOW target module");
MODULE_VERSION(IPT_NETFLOW_VERSION);
MODULE_ALIAS("ip6t_NETFLOW");
 
static char version_string[128];
static int  version_string_size;
static struct duration start_ts; /* ts of module start (ktime) */
 
#define DST_SIZE 256
static char destination_buf[DST_SIZE] = "127.0.0.1:2055";
static char *destination = destination_buf;
module_param(destination, charp, 0444);
MODULE_PARM_DESC(destination, "export destination ipaddress:port");
 
#ifdef ENABLE_SAMPLER
static char sampler_buf[128] = "";
static char *sampler = sampler_buf;
module_param(sampler, charp, 0444);
MODULE_PARM_DESC(sampler, "flow sampler parameters");
static atomic_t flow_count = ATOMIC_INIT(0); /* flow counter for deterministic sampler */
static atomic64_t flows_observed = ATOMIC_INIT(0);
static atomic64_t flows_selected = ATOMIC_INIT(0);
#define SAMPLER_INFO_INTERVAL (5*60)
static unsigned long ts_sampler_last = 0; /* template send time (jiffies) */
static struct duration sampling_ts; /* ts of sampling start (ktime) */
#define SAMPLER_SHIFT       14
#define SAMPLER_INTERVAL_M  ((1 << SAMPLER_SHIFT) - 1)
enum {
	SAMPLER_DETERMINISTIC = 1,
	SAMPLER_RANDOM	      = 2,
	SAMPLER_HASH	      = 3
};
struct sampling {
	union {
		u32		v32;
		struct {
			u8	mode;
			u16 	interval;
		};
	};
} samp;
#endif
 
static int inactive_timeout = 15;
module_param(inactive_timeout, int, 0644);
MODULE_PARM_DESC(inactive_timeout, "inactive flows timeout in seconds");
 
static int active_timeout = 30 * 60;
module_param(active_timeout, int, 0644);
MODULE_PARM_DESC(active_timeout, "active flows timeout in seconds");
 
static int exportcpu = -1;
module_param(exportcpu, int, 0644);
MODULE_PARM_DESC(exportcpu, "lock exporter to this cpu");
 
#ifdef ENABLE_PROMISC
static int promisc = 0;
module_param(promisc, int, 0444);
MODULE_PARM_DESC(promisc, "enable promisc hack (0=default, 1)");
static DEFINE_MUTEX(promisc_lock);
#endif
 
static int debug = 0;
module_param(debug, int, 0644);
MODULE_PARM_DESC(debug, "debug verbosity level");
 
static int sndbuf;
module_param(sndbuf, int, 0444);
MODULE_PARM_DESC(sndbuf, "udp socket SNDBUF size");
 
static int protocol = 5;
module_param(protocol, int, 0444);
MODULE_PARM_DESC(protocol, "netflow protocol version (5, 9, 10=IPFIX)");
 
static unsigned int refresh_rate = 20;
module_param(refresh_rate, uint, 0644);
MODULE_PARM_DESC(refresh_rate, "NetFlow v9/IPFIX refresh rate (packets)");
 
static unsigned int timeout_rate = 30;
module_param(timeout_rate, uint, 0644);
MODULE_PARM_DESC(timeout_rate, "NetFlow v9/IPFIX timeout rate (minutes)");
 
static int one = 1;
static unsigned int scan_min = 1;
static unsigned int scan_max = HZ / 10;
module_param(scan_min, uint, 0644);
MODULE_PARM_DESC(scan_min, "Minimal interval between export scans (jiffies)");
 
#ifdef SNMP_RULES
static char snmp_rules_buf[DST_SIZE] = "";
static char *snmp_rules = snmp_rules_buf;
module_param(snmp_rules, charp, 0444);
MODULE_PARM_DESC(snmp_rules, "SNMP-index conversion rules");
static unsigned char *snmp_ruleset;
static DEFINE_SPINLOCK(snmp_lock);
#endif
 
#ifdef CONFIG_NF_NAT_NEEDED
static int natevents = 0;
module_param(natevents, int, 0444);
MODULE_PARM_DESC(natevents, "enable NAT Events");
#endif
 
static int hashsize;
module_param(hashsize, int, 0444);
MODULE_PARM_DESC(hashsize, "hash table size");
 
static int maxflows = 2000000;
module_param(maxflows, int, 0644);
MODULE_PARM_DESC(maxflows, "maximum number of flows");
static int peakflows = 0;
static unsigned long peakflows_at; /* jfffies */
 
static int engine_id = 0;
module_param(engine_id, int, 0644);
MODULE_PARM_DESC(engine_id, "Observation Domain ID");
 
#ifdef ENABLE_AGGR
#define AGGR_SIZE 1024
static char aggregation_buf[AGGR_SIZE] = "";
static char *aggregation = aggregation_buf;
module_param(aggregation, charp, 0400);
MODULE_PARM_DESC(aggregation, "aggregation ruleset");
static LIST_HEAD(aggr_n_list);
static LIST_HEAD(aggr_p_list);
static DEFINE_RWLOCK(aggr_lock);
static void aggregation_remove(struct list_head *list);
static int add_aggregation(char *ptr);
#endif
 
static DEFINE_PER_CPU(struct ipt_netflow_stat, ipt_netflow_stat);
static LIST_HEAD(usock_list);
static DEFINE_MUTEX(sock_lock);
 
#define LOCK_COUNT (1<<8)
#define LOCK_COUNT_MASK (LOCK_COUNT-1)
struct stripe_entry {
	struct list_head list; /* struct ipt_netflow, list for export */
	spinlock_t lock; /* this locks both: hash table stripe & list above */
};
static struct stripe_entry htable_stripes[LOCK_COUNT];
static DEFINE_RWLOCK(htable_rwlock); /* global rwlock to protect htable[] resize */
static struct hlist_head *htable __read_mostly; /* hash table memory */
static unsigned int htable_size __read_mostly = 0; /* buckets */
/* How it's organized:
 *  htable_rwlock locks access to htable[hash], where
 *  htable[htable_size] is big/resizable hash table, which is striped into
 *  htable_stripes[LOCK_COUNT] smaller/static hash table, which contains
 *  .list - list of flows ordered by exportability (usually it's access time)
 *  .lock - lock to both: that .list and to htable[hash], where
 *  hash to the htable[] is hash_netflow(&tuple) % htable_size
 *  hash to the htable_stripes[] is hash & LOCK_COUNT_MASK
 */
#ifdef HAVE_LLIST
static LLIST_HEAD(export_llist); /* flows to purge */
#endif
#ifdef CONFIG_NF_NAT_NEEDED
static LIST_HEAD(nat_list); /* nat events */
static DEFINE_SPINLOCK(nat_lock);
static unsigned long nat_events_start = 0;
static unsigned long nat_events_stop = 0;
#endif
static struct kmem_cache *ipt_netflow_cachep __read_mostly; /* ipt_netflow memory */
static atomic_t ipt_netflow_count = ATOMIC_INIT(0);
 
static long long pdu_packets = 0, pdu_traf = 0; /* how much accounted traffic in pdu */
static unsigned int pdu_count = 0;
static unsigned int pdu_seq = 0;
static unsigned int pdu_data_records = 0; /* Data records */
static unsigned int pdu_flow_records = 0; /* Data records with flows (for stat only) */
static unsigned int pdu_tpl_records = 0;
static unsigned long pdu_ts_mod; /* ts(jiffies) of last flow */
static unsigned int pdu_needs_export = 0;
static union {
	__be16 version;
	struct netflow5_pdu v5;
	struct netflow9_pdu v9;
	struct ipfix_pdu ipfix;
} pdu;
static __u8 *pdu_data_used;
static __u8 *pdu_high_wm; /* high watermark */
static struct flowset_data *pdu_flowset = NULL; /* current data flowset */
 
static unsigned long wk_start; /* last start of worker (jiffies) */
static unsigned long wk_busy;  /* last work busy time (jiffies) */
static unsigned int wk_count;  /* how much is scanned */
static unsigned int wk_cpu;
static unsigned int wk_trylock;
static unsigned int wk_llist;
static void (*netflow_export_flow)(struct ipt_netflow *nf);
static void (*netflow_export_pdu)(void); /* called on timeout */
static void netflow_switch_version(int ver);
 
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20)
static void netflow_work_fn(void *work);
static DECLARE_WORK(netflow_work, netflow_work_fn, NULL);
#else
static void netflow_work_fn(struct work_struct *work);
static DECLARE_DELAYED_WORK(netflow_work, netflow_work_fn);
#endif
static struct timer_list rate_timer;
 
#define TCP_SYN_ACK 0x12
#define TCP_FIN_RST 0x05
 
static long long sec_prate = 0, sec_brate = 0;
static long long min_prate = 0, min_brate = 0;
static long long min5_prate = 0, min5_brate = 0;
#define METRIC_DFL 100
static int metric = METRIC_DFL,
	   min15_metric = METRIC_DFL,
	   min5_metric = METRIC_DFL,
	   min_metric = METRIC_DFL; /* hash metrics */
 
static int set_hashsize(int new_size);
static void destination_removeall(void);
static int add_destinations(const char *ptr);
static int netflow_scan_and_export(int flush);
enum {
	DONT_FLUSH, AND_FLUSH
};
static int template_ids = FLOWSET_DATA_FIRST;
static int tpl_count = 0; /* how much active templates */
#define STAT_INTERVAL	 (1*60)
#define SYSINFO_INTERVAL (5*60)
static unsigned long ts_stat_last = 0; /* (jiffies) */
static unsigned long ts_sysinf_last = 0; /* (jiffies) */
static unsigned long ts_ifnames_last = 0; /* (jiffies) */
 
static inline __be32 bits2mask(int bits) {
	return (bits? 0xffffffff << (32 - bits) : 0);
}
 
static inline int mask2bits(__be32 mask) {
	int n;
 
	for (n = 0; mask; n++)
		mask = (mask << 1) & 0xffffffff;
	return n;
}
 
/* under that lock worker is always stopped and not rescheduled,
 * and we can call worker sub-functions manually */
static DEFINE_MUTEX(worker_lock);
 
static int worker_delay = HZ / 10;
static inline void _schedule_scan_worker(const int pdus)
{
	int cpu = exportcpu;
 
	/* rudimentary congestion avoidance */
	if (pdus > 0)
		worker_delay /= pdus;
	else
		worker_delay *= 2;
 
	if (worker_delay < scan_min)
		worker_delay = scan_min;
	else if (worker_delay > scan_max)
		worker_delay = scan_max;
 
	if (cpu >= 0) {
		if (cpu < NR_CPUS &&
		    cpu_online(cpu)) {
			schedule_delayed_work_on(cpu, &netflow_work, worker_delay);
			return;
		}
		printk(KERN_WARNING "ipt_NETFLOW: can't schedule exporter on cpu %d. Disabling cpu lock.\n",
		    cpu);
		exportcpu = -1;
	}
	schedule_delayed_work(&netflow_work, worker_delay);
}
 
/* This is only called soon after pause_scan_worker. */
static inline void cont_scan_worker(void)
{
	_schedule_scan_worker(0);
	mutex_unlock(&worker_lock);
}
 
static inline void _unschedule_scan_worker(void)
{
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,23)
	cancel_rearming_delayed_work(&netflow_work);
#else
	cancel_delayed_work_sync(&netflow_work);
#endif
}
 
/* This is only used for quick pause (in procctl). */
static inline void pause_scan_worker(void)
{
	mutex_lock(&worker_lock);
	_unschedule_scan_worker();
}
 
#ifdef ENABLE_SAMPLER
static inline unsigned char get_sampler_mode(void)
{
	return samp.mode;
}
static inline unsigned short get_sampler_interval(void)
{
	return samp.interval;
}
static inline const char *sampler_mode_string(void)
{
	const unsigned char mode = get_sampler_mode();
	return mode == SAMPLER_DETERMINISTIC? "deterministic" :
		mode == SAMPLER_RANDOM? "random" : "hash";
}
/* map SAMPLER_HASH into SAMPLER_RANDOM */
static unsigned char get_sampler_mode_nf(void)
{
	const unsigned char mode = get_sampler_mode();
	return (mode == SAMPLER_HASH)? SAMPLER_RANDOM : mode;
}
static inline unsigned short sampler_nf_v5(void)
{
	return (get_sampler_mode_nf() << SAMPLER_SHIFT) | get_sampler_interval();
}
#endif
 
/* return value is different from usual snprintf */
static char *snprintf_sockaddr(char *buf, size_t len, const struct sockaddr_storage *ss)
{
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,32)
	if (ss->ss_family == AF_INET) {
		const struct sockaddr_in *sin = (struct sockaddr_in *)ss;
 
		snprintf(buf, len, "%u.%u.%u.%u:%u",
		    NIPQUAD(sin->sin_addr.s_addr),
		    ntohs(sin->sin_port));
	} else if (ss->ss_family == AF_INET6) {
		const struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)ss;
 
		snprintf(buf, len, "[%x:%x:%x:%x:%x:%x:%x:%x]:%u",
		    ntohs(sin6->sin6_addr.s6_addr16[0]),
		    ntohs(sin6->sin6_addr.s6_addr16[1]),
		    ntohs(sin6->sin6_addr.s6_addr16[2]),
		    ntohs(sin6->sin6_addr.s6_addr16[3]),
		    ntohs(sin6->sin6_addr.s6_addr16[4]),
		    ntohs(sin6->sin6_addr.s6_addr16[5]),
		    ntohs(sin6->sin6_addr.s6_addr16[6]),
		    ntohs(sin6->sin6_addr.s6_addr16[7]),
		    ntohs(sin6->sin6_port));
	} else
		snprintf(buf, len, "(invalid address)");
#elif LINUX_VERSION_CODE < KERNEL_VERSION(3,11,0)
	if (ss->ss_family == AF_INET)
		snprintf(buf, len, "%pI4:%u",
		    &((const struct sockaddr_in *)ss)->sin_addr,
		    ntohs(((const struct sockaddr_in *)ss)->sin_port));
	else if (ss->ss_family == AF_INET6)
		snprintf(buf, len, "[%pI6c]:%u",
		    &((const struct sockaddr_in6 *)ss)->sin6_addr,
		    ntohs(((const struct sockaddr_in6 *)ss)->sin6_port));
	else
		snprintf(buf, len, "(invalid address)");
#else
	snprintf(buf, len, "%pISpc", ss);
#endif
	return buf;
}
 
static char *print_sockaddr(const struct sockaddr_storage *ss)
{
	static char buf[64];
 
	return snprintf_sockaddr(buf, sizeof(buf), ss);
}
 
static int is_zero_addr(const struct sockaddr_storage *ss)
{
	if (ss->ss_family == AF_INET)
		return ((const struct sockaddr_in *)ss)->sin_addr.s_addr == 0;
	else if (ss->ss_family == AF_INET6)
		return  ((const struct sockaddr_in6 *)ss)->sin6_addr.s6_addr32[0] == 0 &&
			((const struct sockaddr_in6 *)ss)->sin6_addr.s6_addr32[1] == 0 &&
			((const struct sockaddr_in6 *)ss)->sin6_addr.s6_addr32[2] == 0 &&
			((const struct sockaddr_in6 *)ss)->sin6_addr.s6_addr32[3] == 0;
	else /* AF_UNSPEC */
		return 1;
}
 
static char *print_usock_addr(struct ipt_netflow_sock *usock)
{
	static char buf[128];
	size_t len;
 
	snprintf(buf, sizeof(buf), "%s", print_sockaddr(&usock->addr));
 
	if (!is_zero_addr(&usock->saddr)) {
		len = strlen(buf);
		snprintf(buf + len, sizeof(buf) - len, "@%s",
		    print_sockaddr(&usock->saddr));
		len = strlen(buf);
		/* strip zero port */
		if (len > 2 && buf[len - 1] == '0' && buf[len - 2] == ':')
			buf[len - 2] = '\0';
	}
	if (usock->sdev[0]) {
		len = strlen(buf);
		snprintf(buf + len, sizeof(buf) - len, "%%%s", usock->sdev);
	}
	return buf;
}
 
#ifdef CONFIG_PROC_FS
static inline int ABS(int x) { return x >= 0 ? x : -x; }
#define SAFEDIV(x,y) ((y)? ({ u64 __tmp = x; do_div(__tmp, y); (int)__tmp; }) : 0)
#define FFLOAT(x, prec) (int)(x) / prec, ABS((int)(x) % prec)
static int snmp_seq_show(struct seq_file *seq, void *v)
{
	int cpu;
	unsigned int nr_flows = atomic_read(&ipt_netflow_count);
	struct ipt_netflow_stat t = { 0 };
	struct ipt_netflow_sock *usock;
	unsigned int sndbuf_peak = 0;
	int snum = 0;
 
	for_each_present_cpu(cpu) {
		struct ipt_netflow_stat *st = &per_cpu(ipt_netflow_stat, cpu);
 
		t.notfound	+= st->notfound;
		t.pkt_total	+= st->pkt_total;
		t.traf_total	+= st->traf_total;
 
		t.send_failed	+= st->send_failed;
		t.sock_cberr	+= st->sock_cberr;
 
		t.exported_rate	+= st->exported_rate;
		t.exported_pkt	+= st->exported_pkt;
		t.exported_flow	+= st->exported_flow;
		t.exported_traf	+= st->exported_traf;
 
		t.pkt_drop	+= st->pkt_drop;
		t.traf_drop	+= st->traf_drop;
		t.pkt_lost	+= st->pkt_lost;
		t.traf_lost	+= st->traf_lost;
		t.flow_lost	+= st->flow_lost;
	}
 
 
	seq_printf(seq,
	    "inBitRate    %llu\n"
	    "inPacketRate %llu\n"
	    "inFlows      %llu\n"
	    "inPackets    %llu\n"
	    "inBytes      %llu\n"
	    "hashMetric   %d.%02d\n"
	    "hashMemory   %lu\n"
	    "hashFlows    %u\n"
	    "hashPackets  %llu\n"
	    "hashBytes    %llu\n"
	    "dropPackets  %llu\n"
	    "dropBytes    %llu\n"
	    "outByteRate  %u\n"
	    "outFlows     %llu\n"
	    "outPackets   %llu\n"
	    "outBytes     %llu\n"
	    "lostFlows    %llu\n"
	    "lostPackets  %llu\n"
	    "lostBytes    %llu\n"
	    "errTotal     %u\n",
	    sec_brate,
	    sec_prate,
	    t.notfound,
	    t.pkt_total,
	    t.traf_total,
	    FFLOAT(SAFEDIV(100LL * (t.searched + t.found + t.notfound), (t.found + t.notfound)), 100),
	    (unsigned long)nr_flows * sizeof(struct ipt_netflow) +
		   (unsigned long)htable_size * sizeof(struct hlist_head),
	    nr_flows,
	    t.pkt_total - t.pkt_out,
	    t.traf_total - t.traf_out,
	    t.pkt_drop,
	    t.traf_drop,
	    t.exported_rate,
	    t.exported_flow,
	    t.exported_pkt,
	    t.exported_traf,
	    t.flow_lost,
	    t.pkt_lost,
	    t.traf_lost,
	    t.send_failed + t.sock_cberr);
 
	for_each_present_cpu(cpu) {
		struct ipt_netflow_stat *st = &per_cpu(ipt_netflow_stat, cpu);
 
		seq_printf(seq,
		    "cpu%u %u %llu %llu %llu %d.%02d %llu %llu %u %u %u %u\n",
		    cpu,
		    st->pkt_total_rate,
		    st->notfound,
		    st->pkt_total,
		    st->traf_total,
		    FFLOAT(st->metric, 100),
		    st->pkt_drop,
		    st->traf_drop,
		    st->truncated,
		    st->frags,
		    st->alloc_err,
		    st->maxflows_err);
	}
 
	mutex_lock(&sock_lock);
	list_for_each_entry(usock, &usock_list, list) {
		int wmem_peak = atomic_read(&usock->wmem_peak);
 
		if (sndbuf_peak < wmem_peak)
			sndbuf_peak = wmem_peak;
		seq_printf(seq, "sock%d %s %d %u %u %u %u",
		    snum,
		    print_usock_addr(usock),
		    !!usock->sock,
		    usock->err_connect,
		    usock->err_full,
		    usock->err_cberr,
		    usock->err_other);
		if (usock->sock) {
			struct sock *sk = usock->sock->sk;
 
			seq_printf(seq, " %u %u %u\n",
			    sk->sk_sndbuf,
			    compat_refcount_read(&sk->sk_wmem_alloc),
			    wmem_peak);
		} else
			seq_printf(seq, " 0 0 %u\n", wmem_peak);
 
		snum++;
	}
	mutex_unlock(&sock_lock);
	seq_printf(seq, "sndbufPeak   %u\n", sndbuf_peak);
 
	return 0;
}
 
/* procfs statistics /proc/net/stat/ipt_netflow */
static int nf_seq_show(struct seq_file *seq, void *v)
{
	unsigned int nr_flows = atomic_read(&ipt_netflow_count);
	int cpu;
	struct ipt_netflow_stat t = { 0 };
	struct ipt_netflow_sock *usock;
#ifdef ENABLE_AGGR
	struct netflow_aggr_n *aggr_n;
	struct netflow_aggr_p *aggr_p;
#endif
	int snum = 0;
	int peak = (jiffies - peakflows_at) / HZ;
 
	seq_printf(seq, "ipt_NETFLOW " IPT_NETFLOW_VERSION ", srcversion %s;"
#ifdef ENABLE_AGGR
	    " aggr"
#endif
#ifdef ENABLE_DIRECTION
	    " dir"
#endif
#ifdef HAVE_LLIST
	    " llist"
#endif
#ifdef ENABLE_MAC
	    " mac"
#endif
#ifdef CONFIG_NF_NAT_NEEDED
	    " nel"
#endif
#ifdef ENABLE_PROMISC
	    " promisc"
# ifdef PROMISC_MPLS
	    "+mpls"
# endif
#endif
#ifdef ENABLE_SAMPLER
	    " samp"
# ifdef SAMPLING_HASH
	    "-h"
# endif
#endif
#ifdef SNMP_RULES
	    " snmp"
#endif
#ifdef ENABLE_VLAN
	    " vlan"
#endif
	    "\n",
	    THIS_MODULE->srcversion);
 
	seq_printf(seq, "Protocol version %d", protocol);
	if (protocol == 10)
		seq_printf(seq, " (ipfix)");
	else
		seq_printf(seq, " (netflow)");
	if (protocol >= 9)
		seq_printf(seq, ", refresh-rate %u, timeout-rate %u, (templates %d, active %d).\n",
		    refresh_rate, timeout_rate, template_ids - FLOWSET_DATA_FIRST, tpl_count);
	else
		seq_printf(seq, "\n");
 
	seq_printf(seq, "Timeouts: active %ds, inactive %ds. Maxflows %u\n",
	    active_timeout,
	    inactive_timeout,
	    maxflows);
 
	for_each_present_cpu(cpu) {
		struct ipt_netflow_stat *st = &per_cpu(ipt_netflow_stat, cpu);
 
		t.searched	+= st->searched;
		t.found		+= st->found;
		t.notfound	+= st->notfound;
		t.pkt_total	+= st->pkt_total;
		t.traf_total	+= st->traf_total;
#ifdef ENABLE_PROMISC
		t.pkt_promisc	+= st->pkt_promisc;
		t.pkt_promisc_drop += st->pkt_promisc_drop;
#endif
		t.truncated	+= st->truncated;
		t.frags		+= st->frags;
		t.maxflows_err	+= st->maxflows_err;
		t.alloc_err	+= st->alloc_err;
		t.send_failed	+= st->send_failed;
		t.sock_cberr	+= st->sock_cberr;
 
		t.exported_rate	+= st->exported_rate;
		t.exported_pkt	+= st->exported_pkt;
		t.exported_flow	+= st->exported_flow;
		t.exported_traf	+= st->exported_traf;
 
		t.pkt_total_rate += st->pkt_total_rate;
		t.pkt_drop	+= st->pkt_drop;
		t.traf_drop	+= st->traf_drop;
		t.pkt_lost	+= st->pkt_lost;
		t.traf_lost	+= st->traf_lost;
		t.flow_lost	+= st->flow_lost;
		t.pkt_out	+= st->pkt_out;
		t.traf_out	+= st->traf_out;
#ifdef ENABLE_SAMPLER
		t.pkts_observed	+= st->pkts_observed;
		t.pkts_selected	+= st->pkts_selected;
#endif
	}
 
#ifdef ENABLE_SAMPLER
	if (get_sampler_mode()) {
		seq_printf(seq, "Flow sampling mode %s one-out-of %u.",
		    sampler_mode_string(),
		    get_sampler_interval());
		if (get_sampler_mode() != SAMPLER_HASH)
			seq_printf(seq, " Flows selected %lu, discarded %lu.",
			    atomic64_read(&flows_selected),
			    atomic64_read(&flows_observed) - atomic64_read(&flows_selected));
		else
			seq_printf(seq, " Flows selected %lu.", atomic64_read(&flows_selected));
		seq_printf(seq, " Pkts selected %llu, discarded %llu.\n",
		    t.pkts_selected,
		    t.pkts_observed - t.pkts_selected);
	} else
		seq_printf(seq, "Flow sampling is disabled.\n");
#endif
 
#ifdef ENABLE_PROMISC
	seq_printf(seq, "Promisc hack is %s (observed %llu packets, discarded %llu).\n",
	    promisc? "enabled" : "disabled",
	    t.pkt_promisc,
	    t.pkt_promisc_drop);
#endif
 
#ifdef CONFIG_NF_NAT_NEEDED
	seq_printf(seq, "Natevents %s, count start %lu, stop %lu.\n", natevents? "enabled" : "disabled",
	    nat_events_start, nat_events_stop);
#endif
 
	seq_printf(seq, "Flows: active %u (peak %u reached %ud%uh%um ago), mem %uK, worker delay %d/%d"
	    " [%d..%d] (%u ms, %u us, %u:%u"
#ifdef HAVE_LLIST
	    " %u"
#endif
	    " [cpu%u]).\n",
		   nr_flows,
		   peakflows,
		   peak / (60 * 60 * 24), (peak / (60 * 60)) % 24, (peak / 60) % 60,
		   (unsigned int)(((unsigned long)nr_flows * sizeof(struct ipt_netflow) +
				   (unsigned long)htable_size * sizeof(struct hlist_head)) >> 10),
		   worker_delay, HZ,
		   scan_min, scan_max,
		   jiffies_to_msecs(jiffies - wk_start),
		   jiffies_to_usecs(wk_busy),
		   wk_count,
		   wk_trylock,
#ifdef HAVE_LLIST
		   wk_llist,
#endif
		   wk_cpu);
 
	seq_printf(seq, "Hash: size %u (mem %uK), metric %d.%02d [%d.%02d, %d.%02d, %d.%02d]."
	    " InHash: %llu pkt, %llu K, InPDU %llu, %llu.\n",
	    htable_size,
	    (unsigned int)((htable_size * sizeof(struct hlist_head)) >> 10),
	    FFLOAT(metric, 100),
	    FFLOAT(min_metric, 100),
	    FFLOAT(min5_metric, 100),
	    FFLOAT(min15_metric, 100),
	    t.pkt_total - t.pkt_out,
	    (t.traf_total - t.traf_out) >> 10,
	    pdu_packets,
	    pdu_traf);
 
	seq_printf(seq, "Rate: %llu bits/sec, %llu packets/sec;"
	    " Avg 1 min: %llu bps, %llu pps; 5 min: %llu bps, %llu pps\n",
	    sec_brate, sec_prate, min_brate, min_prate, min5_brate, min5_prate);
 
	seq_printf(seq, "cpu#     pps; <search found new [metric], trunc frag alloc maxflows>,"
	    " traffic: <pkt, bytes>, drop: <pkt, bytes>\n");
 
	seq_printf(seq, "Total %6u; %6llu %6llu %6llu [%d.%02d], %4u %4u %4u %4u,"
	    " traffic: %llu, %llu MB, drop: %llu, %llu K\n",
	    t.pkt_total_rate,
	    t.searched,
	    t.found,
	    t.notfound,
	    FFLOAT(SAFEDIV(100LL * (t.searched + t.found + t.notfound), (t.found + t.notfound)), 100),
	    t.truncated, t.frags, t.alloc_err, t.maxflows_err,
	    t.pkt_total, t.traf_total >> 20,
	    t.pkt_drop, t.traf_drop >> 10);
 
	if (num_present_cpus() > 1) {
		for_each_present_cpu(cpu) {
			struct ipt_netflow_stat *st;
 
			st = &per_cpu(ipt_netflow_stat, cpu);
			seq_printf(seq, "cpu%-2u %6u; %6llu %6llu %6llu [%d.%02d], %4u %4u %4u %4u,"
			    " traffic: %llu, %llu MB, drop: %llu, %llu K\n",
			    cpu,
			    st->pkt_total_rate,
			    st->searched,
			    st->found,
			    st->notfound,
			    FFLOAT(st->metric, 100),
			    st->truncated, st->frags, st->alloc_err, st->maxflows_err,
			    st->pkt_total, st->traf_total >> 20,
			    st->pkt_drop, st->traf_drop >> 10);
		}
	}
 
	seq_printf(seq, "Export: Rate %u bytes/s; Total %llu pkts, %llu MB, %llu flows;"
	    " Errors %u pkts; Traffic lost %llu pkts, %llu Kbytes, %llu flows.\n",
	    t.exported_rate,
	    t.exported_pkt,
	    t.exported_traf >> 20,
	    t.exported_flow,
	    t.send_failed,
	    t.pkt_lost,
	    t.traf_lost >> 10,
	    t.flow_lost);
 
	mutex_lock(&sock_lock);
	list_for_each_entry(usock, &usock_list, list) {
		seq_printf(seq, "sock%d: %s",
		    snum,
		    print_usock_addr(usock));
		if (usock->sock) {
			struct sock *sk = usock->sock->sk;
 
			seq_printf(seq, ", sndbuf %u, filled %u, peak %u;"
			    " err: sndbuf reached %u, connect %u, cberr %u, other %u\n",
			    sk->sk_sndbuf,
			    compat_refcount_read(&sk->sk_wmem_alloc),
			    atomic_read(&usock->wmem_peak),
			    usock->err_full,
			    usock->err_connect,
			    usock->err_cberr,
			    usock->err_other);
		} else
			seq_printf(seq, " unconnected (%u attempts).\n",
			    usock->err_connect);
		snum++;
	}
	mutex_unlock(&sock_lock);
 
#ifdef ENABLE_AGGR
	read_lock_bh(&aggr_lock);
	snum = 0;
	list_for_each_entry(aggr_n, &aggr_n_list, list) {
		seq_printf(seq, "aggr#%d net: match %u.%u.%u.%u/%d strip %d (usage %u)\n",
		    snum,
		    HIPQUAD(aggr_n->addr),
		    mask2bits(aggr_n->mask),
		    mask2bits(aggr_n->aggr_mask),
		    atomic_read(&aggr_n->usage));
		snum++;
	}
	snum = 0;
	list_for_each_entry(aggr_p, &aggr_p_list, list) {
		seq_printf(seq, "aggr#%d port: ports %u-%u replace %u (usage %u)\n",
		    snum,
		    aggr_p->port1,
		    aggr_p->port2,
		    aggr_p->aggr_port,
		    atomic_read(&aggr_p->usage));
		snum++;
	}
	read_unlock_bh(&aggr_lock);
#endif
#ifdef SNMP_RULES
	{
		const unsigned char *rules;
 
		snum = 0;
		rcu_read_lock();
		rules = rcu_dereference(snmp_ruleset);
		if (rules)
		while (*rules) {
			const unsigned int len = *rules++;
 
			seq_printf(seq, "SNMP-rule#%d: prefix '%.*s' map to %d\n",
				snum, len, rules, (rules[len] << 8) + rules[len + 1]);
			rules += len + 2;
			++snum;
		}
		rcu_read_unlock();
	}
#endif
	return 0;
}
 
static int nf_seq_open(struct inode *inode, struct file *file)
{
	return single_open(file, nf_seq_show, NULL);
}
 
static int snmp_seq_open(struct inode *inode, struct file *file)
{
	return single_open(file, snmp_seq_show, NULL);
}
 
static struct file_operations nf_seq_fops = {
	.owner	 = THIS_MODULE,
	.open	 = nf_seq_open,
	.read	 = seq_read,
	.llseek	 = seq_lseek,
	.release = single_release,
};
 
static struct file_operations snmp_seq_fops = {
	.owner	 = THIS_MODULE,
	.open	 = snmp_seq_open,
	.read	 = seq_read,
	.llseek	 = seq_lseek,
	.release = single_release,
};
 
static inline int inactive_needs_export(const struct ipt_netflow *nf, const long i_timeout,
    const unsigned long jiff);
static inline int active_needs_export(const struct ipt_netflow *nf, const long a_timeout,
    const unsigned long jiff);
static inline u_int32_t hash_netflow(const struct ipt_netflow_tuple *tuple);
 
struct flows_dump_private {
	int pcache;	/* pos */
	void *vcache;	/* corresponding pointer for pos */
	int stripe;	/* current stripe */
	struct list_head list; /* copy of stripe */
	int alloc_errors;
};
 
/* deallocate copied stripe */
static void nf_free_stripe(struct list_head *list)
{
	struct ipt_netflow *cf, *tmp;
 
	list_for_each_entry_safe(cf, tmp, list, flows_list) {
		kmem_cache_free(ipt_netflow_cachep, cf);
	}
	INIT_LIST_HEAD(list);
}
 
/* quickly clone stripe into flows_dump_private then it can be walked slowly
 * and lockless */
static void __nf_copy_stripe(struct flows_dump_private *st, const struct list_head *list)
{
	const struct ipt_netflow *nf;
	struct ipt_netflow *cf;
 
	nf_free_stripe(&st->list);
	list_for_each_entry(nf, list, flows_list) {
		cf = kmem_cache_alloc(ipt_netflow_cachep, GFP_ATOMIC);
		if (!cf) {
			st->alloc_errors++;
			continue;
		}
		memcpy(cf, nf, sizeof(*cf));
		list_add(&cf->flows_list, &st->list);
	}
}
 
/* nstripe is desired stripe, in st->stripe will be recorded actual stripe used
 * (with empty stripes skipped), -1 is there is no valid stripes anymore,
 * return first element in stripe list or NULL */
static struct list_head *nf_get_stripe(struct flows_dump_private *st, int nstripe)
{
	read_lock_bh(&htable_rwlock);
	for (; nstripe < LOCK_COUNT; nstripe++) {
		struct stripe_entry *stripe = &htable_stripes[nstripe];
 
		spin_lock(&stripe->lock);
		if (!list_empty(&stripe->list)) {
			st->stripe = nstripe;
			__nf_copy_stripe(st, &stripe->list);
			spin_unlock(&stripe->lock);
			read_unlock_bh(&htable_rwlock);
			return st->list.next;
		}
		spin_unlock(&stripe->lock);
	}
	read_unlock_bh(&htable_rwlock);
	st->stripe = -1;
	return NULL;
}
 
/* simply next element in flows list or NULL */
static struct list_head *nf_get_next(struct flows_dump_private *st, struct list_head *head)
{
	if (head == SEQ_START_TOKEN)
		return nf_get_stripe(st, 0);
	if (st->stripe < 0)
		return NULL;
	/* next element */
	if (!list_is_last(head, &st->list))
		return head->next;
	/* next bucket */
	return nf_get_stripe(st, st->stripe + 1);
}
 
/* seq_file could arbitrarily start/stop iteration as it feels need,
 * so, I try to cache things to (significantly) speed it up. */
static void *flows_dump_seq_start(struct seq_file *seq, loff_t *pos)
{
	struct flows_dump_private *st = seq->private;
	int ppos = *pos;
	struct list_head *lh;
 
	if (!ppos) {
		/* first */
		st->pcache = 0;
		st->vcache = SEQ_START_TOKEN;
		return st->vcache;
	}
	if (ppos >= st->pcache) {
		/* can iterate forward */
		ppos -= st->pcache;
		lh = st->vcache;
	} else /* can't, start from 0 */
		lh = SEQ_START_TOKEN;
	/* iterate forward */
	while (ppos--)
		lh = nf_get_next(st, lh);
	st->pcache = *pos;
	st->vcache = lh;
	return st->vcache;
}
 
static void *flows_dump_seq_next(struct seq_file *seq, void *v, loff_t *pos)
{
	struct flows_dump_private *st = seq->private;
 
	st->pcache = ++*pos;
	st->vcache = nf_get_next(st, (struct list_head *)v);
	return st->vcache;
}
 
static void flows_dump_seq_stop(struct seq_file *seq, void *v)
{
}
 
/* To view this: cat /sys/kernel/debug/netflow_dump */
static int flows_dump_seq_show(struct seq_file *seq, void *v)
{
	struct flows_dump_private *st = seq->private;
	const long i_timeout = inactive_timeout * HZ;
	const long a_timeout = active_timeout * HZ;
	const struct ipt_netflow *nf;
 
	if (v == SEQ_START_TOKEN) {
		seq_printf(seq, "# hash a dev:i,o"
#ifdef SNMP_RULES
		    " snmp:i,o"
#endif
#ifdef ENABLE_MAC
		    " mac:src,dst"
#endif
#ifdef ENABLE_VLAN
		    " vlan"
#endif
#if defined(ENABLE_MAC) || defined(ENABLE_VLAN)
		    " type"
#endif
		    " proto src:ip,port dst:ip,port nexthop"
		    " tos,tcpflags,options,tcpoptions"
		    " packets bytes ts:first,last\n");
		return 0;
	}
 
	nf = list_entry(v, struct ipt_netflow, flows_list);
	seq_printf(seq, "%d %04x %x",
	    st->pcache,
	    hash_netflow(&nf->tuple),
	    (!!inactive_needs_export(nf, i_timeout, jiffies)) | 
	    (active_needs_export(nf, a_timeout, jiffies) << 1));
	seq_printf(seq, " %hd,%hd",
	    nf->tuple.i_ifc,
	    nf->o_ifc);
#ifdef SNMP_RULES
	seq_printf(seq, " %hd,%hd",
	    nf->i_ifcr,
	    nf->o_ifcr);
#endif
#ifdef ENABLE_MAC
	seq_printf(seq, " %pM,%pM", &nf->tuple.h_src, &nf->tuple.h_dst);
#endif
#ifdef ENABLE_VLAN
	if (nf->tuple.tag[0]) {
		seq_printf(seq, " %d", ntohs(nf->tuple.tag[0]));
		if (nf->tuple.tag[1])
			seq_printf(seq, ",%d", ntohs(nf->tuple.tag[1]));
	}
#endif
#if defined(ENABLE_MAC) || defined(ENABLE_VLAN)
	seq_printf(seq, " %04x", ntohs(nf->ethernetType));
#endif
	seq_printf(seq, " %u ",
	    nf->tuple.protocol);
	if (nf->tuple.l3proto == AF_INET) {
		seq_printf(seq, "%pI4n,%u %pI4n,%u %pI4n",
		    &nf->tuple.src,
		    ntohs(nf->tuple.s_port),
		    &nf->tuple.dst,
		    ntohs(nf->tuple.d_port),
		    &nf->nh);
	} else if (nf->tuple.l3proto == AF_INET6) {
		seq_printf(seq, "%pI6c,%u %pI6c,%u %pI6c",
		    &nf->tuple.src,
		    ntohs(nf->tuple.s_port),
		    &nf->tuple.dst,
		    ntohs(nf->tuple.d_port),
		    &nf->nh);
	} else {
		seq_puts(seq, "?,? ?,? ?");
	}
	seq_printf(seq, " %x,%x,%x,%x",
	    nf->tuple.tos,
	    nf->tcp_flags,
	    nf->options,
	    nf->tcpoptions);
	seq_printf(seq, " %u %u %lu,%lu\n",
	    nf->nr_packets,
	    nf->nr_bytes,
	    jiffies - nf->nf_ts_first,
	    jiffies - nf->nf_ts_last);
 
	return 0;
}
 
static struct seq_operations flows_dump_seq_ops = {
	.start	= flows_dump_seq_start,
	.show	= flows_dump_seq_show,
	.next	= flows_dump_seq_next,
	.stop	= flows_dump_seq_stop,
};
 
static int flows_seq_open(struct inode *inode, struct file *file)
{
	struct flows_dump_private *st;
	char *buf;
	const size_t size = 4 * PAGE_SIZE;
 
	buf = kmalloc(size, GFP_KERNEL);
	if (!buf)
		return -ENOMEM;
 
	st = __seq_open_private(file, &flows_dump_seq_ops, sizeof(struct flows_dump_private));
	if (!st) {
		kfree(buf);
		return -ENOMEM;
	}
	INIT_LIST_HEAD(&st->list);
	/* speed up seq interface with bigger buffer */
	((struct seq_file *)file->private_data)->buf = buf;
	((struct seq_file *)file->private_data)->size = size;
	return 0;
 
}
static int flows_seq_release(struct inode *inode, struct file *file)
{
	struct seq_file *seq = file->private_data;
	struct flows_dump_private *st = seq->private;
 
	nf_free_stripe(&st->list);
	if (st->alloc_errors)
		printk(KERN_INFO "ipt_NETFLOW: alloc_errors %d\n", st->alloc_errors);
	return seq_release_private(inode, file);
}
 
static struct file_operations flows_seq_fops = {
	.owner	 = THIS_MODULE,
	.open	 = flows_seq_open,
	.read	 = seq_read,
	.llseek	 = seq_lseek,
	.release = flows_seq_release,
};
#endif /* CONFIG_PROC_FS */
 
#ifdef ENABLE_PROMISC
static int promisc_finish(
#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,4,0)
    struct net *net,
#endif
#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,1,0) || \
    (defined(RHEL_MAJOR) && RHEL_MAJOR == 7 && RHEL_MINOR >= 2)
    struct sock *sk,
#endif
    struct sk_buff *skb)
{
	/* don't pass to the routing */
	kfree_skb(skb);
	return NET_RX_DROP;
}
 
static int promisc4_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
{
	const struct iphdr *iph;
	u32 len;
 
	/* clone skb and do basic IPv4 sanity checking and preparations
	 * for L3, this is quick and dirty version of ip_rcv() */
	if (!pskb_may_pull(skb, sizeof(struct iphdr)))
		goto drop;
	iph = ip_hdr(skb);
	if (iph->ihl < 5 || iph->version != 4)
		goto drop;
	if (!pskb_may_pull(skb, iph->ihl*4))
		goto drop;
	iph = ip_hdr(skb);
	if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl)))
		goto drop;
	len = ntohs(iph->tot_len);
	if (skb->len < len)
		goto drop;
	else if (len < (iph->ihl*4))
		goto drop;
	if (pskb_trim_rcsum(skb, len))
		goto drop;
	skb->transport_header = skb->network_header + iph->ihl*4;
	memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
	skb_orphan(skb);
 
	return NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING,
#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,4,0)
	    dev_net(dev),
#endif
#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,1,0) || (defined(RHEL_MAJOR) && RHEL_MAJOR == 7 && RHEL_MINOR > 1)
	    NULL,
#endif
	    skb, dev, NULL, promisc_finish);
drop:
	NETFLOW_STAT_INC(pkt_promisc_drop);
	kfree_skb(skb);
	return NET_RX_DROP;
}
 
static int promisc6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
{
	const struct ipv6hdr *hdr;
	u32 pkt_len;
	struct inet6_dev *idev;
 
	/* quick and dirty version of ipv6_rcv(), basic sanity checking
	 * and preparation of skb for later processing */
	rcu_read_lock();
	idev = __in6_dev_get(skb->dev);
	if (!idev || unlikely(idev->cnf.disable_ipv6))
		goto drop;
	memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
	IP6CB(skb)->iif = skb_dst(skb) ? ip6_dst_idev(skb_dst(skb))->dev->ifindex : dev->ifindex;
	if (unlikely(!pskb_may_pull(skb, sizeof(*hdr))))
		goto drop;
	hdr = ipv6_hdr(skb);
	if (hdr->version != 6)
		goto drop;
	if (!(dev->flags & IFF_LOOPBACK) &&
	    ipv6_addr_loopback(&hdr->daddr))
		goto drop;
	if (!(skb->pkt_type == PACKET_LOOPBACK ||
		    dev->flags & IFF_LOOPBACK) &&
	    ipv6_addr_is_multicast(&hdr->daddr) &&
	    IPV6_ADDR_MC_SCOPE(&hdr->daddr) == 1)
		goto drop;
	if (ipv6_addr_is_multicast(&hdr->daddr) &&
	    IPV6_ADDR_MC_SCOPE(&hdr->daddr) == 0)
		goto drop;
	if (ipv6_addr_is_multicast(&hdr->saddr))
		goto drop;
	skb->transport_header = skb->network_header + sizeof(*hdr);
	IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr);
	pkt_len = ntohs(hdr->payload_len);
	if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
		if (pkt_len + sizeof(struct ipv6hdr) > skb->len)
			goto drop;
		if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
			goto drop;
		hdr = ipv6_hdr(skb);
	}
	if (hdr->nexthdr == NEXTHDR_HOP) {
		int optlen;
		/* ipv6_parse_hopopts() is not exported by kernel.
		 * I dont really need to parse hop options, since packets
		 * are not routed, nor terminated, but I keep calculations
		 * in case other code depend on it. */
		if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
		    !pskb_may_pull(skb, (sizeof(struct ipv6hdr) +
				    ((skb_transport_header(skb)[1] + 1) << 3))))
			goto drop;
		optlen = (skb_transport_header(skb)[1] + 1) << 3;
		if (skb_transport_offset(skb) + optlen > skb_headlen(skb))
			goto drop;
		skb->transport_header += optlen;
		IP6CB(skb)->nhoff = sizeof(struct ipv6hdr);
	}
	rcu_read_unlock();
	skb_orphan(skb);
 
	return NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING,
#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,4,0)
	    dev_net(dev),
#endif
#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,1,0) || (defined(RHEL_MAJOR) && RHEL_MAJOR == 7 && RHEL_MINOR > 1)
	    NULL,
#endif
	    skb, dev, NULL, promisc_finish);
drop:
	rcu_read_unlock();
	NETFLOW_STAT_INC(pkt_promisc_drop);
	kfree_skb(skb);
	return NET_RX_DROP;
}
 
/* source is skb_network_protocol() and __vlan_get_protocol() */
static __be16 __skb_network_protocol(struct sk_buff *skb, int *depth)
{
	__be16 type = skb->protocol;
	unsigned int vlan_depth;
 
	if (type == htons(ETH_P_TEB)) {
		struct ethhdr *eth;
 
		if (unlikely(!pskb_may_pull(skb, sizeof(struct ethhdr))))
			return 0;
 
		eth = (struct ethhdr *)skb_mac_header(skb);
		type = eth->h_proto;
	}
 
	vlan_depth = skb->mac_len;
	if (type == htons(ETH_P_8021Q) || type == htons(ETH_P_8021AD)) {
		if (vlan_depth) {
			if (WARN_ON(vlan_depth < VLAN_HLEN))
				return 0;
			vlan_depth -= VLAN_HLEN;
		} else {
			vlan_depth = ETH_HLEN;
		}
		do {
			struct vlan_hdr *vh;
 
			if (unlikely(!pskb_may_pull(skb, vlan_depth + VLAN_HLEN)))
				return 0;
 
			vh = (struct vlan_hdr *)(skb->data + vlan_depth);
			type = vh->h_vlan_encapsulated_proto;
			vlan_depth += VLAN_HLEN;
		} while (type == htons(ETH_P_8021Q) ||
			 type == htons(ETH_P_8021AD));
	}
 
	*depth = vlan_depth;
 
	return type;
}
 
static int promisc_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
{
	/* what is not PACKET_OTHERHOST will be processed normally */
	if (skb->pkt_type != PACKET_OTHERHOST)
		goto out;
 
	NETFLOW_STAT_INC(pkt_promisc);
 
	if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
		goto drop;
 
	/* Note about vlans:
	 * - older kernels will pass raw packet;
	 * - newer kernes (since 3.0) will have one vlan tag
	 * physically stripped out of the packet, and it will
	 * be saved into skb->vlan_tci. skb->protocol will be
	 * untagged etherType. */
 
	if (skb->protocol == cpu_to_be16(ETH_P_8021Q) ||
	    skb->protocol == cpu_to_be16(ETH_P_8021AD)) {
		int vlan_depth = skb->mac_len;
 
		skb_push(skb, skb->data - skb_mac_header(skb));
		skb->protocol = __skb_network_protocol(skb, &vlan_depth);
		skb_pull(skb, vlan_depth);
 
		skb_reset_network_header(skb);
		skb_reset_mac_len(skb);
	}
# ifdef PROMISC_MPLS
	if (eth_p_mpls(skb->protocol)) {
		size_t stack_len = 0;
		const struct mpls_label *mpls;
 
		do {
			stack_len += MPLS_HLEN;
			if (unlikely(!pskb_may_pull(skb, stack_len)))
				goto drop;
			mpls = (struct mpls_label *)(skb->data + stack_len - MPLS_HLEN);
		} while (!(mpls->entry & htonl(MPLS_LS_S_MASK)));
 
		skb_pull(skb, stack_len);
		skb_reset_network_header(skb);
 
		if (!pskb_may_pull(skb, 1))
			goto drop;
		switch (ip_hdr(skb)->version) {
		case 4:  skb->protocol = htons(ETH_P_IP);   break;
		case 6:  skb->protocol = htons(ETH_P_IPV6); break;
		default: goto drop;
		}
	}
# endif
	switch (skb->protocol) {
	case htons(ETH_P_IP):
		return promisc4_rcv(skb, dev, pt, orig_dev);
	case htons(ETH_P_IPV6):
		return promisc6_rcv(skb, dev, pt, orig_dev);
	}
drop:
	NETFLOW_STAT_INC(pkt_promisc_drop);
out:
	kfree_skb(skb);
	return 0;
}
 
static struct packet_type promisc_packet_type __read_mostly = {
	.type = htons(ETH_P_ALL),
	.func = promisc_rcv,
};
 
/* should not have promisc passed as parameter */
static int switch_promisc(int newpromisc)
{
	newpromisc = !!newpromisc;
	mutex_lock(&promisc_lock);
	if (newpromisc == promisc)
		goto unlock;
	if (newpromisc)
		dev_add_pack(&promisc_packet_type);
	else
		dev_remove_pack(&promisc_packet_type);
	printk(KERN_INFO "ipt_NETFLOW: promisc hack is %s\n",
	    newpromisc? "enabled" : "disabled");
	promisc = newpromisc;
unlock:
	mutex_unlock(&promisc_lock);
	return 0;
}
#endif
 
#ifdef CONFIG_SYSCTL
/* sysctl /proc/sys/net/netflow */
static int hsize_procctl(ctl_table *ctl, int write, BEFORE2632(struct file *filp,)
			 void __user *buffer, size_t *lenp, loff_t *fpos)
{
	int ret, hsize;
	ctl_table_no_const lctl = *ctl;
 
	if (write)
		lctl.data = &hsize;
	ret = proc_dointvec(&lctl, write, BEFORE2632(filp,) buffer, lenp, fpos);
	if (write) {
		if (hsize < LOCK_COUNT)
			return -EPERM;
		return set_hashsize(hsize)?:ret;
	} else
		return ret;
}
 
static int sndbuf_procctl(ctl_table *ctl, int write, BEFORE2632(struct file *filp,)
			 void __user *buffer, size_t *lenp, loff_t *fpos)
{
	int ret;
	struct ipt_netflow_sock *usock;
	ctl_table_no_const lctl = *ctl;
 
	mutex_lock(&sock_lock);
	if (list_empty(&usock_list)) {
		mutex_unlock(&sock_lock);
		return -ENOENT;
	}
	usock = list_first_entry(&usock_list, struct ipt_netflow_sock, list);
	if (usock->sock)
		sndbuf = usock->sock->sk->sk_sndbuf;
	mutex_unlock(&sock_lock);
 
	lctl.data = &sndbuf;
	ret = proc_dointvec(&lctl, write, BEFORE2632(filp,) buffer, lenp, fpos);
	if (!write)
		return ret;
	if (sndbuf < SOCK_MIN_SNDBUF)
		sndbuf = SOCK_MIN_SNDBUF;
	pause_scan_worker();
	mutex_lock(&sock_lock);
	list_for_each_entry(usock, &usock_list, list) {
		if (usock->sock)
			usock->sock->sk->sk_sndbuf = sndbuf;
	}
	mutex_unlock(&sock_lock);
	cont_scan_worker();
	return ret;
}
 
static void free_templates(void);
static int destination_procctl(ctl_table *ctl, int write, BEFORE2632(struct file *filp,)
			 void __user *buffer, size_t *lenp, loff_t *fpos)
{
	int ret;
 
	ret = proc_dostring(ctl, write, BEFORE2632(filp,) buffer, lenp, fpos);
	if (ret >= 0 && write) {
		pause_scan_worker();
		destination_removeall();
		add_destinations(destination_buf);
		free_templates();
		cont_scan_worker();
	}
	return ret;
}
 
#ifdef ENABLE_AGGR
static int aggregation_procctl(ctl_table *ctl, int write, BEFORE2632(struct file *filp,)
			 void __user *buffer, size_t *lenp, loff_t *fpos)
{
	int ret;
 
	if (debug > 1)
		printk(KERN_INFO "aggregation_procctl (%d) %u %llu\n", write, (unsigned int)(*lenp), *fpos);
	ret = proc_dostring(ctl, write, BEFORE2632(filp,) buffer, lenp, fpos);
	if (ret >= 0 && write)
		add_aggregation(aggregation_buf);
	return ret;
}
#endif
 
#ifdef ENABLE_PROMISC
static int promisc_procctl(ctl_table *ctl, int write, BEFORE2632(struct file *filp,)
			 void __user *buffer, size_t *lenp, loff_t *fpos)
{
	int newpromisc = promisc;
	int ret;
	ctl_table_no_const lctl = *ctl;
 
	lctl.data = &newpromisc;
	ret = proc_dointvec(&lctl, write, BEFORE2632(filp,) buffer, lenp, fpos);
	if (ret < 0 || !write)
		return ret;
	return switch_promisc(newpromisc);
}
#endif
 
#ifdef ENABLE_SAMPLER
static int parse_sampler(char *ptr);
static int sampler_procctl(ctl_table *ctl, int write, BEFORE2632(struct file *filp,)
			 void __user *buffer, size_t *lenp, loff_t *fpos)
{
	int ret;
 
	if (debug > 1)
		printk(KERN_INFO "sampler_procctl (%d) %u %llu\n", write, (unsigned int)(*lenp), *fpos);
	ret = proc_dostring(ctl, write, BEFORE2632(filp,) buffer, lenp, fpos);
	if (ret >= 0 && write) {
		int cpu;
 
		pause_scan_worker();
		netflow_scan_and_export(AND_FLUSH);
		/* paused for sampling_code reads to be consistent */
		ret = parse_sampler(sampler_buf);
		/* resend templates */
		ts_sampler_last = 0;
		/* zero stat */
		atomic64_set(&flows_observed, 0);
		atomic64_set(&flows_selected, 0);
		for_each_present_cpu(cpu) {
			struct ipt_netflow_stat *st = &per_cpu(ipt_netflow_stat, cpu);
			st->pkts_selected = 0;
			st->pkts_observed = 0;
		}
		cont_scan_worker();
	}
	return ret;
}
#endif
 
#ifdef SNMP_RULES
static int add_snmp_rules(char *ptr);
static int snmp_procctl(ctl_table *ctl, int write, BEFORE2632(struct file *filp,)
			 void __user *buffer, size_t *lenp, loff_t *fpos)
{
       int ret;
 
       if (debug > 1)
	       printk(KERN_INFO "snmp_procctl (%d) %u %llu\n", write, (unsigned int)(*lenp), *fpos);
       ret = proc_dostring(ctl, write, BEFORE2632(filp,) buffer, lenp, fpos);
       if (ret >= 0 && write)
               return add_snmp_rules(snmp_rules_buf);
       return ret;
}
#endif
 
static void clear_ipt_netflow_stat(void)
{
	int cpu;
 
	for_each_present_cpu(cpu) {
		struct ipt_netflow_stat *st = &per_cpu(ipt_netflow_stat, cpu);
		memset(st, 0, sizeof(*st));
		st->metric = METRIC_DFL;
	}
}
 
static int flush_procctl(ctl_table *ctl, int write, BEFORE2632(struct file *filp,)
			 void __user *buffer, size_t *lenp, loff_t *fpos)
{
	int ret;
	int val = 0;
	ctl_table_no_const lctl = *ctl;
 
	lctl.data = &val;
	ret = proc_dointvec(&lctl, write, BEFORE2632(filp,) buffer, lenp, fpos);
 
	if (!write)
		return ret;
 
	if (val > 0) {
		char *stat = "";
 
		pause_scan_worker();
		netflow_scan_and_export(AND_FLUSH);
		if (val > 1) {
			clear_ipt_netflow_stat();
			stat = " (reset stat counters)";
		}
		printk(KERN_INFO "ipt_NETFLOW: forced flush%s.\n", stat);
		cont_scan_worker();
	}
 
	return ret;
}
 
static int protocol_procctl(ctl_table *ctl, int write, BEFORE2632(struct file *filp,)
			 void __user *buffer, size_t *lenp, loff_t *fpos)
{
	int ret;
	int ver = protocol;
	ctl_table_no_const lctl = *ctl;
 
	lctl.data = &ver;
	ret = proc_dointvec(&lctl, write, BEFORE2632(filp,) buffer, lenp, fpos);
 
	if (!write)
		return ret;
 
	switch (ver) {
		case 5:
		case 9:
		case 10:
			printk(KERN_INFO "ipt_NETFLOW: forced flush (protocol version change)\n");
			pause_scan_worker();
			netflow_scan_and_export(AND_FLUSH);
			netflow_switch_version(ver);
			cont_scan_worker();
			break;
		default:
			return -EPERM;
	}
 
	return ret;
}
 
#ifdef CONFIG_NF_NAT_NEEDED
static void register_ct_events(void);
static void unregister_ct_events(void);
static int natevents_procctl(ctl_table *ctl, int write, BEFORE2632(struct file *filp,)
			 void __user *buffer, size_t *lenp, loff_t *fpos)
{
	int ret;
	int val = natevents;
	ctl_table_no_const lctl = *ctl;
 
	lctl.data = &val;
	ret = proc_dointvec(&lctl, write, BEFORE2632(filp,) buffer, lenp, fpos);
 
	if (!write)
		return ret;
 
	if (natevents && !val)
		unregister_ct_events();
	else if (!natevents && val)
		register_ct_events();
 
	return ret;
}
#endif
 
static struct ctl_table_header *netflow_sysctl_header;
 
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20)
#define _CTL_NAME(x) .ctl_name = x,
static void ctl_table_renumber(ctl_table *table)
{
	int c;
 
	for (c = 1; table->procname; table++, c++)
		table->ctl_name = c;
}
#else
#define _CTL_NAME(x)
#define ctl_table_renumber(x)
#endif
static ctl_table netflow_sysctl_table[] = {
	{
		.procname	= "active_timeout",
		.mode		= 0644,
		.data		= &active_timeout,
		.maxlen		= sizeof(int),
		.proc_handler	= &proc_dointvec,
	},
	{
		.procname	= "inactive_timeout",
		.mode		= 0644,
		.data		= &inactive_timeout,
		.maxlen		= sizeof(int),
		.proc_handler	= &proc_dointvec,
	},
	{
		.procname	= "debug",
		.mode		= 0644,
		.data		= &debug,
		.maxlen		= sizeof(int),
		.proc_handler	= &proc_dointvec,
	},
	{
		.procname	= "hashsize",
		.mode		= 0644,
		.data		= &htable_size,
		.maxlen		= sizeof(int),
		.proc_handler	= &hsize_procctl,
	},
	{
		.procname	= "sndbuf",
		.mode		= 0644,
		.maxlen		= sizeof(int),
		.proc_handler	= &sndbuf_procctl,
	},
	{
		.procname	= "destination",
		.mode		= 0644,
		.data		= &destination_buf,
		.maxlen		= sizeof(destination_buf),
		.proc_handler	= &destination_procctl,
	},
#ifdef ENABLE_AGGR
	{
		.procname	= "aggregation",
		.mode		= 0644,
		.data		= &aggregation_buf,
		.maxlen		= sizeof(aggregation_buf),
		.proc_handler	= &aggregation_procctl,
	},
#endif
	{
		.procname	= "maxflows",
		.mode		= 0644,
		.data		= &maxflows,
		.maxlen		= sizeof(int),
		.proc_handler	= &proc_dointvec,
	},
	{
		.procname	= "flush",
		.mode		= 0644,
		.maxlen		= sizeof(int),
		.proc_handler	= &flush_procctl,
	},
	{
		.procname	= "protocol",
		.mode		= 0644,
		.maxlen		= sizeof(int),
		.proc_handler	= &protocol_procctl,
	},
	{
		.procname	= "refresh-rate",
		.mode		= 0644,
		.data		= &refresh_rate,
		.maxlen		= sizeof(int),
		.proc_handler	= &proc_dointvec,
	},
	{
		.procname	= "timeout-rate",
		.mode		= 0644,
		.data		= &timeout_rate,
		.maxlen		= sizeof(int),
		.proc_handler	= &proc_dointvec,
	},
#ifdef ENABLE_PROMISC
	{
		.procname	= "promisc",
		.mode		= 0644,
		.data		= &promisc,
		.maxlen		= sizeof(int),
		.proc_handler	= &promisc_procctl,
	},
#endif
#ifdef ENABLE_SAMPLER
	{
		.procname	= "sampler",
		.mode		= 0644,
		.data		= &sampler_buf,
		.maxlen		= sizeof(sampler_buf),
		.proc_handler	= &sampler_procctl,
	},
#endif
	{
		.procname	= "scan-min",
		.mode		= 0644,
		.data		= &scan_min,
		.maxlen		= sizeof(int),
		.proc_handler	= &proc_dointvec_minmax,
		.extra1		= &one,
		.extra2		= &scan_max,
	},
#ifdef SNMP_RULES
	{
		.procname	= "snmp-rules",
		.mode		= 0644,
		.data		= &snmp_rules_buf,
		.maxlen		= sizeof(snmp_rules_buf),
		.proc_handler	= &snmp_procctl,
	},
#endif
#ifdef CONFIG_NF_NAT_NEEDED
	{
		.procname	= "natevents",
		.mode		= 0644,
		.maxlen		= sizeof(int),
		.proc_handler	= &natevents_procctl,
	},
#endif
	{ }
};
 
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,25)
static ctl_table netflow_sysctl_root[] = {
	{
		_CTL_NAME(33)
		.procname	= "netflow",
		.mode		= 0555,
		.child		= netflow_sysctl_table,
	},
	{ }
};
 
static ctl_table netflow_net_table[] = {
	{
		.ctl_name	= CTL_NET,
		.procname	= "net",
		.mode		= 0555,
		.child		= netflow_sysctl_root,
	},
	{ }
};
#else /* >= 2.6.25 */
static struct ctl_path netflow_sysctl_path[] = {
	{
		.procname = "net",
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,33)
		.ctl_name = CTL_NET
#endif
	},
	{ .procname = "netflow" },
	{ }
};
#endif /* 2.6.25 */
#endif /* CONFIG_SYSCTL */
 
/* socket code */
static void sk_error_report(struct sock *sk)
{
	struct ipt_netflow_sock *usock;
 
	/* clear connection refused errors if any */
	if (debug > 1)
		printk(KERN_INFO "ipt_NETFLOW: socket error <%d>\n", sk->sk_err);
	sk->sk_err = 0;
	usock = sk->sk_user_data;
	if (usock)
		usock->err_cberr++;
	NETFLOW_STAT_INC(sock_cberr);
	/* It's theoretically possible to determine to which datagram this reply is,
	 * because ICMP message frequently includes header of erroneous packet, but
	 * this is not that reliable - packets could be spoofed, and requires keeping
	 * book of sent packets. */
	return;
}
 
static struct socket *usock_open_sock(struct ipt_netflow_sock *usock)
{
	struct socket *sock;
	int error;
	int salen = 0;
 
	if ((error = sock_create_kern(usock->addr.ss_family, SOCK_DGRAM, IPPROTO_UDP, &sock)) < 0) {
		printk(KERN_ERR "ipt_NETFLOW: sock_create_kern error %d\n", -error);
		return NULL;
	}
	sock->sk->sk_allocation = GFP_ATOMIC;
	sock->sk->sk_prot->unhash(sock->sk); /* hidden from input */
	sock->sk->sk_error_report = &sk_error_report; /* clear ECONNREFUSED */
	sock->sk->sk_user_data = usock;
	sock->sk->sk_reuse = SK_CAN_REUSE;
 
	if (usock->sdev[0]) {
		struct net_device *dev = dev_get_by_name(&init_net, usock->sdev);
 
		if (dev) {
			sock->sk->sk_bound_dev_if = dev->ifindex;
			dev_put(dev);
		} else {
			printk(KERN_ERR "ipt_NETFLOW: error binding to device %s, errno %d\n",
			    usock->sdev, -error);
			return NULL;
		}
	}
	if (!is_zero_addr(&usock->saddr)) {
		if (usock->saddr.ss_family == AF_INET)
			salen = sizeof(struct sockaddr_in);
		else if (usock->saddr.ss_family == AF_INET6)
			salen = sizeof(struct sockaddr_in6);
		if ((error = sock->ops->bind(sock, (struct sockaddr *)&usock->saddr, salen)) < 0) {
			printk(KERN_ERR "ipt_NETFLOW: error binding socket %d\n", -error);
			return NULL;
		}
	}
 
	if (sndbuf)
		sock->sk->sk_sndbuf = sndbuf;
	else
		sndbuf = sock->sk->sk_sndbuf;
	error = sock->ops->connect(sock, (struct sockaddr *)&usock->addr, sizeof(usock->addr), 0);
	if (error < 0) {
		printk(KERN_ERR "ipt_NETFLOW: error connecting UDP socket %d,"
		    " don't worry, will try reconnect later.\n", -error);
		/* ENETUNREACH when no interfaces */
		sock_release(sock);
		return NULL;
	}
	return sock;
}
 
static void usock_connect(struct ipt_netflow_sock *usock, const int sendmsg)
{
	usock->sock = usock_open_sock(usock);
	if (usock->sock) {
		if (sendmsg || debug)
			printk(KERN_INFO "ipt_NETFLOW: connected %s\n",
			    print_sockaddr(&usock->addr));
	} else {
		usock->err_connect++;
		if (debug)
			printk(KERN_INFO "ipt_NETFLOW: connect to %s failed%s.\n",
			    print_sockaddr(&usock->addr),
			    (sendmsg)? " (pdu lost)" : "");
	}
	atomic_set(&usock->wmem_peak, 0);
	usock->err_full = 0;
	usock->err_other = 0;
}
 
static void usock_close(struct ipt_netflow_sock *usock)
{
	if (usock->sock)
		sock_release(usock->sock);
	usock->sock = NULL;
}
 
ktime_t ktime_get_real(void);
 
// return numbers of sends succeded, 0 if none
/* only called in scan worker path */
static void netflow_sendmsg(void *buffer, const int len)
{
	struct msghdr msg = { .msg_flags = MSG_DONTWAIT|MSG_NOSIGNAL };
	struct kvec iov = { buffer, len };
	int retok = 0, ret;
	int snum = 0;
	struct ipt_netflow_sock *usock;
 
	mutex_lock(&sock_lock);
	list_for_each_entry(usock, &usock_list, list) {
		usock->pkt_exp++;
		usock->bytes_exp += len;
		if (!usock->sock)
			usock_connect(usock, 1);
		if (!usock->sock) {
			NETFLOW_STAT_INC(send_failed);
			usock->pkt_fail++;
			continue;
		}
		if (debug)
			printk(KERN_INFO "netflow_sendmsg: sendmsg(%d, %d) [%u %u]\n",
			       snum,
			       len,
			       compat_refcount_read(&usock->sock->sk->sk_wmem_alloc),
			       usock->sock->sk->sk_sndbuf);
		ret = kernel_sendmsg(usock->sock, &msg, &iov, 1, (size_t)len);
		if (ret < 0) {
			char *suggestion = "";
 
			NETFLOW_STAT_INC(send_failed);
			usock->pkt_fail++;
			if (ret == -EAGAIN) {
				usock->err_full++;
				suggestion = ": increase sndbuf!";
			} else {
				usock->err_other++;
				if (ret == -ENETUNREACH) {
					suggestion = ": network is unreachable.";
				} else if (ret == -EINVAL) {
					usock_close(usock);
					suggestion = ": will reconnect.";
				}
			}
			printk(KERN_ERR "ipt_NETFLOW: sendmsg[%d] error %d: data loss %llu pkt, %llu bytes%s\n",
			       snum, ret, pdu_packets, pdu_traf, suggestion);
		} else {
			unsigned int wmem = compat_refcount_read(&usock->sock->sk->sk_wmem_alloc);
			if (wmem > atomic_read(&usock->wmem_peak))
				atomic_set(&usock->wmem_peak, wmem);
			NETFLOW_STAT_INC(exported_pkt);
			NETFLOW_STAT_ADD(exported_traf, ret);
			usock->pkt_sent++;
			retok++;
		}
		snum++;
	}
	mutex_unlock(&sock_lock);
	if (retok == 0) {
		/* not least one send succeded, account stat for dropped packets */
		NETFLOW_STAT_ADD(pkt_lost, pdu_packets);
		NETFLOW_STAT_ADD(traf_lost, pdu_traf);
		NETFLOW_STAT_ADD(flow_lost, pdu_flow_records);
		NETFLOW_STAT_TS(lost);
	} else {
		NETFLOW_STAT_ADD(exported_flow, pdu_flow_records);
	}
}
 
static void usock_close_free(struct ipt_netflow_sock *usock)
{
	printk(KERN_INFO "ipt_NETFLOW: removed destination %s\n",
	       print_sockaddr(&usock->addr));
	usock_close(usock);
	vfree(usock);
}
 
static void destination_removeall(void)
{
	mutex_lock(&sock_lock);
	while (!list_empty(&usock_list)) {
		struct ipt_netflow_sock *usock;
 
		usock = list_entry(usock_list.next, struct ipt_netflow_sock, list);
		list_del(&usock->list);
		mutex_unlock(&sock_lock);
		usock_close_free(usock);
		mutex_lock(&sock_lock);
	}
	mutex_unlock(&sock_lock);
}
 
static void add_usock(struct ipt_netflow_sock *usock)
{
	struct ipt_netflow_sock *sk;
 
	mutex_lock(&sock_lock);
	/* don't need duplicated sockets */
	list_for_each_entry(sk, &usock_list, list) {
		if (sockaddr_cmp(&sk->addr, &usock->addr)) {
			mutex_unlock(&sock_lock);
			usock_close_free(usock);
			return;
		}
	}
	list_add_tail(&usock->list, &usock_list);
	printk(KERN_INFO "ipt_NETFLOW: added destination %s%s\n",
	       print_usock_addr(usock),
	       (!usock->sock)? " (unconnected)" : "");
	mutex_unlock(&sock_lock);
}
 
#if defined(ENABLE_SAMPLER) || defined(SNMP_RULES)
static inline int xisdigit(int ch)
{
	return (ch >= '0') && (ch <= '9');
}
 
static inline int simple_atoi(const char *p)
{
	int i;
 
	for (i = 0; xisdigit(*p); p++)
		i = i * 10 + *p - '0';
	return i;
}
#endif
 
#ifdef ENABLE_SAMPLER
static void set_sampler(const unsigned char mode, const unsigned short interval)
{
	struct sampling s;
 
	s.mode = mode;
	s.interval = interval;
	if (!mode || interval > SAMPLER_INTERVAL_M) {
		*sampler_buf = 0;
		samp.v32 = s.v32;
		printk(KERN_ERR "ipt_NETFLOW: flow sampling is disabled.\n");
	} else {
		sampling_ts.first = ktime_get_real();
		/* no race here, becasue exporting process is stopped */
		samp.v32 = s.v32;
		sprintf(sampler_buf, "%s:%u", sampler_mode_string(), interval);
		printk(KERN_ERR "ipt_NETFLOW: flow sampling is enabled, mode %s one-out-of %u.\n",
		    sampler_mode_string(), interval);
	}
}
 
static int parse_sampler(char *ptr)
{
	char *p;
	unsigned char mode;
	unsigned int val;
	int ret = 0;
 
	switch (tolower(*ptr)) {
	case 'd': mode = SAMPLER_DETERMINISTIC; break;
	case 'r': mode = SAMPLER_RANDOM; break;
#ifdef SAMPLING_HASH
	case 'h': mode = SAMPLER_HASH; break;
#endif
	default:
		printk(KERN_ERR "ipt_NETFLOW: sampler parse error (%s '%s').\n",
		    "unknown mode", ptr);
		ret = -EINVAL;
		/* FALLTHROUGH */
	case '\0': /* empty */
	case 'n':  /* none */
	case 'o':  /* off */
	case '0':  /* zero */
		  set_sampler(0, 0);
		  return ret;
	}
	p = strchr(ptr, ':');
	if (!p) {
		printk(KERN_ERR "ipt_NETFLOW: sampler parse error (%s '%s').\n",
		    "no interval specified", ptr);
		set_sampler(0, 0);
		return -EINVAL;
	}
	val = simple_atoi(++p);
	if (val < 2 || val > SAMPLER_INTERVAL_M) {
		printk(KERN_ERR "ipt_NETFLOW: sampler parse error (%s '%s').\n",
		    "illegal interval", p);
		set_sampler(0, 0);
		return -EINVAL;
	}
	set_sampler(mode, val);
	return 0;
}
#endif
 
#ifdef SNMP_RULES
/* source string: eth:100,ppp:200,vlan:300 */
/* reformat to: length[1], prefix[len], offset[2], ..., null[1]. */
static int parse_snmp_rules(char *ptr, unsigned char *dst)
{
	int osize = 0;
 
	while (*ptr) {
		char *prefix = ptr;
		unsigned int number;
		int len, lsize;
		char *p;
 
		p = strchr(ptr, ':');
		if (!p)
			return -EINVAL;
		len = p - ptr;
		if (len == 0)
			return -EINVAL;
		ptr += len;
		if (sscanf(ptr, ":%d%n", &number, &lsize) < 1)
			return -EINVAL;
		ptr += lsize;
		if (*ptr) /* any separator will work */
			ptr++;
		osize += 1 + len + 2;
		if (dst) {
			*dst++ = len;
			memcpy(dst, prefix, len);
			dst += len;
			*dst++ = (number >> 8) & 0xff;
			*dst++ = number & 0xff;
		}
	}
	osize += 1;
	if (dst)
		*dst = '\0';
	return osize;
}
 
static int add_snmp_rules(char *ptr)
{
	int osize = parse_snmp_rules(ptr, NULL);
	char *dst;
	char *old;
 
	if (osize <= 0) {
		printk(KERN_ERR "ipt_NETFLOW: add_snmp_rules parse error.\n");
		strcpy(snmp_rules_buf, "parse error");
		return -EINVAL;
	}
	dst = kmalloc(osize, GFP_KERNEL);
	if (!dst) {
		strcpy(snmp_rules_buf, "no memory");
		printk(KERN_ERR "ipt_NETFLOW: add_snmp_rules no memory.\n");
		return -ENOMEM;
	}
	parse_snmp_rules(ptr, dst);
	spin_lock(&snmp_lock);
	old = snmp_ruleset;
	rcu_assign_pointer(snmp_ruleset, dst);
	spin_unlock(&snmp_lock);
	synchronize_rcu();
	if (old)
		kfree(old);
	return 0;
}
 
static inline int resolve_snmp(const struct net_device *ifc)
{
	const unsigned char *rules;
 
	if (!ifc)
		return -1;
	rules = rcu_dereference(snmp_ruleset);
	if (!rules)
		return ifc->ifindex;
	while (*rules) {
		const unsigned int len = *rules++;
		const char *ifname = ifc->name;
 
		if (!strncmp(ifname, rules, len)) {
			rules += len;
			return (rules[0] << 8) + rules[1] +
				simple_atoi(ifname + len);
		}
		rules += len + 2;
	}
	return ifc->ifindex;
}
#endif /* SNMP_RULES */
 
/* count how much character c is in the string */
static size_t strncount(const char *s, size_t count, int c)
{
	size_t amount = 0;
 
	for (; count-- && *s != '\0'; ++s)
		if (*s == (char)c)
			++amount;
	return amount;
}
 
#define SEPARATORS " ,;\t\n"
static int add_destinations(const char *ptr)
{
	int len;
 
	for (; ptr; ptr += len) {
		struct sockaddr_storage ss;
		struct sockaddr_storage sbind = {};
		struct ipt_netflow_sock *usock;
		const char *end;
		int succ = 0;
		char name[IFNAMSIZ] = { 0 };
 
		/* skip initial separators */
		ptr += strspn(ptr, SEPARATORS);
 
		len = strcspn(ptr, SEPARATORS);
		if (!len)
			break;
		memset(&ss, 0, sizeof(ss));
 
		if (strncount(ptr, len, ':') >= 2) {
			struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&ss;
			struct sockaddr_in6 *sout = (struct sockaddr_in6 *)&sbind;
			const char *c = ptr;
			int clen = len;
 
			sin6->sin6_family = AF_INET6;
			sin6->sin6_port = htons(2055);
			if (*c == '[') {
				++c;
				--clen;
			}
			succ = in6_pton(c, clen, (u8 *)&sin6->sin6_addr, -1, &end);
			if (succ && *ptr == '[' && *end == ']')
				++end;
			if (succ &&
			    (*end == ':' || *end == '.' || *end == 'p' || *end == '#'))
				sin6->sin6_port = htons(simple_strtoul(++end, (char **)&end, 0));
			if (succ && *end == '@') {
				++end;
				sout->sin6_family = AF_INET6;
				sout->sin6_port   = 0;
				succ = in6_pton(end, strcspn(end, SEPARATORS), (u8 *)&sout->sin6_addr, -1, &end);
			}
		} else {
			struct sockaddr_in *sin  = (struct sockaddr_in *)&ss;
			struct sockaddr_in *sout = (struct sockaddr_in *)&sbind;
 
			sin->sin_family = AF_INET;
			sin->sin_port = htons(2055);
			succ = in4_pton(ptr, len, (u8 *)&sin->sin_addr, -1, &end);
			if (succ && *end == ':')
				sin->sin_port = htons(simple_strtoul(++end, (char **)&end, 0));
			if (succ && *end == '@') {
				++end;
				sout->sin_family = AF_INET;
				sout->sin_port   = 0;
				succ = in4_pton(end, strcspn(end, SEPARATORS), (u8 *)&sout->sin_addr, -1, &end);
			}
		}
		if (succ && *end == '%') {
			++end;
			snprintf(name, sizeof(name), "%.*s", (int)strcspn(end, SEPARATORS), end);
		}
		if (!succ) {
			printk(KERN_ERR "ipt_NETFLOW: can't parse destination: %.*s\n",
			    len, ptr);
			continue;
		}
 
		if (!(usock = vmalloc(sizeof(*usock)))) {
			printk(KERN_ERR "ipt_NETFLOW: can't vmalloc socket\n");
			return -ENOMEM;
		}
		memset(usock, 0, sizeof(*usock));
		usock->addr  = ss;
		usock->saddr = sbind;
		memcpy(usock->sdev, name, sizeof(usock->sdev));
		usock_connect(usock, 0);
		add_usock(usock);
	}
	return 0;
}
 
#ifdef ENABLE_AGGR
static void aggregation_remove(struct list_head *list)
{
	write_lock_bh(&aggr_lock);
	while (!list_empty(list)) {
		struct netflow_aggr_n *aggr; /* match netflow_aggr_p too */
 
		aggr = list_entry(list->next, struct netflow_aggr_n, list);
		list_del(&aggr->list);
		write_unlock_bh(&aggr_lock);
		vfree(aggr);
		write_lock_bh(&aggr_lock);
	}
	write_unlock_bh(&aggr_lock);
}
 
static int add_aggregation(char *ptr)
{
	struct netflow_aggr_n *aggr_n, *aggr, *tmp;
	struct netflow_aggr_p *aggr_p;
	LIST_HEAD(new_aggr_n_list);
	LIST_HEAD(new_aggr_p_list);
	LIST_HEAD(old_aggr_list);
 
	while (ptr && *ptr) {
		unsigned char ip[4];
		unsigned int mask;
		unsigned int port1, port2;
		unsigned int aggr_to;
 
		ptr += strspn(ptr, SEPARATORS);
 
		if (sscanf(ptr, "%hhu.%hhu.%hhu.%hhu/%u=%u",
			   ip, ip + 1, ip + 2, ip + 3, &mask, &aggr_to) == 6) {
 
			if (!(aggr_n = vmalloc(sizeof(*aggr_n)))) {
				printk(KERN_ERR "ipt_NETFLOW: can't vmalloc aggr\n");
				return -ENOMEM;
			}
			memset(aggr_n, 0, sizeof(*aggr_n));
 
			aggr_n->mask = bits2mask(mask);
			aggr_n->addr = ntohl(*(__be32 *)ip) & aggr_n->mask;
			aggr_n->aggr_mask = bits2mask(aggr_to);
			aggr_n->prefix = mask;
			printk(KERN_INFO "ipt_NETFLOW: add aggregation [%u.%u.%u.%u/%u=%u]\n",
			       HIPQUAD(aggr_n->addr), mask, aggr_to);
			list_add_tail(&aggr_n->list, &new_aggr_n_list);
 
		} else if (sscanf(ptr, "%u-%u=%u", &port1, &port2, &aggr_to) == 3 ||
			   sscanf(ptr, "%u=%u", &port2, &aggr_to) == 2) {
 
			if (!(aggr_p = vmalloc(sizeof(*aggr_p)))) {
				printk(KERN_ERR "ipt_NETFLOW: can't vmalloc aggr\n");
				return -ENOMEM;
			}
			memset(aggr_p, 0, sizeof(*aggr_p));
 
			aggr_p->port1 = port1;
			aggr_p->port2 = port2;
			aggr_p->aggr_port = aggr_to;
			printk(KERN_INFO "ipt_NETFLOW: add aggregation [%u-%u=%u]\n",
			       port1, port2, aggr_to);
			list_add_tail(&aggr_p->list, &new_aggr_p_list);
		} else {
			printk(KERN_ERR "ipt_NETFLOW: bad aggregation rule: %s (ignoring)\n", ptr);
			break;
		}
 
		ptr = strpbrk(ptr, SEPARATORS);
	}
 
	/* swap lists */
	write_lock_bh(&aggr_lock);
	list_for_each_entry_safe(aggr, tmp, &aggr_n_list, list)
		list_move(&aggr->list, &old_aggr_list);
	list_for_each_entry_safe(aggr, tmp, &aggr_p_list, list)
		list_move(&aggr->list, &old_aggr_list);
 
	list_for_each_entry_safe(aggr, tmp, &new_aggr_n_list, list)
		list_move_tail(&aggr->list, &aggr_n_list);
	list_for_each_entry_safe(aggr, tmp, &new_aggr_p_list, list)
		list_move_tail(&aggr->list, &aggr_p_list);
	write_unlock_bh(&aggr_lock);
	aggregation_remove(&old_aggr_list);
	return 0;
}
#endif
 
#ifdef SAMPLING_HASH
static uint32_t hash_seed;
#define HASH_SEED hash_seed
#else
#define HASH_SEED 0
#endif
static inline u_int32_t __hash_netflow(const struct ipt_netflow_tuple *tuple)
{
	return murmur3(tuple, sizeof(struct ipt_netflow_tuple), HASH_SEED);
}
 
static inline u_int32_t hash_netflow(const struct ipt_netflow_tuple *tuple)
{
	return __hash_netflow(tuple) % htable_size;
}
 
static struct ipt_netflow *
ipt_netflow_find(const struct ipt_netflow_tuple *tuple, const unsigned int hash)
{
	struct ipt_netflow *nf;
#if LINUX_VERSION_CODE < KERNEL_VERSION(3,9,0)
	struct hlist_node *pos;
#endif
 
	compat_hlist_for_each_entry(nf, pos, &htable[hash], hlist) {
		if (ipt_netflow_tuple_equal(tuple, &nf->tuple) &&
		    nf->nr_bytes < FLOW_FULL_WATERMARK) {
			NETFLOW_STAT_INC(found);
			return nf;
		}
		NETFLOW_STAT_INC(searched);
	}
	NETFLOW_STAT_INC(notfound);
	return NULL;
}
 
static struct hlist_head *alloc_hashtable(const int size)
{
	struct hlist_head *hash;
 
	hash = vmalloc(sizeof(struct hlist_head) * size);
	if (hash) {
		int i;
 
		for (i = 0; i < size; i++)
			INIT_HLIST_HEAD(&hash[i]);
	} else
		printk(KERN_ERR "ipt_NETFLOW: unable to vmalloc hash table.\n");
 
	return hash;
}
 
static int set_hashsize(int new_size)
{
	struct hlist_head *new_hash, *old_hash;
	struct ipt_netflow *nf, *tmp;
	LIST_HEAD(all_list);
	int i;
 
	if (new_size < LOCK_COUNT)
		new_size = LOCK_COUNT;
	printk(KERN_INFO "ipt_NETFLOW: allocating new hash table %u -> %u buckets\n",
	       htable_size, new_size);
	new_hash = alloc_hashtable(new_size);
	if (!new_hash)
		return -ENOMEM;
 
	/* rehash */
	write_lock_bh(&htable_rwlock);
	old_hash = htable;
	htable = new_hash;
	htable_size = new_size;
	for (i = 0; i < LOCK_COUNT; i++) {
		struct stripe_entry *stripe = &htable_stripes[i];
		spin_lock(&stripe->lock);
		list_splice_init(&stripe->list, &all_list);
		spin_unlock(&stripe->lock);
	}
	list_for_each_entry_safe(nf, tmp, &all_list, flows_list) {
		unsigned int hash;
		struct stripe_entry *stripe;
 
		hash = hash_netflow(&nf->tuple);
		stripe = &htable_stripes[hash & LOCK_COUNT_MASK];
		spin_lock(&stripe->lock);
		list_move_tail(&nf->flows_list, &stripe->list);
		hlist_add_head(&nf->hlist, &htable[hash]);
		spin_unlock(&stripe->lock);
	}
	write_unlock_bh(&htable_rwlock);
	vfree(old_hash);
 
	return 0;
}
 
static struct ipt_netflow *
ipt_netflow_alloc(const struct ipt_netflow_tuple *tuple)
{
	struct ipt_netflow *nf;
	long count;
 
	nf = kmem_cache_alloc(ipt_netflow_cachep, GFP_ATOMIC);
	if (!nf) {
		printk(KERN_ERR "ipt_NETFLOW: Can't allocate flow.\n");
		return NULL;
	}
 
	memset(nf, 0, sizeof(*nf));
	nf->tuple = *tuple;
 
	count = atomic_inc_return(&ipt_netflow_count);
	if (count > peakflows) {
		peakflows = count;
		peakflows_at = jiffies;
	}
 
	return nf;
}
 
static void ipt_netflow_free(struct ipt_netflow *nf)
{
	if (IS_DUMMY_FLOW(nf))
		return;
	atomic_dec(&ipt_netflow_count);
	kmem_cache_free(ipt_netflow_cachep, nf);
}
 
/* cook pdu, send, and clean */
/* only called in scan worker path */
static void netflow_export_pdu_v5(void)
{
	struct timeval tv;
	int pdusize;
 
	if (!pdu_data_records)
		return;
 
	if (debug > 1)
		printk(KERN_INFO "netflow_export_pdu_v5 with %d records\n", pdu_data_records);
 
	pdu.v5.version		= htons(5);
	pdu.v5.nr_records	= htons(pdu_data_records);
	pdu.v5.ts_uptime	= htonl(jiffies_to_msecs(jiffies));
	do_gettimeofday(&tv);
	pdu.v5.ts_usecs		= htonl(tv.tv_sec);
	pdu.v5.ts_unsecs	= htonl(tv.tv_usec);
	pdu.v5.seq		= htonl(pdu_seq);
	//pdu.v5.eng_type	= 0;
	pdu.v5.eng_id		= (__u8)engine_id;
#ifdef ENABLE_SAMPLER
	pdu.v5.sampling		= htons(sampler_nf_v5());
#endif
	pdusize = NETFLOW5_HEADER_SIZE + sizeof(struct netflow5_record) * pdu_data_records;
 
	netflow_sendmsg(&pdu.v5, pdusize);
 
	pdu_packets = 0;
	pdu_traf    = 0;
 
	pdu_seq += pdu_data_records;
	pdu_count++;
	pdu_flow_records = pdu_data_records = 0;
}
 
/* only called in scan worker path */
static void netflow_export_flow_v5(struct ipt_netflow *nf)
{
	struct netflow5_record *rec;
 
	if (unlikely(debug > 2))
		printk(KERN_INFO "adding flow to export (%d)\n", pdu_data_records);
 
	pdu_packets += nf->nr_packets;
	pdu_traf += nf->nr_bytes;
	pdu_ts_mod = jiffies;
	rec = &pdu.v5.flow[pdu_data_records++];
	pdu_flow_records++;
 
	/* make V5 flow record */
	rec->s_addr	= nf->tuple.src.ip;
	rec->d_addr	= nf->tuple.dst.ip;
	rec->nexthop	= nf->nh.ip;
#ifdef SNMP_RULES
	rec->i_ifc	= htons(nf->i_ifcr);
	rec->o_ifc	= htons(nf->o_ifcr);
#else
	rec->i_ifc	= htons(nf->tuple.i_ifc);
	rec->o_ifc	= htons(nf->o_ifc);
#endif
	rec->nr_packets = htonl(nf->nr_packets);
	rec->nr_octets	= htonl(nf->nr_bytes);
	rec->first_ms	= htonl(jiffies_to_msecs(nf->nf_ts_first));
	rec->last_ms	= htonl(jiffies_to_msecs(nf->nf_ts_last));
	rec->s_port	= nf->tuple.s_port;
	rec->d_port	= nf->tuple.d_port;
	//rec->reserved	= 0; /* pdu is always zeroized for v5 in netflow_switch_version */
	rec->tcp_flags	= nf->tcp_flags;
	rec->protocol	= nf->tuple.protocol;
	rec->tos	= nf->tuple.tos;
#ifdef CONFIG_NF_NAT_NEEDED
	rec->s_as	= nf->s_as;
	rec->d_as	= nf->d_as;
#endif
	rec->s_mask	= nf->s_mask;
	rec->d_mask	= nf->d_mask;
	//rec->padding	= 0;
	ipt_netflow_free(nf);
 
	if (pdu_data_records == NETFLOW5_RECORDS_MAX)
		netflow_export_pdu_v5();
}
 
/* pdu is initially blank, export current pdu, and prepare next for filling. */
static void netflow_export_pdu_v9(void)
{
	struct timeval tv;
	int pdusize;
 
	if (pdu_data_used <= pdu.v9.data)
		return;
 
	if (debug > 1)
		printk(KERN_INFO "netflow_export_pdu_v9 with %d records\n",
		    pdu_data_records + pdu_tpl_records);
 
	pdu.v9.version		= htons(9);
	pdu.v9.nr_records	= htons(pdu_data_records + pdu_tpl_records);
	pdu.v9.sys_uptime_ms	= htonl(jiffies_to_msecs(jiffies));
	do_gettimeofday(&tv);
	pdu.v9.export_time_s	= htonl(tv.tv_sec);
	pdu.v9.seq		= htonl(pdu_seq);
	pdu.v9.source_id	= htonl(engine_id);
 
	pdusize = pdu_data_used - (unsigned char *)&pdu.v9;
 
	netflow_sendmsg(&pdu.v9, pdusize);
 
	pdu_packets = 0;
	pdu_traf    = 0;
 
	pdu_seq++;
	pdu_count++;
	pdu_flow_records = pdu_data_records = pdu_tpl_records = 0;
	pdu_data_used = pdu.v9.data;
	pdu_flowset = NULL;
}
 
static void netflow_export_pdu_ipfix(void)
{
	struct timeval tv;
	int pdusize;
 
	if (pdu_data_used <= pdu.ipfix.data)
		return;
 
	if (debug > 1)
		printk(KERN_INFO "netflow_export_pduX with %d records\n",
		    pdu_data_records);
 
	pdu.ipfix.version	= htons(10);
	do_gettimeofday(&tv);
	pdu.ipfix.export_time_s	= htonl(tv.tv_sec);
	pdu.ipfix.seq		= htonl(pdu_seq);
	pdu.ipfix.odomain_id	= htonl(engine_id);
	pdusize = pdu_data_used - (unsigned char *)&pdu;
	pdu.ipfix.length	= htons(pdusize);
 
	netflow_sendmsg(&pdu.ipfix, pdusize);
 
	pdu_packets = 0;
	pdu_traf    = 0;
 
	pdu_seq += pdu_data_records;
	pdu_count++;
	pdu_flow_records = pdu_data_records = pdu_tpl_records = 0;
	pdu_data_used = pdu.ipfix.data;
	pdu_flowset = NULL;
}
 
static inline int pdu_have_space(const size_t size)
{
	return ((pdu_data_used + size) <= pdu_high_wm);
}
 
static inline unsigned char *pdu_grab_space(const size_t size)
{
	unsigned char *ptr = pdu_data_used;
	pdu_data_used += size;
	return ptr;
}
 
static inline void pdu_rewind_space(const size_t size)
{
	pdu_data_used -= size;
}
 
/* allocate data space in pdu, or export (reallocate) and fail. */
static inline unsigned char *pdu_alloc_fail_export(const size_t size)
{
	if (unlikely(!pdu_have_space(size))) {
		netflow_export_pdu();
		return NULL;
	}
	return pdu_grab_space(size);
}
 
/* doesn't fail, but can provide empty pdu. */
static unsigned char *pdu_alloc_export(const size_t size)
{
	return pdu_alloc_fail_export(size) ?: pdu_grab_space(size);
}
 
/* global table of sizes of template field types */
#define two(id, a, b, len)	[id] = len,
#define one(id, a, len)		[id] = len,
static u_int8_t tpl_element_sizes[] = {
	Elements
};
#undef two
#undef one
 
#define TEMPLATES_HASH_BSIZE	8
#define TEMPLATES_HASH_SIZE	(1<<TEMPLATES_HASH_BSIZE)
static struct hlist_head templates_hash[TEMPLATES_HASH_SIZE];
 
struct base_template {
	int length; /* number of elements in template */
	u_int16_t types[]; /* {type, size} pairs */
};
 
/* Data Templates */
#define BTPL_BASE9	0x00000001	/* netflow base stat */
#define BTPL_BASEIPFIX	0x00000002	/* ipfix base stat */
#define BTPL_IP4	0x00000004	/* IPv4 */
#define BTPL_MASK4	0x00000008	/* Aggregated */
#define BTPL_PORTS	0x00000010	/* UDP&TCP */
#define BTPL_IP6	0x00000020	/* IPv6 */
#define BTPL_ICMP9	0x00000040	/* ICMP (for V9) */
#define BTPL_ICMPX4	0x00000080	/* ICMP IPv4 (for IPFIX) */
#define BTPL_ICMPX6	0x00000100	/* ICMP IPv6 (for IPFIX) */
#define BTPL_IGMP	0x00000200	/* IGMP */
#define BTPL_IPSEC	0x00000400	/* AH&ESP */
#define BTPL_NAT4	0x00000800	/* NAT IPv4 */
#define BTPL_LABEL6	0x00001000	/* IPv6 flow label */
#define BTPL_IP4OPTIONS	0x00002000	/* IPv4 Options */
#define BTPL_IP6OPTIONS	0x00004000	/* IPv6 Options */
#define BTPL_TCPOPTIONS	0x00008000	/* TCP Options */
#define BTPL_MAC	0x00010000	/* MAC addresses */
#define BTPL_VLAN9	0x00020000	/* outer VLAN for v9 */
#define BTPL_VLANX	0x00040000	/* outer VLAN for IPFIX */
#define BTPL_VLANI	0x00080000	/* inner VLAN (IPFIX) */
#define BTPL_ETHERTYPE	0x00100000	/* ethernetType */
#define BTPL_DIRECTION	0x00200000	/* flowDirection */
#define BTPL_SAMPLERID	0x00400000	/* samplerId (v9) */
#define BTPL_SELECTORID	0x00800000	/* selectorId (IPFIX) */
#define BTPL_MPLS	0x01000000	/* MPLS stack */
#define BTPL_OPTION	0x80000000	/* Options Template */
#define BTPL_MAX	32
/* Options Templates */
#define OTPL(x) (BTPL_OPTION | x)
#define OTPL_SYSITIME	OTPL(1)		/* systemInitTimeMilliseconds */
#define OTPL_MPSTAT	OTPL(2)		/* The Metering Process Statistics (rfc5101) */
#define OTPL_MPRSTAT	OTPL(3)		/* The Metering Process Reliability Statistics */
#define OTPL_EPRSTAT	OTPL(4)		/* The Exporting Process Reliability Statistics */
#define OTPL_SAMPLER	OTPL(5)		/* Flow Sampler for v9 */
#define OTPL_SEL_RAND	OTPL(6)		/* Random Flow Selector for IPFIX */
#define OTPL_SEL_COUNT	OTPL(7)		/* Systematic count-based Flow Selector for IPFIX */
#define OTPL_SEL_STAT	OTPL(8)		/* rfc7014 */
#define OTPL_SEL_STATH	OTPL(9)		/* OTPL_SEL_STAT, except selectorIDTotalFlowsObserved */
#define OTPL_IFNAMES	OTPL(10)
 
static struct base_template template_base_9 = {
	.types = {
		INPUT_SNMP,
		OUTPUT_SNMP,
#ifdef ENABLE_PHYSDEV
		ingressPhysicalInterface,
		egressPhysicalInterface,
#endif
		IN_PKTS,
		IN_BYTES,
		FIRST_SWITCHED,
		LAST_SWITCHED,
		PROTOCOL,
		TOS,
		0
	}
};
static struct base_template template_base_ipfix = {
	.types = {
		ingressInterface,
		egressInterface,
#ifdef ENABLE_PHYSDEV
		ingressPhysicalInterface,
		egressPhysicalInterface,
#endif
		packetDeltaCount,
		octetDeltaCount,
		flowStartMilliseconds,
		flowEndMilliseconds,
		protocolIdentifier,
		ipClassOfService,
		flowEndReason,
		0
	}
};
#ifdef ENABLE_MAC
static struct base_template template_mac_ipfix = {
	.types = {
		destinationMacAddress,
		sourceMacAddress,
		0
	}
};
#endif
#if defined(ENABLE_MAC) || defined(ENABLE_VLAN)
static struct base_template template_ethertype = {
	.types = { ethernetType, 0 }
};
#endif
#ifdef ENABLE_VLAN
static struct base_template template_vlan_v9 = {
	.types = { SRC_VLAN, 0 }
};
/* IPFIX is different from v9, see rfc7133. */
static struct base_template template_vlan_ipfix = {
	.types = {
		dot1qVlanId,
		dot1qPriority,
		0
	}
};
static struct base_template template_vlan_inner = {
	.types = {
		dot1qCustomerVlanId,
		dot1qCustomerPriority,
		0
	}
};
#endif
#ifdef MPLS_DEPTH
static struct base_template template_mpls = {
	.types = {
		mplsTopLabelTTL,
		/* do not just add element here, becasue this array
		 * is truncated in ipt_netflow_init() */
#define MPLS_LABELS_BASE_INDEX 1
		MPLS_LABEL_1,
		MPLS_LABEL_2,
		MPLS_LABEL_3,
		MPLS_LABEL_4,
		MPLS_LABEL_5,
		MPLS_LABEL_6,
		MPLS_LABEL_7,
		MPLS_LABEL_8,
		MPLS_LABEL_9,
		MPLS_LABEL_10,
		0
	}
};
#endif
#ifdef ENABLE_DIRECTION
static struct base_template template_direction = {
	.types = { DIRECTION, 0 }
};
#endif
static struct base_template template_ipv4 = {
	.types = {
		IPV4_SRC_ADDR,
		IPV4_DST_ADDR,
		IPV4_NEXT_HOP,
		0
	}
};
static struct base_template template_options4 = {
	.types = { ipv4Options, 0 }
};
static struct base_template template_tcpoptions = {
	.types = { tcpOptions, 0 }
};
static struct base_template template_ipv6 = {
	.types = {
		IPV6_SRC_ADDR,
		IPV6_DST_ADDR,
		IPV6_NEXT_HOP,
		0
	}
};
static struct base_template template_options6 = {
	.types = { IPV6_OPTION_HEADERS, 0 }
};
static struct base_template template_label6 = {
	.types = { IPV6_FLOW_LABEL, 0 }
};
static struct base_template template_ipv4_mask = {
	.types = {
		SRC_MASK,
		DST_MASK,
		0
	}
};
static struct base_template template_ports = {
	.types = {
		L4_SRC_PORT,
		L4_DST_PORT,
		TCP_FLAGS,
		0
	}
};
static struct base_template template_icmp_v9 = {
	.types = {
		L4_SRC_PORT,	/* dummy (required by some collector(s) to
				   recognize ICMP flows) */
		L4_DST_PORT,	/* actually used in V9 world instead of
				   ICMP_TYPE(32), disregarding docs */
		0
	}
};
static struct base_template template_icmp_ipv4 = {
	.types = { icmpTypeCodeIPv4, 0 }
};
static struct base_template template_icmp_ipv6 = {
	.types = { icmpTypeCodeIPv6, 0 }
};
static struct base_template template_igmp = {
	.types = { MUL_IGMP_TYPE, 0 }
};
static struct base_template template_ipsec = {
	.types = { IPSecSPI, 0 }
};
static struct base_template template_nat4 = {
	.types = {
		observationTimeMilliseconds,
		IPV4_SRC_ADDR,
		IPV4_DST_ADDR,
		postNATSourceIPv4Address,
		postNATDestinationIPv4Address,
		L4_SRC_PORT,
		L4_DST_PORT,
		postNAPTSourceTransportPort,
		postNAPTDestinationTransportPort,
		PROTOCOL,
		natEvent,
		0
	}
};
 
static struct base_template template_sys_init_time = {
	.types = {
		observationDomainId,
 
		/* ipfix does not report sys_uptime_ms like v9 does,
		 * so this could be useful to detect system restart
		 * (rfc5102), and conversion of flow times to absolute
		 * time (rfc5153 4.7) */
		systemInitTimeMilliseconds,
 
		/* this will let collector detect module version and
		 * recompilation (by srcversion) */
		observationDomainName,
 
		/* useful to detect module reload */
		flowStartMilliseconds,
		flowEndMilliseconds,
		0
	}
};
 
/* http://tools.ietf.org/html/rfc5101#section-4 */
/* The Metering Process Statistics Option Template */
static struct base_template template_meter_stat = {
	.types = {
		observationDomainId,
		exportedMessageTotalCount,
		exportedFlowRecordTotalCount,
		exportedOctetTotalCount,
		observedFlowTotalCount,
		0
	}
};
/* The Metering Process Reliability Statistics Option Template */
static struct base_template template_meter_rel_stat = {
	.types = {
		observationDomainId,
		ignoredPacketTotalCount,
		ignoredOctetTotalCount,
		flowStartMilliseconds, /* sampling start time */
		flowEndMilliseconds,
		0
	}
};
/* The Exporting Process Reliability Statistics Option Template */
static struct base_template template_exp_rel_stat = {
	.types = {
		exportingProcessId,
		notSentFlowTotalCount,
		notSentPacketTotalCount,
		notSentOctetTotalCount,
		flowStartMilliseconds, /* sampling start time */
		flowEndMilliseconds,
		0
	}
};
 
#ifdef ENABLE_SAMPLER
static struct base_template template_samplerid = {
	.types = { FLOW_SAMPLER_ID, 0 }
};
static struct base_template template_selectorid = {
	.types = { selectorId, 0 }
};
 
/* sampler for v9 */
static struct base_template template_sampler = {
	.types = {
		observationDomainId,
		FLOW_SAMPLER_ID,
		FLOW_SAMPLER_MODE,
		FLOW_SAMPLER_RANDOM_INTERVAL,
		0
	}
};
/* sampler for ipfix */
static struct base_template template_selector_systematic = {
	.types = {
		observationDomainId,
		selectorId,
		flowSelectorAlgorithm,
		samplingFlowInterval,
		samplingFlowSpacing,
		0
	}
};
static struct base_template template_selector_random = {
	.types = {
		observationDomainId,
		selectorId,
		flowSelectorAlgorithm,
		samplingSize,
		samplingPopulation,
		0
	}
};
static struct base_template template_selector_stat = {
	.types = {
		selectorId,
		selectorIDTotalFlowsObserved,
		selectorIDTotalFlowsSelected,
		selectorIdTotalPktsObserved,
		selectorIdTotalPktsSelected,
		flowStartMilliseconds,
		flowEndMilliseconds,
		0
	}
};
/* can't calc selectorIDTotalFlowsObserved for hash sampling,
 * because dropped flows are not accounted */
static struct base_template template_selector_stat_hash = {
	.types = {
		selectorId,
		selectorIDTotalFlowsSelected,
		selectorIdTotalPktsObserved,
		selectorIdTotalPktsSelected,
		flowStartMilliseconds,
		flowEndMilliseconds,
		0
	}
};
#endif
 
static struct base_template template_interfaces = {
	.types = {
		observationDomainId,
		INPUT_SNMP,
		IF_NAME,
		IF_DESC,
		0
	}
};
 
struct data_template {
	struct hlist_node hlist;
	unsigned int tpl_key;
 
	char options;	/* is it Options Template */
	short length;	/* number of elements in template */
	short tpl_size;	/* whole size of template itself (with header), for alloc */
	short rec_size;	/* size of one template record (w/o header) */
	int template_id_n; /* uassigned from template_ids, network order. */
	int		exported_cnt;
	unsigned long	exported_ts; /* last exported (jiffies) */
	u_int16_t fields[]; /* {type, size} pairs */
} __attribute__ ((packed));
 
#define TPL_FIELD_NSIZE 4 /* one complete template field's network size */
 
static void free_templates(void)
{
	int i;
#if LINUX_VERSION_CODE < KERNEL_VERSION(3,9,0)
	struct hlist_node *pos;
#endif
	struct hlist_node *tmp;
 
	for (i = 0; i < TEMPLATES_HASH_SIZE; i++) {
		struct hlist_head *thead = &templates_hash[i];
		struct data_template *tpl;
 
		compat_hlist_for_each_entry_safe(tpl, pos, tmp, thead, hlist)
			kfree(tpl);
		INIT_HLIST_HEAD(thead);
	}
	tpl_count = 0;
 
	/* reinitialize template timeouts */
	ts_sysinf_last = ts_stat_last = 0;
#ifdef ENABLE_SAMPLER
	ts_sampler_last = 0;
#endif
}
 
/* find old, or create new combined template from template key (tmask) */
static struct data_template *get_template(const unsigned int tmask)
{
	struct base_template *tlist[BTPL_MAX];
	struct data_template *tpl;
	int tnum;
	int length;
	int i, j, k;
#if LINUX_VERSION_CODE < KERNEL_VERSION(3,9,0)
	struct hlist_node *pos;
#endif
	int hash = hash_long(tmask, TEMPLATES_HASH_BSIZE);
 
	compat_hlist_for_each_entry(tpl, pos, &templates_hash[hash], hlist)
		if (tpl->tpl_key == tmask)
			return tpl;
 
	tnum = 0;
	/* assemble array of base_templates from template key */
	/* NB: this should not have exporting protocol dependent checks */
	if (tmask & BTPL_OPTION) {
		switch (tmask) {
		case OTPL_SYSITIME:
			tlist[tnum++] = &template_sys_init_time;
			break;
		case OTPL_MPSTAT:
			tlist[tnum++] = &template_meter_stat;
			break;
		case OTPL_MPRSTAT:
			tlist[tnum++] = &template_meter_rel_stat;
			break;
		case OTPL_EPRSTAT:
			tlist[tnum++] = &template_exp_rel_stat;
			break;
#ifdef ENABLE_SAMPLER
		case OTPL_SAMPLER:
			tlist[tnum++] = &template_sampler;
			break;
		case OTPL_SEL_RAND:
			tlist[tnum++] = &template_selector_random;
			break;
		case OTPL_SEL_COUNT:
			tlist[tnum++] = &template_selector_systematic;
			break;
		case OTPL_SEL_STAT:
			tlist[tnum++] = &template_selector_stat;
			break;
		case OTPL_SEL_STATH:
			tlist[tnum++] = &template_selector_stat_hash;
			break;
#endif
		case OTPL_IFNAMES:
			tlist[tnum++] = &template_interfaces;
			break;
		}
	} else {
		if (tmask & BTPL_IP4) {
			tlist[tnum++] = &template_ipv4;
			if (tmask & BTPL_IP4OPTIONS)
				tlist[tnum++] = &template_options4;
			if (tmask & BTPL_MASK4)
				tlist[tnum++] = &template_ipv4_mask;
			if (tmask & BTPL_ICMPX4)
				tlist[tnum++] = &template_icmp_ipv4;
		} else if (tmask & BTPL_IP6) {
			tlist[tnum++] = &template_ipv6;
			if (tmask & BTPL_LABEL6)
				tlist[tnum++] = &template_label6;
			if (tmask & BTPL_IP6OPTIONS)
				tlist[tnum++] = &template_options6;
			if (tmask & BTPL_ICMPX6)
				tlist[tnum++] = &template_icmp_ipv6;
		} else if (tmask & BTPL_NAT4)
			tlist[tnum++] = &template_nat4;
		if (tmask & BTPL_PORTS)
			tlist[tnum++] = &template_ports;
		else if (tmask & BTPL_ICMP9)
			tlist[tnum++] = &template_icmp_v9;
		if (tmask & BTPL_BASE9)
			tlist[tnum++] = &template_base_9;
		else if (tmask & BTPL_BASEIPFIX)
			tlist[tnum++] = &template_base_ipfix;
		if (tmask & BTPL_TCPOPTIONS)
			tlist[tnum++] = &template_tcpoptions;
		if (tmask & BTPL_IGMP)
			tlist[tnum++] = &template_igmp;
		if (tmask & BTPL_IPSEC)
			tlist[tnum++] = &template_ipsec;
#ifdef ENABLE_MAC
		if (tmask & BTPL_MAC)
			tlist[tnum++] = &template_mac_ipfix;
#endif
#ifdef ENABLE_VLAN
		if (tmask & BTPL_VLAN9)
			tlist[tnum++] = &template_vlan_v9;
		else {
			if (tmask & BTPL_VLANX)
				tlist[tnum++] = &template_vlan_ipfix;
			if (tmask & BTPL_VLANI)
				tlist[tnum++] = &template_vlan_inner;
		}
#endif
#if defined(ENABLE_MAC) || defined(ENABLE_VLAN)
		if (tmask & BTPL_ETHERTYPE)
			tlist[tnum++] = &template_ethertype;
#endif
#ifdef MPLS_DEPTH
		if (tmask & BTPL_MPLS)
			tlist[tnum++] = &template_mpls;
#endif
#ifdef ENABLE_DIRECTION
		if (tmask & BTPL_DIRECTION)
			tlist[tnum++] = &template_direction;
#endif
#ifdef ENABLE_SAMPLER
		if (tmask & BTPL_SAMPLERID)
			tlist[tnum++] = &template_samplerid;
		else if (tmask & BTPL_SELECTORID)
			tlist[tnum++] = &template_selectorid;
#endif
	} /* !BTPL_OPTION */
 
	/* calculate resulting template length
	 * and update base_template array lengths  */
	length = 0;
	for (i = 0; i < tnum; i++) {
		if (!tlist[i]->length) {
			for (k = 0; tlist[i]->types[k]; k++);
			tlist[i]->length = k;
		}
		length += tlist[i]->length;
	}
	/* elements are [type, len] pairs + one termiantor */
	tpl = kmalloc(sizeof(struct data_template) + (length * 2 + 1) * sizeof(u_int16_t), GFP_KERNEL);
	if (!tpl) {
		printk(KERN_ERR "ipt_NETFLOW: unable to kmalloc template (%#x).\n", tmask);
		return NULL;
	}
	tpl->tpl_key = tmask;
	tpl->options = (tmask & BTPL_OPTION) != 0;
	if (tpl->options)
		tpl->tpl_size = sizeof(struct flowset_opt_tpl_v9); /* ipfix is of the same size */
	else
		tpl->tpl_size = sizeof(struct flowset_template);
	tpl->length = length;
	tpl->rec_size = 0;
	tpl->template_id_n = htons(template_ids++);
	tpl->exported_cnt = 0;
	tpl->exported_ts = 0;
 
	/* construct resulting data_template and fill lengths */
	j = 0;
	for (i = 0; i < tnum; i++) {
		struct base_template *btpl = tlist[i];
 
		for (k = 0; k < btpl->length; k++) {
			int size;
			int type = btpl->types[k];
 
			tpl->fields[j++] = type;
			size = tpl_element_sizes[type];
			tpl->fields[j++] = size;
			tpl->rec_size += size;
		}
		tpl->tpl_size += btpl->length * TPL_FIELD_NSIZE;
	}
	tpl->fields[j++] = 0;
 
	hlist_add_head(&tpl->hlist, &templates_hash[hash]);
	tpl_count++;
 
	return tpl;
}
 
static u_int16_t scope_ipfix_to_v9(const u_int16_t elem)
{
	switch (elem) {
	case observationDomainId:
	case meteringProcessId:
	case exportingProcessId:
		return V9_SCOPE_SYSTEM;
	case ingressInterface:
	case portId:
		return V9_SCOPE_INTERFACE;
	case observationPointId:
	case LineCardId:
		return V9_SCOPE_LINECARD;
	case TemplateId:
		return V9_SCOPE_TEMPLATE;
	default:
		return -1;
	}
}
 
/* add template of any type and version */
static void pdu_add_template(struct data_template *tpl)
{
	__u8 *ptr;
	struct flowset_template *ntpl;
	__be16 *sptr, *fields;
	size_t added_size = 0;
 
	/* for options template we also make sure there is enough
	 * room in the packet for one record, with flowset header */
	if (tpl->options)
		added_size = sizeof(struct flowset_data) + tpl->rec_size;
	ptr = pdu_alloc_export(tpl->tpl_size + added_size);
	pdu_rewind_space(added_size);
	ntpl = (void *)ptr;
 
	/* first three fields are equal for all types of templates */
	if (tpl->options)
		ntpl->flowset_id = protocol == 9? htons(FLOWSET_OPTIONS) : htons(IPFIX_OPTIONS);
	else
		ntpl->flowset_id = protocol == 9? htons(FLOWSET_TEMPLATE) : htons(IPFIX_TEMPLATE);
	ntpl->length	  = htons(tpl->tpl_size);
	ntpl->template_id = tpl->template_id_n;
 
	if (tpl->options) {
		/* option templates should be defined with first element being scope */
		if (protocol == 9) {
			struct flowset_opt_tpl_v9 *otpl = (void *)ptr;
 
			otpl->scope_len   = htons(TPL_FIELD_NSIZE);
			otpl->opt_len     = htons((tpl->length - 1) * TPL_FIELD_NSIZE);
			ptr += sizeof(struct flowset_opt_tpl_v9);
		} else {
			struct flowset_opt_tpl_ipfix *otpl = (void *)ptr;
 
			otpl->field_count = htons(tpl->length);
			otpl->scope_count = htons(1);
			ptr += sizeof(struct flowset_opt_tpl_ipfix);
		}
	} else {
		ntpl->field_count = htons(tpl->length);
		ptr += sizeof(struct flowset_template);
	}
 
	sptr = (__be16 *)ptr;
	fields = tpl->fields;
	if (tpl->options && protocol == 9) {
		/* v9 scope */
		*sptr++ = htons(scope_ipfix_to_v9(*fields++));
		*sptr++ = htons(*fields++);
	}
	for (;;) {
		const int type = *fields++;
		if (!type)
			break;
		*sptr++ = htons(type);
		*sptr++ = htons(*fields++);
	}
 
	tpl->exported_cnt = pdu_count;
	tpl->exported_ts = jiffies;
 
	pdu_flowset = NULL;
	pdu_tpl_records++;
}
 
#ifdef ENABLE_DIRECTION
static inline __u8 hook2dir(const __u8 hooknum)
{
	switch (hooknum) {
	case NF_INET_PRE_ROUTING:
	case NF_INET_LOCAL_IN:
		return 0;
	case NF_INET_LOCAL_OUT:
	case NF_INET_POST_ROUTING:
		return 1;
	default:
		return -1;
	}
}
#endif
 
static inline void put_unaligned_be24(u32 val, unsigned char *p)
{
	*p++ = val >> 16;
	put_unaligned_be16(val, p);
}
 
static struct {
	s64		ms;	 /* this much abs milliseconds */
	unsigned long	jiffies; /* is that much jiffies */
} jiffies_base;
 
/* prepare for jiffies_to_ms_abs() batch */
static void set_jiffies_base(void)
{
	ktime_t ktime;
 
	/* try to get them atomically */
	local_bh_disable();
	jiffies_base.jiffies = jiffies;
	ktime = ktime_get_real();
	local_bh_enable();
 
	jiffies_base.ms = ktime_to_ms(ktime);
}
 
/* convert jiffies to ktime and rebase to unix epoch */
static inline s64 jiffies_to_ms_abs(unsigned long j)
{
	long jdiff = jiffies_base.jiffies - j;
 
	if (likely(jdiff >= 0))
		return jiffies_base.ms - (s64)jiffies_to_msecs(jdiff);
	else
		return jiffies_base.ms + (s64)jiffies_to_msecs(-jdiff);
}
 
typedef struct in6_addr in6_t;
/* encode one field (data records only) */
static inline void add_tpl_field(__u8 *ptr, const int type, const struct ipt_netflow *nf)
{
	switch (type) {
	case IN_BYTES:	     put_unaligned_be32(nf->nr_bytes, ptr); break;
	case IN_PKTS:	     put_unaligned_be32(nf->nr_packets, ptr); break;
	case FIRST_SWITCHED: put_unaligned_be32(jiffies_to_msecs(nf->nf_ts_first), ptr); break;
	case LAST_SWITCHED:  put_unaligned_be32(jiffies_to_msecs(nf->nf_ts_last), ptr); break;
	case flowStartMilliseconds: put_unaligned_be64(jiffies_to_ms_abs(nf->nf_ts_first), ptr); break;
	case flowEndMilliseconds:   put_unaligned_be64(jiffies_to_ms_abs(nf->nf_ts_last), ptr); break;
	case IPV4_SRC_ADDR:  put_unaligned(nf->tuple.src.ip, (__be32 *)ptr); break;
	case IPV4_DST_ADDR:  put_unaligned(nf->tuple.dst.ip, (__be32 *)ptr); break;
	case IPV4_NEXT_HOP:  put_unaligned(nf->nh.ip, (__be32 *)ptr); break;
	case L4_SRC_PORT:    put_unaligned(nf->tuple.s_port, (__be16 *)ptr); break;
	case L4_DST_PORT:    put_unaligned(nf->tuple.d_port, (__be16 *)ptr); break;
#ifdef SNMP_RULES
	case INPUT_SNMP:     put_unaligned_be16(nf->i_ifcr, ptr); break;
	case OUTPUT_SNMP:    put_unaligned_be16(nf->o_ifcr, ptr); break;
#else
	case INPUT_SNMP:     put_unaligned_be16(nf->tuple.i_ifc, ptr); break;
	case OUTPUT_SNMP:    put_unaligned_be16(nf->o_ifc, ptr); break;
#endif
#ifdef ENABLE_PHYSDEV
	case ingressPhysicalInterface:
			     put_unaligned_be16(nf->i_ifphys, ptr); break;
	case egressPhysicalInterface:
			     put_unaligned_be16(nf->o_ifphys, ptr); break;
#endif
#ifdef ENABLE_VLAN
#define EXTRACT_VLAN_PRIO(tag) ((ntohs(tag) & VLAN_PRIO_MASK) >> VLAN_PRIO_SHIFT)
	case SRC_VLAN:
	case dot1qVlanId:    put_unaligned(nf->tuple.tag[0] & htons(VLAN_VID_MASK), (__be16 *)ptr); break;
	case dot1qPriority:            *ptr = EXTRACT_VLAN_PRIO(nf->tuple.tag[0]); break;
	case dot1qCustomerVlanId:
			     put_unaligned(nf->tuple.tag[1] & htons(VLAN_VID_MASK), (__be16 *)ptr); break;
	case dot1qCustomerPriority:    *ptr = EXTRACT_VLAN_PRIO(nf->tuple.tag[1]); break;
#endif
#if defined(ENABLE_MAC) || defined(ENABLE_VLAN)
	case ethernetType:   put_unaligned(nf->ethernetType, (__be16 *)ptr); break;
#endif
#ifdef ENABLE_MAC
	case destinationMacAddress: memcpy(ptr, &nf->tuple.h_dst, ETH_ALEN); break;
	case sourceMacAddress:	    memcpy(ptr, &nf->tuple.h_src, ETH_ALEN); break;
#endif
#ifdef MPLS_DEPTH
# if __GNUC_PREREQ(4,6)
#  pragma GCC diagnostic push
#  pragma GCC diagnostic ignored "-Warray-bounds"
# endif
	case MPLS_LABEL_1:    memcpy(ptr, &nf->tuple.mpls[0], 3); break;
	case MPLS_LABEL_2:    memcpy(ptr, &nf->tuple.mpls[1], 3); break;
	case MPLS_LABEL_3:    memcpy(ptr, &nf->tuple.mpls[2], 3); break;
# if MPLS_DEPTH > 3
	case MPLS_LABEL_4:    memcpy(ptr, &nf->tuple.mpls[3], 3); break;
	case MPLS_LABEL_5:    memcpy(ptr, &nf->tuple.mpls[4], 3); break;
	case MPLS_LABEL_6:    memcpy(ptr, &nf->tuple.mpls[5], 3); break;
	case MPLS_LABEL_7:    memcpy(ptr, &nf->tuple.mpls[6], 3); break;
	case MPLS_LABEL_8:    memcpy(ptr, &nf->tuple.mpls[7], 3); break;
	case MPLS_LABEL_9:    memcpy(ptr, &nf->tuple.mpls[8], 3); break;
	case MPLS_LABEL_10:   memcpy(ptr, &nf->tuple.mpls[9], 3); break;
# endif
# if __GNUC_PREREQ(4,6)
#  pragma GCC diagnostic pop
# endif
	case mplsTopLabelTTL: *ptr = ntohl(nf->tuple.mpls[0]); break;
#endif
#ifdef ENABLE_DIRECTION
	case DIRECTION:		       *ptr = hook2dir(nf->hooknumx - 1); break;
#endif
	case PROTOCOL:	               *ptr = nf->tuple.protocol; break;
	case TCP_FLAGS:	               *ptr = nf->tcp_flags; break;
	case TOS:	               *ptr = nf->tuple.tos; break;
	case IPV6_SRC_ADDR:   *(in6_t *)ptr = nf->tuple.src.in6; break;
	case IPV6_DST_ADDR:   *(in6_t *)ptr = nf->tuple.dst.in6; break;
	case IPV6_NEXT_HOP:   *(in6_t *)ptr = nf->nh.in6; break;
	case IPV6_FLOW_LABEL: put_unaligned_be24(nf->flow_label, ptr); break;
	case tcpOptions:      put_unaligned_be32(nf->tcpoptions, ptr); break;
	case ipv4Options:     put_unaligned_be32(nf->options, ptr); break;
	case IPV6_OPTION_HEADERS:
			      put_unaligned_be16(nf->options, ptr); break;
	case SRC_MASK:	               *ptr = nf->s_mask; break;
	case DST_MASK:	               *ptr = nf->d_mask; break;
	case icmpTypeCodeIPv4:	/*FALLTHROUGH*/
	case icmpTypeCodeIPv6:	put_unaligned(nf->tuple.d_port, (__be16 *)ptr); break;
	case MUL_IGMP_TYPE:            *ptr = nf->tuple.d_port; break;
	case flowEndReason: 	       *ptr = nf->flowEndReason; break;
#ifdef CONFIG_NF_NAT_NEEDED
	case postNATSourceIPv4Address:	       put_unaligned(nf->nat->post.s_addr, (__be32 *)ptr); break;
	case postNATDestinationIPv4Address:    put_unaligned(nf->nat->post.d_addr, (__be32 *)ptr); break;
	case postNAPTSourceTransportPort:      put_unaligned(nf->nat->post.s_port, (__be16 *)ptr); break;
	case postNAPTDestinationTransportPort: put_unaligned(nf->nat->post.d_port, (__be16 *)ptr); break;
	case natEvent:		       *ptr = nf->nat->nat_event; break;
#endif
	case IPSecSPI:       put_unaligned(EXTRACT_SPI(nf->tuple), (__be32 *)ptr); break;
	case observationTimeMilliseconds:
			     put_unaligned_be64(ktime_to_ms(nf->nf_ts_obs), ptr); break;
	case observationTimeMicroseconds:
			     put_unaligned_be64(ktime_to_us(nf->nf_ts_obs), ptr); break;
	case observationTimeNanoseconds:
			     put_unaligned_be64(ktime_to_ns(nf->nf_ts_obs), ptr); break;
#ifdef ENABLE_SAMPLER
	case FLOW_SAMPLER_ID:
	case selectorId:
			     *ptr = get_sampler_mode(); break;
#endif
	default:
			     WARN_ONCE(1, "NETFLOW: Unknown Element id %d\n", type);
			     memset(ptr, 0, tpl_element_sizes[type]);
	}
}
 
#define PAD_SIZE 4 /* rfc prescribes flowsets to be padded */
 
/* cache timeout_rate in jiffies */
static inline unsigned long timeout_rate_j(void)
{
	static unsigned int t_rate = 0;
	static unsigned long t_rate_j = 0;
 
	if (unlikely(timeout_rate != t_rate)) {
		struct timeval tv = { .tv_sec = timeout_rate * 60, .tv_usec = 0 };
 
		t_rate = timeout_rate;
		t_rate_j = timeval_to_jiffies(&tv);
	}
	return t_rate_j;
}
 
/* return buffer where to write records data */
static unsigned char *alloc_record_tpl(struct data_template *tpl)
{
	unsigned char *ptr;
 
	/* If previous write was to the same template and there is room, then we just add new record,
	 * otherwise we (re)allocate flowset (and/or whole pdu). */
	if (!pdu_flowset ||
	    pdu_flowset->flowset_id != tpl->template_id_n ||
	    !(ptr = pdu_alloc_fail_export(tpl->rec_size))) {
 
		/* if there was previous data template we should pad it to 4 bytes */
		if (pdu_flowset) {
			int padding = (PAD_SIZE - ntohs(pdu_flowset->length) % PAD_SIZE) % PAD_SIZE;
			if (padding && (ptr = pdu_alloc_fail_export(padding))) {
				pdu_flowset->length = htons(ntohs(pdu_flowset->length) + padding);
				for (; padding; padding--)
					*ptr++ = 0;
			}
		}
 
		/* export template if needed */
		if (!tpl->exported_ts ||
		    pdu_count > (tpl->exported_cnt + refresh_rate) ||
		    time_is_before_jiffies(tpl->exported_ts + timeout_rate_j())) {
			pdu_add_template(tpl);
		}
 
		/* new flowset */
		ptr = pdu_alloc_export(sizeof(struct flowset_data) + tpl->rec_size);
		pdu_flowset		= (struct flowset_data *)ptr;
		pdu_flowset->flowset_id = tpl->template_id_n;
		pdu_flowset->length	= htons(sizeof(struct flowset_data));
		ptr += sizeof(struct flowset_data);
	}
	return ptr;
}
 
static unsigned char *alloc_record_key(const unsigned int t_key, struct data_template **ptpl)
{
	struct data_template *tpl;
 
	tpl = get_template(t_key);
	if (unlikely(!tpl)) {
		printk(KERN_INFO "ipt_NETFLOW: template %#x allocation failed.\n", t_key);
		NETFLOW_STAT_INC_ATOMIC(alloc_err);
		return NULL;
	}
	*ptpl = tpl;
	return alloc_record_tpl(tpl);
}
 
static void netflow_export_flow_tpl(struct ipt_netflow *nf)
{
	unsigned char *ptr;
	struct data_template *tpl;
	unsigned int tpl_mask;
	int i;
 
	if (unlikely(debug > 2))
		printk(KERN_INFO "adding flow to export (%d)\n",
		    pdu_data_records + pdu_tpl_records);
 
	/* build the template key */
#ifdef CONFIG_NF_NAT_NEEDED
	if (nf->nat) {
		tpl_mask = BTPL_NAT4;
		goto ready;
	}
#endif
	tpl_mask = (protocol == 9)? BTPL_BASE9 : BTPL_BASEIPFIX;
	if (likely(nf->tuple.l3proto == AF_INET)) {
		tpl_mask |= BTPL_IP4;
		if (unlikely(nf->options))
			tpl_mask |= BTPL_IP4OPTIONS;
	} else {
		tpl_mask |= BTPL_IP6;
		if (unlikely(nf->options))
			tpl_mask |= BTPL_IP6OPTIONS;
		if (unlikely(nf->flow_label))
			tpl_mask |= BTPL_LABEL6;
	}
	if (unlikely(nf->tcpoptions))
		tpl_mask |= BTPL_TCPOPTIONS;
	if (unlikely(nf->s_mask || nf->d_mask))
		tpl_mask |= BTPL_MASK4;
	if (likely(nf->tuple.protocol == IPPROTO_TCP ||
		    nf->tuple.protocol == IPPROTO_UDP ||
		    nf->tuple.protocol == IPPROTO_SCTP ||
		    nf->tuple.protocol == IPPROTO_UDPLITE))
		tpl_mask |= BTPL_PORTS;
	else if (nf->tuple.protocol == IPPROTO_ICMP ||
		 nf->tuple.protocol == IPPROTO_ICMPV6) {
		if (protocol == 9)
			tpl_mask |= BTPL_ICMP9;
		else if (likely(nf->tuple.l3proto == AF_INET))
			tpl_mask |= BTPL_ICMPX4;
		else
			tpl_mask |= BTPL_ICMPX6;
	} else if (nf->tuple.protocol == IPPROTO_IGMP)
		tpl_mask |= BTPL_IGMP;
        else if (nf->tuple.protocol == IPPROTO_AH ||
                    nf->tuple.protocol == IPPROTO_ESP)
                tpl_mask |= BTPL_IPSEC;
#ifdef ENABLE_MAC
	if (!is_zero_ether_addr(nf->tuple.h_src) ||
	    !is_zero_ether_addr(nf->tuple.h_dst))
		tpl_mask |= BTPL_MAC;
#endif
#ifdef ENABLE_VLAN
	if (nf->tuple.tag[0]) {
		if (protocol == 9)
			tpl_mask |= BTPL_VLAN9;
		else {
			tpl_mask |= BTPL_VLANX;
			if (nf->tuple.tag[1])
				tpl_mask |= BTPL_VLANI;
		}
	}
#endif
#if defined(ENABLE_MAC) || defined(ENABLE_VLAN)
	if (nf->ethernetType)
		tpl_mask |= BTPL_ETHERTYPE;
#endif
#ifdef MPLS_DEPTH
	if (nf->tuple.mpls[0])
		tpl_mask |= BTPL_MPLS;
#endif
#ifdef ENABLE_DIRECTION
	if (nf->hooknumx)
		tpl_mask |= BTPL_DIRECTION;
#endif
#ifdef ENABLE_SAMPLER
	if (get_sampler_mode())
		tpl_mask |= (protocol == 9)? BTPL_SAMPLERID : BTPL_SELECTORID;
#endif
 
#ifdef CONFIG_NF_NAT_NEEDED
ready:
#endif
	ptr = alloc_record_key(tpl_mask, &tpl);
	if (unlikely(!ptr)) {
		NETFLOW_STAT_ADD(pkt_lost, nf->nr_packets);
		NETFLOW_STAT_ADD(traf_lost, nf->nr_bytes);
		NETFLOW_STAT_INC(flow_lost);
		NETFLOW_STAT_TS(lost);
		ipt_netflow_free(nf);
		return;
	}
 
	/* encode all fields */
	for (i = 0; ; ) {
		int type = tpl->fields[i++];
 
		if (!type)
			break;
		add_tpl_field(ptr, type, nf);
		ptr += tpl->fields[i++];
	}
 
	pdu_data_records++;
	pdu_flow_records++;
	pdu_flowset->length = htons(ntohs(pdu_flowset->length) + tpl->rec_size);
 
	pdu_packets += nf->nr_packets;
	pdu_traf    += nf->nr_bytes;
	pdu_ts_mod = jiffies;
 
	ipt_netflow_free(nf);
}
 
static u64 get_sys_init_time_ms(void)
{
	static u64 sys_init_time = 0;
 
	if (!sys_init_time)
		sys_init_time = ktime_to_ms(ktime_get_real()) - jiffies_to_msecs(jiffies);
	return sys_init_time;
}
 
#ifdef ENABLE_SAMPLER
/* http://www.iana.org/assignments/ipfix/ipfix.xml#ipfix-flowselectoralgorithm */
static unsigned char get_flowselectoralgo(void)
{
	switch (get_sampler_mode()) {
	case SAMPLER_DETERMINISTIC:
		return 1; /* Systematic count-based Sampling */
	case SAMPLER_HASH:
	case SAMPLER_RANDOM:
		return 3; /* Random n-out-of-N Sampling */
	default:
		return 0; /* Unassigned */
	}
}
#endif
 
static void export_stat_st_ts(const unsigned int tpl_mask, struct ipt_netflow_stat *st, struct duration *ts)
{
	unsigned char *ptr;
	struct data_template *tpl;
	int i;
 
	ptr = alloc_record_key(tpl_mask, &tpl);
	if (unlikely(!ptr))
		return;
 
	/* encode all fields */
	for (i = 0; ; ) {
		int type = tpl->fields[i++];
 
		if (!type)
			break;
		switch (type) {
		case observationDomainId:	put_unaligned_be32(engine_id, ptr); break;
		case exportingProcessId:	put_unaligned_be32(engine_id, ptr); break;
		case observedFlowTotalCount:	put_unaligned_be64(st->notfound, ptr); break;
		case exportedMessageTotalCount:	put_unaligned_be64(st->exported_pkt, ptr); break;
		case exportedOctetTotalCount:	put_unaligned_be64(st->exported_traf, ptr); break;
		case exportedFlowRecordTotalCount: put_unaligned_be64(st->exported_flow, ptr); break;
		case ignoredPacketTotalCount:	put_unaligned_be64(st->pkt_drop, ptr); break;
		case ignoredOctetTotalCount:	put_unaligned_be64(st->traf_drop, ptr); break;
		case notSentFlowTotalCount:	put_unaligned_be64(st->flow_lost, ptr); break;
		case notSentPacketTotalCount:	put_unaligned_be64(st->pkt_lost, ptr); break;
		case notSentOctetTotalCount:	put_unaligned_be64(st->traf_lost, ptr); break;
		case flowStartMilliseconds:	put_unaligned_be64(ktime_to_ms(ts->first), ptr); break;
		case flowEndMilliseconds:	put_unaligned_be64(ktime_to_ms(ts->last), ptr); break;
		case systemInitTimeMilliseconds: put_unaligned_be64(get_sys_init_time_ms(), ptr); break;
		case observationDomainName:     memcpy(ptr, version_string, version_string_size + 1); break;
#ifdef ENABLE_SAMPLER
		case FLOW_SAMPLER_ID:
		case selectorId:
						*ptr = get_sampler_mode(); break;
		case FLOW_SAMPLER_MODE:
						*ptr = get_sampler_mode_nf(); break;
		case flowSelectorAlgorithm:	*ptr = get_flowselectoralgo(); break;
		case samplingSize:
		case samplingFlowInterval:
						*ptr = 1 /* always 'one-out-of' */; break;
		case samplingFlowSpacing:
		case samplingPopulation:
		case FLOW_SAMPLER_RANDOM_INTERVAL:
						put_unaligned_be16(get_sampler_interval(), ptr); break;
		case selectorIDTotalFlowsObserved: put_unaligned_be64(atomic64_read(&flows_observed), ptr); break;
		case selectorIDTotalFlowsSelected: put_unaligned_be64(atomic64_read(&flows_selected), ptr); break;
		case selectorIdTotalPktsObserved:  put_unaligned_be64(st->pkts_observed, ptr); break;
		case selectorIdTotalPktsSelected:  put_unaligned_be64(st->pkts_selected, ptr); break;
#endif
		default:
			WARN_ONCE(1, "NETFLOW: Unknown Element id %d\n", type);
		}
		ptr += tpl->fields[i++];
	}
 
	pdu_data_records++;
	pdu_flowset->length = htons(ntohs(pdu_flowset->length) + tpl->rec_size);
 
	pdu_ts_mod = jiffies;
}
 
static inline void export_stat_ts(const unsigned int tpl_mask, struct duration *ts)
{
	export_stat_st_ts(tpl_mask, NULL, ts);
}
 
static inline void export_stat_st(const unsigned int tpl_mask, struct ipt_netflow_stat *st)
{
	export_stat_st_ts(tpl_mask, st, NULL);
}
 
static inline void export_stat(const unsigned int tpl_mask)
{
	export_stat_st(tpl_mask, NULL);
}
 
static void netflow_export_stats(void)
{
	struct ipt_netflow_stat t = { 0 };
	int cpu;
 
	if (unlikely(!ts_sysinf_last) ||
	    time_is_before_jiffies(ts_sysinf_last + SYSINFO_INTERVAL * HZ)) {
		start_ts.last = ktime_get_real();
		export_stat_ts(OTPL_SYSITIME, &start_ts);
		ts_sysinf_last = jiffies;
		pdu_needs_export++;
	}
 
	if (unlikely(!ts_stat_last))
		ts_stat_last = jiffies;
	if (likely(time_is_after_jiffies(ts_stat_last + STAT_INTERVAL * HZ)))
		return;
 
	for_each_present_cpu(cpu) {
		struct ipt_netflow_stat *st = &per_cpu(ipt_netflow_stat, cpu);
 
		t.notfound	+= st->notfound; // observedFlowTotalCount
		t.exported_pkt	+= st->exported_pkt;  // exportedMessageTotalCount
		t.exported_traf	+= st->exported_traf; // exportedOctetTotalCount
		t.exported_flow	+= st->exported_flow; // exportedFlowRecordTotalCount
		t.pkt_drop	+= st->pkt_drop;  // ignoredPacketTotalCount
		t.traf_drop	+= st->traf_drop; // ignoredOctetTotalCount
		t.flow_lost	+= st->flow_lost; // notSentFlowTotalCount
		t.pkt_lost	+= st->pkt_lost;  // notSentPacketTotalCount
		t.traf_lost	+= st->traf_lost; // notSentOctetTotalCount
#ifdef ENABLE_SAMPLER
		t.pkts_selected	+= st->pkts_selected;
		t.pkts_observed	+= st->pkts_observed;
#endif
		t.drop.first_tv64 = min_not_zero(t.drop.first_tv64, st->drop.first_tv64);
		t.drop.last_tv64  = max(t.drop.last_tv64, st->drop.last_tv64);
		t.lost.first_tv64 = min_not_zero(t.lost.first_tv64, st->lost.first_tv64);
		t.lost.last_tv64  = max(t.lost.last_tv64, st->lost.last_tv64);
	}
 
	export_stat_st(OTPL_MPSTAT, &t);
	if (t.pkt_drop)
		export_stat_st_ts(OTPL_MPRSTAT, &t, &t.drop);
	if (t.pkt_lost)
		export_stat_st_ts(OTPL_EPRSTAT, &t, &t.lost);
#ifdef ENABLE_SAMPLER
	if (protocol == 10) {
		sampling_ts.last = ktime_get_real();
		switch (get_sampler_mode()) {
		case SAMPLER_HASH:
			export_stat_st_ts(OTPL_SEL_STATH, &t, &sampling_ts);
			break;
		case SAMPLER_DETERMINISTIC:
		case SAMPLER_RANDOM:
			export_stat_st_ts(OTPL_SEL_STAT, &t, &sampling_ts);
		}
	}
#endif
 
	ts_stat_last = jiffies;
	pdu_needs_export++;
}
 
#ifdef ENABLE_SAMPLER
static void export_sampler_parameters(void)
{
	if (get_sampler_mode() &&
	    (unlikely(!ts_sampler_last) ||
	     time_is_before_jiffies(ts_sampler_last + SAMPLER_INFO_INTERVAL * HZ))) {
		if (protocol == 9)
			export_stat(OTPL_SAMPLER);
		else {
			const unsigned char mode = get_sampler_mode();
 
			if (mode == SAMPLER_DETERMINISTIC)
				export_stat(OTPL_SEL_COUNT);
			else
				export_stat(OTPL_SEL_RAND);
		}
		ts_sampler_last = jiffies;
	}
}
#endif
 
static int ethtool_drvinfo(unsigned char *ptr, size_t size, struct net_device *dev)
{
	struct ethtool_drvinfo info = { 0 };
	const struct ethtool_ops *ops = dev->ethtool_ops;
#ifndef ETHTOOL_GLINKSETTINGS
	struct ethtool_cmd ecmd;
#define _KSETTINGS(x, y) (x)
#else
	struct ethtool_link_ksettings ekmd;
#define _KSETTINGS(x, y) (y)
#endif
	int len = size;
	int n;
 
	if (len <= 0 || !ops)
		return 0;
	if (ops->begin) {
		/* was not called before __ethtool_get_settings() though */
		if (ops->begin(dev) < 0)
			return 0;
	}
 
	/* driver name */
	if (ops->get_drvinfo)
		ops->get_drvinfo(dev, &info);
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)
	else if (dev->dev.parent && dev->dev.parent->driver) {
		strlcpy(info.driver, dev->dev.parent->driver->name, sizeof(info.driver));
	}
#endif
	n = scnprintf(ptr, len, "%s", info.driver);
	ptr += n;
	len -= n;
	if (!n || len <= 1) /* have room for separator too */
		goto ret;
 
	/* only get_settings for running devices to not trigger link negotiation */
	if (dev->flags & IFF_UP &&
	    dev->flags & IFF_RUNNING &&
	    !_KSETTINGS(__ethtool_get_settings(dev, &ecmd), __ethtool_get_link_ksettings(dev, &ekmd))) {
		char *units, *p;
		__u32 speed = _KSETTINGS(ethtool_cmd_speed(&ecmd), ekmd.base.speed);
 
		if (speed == SPEED_UNKNOWN)
			units = "";
		else if (speed <= 1000)
			units = "MbE";
		else {
			speed /= 1000;
			units = "GbE";
		}
		switch (_KSETTINGS(ecmd.port, ekmd.base.port)) {
		case PORT_TP:     p = "tp"; break;
		case PORT_AUI:    p = "aui"; break;
		case PORT_MII:    p = "mii"; break;
		case PORT_FIBRE:  p = "fb"; break;
		case PORT_BNC:    p = "bnc"; break;
#ifdef PORT_DA
		case PORT_DA:     p = "da"; break;
#endif
		default:          p = "";
		}
		n = scnprintf(ptr, len, ",%d%s,%s", speed, units, p);
		len -= n;
	}
ret:
	if (ops->complete)
		ops->complete(dev);
	return size - len;
}
#undef _KSETTINGS
 
static const unsigned short netdev_type[] =
{ARPHRD_NETROM, ARPHRD_ETHER, ARPHRD_AX25,
	ARPHRD_IEEE802, ARPHRD_ARCNET,
	ARPHRD_DLCI, ARPHRD_ATM, ARPHRD_METRICOM,
	ARPHRD_IEEE1394, ARPHRD_EUI64, ARPHRD_INFINIBAND,
	ARPHRD_SLIP, ARPHRD_CSLIP, ARPHRD_SLIP6, ARPHRD_CSLIP6,
	ARPHRD_ROSE, ARPHRD_X25, ARPHRD_HWX25,
	ARPHRD_PPP, ARPHRD_CISCO, ARPHRD_LAPB, ARPHRD_DDCMP,
	ARPHRD_RAWHDLC, ARPHRD_TUNNEL, ARPHRD_TUNNEL6, ARPHRD_FRAD,
	ARPHRD_LOOPBACK, ARPHRD_LOCALTLK, ARPHRD_FDDI,
	ARPHRD_SIT, ARPHRD_IPDDP, ARPHRD_IPGRE,
	ARPHRD_PIMREG, ARPHRD_HIPPI, ARPHRD_IRDA,
	ARPHRD_IEEE80211, ARPHRD_IEEE80211_PRISM,
	ARPHRD_IEEE80211_RADIOTAP, ARPHRD_PHONET, ARPHRD_PHONET_PIPE,
	ARPHRD_IEEE802154, ARPHRD_VOID, ARPHRD_NONE};
 
static const char *const netdev_type_name[] =
{"NET/ROM", "Ethernet", "AX.25 Level 2",
	"IEEE 802.2 Ethernet", "ARCnet",
	"Frame Relay DLCI", "ATM", "Metricom STRIP",
	"IEEE 1394 IPv4", "EUI-64", "InfiniBand",
	"SLIP", "CSLIP", "SLIP6", "CSLIP6",
	"ROSE", "X.25", "HW X.25",
	"PPP", "Cisco HDLC", "LAPB", "DDCMP",
	"Raw HDLC", "IPIP Tunnel", "IP6IP6 Tunnel", "FRAD",
	"Loopback", "Localtalk", "FDDI",
	"SIT Tunnel", "IP over DDP", "GRE over IP",
	"PISM Register", "HIPPI", "IrDA",
	"IEEE 802.11", "IEEE 802.11 Prism2",
	"IEEE 802.11 Radiotap", "PhoNet", "PhoNet pipe",
	"IEEE 802.15.4", "void", "none"};
 
static const char *dev_type(int dev_type)
{
	int i;
 
	BUG_ON(ARRAY_SIZE(netdev_type) != ARRAY_SIZE(netdev_type_name));
	for (i = 0; i < ARRAY_SIZE(netdev_type); i++)
		if (netdev_type[i] == dev_type)
			return netdev_type_name[i];
	return "";
}
 
static void export_dev(struct net_device *dev)
{
	unsigned char *ptr;
	struct data_template *tpl;
	int i;
 
	ptr = alloc_record_key(OTPL_IFNAMES, &tpl);
	if (unlikely(!ptr))
		return;
 
	/* encode all fields */
	for (i = 0; ; ) {
		int type = tpl->fields[i++];
		int size = tpl->fields[i++];
		int n;
 
		if (!type)
			break;
		switch (type) {
		case observationDomainId:
			put_unaligned_be32(engine_id, ptr);
			break;
		case IF_NAME:
			n = scnprintf(ptr, size, "%s", dev->name);
			memset(ptr + n, 0, size - n);
			break;
		case IF_DESC:
			/* manual dev 'alias' setting is a first priority,
			 * then ethtool driver name with basic info,
			 * finally net_device.type is a last resort */
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28)
			if (dev->ifalias)
				n = scnprintf(ptr, size, "%s", dev->ifalias);
			else
#endif
				n = ethtool_drvinfo(ptr, size, dev);
			if (!n)
				n = scnprintf(ptr, size, "%s", dev_type(dev->type));
			memset(ptr + n, 0, size - n);
			break;
		case INPUT_SNMP:
#ifdef SNMP_RULES
			rcu_read_lock();
			put_unaligned_be16(resolve_snmp(dev), ptr);
			rcu_read_unlock();
#else
			put_unaligned_be16(dev->ifindex, ptr);
#endif
			break;
		default:
			WARN_ONCE(1, "NETFLOW: Unknown Element id %d\n", type);
		}
		ptr += size;
	}
 
	pdu_data_records++;
	pdu_flowset->length = htons(ntohs(pdu_flowset->length) + tpl->rec_size);
 
	pdu_ts_mod = jiffies;
}
 
static void export_ifnames(void)
{
	struct net_device *dev;
 
	if (likely(ts_ifnames_last) &&
	    time_is_after_jiffies(ts_ifnames_last + SYSINFO_INTERVAL * HZ))
		return;
 
	rtnl_lock();
	for_each_netdev_ns(&init_net, dev) {
		export_dev(dev);
	}
	rtnl_unlock();
	ts_ifnames_last = jiffies;
}
 
/* under pause_scan_worker() */
static void netflow_switch_version(const int ver)
{
	protocol = ver;
	if (protocol == 5) {
		memset(&pdu, 0, sizeof(pdu));
		pdu_data_used	    = NULL;
		pdu_high_wm	    = NULL;
		netflow_export_flow = &netflow_export_flow_v5;
		netflow_export_pdu  = &netflow_export_pdu_v5;
	} else if (protocol == 9) {
		pdu_data_used	    = pdu.v9.data;
		pdu_high_wm	    = (unsigned char *)&pdu + sizeof(pdu.v9);
		netflow_export_flow = &netflow_export_flow_tpl;
		netflow_export_pdu  = &netflow_export_pdu_v9;
	} else { /* IPFIX */
		pdu_data_used	    = pdu.ipfix.data;
		pdu_high_wm	    = (unsigned char *)&pdu + sizeof(pdu.ipfix);
		netflow_export_flow = &netflow_export_flow_tpl;
		netflow_export_pdu  = &netflow_export_pdu_ipfix;
	}
	pdu.version = htons(protocol);
	free_templates();
	pdu_flow_records = pdu_data_records = pdu_tpl_records = 0;
	pdu_flowset = NULL;
	printk(KERN_INFO "ipt_NETFLOW protocol version %d (%s) enabled.\n",
	    protocol, protocol == 10? "IPFIX" : "NetFlow");
}
 
#ifdef CONFIG_NF_NAT_NEEDED
static void export_nat_event(struct nat_event *nel)
{
	static struct ipt_netflow nf = { { NULL } };
 
	nf.tuple.l3proto = AF_INET;
	nf.tuple.protocol = nel->protocol;
	nf.nat = nel; /* this is also flag of dummy flow */
	nf.tcp_flags = (nel->nat_event == NAT_DESTROY)? TCP_FIN_RST : TCP_SYN_ACK;
	if (protocol >= 9) {
		nf.nf_ts_obs = nel->ts_ktime;
		nf.tuple.src.ip = nel->pre.s_addr;
		nf.tuple.dst.ip = nel->pre.d_addr;
		nf.tuple.s_port = nel->pre.s_port;
		nf.tuple.d_port = nel->pre.d_port;
		netflow_export_flow(&nf);
	} else { /* v5 */
		/* The weird v5 packet(s).
		 * src and dst will be same as in data flow from the FORWARD chain
		 * where src is pre-nat src ip and dst is post-nat dst ip.
		 * What we lacking here is external src ip for SNAT, or
		 * pre-nat dst ip for DNAT. We will put this into Nexthop field
		 * with port into src/dst AS field. tcp_flags will distinguish it's
		 * start or stop event. Two flows in case of full nat. */
		nf.tuple.src.ip = nel->pre.s_addr;
		nf.tuple.s_port = nel->pre.s_port;
		nf.tuple.dst.ip = nel->post.d_addr;
		nf.tuple.d_port = nel->post.d_port;
 
		nf.nf_ts_first = nel->ts_jiffies;
		nf.nf_ts_last = nel->ts_jiffies;
		if (nel->pre.s_addr != nel->post.s_addr ||
		    nel->pre.s_port != nel->post.s_port) {
			nf.nh.ip = nel->post.s_addr;
			nf.s_as  = nel->post.s_port;
			nf.d_as  = 0;
			netflow_export_flow(&nf);
		}
		if (nel->pre.d_addr != nel->post.d_addr ||
		    nel->pre.d_port != nel->post.d_port) {
			nf.nh.ip = nel->pre.d_addr;
			nf.s_as  = 0;
			nf.d_as  = nel->pre.d_port;
			netflow_export_flow(&nf);
		}
	}
	kfree(nel);
}
#endif /* CONFIG_NF_NAT_NEEDED */
 
static inline int active_needs_export(const struct ipt_netflow *nf, const long a_timeout,
    const unsigned long j)
{
	return ((j - nf->nf_ts_first) > a_timeout) ||
	    nf->nr_bytes >= FLOW_FULL_WATERMARK;
}
 
/* return flowEndReason (rfc5102) */
/* i_timeout == 0 is flush */
static inline int inactive_needs_export(const struct ipt_netflow *nf, const long i_timeout,
    const unsigned long j)
{
	if (likely(i_timeout)) {
		if (unlikely((j - nf->nf_ts_last) > i_timeout)) {
			if (nf->tuple.protocol == IPPROTO_TCP &&
			    (nf->tcp_flags & TCP_FIN_RST))
				return 0x03; /* end of Flow detected */
			else
				return 0x01; /* idle timeout */
		} else
			return 0;
	} else
		return 0x04; /* forced end */
}
 
/* helper which also record to nf->flowEndReason */
static inline int needs_export_rec(struct ipt_netflow *nf, const long i_timeout,
    const long a_timeout, const unsigned long j)
{
	int reason = inactive_needs_export(nf, i_timeout, j);
 
	if (!reason && active_needs_export(nf, a_timeout, j))
		reason = 0x02; /* active timeout or just active flow */
	return (nf->flowEndReason = reason);
}
 
/* could be called with zero to flush cache and pdu */
/* this function is guaranteed to be called non-concurrently */
/* return number of pdus sent */
static int netflow_scan_and_export(const int flush)
{
	const long i_timeout = flush? 0 : inactive_timeout * HZ;
	const long a_timeout = active_timeout * HZ;
#ifdef HAVE_LLIST
	struct llist_node *node;
#endif
	const int pdu_c = pdu_count;
	LIST_HEAD(export_list);
	struct ipt_netflow *nf, *tmp;
	int i;
#ifdef ENABLE_SAMPLER
	unsigned char mode;
#endif
 
	if (protocol >= 9) {
		netflow_export_stats();
#ifdef ENABLE_SAMPLER
		export_sampler_parameters();
#endif
		export_ifnames();
	}
 
	read_lock_bh(&htable_rwlock);
	for (i = 0; i < LOCK_COUNT; i++) {
		struct stripe_entry *stripe = &htable_stripes[i];
 
		if (!spin_trylock(&stripe->lock)) {
			++wk_trylock;
			continue;
		}
		list_for_each_entry_safe_reverse(nf, tmp, &stripe->list, flows_list) {
			++wk_count;
			if (needs_export_rec(nf, i_timeout, a_timeout, jiffies)) {
				hlist_del(&nf->hlist);
				list_del(&nf->flows_list);
				list_add(&nf->flows_list, &export_list);
			} else {
				/* all flows which need to be exported is always at the tail
				 * so if no more exportable flows we can break */
				break;
			}
		}
		spin_unlock(&stripe->lock);
	}
	read_unlock_bh(&htable_rwlock);
 
#ifdef HAVE_LLIST
	node = llist_del_all(&export_llist);
	while (node) {
		struct llist_node *next = node->next;
		nf = llist_entry(node, struct ipt_netflow, flows_llnode);
		++wk_llist;
		list_add(&nf->flows_list, &export_list);
		node = next;
	}
#endif
 
#ifdef ENABLE_SAMPLER
	mode = get_sampler_mode();
#endif
	set_jiffies_base();
	list_for_each_entry_safe(nf, tmp, &export_list, flows_list) {
		NETFLOW_STAT_ADD(pkt_out, nf->nr_packets);
		NETFLOW_STAT_ADD(traf_out, nf->nr_bytes);
		list_del(&nf->flows_list);
#ifdef ENABLE_SAMPLER
		if (mode) {
			const unsigned int interval = get_sampler_interval();
			unsigned int val; /* [0..interval) */
 
			atomic64_inc(&flows_observed);
			NETFLOW_STAT_ADD_ATOMIC(pkts_observed, nf->nr_packets);
			switch (mode) {
			case SAMPLER_DETERMINISTIC:
				val = nf->sampler_count % interval;
				break;
			case SAMPLER_RANDOM:
				val = prandom_u32_max(interval);
				break;
			default: /* SAMPLER_HASH */
				val = 0;
			}
			if (val) {
				ipt_netflow_free(nf);
				continue;
			}
			atomic64_inc(&flows_selected);
			NETFLOW_STAT_ADD_ATOMIC(pkts_selected, nf->nr_packets);
		}
#endif
		netflow_export_flow(nf);
	}
 
#ifdef CONFIG_NF_NAT_NEEDED
	spin_lock_bh(&nat_lock);
	while (!list_empty(&nat_list)) {
		struct nat_event *nel;
 
		nel = list_entry(nat_list.next, struct nat_event, list);
		list_del(&nel->list);
		spin_unlock_bh(&nat_lock);
		export_nat_event(nel);
		spin_lock_bh(&nat_lock);
	}
	spin_unlock_bh(&nat_lock);
#endif
	/* flush flows stored in pdu if there no new flows for too long */
	/* Note: using >= to allow flow purge on zero timeout */
	if ((jiffies - pdu_ts_mod) >= i_timeout || pdu_needs_export) {
		netflow_export_pdu();
		pdu_needs_export = 0;
	}
 
	return pdu_count - pdu_c;
}
 
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20)
static void netflow_work_fn(void *dummy)
#else
static void netflow_work_fn(struct work_struct *dummy)
#endif
{
	int pdus;
 
	wk_count = 0;
	wk_trylock = 0;
	wk_llist = 0;
	wk_cpu = smp_processor_id();
	wk_start = jiffies;
 
	pdus = netflow_scan_and_export(DONT_FLUSH);
 
	_schedule_scan_worker(pdus);
	wk_busy = jiffies - wk_start;
}
 
#define RATESHIFT 2
#define SAMPLERATE (RATESHIFT*RATESHIFT)
#define NUMSAMPLES(minutes) (minutes * 60 / SAMPLERATE)
#define _A(v, m) (v) * (1024 * 2 / (NUMSAMPLES(m) + 1)) >> 10
// x * (1024 / y) >> 10 is because I can not just divide long long integer
 
// Note that CALC_RATE arguments should never be unsigned.
#define CALC_RATE(ewma, cur, minutes) ewma += _A(cur - ewma, minutes)
 
// calculate EWMA throughput rate for whole module
static void rate_timer_calc(unsigned long dummy)
{
	static u64 old_pkt_total = 0;
	static u64 old_traf_total = 0;
	static u64 old_searched = 0;
	static u64 old_found = 0;
	static u64 old_notfound = 0;
	u64 searched = 0;
	u64 found = 0;
	u64 notfound = 0;
	int dsrch, dfnd, dnfnd;
	u64 pkt_total = 0;
	u64 traf_total = 0;
	int cpu;
 
	for_each_present_cpu(cpu) {
		int metrt;
		struct ipt_netflow_stat *st = &per_cpu(ipt_netflow_stat, cpu);
		u64 pkt_t = st->pkt_total;
 
		pkt_total += pkt_t;
		st->pkt_total_rate = (pkt_t - st->pkt_total_prev) >> RATESHIFT;
		st->pkt_total_prev = pkt_t;
		traf_total += st->traf_total;
		searched += st->searched;
		found += st->found;
		notfound += st->notfound;
		st->exported_rate = (st->exported_traf - st->exported_trafo) >> RATESHIFT;
		st->exported_trafo = st->exported_traf;
		/* calculate hash metric per cpu */
		dsrch = st->searched - st->old_searched;
		dfnd  = st->found - st->old_found;
		dnfnd = st->notfound - st->old_notfound;
		/* zero values are not accounted, becasue only usage is interesting, not nonusage */
		metrt = (dfnd + dnfnd)? 100 * (dsrch + dfnd + dnfnd) / (dfnd + dnfnd) : st->metric;
		CALC_RATE(st->metric, metrt, 1);
		st->old_searched = st->searched;
		st->old_found    = st->found;
		st->old_notfound = st->notfound;
	}
 
	sec_prate = (pkt_total - old_pkt_total) >> RATESHIFT;
	CALC_RATE(min5_prate, sec_prate, 5);
	CALC_RATE(min_prate, sec_prate, 1);
	old_pkt_total = pkt_total;
 
	sec_brate = ((traf_total - old_traf_total) * 8) >> RATESHIFT;
	CALC_RATE(min5_brate, sec_brate, 5);
	CALC_RATE(min_brate, sec_brate, 1);
	old_traf_total = traf_total;
 
	/* hash stat */
	dsrch = searched - old_searched;
	dfnd  = found - old_found;
	dnfnd = notfound - old_notfound;
	old_searched = searched;
	old_found    = found;
	old_notfound = notfound;
	/* if there is no access to hash keep rate steady */
	metric = (dfnd + dnfnd)? 100 * (dsrch + dfnd + dnfnd) / (dfnd + dnfnd) : metric;
	CALC_RATE(min15_metric, metric, 15);
	CALC_RATE(min5_metric, metric, 5);
	CALC_RATE(min_metric, metric, 1);
 
	/* yes, timer delay is not accounted, but this stat is just estimational */
	mod_timer(&rate_timer, jiffies + (HZ * SAMPLERATE));
}
 
#ifdef CONFIG_NF_NAT_NEEDED
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,31)
static struct nf_ct_event_notifier *saved_event_cb __read_mostly = NULL;
static int netflow_conntrack_event(const unsigned int events, struct nf_ct_event *item)
#else
static int netflow_conntrack_event(struct notifier_block *this, unsigned long events, void *ptr)
#endif
{
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,31)
	struct nf_conn *ct = item->ct;
#else
	struct nf_conn *ct = (struct nf_conn *)ptr;
#endif
	struct nat_event *nel;
	const struct nf_conntrack_tuple *t;
	int ret = NOTIFY_DONE;
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,31)
	struct nf_ct_event_notifier *notifier;
 
	/* Call netlink first. */
	notifier = rcu_dereference(saved_event_cb);
	if (likely(notifier))
		ret = notifier->fcn(events, item);
#endif
	if (unlikely(!natevents))
		return ret;
 
	if (!(events & ((1 << IPCT_NEW) | (1 << IPCT_RELATED) | (1 << IPCT_DESTROY))))
		return ret;
 
	if (!(ct->status & IPS_NAT_MASK))
		return ret;
 
	if (unlikely(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num != AF_INET ||
		    ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.l3num != AF_INET)) {
		/* Well, there is no linux NAT for IPv6 anyway. */
		return ret;
	}
 
	if (!(nel = kmalloc(sizeof(struct nat_event), GFP_ATOMIC))) {
		printk(KERN_ERR "ipt_NETFLOW: can't kmalloc nat event\n");
		return ret;
	}
	memset(nel, 0, sizeof(struct nat_event));
	nel->ts_ktime = ktime_get_real();
	nel->ts_jiffies = jiffies;
	t = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
	nel->protocol = t->dst.protonum;
	nel->pre.s_addr = t->src.u3.ip;
	nel->pre.d_addr = t->dst.u3.ip;
	nel->pre.s_port = t->src.u.all;
	nel->pre.d_port = t->dst.u.all;
	t = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
	/* reply is reversed */
	nel->post.s_addr = t->dst.u3.ip;
	nel->post.d_addr = t->src.u3.ip;
	nel->post.s_port = t->dst.u.all;
	nel->post.d_port = t->src.u.all;
	if (events & (1 << IPCT_DESTROY)) {
		nel->nat_event = NAT_DESTROY;
		nat_events_stop++;
	} else {
		nel->nat_event = NAT_CREATE;
		nat_events_start++;
	}
 
	spin_lock_bh(&nat_lock);
	list_add_tail(&nel->list, &nat_list);
	spin_unlock_bh(&nat_lock);
 
	return ret;
}
 
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,31)
static struct notifier_block ctnl_notifier = {
	.notifier_call = netflow_conntrack_event
};
#else
static struct nf_ct_event_notifier ctnl_notifier = {
	.fcn = netflow_conntrack_event
};
#endif /* since 2.6.31 */
#endif /* CONFIG_NF_NAT_NEEDED */
 
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,23) && \
    LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35)
static bool
#else
static int
#endif
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
netflow_target_check(const char *tablename, const void *entry, const struct xt_target *target,
    void *targinfo,
#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,18)
    unsigned int targinfosize,
#endif
    unsigned int hook_mask)
{
#else
netflow_target_check(const struct xt_tgchk_param *par)
{
	const char *tablename = par->table;
	const struct xt_target *target = par->target;
#endif
	if (strcmp("nat", tablename) == 0) {
		/* In the nat table we only see single packet per flow, which is useless. */
		printk(KERN_ERR "%s target: is not valid in %s table\n", target->name, tablename);
		return CHECK_FAIL;
	}
	if (target->family == AF_INET6 && protocol == 5) {
		printk(KERN_ERR "ip6tables NETFLOW target is meaningful for protocol 9 or 10 only.\n");
		return CHECK_FAIL;
	}
	return CHECK_OK;
}
 
#define SetXBit(x) (0x8000 >> (x)) /* Proper bit for htons later. */
static inline __u16 observed_hdrs(const __u8 currenthdr)
{
	switch (currenthdr) {
	case IPPROTO_TCP:
	case IPPROTO_UDP:
		/* For speed, in case switch is not optimized. */
		return 0;
	case IPPROTO_DSTOPTS:  return SetXBit(0);
	case IPPROTO_HOPOPTS:  return SetXBit(1);
	case IPPROTO_ROUTING:  return SetXBit(5);
	case IPPROTO_MH:       return SetXBit(12);
	case IPPROTO_ESP:      return SetXBit(13);
	case IPPROTO_AH:       return SetXBit(14);
	case IPPROTO_COMP:     return SetXBit(15);
	case IPPROTO_FRAGMENT: /* Handled elsewhere. */
		/* Next is known headers. */
	case IPPROTO_ICMPV6:
	case IPPROTO_UDPLITE:
	case IPPROTO_IPIP:
	case IPPROTO_PIM:
	case IPPROTO_GRE:
	case IPPROTO_SCTP:
#ifdef IPPROTO_L2TP
	case IPPROTO_L2TP:
#endif
	case IPPROTO_DCCP:
	       return 0;
	}
	return SetXBit(3); /* Unknown header. */
}
 
/* http://www.iana.org/assignments/ip-parameters/ip-parameters.xhtml */
static const __u8 ip4_opt_table[] = {
	[7]	= 0,	/* RR */ /* parsed manually because of 0 */
	[134]	= 1,	/* CIPSO */
	[133]	= 2,	/* E-SEC */
	[68]	= 3,	/* TS */
	[131]	= 4,	/* LSR */
	[130]	= 5,	/* SEC */
	[1]	= 6,	/* NOP */
	[0]	= 7,	/* EOOL */
	[15]	= 8,	/* ENCODE */
	[142]	= 9,	/* VISA */
	[205]	= 10,	/* FINN */
	[12]	= 11,	/* MTUR */
	[11]	= 12,	/* MTUP */
	[10]	= 13,	/* ZSU */
	[137]	= 14,	/* SSR */
	[136]	= 15,	/* SID */
	[151]	= 16,	/* DPS */
	[150]	= 17,	/* NSAPA */
	[149]	= 18,	/* SDB */
	[147]	= 19,	/* ADDEXT */
	[148]	= 20,	/* RTRALT */
	[82]	= 21,	/* TR */
	[145]	= 22,	/* EIP */
	[144]	= 23,	/* IMITD */
	[30]	= 25,	/* EXP */
	[94]	= 25,	/* EXP */
	[158]	= 25,	/* EXP */
	[222]	= 25,	/* EXP */
	[25]	= 30,	/* QS */
	[152]	= 31,	/* UMP */
};
/* Parse IPv4 Options array int ipv4Options IPFIX value. */
static inline __u32 ip4_options(const u_int8_t *p, const unsigned int optsize)
{
	__u32 ret = 0;
	unsigned int i;
 
	for (i = 0; likely(i < optsize); ) {
		u_int8_t op = p[i++];
 
		if (op == 7) /* RR: bit 0 */
			ret |= 1;
		else if (likely(op < ARRAY_SIZE(ip4_opt_table))) {
			/* Btw, IANA doc is messed up in a crazy way:
			 *   http://www.ietf.org/mail-archive/web/ipfix/current/msg06008.html (2011)
			 * I decided to follow IANA _text_ description from
			 *   http://www.iana.org/assignments/ipfix/ipfix.xhtml (2013-09-18)
			 *
			 * Set proper bit for htonl later. */
			if (ip4_opt_table[op])
				ret |= 1 << (32 - ip4_opt_table[op]);
		}
		if (likely(i >= optsize || op == 0))
			break;
		else if (unlikely(op == 1))
			continue;
		else if (unlikely(p[i] < 2))
			break;
		else
			i += p[i] - 1;
	}
	return ret;
}
 
#define TCPHDR_MAXSIZE (4 * 15)
/* List of options: http://www.iana.org/assignments/tcp-parameters/tcp-parameters.xhtml */
static inline __u32 tcp_options(const struct sk_buff *skb, const unsigned int ptr, const struct tcphdr *th)
{
	const unsigned int optsize = th->doff * 4 - sizeof(struct tcphdr);
	__u8 _opt[TCPHDR_MAXSIZE];
	const u_int8_t *p;
	__u32 ret;
	unsigned int i;
 
	p = skb_header_pointer(skb, ptr + sizeof(struct tcphdr), optsize, _opt);
	if (unlikely(!p))
		return 0;
	ret = 0;
	for (i = 0; likely(i < optsize); ) {
		u_int8_t opt = p[i++];
 
		if (likely(opt < 32)) {
			/* IANA doc is messed up, see above. */
			ret |= 1 << (32 - opt);
		}
		if (likely(i >= optsize || opt == 0))
			break;
		else if (unlikely(opt == 1))
			continue;
		else if (unlikely(p[i] < 2)) /* "silly options" */
			break;
		else
			i += p[i] - 1;
	}
	return ret;
}
 
/* check if data region is in header boundary */
inline static int skb_in_header(const struct sk_buff *skb, const void *ptr, size_t off)
{
	return ((unsigned char *)ptr + off) <= skb->data;
}
 
static inline int eth_p_vlan(__be16 eth_type)
{
	return eth_type == htons(ETH_P_8021Q) ||
		eth_type == htons(ETH_P_8021AD);
}
 
/* Extract all L2 header data, currently (in iptables) skb->data is
 * pointing to network_header, so we use mac_header instead. */
/* Parse eth header, then vlans, then mpls. */
static void parse_l2_header(const struct sk_buff *skb, struct ipt_netflow_tuple *tuple)
{
#if defined(ENABLE_MAC) || defined(ENABLE_VLAN) || defined(MPLS_DEPTH)
#define ENABLE_L2
	unsigned char *mac_header = skb_mac_header(skb);
# if defined(ENABLE_VLAN) || defined(MPLS_DEPTH)
	unsigned int hdr_depth;
	__be16 proto;
# endif
# ifdef ENABLE_VLAN
	int tag_num = 0;
 
	/* get vlan tag that is saved in skb->vlan_tci */
	if (vlan_tx_tag_present(skb))
		tuple->tag[tag_num++] = htons(vlan_tx_tag_get(skb));
# endif
	if (mac_header < skb->head ||
	    mac_header + ETH_HLEN > skb->data)
		return;
# ifdef ENABLE_MAC
	memcpy(&tuple->h_dst, eth_hdr(skb)->h_dest, ETH_ALEN);
	memcpy(&tuple->h_src, eth_hdr(skb)->h_source, ETH_ALEN);
# endif
# if defined(ENABLE_VLAN) || defined(MPLS_DEPTH)
	hdr_depth = ETH_HLEN;
	proto = eth_hdr(skb)->h_proto;
	if (eth_p_vlan(proto)) {
		do {
			const struct vlan_hdr *vh;
 
			vh = (struct vlan_hdr *)(mac_header + hdr_depth);
			if (!skb_in_header(skb, vh, VLAN_HLEN))
				return;
			proto = vh->h_vlan_encapsulated_proto;
#  ifdef ENABLE_VLAN
			if (tag_num < MAX_VLAN_TAGS)
				tuple->tag[tag_num++] = vh->h_vlan_TCI;
#  endif
			hdr_depth += VLAN_HLEN;
		} while (eth_p_vlan(proto));
	}
#  ifdef MPLS_DEPTH
	if (eth_p_mpls(proto)) {
		const struct mpls_label *mpls;
		int label_num = 0;
 
		do {
			mpls = (struct mpls_label *)(mac_header + hdr_depth);
			if (!skb_in_header(skb, mpls, MPLS_HLEN))
				return;
			if (label_num < MPLS_DEPTH)
				tuple->mpls[label_num++] = mpls->entry;
			hdr_depth += MPLS_HLEN;
		} while (!(mpls->entry & htonl(MPLS_LS_S_MASK)));
	}
#  endif
# endif /* defined(ENABLE_VLAN) || defined(MPLS_DEPTH) */
#endif /* defined(ENABLE_MAC) || defined(ENABLE_VLAN) || defined(MPLS_DEPTH) */
}
 
/* packet receiver */
static unsigned int netflow_target(
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24)
			   struct sk_buff **pskb,
#else
			   struct sk_buff *skb,
#endif
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
			   const struct net_device *if_in,
			   const struct net_device *if_out,
			   unsigned int hooknum,
# if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
			   const struct xt_target *target,
# endif
# if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
			   const void *targinfo,
			   void *userinfo
# else
			   const void *targinfo
# endif
#else /* since 2.6.28 */
# define if_in  xt_in(par)
# define if_out xt_out(par)
# if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35)
			   const struct xt_target_param *par
# else
			   const struct xt_action_param *par
# endif
#endif
		)
{
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24)
# ifndef ENABLE_L2
	/* pskb_may_pull() may modify skb */
	const
# endif
		struct sk_buff *skb = *pskb;
#endif
	union {
		struct iphdr ip;
		struct ipv6hdr ip6;
	} _iph, *iph;
	u_int32_t hash;
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
	const int family = target->family;
#else
# ifdef ENABLE_DIRECTION
	const int hooknum = xt_hooknum(par);
# endif
	const int family = xt_family(par);
#endif
	struct ipt_netflow_tuple tuple;
	struct ipt_netflow *nf;
	__u8 tcp_flags;
#ifdef ENABLE_AGGR
	struct netflow_aggr_n *aggr_n;
	struct netflow_aggr_p *aggr_p;
#endif
	__u8 s_mask, d_mask;
	unsigned int ptr;
	int fragment;
	size_t pkt_len;
	int options = 0;
	int tcpoptions = 0;
	struct stripe_entry *stripe;
 
	if (unlikely(
#ifdef ENABLE_L2
	    /* to ensure that full L2 headers are present */
	    unlikely(!pskb_may_pull(skb, 0)) ||
#endif
	    !(iph = skb_header_pointer(skb, 0,
			    (likely(family == AF_INET))? sizeof(_iph.ip) : sizeof(_iph.ip6),
			    &iph)))) {
		NETFLOW_STAT_INC(truncated);
		NETFLOW_STAT_INC(pkt_drop);
		NETFLOW_STAT_ADD(traf_drop, skb->len);
		NETFLOW_STAT_TS(drop);
		return IPT_CONTINUE;
	}
 
	memset(&tuple, 0, sizeof(tuple));
	tuple.l3proto = family;
#ifdef ENABLE_PHYSDEV_OVER
	if (skb->nf_bridge && skb->nf_bridge->physindev)
		tuple.i_ifc = skb->nf_bridge->physindev->ifindex;
	else /* FALLTHROUGH */
#endif
	tuple.i_ifc	= if_in? if_in->ifindex : -1;
	tcp_flags	= 0;
	s_mask		= 0;
	d_mask		= 0;
	parse_l2_header(skb, &tuple);
 
	if (likely(family == AF_INET)) {
		tuple.src	= (union nf_inet_addr){ .ip = iph->ip.saddr };
		tuple.dst	= (union nf_inet_addr){ .ip = iph->ip.daddr };
		tuple.tos	= iph->ip.tos;
		tuple.protocol	= iph->ip.protocol;
		fragment	= unlikely(iph->ip.frag_off & htons(IP_OFFSET));
		ptr		= iph->ip.ihl * 4;
		pkt_len		= ntohs(iph->ip.tot_len);
 
#define IPHDR_MAXSIZE (4 * 15)
		if (unlikely(iph->ip.ihl * 4 > sizeof(struct iphdr))) {
			u_int8_t _opt[IPHDR_MAXSIZE - sizeof(struct iphdr)];
			const u_int8_t *op;
			unsigned int optsize = iph->ip.ihl * 4 - sizeof(struct iphdr);
 
			op = skb_header_pointer(skb, sizeof(struct iphdr), optsize, _opt);
			if (likely(op))
				options = ip4_options(op, optsize);
		}
	} else { /* AF_INET6 */
		__u8 currenthdr;
 
		tuple.src.in6	= iph->ip6.saddr;
		tuple.dst.in6	= iph->ip6.daddr;
		tuple.tos	= iph->ip6.priority;
		fragment	= 0;
		ptr		= sizeof(struct ipv6hdr);
		pkt_len		= ntohs(iph->ip6.payload_len) + sizeof(struct ipv6hdr);
 
		currenthdr	= iph->ip6.nexthdr;
		while (currenthdr != NEXTHDR_NONE && ipv6_ext_hdr(currenthdr)) {
			struct ipv6_opt_hdr _hdr;
			const struct ipv6_opt_hdr *hp;
			unsigned int hdrlen = 0;
 
			options |= observed_hdrs(currenthdr);
			hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr);
			if (hp == NULL) {
				/* We have src/dst, so must account something. */
				tuple.protocol = currenthdr;
				fragment = 3;
				goto do_protocols;
			}
 
			switch (currenthdr) {
			case IPPROTO_FRAGMENT: {
				struct frag_hdr _fhdr;
				const struct frag_hdr *fh;
 
				fh = skb_header_pointer(skb, ptr, sizeof(_fhdr),
						&_fhdr);
				if (fh == NULL) {
					tuple.protocol = currenthdr;
					fragment = 2;
					goto do_protocols;
				}
				fragment = 1;
#define FRA0 SetXBit(4) /* Fragment header - first fragment */
#define FRA1 SetXBit(6) /* Fragmentation header - not first fragment */
				options |= (ntohs(fh->frag_off) & 0xFFF8)? FRA1 : FRA0;
				hdrlen = 8;
				break;
			}
			case IPPROTO_AH: {
				struct ip_auth_hdr _ahdr, *ap;
 
				if (likely(ap = skb_header_pointer(skb, ptr, 8, &_ahdr)))
					SAVE_SPI(tuple, ap->spi);
				hdrlen = (ap->hdrlen + 2) << 2;
				break;
			}
			case IPPROTO_ESP:
				/* After this header everything is encrypted. */
				tuple.protocol = currenthdr;
				goto do_protocols;
			default:
				hdrlen = ipv6_optlen(hp);
			}
			currenthdr = hp->nexthdr;
			ptr += hdrlen;
		}
		tuple.protocol	= currenthdr;
		options |= observed_hdrs(currenthdr);
	}
 
do_protocols:
	if (fragment) {
		/* if conntrack is enabled it should defrag on pre-routing and local-out */
		NETFLOW_STAT_INC(frags);
	} else {
		switch (tuple.protocol) {
		    case IPPROTO_TCP: {
			struct tcphdr _hdr, *hp;
 
			if (likely(hp = skb_header_pointer(skb, ptr, 14, &_hdr))) {
				tuple.s_port = hp->source;
				tuple.d_port = hp->dest;
				tcp_flags = (u_int8_t)(ntohl(tcp_flag_word(hp)) >> 16);
 
				if (unlikely(hp->doff * 4 > sizeof(struct tcphdr)))
					tcpoptions = tcp_options(skb, ptr, hp);
			}
			break;
		    }
		    case IPPROTO_UDP:
		    case IPPROTO_UDPLITE:
		    case IPPROTO_SCTP: {
			struct udphdr _hdr, *hp;
 
			if (likely(hp = skb_header_pointer(skb, ptr, 4, &_hdr))) {
				tuple.s_port = hp->source;
				tuple.d_port = hp->dest;
			}
			break;
		    }
		    case IPPROTO_ICMP: {
			struct icmphdr _hdr, *hp;
 
			if (likely(family == AF_INET) &&
				    likely(hp = skb_header_pointer(skb, ptr, 2, &_hdr)))
				tuple.d_port = htons((hp->type << 8) | hp->code);
			break;
		    }
		    case IPPROTO_ICMPV6: {
			struct icmp6hdr _icmp6h, *ic;
 
			if (likely(family == AF_INET6) &&
				    likely(ic = skb_header_pointer(skb, ptr, 2, &_icmp6h)))
				tuple.d_port = htons((ic->icmp6_type << 8) | ic->icmp6_code);
			break;
		    }
		    case IPPROTO_IGMP: {
			struct igmphdr _hdr, *hp;
 
			if (likely(hp = skb_header_pointer(skb, ptr, 1, &_hdr)))
				tuple.d_port = hp->type;
			break;
		    }
		    case IPPROTO_AH: { /* IPSEC */
			struct ip_auth_hdr _hdr, *hp;
 
			/* This is for IPv4 only. IPv6 it's parsed above. */
			if (likely(family == AF_INET) &&
				    likely(hp = skb_header_pointer(skb, ptr, 8, &_hdr)))
				SAVE_SPI(tuple, hp->spi);
			break;
		    }
		    case IPPROTO_ESP: {
			struct ip_esp_hdr _hdr, *hp;
 
			/* This is for both IPv4 and IPv6. */
			if (likely(hp = skb_header_pointer(skb, ptr, 4, &_hdr)))
				SAVE_SPI(tuple, hp->spi);
			break;
		    }
	       	}
	} /* not fragmented */
 
#ifdef ENABLE_AGGR
	/* aggregate networks */
	read_lock(&aggr_lock);
	if (family == AF_INET) {
		list_for_each_entry(aggr_n, &aggr_n_list, list)
			if (unlikely((ntohl(tuple.src.ip) & aggr_n->mask) == aggr_n->addr)) {
				tuple.src.ip &= htonl(aggr_n->aggr_mask);
				s_mask = aggr_n->prefix;
				atomic_inc(&aggr_n->usage);
				break;
			}
		list_for_each_entry(aggr_n, &aggr_n_list, list)
			if (unlikely((ntohl(tuple.dst.ip) & aggr_n->mask) == aggr_n->addr)) {
				tuple.dst.ip &= htonl(aggr_n->aggr_mask);
				d_mask = aggr_n->prefix;
				atomic_inc(&aggr_n->usage);
				break;
			}
	}
 
	if (tuple.protocol == IPPROTO_TCP ||
	    tuple.protocol == IPPROTO_UDP ||
	    tuple.protocol == IPPROTO_SCTP ||
	    tuple.protocol == IPPROTO_UDPLITE) {
		/* aggregate ports */
		list_for_each_entry(aggr_p, &aggr_p_list, list)
			if (unlikely(ntohs(tuple.s_port) >= aggr_p->port1 &&
			    ntohs(tuple.s_port) <= aggr_p->port2)) {
				tuple.s_port = htons(aggr_p->aggr_port);
				atomic_inc(&aggr_p->usage);
				break;
			}
 
		list_for_each_entry(aggr_p, &aggr_p_list, list)
			if (unlikely(ntohs(tuple.d_port) >= aggr_p->port1 &&
			    ntohs(tuple.d_port) <= aggr_p->port2)) {
				tuple.d_port = htons(aggr_p->aggr_port);
				atomic_inc(&aggr_p->usage);
				break;
			}
	}
	read_unlock(&aggr_lock);
#endif
 
#ifdef SAMPLING_HASH
	hash = __hash_netflow(&tuple);
	{
		struct sampling hs = samp;
 
		if (hs.mode == SAMPLER_HASH) {
			NETFLOW_STAT_INC(pkts_observed);
			if ((u32)(((u64)hash * hs.interval) >> 32))
				return IPT_CONTINUE;
			NETFLOW_STAT_INC(pkts_selected);
		}
	}
	hash %= htable_size;
#else /* !SAMPLING_HASH */
	hash = hash_netflow(&tuple);
#endif
	read_lock(&htable_rwlock);
	stripe = &htable_stripes[hash & LOCK_COUNT_MASK];
	spin_lock(&stripe->lock);
	/* record */
	nf = ipt_netflow_find(&tuple, hash);
	if (unlikely(!nf)) {
		struct rtable *rt;
 
		if (unlikely(maxflows > 0 && atomic_read(&ipt_netflow_count) >= maxflows)) {
			/* This is DOS attack prevention */
			NETFLOW_STAT_INC(maxflows_err);
			NETFLOW_STAT_INC(pkt_drop);
			NETFLOW_STAT_ADD(traf_drop, pkt_len);
			NETFLOW_STAT_TS(drop);
			goto unlock_return;
		}
 
		nf = ipt_netflow_alloc(&tuple);
		if (unlikely(!nf || IS_ERR(nf))) {
			NETFLOW_STAT_INC(alloc_err);
			NETFLOW_STAT_INC(pkt_drop);
			NETFLOW_STAT_ADD(traf_drop, pkt_len);
			NETFLOW_STAT_TS(drop);
			goto unlock_return;
		}
		hlist_add_head(&nf->hlist, &htable[hash]);
 
#ifdef ENABLE_SAMPLER
		/* I only increment if deterministic sampler is enabled to
		 * avoid cache conflict by default. */
		if (get_sampler_mode() == SAMPLER_DETERMINISTIC)
			nf->sampler_count = atomic_inc_return(&flow_count);
#endif
		nf->nf_ts_first = jiffies;
		nf->tcp_flags = tcp_flags;
		nf->o_ifc = if_out? if_out->ifindex : -1;
#ifdef ENABLE_PHYSDEV_OVER
		if (skb->nf_bridge && skb->nf_bridge->physoutdev)
			nf->o_ifc = skb->nf_bridge->physoutdev->ifindex;
#endif
 
#ifdef SNMP_RULES
		rcu_read_lock();
#else
# define resolve_snmp(dev) ((dev)? (dev)->ifindex : -1)
#endif
/* copy and snmp-resolve device with physdev overriding normal dev */
#define copy_dev(out, physdev, dev) \
		if (skb->nf_bridge && skb->nf_bridge->physdev) \
			out = resolve_snmp(skb->nf_bridge->physdev); \
		else \
			out = resolve_snmp(dev);
#ifdef ENABLE_PHYSDEV
		copy_dev(nf->o_ifphys, physoutdev, if_out);
		copy_dev(nf->i_ifphys, physindev, if_in);
#endif
#ifdef SNMP_RULES
# ifdef ENABLE_PHYSDEV_OVER
		copy_dev(nf->o_ifcr, physoutdev, if_out);
		copy_dev(nf->i_ifcr, physindev, if_in);
# else
		nf->o_ifcr = resolve_snmp(if_out);
		nf->i_ifcr = resolve_snmp(if_in);
# endif
		rcu_read_unlock();
 
#endif
		nf->s_mask = s_mask;
		nf->d_mask = d_mask;
 
#if defined(ENABLE_MAC) || defined(ENABLE_VLAN)
		nf->ethernetType = skb->protocol;
#endif
 
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,26)
		rt = (struct rtable *)skb->dst;
#else /* since 2.6.26 */
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,31)
		rt = skb->rtable;
#else /* since 2.6.31 */
		rt = skb_rtable(skb);
#endif
#endif
#ifdef ENABLE_DIRECTION
		nf->hooknumx = hooknum + 1;
#endif
		if (likely(family == AF_INET)) {
			if (rt)
				nf->nh.ip = rt->rt_gateway;
		} else {
			if (rt)
				nf->nh.in6 = ((struct rt6_info *)rt)->rt6i_gateway;
			nf->flow_label = (iph->ip6.flow_lbl[0] << 16) |
			       	(iph->ip6.flow_lbl[1] << 8) | (iph->ip6.flow_lbl[2]);
		}
#if 0
		if (unlikely(debug > 2))
			printk(KERN_INFO "ipt_NETFLOW: new (%u) %hd:%hd SRC=%u.%u.%u.%u:%u DST=%u.%u.%u.%u:%u\n",
			       atomic_read(&ipt_netflow_count),
			       tuple.i_ifc, nf->o_ifc,
			       NIPQUAD(tuple.src.ip), ntohs(tuple.s_port),
			       NIPQUAD(tuple.dst.ip), ntohs(tuple.d_port));
#endif
	}
 
	nf->nr_packets++;
	nf->nr_bytes += pkt_len;
	nf->nf_ts_last = jiffies;
	nf->tcp_flags |= tcp_flags;
	nf->options |= options;
	if (tuple.protocol == IPPROTO_TCP)
		nf->tcpoptions |= tcpoptions;
 
	NETFLOW_STAT_INC(pkt_total);
	NETFLOW_STAT_ADD(traf_total, pkt_len);
 
#define LIST_IS_NULL(name) (!(name)->next)
 
	if (unlikely(active_needs_export(nf, active_timeout * HZ, jiffies))) {
		/* ok, if this is active flow to be exported */
#ifdef HAVE_LLIST
		/* delete from hash and add to the export llist */
		hlist_del(&nf->hlist);
		if (!LIST_IS_NULL(&nf->flows_list))
			list_del(&nf->flows_list);
		llist_add(&nf->flows_llnode, &export_llist);
#else
		/* bubble it to the tail */
		if (LIST_IS_NULL(&nf->flows_list))
			list_add_tail(&nf->flows_list, &stripe->list);
		else
			list_move_tail(&nf->flows_list, &stripe->list);
#endif
		/* Blog: I thought about forcing timer to wake up sooner if we have
		 * enough exportable flows, but in fact this doesn't have much sense,
		 * because this would only move flow data from one memory to another
		 * (from our buffers to socket buffers, and socket buffers even have
		 * limited size). But yes, this is disputable. */
	} else {
		/* most recently accessed flows go to the head, old flows remain at the tail */
		if (LIST_IS_NULL(&nf->flows_list))
			list_add(&nf->flows_list, &stripe->list);
		else
			list_move(&nf->flows_list, &stripe->list);
	}
 
unlock_return:
	spin_unlock(&stripe->lock);
	read_unlock(&htable_rwlock);
 
	return IPT_CONTINUE;
}
 
#ifdef CONFIG_NF_NAT_NEEDED
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,31)
	/* Below 2.6.31 we don't need to handle callback chain manually. */
 
#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,2,0)
#define NET_STRUCT struct net *net
#define NET_ARG net,
#define nf_conntrack_event_cb net->ct.nf_conntrack_event_cb
#else
#define NET_STRUCT void
#define NET_ARG
#endif
static int set_notifier_cb(NET_STRUCT)
{
	struct nf_ct_event_notifier *notifier;
 
	notifier = rcu_dereference(nf_conntrack_event_cb);
	if (notifier == NULL) {
		/* Polite mode. */
		nf_conntrack_register_notifier(NET_ARG &ctnl_notifier);
	} else if (notifier != &ctnl_notifier) {
		if (!saved_event_cb)
			saved_event_cb = notifier;
		else if (saved_event_cb != notifier)
			printk(KERN_ERR "natevents_net_init: %p != %p (report error.)\n",
			    saved_event_cb, notifier);
		rcu_assign_pointer(nf_conntrack_event_cb, &ctnl_notifier);
	} else
		printk(KERN_ERR "ipt_NETFLOW: natevents already enabled.\n");
	return 0;
}
static void unset_notifier_cb(NET_STRUCT)
{
	struct nf_ct_event_notifier *notifier;
 
	notifier = rcu_dereference(nf_conntrack_event_cb);
	if (notifier == &ctnl_notifier) {
		if (saved_event_cb == NULL)
			nf_conntrack_unregister_notifier(NET_ARG &ctnl_notifier);
		else
			rcu_assign_pointer(nf_conntrack_event_cb, saved_event_cb);
	} else
		printk(KERN_ERR "ipt_NETFLOW: natevents already disabled.\n");
}
 
#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,2,0)
#undef nf_conntrack_event_cb
static struct pernet_operations natevents_net_ops = {
	.init = set_notifier_cb,
	.exit = unset_notifier_cb
};
#endif
#endif /* since 2.6.31 */
 
static DEFINE_MUTEX(events_lock);
/* Both functions may be called multiple times. */
static void register_ct_events(void)
{
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,31)
#define NETLINK_M "nf_conntrack_netlink"
	struct module *netlink_m;
	static int referenced = 0;
#endif
 
	printk(KERN_INFO "ipt_NETFLOW: enable natevents.\n");
	mutex_lock(&events_lock);
 
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,31)
	/* Pre-load netlink module who will be first notifier
	 * user, and then hijack nf_conntrack_event_cb from it. */
	if (
#if LINUX_VERSION_CODE < KERNEL_VERSION(3,2,0)
	    !rcu_dereference(nf_conntrack_event_cb) ||
#endif
	    !(netlink_m = find_module(NETLINK_M))) {
		printk("Loading " NETLINK_M "\n");
		request_module(NETLINK_M);
	}
	/* Reference netlink module to prevent it's unsafe unload before us. */
	if (!referenced && (netlink_m = find_module(NETLINK_M))) {
		referenced++;
		use_module(THIS_MODULE, netlink_m);
	}
 
	/* Register ct events callback. */
#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,2,0)
	register_pernet_subsys(&natevents_net_ops);
#else
	set_notifier_cb();
#endif
#else /* below v2.6.31 */
	if (!natevents && nf_conntrack_register_notifier(&ctnl_notifier) < 0)
		printk(KERN_ERR "Can't register conntrack notifier, natevents disabled.\n");
	else
#endif
	natevents = 1;
	mutex_unlock(&events_lock);
}
 
static void unregister_ct_events(void)
{
	printk(KERN_INFO "ipt_NETFLOW: disable natevents.\n");
	mutex_lock(&events_lock);
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,31)
#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,2,0)
	unregister_pernet_subsys(&natevents_net_ops);
#else /* < v3.2 */
	unset_notifier_cb();
#endif /* v3.2 */
	rcu_assign_pointer(saved_event_cb, NULL);
#else /* < v2.6.31 */
	nf_conntrack_unregister_notifier(&ctnl_notifier);
#endif
	natevents = 0;
	mutex_unlock(&events_lock);
}
#endif /* CONFIG_NF_NAT_NEEDED */
 
static struct ipt_target ipt_netflow_reg[] __read_mostly = {
	{
		.name		= "NETFLOW",
		.target		= netflow_target,
		.checkentry	= netflow_target_check,
		.family		= AF_INET,
		.hooks		=
		       	(1 << NF_IP_PRE_ROUTING) |
		       	(1 << NF_IP_LOCAL_IN) |
		       	(1 << NF_IP_FORWARD) |
			(1 << NF_IP_LOCAL_OUT) |
			(1 << NF_IP_POST_ROUTING),
		.me		= THIS_MODULE
	},
	{
		.name		= "NETFLOW",
		.target		= netflow_target,
		.checkentry	= netflow_target_check,
		.family		= AF_INET6,
		.hooks		=
		       	(1 << NF_IP_PRE_ROUTING) |
		       	(1 << NF_IP_LOCAL_IN) |
		       	(1 << NF_IP_FORWARD) |
			(1 << NF_IP_LOCAL_OUT) |
			(1 << NF_IP_POST_ROUTING),
		.me		= THIS_MODULE
	},
};
 
#ifdef CONFIG_PROC_FS
static int register_stat(const char *name, struct file_operations *fops)
{
	struct proc_dir_entry *proc_stat;
 
	printk(KERN_INFO "netflow: registering: /proc/net/stat/%s\n", name);
 
# if LINUX_VERSION_CODE < KERNEL_VERSION(3,10,0)
	proc_stat = create_proc_entry(name, S_IRUGO, INIT_NET(proc_net_stat));
# else
	proc_stat = proc_create(name, S_IRUGO, INIT_NET(proc_net_stat), fops);
# endif
	if (!proc_stat) {
		printk(KERN_ERR "Unable to create /proc/net/stat/%s entry\n", name);
		return 0;
	}
# if LINUX_VERSION_CODE < KERNEL_VERSION(3,10,0)
	proc_stat->proc_fops = fops;
# endif
# if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30)
	proc_stat->owner = THIS_MODULE;
# endif
	printk(KERN_INFO "netflow: registered: /proc/net/stat/%s\n", name);
	return 1;
}
#else
# define register_stat(x, y) 1
#endif
 
static int __init ipt_netflow_init(void)
{
	int i;
 
	printk(KERN_INFO "ipt_NETFLOW version %s, srcversion %s\n",
		IPT_NETFLOW_VERSION, THIS_MODULE->srcversion);
 
	version_string_size = scnprintf(version_string, sizeof(version_string),
		"ipt_NETFLOW " IPT_NETFLOW_VERSION " %s", THIS_MODULE->srcversion);
	tpl_element_sizes[observationDomainName] = version_string_size + 1;
 
	start_ts.first = ktime_get_real();
	clear_ipt_netflow_stat();
 
	if (!hashsize) {
		/* use 1/1024 of memory, 1M for hash table on 1G box */
		unsigned long memksize = (num_physpages << PAGE_SHIFT) / 1024;
 
		if (memksize > (5 * 1024 * 1024))
			memksize = 5 * 1024 * 1024;
		hashsize = memksize / sizeof(struct hlist_head);
	}
	if (hashsize < LOCK_COUNT)
		hashsize = LOCK_COUNT;
	printk(KERN_INFO "ipt_NETFLOW: hashsize %u (%luK)\n", hashsize,
		hashsize * sizeof(struct hlist_head) / 1024);
 
	htable_size = hashsize;
	htable = alloc_hashtable(htable_size);
	if (!htable) {
		printk(KERN_ERR "Unable to create ipt_neflow_hash\n");
		goto err;
	}
 
#ifdef MPLS_DEPTH
	/* template_mpls is terminated on the MPLS_DEPTH mark, so, it
	 * never send Element which can access mpls labels array above
	 * its defined MPLS_DEPTH value. */
	if (MPLS_DEPTH >= 0 && MPLS_DEPTH < 10)
		template_mpls.types[MPLS_LABELS_BASE_INDEX + MPLS_DEPTH] = 0;
#endif
 
	for (i = 0; i < LOCK_COUNT; i++) {
		spin_lock_init(&htable_stripes[i].lock);
		INIT_LIST_HEAD(&htable_stripes[i].list);
	}
 
	ipt_netflow_cachep = kmem_cache_create("ipt_netflow",
						sizeof(struct ipt_netflow), 0,
						0, NULL
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,23)
						, NULL
#endif
					      );
	if (!ipt_netflow_cachep) {
		printk(KERN_ERR "Unable to create ipt_netflow slab cache\n");
		goto err_free_hash;
	}
 
	if (!register_stat("ipt_netflow", &nf_seq_fops))
		goto err_free_netflow_slab;
	if (!register_stat("ipt_netflow_snmp", &snmp_seq_fops))
		goto err_free_proc_stat1;
	if (!register_stat("ipt_netflow_flows", &flows_seq_fops))
		goto err_free_proc_stat2;
 
#ifdef CONFIG_SYSCTL
	ctl_table_renumber(netflow_sysctl_table);
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,25)
	netflow_sysctl_header = register_sysctl_table(netflow_net_table
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,21)
						      , 0 /* insert_at_head */
#endif
						      );
#else /* 2.6.25 */
	netflow_sysctl_header = register_sysctl_paths(netflow_sysctl_path, netflow_sysctl_table);
#endif
	if (!netflow_sysctl_header) {
		printk(KERN_ERR "netflow: can't register to sysctl\n");
		goto err_free_proc_stat3;
	} else
		printk(KERN_INFO "netflow: registered: sysctl net.netflow\n");
#endif
 
	if (!destination)
		destination = destination_buf;
	if (destination != destination_buf) {
		strlcpy(destination_buf, destination, sizeof(destination_buf));
		destination = destination_buf;
	}
	if (add_destinations(destination) < 0)
		goto err_free_sysctl;
 
#ifdef ENABLE_AGGR
	if (!aggregation)
		aggregation = aggregation_buf;
	if (aggregation != aggregation_buf) {
		strlcpy(aggregation_buf, aggregation, sizeof(aggregation_buf));
		aggregation = aggregation_buf;
	}
	add_aggregation(aggregation);
#endif
 
#ifdef ENABLE_SAMPLER
	if (!sampler)
		sampler = sampler_buf;
	if (sampler != sampler_buf) {
		strlcpy(sampler_buf, sampler, sizeof(sampler_buf));
		sampler = sampler_buf;
	}
	parse_sampler(sampler);
#ifdef SAMPLING_HASH
	hash_seed = prandom_u32();
#endif
#endif
 
#ifdef SNMP_RULES
	if (!snmp_rules)
		snmp_rules = snmp_rules_buf;
	if (snmp_rules != snmp_rules_buf) {
		strlcpy(snmp_rules_buf, snmp_rules, sizeof(snmp_rules_buf));
		snmp_rules = snmp_rules_buf;
	}
	add_snmp_rules(snmp_rules);
#endif
 
#ifdef ENABLE_PROMISC
	{
		int newpromisc = promisc;
 
		promisc = 0;
		switch_promisc(newpromisc);
	}
#endif
 
	netflow_switch_version(protocol);
	_schedule_scan_worker(0);
	setup_timer(&rate_timer, rate_timer_calc, 0);
	mod_timer(&rate_timer, jiffies + (HZ * SAMPLERATE));
 
	peakflows_at = jiffies;
	if (xt_register_targets(ipt_netflow_reg, ARRAY_SIZE(ipt_netflow_reg)))
		goto err_stop_timer;
 
#ifdef CONFIG_NF_NAT_NEEDED
	if (natevents)
		register_ct_events();
#endif
 
	printk(KERN_INFO "ipt_NETFLOW is loaded.\n");
	return 0;
 
err_stop_timer:
	_unschedule_scan_worker();
	netflow_scan_and_export(AND_FLUSH);
	del_timer_sync(&rate_timer);
	free_templates();
	destination_removeall();
#ifdef ENABLE_AGGR
	aggregation_remove(&aggr_n_list);
	aggregation_remove(&aggr_p_list);
#endif
err_free_sysctl:
#ifdef CONFIG_SYSCTL
	unregister_sysctl_table(netflow_sysctl_header);
#endif
err_free_proc_stat3:
#ifdef CONFIG_PROC_FS
	remove_proc_entry("ipt_netflow_flows", INIT_NET(proc_net_stat));
err_free_proc_stat2:
	remove_proc_entry("ipt_netflow_snmp", INIT_NET(proc_net_stat));
err_free_proc_stat1:
	remove_proc_entry("ipt_netflow", INIT_NET(proc_net_stat));
err_free_netflow_slab:
#endif
	kmem_cache_destroy(ipt_netflow_cachep);
err_free_hash:
	vfree(htable);
err:
	printk(KERN_INFO "ipt_NETFLOW is not loaded.\n");
	return -ENOMEM;
}
 
static void __exit ipt_netflow_fini(void)
{
	printk(KERN_INFO "ipt_NETFLOW unloading..\n");
 
#ifdef CONFIG_SYSCTL
	unregister_sysctl_table(netflow_sysctl_header);
#endif
#ifdef CONFIG_PROC_FS
	remove_proc_entry("ipt_netflow_flows", INIT_NET(proc_net_stat));
	remove_proc_entry("ipt_netflow_snmp", INIT_NET(proc_net_stat));
	remove_proc_entry("ipt_netflow", INIT_NET(proc_net_stat));
#endif
#ifdef ENABLE_PROMISC
	switch_promisc(0);
#endif
	xt_unregister_targets(ipt_netflow_reg, ARRAY_SIZE(ipt_netflow_reg));
#ifdef CONFIG_NF_NAT_NEEDED
	if (natevents)
		unregister_ct_events();
#endif
	_unschedule_scan_worker();
	netflow_scan_and_export(AND_FLUSH);
	del_timer_sync(&rate_timer);
 
	synchronize_sched();
 
	free_templates();
	destination_removeall();
#ifdef ENABLE_AGGR
	aggregation_remove(&aggr_n_list);
	aggregation_remove(&aggr_p_list);
#endif
#ifdef SNMP_RULES
	kfree(snmp_ruleset);
#endif
 
	kmem_cache_destroy(ipt_netflow_cachep);
	vfree(htable);
 
	printk(KERN_INFO "ipt_NETFLOW unloaded.\n");
}
 
module_init(ipt_netflow_init);
module_exit(ipt_netflow_fini);
 
/* vim: set sw=8: */
ipt-netflow-2.2/raw_promisc.patch0000644000000000000000000000147613213006644015700 0ustar  rootroot
 This simple hack will allow to see promisc traffic in raw table of
 iptables. Of course you will need to enable promisc on the interface.
 Refer to README.promisc for details.
 
 Example how to catch desired traffic:
   iptables -A PREROUTING -t raw -i eth2 -j NETFLOW
 
 
--- linux-2.6.26/net/ipv4/ip_input.old.c        2008-07-14 01:51:29.000000000 +0400
+++ linux-2.6.26/net/ipv4/ip_input.c        2008-08-06 14:02:16.000000000 +0400
@@ -378,12 +378,6 @@
        struct iphdr *iph;
        u32 len;
 
-       /* When the interface is in promisc. mode, drop all the crap
-        * that it receives, do not try to analyse it.
-        */
-       if (skb->pkt_type == PACKET_OTHERHOST)
-               goto drop;
-
        IP_INC_STATS_BH(IPSTATS_MIB_INRECEIVES);
 
        if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL) {
ipt-netflow-2.2/testing.sh0000755000000000000000000000171713213006644014344 0ustar  rootroot#!/bin/bash
 
set -e
 
if [ "$1" = "" ]; then
  echo Maintainer only tool.
  exit 1
elif [ "$1" = all ]; then
  exec bash $0 linux-2.6.18 centos5 linux-3.11.2 centos6 linux-3.4.66 linux-3.9.11 centos7 linux-3.14 linux-3.17 linux-3.19
  exit 1
fi
 
smilint IPT-NETFLOW-MIB.my
 
cfg=()
echo -n Testing for:
for k in "$@"; do
  if [ ! -d /usr/src/$k ]; then continue; fi
  echo -n " $k"
  cfg+=("./configure --kdir=/usr/src/$k")
done
echo
 
readarray -t opts <<EOF
  --disable-snmp-agent
  --enable-aggregation
  --enable-natevents
  --enable-snmp-rules
  --enable-macaddress
  --enable-vlan
  --promisc-mpls
  --enable-direction
  --enable-sampler
  --enable-sampler=hash
  --enable-promisc --promisc-mpls
  --enable-physdev
  --enable-physdev-override
EOF
if [ "$SHORT" ]; then
  opts=("$SHORT")
fi
 
colorecho() {
  echo -e "\033[1;32m$@\033[m"
}
for i in "${cfg[@]}"; do
  for j in "${opts[@]}"; do
    echo
    colorecho == $i $j
    echo
    $i $j -Werror
    make
  done
done
 
ipt-netflow-2.2/NEWS0000644000000000000000000000552713213006644013032 0ustar  rootrootipt-netflow NEWS
================
 
2.2 (2016-02-21)
 
    * Minor feature and Maintenance release.
       - Decapsulate MPLS in promisc mode and MPLS-aware NetFlow feature.
       - Export flowEndReason for IPFIX.
       - Promics mode improvements.
       - Allow export destination to be IPv6 address.
       - Move flows list from debugfs to proc.
       - Compilation compatibility with latest kernels.
       - Code is Coverity scanned.
 
2.1 (2014-02-08)
 
    * Options Templates support (V9 and IPFIX). Which let to implement:
       - Flow Sampling (random, deterministic, and hash modes) for all types
	 of NetFlow protocols (V5, V9, IPFIX).
       - Export Statistics (metering, exporting, sampling) and Configuration.
       - Export Interface list (ifName, ifDescr).
    * Promisc hack (no need to patch kernel anymore).
    * SNMP monitoring interface and agent (via net-snmp dlmod).
    * More compilation compatibility with recent kernels, grsecurity kernels,
      Gentoo, Debian, Centos. DKMS install support.
    * Minor features: IPSec flows, Direction Element. Removed support for
      CONNMARK. Bug fixes and improvements.
    * irqtop tool (ruby).
 
2.0.1 (2014-09-04)
 
    * Minor fixes for 2.0 release.
 
2.0 (2014-08-07)
 
    * This is major release with a lot of new features and improvements, such
      as:
	- Support of NetFlow v9 and IPFIX.
	- IPv6 support.
	- NAT translation events (NEL).
	- Additional options is SNMP-index translation rules, Ethernet Type,
	  VLAN, and MAC addresses exporting.
        - Performance improvements (tested to work well on 10Gbit load).
	- Stability improvements and bug fixes.
 
1.8 (2012-07-02)
 
    * This is minor bug fix release with small improvements.
 
1.7.1 (2011-04-04)
 
    * This is minor release with improved compilation compatibility and small
      improvements.
 
1.7 (2011-01-30)
 
    * This version have improved compilation compatibility with latest Linux
      kernels (2.6.36.3 and 2.6.27) and bunch of small improvements.
 
    * Since version 1.7 ipt-netflow's repository moved to Git SCM. Use of CVS
      repository is deprecated.
 
1.5.1 (2009-03-14)
 
    * This version have improved compliance to NetFlow standard and
      compatibility with iptables/xtables 1.4.x. Added options to configure
      script for manual customization.
 
1.4 (2008-12-23)
 
    * This version have restored compatibility with popular kernel 2.6.18,
      added configure script, statistics improvements, some fixes for 64-bit
      platforms, and minor performance tune up.
 
1.2 (2008-11-15)
 
    * This version have stability enhancements, documentation improvements, IP
      frag support, better statistics.
 
1.1 (2008-08-06)
 
    * This version updated compatibility with latest (2.6.26) Linux kernel, have
      more support for promisc patch, and minor fixes.
 
1.0 (2008-07-12)
 
    * First release tested in production environment.
ipt-netflow-2.2/libipt_NETFLOW.c0000644000000000000000000000500713213006644015151 0ustar  rootroot/*
 * iptables helper for NETFLOW target
 * <abc@telekom.ru>
 *
 *
 *   This file is part of NetFlow exporting module.
 *
 *   This program is free software: you can redistribute it and/or modify
 *   it under the terms of the GNU General Public License as published by
 *   the Free Software Foundation, either version 2 of the License, or
 *   (at your option) any later version.
 *
 *   This program is distributed in the hope that it will be useful,
 *   but WITHOUT ANY WARRANTY; without even the implied warranty of
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *   GNU General Public License for more details.
 *
 *   You should have received a copy of the GNU General Public License
 *   along with this program.  If not, see <http://www.gnu.org/licenses/>.
 *
 */
 
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <getopt.h>
#include <net/if.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
 
#define __EXPORTED_HEADERS__
#ifdef XTABLES
#include <xtables.h>
#else
#include <iptables.h>
#endif
 
#ifdef XTABLES_VERSION_CODE	// since 1.4.1
#define MOD140
#define iptables_target         xtables_target
#endif
 
#ifdef iptables_target		// only in 1.4.0
#define MOD140
#endif
 
#ifdef MOD140
#define ipt_entry_target	xt_entry_target
#define register_target		xtables_register_target
#define _IPT_ENTRY		void
#define _IPT_IP			void
#ifndef IPT_ALIGN
#define IPT_ALIGN		XT_ALIGN
#endif
#else // before 1.3.x
#define _IPT_ENTRY struct ipt_entry
#define _IPT_IP struct ipt_ip
#endif
 
#ifndef IPTABLES_VERSION
#define IPTABLES_VERSION XTABLES_VERSION
#endif
 
static struct option opts[] = {
  { 0 }
};
 
static void help(void)
{
	printf("NETFLOW target\n");
}
 
static int parse(int c, char **argv, int invert, unsigned int *flags,
	     const _IPT_ENTRY  *entry,
	     struct ipt_entry_target **targetinfo)
 
{
	return 1;
}
 
static void final_check(unsigned int flags)
{
}
 
static void save(const _IPT_IP *ip, const struct ipt_entry_target *match)
{
}
 
static void print(const _IPT_IP *ip,
      const struct ipt_entry_target *target,
      int numeric)
{
	printf("NETFLOW ");
}
 
static struct iptables_target netflow = { 
	.next		= NULL,
	.name		= "NETFLOW",
	.version	= IPTABLES_VERSION,
	.size           = IPT_ALIGN(0),
	.userspacesize  = IPT_ALIGN(0),
	.help		= &help,
	.parse		= &parse,
	.final_check    = &final_check,
	.print		= &print,
	.save		= &save,
	.extra_opts     = opts
};
 
#ifndef _init
#define _init __attribute__((constructor)) _INIT
#endif
void _init(void)
{
	register_target(&netflow);
}
ipt-netflow-2.2/configure0000755000000000000000000004317513213006644014243 0ustar  rootroot#!/bin/sh
 
PATH=$PATH:/bin:/usr/bin:/usr/sbin:/sbin:/usr/local/sbin
 
case "$1" in
  --from-dkms-conf*)
    KDKMS=`echo "$1" | sed 's/[^=]*.//'`
    # restore options from existing Makefile, if present
    if [ -e Makefile ]; then
      set -- `sed -n 's/^CARGS = \(.*\)/\1/p' Makefile`
      FROMDKMSCONF=1
    fi
    ;;
esac
 
error() {
  printf "! Error: $*\n"
  exit 1
}
 
iptables_src_version() {
  test "$IPTSRC" || return 1
 
  echo -n "Checking iptables sources version: "
  SRC="$IPTSRC/Makefile"
  test -s "$SRC" || error "Please build iptables first."
  VER=`sed -n 's/^\(IPTABLES_\)\?VERSION[ :]= \?//p' "$SRC"`
  test "$VER" || error "Unknown version of iptables."
  if [ "$VER" = "$IPTVER" ]; then
    echo "$VER (ok)"
  else
    echo "$VER"
    error "Source version ($VER) doesn't match binary ($IPTVER)"
  fi
}
 
get_lib_dir() {
  test -s "$1" && LIB=`sed -n 's/.*_LIB_DIR "\(.*\)"/\1/p' "$1"`
  if [ "$LIB" ]; then
    IPTLIB=$LIB
    echo "$IPTLIB (from sources)"
    return 0
  fi
  return 1
}
 
get_lib_from_bin() {
  LIB=`strings $IPTBIN | grep ^/.*lib.*/.*tables`
  if [ "$LIB" ]; then
    IPTLIB=$LIB
    echo "$IPTLIB (from binary)"
    return 0
  fi
  return 1
}
 
get_lib_from_lib() {
  XLIB=`/usr/bin/ldd $IPTBIN | grep libxtables | sed -n 's!.* \(/[^ ]\+\).*!\1!p'`
  test "$XLIB" || return 1
  LIB=`strings $XLIB | grep ^/.*lib.*/.*tables`
  if [ "$LIB" ]; then
    IPTLIB=$LIB
    echo "$IPTLIB (from libxtables.so, from binary)"
    return 0
  fi
  return 1
}
 
iptables_inc() {
  echo -n "Iptables include flags: "
  if [ "$IPTINC" ]; then
    echo "$IPTINC (user specified)"
  elif [ "$PKGVER" ]; then
    IPTINC="$PKGINC"
    echo "$IPTINC (pkg-config)"
  elif [ "$NOIPTSRC" ]; then
    IPTINC=
    echo "none (default)"
  else
    IPTINC="$IPTSRC/include"
    IPTINC="-I$IPTINC"
    echo "$IPTINC (from source)"
  fi
}
 
iptables_modules() {
  echo -n "Iptables module path: "
  if [ "$IPTLIB" ]; then
    echo "$IPTLIB (user specified)"
  else
    if [ "$PKGLIB" ]; then
      IPTLIB="$PKGLIB"
      echo "$IPTLIB (pkg-config)"
    else
      get_lib_dir "$IPTSRC/include/iptables.h" && return 0
      get_lib_dir "$IPTSRC/include/xtables.h" && return 0
      get_lib_dir "$IPTSRC/xtables/internal.h" && return 0
      get_lib_from_bin && return 0
      get_lib_from_lib && return 0
      error "can not find, try setting it with --ipt-lib="
    fi
  fi
}
 
try_dir() {
  if [ -d "$1/include" ]; then
    echo "Found iptables sources at $1"
    IPTSRC=$1
    return 0
  fi
  return 1
}
 
try_dirg() {
  try_dir "$1" && return 0
  try_dir "$1.git" && return 0
}
 
try_dir2() {
  test -d "$1" && try_dir `dirname $1` && return 0
}
 
check_pkg_config() {
  test "$PKGWARN" && return 1
  if ! which pkg-config >/dev/null 2>&1; then
    echo "! You don't have pkg-config, it may be useful to install it."
    PKGWARN=1
    return 1
  fi
  return 0
}
iptables_find_version() {
  echo -n "Iptables binary version: "
  if [ "$IPTVER" ]; then
    echo "$IPTVER (user specified)"
  else
    IPTVER=`$IPTBIN -V 2>/dev/null | sed -n s/iptables.v//p`
    if [ "$IPTVER" ]; then
      echo "$IPTVER (detected from $IPTBIN)"
      return
    else
      echo "no iptables binary found"
    fi
    check_pkg_config
    PKGVER=`pkg-config --modversion xtables 2>/dev/null`
    if [ "$PKGVER" ]; then
      IPTVER="$PKGVER"
      echo "Xtables version: $IPTVER (detected from `which pkg-config`)"
      return
    fi
    error "Can not find iptables version, try setting it with --ipt-ver="
  fi
}
 
compiler_presence_test() {
  echo -n "Check for working gcc: "
  $CC -v >/dev/null 2>&1
  if [ $? = 0 ]; then
    echo Yes "($CC)"
  else
    echo No
 
    echo "! You need gcc to install module from source"
    if [ -s /etc/debian_version ]; then
      NAME=Debian
      if [ -e /etc/os-release ]; then
	. /etc/os-release >/dev/null 2>&1
      fi
      echo "! "
      echo "! Under $NAME try to run this:"
      echo "!   root# apt-get install gcc"
      echo "! "
    elif [ -s /etc/redhat-release ]; then
      echo "! "
      echo "! Under Centos try to run this:"
      echo "!   root# yum install gcc"
      echo "! "
    fi
    exit 1
  fi
}
 
compile_libitp_test() {
  local FLAGS
  local MSG
  echo -n "Checking for presence of $@... "
  if [ "$IPTINC" ]; then
    FLAGS=$IPTINC
    MSG="(using ipt-inc)"
  elif [ "$PKGINC" ]; then
    FLAGS=$PKGINC
    MSG="(using pkg-config)"
  else
    FLAGS=
    MSG=
  fi
  echo "
#define __EXPORTED_HEADERS__
#include <$*>" > test.c
  $CC -c test.c $FLAGS >/dev/null 2>&1
  RET=$?
  if [ $RET = 0 ]; then
    echo Yes $MSG;
  else
    echo No;
  fi
  rm -f test.c test.o
  return $RET
}
 
iptables_try_pkgconfig() {
  if [ ! "$PKGVER" ]; then
    check_pkg_config
    PKGVER=`pkg-config --modversion xtables 2>/dev/null`
    TRYPKGVER=`pkg-config --modversion xtables 2>/dev/null`
    echo -n "pkg-config for version $IPTVER exists: "
    pkg-config --exact-version=$IPTVER xtables 2>/dev/null
    if [ $? = 0 ]; then
      echo "Yes"
      PKGVER=$TRYPKGVER
    else
      if [ "$TRYPKGVER" ]; then
	echo "No (reported: $TRYPKGVER)"
      else
	echo "No"
      fi
      PKGVER=
    fi
  fi
  if [ "$PKGVER" ]; then
    check_pkg_config
    PKGVER=`pkg-config --modversion xtables 2>/dev/null`
    PKGINC=`pkg-config --cflags xtables`
    PKGLIB=`pkg-config --variable=xtlibdir xtables`
  elif expr "$IPTVER" : '^1\.3' >/dev/null; then
    echo "! This version of iptables ($IPTVER) will be treated as old version."
    # Newer versions of iptables should not have -I/kernel/include!
    # So I assume that newer version will have correct pkg-config set up
    # and if not, then it's older who need it.
    IPTCFLAGS="-I$KDIR/include -DIPTABLES_VERSION=\\\\\"$IPTVER\\\\\""
  fi
  compiler_presence_test
  if compile_libitp_test xtables.h; then
    IPTCFLAGS="-DXTABLES $IPTCFLAGS"
  elif ! compile_libitp_test iptables.h; then
    echo "! Iptables headers not found. You may need to specify --ipt-inc=..."
    if [ -s /etc/debian_version ]; then
      echo "! "
      echo "! Under Debian simply run this:"
      echo "!   root# apt-get install iptables-dev pkg-config"
    elif [ -s /etc/redhat-release ]; then
      echo "! "
      arch=.`uname -m`
      echo "! Under Centos simply run this:"
      echo "!   root# yum install iptables-devel$arch pkgconfig"
    fi
    exit 1
  fi
 
}
 
iptables_find_src() {
  test "$IPTINC" && return 1
  test "$PKGVER" && return 1
 
  VER="iptables-$IPTVER"
  if [ "$IPTSRC" ]; then
    echo "User specified source directory: $IPTSRC"
    try_dir $IPTSRC || error "Specified directory is not iptables source.."
  else
    echo "Searching for $VER sources.."
    try_dir "./$VER" && return 0
    try_dir "../$VER" && return 0
    try_dir "/usr/src/$VER" && return 0
    try_dirg "iptables" && return 0
    try_dirg "../iptables" && return 0
    try_dirg "/usr/src/iptables" && return 0
    try_dir2 `locate $VER/extensions 2>/dev/null | head -1` && return 0
    echo "! Can not find iptables source directory, you may try setting it with --ipt-src="
    echo "! This is not fatal error, yet. Will be just using default include dir."
    NOIPTSRC=1
  fi
}
 
show_help() {
  echo "Possible options:"
  echo "  --ipt-ver=..  iptables version (ex.: 1.4.2)"
  echo "  --ipt-bin=..  iptables binary to use (ex.: /usr/sbin/iptables)"
  echo "  --ipt-src=..  directory for iptable source (ex.: ../iptables-1.4.2)"
  echo "  --ipt-lib=..  iptable modules path (ex.: /usr/libexec/xtables)"
  echo "  --ipt-inc=..  directory for iptable headers (ex.: /usr/include)"
  echo "  --kver=..     kernel version (ex.: 2.6.30-std-def-alt15)"
  echo "  --kdir=..     directory for kernel source (ex.: /usr/src/kernel)"
  echo "  --enable-natevents     enables natevents support"
  echo "  --enable-snmp-rules    enables SNMP-index conversion rules"
  echo "  --enable-macaddress    enables MAC address for v9/IPFIX"
  echo "  --enable-vlan          enables VLAN Ids for v9/IPFIX"
  echo "  --enable-direction     enables flowDirection(61) Element"
  echo "  --enable-sampler       enables Flow Sampling"
  echo "  --enable-sampler=hash  enables Hash sampler"
  echo "  --enable-aggregation   enables aggregation rules"
  echo "  --enable-promisc       enables promisc hack mode"
  echo "  --promisc-mpls         decapsulate MPLS in promisc mode"
  echo "  --promisc-mpls=N       -- and record N labels (default 3)"
  echo "  --enable-physdev       enables physdev reporting"
  echo "  --enable-physdev-override      to override interfaces"
  echo "  --disable-snmp-agent   disables net-snmp agent"
  echo "  --disable-dkms         disables DKMS support completely"
  echo "  --disable-dkms-install  no DKMS install but still create dkms.conf"
  exit 0
}
 
CARGS="$@"
for ac_option
do
  case "$ac_option" in
    -*=*) ac_optarg=`echo "$ac_option" | sed 's/[-_a-zA-Z0-9]*=//'` ;;
    *) ac_optarg= ;;
  esac
 
  case "$ac_option" in
    --ipt-bin=*) IPTBIN="$ac_optarg" ;;
    --ipt-lib=*) IPTLIB="$ac_optarg" ;;
    --ipt-src=*) IPTSRC="$ac_optarg" ;;
    --ipt-ver=*) IPTVER="$ac_optarg" ;;
    --ipt-inc=*) IPTINC="-I$ac_optarg" ;;
    --kver=*)  KVERSION="$ac_optarg" ;;
    --kdir=*)      KDIR="$ac_optarg" ;;
    --enable-nat*)   KOPTS="$KOPTS -DENABLE_NAT" ;;
    --enable-mac*)   KOPTS="$KOPTS -DENABLE_MAC" ;;
    --enable-vlan*)  KOPTS="$KOPTS -DENABLE_VLAN" ;;
    --enable-direc*) KOPTS="$KOPTS -DENABLE_DIRECTION" ;;
    --enable-sampl*hash) KOPTS="$KOPTS -DENABLE_SAMPLER -DSAMPLING_HASH" ;;
    --enable-sampl*) KOPTS="$KOPTS -DENABLE_SAMPLER" ;;
    --enable-aggr*)  KOPTS="$KOPTS -DENABLE_AGGR" ;;
    --enable-promi*)   ENABLE_PROMISC=1 ;;
    --promisc-mpls*)   ENABLE_PROMISC=1; PROMISC_MPLS=1; MPLS_DEPTH=${ac_optarg:-3} ;;
    --enable-snmp-r*)  KOPTS="$KOPTS -DSNMP_RULES" ;;
    --enable-physdev)       KOPTS="$KOPTS -DENABLE_PHYSDEV" ;;
    --enable-physdev-over*) KOPTS="$KOPTS -DENABLE_PHYSDEV_OVER" ;;
    --disable-snmp-a*)   SKIPSNMP=1 ;;
    --disable-net-snmp*) SKIPSNMP=1 ;;
    --disable-dkms*)     SKIPDKMS=1 ;;
    --from-dkms-conf*) ;;
    --make) echo called from make; CARGS=`echo $CARGS | sed s/--make//g` ;;
    -Werror) KOPTS="$KOPTS -Werror" ;;
    --help|-h) show_help ;;
    -*) echo Invalid option: $ac_option; exit 1 ;;
#    *) ni="$ni $ac_option" ;;
  esac
done
 
if [ "$ENABLE_PROMISC" = 1 ]; then KOPTS="$KOPTS -DENABLE_PROMISC"; fi
if [ "$PROMISC_MPLS" = 1 ]; then
  KOPTS="$KOPTS -DPROMISC_MPLS"
  case "$MPLS_DEPTH" in (*[!0-9]*|"") MPLS_DEPTH=1 ;; esac
  if [ "$MPLS_DEPTH" -lt 1 ]; then
    echo "! Requested MPLS stack depth is too small, limiting to 1."
  elif [ "$MPLS_DEPTH" -gt 10 ]; then
    echo "! Requested MPLS stack depth is too big, limiting to 10."
    MPLS_DEPTH=10;
  fi
  if [ "$MPLS_DEPTH" -ge 1 ]; then KOPTS="$KOPTS -DMPLS_DEPTH=$MPLS_DEPTH"; fi
fi
 
kernel_find_version() {
  KHOW=requested
  test "$KVERSION" && return 0
 
  if grep -q '#.*Debian' /proc/version; then
    KHOW=proc
    KVERSION=`sed -n 's/.*#.*Debian \([0-9\.]\+\)-.*/\1/p' /proc/version`
    KLIBMOD=`uname -r`
  else
    KHOW=uname
    KVERSION=`uname -r`
  fi
  test "$KDIR" || return 0
 
  test -s $KDIR/Makefile || return 1
  test -s $KDIR/include/config/kernel.release || return 1
  KVERSION=`cat $KDIR/include/config/kernel.release`
  KHOW=sources
}
 
kernel_check_src() {
  if [ -s "$1/Makefile" ]; then
    KDIR="$1"
    return 0
  fi
  return 1
}
 
kernel_check_src2() {
  if kernel_check_src $1/source; then
    KSRC=$KDIR
  fi
  kernel_check_src $1/build
}
 
kernel_find_source() {
  if [ "$KDKMS" ]; then
    # dkms args is highest priority
    KDIR=$KDKMS
    KSHOW=dkms
    return 0
  fi
  KSHOW=requested
  test "$KDIR" && return 0
  KSHOW=found
  kernel_check_src2 /lib/modules/$KLIBMOD  && return 0
  kernel_check_src2 /lib/modules/$KVERSION && return 0
  kernel_check_src  /usr/src/kernels/$KVERSION && return 0
  kernel_check_src  /usr/src/linux-$KVERSION && return 0
  echo "! Linux source not found. Don't panic. You may specify kernel source"
  echo "! directory with --kdir=..., or try to install kernel-devel package,"
  echo "! or just raw sources for linux-$KVERSION from kernel.org."
  if grep -q -i centos /proc/version 2>/dev/null; then
    echo "! "
    arch=.`uname -m`
    echo "! Under Centos simply run this:"
    echo "!   root# yum install kernel-devel iptables-devel$arch pkgconfig"
  fi
  if grep -q -i debian /proc/version 2>/dev/null; then
    echo "! "
    echo "! Under Debian simply run this:"
    echo "!   root# apt-get install module-assistant iptables-dev pkg-config"
    echo "!   root# m-a prepare"
  fi
  exit 1
}
 
kernel_check_consistency() {
  if [ -s $KDIR/include/config/kernel.release ]; then
    SRCVER=`cat $KDIR/include/config/kernel.release`
    if [ "$KVERSION" != "$SRCVER" ]; then
      echo "! Warning: $KHOW kernel version ($KVERSION) and $KSHOW version of kernel source ($SRCVER) doesn't match!"
      echo "!   You may try to specify only kernel source tree with --kdir=$KDIR"
      echo "!   and configure will pick up version properly."
      echo "! Assuming you want to build for $SRCVER"
      KVERSION=$SRCVER
    fi
  fi
  test -e "$KDIR/.config" || error ".config in kernel source not found, run  make menuconfig  in $KDIR"
  test -d "$KDIR/include/config" || error "kernel is not prepared, run  make prepare modules_prepare  in $KDIR"
}
 
kconfig() {
  KCONFIG=$KDIR/.config
  if ! grep -q "^$1=" $KCONFIG 2>/dev/null; then
    if [ "$KCONFIGREPORTED" != true ]; then
      KCONFIGREPORTED=true
      echo Kernel config file checked: $KCONFIG
      echo
    fi
    echo "! Attention: $1 is undefined in your kernel configuration"
    echo "!   Without this option enabled $2 will not work."
    echo
  fi
}
 
kernel_check_config() {
  kconfig CONFIG_SYSCTL			"sysctl interface"
  kconfig CONFIG_PROC_FS		"proc interface"
  kconfig CONFIG_NF_NAT_NEEDED		"natevents"
  kconfig CONFIG_NF_CONNTRACK_EVENTS	"natevents"
  kconfig CONFIG_IPV6			"IPv6"
  kconfig CONFIG_IP6_NF_IPTABLES	"ip6tables target"
}
 
kernel_check_include() {
  echo -n "Checking for presence of $1... "
  if [ "$KSRC" -a -e $KSRC/$1 ]; then
    echo Yes
    KOPTS="$KOPTS $2"
  elif [ -e $KDIR/$1 ]; then
    echo Yes
    KOPTS="$KOPTS $2"
  else
    echo No
  fi
}
 
kernel_check_features() {
  kernel_check_include include/linux/llist.h -DHAVE_LLIST
  kernel_check_include include/linux/grsecurity.h -DHAVE_GRSECURITY_H
}
 
snmp_check() {
  SNMPTARGET=
  SNMPINSTALL=
  test "$SKIPSNMP" && return
 
  echo -n "Searching for net-snmp-config... "
  if which net-snmp-config >/dev/null 2>&1; then
    echo Yes `which net-snmp-config`
  else
    echo No.
    SNMPCONFIG=no
  fi
 
  echo -n "Searching for net-snmp agent... "
  if [ -s /etc/redhat-release ]; then
    if ! rpm --quiet -q net-snmp; then
      echo No.
      SNMPADD="do:  yum install net-snmp"
      if [ "$SNMPCONFIG" ]; then
	SNMPADD="$SNMPADD net-snmp-devel"
      fi
    else
      echo Yes.
    fi
    if [ "$SNMPCONFIG" ]; then
      SNMPCONFIG="run:  yum install net-snmp-devel"
    fi
  elif [ -s /etc/debian_version ]; then
    if ! dpkg -s snmpd >/dev/null 2>&1; then
      echo No.
      SNMPADD="do:  apt-get install snmpd"
      if [ "$SNMPCONFIG" ]; then
	SNMPADD="$SNMPADD libsnmp-dev"
      fi
    else
      echo Yes.
    fi
    if [ "$SNMPCONFIG" ]; then
      SNMPCONFIG="run:  apt-get install libsnmp-dev"
    fi
  elif [ -s /etc/snmp/snmpd.conf ]; then
    echo Yes.
  else
    echo No.
    SNMPADD="install net-snmp (www.net-snmp.org)"
    SNMPCONFIG="reinstall net-snmp with agent support."
  fi
 
  if [ "$SNMPADD" ]; then
    echo " Assuming you don't want net-snmp agent support".
    echo " Otherwise $SNMPADD"
    return
  elif [ "$SNMPCONFIG" ]; then
    echo "! You have net-snmp agent but not development package."
    echo "! net-snmp agent will not be built, to fix:"
    echo "!   $SNMPCONFIG"
    return
  fi
 
  SNMPTARGET=snmp_NETFLOW.so
  SNMPINSTALL=sinstall
}
 
dkms_check() {
  DKMSINSTALL=
  test "$SKIPDKMS" && return
 
  echo -n "Checking for DKMS... "
  if ! which dkms >/dev/null 2>&1; then
    echo "No. (It may be useful to install it.)"
    echo "! "
    echo "! DKMS is method of installing kernel modules, that will"
    echo "! automatically recompile module after kernel upgrade."
    if [ -s /etc/debian_version ]; then
      echo "! "
      echo "! To install it under Debian simply run this:"
      echo "!   root# apt-get install dkms"
      echo "! "
    elif [ -s /etc/redhat-release ]; then
      echo "! "
      echo "! To install it under Centos enable EPEL or RPMforge repository,"
      echo "! then run this:"
      echo "!   root# yum install dkms"
      echo "! "
    fi
    return
  fi
  echo Yes.
  DKMSINSTALL=dinstall
  test "$FROMDKMSCONF" && return
  if dkms status | grep ^ipt-netflow, >/dev/null; then
    echo "! You are already have module installed via DKMS"
    echo "!   it will be uninstalled on 'make install' and"
    echo "!   current version of module installed afterwards."
    echo "! Use --disable-dkms option if don't want this."
  fi
}
 
kernel_find_version	#KVERSION
test "$KLIBMOD" || KLIBMOD=$KVERSION
echo "Kernel version: $KVERSION ($KHOW)"
kernel_find_source	#KDIR
echo "Kernel sources: $KDIR ($KSHOW)"
kernel_check_consistency
kernel_check_config
kernel_check_features
 
CC=${CC:-gcc}
test "$IPTBIN" || IPTBIN=`which iptables`
 
iptables_find_version	#IPTVER
iptables_try_pkgconfig	#try to configure from pkg-config
iptables_find_src	#IPTSRC
iptables_src_version	#check that IPTSRC match to IPTVER
iptables_inc		#IPTINC
iptables_modules	#IPTLIB
 
snmp_check
dkms_check
 
REPLACE="\
s!@CARGS@!$CARGS!;\
s!@KVERSION@!$KVERSION!;\
s!@KDIR@!$KDIR!;\
s!@KOPTS@!$KOPTS!;\
s!@SNMPTARGET@!$SNMPTARGET!;\
s!@SNMPINSTALL@!$SNMPINSTALL!;\
s!@DKMSINSTALL@!$DKMSINSTALL!;\
s!@IPTABLES_VERSION@!$IPTVER!;\
s!@IPTABLES_CFLAGS@!$IPTCFLAGS $IPTINC!;\
s!@IPTABLES_MODULES@!$IPTLIB!"
 
echo -n "Creating Makefile.. "
 sed "$REPLACE" Makefile.in > Makefile
 echo done.
echo
echo "  If you need some options enabled run ./configure --help"
echo "  Now run: make all install"
echo
 
ipt-netflow-2.2/openwrt/0000755000000000000000000000000013213006644014020 5ustar  rootrootipt-netflow-2.2/openwrt/Readme.md0000644000000000000000000000360113213006644015537 0ustar  rootrootCross-compiling and packages for openwrt
===
 
Place Makefile in `packages/network/ipt-netflow` directory in OpenWRT bouldroot.
Run `make menuconfig` and select package in Network/Netflow menu. Configure args partially supported.
 
Run `make` to build full firmware or `make package/network/ipt-netflow/{clean,prepare,configure,compile,install}` to rebuild packages.
 
To make git version uncomment two lines in Makefile.
 
Tested to work on Chaos Calmer and Designated Driver with Atheros AR7xxx/AR9xxx target.
 
For ipt-netflow 2.2 patches are needed, drop it for next version or git master to build.
 
Making and installilng
===
 
```shell
mkdir debian-toolchain
sudo debootstrap jessie debian-toolchain
sudo chroot debian-toolchain
 
. /etc/profile
apt update
apt install git ssh-client build-essential mercurial subversion \
   binutils flex bzip2 asciidoc ncurses-dev libssl-dev gawk zlib1g-dev fastjar
 
adduser user
su user
. /etc/profile
cd ~
 
git clone https://github.com/openwrt/openwrt.git openwrt-trunk
git clone https://github.com/aabc/ipt-netflow.git
 
cd openwrt-trunk
./scripts/feeds update -a
ln -s ~/ipt-netflow/openwrt/ package/network/ipt-netflow
 
 
make menuconfig
  #select target and device
  #go to network/netflow and check both
 
make
  #and go for dinner or a walk ;)
  #after five hours
 
scp bin/ar71xx/packages/kernel/kmod-ipt-netflow_4.4.14+2.2-2_ar71xx.ipk  \
   root@192.168.236.79:/tmp/
scp bin/ar71xx/packages/base/iptables-mod-netflow_2.2-2_ar71xx.ipk \
   root@192.168.236.79:/tmp/
scp bin/ar71xx/packages/base/kernel_4.4.14-1-abf9cc6feb410252d667326556dae184_ar71xx.ipk   \
   root@192.168.236.79:/tmp/
 
   #goto router
ssh root@192.168.236.79
 
opkg install /tmp/*.ipk
 
insmod /lib/modules/4.4.14/ipt_NETFLOW.ko
sysctl -w net.netflow.protocol=5
sysctl -w net.netflow.destination=192.168.236.34:2055
 
iptables -I FORWARD -j NETFLOW
iptables -I INPUT -j NETFLOW
iptables -I OUTPUT -j NETFLOW
 
```
ipt-netflow-2.2/openwrt/Makefile0000644000000000000000000001001113213006644015451 0ustar  rootrootinclude $(TOPDIR)/rules.mk
include $(INCLUDE_DIR)/kernel.mk
 
PKG_NAME:=ipt-netflow
PKG_RELEASE:=2
 
PKG_SOURCE_URL:=https://github.com/aabc/$(PKG_NAME).git
PKG_VERSION:=2.2
PKG_SOURCE_VERSION:=v$(PKG_VERSION)
 
#TO BUILD development version uncomment 2 rows below and remove patches
#PKG_VERSION:=$(shell (git ls-remote $(PKG_SOURCE_URL) | grep refs/heads/master | cut -f 1 | head -c 7))
#PKG_SOURCE_VERSION:=HEAD
 
PKG_SOURCE_PROTO:=git
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 
PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
 
PKG_BUILD_DIR := $(KERNEL_BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
PKG_DEPENDS:=iptables
 
include $(INCLUDE_DIR)/package.mk
 
 
define KernelPackage/ipt-netflow
	SECTION:=net
	CATEGORY:=Network
	SUBMENU:=Netflow
	TITLE:=Netflow iptables module for Linux kernel
	URL:=http://ipt-netflow.sourceforge.net/
	FILES:=$(PKG_BUILD_DIR)/ipt_NETFLOW.ko
	DEPENDS:=+iptables +iptables-mod-netflow
endef
 
 
define Package/iptables-mod-netflow
	SECTION:=net
	CATEGORY:=Network
	SUBMENU:=Netflow
	TITLE:=Netflow iptables module for Linux kernel
	URL:=http://ipt-netflow.sourceforge.net/
	#DEPENDS:=+kmod-ipt-netflow
	DEPENDS:=+iptables
endef
 
CONFIGURE_ARGS:= \
	--kdir="$(LINUX_DIR)" 
 
define Package/iptables-mod-netflow/config
	menu "Configuration"
		depends on PACKAGE_iptables-mod-netflow
	config PACKAGE_iptables-mod-netflow_natevents
		bool "enables natevents support"
		default n
	config PACKAGE_iptables-mod-netflow_snmp-rules
		bool "enables SNMP-index conversion rules"
		default n
	config PACKAGE_iptables-mod-netflow_macaddress
		bool "enables MAC address for v9/IPFIX"
		default n
	config PACKAGE_iptables-mod-netflow_vlan
		bool "enables VLAN Ids for v9/IPFIX"
		default n
	config PACKAGE_iptables-mod-netflow_direction
		bool "enables flowDirection(61) Element"
		default n
	config PACKAGE_iptables-mod-netflow_sampler
		bool "enables Flow Sampling"
		default n
	config PACKAGE_iptables-mod-netflow_aggregation
		bool "enables aggregation rules"
		default n
	config PACKAGE_iptables-mod-netflow_promisc
		bool "enables promisc hack mode"
		default n
	config PACKAGE_iptables-mod-netflow_promisc-mpls
		bool "decapsulate MPLS in promisc mode"
		default n
	config PACKAGE_iptables-mod-netflow_physdev
		bool "enables physdev reporting"
		default n
	config PACKAGE_iptables-mod-netflow_physdev-override
		bool "to override interfaces"
		default n
	config PACKAGE_iptables-mod-netflow_snmp-agent
		bool "disables net-snmp agent"
		default y
	config PACKAGE_iptables-mod-netflow_dkms
		bool "disables DKMS support completely"
		default y
	config PACKAGE_iptables-mod-netflow_dkms-install
		bool "no DKMS install but still create dkms.conf"
		default n
	endmenu
endef
 
CONFIGURE_ARGS += \
	$(if $(CONFIG_PACKAGE_iptables-mod-netflow_natevents),--enable-natevents) \
	$(if $(CONFIG_PACKAGE_iptables-mod-netflow_snmp-rules),--enable-snmp-rules) \
	$(if $(CONFIG_PACKAGE_iptables-mod-netflow_macaddress),--enable-macaddress) \
	$(if $(CONFIG_PACKAGE_iptables-mod-netflow_vlan),--enable-vlan) \
	$(if $(CONFIG_PACKAGE_iptables-mod-netflow_direction),--enable-direction) \
	$(if $(CONFIG_PACKAGE_iptables-mod-netflow_sampler),--enable-sampler) \
	$(if $(CONFIG_PACKAGE_iptables-mod-netflow_aggregation),--enable-aggregation) \
	$(if $(CONFIG_PACKAGE_iptables-mod-netflow_promisc),--enable-promisc) \
	$(if $(CONFIG_PACKAGE_iptables-mod-netflow_promisc-mpls),--promisc-mpls) \
	$(if $(CONFIG_PACKAGE_iptables-mod-netflow_physdev),--enable-physdev) \
	$(if $(CONFIG_PACKAGE_iptables-mod-netflow_physdev-override),--enable-physdev-override) \
	$(if $(CONFIG_PACKAGE_iptables-mod-netflow_snmp-agent),--disable-snmp-agent) \
	$(if $(CONFIG_PACKAGE_iptables-mod-netflow_dkms),--disable-dkms) \
	$(if $(CONFIG_PACKAGE_iptables-mod-netflow_dkms-install),--disable-dkms-install) 
 
#TODO: --enable-sampler=hash --promisc-mpls=N
 
 
$(eval $(call KernelPackage,ipt-netflow))
 
$(eval $(call Package,kmod-ipt-netflow))
 
define Package/iptables-mod-netflow/install
	$(MAKE) -C $(PKG_BUILD_DIR) DESTDIR=$(1) linstall
	#TODO: snmp install, dkms install
endef
 
$(eval $(call BuildPackage,iptables-mod-netflow))
ipt-netflow-2.2/openwrt/patches/0000755000000000000000000000000013213006644015447 5ustar  rootrootipt-netflow-2.2/openwrt/patches/310-Makefile_crosscompile.patch0000644000000000000000000000111713213006644023270 0ustar  rootrootIndex: ipt-netflow-2.2/Makefile.in
===================================================================
--- ipt-netflow-2.2.orig/Makefile.in
+++ ipt-netflow-2.2/Makefile.in
@@ -64,10 +64,10 @@ sinstall: | snmp_NETFLOW.so IPT-NETFLOW-
 	fi
 
 %_sh.o: libipt_NETFLOW.c
-	gcc -O2 -Wall -Wunused $(IPTABLES_CFLAGS) -fPIC -o $@ -c libipt_NETFLOW.c
+	$(CC) $(CFLAGS) -O2 -Wall -Wunused $(IPTABLES_CFLAGS) -fPIC -o $@ -c libipt_NETFLOW.c
 
 %.so: %_sh.o
-	gcc -shared -o $@ $<
+	$(CC) -shared -o $@ $<
 
 version.h: ipt_NETFLOW.c ipt_NETFLOW.h compat.h Makefile
 	@./version.sh --define > version.h
ipt-netflow-2.2/irqtop0000755000000000000000000003676013213006644013602 0ustar  rootroot#!/usr/bin/ruby
# Obeserve irq and softirq in top fashion
# (c) 2014 <abc@telekom.ru>
# License: GPL.
 
require 'getoptlong'
require 'curses'
require 'stringio'
 
@imode = :both
@omode = :table
@color = true
@showrps = false
 
GetoptLong.new(
    ["--help",     "-h", GetoptLong::NO_ARGUMENT],
    ["--batch",    "-b", GetoptLong::NO_ARGUMENT],
    ["--delay",    "-d", GetoptLong::REQUIRED_ARGUMENT],
    ["--top",      "-t", GetoptLong::NO_ARGUMENT],
    ["--table",    "-x", GetoptLong::NO_ARGUMENT],
    ["--soft",     "-s", GetoptLong::NO_ARGUMENT],
    ["--softirq",        GetoptLong::NO_ARGUMENT],
    ["--softirqs",       GetoptLong::NO_ARGUMENT],
    ["--irq",      "-i", GetoptLong::NO_ARGUMENT],
    ["--irqs",           GetoptLong::NO_ARGUMENT],
    ["--reverse",  "-r", GetoptLong::NO_ARGUMENT],
    ["--nocolor",  "-C", GetoptLong::NO_ARGUMENT],
    ["--eth",      "-e", "--pps", GetoptLong::NO_ARGUMENT],
    ["--rps",      "-R", "--xps", GetoptLong::NO_ARGUMENT]
).each do |opt, arg|
  case opt
  when '--help'
    puts " Shows interrupt rates (per second) per cpu."
    puts " Also shows irq affinity ('.' for disabled cpus),"
    puts " and rps/xps affinity ('+' rx, '-' tx, '*' tx/rx)."
    puts " Can show packet rate per eth queue."
    puts
    puts " Usage: #{$0} [-h] [-d #{@delay}] [-b] [-t|-x] [-i|-s] [-r]"
    puts "    -d  --delay=n  refresh interval"
    puts "    -s  --softirq  select softirqs only"
    puts "    -i  --irq      select hardware irqs only"
    puts "    -e  --eth      show extra eth stats (from ethtool)"
    puts "    -R  --rps      enable display of rps/xps"
    puts "    -x  --table    output in table mode (default)"
    puts "    -t  --top      output in flat top mode"
    puts "    -b  --batch    output non-interactively"
    puts "    -r  --reverse  reverse sort order"
    puts "    -C  --nocolor  disable colors"
    puts
    puts " Rates marked as '.' is forbidden by smp_affinity mask."
    exit 0
  when '--reverse'
    @reverse = !@reverse
  when '--batch'
    @batch = true
    @reverse = !@reverse if @omode == :top
  when '--delay'
    @delay = arg.to_i
  when '--top'
    @omode = :top
  when '--table'
    @omode = :table
  when /--irq/
    @imode = :irq
  when /--soft/
    @imode = :soft
  when /--pps/
    @pps = true
  when /--nocolor/
    @color = false
  when /--rps/
    @showrps = !@showrps
  end
end
if !@delay && ARGV[0].to_f > 0
  @delay = ARGV.shift.to_f
else
  @delay = 5
end
@count = ARGV.shift.to_f if ARGV[0].to_i > 0
 
def read_table(tag, file)
  @cpus = []
  lines = IO.readlines(file)
  @cpus = lines[0].scan(/CPU\d+/)
  @icpus = @cpus if tag == 'i'
  lines[2..-1].each do |li|
    irq, stat, desc = li.match(/^\s*(\S+):((?:\s+\d+)+)(.*)$/).captures
    stat = stat.scan(/\d+/)
    @irqs << [tag, irq, desc]
    stat.each_with_index do |val, i|
      # interruptsN, 's|i', irq'N', 'cpuX', 'descr...'
      @stats << [val.to_i, tag, irq, @cpus[i], desc.strip]
    end
  end
end
 
def read_procstat
  @cstat = {}
  lines = IO.readlines("/proc/stat").grep(/^cpu\d+ /)
  lines.each do |li|
    c, *d = li.split(" ")
    d = d.map {|e| e.to_i}
    @cstat[c] = d
  end
end
 
def read_affinity
  @aff = {}
  Dir.glob("/proc/irq/*/smp_affinity").each do |af|
    irq = af[%r{\d+}].to_i
    a = IO.read(af).strip.to_i(16)
    @aff[irq] = a
  end
end
 
# list ethernet devices
def net_devices_pci
  Dir['/sys/class/net/*'].reject do |f|
    f += "/device" unless File.symlink?(f)
    if File.symlink?(f)
      !(File.readlink(f) =~ %r{devices/pci})
    else
      false
    end
  end.map {|f| File.basename(f)}
end
 
@devlist = net_devices_pci
@devre = Regexp.union(@devlist)
def get_rps(desc)
  @rps = @xps = 0
  return unless @showrps
  return if @devlist.empty?
  dev = desc[/\b(#{@devre})\b/, 1]
  return unless dev
  return unless desc =~ /-(tx|rx)+-\d+/i
  qnr = desc[/-(\d+)\s*$/, 1]
  return unless qnr
  begin
    @rps = IO.read("/sys/class/net/#{dev}/queues/rx-#{qnr}/rps_cpus").hex if desc =~ /rx/i
    @xps = IO.read("/sys/class/net/#{dev}/queues/tx-#{qnr}/xps_cpus").hex if desc =~ /tx/i
  rescue
  end
end
 
def calc_rps(cpu)
  m = 0
  m |= 1 if @rps & (1 << cpu) != 0
  m |= 2 if @xps & (1 << cpu) != 0
  " +-*".slice(m, 1)
end
 
# ethtool -S eth0
def ethtool_grab_stat(dev = nil)
  unless dev
    @esto = @est if @est
    @est = Hash.new { |h,k| h[k] = Hash.new(&h.default_proc) }
    @devlist = net_devices_pci
    @devre = Regexp.union(@devlist)
    # own time counter because this stat could be paused
    @ehts = @ets if @ets
    @ets = @ts
    @edt = @ets - @ehts if @ehts
    @devlist.each {|e| ethtool_grab_stat(e)}
    return
  end
  h = Hash.new {|k,v| k[v] = Array.new}
  t = `ethtool -S #{dev} 2>/dev/null`
  return if t == ''
  t.split("\n").map { |e|
    e.split(':')
  }.reject { |e|
    !e[1]
  }.each { |k,v|
    k.strip!
    v = v.strip.to_i
    if k =~ /^.x_queue_(\d+)_/
      t = k.split('_', 4)
      qdir = t[0]
      qnr  = t[2]
      qk   = t[3]
      @est[dev][qdir][qnr][qk] = v
    else
      @est[dev][k] = v
    end
  }
end
 
def e_queue_stat(dev, qdir, qnr, k)
  n = @est[dev][qdir][qnr][k]
  o = @esto[dev][qdir][qnr][k]
  d = (n - o) / @edt
  if d > 0
    "%s:%d" % [qdir, d]
  else
    nil
  end
end
 
def e_dev_stat(dev, k, ks)
  n = @est[dev][k]
  o = @esto[dev][k]
  r = (n - o) / @edt
  ks = k unless ks
  "%s:%d" % [ks, r]
end
 
def e_queue_stat_err(dev, qdir, qnr)
  r = []
  ek = @est[dev][qdir][qnr].keys.reject{|e| e =~ /^(bytes|packets)$/}
  ek.each do |k|
    n = @est[dev][qdir][qnr][k]
    o = @esto[dev][qdir][qnr][k]
    d = n - o
    r << "%s_%s:%d" % [qdir, k, d] if d.to_i > 0
  end
  r
end
 
# this is not rate
def e_dev_stat_sum(dev, rk, ks)
  ek = @est[dev].keys.reject{|ek| !(ek =~ rk)}
  n = ek.inject(0) {|sum,k| sum += @est[dev][k].to_i}
  o = ek.inject(0) {|sum,k| sum += @esto[dev][k].to_i rescue 0}
  r = (n - o)
  if r > 0
    "%s:%d" % [ks, r]
  else
    nil
  end
end
 
def print_ethstat(desc)
  return if @devlist.empty?
  dev = desc[/\b(#{@devre})\b/, 1]
  return unless dev
  unless @esto && @est
    print ' []'
    return
  end
  t = []
  if desc =~ /-(tx|rx)+-\d+/i
    qnr = desc[/-(\d+)\s*$/, 1]
    if qnr
      if desc =~ /rx/i
	t << e_queue_stat(dev, "rx", qnr, "packets")
	t += e_queue_stat_err(dev, "rx", qnr)
      end
      if desc =~ /tx/i
	t << e_queue_stat(dev, "tx", qnr, "packets")
	t += e_queue_stat_err(dev, "tx", qnr)
      end
    end
  else
    t << e_dev_stat(dev, "rx_packets", 'rx')
    t << e_dev_stat(dev, "tx_packets", 'tx')
    t << e_dev_stat_sum(dev, /_err/, 'err')
    t << e_dev_stat_sum(dev, /_drop/, 'drop')
  end
  t.delete(nil)
  print ' [' + t.join(' ') + ']'
end
 
def grab_stat
  # @h[istorical]
  @hstats = @stats
  @hcstat = @cstat
  @hts = @ts
 
  @stats = []
  @irqs = []
  @ts = Time.now
  @dt = @ts - @hts if @hts
 
  read_table 'i', "/proc/interrupts"
  read_table 's', "/proc/softirqs"
  read_affinity
  read_procstat
  ethtool_grab_stat if @pps
end
 
def calc_speed
  s = []
  # calc speed
  h = Hash.new(0)
  @hstats.each do |v, t, i, c, d|
    h[[t, i, c]] = v
  end
  # output
  @h = {}
  @t = Hash.new(0) # rate per cpu
  @w = Hash.new(0) # irqs per irqN
  @s = @stats.map do |v, t, i, c, d|
    rate = (v - h[[t, i, c]]) / @dt
    @t[c] += rate if t == 'i'
    @w[[t, i]] += (v - h[[t, i, c]])
    @h[[t, i, c]] = rate
    [rate, v, t, i, c, d]
  end
end
 
def calc_cpu
  @cBusy  = Hash.new(0)
  @cHIrq  = Hash.new(0)
  @cSIrq  = Hash.new(0)
  # user, nice, system, [3] idle, [4] iowait, irq, softirq, etc.
  @cstat.each do |c, d|
    d = d.zip(@hcstat[c]).map {|a, b| a - b}
    c = c.upcase
    sum = d.reduce(:+)
    @cBusy[c] = 100 - (d[3] + d[4]).to_f / sum * 100
    @cHIrq[c] = (d[5]).to_f / sum * 100
    @cSIrq[c] = (d[6]).to_f / sum * 100
  end
end
 
def show_top
  @s.sort!.reverse!
  @s.reverse! if @reverse
  rej = nil
  rej = 's' if @imode == :irq
  rej = 'i' if @imode == :soft
  @s.each do |s, v, t, i, c, d|
    next if t == rej
    if s > 0
      print "%9.1f  %s  %s  <%s>  %s" % [s, c.downcase, t, i, d]
      print_ethstat(d) if @pps
      puts
    end
  end
end
 
@ifilter = {}
def show_interrupts
  maxlen = 7
  @irqs.reverse! if @reverse
  print "%s %*s  " % [" ", maxlen, " "]
  @icpus.each { |c| print " %6s" % c }
  puts
 
  # load
  print "%*s: " % [maxlen + 2, "cpuUtil"]
  @icpus.each { |c| print " %6.1f" % @cBusy[c] }
  puts "   total CPU utilization %"
  #
  print "%*s: " % [maxlen + 2, "%irq"]
  @icpus.each { |c| print " %6.1f" % @cHIrq[c] }
  puts "   hardware IRQ CPU util%"
  print "%*s: " % [maxlen + 2, "%sirq"]
  @icpus.each { |c| print " %6.1f" % @cSIrq[c] }
  puts "   software IRQ CPU util%"
 
  # total
  print "%*s: " % [maxlen + 2, "irqTotal"]
  @icpus.each { |c| print " %6d" % @t[c] }
  puts "   total hardware IRQs"
 
  rej = nil
  rej = 's' if @imode == :irq
  rej = 'i' if @imode == :soft
  @irqs.each do |t, i, desc|
    next if t == rej
 
    # include incrementally and all eth
    unless @ifilter[[t, i]] || @showall
      next unless @w[[t, i]] > 0 || desc =~ /eth/
      @ifilter[[t, i]] = true
    end
 
    print "%s %*s:  " % [t.to_s, maxlen, i.slice(0, maxlen)]
    rps = get_rps(desc)
    @icpus.each do |c|
      cpu = c[/\d+/].to_i
      aff = @aff[i.to_i]
      off = ((aff & 1 << cpu) ==0)? true : false if aff
      fla = calc_rps(cpu)
      begin
	v = @h[[t, i, c]]
	if v > 0 || !off
	  print "%6d%c" % [v, fla]
	elsif aff
	  print "%6s%c" % [".", fla]
	end
      rescue
      end
    end
    print desc
    print_ethstat(desc) if @pps
    puts
  end
end
 
def select_output
  if @omode == :top
    show_top
  else
    show_interrupts
  end
end
 
def curses_choplines(text)
  cols = Curses.cols - 1
  rows = Curses.lines - 2
  lines = text.split("\n").map {|e| e.slice(0, cols)}.slice(0, rows)
  text = lines.join("\n")
  text << "\n" * (rows - lines.size) if lines.size < rows
  text
end
 
def show_help
  puts "irqtop help:"
  puts
  puts "  In table view, cells marked with '.' mean this hw irq is"
  puts "     disabled via /proc/irq/<irq>/smp_affinity"
  puts "  Interactive keys:"
  puts "    i     Toggle (hardware) irqs view"
  puts "    s     Toggle software irqs (softirqs) view"
  puts "    e     Show eth stat per queue"
  puts "    R     Show rps/xps affinity"
  puts "    t     Flat top display mode"
  puts "    x     Table display mode"
  puts "    r     Reverse rows order"
  puts "    c     Toggle colors (for eth)"
  puts "    a     Show lines with zero rate (all)"
  puts "    A     Clear lines with zero rates"
  puts "    .     Pause screen updating"
  puts "    h,?   This help screen"
  puts "    q     Quit."
  puts "  Any other key will update display."
  puts
  puts "Press any key to continue."
end
 
hostname = `hostname`.strip
#
grab_stat
sleep 0.5
 
COLOR_GREEN  = "\033[0;32m"
COLOR_YELLOW = "\033[0;33m"
COLOR_CYAN   = "\033[0;36m"
COLOR_RED    = "\033[0;31m"
COLOR_OFF    = "\033[m"
def tty_printline(t)
  latr = nil # line color
  if t =~ /-rx-/
    latr = COLOR_GREEN
  elsif t =~ /-tx-/
    latr = COLOR_YELLOW
  elsif t =~ /\beth/
    latr = COLOR_CYAN
  end
  print latr if latr
 
  if t =~ /cpuUtil:|irq:|sirq:/
    # colorize percentage values
    t.scan(/\s+\S+/) do |e|
      eatr = nil
      if e =~ /^\s*[\d.]+$/
        if e.to_i >= 90
          eatr = COLOR_RED
        elsif e.to_i <= 10
          eatr = COLOR_GREEN
        else
          eatr = COLOR_YELLOW
        end
      end
      print eatr if eatr
      print e
      print (latr)? latr : COLOR_OFF if eatr
    end
  elsif latr && t =~ / \[[^\]]+\]$/
    # colorize eth stats
    print $`
    print COLOR_OFF if latr
    $&.scan(/(.*?)(\w+)(:)(\d+)/) do |e|
      eatr = nil
      case e[1]
      when 'rx'
	eatr = COLOR_GREEN
      when 'tx'
	eatr = COLOR_YELLOW
      else
	eatr = COLOR_RED
      end
      eatr = nil if e[3].to_i == 0
 
      print e[0]
      print eatr if eatr
      print e[1..-1].join
      print (latr)? latr : COLOR_OFF if eatr
    end
    print $'
  else
    print t
  end
 
  print COLOR_OFF if latr
  puts
end
def tty_output
  if @color
    $stdout = StringIO.new
    yield
    $stdout.rewind
    txt = $stdout.read
    $stdout = STDOUT
 
    txt.split("\n", -1).each do |li|
      tty_printline(li)
    end
  else
    yield
  end
end
 
if @batch
  @color = @color && $stdout.tty?
  loop do
    grab_stat
    calc_speed
    calc_cpu
    puts "#{hostname} - irqtop - #{Time.now}"
    tty_output {
      select_output
    }
    $stdout.flush
    break if @count && (@count -= 1) == 0
    sleep @delay
  end
  exit 0
end
 
Curses.init_screen
Curses.start_color
Curses.cbreak
Curses.noecho
Curses.nonl
Curses.init_pair(1, Curses::COLOR_GREEN,  Curses::COLOR_BLACK);
Curses.init_pair(2, Curses::COLOR_YELLOW, Curses::COLOR_BLACK);
Curses.init_pair(3, Curses::COLOR_CYAN,   Curses::COLOR_BLACK);
Curses.init_pair(4, Curses::COLOR_RED,    Curses::COLOR_BLACK);
$stdscr = Curses.stdscr
$stdscr.keypad(true)
 
def curses_printline(t)
  latr = nil # line color
  if t =~ /-rx-/
    latr = Curses.color_pair(1)
  elsif t =~ /-tx-/
    latr = Curses.color_pair(2)
  elsif t =~ /\beth/
    latr = Curses.color_pair(3)
  end
  $stdscr.attron(latr)  if latr
 
  if t =~ /cpuUtil:|irq:|sirq:/
    # colorize percentage values
    t.scan(/\s+\S+/) do |e|
      eatr = nil
      if e =~ /^\s*[\d.]+$/
	if e.to_i >= 90
	  eatr = Curses.color_pair(4)
	elsif e.to_i <= 10
	  eatr = Curses.color_pair(1)
	else
	  eatr = Curses.color_pair(2)
	end
      end
      $stdscr.attron(eatr)  if eatr
      $stdscr.addstr("#{e}")
      $stdscr.attroff(eatr) if eatr
    end
  elsif latr && t =~ / \[[^\]]+\]$/
    # colorize eth stats
    $stdscr.addstr($`)
    $stdscr.attroff(latr) if latr
    $&.scan(/(.*?)(\w+)(:)(\d+)/) do |e|
      eatr = nil
      case e[1]
      when 'rx'
	eatr = Curses.color_pair(1)
      when 'tx'
	eatr = Curses.color_pair(2)
      else
	eatr = Curses.color_pair(4)
      end
      eatr = nil if e[3].to_i == 0
 
      $stdscr.addstr(e[0])
      $stdscr.attron(eatr)  if eatr
      $stdscr.addstr(e[1..-1].join)
      $stdscr.attroff(eatr) if eatr
    end
    $stdscr.addstr($' + "\n")
  else
    $stdscr.addstr("#{t}\n")
  end
 
  $stdscr.attroff(latr) if latr
end
 
def curses_output
  $stdout = StringIO.new
  yield
  $stdout.rewind
  text = $stdout.read
  $stdout = STDOUT
  txt = curses_choplines(text)
  if @color
    txt.split("\n", -1).each_with_index do |li, i|
      $stdscr.setpos(i, 0)
      curses_printline(li)
    end
  else
    $stdscr.setpos(0, 0)
    $stdscr.addstr(txt)
  end
  $stdscr.setpos(1, 0)
  Curses.refresh
end
 
def curses_enter(text, echo = true)
  $stdscr.setpos(1, 0)
  $stdscr.addstr(text + "\n")
  $stdscr.setpos(1, 0)
  Curses.attron(Curses::A_BOLD)
  $stdscr.addstr(text)
  Curses.attroff(Curses::A_BOLD)
  Curses.refresh
  Curses.echo if echo
  Curses.timeout = -1
  line = Curses.getstr
  Curses.noecho
  line
end
 
loop do
  grab_stat
  calc_speed
  calc_cpu
 
  curses_output {
   puts "#{hostname} - irqtop - #{Time.now}"
   select_output
  }
 
  Curses.timeout = @delay * 1000
  ch = Curses.getch.chr rescue nil
  case ch
  when "\f"
    Curses.clear
  when "q", "Z", "z"
    break
  when 'i'
    @imode = (@imode == :both)? :soft : :both
  when 's'
    @imode = (@imode == :both)? :irq : :both
  when 't'
    @omode = (@omode == :top)? :table : :top
  when 'x'
    @omode = (@omode == :table)? :top : :table
  when 'e', 'p'
    @pps = !@pps
  when 'r'
    @reverse = !@reverse
  when 'c'
    @color = !@color
  when 'A'
    @ifilter = {}
  when 'a'
    @ifilter = {}
    @showall = !@showall
  when 'R'
    @showrps = !@showrps
  when '.'
    curses_enter("Pause, press enter to to continue: ", false)
  when 'd'
    d = curses_enter("Enter display interval: ")
    @delay = d.to_f if d.to_f > 0
  when 'h', '?'
    curses_output { show_help }
    Curses.timeout = -1
    ch = Curses.getch.chr rescue nil
    break if ch == 'q'
  end
end
 
ipt-netflow-2.2/snmp_NETFLOW.c0000644000000000000000000004172613213006644014653 0ustar  rootroot/*
 * dlmod plugin for net-snmp for monitoring
 * ipt_NETFLOW module via IPT-NETFLOW-MIB.
 *
 * (c) 2014 <abc@telekom.ru>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */
 
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <errno.h>
 
#include <net-snmp/net-snmp-config.h>
#include <net-snmp/net-snmp-includes.h>
#include <net-snmp/agent/net-snmp-agent-includes.h>
 
#define iptNetflowMIB_oid 1, 3, 6, 1, 4, 1, 37476, 9000, 10, 1 /* .1.3.6.1.4.1.37476.9000.10.1 */
 
/* iptNetflowObjects */
static oid iptNetflowModule_oid[]    = { iptNetflowMIB_oid, 1, 1 };
static oid iptNetflowSysctl_oid[]    = { iptNetflowMIB_oid, 1, 2 };
/* iptNetflowStatistics */
static oid iptNetflowTotals_oid[]    = { iptNetflowMIB_oid, 2, 1 };
static oid iptNetflowCpuTable_oid[]  = { iptNetflowMIB_oid, 2, 2 };
static oid iptNetflowSockTable_oid[] = { iptNetflowMIB_oid, 2, 3 };
 
struct snmp_vars {
	int obj;
	int type;
	char *name;
 
	time_t ts; /* when value last read */
	long long val64;
};
 
struct snmp_vars modinfos[] = {
	{1, ASN_OCTET_STR, "name"},
	{2, ASN_OCTET_STR, "version"},
	{3, ASN_OCTET_STR, "srcversion"},
	{4, ASN_OCTET_STR, "loadTime"}, /* DateAndTime */
	{5, ASN_INTEGER,   "refcnt"},
	{ 0 }
};
#define MODINFO_NAME "ipt_NETFLOW"
#define MODINFO_NAME_ID 1
#define MODINFO_DATE_ID 4
 
struct snmp_vars sysctls[] = {
	{1,  ASN_INTEGER,   "protocol"},
	{2,  ASN_INTEGER,   "hashsize"},
	{3,  ASN_INTEGER,   "maxflows"},
	{4,  ASN_INTEGER,   "active_timeout"},
	{5,  ASN_INTEGER,   "inactive_timeout"},
	{6,  ASN_INTEGER,   "sndbuf"},
	{7,  ASN_OCTET_STR, "destination"},
	{8,  ASN_OCTET_STR, "aggregation"},
	{9,  ASN_OCTET_STR, "sampler"},
	{10, ASN_INTEGER,   "natevents"},
	{11, ASN_INTEGER,   "promisc"},
	{12, ASN_OCTET_STR, "snmp-rules"},
	{13, ASN_INTEGER,   "scan-min"},
	{ 0 }
};
 
struct snmp_vars totals[] = {
	{1,  ASN_COUNTER64, "inBitRate"},
	{2,  ASN_GAUGE,     "inPacketRate"},
	{3,  ASN_COUNTER64, "inFlows"},
	{4,  ASN_COUNTER64, "inPackets"},
	{5,  ASN_COUNTER64, "inBytes"},
	{6,  ASN_GAUGE,     "hashMetric"},
	{7,  ASN_GAUGE,     "hashMemory"},
	{8,  ASN_GAUGE,     "hashFlows"},
	{9,  ASN_GAUGE,     "hashPackets"},
	{10, ASN_COUNTER64, "hashBytes"},
	{11, ASN_COUNTER64, "dropPackets"},
	{12, ASN_COUNTER64, "dropBytes"},
	{13, ASN_GAUGE,     "outByteRate"},
	{14, ASN_COUNTER64, "outFlows"},
	{15, ASN_COUNTER64, "outPackets"},
	{16, ASN_COUNTER64, "outBytes"},
	{17, ASN_COUNTER64, "lostFlows"},
	{18, ASN_COUNTER64, "lostPackets"},
	{19, ASN_COUNTER64, "lostBytes"},
	{20, ASN_COUNTER,   "errTotal"},
	{21, ASN_COUNTER,   "sndbufPeak"},
	{ 0 }
};
#define TOTALS_METRIC_ID 6
 
static netsnmp_table_data_set *cpu_data_set;
static netsnmp_cache *stat_cache = NULL;
 
struct snmp_vars cputable[] = {
	{1,  ASN_INTEGER,   "cpuIndex"},
	{2,  ASN_GAUGE,     "cpuInPacketRate"},
	{3,  ASN_COUNTER64, "cpuInFlows"},
	{4,  ASN_COUNTER64, "cpuInPackets"},
	{5,  ASN_COUNTER64, "cpuInBytes"},
	{6,  ASN_GAUGE,     "cpuHashMetric"},
	{7,  ASN_COUNTER64, "cpuDropPackets"},
	{8,  ASN_COUNTER64, "cpuDropBytes"},
	{9,  ASN_COUNTER,   "cpuErrTrunc"},
	{10, ASN_COUNTER,   "cpuErrFrag"},
	{11, ASN_COUNTER,   "cpuErrAlloc"},
	{12, ASN_COUNTER,   "cpuErrMaxflows"},
	{ 0 }
};
 
static netsnmp_table_data_set *sock_data_set;
struct snmp_vars socktable[] = {
	{1,  ASN_INTEGER,   "sockIndex"},
	{2,  ASN_OCTET_STR, "sockDestination"},
	{3,  ASN_INTEGER,   "sockActive"},
	{4,  ASN_COUNTER,   "sockErrConnect"},
	{5,  ASN_COUNTER,   "sockErrFull"},
	{6,  ASN_COUNTER,   "sockErrCberr"},
	{7,  ASN_COUNTER,   "sockErrOther"},
	{8,  ASN_GAUGE,     "sockSndbuf"},
	{9,  ASN_GAUGE,     "sockSndbufFill"},
	{10, ASN_GAUGE,     "sockSndbufPeak"},
	{ 0 }
};
 
static time_t totals_ts; /* when statistics last read from kernel */
 
static int var_max(struct snmp_vars *head)
{
	struct snmp_vars *sys;
	int max = 0;
 
	for (sys = head; sys->obj; sys++)
		if (max < sys->obj)
			max = sys->obj;
	return max;
}
 
static struct snmp_vars *find_varinfo(struct snmp_vars *head, const int obj)
{
	struct snmp_vars *sys;
 
	for (sys = head; sys->obj; sys++) {
		if (sys->obj == obj)
			return sys;
	}
	return NULL;
}
 
static struct snmp_vars *find_varinfo_str(struct snmp_vars *head, const char *name)
{
	struct snmp_vars *sys;
 
	for (sys = head; sys->obj; sys++) {
		if (!strcmp(sys->name, name))
			return sys;
	}
	return NULL;
}
 
static void modinfo_fname(char *name, char *fname, size_t flen)
{
	snprintf(fname, flen, "/sys/module/" MODINFO_NAME "/%s", name);
}
 
static void sysctl_fname(char *name, char *fname, size_t flen)
{
	snprintf(fname, flen, "/proc/sys/net/netflow/%s", name);
}
 
static int sysctl_access_ok(char *name)
{
	char fname[64];
 
	sysctl_fname(name, fname, sizeof(fname));
	if (access(fname, W_OK) < 0)
		return 0;
	return 1;
}
 
static char *file_read_string(char *name, char *buf, size_t size)
{
	int fd = open(name, O_RDONLY);
	if (fd < 0)
		return NULL;
	int n = read(fd, buf, size - 1);
	if (n < 0) {
		close(fd);
		return NULL;
	}
	buf[n] = '\0';
	close(fd);
	return buf;
}
 
static char *modinfo_read_string(char *name, char *buf, size_t size)
{
	char fname[64];
 
	modinfo_fname(name, fname, sizeof(fname));
	return file_read_string(fname, buf, size);
}
 
static char *sysctl_read_string(char *name, char *buf, size_t size)
{
	char fname[64];
 
	sysctl_fname(name, fname, sizeof(fname));
	return file_read_string(fname, buf, size);
}
 
static int sysctl_write_string(char *name, char *buf, size_t size)
{
	char fname[64];
	int fd;
	int n;
 
	sysctl_fname(name, fname, sizeof(fname));
	fd = open(fname, O_RDWR, 0644);
	if (fd < 0)
		return fd;
	n = write(fd, buf, size);
	close(fd);
	return n;
}
 
static int sysctl_read(netsnmp_request_info *request, int obj)
{
	struct snmp_vars *sys = find_varinfo(sysctls, obj);
	char buf[225];
	char *p;
	long value;
 
	if (!sys)
		goto nosuchobject;
 
	p = sysctl_read_string(sys->name, buf, sizeof(buf));
	if (!p)
		goto nosuchobject;
 
	switch (sys->type) {
	case ASN_INTEGER:
		value = atoi(p);
		snmp_set_var_typed_value(request->requestvb,
		    sys->type,
		    (u_char *)&value, sizeof(value));
		return SNMP_ERR_NOERROR;
	case ASN_OCTET_STR:
		snmp_set_var_typed_value(request->requestvb,
		    sys->type,
		    (u_char *)p, strcspn(p, "\n"));
		return SNMP_ERR_NOERROR;
	}
nosuchobject:
	netsnmp_request_set_error(request, SNMP_NOSUCHOBJECT);
	return SNMP_ERR_NOERROR;
}
 
static int sysctl_write(netsnmp_request_info *request, int obj)
{
	struct snmp_vars *sys = find_varinfo(sysctls, obj);
	char buf[225];
	int len;
 
	if (!sys) {
		netsnmp_request_set_error(request, SNMP_NOSUCHOBJECT);
		return SNMP_ERR_NOERROR;
	}
	switch (sys->type) {
	case ASN_INTEGER:
		snprintf(buf, sizeof(buf), "%ld\n", *(request->requestvb->val.integer));
		break;
	case ASN_UNSIGNED:
		snprintf(buf, sizeof(buf), "%lu\n", *(request->requestvb->val.integer));
		break;
	case ASN_OCTET_STR:
		snprintf(buf, sizeof(buf), "%s\n", request->requestvb->val.string);
		break;
	default:
		netsnmp_request_set_error(request, SNMP_ERR_WRONGTYPE);
		return SNMP_ERR_NOERROR;
	}
	len = strlen(buf);
	if (sysctl_write_string(sys->name, buf, len) < len)
		netsnmp_request_set_error(request, SNMP_ERR_BADVALUE);
	return SNMP_ERR_NOERROR;
}
 
static int iptNetflowModule_handler(
    netsnmp_mib_handler          *handler,
    netsnmp_handler_registration *reginfo,
    netsnmp_agent_request_info   *reqinfo,
    netsnmp_request_info         *request)
{
	struct snmp_vars *sys;
	oid obj;
	char buf[225];
	char *p = NULL;
	long value;
 
	obj = request->requestvb->name[request->requestvb->name_length - 2];
	sys = find_varinfo(modinfos, obj);
	if (!sys) {
		netsnmp_request_set_error(request, SNMP_ERR_NOSUCHNAME);
		return SNMP_ERR_NOERROR;
	}
	if (reqinfo->mode != MODE_GET) {
		netsnmp_request_set_error(request, SNMP_ERR_READONLY);
		return SNMP_ERR_NOERROR;
	}
	switch (obj) {
	case MODINFO_NAME_ID:
		p = MODINFO_NAME;
		break;
	case MODINFO_DATE_ID: {
		size_t len;
		struct stat st;
 
		modinfo_fname(".", buf, sizeof(buf));
		if (stat(buf, &st) < 0)
			break;
		p = (char *)date_n_time(&st.st_mtime, &len);
		snmp_set_var_typed_value(request->requestvb, ASN_OCTET_STR, p, len);
		return SNMP_ERR_NOERROR;
	}
	default:
		p = modinfo_read_string(sys->name, buf, sizeof(buf));
	}
	if (!p) {
		netsnmp_request_set_error(request, SNMP_ERR_NOSUCHNAME);
		return SNMP_ERR_NOERROR;
	}
 
	switch (sys->type) {
	case ASN_INTEGER:
		value = atoi(p);
		snmp_set_var_typed_value(request->requestvb,
		    sys->type,
		    (u_char *)&value, sizeof(value));
		break;
	case ASN_OCTET_STR:
		snmp_set_var_typed_value(request->requestvb,
		    sys->type,
		    (u_char *)p, strcspn(p, "\n"));
		break;
	default:
		netsnmp_request_set_error(request, SNMP_ERR_WRONGTYPE);
 
	}
	return SNMP_ERR_NOERROR;
}
 
static int iptNetflowSysctl_handler(
    netsnmp_mib_handler          *handler,
    netsnmp_handler_registration *reginfo,
    netsnmp_agent_request_info   *reqinfo,
    netsnmp_request_info         *request)
{
	struct snmp_vars *sys;
	oid obj;
 
	obj = request->requestvb->name[request->requestvb->name_length - 2];
	switch (reqinfo->mode) {
	case MODE_GET:
		return sysctl_read(request, obj);
	case MODE_SET_RESERVE1:
		sys = find_varinfo(sysctls, obj);
		if (!sys || !sysctl_access_ok(sys->name))
			netsnmp_request_set_error(request, SNMP_ERR_NOSUCHNAME);
		if (sys && request->requestvb->type != sys->type)
			netsnmp_request_set_error(request, SNMP_ERR_WRONGTYPE);
		break;
	case MODE_SET_RESERVE2:
	case MODE_SET_FREE:
	case MODE_SET_UNDO:
	case MODE_SET_COMMIT:
		return SNMP_ERR_NOERROR;
	case MODE_SET_ACTION:
		return sysctl_write(request, obj);
	default:
		return SNMP_ERR_GENERR;
 
	}
	return SNMP_ERR_NOERROR;
}
 
#define TOTAL_INTERVAL 1
 
static void clear_data_set(netsnmp_table_data_set *data_set)
{
	netsnmp_table_row *row, *nextrow;
 
	for (row = netsnmp_table_data_set_get_first_row(data_set); row; row = nextrow) {
		nextrow = netsnmp_table_data_set_get_next_row(data_set, row);
		netsnmp_table_dataset_remove_and_delete_row(data_set, row);
	}
}
 
static void parse_table_row(
    int			    cpu,
    char		    *p,
    struct snmp_vars	    *sys,
    netsnmp_table_data_set  *data_set)
{
	netsnmp_table_row *row;
 
	row = netsnmp_create_table_data_row();
	netsnmp_table_row_add_index(row, ASN_INTEGER, (u_char *)&cpu, sizeof(cpu));
 
	if (sys == cputable) {
		/* add cpuIndex as column too to break SMIv2 */
		netsnmp_set_row_column(row, 1, sys->type, (char *)&cpu, sizeof(cpu));
	}
	for (++sys; p && sys->obj; sys++) {
		char		 *val;
		long long	 val64;
		unsigned int	 uval32;
		int		 val32;
		struct counter64 c64;
 
		p += strspn(p, " \t");
		val = p;
		if ((p = strpbrk(p, " \t")))
			*p++ = '\0';
		if (index(val, '.')) {
			double d = strtod(val, NULL);
 
			val64 = (long long)(d * 100);
		} else
			val64 = strtoll(val, NULL, 10);
 
		switch (sys->type) {
		case ASN_OCTET_STR:
			netsnmp_set_row_column(row, sys->obj,
			    sys->type, (char *)val, strlen(val));
			break;
		case ASN_INTEGER:
		case ASN_GAUGE:
			val32 = (int)val64;
			netsnmp_set_row_column(row, sys->obj,
			    sys->type, (char *)&val32, sizeof(val32));
			break;
		case ASN_COUNTER:
			uval32 = (unsigned int)val64;
			netsnmp_set_row_column(row, sys->obj,
			    sys->type, (char *)&uval32, sizeof(uval32));
			break;
		case ASN_COUNTER64:
			c64.low = (uint32_t)val64;
			c64.high = val64 >> 32;
			netsnmp_set_row_column(row, sys->obj,
			    sys->type, (char *)&c64, sizeof(c64));
			break;
		default:
			netsnmp_table_dataset_delete_row(row);
			continue;
		}
 
	}
	netsnmp_table_data_add_row(data_set->table, row);
}
 
static void grab_ipt_netflow_snmp(time_t now)
{
	static char buf[4096];
	int fd;
	int n;
	char *p = buf;
 
	if ((now - totals_ts) < (TOTAL_INTERVAL + 1))
		return;
 
	if ((fd = open("/proc/net/stat/ipt_netflow_snmp", O_RDONLY)) < 0)
		return;
 
	n = read(fd, buf, sizeof(buf) - 1);
	close(fd);
	if (n <= 0)
		return;
	buf[n] = '\0';
 
	DEBUGMSGTL(("netflow", "%s\n", buf));
	clear_data_set(cpu_data_set);
	clear_data_set(sock_data_set);
	while (*p) {
		struct snmp_vars *sys;
		char *name = p;
		char *val;
 
		if (!(p = strpbrk(p, " \t")))
			break;
		*p++ = '\0';
		val = p + strspn(p, " \t");
		p = index(p, '\n');
		*p++ = '\0';
 
		if (!strncmp(name, "cpu", 3)) {
			parse_table_row(atoi(name + 3), val, cputable, cpu_data_set);
			continue;
		} else if (!strncmp(name, "sock", 4)) {
			parse_table_row(atoi(name + 4), val, socktable, sock_data_set);
			continue;
		}
		if (!(sys = find_varinfo_str(totals, name)))
		    continue;
		if (index(val, '.')) {
			double d = strtod(val, NULL);
			sys->val64 = (long long)(d * 100);
		} else
			sys->val64 = strtoll(val, NULL, 10);
		sys->ts = now;
	}
	totals_ts = now;
}
 
static int iptNetflowTotals_handler(
    netsnmp_mib_handler          *handler,
    netsnmp_handler_registration *reginfo,
    netsnmp_agent_request_info   *reqinfo,
    netsnmp_request_info         *request)
{
	struct snmp_vars *sys;
	time_t now = time(NULL);
	oid obj;
	unsigned int	 uval32;
	int		 val32;
	struct counter64 c64;
 
	grab_ipt_netflow_snmp(now);
 
	obj = request->requestvb->name[request->requestvb->name_length - 2];
	sys = find_varinfo(totals, obj);
	if (!sys || ((now - sys->ts) > (TOTAL_INTERVAL * 2 + 3))) {
		netsnmp_request_set_error(request, SNMP_ERR_NOSUCHNAME);
		return SNMP_ERR_NOERROR;
	}
	if (reqinfo->mode != MODE_GET) {
		netsnmp_request_set_error(request, SNMP_ERR_READONLY);
		return SNMP_ERR_NOERROR;
	}
	switch (sys->type) {
	case ASN_GAUGE:
		val32 = (int)sys->val64;
		snmp_set_var_typed_value(request->requestvb,
		    sys->type, (u_char *)&val32, sizeof(val32));
		break;
	case ASN_COUNTER:
		uval32 = (unsigned int)sys->val64;
		snmp_set_var_typed_value(request->requestvb,
		    sys->type, (u_char *)&uval32, sizeof(uval32));
		break;
	case ASN_COUNTER64:
		c64.low = (uint32_t)sys->val64;
		c64.high = sys->val64 >> 32;
		snmp_set_var_typed_value(request->requestvb,
		    ASN_COUNTER64, (u_char *)&c64, sizeof(c64));
		break;
	default:
		return SNMP_ERR_GENERR;
	}
	return SNMP_ERR_NOERROR;
}
 
static int stat_cache_load(netsnmp_cache *cache, void *x)
{
	grab_ipt_netflow_snmp(time(NULL));
	return 0;
}
 
static void dummy_cache_free(netsnmp_cache *cache, void *x)
{
	/* free_cache callback is not always checked for NULL
	 * pointer. */
}
 
void init_netflow(void)
{
	netsnmp_handler_registration *reg;
	struct snmp_vars *sys;
 
	/* snmpd -f -L -Dnetflow,dlmod */
	DEBUGMSGTL(("netflow", "init_netflow\n"));
 
	netsnmp_register_scalar_group(
	    netsnmp_create_handler_registration(
		    "iptNetflowModule",
		    iptNetflowModule_handler,
		    iptNetflowModule_oid,
		    OID_LENGTH(iptNetflowModule_oid),
		    HANDLER_CAN_RONLY),
	    1, var_max(modinfos));
 
	netsnmp_register_scalar_group(
	    netsnmp_create_handler_registration(
		    "iptNetflowSysctl",
		    iptNetflowSysctl_handler,
		    iptNetflowSysctl_oid,
		    OID_LENGTH(iptNetflowSysctl_oid),
		    HANDLER_CAN_RWRITE),
	    1, var_max(sysctls));
 
	netsnmp_register_scalar_group(
	    netsnmp_create_handler_registration(
		    "iptNetflowTotals",
		    iptNetflowTotals_handler,
		    iptNetflowTotals_oid,
		    OID_LENGTH(iptNetflowTotals_oid),
		    HANDLER_CAN_RONLY),
	    1, var_max(totals));
 
	/* Register first table. */
	reg = netsnmp_create_handler_registration(
	    "iptNetflowCpuTable", /* no handler */ NULL,
	    iptNetflowCpuTable_oid, OID_LENGTH(iptNetflowCpuTable_oid),
	    HANDLER_CAN_RONLY);
 
	/* set up columns */
	cpu_data_set = netsnmp_create_table_data_set("iptNetflowCpuDataSet");
	netsnmp_table_set_add_indexes(cpu_data_set, ASN_INTEGER, 0);
	/* I include cpuIndex into columns, which is not SMIv2'ish */
	for (sys = cputable; sys->obj; sys++)
		netsnmp_table_set_add_default_row(cpu_data_set, sys->obj, sys->type, 0, NULL, 0);
	netsnmp_register_table_data_set(reg, cpu_data_set, NULL);
 
	/* cache handler will load actual data, and it needs to be
	 * injected in front of dataset handler to be called first */
	stat_cache = netsnmp_cache_create(
	    /* no timeout */ -1,
	    stat_cache_load, dummy_cache_free,
	    iptNetflowCpuTable_oid, OID_LENGTH(iptNetflowCpuTable_oid));
	netsnmp_inject_handler(reg, netsnmp_cache_handler_get(stat_cache));
 
	/* Register second table. */
	reg = netsnmp_create_handler_registration(
	    "iptNetflowSockTable", /* no handler */ NULL,
	    iptNetflowSockTable_oid, OID_LENGTH(iptNetflowSockTable_oid),
	    HANDLER_CAN_RONLY);
 
	/* set up columns */
	sock_data_set = netsnmp_create_table_data_set("iptNetflowSockDataSet");
	/* I don't include sockIndex into columns, which is more SMIv2'ish */
	netsnmp_table_set_add_indexes(sock_data_set, ASN_INTEGER, 0);
	for (sys = &socktable[1]; sys->obj; sys++)
		netsnmp_table_set_add_default_row(sock_data_set, sys->obj, sys->type, 0, NULL, 0);
	netsnmp_register_table_data_set(reg, sock_data_set, NULL);
 
	/* as before, cache handler will load actual data, and it needs
	 * to be injected in front of dataset handler to be called first */
	stat_cache = netsnmp_cache_create(
	    /* no timeout */ -1,
	    stat_cache_load, dummy_cache_free,
	    iptNetflowSockTable_oid, OID_LENGTH(iptNetflowSockTable_oid));
	netsnmp_inject_handler(reg, netsnmp_cache_handler_get(stat_cache));
}
 
void deinit_netflow(void)
{
	DEBUGMSGTL(("netflow", "deinit_netflow\n"));
}
 
ipt-netflow-2.2/dkms.conf0000644000000000000000000000042713213006644014132 0ustar  rootrootPACKAGE_NAME=ipt-netflow
pushd `dirname $BASH_SOURCE`
PACKAGE_VERSION=`./version.sh`
popd
BUILT_MODULE_NAME[0]=ipt_NETFLOW
DEST_MODULE_LOCATION[0]=/kernel/extra
STRIP[0]=no
MAKE[0]="make ipt_NETFLOW.ko"
PRE_BUILD="./configure --from-dkms-conf=$kernel_source_dir"
AUTOINSTALL=yes
ipt-netflow-2.2/ipt_NETFLOW.h0000644000000000000000000003536313213006644014477 0ustar  rootroot/*
 *   This file is part of NetFlow exporting module.
 *
 *   This program is free software: you can redistribute it and/or modify
 *   it under the terms of the GNU General Public License as published by
 *   the Free Software Foundation, either version 2 of the License, or
 *   (at your option) any later version.
 *
 *   This program is distributed in the hope that it will be useful,
 *   but WITHOUT ANY WARRANTY; without even the implied warranty of
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *   GNU General Public License for more details.
 *
 *   You should have received a copy of the GNU General Public License
 *   along with this program.  If not, see <http://www.gnu.org/licenses/>.
 *
 */
 
#ifndef _IPT_NETFLOW_H
#define _IPT_NETFLOW_H
 
/*
 * Some tech info:
 * http://www.cisco.com/en/US/products/ps6601/prod_white_papers_list.html
 * http://www.cisco.com/en/US/products/sw/netmgtsw/ps1964/products_implementation_design_guide09186a00800d6a11.html
 */
 
#define NETFLOW5_RECORDS_MAX 30
 
struct netflow5_record {
	__be32		s_addr;
	__be32		d_addr;
	__be32		nexthop;
	__be16		i_ifc;
	__be16		o_ifc;
	__be32		nr_packets;
	__be32		nr_octets;
	__be32		first_ms;
	__be32		last_ms;
	__be16		s_port;
	__be16		d_port;
	__u8		reserved;
	__u8		tcp_flags;
	__u8		protocol;
	__u8		tos;
	__be16		s_as;
	__be16		d_as;
	__u8		s_mask;
	__u8		d_mask;
	__u16		padding;
} __attribute__ ((packed));
 
/* NetFlow v5 packet */
struct netflow5_pdu {
	__be16			version;
	__be16			nr_records;
	__be32			ts_uptime; /* ms */
	__be32			ts_usecs;  /* s  */
	__be32			ts_unsecs; /* ns */
	__be32			seq;
	__u8			eng_type;
	__u8			eng_id;
	__u16			sampling;
	struct netflow5_record	flow[NETFLOW5_RECORDS_MAX];
} __attribute__ ((packed));
#define NETFLOW5_HEADER_SIZE (sizeof(struct netflow5_pdu) - NETFLOW5_RECORDS_MAX * sizeof(struct netflow5_record))
 
#define IF_NAME_SZ	IFNAMSIZ
#define IF_DESC_SZ	32
 
/* NetFlow v9	http://www.ietf.org/rfc/rfc3954.txt */
/* IPFIX	http://www.iana.org/assignments/ipfix/ipfix.xhtml */
/* v9 elements are uppercased, IPFIX camel cased. */
#define one(id, name, len) name = id,
#define two(id, a, b, len)		\
		one(id, a, len)	\
		one(id, b, len)
#define Elements \
	two(1,   IN_BYTES, octetDeltaCount, 4) \
	two(2,   IN_PKTS, packetDeltaCount, 4) \
	two(4,   PROTOCOL, protocolIdentifier, 1) \
	two(5,   TOS, ipClassOfService, 1) \
	two(6,   TCP_FLAGS, tcpControlBits, 1) \
	two(7,   L4_SRC_PORT, sourceTransportPort, 2) \
	two(8,   IPV4_SRC_ADDR, sourceIPv4Address, 4) \
	two(9,   SRC_MASK, sourceIPv4PrefixLength, 1) \
	two(10,  INPUT_SNMP, ingressInterface, 2) \
	two(11,  L4_DST_PORT, destinationTransportPort, 2) \
	two(12,  IPV4_DST_ADDR, destinationIPv4Address, 4) \
	two(13,  DST_MASK, destinationIPv4PrefixLength, 1) \
	two(14,  OUTPUT_SNMP, egressInterface, 2) \
	two(15,  IPV4_NEXT_HOP, ipNextHopIPv4Address, 4) \
	two(21,  LAST_SWITCHED, flowEndSysUpTime, 4) \
	two(22,  FIRST_SWITCHED, flowStartSysUpTime, 4) \
	one(25,  minimumIpTotalLength, 2) \
	one(26,  maximumIpTotalLength, 2) \
	two(27,  IPV6_SRC_ADDR, sourceIPv6Address, 16) \
	two(28,  IPV6_DST_ADDR, destinationIPv6Address, 16) \
	two(31,  IPV6_FLOW_LABEL, flowLabelIPv6, 3) \
	two(32,  ICMP_TYPE, icmpTypeCodeIPv4, 2) \
	two(33,  MUL_IGMP_TYPE, igmpType, 1) \
	two(40,  TOTAL_BYTES_EXP, exportedOctetTotalCount, 8) \
	two(41,  TOTAL_PKTS_EXP, exportedMessageTotalCount, 8) \
	two(42,  TOTAL_FLOWS_EXP, exportedFlowRecordTotalCount, 8) \
	two(48,  FLOW_SAMPLER_ID, samplerId, 1) \
	two(49,  FLOW_SAMPLER_MODE, samplerMode, 1) \
	two(50,  FLOW_SAMPLER_RANDOM_INTERVAL, samplerRandomInterval, 2) \
	one(52,  minimumTTL, 1) \
	one(53,  maximumTTL, 1) \
	two(56,  SRC_MAC, sourceMacAddress, 6) \
	two(57,  DST_MAC, postDestinationMacAddress, 6) \
	two(58,  SRC_VLAN, vlanId, 2) \
	two(61,  DIRECTION, flowDirection, 1) \
	two(62,  IPV6_NEXT_HOP, ipNextHopIPv6Address, 16) \
	two(64,  IPV6_OPTION_HEADERS, ipv6ExtensionHeaders, 2) \
	two(70,  MPLS_LABEL_1,  mplsTopLabelStackSection, 3) \
	two(71,  MPLS_LABEL_2,  mplsLabelStackSection2,   3) \
	two(72,  MPLS_LABEL_3,  mplsLabelStackSection3,   3) \
	two(73,  MPLS_LABEL_4,  mplsLabelStackSection4,   3) \
	two(74,  MPLS_LABEL_5,  mplsLabelStackSection5,   3) \
	two(75,  MPLS_LABEL_6,  mplsLabelStackSection6,   3) \
	two(76,  MPLS_LABEL_7,  mplsLabelStackSection7,   3) \
	two(77,  MPLS_LABEL_8,  mplsLabelStackSection8,   3) \
	two(78,  MPLS_LABEL_9,  mplsLabelStackSection9,   3) \
	two(79,  MPLS_LABEL_10, mplsLabelStackSection10,  3) \
	one(80,  destinationMacAddress, 6) \
	two(82,  IF_NAME, interfaceName, IF_NAME_SZ) \
	two(83,  IF_DESC, interfaceDescription, IF_DESC_SZ) \
	one(136, flowEndReason, 1) \
	one(138, observationPointId, 4) \
	one(139, icmpTypeCodeIPv6, 2) \
	one(141, LineCardId, 4) \
	one(142, portId, 4) \
	one(143, meteringProcessId, 4) \
	one(144, exportingProcessId, 4) \
	one(145, TemplateId, 2) \
	one(149, observationDomainId, 4) \
	one(152, flowStartMilliseconds, 8) \
	one(153, flowEndMilliseconds, 8) \
	one(154, flowStartMicroseconds, 8) \
	one(155, flowEndMicroseconds, 8) \
	one(160, systemInitTimeMilliseconds, 8) \
	one(163, observedFlowTotalCount, 8) \
	one(164, ignoredPacketTotalCount, 8) \
	one(165, ignoredOctetTotalCount, 8) \
	one(166, notSentFlowTotalCount, 8) \
	one(167, notSentPacketTotalCount, 8) \
	one(168, notSentOctetTotalCount, 8) \
	one(200, mplsTopLabelTTL, 1) \
	one(201, mplsLabelStackLength, 1) \
	one(202, mplsLabelStackDepth, 1) \
	one(208, ipv4Options, 4) \
	one(209, tcpOptions, 4) \
	one(225, postNATSourceIPv4Address, 4) \
	one(226, postNATDestinationIPv4Address, 4) \
	one(227, postNAPTSourceTransportPort, 2) \
	one(228, postNAPTDestinationTransportPort, 2) \
	one(230, natEvent, 1) \
	one(243, dot1qVlanId, 2) \
	one(244, dot1qPriority, 1) \
	one(245, dot1qCustomerVlanId, 2) \
	one(246, dot1qCustomerPriority, 1) \
	one(252, ingressPhysicalInterface, 2) \
	one(253, egressPhysicalInterface, 2) \
	one(256, ethernetType, 2) \
	one(295, IPSecSPI, 4) \
	one(300, observationDomainName, 128) \
	one(302, selectorId, 1) \
	one(309, samplingSize, 1) \
	one(310, samplingPopulation, 2) \
	one(318, selectorIdTotalPktsObserved, 8) \
	one(319, selectorIdTotalPktsSelected, 8) \
	one(323, observationTimeMilliseconds, 8) \
	one(324, observationTimeMicroseconds, 8) \
	one(325, observationTimeNanoseconds, 8) \
	one(390, flowSelectorAlgorithm, 1) \
	one(394, selectorIDTotalFlowsObserved, 8) \
	one(395, selectorIDTotalFlowsSelected, 8) \
	one(396, samplingFlowInterval, 1) \
	one(397, samplingFlowSpacing, 2)
 
enum {
	Elements
};
#undef one
#undef two
 
enum {
	FLOWSET_TEMPLATE = 0,
	FLOWSET_OPTIONS = 1,
	IPFIX_TEMPLATE = 2,
	IPFIX_OPTIONS = 3,
	FLOWSET_DATA_FIRST = 256,
};
 
enum {				/* v9 scopes */
	V9_SCOPE_SYSTEM = 1,
	V9_SCOPE_INTERFACE = 2,
	V9_SCOPE_LINECARD = 3,
	V9_SCOPE_CACHE = 4,
	V9_SCOPE_TEMPLATE = 5,
};
 
struct flowset_template {
	__be16	flowset_id;
	__be16	length;		/* (bytes) */
	__be16	template_id;
	__be16	field_count;	/* (items) */
} __attribute__ ((packed));
 
struct flowset_data {
	__be16	flowset_id;	/* corresponds to template_id */
	__be16	length;		/* (bytes) */
} __attribute__ ((packed));
 
/* http://tools.ietf.org/html/rfc3954#section-6.1 */
struct flowset_opt_tpl_v9 {
	__be16	flowset_id;
	__be16	length;
	__be16	template_id;
	__be16	scope_len;	/* (bytes) */
	__be16	opt_len;	/* (bytes) */
} __attribute__ ((packed));
 
/* http://tools.ietf.org/html/rfc5101#section-3.4.2.2 */
struct flowset_opt_tpl_ipfix {
	__be16	flowset_id;
	__be16	length;
	__be16	template_id;
	__be16	field_count;	/* total (items) */
	__be16	scope_count;	/* (items) must not be zero */
} __attribute__ ((packed));
 
/* NetFlow v9 packet. */
struct netflow9_pdu {
	__be16		version;
	__be16		nr_records;	/* (items) */
	__be32		sys_uptime_ms;
	__be32		export_time_s;
	__be32		seq;
	__be32		source_id;	/* Exporter Observation Domain */
	__u8		data[1400];
} __attribute__ ((packed));
 
/* IPFIX packet. */
struct ipfix_pdu {
	__be16		version;
	__be16		length;		/* (bytes) */
	__be32		export_time_s;
	__be32		seq;
	__be32		odomain_id;	/* Observation Domain ID */
	__u8		data[1400];
} __attribute__ ((packed));
 
/* Maximum bytes flow can have, after it's reached flow will become
 * not searchable and will be exported soon. */
#define FLOW_FULL_WATERMARK 0xffefffff
 
#define EXTRACT_SPI(tuple)	((tuple.s_port << 16) | tuple.d_port)
#define SAVE_SPI(tuple, spi)	{ tuple.s_port = spi >> 16; \
				  tuple.d_port = spi; }
#define MAX_VLAN_TAGS	2
 
/* hashed data which identify unique flow */
/* 16+16 + 2+2 + 2+1+1+1 = 41 */
struct ipt_netflow_tuple {
	union nf_inet_addr src;
	union nf_inet_addr dst;
	__be16		s_port; // Network byte order
	__be16		d_port; // -"-
#ifdef MPLS_DEPTH
	__be32		mpls[MPLS_DEPTH]; /* Network byte order */
#endif
	__u16		i_ifc;	// Host byte order
#ifdef ENABLE_VLAN
	__be16		tag[MAX_VLAN_TAGS]; // Network byte order (outer tag first)
#endif
	__u8		protocol;
	__u8		tos;
	__u8		l3proto;
#ifdef ENABLE_MAC
	__u8		h_dst[ETH_ALEN];
	__u8		h_src[ETH_ALEN];
#endif
} __attribute__ ((packed));
 
/* hlist[2] + tuple[]: 8+8 + 41 = 57 (less than usual cache line, 64) */
struct ipt_netflow {
	struct hlist_node hlist; // hashtable search chain
 
	/* unique per flow data (hashed, NETFLOW_TUPLE_SIZE) */
	struct ipt_netflow_tuple tuple;
 
	/* volatile data */
	union nf_inet_addr nh;
#if defined(ENABLE_MAC) || defined(ENABLE_VLAN)
	__be16		ethernetType; /* Network byte order */
#endif
	__u16		o_ifc;
#ifdef ENABLE_PHYSDEV
	__u16		i_ifphys;
	__u16		o_ifphys;
#endif
#ifdef SNMP_RULES
	__u16		i_ifcr;	/* translated interface numbers*/
	__u16		o_ifcr;
#endif
	__u8		s_mask;
	__u8		d_mask;
	__u8		tcp_flags; /* `OR' of all tcp flags */
	__u8		flowEndReason;
#ifdef ENABLE_DIRECTION
	__u8		hooknumx; /* hooknum + 1 */
#endif
	/* flow statistics */
	u_int32_t	nr_packets;
	u_int32_t	nr_bytes;
#ifdef ENABLE_SAMPLER
	unsigned int	sampler_count; /* for deterministic sampler only */
#endif
	union {
		struct {
			unsigned long first;
			unsigned long last;
		} ts;
		ktime_t	ts_obs;
	} _ts_un;
#define nf_ts_first _ts_un.ts.first
#define nf_ts_last  _ts_un.ts.last
#define nf_ts_obs   _ts_un.ts_obs
	u_int32_t	flow_label; /* IPv6 */
	u_int32_t	options; /* IPv4(16) & IPv6(32) Options */
	u_int32_t	tcpoptions;
#ifdef CONFIG_NF_NAT_NEEDED
	__be32		s_as;
	__be32		d_as;
	struct nat_event *nat;
#endif
	union {
		struct list_head list; /* all flows in ipt_netflow_list */
#ifdef HAVE_LLIST
		struct llist_node llnode; /* purged flows */
#endif
	} _flow_list;
#define flows_list  _flow_list.list
#define flows_llnode _flow_list.llnode
};
 
#ifdef CONFIG_NF_NAT_NEEDED
enum {
	NAT_CREATE = 1, NAT_DESTROY = 2, NAT_POOLEXHAUSTED = 3
};
struct nat_event {
	struct list_head list;
	struct {
		__be32	s_addr;
		__be32	d_addr;
		__be16	s_port;
		__be16	d_port;
	} pre, post;
	ktime_t		ts_ktime;
	unsigned long	ts_jiffies;
	__u8	protocol;
	__u8	nat_event;
};
#define IS_DUMMY_FLOW(nf) (nf->nat)
#else
#define IS_DUMMY_FLOW(nf) 0
#endif
 
static inline int ipt_netflow_tuple_equal(const struct ipt_netflow_tuple *t1,
				    const struct ipt_netflow_tuple *t2)
{
	return (!memcmp(t1, t2, sizeof(struct ipt_netflow_tuple)));
}
 
struct ipt_netflow_sock {
	struct list_head list;
	struct socket *sock;
	struct sockaddr_storage addr;	// destination
	struct sockaddr_storage saddr;	// source
	char   sdev[IFNAMSIZ];		// source device
	atomic_t wmem_peak;		// sk_wmem_alloc peak value
	unsigned int err_connect;	// connect errors
	unsigned int err_full;		// socket filled error
	unsigned int err_other;		// other socket errors
	unsigned int err_cberr;		// async errors, icmp
	unsigned int pkt_exp;		// pkts expoted to this dest
	u64 bytes_exp;			// bytes -"-
	u64 bytes_exp_old;		// for rate calculation
	unsigned int bytes_rate;	// bytes per second
	unsigned int pkt_sent;		// pkts sent to this dest
	unsigned int pkt_fail;		// pkts failed to send to this dest
};
 
struct netflow_aggr_n {
	struct list_head list;
	atomic_t usage;
	__u32 mask;
	__u32 addr;
	__u32 aggr_mask;
	__u8 prefix;
};
 
struct netflow_aggr_p {
	struct list_head list;
	atomic_t usage;
	__u16 port1;
	__u16 port2;
	__u16 aggr_port;
};
 
#define NETFLOW_STAT_INC(count) (__get_cpu_var(ipt_netflow_stat).count++)
#define NETFLOW_STAT_ADD(count, val) (__get_cpu_var(ipt_netflow_stat).count += (unsigned long long)val)
#define NETFLOW_STAT_SET(count, val) (__get_cpu_var(ipt_netflow_stat).count = (unsigned long long)val)
#define NETFLOW_STAT_TS(count)							 \
	do {									 \
		ktime_t kts = ktime_get_real();					 \
		if (!(__get_cpu_var(ipt_netflow_stat)).count.first_tv64)	 \
			__get_cpu_var(ipt_netflow_stat).count.first = kts;	 \
		__get_cpu_var(ipt_netflow_stat).count.last = kts;		 \
	} while (0);
 
#define NETFLOW_STAT_INC_ATOMIC(count)				\
	do {							\
		preempt_disable();				\
		(__get_cpu_var(ipt_netflow_stat).count++);	\
		preempt_enable();				\
	} while (0);
 
#define NETFLOW_STAT_ADD_ATOMIC(count, val)			\
	do {							\
		preempt_disable();				\
		(__get_cpu_var(ipt_netflow_stat).count += (unsigned long long)val); \
		preempt_enable();				\
	} while (0);
#define NETFLOW_STAT_READ(count) ({					\
		unsigned int _tmp = 0, _cpu;				\
		for_each_present_cpu(_cpu)				\
			 _tmp += per_cpu(ipt_netflow_stat, _cpu).count;	\
		_tmp;							\
	})
 
struct duration {
	ktime_t first;
	ktime_t last;
};
 
/* statistics */
struct ipt_netflow_stat {
	u64 searched;			// hash stat
	u64 found;			// hash stat
	u64 notfound;			// hash stat (new flows)
	u64  pkt_total;			// packets metered
	u64 traf_total;			// traffic metered
#ifdef ENABLE_PROMISC
	u64 pkt_promisc;		// how much packets passed promisc code
	u64 pkt_promisc_drop;		// how much packets discarded
#endif
	/* above is grouped for cache */
	unsigned int truncated;		// packets stat (drop)
	unsigned int frags;		// packets stat (drop)
	unsigned int maxflows_err;	// maxflows reached (drop)
	unsigned int alloc_err;		// failed to allocate memory (drop & lost)
	struct duration drop;
	unsigned int send_success;	// sendmsg() ok
	unsigned int send_failed;	// sendmsg() failed
	unsigned int sock_cberr;	// socket error callback called (got icmp refused)
	unsigned int exported_rate;	// netflow traffic itself
	u64 exported_pkt;		// netflow traffic itself
	u64 exported_flow;		// netflow traffic itself
	u64 exported_traf;		// netflow traffic itself
	u64 exported_trafo;		// netflow traffic itself
	u64  pkt_total_prev;		// packets metered previous interval
	u32  pkt_total_rate;		// packet rate for this cpu
	u64  pkt_drop;			// packets not metered
	u64 traf_drop;			// traffic not metered
	u64 flow_lost;			// flows not sent to collector
	u64  pkt_lost;			// packets not sent to collector
	u64 traf_lost;			// traffic not sent to collector
	struct duration lost;
	u64  pkt_out;			// packets out of the hash
	u64 traf_out;			// traffic out of the hash
#ifdef ENABLE_SAMPLER
	u64 pkts_observed;		// sampler stat
	u64 pkts_selected;		// sampler stat
#endif
	u64 old_searched;		// previous hash stat
	u64 old_found;			// for calculation per cpu metric
	u64 old_notfound;
	int metric;			// one minute ewma of hash efficiency
};
 
#endif
/* vim: set sw=8: */
ipt-netflow-2.2/version.sh0000755000000000000000000000164013213006644014347 0ustar  rootroot#!/bin/sh
# This script determines actual module version.
 
PATH=$PATH:/usr/local/bin:/usr/bin:/bin
 
# Base version from the source.
MVERSION=`sed -n 's/^#define.*IPT_NETFLOW_VERSION.*"\(.*\)".*/\1/p' ipt_NETFLOW.c`
 
# GITVERSION overrides base version.
if [ -e version.h ] && grep -q GITVERSION version.h; then
  MVERSION=`sed -n 's/#define GITVERSION "\(.*\)".*/\1/p' version.h`
fi
 
# git describe overrides version from the source.
if [ -d .git ] && which git >/dev/null 2>&1; then \
  GVERSION=`git describe --dirty 2>/dev/null`
  if [ "$GVERSION" ]; then
    MVERSION=${GVERSION#v}
  fi
else
  GVERSION=
fi
 
if [ "$1" = --define ]; then
  # called from Makefile to create version.h
  # which should contain GITVERSION or be empty.
  if [ "$GVERSION" ]; then
    echo "#define GITVERSION \"$MVERSION\""
  else
    echo "/* placeholder, because kernel doesn't like empty files */"
  fi
else
  # normal run
  echo $MVERSION
fi
ipt-netflow-2.2/README0000644000000000000000000010145113213006644013204 0ustar  rootrootipt_NETFLOW linux 2.6.x-4.x kernel module by <abc@telekom.ru> -- 2008-2016.
 
   High performance NetFlow v5, v9, IPFIX flow data export module for Linux
   kernel. Created to be useful for highly loaded linux router. It should be
   used as iptables target.
 
 
=========================
= Detailed Feature List =
=========================
 
   * High performance and scalability. For highest performance module could be
     run without conntrack being enabled in kernel. Reported to be able to
     handle 10Gbit traffic with more than 1500000 pps with negligible server
     load (on S5500BC).
 
   * NetFlow v5, v9, and IPFIX are fully supported.
 
     Support of v9/IPFIX is adding flexibility to exporting of flow data
     plus greater visibility of traffic, letting export many additional fields
     besides what was possible in v5 era. Such as
     
   * IPv6 option headers, IPv4 options, TCP options, ethernet type, dot1q
     service and customer VLAN ids, MAC addresses, and
 
   * Full IPv6 support,
 
   * NAT translations events (from conntrack) using NetFlow Event Logging (NEL).
     This is standardized way for v9/IPFIXr, but module export such events even
     for v5 collectors via specially crafted pseudo-records.
 
   * Deterministic (systematic count-based), random and hash Flow Sampling.
     With appropriate differences in support of v5, v9, and IPFIX.
 
   * SNMP agent (for net-snmp) for remote management and monitoring.
 
   * Options Templates (v9/IPFIX) let export useful statistical,
     configurational, and informational records to collector.
     Such as metering, exporting, sampling stat and reliability stat, sampling 
     configuration, network devices ifName, ifDescr list.
 
   * Tested to compile and work out of the box on Centos 5, 6, 7, Debian and
   * Ubuntu. Many vanilla Linux kernels since 2.6.18 up to the latest (as of
   * writing is 3.19) are supported and tested.
 
   * Module load time and run-time (via sysctl) configuration.
 
   * Flexibility in enabling features via ./configure script. This will let you
     disable features you don't need, which increase compatibility with custom
     kernels and performance.
 
   * SNMP-index translation rules, let convert meaningless and unstable
     interface indexes (ifIndex) to more meaningful numbering scheme.
 
   * Easy support for catching mirrored traffic with promisc option. Which is
     also supporting optional MPLS decapsulation and MPLS-aware NetFlow.
 
 
============================
= OBTAINING LATEST VERSION =
============================
 
   $ git clone git://github.com/aabc/ipt-netflow.git ipt-netflow
   $ cd ipt-netflow
 
 
================
= INSTALLATION =
================
 
   Five easy steps.
 
** 1. Prepare Kernel source
 
   If you have package system install kernel-devel package, otherwise install
   raw kernel source from http://kernel.org matching _exactly_ version of your
   installed kernel.
 
   a) What to do for Centos:
 
      ~# yum install kernel-devel
 
   b) What to do for Debian and Ubuntu:
 
      ~# apt-get install module-assistant
      ~# m-a prepare
 
   c) Otherwise, if you downloaded raw kernel sources don't forget to create
    .config by copying it from your distribution's kernel. Its copy could reside
    in /boot or sometimes in /proc, examples:
 
      kernel-src-dir/# cp /boot/config-`uname -r` .config
    or
      kernel-src-dir/# zcat /proc/config.gz > .config
 
    Assuming you unpacked kernel source into `kernel-src-dir/' directory.
    Then run:
 
      kernel-src-dir/# make oldconfig
 
    After that you'll need to prepare kernel for modules build:
 
      kernel-src-dir/# make prepare modules_prepare
 
   Note: Don't try to `make prepare' in Centos kernel-devel package directory
     (which is usually something like /usr/src/kernels/2.6.32-431.el6.x86_64)
     as this is wrong and meaningless.
 
** 2. Prepare Iptables
 
   Before this step it also would be useful to install pkg-config if don't
   already have.
 
   If you have package system just install iptables-devel (or iptables-dev)
   package, otherwise install iptables source matching version of your
   installation from ftp://ftp.netfilter.org/pub/iptables/
 
   a) What to do for Centos:
 
      # yum install iptables-devel
 
   b) What to do for Debian or Ubuntu:
 
      # apt-get install iptables-dev pkg-config
 
   c) Otherwise, for raw iptables source build it and make install.
 
** 3. Prepare net-snmp (optional)
 
  In case you want to manage or monitor module performance via SNMP you
  may install net-snmp. If you want to skip this step run configure
  with --disable-snmp-agent option.
 
  a) For Centos:
 
      # yum install net-snmp net-snmp-devel
 
  b) For Debian or Ubuntu:
 
      # apt-get install snmpd libsnmp-dev
 
  c) Otherwise install net-snmp from www.net-snmp.org
 
** 4. Now, to actually build the module run:
 
      ~/ipt-netflow# ./configure
      ~/ipt-netflow# make all install
      ~/ipt-netflow# depmod
 
   This will install kernel module and iptables specific library.
 
   Troubleshooting:
 
     a) Sometimes you will want to add CC=gcc-3 to make command.
     Example: make CC=gcc-3.3
 
     b) Compile module with actual kernel source compiled.
     I.e. first compile kernel and boot into it, and then compile module.
     If you are using kernel-devel package check that its version matches
     your kernel package.
 
     c) If you have sources in non-standard places or configure isn't able to
     find something run ./configure --help to see how to specify paths manually.
 
     d) To run irqtop on Debian 8 you may need to install:
 
       # apt-get install ruby ruby-dev ncurses-dev
       # gem install curses
 
     z) If all fails create ticket at
          https://github.com/aabc/ipt-netflow/issues
 
** 5. After this point you should be able to load module and
     use -j NETFLOW target in your iptables. See next section.
 
 
=====================
= Configure Options =
=====================
 
   Configure script allows to enable or disable optional features:
 
     --enable-natevents
         enables natevents (NEL) support, (this and option will require
	 conntrack support to be enabled into kernel and conntack
         module (nf_conntrack) loaded before ipt_NETFLOW. Usually this is
         done automatically because of `depmod', but if you don't do `make
         install' you'll need to load nf_conntrack manually.
         Read below for explanation of natevents.
 
     --enable-sampler
         enables flow sampler. Read below for explanation of its configuration
	 option.
 
     --enable-sampler=hash
         additionally enables 'hash' sampler.
 
     --disable-snmp-agent
         disables building net-snmp agent module, which is enabled by default.
 
     --enable-snmp-rules
         enables SNMP-index conversion rules. Read below for explanation
         of snmp-rules.
 
     --enable-macaddress
         enables exporting of src and dst MAC addresses for every flow
         in v9/IPFIX. Difference in any of MAC address will be accounted
         as differnt flow. I.e. MAC addresses will be part of flow key.
 
     --enable-vlan
         enables exporting of dot1q VLAN Ids and Priorities for every flow
         in v9/IPFIX. It supports outer and second dot1q tags if present.
 
         Any of two previous options will enable exporting of Ethernet Packet
         Type, ethernetType(256).
 
     --enable-direction
         enables exporting of flowDirection(61) Element for v9/IPFIX.
 
         Packets captured in PREROUTING and INPUT chains will be accounted as
         ingress flows(0), in OUTPUT and POSTROUTING as egress flows(1), and
         in FORWARD will have flowDirection set to undefined value 255.
 
     --enable-aggregation
         enables aggregation rules. Read below for explanation of aggregation.
 
     --disable-dkms
         disable creating dkms.conf and auto-install module into DKMS tree.
 
     --disable-dkms-install
         only disable auto-install into DKMS, but still create dkms.conf, in
         case you will want to install it manually.
 
     --enable-physdev
	 Export ingressPhysicalInterface(252) and egressPhysicalInterface(253)
	 (relevant for bridges) in V9 and IPFIX. If your collector does not
	 support these Elements but you still need physdevs then use
	 --enable-physdev-override, in that case physdevs will override normal
	 interface numbers ingressInterface(10) and egressInterface(14).
 
     --enable-promisc
	 Enables capturing of promiscuous packets into raw/PREROUTING chain.
	 See README.promisc Solution 1 for usage details and example.
 
     --promisc-mpls
	 Enables MPLS label stack decapsulation for promiscuous packets. (For
	 IPv4 and IPv6 packets only). This also enables MPLS-aware NetFlow (v9
	 and IPFIX), you may wish to specify with --promisc-mpls=n how much MPLS
	 labels you want to be recorded and exported (default is 3, maximum is
	 10, set to 0 to not report anything).
 
 
===========
= RUNNING =
===========
 
1. You can load module directly by insmod like this:
 
     # insmod ipt_NETFLOW.ko destination=127.0.0.1:2055 debug=1
 
   Or if properly installed (make install; depmod) by this:
 
     # modprobe ipt_NETFLOW destination=127.0.0.1:2055
 
   See, you may add options in insmod/modprobe command line, or add
   them in /etc/modprobe.conf or /etc/modprobe.d/ipt_NETFLOW.conf
   like thus:
 
     options ipt_NETFLOW destination=127.0.0.1:2055 protocol=9 natevents=1
 
2. Statistics is in /proc/net/stat/ipt_netflow
   Machine readable statistics is in /proc/net/stat/ipt_netflow_snmp
   To view boring slab statistics: grep ipt_netflow /proc/slabinfo
   Dump of all flows is in /proc/net/stat/ipt_netflow_flows
 
3. You can view parameters and control them via sysctl, example:
 
     # sysctl net.netflow
     # sysctl net.netflow.hashsize=32768
 
   Note: For after-reboot configuration I recommend to store module parameters
   in modprobe configs instead of storing them in /etc/sysctl.conf, as it's
   less clear when init process will apply sysctl.conf, before of after
   module's load.
 
4. Example of directing all IPv4 traffic into the module:
 
     # iptables -I FORWARD -j NETFLOW
     # iptables -I INPUT -j NETFLOW
     # iptables -I OUTPUT -j NETFLOW
 
   Note: It is preferable (because easier to understand) to _insert_
   NETFLOW target at the top of the chain, otherwise not all traffic may
   reach NETFLOW if your iptables configuration is complicated and some
   other rule inadvertently consume the traffic (dropping or acepting before
   NETFLOW is reached). It's always good to test your configuration.
   Use  iptables -L -nvx  to check pkts/bytes counters on the rules.
 
5. If you want to account IPv6 traffic you should use protocol 9 or 10.
   Example of directing all IPv6 traffic into the module:
 
     # sysctl net.netflow.protocol=10
     # ip6tables -I FORWARD -j NETFLOW
     # ip6tables -I INPUT -j NETFLOW
     # ip6tables -I OUTPUT -j NETFLOW
 
   Note: First enable right version of protocol and after that add ip6tables
     rules, otherwise you will get errors in dmesg.
 
6. If you want to account NAT events (NEL):
 
     # sysctl net.netflow.natevents=1
 
   Note that natevents feature is completely independent from traffic accounting
   (it's using so called conntrack events), thus you don't need to set or change
   any iptables rules to use that. You may need to enable kernel config option
   CONFIG_NF_CONNTRACK_EVENTS though (if it isn't already enabled).
   For details on how they are exported for different protocol versions see
   below.
 
7. For SNMP support you will need to add this command into snmpd.conf to
   enable IPT-NETFLOW-MIB in SNMP agent:
 
      dlmod netflow /usr/lib/snmp/dlmod/snmp_NETFLOW.so
 
   Restart snmpd for changes to take effect. Don't forget to properly configure
   access control. Example simplest configuration may looks like (note that this
   is whole /etc/snmp/snmpd.conf):
 
      rocommunity public 127.0.0.1
      dlmod netflow /usr/lib/snmp/dlmod/snmp_NETFLOW.so
 
   Note, that this config will also allow _full_ read-only access to the whole
   linux MIB. To install IPT-NETFLOW-MIB locally, copy file IPT-NETFLOW-MIB.my
   into ~/.snmp/mibs/
 
   * Detailed example of SNMP configuration is there:
   * https://github.com/aabc/ipt-netflow/wiki/Configuring-SNMP-access
 
   To check that MIB is installed well you may issue:
 
     $ snmptranslate -m IPT-NETFLOW-MIB -IR -Tp iptNetflowMIB
 
   This should output IPT-NETFLOW-MIB in tree form.
 
   To check that snmp agent is working well issue:
 
     $ snmpwalk -v 1 -c public 127.0.0.1 -m IPT-NETFLOW-MIB iptNetflowMIB
 
   Should output full MIB. If MIB is not installed try:
 
     $ snmpget -v 1 -c public 127.0.0.1 .1.3.6.1.4.1.37476.9000.10.1.1.1.1.0
 
   Which should output STRING: "ipt_NETFLOW".
 
   MIB provides access to very similar statistics that you have in
   /proc/net/stat/ipt_netflow, you can read description of objects in
   text file IPT-NETFLOW-MIB.my
 
   If you want to access to SNMP stat in machine readable form for your
   scripts there is file /proc/net/stat/ipt_netflow_snmp
 
   Note: Using of SNMP v2c or v3 is mandatory for most tables, because
   this MIB uses 64-bit counters (Counter64) which is not supported in old
   SNMP v1. You should understand that 32-bit counter will wrap on 10Gbit
   traffic in just 3.4 seconds! So, always pass option `-v2c' or `-v3'
   to net-snmp utils. Or, for example, configure option `defVersion 2c'
   in ~/.snmp/snmp.conf  You can also have `defCommunity public' ov v3
   auth parameters (defSecurityName, defSecurityLevel, defPassphrase)
   set there (man snmp.conf).
 
   Examples for dumping typical IPT-NETFLOW-MIB objects:
 
   - Module info (similar to modinfo, SNMPv1 is ok for following two objects):
 
     $ snmpwalk -v 1 -c public 127.0.0.1 -m IPT-NETFLOW-MIB iptNetflowModule
 
   - Read-write sysctl-like parameters (yes, they are writable via snmpset, you
     may need to configure write access to snmpd, though):
 
     $ snmpwalk -v 1 -c public 127.0.0.1 -m IPT-NETFLOW-MIB iptNetflowSysctl
 
   - Global performance stat of the module (note -v2c, because rest of the
     objects require SNMP v2c or SNMP v3):
 
     $ snmpwalk -v2c -c public 127.0.0.1 -m IPT-NETFLOW-MIB iptNetflowTotals
 
   - Per-CPU (metering) and per-socket (exporting) statistics in table format:
 
     $ snmptable -v2c -c public 127.0.0.1 -m IPT-NETFLOW-MIB iptNetflowCpuTable
     $ snmptable -v2c -c public 127.0.0.1 -m IPT-NETFLOW-MIB iptNetflowSockTable
 
 
===========
= OPTIONS =
===========
 
   Options can be passed as parameters to module or changed dynamically
   via  sysctl net.netflow  or  IPT-NETFLOW-MIB::iptNetflowSysctl
 
   protocol=5
     - what version of NetFlow protocol to use. Default is 5.
       You can choose from 5, 9, or 10 (where 10 is IPFIX). If you plan
       to account IPv6 traffic you should use protocol 9 or 10 (IPFIX),
       because NetFlow v5 isn't compatible with IPv6.
 
   destination=127.0.0.1:2055
     - where to export netflow, to this ip address. Port is optional, default
       is 2055. You will see this connection in netstat like this:
 
       udp 0 0 127.0.0.1:32772 127.0.0.1:2055 ESTABLISHED 
 
   destination=[2001:db8::1]:2055
     - export target using IPv6 address. Brackets are optional, but otherwise
       you should delimit port with 'p' or '#' character.
 
   destination=127.0.0.1:2055,192.0.0.1:2055
     - mirror flows to two (can be more) addresses, separate addresses
       with comma.
 
   destination=127.0.0.1:2055@127.0.0.2
     - bind socket to address (127.0.0.2).
 
   destination=127.0.0.1:2055%eth0
     - bind socket to interface (eth0). May be useful for multi-homed boxes.
 
   sampler=deterministic:123
   sampler=random:123
   sampler=hash:123
     - enables Flow Sampling. To disable set to the empty value or to `0'.
       Note, that this is flow sampling (as of RFC 7014), not packet
       sampling (PSAMP).
 
       There is three sampling modes:
 
         deterministic:  select each N-th observed flow; in IPFIX this mode
                         is called Systematic count-based Sampling;
         random:         select randomly one out of N flows.
         hash:           select hash-randomly one out of N flows.
 
       Number after colon is population size N, with valid values 2-16383.
       (This 16383 limit is for compatibility with NetFlow v5.)
         Using 'deterministic' and 'random' sampling will not reduce resource
       usage caused by the module, because flows are sampled late in exporting
       process. This will reduces amount of flows which go to the collector,
       thus, reducing load on the collector.
         On the other hand, using 'hash' sampling will reduce CPU and memory
       load caused by the module, because flows are discarded early in the
       processing chain. They are discarded almost like in random sampler,
       except that pseudo-random value is depend on the Flow Key hash for each
       packet.
         All required NetFlow/IPFIX information to signal use of sampling is
       also sent to the collector. 'Hash' sampling will be presented as 'random'
       sampling to the collector, because of their similarity.
       Note, that Flow Sampling is compatible with NetFlow v5, v9, and IPFIX.
 
   natevents=1
     - Collect and send NAT translation events as NetFlow Event Logging (NEL)
       for NetFlow v9/IPFIX, or as dummy flows compatible with NetFlow v5.
       Default is 0 (don't send).
 
       For NetFlow v5 protocol meaning of fields in dummy flows are such:
         Src IP, Src Port  is Pre-nat source address.
         Dst IP, Dst Port  is Post-nat destination address.
           - These two fields made equal to data flows catched in FORWARD chain.
         Nexthop, Src AS  is Post-nat source address for SNAT. Or,
         Nexthop, Dst AS  is Pre-nat destination address for DNAT.
         TCP Flags is SYN+SCK for start event, RST+FIN for stop event.
         Pkt/Traffic size is 0 (zero), so it won't interfere with accounting.
 
       Natevents are compilation disabled by default, to enable you will need to
       add --enable-natevents option to ./configure script.
 
       For techical description of NAT Events see:
         http://tools.ietf.org/html/draft-ietf-behave-ipfix-nat-logging-04
 
   inactive_timeout=15
     - export flow after it's inactive for 15 seconds. Default value is 15.
 
   active_timeout=1800
     - export flow after it's active for 1800 seconds (30 minutes). Default
       value is 1800.
 
   refresh-rate=20
     - for NetFlow v9 and IPFIX it's rate how frequently to re-send templates
       (per packets). You probably don't need to change default (which is 20).
 
   timeout-rate=30
     - for NetFlow v9 and IPFIX it's rate when to re-send old templates (in
       minutes). No need to change it.
 
   debug=0
     - debug level (none).
 
   sndbuf=number
     - size of output socket buffer in bytes. I recommend you to put higher
       value if you experience netflow packet drops (can be seen in statistics
       as 'sock: fail' number.)
       Default value is system default.
 
   hashsize=number
     - Hash table bucket size. Used for performance tuning.
       Abstractly speaking, it should be minimum two times bigger than flows
       you usually have, but not need to.
       Default is system memory dependent small enough value.
 
   maxflows=2000000
     - Maximum number of flows to account. It's here to prevent DOS attacks.
       After this limit is reached new flows will not be accounted. Default is
       2000000, zero is unlimited.
 
   aggregation=string..
     - Few aggregation rules (or some say they are rule.)
 
       Buffer for aggregation string 1024 bytes, and sysctl limit it
         to ~700 bytes, so don't write there a lot.
       Rules worked in definition order for each packet, so don't
         write them a lot again.
       Rules applied to both directions (dst and src).
       Rules tried until first match, but for netmask and port
          aggregations separately.
       Delimit them with commas.
 
       Rules are of two kinds: for netmask aggregation
          and port aggregation:
 
       a) Netmask aggregation example: 192.0.0.0/8=16
       Which mean to strip addresses matching subnet 192.0.0.0/8 to /16.
 
       b) Port aggregation example: 80-89=80
       Which mean to replace ports from 80 to 89 with 80.
 
       Full example:
          aggregation=192.0.0.0/8=16,10.0.0.0/8=16,80-89=80,3128=80
 
       Aggregation rules are enabled by default, if you feel you don't need them
       you may add --disable-aggregation to ./configure script.
 
   snmp-rules=string...
     - Few SNMP-index conversion rules similar to fproble-ulog.
 
       Quoting man fprobe-ulog:
 
         "Comma separated list of interface name to SNMP-index conversion
         rules.  Each rule consists of interface base name and SNMP-index
         base separated by colon (e.g. ppp:200). Final SNMP-index is  sum
         of corresponding SNMP-index base and interface number.
         In the above example SNMP-index of interface ppp11 is 211.
 
         If interface  name  did not fit to any of conversion rules then
         SNMP-index will be taken from kernel."
 
       This implementation isn't optimized for performance (no rule caching
       or hashing), but should be fast if rules list are short.
 
       Rules are parsed in order from first to last until first match.
 
       snmp-rules are compilation disabled by default, to enable you will need
       to add --enable-snmp option to ./configure script.
 
   scan-min=1
     - Minimal interval between flow export scans. Sometimes could be useful
       to reduce load on exporting CPU by increasing this interval. Value are
       in kernel jiffies units (which is x/HZ seconds).
 
   promisc=1
     - Enables promisc hack. See README.promisc Solution 1 for details.
 
   exportcpu=number
     - Lock exporter to single CPU. This may be useful to fine control CPU
       load. Common use case: with smp_affinity and RSS you spread packet
       processing to all CPUs except one, and lock it to the exporter. While
       exporter CPU load generally is not high, for someone it may be not
       desirable to combine it with packet processing on very highly loaded
       routers.
 
       This option could be changed at runtime with:
 
         # echo number > /sys/module/ipt_NETFLOW/parameters/exportcpu
 
   engine_id=number
     - Observation Domain ID (on IPFIX, Source Id on NetFlow v9, or Engine Id
       on NetFlow v5) value to be exported. This may help your collector to
       distinguish between multiple exporters. On Netflow v9 and IPFIX this
       value is 32-bit on NetFlow v5 only 8 low bits are significant.
       Default value is 0.
 
       This option could be changed at runtime with:
 
         # echo number > /sys/module/ipt_NETFLOW/parameters/engine_id
 
 
====================
= HOW TO READ STAT =
====================
 
  Statistics is your friend to fine tune and understand netflow module
  performance.
 
  To see stat in human readable form:
    # cat /proc/net/stat/ipt_netflow
 
  How to interpret the data:
 
> ipt_NETFLOW version v1.8-122-gfae9d59-dirty, srcversion 6141961152BE0DFA6A21EF4; aggr mac vlan
 
  This line helps to identify actual source that your module is build on.
  Please always supply it in all bug reports.
 
  v1.8-122: 1.8 is release, 122 is commit number after release;
  -gfae9d59: fae9d59 is short git commit id;
  -dirty: if present, meaning that git detected that sources are changed since
      last git commit, you may wish to do `git diff' to view changes;
  srcversion 6141961152BE0DFA6A21EF4: binary version of module, you can
      compare this with data from `modinfo ./ipt_NETFLOW.ko' to identify
      actual binary loaded;
  aggr mac vlan: tags to identify compile time options that are enabled.
 
> Protocol version 10 (ipfix), refresh-rate 20, timeout-rate 30, (templates 2, active 2). Timeouts: active 5, inactive 15. Maxflows 2000000
 
  Protocol version currently in use. Refresh-rate and timeout-rate
      for v9 and IPFIX. Total templates generated and currently active.
  Timeout: active X: how much seconds to wait before exporting active flow.
    - same as sysctl net.netflow.active_timeout variable.
  inactive X: how much seconds to wait before exporting inactive flow.
    - same as sysctl net.netflow.inactive_timeout variable.
  Maxflows 2000000: maxflows limit.
    - all flows above maxflows limit must be dropped.
    - you can control maxflows limit by sysctl net.netflow.maxflows variable.
 
> Promisc hack is disabled (observed 0 packets, discarded 0).
 
  observed n: To see that promisc hack is really working.
 
> Natevents disabled, count start 0, stop 0.
 
    - Natevents mode disabled or enabled, and how much start or stop events
      are reported.
 
> Flows: active 5187 (peak 83905 reached 0d0h1m ago), mem 283K, worker delay 100/1000 (37 ms, 0 us, 4:0 0 [3]).
 
  active X: currently active flows in memory cache.
    - for optimum CPU performance it is recommended to set hash table size to
      at least twice of average of this value, or higher.
  peak X reached Y ago: peak value of active flows.
  mem XK: how much kilobytes of memory currently taken by active flows.
    - one active flow taking 56 bytes of memory.
    - there is system limit on cache size too.
  worker delay X/HZ: how frequently exporter scan flows table per second.
  Rest is boring debug info.
 
> Hash: size 8192 (mem 32K), metric 1.00, [1.00, 1.00, 1.00]. InHash: 1420 pkt, 364 K, InPDU 28, 6716.
 
  Hash: size X: current hash size/limit.
    - you can control this by sysctl net.netflow.hashsize variable.
    - increasing this value can significantly reduce CPU load.
    - default value is not optimal for performance.
    - optimal value is twice of average of active flows.
  mem XK: how much memory occupied by hash table.
    - hash table is fixed size by nature, taking 4 bytes per entry.
  metric X, [X, X, X]: how optimal is your hash table being used.
    - lesser value mean more optimal hash table use, min is 1.0.
    - last three numbers in squares is moving average (EWMA) of hash table
      access divided by match rate (searches / matches) for 4sec, and 1, 5, and
      15 minutes. Sort of hash table load average. First value is instantaneous.
      You can try to increase hashsize if averages more than 1 (increase
      certainly if >= 2).
  InHash: X pkt, X K: how much traffic accounted for flows in the hash table.
  InPDU X, X: how much traffic in flows preparing to be exported.
 
> Rate: 202448 bits/sec, 83 packets/sec; 1 min: 668463 bps, 930 pps; 5 min: 329039 bps, 483 pps
 
  - Module throughput values for 1 second, 1 minute, and 5 minutes.
 
> cpu#  pps; <search found new [metric], trunc frag alloc maxflows>, traffic: <pkt, bytes>, drop: <pkt, bytes>
> cpu0  123; 980540  10473 180600 [1.03],    0    0    0    0, traffic: 188765, 14 MB, drop: 27863, 1142 K
 
  cpu#: this is Total and per CPU statistics for:
  pps: packets per second on this CPU. It's useful to debug load imbalance.
  <search found new, trunc frag alloc maxflows>: internal stat for:
  search found new: hash table searched, found, and not found counters.
  [metric]: one minute (ewma) average hash metric per cpu.
  trunc: how much truncated packets are ignored
    - for example if packets don't have valid IP header.
    - it's also accounted in drop packets counter, but not in drop bytes.
  frag: how much fragmented packets have seen.
    - kernel defragments INPUT/OUTPUT chains for us if nf_defrag_ipv[46]
      module is loaded.
    - these packets are not ignored but not reassembled either, so:
    - if there is no enough data in fragment (ex. tcp ports) it is considered
      to be zero.
  alloc: how much cache memory allocations are failed.
    - packets ignored and accounted in traffic drop stat.
    - probably increase system memory if this ever happen.
  maxflows: how much packets ignored on maxflows (maximum active flows reached).
    - packets ignored and accounted in traffic drop stat.
    - you can control maxflows limit by sysctl net.netflow.maxflows variable.
 
  traffic: <pkt, bytes>: how much traffic is accounted.
  pkt, bytes: sum of packets/megabytes accounted by module.
    - flows that failed to be exported (on socket error) is accounted here too.
 
  drop: <pkt, bytes>: how much of traffic is not accounted.
  pkt, bytes: sum of packets/kilobytes that are dropped by metering process.
    - reasons these drops are accounted here:
      truncated/fragmented packets,
      packet is for new flow but failed to allocate memory for it,
      packet is for new flow but maxflows is already reached.
    Traffic lost due to socket errors is not accounted here. Look below
      about export and socket errors.
 
> Export: Rate 0 bytes/s; Total 2 pkts, 0 MB, 18 flows; Errors 0 pkts; Traffic lost 0 pkts, 0 Kbytes, 0 flows.
 
  Rate X bytes/s: traffic rate generated by exporter itself.
  Total X pkts, X MB: total amount of traffic generated by exporter.
  X flows: how much data flows are exported.
  Errors X pkts: how much packets not sent due to socket errors.
  Traffic lost 0 pkts, 0 Kbytes, 0 flows: how much metered traffic is lost
    due to socket errors.
  Note that `cberr' errors are not accounted here due to their asynchronous
    nature. Read below about `cberr' errors.
 
> sock0: 10.0.0.2:2055 unconnected (1 attempts).
 
  If socket is unconnected (for example if module loaded before interfaces is
  up) it shows now much connection attempts was failed. It will try to connect
  until success.
 
> sock0: 10.0.0.2:2055, sndbuf 106496, filled 0, peak 106848; err: sndbuf reached 928, connect 0, cberr 0, other 0
 
  sockX: per destination stats for:
  X.X.X.X:Y: destination ip address and port.
    - controlled by sysctl net.netflow.destination variable.
  sndbuf X: how much data socket can hold in buffers.
    - controlled by sysctl net.netflow.sndbuf variable.
    - if you have packet drops due to sndbuf reached (error -11) increase this
      value.
  filled X: how much data in socket buffers right now.
  peak X: peak value of how much data in socket buffers was.
    - you will be interested to keep it below sndbuf value.
  err: how much packets are dropped due to errors.
    - all flows from them will be accounted in drop stat.
  sndbuf reached X: how much packets dropped due to sndbuf being too small
      (error -11).
  connect X: how much connection attempts was failed.
  cberr X: how much connection refused ICMP errors we got from export target.
    - probably you are not launched collector software on destination,
    - or specified wrong destination address.
    - flows lost in this fashion is not possible to account in drop stat.
    - these are ICMP errors, and would look like this in tcpdump:
      05:04:09.281247 IP alice.19440 > bob.2055: UDP, length 120
      05:04:09.281405 IP bob > alice: ICMP bob udp port 2055 unreachable, length 156
  other X: dropped due to other possible errors.
 
> aggr0: ...
  aggrX: aggregation rulesets.
    - controlled by sysctl net.netflow.aggregation variable.
 
 
==========================
= NetFlow considerations =
==========================
 
  List of all IPFIX Elements http://www.iana.org/assignments/ipfix/ipfix.xhtml
 
  Flow Keys are Elements that distinguish flows. Quoting RFC: "If a Flow
  Record for a specific Flow Key value already exists, the Flow Record is
  updated; otherwise, a new Flow Record is created."
 
  In this implementation following Elements are treated as Flow Keys:
 
     IPv4 source address:        sourceIPv4Address(8),
     IPv6 source address:        sourceIPv6Address(27),
     IPv4 destination address:   destinationIPv4Address(12),
     IPv6 destination address:   destinationIPv6Address(28),
     TCP/UDP source port:        sourceTransportPort(7),
     TCP/UDP destination port:   destinationTransportPort(11),
     input interface:            ingressInterface(10),
     IP protocol:                protocolIdentifier(4),
     IP TOS:                     ipClassOfService(5),
     and address family (IP or IPv6).
 
  Additional Flow Keys if VLAN exporting is enabled:
 
     First (outer) dot1q VLAN tag: dot1qVlanId(243) and
                                 dot1qPriority(244) for IPFIX,
                                 or vlanId(243) for NetFlow v9.
     Second (customer) dot1q VLAN tag: dot1qCustomerVlanId(245)
                                 and dot1qCustomerPriority(246).
 
  Additional Flow Keys if MAC address exporting is enabled:
 
     Destination MAC address:    destinationMacAddress(80),
     Source MAC address:         sourceMacAddress(56).
 
  Additional Flow Keys if MPLS-aware NetFlow is enabled:
 
     Captured MPLS stack is fully treated as flow key (including TTL values),
     which is Elements from mplsTopLabelStackSection(70) to
     mplsLabelStackSection10(79), and, if present, mplsTopLabelTTL(200).
 
 
  Other Elements are not Flow Keys. Note that outer interface, which is
  egressInterface(14), is not regarded as Flow Key. Quoting RFC 7012: "For
  Information Elements ... for which the value may change from packet to packet
  within a single Flow, the exported value of an Information Element is by
  default determined by the first packet observed for the corresponding Flow".
 
  Note that NetFlow and IPFIX modes of operation may have slightly different
  Elements being used and different statistics sent via Options Templates.
 
 
=========
= VOILA =
=========
ipt-netflow-2.2/README.promisc0000644000000000000000000000675513213006644014672 0ustar  rootrootHello,
 
If you wish to account with ipt-netflow module traffic mirrored on switch you may follow
 one of these examples:
 
 
   Solution 1: Promisc-hack module option. [2014]
   Solution 2: General kernel patch. [2008]
   Solution 3: Alternative w/o kernel patch, using bridges. [2010]
 
 
    **************
    * Solution 1 *
    **************
 
   No kernel patching is need anymore! (As in easy.)
 
   Compile module with `./configure --enable-promisc' option. This will enable
  `promisc=' module parameter and sysctl parameter `net.netflow.promisc'.
  Set any of these to `1' to enable promisc hack, you will see dmesg message
  that it's enabled, set to `0' to disable (default).
 
   This option turned on will pass promisc traffic into `PREROUTING' chain
  of `raw' table (same as with promisc patches). Briefly it's like this:
 
   # cd ipt-netflow/
   # ./configure --enable-promisc
   # make all install
   # iptables -A PREROUTING -t raw -i eth2 -j NETFLOW
   # sysctl net.netflow.promisc=1
   # ifconfig eth2 promisc
   # grep Promisc /proc/net/stat/ipt_netflow
 
   Now you should be able to see promisc observed packets count increasing.
 
   Note, that enabling module's parameter promisc=1 will not enable promiscuous
  mode on network cards, these are completely different things. This option will
  let iptables to see promisc traffic. That traffic will not be routed anywhere
  and discarded just after passing PREROUTING chain.
 
   Do not enable this option if you have kernel already patched with promisc
  patch, as this may cause double accounting. Just keep it disabled or remove
  the patch. Promisc patching is completely custom and non-standard, so if you
  did not apply it - you are most probably safe to use promisc option. But, if
  in doubt - measure if module seeing traffic in raw/PREROUTING, if it isn't - you
  don't have the patch applied and certainly safe to use the option.
 
 
 
    **************
    * Solution 2 *
    **************
 
1. Patch your kernel with `raw_promisc.patch' to enable raw table to see promisc traffic.
 
 # cd /usr/src/linux
 # patch -p1 < ~/ipt_netflow/raw_promisc.patch
 
 Then recompile and reinstall patched kernel.
 
2. For example you mirroring traffic on your Cisco switch to 47th vlan:
 
 # interface FastEthernet0/32
 # description this port with vlan 47
 # switchport trunk encapsulation dot1q
 # switchport mode trunk
 # !
 # interface FastEthernet0/33
 # port monitor FastEthernet0/32
 # !
 
3. Enable promisc mode on interface to actually see the packets:
 
 # /sbin/ifconfig eth1 promisc
 
4. Configure vlan on your linux box:
 
 # /sbin/vconfig add eth1 47
 # /sbin/ifconfig eth1.47 up
 
5. Compile module:
 
 # make clean all install
 
6. Load ipt_netflow module:
 
 # /sbin/modprobe ipt_NETFLOW hashsize=160000 destination=127.0.0.1:9800
 
7. Direct all packets from 47th vlan to ipt_netflow module:
 
 # /sbin/iptables -A PREROUTING -t raw -i eth1.47 -j NETFLOW
 
Voila.
 
ps. For Debian Squeeze instructions look at raw_promisc_debian_squeeze6.patch
 
 
 
    **************
    * Solution 3 *
    **************
 
By Anonymous.
 
> raw promisc hack is not needed
> there is a more elegant way to capture port mirrored traffic:
>
> 1. create a bridge of eth0 and dummy0
> 2. put eth0 to promisc
> 3. add a "-i br0 -j NETFLOW" rule to FORWARD (possibly also -j DROP after that)
>
> ...for some reason it works when ipt_netflow is attached to a bridge, but
> requires the promisc hack when attached to a real promisc interface.
 
Sometimes you may need to run:
 
 # brctl setageing br0 0
 
for this scheme to work.
 
ipt-netflow-2.2/murmur3.h0000644000000000000000000000171213213006644014106 0ustar  rootroot/* MurmurHash3, based on https://code.google.com/p/smhasher of Austin Appleby. */
 
static __always_inline uint32_t rotl32(const uint32_t x, const int8_t r)
{
	return (x << r) | (x >> (32 - r));
}
 
static __always_inline uint32_t fmix32(register uint32_t h)
{
	h ^= h >> 16;
	h *= 0x85ebca6b;
	h ^= h >> 13;
	h *= 0xc2b2ae35;
	h ^= h >> 16;
	return h;
}
 
static inline uint32_t murmur3(const void *key, const uint32_t len, const uint32_t seed)
{
	const uint32_t c1 = 0xcc9e2d51;
	const uint32_t c2 = 0x1b873593;
	const uint32_t *blocks;
	const uint8_t *tail;
	register uint32_t h1 = seed;
	uint32_t k1 = 0;
	uint32_t i;
 
	blocks = (const uint32_t *)key;
	for (i = len / 4; i; --i) {
		h1 ^= rotl32(*blocks++ * c1, 15) * c2;
		h1 = rotl32(h1, 13) * 5 + 0xe6546b64;
	}
	tail = (const uint8_t*)blocks;
	switch (len & 3) {
		case 3: k1 ^= tail[2] << 16;
		case 2: k1 ^= tail[1] << 8;
		case 1: k1 ^= tail[0];
			h1 ^= rotl32(k1 * c1, 15) * c2;
	}
	return fmix32(h1^ len);
}
 
ipt-netflow-2.2/CREDITS0000644000000000000000000000572013213006644013346 0ustar  rootrootLicense is GPL v2, is the same as of Linux kernel:
 
   This program is free software: you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation, either version 2 of the License, or
   (at your option) any later version.
 
   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.
 
   You should have received a copy of the GNU General Public License
   along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 
Sign-off rule is that of the Linux kernel:
 
  Developer's Certificate of Origin 1.1
 
  By making a contribution to this project, I certify that:
 
  (a) The contribution was created in whole or in part by me and I
      have the right to submit it under the open source license
      indicated in the file; or
 
  (b) The contribution is based upon previous work that, to the best
      of my knowledge, is covered under an appropriate open source
      license and I have the right under that license to submit that
      work with modifications, whether created in whole or in part
      by me, under the same open source license (unless I am
      permitted to submit under a different license), as indicated
      in the file; or
 
  (c) The contribution was provided directly to me by some other
      person who certified (a), (b) or (c) and I have not modified
      it.
 
  (d) I understand and agree that this project and the contribution
      are public and that a record of the contribution (including all
      personal information I submit with it, including my sign-off) is
      maintained indefinitely and may be redistributed consistent with
      this project or the open source license(s) involved.
 
 
Principal author and project maintainer:
 
   ABC <abc@telekom.ru> [2008-2015]
 
 
Compatibility layer is using code from Linux Kernel and should be
attributed to respective Linux developers.
 
MurmurHash3 is based on smhasher (2012) of Austin Appleby.
 
 
Patch authors and submitters:
 
   Ilya Evseev [2010]
   spizer [2010]
   Eric W. Biederman [2010]
   Giedrius Liubavičius [2010]
   Igor Alov [2010]
   Alexey Osipov [2011]
   Pavel Boldin [2012]
   Alexander Demenshin [2013]
   uropek [2013]
   shaman [2013]
   Jeremy Drake [2013]
   Matthew Martin [2016] DKMS fixes
   alex-eri [2016, 2017] OpenWRT compatibility
 
 
Reference or prototype code authors:
 
   Valentin V. Yankin [2011] SNMP-index
 
 
Project supporters:
 
   Summa Telecom [2014]
   Starlink [2014]
   Anonymous
 
 
Extensive testing and other help:
 
   Alexander (shulik) [2013]
   Igor Diakonov @ Summa Telecom [2014]
   Yuriy Dolgoruk @ Summa Telecom [2014]
   Andrew Savin @ Starlink [2014]
   Alexander Zakharov @ WAW Technologies [2015]
   Ivanov Eduard [2015]
   Maciej Zdeb [2015]
 
 
(Send your names, emails, or nicks to add to the list.)
 
 
 
Generated by GNU Enscript 1.6.6.
 
 
 

Rev 2057	Rev 2483
1	`nËÉVì=ù{ÚÆ¶ùýâW/Á[ã<Ú'¼ÚkpÜ$µ4=jñÒ4ÿû=giXÄâyß_?GËÌ³ÍÙfFµ¡îÒ°çx7z)_*¼xß&üöövØ¿ðÿ]K»»¥ííÝE¸Ú\|Av^<Ã/`	1	`ipt-netflow-2.2/0000755000000000000000000000000013213006644012322 5ustar rootrootipt-netflow-2.2/Makefile.in0000644000000000000000000000671013213006644014373 0ustar rootroot# Edit Makefile.in and run ./configure`
2	BÃ'äïyá¬vóÞÿýÙcòo´:z³Þ9<:ùM?näw#ÿÝÝíùooöö¤ü·K[ 'ÅMP²ù]þOþÓu2)rM{FjõÃF³Ñi4Ûd¿LêoMhvÜ:9í´5¿ãÚÙQ]oÔêÍN£ó!GNþ§^íèzT½È ©¿»cßÑ%ÝåH^R/E¼¤x1ôíZæðôä´ÇëÞ>n°þöÛÓ³VN]=9n5Íj}´Sõ¤yÈzZÝmÑò]µyv¬wª¬Y§þ¾sV9Â~¿"1'Í©ÙÁÐ1îÚ¡o»pk´âZ{@GÇêTßhLª&SÈ»1Æ°!*í~ÖªU:õÉ6Û¯%ÿÎrOßVWptTùc@©SÂÍÃ-DaßóWBíì£k#$!uè7Èû¦eÕ $×ÔlÏ%Aßt)ñº¡a»Ô"=ßh~ýBÁ7nòvØºQ@}Ó¹aÞôÀQ°sÍÈjÛZ½]=·@ ÛéÓq]#í	2
3	`®q ¨xÝÿ¥fBïy>¡ÎEcrE}:dàYCsä¦o}b¤o_öµÌúÐç¹Fë°ñ}HEhG¶Ýæ!UoxçC·¬ëyOþ{q?aË#Û¤n@÷ÉÛÖ é´þk£ ôd¤ÐÐzI¶áÚ¡m8Ä§×6r>/ àôù¢j8ÙÚÛÞÛ%¯)Âä«¦Á´ìxCrD¯h]W4ês(ÃgáZuØ¨`	3	`KVERSION = @KVERSION@`
4	`À£ºÀ'íÐí ´ÍE»FºW=WryÁþ[4R· E@©óÉu¨»À`	4	`KDIR = @KDIR@`
5	J©Ë^.´$Ð=æø íª4&Ëöï3#ÆÃÊ{½RÖÛíO K÷\ç÷èT:gíù>¨ÀYÂ9Ap¸\|VQq^q=³úk{½ðÆðilI¼ aJó)9WÆØÀ7]=°]Ã¿»¶LkÏ`æ=WÅ<S1,H,«ö<áo#>ín`ìY ½(MºwÄ>úÒ =Û1¯N#\|NÊnlf=ÓsR ivêoaÖ~Ñ2bï¬í¬çâ»×k¯ñÎöìÛµâæ:ëûu*Õ7¾ÒÅÔ½%±	5	`KINSTDIR = $(shell dirname @KDIR@)`
6	´¶#¯s`¡ËÌ³¬§,d³³oýÀþ.&¢3°Úl72¯hdJÀ;FøÏp øÄ4Ì>=¯ãwX{ÖãÁ¸·YÇØatú¶¸F§Å\|zÍk£A¸AÕ4¼æÌÂ¥(@üÔi«0ykÃæÈMy°i? Äò40C¸V7ê-7'îï¶Çfêµ³C6+f£»èZ=ÛÃù%°¬ß=?$ê°CÃpÆÙèî1 ¿¼ôéåó¡[QÆñf#ú#Sc0tÀ<m1Và>aãl è~\|gc`ª×2¿£¢Ý¥ËÚA?ûÃTbtøkyA[?ê×H5Hbz7ðv ù¶Ö6Ñ¿QßÉÁ5cLÖõ£uï9 *d+_ÿØù·Ôxô óê^Ô¹uu¢ày4³yÜÒm×¢·$U	6	`KOPTS = @KOPTS@`
7	`>sÐåAµi¸:hãý¢À%Z2÷KÎ\|éÐñBÃY$#U ¹3<°ÃSPãâ I+úÄ®7!Ù®ÖXãni3ïÎ.FtTá!X >°n8ÎIXË@W56QF¤gÈú?)Ib¨qªg#Â&¢©åC(ñºXz$×:Sk4édl©Â¹7!qI @Ê$O^&0rQPï ÊËTòDyÁÖ}©=i0hùN3í[jÕìëâæ&³$U]>f£Ý:ª\|Ðß"YK/e°$Ë ¡áB7¦=ÁUæWNP`	7	`IPTABLES_CFLAGS = @IPTABLES_CFLAGS@`
8	`SpæLÎ*H?`	8	`IPTABLES_MODULES = @IPTABLES_MODULES@`
9	©D>KþÔ)Üöãô0O Ðq7Q Ö2FÉIèb~K®ÐÈõ\]6¼±ëÈXuîÑõ®äbº`veV\|Lw?ÛööÎ»!Èìc1¤P6L1»w¬f¤°²=IÙ\|JØ#Z8xÂñi`[<¼#@ü	9	`DEPMOD = /sbin/depmod -a`
10	b !c}GÃtB.bçù§Ç!Vb´õ¦;Â×Â áØâñôõ@ÁÇ Gïè¾=&é»`&2GÀß3i0Ãüó@»~[®,va£S^"q÷2O	10	`CARGS = @CARGS@`
11	+âÀpèBß-AØ·&Æf!c}Þ`¦ç[³d´-HùöfVLTBðØ¢Nàä*ÔéÍ nGÑÀogzÅq»]»\|á'øÆ4(1L hÉkß .Æ!¶h?8ñÑ2Ä(Fo+{êûR:«Õò\|?&uNdA,Ü¹fß÷\/B¼Y3»pµCÏÐ8îA×Õ¼Ý¼ýæ³§tæ'mÊÎU!,¶3Ëü(iÿÆýÑ£ÎB)©Ð=Q§z¸A@2Qù	11	`SNMPTGSO = /usr/lib/snmp/dlmod/snmp_NETFLOW.so`
12	ÍõßpÕQ¹ØL,ZÔ¸Z§Þ[Çë¢Ö·ö ©6BÌsk´qs?¬eþ(´s¨{ögÐ+·´ÀcW[g`;ã¢ÛhÙ®::,H©<¶ëÿ:«7«urrHj¯ºúwãåH°B:9Ð5`.Xð¥¾>bZI2¡W¢&ÐI-> â5±ëÉpq&<jd® ¨Ñ¬Õßg¾s5XøëT:c0!Nâ8R6_4¡mpFësê¤)#¯EÈíðéöÙÃ©ïÞÅõRQÔ¼e*ÿ§¾Mò#×Ì$G^úÆeÚ»ãx©Å¢yfÔ8bÙÍ«ÔµÍ\|~{óõîúwìðáØÆpù0~ÊôÕ£ã9·þH,2sÎËcZhfÞgQ¢J1Q³¢ºÌÇ;s7Ãâðaeá¹c¾5&åpO Å^-ñGÖKUGÀvLÀ¬Àg:ú3üG{ÖïÌßÍ+ÛfÒ+¶Kïü[ V» »ÚÜ	12	`SNMPCONF = /etc/snmp/snmpd.conf`
13	Ï³(ÐbÇ2Tí)TýZ>{¹ËX¥ÒÍ¡â¡»ø²lCÍû¥<Áúu5zÈ§FÇP÷¡XóB§â¼ïq¸X]0¾Ì/ròyøüçlÊ{jäð\|/^â,ÐfZsÉ()©E[$+iÙ¾¿GzÝ3¿ª%RÑ#Fi~ñ¨ØÏO2beHó¬4#ÍXhÄ°'2 \|SK6½n³Qñ ÓºÃü¨z®KÍp2<ï#ÇI}YÅb@êÛÜ÷<ýmåÜãÉQòæÐQSßb]a$ÆC,û§÷ÑúXÍØ3½DÞEsí1vK.n¦tM.xWÝ:)³NÍ\:J±Kwþ6Bä\¾«q7s[ÛâVºÐÑe)Ú%ã©}G2X0¤!ßæÉ;û²/*VQ'Ä`Ðpµ+h»4¼ñü+\Çªtê 1HxØ¹Ëðùüü¶ÀãÔÒ2]	13	`SNMPLINE = dlmod netflow $(SNMPTGSO)`
14	`±UûFÃ7v´%HËpaÒ°ê6®{'áìK XsÙ¹°mÉSóRøÉ%ª2X`	14	`CC = gcc`
15	@ÎFêá<V¡ç` æ¶£j	15
16	`ZÂ§¦¢¬6 §;7 R¨KÈöçBUeòû´{7V8gµ£bèÚ6H£zÜl æògWáóOÎ9?l3ô¸ OaÎ<Ì÷$æí[ï§t%_£rw)X4 @"±1D¸Ü5©öNË¬ÅuüuÜ#ÛëA2Þü /²G G7üÜÄW¨ hµÙÒq²e,p±Y÷Ìó}Xa¼>§eØR¯ù>»s"Âå/Çy&Ë×£ì±ñdìxA²çÛ&îñÀáQöLaÊY3Ú;¦e(²} 8B<Éõ6 òcá³}¸£ÚÆãËsãM(g\I_2³2¶öáál´È¾eæèÜ·àË_Âqr^YUJÝÊ8 TV9Ò/$Þ¬U:'§øû6>ãçü59õ9ß>ù/6M>\q`	16	`# https://www.kernel.org/doc/Documentation/kbuild/modules.txt`
17	`{ªÄSü"¶POÃmä³Êw5xâÆÇýà*9¯`	17	`# https://www.kernel.org/doc/Documentation/kbuild/makefiles.txt`
18	7ò8h]»T·WT'NQB®ãX+µ<bxÉÜ.åJ¸=/u' ³¢eÈ»&G{°?Cç.åÉ>º`@äÁ ¼§àÒi\| !>Êá¬ùQï<Íäa\|q'Yú`·¥ñ¶cvÍJ9Î~^o°Æ#nd_e»¤¸ýÝwâN¾Q6xñ; ,ÙU´	18	`obj-m = ipt_NETFLOW.o`
19	qe¸äb\|,utKHI©s½³µzkb¹u¾8äêBN\$YÈ}ßJBG÷ü¾6ÂlµÌoe-6¾Ãúc\|Ã*ñ¬Ã-ÁºÉõÙ¼Û¬#ÍgÞXãOx6+nD0y©ò£ÿä»â¶-MÅ¨·y°¤J-Sf¬a©J½YÓ^\|ÿ=î÷¬«Atª÷ÈßÿJÿþÓææviüûOÛÅííïßz_«Rý¥ò¶~Þ¬×Ë2hÃ(è[äÂ²}öåJûÝyûäì´Z¿Ðd¯_ë§ø1òE¾ B¥\|Ð¿ÐÞÐÒÎGsB2ð7?Oúh`â÷G'Uö©#lSà(Ð[ßµv>v=í¸òWTý<PþÊËjÓú9Z+góTaûSu¿o¤£bëø´¼Âá^äô(Ìj³ÎI£ êè¨\|Gíÿíü·]ÃØ²\|ïÿíJÛãßÛ×ßçÿ3ü^½,tm·ÐPI{Å÷¦ocÅÖ¡ËèB)ââ«z¤öËqlJóÎ»ò	19	`ccflags-y = @KOPTS@`
20	þÝGhû(ð]ñ=®~:ìÂùH²+Å,)ÃDÅó\|¤Ïo°ºé5ûÉÉ7XêÇùÌÆÏç!L Î(4@Làâ½µCRÔz6Ãê¥øÄÎòSÁ¢×k°¥~(~I>x±<w5$}ãrÖ$/¬¨ÁÎ± ft0NIìv'Ð=6oÊJ¸òi#eãá yµ¶afW¾üs¿ô5û$ÙÊ¸ûù3ùáÐ0ò]²-\úFÞW &«Ü+\)îRâ@(!Ìã8vrTk¶ËÙøÕðreõ»JåµÆr£üE ß3u±®ñ®FVÓØ·âòÿüÌ±6üY^[±qæº¼òåÏÅÏ_ÅõõåË}¼d",@×YVÐD pý¼FÀ[¤_qåË+Ödù¤ò_4ÎI¾2,Ý%\|ÉsLñZÊ,«Õ¦ :fåûVbzNWô)×÷)-kn¤O ø E¶ñþÈwu k!UÃe2=Ûµ¸Z/fªhã¡Ú¾®dèDÈ µ}K`Ï92T!oD¡e;sê¨\:ôÝ Ù/$t²Ó±=ÌeG ý(È¡0£ÇvFøø_S<yMn<ß·ÅÂ³'n49òIöÂ_×³èQæ¼fsBÿ´tþ\$æêB!:î¨ëq[)4Ñ)bÛUfòll6W$A!Q? ÕuÀY:MËteçÑó(40¬»? ºßKKpN(K2;/Ã±Ù9Ð&ó3`§jFfæÄ4ì3{ò)SOjo ¨ä( 3HÔtÉ¸ölÙxÇ6Ã«u\{û÷cañçJóvtyI\ïÂÃµDWÙ¸¬ol@Åæ3ðçdØ\"h'ÝÜl'7ÕÆßjÌïLð4© eH"¶-VEôJÑ¯IW¢´ò3ÃIVB¸éX0!s6Ú6¸BS§ç54Øh#ÿÑì&ÇõlÓz¥¶ÁcØþð6èÃ=ÌWÐä$Å/¼¼cÃøüé<ÀÐÃ3ós&fXÓâ¹äø÷¢ÎßÿÅå³}ÿ}»¸WÏÿ¶K;¥ïùß3æý= clg+>ã ¾ê4ånL±ñ_×vVÂÇßË7òÂêkø	20
21	?gâ¦üÔúW}ØV/´=? ælmeYYF²ÁHÄAØ~"]'8ªîâÀ¿W+§oÛàg>å7>>ÃÕ¸ûèß÷FÜñ;âå"{È(BÞ¼Ñh`ì£çc&>¸ú:>Ý'+\%+ãU}Ü?ù<QèÍ>Ö yQ«Ó>þ,M:9À=[íSóå² ì`%°¤++Ñ1ÓÃ0HV&ÝÈv¬xÏöµ.«ü´Ð+Gõöù§õO?cþì®þ\@~ò1.â :ä{åz7®tÈÙ"$`½Ê7ìz2Ä6dÍ»Zz³þüÛægü}Wl°á 0×Ï>®Ë?"¼&Æ\%ðçÝÅò¡9ÆRÐmH§òçðä¼Ö8%Y®nY¡oØá"¡ZÒc#,\|¡ÒÃ569ô×Ex,rtêÇ¤ ÝÎ>=ÇíÉ `4qú ÈCüüËåòPt9_Å.¶ïºÒB-Æp¶·By¹aRxß¹\|þôOëù/«n¾gô¨Ón7Øâé8à¼Y[±]±]Sp¶ 9åaÿc\ÜLqE®Y:±ø+²ÿO©i÷lj+9Äì¿¼¼_½DØÓ`¯.uwÂkH+8¢È¬Y´g@b6:õãá ´gG^ê Iù4ìé¥LÿÓ<ïR¹-òÂ¡öÇy=¡cú0×°åPb=_ÇcàÇØ®'D±ndyØ8÷³jAp®·K÷=	21	`all: ipt_NETFLOW.ko libipt_NETFLOW.so libip6t_NETFLOW.so @SNMPTARGET@`
22	ì»¬®áÌî*Ú¼&p1¥p¦RÊÜ<ÀßØa«Ì7r6 ¸b@sÅ'ÄEb¬{SD~èE®5éÊ È±®¢/_)ÎµKéømì®Ê+ÌüF_'J#þÍ!ÉîÉañbaÊ9hÚ9×´Ñ Ôó·ÊiS¸(k±¼èhj>µPþöµ¹ãÈÏÀ¯A,°II¤¡&!EDdeK`I"ÂË»HÆñSÊ©+_ì$uu_î'Ü¸O×ÝóØÙHÉ>¤D«`¦»çÝÓÝÓÓáæqàFÞ5¥çÒPh O8êT>.Y}ÍRg%¿Å9À©ñÍI2<k9à0Õ¹õ9Ï¡k¢nRû^-Ù7 è$©	22
23	±J`ÌãÞL<#wÚUÉWxÏØ,DòæhZ8ÃÉÑÅh{ÈÑ ÆiSÀqJyMîîZO,ÖÐ0ÑeÛ¨ìç¤ªpbOÎ¤¾LÅ0v«.K¸T£}§7MAG6M»¸ÄÄ#==¨í¶Õ¯Ãön¢Ò?®8ñÆ+O\×½I ÒUÅBÛ»ÕÌP¡8ÀábÁ"2<+F&&ùÄ±¸iÃNßåï±n·þ9¾HUßéîÕk; t»é»Ràùt%÷8Ã÷q{}Þë1§'~³Ãæ3i\|ó§S]ù:£ ãö%è	23	`ipt_NETFLOW.ko: version.h ipt_NETFLOW.c ipt_NETFLOW.h compat.h Makefile`
24	`Ôn+¦\|4'[s&¤IÄ\¶!] .1§8lIá¿íRê¿\|o\5ë4LwQ®-RëÊQåõh BU"$ûßÅÆFÎÒ{]uÈjÍ¼ÄüUùQ'§8±æeå]à`	24	`@echo Compiling for kernel $(KVERSION)`
25	`P1"¦eªà ªô°uý¶ËWØ#@")@Ò~À7^0@êÕøÊ-~ÿjhË&»÷Ué[¹§®Ä£¹Adôo\|#º!?öB6ªe±ßeMÿÒóH¸âw¾à4¤Ãàwö5~8ùL\OÓòÞ$ðZÖGüê 7Í O D`	25	`make -C $(KDIR) M=$(CURDIR) modules CONFIG_DEBUG_INFO=y`
26	`¡6ª Ô.¡åcf®ÜÓ·9³C½d§q,ëÅejú¯ðOö3ÿ¡Ê&ìLà¦N¥`	26	`@touch $@`
27	`ÝùA§*~'b¤$©.\|Ì¯áàÀbuFª#1çZl\|Ðìª8tÈ`	27	`sparse: \| version.h ipt_NETFLOW.c ipt_NETFLOW.h compat.h Makefile`
28	þ¬Sètà¥à¸Øï°õûÙû{PY8MÑ·eÎïÛlÚÀòÀËzÓ-X!+Ö80µñúQËÀïÃ¬q[Ô×ÒzU÷dN´3:I¬ü¶?MÂ[Wþz>J¬¸?\ÁâÚXaLX)ùª¾°½¡¶xS\|Zÿz¦°!fT$0¤Ú/üiXõ7 ®¹Ä¸#5¨ÛÂWD--ÌM:ÆoûØR"«£ÐÙä\|Uº[X±º hÜ¡ÚÂ3Õ¥Ë` ¸Ûé{ËËìâYøÔèµé9×5u\ÿÌ±TÄî Ö(DÃG×âEf¨w5ßYÄy'Bb]³bSùýf-C5IËäé1cÒ*U-)¡¶Ëî?ê:`¦%/mSÍèi²=Þ1}eý+wÜ5·¼GEÊD°P¼ÇÕ©ÂJØSH)ZâáMþnï{NO8Î¢¡ED«0~dýÒ«pþßÆJù/ªÜK4b ,R¯eÃx±Îìâ²»áVN8ëg<s¼á¬´nÓ:HfuE£ÔÂá-þæ½DtÌG1J çS-qµj4\íàé²Heäõ¼~?ÀàKÃÚ6É$«?âÏ¨&x3«þ$çµ&kôoÏû«©ããIôÌÉnVY}èc äÎ;uÀûA¬-^tZW¥ÈZ	28	`@rm -f ipt_NETFLOW.ko ipt_NETFLOW.o`
29	`ÌYhúãZº¸Çå3IfU§ú£EøÂ+²¨R¨ººï÷¼i8"Ï=l´)« ³Dµ)H8I¥<5k²¡w`	29	`@echo Compiling for kernel $(KVERSION)`
30	`[2¢³Jò¼^\(ùXm©\ZÔåÊÀäÀRéXJ ï×³;P<Åg¾wþ¸C±jüå0ÊIÆ$ÿÕ}ÜÄR#ÁvèÏüáõbÊ·ö-Nçxy ·)&Co&roÎ«'òZõz]¾9¤ÉáJ£«TqÕÈUs«ÚÎÕ!º¦;]ÏùCÍù·¢óèË\OÕñÉ4x"?¾^V´ÚqþªÈd$íhàpübî;P/CöÍá¸ÕnnNè$A¾äØ¾Ô)ÇG8î¶ÐXTrÄÍ xÿ ô ÚZ½T·YëÄqÿ.ÃFÇAKµOÆAÎG".X qõí¹ÒÙÄsÈ!b·kÀ@øuvè[£¹ÛÝ«µ÷ÑºNYë&×vwãQï`	30	`make -C $(KDIR) M=$(CURDIR) modules C=1`
31	°ÖñÑa£ [ªsÅDÐ-&¾vÅâoüìîÔ[è%óNåÛxsi^RqÜ®*ÎY¤xp[{/Û;õçÑÃ.îkÞ=znt¸Éd©KÚûVTï7 &¹..C6(fú FxÁksáw£%Ã;&o1ÎD9\á<ûY(+ç¼ I?Ö<YëßÿèÀ\WÒ¼ÊËª4Æo¼á /zP6»Üj3¢Ü¬v<ÒÆ¦3Õçj2+æäC/å¥¼pìê Òn¨ÍXH:>Øh&9î,ûâí#ÌdVõ-å QZ»êMGkÝáûë9÷H&Ñ¶O\|úþ=ZQGDU 2Ð¥»øEâÙ QPQhyzS[}Ö,ß_2X:ÏÐ°hÐÐ¾"®"&#îï½¨²Ie_¹>ëz´q/Ý»ëæ¸¡ë+`UyóGë$¢yüº%¤;,)2ìUö¯\òqÜð\2sÕ>lüG;UiÊ	31	`@touch ipt_NETFLOW.ko`
32	`Ntó J9V±:4uµl.lPº;5UzZqó¨òö3vL éÀ ^B9s¥mÎÄjÕÃøñOäx #Jzbd¹Ù>²I!:(<cö`	32	`coverity:`
33	y£t³·]D9*ÃÎbP¯^y`yzyjÅq3 ÑÒÛCÜÝl¸1Û$Y_ð¥8i0ÙuÔ^,j=xÀ³ÍÓ¸ÄÉÚÐº2CCDA)	33	`coverity-submit -v`
34	+bê2Èhò&Àr4fÞ4Úù³Qr¾v Íà¾CÞSo<èEÖwiu7¬úÈè!llÂ"âRD¾7<IMSáffSjY^§(dg¼KåèºÝ2ÚðÅ:çÒTò8gÀzÜn0!Ýè°%ðEhlSû2C»ÑþîrWÑZÅ7Þ£UïpÐqÓ1ÛHÏn8÷°¨½¦^à«6F¾ÏÆä2X?î][ò6l[g5ÀËè(ôXvÄ¹Ôz§Ê½ºÄÜa/¼UéY~Ìª¨eX~¨i EiãñøÎKÍìaè5&Ý¡Óç1X¿(NgN "Í§ª¾2ö¦kc×ð\&´Æ_âÁ;¿ä4NG"¢ÚQEºuìÍ·j_0ñ+&v^#P$5Ûª[æ8iläçnµÉæGl D/N!Ä\6iÒÂÝ¿µòp®ûx ±[5Z)ýÝ$È\|µRªf^°òåÄå@ÇuîôBówÌíÃF¬ úxîóæJ' ¥hyk@ÖàÓB9f°VT¢ ¬cîC a(k¹qd/µÈµù_¼åJ03ÂRGa¨W7BV'16s:_ãé¶_¶·;©T*ÃãEÆÇLt¥íîÓ6#S^	34
35	Ú\|ön³^ß©ï²é'ÃÂ·fç¸¶½ßã£ÄíåÖó ¬r£õf#1{iJ'Tf0ÝDh©ðgX%`û..v+YbûtP/ý(¬=£ÒqÆJÙ¼ÐÍ×Å»ãVÉsáÌ÷@JR~ÚI Ïú¸UbøxèÎ^íy½{pÐhwny~on¾{Ü®o?;nt^v÷èÈp<r"¢FhAéÔwëªø%ãÑD"®´´hb®q)È<&±WkÇÝülÑ»í$ó$a¸3VV0½ñDÝf¿¡¾ÜoÌ³[¸T ¦#Øó¾ð¦××b\|äU¬íìT3ýÉ&3$91}Â¢6iNaÊøõ~ÿí&}ëê\uIQQEÇf`SZPs½l. oëGCÝÙIVÉü¸¡SméÈ½_¯â%öÏïR»Þ±Âú!è};Y±ÅZl%Ë^^^ºòDÂÓÐ¨¶C#1.-¬Ö'Ph¿)çqçzöÌÅª¬]â^`¡ª"Ò´2è-Xè«X<v£°î8Ï'S<&:§k¢$NùUGôÌ@¯\Å$½nfíyj\|xºHN,6±AîÖ û£õ#ßs£J2¿7¶i@2Í[0 éÇ²åw$V3KtN~JOm]LúZÐ¬ü¨Ì#»Ð4Ì8,x4M®²Æ¾-hÍ§ç×÷3çÀÞT]µ« v\|&±Ø_ã'¸¬ÂÂfÁåeVoÕÐØrÜ:éqîÓñ\|8 Ù®ßÉpqë¿ÕÉùô¹ÞBÍyý²µ>ïio _î^lGáÁ\ìðFkÅ3å\|¬BðGåîñp<éªÕ6®}º4¬ÍïK¿+nØsBßveöHÄqìÜ-þêG©»ROK£)7yî+-÷Ê!âìÔ¥.K&`qÓ0ve°ömrA±ÛzÌ$¤Î%õétäúY£IíÎ	35	`minstall: \| ipt_NETFLOW.ko`
36	Bf¬tòõÔ]îd°àîEê®°»D2PF¶°¸£,(ñºê.µ3CáÊïC!vU@¿H5¼2c_=¥¼R¬)ÚNÞPÛ®W3¯Òá't`úä?8½³EirD!Y~90R	36	`@echo " *"`
37	`2u/LÂOmýÐrÅÙâÈ×äk¿D¾íõ@¼ì\|îÎ³ùw&ümHvTBßÝÉ(?´¢hïªx2Y2cöXýJóe§».QLKW¢ÆÉPäëNFQpiß@þk.ÅCè"Ð\2LÝççÌ¼_Ü;þËhÀ¿{ñÇYÿ·ô TÅÿ-ÿùAþ`	37	`make -C $(KDIR) M=$(CURDIR) modules_install INSTALL_MOD_PATH=$(DESTDIR)`
38	9vHC¾<;õB¾©]ÌfÓp³óÄ¬óÉäf:HdPnFèòìbµ9daµétè^»,W.4£Ø{Ý®7¼ô®y ñnÞ\|0UÊÝ³a¥E>?R¯ò§@ÂCZMo-ÐÙVö}ú)$Á¦_?fÙJ9°ºEÆJ< ® ÄÀ?Ç%2.¨öU] ÙÒÆþÌUYñêáºÚó6N·JÐ+=¿²¾£ j}¡WÎ®Xh¢(à[îµ-{AÁ ýq,-B5·Ò{%Fë=òËýõÒV L¥ÓëqÜépÒ{8¹7RËb]eb W%¾¦è)t:ÅC=ø¹Uh:£´ØÚà¡I©Ý,¦¨éýû,íÎ³Òú~+oq@wyÌ[g÷¡íþÆúÚÆéÆÀ}Na³Ìú@ks«ªBÐaKÎb}>a^r©lb+¡>Hâò8AiðyvÙÈ.QöC[2r_bÙ<Èµë[5³Ä¾(}=ÅÁoÿ+ð.»Â7Î¢8òøÿÚ ;þ3n ùÿøKÏ¨äúÜ´zÎ}_9Ë×·ããé½xú,ÝdGxépÀ§A2³Û}B/Ä&â9Ryªá±¬@1ÆáaÝ Èú>®P Ó¬~åñÚòöHjîûáÃ!:n¢	38	`$(DEPMOD)`
39	`¥îÇ85Ö:®=Yp9ÜùÀ0vûÈïIO@9Âo7`	39	`mclean:`
40	`°8`	40	`make -C $(KDIR) M=$(CURDIR) clean`
41	`é5øì+ÓùÌû®tãgåbñ¡S\|àÖX±´¹^Ú,?rå»Ev¿¸V,¦ïº¦Eþm°ÒÚf±¼YÚÑ{ò9ó¥2»ìÉ´$Îyì/úËÁÇÊÃ¦ ìÒHí_<:¦r¢+.Ý)ÈÓKÀ$u"l/ð¦ð'Òb@Cü?xFþìkBkòÆÞð^bt5´úl6\|}ê<¾ug×SU«_¨wºG½úñÞQ»³¡¿ó ÐÆm¥ÕÌF«iw?ÛË6Züëaã3È8®o×ÏëíUì¦åãVöú´^x/ìsð;Ïv¶ºµÎÑac{ukÖ\|vp{Á¿^üG¼×«½«Ðûòÿz±h¿ÿ±^Ú¨\|äÿFþOÃòD´SÇàS@#Ô§ÞiïÉÌú¯'#7?4þ#Eà.B¼îPà÷¦O/R1õ£Qo¢£9¼b¡ëJ89]Â`	41	`lclean:`
42	Ü¤=£1c`üµÓù^sõÆývpvÍ))+(²'`d£¿ë³Ýæ3¶ëýÀ²ÖütØÁ çyP8¦:Q·9%Äyõhz0	42	`-rm -f .so _sh.o`
43	`ÏÄßSbþ^äTY²A]â8,pDò{àz>º]3¼³¥wCÔÚ¾\|¶ûb2õUH2Ôç9<yÑèìÁ.ÇjÍìEíø¸Öì¼Ü¢C ôª@ÇÎêñjÐÖÞxvM8Ò8¬oïRí³ÆA£óíÇOf½ÝfOl£µãNcûÙAíµ·Úu±¶OÁ¤9%Ý}Fcª6sÙhÈ+ö>ó@^ß<7À$£3¯Ö¥.Y_(þ3¢nª-¨çx\|ÈÇ¢R ÈFcÂY0q/IÐNëc0@# ÖL3öÿ3÷:,'QmØÁÍt/zÌÁäàA6q4¦óÈ(+éycXgi´Æu·vê©B:À.Ý5·¤êsx´SZ+ªmÚÇ¯d»@+Û, ,®+ÎÄW¢ëã«Þù[JeW+«ieD½ßhuºõfçøe*½Ñh¥dòà½£ÐÌÛ4v`	43	`clean: mclean lclean`
44	`P¥¤R«<Þ!M^Ü{Pt$fÙµÐS½³d¥ñÕëfdØAQQ8«ð/AÀÂãÎo¾·úí%ûÝ ÇodÛàat³sz5Î¬f<ñ}#ßzyÖÙårü&O¹¼ +>çÜmÆrêkÇãÒþµ.d9ê9o÷¨¾¹ÿ¯{®¦5{UI¯"µ zÐY£&Tl°Ìjqi^ÖÈQo&Ð"ð Tù§Æjç#?ôGÊ¡¨±ôex\|ß/rÇþ,0.Yçñ·7òñ·$ÁDytRÍEÌ¥£¿j´²ÅUÀPzáïd' ú ~ÁYBß0IH^Ê'Z`	44	`-rm -f .so .o modules.order version.h`
45	á`opüF5±¤ü ô´^	45
46	`EUñ+¹`	46	`snmp_NETFLOW.so: snmp_NETFLOW.c`
47	A/h¡}s&Än7ËûvVªM£# 9!EëÉbZÙOÄÐ`}ÿ1þ¿mÿë	47	`$(CC) -fPIC -shared -o $@ $< -lnetsnmp`
48	Oðë¹ïÿÁßxo{à ú_¹¼¾nêåR±òà£þ÷aìíÀ¡+4ÌÜ¥{À´ùH³P½&szÍZÞp9ê'o6Óé£1è1ó<`õXùA¥2°->Ø\ÛØ¬[Ü~·PÙe0ùéÇéÇì_ÞþýïÿýåíOÿxû#ûîÇÙ_ßþý¾ÿéßßZµa?÷Ë[Êüó_©	48
49	`(À¿^ôü²ýrkòkD/>-®.àILê#ïÜ']¥ì¬;Þ¨¿±Æi+SÈ-hdÄå4àß%»è®UÀuó²>.Î´Ä>e·ÿß·?üøö»ÿþ¯·ÐAÔì»?ÿéûz]-nx^k^³ÿ{û×üíÄùÛþóþæ±8ï1'OñNI²qÚ@ª ÐBi]B:U.9¥²S¬°âÙaKÝ´dÛao[Nc§ðë¬ôh³TÙ\3-¼ei}XÉ?d÷ù$ì9í½7Y!¯»§sè±ÙEâ8ÍR¿Ê`	49	`sinstall: \| snmp_NETFLOW.so IPT-NETFLOW-MIB.my`
50	`ËRïhEBÚIÝÖæJifÖû \|ÝAuTÿ¥î³ÖN·uha%v¡çñs5ÏLsmQIüëãvýOßÿÿ½?]l#GEáûWz`	50	`@echo " *"`
51	`XÕ¶I¢Dj)[²]EK´ÍSÚZ¤kiOE&¥lL63)[SöyïîÝX°f"IÊåîé3ßÔL[L @D^4Zö7cÑùïîNfý¯moïíþÏúÿ¯øOÍ°ys~,nëÔEìÒ)?'fÃ»}´@þFç¶ßêÔöÙ.wb»ú-NkÿüYí>©½ç9íê·9£ýV'´««íèj¼Ãb:ñu¶×¿ñûpú8á4y¬ø³itEçäôÕZ×áME¢ÁÒ°"ÏÀ¦èý{Ø2[¢Gî¨fª¥Ô-onAñÙÎ1éuwæSZÚñ4ig w·äñ`	51	`install -D IPT-NETFLOW-MIB.my $(DESTDIR)/usr/share/snmp/mibs/IPT-NETFLOW-MIB.my`
52	u.6(»¦wµÉìr¥îdÖº94ýKÇ3}jfF¼9@G/=4B»Øîk6¡7¿ámÏzdI«póC`â$µ óÀÀMÃ°Øè¡ç!DCTÂüïNðñ4¢¾6KC5±ñÙf«Â¨8Ó,ÄO$U°åhUYiÖÏé\| bõ->OÒl<Dß-ÑÉÂÀT@Q3y²ýV<]ÔnbHX~z¬ýyõµßZ	52	`install -D snmp_NETFLOW.so $(DESTDIR)$(SNMPTGSO)`
53	ÔBØ¨ÛlHKbjµäU#À¤â4µêíÎG};ÑÒÜ/õËDÍB}Õ½RÈÙSòÒíÚËqÈ¢»'¡ lWy!×ir/$hBJ7ïª]]´I5bÇ-ÕùÄ@ØFM¤¼(J4£nDá7è -B÷D\|c¯_ôV-Ó¹Æi{\89KI¢ãá-F]]=}Ñ÷Ü3øSÞzK4´)/·W¹ÛWñlE`{²ûðÆ#ØøEÑ0JqÕºÄgØäÍ8Ù^E£4ÈÇ¥D¿WõábcÄ¢¼,ÓW2ËfÔHmZÂmSÙc"M§,7;a"hè`¡M¸½á]W4oa)¸ÅfÖ¶>`j2þPæéªxÓÉ{iÓ¤Øq4»ìÞFÿïÿ?L~ë	53	`@if ! egrep -qs "^ *$(SNMPLINE)" $(SNMPCONF); then \`
54	`ú¼1í`	54	`echo " *"; \`
55	ÃðSx'Îh"ÓkÎç¯â!p%×5xW>Á_ËÜmÊ¡ë+!¹î9álÖ<¢=·L^]%#(~oo¯aÿD[,BÙgÜI?wøä~,~®ßºãY{íq3\|§;¶=º¢\Ôf@ð"¥ J0loTÒêjý8£L9ì"º¨©» \ÏÑMÙjuñQÔ½ÇÐ?VþÛlA7ÄCÝÌlûÓ=»ÞB[ÌíÐó·îÍuwJõþÒøõ®Çñ0¾Bæ]&ñ¶´5û³.H ~ÒíEáßÅßúá¥J]]-µCèÒñzÖpê¹ÁGhÚ[í~_-ô¼üoÐ6ÿÅÈ75ÿ_°ÿÛÞÞÍÙî@ÿÙÿýìÿi;Câ÷2átzZ,.í¾à¢Ce}´º@ýC.W¢ç,B´È}GFÆâ6¬ïÁJÞÕ¾]"Úæ"µx±,$4î.ö¶^U\|vxvrNN9è1x«ïÕr¦Ìiëü¯ïG«ß +Jè»,~_])\¾t.?¢¼÷[sókòëòAºIì[M,> d¿+¥ aç¸4OZÓ2:¦my»t[¶ÿ$Ú	55	`echo " * Add this line to $(SNMPCONF) to enable IPT-NETFLOW-MIB:"; \`
56	ïwü Öýªõ¦fk`ØdEd"×¢O d6/ïÒÔÊpZ½^C`ì0´wÍt2Ç=³tZ§ïìTñ«/Îåõö§ÔcÌ"þWÇpF<?5/NÇµT¯ìUê»åÕÙÕÚñ @#{Áe¸]_Y&öÇÞû\|D îÚÇ¿í´=¸wWÍÙFãbPßÙH6£4I§°#¥¤;ÑeÈ,D`åx§üºÞØ)[£pÚ¢ [úTÙ/Õy<VF#LS·Áyðt«^³'¸º²õééÓÆS<jÛípzbÜ{ÿµuú×Z'%Êgµ-DÙaÍ[ô¿Fã¿ùbu,V¿w±m,¶½ XëÏ/Î:gÁÉ[çUÚJm{7kXåøRbá³ìn×í¹ýªùúì¢YßÛ®>Uî``+wr~ãeÃ2¾¯áöSÓ\|µ/²ÄlWjßW¶lb`WÈø<ut%oÎ¹Q0¶°É£ºïØ®<crU%´ä×<Kãiv{×<ñM'y©²AÒþò¥ÌÑÔèlWU·f¼ÔLâ¤Ò«ôËþ3§Ô`¬åy`c~ü6µØÓ)ÀZú#ÒôT¤ÙöÜppÄw%U>_¾RÈÙª¦Ý»£sX¬¢¶½£8Fa%=ö6?Ï()Ü djEtËYB'ÀbôN¶ÆÎúÐßÑk;Ìé÷èÅÚ3{&O¦°G>\|Áð¿òFN)ËòÔ6Zþ¹]×½ FÝO3ÉÙÇ¡0QÂ´pLcç=,¤K Tííí%\|+ÈÐøÐ¸+Ë9#ÐÆqüg8ÍÚ©ÀòâÙD,í¸Çdû øÏ%?;Ì¹Ã;CñÊÚ¥@RÒ>AÔ ©Pd¿nîlWê8:9héuÇÃÇ\FJÔ%<SýVòuø«ïáUÞ¨/ÖáêîF»Ý¼èÓãR_°âì>ö_øxl¼´+¯®¨aÚhuÚïÎÏ±0è@Tä±Gÿ}¯_5¯ÀßHÌ\Ö;ggÇÁv³c^Ï§¢DmCdX^ }o $º¶c ¦3Àÿ6^ÒWÅço/ó·g 4NòÊÊÓúVA^pÞ:oB~-+$T«Ùl¢¦¶»C`²Vní\|]ÓëVÓõ2C	56	`echo " *"; \`
57	`I ~Uj Ëè÷~xz¿èNd={øµ:o! ålV©_ÎêÄ÷(,Ó¿ªÏ¶w-ß6`	57	`echo " * $(SNMPLINE)"; \`
58	^7ZÇ+[ÙÔ³VjY-øfëôçÆ±§ÔÖ"ºòÊ]°YJ·)0òg{Éfp\|vØ8Z§¨äÐÃÍ]G¿a óf ß®`	58	`echo " *"; \`
59	`ñ®IË++X¥d!A±½âÈÊ?F¨-Rr´µ;ybÄ¯x\r¡Ðt`	59	`fi`
60	£!èù\|¤}f¢ÃÆx6ÎØ"ká¬wÍÚäÜ5ÛTvÈ±ö°u " s<AIì«®ôÿ¾>t´ÖÿÖ´áp:)¥7¨§Â&¹ÐlXàfA øg©H¼¥¶ jCTÎ`ørÿiªZT$ÉnãÙ(À`4îU¬¤qÚN»B¸ð¦óÌ4ðïmwÌMãLv?ÅÞÎ%(EÒ¶ëÖÌAÅGWû-N)öL"Æº"ýêIßÐü´ ÍQ Á»?»¼\|ìíÞPXñ¬S¤è#ÃÂ´8°XIz<ÞVÓ[Xû{P.Mäï>ãR?âq%b¢¶µµx$ Ò/Fz8ô4Ël]Û©Kèa%²d	60	`@if killall -0 snmpd >/dev/null 2>&1; then \`
61	üÍv7ÈÎm ` ËTMû×Å ìÅóæEÅauÁ¦x§òÈi£E^É¶¸È÷Wt±«Îï¥[,ÓE³b½+ê"êlÌ/y_§Yíe[Ï¯f(£ºC°y¬ífµ=AÓ]ãLø¥ WÉ¤8¢]C@_b½<q%{qU°iÂ-Ö²U¸UG-_ÕÞnØ®	61	`echo " * (snmpd needs restart for changes to take effect.)"; \`
62	Àª ªjQÇ¿(P(ÑâuÌ~ñNÿëì¢ì¬Ïë0É?´`ÝjtÛMCµÒóîõÞ2I8öäuØð1zÛj~MQÉ63R#Ê £_($2ö¢^±n²7.rTúdXc<KIõÈ97§ª(ä=çRÐA (7Øx)ÑýnÚ= t¦%r¦éU Öâü«Ê!k_@¢í!ÅãÚ(éN&!@Ë Ûíjí)êemkKn»Sëá¯	62	`else \`
63	\|3-¯ÖÑ4Ò&é´ôRËù£/Kõö¸i^zê±ákRfÒë``à<5Ý0Oì#	63	`echo " * (snmpd is not started.)"; \`
64	`C{GØuðé4á~wX?C×Ï:9´ÙÝ!þòíÔ¢äÅÔÜ:øãË»eºðÊÊÖ'vA´µµj>Ä¦:¶FhF5{ÌèdïÄ ÙÃÿzÃýÛ.vÂÐÌ àÇ^Éyi©ëYOºµÌÛN;¯nyûÊdÑä]kÆ¤U,BR_¤®ÏA¢É-ß)á?f°ê<B*6^&êª©"0¥n¥ÃP8Pm®ÐI2©¬!òD0!ÆÑÑEï'ÚêX8Iæ\|8Ë¢B%ëû/ïÝÂñÛùgßâá[8zÏ]¶¯¨o« _1Ú½egöNo4¾ùïÂ×ªoüsTÃJ`	64	`fi`
65	`LW²Øb»¬Iåýößüó¥°Ïò]¶¸Ç`	65
66	`¨IÒx`	66	`%_sh.o: libipt_NETFLOW.c`
67	`{Ëy½fÃÌé=È.î¸ù½EëójÉ X ÁI0è¢áíL+ÅÆ¡[;Áåì[0Ëf B{ÅEö¬"Æñà¾1>Ý;ïÚùëQë >>ìuø4Xm\]1z¤ôg£ ¯8Ì¤D"ìÅOE í/_Ç[IÅOÐq?{l/'ø4A°×¸ ñÇp`	67	`$(CC) $(CFLAGS) -O2 -Wall -Wunused $(IPTABLES_CFLAGS) -fPIC -o $@ -c libipt_NETFLOW.c`
68	ÀJáShº.M÷1l0î§>ÉçåAsõ`ÿ·9KñeÑ¯=d8ý!µÜ[oå@lºâðìþ%5¡¾ßUcLTÝù£Õ/hÔûBJôÑÉë\¸n	68
69	Ó)ÁrkAJïèÒûÊÉv?ÕEª^¸æqë!kÒ^0Ê3Ô%¢";MrëéÁùîô§Ó³_N±ÐÂêÑp?õ£«(^dO"ýpôöfj>÷PQ.ú§¯Ç¿·¶ru`z¼ï3cïÀV½(Ï:H¼pfâ{Ìyù·:²,&}Î°+úÖÅôçN÷Q¶ôý7èÙ¨Íia&Yö<Í"öÊ²»x,Å%%SÙÓðýÞJ÷+³§b½¤êSõÒåès`Ñ-ç¿ýËÙ-¥hS¦òTVÖÒß&%5¢6òëJwø¹t$)´ÃÅÛ:¬QIÔ¯ak[ª±çXòQC^`ñ×pDü®K×ènää¸y:üØä;2mF°¿p¬oÃR°$b¬ò	69	`%.so: %_sh.o`
70	xÉhv Kcdà#_ñâ§SÁÊzÿÉhõG¨`ëÓ`@i²¯±è'	70	`$(CC) -shared -o $@ $<`
71	KÃÂZåi7¬¢;\[ïÊå4ìÞÐÏ/ºÕøÈD5²×ïË ö{ª»KT\|5òRÔww½ý¨öW/6PÂãQÞØÐ+è> {áÞä®,NÜ£¯ñ£¬°âqèK4D¦3óþXskï_2·b=oÄyÁ û='&]moþ¬C!g¹ÕÅ'§ì ;kå%;÷ãV®+fës]ÎgÐnFSÛË9®ù© F(Ä'j1¬eµ½ ¼äø¯«`5\Qrg?rúQÏ&9Oû_¾OËötõÎá/,©vV¸ÑÑAøø6TT0ì&Ùéº¹ÿ¢©8sxñRH}ÓN¯ôÏT¥[ó%(gQmZ³ÎôÕµL:iÍ½iè%nïsÿd¹8Ç±jue7Qn8Êñ}~åx§<¤Õ>çæÑþrÊ¦-SÇ<Ë/¢©Påº³aêÙ2Â¢(AÅýÀ#çW=¬yÖ£Ë2Ië$êÿîrr.?Á×i¹ÀA^&sE ËGt¬ÌU 2¼z<ßO`M(^ôBb¢çÏaA}'LZFA?Õ\|ÜÅÓ\NSPrÕäÎñ-¥<ÝP-ê 9¸¼YKëÉ~ôBüuª®ãå ÒB/ç×ãiÌNQcè×>zñâ>m&åÛnÑ}[#EGî(¼>åÕËÚîècÔË{\ kLJ ,ðï£ ô¾¸NPÄ@Rea·2[È¾ðKÅ¥õ,¯Ó×Ôsõ·QØa;A}áÇ¿ ÐSÞÙ ¹Ï\|¤^TçÜÄéµÛaw¤hs2tØ òÐ»8çËLCP¦Èú!98oZ&Ú7§¯·gg?áÝÅcFóoâa~UÈ#?¨{Ì9YuI\ÉÁTø),åÃ;DN+Ùèñ@¦û¾ú~«ö°õgô ÿ²Û»ÄäJW^ré¾$ãÅMgîÚûÕ\|âÄýÞ$µN!é¹° ù$¾}ºK6¯WeKÉ d²1sÇ®àv%Y30«ú4¡7ûÖ±üû½ÿtbXöþï?wjß×sï?÷þÇÿÏ¿Òÿ{8ûb2¡+'3»cØH£ÒW¼bÄC&¶Î;2yã¤õJ¹öFø:»Àyü\|GBË;ÿGBÆ!P7A$¶W¡¹.ª9áwÉ&ÞY&§Þi7ãÒ{Ð§C7)NÇ1{ò¶=Ólfygýg dVRGp 4}:elGÙ§,ÐoÔb»"öøcþÝþ~ç{ø~¶~kø?uUtN½W%_àU©"DµÿO=·¹na?»D_uuYµ!ï?°»Ü?ò´55ñåÀ£}àÛ«%pÔC_&³ÄÚ8&Ñ×çx8uÈÈJb)ÆQ/n&(.6bÛÝoó5JýÛî4òp;¾ü»<XA®¦;<òA·doÈ&iir éämw+:íæ1ºí¯É×ý¹rË[%Nâñ VÞÁWþAh´O³ÃN³´;±¯}©@f=)§1çoçóAuv@vò Ã¸ÛïDT¶è¿ÆR¨!ìrÖi§ù¦ X8£rgnù¡o¾>N'M±fIÌ5/HÐ:µ\ÎQ£C9;>K.ËH¾CzñP÷[}µ ®{.1ê~BÆItÇå ºô4,A¥g¸]\4öAîy 1n8ÿ{oUüf § îÕÕ4¼²y#5e^YR ôÃÊö×j_/£N àáN²ä:UÂlç$°Æm¢±ËMùa'Sêü¨½d{0>ÐÏ¯¢ôèvýMãÝfÎxä¼&Ô¶ÑëüÈ»&q=CÌ]ª¾ç!9ð$½çwfOïÜáÎÂXä>+qVn@ÉjÀmtfêâ©ûl<rÌmz` ÚNYÍªíz!\jö¼061ßç!qâTôÔâÖôÌdUUw»xTZ-%D-Áà<ìÞø¥kç¬Ó@óÀfç¢urO_âZC³Ñl_Äu4T_Yà^·w!«ëüD{®ä (£§ A,3 pÁD´Íµ`:ÌÛAuOá¬J¹Pª·ÀÓÙ¸çÐëi÷Ê;3-Z{g¦tâ¬kÙh$E\DÇB6eWeÈ_ÌåagÍ£ì2·]«Aëª=44ù0AÍö2 ÷z6ºâCv ÓØË 6Ôz+ÚÕ¶ûgsa^G.Å~¸¼ÜPÃª´VÖÕmå51¾Ñ`ÉÆWeYqÙöcJ³s°~ %íwVèlR§ÆáòºÞAÙntû¨Ùm¼DõaXä¹Î¤XÆ¢áõ±)¤{â¯XpØûîµî&XÁÕWÜ¢%ÚÀW¥¢<¬SÍPægÔ;_rñË5#ìM1;oÕ WÈ/\ù>Í¢7r°xÉª¢ øUufÎÐ© cyGæ(VôÚ&:ðÉÌæZf+²ù0YTæ¨à=Å·"oxõ0ÄmAítÿÏw{x-Ä7¥ÌpÑ'Uñ~ x b\Y·!1cVTþàÁòsÇ(Ê2÷sÁeó#X	71
72	`P.ùÍÓCúÆCtÛ¯_}`	72	`version.h: ipt_NETFLOW.c ipt_NETFLOW.h compat.h Makefile`
73	ñ%gÁÅÑÙéño6ÈwI±Ð« <¤5 QS¥Ùd#Sþ$]¹¸Ñc+"àÞÀd mºbÏ¯h}~Ø\^?nÚu¶ë%¼®±§YrÇ7!ùöU[üÿq¥á$X²â{¶ÀðêÀ0ë/°¬oííì2,U¬J pyµìgµqA³+ LZÈ2b]~U/Kø\|ËYåø¼¤B¥ÔqÎz}÷>ÞBjê¸jêw.PX?ÇÉ¬wÓ%½Uã%8ËkÖ`ßÊkPF;)DªR=¬2¦ÞFÄKn>u{!ºi&l&ú)¶ÞÑ`/TIöÞÆKùãö²"o¾u=¡4>«@_e[¼´OOÎæÅEpzÿ]XjvÿÓ5¡W½d2.ÁÏ5¸ª/«v7EYCÚÈ`Ió¡9=k¿;\|{öê5;ÿæ«(Ñÿr~FêÛbaZ!¾¶Ñs;ö«Õì´A\|8ìÃ8VÄº%6^³TÑïèU8å¡VÆ4ºw§íÖÓæÑâzfª[Ï©(¡zjaYáÔa9-;R8¿\¾éüvÞ\<TQ#Ò©¬=PV¡ÎT¿ûøªqôsãø]óó'wÿsÝ÷á´DOUå£èReÐë2¥âÊDéZ_-ã¼ÂåÒ¥;YM×<hH SçîQçæ[Ájd¬hÝE6P^®"% (#q»Jñ}K\|æ¥ºÑbåëdÊÜt,fI6£¾Ýxa®Ðö-ÍàM³sÿª/ ]/'¶°µZ`e.fpâHØÉ9©¹²Ù'¥FbxEs08üC&Ã®¼V]ó+<=¡GÀVJû2zzÆkcÍÆtÑRh3Á? ,ÇÑºßb=° XØ»,Cê\|»jÒ)ý3ùïÿ}kÑ2ô¯Ð®¾á2e,¿Èküÿ¶KÁ7î£±êÈ8®öóOk÷¥GNiºL8î¢Ùn^üÜ$ûï%TS½ ßÜ9\|lö'æ¸ÔbÐÐ×KäfâÁÃö÷®ÏÕ²²Ó9hÚîf¼¾h6sïNÎrg''-{h¶XºDã°Ó:;Í&ï=²£iMÞlo§ðgÉé\Å¼ýNÔÜÅÞ0i¤.LJE×êMhe½(Â/}D;¥àá~ä]XIWp PE ¡Z[èc>FrVqC¾£ø6@Úýp¦¡¿ô\´v6nº ¤¼ê¬° îMf,yP\sÒºå0 üàªÌ,5d¾ít´¶!±Ø¢t"`¥O%Nç"ËZþ°ijñßeýê$Í}ÿÊ£¶¹NáVÔ}+×êÅÃÙãµÅd^T´OZ·u~ñ££Ñ²iÂ÷îzMÔÚ$ÄO :Þ{9BëôZxÅXD(¨ÇeàAú6=¡ ñúS9#g!voGô°8)WOhC§Vkñ{ºF<ÉO'ú=ã7~Ëéd±»>¡]ò`ß2Ò`³\|x,0ôãzFï3ª4î3½ #jV¨]¨ê¶K}z]¹ÅoÔk IC - _3+Ðæ®ÊêJVýÑCMÈ1ºÞâ7=ZÇö):.#÷e³¶É¾Ò£ü§{DxmÍp»^H¡¼%zf Ó¾%e3´ÙR´ííuÀÅÕ!IÒÈÚ®6i{]¡Cæòjým¨î¡×{;Yzí÷f~éntµàÙ4ã>t}Yõ&ah¯@fª!³\M»Êk´ÑämöJ°jin?èûÖ³=ßeu¸@=Ò7 ¡gmòjw¥ÌâþDÔ,Oº¤¹0~xáÔlfI^³n¾2oÍÓ%·êÂË¾H_/\DÙk®Õ£æ«woNÚo:Ç¥Ò$hÍÏ©ÝfF[±M<Ù-Hù@?^Õ"Uß²¤UÂS¤? ùvo¬ÖÚRÜãÓ3Ïb0¡(Ò!ùñïãÇå	73	`@./version.sh --define > version.h`
74	`ëZ{÷Ú¼1Gè¥mµduÚ`	74
75	SsPÝªe~9Ý"B;ÿÊVõî,SïªW[àðÏy5ë®ÎïaÈçºÒ/Ë=²âkWÉÚ7Ñð+¥^´\J0vê¶QÏhX´³ìÿÝvÖFJ¢O <S`_0WÿR¿üÂyLrüxT«¸3sPKoå¤0Ü¾+²¢\|]Ôi¶ÿìèi]ÍQÕÌ$ûÓÇz=¿Ú;Ð³¶íDâýHÖÞ\|ÊK£¥ÀYBLkq_Ñ©½wô)t#Ë¢S{H[á2¦ÄôG9ùýDªXcdÝmå4Àþl4ºõ;ÙÅõ¡/,èÈÚ·åÝáÇ.HÈêÝ`´GØË"«è2cãõçÞãT=FÊKâ	75	`linstall: \| libipt_NETFLOW.so libip6t_NETFLOW.so`
76	ý9vvèhûbc 6ÅÆD_áÇ¸[/RÜljäÙ´}/=Ý'Ðhàª«i<Ø¿MæàÂGwI²ÙZöþqM1`ÑÅda>>¹yg£à¸yú¦ó¶ä++¸·Ó£ãæEpØ8 .HæI=µ6>U·uÿìæó»§ùîa\|aþ¢æ0ó¹huöËævóY1ò4ßÕ	76	`@echo " *"`
77	ó5ßÝkôYàÆÃTºífxt`Á T®òGvmÏ4]½H\£GqãX(%p}ÏÕLí'smÕ¬\|{S1È3=z}¹bï'æEâ&ÍmË$·CÞ¹ò#lòe8{¿ÌY%iÚèB¨§µúôÄf¬hÍ ÈÇQrMm°LÕFÉkøí'R®d´ r ÕÇö:¿¥6 [v»x NAº»g³Îö Õ¼(6ø ×?Ñí¥3Ø~b¡	77	`install -D libipt_NETFLOW.so $(DESTDIR)$(IPTABLES_MODULES)/libipt_NETFLOW.so`
78	`ÚÀH[a"b_´®Dc4¼b¯æi<¦¿ò,E£$pZ®pY"^ÆsÞæ8yÉ¼Ì¦ò!²éFMòXfÅ®äÖÔ?ÍÌv÷r[õnzÕ%[Í@îbhËÏgéóÛLhý<xéí<(.èækæ´³U¿Ï¤ÆíYMó²§zvê×6EÓsÁ<Üù9_88Ôú¤5½'Aµ_9Ç3õ}«IAkÏòn"Tî?áiªó,þ¿mÂß×¿ÕWjv?ô+ÚE°/Ua@öõþ_¬·êÕëÿç_áÿe{·^ßÊúÙÝªýÿÿÁ~X(`	78	`install -D libip6t_NETFLOW.so $(DESTDIR)$(IPTABLES_MODULES)/libip6t_NETFLOW.so`
79	`úcéNi®ÏãÓSä_I/Ê¹ï¾ey÷-âë¸ ²}¶0¦y["ðQ¢åúEÖ"QVD<e4¥nôOE<Áe úN»©)\Ü ¦µ$üÿu<v]wÑËËÑK`	79
80	`G8 +=pýÒê¼={×Óß0ñEã´óÛ§×(ÞÐ!Fa¸¡uÓî8½F0æÅ!¬¼Æ«Öq«ó4F¼nuNí¶x}v!â¼qÑi¾;n\ówçgífUv¤bNw³3 èÐ~¶Ó¿Á@'@ã°ý6ïÑ-PØwr·x(MNÂ±¹"µºHl PUH}~¦ýÍÍ?V¯Æ³j<½Ú2dó¥$jÓ¸©Zçß-2ÇM^å©ÐGÈ¨Àæz¬êzQÒ«½x´7ßµñÂ«?ë¥Éæ$ÙÛÛªÑwªh-îØ$ÀPÔÕët4\SòoÐFW)ü$µg{;:/ÀqGá8%f-Ï«YÔ·ÕîuÉ«z¯[«©:7±lënpÑ<<»8Â8¿í-ýÊ]®» 7ôÐ!«¤³²¢è~6mcÇeJmoe%`	80	`dinstall:`
81	`¢AÏúo1>¢änb:Æ<#; _éÄPô+¡ofOñÐ/ §À:!íMÁ°{èå0ÅÄn ÝÄÁß5EØ'7ú³o}",ÆÂñ k³neC Qviä¦OJÜÛ]Á}cÅÔÃ3éÏÔØ ò),Ú°yíN[MPW¢Ï#V¾\Øm$¤U%";ælÔ¹2e)rlüJ8¾`	81	`@echo " *"`
82	`¤Û +%êþX!Ï+Ô#+~æ[Á÷>ý0¿sÌþ¶Ù8ÂPw¿5A+wb.Û=7ÌÞ ².`	82	`@./install-dkms.sh --install`
83		83
84	1¡å²`×l5ÞþÛJë5ü:í¼£fûó¶ëîX?[±äBèI¢M=üßö³Ýjú)a*[ç¯[¿:ðÝqà»	84	`install: minstall linstall @DKMSINSTALL@ @SNMPINSTALL@`
85	hqèÿ[ý@¾}&B Àq6Gû îfXGáPP!%TùrÈ+l<ÞRPéÇ `OpÉP\|EîÊD;MjME \|èBA´NW¿umXQ:Ã´{WqxA¬ ëòü§òüñC¢q~qÖ9;<Mø>T "ôaYÓÀè+AtÎe49Á Ú J`Á±¡öêð<x}Üx° ^aË3¯¢4±!Ña8Þ ÚÁùÙE·b³i/ìÀR Ì:ÿUD]xJí:ÿ`ð+U¤u~»Ó9&Ý<t¤ ÉÚ°çSèãOÇt¹h çÎßu¼ùÀiW´.¶Ô®7þ£vGÒoyd*lúâàF`9nU® %è8G`nI¦@asp\|A2í ç4gWvÚüµ¼=ÃæONa9{O	85
86	`ÈªS4®6hloGøð=þØ÷ÛwÉ»I^[XðØø×\6l>Ò\u$kÛ»ÑlÔÐ!±jhÝ!×º`	86	`uninstall:`
87	¨òï¹{>öÙÓ«íOU¢±òÛ®©b¤R7^5¹Ç¡'8<9Ð¦:½7t`Ù8ûÄ¬v¶NÞ7þáíßAFæËnAóW}¤÷eõOMÁ.âÃ-w-í^%ëº$6;S%ü-¥±«©»Ús<0ka¼,rLÖê;m{Å«t \|Bn\|-±µÝÄÑÙ¶Ð%/`;hrMá¯ÝºaÂNçX¡§¬mÃzVÕ\ÉâçP±ÚI·§YÆpÌî÷zzä$NRËëMA§ùÏÇÓ	87	`-rm -f $(DESTDIR)$(IPTABLES_MODULES)/libipt_NETFLOW.so`
88	`ùBÆn2¬²#yÔ%âÿ"X¬yÿgIìºbWÿÄ÷ò8^1s¡³sÄ/ÕZn÷RØ@=oÃ.ìe®ïq<8þ$NÉÄ¨xBÓDAï¦È4Óäû[®.Ëå`	88	`-rm -f $(DESTDIR)$(IPTABLES_MODULES)/libip6t_NETFLOW.so`
89	`Ñòg«»å¶ÊmgÊm»åvÊídÊí¸åvÊífÊíºåöÊíeÊí¹å¾/÷}¦Ü÷n¹§EåfÊ=uË=+÷,SîYfÜ¼åhÞÖì)~öM§ÄÄ¬wÒ;r^àNIM3ú¨ßfxÔE-xv½i4aÞ3ªª&¦¶½§W¸°Ä¹OÑ 7XDê9Zà¬Ü±@å$ü-jj(A<ìNû²(bQf¡-£ZÚÊ9ÉBìTÌáU°_'é¦¡$õÌiÕQ<êFãLqz!?°ÝçëJÈ3Ô¶î½bSo{¡v-L0{[t7 Ó£ÂJ÷¶Uy©Ê/R¶Ëí8}vúV·«á`	89	`-rm -f $(DESTDIR)/usr/share/snmp/mibs/IPT-NETFLOW-MIB.my`
90	ÖZÇi´íy~¯¡æWúTÃÍ©´¾%ç·õ¬¾UËÎKW±d zè(daÒb°sFÓ)qºg´3ðe¡Â+ài£Ó.RîpOÍU ú{}.ñzUt}j`èôT`{wi}¤:}S³§µüì¬Ï·#óÎ§Q<Ò;·ä®Ì=%i<	90	`-rm -f $(DESTDIR)$(SNMPTGSO)`
91	§>{/&rs~}D½î0·`ÀmµAXÕxz<&#ÅÓÊ\|¶[håíó=ÛÈw9)Âò¹VjÁ¡ìÎ{il)~õLêjÐ6EB·2qÙPçñd6Ýuä©æÇùMÉoOmôêémSR¶¾í4m¤Ù®ïx`ýl§Bö´;ö>ÛRSÜ^!'\>z¶c5êE>5½=#éövÁ³=Óûe´h»úï] ö¤Û8F««áx6Âã<uîANgtp ÕOX» (í3 Ó½¢Ñi¢3ÁIfÍ´qV ÎulÐºN4ÛVñ£F§ÐféÉ"×-xÝ>HOÛgç düÖJd¥D;×CU+§·N#Y-'6`S);:Å¢x·b»C&Ça¤rÕ¶ÎBU<k¤46¥> ºKè´¬Ï.![aqÊ¢pØÈÖûÊEÆåæàf(Ä»n?udKOAæL¥ñÜ"Ä¦¯üEÉò0ãabÎñ(P~°Ú¹±Ç>ù3´ÇèáÉ0¡^ªçw(]GWÃÕy²ÿ\3wk[5ÝÌíêNµ^Ïi~ÖfÙlõl&r»%Ïg#X×Ènì2ÿNãeºÂ'Ë£ÏjþîàYöî u`Ýd8ß\Ý©{÷R5mò;Øéêr@~¢&AÏI¦âÌÈ{Ák¤¬îS`"½¯ílm}X\|ÂçØù. Ñ]ÜþyâbùFÆ}jj¥§q£¯lß ¹¢x®ØñÚµ"ºìKÑ4 Ñº¤ÏòÂ¹ÊÞC"k%awÚ»FS²ßQWÒêàJ$q<v®è,éõ»ããàË'(	91	`@if egrep -qs "^ *$(SNMPLINE)" $(SNMPCONF); then \`
92	`dRæ¤ùkç¢qØ @*¥³É0,¯øG/é0¾©\|Ê7uæ Ýø¹iJÃÒ9Ê+ÅLÅwµ½\gé§!ÄW¡ñ+Æö`	92	`echo " *"; \`
93	ßÁ ¿wh+ jiÆwwb6þ1¹ûøö¤¶÷¤¶1ëÔéßþ®Y5Í?Ñì¸`äÇè ¯©AêÉè'iþZSlnâÿOohàLÐp»ìD°µ ¼ùF¥Nç·3q÷òÞd\| ë¼<jxa¥.íø>wªx{Y]ó´ñê¸I}l(K»WïÿPÐQgÈ¼PíÀÊ6ó®gñ÷p²2´4Äuë·Aã¸yúáÀ¤ÃPØé²ÖKÞì¿¯V q~ÿa_<}ò_#"Sì~/JCÄ^Ãì%h-Çölf¼"övÊ~®æ5Uñáý¤C%{>9ñÉo4fÃ=É³´GTÄ×%fòºÞ:ïÎ¡kðB´,mí	93	`echo " * Remove this line from $(SNMPCONF):"; \`
94	8þ6·1n,ðQ#âÄbÞ_8!ÜÌ(P·L2²DÙp½µZ+¥U;ìçok5vXwr}8Å8EâèáÏÅ»ãfÛåû)/ä¸Æå¾oÎ(Æ°Hi®idøwcMÿ³Çh4Ó¡9r¬Ã9Ë¶^~kã ò¡øÛîN\|/,8ÁVf\|×åk8É´e×òÆAª<HÚõñ¯òôÍ0°ûÞÙ2¿Yo«é©FO¦C$8òéh/ÂOjü~V °Ñ¤Y8`lHaTÎ«¦I¾30ä2ÞÁïT",ü¶;æÜÏ¨Oðl4Óûl¨ì. öËe!O2¥uTA5<g§¯[oS<Fó§æQóÈ±óI\+Ä2Ñè¦ÃÁçëéAñÀØBçéBJubdÒ§ÑÎ4!#?"yoqí?>nµ;:#CüC'³éToM`$5b3ÆYùUü'CU8@B[Ðy¨vçtxÑäk Ä.\|5Û³ßhL çggÇÍ_ß6ÞÁ¦vÂ«_t@ ÓÏf)Ètéª=ähi-Ðwp»¡L¢T¶ú"&híð¥fNúm?&ï5ñ÷hû½gWgÝ;tKÔw''¿ÑUii<(øß<§2ÔæÈ-TS?ÄRº±gí	94	`echo " *"; \`
95	`ÂÀ[b×ÿÜzZ«HÝQ°u²Å4K0Ú->á!NÍãÙ¢òå²rìËGKü%ÁT79HÒxÚ½`	95	echo " * "`egrep "^ *$(SNMPLINE)" $(SNMPCONF)`; \
96	`9jiÖÝÑêJ7GQ/HÅG ;àØJnJébÔéìgÔÛ"¢Ì¦"[þôT;ñfÃ¡¬ÉDdáO<ð1.þ\~ªbô0 è&wãäK¦üäxñÓ¡á#¡]®âxî¦ØWPho·UÁyJµÄÃ>#ÄlçP½î°'_3p):08'úu\ßkÑK1~3ÄfºÑÐ*ÜÂ#+;Ó4Å0-ÏcCÍB34ày¾]FmJÒRrPÆÀü °úÉ}«í`	96	`echo " *"; \`
97	`°óU×_$ o×40hw@·NK¤(`	97	`fi`
98	ÈË¾~»íNKÎS®>Ûñbj1&òE²,:tÞUÊ(+è Qøëi7;_SÏ}«é´e¿¬ð¸ËîÇ\|¬ÔR!nÈÃ]ç;¾åÈ¾V*ie-«ÞÂ&K¯,ÕF.Gt$\p¹r¤ÁÉbTîî\|ÈYãÎÙIëÐê'·àùpÕö£7m²O0giv;pcÏ¤g:¤2ãüSÈÇÎ\|P³T;¼Í@ÿz®þ¡Iva&t"RM<ÈèÏÃThtÌ,á?jÔ`Ø©(?Áý dg[È(e;yL°Èé½/e-×ú3éáNéÍúæMÉ>NH2AfóZzþW!Þù}¹Fápî»ø³ÆqêÍ5,üÈ	98	`@if [ "@DKMSINSTALL@" = dinstall ]; then ./install-dkms.sh --uninstall; fi`
99	`p!iI¡k +7lqö`	99	`-rm -f $(DESTDIR)$(KINSTDIR)/extra/ipt_NETFLOW.ko`
100	`6Ä`	100
101	)¨Ì¾ü°}Èe±=kØ~f½k]Õ¤$0®"Ñçj± <0q¯;í#fÛ½oé¹Î/¤ÍÌ²bP:Üî8]À=3SÜÁ/ ¬«¤É@ Ïn½ÅHU´öcÖyÊ@EdDÑ2¹4l1(cY/¬3©ã2¸QUyç%0a\Ê"¾ñÁríPNÌã{S©µµ´6ãD¾-]Å))rÐð@¶Ô)µÑ©ÔébÀ(MÂáÙECßp§-÷ÇÌ{ÇáÍ<DÙu{à¨XÝFñ,áS)µP0«,÷)Ë+²>i Ø¬êä²kÂüÌ·í9@ÞGãÆÃùZØ5òm»EUÀ&¡ c±ñÉÎ!o{uåñ,[7¾¾oØPfZµXUi¶è\åñË$Þ.ÉÓ/#³ (Æ }°°) ¬Å[ X#³ ¤½°ÔÚWàXN£)£WÊ²%VìQ4ÆGáÇQ{j ±_¢pÜ»c= ÆCåh´O/î£üýþç¿é¹÷ßÓ¤ñäÛÖ¯¼¿ÿ~·èý÷Þ÷{Ù÷ßÛ{µÿyÿý¯øï»³dºy7§³Ë»ÕïÄÙ%¿À	101	`Makefile: Makefile.in configure`
102	`t3Ï¹ñ7>d}b3O8¾¥^YÔ·j;ây÷²÷c`	102	`./configure --make ${CARGS}`
103	ê&U§³'õî7çÇÕÕUôâMCñ¶ñ$Å-ÁcØM0±8<H?^]ý1"Ç/Äþe^¯þ«Oº[ýÄ:H®¨ªÁW:àtBÞ»x¸úê;úª á²[Ë÷k×áýÑkøe÷÷OÏÆÅw'ÍÓÎ.rÙM{×\fmãr©"ýpØ½SEú"Í¿¾k]4\|JRÓ¥êJ¥_òi©"8²º¥3(âÄòE]fq«µh)Â«VÆKmLªe¿qÃ¥éµiViÉr½=$¦ìý4·ìj¹{ÛúÏPÝéÕgÀGþ!~RÄãÇ<SU¨8k¢}Í÷3 ¼MgVQ2çe¥T×ìraãë,2VûqÂþãqõ1ßïña9êOÊ§0Jhæ&4Ë.ùä±~ªE×ñïæôSÙú°;¦^ÿ³Ð·¾ÃCÄ}ñÝÙú"Þo\úðù#MÙ/øyÿ¤7>áßèóF§úá?(&äL1¸aÉµÖÄsà + MMèÒ3W$Â"Nm¸È5ìlÉ»Eq¹ËaOp¹kråjõª0ºå¾Ñ®ÃpP Ò\|dÃ9Ö¢z'G.Wîc+ø4bÈ£H¤£\|¥)¥F¸ Òås¥.±Éh«Ô8oÐHt)Hº§¦ÔB8zü#A"29È8ÄRÅÚ>?¯]Ð<u§èj³ £hòO/£~&ãåHÐ!²b<3\|~R±eÍZI!OÜ½/ÄõÛ¥ÞÜ3r,¸Õ	103
104	Kl<±°Klôã`M¯ªiD@f©vðä@h5@Äí¢×H²pÆd!0Í)+!&¤È¦«l9Dé¬7¨©Fbtê÷ÎþþzîìGÈãßo}À¾4ºÏ0¯	104	`load: all`
105	`:Ô ¥ìÕ+Ôù»ïGujÇ!²°G}7Xú±v¯äÍ§Qê¢÷àoLñ£uVExú,e!)+HzÝqióðüÝïý'IZÐ\xåqôXa_¯V7jÌ:4>sé?ORûaÒ£ª#äËÒæÿþ=Y/ýÞ~RÞ/~Øÿ=y5KÕõò_6ËÕ^wÎ@®®*Ï^ä½J`	105	`-insmod ipt_NETFLOW.ko active_timeout=5 protocol=9`
106	`yH JÃçÏÅ{êª+û K]úanD"YìK2øÎ,É),>Éçè1áz\|`	106	`-iptables -I OUTPUT -j NETFLOW`
107	`CÓÅ¿wZVËb?²HÅÊ1¼'NE2¨ËÞG þ9a²p¼ 'ÁÄp`	107	`-iptables -I INPUT -j NETFLOW`
108	´cÇ¡þãKÑ(ªë·V®^MÃ t+Ô #¨w,?,½Xïó`\ÒÒXãÎÄÔ>ÐDüñ9ü,BjÒ9_°÷=³à'^I3$~+Ò¢iõj_*rq¢¯oÚâoÍRaºÍ:(mïNÿö\|ù ¤]Ó¥î ÌýJÙh#ÃÄê÷íÚÄ~GúQºuH¨cðAßÁ¤1éïSLûº @ë?@Õèùèäðam¯Ù,_Gh¿z7q¸ù¡4`Ú`	108	`-ip6tables -I OUTPUT -j NETFLOW`
109	`yÓxP¢9À7!^ü ©Úª¾0°!TuWýÖ\%GpðkºU"NÊ_¸@ôÜRG¼Èµ³¦(\/Â«ðÓ¤J¶>%U L=E÷}¤lMB¥äèÊ>i3!ûÁ2²Cw?¬âÛ×[d.@ú~ó÷Ëéf@ËòïQûÃÙ44ÿ$y)ýôôÇ'(,p8ÿ1jü%7 þâG °vaäâ9±æð²Ëßá}Ù$4uã»?ÃM(wH °ø5z¤ú¦6e·-:Õ¨?£N5Ï-Î\Å3?=¼ÛÌ²øüBÔhd°D© ¡Ð¿©È§5ñdc} {®½ÉROªb£?·¯txÊ<0H3ÌÐQaÆÈgð@Ëéo»É5núÅâóuåæ³¸~óÁJ/=º®*?(ÊâRnfÊ7#x?É+¥`	109	`-ip6tables -I INPUT -j NETFLOW`
110	`Æ÷ÝYòq;Éò¹K»ý`	110
111	`fô%é×tþ#:S¤*I ®?û©Û¥üZèé¢Åw®wÃ2·y}Uk§ó>ßTn?÷·Øwé´{éX)øk5Eý%`	111	`unload:`
112	`¾Íñl8üg§¤(àjª]V²x@"-÷xÿ1væ%^ Ät¦JYÜ8A$RÖ ÿô¬skJÞÞÐ¬øßÕOÍ¢æ~°)((ÇøSæü£ÑIhF*D¥ÔuÊàmÜø:äÃ{,ÿñâÄÛ¬ð6°v> Ê3eCI·!¢¬ÔTÄ R;Ó"Wï R¥&MìÏÆU¿4¶Ëb8mº/Yöö×ÄCñkîc9Ý®Y)â4²¾ÿOòúÈ£´©¦29Qbáß¢ì&©é¯áíi¦çÊ²ÒÃ¬ÞwäHTÌKüRè³¼.õa1Ì óçüY84<8Ô<qQÞBìÜàÐ Mâ¤©Á$¤r<8ÉTÌFÜIS=\nÇdzDìRH³kzC¢½À®qK[e&eqèîÐkí2^¦TìØúâ2sîÔÇ¹?æóíd`	112	`-iptables -D OUTPUT -j NETFLOW`
113	`;dd]Vpþ ZRhM ¤^Ìñøò±OV§eí?¯ë,Òv¨<+9òÃULVèÑV^ð¬Mñ¤Ïd~Ø;¬ÂéJªr;²µ¦skMï]kZP«TÈ`	113	`-iptables -D INPUT -j NETFLOW`
114	]a$«§äñôÓãòàÔNÍäÚDaÃÅ°xãÀø %T9aIªJkãó¤êßãh\z,áë10æo¬¢ÒòãõûÍÑrÅ×¼£}!·¶¤6¢?êéµVMVõ&Xr%oÇÕ¥ãkþê8þHG)DF©0×ÇfàÙô«Ü.êùZ(1@úÆAX{ÑìÆ:§Ø¸r2 IGÓùÒJ·&Y¦÷ÌVDTÁw×ë÷ïeÒµàó~'O0 Ú;ÿº>ðFø @øqJ¤Ç4¯Ê1ÈÑ[JZûRÑ¦t¬5¼Hî}äb$2=@ë]à¯p(ûàÝ¼È÷^Í;ÞÛçÓÛÞôïÐ)31ùwd7:êúøõýü?v£TëHfC× ½ª>©1£nºSþ3ä,ÞÚïgôùYt¡.Y'Çã±^u6Á>»¨ü4ìÏ`3µÿDv µbj[[ ÔGj>Zæ3ÃMMe!ì.à»ÅpmnÏç îí>ðý1©â9úª<]~Àiê÷úÐÔÞêéß0¥ &ÒÒ\|,s£l®<þýÑrI¤~J5»6µ&ZOPtíá³jm ÄÃÿ÷üaòÈ{Õ>ìôpT-ý6£:µ\Ùê sø÷c4¸a¤9¯{ÔÈ½Ur»7Q·ú^Ø¢NUHÄÃõ·ã@öQ`Ðµú\Wï§zUIñpÛ£Í1MCXø×}F.I{ï0rè»4.¬ºVVuÑ{O8<'f,úO¶OzÂý»$<Ä«ä¥ëW³Â©__´µ.þªÉ êTÜ«î¶¯nåJ?[7uÌB2òa³RY¤{úßîdmõNXâ`=gå<M°`¶®ª3zð§ì}8¼£ûd\|làb-§^>æsH3êQàfíÀo¥f	114	`-ip6tables -D OUTPUT -j NETFLOW`
115	`ÕQA©u½FÙ$4÷å¤»ÄLÃHm©¤2>fÌ°ºãHºº@=X8ÞÓuJ.ÁóQ8¥+ASF©9Â{ñb«ü5Hìó±2@©æ!½gÏñ?>']Á³¾SDÐ[Õ£ bÁ¢:h¯ÿ°Gs.º j¹¬ÑK$ØZuMê=>äÌ+ù`	115	`-ip6tables -D INPUT -j NETFLOW`
116	`öâªGBcç:BZhwy£Ë÷@+g¾Sa/zkã®*C6PAï:ðuN`	116	`-rmmod ipt_NETFLOW.ko`
117	ìÚÈ_¥¯ QÃY:¯6DÝºBù6¾ÊÑüË_Ì÷Þ¬îyA8T<À7(%"dCBâ3HêFó)RY2£ 6l}(0mmUE-e@pòp8Ô÷ê4oÖGawÌG×éÞ(JÖlq&9ÊmÔæê9üóÒ½rêÖV=ö]¤aîÄWWøE Ë2kßH®ØàZÈpIí^ÊrdNA:Út{Úóº 4k_ã¦øZW(ëeda?1Ñ HCD_Hâ mHa zv°ñ(¡4«ìvMC±i¨É-í;J Â3ETä#¶{Ëd8¢Jàçt>ÀbkçlcÆW.àuåíyT»0l¥ó×YVíÆøN¾lîao;TîÊjáÏÑ%!Á"dÂÎÁÇ&Ñu¤Òÿ¨ßÿÁÞ«ß½}2ÃØªî®®]o.ÍSÜû¬ý¾µ½ý~ë`»>Zy¿5Ï~±ó¶uÞáoSáÛÓyÍ#áæÕtÞÙë×v¤O»ô. CT"aL8e¥uL\|F¼Á6åÃé§ ^%°Õ$·4õr3°¿_êÝÆ&ë]9/ þ®Ú¤I}wÿ3LßýÏ¨þíoJe². ®ròCk^j´!Còä÷öÍ2-ê¡ZÔCÝ+æ¤L<ÿ¬¿ÿ½_ýðä/J)á\yìûB<ÛZ56¡Ý20Å=!K=ÇdQ)ÕÏº\X©»9{Îg~q²?ñ¯á\|°¿A#¡îß³ì¢ú<O¥òàßß¿ÿß¿øðä÷É6³ô¿üõáÔ6Tµýå·Ruýré÷OÊ¥ý2®.C²È7YøGM?=u¦¨Ã&ÍÁ8]Mc²R0ÔÖ(©ø~[¤¿À[wÌ×¢{_cÛÔ¾vðtÿ?¶Õ'NKWµf]<.$DJ G[SF/IûøXçh½yë(ë=øÙ@°ÁþIòRRLF·E×9:{×YUÀ	117
118	VµrÞGddá0*ûN§UZqÄöaßªeÁ&ã+S¾Æ¸¼óÍ}ð+ÜNa«©µè»?ÔóT=©§mïþPÇ¹_Ø^Ñt·øcÕ¶W5 ä=»¢n0%¼W£XírÐø P?7^ CÕ/äù¯hl2§¥³´¤Z1GäUZ%á{4`.PJ5U¬¾ÆqZ¸ùln4Å 4¶¿oÍÒÈ¤¾:nþT>È¯gËó®,[~;ËZ/Y~'[þ#Ç¡^4» þVéx8éöK¸W,;Ûo±¼ëO<_^¸ÎçÊÔË×û\¡msÁ¢Záâ1K3ñï¨¬dWÿ³,ç¸SVlgéW¤ÆEÂ¹@õ²½'7¿2½ê^´V Óï&[É~Y+ûÃ7W24üå?Ê«¾ÚªöBà	118	`reload: unload load`
119	ä5W\|²é4ÔÊ_?î*qßáÏ Þªó½æY-ý¢`XÉ?âÙÃ½ÄjjÏiò´%£TäT	119
120	¥\|¹Nò5Fõ³js¦8)ETZ±hVª([E¦ÇS&Ú±²PMü)ßÕäú<Äsj~Eàº-Ï`ËÅ³4`ÏæOd`µJ6WgÇGH³Å}òå2Ó ÔdlTEtªsýFRó\|¦ ÍWa0î7£Úú£ýiÝoU¸lÍúÜ½´Á¬æ÷eÕ×ùðnQ»£g¦M½ëjïzª\|X\¨$äÞÚïÖ>,ÃO ×þÿüçQ3õu[^¬	120	`ChangeLog:`
121	`\|r`	121	`gitlog-to-changelog > ChangeLog`
122	`º¨]?AU%`	122	`.PHONY: ChangeLog`
123	`âùc¶\yûRr±rî»/g>Í+¨$Ä~æ9Íã_+¨W9ùO¹å"³Äs¢Þc÷¡Ì-g8¿¡ºÃ¾¿T]¦Ðw0úU ßÇp©Çó^Þ0\|}áH5:ÊÃ¸xFiäÿÌ íã(Ýi5¦þc}Kïbkuâ©öí«WúáN_?ÐéÛû5Á±j^p¹3òÏö¥fµBèâñ?Û;ÆEïÿOº7!>½Â7}ÿ_ÿ²¾¯gã¿ïüÏûÿÑûÑìÃ®Ùv~;ê&ÌAt5««?ýÜ¼h·ÎNQ^«ß?®þtÔº ø_SPS(å/¥øyfJÔQ^ýéì¼Ó¦øãÇÕÖy½¢´C`	123
124	9$æäì3;@2íÇÕ£æ9ü¼ÍôÃ G±Ñ]=l\0búñãzxî¼i!(º>FÉx4Ùì¡ýTQÁ«ILàèîÁaÊ1(þÓ¯b÷P>F4Áù´3¿TMåÕÃC¼ÅíõÐêCV$2xï >;RÌ~ÜÛ<{3Ý{óær ûs6Dið)ýÒr`¹\|\|ù÷ ´"B¿bªñj¯Gî¥7î¬Y9¼ïÀÝÄ H\Ú)LÙs~¤fC_7;ÆÅ°/dÀêµ»ç\|]Mº)üP\|¹ºò#iDazWÎ=8¶Ø`\|¤Àreqòâ/¥Ãwô[v¥rß{Ô\|õîMÐ:}}öâHcôöWIw®+>ÿ j§#±1ÈöÛíß¶I/jº n«½¥wû«+êçF2»Á´ß¸]]Eã$¥Ñþ-))\ëkKQHTAãøggpÞè¼Pô°«+øçjyuÚx>nYÐ îÙudµõ ¹Fþ¥,ÁØCf«±¢±ÊäõÈ®®ffü¾pzHðáap·ÅFrÝE[1pøËs±1 %Õ¤ÖüÜ8i½ªîÜÞU=·qä¦ûHd ,FÑe²éCn!ÌÒb°Ù2jåG\|ÂLÐ@ÿhùÿ[¬3Ê·òh8yÊèÞjþuì/!ý>ßÂÓ&%íÒø)} dHßwÑdâÒ¢È;¸!7ÑpHÍß¢æ÷y$ê/ÕL0øK;:á££böuÝ_§ y5`gSU$ m\|^AÂ¾T®>$æÝÏ	124	`ipt-netflow-2.2/raw_promisc_debian_squeeze6.patch0000644000000000000000000000225513213006644021025 0ustar rootroot`
125	`Uà7X(ÄÆY]lüB-øe6Æ÷aÐòÌÒ¨yxq£Gµú«3¼ºª§Âþ½¥\uSN®É 9í\|iÏ®¡5)Y?`	125	`Short manual and patch for Debian Squeeze`
126	`§E¾°ÍÇY ¼ÏcÛ»/:ÒÕ¾jK4tÌØèßî+¢ê%xê"ñãÑO'm);äT}®ÎÆ¦6)ÛîÝËÛ[Ppi9ä©2#s¾Ä¹GèÙÓrmb¡X,\ÖþGÈÌ:ïÅ3k¨ªÑý àã=¸qy:M)×åMrá²YªWÕ¬Üwty£Á¯Xê<TH+î_þ øuûûh7 u%¨Çft6}`	126	`suggested by Pavel Odintsov:`
127	äôÅ®Pÿ_<Ã2:qHÄFK½ë¿ë¿+ï½üÖ©'{oQù½9`nPr´£ExLGù¾C÷gÜÁL'O¯Òr_ÝWQ:¯6ÒxWø1ª!V«çoÏNÛ·RVÿIþÿìà_±ÿßÙÝ×¶³ûÿÝÿÙÿÿKþÛ\ÇxpùTÅÔ1³¥Ö,J'@û^i"²³OXn=Ý¨oÕöòÞÅ:ÿ¿2Éq5íÈÒ44öûâ.Q0;PP¢DÞ°OéûP! îS¶Ú¨É£U(§«oNß7á8vâ\|v9zÊ!:_`	127
128	}»°Ìk¤£ì0_£SF7ÈhOj4¢®j(+@M©"ýSÁwÊd¸±¢Ìf£°Lkûä%]ÇÆ\Ëð=Zªó8 +ÀÅ/Î[S¢qúø¥qqÑ8íüv@ÆxpñWY±gÑH¶;vÇ)ºîb'ÍÃ·P¨ñªuÜêü¯[Óf»-^]8o\tZïâüÝÅùY»Y¢"i!£ÓÝ3èÐ~v£ab:à7èä `àBð^ËK_taÉÜ-JFÓ%ódÛZ]	128	`On Thu, Dec 27, 2012 at 07:46:30PM +0400, Pavel Odintsov wrote:`
129	$¶¨wc ßP<QBñÌäj<£!£I6_J¢61¸\|Qð8[¼T¯_ærzéÝÄÜ\Î_Äu;"ÏÝ^\|á?ZË=y0}ah¼çOS_º<GòøRg}o2úëö¦_¤9ì\Ã;7öÌÍÆ7¾,ôGìK§3\|ïL"X´{7¹wøÈ¿· ;Í4]¸ä;R½i·{ùÔ´çbôD=` Ë\|FjA0ÓOÒáËÛb~x+»d0¶\|\6:«ß \í ebîyczbÊÈåUóîÇôòí°;&2P~VH_!â!%pWX_£<¤Q®ìdÝãEV¾w³4 üºÄeDÚÛãØMF³qwHnôå°ec®m®s¸5<òÄwÓ»Ùtº~±]ÅðY q)B¦8Ùcykúó¡daÝÒDÔ«{Õíz5Rp»\oÉzómZSGkVs8agfSøÿmN´£µ½ºh½iR¡Öq§yá/ÍâÓ¨æyJ¢jÿÖ>ìç$wI/ºÅ2³~b\|ÜæÏÍÓNB7ÓÅ$,-Úi¢Ôyø¬h84ïÌDT;ï¨ÔmÎèüøjHÂ1 E5¡YJà>v$* P%ÁÕUiF@0¿oUÔåÐËfT4CêQyÓêHT{s·1È¶ò!FpÜ:l¶¥µ7çÇkåÜxÚÒEi-«¡Z °á>¼ÊiiMo]íWÅV)IFÉC¥Uûq«ÑF¤æleÆS4;ØøiM1`Øïkõ§L¸»Td\|^¥²a ØÒ5å )éÇRçÍ\eÖ}d?µ;VÔw÷Ê¬hrè8ï >z\«Õ¿¯nÁÿÕöë[»»kNÉu«(» ±¬2MÁ¤[ÉÊPñIElíììnôÉ]ã=¶á¸ÊI²YÔÙþ`6¹*D)6ûÛm¿ðÂÎ´Dæ,l[ãø«5!Á8 Ò-k×1Ð(¨öJ¡Öi«Á	129	`>`
130	åª\X¥HCæ½ÛD¥Èã/,¢bTxÐÞÔátéÿþ¹q,J»ë{[e×±/dË(][ÌÏ!$âó)n®ÖJ2$eÙjWnN .9Î´P©ù%¼ý¶õº#E`mÇÓ.nRpBvç,ãÛÍ²ªòPz« -jò`Owtv"Å.Æ5Yoí·:Ã ªÛóu!]o·1>B÷é	130	`> ËÒÁÔËÉÊ ÍÁÎÕÁÌ ÄÌÑ ÐÁÔÞÉÎÇÁ Debian Squeeze ÑÄÒÁ ÐÁÔÞÅÍ promisc.`
131	`qØ\ØÀ¯(ÑA1*=â<ÈàDÏÌîÙ Ò¿Y`	131	`>`
132	9±çyð5$ãÇ¨º`Õaßä-K)LR¨í-ÐTö¶2Ý®U÷¤e¿ÑÞ¨e(Ñ°àÖpg¢B	132	`> cd /usr/src`
133	`MuGÈó;\|Ë¢GEÖÂIå#s)²KCÉë<ð5ÒÖé_?Zbì¨ùºu`	133	`> apt-get install -y dpkg-dev`
134	`ù»NóW#À¦½Ö/gW)}AgI5Æ«çe í!hQÃìð$ã¾GSâP@k°7V¡Ú§G¯Þ½¦¸°ÙÔÙ9z{Îw<e-îy ¶¦N4R¥v+âtýÖÖùëÖ¯e`	134	`> apt-get build-dep linux-image-2.6.32-5-amd64`
135	`'´> ¤Ïz¶£íüÍípvM(Þ>Û$"´\|~º«æ&ç"m;K¿46O¿L2rICb²¹xÉEãÿJ.è~BÇC0:Y~(µÆÀÀº>êµi¢¸ÓøYêDåÑ V¼{G B)Ùtä½2¤aQr`	135	`> cd linux-2.6-2.6.32/`
136	`æ¦Ê\¬Y kHä[«XUìM¹TÑÝ%+L³§}Þ:=>;ü«ÉHy1¾->Ð;1dÒyf±§$(T&¶æxÅj¿S¥J^P£[£Ð\liìQ:!`	136	`> apt-get source linux-image-2.6.32-5-amd64`
137	`ú/S£X ØüF ùös Ë(^c! Ç°{£jÞ:ðk&èr\|ù¿·å9®½ì5Þ¼¹Ðz~ðþ¦¶UßqøWf£A½LoA£Sq·lVÅ0¹ßomy5vÍ®E²²ÕYxb¼Å ¨¼¢ÕfO2Ùr*\üB@äD·qÔwZ6¥öR.@óº¯~?°¸Ó&é4ÏÓsÐgÏß`	137	`>`
138	"Vr)¾Î(È¤·¬lp>7S3v@pxöî´#JµçÏ=9ÁI£ý(ZYkÛèp!Dkñé]qkAA^³«°zò\|ÁÂCgx§Bv ð\|N°/ìùK`¨ODÆNÏìÑCé5 8-yoö¡GdéGî@$	138	`> wget .... /root/raw_promisc_debian_squeeze6.patch`
139	`=ùÃzÃI¨¢BÑiöý´¢Â÷u¹ÙµÅ?,3â$Þz«2¦©Áã¬ªª-XFï/gÉÀ×[X÷£ô1º&¹ê¡Tn&ÊÞîR4TllRõ¡výÓÐ*õÞ"â^FWÔ\|jiztÀÊOmm<"¼&`	139	`> patch -p1 < raw_promisc_debian_squeeze6.patch`
140	§²ýy\|ø¸¡BT%VØ`P=±ÐÝ§d·îe4¤K³dFç¼Ô+ªÉ¸Ø°?6fæ@:-äºb¾°Øo6kDRMÒ£tûü²xhgAqÝC pfº®òdö[I #6¸+!u~BC>M¯{½çÀ^åÀàå=08áKî.Î$TÄÃîÂù$à³â5Ò')áÎÅ\lYJxæ¥úÊAå?«Ò«.&ýr Ë¼1c«ê©¬ã<ÒWßDÎ#x@LB$üÇ\|~7íBô`6%ª#HqÔsÓ}6s ¹D"/Oà«<o::h'L`,ûòøËÅHÎgs*"ëØ@®VnMò¤).ÃÚÚèQ2Ãnct»ËxÆÏLF4D(~á9\|8ªF8¾¥:úº3Ïèèµ¦£x"ÑjNÌ&¢F-kòy×ÑÕuðqÄì¿ÅG4ä@WcùF	140	`> îÁËÌÁÄÙ×ÁÅÍ ÐÁÔÞÉ ÄÅÂÉÑÎÁ:`
141	Eà®«!Æ¨¶/Äé»ãcBÒM§T>*«ÞQúxÃ³Ò ðd!úOo@wöuæp\Î¯V\|\êöÇ-BÏ:\¶`CPs	141	`> debian/rules source`
142	NfEy \|VSOrØUCKëJHY¿ËeQ¬åeaÊ%Ìb¹,cÇc}`E´Ö ³wH¶.!µð[n¦Aì¾ûUÝúÀtÔÏÅOÍÓæ±¾ªWöusÒí`ÇÑ c"L¬ãÃ7.Á/g°DXÙâb9Ò²ñ1ö¼dçÑ§ü]PíQó¸ñ[óhêË+öìÖB:]¡Ô©¥wÏöo§Aãð'±õ©Vw2`.ÚÈØÚõ,IØ&ò\|h«Bêó >Æ68~.ßÍÀïÚ¡'ÍÎ,lG¯É+²½¦Ùm@ðÖ\ ªÚn0/{~®/Ó¨ÍØBÎ@R©CbáqøÌ¬±¯éxãÓDÎìNÏMJ Â(Û>ûÐDM%<¼QNI"ü¸º9:=îõñ»öÛhñOkOCÇòÄ?®zx§Únv£F§lLãBÃiÖÿAù	142	`>`
143	`_âÜýt@ÇS7;+°G¤Û*û[û~·YèÑß¹ÊZ,Ë±Ø]_Q0àÌdNIÓEd6«÷vv/iRÇH48øUÆQÁ+JðLÉü¯ºJPlCîTï¾dóÉRrSG¨¬`	143	`> úÁÐÕÓËÁÅÍ ÓÂÏÒËÕ:`
144	`9±T{Jc&sÄøÉòêÊ`	144	`> debian/rules binary`
145	`~àÛwúUÖÊ ÷*4cªª¬D»¼V(¬bÝáÇîîÁâ îÁpC¡PÂÔ^<¿é¥%¦É.`	145	`>`
146	`]nfãq=9æýSNµç.¤,¦9ê¹>vûæd ãùÃ%åÚYR^ýÈ·Lú²{zc:ëGôHTv(x3V¾.âï¢eÏ:»*!.\|Àî¸ùê9PnÜÜõ¢U!`	146
147	`'ã¹>Ïa\|¡³$R+ýRî~RõbË_ëKéçâNÚâÑ£U6cä ¦þ%ïÅ¿¢;ð}^Ûð¯Ü¹ëMJnPÿèêþG®RnJ¨¿4.N[§oÛ¥}ä«ÇxDÏË<$ûa¿*Èa-Þçb`	147	`diff -rupN linux-2.6-2.6.32/net/ipv4/ip_input.c linux-2.6-2.6.32_promisc_raw//net/ipv4/ip_input.c`
148	`òPÝ¹VPÍÙËE¬ßÛÒü6ð´Q&á¸ïP*R#«R2OÍÙfÃªÅù6Ïâ¡Ã®´ ú¹¥ÆÊh¹s''RxjÜó¡SµÝKCÛ&ëálÀUÍ&®æt V¶To»qÏO:§§é¥J¿Ì"VÔÍ¢ÛÚiÜë¥ÃrQ?çÄt4÷¦¯/Wºûy®±¬Ü½uAOåÊ\m`	148	`--- linux-2.6-2.6.32/net/ipv4/ip_input.c 2009-12-03 04:51:21.000000000 +0100`
149	R,cf ¾aJ®qgi£R[~tÆ\!ÒÖEl²¤ùAÇn[¤\ÊfQþW¼v?à³eu³&öqËaóesnâ5l pºì¶í=è¨0SÚ·ü{#þtKÙ Uå²$í¥FYÕªÍínnxK¾=V5ýìBl¬îpõc´äsß]!íËé dLB{`õªºQäoÐ²L^kÐÍ?ªÐx\Þü¹gÕ»ÆC¸)zü[OûJ¤mt¨Yl¼L`ÐEx¶ýB4^âÙìðÒå¯?º.ù²ÊIçj]ÃÁAÎªêÿ÷ÎôsÚ:ÿë»ÆQ °9°AdÕþ°éub@pm*#}z/jÍÞüæìQ{öü Úß¢÷?íûþÿÝ>MúÑ¾'ÛÇk{èØnYÐÚò õåA·ÝYtwyÐ½åA¿a1åf,^F²5goÆKN íJVÙZ4fÀ¤µc³Æ£R©xãÍp[½\9Ý!KÌB´öz$zÏª}ï^d»%Âï9X ïÛÞÈÖÄèLji kö/®õô:Gô0ây9¼bcÀÿ½(>úZÜÇDmYÒ÷%k9r~qv¼n{6ÀWmÚT9§Ö¤O´e?À}±ñé@\|±K_7Z?>UîÊ¢TºÅ¶ôííÀV=áÅ÷ã Ý(¥"@G1-Ó7 ã ¹Fùö`Di½2Ã>ap7L¨:ñ!C¹¦r£ ^è»LaùZ º6üGõÒõ[{Gzö¨Öiïx(SymDA¯å®Êök@10ÿ¾ûR»þu2 ÈVÏf{ZðiÞ	149	`+++ linux-2.6-2.6.32_promisc_raw//net/ipv4/ip_input.c 2012-06-25 19:13:49.000000000 +0200`
150	`§R¨µ-yÇLô%lÓfV¨"Öé¨åÑtÏ3ð 0¤Õqð½éÊØÉ¦/Õ÷åNnÒ0©lÀùxñåYHüqÑuXIì"zátªAtD#7¦}2SPNâæÀ -ÃÄ6+<ìi÷~[ÝdgëÓÍÃ8IíÒøm¶³uçÓÀÚù:vá@ Î)àpjÐ .Ú4¿Ò<Jÿ3ØÕë¬sº¥ÜlÖk2¢¸TâËz!}¥p»qÂGÉÏnÕûÙ\ºãÅrMH¾.M£QP`	150	`@@ -383,8 +383,8 @@ int ip_rcv(struct sk_buff *skb, struct n`
151	`³`	151	`/* When the interface is in promisc. mode, drop all the crap`
152	`JÅ³s¸º¦reL?yÑùJáxææ²`	152	`* that it receives, do not try to analyse it.`
153	HÇ¬ÒanQd6¡ûO2¾Â°¾'Ö·:AbäL2_&µãc\|¼¢;ÅSKxéªV¸7½ÆÅ[e¿ä=µh_We^ZÅÖ62emslqc8¤V5å;ClÈ/´ÖÏweÓ§¯$[ÀIqÄ^>»r©7¸uª-N<:Åå4:FpÿXN²1oCþÃÀÿ·ÿañb§ÿw5ÕOgÕS=®s¬¶ù`OÌäË2ÍÎ&9ò.¢\|âlÜÒ: g&v½óÇxÏv¢2 xÈpÁpìlÅb~=¦dÈÇVñÈX?²U¡<ÿÆ;4ðZ£gQ:ÇöjôÜ (Ó ¹£6é¼<;5¬àa§â¿f¬õH£¶¥~gôwEs®ðàL¥VËD=Ho¤Ã^êÉÌC_Kk@¬tzÍJ'ëØV¥êÀì+`¾`OX0ðï õe¾G²ìÎ½@%ùD¥:c%A¨»ÊÎ¿³öÔ½ÿÇ5Ì ã8<yÂ×îù»Ãù&ÏÔfëÕek/µ¥.ð0{a&2>xÇÄMÇ¢cÓ¹AÜgÛñõ ³aùÛIzÆö)`n¶,òFS?ùæ%^fÇ²¢,èñtL^òÂ2gÛËã&ïíßV=ci]L¯xÃàN{ê ÆÃä`ÍÛ6ZÈx\|Íïá¨uÑ<ÄWÖ	153	`*/`
154	¶å@m¿DAkÅ~$Ø¨Û[[Æ`SÃaNõdNÊ§jkøðÀd~pr~Ü@OFaºIhñØÚà¤ÌÖé:W ×E÷;	154	`- if (skb->pkt_type == PACKET_OTHERHOST)`
155	`Û°ùêEç`	155	`- goto drop;`
156	`}fh0N3`	156	`+ //if (skb->pkt_type == PACKET_OTHERHOST)`
157	`hçmK9£Ç»ìeóì»³ýµ~Fs ïõ71Sö-¢DF~t,¤Ïò@Jw\Ë¡Æ7^ÌõìlwÎ*ÊÖË$íÇÃ~E<ìí»V÷uû Ì±EÙðØ¢TÊ¼b`	157	`+ // goto drop;`
158	oGw¸ºdßGoÌWU¨W;ö~"ólsol9Yi#åÍéÚz þk:Ñ»js,òÏ<4)¯6ft!%Qäå¹{DÔ =2Aö¦ð3lÝQeÛi¥ÕN¢þÿìÈì!D5,ÿmÏVônÖFn+S}?Ï8{°°Ä§<<8pÑpt¡éëüå²'Yy÷ZûÃCÜFÄãpw<W5ÛÏõ¾Þ3ø/µn§H<ÈÜoûµi>Ò~/aéÃïNûüY]Ëèò{;Rét]fç©¡@÷óñ°%P¡ú'¨/2êÆÞÆm; ¶Îeµ³, {98CØ"ö®ò"yÒé>UÆ¸/tÀn%MVÈ)Ù¦%7±äõ¤·O6²5çlG9Pð¤DYòYr¾%§úuòC\|lMF¯ü=Cd2/ 9ûø¨}cdë,Kwâûø1E{rÖ8»~{îU\®àÓ"HûIY¨ 6ø{Øß Sé±ïö«Õý¢FÐVø3£?xZ¼ L[ûïéÌêïY'ø©wQÖ7l¦J{ìYþ©ïàai&½7hõI²·UÉ~Ò[é«RÿÄQjY¼\|z¹$É6 ¬ÀnQ&ÊæRfÈ&¬¤Á( {µõToYÊyÐÊºjùêÄ\|Ê÷"ß`JÚVJ%ñH=3Ço»Éõ>uñ¡ä3â8ºQ§ïåÈþøPÕØ3:70+è°mk\|~ôNFK R$y3,¹ãsæûu¦9Ï´sô»ÜÝùÙ5oþü3÷Rá¡»¤^INóôÏJAXÿ0â¥ìw4'ßLðæÚÓr ªq{%jøpB$	158
159	\|Ý¢,ßÅu'cTÌãû¡HÅzDâo0êw, yÎ Á7.ãð£xÏ]þ¡"hc p H×ûµÝNùr_<'n¼ÄÛ§°bÁzâ¦ï4i îÍà:¤·þU¨y¸3³ÿç!Á0¿8y¥h°2ÕÐÞ{çê+söÏ¾æ²vk!·føÃíw_æ¹£so¡`	159
160	Ô·ò×OöÍäÊÂ}<Ù[òÖøÕèù{öyvy^½ÔæÝ§]âú¹Q}ß¬\|%ç8×EsîtÅMÖMºBòÞ+-º-òÜY÷?ÜÝOx%s.¡¹Äs9åîB5¯Ð/¾ùÝ¤íñ¾`ëM=râË,±ú~ÍF 6§ÓxGM¥å+lÜæüDØªöÜ_p¥Zxy=þ;Xë4c«UgM²vä4ý¾áÍ\Á]pyrïÛ±Â=ºÆ¡ÓÑAD/@ð§ÔÚ¬I\¼¯ 2OÐxÇ¿ñ¤~±Øoyÿ5ÿNSyîçÜÞ_Î»yÉÀ¸¡op¯ÒMñÀ8Mô~£Þ~/u9ç½!ß äLæòºôÈöó³b]ù¸o¢}-÷Bsùá¾{H/÷A1IA±,Èa×ÆþNð&øm0ÎÊÖ!Íìo¥9×¹6/U6=!,Î¦¿Ã2	160	`IP_UPD_PO_STATS_BH(dev_net(dev), IPSTATS_MIB_IN, skb->len);`
161	`çz\|~¨~,ßO,ñ_¢´»=Þ,ê!® (_ó%Ö³ür;aRØ ÄGÌu9N¾2vü÷läÎJ_<ËÞ]öffXzu²¢<Ëa:¯¡½°dûwÓÒ¾éà5^¸)3tàMé0Äw õN]r? ß¡pµj}V×Çô<'£Õ$¦æHfé¿©zIðéÊSØ¬¿käËAjéÉOëÊ'P='Ôý#§?ÛdL£·ÜGrúÎ<úÕ4ÆãÔuúSÑ,èÿuÞXEã+ØRiÌ«ØwðÚßÀU¯yð7«Ó18öÔj¡Ãbìî7Q¤b`	161	`ipt-netflow-2.2/compat.h0000644000000000000000000003557413213006644013774 0ustar rootroot/* This code is derived from the Linux Kernel sources intended`
162	TããpºÖ%gÓ¡.L¶:±·1Óð7¦ AÈ7>tv)z¶$_&TðÑú:uóîA©ÓÉÿZ-u}[h{q ì3^8Ô3(z[FR×ÝH x.T>ðTý§î~eÅ3¼'Ø®©ë¢ª¨Þ\Wuö`E=h\|Ãý[T·¥1ü+àìILîV¤áÉèÅSØÃMbÝèº'´;oUæyÂâÒËôG®ä	162	`* to maintain compatibility with different Kernel versions.`
163	`Ñ©@;0u·Ú©j@Ü°ý~(¡L)ÇÇÈ ÀNÒ;W«ÀÕ?\|3b½c·ïV½mta è/³ÜÃf±5¾¬RÞðÇåæ`	163	`* Copyright of original source is of respective Linux Kernel authors.`
164	`º¡`	164	`* License is GPLv2.`
165	`¿.é8mè.¾}¢ÇWÙ\z\|éT`	165	`*/`
166	ì¥ä$à2»Ãì#Þ)(°èV-ÓgA@=&w^óT³-vxÐ×µó&ÇAQÏcgFïn+exkþQè¡·.k({¼cñæõyÀNÁô"þÆGm]¬3ð#é"´§ÑxªUêéMî3Ææm4µ"ôÇÒ£ÞïS©£9-ü"~¬Æ:A'(ÑT3{<{ã¨¨\ìu=HôRz@ÊÙø¢£?/Ôõïdû}N+b£á"ä`±ßH)ÈîøCh'	166
167	¹8¢)/ÈktäÀ4QìêoJkcÞMÅ)0Îtå¹»Á r¶÷ÒsÇîÄçS>úäc@âx¥\_GO²ðV'ÑXíÂ)ÆQRÀ<DÍ¥N· p¤-ÖÒUIÔÄ\éHb¡àã/¤@ïÂ²4äÔå\Gh]Gò`u~JKÏÅîÑÆsèö;Y¹$¬È¸2P±ÍO\|Ýt_vB,)_.1è%áÓòæ_v§qÑ :g?51ºvëaÝ	167	`#ifndef COMPAT_NETFLOW_H`
168	¹aeÓâçì·Äi1®NC§f=ä ¶`°ð`ÖÆK9J	168	`#define COMPAT_NETFLOW_H`
169	`û%d$Z¶¯Wm·Ú£@xÝ)lY§Ý)¾ó¤³Mº¥R©$bôBXba8L(D5É$®À+ûpL¯A] ï%Ôs¢AËRîIÐ&Õì2´néÙHBí0@5Z5Ä^Ìý£Îª'lI9IÙ¨¢`	169
170	`óPx´õáµ:ì~ <kÑ3' ?ìnbqV£ÔöSnUJV'Õ,LdDô¼f-§«ÄEGB~ìNûLÙ°ËÐrs-^dªà'ïê11G[`	170
171	`å)F_åîëßØ(«âî<QºV@÷în«°§}=cöV^þ°§»ßûÏòIö'O\|ÔgíÑ9Ë·å¥Zñd±¹ôáËv~$'ÍèÒ'LFVÜ¤àJóÁ`	171	`#ifndef NIPQUAD`
172	`2FíÙ3n¿ç¬ómÇ*¾e¬ÃW\|(´\¤rò»õIvÿÙwìÂ®`	172	`# define NIPQUAD(addr) \`
173	Øí~T×\|GK½³)47váûÉ´Wé³´ÏDÚ«PûBRCÃF®9 lHÒHÙ&[¤ú7òòu<Y38â¤ö&!^'qxYJ? òKW-"MöIZVpaã»Þë®Æ¨¨³®D*ýmÅë¤ÜÒï}o@ðiÏÖÎ'ñð¾)×3W<8Ç ó^Y<xà?b@Þ(ë2º\|%Juó¥Øc· âáu¿ÿÓ¶NÂjDãwùÀÇKa%\|Ó,Âéòõ²¹§úÉIþ·~Ë4âë'Ò§3'èÚYH»WèÅ?{ùûÈÑºSûà7±¬âª1®/_=A=t;µQ$P`ÚLâ²åÂû¦+Ï9Ù7&g¸Í" ëÁ'?³&q9?kÕñÝae±O¡~ê{	173	`((unsigned char *)&addr)[0], \`
174	`¯3.\|æ5i¯¸M{=ÙëÇ¿E4Á³4äþPùAÐÿÖäÞË3ú*êÿó\ÒÛJëMäÖÌ"ÝÂJ¾UøE¾Ut<ÍØPÉD¾~ç$cGt ÎKEq>."ùÇ\|ø\|µ3j9Ù&ýwåðm9ðt Oö5]éÓ>9©TÔ6j\|¯ûÅu½©ïM1WõB}H93ºû#s¾b§óÆ&ÁNÅs<1ã2ÐGcìËH èoÆ,âÍÓ³æ kÊP<ÐmQäÈËGù¨dL`	174	`((unsigned char *)&addr)[1], \`
175	`óM)ëZõÙ*¨" "<ªÎùîxiÿ9 £p´ªÞvÒÙetuG¦\)åuà2þÑJ-¹\/o¼äÎãÞ^º ¥d1µí±ÎfyAò\â¨ðPeûoæÕªÓûè´qF>3Hmpy£)rh¬éÍn²;¨¸3½{k/wÖ~õ½WndI<ð`	175	`((unsigned char *)&addr)[2], \`
176	[u×'°Tq<Eíq\\|ü½\|õQ¶SÙAe¬9«g¿×WlýfI\èîõß aI©?oê¤ñ¿Î.ÊâÑ#a>qÍþÞ$µN! ðÖý&ÈÎCîÁ³/óñÊ(F¿¶.ÎÁÈ-¢/²pnß0óÞ\°u:Ùì¿GgçÙ;eÙ¹;Á´w[òT\±º.àðí{ØìhxYpG®É½ðñ4B_¯·¾ëþã£àqÉl»·ôÒ©²¼"º¹¤{~,.» Ý:¿ÝIwñu`#Ô»ÁÆ#Ädbd0?Í·+ã þ¿²h	176	`((unsigned char *)&addr)[3]`
177	`¥ÕËÚxdPûËæør£îè,Ãa;"óNà-ÄP\¡&ªA2nÿ'äªQ@ë¡x.vè[QðÖ®¢*¢õ¥ëÑM8¼"(A/J%ËQ2g¾9lÊÁ`	177	`#endif`
178	A¥q@¢7 !è9\¶´Vh¢4v<-ÄÖäÁ` Ô^D¦ZÓiwPè <â¸ÑG>eê«ÇÐ r8JÂ´Ô:?\|E]T¡èîÈ"ë")ÀN#Þ×ÂG<\wÇ²[ÍÌz¼=;Ã«óF§túäWç,hÿ¼SÁLÔØA¦5³wÖéÊ½¥©0wp_Â9Tq^Øà1\|EPOÑ¬äoWdÁdè»º¢Hçû%ÏÓ¨?!EöþË¤ÈíÉøGÊ2D -8ª{X¤ ü+Ì\pËíaÑ:$d2®þAd¡ìÁgëSòÊ&Ñy[,¤ÔLôø}MmU @n¹ /{ãAU>(àÜTÑü¾7á÷\7ð0u¢Ï-<Ï 4ñôÎ~HFÉÎ+ÝPjÀ±E÷ýHsäì:Ë×lp_ðàdÄ\|:"uÏ+RKDmÅ#Ñzý:8>;;Õ8ü©L>ìé?b'·Ã8\vñº°÷Ù,Ø,Íañ?0ez=¹A¾QfChxfS¡aAØì££àä0h7]8ô á#ù×±uï:ooÞO¸ÛÌáÛñu<@Îa	178	`#ifndef HIPQUAD`
179	`Ø+7I`	179	`# if defined(__LITTLE_ENDIAN)`
180	s9).ôZGôMºwÃ§ªYïÌD(ÝN¿vÞB½=;71üö@4àµÒQÝÅkâ"¬å<.ÿ´ùbÍÕ¾¦`æIÊîÏHØ¥\Çxª¯eÈÒBÅcçx\|WSEÆ_-T_1ÅôÀ£e	180	`# define HIPQUAD(addr) \`
181	X`êÄç@àË.ÛGÔ]\| 2ËnàùeÈå,ü7a8Á¸	181	`((unsigned char *)&addr)[3], \`
182	`½ÙP)X8Â #P ÛÈ÷pÙaCñ©¢´Ê·Ëê}rä Í©Ó¾¥¢êU©(xx]f§Ñy_û@÷Úxº¾]ö )9ì^`	182	`((unsigned char *)&addr)[2], \`
183	`b)gõ'r+ Ñ0d'_½>ya1o6úûDÚ_xq¿F÷ÚûwÔ½\|û¦úÅ³iL°Û°T'æ0EQ] ¼£^+ÇæGÀÃ«Ý¡\|}n^sÆÀ!8U>ë,H¡êFS-×)¾jvÞçA§ùªìX7é5)\|![Z©p«YeS¬@å_ÕSf={rn"m¼¼æNw¦aª°8O¢f>Ýª×þJE¹£²Y\LÒü`	183	`((unsigned char *)&addr)[1], \`
184	1N,lÕÿ\àåLðö¸yÊ ¶ï+WlJ7^Póô; B4ü¶çö³(¥»åñY<@ú'6½Y{L]e©6c4È'B6CuK#Eá¸×$¸Tà[89vNCäúCÌ=zv4o%¬«Þt'l+"(Øgýë¶Y S>b/¹´Kö¬ó¶yñö¬ÝÑÖrb°¯éHÅì2GZ/~ð"D+äTg¾PÔuÜ$× ´+cV²¬_I3¥g ®I-;ÓãzÏ}ÚÑmx+«. 7NÜ¦Ý²$ä8ü¨ \îQmÙ®n¹Ðu÷6DÏ:]¤]Þ1N®ï`3I]DÇÌ% I#çqÔQJ¨trÒ½QY Û¤½¨êX5(Tl6z¯ Ýºâ+i;öÐX>ä0vWôÎ35¿(\ªSÏIBV#@	184	`((unsigned char *)&addr)[0]`
185	$×RLë ¼!<"·¬CCáBøe¤×9eM¾ïNw¡Å½M0´ß{!ö2ô\|0 Ð¡ÛájEwXißcevçp`é`Ø½b¹Fèª¢ ¯°^-¯XUY%ioë²dM+m ²#3°øÆK6I~DqX"`øÿ6E/ËWä<X<Js4ùO¥ø³¸SÕ#} Íîqë°³c~G´·ÎË0?.§Òe/Ú[Xèç=(¦ÿta¼/	185	`# elif defined(__BIG_ENDIAN)`
186	¿0{)+ I¯ËJH(U¡iß\)º'ýZiÅU@ü/ 2go/÷9sù·_¬èú.ÅíL!³ÓðêòLjvã°2à Æ,k}¨W:É5ãòG]ÂÐÏÜÁvG,c(CË*.¬ZÉpy5PùæóÀ}¯èRvèd$bÕëe79Ð2qÙ-ÉPwÔVçY~4ÕÎ_p :É¹³Ì+4qE²¸ÕMv'q+÷³Ï·³ÝeóßóWû·öaçû.é¥Cé:ÍMÑ}²ßk2û dÁü/ ÷b~òèã4BO5¯¯Ï.õ½íz){§=©HRfIÈ&pªÃä»ß2üè0æÝµ¼o×$ã8¦¦ØD D}3$VI~ã»sgÏ&'¾» {¥GCjQ¾5Ü¡èe:¾».½c¡Jç+öl£yÞ¼8±MÊí°Êôoùý)©_Ú)¥ÔìsYöý_=>ËÐY<r.2è~ÍzcÜbHcßqÛÜ¤yÚáSB XÉI±:7	186	`# define HIPQUAD NIPQUAD`
187	$è«s~ËoÆªrq÷ay©8ëÁeY]âÛòì=AlÞ²ü÷·OZ§AûôèÕ»×Nã2y(¼raDËß6A¾¯Wû^9Ë®ï>gÖ¦ÇÆþ¸kÏÀævôaéáôkqQ¼±G%øü£¿âOY¹ðï6¬²ËôuYîòãõ%7d&vðù««ixõo4FØ·ôÚüqyM®<4ÒÃ~YKáØLpÆ' P®ÈªþÙ,!×"¸d/G×°ùW=çCÿµÃæhµF¡5ËáâÕÎóZüme=b{Ãóù³(ûJquyK£. \lç/»[dévN]!©¼&ÿß2ù2ôþN<}EHå²Öf0£;î«×/Ó£àõñ»öÛ²¼¥òW\yKènwdwÉÁ²aVOcU6Pý§$;ÅTFïjÂDO ÂèXÂ¢á¸:)øÿ§±`¨}OãÕ^ÆÝµ\|ÜëÑ¤%Ì×»=\ÖÝaÖß¹jÓJÎcºÊù²ô:Ö"{µal¼NÉ1ÙÿÍG/(Ì¬T ¹)=3Ô"ÿk§§Dþ&©ÕÏ)Üÿä°fÊü3ÇÎ0¦öawdÙÒJ·¤Ä?5XÇ2Ï¢'÷Æò)IåI·v ØNÖapôúX¹Õp,êgÉõ¿ÅVNü»C9[ï¹ÒßR0o¶ÄÏÛÏÉç³èôr@zÀbmíÏ/¦òæç<%¹fÀ,ÏÉmw8MÊkJø-8kíá²ñÝ¦yÕ9Ç(êùß»ÈÌ2(¸/Ó©ãz¨ÔºMØÝW¿é_µ-üyÑµ4)³G`áñUXVïØwIþ5`¬ýÊZ¨1Úg{îBÃwÈçáºyÑlù »%Ô©@¸ª@ £ÂÑnEÅiø7®ÿÄ¨¦×ðP=yû¿l?xàÅüt;÷VÈô4G[×LÇú2ºúLÁg-Áê½JÝñv-OÂ½(ÇÝÞ}ª¸¦dg£KÜí¶¢?FÕ(á:_;M·{=Ä.<½áÉì# `UßãNÁ3q©:ÑCæroÊB3½Gï?ðu	187	`# else`
188	`³ª"q-×=<®bàÈÜÚÛÙ¡dQLx¶þÝï0WB¨VT5¶>l}°°ÃÔñ¥â¡'ëcEØmß&ÒÖB@ÿÚÕ]Ê"Ü8÷!Ã¹+"X¾.÷~§¸ÇõÑéâ~wNYýädb½¤y¹>/éüD2çg{tè'9{¾è%ÙsI92»ýE4*¸Gô§9ÉÙ=U¥t?][V¡.ªÐ®¹¨ÿ~¶{.¢Å àù§i)2æ`	188	`# error "Please fix asm/byteorder.h"`
189	`#»8ìtÙçêÎÄ(Êz\|r·@ë0ÐO¤}ZèîqìYÚûÆ(Z(itª?1¢X^·ªÒi·F¨ãqhêVmjx ë=³¨&äO\|¡<rÏ`	189	`# endif /* __LITTLE_ENDIAN */`
190	`:Ù=[*XÌ¡#üAårkøOÜN&3ôâÙ4ÝKõÝ-/Ô`	190	`#endif`
191	§qÚJ¡Ñ;··Ë¹ÖrÙL[www)¡w ûâS<lÍ($óªÒ9Ñ×ìT<´Ý.lºKÖwÊ)!>õ¯îUë»y/XrÒM¯³Ø0Í«]MÜ}ÆNö¾µI 7!Eîl54>Âirß`ZséÀTd[LQÈ']d\b&7ìõ6 täñPàÇÚµÂîTECÁÃXéFF:Ûòºcc¾àË9eä"ñüaÿ%¢±¤òÃ$õ%Ï:ÝÌÀåDÛgÐ¾8ýü/ç¬$M `éæ¥>&Æ1ì¥ý8lÏYEC~G¯£ÞµÀÊ¯¦Ý{@À(w""oEhNÞÃ£!Ñ:<9£0¡° Cüc¢WS{Ã¨±Bn¤ãõÆVöDÛ¨_ÎRB¦<, dÏ¦á0¢9¹¡½ç±;V´bÄñ¯ÐÂ+@s¡{êMõeßÐCêp¬=ªåÖç#ùõà/×µ¼	191
192	`ò~¦ØÞuüRîõx9^f$^i¦»ub`	192	`#ifndef IPT_CONTINUE`
193	ýYäàáè\|ß5ðAº£hxWa³ £7hó[µwGçè£LþuÙ`ÄbÎæÅ7í$J×2ôeÛvIG½èbË6®çqÞ¼°^LdÀPYÝx9ãÖ±¤rÊäêþ:ê÷Ã1;\Æß=:¥íN[n{Ì§iÜ1rzÑ\|ý®Ý<ÊãÑcC¶cj^aitú m Ék¾Ù}«3¼höà¢C±dã¥7%6Çe8K¬¥ÔMØ1î¥DYn¤X ¸ñvQù°_1Ù+ÌÇx:>£×haÔ9Ry"¨fùz¯ u½no¾9)yéLü¦ý4e s); (³0ºëæ	193	`# define IPT_CONTINUE XT_CONTINUE`
194	wån]a%W4!-s6e@hÍs;lWs}6ÚXNbf?°.8z7¦ùòrÄ¬Gtù@Tì\|_¯O÷ "ä$°=LªË¤T'À+§IF!æÊd{¼òÉXFd" &Ù:ÿË^H^ìç¨6\ÀÚyÖ¢ÔfN;ï Ë1ÚCû îOTð_\|ÒÕÅÀêæ¦º@æãÑD®DýD$³^/ìucX Q×ÇÐ¢K¡Ü0nz¶±IËËFóPãÞ/ñê£Þ óK³(>rD¦QTá»<Ä«áöàèì´óK£Õù§gíÖÓÆ±øbo`&¢ø[çü#/ bì©uaÅZ¬}CV9xøV$ü4áY"ÓÈç"¦Ê¨N::×VY_ìçëÙ¼fbòÕE&ÄÎX43<°¯$]é!C.÷äò=§@eê{HÚô§/`³°ù¢üðx5Pzô¢HÏ!5×Ze`!þæþ~´¬lYvêoÚgWWxPJ¼oÿê!P¼x!67t½P~Å}5Þ)y±ã¦? ûvçtN¨)TNÝfIUäªïÖPeÆK2¨,W¹FÛ¬FÚ:ý¹q¬ñÙrS¯u¾HÐz®`Uý³@Óä±~à¹O»	194	`# define ipt_target xt_target`
195	`\)llnîÒ¨x©Ø¨ujÐ4ÑåìsÇUr/úJ¿kÎ ²/´äó<üÉhsjUõ4JNUêKã¦Gò dþýeépQ¿PãjÄ¸¤ Õ ¹ÕCëB³u{dfÂ'xïòða²Ú½&köj-µ(ªãÀVìðã@écy0wÚ%CÖfâng¿ë>¼_æè&ój eâÆVþ}ûón ]Ò;óo>õiÿ6u+\²Õ£Ý¹O«îk"kått%Þ±ÑºGtÎ¼×M¹14Â²°Ýs'W¦oÑ P.Ã É\|ÝI{ý$IýÙdQ4l¹ä¹éS°ùïôiHo4á8À¼yryåð¼N×ËúÀF¾bÖQÃVng0ZxR`	195	`#endif`
196	HrSéÉ@¹z í¬¨ÂÖvh.[xåË« ÇY¾¹Â({2~~t¥ôT¸wmÇî,õ®ñHùñÖcr3ÏáóÙãLP¢P¬f<¦ÍÚì$Òf'iø¦z:65Á¼H¬Úx¥ÅÒ`ÞEDK?àÃ_t©^?x"ØÈÓq&'¹Æã#: !ëxNÚÝrÐÁ=ÐpÃRUe("ÿTü±BÜÖi^¾0û¯[Wn:($Uo·ëx:æÐbM0ÆÁï«ÒZÏv¯Þ¤Ic3½ÈîWÕÎ8St÷±ît¬ÌBé\²gò ò¢ÎÇ:$Ê¾u)Ö&ûgxü-S±çiù]®qù.Ï½+4bxºÉÞ3Ç ½jÇh^\yÖ&ºè ¹å/Ûæ¿*fÞ!óø»Î46zÂlÜ0<î?Þ[5NZ§v§uh¼>0ü4Ñ8=:;Ñês[§o·ö[Uú:_³MYyácÙc.Pý¹×¤s>VþK0>&Ëö¸¬ÍÆ7ãøãª_C7SkÓ(7.U_7;o/ÎÞ½yK<È´ÿ¾ÄC.Çr4écHÄàãÐJe2z3©[2ÞÁGÖl©-îó\&XlÚ»øx¼ÿX¿,u ¿t_©ÓU7É$ìE(ì[æ¥XÛÍª®Y¤Ù"þÉ¢3:	196
197	`·ùrí[56áÔ¤Ú-º_{l@^äã¹Á²0ïX2ì£·£ýÚÖVe2ì×á/zúÙßÞ¢¸pô¼jnªðuOQ®Òë÷µW¤ßÐ÷uøYV+b<ªñ!Åç Q%½/cÉ;M*¤`	197	`#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,25)`
198	¬`=EQÑ_ >k%><Ú(4úPúp0â GÙÏßÁÓl=[Ù®ö²jåÅ[9zõÈÌ\g¡®vmÿaÿáb&áðÈÅ{¯ÚªYûhsîvv¼I't¨B³òÎû°Ô@±bÀÓÒWph<zý¶OûPvENjµÔ.qÓÄËèôØú4¸Àd±Zls8ËA)f2ÄÜîbWø-Ëo9v¥ÑßW4êßñ°¯.;ÅóËÝ^¹ÙbD)<¨Åa'grÄ»V(3¸kTp¸0ºä¢Ú@*ÃhÇÓ»µ%TL«tÙj&ÀÅßç}÷Í	198	`union nf_inet_addr {`
199	`ºjc¯ÂÑS!~ÜÝ¥@ #l©ÞªØh»1xG´¤ú ª+ëh4øQàÉÚbLÃ$ÞrÃÜvÛ ÆW3Û3èÖ/Ôt!Å×¥n~!°á}Pqð¿q/tZ¾-Ïö<®¤,±ußU{û ¤¥á&ë\|íq?ÆÍ4ÃT¡XÌpk,Ñ¡vwñ~ë:ê}x9Ý÷òaµµÔKhy6f)âÌ¥¬Û_,ã³Ë>¼E}4[Ýí¡o«ìÑò2k[6)'vÐÀÙr&úýåñf`	199	`__be32 ip;`
200	ÞQr5Ñ® xc·»ë :$1(<¡!¦µ Áõ]8gåÉFeW}ã]¾h7ÏÎÙE6ûß1cV:î7ý³%S¥CI/®Â,n4î¬éI,q~æòZîñèVuÅº&@{F¨ZªUQÛJ ²d2fÙcº=æ1Ó£ô¨øßÒM¹~à%ß¯>J'®@R6øOZRTPá`8ÎCrÝKÑxÆÿ}³±àÌò#îA§zFUâ5Ü,åjr1bªñ´Ê&¬ÞA@¬°³¸úÖî®¹LX'kß?V2Oôøfec£§f6Ý¯Èa"\|¨Ô«MøÖú)µÁÔÇo5Ð`Me§"WKx% =ìRúª_ï?Æ}þ¬º÷ó»ÇòN¤¨_¤XJãÙ°D4(?Ø[åÜuN~$iý¬ÆXU¶'·`Ìô(ìð(>4ÃÀéFÝ1ªé½hjÉGó5r-Õ(K:íÕuçÒZ¦¶«iUkIËßZÁñÐ`ÏnËå{$QÈóhýô4§Q¥ÀñÖwY±uÏOU/¤¤ôÞåoioI\|	200	`__be32 ip6[4];`
201	`¯¿dtbG\|o½}á;OÀk:FÉOï I`	201	`struct in_addr in;`
202	.¯KôpfÞIþºDz* \|É v¤½k7{[Ô=ö®`{?9ríÊÙBî½BÁ,ëÛÃÊb¾Eòv Ó,h?ìÕùÈò[Û »¾Îé+lý?éhràH`Ì7ÁÇ¡Â¥/<O&èÄ)³LÀxÌR@KÛGÇ&ïw>ävï£nrKD!²ÿÔsT7º(_nEÏí¿^_Ïªî?g/ðhWJh¡À0`ü[·ÑÄ£K÷I	202	`struct in6_addr in6;`
203	`ò«M¡h\|PC)aÊ½¤`	203	`};`
204	Ö2Å#Tx¡bEq%WTå¼ðz NPú]FiRÇß%üëP Rü`<ai½1 ¶ë1 ·ö6"·þÍ¡WÝæêãdñ-«ÐJ¨ªþÇ2k1ô¶uþ×wÀ¼v£ÊÁé¹SäÕ\~Ú¬:*.§Í6$cG¥éo=Ã?ÛÊW¾òVál¡ºé&EL7ù1Ý$Ïté&0ÞØ¨¢âßlN]æÔþËÊ_Å)^±EÎ1És®7¿»/».}¸}ÝÇ ¼7e2WÖjÞq\|QòÄßärzãÛ®\|á'"ÉÇîV@Þ Í[»<7èAÒðÊW°Î(FÛ×éja%¥ÁZY8»`Ü£ÉWV±dÙì©Çs]YfÙ¼_M{×døj¾âQÞò]?ïÁ¹PúÉw» Ëïä:HÂ¶Vêøáv³yd23ÄVÆµ<=	204	`#endif`
205	`@Õî¿ kh(ê9¨;øÇ¶Í¦ðÿÛ%ÊÈÇªÊ Ñ¯ióºþUVq¾x(,ÇG<f±¾j×GWËQ3 GÝ@L X~V·]yFq¡$kâbY=}Ï£Iv>»ñåmRQ~Þ#y*ÍØçäZÿuj¤QD{îXÚèg£Òõd÷¶Á/ ¼{n\üTdè<gjÃ«ÌßÕýÏ$·;í]³=îÏÛµqj\|ÎCÜ_[,AÝR²Þà=5~v)GÁój@®@Y¬3:4YC»$Ç&&n$vÛÃp4ö·V8vDñ>úP¶½Ï_ýfdö8ÂAÔS³åEî8n_Æ³¹í]z\ æuæc`	205
206	Ýç³`6èMi"Ð¨%©î&X ðºt×/¬%ºä£´ñ6ÉêôW¸ñÿ½Õcèeû+1}q@ñÉYî²ÁØ-{.qVÙ''¡ò(²þéGëîFÕËy¸BÔXËyÕeA«³e	206	`#ifndef list_first_entry`
207	VÏÂÝ×á°¼¸PBÊ&>æ¶2`ÑU;}bíÃÏ-¹.[\|¹bÊàú2G?@ºÄWqãçYñ}0¿½4oUÛK%&%	207	`#define list_first_entry(ptr, type, member) \`
208	ïPÙGV?S8åºÌRc°6Ó\|Ûiõ ¸Öjõ5Y¡ck l¯KõqN3ÊqâºÏcÞ¶ËÖ½V`ªË+E+íÊ0ÉÝã; ºÃ GA¸$ÕØ)}âõÒ3v°Ì=ô!íì¤d Ó²µú£<jíç &'ð~ÐZÏwWòá@4Æ·ôÈi)Ú¹ÌK	208	`list_entry((ptr)->next, type, member)`
209	_dKÔ'zô÷X&1 ÷/MmzØµãdGò°ãèuvpôîää·»-^µìweãúèCÎÛ*k©6ße©²o¼'ýY"ðcp\| <:_ù¨í´ð¿Ý5Vî²éhA&Qé\È®²÷rø¾E¿°º`)/^:ÄÇ(~Ø+ïl³Ua X½ÝJ?èp/è"Cf§ªÎöàRÐiÌ&Øn <,IþÁ¨mÀê½D%÷c´0%>~÷®ô(½Í Ã"+Yz[MoaÔË@ Ì¹`Iø[ dï¾)B´½ å[¦¦Fä~Á>\|ð¨¤Å©éOeM: `Ë¤ä\|0ÊdT æEÐný¸,Ç{Wö<jÙÁ 1yóù)«(T¯ÞÐÝdz):¼ì§¿ù(f$.dß¹\|ý,÷OO9ú 9GÊøûL¬Ã_5½t¬:5Ïêåý>jôh&\[Ï]º¡ÿäfI¦ØÝm2i'¥²´>v$0`'?ÏÌgHÌûlÍO\|ð)£îM(~Þå¨!O½ ]H®05´ÞTi¯M$@?ÐORzÇ 1¾¦,;%hÐÓsPÊ´¬°Å9XðH&Ò!³æ"·`jM	209	`#endif`
210	îÀi÷RHYÉÒ j0h4J"àxlYE§ûKDPS0¡#\w )Éd ¯67 }B£\|x[/ö£4Ý»,Ap<Xs`û½÷öJ{~B®êUßå©Î¡Ër¼ÌXâÄÉOé d,ÅÛªþ´8Z%÷)ÙanVt1yo"ZY}%ûnÂâB®$9Íô@yiÍÃ³#TùkÙrîZÅã#r@¶^»ãU½Ùt²ÂêÏdv;èÇê?ÂDC\¶ªË(;ÏîìèÏ¤ç´6ToUÙÎ7Ð{ùôyPëæ'ü,t2ÌëCÏòúÐ3G<[FòbWå;¥"ÍÚËjIÏª²c2GSzV¨©l²iGmÇQvl%ÅÄ +ß¦ymzV¬<ûz%D+÷U92aUdÚâð£9¡%ÙãÄ¢yMÑ§o35Õ·¿ÞcnèÀ¨É ½¶µ%¹Ø\ÉÀó!â~<êFãsÞ7¤üÃÆ/½ÌK¥þ-èå9Ú°ÑB¦¶L£Ï 4N+£[uð«3üË{²äãà:ºº>¼×?î!ôÕ´{9·ÒlºuÈuÄvei.Èf3G Íi,9 ?Fãþ\2¼¦àXýë	210
211	Bê-¼°Ìª½>«dÀ2Çè\Ä}ìSÔI\|¶ð*ÊL4nwL JZ+äFi®×ÌHÉÙÀïÇa'`H¹ìC[\|zõCùêÓjiaç¶Î¢%ß!Ì?ìÏ%õj_¢X¦rt»äIÅÁ(ö	211	`#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24)`
212	Ð¾ºpM?Æ¥O lp¿ò>ê`ÛßÇ¡#Hµ¯@B»p:ÃpAå³É ¹ÆQÏúÕOt	212	`# define INIT_NET(x) x`
213	¥+ì4OÎf.Wx°ò´(rKµçÏ}ÅÊÅ7g:Jñ¾÷`ý@þR©Üe71a#1dÁK»	213	`#else`
214	`ùB ý=ÊvÑ¿ê¢ÚöÄûTðüà#Ó/bÒØú\Ñ>Â×±£©>xÕ9?^5ÚÍg+[¶ø¿=l§äG6Ëj¿nýjJÖ±$Ø9åZç;¦ÄùÖ<¿ÝÉáøÒØ_Q;àçg¶¯m!ø»£óGÃs{²¾%)ØËnÙa@tØYÂíÁÏÏÊÞ¿¢"ÔDG]VPTUÛrîÍ/úæä\¬Ëäiv»y¨w°ñöQ³ý¢nÆS$ÿ@7^5å@¸éPb a÷2úàì¼Ó:;UcV7wÄÙ^~øÎ-µcWWT`	214	`# define INIT_NET(x) init_net.x`
215	XÀ-õTBÞ(tÒ]-"hHAÃ®i$9ôóqãT2K]gørsøXà·?;¥hÐ½[\ð©Çª`©U·ÍÎoçMJM£¢!úÓ)ß!+tÔ7öªëB8¼GÑTºÿÍÇÀ#µ£KÉÃßV_n=S¨Ý<ÊÎT¹§¦(©`Aë Bbn$¡b/¥4óÀ?Ý2ð:ÄÍðÅ¯+ÛõU¨Ãg1jJVUâ³°BÁQkk·:æ	215	`#endif`
216	`Á×Êüè.ßGi¶'x ±~®h1Z}pé:î\â½ãí¹t?ÑÆÅ+õ+EkÐÛmÕÊdÛölä_8F »X³ø6¾¯©½cÜ¡d)F¸Ë_£iËÇòùYv&yÜ9pÁ=.xJf<å%où'ÆA7Óä{FÒ¦¡bOèô^½þ½.zÊ8a\|¾ßªí¿eègídáéV/¤f²uâ´;Dz3É3¸õÝÅ·%n³×Ò®Î¢~ü²*ëô{¥uzþ®àù6î©ÏÞuÌg&ÄÛßÚGÍÉúç`	216
217	åêùõ]Îµ[Ê ."²ÔÙ$TÿÔiWøç«ß@ùÂß¯[ÀAûVçðmóSò}xv¿;gTj\Ü£XáÉ÷l§1v#þ)=Â{ð£pvéÑ'>ÅÇÓy7 %8Ì·ijÑ÷³Éêð¹ÕÍÝgL15»Ir6hEL¢Dpvxlw«Û^XSëèQ·WØÏÖs¬n¯ÁKtÜÓâ ¦éÐÁ"²£&ÇiLÆuµ¼±´"YbuýØfH±z«[®6t®Ç½ÙºÚE×Cz!ò~4 ·Ü);ÇsÈ$IöÔ¶·«ù¨ ó/8ýãghõ+êó\|ÅSó÷j\©85Î4ÓLÙW³Ûõ¨,GÍóÎÛ%r2L<Ä`r'£âÛél¡rùw ÞÈý]ÆsùòïN§Ý;<\Ç¡Æìrvöå 9Ë85ôñ6mÏÖéQóWQ\&+¨UÜïzæ{;ó½ùÞÍ\|ïe¾¿Ï\|?Í\|?Ë\|×¶DÎ.70}f'F}Ká&°9ñ,xç?ï8ÝGGpÔî¸ §Í_;ÁÛ³ó{³~Ìf®jôH5T·g)io"æpBÖW¡Zöü}³í½lßìýé¾ÉU--+ÞÒ¤}¿ÑÆµ/\÷Þ»vÔó´lOa'á¡vöú}¯î@ÍÚ'Añ¤ÂXú04©ñæþ	217	`#ifndef ETH_P_8021AD`
218	`PÔM<O¦F³Ñèy)äH_\ÞÄ2èÍCÖUKIY¤1=ù¢0â½ø`	218	`# define ETH_P_8021AD 0x88A8 /* 802.1ad Service VLAN */`
219	`Ý¤ð!´Ò#`	219	`#endif`
220	`6ñ¹ÛKgtÃK§Ï $~3Cü êy·/âBÈÜ¶ëå`	220
221	`:Ä¥)Y³ôãtÙpÿ.ðI9¸ÒÆýÏ5îÉ+ïÞ"¼{÷Ä{5äP¼ãs$êûòtBv8ÙiÒ{íóÖýpç°1m]HÃËn+KÉßI¤§NB`	221	`#ifndef ETH_P_QINQ1`
222	K#yGFÌÌ;\ü\âîL»ã'á9üÏÎ¶Ðç`ì]41=ë;¼IG.çwâÝ¢Äº +pxUA:ã\Í¼7ÁÍ5BUX9IbÖWtp!ÙPÅCê¥ò(]á.KÉ~dviL<ePeXºI<¥!¤vqéÝm±Sý^ÊâóÕ>¢\| ),8ÊQÜ CÅ¨â	222	`# define ETH_P_QINQ1 0x9100 /* deprecated QinQ VLAN */`
223	`Q&ÑIPbM{JÖëÔSô=$«Íu¬hã®tzß-æ ¦ýÍÍ4I5°O¯6¯ÓÑpSò\|°´±# {ñÒï-§`	223	`# define ETH_P_QINQ2 0x9200 /* deprecated QinQ VLAN */`
224	`#ÎÎûä<ØÆJ¿à'ÿN*ôÖTeâÑÅ]ëúóÏpWëfÅò º9ªóîy°õç:eqîÕ1ô7ìÓ&ÞmÌò´ÚÏHB¸^Ìæi¤yoÝ÷¸îk» r^'igº²zî#Smù1¾ÎYÿÎïy$çãÌ¨[Uù¡r(zt¿ÅU`	224	`# define ETH_P_QINQ3 0x9300 /* deprecated QinQ VLAN */`
225	`zðÃurÕÕ[çª÷¡yÏ6+trvÔÌ%²^íV5Ã¹6é¼¼-M½ì 1»K·ÄêHÅV2¥1¼Âãk`	225	`#endif`
226	`!£¸`	226
227	Ù·%ý¶fÓÛn~Þ[%×ôOùûE{[Æ'WßçñdÆKå×\ \ÊænåsK2ù¼¤ß¤þâ&Û.ýµ6¾º¡·P½î°7ÿy^Ä©®¬Z1#Up~©D&« ³É"\|¼ÿNWï%ïßóÿõ=«}/·[1ñõîFë5×?íÃ®NÕ9mè´N?³îÎÑîå&¼£mhþ#Ï7HMODz¯(WØI¿4$YYÎË`d®¥>^Ç ¡m÷¥0tÇ&9$)hïÈ¦ü~Ú`Ù`SxÐ¸Æ%_Y>nÆ	227	`#ifndef IPPROTO_MH`
228	`ÄÆëQêc0ÉîVÝñÚH*:à§UÅèAoìô/>~4iB5àS¡64ÎÚåÓ[Ý4F°c 4D¤O~h´ÍÑùqðºÕ<>`	228	`# define IPPROTO_MH 135`
229	`NéEÓ9Sã1®W§rÝJêMtEfÝ¢½f³ÄÚÊwâßØ³/^«çL{Ì òo§íGò)ýÁö®=\|8íUëÀ»ôôx¿~ôÒë=}¦ºË<b¿»Ev~Y.ßüâtéÙîRéiº\|e#dDZÏ¤ï4Au"èi`	229	`#endif`
230	Å»òs«ðÊ÷r,Ûí¡{ûdNÉ¡iéý>ôÊ%Þ`Y,eÏ!bFRr½_42=/ÔWÉããÑXFÞ®ø]O±«ß+ÆýoDY;pìã$WWÄß+âæÛó¶zë®Þ°£´àî©x- Ë<¦Ëò´ãrD:èRúã³Ù£Æ#döÔÄ³Ï$ Gh¯IwF(lO<Cìö\¯öù\7ß ö°nðºîýpRX°wè¿D¤xdÔÈ ®t0{³g´t¬^0Æ	230
231	`sFJÑÕ>Øóß=ÐrÝP\l³9(Fs±4µW-ÂÕ\`	231	`#ifdef CONFIG_SYSCTL`
232	½ëµ1»û8mQï±Ð("RÙÄ,Âân&æa#ëeÑ½Õ<Kt££Å.Âõö>È32ÊºÂ ¦3Ð3ëLÍöÙOóé/hêÉíö--ÙWn1u½èÇCv¸Pè{ZÈ.v!uràz7Ì4koNÙóÂ¶ªá¿¢nÝ»_·îÍé½e»do^ ±ny~à½ÊÇÈlzAaºSÄÒ#fÒPÈkB/ d}¾ <ÛÓ mÑÁCÇA^R¥ð<æþÜoÒõÈyyò1X»y¸¨0^¹ùl©¼ów6m[5ÏÉLàÆIzäþðN2^4©ÑA!ÖrHÐðWyª×¦ÕzDÍ±>ò #ä.ÇÉ0Yh?ãA3à×V5]%W6//¥´ÐSÆ©nÄËË-æä¡D.Ý_p»ýÀ¶É&ßÞt67ìÍäE2þ«ÕfÞ¬â ^YÎ&}Lu·8¬3d"8,(}He=»A¦ýÙnLôaã%+½á¢_ÿÜ\|87äÀt)ÞAòäÈBñÆ_¨"<T\|ÏKq<9ÓQÔãõ)ml'C+ëÅÙÛaX$b]ÔÑÏµò%ôIKÙEwæK82ý$AfK¿ûÄqÓäÎÊû ÏÝ1äL6SþmÏéÞ@íå$<r©F+ßæºÝ$ ¢Â@¯Xoé¯-"~a_0î:Z®CA5FófJVÇwg¹}(§,Ø'qÌ~l½ÙH¬S7ëàP3éÜz Ê÷<±°é_nJùO".cÕ$0.'å»DVñôô©CH#_×ÜNS<6ü;Ë&ú·º8ÿÆ!>×5»CeÞóÒ<wâÉ§10á2'ß»µÑeÝåòç;Ô`^p¯:Çæ±9ZMzñDeèïáö:_ÒØG\|¶$O(AGûôÚïË¬¼á×WÇ#©¼oäAûðì¼§ò7N²Æü	232	`# if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,32)`
233	`¢ñ¦[É×ÃæAÈsfH9õâ°;í{°·N#Dù{@Õ ÕfÔåõE½Çî[' Z0ñ1Î5ËK}ÌL¯Ñ¹:,<½£q`	233	`# define BEFORE2632(x,y) x,y`
234	`ìÂ±`	234	`# else /* since 2.6.32 */`
235	$XóYzö¯a¼!ò#¾ÎLx`bSa éÀÖ'±¾1Mù-&1ûtJfS4¦á_	235	`# define BEFORE2632(x,y)`
236	`tÏ®xýÆñHÅÑâWm¬n&*ìBùà+`	236	`# endif`
237	sàìy~ÙK>+`¹sf-¾Ê×oõ×Ýùkutá>Èw³Ç,Üè@¬i¸Ç(qz= åÅ/òäÓX]äÈÝÖÅORØî1KÙD²(Ð§/^g?Èe×åv³¨mØ´[ÓÉz=»/bÅ÷YÌ:]ö+Â,avO8kecY×§Kh}À«¶1(OW/CµìEã¡Þ\daKÈ Ýl7RW^cë±wèWVb¢,ä2íÏ¬¬BÆªYØìudµ7/	237
238	e¡ãOÖóÛG</f¬ñôA¶+\ÐÚ=('zÊùó»ñÒÌÆVÕÐÅhÂr¢¤ä$·\|ENbÉ ZjfCãx 8xÆb8¿#UºhÌ-ÊR2.DmÈ0Ù¬QpT¾;Î£¥0ihÛ3ÜàvÙbªý¨v+ã×HµSA¿W$<Ø÷HEº,¡Õð:oê°ÊNÕQmTÖnN9ÔZp~Ñ.ÎÞuZ§oö3YÇgcøiø[^(-\|~ÖîXÚ\|E"csáø¥lÄt9L[ß)Í¶ëR:yBM_Ð`R´ì¢gYµ½=n±÷övVVFÉÁPÖ¾>³{ ?2ï§3æjàÛW¤×ÝËÊ¾ÙWþÈp/Á¦qÊ]ò¹ã,JKeØuàpfÔ(ß6s_CfÖ©¸á».Z³ÑÁ6le¯B\¸ÃôpL/èt!ßÁåuÐò©ìoc¯ª&Ø>3o¤u8W×ºèxÊjáXáË %º$µµD¿-¯ÂhÊê®Ã}8Uå4$ 6<'±Ó?` =Ýéø;õÿÄw¦}n³7ÄßÕZ-þ0øK¡lùÏ6qCrÞ¶TâO	238	`# if LINUX_VERSION_CODE >= KERNEL_VERSION(3,17,0)`
239	o¨òÐY(ËPr(w2%ýHÉV,÷ðõRöºS"÷IÊÃz-ç»ãé¡¢²Ê´.®bs(1¬¾ç¹U·¸(zµDRo¬÷9@v®n×Ï2Pr]¡ÀÛ1H_b^îóî}¾E½WâûâÉõ¨¯×¾-O÷ÞN)?"Üc'·ïéÞ7ÀygíRÖKnE¨mEÈÔ9ÈØ£î2ÈÔB/2r¾»õÐg?Ç¥¬óØ«y©gBsõç#óx3HÙ$î{ç¬Æ°w4-Çûs0Ä>Òßð}(±ÿirrÔxn#´+ûø&ç3a_cÓ(å¥9üJ¤±iñí2¿hv(4ÂÖY)í^E©qþx$t.]ÞQ«2Ií·×$ \|(¥Ðz±?i¡"þHjàýçÖ×·`b8nöõt_od¶b/J÷ùÁdPÕþL²öïÑÚß°ßïYÐò(±ïmës¢HÌøXn¹½>ûbz;hB½TA%ÅâfçmÐ8nf;/ëµB\°øp^~ºy÷jÔoE?ê^c\|=\fÊwUbmãºÈÛ¸ÄZÉ$ÙöV°?Z¼þ¬íl£m1Ô`Ø^¡îbøïQMb;ug!Öítí.Ä°³ÃÞB»0\|¿ÃÞObø~g1<]¡¶µ¿Ã³ìËùPÄýñDÝ¸îIöÈâP»9^^ #,ËÂ®¿÷uS_PÌ%>æøDÙz½¿"Üÿ½yønwj¯s1h¯ûÂgíÅ£³ý"ºg«Èb½D{:·"Kb¼çC`©ÅsfìG`©Â^¨ ûKÏû¾amä¼Jq "÷í±¡ò¢±\|ìÏC3ÇÑ	239	`# define ctl_table struct ctl_table`
240	`³9y¬!#¸Cyû¾Yû+ë¯ÇÇ·gïÞ¼Å ÜÞþÊWn8¤(²ýAìÏ2Rw+Êþ¿öÅJ¾°Ýîø#WÈW¿+Ý³½_7Å Ï0]8¤Ëmà\ûªè/_×iÄþ2Xb9Ø_Ð%ªP¾*r¢^ãAü"^9 Ù÷Ò¡À°oyAÏÎqR¼-ÛÛ)Ù§æ,°ùBrÕô¦ñ½ª}M5§Ýñýj/¨¥ÀÏ×ÜGÙjhqä°ãi²z«49TÊ¯ìÖý¥qq6KµXÓ\ïÆ7ãøãXHoß"ê}¶ÞR×@\^F$i«RdRSVöj#}Þ8`	240	`# endif`
241	`Ì¼é úIo]â¾ý¡ìK4À;v²$CÁÞµ~ÜLéyäØ¾-(ðWOçÕv±àïvd×ó;Ñ2r6uÊ06GYF8î`	241
242	`¼ÀeÇ4ÊDâ /2^*Ú×Åô¬!/t÷ª)´Át&«@f}¤cÿù`	242	`# ifndef HAVE_GRSECURITY_H`
243	`\Ý#ÈäËú(ÉÂmêp:/tÏ&áVòaäLkqÅ³DÖÿ±K\|¡ òS5mqf&ôÎpv)Úé>Ëf&dc ª4 ËN L¼,ÚÍx_æNú³rUe<°¯?^ÕñKdcGñÀgË K=(eÍQìðé`	243	`# define ctl_table_no_const ctl_table`
244	`GI²ÉØ+º£hhl»i 0CïímÕ×ßzÂn>ërÚ©ÌeêmÿÖöâ`	244	`# endif`
245	ß£Gbn{%±²â©L_?Ï!çj,y)®õ 6[_YWÛ[ÿl¸§eó${ÌJ¹´¢dÝ{m]Íèi)=þròïe)GëHÀª¤zçzlºërcêjN ÅÃÔ»¨{W±¦ã+¨)V&ßþÇË&ºe1¡?Ì .âFg'çnÂ;ïÛ\Ì¨<ì2pîk6¾q^Ze¡mâª º¼¶'Ú¸®ãáwtèñxLRÂ¾4ÕVuä¢ÜËhÄ%É#Ó©ß ÇÃhÞäæÉùñ¬8Ð²YI\|÷¥¾edîCçëipîyÿFQ9ïû fæå,Ò{?<wFéyÀ\| ÚÃ ß«á`]Å@$¨ý;+¥"Zà¸¬cb?óòëÀ¹é7ÛÓá6!A 6y)gÈúüB¿TæHºËrYÚ^çJI+ÆÇÌ¸÷Uè÷ú\|asSP_<òdÈ6G0å²dóîÀS:ÀÓ?zCZ4@ö·ÎéÔ+6Ð\|ÐwGK¶;÷A{Üê4ýí¡WÒD(~/ÆEL¹ÞÅ?ïA.ûûù__:¯¥¸~ÝQÈAö§/Ñxù2	245	`#endif`
246	2VÕ±ÒØo±#ç¿ùåm "[Ä3ÙÚÍCï»JÒ¯@Â8¯üyJª²Q¨÷1@®Î}éö¼½ÇÐ³M÷A¦æW6ç®.ù¥¯PKÙÅ~õ¦ªÐ¾¶ôv~p9ï!¥K¾ºÒðö;Z\|Ç¡ð©û/* ¿è¡$bËdqúWAý¤Ræa¤q5o¡¦wß^'µ;§OBð½kî0zéT®§Ö8:MnÒ`ãMp>dtDºà:ptNù+ñ²ÀùìN»¤3ü¡MøPÚc;\|!íªq'b?/;rfûÍTDqÆm]<:¬b<IÜäQù æ1Í¿~Ý?Ý#\;ü·lÄö¢àÏÖöfomß/x&;À¬Çc}öÀÉ)³`4gÄjÂÑr´(±ÙEdÜÓ\|)rùiõ~üø±uÇ]rÓËÍè½í&ÙÙó¿ÕO£áwôkO[»ÊcáÒ-aõ´äôHm×©ÎzæÅIë´Õî´pQò¨ü¤ê)=&ígÒØw§{pËLãxnÄSmÞC±¿k/qæ±O§ ÜÈo-ñnµ¼ËïóØ=å:(µ©MyÓºbí«vz§÷gä¯ù_!ÏrÁÅ/1W<÷¶:bqöÒ£ðqæW`ñ»ÎcÚÛ-=¯8 ÍÏ<<¾ªñéã1XçãÌø#^Åî\|>¯Ù^Kc/ò¸oGêBRqéG?¥s±-ÛnÒ±y=A"ÓÃ\d÷jèBl÷jh16¿ýøÊËÌ4ÁYí³/6_§×L\^:ä÷ò w½/ÏÔûû"kn%1ÀÆ×ßÙoõ´¶¶ð"´è&Ô{ðç_úP¢{ëñ äg¬æ}EN!ÈåÍy?h»§ÎXÚûc÷.ãq(ìÇ°ÒUa9µÎÕdGï{»(ãì[ã1á±{.´qÓ</Ì^Vå'X{;¨)öK¨{µÐÜ£åöxùJYbQ%yÏËûB/CýÒx ísñ*ý6î+%À×\|ùs§o´OÊït¾xFÚèêgNÃÌk±¦Þ{@ç$åeHÒ¯ÖK³!ó¨ðTiîÂ{Ìr¶þVÛy¶l ¥¸7åî_¸^\|Ía_Ñ5©ëô÷@Ç§§¯Ï´ëâíß´I¬ìÐUéå×ó@s%Ã?3UØ (ó8lÞÏâíq";æÄosb>rÖ¹³êî}¥Ú]¡KBGðAÓî.FûÒE»´æ)Áÿûo¢° ÔðÙü	246
247	kmWªJá_ÁËXk[ÊÍÍ³{UÖN; pÃàâ@/l$ÒEË¡ÀDoG@xª®P¨onFâO%µ^®ê«¨v«:Jz5zM¬]N}3±Ê»!Ö.ªì³Ä©DYã,rLâSÜäÀ©DkML«Ø{UR×«éíÆBEã¨£ËR Bø2<ÿ'£B\ÝO¥lºA§IØ;sÉ0ªL¢ËCnapAÙY,ïÏx6¢NFC3312Sz{Ærø?ê!#hfÈç9Çüö~mKJ1©ü.úÎî¼§mkWÈv²Ç}rá`ÁqÞ¢jjµoVßºõeA¨%GÝ½7éN»äÌà½ñY-üF §Ø.üèóió.ólµÉö^vïó2Eb{ü[ÓUuÏÇ /üÎ~yçoæuqìD>Ñj{>°h¯;b°;Þ· ØÄ¥üi+GåØMÖaÇhYblr±mE0RÐ?Ft\$(ØxuüçltU©Òr{#`?øÇÄ20®ü0AûÂçh\ûù³x¨Ê®7ÔáU4Ön\|Ðð]÷£_ªJ'@UOã¦xnIÒkôfl Ævx.¶ì[æ¬?nÃ©we4]k½E³if<emxù"µ¡^Ù«l_¶l,¨«áú]{ôHdpC"µ8Ä!¬¹Ê¢h4!]â]¤\vhðzc²½ðYlZ&°-µËIox5v@®`Åÿ¤#u´¼rÄke<K¡ØäÏéô.ÓE'«0<\Ò\güèDØ£Kå¦³ñ¼h·¥2rG:®®`ô@æÞÀlTÜUÊ¤~¡wpâh½~¼;×¢/wñîô´uúF<(`7yd~µRÑ4M0U¤ùgw¡%ÐI'>RÔry_$ôdTMVléSù4s+ ¸S-MçÍæQPÛÿÚZmëÍåZö\|Áê»Å`õên!\mËÀÕæAá¤¬të¤.%¦NG±	247	`#if LINUX_VERSION_CODE < KERNEL_VERSION(3,9,0)`
248	)á©{]Å²ÖIAGycÀbé$G5ÞñÓêÎ"?ÔIËEP¯[¯.ð¥A .ý@¯N ªËqo-{KPG §ÐQÃjJ¿»V\|dzkâôVá¬<L4sö-µbOÔ/«0Ûö-I§b4i1§HvZ7Ãx¼¼UØEãeÁÊe<ÏzÿA¼Xý£qqþöâd/ÎNB~þjüZß¬®È¯V³Ù\|ºU7¹PÚä¶LfÇ =:ZPª¶ýlÇÔû®µg¾@[eà,â¦Hû¸u®/üØsóöLÁ³vSgbÔï·¿8Í;?·ð·Úgúë¸qþJRx6½ñË[h¸ÎîÈÂ`íÎ§!îõEÃjÓñÙÙù«ÆáO¦&tÖ96 ¯ZV´:¦ÎÎ¯7M«-æÓÒÖù¹ÖÅQ#7ªµÉW)èO¢}âVµÎ: SÿùÛ3ä÷È8oæïþùc*V2VjfcäüÛâáQfd<ÆÝÉµÖ¶\ø»ñkµ¾+ÃÛp(êh¼ ZàÅ!ý×¸,`ØÙî@v¦ì¡> amy(ÚÀÌç²±ÀwTÿ»ÖÆýjÑ8zË	248	`# define compat_hlist_for_each_entry hlist_for_each_entry`
249	"Obò¡úALªSö9püûöÁ?!¸ £¤ä8üBÆÄ¿Ä¢ûQç¶ ûEÖépÈ{ðÿVò":ãÉe·wC(Ñ7[ÚÒrßê8D0 ~çñ·ìs`èÃ«(ÚìG§G w$j5J7â\|%£zJ\tûQv'~~òÐñ/1&a¦Änw]øwÃµæR<UB-Y}ØÁíVW^½{®Ø¸¸hüF/}J/Gv±)ivYâ¨Ø«¸Ôm}À ¡Î¨Î¹YAìd&.M_¼Ö)P¦4g×òÍíKì0Fÿ6&Æ©úìñ7²EYõ\zIòÇ 2æ'!ð(¼Ùä=iËÄ_Ç¼OmÿÞ¨Jõ`\PF¥ GÝ1:hâ1ÜM©]ã#Ã®t#<ôvJÙÙ·ëaVµq«¢àA$WIÃp« ½ù4L¤~¯ \ýiY-P·Dj%,Óª9[Ð:#ÈXh¤N&ùf¼l¥,s¨vâ¨¯FãÍçÁ ¦RoF×»LÇô>¿ÌÆ~ÞA2MHÉ´8T£\|§_<¨dFã~øIa1Ûx\|³kYyÔñïpkËÙh3"1º¢]Gj\xëeß:Âu/ôE\P [¥\|3Ì³Éø_$&Ã+YzÜ^Âp»ctv?Á8ÓAÒë<NKå¬'[}«FÂ7ö5%ãa@°[Í&&äÃw~9ÁÁêÙpìËú9'ñÖ_a¿äòå]GW×ÁÇQ&Çóï}Oûnw=³ðÀ	249	`# define compat_hlist_for_each_entry_safe hlist_for_each_entry_safe`
250	Þzãñ²í£Òª·Ïªì'={¨YÆ.Î1R¾ÓïÑ8ÖîÓºgÖk6<¢7vònA³Ø~ùOµÌøVÿg6NûB"£ªb^(©£Ff_¹ì1¼7/²o*ån¿oñyïd÷vEæÃ¾(=LÊ½4óCYùô_V{Ûôî `øÖÄ>ñ.V×ÊöÕ÷Gjj.ZGU bv!¶¾çìx@'ëPÃÅö"1T3ÏÔÔ+µ+Ó#PÏÆKíò`	250	`#else /* since 3.9.0 */`
251	Î8Ðþ¿QwÁh xn!-ú³ÑèÆ"#båùYÆ@·aGÖ¹8ûüûkít"~µ; ?e%ÚK=û.åwE _7n»Ë5-¥"ÝàÚ@ý<;r1s&S¨oòÓ«ôß¨ØÂàv%üì\£hÚÇD~RJÊÕUR,¡etÄî ;Ké4£KÑèé > G)T¯Ï.@ë8B ûÿ@TùØÀÑ¦ÏF9qR}O$¿ ?÷!h±½ÔuDO°N¤á¾¥}÷ñKª@Uür[@Ç¬j8×ñ÷BpÔ¶©¯ jÚDd6Uá@BØÐSÓÕ,J®E>Nd¢QFöNR@OìY1»ÀnäíÎ@fHf!÷ä¯åXÇeBãîjwR´ÓÓ÷.fbXöIFj)Þ;íÁý¾©R¦ç¾n»²Àæj¿Î¶ÓtæÃW"DÊïË\|öã1gV¦ì´¥ïiK¿¨-}O[úsÛâ»)[YÚ=âaQKàÿoøUWÈx"Ã·ÂK%×8UÇn/-«sÑ_çª^9²'HÝ@z"©ÐsßÌ¡»?@ÄJÇM\Æ½ºxiû}û	251	`# define compat_hlist_for_each_entry(a,pos,c,d) hlist_for_each_entry(a,c,d)`
252	`z²P~ kYðKoÊ?e\9NîDi:èíÖ¶ê¤M£÷U®7[(ÃYâ@8ã?Õ/Ñ²ýbívtË&A`	252	`# define compat_hlist_for_each_entry_safe(a,pos,c,d,e) hlist_for_each_entry_safe(a,c,d,e)`
253	eú·C/E¶ÌÊâ7ÝøØ÷QÌÛ%Ç+§xd/½ün]_NÚâgcxòÕØ¥d}Å2ÐØ#2ü-êµ/å.{ù-Ü`P~ÊÃzÐZ°jB~'ä°*ÂØ#¨}°öG·°YþQ¶uÇÒ×mf2Ìð1ïI/	253	`#endif`
254	`¸+4µ@9ýÐR\|ôHëÚåx£+ë¾¬S_rQ=Qfq²ÖÙÔÍwåÙ+º%Í"h)F£5`	254
255	`dìÇîa§ÀóÁlLQnq>^ÍºÓî8Åhö'ñãñôho6E+Èbfýx6º>ÔHH=Þ´ Yôö÷Ø@;¤ññ4´~±±oMó³xû·§d×*é·Áñq«ÝÑ'"C9ÆÃÞuü×òá¨©%ÿR(K¼®$;#òÏYz=¥ØòÄºÀ.oÔd^»jâ>ðbs½bk1ûÌ,s¤Ìõ©^py]ztâ&-~ÄßÃñÙáOl@\¯&aì3½CÓfüÂ-DÊ`	255	`#ifndef WARN_ONCE`
256	`bÊ'Ñ8p:òyÄhP KyüäÉÇq Å@íé¢4ÜúÔ*®@#BÜ4«a¨Èà\â§ üPFÙªJ±Rs2ò-#Zli!_\+l´Kä`	256	`#define WARN_ONCE(x,fmt...) ({ if (x) printk(KERN_WARNING fmt); })`
257	ûZ±Ó$YçXtXÙ ód³Ñ8ÅeM7 Ù§àýiÚ,ÖÇF(ÓjÞkÒK¨nÊþºÑ þ¯¶xuªÊPbeÊ-äec¥8`Vyçªò¦Ï½lçÞc6ªÎCwk%Ý!ªG Õ@k Þt¤ì}PaPàuxxPø^hÆR%XÊ¬Þkød$ _²~0²3}M¤æ¹])«`XSÃ¢,?3¼®2éöaCGs&Â¼Xí#=º+Ç8ê]¦§Ìã:bU§$ÓÊþ~«ZUpeµ¾²¢ß·Eã^î áÊ6Y9{Ë<Xót¾ ´4×yeFdÓØUâCÝòÌ´,2~¨&SòcÌ¶ëZ¹ëÈâÑvKèWÁ2àVÑg4XÔ,ü¸Búz]?*\Üëæ9§×}¤w(æ6²ÓÏâ2èÑ$½ùÈÙTr#ù¼!Ä>´å,YE)aLUÉÐÒÄM¸Öé4ÎÑº;)å½ðÊö}YRu-n:Hså#I)`I4&ýU;bF{Ô¤C+´%y	257	`#endif`
258	`pÆi¸/f KÚp 1M¯0èÔír^ÉDÖ3WmeÄbÓÏEÖJß«P©ì{&þnr½=urí»~î½Þ*{o¯ðv+eLY:".ËKÔyàeèSþ6i°ä¶`	258
259	ÕdB¥É¶Ì$Ðjg>{ÞT&Á}`Àbõ©Ç>b¥ÝiZÊ§ÌþÅÑÙi'x}ü®ýönögC÷qÈ.gÉ©:^Õz`{Ñ¾htOJÔuc#J:]ÿkÀÓw'Û.@Tá&Ô/ò9-6-d¦\Ð(ÝVÄo1q©¶Uß¿u/Ù8ËôÂ¢_Õ¶V77Å' ½)îd:êna/<E414¦íg?º@= ¹Ã»/ãWátqá,â`¡ãÃÛ^ÍÈòw<F5Eµ6Vu#t©RøqÔíùlZº0 ïÎ¡©½Ï@(hoF>Í_NÚ-ûñPr´Ïh£0ÐC^±°ÔL\|MÉÊ®¯¥xHÇeËlÒKæä'awlçÏ¥·þ,õ2Sæë'&eA2¥È,BÑ þþHØlË0-×ëYðü×©F>3ýOUW}Â¼y$²hy3¿ÐWjÁ)/í%Æ²ábÁ&ÜÒlÐs4aßêû9¥$J«á¹êóxPÔÃOzqK{êdè×¸ý²U5&÷bV6ÌIý saïù-ßnIvÝwDÆ¦ùP@F<%ÜfJRl¦'Û`8!¬[pº±ÄÂíÎî ÖiÐg 3»´üã¹-6¨«¡hKf!?áCdÁV ÐeSJã1gRu±Þ'<QÊ?´ÜB Ê ~"\¾nÂ>Ì=ÄgÒ+<Mã¯gûLäÇé.6+pØ(ÛM"ÇMS=ìKÛ³XyÃr9Þ1MI¼Ë@TÈ*b·òQ[³âÔÔ\|©È+Ysm##gqý{ºÌKCÁe!y M¦#íiNê$Íhè¡MM32@ÍÅ×6ï+Ö·Ø>ÃòYî0x3La°xÁBeG/ð ÎP´P#¦FÝá×Ò$EWÔ@)þüäÐÃÚn`Ïü[ËVÈ3¢9<Ê÷Æd¦Å_ôÉ¢>JrbC]mÓÀÂ_RPbÈ X:#î³Qzd4	259	`#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20)`
260	}p°ßþM¬ÛJÜb£û=¬3±àÇ '7^8î/Îº· ×9µw)¶Å Ý+;Ïñ<ì¢aË]¹óPFRñÔ/Ö£4eöó°+ìàvë8ÌÍª7.hÌiv÷îÁv I¬÷Pú#ñ/{©¶õB²©QAù·åî³ZY»® ¡Ñêb¥Î:×¿°iü¹öåyCý³ã\|aè¥${1`!Uà@ÃÛ>üoÜK.w3~Îe9eãÉB`ÙêKj(YLÏ¹øÐgÇoAéÜ_¢`Á¨çÏEëüçÔ/eñYX)ÍcGTeçT.DßÃuXxFo@ÏÛ4e)R®¿&Ò¢L}ß:°ºÖEpvÑzÓ:m°TÛãÙ^m°1x(ÂrÑ<?þm²~(ýK8VyC<ûv^´YÂ y¢;¾ûØ½4v«´w%>PºÑSL´Íèåxóú\ =1x°ù\|¼gùïã5;´¢FÌ1	260	`# define IPPROTO_UDPLITE 136`
261	`£±ÍÑeÓ3¿óö)K£BeÙëá#kEc ´ÝÁàèÍ¶«ÑÄè[$ Í*tÁ 0·Q6[±ª0 'CZ)å%Ûä¬`	261	`#endif`
262	`µlx`	262
263	`ÚjLò¤fM{òEÆ4À3¯å kãh8ÒLe¡ûxÂN¡Ìu·øáEäI®t×ò)U\|î©.v¼/³Y1Øm×º/.>]u¦Å=O=Ú»ôöÐ\|ÞüÐU Ö[f1_ýrà.üóÖ _=°4,Â®L«V!Q¯îU·kôDg±ÑÕý^ñlã;ñ;Y,Ý¹»ºs/ãxÓìøKã>-¯ªCÚï¦d?¤OöæÀÉ¬#ÑÙ¿Jñ)h°þe.)üHªDogÕr ×ÄEOTËsPS@{½ãþÓZ« W½ë¶R]°;µ¬F2]Í.èUÃr½a ñËUM Lo4)Á\Äw?ª2Y²é5·5¦ëp\ËøÎû£<HÂÙö`	263	`#ifndef time_is_before_jiffies`
264	`CÚÑ=©ðm0ß³¨áSÈÕ8·x>LS¶¯v0·ÝaD7"õñ£$R>©Ö¢zø¶yøSðºÑ:6rT±Awá.A«{8</X<«ûÕeË/ûÈ]ôÓ1 IùÐè¡õSmz©Yú³T:Ég?9'óí0ýõU>EiëÓÓ-Ø¾\|)à\|OcìïË(¥ÚéÙÀc®i5o³Úv\÷§Ês%ä<Ò`	264	`# define time_is_before_jiffies(a) time_after(jiffies, a)`
265	GóV²v0oüígÞaòÌk4uFmÛ,qÊQÆE#H}WMÛ:È <jwÎÎ;í}¡Ì²Tl³ oÏÎý µèÅÙ»NëôMt7zòV9¤Èbç`mé¯#»mâÝÉÁHÄYØ<½¯/oN§º~Û÷ÑÒ ÅYàWµÉ?ºã`ð+ÀkØJFT5ÿÝhFÆÀJÙd\|M;odÞ\äJbT'ýÊR%×;ç8LÚÏÆ¬rHéöê3ËT¿ÁppÈ»õUËta¨ cOæ~U?]§£¡5YMv`ü	265	`#endif`
266	`:XÀIõþû+ n+8( pÖ72Àê)¿Á¥n·âØ¢1z_ÛÞÁr5w¹3¾éuJon´¾÷·)¹ÓV°5LÜ¡ÄãöJÝÂÔ]JÕå rÒNÏÎ9à¾çÎÎ%à.¦>åÔSZd9}§Ï(ãçV»ÁÉõ-¯q¼nJp®qûN:ïqDG®%%5"¥ÆÍû[ûj õmØ6 Ü£dÙÂÖ"qs#ÎU'í2nnçi»qÞP zFÜÔöÑ+ÌrCGGÍ_;Æ .ÇºsÑ89O©±unlG¹C=SCÙRMÝ¡¯s[['¤Îjþ*ÁíøRk»O}ÉõzÝLl3ÝÕýB°ÛLô»W&ä^òÛ!Î82èN§xHHÛÊïéæÃ¿fm×Õ¤AxutVKOPq&9h¬ é51®dl¶²±#y¨m9É<h®`	266	`#ifndef time_is_after_jiffies`
267	ò +ñÆÄ ®i0hY¾¸Ø§5yKÚÿ`Ý\|áÝ ãÂ:ú* }NÕj6D?î±ê Mp}íÞ´ûwâc÷n_zdØ¶hxÚÝÃK³F.ó£äjkokëiDX©¾U«%¾è½¨ÏfM $\»=áØÓxä%caÔ]ïöÆÖ³ÚSY»DÖF 3¯ô-¥GZW¹6\|ÐOh(pk]¶Øy@û9fØRI~@Óí²ëÁB>5c¸ÃÙ¶\yÐ ú y.cº8©Mt/0ÄH_ò[f©2Vööè"8iüJqKhTZÎÊc´MDN¦ýCöeÎýÌsÎ¤Å§î¤UÖÐh2õäæÒ;yÉSpGèÖÈ7áñHåzãe?Fübï[ó4F#L«1øÞí¯z;eÉKx%	267	`# define time_is_after_jiffies(a) time_before(jiffies, a)`
268	`hNÀjD0éj¶D-d_^:*î`	268	`#endif`
269	âñØRÎx4bìþB+ÍK-Í¦)Ý®[âÆ+i´áë^Æ·JôL(ÙÅS(]v¥_1P¯%jN×$Å_1µÐ·ìX=vWòeI¤tGqÝ)Ý/Ê`]!wDcÉ '¾ÒP¥Ý÷nÙWøÌgGæ½áÿâ{¦×Á$¸vÇ¥PvÍ$kQi8ü¨¾Ùyègì¯2¾ø<Æ~ÊÓü_)â×U§!aÞß ?a ¡ívÙ4zzßòâ¼BG\|¦d¸Çhÿ1Ä³P{2ZJw¾Uù®µ X¨Räb{!¿1´d5ë%tñ`X_bø<fBê*ÿåÅÞ=BiÚé&$¦±£°ÇõW)«#X<MxK%ò´ÌÔ} Ã~8I¯I@Ñ "ÇÂúÒ®¼âÑþ`pðDG³Ø$/®ñN'±fi/Ò¬ð)@lÒZFA°¿ñÔëê½¬$va¼	269
270	`e)C7Óþ{Îà~Fje?Èóo§â¥áZÛL¦#(tôHRJÁd+4ç c"J1ñ7?Ö\¹dÚËKâÙ´:%íQ¹ß°ëTM=^aØ}S·ä¾Ð0å"Óí`	270	`#if LINUX_VERSION_CODE < KERNEL_VERSION(3,14,0)`
271	rÚÐ¨ÐR{Íþ¬o¯Ûi].9½¯É³<E¹&çíuE`;\|ç*;n¹½Æ6Peá¸×$d:Ö4oûzE62[? OPNÐi¼iËH»iÕ×9lQÚ¡éxX¤4í´¾	271	`# if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)`
272	iOï`~3£ÈÌÆÑextÎ8¹ÄüVÜ(É¸zÊÁ× b¨0ñþá"åBÓó\8kºk8îqLÛxIw ¹^ÖU:½ü dxßÁþ¿-/Ñu×«¦ïpî1ÝÜË?¿TS-yH? {!yó!µ-[ø»t¿Ë²\|]×'8®Æ¹D\|Õct-R,'`Ñ¬²=Àf°Üµ0P¥çÒ·nµï½¤yî¬é¼lËkÏ\ôÙK/ÎãTP¦51ð3´í\NÖJFÔ¯o¢±ïH(~Ü¯Uxë8¯Ó¬[2_cxgÀeË¤-ÛZ286fl-¨\|áôb%ë.ÌÃR4;4Ûw¨ðÉ:hÔÏùDSÅÜÔÍÆ¸Ûp&áHv&év÷è¾?	272	`# define prandom_u32 get_random_int`
273	0ô3Ún×a÷[Övy&Ü5uM^qÝ`I]KÊOßst]£´¼ªì=üÔÕæ_û¦È¾©l¼ysaû$ÌÝ««i0ëü÷À?ùC$UÈ@g}ú=A`ç¯ÔÞi÷	273	`# elif LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0)`
274	`^=ïú(M8ùr'k½cF¸sçlº2íF&F½(ÄÀ Él*ßÆG"½icu©nSó¸>´pfå°ËGµYu`	274	`# define prandom_u32 random32`
275	(kÎ96ÙªhO"qî·\þA« ·W£ «;){eç¤Ë¾(÷ú t=õ2£?ååÐ¶¤ýÃy#ÚkrÝ:ïÀÌ;íÀTlJ3å@Ø6 ãý#¹ÌøYÓÃÎó·¿µ?g?«ØEDÚx\N£þUøÿµ÷æ}\Iºpÿ"]vÉ- mlÇPeÆUxéqûÊ))ÙHJ9SÂs=ý'"Î©ÊöíßÜûéqyÖ8qb}îïü'Õ/¦7(5Ç Å?Õân<ì/V?jÑHk8qß¼¹úêâì×_9afÓoqãÜÿ&ÿØFh«0ÂØÓ¹¡tÍGgCÿäþ*ªçL?²åðçbr°ov;Á¸"lJËÿø uZË8ì×çöURÝøê øê,Á$Í×ôûÊÄxß{y_Ð×öøçð]vÐOUã==ï½zu)?X× ¯ÙøfésME"Æ·ÜêÆ_0Þò§ËmÍ¡B'ÐsæP¾Î¬³Ã,Ù<ï¡ºôÍ{)ïÖlLÚ¸8¦å-¬³ï.{ma·`pUuÆ1oßÉ>b ¹	275	`#endif`
276	ÉåÁöÙ6h¢7¤¢ìº]ÞºÍQmñAþqîÖDuúêE×Åò:Â¢fÃQ¼¢®c¹kZª¨?,¤ßÈ°U]sÏ!øÝÉ÷W #Ô@ßC]x`´ðB\½Ù7VºÚþFªË{ä³%G_H¨º¡%Ùñÿý¢ã!:é#NKy]¡¸O»öUPÚ »¸´ªCAù.úDaÈVÓ±`4Ibs£ÙM<¹6öýÜNÔð!úª%p£AÒ5/e^àã:â6V°ÈÐuµ§ñfm÷¹í°\|6TûÑÆðæ©Ë8äuÔÔÊÒÖíä×óñ¥ñ×¦©-_Ávð§KÐ0YZº \i³kãyPU· àÖu¯7ìë»¹×¥xmaYílä©VÑ¼tôÌS¦K¦þþÕ«Wû$qw´LÍýçK`qc¢r[O»á\¬A7¤ÿNNuo=>zZöqDB¹hd+.¢sy~ZRY+V¿È¦q¹0ì>×¿þ4Ëpu5	276	`#define prandom_u32_max compat_prandom_u32_max`
277	`BÁÌ¹;¸¤béb#üüOÃNúéÃtfcá@[ËéÈ}w30\þ"¾Pöì¸äàf*¨?¦~Vlµ¿¢\×¹ñèZÉ;¥mÄ´,C%ñÌ¤æÓ\|SOç5MæìÜVªpA Ç{Y9oKPä&)ÃáôbôcîºP/uWôfê`	277	`static inline u32 prandom_u32_max(u32 ep_ro)`
278	`2>ÎÑmÃÇ-\VÖ$ýçÞ×ÿk8ôKÙFe>À£ù¨@)ì½Ãe%8n×xÕ¿XîÍ6Ç§úan9"´Küë²¥Ö¨ÒekââwNÛùàwïÏº=O<Â/óûãGf²¨æ(2'7ÿäé6ÝtÎõ`	278	`{`
279	¦ v_ÜGF>è°'ÎðÛÝÅ9²=«+¿ÁÕ\|»Ë&÷4Qéhý\ã> x®±ûøæýzag¯Ç¿<²iº[O#_ÈR8À.¿ó#fDqo×¤¼¶ÄÂK~`±Mk.ä§áýÂr/ýÿÒ\|=8À;¯$t£lú5è%³Y\OX%þ ôáóÑÈhQ(i\|,ðé+¹pKm¡ÀO¼¾N£kdÑkàE¦X®¦öÍ§lù4)a\|/nà-Ç¥,Uf&¿(Ü'm¯"s}yè?åÍêxNÍl)°kARÿôzñì£øî-F§ÀµEB°@lÃf¾gôò2Ùðµà·è¬õýÑYþ°YdÛõÑ&bõStÏ?á)ÜøOkB2eC	279	`return (u32)(((u64) prandom_u32() * ep_ro) >> 32);`
280	Y¯Þ®©Ù®éÚíÉ_MÞDh:kx`ÙËÿ<ÿxs¥ÈÁ7yTþE+ökºz¿þày>lÞ§Í{ðÇÏ»¼geèQÁ8}÷ñ77aäEÐíâãe*YÛóPJ®]¹Ù0Ì¬V¬ÙæuâË\|E¤Mõ·åý³Û.ó¸>£®<ØNî[Í<ôzÁÿ°ª¯¾¤¬wðWì`su0ë-þ(·L\|¤t¥¯qx×ÉâòJÜdnùSc1~\|î¥,/ír.8ºKÖ=Îx2°>t°;æ1+ø3{x¾$Ç/:¬ubº¥Oý~Ù	280	`}`
281	`ÇGÆ¼âÅäiâøìZA) RS\|ÉvºQWî±ómun©wÉ¾sKléív~Ý4pÂþ~ÁUFPËé%R1@Z^u(¤"æÿIk$Äßð[ë¡]¦Ù=@ç8_HÜcK,,Õ}C.ã JÌôÅ¹õM#³DÊÍÐ!àøýd2ÅD¢½@ D*zbQ}>ÃÙ-Ki"ÀîÀq[]`	281	`#endif`
282	A¦UröÀÖ:røù/\|½\|¨/RbKþMÿ-ú×¹A?ÀJ-«#4×÷êG=GhñÒðkF.ÔÀ 8³P+8;þù7.¾YÎÏÖâq±éëx³ªÍÙ$Eh¬¨ArÂ4\|\F$keRÏd¦¸!ÃSëkZ¥ð´ö )ZÝªó\|¬zU#.ÝjeÔñCË2Ù«ÒåÜÓqîiöpWÄGíèxq[á½¢[N?}ú`Ì³Å¡°'×fq¼V]cK2íé]R4ZxþØê &ÌåC#ÝµH_Ia&çõöÖÓCv9Ûº2·uY¢µ³Ùó¥±n»kjå®#Ñ®¸åT14.(îá®<kBósaj+ÃªxÅ4ê=ä+ ®ú;Ì®=!IgZ^lZëM¥3Ì¢ é>\|x¾¯°ìÉ.ÚÞí"¦ÖD[»±ßÚ¸×páóËÇ½ÑõakkìíÝv%O6~´V¹%ß6Mzö´^6Qo~M2JÉk:v»ô×y9øëÍ Cÿ\^½øë¼fþ×ùë<8¾¼\|$eíýG½èAoçSï?ñîôü?¾9<ÎÛFË´ËÕo©m¡²L7ónò_¹ä£ Ï@A¹ÒZd+Þ£\|©ÜÅ¿÷ÿwþâçz^%ùõùe'Rx ¸¿ ¦/óùæ	282
283	`)¿öÅD{mr©Uá%.`	283	`#ifndef min_not_zero`
284	`Æð¸ÖÊÅ¼ÕkûxT¬í"¹ú¥VÊô*-j+ÖÙàøòQ indU`	284	`# define min_not_zero(x, y) ({ \`
285	`" ¯h¨/`	285	`typeof(x) __x = (x); \`
286	ç.ÀæÌ°VVpáPþÜ"ëWð¹Z[æe´´LÈHªËXrFoÞCgfÜ£rRîGå¡XkøErÊ~þ ¿8N°]OzÓreduëIú³ ~Ï`s^sÓÜÝæsÞFÈôÎdy\7Dr°MðöBQ'ÁwL$$ÊOÇQ ãyÿU²¨"í ~ô¬¬`rBURê¤B ÆÑ8I¸öÀ$Á-Íäy ¦£(pê~RA5÷ãäy³Åã¤ËaPµà%ÍE0OÚq6ótEñ®%ZY r¢ç	286	`typeof(y) __y = (y); \`
287	&,5&jøub¨Zð´ú ©Z!òég¿~ù<á%âº9³³¹¾¤PÎªµPLh¹ève2@<*ôé¡©ÁtÃ5\£µÈ'µC:kUºWàäØ÷Å7GW^ºàKg¹G/^ãý0fjg'xïÏjK¿5ÜbÏÐÅÝ6àçGLÚ+¹rí?]qºtàÆ¶åÞó7è$r6[ÖkÙÐÙÆl(%ý4WÎWZ·Ý}ô¢ø -SùQoy`ÄË /<õ{lA¶c/Í	287	`__x == 0 ? __y : ((__y == 0) ? __x : min(__x, __y)); })`
288	ÖxÖ þ:Å{ôßRñ%HjsÖÊ¾ï§øeUJð¬'oéTV®Ô£p£vÜA8JßÚ+(.<À üKjOþ'ÑÛ(n¶R¦è ^ÛóÉP¡e¾Oß Etàß¼Atqù;ôëoànsÎ>ZÎòHSÖ¥»ÀL EÎSz2Íª4Ï`ì9ª B¯Eïùqøk`,ÍxO^ºÙ}ûÍÕÉ÷rj\|,¸!à7%;3Îre:ÇóÑ,j¡×Åô\|»óN3®Tþ- Ú¦÷¾î¾%Îà¯²BJ?³ÇCÊ²ð/ºcW÷D¯õ(hý[ãòåR±Û+sÇóYô^}ùEüm7óyUzm±²u>÷7-õ.¦Z³ïÍJ(2£&ÜÄÿÄÅ½üÒdi0V3Îô Jí/ô4Ö²fd72ñxñaÉîpÖùÙZHßÏ\|"p?Ï#Ø	288	`#endif`
289	pÐÌKJºk$þS8Ø¢Èí%ç[§<âùôÓàé3qï±R¾A»e½úØ·gÇß¼9©¶ASô/)èP\|+ÕÖÃV²ª {:eó^ö1üo 9}®x1ùæ05£õX¢¼óìh¼bÙÒ="¤¯Ïw1 wj×ÅF¤W+/ðv¹hAºÇ L³ÏóÇÙ¡¶èm½Ë=ÆLtPÂM>q~(]x3z*e`ã?îZµ&ïø¢SöñísK.ù¢ÔÆBE¾´4$e;^tÇø¿Üã©M#÷m4À~\(ñ_P=	289
290	98Ï>XI3Ëþç/ý£A¾0c~JLËhBMËü),Ò}¸ém.&wzÞ=¿81`¬bÜ]öÐ³£Ã7Ôäê'^]\|wxq¬öáÅw©%ßFozçÑÊÒx\cå_¾p»ÿÏ¬Ü¯Ïæó³£î«ËÍ¤	290	`#if LINUX_VERSION_CODE < KERNEL_VERSION(3,2,0)`
291	`åPÀìÙd÷Ä£Èd?7xª`	291	`static int __ethtool_get_settings(struct net_device dev, struct ethtool_cmd cmd)`
292	j,vqjòùo´ù\|©À¥ûÑ±ýÓß ¶ñÖ6}·7·ÿ1ú´BM?Æ UiÔÏÙA Nä,âZ¶)&xÙ=½øæõY%8}wã~UâG)ÒeÏßç7Ç¿KOl¨ú@GÙFW@`#Ò(I0ÒÛâ"<©r¸u¿þc÷_¿;Uÿ<ÿm`B³ÉýµVh½yÁDGèÅ¬ACØ{ÁÑïSýû	292	`{`
293	Y6¬à.#r¸ëßá®T¼@¤Ð_Qç(í»?Õ; qyè²UüµábúÛõwÄ\w5³6ëOxÃRþ{iÿ¹GnÏ%#¡Oÿ=[7ÙtÔF+ÃcÉ~ 9fÇ »ïh[riÉÈÙeÊÊ[J·jV3*KÊ¬ôGQvµK6Ûü#8RØnmLh0«7¶¹ji2TÃy%h¼S¸]ÄpOûÑxô÷bgË¢×nuKù¸°ixeàËç¯OºR5ØÐC³ï}v¢-¥VñØ½ßãÉ8É<¸]È¬ée½o_üÜÎ+ç[t_<Tµ¯ýuþ:Í8ûqÅoù³ÕÔåáÝòâ5:QBõÄ6q`¾÷¼÷1d}$=y	293	`ASSERT_RTNL();`
294	Ý0Ù Y£Zr@Y¦¹Û>x9¢ñ`dß'·¤{#é-r\|QÕv©d Nä hTÌÕºyÜ2»â f3ghðû14ÜðûqðÍ¼Þ7$þsÀ£÷Ñç´ø/áO¥ìÓ:\|yBÿ¼<¼<!"8>ùN¦{ÿÇÅÇAsFÿío¢ik×0ã,FÆ?ÖlÝo¾8ÙÓóÕÉáñÒG3&W¹í¦\SË_ær~æ=÷Ì¤³Üíe~B?uÑM>,Ü¥¥xæe'gD@K¹ø0XèE ÄÌõì»:äoå¯¾üêºE?ó}Ïì)ßå¸ÔçóGÛã '4×5kÅÆe'ZoÝSm.Â¿<ºzCÉlÔU×\D\½´üCf¿- l`8	294
295	íX0P75¯Û+¤EþäÃ:lª#"&N÷i(¼×GÉ£U½9îjGër=møÓpv VU+éK¿K»Yq¬ØÏ[àáæ×KU5¦4©Ôô{éÄò@Å+³¬ðþDHû@cJâþ3-<d£ÛG@-\|Yñ¶]±^ÇF¢ÂB/¼/3¿1kË¯ª,ÌóåIk¼(&¹GÅûSóô/oQüg>Zx(¿(/+þÓvQ-ð¢<6Z,÷ßÎb^J1\§¦Pñ&hÜ±ùî£Üùz_TÌSûÆ{K@¯èíWÖ¤7](ïüb¯ì=¦ádÄ^Z\j-k¾Î'Ù¿06û¿î$÷]Å{Ö-LþuYµCÐ}w{m¬Üõó³·§Gb¦Ï{â8ã8ë¿Iyû)sàAW?-¹×ÇÔ0Ë!åyÕJ!z8Ï!k¨À-í/×hÊH.«0ì~G¾>pâÿÆrÄDXQx+×q/Ä®¾9ß>³Vòe8rßó7;ÊÊ°¯7·-úÊ6+~ù©^AÈûð-óíoæÇÕ¡ !ÝqÙHPÝO\|N§Ê¾;î¾zóÍåWxhts²¤Ñ¹ÍÀ·ÌÏð=-BÂëËËØ³ÏòäáöV>2íæCé	295	`if (!dev->ethtool_ops->get_settings)`
296	Bg åYîÊ=ùû±uwwVØ47d¾o©Ü¸ÚÌ·Dpì<Ú¬Ê¸ÒjãÑVÖ /»ª\¢HÒEÃk\|Ft?TÃ¯;O8Èb_z.ª'ïÎÞ¼]p¦u»ÑPHøèOS-@²´¿?ÞþOÖï¦¢ßC0Kóì½U¸êNÛ[ÇßÄ» ^êkõô³ÒjÐ7i2,w$ÅÿIw´uËg×I+ÑÌ¿ØÊ,àigÑ¥@1ôMæô~ P2ôÇq<î Èî_ìw þåÏýíNUw§Ú¬5·/NßÔIü1}Ôégw·ÍÿÒOñßÝ½¿4»»ÍV»Ýlíü¥ÞhïÕÛ êÿÃId¶î¹Ç¾ÿ¿ôç«h4J*§Ãà!÷1$ªäVFlUäßÆ1uÅ.®ÀnhR½ns¤ÏD(ôuÑ¬³¹ÎÉhÎÚy£:» ¹ê ¢~´I"ª?4&~Ì½Ñì¯£I£à-£`R÷ül}?ÿl«è¦¿ûí$÷N%£¾r ²tWÿQ\|û¼-{	296	`return -EOPNOTSUPP;`
297	`½Ë÷¢(NÆ´l¥C®nÙCÌo%ã)ÀUM 6à§Ú6ÒËãkW«¶XÕ3ºeW¡8P æ~Ò^lmi9I«ûð'Ïf¸ÀVZBU@¶ÛJ¢[bÎVk£öb+JM4T3£ìK×TB\|ÆQWø@unÒS4¾\ãÅáÊtBxÜÍ4Ì2;Ct©Qç'D±%iÔMã§4¼ßR l$QfÂÍð¾EòbÒ8'cFZ'ÈtxPýF¶åÃu{&OpR]¨ EÿÊ§¦2WP=ÜÈê4ùû £P3¨þÓÊ·Íf÷^4´Ý¡GÞÏ ä©9EW»w}+UßóÞ6d¥êÄe6+gS´J;a¦ÍPfÔÀ3"t*ÐeJv&²ÕPEò47OæµÇø.ô¬ ¦©9Fô`	297
298	<ý~î3Frü&çlM®³Z¸Ð58/ÙÂÆðâìia)BS{8rDÚ}ñOfÔRP/&ïm8Sª,ÓqâÏyæ3¶ÍfÊlL¼ï GÑáxDêÜ8µä£ 9ZWÎÏèÄÿÞFD¤È K]±rdøî¹hÙyëÝ§¶1¯À$T¶PÈoÀèÈ2jnx¦átÊ-¨òô°ujFÓèÑ ê4HæÑ²ÁS y8gÅ¬ÐÌÈ'ºRFH{ÉéUà\|m» à¤O(°ËW5#Llf;7æý(ÑÆÆgu\|OºW+î-t¨×lj¶\. ¾Qîj<.9wÌTCÆ4(fdÛó,Ýt5Æù{\|(s¬NÁçÁûü`{¡Gjä	298	`memset(cmd, 0, sizeof(struct ethtool_cmd));`
299	`¡ê@ýkKFÊà,MÊ¸©ÏfkØ«X ²þÖÐrðl¨Ä4öM%¹:<x:ý(xf³8¨o·øÖ¯ËÏ¹F¼r\¯½§¤qþ`	299	`cmd->cmd = ETHTOOL_GSET;`
300	`µ*nW/YãçÂsÌtøa\|ñÑÚ´x=å-ÒhæËúÑæf«äoUÃÛ\Û,¦Í¤p9vTèÙ,ÈvÖ'Û>ßoXF°Ù®¨aî'^³Ì¼ññ[¹ÓF³Ì Éz-é¢ÖÞæÓÍÍZAæøÒChÏ$wõmîÖää<Þþ{Ò} q£]è¾÷ëE£¹W«Óÿ5:ûõúææ^-8<¥F¦¹8{ÂVvý0rGóBx×ôæ·I<`	300	`return dev->ethtool_ops->get_settings(dev, cmd);`
301	`æ§ýqÔ©³ËçQôKÄ+ º%É-òc½F*=ïfòü®9qOá&ÜäåCpHÜÑyF#ûïËqÆò©5Ð ÕÓàH°A4®C(`	301	`}`
302	!§(Óa Ær ¹³ùµ@LB¸!ÑÕåzÇuzXÃt>/8«C÷Î¨0ÑB÷Òº·ÈÏT@4à6(MºYqe#ºièÑã³s½u!xyPµZ 1.@æ ¡à Ñ¤óÍ§ÌÈ`7Yk¦ÁàXÃèç9X&Ò_Ln)ÿ¢ÝìCölÓ^\¢H2±¬Be2yÕ-öR\|$8P-úK= ÇDÃÁ¬5æÕÀD¨Í'èÿêuªe7C¹··³Jÿoì¶ëEý¿µÛøSÿÿWü\|üÑ6Zv³ù±ÀrKZ´(ÓKÆM@67Ï¯¾zñ þÛa¡ÁàÑüÉ¿ÐÎýè¾&-Î`x×6ßjËP[ÙöÿÒÁÚgKÂTk=ûG©öÙ?ÊÏjmÿ£±=ÝòïZÿ'ôùúôÊDµÍ¥ç ¤¶IÞAÕ}pü8:Vª?û-Ø's.1Óe6yÞµ-ý´91ÎkÈÖ,ÐµæFºrµdÐ y¼]?¿ØDwÛTk~ñiCüûÚ7×_µ:ÓÙ=mßü 3úxöyéYð£·7óOþË<ðñÝ¯ôÍcn¼ÞxÚZãYðÊ¹?6¨<Õ·$ Á³KÆËlUýD¥ràø2&Ëx:{¨=6¨ÏlÛ?}b¦ùgÏèYyuGÄ¨o¸6 ¶ðP8¯¸·Ïrõ±Á#¦¾©Û±xÿjûïe§ë)ÿßkì-ðÿÝ?ùÿ¿ÿ_$Q6¸j?°ÏüÃôù P\3KN»{DÙþë²½÷ßG}ðààºèUD"6ö@È$Ù~Øª5µ¦~¸k?l×vÝô>±ç^k»_½OÜðÀ²q<B]-U½4ªoO_ÖÆýáõRygJ\ýJÎ2:,YÝÂRðì/=§SnøËG`ÈVsþäÖLù "z3¯ëG>>¹# Îþö¢ô,o¼%üÂkìYysL"Òæ&;1^JkÁç½¢ÆÀËÙDSelJ	302	`#endif`
303	'3þXmßÑÿØzeýÝFÿÓqØäyå>ÊÄ«[E¬¹ÿÀ®B·¶ä£ÐçüÏx¼ºÅ´\òQÕÜ¨X$¥ÌË¯Î.®\|ºÆ:Ò>èe&~2"åÖ¼4³wÝèõVëÆóVsüÉüûøÙæ¯L±ÐÆÑ¶þðå¿ÁWÿÔ¯Ðÿ´Ë¿ØÀñI\|òÏü÷üQPýñQøèÒbD67ÿÿßËcÖúÿõz»Ý.ðÿV®?ùÿ¿Æÿkí(bøC~_m×ÞaFÿÞCðyØë9#ÿ6×ÒùtÚxÛªMRâÄTýU\|}8!Äà3¼f¯E`§ÜTç¾:ýÞÃ9Sä;íGåc%X(ÚYÃùHRº¨3º$8AÏF÷´ÎÍ¹Jæó9ÊæØ«~6_ÇàÉèÕW4ðç7@è{±æM6½,¬{ÛHÐ {t÷hÊ& L Êf¹u%úÞØl«pÃFè±ÚovMì]DH(K¦v_iJÀõ×½Ø÷[ÌnÄ¢3£ÆÎ`:UØ$ºÅ×q çé]$>(r¹Co¼<R?ÝgÛ.åX°õ0æ£ÖñCÍ§2Ly).åØî¶åq[2Ñ.«Çm&\|A[z¦£y5.ç.ÎÌkp^Ê+ðíðÛáÜDO¸¨H ÆÑhIs½(cìû¶c6*ÁhG3¢4¬Ñàá Ð7d¸zj´¬sEËô:f%@mûå ¨U1ÖfÀ¢5ÄBoÃÃõöð(Ð9Ø?ÝWPyºØ³?WXI6Ò<oEPXAKbeuí<ad7Éõ5>-½;yS®É n¾qìÄ¿À÷Äq©ÝÍTÐÄuå3,v¤=~m"Ê"$)iÄqdÓ¨³Å»Â7¦Y4$U©3ò;ÎA¸²l96½[UØeG#ÚóCyZDBgöè?ì1Mcè£ÆuØØyyT[¤v3Äp,Ñ	303
304	ÓÌq«Ìó; ÐoááA4 .ë,ý,8SÕ+ÌÊÙW©+ª,£1±á¨"S1bf(D.np:Ö´`{;íÚ×Ìñd	304	`#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,27)`
305	Ø)Ë¹ÆöV\å N·Ï(VnÇzÏ,MÅzmLvøÓíãá1Ì\Å¬Ärao¾£_ Îð¥£wÄJB@{³[ ö*ÆðSÂ}Ó#×H±!pNâÑ([Hjæám®2`KÞÚRZd(Ý§ñL½P<ÊÌï,§4'¼Ê[9ÌIaðµOªüG©ûåü÷_yl¡$Æ>KÎ¯aÏé{3lè}ög%YQºòÅ§NÒðe!J3+Yy×0ªµï±£@3<008]73xp'4¯ÒgÑØ#r Ï-ÆáhÄÃSüZÆfñÍ¦-àhH	305	`# define ethtool_cmd_speed(x) (x)->speed`
306	+ÉÍpNÂÌÞK\|4ûÆ]tfä#Eïù;Y½Øå ñE5ÕCL[¢sßµ)áãjxQ»V< åìåÕáé;¸Þ^\^Æõbýâ'l5ì£E¿u¶·é¿7ó^6u;$ioÛÓØàèý- äc_xúîòêð où°x(¯ñòÏ¢)ùgÁWtFS,È×"ß8õbàÈ#Þ£7^E%¾qhd©¢{gxÏ×ß5ÏfSZ¬ÁPD7zÒ±\|èZ[mÂ#bÑH[ö}Ý 2QHÈNéKxSG à¿?æËÇÏôpÌLùßVH;Ã¸EÚ\¼Uà¹'ÇÕÀiXj~¿_ÎÌ2ULÉ ¹×HàÅåÊGÐ®%K¬·ÜEMýÃ¤C ôóÇ,0»çÌÒ¸ÇÎÊÌ±§84}Pa8e1lS{°Ý#,P§xÊð)¢~aà±¡jöaØþ8èO¥eÕæ@ ªéOf´ü¦jÚKøXKÉóµë_/ìËüÚaÍÇ-Vo>awó @f£Vh~+£I>Èå+aâù[>v¬'£A®ëæÄ¶¤NDÝk3PGFZ<<Òy]ßéú¤ ®NpÌÔ0äêü¶°Oz'/; nê2^8É5í`	306	`#endif`
307	`¨ÝÚÊô®ÙfT±fµÝjÔ¢i³û»ÝÝvYyrf±ïÓDë{w0¦c<§ª0òÜ^`	307
308	¸WgÅ\þÞDÃ©ìôr{]UúG©¬óÓÿª=ÆÐ8TÌ4hTX]¶,OÞG<ÑÕÌÎiÀJ¡fcrEñy2?¤ÿra°Z°Åíé¼gÃ"¶Æìò¼.?«õÜ~+0»E^ç·çíÁîÆ"8ñ³âÂðAàµm¡£#ÎÓ^èÏÁ¼§©kÊ±°$ÂB~ÀçMBL`®gÈÆHeðþi®j\LÃÙm<õ+óQ,®,3»¸4Þ²Wí«ùÅmX¯ì¶<eð>,7=Óõwg±[¦Âûûû] "?Þv Ñ©\`ì!du]fþ·/Þä"v?°,`wñ©A4¥¾\¼2ØùÝÕ/KuÐm!YÒr¤!?7r\fvCw Ótì´SùîÅÐâc^\÷ûÕÝ-êD]UæNäìÈwæáZKÛ§\®±ùLU0Óòi-ª)QÎLhMom¾óânÛÏufZÚðO1C,½.âÏ;ÇùX·¥%?ZRß3F'¢6ñiî(?NUÜ½ÚiR³®2Ö»p	308	`#ifndef ARPHRD_PHONET`
309	`óÞh4517RBD6#vo2É¯ã+ú âôçY2F«'l!6HÉÌRø#ÎI`	309	`# define ARPHRD_PHONET 820`
310	`Ã1Núó4&é^¹öDhù^Ûû×`	310	`# define ARPHRD_PHONET_PIPE 821`
311	`Ã:uÐÏb.1yÍ$8gëíÄ#´Mgw§fÍ{ny9+ÊîüHð½»0°ÀÀujD£9bµà2³~2}»J±ráÆî²B£Ò¼¼~ÍV÷¤V·¶ Q²Í-õÊé\|ãAýÍZö¯ÅnÂÑ67<Ã±Ñpµ~5 Ïÿ¨òóô¸.{ºlìï`	311	`#endif`
312	`®ìGâß¨Ä¦"k îª Ï¶Ê «Ö`	312	`#ifndef ARPHRD_IEEE802154`
313	`¤fÝÒâ*CÏ1PiÒ5¥ºUqqÛ©w´ìËÃBÃì7ä@d:ç`	313	`# define ARPHRD_IEEE802154 804`
314	£BãpX¾ÅýqîËÂîT\|[{¤ùõÏ¦CäÝÆÁjß¨)leíÕ£;-<³eÇ`[Zê6Û!ß©ðÏ5Í}+Bì¼5þ¸Z^¹Ë1ûNäÂ2yv1ðdÖì³nÕ\C´\|®ý®sêB×9Ç© vJ·UÎ.=ÓÀcì0äfÍÙ%6¦`\|®ùQ^;Þ]Ó¢·yZiyÙ¾"7g~æ}3gÖÑq=,ÌX½ðëæÊþñQ§qåSç¯ð,`Gøµ"ÚÃ¶?C}1:²¤íeD9µM×Ô¡æÝH{ÌM"K.o-?js°¶kí$~!ÃRsg·¼°2~øÁºåÁ´Í³¥ÝFÙÂ÷ù.>ç&¹I¢Ùç³àÝù7WË³¬¿HúIAJõrÍQSh÷êìòÊ6Mc÷n+î2Ô]3!ÐÜ+Ë6¹;®rÁ`04wv0:RXDeéÑö^XÜ,T.Z".ùb!ÿÁÔbËÄ?¼{ùõE¡o~Ï57§Ó¡Kµm8¤c«é`Þ6éêùØÊj¥\êÊ;Ä¼¦æÕ"³Ü³6+rÈ_³ÅH	314	`#endif`
315	ÂÑ}XÍÛêäR>þúíe0K£hyÕ¼>î8Ù(ùfm{r·f3PÊqv4 =×Óa}Ã68[Yâr6HÝ`Ciü¥VéÖ?5I'·Yæ5V>ÀE Ew¡JÍØ-Ü¿=ðÜn*Ò§ÎÅ1Èe F¬øÃzÊ3^9yMXÐ d¢¤Ì(·:Ä,ë!¼bö]^6ó\|R;ÅÕqnÔýEñ>o/²9 ±¡C-)wó2%mÚÓB>ëÍ¤n°¨Gð³±úóu!!×]ÝØr[ndìÿJ¤XÏûBÐøñÖÒ«¥QØ.}·kg/«[mr×[Þ¿)µcé¥\±É7JÚMü¼°æÆýÐ6µ¤P®¾= ìKU¯irÙEXA úxû	315
316	¨Q·ÐõÜ-EÂëåÎBÊÅ7ïØÓO8Wðï4 ÀÎúJÜ¸ÙªD39]X¾ñ¥ùÛdEjU³¾³#öE8KEüèÁs\|3Ús51\|ïKó¼Vw.`Qä¶#ZÄKS[b`#Mñ<Ú c>f7B4ëÛ§AÓCùOÛ¹¤z-èRÎídì(4ÀÀ½½8pÚVµIÊ«ñçóåfËSµ§Â¬ËùL¾²§¿Ï8El~J»8ºzÉ´®äJøÉQÒ&C\g2"älVwftÌYdá¯ÛzpI,f¸¯þ¦fS[Í½Ý}Ï-û$'UÓMQ9ý+8ÔÕ1ÀÁfurx#ËxàQÚÈ®!ù@¯i«OP2P½a6Ûâ¶Ø§Ípçl$z¬£Õ $!:÷¾ªÛ§0M«o ]s<ÕÌÇâ¿H~pyHPP;à¤°§VÌCwý3*ÔúÉvN/N¹º@3»"kÊ9vîwþÉ[LQÍ$&ï7ß-Âùæ´ Ò$dñN ±w6Ì[	316	`#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,22)`
317	dcRÝId1A°¢îHÒéÄÊ ÕRQc>´]Ówi@,sÊ76i?òvÉNû³3_4(C'ÛÂw> æj"5¢P.fù&ímÇ :¹{°Ç-©ÓÛY¶-Å¥EMI3{níïáÙLÇ3ài¢¾>ÀôuÍ:Ý}@ã^mÔñí>wBÈ»O£äWl7ù÷1{6»,ø;?-..Û þä`G²Vs88³sFY©qõÝAÔo;\»¹ëGg%ctHµ_°`×eÝó×t¸,I6¶ìgÉsæ:«ðuZCµýÿt¢'*ÃöKØþjñÂ\D¾µ\÷FMê£ûMºÉ~{wuqxôu÷äÛwWZJ1F"¢PT#_±	317	`# define for_each_netdev_ns(net, dev) for (dev = dev_base; dev; dev = dev->next)`
318	`*r"r#mãû4¬DÈzªÅ#±¡ÔAÿdwh$A{<ÌB£ÊX0sãââ7²/c óÃÁß&òx,t`	318	`#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24)`
319	`0 &²h½ DB{ÓsÒgÜÛF£ÛüÿjE¢,á/"®ö¡¾¾¡Ý1ÞäÁ¦Þ§ý9.DX2çÓ`	319	`# define for_each_netdev_ns(net, d) for_each_netdev(d)`
320	*9¸+.9ä£x¥cÃN¯¸=(ªdåá«½ µ 4fãÖÉîcZÊùanÓy}`e·ßµ@	320	`#else`
321	î¢\üPdØt5Ýeq®Êú½.rFH \D>¤7£¦w³uG °áË%éPYÿ½]ãIãz÷?s¡ñcáL4w#tä§øîãÛxÛ8T;TÙZ,ÓÝT©Ôóú1ÁfqÑ&ÀN&³0HÃ(¨¦zzT¯X¨}'ã¡O7Wï³d>:Ás3 hx\[2TÏ¢ÎÕßÓ[0?ïqÞ£Û zGêvµ¿@rËÆ¾8æËÜpAABtAè²M·t³ô!?ÅC¨5j-ÄÄÖÚøm¯½·[;¨×éúþ_[ûÎOÚÕÁ\^]ÒÚÉAM>EÃÐèðßqÔ½#s¶NÓ1G$){Ú p+§®Vë6¢$B!ÁQÊÃ'½/Ê´\|«³ã]´:VáÎæ2ëUôÁ¬ÐÚÈ2¯Á>¦ 9aãLí<Üï]³ñ®0ÄÓd"J£¼CÊiÓEó¥G±îsXGwÛUdXù¯t$¿í¶ËÎÊqÍ4ÍdÄJ´AFþ³"»ìV«éw Å4dï¶¤¦ð 8G@µjmu6dIÅ½þ¦NÏª4û-L~kmq3sgÍgt×³´¢¦iæ]Ï«oÚDÃoU^£Uç3Oøµê-³j¦@¼zT¸+hDw´!\|Í9ìô`.£>±ºÙ¼{¼A¬rNÞ¤aqZJ´ÃZõVT#ø\|ÌZÅìa	321	`# define for_each_netdev_ns(net, d) for_each_netdev(net, d)`
322	«êßP¢_5!éPà9oE=ÀgÞá»h ¹åì»¸OLså?ñttp.Tf©ÔZåÝ_ÐH`ßDÎÂ³\|êØ¾@#¡¥«¸w_"tT ¸óÌAE¿?nf<ÙëQÒ ÆDUWë}w¸)äyLNÊÆÔûcò{kù$èÄUB·G¦8ÒêÑù7(&i"eû_Í)Y·[9g(B¤£®lþæ· ïh:¿r¿¿½K4X4Ä#Äý²hET`ìÎÍ4Ñ#[9as ®§I8 ´^¢¬!P9(¹ÓYJgV?ÞQ+½äµyº©±[MD´(ÐåzÇQþ×¿ILÃæwÁAE´\|ÄïKÑoôÛ:õ¼Ö¿ÑÔoÚ1gÂ¥ ªf2UL0zf¹Æ²ls°i%Xúô95^ûZpÎ®®ÌùTL"}Æå´(©Fø¨6f$Kæú ¦AþÏ·ÕÜÛk{òÉåÕáË7§_sVn£3èíw:sóÕiªMttÞ;É©ú]Â4òf	322	`#endif`
323	`'µT±z[8Ft¡Ì<ø½)ßÖ[3:+µ:3Q+«·¥Ò8h.Ù%IÒQ0v.£9¤ý,É±»Cf>3Ã$&èÍ2\|3ð³`	323
324	`;fËÿRR rÍý×U}RùDCh Æ[«î0\|A·\|*<®=wEµ1ö8=ÓÒWGÁ^½Ñ.WXbæÂ(ÜÃç¨õRvá WFÝ@£±Ð#Ã È¯`	324	`#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35)`
325	`x\±Vi%-,÷d-©½@¼X®â(&KS8í>wmèFØ¿u<ò1©ÍH-IïÛÞ-b¿¼èËø¸º¶»+ìËU X&SãÜäï`	325	`# define CHECK_FAIL 0`
326	=b ¼ Pmì¶ö[v4%V8ù³@Æ4,I¹sÌ®Vv³`+·C[\|oÉd¶Ü¾ZäÚ4Ìû,RH®á7ìíeÖ:]d£ÂËÇLÿÎä´DsåæÔ½á§!JÇôþ/ ÉÉ¾Ubõé[aEÞç¬x;Õd]LbÅÏ\|%¦yäÃp?tÎ®®dÉÛÔMê¢8èß(¿¨Øì _qÂã>^G¬Àñ}Àµ¿lj¦¢÷ðo0 Òò¤0Fa¡5«Ä´óuô YÐ¬Ññµ#cá-à¡+Ò3ùú.Åæøq®×iÖJd4-ìn-ØújÉvô"Z&¡ä¶@-~)}§ÆÏqÕ6&n_X r ìÀ7 +û?ÁhÔý§o¬ó4¯5)÷f¬Ø';Oov&8J{«Çm§íIv$Qô.W~oÎQm§ø¼2hû"¼î%ºÓqtöi¥*ü/KKèø<å¸gV`$ ÷Öq6ã·ð¯{Î¿æ@\\|«%Àõ$è@ÇánÙÒ#àè)P±F§1¶¹wÑ{R§2ÃËüXòSàº¤f»Ã&0!Ó.ÂÙHñ ÎN9ä2.ÿþîoG_ósbsgrªW{uúN¿H¦ò¹×ÌùílûJåm¾ ~Ò¤,Ý@CQHÔDM±páî	326	`# define CHECK_OK 1`
327	´î!¹üd!î¢+#¦èÄØtaÎK"ãm!dYz{lgQÿ cNß4F¸Göh³¬¬Ï9n7³ñh{à>«ö"{ªñt¿Ç¸ª#9¥Õz{SìE ÈeH`xÑ(Ê×,°¬ÀÎ0óïTcÇ»æeùwC£4=åx}~ô´é#(µê$@Oæ3®xp×X\¿ôôFC¢JE³èEÓögJðwÎ7¼`CÜâ GZTevh+/YhÊèø¬iE_² ðyo (Ì¬¼¬Ñf]®¸õ!æ¨oÉÈjPrÁnýÞ%ÅÅ3£Õ PÊvÏ#Iåh©£Í&Þ\|øBbÍÃ\|6a¥ºTè¹!vô¸ík¹0øÒèqJ[*8ÑJÆÈnL	327	`#else`
328	`²êB2«EÑ1aÅÔÙm6]8ûÆÓáÜ - jtÒèkjk.{ÀÆíä§ 9@C½9`	328	`# define CHECK_FAIL -EINVAL`
329	`!½D½§¾Él68ðUzÜÉ ´å+$öÐ¡°iAêzñõµ8ä'r!ø¬ÉBÆÙ}× dÓ:/»Pu¢"8Î5CygW²wçEï¹S:TücVáF`	329	`# define CHECK_OK 0`
330	`ÊÚ8ùØN4ÄØ*dÏ.vúÖÝ^¶Õ-4¦Mèí³°Që¾È4§C¸28W{ÂÍ/æûrýQ×ÏÌëu·DÎiÍÇÎï´R~^`	330	`#endif`
331	`åü¤ Qo¶åHTüj7:_/Î=búl(o#°XÙCõÝyÁcät,%p},÷J:Ð!±`	331
332	,ÇÈ5êzµ¥q/bH¦¶"JIa l6üJi¿\x ×e4s,?@¯@4³[±ÍÒ5áIJÞJfÖJâeM« Gîl%¬Cð4+:u¬ïxYNÿµ36epêâë6V00V¡úöþÆ®yKS%¦/u¶º(séïÙ¼4¯ <¾mí4+ö¼08×ù~½ºðb¿¾¼Û4âÒ@rgØHºÏ!¾û²ûuOfÖF@.Ýù¹Vuÿ/3J«ÑÜÇì±_8g2YËôbFÑh!ö6Þç&àÖe%ø´F>s\)ä¸Â,±ÀóK !P¯s¿Ü"þÇ3¦áÿ'äßtõ^ºÐÒøsH83ÏÅæ¡¿t(ÑI_ùTü&@YÉòÍ19· Jwºø 7"L©Õ®kÁt:í¯%ãUÅÚ1]¢áq.E®¤DæSï°ÞÃÜå²<¥àTla/¹³Ûü6r£5Ø#Øl4ü©Sÿ!¹-ó3Åi.ia;laºEet;B!cyæKD1d$wP0Ô1ÃÓ%¿tïØ_omU@j$ +Í±²Ã0Ì8AUFÌäÃêî óeü+³³\® ÆÔ`U´¶À´];î¼ü.ÕÊ÷¸øª;È×ªPvµJB3k¼d§I¡ÝCRdAÒàüÑkHÁ¶°ý<f7*5¹;KÓÓL15}k¿µà[.CààP1mmsxå3O?x¿ýÕ%Heï\é4LÐ$®øå<jOHÑÐ?iU¦ÑÎÒíÁÑX4¬GÁ`sØ2Wobçé9ßÉuwÆ §+q&RG.l<íBÃç ýËKñÌL9&ïð¬3@C7±,&Hà	332	`#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35)`
333	`=v#¡"gÔÉaÿxW¯¥v# HÝDB2 ôÁÂÎe<odmYgC§`	333	`# define use_module ref_module`
334	è¿ËÆ&7tZÊ!Å¶*6«åyÒ?Û%-o,Jòà\|ÅüÑ <N÷±@D«tþä1ØÏÙvßmK+`6__}\1WW+@0\|~G¡Ó ,Åj)x ÇÉW9B¸Jß$@X¦ùXC§¬³^Dµª\|àWxÁç¨N¢óawë ú"c®»Fm¿Úh6«×Ã0:ìHÅ	334	`#endif`
335	^óÌn£Ý8Øm4v/OêÇ¯wWíç,/!øË:ñ\Dß¡U«N1t1dz)¶îLLÅç59>0úó£jÂ ¤b],u ÓKâÐÉ¨µ}Ñµ¸J@ªm2õÄwé3ðmÙéC½æ_ F$ÆÊ~òz<ày:^vÅZiy^RdFD¤ñXö¯%v½TúæÉu´/\n¸,ãlôÅ ß¯éÝN«`)²§£a¶Ááâ£/¶[\¦?i]_ùäµ-·7Mú.ï¹ö+ìÍNGrÚ}Z1p5Ì LÄï;q+j¢¹9b-õLh¤BWr&ª U¦535+Æt×D£<IJ~¸SqÖÃÆÐLÅ`TsPáÂ`lF3èC<.ü!q¸7¤Mçw¸Ë¥Ûrgönra\/2>¿þ÷Ti,¨\Æ3êäÄ/ï[äÕj`	335
336	`¸.IdÈH»0±?\fò[ºwVÚ§ hÎ ¡¸OkÿCiQwÄÂyþ)yÆVÎ 2XLUêjdÂ[½eãµ¹q`	336	`#ifndef NF_IP_LOCAL_IN /* 2.6.25 */`
337	%çêÂY³düucªx.K5¿Úè<é"þÉB³¨F¢±ÑÜ³s(>+ZPV¼HWÃhÐUï ®è×.µôÙî97sÛ"Tþû½s×Øß:¼ ö[õkE«ê71±¸PÆÑ8hî·¾®Íá¸g£^ßnh½ÔÚÆ´lõìv=?´~¥s4Z<IJ1ë"4Èl>Î)k;ó1K^¾®c,~j&v57ÎÖÊÖfëARk`v(r$ ¯ÕgbÃd¤Xk,MÐÂ\|oåïX\|ª-ÃÜ\ðëû¯½yÉHÃ 3µK!j`ïa¡¬ã¹Ïñ0ðÎnPhÐ¼`#°Õl+¼30kÂÞÜV~OjD§èÚ°/c®ºø ZBK5*>ÜbLp_qP	337	`# define NF_IP_PRE_ROUTING NF_INET_PRE_ROUTING`
338	÷¼ß8h"´r´_3]ÍRD.Ö`{ýAþqÿý±FJ¼¼Ýh7ëHí«Ýv@tx:9?þh²ìî©ËëÇÑ>ÜÎñ£"ga	338	`# define NF_IP_LOCAL_IN NF_INET_LOCAL_IN`
339	XÎOU?Ç÷ÐFQ@«^ÈËè`Hj«q\	339	`# define NF_IP_FORWARD NF_INET_FORWARD`
340	`P$àÃQQ¹·ô _ÛwQó£©4ôûói,J·;7¦+ï$q@ÿ{©~áRÎ«rT35S¹P£îí÷´±ôÿøß23#å{II£Q ¹Ux¾ld0lÓ÷îâè8æ%¢Ûys@Aöó<:8pÝñ¥¬ëW:ùîíaËèÚ¶âSbdvðª±Cl¥,`	340	`# define NF_IP_LOCAL_OUT NF_INET_LOCAL_OUT`
341	S@öÛ¼OàñÛtN]7*sÐMcÇxÜ`W$oB¬iê°ji÷s^&ô¿æcY·Ö[	341	`# define NF_IP_POST_ROUTING NF_INET_POST_ROUTING`
342	`-d~¹øåQ#¡Ú2ÐôÆ/ ²1 ¨±ïå$~ø4UHTûeðÐò4&'t±¤Ø°AÝU=¾ç²³\HiÖíö>IÁ³l×z¿e.rüýæGËÜ vw÷Û» 7¥+ê ÅÕA;ò]«yPoÈwm¼?åpL@?×t>3ánìVX.æ35+¸}Å(IAþ8Þ>"¡çqTý ÇäÇ`	342	`#endif`
343	aî÷ 98é[aç-A\|Î+Ï§>´ÿLº«m5[ÏýúNÔÛ{-ø¾wé®mQôS/üÇë¨±¿¿·KÔÚho_{û»-ú¸qð5cÒÔ:6~SÄh gvçÅÇs 2^Å<q·H`êZ³ÕèT2k¹H}Ì\_yÜG!.¬æºEìÚ«3Ût<Å&:9 Bô "ßW´þûL7ùEÙÇ_Ù²ýA)ºeËZ¸ee:^å1çÎýÍÚÇÔQ¦þldlÚÐõA¯¾»Äfké{gIº}x@Ú_ÛÎËyÍâGM07bü96Ó FÑÄtljKFæáLrÔ·5 ]AÆs»òp7ÞýÐÞýq3âgªðzOå.Ëf§.Ec§£Ò\|³:C'@MãÜfíIGZ0ëOÅVVi]&´ÔÖD'.eéÑ[4Èôæ/ÕgÉ%BI[uG:Nº÷·Ï°MÞ%·}ÓDØ» ïÎUötíé^¼aæÔxÃ-sUÑ Xo1~÷,þ050XÎI]@1¾eîÀMÅzÇ£ëPä7ÈpÕÏPeo÷¡ÒÆD(ç`"Ä"ß÷fàªDò©qzµ©>ÎóÑ(û¬3ã?·Á«ù±?°enÛLÃÄª!\ÃÅM8øþíÚé±'+ÎÐ¥ÚÐ%U-V «7B¨ò`Î¶zg²uåÖ7({Ï0F`ìÁ\¢$Uñaá@å:,ÊÂ±MÜ¥M3^K¸±/dô<8q°Jý×í;_k@HÝòç~¾7ýt,©°ëì^=Où#¹* ÙêÅú^;øE È¥oÞMKÛB#R>Ïg-^äª,u¢ÒånÄI¼`ÉËöü¤¥ÉéF³È/Ã÷L&U8lú¤a¤[PÌ-T8ÇÚDqÙÃ¤Oâ%Ý5b³å*C)oÉC©w hJÒ0IÃ[i v	343
344	©8ê<ñs÷dA¦»ÊN<²q+ò\|ZÖh´{l¹Ú\éÏé$öæª¢£9vgó¾0¬ht!}ºÛ>Ø Û\äW¶ÌÐÇûíýçX§yÔXp`2Ðñ/)~t	344	`#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)`
345	`¶3£Ïï;,¢ùqÌ¸¬û}ÿ¯ó÷NîccÔËKÜK.,¿ßÔ 3ø¾xbtq1¢7Pr@Yöä.µéÃF¡£4 ¿¦%&È ÚhaàIL¨&²O3'ùXÐL&b#\ÑìöX÷aæË&ê)ØÖ_»¤`	345	`/* net/netfilter/x_tables.c */`
346	3»:^& ãßº ämÝ$fEð\#TA§°¨ß/é¹Ð«¾!F $$SÝÛ´nHÞoöc·øt¬x'%ýÑ §GoÏ Ã»§K$QØ¤\æ@jJ#=BbD7dðN³d8cÌK¸Q1v°Ô`	346	`static void xt_unregister_targets(struct xt_target *target, unsigned int n)`
347	`WÂY@a/¾bÕ3ì6N+4%1½4Þâ9%ë¸YW´\|¼íÀêqù®Ü]`	347	`{`
348	`#Õw:õv§~Pkî7í=hh¤©BÛ8h®þEÐKz5p¹NðÍñ9ÈM®g7¤Ï×4Ð®ï z^äf:20\|[Þ½²pÌ]£;2ÎG\ /ùÜ®wëÀ¿HLYÂÝð½¼ÈÓ§ò!ÿeO\ß\[:ÎD½½+\[æÀÆ¼Ñ 9B¤¼ÐÕ¼ gÃIÈY¨6v=áï·Ùñ)ÿ½G:Ú3ÉgÂl[, 2Î9¼Ì"Ù¸¾WGàêQplEÞªD»r*6·Mézè¼KÓ·õV@òzîRDY`	348	`unsigned int i;`
349	`Î?ªÈÉ <;Õ£Q;sàvnì¼Ö²ÆaæVÀ'2:c>Èf¥ÊÇxâP¾)íäw©ôúÈk»æµæ÷^{Ùñïä°ý>Í\§OzÙõlG\|ut¾M§ÔZDùÜ¯Ïy[Ú+¾èwlÞö>Ë¿M¬¼bêEÂi±N.éx ³«Í{ësÍ§$Gi©í½wuvÙYã<=Ñ9^JßÒyõ{ûcbú%jÈ)Òè¡+YìÎóï¹¬mÅCbb/qTÙ¯ 0eÿþvNN¥f»UÎ£Ë¯úá·´¦À½×¾$&>þ:Â`	349
350	`¼.ó9¦X;K¦`	350	`for (i = 0; i < n; i++)`
351	`ò¡é×v`	351	`xt_unregister_target(&target[i]);`
352	;åÇûMó¶7GÛ¯ù°nÕ=rõÞéy²}öíá¶Äw)g¤øwV¼×vð"(öâhLaì¨n\ý\¾Ûã_¦»AFs6¾ºz£~3~qiÙ K9Ô¾J¦o¡}..µÃ^½l½ÏxháF½´w ù`'¯IG#¦71).,çÃ^ìÒÔ<UT	352	`}`
353	\Xá@°]Dd¯Q±$k;Î»¶ÇÐ¤»ëW<õ2¦íÀH2`ú.qG©/\|0ùd¼xª\ ÙÇo"	353	`static int xt_register_targets(struct xt_target *target, unsigned int n)`
354	Qh&ôàÜx¦2çy,ë=Ñ2V àÜ%<Y{wÈµäk?ì`7·¶æ\¶ãJpnÛ4ò Å>6Ã% % Ûo}r-¦ç<aÀsjhç¤$¾=;}sèË@ùøÇ]¬6kÍíw'ß]þÑ} ªiw·ýoªÿÝÙiîý¥ÑÜÝm¶Úífkç/õF«Þnÿ%¨ÿ+`È øK$³uÏ=öýÿýû`ïg&²6v«õfµÙÐä»Ïôÿ´"sýêÌrÂñE»jÓIªtõÜ'Ä¤LðGi-/mzðZ:qÍ'ÁÏ á=È!k} #©<MîgxÏ¼_÷BôÈ½õ6ÉÕfljÔtmß{üÈËÔXÞ¢uäµ~mî½»ÒP>#hÂÎûfÁÛÒÆ¶Ô÷í¶,08\òK¤M±ò\Vgé¸Þó%Ú¨ä4³àà"¶1 úÃ4BM%be§\|{P1YØ\/Ý"ÉUhU±8/w´skÍ^Ô²[¥x(@ñðÚÿgùG¤ÙzÉ§bã=0yõ´«ÄÞXg¸×.BÉ`Àöý·I!g ¤QÍ(Të4SHûÎú5ª·&-YÑj®5)"d¯	354	`{`
355	MÔe+OÏIÄú¦lÉ(½raY'¸ð i ml@e¿=¼øº¼_sÐrOßg¦ %Pºæ½2ÓuÝQöAµÞ.2nDFO:6÷Ì[ûÕú}ËÿLlH½WpÖ-êüEÍ,¶Âà%Æ!EúF5¸Ôy{´Æ3¢u¦V`½0¤?àÉê¶jH®Tÿ¶¢ÂÛòh\kBró¥äìÙq)~ÖèBB½I#ðÜxæ(Å2h:¨J§¹÷¹Ö«¡Ñìóö¯Ú#µ¸=¼¹úF~$O>O@ÔÞIhÄ'\|¹´ÁÃÆNFÏ	355	`unsigned int i;`
356	¼Øé´QmÕó¨z!~¼/÷¿jw®æ:í2§ÿñ¨ðGs¯¬+;GõÒµQ®s)iv@÷.{ [DÓ$X3mõkÚÚË£·¬æ¾½4èçîiA"JY£¶#[ãÚª6ÚO]Q, =D¶Ü®37,Y2[gü½býú} ç're\|8WmKK³22×,ÄÿbªÑQK<$ëT53£0PàÞlÅaì\cßðçGYL¬ä Póì(í 6³qÓùà« ]h¾ó)Oi¦Ö¨6vÖL-³G:Ü È éÏ½lÚÜ OÏMrBÇlMÚ^4ãðg;7HCÿí.Z`×>ÍÝ²]ë	356
357	`ÏÀ:1ò½¢¬¸9,·bKÕÍÐöìÐÄXfx²F_s¹£É]&lç®mþ_«ÿ±máMrýGëíUúß^so·nô¿Vcô¿v£ÙøSÿûWü8½._Áça¯ÿåý6×ÒùJöD$fñj³¾úHGl S[®ñºßHãÄìsÞÆNø;8áñ½Fj°¦ihÊ\À¸ÃyOHÞ6K½¹áR¹ñV÷øäüê+. i-Dñ àÏA<ÒAt´õlÞÓ[!6UòEªYðCõ;þ»ÿHms6MZ0³BÊH8tÀõu÷é8¸lnnJ¢L¥KuLtjp>¸,s\|bÑÞtqKT×Ñ·À(½ãg![àúªFN8JQ@ËÏÅÐ«Ï9TÆÎyµ!'sÑ`	357	`int err = 0;`
358	ÜXo¾¢ØíÈ®äwAhAªÜF å!FH¨Í¢Ù{µ&&ÃäÇ;MäÌÛ,ørüK¼·gÃU{¼Y½µÛ$Tð0w 4öWóTnÂà&"Lnp`cJD¨ïÙ ô±ÃrsÍsÃvDëÑ\¿KÖàìÖÀ¬¶ÙÞ÷`IÖ£v4Ü Ûõþþ îôë{½z¯×îEÃao¯¾¿³ç £¾³zÔójOU ]¯¶*Ä¾¹ql2i$Öqtz4i\:7.:Ñ8f¼ÇÞkâ½·ámBÚFýÞK¸´VOäÜ7?=&§³B'´áºÆHÚiÝÍÂ2°úÚ ª	358	`for (i = 0; i < n; i++)`
359	Aæ¯ûDb Yß4 8Õz7MjÍj8ì¶yñT ®¨ÉôÚÙÄöA¨óÅKê¿ÆæpÊææF2HéÚ«î«Gm{2oY<øRK¹Ù5~;+ð[Ûù-')a`{ÃKöö¿Ì^µg e·öËF).Í³Ê%}õ¢ ªÙ}ú]ÏH¸4aÞ.Ûáª½zTß0G'Ç§Wz·ÒaED^;õ5´%FÒÇ¬£`æÊý¸n²ñZp>:åÜ¢gç'äêþæ&:¸öZÂ·½®µo»@¨V5Ó2`q£PX_ÞÁ}×{À¹ö{Þ¹þ°q·ãFûÆH¢ßÈ#&)V5iwÌµ[Ìbpe RpþqJ%W èDÔS½ó¹,yÑE áÉdÀ!ÑÅTî¦±2H"®yjIyÉ¥SY¸'Ûð§²Û^õcÓ-{»µ$ÁëyÉ0iåÜqà{;wð®ýêO PánçQÇõíCd¡à¼ª³¯PàJáÈ ùIöA¶ AÆÓÚå9Üâ(£$mY¬SAÏ¼xËEkªuÓµU(×-8 À(5h÷Û ÃÛÈ¢[Zã¿áål&ûóup¶ìG£©·îõÇ.-Zo58À#[×d*f q= TÒú]'Ü4Hiíµ$ì7ööêaxÐê·÷Âa«ÑjÐû{ýÒ¡ÐÜy=ZPÅaYKb¾hg»ûølß"ÚëÞ\|2Û[ÕæÞã£ºB¢ïËÂÓ¸Õ!P8#µøD	359	`if ((err = xt_register_target(&target[i])))`
360	`8È4`	360	`goto err;`
361	Òazi<¸f8Ú3¢»I2©Ê'$¬ÊÂ_ok`k &ÜæÆÊª÷`{Mô{V@´Ø½ô^ÙÜ'JeÊÓr¼Å¥Ú¹L¤qXçº2§.#õ [4Æ®Ufrë"îïoÎ¥«½zGMÛ&´Q.ìlåèS/ÿú6 <5ksö¤ÆÛT,`nÎ(%ÏIZòì-¿HÄõÓ®Uc`$#©n¼E3Æ~KÇ(z¾£IÝ.Ýgð uI ïfÑÜ,+1«ãD3û°ÝmÄï¯ (èdLp\|zêAä¤± ÐX<@è4Ã+Gôy\|öÝ;D£½;«^\\¯» ýãëy@BüDËAln8yÇdÂôæDÙÏÝÆS÷Ãö{o²Á¸\ Rcy «4ºõy'%ÍòÛU'Õu #b?vÒÜ$ì)q%r¸aI«ÝýÆwdëòVÒÐ½Cs'¸·j'w#Ãd&î%$&Ü8]aËÿè^^^\u¯Î¾>yW[ú)³y¨2"Ì¨.½N+ì~ã4ÙD³.IªÑ,/¤\|ýöðÍ³£îÛÃï»§ÿyÂhItè£÷}¬¿$;¬÷£qØJ`Ä¶]}%ü5L£èv³bH/Fñ~LÚÙ¤Ñ®©)°ÖnÌGùáÊp ç·ä²	361	`return err;`
362	w> øBÁ¾GA5V¢DÌÔ\kt¢øúº::ÕÇñÌP¯ÇïÕé;®þcÂ5TlÂ©+Ë8 ~Þ,uÓ¡¢b ý&;Ï¾n¾ÈFÍAÆ ©èKÎNWà@årãBèÈdF¼³1'à¨å³ð£ùÔ$õC2Ð½¸tHRï3Æ)l8zÉ4Y¤Rp@5X±Ðå!©B-(z N[Ö éÂBÑè åùñ+/U681ÎSN úåÅµ&çt-ÐÃÛZ½;§gÐÝJKk 9H6cíh^¸[/FôU ë¬0îmtgý8à,U+>k(6^àGO r,$ð77zÜÄÀðºÄ«{ì¨²%PÐ)Ä`ÃÂ ª%§	362	`err:`
363	`^×L¾$ØÝ.wnê}eG'`	363	`if (i > 0)`
364	<:Æm#ëh\APh¤rvÊÃbÅ!9HÊÊ¬yÈ_I3W´WíÏÔ-¯y6ÝÉ«¯ºç]b«4õ³ÍC ¦_:v¤4os¾f^(ªä÷IéÃ9k1ó,G¡ëìIÆÑU°r0ÕS\|!%Òkbw;eUÛF¬FöBiy¾ÅdrË¸Ü¥n)æÑZK³Ø¸B e GÙª©ë«7 £råHò°¢ñLx$>¼Q¬>%4óLïYNËþFhý#~N0¹¾ûuÃØ^2bâãÈ'»¨ÉYµ@ÃÕ%Þ%õdÛüívo¿Ñ¤#B@b¸=ª±Í¿¨Ó÷â3z$ú_guO77}Üù2ìJ7$áÁcÚâ5ì.Dô¦Ý½¼8ê]\ÉÜ2éóíAN)=EïCè?Á·tå$w¦$öÚ¨¶Öôúüz> hq¨ñ¶°D@Gm,ï@?dJLd:r¯É¼PðÅ"rhPÛ®Ü01EnËC)Íìì¼ºtÄÌ3MeH®l¦Rk¶v8,À6¸Z/{ø6kS4=gÊÒµ¤8ÛôòèaFn¼ JÒ ç/7^ëdF^e8¸a°óöÛr`øþÌÓõô´XÍ¶è\|"gÊ?Ü½úûùI©Õ,ÛýK¯R×B=._3@<5Û`äçWG¶¤NX®;KÒB7Ô÷Sw9ðôñå4§SÙRtßî8K¥V"ÿwX¢2¸Ä ÏßòRýl]UÌj nkXÝÝ.í*`HL$\Fäâ-üñi>	364	`xt_unregister_targets(target, i);`
365	`ËyuiÉbª¤ÍÅ"á¬óEN[âKVØiì»{5l4\|A`	365	`return err;`
366	`81²G`	366	`}`
367	`; >nîvyQ5ëá§ï¾=\|cbFRÐ ò -å ¹øOá± cd³øÒ2¨6¼ëî#Âì0Apq~XpÐÿÏóhù-í<¡¥éíývúÞ¤53°7Ì 2;Îul$:óc,<¥÷Y°<ÞFm[I«Õ)®Ë4E`	367	`#endif`
368	1}#knÆáøXL6«ª$°hI!}P}?4Uh+ÿ%5W-¹ÌFÙÒÎêôrIAPÎ_åöã«ºhÑûÝÀ%ýY~ñÛk=Ýã^j¬ÓcÃKbjÖÄyI >ð>ÿf1ÐÄAWå;>bf\|üÈ¹he«äiÁ$Yyû¸ÙACÄGÐ9kvY®wø1ê¬%*Mç²§BpÒ£{¨±/KFw\|vMo¬{¯Ù@Ù\YÀ² Ú-¶I²Î¹F?nT<2ÂÛ ó o¿4u£úRA¡ØFqOOâÊÏ]÷!ªëztÅÈyd.PTÄòü°:oÄÍV-(êÆ°BM&;§½³2Ûï]g°7ÈæÁ:9¿ÄLª®Ú0@»éùTKÔËS.N_&á55væ´ûe¯ï5Æ1ÁÄspÁ4¾VµêõbWÇ l»$xs_wÈÌIWÓ¸}ÃÎÛ$Å¶ §ó),G`3Ñ·!\ºÂÒ#A4	368
369	3ÈpKBbøÅYË¸·Áå®¦é«ï·/¾·ÜïDíoÙ)Ö×únõ½Åú_Þ2º¦Ö2qzlZí«7×o¢½n4&uÝSNóÏK¥ÌDñhWçd,h!Ì¡Í[&i«WBà9FJ{\sd_qª&w÷Ò:¿Üá8RUõFpCl¬~+û¿3Ô·=ÓÂUÖlTA¾È«Ó×Ýãß¼î¾{u&ÑÙ"Ê,Ò¢D!vÌÒE&EÇ·±¹ØmÒÏç ¹NÖÄ\ºa²órOÍ U¿gEùU#fG¯ÃùuÔjbDGùQ}üñnÛGãÑà³d+¼\^pT/0O8ZÑþQ7IH^³ëD#Ò'¤J!æ¼T»!¹E,+Ð(µDu«×Â£oMäP7Éj* þSÃà @ÁRFd=JJûû<üá·³EQÀaÝ`¢E Û,º~`bPW~TUPÓµh¦/'l&HB$ TÁìÐö×>&Ìp4Ïn^0Á`"ø[æj.þ UjWÆS ÍÑ+4&lrÜÐ,:/ HÆYzº!"HÀÅl"ÚÇ j±5PlåÚ µøó¸.!úâ#üs!^à%Ñ±éH	369	`#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,11,0)`
370	`T©=EAÚLÀ-Î¼É®aÞúÑ\çkEÅ'vÉFM½õ×2DÈ«DtlæêCpá!Y`	370	`#define num_physpages totalram_pages`
371	`&¤ ûÂ:ÁæÉ5?v8ásµ³yX/³\|é¹cW¹K>/í·ÊÆrhBvµl*Ù"âtÒ5ý^JûHYP}_25øÜ`	371	`#endif`
372	àG·C-ò¢ö¯ü({Ú!jêHáÅÀ'BÇÒTüc$WÞ&×{¼¶m°»jÏð"û»HEÚ85êeâÐ¯f×6³=änÅSöoñè4Êpm ÕèÖc`ör¹©u&òYIAdõðî ©¿$Qw:-KyÀ¬ë.¤¹lÏïÖ$Âé³U ¶Ü¹eB=,Ñí?&-³rMûvy¯.'EZI¹æ³Ë	372
373	`åTl××ºàá9"(M§j2>.SqÃèºð¤öcT¶G 4µ¹á X^QsÎYaXH4éÚRÑc¥?½5ÎWz3Ý$SfxAREë<¹Üñ¢Ô±¿6~e`	373	`#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35)`
374	»¨Ã,HU4Ú °¥ÃôÖï`mF^jkaã]ÒKÒVÏG6ÝE0ï¼ÞÏ\ÔYY²¹Ñg[®ø"gq¥\C ÁóLYñpQ ó}ÈÁ@°úQiL¿RLã^2ëuzb$HÄêÎ'!4ÿh ±46Ïèz'Âá¬~y~j¾!¡UÈã!qZ#Ã¿{ÕEö÷ÕÅáÑ×]Î÷Æµf»/aÙ#äl6á<6qYä7µ	374	`# ifdef ktime_to_timeval`
375	`eN\9å¼S®d¾~¤©)Å¥ÌÔ9ÄÝÈV îZVrÒõª5'«PLWïÕjnëkõA©QW¯«=GÊ0Êþí=Å Y÷^ØYï2,1?ÝatgIw-ì%cµÆÒ½UZËdeÛch¤.o0õÙaæÔa'-¼@i·Á¡ÅÙÀxeoÀ;ð~4ä(®kÁMÅÈÇËçgW¶±LCñÌs¯Î.¾;¼8F9t#7F.göÄ²ÇÍ'í\|9d[PÃ%~3ÄTê[lLìææþ:Ì1e#~Lz>r¢â,ÛwÞø×vD= g'\YÞT·/®¸oÀ¤æ>£]âÌ`	375	`/* ktime_to_timeval is defined on 64bit and inline on 32bit cpu */`
376	\|YÝâ L¬Ø¤¢]§ë4M¥+:»0¯0;I{óñÔoh Õ2½Ç^û\|¾=+ÆÔ"ýQDÂíû¦yÓËÒ`f_4O°Oë>ÔO½ª2G¤r¬Ú[ÅÂÅy&F6÷©÷ÛüUh>	376	`/* when it's defined it calls ns_to_timeval, which is not exported */`
377	`Æc>ø/ófq¯QRZÒ\r 5Ï$hMeêyLpÝß.3`	377	`struct timeval portable_ns_to_timeval(const s64 nsec)`
378	í®µ×¼b@ Í$ öWã!¤Û5ØHp¿Á5ü.ñ£cÔ]3!7ã)DÍ·P"LYùQÞN=¯»ÂÏÄÌq·D"µpviº9ºü.4ÉG+ÕØÉlOº³ôAêùº0þ"nµ7Ï$.¿.òb)v5YëÉêÝÜ³¦\|M[X¾ÂåI#t~öùfó]Ö3ÍÔÐ6ëlo¾"±ËëÈötÛËß¸ªYu*Å«¶wö·Ù±ªýàr~gú? ôüÆPt~ã7ßø}æ7þóO¬.¿iÈ~gYùòãðiÒP§¹¢¼Dh%¾l sÌ'_êÞ µGeÔ>EÅ`[^7Xaú½Åç½h	378	`{`
379	uî2 ¾§é· [ ¡²ñ%é;ÌZ°$UKFÙg{OX)1Êµ,W9Øì<SËiW~´ Õ%J49ÑÀ¤©n¾¢®ä~"ír>ÚôÛHû69ðr=³pC÷Yb,øâòv+?"êÿô7Å¯GI"@a]aË"ªHë@P8£¿n»ë5±Ô&Ì9ÙÖ7pà2ËëqíJ(G%~z¯Á]YJ"%}Js÷%zÇd¤tg®hÇü fxx)?Û§×m~lÛfö¦ºF[Z¡Äf*?©Qæ`ÎÏë¤#le$£b\þ'K¸WÜgúÐh\³¯ÒÐx¹ÔÁºDpÉÈßêG249½vãÅ«c 6³[-(gÚÒ'Kê3g,`àC<'¢ÚöQöå nìSâ=^æÍ °ÅÌ7Z	379	`struct timespec ts = ns_to_timespec(nsec);`
380	Ñ`TbX·°r²GYXÎ2êÈÖlÅ?qjbæ9en_dï«o%µ,Ô§½6ý¬_Ol{08ýB_Ó3Aî¬õôHèOKFrTK6ªÞøÔçA´¦åÌË)%[(fÞÛMm8Æ&ZüQèI2-?GW(ü Â¥)Ñ)0&ZTÊÖbO¿s¢u@lµµ¼Ûç¼¿ çß¤§C¼å×PûL»½5Xa³"ü	380	`struct timeval tv;`
381	`ÃGÄrm¼ÕåÊ¾Þ½7GÑPlq\hØú3®ý,Ð-»õµÞº5»ÁØjÀ^ë,·çÑí»îM¬¼øÌMdÊdHÎa.¾XFÈý<mÙ¶0c§ÜÜh74WSÝgaÚ«Sêk®D?ol{¿ìÍ\|m>.]+(sWF^ÏÇF?3h!ªdÚ(ÙTÏ+c[zÖ£èÄUÿMüè)ÑîaNÅ"fééíµF¸&,Ôâk,ó,ÌñLåÁIL²q+Øl(`	381
382	`GaÕç~Ä[ßÝ©3SH:.çYèù§±iø]àæÚ´Xæ!®:ómÆ Îyå4<òRÇÅÖ± ã;>9{vüb»O¶à"j´ô£³úÉ44:¸ Îª7Ò©fÀ>LÀÄb¦ékßÔfAý¶É¢ù ©"Ä= rÜ ì»A¥¹G.RvÌÌH¥y¤u3ÕØeBSÔÇ£+*èwÇK»}Éßu?Å&öY£ìDMLÒÐúpÃGF%D³é¹µã\çgày)ôA¿ÿBró²sçÝ ¹ëÅÈ\½`	382	`tv.tv_sec = ts.tv_sec;`
383	i8uªoj×äÚ5ñ`¨âj/Â)rùzUÒãa#RÍÞÏ\^?r$ÞX¿7ÝÇÌ£,$;#yqÄr»ò"XtQcTMy³ÚfÛúÈ PMàÛ»GRflBË[á+1Jn+ ×gYÎ¡£y¶"Æå58.³ñ{¬2{ííßÙ@kûÉ³÷A=óáoXL`o86RçPÎôô×{L69Ì4[³ÁJD®¢E²ðÞóïÈòqFÝ4àÆHß8S~4-(¼H·wÃW6ô^0®¾NØE§»@`Rk>q+ÆCúºxæÃ{Ég.UO(ëêèÜªhêLçìY®C$øÏGvYëk9×#QpCZeÆU·½çZPR>¼SöÑ\kû`GÆÉÞmæÇóÊ*ëÁO$Õ+Èn»}MÇ·ÐWnÑõOd;hã(b'ÑÃT;0ÌëÀEÊ_¢^¹Oãß!j^ã¯¯ç2²Mfñ=	383	`tv.tv_usec = (suseconds_t) ts.tv_nsec / 1000;`
384	2¸íµdFD)wÉe!#IÁG#rf^«f¢ñ®Ø¶ºý%Zàèx2FU¢5B,B®1r½À³ÙÃ\ZpAn6îéùÄ·kD æ®+áB>>¹¼:>½ßÄHbHçeÓ¡cú6òtgÊ»Hä`¥s7Í*°¹`×_¢æ#TDb3à	384
385	fù4 Ï£ÀÍØÉY r÷øO¹í»þ¸L£A9êpA`VÅ ´ðOÖëb]ª×Ñ* GN?sf[ØEó.ò-ÛÑÎ£÷4Â°ÅÿÝáÕnÅkmbÓù·þ¬æed2ìw4^Kòí¹/9úÂÛc$Zé®B¬ÔGw~88ô'å£5{WÀg¥»;ØVT	385	`return tv;`
386		386	`}`
387	`lÀíiV¼[I[^"ÕÖ×Fû£Õhw)ù2¨72Ûîºãaï¾%èÖw«»Q_àbq!ý ÙCp-ô½!¬ss^y»%OÄDú7%R6%$ð=@K(/ùÛW9'Ã®µkÒsMü9J»Dªåy³NÜMYÈÝsP¯ÐwVÉZyk>ßØ ø=Z?RF±÷÷ÊÇ/¤ÀYC`	387	`# define ns_to_timeval portable_ns_to_timeval`
388	oVesb_¼PÝGÎVÜb\|ß8aAÎ¦ðî#öÃ· htîc6,ø²a#Ú~æ W1ùô`¸RY×Üµb<¸¦¤{Ái¼þÁ¬ï<.-'g¶òÒ9uÈÔ:lùåË·ç¾¯?ÓD`¬û4o¨QÄqc`9$Á;ï½@ÑLðØ~ö·ót<OnÙòÍÈÿd+Zéß#xØÄ¦ækíÙ	388	`# endif`
389	G'9¿ª¨:v9_ÆÇ Ç»ãð½d(`-WßÅÎä]ô~vÀ~h ëîAÒÄwtp©.Ý®±xý6JaR±ü&ØóJnaÂj@"RíÔ¨¯Ë!>Xòé5¿±ÂÁ6´pà_IYPBâ×xÏsM2kPiSÞàtHHnJCú?IÅ¢ïsÆFÃMs@ytu^AâàM<ÌíEý tøU%8¹</{%¼XâT41Ñù ú\ÌÆéS'îíÎ:KÅ"ð"lú¬1Òt!+uÚðµ4 ÖÀÃ°ìa,\îhÒQªr¾¤ ÕLÞ¢§gµ0³»ô,WÞjoé¸?"bðª8®Ë%» ;nrR¯;§zÛv®®9ÄAe½p,Z«P}z6öo`½e¼S\|M~!¥¿líµ.bj0'G® ô!oOs5}Â¾æÍNå+Ìl¿;¨¢¨ðn£ÄE ¦ÑpXX¬?µaÝS»®WrAEÝwhR eÂXp«¯æcç7æc6áÜqAü¡¯U6#DÃ(ÛJ±³mÙ@Ù8ÓÂÁbôÚRìm%úÆ¿Gi4~S:¼µßiÍjüNsØ.G9=¹B>°'ýIw¬í÷Gð'ÏÓ=äáùÊK§c6u{,(fÑÒªk´F°{&½°;âv±,Xb1§ÿ3³çe'Çw4¾ßÈ}kö_z° bM ´²"ôA}õôþKZÃèlÝ¥ ?£>ï?eÉ]ÍônÔöÑ¹Í&(i GÉ/½[æP>x7-©ãQ´n ;9Xqdì}Uq¹æ éÔJî#öB{ãÄ;ë#§F!fÏV¾Ê¹Ãïq £U["Ç!/bFÌ¡Ûh«4»y×A!!¦¹È}8cx?\#uë<	389
390	c¬ª5¬ æSZ$¦½Ì?å<üfÖjDç gKÅ@ScÑàõù1K¢5ÍÀßZkâÞìÞ×ñ¤ÌaÅÍ¨¢f-5ê¤µu×öD\|öWÇZ=M#¼ÿpÄp;VÒ8§Í3ZÊßõfMê÷.,Ç;ò({oþ4a¥mUEoÕ/äÈw³h2g×6e¾Ï®hjÌáMãMª&¶mK=ÖÜfðZ FGÚ1oàæÍU©A àklTxÚÖ¶LØ²99«d¹5Â.¹X ëFÇWtê"ðHø%Àjq>ÎÂ]í ðb6ÄÕZ{¶{)N-I'$ã¢ë^Z$ÙDËí=Âú<Kw Î¿;vw(îñÍX.mók£¹ªi]ùÔòzã$(ëúÆA6äíhì QãJQÈöÙZªã. Ï¢ªâÜP¼0LZÅÝKê¨ÅÂUÿXôeñ4¹ó:_ÑgAÌÍ0¤P,Äp3©pb>Ïø%Òº¥éj=êçYÞ® ÍÅh{M:³þ£ú·¯:ÍµÁxr7¯ð»´ö´ûÏÊOxKïNÏÿãÃc2¨s²Rs}÷ËÚ©y»ÂÜu Òxv[k-ÐýÇ]JïYª©Ö4ÝØùð!7ý!Kô4´/ú·aßfÖO YÇL¿ëNÖÔ¯#"þ'¼ÌkÍS:1÷¦í0ÖLª$j@H³6WÄ'¾\| êÏJÔ £&Emù£kwÍÄQ\Ä¡KyÚÝZsõ`ûb¯%Y !QQ8^ÜÝF><ÎënëI$-øJ(3¹BÔ^3kÖµøMW=W(FàÓ¨$3ÓàÎ£G~EÅO®ôÙ2Í´ÖÊGF@F:{/®º«îçs)6j;P@Xf1NÍùx	390	`static inline s64 portable_ktime_to_ms(const ktime_t kt)`
391	NoRN5Ãh®GßyÕ=}wrÅ&ùeKë°6SöÜY{Î`Ë¢½CbafNG&`'-J-Óu/I8èMãmÕ0âÞ_gÏ]Û{gÝ,B$àèp6z¯µÖoª5ï¶Ù·Wk³ÊÝde¶ëêªßZ²¤íúäX0åµ[³\| $¨\|ª¦q`% ÎÅ?ü£Ø1l_¥¡Ø=\|çq¸n×ìºÆ¨Fòæ¢ LN;Gsg!Èö¹+ M[\|Ó÷þMJ´ùKÔe9{!ò{	391	`{`
392	`;zQI}.Öt/~%\|ÅY"¾{òÝÛCÒkÔ!hB]Ü&Oçª×>×B$È+.æEôÿìÜ]GdôÞ&wåç5p{U L\x7É}du;uWí¹ ©bbx+?;TL³Zuamj³\owu³+ëåâJ÷h¬__ã+æ\K·Â¦b ¢>é=¹¤þÉ 7ý³$Ùçß%bÒËò}?Bv~IÒz¢µt¾ü,{ñ7tÿ¤ÿò}üÃõê{k1JÄºlÜlÏ®Î§¼ÖRÈ1?µfSÈ_òÕGSãú[çE>EÙPÆ\AÙd²ù?þüùóçÏ?þüùóçÏ?þüùóçÏ?þüùóçÏ?þõóÿ@*ºx`	392	`struct timeval tv = ktime_to_timeval(kt);`
393		393	`return (s64) tv.tv_sec * MSEC_PER_SEC + tv.tv_usec / USEC_PER_MSEC;`
394	`Generated by GNU Enscript 1.6.6.`	394	`}`
395		395	`# define ktime_to_ms portable_ktime_to_ms`
396		396	`#endif /* before 2.6.35 */`
397		397
-		398	`#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,22)`
-		399	`static inline s64 portable_ktime_to_us(const ktime_t kt)`
-		400	`{`
-		401	`struct timeval tv = ktime_to_timeval(kt);`
-		402	`return (s64) tv.tv_sec * USEC_PER_SEC + tv.tv_usec;`
-		403	`}`
-		404	`#define ktime_to_us portable_ktime_to_us`
-		405	`#endif`
-		406
-		407	`#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,26)`
-		408	`static inline void put_unaligned_be16(u16 val, void *p)`
-		409	`{`
-		410	`put_unaligned(cpu_to_be16(val), (__be16 *)p);`
-		411	`}`
-		412	`static inline void put_unaligned_be32(u32 val, void *p)`
-		413	`{`
-		414	`put_unaligned(cpu_to_be32(val), (__be32 *)p);`
-		415	`}`
-		416	`static inline void put_unaligned_be64(u64 val, void *p)`
-		417	`{`
-		418	`put_unaligned(cpu_to_be64(val), (__be64 *)p);`
-		419	`}`
-		420	`#endif`
-		421
-		422	`#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,24) && !defined(RHEL_MAJOR)`
-		423	`static void __seq_open_private(struct file f, struct seq_operations *ops,`
-		424	`int psize)`
-		425	`{`
-		426	`int rc;`
-		427	`void *private;`
-		428	`struct seq_file *seq;`
-		429
-		430	`private = kzalloc(psize, GFP_KERNEL);`
-		431	`if (private == NULL)`
-		432	`goto out;`
-		433
-		434	`rc = seq_open(f, ops);`
-		435	`if (rc < 0)`
-		436	`goto out_free;`
-		437
-		438	`seq = f->private_data;`
-		439	`seq->private = private;`
-		440	`return private;`
-		441
-		442	`out_free:`
-		443	`kfree(private);`
-		444	`out:`
-		445	`return NULL;`
-		446	`}`
-		447	`#endif`
-		448
-		449	`/* disappeared in v3.19 */`
-		450	`#ifndef __get_cpu_var`
-		451	`#define __get_cpu_var(var) (*this_cpu_ptr(&(var)))`
-		452	`#endif`
-		453
-		454	`#ifndef MPLS_HLEN`
-		455	`#define MPLS_HLEN 4`
-		456	`static inline int eth_p_mpls(__be16 eth_type)`
-		457	`{`
-		458	`return eth_type == htons(ETH_P_MPLS_UC) \|\|`
-		459	`eth_type == htons(ETH_P_MPLS_MC);`
-		460	`}`
-		461	`#endif`
-		462	`#ifndef MPLS_LS_S_MASK`
-		463	`struct mpls_label {`
-		464	`__be32 entry;`
-		465	`};`
-		466	`#define MPLS_LS_S_MASK 0x00000100`
-		467
-		468	`#endif`
-		469
-		470	`/* sockaddr comparison functions is from fs/nfs/client.c */`
-		471	`static int sockaddr_match_ipaddr6(const struct sockaddr sa1, const struct sockaddr sa2)`
-		472	`{`
-		473	`const struct sockaddr_in6 sin1 = (const struct sockaddr_in6 )sa1;`
-		474	`const struct sockaddr_in6 sin2 = (const struct sockaddr_in6 )sa2;`
-		475
-		476	`if (!ipv6_addr_equal(&sin1->sin6_addr, &sin2->sin6_addr))`
-		477	`return 0;`
-		478	`#if 0`
-		479	`else if (ipv6_addr_type(&sin1->sin6_addr) & IPV6_ADDR_LINKLOCAL)`
-		480	`return sin1->sin6_scope_id == sin2->sin6_scope_id;`
-		481	`#endif`
-		482	`return 1;`
-		483	`}`
-		484
-		485	`static int sockaddr_match_ipaddr4(const struct sockaddr sa1, const struct sockaddr sa2)`
-		486	`{`
-		487	`const struct sockaddr_in sin1 = (const struct sockaddr_in )sa1;`
-		488	`const struct sockaddr_in sin2 = (const struct sockaddr_in )sa2;`
-		489
-		490	`return sin1->sin_addr.s_addr == sin2->sin_addr.s_addr;`
-		491	`}`
-		492
-		493	`static int sockaddr_cmp_ip6(const struct sockaddr sa1, const struct sockaddr sa2)`
-		494	`{`
-		495	`const struct sockaddr_in6 sin1 = (const struct sockaddr_in6 )sa1;`
-		496	`const struct sockaddr_in6 sin2 = (const struct sockaddr_in6 )sa2;`
-		497
-		498	`return sockaddr_match_ipaddr6(sa1, sa2) &&`
-		499	`(sin1->sin6_port == sin2->sin6_port);`
-		500	`}`

Subversion Repositories ALCASAR

(root)/rpms/ipt-netflow-2.2.tgz @ 2483 – Rev 2057 → 2483

Rev 2057		Rev 2483
1	`nËÉVì=ù{ÚÆ¶ùýâW/Á[ã<Ú'¼ÚkpÜ$µ4=jñÒ4ÿû=giXÄâyß_?GËÌ³ÍÙfFµ¡îÒ°çx7z)_*¼xß&üöövØ¿ðÿ]K»»¥ííÝE¸Ú\|Av^<Ã/`	1	`ipt-netflow-2.2/0000755000000000000000000000000013213006644012322 5ustar rootrootipt-netflow-2.2/Makefile.in0000644000000000000000000000671013213006644014373 0ustar rootroot# Edit Makefile.in and run ./configure`
2	BÃ'äïyá¬vóÞÿýÙcòo´:z³Þ9<:ùM?näw#ÿÝÝíùooöö¤ü·K[ 'ÅMP²ù]þOþÓu2)rM{FjõÃF³Ñi4Ûd¿LêoMhvÜ:9í´5¿ãÚÙQ]oÔêÍN£ó!GNþ§^íèzT½È ©¿»cßÑ%ÝåH^R/E¼¤x1ôíZæðôä´ÇëÞ>n°þöÛÓ³VN]=9n5Íj}´Sõ¤yÈzZÝmÑò]µyv¬wª¬Y§þ¾sV9Â~¿"1'Í©ÙÁÐ1îÚ¡o»pk´âZ{@GÇêTßhLª&SÈ»1Æ°!*í~ÖªU:õÉ6Û¯%ÿÎrOßVWptTùc@©SÂÍÃ-DaßóWBíì£k#$!uè7Èû¦eÕ $×ÔlÏ%Aßt)ñº¡a»Ô"=ßh~ýBÁ7nòvØºQ@}Ó¹aÞôÀQ°sÍÈjÛZ½]=·@ ÛéÓq]#í	2
3	`®q ¨xÝÿ¥fBïy>¡ÎEcrE}:dàYCsä¦o}b¤o_öµÌúÐç¹Fë°ñ}HEhG¶Ýæ!UoxçC·¬ëyOþ{q?aË#Û¤n@÷ÉÛÖ é´þk£ ôd¤ÐÐzI¶áÚ¡m8Ä§×6r>/ àôù¢j8ÙÚÛÞÛ%¯)Âä«¦Á´ìxCrD¯h]W4ês(ÃgáZuØ¨`	3	`KVERSION = @KVERSION@`
4	`À£ºÀ'íÐí ´ÍE»FºW=WryÁþ[4R· E@©óÉu¨»À`	4	`KDIR = @KDIR@`
5	J©Ë^.´$Ð=æø íª4&Ëöï3#ÆÃÊ{½RÖÛíO K÷\ç÷èT:gíù>¨ÀYÂ9Ap¸\|VQq^q=³úk{½ðÆðilI¼ aJó)9WÆØÀ7]=°]Ã¿»¶LkÏ`æ=WÅ<S1,H,«ö<áo#>ín`ìY ½(MºwÄ>úÒ =Û1¯N#\|NÊnlf=ÓsR ivêoaÖ~Ñ2bï¬í¬çâ»×k¯ñÎöìÛµâæ:ëûu*Õ7¾ÒÅÔ½%±	5	`KINSTDIR = $(shell dirname @KDIR@)`
6	´¶#¯s`¡ËÌ³¬§,d³³oýÀþ.&¢3°Úl72¯hdJÀ;FøÏp øÄ4Ì>=¯ãwX{ÖãÁ¸·YÇØatú¶¸F§Å\|zÍk£A¸AÕ4¼æÌÂ¥(@üÔi«0ykÃæÈMy°i? Äò40C¸V7ê-7'îï¶Çfêµ³C6+f£»èZ=ÛÃù%°¬ß=?$ê°CÃpÆÙèî1 ¿¼ôéåó¡[QÆñf#ú#Sc0tÀ<m1Và>aãl è~\|gc`ª×2¿£¢Ý¥ËÚA?ûÃTbtøkyA[?ê×H5Hbz7ðv ù¶Ö6Ñ¿QßÉÁ5cLÖõ£uï9 *d+_ÿØù·Ôxô óê^Ô¹uu¢ày4³yÜÒm×¢·$U	6	`KOPTS = @KOPTS@`
7	`>sÐåAµi¸:hãý¢À%Z2÷KÎ\|éÐñBÃY$#U ¹3<°ÃSPãâ I+úÄ®7!Ù®ÖXãni3ïÎ.FtTá!X >°n8ÎIXË@W56QF¤gÈú?)Ib¨qªg#Â&¢©åC(ñºXz$×:Sk4édl©Â¹7!qI @Ê$O^&0rQPï ÊËTòDyÁÖ}©=i0hùN3í[jÕìëâæ&³$U]>f£Ý:ª\|Ðß"YK/e°$Ë ¡áB7¦=ÁUæWNP`	7	`IPTABLES_CFLAGS = @IPTABLES_CFLAGS@`
8	`SpæLÎ*H?`	8	`IPTABLES_MODULES = @IPTABLES_MODULES@`
9	©D>KþÔ)Üöãô0O Ðq7Q Ö2FÉIèb~K®ÐÈõ\]6¼±ëÈXuîÑõ®äbº`veV\|Lw?ÛööÎ»!Èìc1¤P6L1»w¬f¤°²=IÙ\|JØ#Z8xÂñi`[<¼#@ü	9	`DEPMOD = /sbin/depmod -a`
10	b !c}GÃtB.bçù§Ç!Vb´õ¦;Â×Â áØâñôõ@ÁÇ Gïè¾=&é»`&2GÀß3i0Ãüó@»~[®,va£S^"q÷2O	10	`CARGS = @CARGS@`
11	+âÀpèBß-AØ·&Æf!c}Þ`¦ç[³d´-HùöfVLTBðØ¢Nàä*ÔéÍ nGÑÀogzÅq»]»\|á'øÆ4(1L hÉkß .Æ!¶h?8ñÑ2Ä(Fo+{êûR:«Õò\|?&uNdA,Ü¹fß÷\/B¼Y3»pµCÏÐ8îA×Õ¼Ý¼ýæ³§tæ'mÊÎU!,¶3Ëü(iÿÆýÑ£ÎB)©Ð=Q§z¸A@2Qù	11	`SNMPTGSO = /usr/lib/snmp/dlmod/snmp_NETFLOW.so`
12	ÍõßpÕQ¹ØL,ZÔ¸Z§Þ[Çë¢Ö·ö ©6BÌsk´qs?¬eþ(´s¨{ögÐ+·´ÀcW[g`;ã¢ÛhÙ®::,H©<¶ëÿ:«7«urrHj¯ºúwãåH°B:9Ð5`.Xð¥¾>bZI2¡W¢&ÐI-> â5±ëÉpq&<jd® ¨Ñ¬Õßg¾s5XøëT:c0!Nâ8R6_4¡mpFësê¤)#¯EÈíðéöÙÃ©ïÞÅõRQÔ¼e*ÿ§¾Mò#×Ì$G^úÆeÚ»ãx©Å¢yfÔ8bÙÍ«ÔµÍ\|~{óõîúwìðáØÆpù0~ÊôÕ£ã9·þH,2sÎËcZhfÞgQ¢J1Q³¢ºÌÇ;s7Ãâðaeá¹c¾5&åpO Å^-ñGÖKUGÀvLÀ¬Àg:ú3üG{ÖïÌßÍ+ÛfÒ+¶Kïü[ V» »ÚÜ	12	`SNMPCONF = /etc/snmp/snmpd.conf`
13	Ï³(ÐbÇ2Tí)TýZ>{¹ËX¥ÒÍ¡â¡»ø²lCÍû¥<Áúu5zÈ§FÇP÷¡XóB§â¼ïq¸X]0¾Ì/ròyøüçlÊ{jäð\|/^â,ÐfZsÉ()©E[$+iÙ¾¿GzÝ3¿ª%RÑ#Fi~ñ¨ØÏO2beHó¬4#ÍXhÄ°'2 \|SK6½n³Qñ ÓºÃü¨z®KÍp2<ï#ÇI}YÅb@êÛÜ÷<ýmåÜãÉQòæÐQSßb]a$ÆC,û§÷ÑúXÍØ3½DÞEsí1vK.n¦tM.xWÝ:)³NÍ\:J±Kwþ6Bä\¾«q7s[ÛâVºÐÑe)Ú%ã©}G2X0¤!ßæÉ;û²/*VQ'Ä`Ðpµ+h»4¼ñü+\Çªtê 1HxØ¹Ëðùüü¶ÀãÔÒ2]	13	`SNMPLINE = dlmod netflow $(SNMPTGSO)`
14	`±UûFÃ7v´%HËpaÒ°ê6®{'áìK XsÙ¹°mÉSóRøÉ%ª2X`	14	`CC = gcc`
15	@ÎFêá<V¡ç` æ¶£j	15
16	`ZÂ§¦¢¬6 §;7 R¨KÈöçBUeòû´{7V8gµ£bèÚ6H£zÜl æògWáóOÎ9?l3ô¸ OaÎ<Ì÷$æí[ï§t%_£rw)X4 @"±1D¸Ü5©öNË¬ÅuüuÜ#ÛëA2Þü /²G G7üÜÄW¨ hµÙÒq²e,p±Y÷Ìó}Xa¼>§eØR¯ù>»s"Âå/Çy&Ë×£ì±ñdìxA²çÛ&îñÀáQöLaÊY3Ú;¦e(²} 8B<Éõ6 òcá³}¸£ÚÆãËsãM(g\I_2³2¶öáál´È¾eæèÜ·àË_Âqr^YUJÝÊ8 TV9Ò/$Þ¬U:'§øû6>ãçü59õ9ß>ù/6M>\q`	16	`# https://www.kernel.org/doc/Documentation/kbuild/modules.txt`
17	`{ªÄSü"¶POÃmä³Êw5xâÆÇýà*9¯`	17	`# https://www.kernel.org/doc/Documentation/kbuild/makefiles.txt`
18	7ò8h]»T·WT'NQB®ãX+µ<bxÉÜ.åJ¸=/u' ³¢eÈ»&G{°?Cç.åÉ>º`@äÁ ¼§àÒi\| !>Êá¬ùQï<Íäa\|q'Yú`·¥ñ¶cvÍJ9Î~^o°Æ#nd_e»¤¸ýÝwâN¾Q6xñ; ,ÙU´	18	`obj-m = ipt_NETFLOW.o`
19	qe¸äb\|,utKHI©s½³µzkb¹u¾8äêBN\$YÈ}ßJBG÷ü¾6ÂlµÌoe-6¾Ãúc\|Ã*ñ¬Ã-ÁºÉõÙ¼Û¬#ÍgÞXãOx6+nD0y©ò£ÿä»â¶-MÅ¨·y°¤J-Sf¬a©J½YÓ^\|ÿ=î÷¬«Atª÷ÈßÿJÿþÓææviüûOÛÅííïßz_«Rý¥ò¶~Þ¬×Ë2hÃ(è[äÂ²}öåJûÝyûäì´Z¿Ðd¯_ë§ø1òE¾ B¥\|Ð¿ÐÞÐÒÎGsB2ð7?Oúh`â÷G'Uö©#lSà(Ð[ßµv>v=í¸òWTý<PþÊËjÓú9Z+góTaûSu¿o¤£bëø´¼Âá^äô(Ìj³ÎI£ êè¨\|Gíÿíü·]ÃØ²\|ïÿíJÛãßÛ×ßçÿ3ü^½,tm·ÐPI{Å÷¦ocÅÖ¡ËèB)ââ«z¤öËqlJóÎ»ò	19	`ccflags-y = @KOPTS@`
20	þÝGhû(ð]ñ=®~:ìÂùH²+Å,)ÃDÅó\|¤Ïo°ºé5ûÉÉ7XêÇùÌÆÏç!L Î(4@Làâ½µCRÔz6Ãê¥øÄÎòSÁ¢×k°¥~(~I>x±<w5$}ãrÖ$/¬¨ÁÎ± ft0NIìv'Ð=6oÊJ¸òi#eãá yµ¶afW¾üs¿ô5û$ÙÊ¸ûù3ùáÐ0ò]²-\úFÞW &«Ü+\)îRâ@(!Ìã8vrTk¶ËÙøÕðreõ»JåµÆr£üE ß3u±®ñ®FVÓØ·âòÿüÌ±6üY^[±qæº¼òåÏÅÏ_ÅõõåË}¼d",@×YVÐD pý¼FÀ[¤_qåË+Ödù¤ò_4ÎI¾2,Ý%\|ÉsLñZÊ,«Õ¦ :fåûVbzNWô)×÷)-kn¤O ø E¶ñþÈwu k!UÃe2=Ûµ¸Z/fªhã¡Ú¾®dèDÈ µ}K`Ï92T!oD¡e;sê¨\:ôÝ Ù/$t²Ó±=ÌeG ý(È¡0£ÇvFøø_S<yMn<ß·ÅÂ³'n49òIöÂ_×³èQæ¼fsBÿ´tþ\$æêB!:î¨ëq[)4Ñ)bÛUfòll6W$A!Q? ÕuÀY:MËteçÑó(40¬»? ºßKKpN(K2;/Ã±Ù9Ð&ó3`§jFfæÄ4ì3{ò)SOjo ¨ä( 3HÔtÉ¸ölÙxÇ6Ã«u\{û÷cañçJóvtyI\ïÂÃµDWÙ¸¬ol@Åæ3ðçdØ\"h'ÝÜl'7ÕÆßjÌïLð4© eH"¶-VEôJÑ¯IW¢´ò3ÃIVB¸éX0!s6Ú6¸BS§ç54Øh#ÿÑì&ÇõlÓz¥¶ÁcØþð6èÃ=ÌWÐä$Å/¼¼cÃøüé<ÀÐÃ3ós&fXÓâ¹äø÷¢ÎßÿÅå³}ÿ}»¸WÏÿ¶K;¥ïùß3æý= clg+>ã ¾ê4ånL±ñ_×vVÂÇßË7òÂêkø	20
21	?gâ¦üÔúW}ØV/´=? ælmeYYF²ÁHÄAØ~"]'8ªîâÀ¿W+§oÛàg>å7>>ÃÕ¸ûèß÷FÜñ;âå"{È(BÞ¼Ñh`ì£çc&>¸ú:>Ý'+\%+ãU}Ü?ù<QèÍ>Ö yQ«Ó>þ,M:9À=[íSóå² ì`%°¤++Ñ1ÓÃ0HV&ÝÈv¬xÏöµ.«ü´Ð+Gõöù§õO?cþì®þ\@~ò1.â :ä{åz7®tÈÙ"$`½Ê7ìz2Ä6dÍ»Zz³þüÛægü}Wl°á 0×Ï>®Ë?"¼&Æ\%ðçÝÅò¡9ÆRÐmH§òçðä¼Ö8%Y®nY¡oØá"¡ZÒc#,\|¡ÒÃ569ô×Ex,rtêÇ¤ ÝÎ>=ÇíÉ `4qú ÈCüüËåòPt9_Å.¶ïºÒB-Æp¶·By¹aRxß¹\|þôOëù/«n¾gô¨Ón7Øâé8à¼Y[±]±]Sp¶ 9åaÿc\ÜLqE®Y:±ø+²ÿO©i÷lj+9Äì¿¼¼_½DØÓ`¯.uwÂkH+8¢È¬Y´g@b6:õãá ´gG^ê Iù4ìé¥LÿÓ<ïR¹-òÂ¡öÇy=¡cú0×°åPb=_ÇcàÇØ®'D±ndyØ8÷³jAp®·K÷=	21	`all: ipt_NETFLOW.ko libipt_NETFLOW.so libip6t_NETFLOW.so @SNMPTARGET@`
22	ì»¬®áÌî*Ú¼&p1¥p¦RÊÜ<ÀßØa«Ì7r6 ¸b@sÅ'ÄEb¬{SD~èE®5éÊ È±®¢/_)ÎµKéømì®Ê+ÌüF_'J#þÍ!ÉîÉañbaÊ9hÚ9×´Ñ Ôó·ÊiS¸(k±¼èhj>µPþöµ¹ãÈÏÀ¯A,°II¤¡&!EDdeK`I"ÂË»HÆñSÊ©+_ì$uu_î'Ü¸O×ÝóØÙHÉ>¤D«`¦»çÝÓÝÓÓáæqàFÞ5¥çÒPh O8êT>.Y}ÍRg%¿Å9À©ñÍI2<k9à0Õ¹õ9Ï¡k¢nRû^-Ù7 è$©	22
23	±J`ÌãÞL<#wÚUÉWxÏØ,DòæhZ8ÃÉÑÅh{ÈÑ ÆiSÀqJyMîîZO,ÖÐ0ÑeÛ¨ìç¤ªpbOÎ¤¾LÅ0v«.K¸T£}§7MAG6M»¸ÄÄ#==¨í¶Õ¯Ãön¢Ò?®8ñÆ+O\×½I ÒUÅBÛ»ÕÌP¡8ÀábÁ"2<+F&&ùÄ±¸iÃNßåï±n·þ9¾HUßéîÕk; t»é»Ràùt%÷8Ã÷q{}Þë1§'~³Ãæ3i\|ó§S]ù:£ ãö%è	23	`ipt_NETFLOW.ko: version.h ipt_NETFLOW.c ipt_NETFLOW.h compat.h Makefile`
24	`Ôn+¦\|4'[s&¤IÄ\¶!] .1§8lIá¿íRê¿\|o\5ë4LwQ®-RëÊQåõh BU"$ûßÅÆFÎÒ{]uÈjÍ¼ÄüUùQ'§8±æeå]à`	24	`@echo Compiling for kernel $(KVERSION)`
25	`P1"¦eªà ªô°uý¶ËWØ#@")@Ò~À7^0@êÕøÊ-~ÿjhË&»÷Ué[¹§®Ä£¹Adôo\|#º!?öB6ªe±ßeMÿÒóH¸âw¾à4¤Ãàwö5~8ùL\OÓòÞ$ðZÖGüê 7Í O D`	25	`make -C $(KDIR) M=$(CURDIR) modules CONFIG_DEBUG_INFO=y`
26	`¡6ª Ô.¡åcf®ÜÓ·9³C½d§q,ëÅejú¯ðOö3ÿ¡Ê&ìLà¦N¥`	26	`@touch $@`
27	`ÝùA§*~'b¤$©.\|Ì¯áàÀbuFª#1çZl\|Ðìª8tÈ`	27	`sparse: \| version.h ipt_NETFLOW.c ipt_NETFLOW.h compat.h Makefile`
28	þ¬Sètà¥à¸Øï°õûÙû{PY8MÑ·eÎïÛlÚÀòÀËzÓ-X!+Ö80µñúQËÀïÃ¬q[Ô×ÒzU÷dN´3:I¬ü¶?MÂ[Wþz>J¬¸?\ÁâÚXaLX)ùª¾°½¡¶xS\|Zÿz¦°!fT$0¤Ú/üiXõ7 ®¹Ä¸#5¨ÛÂWD--ÌM:ÆoûØR"«£ÐÙä\|Uº[X±º hÜ¡ÚÂ3Õ¥Ë` ¸Ûé{ËËìâYøÔèµé9×5u\ÿÌ±TÄî Ö(DÃG×âEf¨w5ßYÄy'Bb]³bSùýf-C5IËäé1cÒ*U-)¡¶Ëî?ê:`¦%/mSÍèi²=Þ1}eý+wÜ5·¼GEÊD°P¼ÇÕ©ÂJØSH)ZâáMþnï{NO8Î¢¡ED«0~dýÒ«pþßÆJù/ªÜK4b ,R¯eÃx±Îìâ²»áVN8ëg<s¼á¬´nÓ:HfuE£ÔÂá-þæ½DtÌG1J çS-qµj4\íàé²Heäõ¼~?ÀàKÃÚ6É$«?âÏ¨&x3«þ$çµ&kôoÏû«©ããIôÌÉnVY}èc äÎ;uÀûA¬-^tZW¥ÈZ	28	`@rm -f ipt_NETFLOW.ko ipt_NETFLOW.o`
29	`ÌYhúãZº¸Çå3IfU§ú£EøÂ+²¨R¨ººï÷¼i8"Ï=l´)« ³Dµ)H8I¥<5k²¡w`	29	`@echo Compiling for kernel $(KVERSION)`
30	`[2¢³Jò¼^\(ùXm©\ZÔåÊÀäÀRéXJ ï×³;P<Åg¾wþ¸C±jüå0ÊIÆ$ÿÕ}ÜÄR#ÁvèÏüáõbÊ·ö-Nçxy ·)&Co&roÎ«'òZõz]¾9¤ÉáJ£«TqÕÈUs«ÚÎÕ!º¦;]ÏùCÍù·¢óèË\OÕñÉ4x"?¾^V´ÚqþªÈd$íhàpübî;P/CöÍá¸ÕnnNè$A¾äØ¾Ô)ÇG8î¶ÐXTrÄÍ xÿ ô ÚZ½T·YëÄqÿ.ÃFÇAKµOÆAÎG".X qõí¹ÒÙÄsÈ!b·kÀ@øuvè[£¹ÛÝ«µ÷ÑºNYë&×vwãQï`	30	`make -C $(KDIR) M=$(CURDIR) modules C=1`
31	°ÖñÑa£ [ªsÅDÐ-&¾vÅâoüìîÔ[è%óNåÛxsi^RqÜ®*ÎY¤xp[{/Û;õçÑÃ.îkÞ=znt¸Éd©KÚûVTï7 &¹..C6(fú FxÁksáw£%Ã;&o1ÎD9\á<ûY(+ç¼ I?Ö<YëßÿèÀ\WÒ¼ÊËª4Æo¼á /zP6»Üj3¢Ü¬v<ÒÆ¦3Õçj2+æäC/å¥¼pìê Òn¨ÍXH:>Øh&9î,ûâí#ÌdVõ-å QZ»êMGkÝáûë9÷H&Ñ¶O\|úþ=ZQGDU 2Ð¥»øEâÙ QPQhyzS[}Ö,ß_2X:ÏÐ°hÐÐ¾"®"&#îï½¨²Ie_¹>ëz´q/Ý»ëæ¸¡ë+`UyóGë$¢yüº%¤;,)2ìUö¯\òqÜð\2sÕ>lüG;UiÊ	31	`@touch ipt_NETFLOW.ko`
32	`Ntó J9V±:4uµl.lPº;5UzZqó¨òö3vL éÀ ^B9s¥mÎÄjÕÃøñOäx #Jzbd¹Ù>²I!:(<cö`	32	`coverity:`
33	y£t³·]D9*ÃÎbP¯^y`yzyjÅq3 ÑÒÛCÜÝl¸1Û$Y_ð¥8i0ÙuÔ^,j=xÀ³ÍÓ¸ÄÉÚÐº2CCDA)	33	`coverity-submit -v`
34	+bê2Èhò&Àr4fÞ4Úù³Qr¾v Íà¾CÞSo<èEÖwiu7¬úÈè!llÂ"âRD¾7<IMSáffSjY^§(dg¼KåèºÝ2ÚðÅ:çÒTò8gÀzÜn0!Ýè°%ðEhlSû2C»ÑþîrWÑZÅ7Þ£UïpÐqÓ1ÛHÏn8÷°¨½¦^à«6F¾ÏÆä2X?î][ò6l[g5ÀËè(ôXvÄ¹Ôz§Ê½ºÄÜa/¼UéY~Ìª¨eX~¨i EiãñøÎKÍìaè5&Ý¡Óç1X¿(NgN "Í§ª¾2ö¦kc×ð\&´Æ_âÁ;¿ä4NG"¢ÚQEºuìÍ·j_0ñ+&v^#P$5Ûª[æ8iläçnµÉæGl D/N!Ä\6iÒÂÝ¿µòp®ûx ±[5Z)ýÝ$È\|µRªf^°òåÄå@ÇuîôBówÌíÃF¬ úxîóæJ' ¥hyk@ÖàÓB9f°VT¢ ¬cîC a(k¹qd/µÈµù_¼åJ03ÂRGa¨W7BV'16s:_ãé¶_¶·;©T*ÃãEÆÇLt¥íîÓ6#S^	34
35	Ú\|ön³^ß©ï²é'ÃÂ·fç¸¶½ßã£ÄíåÖó ¬r£õf#1{iJ'Tf0ÝDh©ðgX%`û..v+YbûtP/ý(¬=£ÒqÆJÙ¼ÐÍ×Å»ãVÉsáÌ÷@JR~ÚI Ïú¸UbøxèÎ^íy½{pÐhwny~on¾{Ü®o?;nt^v÷èÈp<r"¢FhAéÔwëªø%ãÑD"®´´hb®q)È<&±WkÇÝülÑ»í$ó$a¸3VV0½ñDÝf¿¡¾ÜoÌ³[¸T ¦#Øó¾ð¦××b\|äU¬íìT3ýÉ&3$91}Â¢6iNaÊøõ~ÿí&}ëê\uIQQEÇf`SZPs½l. oëGCÝÙIVÉü¸¡SméÈ½_¯â%öÏïR»Þ±Âú!è};Y±ÅZl%Ë^^^ºòDÂÓÐ¨¶C#1.-¬Ö'Ph¿)çqçzöÌÅª¬]â^`¡ª"Ò´2è-Xè«X<v£°î8Ï'S<&:§k¢$NùUGôÌ@¯\Å$½nfíyj\|xºHN,6±AîÖ û£õ#ßs£J2¿7¶i@2Í[0 éÇ²åw$V3KtN~JOm]LúZÐ¬ü¨Ì#»Ð4Ì8,x4M®²Æ¾-hÍ§ç×÷3çÀÞT]µ« v\|&±Ø_ã'¸¬ÂÂfÁåeVoÕÐØrÜ:éqîÓñ\|8 Ù®ßÉpqë¿ÕÉùô¹ÞBÍyý²µ>ïio _î^lGáÁ\ìðFkÅ3å\|¬BðGåîñp<éªÕ6®}º4¬ÍïK¿+nØsBßveöHÄqìÜ-þêG©»ROK£)7yî+-÷Ê!âìÔ¥.K&`qÓ0ve°ömrA±ÛzÌ$¤Î%õétäúY£IíÎ	35	`minstall: \| ipt_NETFLOW.ko`
36	Bf¬tòõÔ]îd°àîEê®°»D2PF¶°¸£,(ñºê.µ3CáÊïC!vU@¿H5¼2c_=¥¼R¬)ÚNÞPÛ®W3¯Òá't`úä?8½³EirD!Y~90R	36	`@echo " *"`
37	`2u/LÂOmýÐrÅÙâÈ×äk¿D¾íõ@¼ì\|îÎ³ùw&ümHvTBßÝÉ(?´¢hïªx2Y2cöXýJóe§».QLKW¢ÆÉPäëNFQpiß@þk.ÅCè"Ð\2LÝççÌ¼_Ü;þËhÀ¿{ñÇYÿ·ô TÅÿ-ÿùAþ`	37	`make -C $(KDIR) M=$(CURDIR) modules_install INSTALL_MOD_PATH=$(DESTDIR)`
38	9vHC¾<;õB¾©]ÌfÓp³óÄ¬óÉäf:HdPnFèòìbµ9daµétè^»,W.4£Ø{Ý®7¼ô®y ñnÞ\|0UÊÝ³a¥E>?R¯ò§@ÂCZMo-ÐÙVö}ú)$Á¦_?fÙJ9°ºEÆJ< ® ÄÀ?Ç%2.¨öU] ÙÒÆþÌUYñêáºÚó6N·JÐ+=¿²¾£ j}¡WÎ®Xh¢(à[îµ-{AÁ ýq,-B5·Ò{%Fë=òËýõÒV L¥ÓëqÜépÒ{8¹7RËb]eb W%¾¦è)t:ÅC=ø¹Uh:£´ØÚà¡I©Ý,¦¨éýû,íÎ³Òú~+oq@wyÌ[g÷¡íþÆúÚÆéÆÀ}Na³Ìú@ks«ªBÐaKÎb}>a^r©lb+¡>Hâò8AiðyvÙÈ.QöC[2r_bÙ<Èµë[5³Ä¾(}=ÅÁoÿ+ð.»Â7Î¢8òøÿÚ ;þ3n ùÿøKÏ¨äúÜ´zÎ}_9Ë×·ããé½xú,ÝdGxépÀ§A2³Û}B/Ä&â9Ryªá±¬@1ÆáaÝ Èú>®P Ó¬~åñÚòöHjîûáÃ!:n¢	38	`$(DEPMOD)`
39	`¥îÇ85Ö:®=Yp9ÜùÀ0vûÈïIO@9Âo7`	39	`mclean:`
40	`°8`	40	`make -C $(KDIR) M=$(CURDIR) clean`