pandorafms/pandora_console/include/functions_netflow.php

<?php

// Pandora FMS - http://pandorafms.com
// ==================================================
// Copyright (c) 2005-2010 Artica Soluciones Tecnologicas
// Please see http://pandorafms.org for full contribution list

// This program is free software; you can redistribute it and/or
// modify it under the terms of the  GNU Lesser General Public License
// as published by the Free Software Foundation; version 2

// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.


include_once($config['homedir'] . "/include/functions_users.php");
include_once($config['homedir'] . "/include/functions_io.php");
include_once ($config['homedir'] . "/include/functions_io.php");
enterprise_include_once ($config['homedir'] . '/enterprise/include/pdf_translator.php');
enterprise_include_once ($config['homedir'] . '/enterprise/include/functions_metaconsole.php');

// Date format for nfdump
global $nfdump_date_format;
$nfdump_date_format = 'Y/m/d.H:i:s';

// Array to hold the hostnames
$hostnames = array();

/**
 * Selects all netflow filters (array (id_name => id_name)) or filters filtered
 *
 * @param mixed Array with filter conditions to retrieve filters or false.  
 *
 * @return array List of all filters
 */
function netflow_get_filters ($filter = false) {
	if ($filter === false) { 
		$filters = db_get_all_rows_in_table ("tnetflow_filter", "id_name");
	}
	else {
		$filters = db_get_all_rows_filter ("tnetflow_filter", $filter);
	}
	
	$return = array ();
	if ($filters === false) {
		return $return;
	}
	foreach ($filters as $filter) {
		$return[$filter["id_name"]] = $filter["id_name"];
	}
	return $return;
}


/**
 * Selects all netflow reports (array (id_name => id_name)) or filters filtered
 *
 * @param mixed Array with filter conditions to retrieve filters or false.  
 *
 * @return array List of all filters
 */
function netflow_get_reports ($filter = false) {
	if ($filter === false) { 
		$filters = db_get_all_rows_in_table ("tnetflow_report", "id_name");
	}
	else {
		$filters = db_get_all_rows_filter ("tnetflow_report", $filter);
	}
	
	$return = array ();
	if ($filters === false) {
		return $return;
	}
	foreach ($filters as $filter) {
		$return[$filter["id_name"]] = $filter["id_name"];
	}
	return $return;
}

//permite validar si un filtro pertenece a un grupo permitido para el usuario

function netflow_check_filter_group ($id_sg) {
	global $config;
	
	$id_group = db_get_value('id_group', 'tnetflow_filter', 'id_sg', $id_sg);	
	$own_info = get_user_info ($config['id_user']);
	// Get group list that user has access
	$groups_user = users_get_groups ($config['id_user'], "IW", $own_info['is_admin'], true);
	$groups_id = array();
	$has_permission = false;
	
	foreach($groups_user as $key => $groups) {
		if ($groups['id_grupo'] == $id_group)
			return true;
	}
	return false;
}

/* Permite validar si un informe pertenece a un grupo permitido para el usuario.
 * Si mode = false entonces es modo godmode y solo puede ver el grupo All el admin
 * Si es modo operation (mode = true) entonces todos pueden ver el grupo All
 */

function netflow_check_report_group ($id_report, $mode=false) {
	global $config;
	
	if (!$mode) {
		$own_info = get_user_info ($config['id_user']);
		$mode = $own_info['is_admin'];
	}
	$id_group = db_get_value('id_group', 'tnetflow_report', 'id_report', $id_report);
	
	// Get group list that user has access
	$groups_user = users_get_groups ($config['id_user'], "IW", $mode, true);
	$groups_id = array();
	$has_permission = false;
	
	foreach ($groups_user as $key => $groups) {
		if ($groups['id_grupo'] == $id_group)
			return true;
	}
	return false;
}


/**
 * Get a filter.
 *
 * @param int filter id to be fetched.
 * @param array Extra filter.
 * @param array Fields to be fetched.
 *
 * @return array A netflow filter matching id and filter.
 */
function netflow_filter_get_filter ($id_sg, $filter = false, $fields = false) {
	if (! is_array ($filter))
		$filter = array ();
	
	$filter['id_sg'] = (int) $id_sg;
	
	return db_get_row_filter ('tnetflow_filter', $filter, $fields);
}

/**
 * Get options.
 *
 * @param int filter id to be fetched.
 * @param array Extra filter.
 * @param array Fields to be fetched.
 *
 * @return array A netflow filter matching id and filter.
 */
function netflow_reports_get_reports ($id_report, $filter = false, $fields = false) {
	if (empty ($id_report))
		return false;
	if (! is_array ($filter))
		$filter = array ();
	$filter['id_report'] = (int) $id_report;
	
	return db_get_row_filter ('tnetflow_report', $filter, $fields);
}

function netflow_reports_get_content ($id_rc, $filter = false, $fields = false) {
	if (empty ($id_rc))
		return false;
	if (! is_array ($filter))
		$filter = array ();
	$filter['id_rc'] = (int) $id_rc;
	
	return db_get_row_filter ('tnetflow_report_content', $filter, $fields);
}

/**
 * Compare two flows according to the 'data' column.
 *
 * @param array a First flow.
 * @param array b Second flow.
 *
 * @return Result of the comparison.
 */
function compare_flows ($a, $b) {
	return $a['data'] < $b['data'];
}

/**
 * Sort netflow data according to the 'data' column.
 *
 * @param array netflow_data Netflow data array.
 *
 */
function sort_netflow_data (&$netflow_data) {
	usort($netflow_data, "compare_flows");
}

/**
 * Show a table with netflow statistics.
 *
 * @param array data Statistic data.
 * @param string start_date Start date.
 * @param string end_date End date.
 * @param string aggregate Aggregate field.
 * @param string unit Unit to show.
 *
 * @return The statistics table.
 */
function netflow_stat_table ($data, $start_date, $end_date, $aggregate, $unit) {
	global $nfdump_date_format;
	
	$start_date = date ($nfdump_date_format, $start_date);
	$end_date = date ($nfdump_date_format, $end_date);
	$values = array();
	$table->width = '50%';
	$table->cellspacing = 0;
	$table->class = 'databox';
	$table->data = array();
	$j = 0;
	$x = 0;
	
	$table->head = array ();
	$table->head[0] = '<b>' . netflow_format_aggregate ($aggregate) . '</b>';
	$table->head[1] = '<b>' . netflow_format_unit ($unit) . '</b>';
	$table->style[0] = 'padding: 6px';
	$table->style[1] = 'padding: 6px';
	
	while (isset ($data[$j])) {
		$agg = $data[$j]['agg'];
		if (!isset($values[$agg])) {
			$values[$agg] = $data[$j]['data'];
			$table->data[$x][0] = $agg;
			$table->data[$x][1] = format_numeric ($data[$j]['data']) . '&nbsp;' . netflow_format_unit ($unit);
		}
		else {
			$values[$agg] += $data[$j]['data'];
			$table->data[$x][0] = $agg;
			$table->data[$x][1] = format_numeric ($data[$j]['data']) . '&nbsp;' . netflow_format_unit ($unit);
		}
		$j++;
		$x++;
	}
	
	return html_print_table ($table, true);
}

/**
 * Show a table with netflow data.
 *
 * @param array data Netflow data.
 * @param string start_date Start date.
 * @param string end_date End date.
 * @param string aggregate Aggregate field.
 *
 * @return The statistics table.
 */
function netflow_data_table ($data, $start_date, $end_date, $aggregate, $unit) {
	global $nfdump_date_format;
	
	$period = $end_date - $start_date;
	$start_date = date ($nfdump_date_format, $start_date);
	$end_date = date ($nfdump_date_format, $end_date);
	
	// Set the format
	if ($period <= SECONDS_6HOURS) {
		$time_format = 'H:i:s';
	}
	elseif ($period < SECONDS_1DAY) {
		$time_format = 'H:i';
	}
	elseif ($period < SECONDS_15DAYS) {
		$time_format = 'M d H:i';
	}
	elseif ($period < SECONDS_1MONTH) {
		$time_format = 'M d H\h';
	}
	else {  
		$time_format = 'M d H\h';
	}
	
	$values = array();
	$table->size = array ('60%');
	$table->class = 'databox';
	$table->cellspacing = 0;
	$table->data = array();
	
	$table->head = array();
	$table->head[0] = '<b>'.__('Timestamp').'</b>';
	$table->style[0] = 'padding: 4px';
	
	$j = 0;
	$source_index = array ();
	$source_count = 0;
	
	if (isset ($data['sources'])) {
		foreach ($data['sources'] as $source => $null) {
			$table->style[$j+1] = 'padding: 4px';
			$table->align[$j+1] = "right";
			$table->head[$j+1] = $source;
			$source_index[$j] = $source;
			$source_count++;
			$j++;
		}
	}
	else {
		$table->style[1] = 'padding: 4px;';
	}
	
	// No aggregates
	if ($source_count == 0) {
		$table->head[1] = __('Data');
		$table->align[1] = "right";
		$i = 0;
		
		
		foreach ($data as $timestamp => $value) {
			$table->data[$i][0] = date ($time_format, $timestamp);
			$table->data[$i][1] = format_numeric ($value['data']) . '&nbsp;' . netflow_format_unit ($unit);
			$i++;
		}
	}
	// Aggregates
	else {
		$i = 0;
		foreach ($data['data'] as $timestamp => $values) {
			$table->data[$i][0] = date ($time_format, $timestamp);
			for ($j = 0; $j < $source_count; $j++) {
				if (isset ($values[$source_index[$j]])) {
					$table->data[$i][$j+1] = format_numeric ($values[$source_index[$j]]) . '&nbsp;' . netflow_format_unit ($unit);
				}
				else {
					$table->data[$i][$j+1] = 0 . '&nbsp;' . netflow_format_unit ($unit);
				}
			}
			$i++;
		}
	}
	
	return html_print_table($table, true);
}

/**
 * Show a table with a traffic summary.
 *
 * @param array data Summary data.
 *
 * @return The statistics table.
 */
function netflow_summary_table ($data) {
	global $nfdump_date_format;
	
	$values = array();
	$table->size = array('50%');
	$table->cellspacing = 0;
	$table->class = 'databox';
	$table->data = array();
	
	$table->style[0] = 'font-weight: bold; padding: 6px';
	$table->style[1] = 'padding: 6px';
	
	$row = array();
	$row[] = __('Total flows');
	$row[] = format_numeric ($data['totalflows']);
	$table->data[] = $row;
	
	$row = array();
	$row[] = __('Total bytes');
	$row[] = format_numeric ($data['totalbytes']);
	$table->data[] = $row;
	
	$row = array();
	$row[] = __('Total packets');
	$row[] = format_numeric ($data['totalpackets']);
	$table->data[] = $row;
	
	$row = array();
	$row[] = __('Average bits per second');
	$row[] = format_numeric ($data['avgbps']);
	$table->data[] = $row;
	
	$row = array();
	$row[] = __('Average packets per second');
	$row[] = format_numeric ($data['avgpps']);
	$table->data[] = $row;
	
	$row = array();
	$row[] = __('Average bytes per packet');
	$row[] = format_numeric ($data['avgbpp']);
	$table->data[] = $row;
	
	$html = html_print_table ($table, true);
	
	return $html;
}

/**
 * Returns 1 if the given address is a network address.
 *
 * @param string address Host or network address.
 *
 * @return 1 if the address is a network address, 0 otherwise.
 *
 */
function netflow_is_net ($address) {
	if (strpos ($address, '/') !== FALSE) {
		return 1;
	}
	
	return 0;
}

/**
 * Returns netflow data for the given period in an array.
 *
 * @param string start_date Period start date.
 * @param string end_date Period end date.
 * @param string filter Netflow filter.
 * @param string aggregate Aggregate field.
 * @param int max Maximum number of aggregates.
 * @param string unit Unit to show.
 *
 * @return An array with netflow stats.
 *
 */
function netflow_get_data ($start_date, $end_date, $interval_length, $filter, $aggregate, $max, $unit, $connection_name = '', $address_resolution = false) {
	global $nfdump_date_format;
	global $config;
	
	// Requesting remote data
	if (defined ('METACONSOLE') && $connection_name != '') {
		$data = metaconsole_call_remote_api ($connection_name, 'netflow_get_data', "$start_date|$end_date|$interval_length|" . base64_encode(json_encode($filter)) . "|$aggregate|$max|$unit" . (int)$address_resolution);
		return json_decode ($data, true);
	}
	
	// Calculate the number of intervals
	if ($interval_length <= 0) {
		$num_intervals = $config['graph_res'] * 50;
		$period = $end_date - $start_date;
		$interval_length = (int) ($period / $num_intervals);
	}
	else {
		$period = $end_date - $start_date;
		$num_intervals = (int) ($period / $interval_length);
	}
	
	// Set a max number of intervals
	if ($num_intervals > $config['netflow_max_resolution']) {
		$num_intervals = $config['netflow_max_resolution'];
		$interval_length = (int) ($period / $num_intervals);
	}
	
	// If there is aggregation calculate the top n
	if ($aggregate != 'none') {
		$values['data'] = array ();
		$values['sources'] = array ();
		
		// Get the command to call nfdump
		$command = netflow_get_command ($filter);
		
		// Suppress the header line and the statistics at the bottom and configure piped output
		$command .= ' -q -o csv';
		
		// Call nfdump
		$agg_command = $command . " -n $max -s $aggregate/bytes -t ".date($nfdump_date_format, $start_date).'-'.date($nfdump_date_format, $end_date);
		exec($agg_command, $string);
		
		// Remove the first line
		$string[0] = '';
		
		// Parse aggregates
		foreach ($string as $line) {
			if ($line=='') {
				continue;
			}
			$val = explode(',',$line);
			if ($aggregate == 'proto') {
				$values['sources'][$val[3]] = 1;
			}
			else {
				$values['sources'][$val[4]] = 1;
			}
		}
		
		// Update the filter
		switch ($aggregate) {
			case "proto":
				$extra_filter = 'proto';
				break;
			default:
			case "srcip":
				$extra_filter = 'ip_src';
				break;
			case "srcport":
				$extra_filter = 'src_port';
				break;
			case "dstip":
				$extra_filter = 'ip_dst';
				break;
			case "dstport":
				$extra_filter = 'dst_port';
				break;
		}
		if (isset ($filter[$extra_filter]) && $filter[$extra_filter] != '') {
			$filter[$extra_filter] .= ',';
		}
		$filter[$extra_filter] = implode (',',
			array_keys($values['sources']));
	}
	else {
		$values = array ();
	}
	
	// Address resolution start
	$get_hostnames = false;
	if ($address_resolution && ($aggregate == "srcip" || $aggregate == "dstip")) {
		$get_hostnames = true;
		global $hostnames;
		
		$sources = array();
		foreach ($values['sources'] as $source => $value) {
			if (!isset($hostnames[$source])) {
				$hostname = gethostbyaddr($source);
				if ($hostname !== false) {
					$hostnames[$source] = $hostname;
					$source = $hostname;
				}
			}
			else {
				$source = $hostnames[$source];
			}
			$sources[$source] = $value;
		}
		$values['sources'] = $sources;
	}
	// Address resolution end
	
	$interval_start = $start_date;
	for ($i = 0; $i < $num_intervals; $i++, $interval_start += $interval_length + 1) {
		$interval_end = $interval_start + $interval_length;
		if ($interval_end > $end_date) {
			$interval_end = $end_date;
		}
		
		if ($aggregate == 'none') {
			$data = netflow_get_summary ($interval_start, $interval_end, $filter, $connection_name);
			if (! isset ($data['totalbytes'])) {
				$values[$interval_start]['data'] = 0;
				continue;
			}
			
			switch ($unit) {
				case 'megabytes': 
					$values[$interval_start]['data'] = $data['totalbytes'] / 1048576;
					break;
				case 'megabytespersecond': 
					$values[$interval_start]['data'] = $data['avgbps'] / 1048576 / 8;
					break;
				case 'kilobytes': 
					$values[$interval_start]['data'] = $data['totalbytes'] / 1024;				
					break;
				case 'kilobytespersecond': 
					$values[$interval_start]['data'] = $data['avgbps'] / 1024 / 8;
					break;
				default:
					$values[$interval_start]['data'] = $data['totalbytes'];
					break;
			}
		}
		else {
			
			// Set default values
			foreach ($values['sources'] as $source => $discard) {
				$values['data'][$interval_start][$source] = 0;
			}
			
			
			$data = netflow_get_stats($interval_start,
				$interval_end, $filter, $aggregate, $max, $unit,
				$connection_name);
			
			foreach ($data as $line) {
				
				// Address resolution start
				if ($get_hostnames) {
					if (!isset($hostnames[$line['agg']])) {
						$hostname = false;
						// Trying to get something like an IP from the description
						if (preg_match ("/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/", $line['agg'], $matches) ||
							preg_match ("/(((?=(?>.*?(::))(?!.+\3)))\3?|([\dA-F]{1,4}(\3|:?)|\2))(?4){5}((?4){2}|(25[0-5]|
								(2[0-4]|1\d|[1-9])?\d)(\.(?7)){3})/i", $line['agg'], $matches)) {
							if ($matches[0]) {
								$hostname = gethostbyaddr($line['agg']);
							}
						}
						if ($hostname !== false) {
							$hostnames[$line['agg']] = $hostname;
							$line['agg'] = $hostname;
						}
					}
					else {
						$line['agg'] = $hostnames[$line['agg']];
					}
				}
				// Address resolution end

				if (! isset ($values['sources'][$line['agg']])) {
					continue;
				}

				$values['data'][$interval_start][$line['agg']] = $line['data'];
			}
		}
	}
	
	if (($aggregate != 'none') && (empty($values['data']))) {
		return array();
	}
	
	return $values;
}

/**
 * Returns netflow stats for the given period in an array.
 *
 * @param string start_date Period start date.
 * @param string end_date Period end date.
 * @param string filter Netflow filter.
 * @param string aggregate Aggregate field.
 * @param int max Maximum number of aggregates.
 * @param string unit Unit to show.
 *
 * @return An array with netflow stats.
 */
function netflow_get_stats ($start_date, $end_date, $filter, $aggregate, $max, $unit, $connection_name = '', $address_resolution = false) {
	global $config, $nfdump_date_format;

	// Requesting remote data
	if (defined ('METACONSOLE') && $connection_name != '') {
		$data = metaconsole_call_remote_api ($connection_name, 'netflow_get_stats', "$start_date|$end_date|" . base64_encode(json_encode($filter)) . "|$aggregate|$max|$unit|" . (int)$address_resolution);
		return json_decode ($data, true);
	}

	// Get the command to call nfdump
	$command = netflow_get_command ($filter);

	// Execute nfdump
	$command .= " -o csv -q -n $max -s $aggregate/bytes -t " .date($nfdump_date_format, $start_date).'-'.date($nfdump_date_format, $end_date);
	exec($command, $string);

	if (! is_array($string)) {
		return array ();
	}
	
	// Remove the first line
	$string[0] = '';
	
	$i = 0;
	$values = array();
	$interval_length = $end_date - $start_date;
	foreach ($string as $line) {
		if ($line == '') {
			continue;
		}
		
		$val = explode(',',$line);
		
		$values[$i]['date'] = $val[0];
		$values[$i]['time'] = $val[1];
		
		//create field to sort array
		$datetime = $val[0];
		$end_date = strtotime ($datetime);
		$values[$i]['datetime'] = $end_date;
		if ($aggregate == 'proto') {
			$values[$i]['agg'] = $val[3];
		}
		else {

			// Address resolution start
			if ($address_resolution && ($aggregate == "srcip" || $aggregate == "dstip")) {
				global $hostnames;
				
				if (!isset($hostnames[$val[4]])) {
					$hostname = gethostbyaddr($val[4]);
					if ($hostname !== false) {
						$hostnames[$val[4]] = $hostname;
						$val[4] = $hostname;
					}
				}
				else {
					$val[4] = $hostnames[$val[4]];
				}
			}
			// Address resolution end

			$values[$i]['agg'] = $val[4];
		}
		if (! isset ($val[9])) {
			return array ();
		}
		
		switch ($unit) {
			case "megabytes":
				$values[$i]['data'] = $val[9] / 1048576;
				break;
			case "megabytespersecond":
				$values[$i]['data'] = $val[9] / 1048576 / $interval_length;
				break;
			case "kilobytes":
				$values[$i]['data'] = $val[9] / 1024;
				break;
			case "kilobytespersecond":
				$values[$i]['data'] = $val[9] / 1024 / $interval_length;
				break;
			default:
			case "bytes":
				$values[$i]['data'] = $val[9];
				break;
			case "bytespersecond":
				$values[$i]['data'] = $val[9] / $interval_length;
				break;
		}
		$i++;
	}
	
	sort_netflow_data ($values);
	
	return $values;
}

/**
 * Returns a traffic summary for the given period in an array.
 *
 * @param string start_date Period start date.
 * @param string end_date Period end date.
 * @param string filter Netflow filter.
 *
 * @return An array with netflow stats.
 */
function netflow_get_summary ($start_date, $end_date, $filter, $connection_name = '') {
	global $nfdump_date_format;
	global $config;

	// Requesting remote data
	if (defined ('METACONSOLE') && $connection_name != '') {
		$data = metaconsole_call_remote_api ($connection_name, 'netflow_get_summary', "$start_date|$end_date|" . base64_encode(json_encode($filter)));
		return json_decode ($data, true);
	}

	// Get the command to call nfdump
	$command = netflow_get_command ($filter);

	// Execute nfdump
	$command .= " -o csv -n 1 -s srcip/bytes -t " .date($nfdump_date_format, $start_date).'-'.date($nfdump_date_format, $end_date);
	exec($command, $string);

	if (! is_array($string) || ! isset ($string[5])) {
		return array ();
	}
	
	// Read the summary
	$summary = explode (',', $string[5]);
	if (! isset ($summary[5])) {
		return array ();
	}

	$values['totalflows'] = $summary[0];
	$values['totalbytes'] = $summary[1];
	$values['totalpackets'] = $summary[2];
	$values['avgbps'] = $summary[3];
	$values['avgpps'] = $summary[4];
	$values['avgbpp'] = $summary[5];
	
	return $values;
}

/**
 * Returns a traffic record for the given period in an array.
 *
 * @param string start_date Period start date.
 * @param string end_date Period end date.
 * @param string filter Netflow filter.
 * @param int max Maximum number of elements.
 * @param string unit to show.
 *
 * @return An array with netflow stats.
 */
function netflow_get_record ($start_date, $end_date, $filter, $max, $unit, $address_resolution = false) {
	global $nfdump_date_format;
	global $config;

	// TIME_START = 0;
	// TIME_END = 1;
	// DURATION = 2;
	// SOURCE_ADDRESS = 3;
	// DESTINATION_ADDRESS = 4;
	// SOURCE_PORT = 5;
	// DESTINATION_PORT = 6;
	// PROTOCOL = 7;
	// INPUT_BYTES = 12;

	// Get the command to call nfdump
	$command = netflow_get_command($filter);

	// Execute nfdump
	$command .= " -q -o csv -n $max -s record/bytes -t " .date($nfdump_date_format, $start_date).'-'.date($nfdump_date_format, $end_date);
	exec($command, $result);

	if (! is_array($result)) {
		return array();
	}

	$values = array();
	foreach ($result as $key => $line) {
		$data = array();

		$items = explode (',', $line);

		$data['time_start'] = $items[0];
		$data['time_end'] = $items[1];
		$data['duration'] = $items[2] / 1000;
		$data['source_address'] = $items[3];
		$data['destination_address'] = $items[4];
		$data['source_port'] = $items[5];
		$data['destination_port'] = $items[6];
		$data['protocol'] = $items[7];
		
		switch ($unit) {
			case "megabytes":
				$data['data'] = $items[12] / 1048576;
				break;
			case "megabytespersecond":
				$data['data'] = $items[12] / 1048576 / $data['duration'];
				break;
			case "kilobytes":
				$data['data'] = $items[12] / 1024;
				break;
			case "kilobytespersecond":
				$data['data'] = $items[12] / 1024 / $data['duration'];
				break;
			default:
			case "bytes":
				$data['data'] = $items[12];
				break;
			case "bytespersecond":
				$data['data'] = $items[12] / $data['duration'];
				break;
		}
		$values[] = $data;
	}
	
	// Address resolution start
	if ($address_resolution) {
		global $hostnames;

		for ($i = 0; $i < count($values); $i++) {
			if (!isset($hostnames[$values[$i]['source_address']])) {
				$hostname = gethostbyaddr($values[$i]['source_address']);
				if ($hostname !== false) {
					$hostnames[$values[$i]['source_address']] = $hostname;
					$values[$i]['source_address'] = $hostname;
				}
			}
			else {
				$values[$i]['source_address'] = $hostnames[$values[$i]['source_address']];
			}
			if (!isset($hostnames[$values[$i]['destination_address']])) {
				$hostname = gethostbyaddr($values[$i]['destination_address']);
				if ($hostname !== false) {
					$hostnames[$values[$i]['destination_address']] = $hostname;
					$values[$i]['destination_address'] = $hostname;
				}
			}
			else {
				$values[$i]['destination_address'] = $hostnames[$values[$i]['destination_address']];
			}
		}
	}
	// Address resolution end
	
	return $values;
}

/**
 * Returns the command needed to run nfdump for the given filter.
 *
 * @param array filter Netflow filter.
 *
 * @return Command to run.
 *
 */
function netflow_get_command ($filter) {
	global $config;
	
	// Build command
	$command = io_safe_output ($config['netflow_nfdump']) . ' -N';

	// Netflow data path
	if (isset($config['netflow_path']) && $config['netflow_path'] != '') {
		$command .= ' -R. -M '.$config['netflow_path'];
	}
	
	// Filter options
	$command .= netflow_get_filter_arguments ($filter);
	
	return $command;
}

/**
 * Returns the nfdump command line arguments that match the given filter.
 *
 * @param array filter Netflow filter.
 *
 * @return Command line argument string.
 *
 */
function netflow_get_filter_arguments ($filter) {
	
	// Advanced filter
	$filter_args = '';
	if ($filter['advanced_filter'] != '') {
		$filter_args = preg_replace('/["\r\n]/','', io_safe_output ($filter['advanced_filter']));
		return ' "(' . $filter_args . ')"';
	}
	
	// Normal filter
	if ($filter['ip_dst'] != '') {
		$filter_args .= ' "(';
		$val_ipdst = explode(',', io_safe_output ($filter['ip_dst']));
		for ($i = 0; $i < count ($val_ipdst); $i++) {
			if ($i > 0) {
				$filter_args .= ' or ';
			}
			
			if (netflow_is_net ($val_ipdst[$i]) == 0) {
				$filter_args .= 'dst ip '.$val_ipdst[$i];
			}
			else {
				$filter_args .= 'dst net '.$val_ipdst[$i];
			}
		}
		$filter_args .=  ')';
	}
	if ($filter['ip_src'] != '') {
		if ($filter_args == '') {
			$filter_args .= ' "(';
		}
		else {
			$filter_args .= ' and (';
		}
		$val_ipsrc = explode(',', io_safe_output ($filter['ip_src']));
		for ($i = 0; $i < count ($val_ipsrc); $i++) {
			if ($i > 0) {
				$filter_args .= ' or ';
			}
			
			if (netflow_is_net ($val_ipsrc[$i]) == 0) {
				$filter_args .= 'src ip '.$val_ipsrc[$i];
			}
			else {
				$filter_args .= 'src net '.$val_ipsrc[$i];
			}
		}
		$filter_args .=  ')';
	}
	if ($filter['dst_port'] != '') {
		if ($filter_args == '') {
			$filter_args .= ' "(';
		}
		else {
			$filter_args .= ' and (';
		}
		$val_dstport = explode(',', io_safe_output ($filter['dst_port']));
		for ($i = 0; $i < count ($val_dstport); $i++) {
			if ($i > 0) {
				$filter_args .= ' or ';
			}
			$filter_args .= 'dst port '.$val_dstport[$i];
		}
		$filter_args .=  ')';
	}
	if ($filter['src_port'] != '') {
		if ($filter_args == '') {
			$filter_args .= ' "(';
		}
		else {
			$filter_args .= ' and (';
		}
		$val_srcport = explode(',', io_safe_output ($filter['src_port']));
		for ($i = 0; $i < count ($val_srcport); $i++) {
			if ($i > 0) {
				$filter_args .= ' or ';
			}
			$filter_args .= 'src port '.$val_srcport[$i];
		}
		$filter_args .=  ')';
	}
	if (isset ($filter['proto']) && $filter['proto'] != '') {
		if ($filter_args == '') {
			$filter_args .= ' "(';
		}
		else {
			$filter_args .= ' and (';
		}
		$val_proto = explode(',', io_safe_output ($filter['proto']));
		for ($i = 0; $i < count ($val_proto); $i++) {
			if ($i > 0) {
				$filter_args .= ' or ';
			}
			$filter_args .= 'proto '.$val_proto[$i];
		}
		$filter_args .=  ')';
	}
	if ($filter_args != '') {
		$filter_args .= '"';
	}
	
	return $filter_args;
}

/**
 * Get the types of netflow charts.
 *
 * @return Array of types.
 *
 */
function netflow_get_chart_types () {
	return array(
		'netflow_area' => __('Area graph'),
		'netflow_pie_summatory' => __('Pie graph and Summary table'),
		'netflow_statistics' => __('Statistics table'),
		'netflow_data' => __('Data table'),
		'netflow_mesh' => __('Circular mesh'),
		'netflow_host_treemap' => __('Host detailed traffic'));
}

/**
 * Gets valid intervals for a netflow chart in the format:
 *
 * interval_length => interval_description
 *
 * @return Array of valid intervals.
 *
 */
function netflow_get_valid_intervals () {
	return array (
		(string)SECONDS_10MINUTES => __('10 mins'),
		(string)SECONDS_15MINUTES => __('15 mins'),
		(string)SECONDS_30MINUTES => __('30 mins'),
		(string)SECONDS_1HOUR => __('1 hour'),
		(string)SECONDS_2HOUR => __('2 hours'),
		(string)SECONDS_5HOUR => __('5 hours'),
		(string)SECONDS_12HOURS => __('12 hours'),
		(string)SECONDS_1DAY => __('1 day'),
		(string)SECONDS_2DAY => __('2 days'),
		(string)SECONDS_5DAY => __('5 days'),
		(string)SECONDS_15DAYS => __('15 days'),
		(string)SECONDS_1WEEK => __('Last week'),
		(string)SECONDS_1MONTH => __('Last month'),
		(string)SECONDS_2MONTHS => __('2 months'),
		(string)SECONDS_3MONTHS => __('3 months'),
		(string)SECONDS_6MONTHS => __('6 months'),
		(string)SECONDS_1YEAR => __('Last year'),
		(string)SECONDS_2YEARS => __('2 years'));
}

/**
 * Gets valid intervals for a netflow chart in the format:
 *
 * interval_length => interval_description
 *
 * @return Array of valid intervals.
 *
 */
function netflow_get_valid_subintervals () {
	return array (
		(string)SECONDS_1MINUTE => __('1 min'),
		(string)SECONDS_2MINUTES => __('2 mins'),
		(string)SECONDS_5MINUTES => __('5 mins'),
		(string)SECONDS_10MINUTES => __('10 mins'),
		(string)SECONDS_15MINUTES => __('15 mins'),
		(string)SECONDS_30MINUTES => __('30 mins'),
		(string)SECONDS_1HOUR => __('1 hour'),
		(string)SECONDS_2HOUR => __('2 hours'),
		(string)SECONDS_5HOUR => __('5 hours'),
		(string)SECONDS_12HOURS => __('12 hours'),
		(string)SECONDS_1DAY => __('1 day'),
		(string)SECONDS_2DAY => __('2 days'),
		(string)SECONDS_5DAY => __('5 days'),
		(string)SECONDS_15DAYS => __('15 days'),
		(string)SECONDS_1WEEK => __('1 week'),
		(string)SECONDS_1MONTH => __('1 month'));
}

/**
 * Draw a netflow report item.
 *
 * @param string start_date Period start date.
 * @param string end_date Period end date.
 * @param string interval_length Interval length in seconds (num_intervals * interval_length = start_date - end_date).
 * @param string type Chart type.
 * @param array filter Netflow filter.
 * @param int max_aggregates Maximum number of aggregates.
 * @param string output Output format. Only HTML and XML are supported.
 *
 * @return The netflow report in the appropriate format.
 */
function netflow_draw_item ($start_date, $end_date, $interval_length, $type, $filter, $max_aggregates, $connection_name = '', $output = 'HTML', $address_resolution = false) {
	$aggregate = $filter['aggregate'];
	$unit = $filter['output'];
	$interval = $end_date - $start_date;
	if (defined ('METACONSOLE')) {
		$width = 950;
	} else {
		$width = 850;
	}
	$height = 320;
	
	// Process item
	switch ($type) {
		case '0':
		case 'netflow_area':
			$data = netflow_get_data ($start_date, $end_date, $interval_length, $filter, $aggregate, $max_aggregates, $unit, $connection_name, $address_resolution);
			if (empty ($data)) {
				break;
			}
			if ($aggregate != 'none') {
				if ($output == 'HTML') {
					$html = "<b>" . __('Unit') . ":</b> " . netflow_format_unit ($unit);
					$html .= "&nbsp;<b>" . __('Aggregate') . ":</b> " . netflow_format_aggregate ($aggregate);
					if ($interval_length != 0) {
						$html .= "&nbsp;<b>" . _('Resolution') . ":</b> $interval_length " . __('seconds');
					}

					$html .= graph_netflow_aggregate_area ($data, $interval, $width, $height, netflow_format_unit ($unit));
					return $html;
				}
				else if ($output == 'PDF') {
					$html = "<b>" . __('Unit') . ":</b> " . netflow_format_unit ($unit);
					$html .= "&nbsp;<b>" . __('Aggregate') . ":</b> " . netflow_format_aggregate ($aggregate);
					if ($interval_length != 0) {
						$html .= "&nbsp;<b>" . _('Resolution') . ":</b> $interval_length " . __('seconds');
					}
					$html .= graph_netflow_aggregate_area ($data, $interval, $width, $height, netflow_format_unit ($unit), 2, true);
					return $html;
				}
				else if ($output == 'XML') {
					$xml = "<unit>$unit</unit>\n";
					$xml .= "<aggregate>$aggregate</aggregate>\n";
					$xml .= "<resolution>$interval_length</resolution>\n";
					$xml .= netflow_aggregate_area_xml ($data);
					return $xml;
				}
			}
			else {
				if ($output == 'HTML') {
					$html = "<b>" . __('Unit') . ":</b> " . netflow_format_unit ($unit);
					if ($interval_length != 0) {
						$html .= "&nbsp;<b>" . _('Resolution') . ":</b> $interval_length " . __('seconds');
					}
					$html .= graph_netflow_total_area ($data, $interval, 660, 320, netflow_format_unit ($unit));
					return $html;
				}
				else if ($output == 'PDF') {
					$html = "<b>" . __('Unit') . ":</b> " . netflow_format_unit ($unit);
					if ($interval_length != 0) {
						$html .= "&nbsp;<b>" . _('Resolution') . ":</b> $interval_length " . __('seconds');
					}
					$html .= graph_netflow_total_area ($data, $interval, 660, 320, netflow_format_unit ($unit), 2, true);
					return $html;
				}
				else if ($output == 'XML') {
					$xml = "<unit>$unit</unit>\n";
					$xml .= "<resolution>$interval_length</resolution>\n";
					$xml .= netflow_total_area_xml ($data);
					return $xml;
				}
			}
			break;
		case '2':
		case 'netflow_data':
			$data = netflow_get_data ($start_date, $end_date, $interval_length, $filter, $aggregate, $max_aggregates, $unit, $connection_name, $address_resolution);
			
			if (empty ($data)) {
				break;
			}
			if ($output == 'HTML' || $output == 'PDF') {
				$html = "<b>" . __('Unit') . ":</b> " . netflow_format_unit ($unit);
				$html .= "&nbsp;<b>" . __('Aggregate') . ":</b> " . netflow_format_aggregate ($aggregate);
				if ($interval_length != 0) {
					$html .= "&nbsp;<b>" . _('Resolution') . ":</b> $interval_length " . __('seconds');
				}
				$html .= "<div style='max-width: 1000px; overflow: auto;'>";
				$html .= netflow_data_table ($data, $start_date, $end_date, $aggregate, $unit);
				$html .= "</div>";
				
				return $html;
			}
			else if ($output == 'XML') {
				$xml = "<unit>$unit</unit>\n";
				$xml .= "<aggregate>$aggregate</aggregate>\n";
				$xml .= "<resolution>$interval_length</resolution>\n";
				// Same as netflow_aggregate_area_xml
				$xml .= netflow_aggregate_area_xml ($data);
				return $xml;
			}
			break;
		case '3':
		case 'netflow_statistics':
			$data = netflow_get_stats ($start_date, $end_date, $filter,
				$aggregate, $max_aggregates, $unit, $connection_name, $address_resolution);
			if (empty ($data)) {
				break;
			}
			if ($output == 'HTML' || $output == 'PDF') {
				$html = netflow_stat_table ($data, $start_date, $end_date, $aggregate, $unit);
				return $html;
			}
			else if ($output == 'XML') {
				return netflow_stat_xml ($data);
			}
			break;
		case '4':
		case 'netflow_summary':
			$data_summary = netflow_get_summary ($start_date, $end_date,
				$filter, $connection_name);
			if (empty ($data_summary)) {
				break;
			}
			if ($output == 'HTML' || $output == 'PDF') {
				return netflow_summary_table ($data_summary);
			}
			else if ($output == 'XML') {
				return netflow_summary_xml ($data_summary);
			}
			break;
		case '1':
		case 'netflow_pie':
			$data_pie = netflow_get_stats ($start_date, $end_date,
				$filter, $aggregate, $max_aggregates, $unit,
				$connection_name, $address_resolution);
			if (empty ($data_pie)) {
				break;
			}
			if ($output == 'HTML') {
				$html = "<b>" . __('Unit') . ":</b> " . netflow_format_unit ($unit);
				$html .= "&nbsp;<b>" . __('Aggregate') . ":</b> " . netflow_format_aggregate ($aggregate);
				$html .= graph_netflow_aggregate_pie ($data_pie, netflow_format_aggregate ($aggregate));
				return $html;
			}
			else if ($output == 'PDF') {
				$html = "<b>" . __('Unit') . ":</b> " . netflow_format_unit ($unit);
				$html .= "&nbsp;<b>" . __('Aggregate') . ":</b> $aggregate";
				$html .= graph_netflow_aggregate_pie ($data_pie, netflow_format_aggregate ($aggregate), 2, true);
				return $html;
			}
			else if ($output == 'XML') {
				$xml = "<unit>$unit</unit>\n";
				$xml .= "<aggregate>$aggregate</aggregate>\n";
				$xml .= netflow_aggregate_pie_xml ($data_pie);
				return $xml;
			}
			break;
		case 'netflow_pie_summatory':
			$data_summary = netflow_get_summary ($start_date, $end_date,
				$filter, $connection_name);
			if (empty ($data_summary)) {
				break;
			}
			
			$data_pie = netflow_get_stats ($start_date, $end_date,
				$filter, $aggregate, $max_aggregates, $unit,
				$connection_name, $address_resolution);
			if (empty ($data_pie)) {
				break;
			}
			
			switch ($output) {
				case 'HTML':
					$html = '<table>';
					$html .= '<tr>';
					$html .= '<td>';
					$html .= netflow_summary_table ($data_summary);
					$html .= "<b>" . __('Unit') . ":</b> " .
						netflow_format_unit ($unit);
					$html .= "&nbsp;<b>" . __('Aggregate') . ":</b> " . netflow_format_aggregate ($aggregate);
					$html .= '</td>';
					$html .= '<td>';
					$html .= graph_netflow_aggregate_pie ($data_pie, netflow_format_aggregate ($aggregate));
					$html .= '</td>';
					$html .= '</tr>';
					$html .= '</table>';
					return $html;
					break;
				case 'PDF':
					break;
				case 'XML':
					return netflow_summary_xml ($data_summary);
					break;
			}
			break;
		case 'netflow_mesh':
			$netflow_data = netflow_get_record($start_date, $end_date, $filter, $max_aggregates, $unit, $address_resolution);

			switch ($aggregate) {
				case "srcport":
				case "dstport":
					$source_type = "source_port";
					$destination_type = "destination_port";
					break;
				default:
				case "dstip":
				case "srcip":
					$source_type = "source_address";
					$destination_type = "destination_address";
					break;
			}

			$data = array();
			$data['elements'] = array();
			$data['matrix'] = array();
			foreach ($netflow_data as $record) {
				if (!in_array($record[$source_type], $data['elements'])) {
					$data['elements'][] = $record[$source_type];
					$data['matrix'][] = array();
				}
				if (!in_array($record[$destination_type], $data['elements'])) {
					$data['elements'][] = $record[$destination_type];
					$data['matrix'][] = array();
				}
			}
			
			for ($i = 0; $i < count($data['matrix']); $i++) { 
				$data['matrix'][$i] = array_fill(0, count($data['matrix']), 0);
			}

			foreach ($netflow_data as $record) {
				$source_key = array_search($record[$source_type], $data['elements']);
				$destination_key = array_search($record[$destination_type], $data['elements']);
				if ($source_key !== false && $destination_key !== false) {
					$data['matrix'][$source_key][$destination_key] += $record['data'];
				}
			}
			
			$html = "<div style=\"text-align:center;\">";
			$html .= graph_netflow_circular_mesh ($data, netflow_format_unit($unit), 700);
			$html .= "</div>";

			return $html;
			break;
		case 'netflow_host_treemap':
			$netflow_data = netflow_get_record($start_date, $end_date, $filter, $max_aggregates, $unit, $address_resolution);

			switch ($aggregate) {
				case "srcip":
				case "srcport":
					$address_type = "source_address";
					$port_type = "source_port";
					$type = __("Sent");
					break;
				default:
				case "dstip":
				case "dstport":
					$address_type = "destination_address";
					$port_type = "destination_port";
					$type = __("Received");
					break;
			}
			$data_aux = array();
			foreach ($netflow_data as $record) {
				$address = $record[$address_type];
				$port = $record[$port_type];

				if (!isset($data_aux[$address]))
					$data_aux[$address] = array();

				if (!isset($data_aux[$address][$port]))
					$data_aux[$address][$port] = 0;

				$data_aux[$address][$port] += $record['data'];
			}

			$id = -1;

			$data = array();

			if (! empty($netflow_data)) {
				$data['name'] = __("Host detailed traffic") . ": " . $type;
				$data['children'] = array();

				foreach ($data_aux as $address => $ports) {
					$children = array();
					$children['id'] = $id++;
					$children['name'] = $address;
					$children['children'] = array();
					foreach ($ports as $port => $value) {
						$children_data = array();
						$children_data['id'] = $id++;
						$children_data['name'] = $port;
						$children_data['value'] = $value;
						$children_data['tooltip_content'] = "$port: <b>" . format_numeric($value) . " " . netflow_format_unit($unit) . "</b>";
						$children['children'][] = $children_data;
					}
					$data['children'][] = $children;
				}
			}

			return graph_netflow_host_traffic ($data, netflow_format_unit($unit), 'auto', 400);
			break;
		default:
			break;
	}
	
	if ($output == 'HTML' || $output == 'PDF') {
		return graph_nodata_image(300, 110, 'data');
	}
}

/**
 * Render a netflow report as an XML.
 *
 * @param int ID of the netflow report.
 * @param string end_date Period start date.
 * @param string end_date Period end date.
 * @param string interval_length Interval length in seconds (num_intervals * interval_length = start_date - end_date).
 *
 */
function netflow_xml_report ($id, $start_date, $end_date, $interval_length = 0) {
	
	// Get report data
	$report = db_get_row_sql ('SELECT * FROM tnetflow_report WHERE id_report =' . (int) $id);
	if ($report === FALSE) {
		echo "<report>" . __('Error generating report') . "</report>\n"; 
		return;
	}
	
	// Print report header
	$time = get_system_time ();
	echo '<?xml version="1.0" encoding="UTF-8" ?>';
	echo "<report>\n";
	echo "  <generated>\n";
	echo "    <unix>" . $time . "</unix>\n"; 
	echo "    <rfc2822>" . date ("r", $time) . "</rfc2822>\n";
	echo "  </generated>\n"; 
	echo "  <name>" . io_safe_output ($report['id_name']) . "</name>\n";
	echo "  <description>" . io_safe_output ($report['description']) . "</description>\n";
	echo "  <start_date>" . date ("r", $start_date) . "</start_date>\n";
	echo "  <end_date>" . date ("r", $end_date) . "</end_date>\n";
	
	// Get netflow item types
	$item_types = netflow_get_chart_types ();
	
	// Print report items
	$report_contents = db_get_all_rows_sql ("SELECT *
		FROM tnetflow_report_content
		WHERE id_report='" . $report['id_report'] . "'
		ORDER BY `order`");
	foreach ($report_contents as $content) {
		
		// Get item filters
		$filter = db_get_row_sql("SELECT *
			FROM tnetflow_filter
			WHERE id_sg = '" . io_safe_input ($content['id_filter']) . "'",
				false, true);
		if ($filter === FALSE) {
			continue;
		}
		
		echo "  <report_item>\n";
		echo "    <description>" . io_safe_output ($content['description']) . "</description>\n";
		echo "    <type>" . io_safe_output ($item_types[$content['show_graph']]) . "</type>\n";
		echo "    <max_aggregates>" . $content['max'] . "</max_aggregates>\n";
		echo "    <filter>\n";
		echo "      <name>" . io_safe_output ($filter['id_name']) . "</name>\n";
		echo "      <src_ip>" . io_safe_output ($filter['ip_src']) . "</src_ip>\n";
		echo "      <dst_ip>" . io_safe_output ($filter['ip_dst']) . "</dst_ip>\n";
		echo "      <src_port>" . io_safe_output ($filter['src_port']) . "</src_port>\n";
		echo "      <dst_port>" . io_safe_output ($filter['src_port']) . "</dst_port>\n";
		echo "      <advanced>" . io_safe_output ($filter['advanced_filter']) . "</advanced>\n";
		echo "      <aggregate>" . io_safe_output ($filter['aggregate']) . "</aggregate>\n";
		echo "      <unit>" . io_safe_output ($filter['output']) . "</unit>\n";
		echo "    </filter>\n";
		
		echo netflow_draw_item ($start_date, $end_date, $interval_length, $content['show_graph'], $filter, $content['max'], $report['server_name'], 'XML');
		
		echo "  </report_item>\n";
	}
	echo "</report>\n";
}

/**
 * Render an aggregated area chart as an XML.
 *
 * @param array Netflow data.
 *
 */
function netflow_aggregate_area_xml ($data) {
	
	// Print source information
	if (isset($data['sources'])) {
		echo "<aggregates>\n";
		foreach ($data['sources'] as $source => $discard) {
			echo "<aggregate>$source</aggregate>\n";
		}
		echo "</aggregates>\n";
		
		// Print flow information
		echo "<flows>\n";
		foreach ($data['data'] as $timestamp => $flow) {
			
			echo "<flow>\n";
			echo "  <timestamp>" . $timestamp . "</timestamp>\n";
			echo "  <aggregates>\n";
			foreach ($flow as $source => $data) {
				echo "    <aggregate>$source</aggregate>\n";
				echo "    <data>" . $data . "</data>\n";
			}
			echo "  </aggregates>\n";
			echo "</flow>\n";
		}
		echo "</flows>\n";
	}
	else {
		echo "<flows>\n";
		foreach ($data as $timestamp => $flow) {
			echo "<flow>\n";
			echo "  <timestamp>" . $timestamp . "</timestamp>\n";
			echo "  <data>" . $flow['data'] . "</data>\n";
			echo "</flow>\n";
		}
		echo "</flows>\n";
	}
}

/**
 * Render an area chart as an XML.
 *
 * @param array Netflow data.
 *
 */
function netflow_total_area_xml ($data) {

	// Print flow information
	$xml = "<flows>\n";
	foreach ($data as $timestamp => $flow) {
		$xml .= "<flow>\n";
		$xml .= "  <timestamp>" . $timestamp . "</timestamp>\n";
		$xml .= "  <data>" . $flow['data'] . "</data>\n";
		$xml .= "</flow>\n";
	}
	$xml .= "</flows>\n";
	
	return $xml;
}

/**
 * Render a pie chart as an XML.
 *
 * @param array Netflow data.
 *
 */
function netflow_aggregate_pie_xml ($data) {

	// Calculate total
	$total = 0;
	foreach ($data as $flow) {
		$total += $flow['data'];
	}
	if ($total == 0) {
		return;
	}
	
	// Print percentages
	echo "<pie>\n";
	foreach ($data as $flow) {
		echo "<aggregate>" . $flow['agg'] . "</aggregate>\n";
		echo "<data>" . format_numeric (100 * $flow['data'] / $total, 2) . "%</data>\n";
	}
	echo "</pie>\n";
}

/**
 * Render a stats table as an XML.
 *
 * @param array Netflow data.
 *
 */
function netflow_stat_xml ($data) {
	
	// Print stats
	$xml .= "<stats>\n";
	foreach ($data as $flow) {
		$xml .= "<aggregate>" . $flow['agg'] . "</aggregate>\n";
		$xml .= "<data>" . $flow['data'] . "</data>\n";
	}
	$xml .= "</stats>\n";
	
	return $xml;
}

/**
 * Render a summary table as an XML.
 *
 * @param array Netflow data.
 *
 */
function netflow_summary_xml ($data) {
	
	// Print summary
	$xml = "<summary>\n";
	$xml .= "  <total_flows>" . $data['totalflows'] . "</total_flows>\n";
	$xml .= "  <total_bytes>" . $data['totalbytes'] . "</total_bytes>\n";
	$xml .= "  <total_packets>" . $data['totalbytes'] . "</total_packets>\n";
	$xml .= "  <average_bps>" . $data['avgbps'] . "</average_bps>\n";
	$xml .= "  <average_pps>" . $data['avgpps'] . "</average_pps>\n";
	$xml .= "  <average_bpp>" . $data['avgpps'] . "</average_bpp>\n";
	$xml .= "</summary>\n";
	
	return $xml;
}

/**
 * Return a string describing the given unit.
 * 
 * @param string Netflow unit.
 */
function netflow_format_unit ($unit) {
	switch ($unit) {
		case 'megabytes':
			return __('MB');
		case 'megabytespersecond':
			return __('MB/s');
		case 'kilobytes':
			return __('kB');
		case 'kilobytespersecond':
			return __('kB/s');
		case 'bytes':
			return __('Bytes');
		case 'bytespersecond':
			return __('B/s');
		default:
			return '';
	}
}

/**
 * Return a string describing the given aggregate.
 * 
 * @param string Netflow aggregate.
 */
function netflow_format_aggregate ($aggregate) {
	switch ($aggregate) {
		case 'dstport':
			return __('Dst port');
		case 'dstip':
			return __('Dst IP');
		case 'proto':
			return __('Protocol');
		case 'srcip':
			return __('Src IP');
		case 'srcport':
			return __('Src port');
		default:
			return '';
	}
}

/**
 * Check the nfdump binary for compatibility.
 * 
 * @param string nfdump binary full path.
 * 
 * @return 1 if the binary does not exist or is not executable, 2 if a
 *         version older than 1.6.8 is installed or the version cannot be
 *         determined, 0 otherwise.
 */
function netflow_check_nfdump_binary ($nfdump_binary) {
	
	// Check that the binary exists and is executable
	if (! is_executable ($nfdump_binary)) {
		return 1;
	}

	// Check at least version 1.6.8
	$output = '';
	$rc = -1;
	exec ($nfdump_binary . ' -V', $output, $rc);
	if ($rc != 0) {
		return 2;
	}
	
	$matches = array();
	foreach ($output as $line) {
		if (preg_match ('/Version:[^\d]+(\d+)\.(\d+)\.(\d+)/', $line, $matches) === 1) {
			if ($matches[1] < 1) {
				return 2;
			}
			if ($matches[2] < 6) {
				return 2;
			}
			if ($matches[3] < 8) {
				return 2;
			}
			return 0;
		}
	}
	
	return 2;
}

?>