Skip to content

Commit 544f64f

Browse files
Lukas955Lukas955
committed
Unirec output plugin: improved plugin implementation
1 parent 4fe08e0 commit 544f64f

File tree

16 files changed

+1375
-1268
lines changed

16 files changed

+1375
-1268
lines changed

‎extra_plugins/output/unirec/CMakeLists.txt‎

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,14 @@ project(unirec)
33

44
# Description of the project
55
set(UNIREC_DESCRIPTION
6-
"Output plugin for IPFIXcol2 that sends flow records in UniRec format into NEMEA modules."
6+
"Output plugin for IPFIXcol2 that sends flow records in UniRec format into NEMEA modules."
77
)
88

99
set(UNIREC_VERSION_MAJOR 1)
1010
set(UNIREC_VERSION_MINOR 0)
1111
set(UNIREC_VERSION_PATCH 0)
1212
set(UNIREC_VERSION
13-
${UNIREC_VERSION_MAJOR}.${UNIREC_VERSION_MINOR}.${UNIREC_VERSION_PATCH})
13+
${UNIREC_VERSION_MAJOR}.${UNIREC_VERSION_MINOR}.${UNIREC_VERSION_PATCH})
1414

1515
include(CheckCCompilerFlag)
1616
include(CheckCXXCompilerFlag)
@@ -25,8 +25,8 @@ find_package(Unirec REQUIRED)
2525

2626
# Set default build type if not specified by user
2727
if (NOT CMAKE_BUILD_TYPE)
28-
set (CMAKE_BUILD_TYPE Release
29-
CACHE STRING "Choose type of build (Release/Debug/Coverage)." FORCE)
28+
set (CMAKE_BUILD_TYPE Release
29+
CACHE STRING "Choose type of build (Release/Debug)." FORCE)
3030
endif()
3131

3232
# Hard coded definitions
@@ -39,36 +39,36 @@ set(CMAKE_CXX_FLAGS_DEBUG "-g -O0 -Wall -Wextra -pedantic")
3939

4040
# Header files for source code building
4141
include_directories(
42-
"${IPFIXCOL2_INCLUDE_DIRS}" # IPFIXcol2 header files
43-
"${LIBTRAP_INCLUDE_DIRS}" # libtrap header files
44-
"${UNIREC_INCLUDE_DIRS}" # unirec header files
42+
"${IPFIXCOL2_INCLUDE_DIRS}" # IPFIXcol2 header files
43+
"${LIBTRAP_INCLUDE_DIRS}" # libtrap header files
44+
"${UNIREC_INCLUDE_DIRS}" # unirec header files
4545
)
4646

4747
# Create a linkable module
4848
add_library(unirec-output MODULE
49-
configuration.c
50-
configuration.h
51-
unirecplugin.h
52-
unirecplugin.c
53-
translator.c
54-
translator.h
55-
fields.c
56-
fields.h
57-
map.c
58-
map.h
49+
src/configuration.c
50+
src/configuration.h
51+
src/unirecplugin.c
52+
src/translator.c
53+
src/translator.h
54+
src/fields.c
55+
src/fields.h
56+
src/map.c
57+
src/map.h
5958
)
6059

6160
target_link_libraries(unirec-output
6261
${LIBTRAP_LIBRARIES} # libtrap
63-
${UNIREC_LIBRARIES} # unirec
62+
${UNIREC_LIBRARIES} # unirec
63+
m # standard math library
6464
)
6565

6666
install(
67-
TARGETS unirec-output
68-
LIBRARY DESTINATION "${CMAKE_INSTALL_FULL_LIBDIR}/ipfixcol2/"
67+
TARGETS unirec-output
68+
LIBRARY DESTINATION "${CMAKE_INSTALL_FULL_LIBDIR}/ipfixcol2/"
6969
)
7070
install(
71-
FILES unirec-elements.txt
71+
FILES config/unirec-elements.txt
7272
DESTINATION "${CMAKE_INSTALL_FULL_SYSCONFDIR}/ipfixcol2/"
7373
)
7474

‎extra_plugins/output/unirec/README.rst‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -218,3 +218,15 @@ a line: ``"BYTES uint64 e0id1 Number of bytes in flow"``:
218218
To map more than one IPFIX IE to one UniRec element, IPFIX IEs may be written as a comma
219219
separated list of individual IEs (no space before and after comma). For example,
220220
``"SRC_IP ipaddr e0id8,e0id27 IPv4 or IPv6 source address"``.
221+
222+
223+
224+
TODO: how to add new element!! lnf + unirec
225+
226+
227+
Note
228+
----
229+
230+
TODO: bidirectional flows are automatically split into two unidirectional flows
231+
TODO: if multiple IPFIX elements are mapped to the same UniRec field and the result is .....
232+

‎extra_plugins/output/unirec/config/unirec-elements.txt‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
# This file is part of Unirec output plugin for IPFIXcol2
2+
#
3+
# Entries in this file show mapping from IPFIX Information Elements to UniRec
4+
# fields. You can change setting by editing this file. Each entry consists
5+
# of the following parameters:
6+
# - UniRec field name
7+
# - UniRec data type (int{8,16,32,64}, uint{8,16,32,64}, float, double, time,
8+
# ipaddr, macaddr, char, string, bytes)
9+
# - Comma separated list of IPFIX Information Elements identifiers
10+
# ("eXXidYY" where XX is Private Enterprise Number and YY is field ID)
11+
#
12+
# See ipfixcol2-unirec-output(1) for details
13+
14+
#UNIREC NAME UNIREC TYPE IPFIX IEs DESCRIPTION
15+
# --- Basic fields ---
16+
SRC_IP ipaddr e0id8,e0id27 # IPv4 or IPv6 source address
17+
DST_IP ipaddr e0id12,e0id28 # IPv4 or IPv6 destination address
18+
SRC_PORT uint16 e0id7 # Transport protocol source port
19+
DST_PORT uint16 e0id11 # Transport protocol destination port
20+
PROTOCOL uint8 e0id4 # Transport protocol
21+
TCP_FLAGS uint8 e0id6 # TCP flags
22+
BYTES uint64 e0id1 # Number of bytes in flow
23+
PACKETS uint32 e0id2 # Number of packets in flow
24+
TIME_FIRST time e0id152 # Time of the first packet of a flow
25+
TIME_LAST time e0id153 # Time of the last packet of a flow
26+
DIR_BIT_FIELD uint8 e0id10 # Bit field used for determining incoming/outgoing flow (1 => Incoming, 0 => Outgoing)
27+
LINK_BIT_FIELD uint64 e0id405 # Bit field of links on which was flow seen
28+
TTL uint8 e0id192 # IP time to live
29+
TOS uint8 e0id5 # IP type of service
30+
31+
# --- DNS specific fields ---
32+
DNS_ANSWERS uint16 e8057id0 # DNS answers
33+
DNS_RCODE uint8 e8057id1 # DNS rcode
34+
DNS_NAME string e8057id2 # DNS name
35+
DNS_QTYPE uint16 e8057id3 # DNS qtype
36+
DNS_CLASS uint16 e8057id4 # DNS class
37+
DNS_RR_TTL uint32 e8057id5 # DNS rr ttl
38+
DNS_RLENGTH uint16 e8057id6 # DNS rlenght
39+
DNS_RDATA bytes e8057id7 # DNS rdata
40+
DNS_PSIZE uint16 e8057id8 # DNS payload size
41+
DNS_DO uint8 e8057id9 # DNS DNSSEC OK bit
42+
DNS_ID uint16 e8057id10 # DNS transaction id
43+
44+
# --- SMTP specific fields ---
45+
#SMTP_FLAGS uint8 e8057id200 # SMTP flags
46+
SMTP_COMMAND_FLAGS uint32 e8057id810 # SMTP command flags
47+
SMTP_MAIL_CMD_COUNT uint32 e8057id811 # SMTP MAIL command count
48+
SMTP_RCPT_CMD_COUNT uint32 e8057id812 # SMTP RCPT command count
49+
SMTP_FIRST_SENDER string e8057id813 # SMTP first sender
50+
SMTP_FIRST_RECIPIENT string e8057id814 # SMTP first recipient
51+
SMTP_STAT_CODE_FLAGS uint32 e8057id815 # SMTP status code flags
52+
SMTP_2XX_STAT_CODE_COUNT uint32 e8057id816 # SMTP 2XX status code count
53+
SMTP_3XX_STAT_CODE_COUNT uint32 e8057id817 # SMTP 3XX status code count
54+
SMTP_4XX_STAT_CODE_COUNT uint32 e8057id818 # SMTP 4XX status code count
55+
SMTP_5XX_STAT_CODE_COUNT uint32 e8057id819 # SMTP 5XX status code count
56+
SMTP_DOMAIN string e8057id820 # SMTP domain
57+
58+
# --- SIP specific fields ---
59+
SIP_MSG_TYPE uint16 e8057id100 # SIP message type
60+
SIP_STATUS_CODE uint16 e8057id101 # SIP status code
61+
SIP_CALL_ID string e8057id102 # SIP call id
62+
SIP_CALLING_PARTY string e8057id103 # SIP from
63+
SIP_CALLED_PARTY string e8057id104 # SIP to
64+
SIP_VIA string e8057id105 # SIP VIA
65+
SIP_USER_AGENT string e8057id106 # SIP user agent
66+
SIP_REQUEST_URI string e8057id107 # SIP request uri
67+
SIP_CSEQ string e8057id108 # SIP CSeq
68+
69+
# --- HTTP elements --- (Flowmon HTTP plugin in MUNI PEN, and CESNET sdm-http(s) plugin in CESNET PEN)
70+
HTTP_REQUEST_METHOD_ID uint32 e16982id500,e8057id800 # HTTP request method id
71+
HTTP_REQUEST_HOST string e16982id501,e8057id801,e8057id808 # HTTP(S) request host
72+
HTTP_REQUEST_URL string e16982id502,e8057id802 # HTTP request url
73+
HTTP_REQUEST_AGENT_ID uint32 e16982id503 # HTTP request agent id
74+
HTTP_REQUEST_AGENT string e16982id504,e8057id804 # HTTP request agent
75+
HTTP_REQUEST_REFERER string e16982id505,e8057id803 # HTTP referer
76+
HTTP_RESPONSE_STATUS_CODE uint32 e16982id506,e8057id805 # HTTP response status code
77+
HTTP_RESPONSE_CONTENT_TYPE string e16982id507,e8057id806 # HTTP response content type
78+
HTTP_REQUEST_RANGE bytes e8057id821 # HTTP range
79+
HTTP_RESPONSE_TIME uint64 e8057id807,e8057id809 # HTTP(S) application response time
80+
81+
# --- Flowmon (former Invea) specific fields
82+
INVEA_VOIP_PACKET_TYPE uint8 e39499id32 # VOIP packet type
83+
INVEA_SIP_CALL_ID string e39499id33 # SIP call ID
84+
INVEA_SIP_CALLING_PARTY string e39499id34 # SIP calling party
85+
INVEA_SIP_CALLED_PARTY string e39499id35 # SIP called party
86+
INVEA_SIP_VIA string e39499id36 # SIP VIA
87+
INVEA_SIP_INVITE_RINGING_TIME time e39499id37 # SIP INVITE ringing time
88+
INVEA_SIP_OK_TIME time e39499id38 # SIP OK time
89+
INVEA_SIP_BYE_TIME time e39499id39 # SIP BYE time
90+
INVEA_SIP_RTP_IP4 ipaddr e39499id40 # SIP RTP IPv4
91+
INVEA_SIP_RTP_IP6 ipaddr e39499id41 # SIP RTP IPv6
92+
INVEA_SIP_RTP_AUDIO uint16 e39499id42 # SIP RTP audio
93+
INVEA_SIP_RTP_VIDEO uint16 e39499id43 # SIP RTP video
94+
INVEA_SIP_STATS uint64 e39499id44 # SIP stats
95+
INVEA_RTP_CODEC uint8 e39499id45 # RTP codec
96+
INVEA_RTP_JITTER uint32 e39499id46 # RTP jitter
97+
INVEA_RTCP_LOST uint32 e39499id47 # RTCP lost
98+
INVEA_RTCP_PACKETS uint64 e39499id48 # RTCP packets
99+
INVEA_RTCP_OCTETS uint64 e39499id49 # RTCP octets
100+
INVEA_RTCP_SOURCE_COUNT uint8 e39499id50 # RTCP source count
101+
INVEA_SIP_USER_AGENT string e39499id51 # SIP User Agent
102+
INVEA_SIP_REQUEST_URI string e39499id52 # SIP Request-URI
103+
104+
# --- Heartbeat detection fields ---
105+
HB_TYPE uint8 e8057id700 # TLS content type
106+
HB_DIR uint8 e8057id701 # Heartbeat request/response byte
107+
HB_SIZE_MSG uint16 e8057id702 # Heartbeat message size
108+
HB_SIZE_PAYLOAD uint16 e8057id703 # Heartbeat payload size
109+
110+
# --- Other fields ---
111+
#FLOWDIR_SYN uint8 e8057id299 # Packet with SYN flag only flag
112+
VENOM uint8 e8057id1001 # Venom rootkit detection
113+
IPV6_TUN_TYPE uint8 e16982id405 # IPv6 tunnel type
114+

extra_plugins/output/unirec/configuration.c renamed to extra_plugins/output/unirec/src/configuration.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,17 +43,18 @@
4343
#define _GNU_SOURCE
4444
#include <stdio.h>
4545
#include "configuration.h"
46-
#include "unirecplugin.h"
4746

4847
#include <ipfixcol2.h>
4948
#include <stdlib.h>
49+
#include <stdint.h>
5050
#include <inttypes.h>
5151
#include <string.h>
5252
#include <errno.h>
5353
#include <unistd.h>
5454
#include <stdarg.h>
5555
#include <limits.h>
5656
#include <ctype.h>
57+
#include <stdbool.h>
5758

5859
/** Timeout configuration */
5960
enum cfg_timeout_mode {

extra_plugins/output/unirec/configuration.h renamed to extra_plugins/output/unirec/src/configuration.h

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,6 @@
4040
#ifndef CONFIGURATION_H
4141
#define CONFIGURATION_H
4242

43-
#include <stdint.h>
44-
#include <stdbool.h>
4543
#include <ipfixcol2.h>
4644

4745
/**
@@ -56,18 +54,18 @@ struct conf_params {
5654
* Elements marked with '?' are optional and might not be filled (e.g. TCP_FLAGS)
5755
* For example, "DST_IP,SRC_IP,BYTES,DST_PORT,?TCP_FLAGS,SRC_PORT,PROTOCOL".
5856
* All fields must be contained in unirec-elements.txt
59-
* \note All whitespaces has been removed
57+
* \note All whitespaces have been removed
6058
*/
6159
char *unirec_spec;
62-
/** The same as \ref conf_params.unirec_spec, however, question marks has been removed */
60+
/** The same as \ref conf_params.unirec_spec, however, question marks have been removed */
6361
char *unirec_fmt;
6462
};
6563

6664
/**
6765
* \brief Parse the plugin configuration
6866
*
6967
* \warning The configuration MUST be free by configuration_free() function.
70-
* \param[in,out] ctx IPFIXcol2 context for output messages
68+
* \param[in] ctx Instance context
7169
* \param[in] params XML configuration
7270
* \return On success returns a pointer to the configuration. Otherwise returns
7371
* NULL.

extra_plugins/output/unirec/fields.c renamed to extra_plugins/output/unirec/src/fields.c

File renamed without changes.

extra_plugins/output/unirec/fields.h renamed to extra_plugins/output/unirec/src/fields.h

File renamed without changes.

0 commit comments

Comments
 (0)