Skip to content

Commit b0212b2

Browse files
sedmichasedmicha
committed
Merge branch 'filter-plugin' into 'devel'
Filter plugin See merge request monitoring/ipfixcol2!22
2 parents f5e20e9 + fd81c51 commit b0212b2

File tree

10 files changed

+743
-1
lines changed

10 files changed

+743
-1
lines changed

‎include/ipfixcol2/message_ipfix.h

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -225,6 +225,15 @@ ipx_msg_ipfix_add_set_ref(struct ipx_msg_ipfix *msg);
225225
IPX_API struct ipx_ipfix_record *
226226
ipx_msg_ipfix_add_drec_ref(struct ipx_msg_ipfix **msg_ref);
227227

228+
/**
229+
* \brief Set the raw size of an IPFIX message.
230+
*
231+
* \param[in] msg IPFIX Message wrapper.
232+
* \param[in] new_raw_size The new raw_size value.
233+
*/
234+
IPX_API void
235+
ipx_msg_ipfix_set_raw_size(ipx_msg_ipfix_t *msg, uint16_t new_raw_size);
236+
228237
/**@}*/
229238
#ifdef __cplusplus
230239
}

‎src/core/message_ipfix.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -192,3 +192,9 @@ ipx_msg_ipfix_add_drec_ref(struct ipx_msg_ipfix **msg_ref)
192192
msg->rec_info.cnt_valid++;
193193
return ((struct ipx_ipfix_record *) (((uint8_t *) msg->recs) + offset));
194194
}
195+
196+
void
197+
ipx_msg_ipfix_set_raw_size(ipx_msg_ipfix_t *msg, uint16_t new_raw_size)
198+
{
199+
msg->raw_size = new_raw_size;
200+
}

‎src/plugins/intermediate/CMakeLists.txt

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
11
# List of output plugin to build and install
2-
add_subdirectory(anonymization)
2+
add_subdirectory(anonymization)
3+
add_subdirectory(filter)

‎src/plugins/intermediate/filter/CMakeLists.txt

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
add_library(filter-intermediate MODULE
2+
msg_builder.h
3+
filter.c
4+
config.c
5+
config.h
6+
)
7+
8+
install(
9+
TARGETS filter-intermediate
10+
LIBRARY DESTINATION "${INSTALL_DIR_LIB}/ipfixcol2/"
11+
)
12+
13+
if (ENABLE_DOC_MANPAGE)
14+
# Build a manual page
15+
set(SRC_FILE "${CMAKE_CURRENT_SOURCE_DIR}/doc/ipfixcol2-filter-inter.7.rst")
16+
set(DST_FILE "${CMAKE_CURRENT_BINARY_DIR}/ipfixcol2-filter-inter.7")
17+
18+
add_custom_command(TARGET filter-intermediate PRE_BUILD
19+
COMMAND ${RST2MAN_EXECUTABLE} --syntax-highlight=none ${SRC_FILE} ${DST_FILE}
20+
DEPENDS ${SRC_FILE}
21+
VERBATIM
22+
)
23+
24+
install(
25+
FILES "${DST_FILE}"
26+
DESTINATION "${INSTALL_DIR_MAN}/man7"
27+
)
28+
endif()

‎src/plugins/intermediate/filter/README.rst

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
Filter (intermediate plugin)
2+
============================
3+
4+
The plugin performs filtering of flow records based on an filter expression.
5+
Flow records not matching the specified filtering criteria are discarded.
6+
7+
8+
Supported operations
9+
--------------------
10+
11+
- Comparison operators `==`, `<`, `>`, `<=`, `>=`, `!=`. If the comparison operator is ommited, the default comparison is `==`.
12+
13+
- The `contains` operator for substring comparison, e.g. `DNSName contains "example"`.
14+
15+
- Arithmetic operations `+`, `-`, `*`, `/`, `%`.
16+
17+
- Bitwise operations not `~`, or `|`, and `&`, xor `^`.
18+
19+
- The `in` operator for list comparison, e.g. `port in [80, 443]`.
20+
21+
- The logical `and`, `or`, `not` operators.
22+
23+
24+
Value types
25+
-----------
26+
27+
- Numbers can be integer or floating point. Integer numbers can also be written in their hexadecimal or binary form using the `0x` or `0b` prefix.
28+
Floating point numbers also support the exponential notation such as `1.2345e+2`. A number can be explicitly unsigned using the `u` suffix.
29+
Numbers also support size suffixes `B`, `k`, `M`, `G`, `T`, and time suffixes `ns`, `us`, `ms`, `s`, `m`, `d`.
30+
31+
- Strings are values enclosed in a pair of double quotes `"`. Supported escape sequences are `\n`, `\r`, `\t` and `\"`.
32+
The escape sequences to write characters using their octal or hexadecimal value are also supported, e.g. `\ux22` or `\042`.
33+
34+
- IP addresses are written in their usual format, e.g. `127.0.0.1` or `1234:5678:9abc:def1:2345:6789:abcd:ef12`. The shortened IPv6 version is also supported, e.g. `::ff`.
35+
IP addresses can also contain a suffix specifying their prefix length, e.g. `10.0.0.0/16`.
36+
37+
- MAC addresses are written in their usual format, e.g. `12:34:56:78:9a:bc`.
38+
39+
- Timestamps use the ISO timestamp format, e.g. `2020-04-05T24:00Z`.
40+
41+
42+
IPFIX field identificators
43+
--------------------------
44+
45+
IPFIX fields can be identified using their name specified in the IPFIX information elements table or their alias defined in the `aliases.xml` file.
46+
If the IPFIX name is used and the default iana table is being referred, the `iana:` prefix can be ommited.
47+
Note that one alias can point to multiple IPFIX information elements.
48+
The default location of the aliases file is `/etc/libfds/system/aliases.xml`.
49+
50+
51+
Value mappings
52+
--------------
53+
54+
Commonly used values can be mapped to a name using the `mappings.xml` file, for example the name `http` when used in an expression `port http` can refer to the value 80.
55+
These names can have different meanings depending on the IPFIX field they're being compared with.
56+
The default location of the mappings file is `/etc/libfds/system/mappings.xml`.
57+
58+
59+
Example configuration
60+
---------------------
61+
62+
.. code-block:: xml
63+
64+
<intermediate>
65+
<name>Filter</name>
66+
<plugin>filter</plugin>
67+
<params>
68+
<expr>ip 10.0.0.0/16 and port in [80, 8080]</expr>
69+
</params>
70+
</intermediate>
71+
72+
Parameters
73+
----------
74+
75+
:``expr``:
76+
The filter expression.

‎src/plugins/intermediate/filter/config.c

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
/**
2+
* \file src/plugins/intermediate/filter/config.c
3+
* \author Michal Sedlak <[email protected]>
4+
* \brief The filter plugin config
5+
* \date 2020
6+
*/
7+
8+
/* Copyright (C) 2020 CESNET, z.s.p.o.
9+
*
10+
* Redistribution and use in source and binary forms, with or without
11+
* modification, are permitted provided that the following conditions
12+
* are met:
13+
* 1. Redistributions of source code must retain the above copyright
14+
* notice, this list of conditions and the following disclaimer.
15+
* 2. Redistributions in binary form must reproduce the above copyright
16+
* notice, this list of conditions and the following disclaimer in
17+
* the documentation and/or other materials provided with the
18+
* distribution.
19+
* 3. Neither the name of the Company nor the names of its contributors
20+
* may be used to endorse or promote products derived from this
21+
* software without specific prior written permission.
22+
*
23+
* ALTERNATIVELY, provided that this notice is retained in full, this
24+
* product may be distributed under the terms of the GNU General Public
25+
* License (GPL) version 2 or later, in which case the provisions
26+
* of the GPL apply INSTEAD OF those given above.
27+
*
28+
* This software is provided ``as is'', and any express or implied
29+
* warranties, including, but not limited to, the implied warranties of
30+
* merchantability and fitness for a particular purpose are disclaimed.
31+
* In no event shall the company or contributors be liable for any
32+
* direct, indirect, incidental, special, exemplary, or consequential
33+
* damages (including, but not limited to, procurement of substitute
34+
* goods or services; loss of use, data, or profits; or business
35+
* interruption) however caused and on any theory of liability, whether
36+
* in contract, strict liability, or tort (including negligence or
37+
* otherwise) arising in any way out of the use of this software, even
38+
* if advised of the possibility of such damage.
39+
*
40+
*/
41+
42+
#include "config.h"
43+
44+
#include <string.h>
45+
#include <stdlib.h>
46+
47+
/*
48+
* <params>
49+
* <expr>...</expr>
50+
* </params>
51+
*/
52+
53+
enum params_xml_nodes {
54+
FILTER_EXPR = 1,
55+
};
56+
57+
static const struct fds_xml_args args_params[] = {
58+
FDS_OPTS_ROOT("params"),
59+
FDS_OPTS_ELEM(FILTER_EXPR, "expr", FDS_OPTS_T_STRING, 0),
60+
FDS_OPTS_END
61+
};
62+
63+
struct config *
64+
config_parse(ipx_ctx_t *ctx, const char *params)
65+
{
66+
struct config *cfg = NULL;
67+
fds_xml_t *parser = NULL;
68+
69+
cfg = calloc(1, sizeof(struct config));
70+
if (!cfg) {
71+
IPX_CTX_ERROR(ctx, "Memory allocation error (%s:%d)", __FILE__, __LINE__);
72+
goto error;
73+
}
74+
75+
parser = fds_xml_create();
76+
if (!parser) {
77+
IPX_CTX_ERROR(ctx, "Memory allocation error (%s:%d)", __FILE__, __LINE__);
78+
goto error;
79+
}
80+
81+
if (fds_xml_set_args(parser, args_params) != FDS_OK) {
82+
IPX_CTX_ERROR(ctx, "Failed to parse the description of an XML document!");
83+
goto error;
84+
}
85+
86+
fds_xml_ctx_t *params_ctx = fds_xml_parse_mem(parser, params, true);
87+
if (params_ctx == NULL) {
88+
IPX_CTX_ERROR(ctx, "Failed to parse the configuration: %s", fds_xml_last_err(parser));
89+
goto error;
90+
}
91+
92+
const struct fds_xml_cont *content;
93+
while (fds_xml_next(params_ctx, &content) == FDS_OK) {
94+
switch (content->id) {
95+
case FILTER_EXPR:
96+
assert(content->type == FDS_OPTS_T_STRING);
97+
if (strlen(content->ptr_string) == 0) {
98+
IPX_CTX_ERROR(ctx, "Filter expression is empty!");
99+
goto error;
100+
}
101+
cfg->expr = strdup(content->ptr_string);
102+
if (!cfg->expr) {
103+
IPX_CTX_ERROR(ctx, "Memory allocation error (%s:%d)", __FILE__, __LINE__);
104+
goto error;
105+
}
106+
break;
107+
}
108+
}
109+
110+
fds_xml_destroy(parser);
111+
return cfg;
112+
113+
error:
114+
fds_xml_destroy(parser);
115+
free(cfg);
116+
return NULL;
117+
}
118+
119+
void
120+
config_destroy(struct config *cfg)
121+
{
122+
free(cfg->expr);
123+
free(cfg);
124+
}

‎src/plugins/intermediate/filter/config.h

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
/**
2+
* \file src/plugins/intermediate/filter/config.h
3+
* \author Michal Sedlak <[email protected]>
4+
* \brief The filter plugin config header
5+
* \date 2020
6+
*/
7+
8+
/* Copyright (C) 2020 CESNET, z.s.p.o.
9+
*
10+
* Redistribution and use in source and binary forms, with or without
11+
* modification, are permitted provided that the following conditions
12+
* are met:
13+
* 1. Redistributions of source code must retain the above copyright
14+
* notice, this list of conditions and the following disclaimer.
15+
* 2. Redistributions in binary form must reproduce the above copyright
16+
* notice, this list of conditions and the following disclaimer in
17+
* the documentation and/or other materials provided with the
18+
* distribution.
19+
* 3. Neither the name of the Company nor the names of its contributors
20+
* may be used to endorse or promote products derived from this
21+
* software without specific prior written permission.
22+
*
23+
* ALTERNATIVELY, provided that this notice is retained in full, this
24+
* product may be distributed under the terms of the GNU General Public
25+
* License (GPL) version 2 or later, in which case the provisions
26+
* of the GPL apply INSTEAD OF those given above.
27+
*
28+
* This software is provided ``as is'', and any express or implied
29+
* warranties, including, but not limited to, the implied warranties of
30+
* merchantability and fitness for a particular purpose are disclaimed.
31+
* In no event shall the company or contributors be liable for any
32+
* direct, indirect, incidental, special, exemplary, or consequential
33+
* damages (including, but not limited to, procurement of substitute
34+
* goods or services; loss of use, data, or profits; or business
35+
* interruption) however caused and on any theory of liability, whether
36+
* in contract, strict liability, or tort (including negligence or
37+
* otherwise) arising in any way out of the use of this software, even
38+
* if advised of the possibility of such damage.
39+
*
40+
*/
41+
42+
#ifndef CONFIG_H
43+
#define CONFIG_H
44+
45+
#include <ipfixcol2.h>
46+
47+
struct config {
48+
char *expr;
49+
};
50+
51+
struct config *
52+
config_parse(ipx_ctx_t *ctx, const char *params);
53+
54+
void
55+
config_destroy(struct config *cfg);
56+
57+
#endif // CONFIG_H

‎src/plugins/intermediate/filter/doc/ipfixcol2-filter-inter.7.rst

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
========================
2+
ipfixcol2-filter-inter
3+
========================
4+
5+
-----------------------------------
6+
Filter (intermediate plugin)
7+
-----------------------------------
8+
9+
:Author: Michal Sedlák ([email protected])
10+
:Date: 2020-08-24
11+
:Copyright: Copyright © 2020 CESNET, z.s.p.o.
12+
:Version: 1.0
13+
:Manual section: 7
14+
:Manual group: IPFIXcol collector
15+
16+
Description
17+
-----------
18+
19+
.. include:: ../README.rst
20+
:start-line: 3

0 commit comments

Comments
 (0)