Skip to content

Commit cc305e5

Browse files
committed
Time Check: initial implementation of the plugin
1 parent d9c80bb commit cc305e5

File tree

7 files changed

+603
-0
lines changed

7 files changed

+603
-0
lines changed

src/plugins/output/CMakeLists.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# List of output plugin to build and install
22
add_subdirectory(dummy)
33
add_subdirectory(json)
4+
add_subdirectory(timecheck)
45
add_subdirectory(viewer)
Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Create a linkable module
2+
add_library(timecheck-output MODULE
3+
src/config.c
4+
src/config.h
5+
src/timecheck.c
6+
)
7+
8+
install(
9+
TARGETS timecheck-output
10+
LIBRARY DESTINATION "${INSTALL_DIR_LIB}/ipfixcol2/"
11+
)
12+
13+
if (ENABLE_DOC_MANPAGE)
14+
# Build a manual page
15+
set(SRC_FILE "${CMAKE_CURRENT_SOURCE_DIR}/doc/ipfixcol2-timecheck-output.7.rst")
16+
set(DST_FILE "${CMAKE_CURRENT_BINARY_DIR}/ipfixcol2-timecheck-output.7")
17+
18+
add_custom_command(TARGET timecheck-output PRE_BUILD
19+
COMMAND ${RST2MAN_EXECUTABLE} --syntax-highlight=none ${SRC_FILE} ${DST_FILE}
20+
DEPENDS ${SRC_FILE}
21+
VERBATIM
22+
)
23+
24+
install(
25+
FILES "${DST_FILE}"
26+
DESTINATION "${INSTALL_DIR_MAN}/man7"
27+
)
28+
endif()
Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
Time Check (output plugin)
2+
==========================
3+
4+
The plugin checks that start and end timestamps of each flow record are relatively recent.
5+
Based on configured parameters it reports flows with timestamps from the future (i.e. greater
6+
than the current system time) and timestamps from the distant past.
7+
8+
Timestamp anomalies are usually caused by missing clock synchronization (e.g. NTP) or invalid
9+
implementation on side of the exporter. If the anomaly is detected, the plugin will print
10+
details on the standard output.
11+
12+
Only following standard IANA timestamps are supported:
13+
14+
- ID 150 (flowStartSeconds)
15+
- ID 151 (flowEndSeconds)
16+
- ID 152 (flowStartMilliseconds)
17+
- ID 153 (flowEndMilliseconds)
18+
- ID 154 (flowStartMicroseconds)
19+
- ID 155 (flowEndMicroseconds)
20+
- ID 156 (flowStartNanoseconds)
21+
- ID 157 (flowEndNanoseconds)
22+
23+
Example configuration
24+
---------------------
25+
26+
.. code-block:: xml
27+
28+
<output>
29+
<name>TimeCheck output</name>
30+
<plugin>timecheck</plugin>
31+
<params>
32+
<devPast>600</devPast>
33+
<devFuture>0</devFuture>
34+
</params>
35+
</output>
36+
37+
Parameters
38+
----------
39+
40+
:``devPast``:
41+
Maximum allowed deviation between the current system time and timestamps from the past in
42+
seconds. The value must be greater than active and inactive timeouts of exporters and must also
43+
include a possible delay between expiration and processing on the collector.
44+
For example, let's say that active timeout and inactive timeout are 5 minutes and 30 seconds,
45+
respectively. Value 600 (i.e. 10 minutes) should be always enough for all flow data to be
46+
received and processed at the collector.
47+
48+
:``devFuture``:
49+
Maximum allowed deviation between the current time and timestamps from the future in seconds.
50+
The collector should never receive flows with timestamp from the future, therefore, the value
51+
should be usually set to 0.
Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
===========================
2+
ipfixcol2-timecheck-output
3+
===========================
4+
5+
--------------------------
6+
Time Check (output plugin)
7+
--------------------------
8+
9+
:Author: Lukáš Huták ([email protected])
10+
:Date: 2019-03-01
11+
:Copyright: Copyright © 2019 CESNET, z.s.p.o.
12+
:Version: 2.0
13+
:Manual section: 7
14+
:Manual group: IPFIXcol collector
15+
16+
Description
17+
-----------
18+
19+
.. include:: ../README.rst
20+
:start-line: 3
Lines changed: 188 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,188 @@
1+
/**
2+
* \file src/plugins/output/timecheck/src/config.c
3+
* \author Lukas Hutak <[email protected]>
4+
* \brief Parser of an XML configuration (source file)
5+
* \date 2019
6+
*/
7+
8+
/* Copyright (C) 2019 CESNET, z.s.p.o.
9+
*
10+
* Redistribution and use in source and binary forms, with or without
11+
* modification, are permitted provided that the following conditions
12+
* are met:
13+
* 1. Redistributions of source code must retain the above copyright
14+
* notice, this list of conditions and the following disclaimer.
15+
* 2. Redistributions in binary form must reproduce the above copyright
16+
* notice, this list of conditions and the following disclaimer in
17+
* the documentation and/or other materials provided with the
18+
* distribution.
19+
* 3. Neither the name of the Company nor the names of its contributors
20+
* may be used to endorse or promote products derived from this
21+
* software without specific prior written permission.
22+
*
23+
* ALTERNATIVELY, provided that this notice is retained in full, this
24+
* product may be distributed under the terms of the GNU General Public
25+
* License (GPL) version 2 or later, in which case the provisions
26+
* of the GPL apply INSTEAD OF those given above.
27+
*
28+
* This software is provided ``as is'', and any express or implied
29+
* warranties, including, but not limited to, the implied warranties of
30+
* merchantability and fitness for a particular purpose are disclaimed.
31+
* In no event shall the company or contributors be liable for any
32+
* direct, indirect, incidental, special, exemplary, or consequential
33+
* damages (including, but not limited to, procurement of substitute
34+
* goods or services; loss of use, data, or profits; or business
35+
* interruption) however caused and on any theory of liability, whether
36+
* in contract, strict liability, or tort (including negligence or
37+
* otherwise) arising in any way out of the use of this software, even
38+
* if advised of the possibility of such damage.
39+
*
40+
*/
41+
42+
#include <stdlib.h>
43+
#include <limits.h>
44+
#include "config.h"
45+
46+
/*
47+
* <params>
48+
* <delay>...</delay> <!-- in microseconds -->
49+
* </params>
50+
*/
51+
52+
/** XML nodes */
53+
enum params_xml_nodes {
54+
DEV_PAST = 1,
55+
DEV_FUTURE
56+
};
57+
58+
/** Definition of the \<params\> node */
59+
static const struct fds_xml_args args_params[] = {
60+
FDS_OPTS_ROOT("params"),
61+
FDS_OPTS_ELEM(DEV_PAST, "devPast", FDS_OPTS_T_UINT, 0),
62+
FDS_OPTS_ELEM(DEV_FUTURE, "devFuture", FDS_OPTS_T_UINT, FDS_OPTS_P_OPT),
63+
FDS_OPTS_END
64+
};
65+
66+
/**
67+
* \brief Process \<params\> node
68+
* \param[in] ctx Plugin context
69+
* \param[in] root XML context to process
70+
* \param[in] cfg Parsed configuration
71+
* \return #IPX_OK on success
72+
* \return #IPX_ERR_FORMAT in case of failure
73+
*/
74+
static int
75+
config_parser_root(ipx_ctx_t *ctx, fds_xml_ctx_t *root, struct instance_config *cfg)
76+
{
77+
(void) ctx;
78+
79+
const struct fds_xml_cont *content;
80+
while (fds_xml_next(root, &content) != FDS_EOC) {
81+
switch (content->id) {
82+
case DEV_PAST:
83+
assert(content->type == FDS_OPTS_T_UINT);
84+
cfg->dev_past = content->val_uint;
85+
break;
86+
case DEV_FUTURE:
87+
assert(content->type == FDS_OPTS_T_UINT);
88+
cfg->dev_future = content->val_uint;
89+
break;
90+
default:
91+
// Internal error
92+
assert(false);
93+
}
94+
}
95+
96+
return IPX_OK;
97+
}
98+
99+
/**
100+
* \brief Set default parameters of the configuration
101+
* \param[in] cfg Configuration
102+
*/
103+
static void
104+
config_default_set(struct instance_config *cfg)
105+
{
106+
cfg->dev_past = 0;
107+
cfg->dev_future = 0;
108+
}
109+
110+
/**
111+
* \brief Validate the parsed configuration
112+
* \param[in] ctx Plugin context
113+
* \param[in] cfg Configuration
114+
* \return #IPX_OK or #IPX_ERR_FORMAT
115+
*/
116+
static int
117+
config_validate(ipx_ctx_t *ctx, const struct instance_config *cfg)
118+
{
119+
if (cfg->dev_past == 0) {
120+
IPX_CTX_ERROR(ctx, "Maximum allowed deviation from current time and the timestamps "
121+
"from the past cannot be zero!", '\0');
122+
return IPX_ERR_FORMAT;
123+
}
124+
125+
if (cfg->dev_past < 300) {
126+
IPX_CTX_WARNING(ctx, "The configuration might cause many false warnings!");
127+
}
128+
129+
return IPX_OK;
130+
}
131+
132+
133+
struct instance_config *
134+
config_parse(ipx_ctx_t *ctx, const char *params)
135+
{
136+
struct instance_config *cfg = calloc(1, sizeof(*cfg));
137+
if (!cfg) {
138+
IPX_CTX_ERROR(ctx, "Memory allocation error (%s:%d)", __FILE__, __LINE__);
139+
return NULL;
140+
}
141+
142+
// Set default parameters
143+
config_default_set(cfg);
144+
145+
// Create an XML parser
146+
fds_xml_t *parser = fds_xml_create();
147+
if (!parser) {
148+
IPX_CTX_ERROR(ctx, "Memory allocation error (%s:%d)", __FILE__, __LINE__);
149+
free(cfg);
150+
return NULL;
151+
}
152+
153+
if (fds_xml_set_args(parser, args_params) != FDS_OK) {
154+
IPX_CTX_ERROR(ctx, "Failed to parse the description of an XML document!", '\0');
155+
fds_xml_destroy(parser);
156+
free(cfg);
157+
return NULL;
158+
}
159+
160+
fds_xml_ctx_t *params_ctx = fds_xml_parse_mem(parser, params, true);
161+
if (params_ctx == NULL) {
162+
IPX_CTX_ERROR(ctx, "Failed to parse the configuration: %s", fds_xml_last_err(parser));
163+
fds_xml_destroy(parser);
164+
free(cfg);
165+
return NULL;
166+
}
167+
168+
// Parse parameters
169+
int rc = config_parser_root(ctx, params_ctx, cfg);
170+
fds_xml_destroy(parser);
171+
if (rc != IPX_OK) {
172+
free(cfg);
173+
return NULL;
174+
}
175+
176+
if (config_validate(ctx, cfg) != IPX_OK) {
177+
free(cfg);
178+
return NULL;
179+
}
180+
181+
return cfg;
182+
}
183+
184+
void
185+
config_destroy(struct instance_config *cfg)
186+
{
187+
free(cfg);
188+
}
Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
/**
2+
* \file src/plugins/output/timecheck/src/config.h
3+
* \author Lukas Hutak <[email protected]>
4+
* \brief Parser of an XML configuration (header file)
5+
* \date 2019
6+
*/
7+
8+
/* Copyright (C) 2019 CESNET, z.s.p.o.
9+
*
10+
* Redistribution and use in source and binary forms, with or without
11+
* modification, are permitted provided that the following conditions
12+
* are met:
13+
* 1. Redistributions of source code must retain the above copyright
14+
* notice, this list of conditions and the following disclaimer.
15+
* 2. Redistributions in binary form must reproduce the above copyright
16+
* notice, this list of conditions and the following disclaimer in
17+
* the documentation and/or other materials provided with the
18+
* distribution.
19+
* 3. Neither the name of the Company nor the names of its contributors
20+
* may be used to endorse or promote products derived from this
21+
* software without specific prior written permission.
22+
*
23+
* ALTERNATIVELY, provided that this notice is retained in full, this
24+
* product may be distributed under the terms of the GNU General Public
25+
* License (GPL) version 2 or later, in which case the provisions
26+
* of the GPL apply INSTEAD OF those given above.
27+
*
28+
* This software is provided ``as is'', and any express or implied
29+
* warranties, including, but not limited to, the implied warranties of
30+
* merchantability and fitness for a particular purpose are disclaimed.
31+
* In no event shall the company or contributors be liable for any
32+
* direct, indirect, incidental, special, exemplary, or consequential
33+
* damages (including, but not limited to, procurement of substitute
34+
* goods or services; loss of use, data, or profits; or business
35+
* interruption) however caused and on any theory of liability, whether
36+
* in contract, strict liability, or tort (including negligence or
37+
* otherwise) arising in any way out of the use of this software, even
38+
* if advised of the possibility of such damage.
39+
*
40+
*/
41+
42+
#ifndef CONFIG_H
43+
#define CONFIG_H
44+
45+
#include <ipfixcol2.h>
46+
#include "stdint.h"
47+
48+
/** Configuration of a instance of the plugin */
49+
struct instance_config {
50+
/** Maximum allowed deviation between the current time and timestamps from the past (sec) */
51+
uint64_t dev_past;
52+
/** Maximum allowed deviation between the current time and timestamps from the future (sec) */
53+
uint64_t dev_future;
54+
};
55+
56+
/**
57+
* \brief Parse configuration of the plugin
58+
* \param[in] ctx Instance context
59+
* \param[in] params XML parameters
60+
* \return Pointer to the parse configuration of the instance on success
61+
* \return NULL if arguments are not valid or if a memory allocation error has occurred
62+
*/
63+
struct instance_config *
64+
config_parse(ipx_ctx_t *ctx, const char *params);
65+
66+
/**
67+
* \brief Destroy parsed configuration
68+
* \param[in] cfg Parsed configuration
69+
*/
70+
void
71+
config_destroy(struct instance_config *cfg);
72+
73+
#endif // CONFIG_H

0 commit comments

Comments
 (0)