Merge pull request #182 from CESNET/mpls-plugin

Mpls plugin

Author: SiskaPavel

Makefile.am

@@ -134,7 +134,9 @@ ipfixprobe_process_src=\
 		process/nettisa.hpp \
 		process/nettisa.cpp \
 		process/flow_hash.hpp \
-		process/flow_hash.cpp
+		process/flow_hash.cpp \
+		process/mpls.hpp \
+		process/mpls.cpp
 
 if WITH_QUIC
 ipfixprobe_process_src+=\

README.md

@@ -651,6 +651,14 @@ List of fields exported together with basic flow fields on interface by flow_has
 |:------------------:|:------:|:---------------------------------:|
 | FLOW_ID            | uint64 | Hash of the flow - unique flow id |
 
+### MPLS
+
+List of fields exported together with basic flow fields on interface by mpls plugin.
+
+| Output field                 | Type  | Description                                      |
+|:----------------------------:|:-----:|:------------------------------------------------:|
+| MPLS_TOP_LABEL_STACK_SECTION | bytes | MPLS label section (without TTL), always 3 bytes |
+
 ## Simplified function diagram
 Diagram below shows how `ipfixprobe` works.
 

include/ipfixprobe/ipfix-elements.hpp

@@ -277,6 +277,8 @@ namespace ipxp {
 #define NTS_TIME_DISTRIBUTION(F)      F(8057,    1031,  4,    nullptr)
 #define NTS_SWITCHING_RATIO(F)        F(8057,    1032,  4,    nullptr)
 
+#define MPLS_TOP_LABEL_STACK_SECTION  F(0,         70,  -1,    nullptr)
+
 
 /**
  * IPFIX Templates - list of elements
@@ -534,6 +536,9 @@ namespace ipxp {
 #define IPFIX_FLOW_HASH_TEMPLATE(F) \
    F(FLOW_ID)
 
+#define IPFIX_MPLS_TEMPLATE(F) \
+   F(MPLS_TOP_LABEL_STACK_SECTION)
+
 #ifdef WITH_FLEXPROBE
 #define IPFIX_FLEXPROBE_DATA_TEMPLATE(F) F(FX_FRAME_SIGNATURE) F(FX_INPUT_INTERFACE)
 #define IPFIX_FLEXPROBE_TCP_TEMPLATE(F) F(FX_TCP_TRACKING)

include/ipfixprobe/packet.hpp

@@ -70,6 +70,17 @@ struct Packet : public Record {
    uint32_t    tcp_seq;
    uint32_t    tcp_ack;
 
+   /**
+    * @brief The top level mpls
+    *
+    * Contents are (from MSb to LSb):
+    *   20-bit - Label,
+    *   3-bit  - Traffic class / EXP,
+    *   1-bit  - Bottom of stack (true if last),
+    *   8-bit  - TTL (Time To Live)
+    */
+   uint32_t    mplsTop;
+
    const uint8_t *packet; /**< Pointer to begin of packet, if available */
    uint16_t    packet_len; /**< Length of data in packet buffer, packet_len <= packet_len_wire */
    uint16_t    packet_len_wire; /**< Original packet length on wire */
@@ -96,7 +107,7 @@ struct Packet : public Record {
       ip_len(0), ip_payload_len(0), ip_version(0), ip_ttl(0),
       ip_proto(0), ip_tos(0), ip_flags(0), src_ip({0}), dst_ip({0}), vlan_id(0),
       src_port(0), dst_port(0), tcp_flags(0), tcp_window(0),
-      tcp_options(0), tcp_mss(0), tcp_seq(0), tcp_ack(0),
+      tcp_options(0), tcp_mss(0), tcp_seq(0), tcp_ack(0), mplsTop(0),
       packet(nullptr), packet_len(0), packet_len_wire(0),
       payload(nullptr), payload_len(0), payload_len_wire(0),
       custom(nullptr), custom_len(0),

input/parser.cpp

@@ -568,6 +568,7 @@ uint16_t process_mpls_stack(const u_char *data_ptr, uint16_t data_len)
 uint16_t process_mpls(const u_char *data_ptr, uint16_t data_len, Packet *pkt)
 {
    Packet tmp;
+   pkt->mplsTop = ntohl(*reinterpret_cast<const uint32_t *>(data_ptr));
    uint16_t length = process_mpls_stack(data_ptr, data_len);
    uint8_t next_hdr = (*(data_ptr + length) & 0xF0) >> 4;
 
@@ -656,6 +657,7 @@ void parse_packet(parser_opt_t *opt, struct timeval ts, const uint8_t *data, uin
    pkt->tcp_window = 0;
    pkt->tcp_options = 0;
    pkt->tcp_mss = 0;
+   pkt->mplsTop = 0;
 
    uint32_t l3_hdr_offset = 0;
    uint32_t l4_hdr_offset = 0;

process/mpls.cpp

@@ -0,0 +1,63 @@
+/**
+ * \file mpls.cpp
+ * \brief Plugin for parsing mpls traffic.
+ * \author Jakub Antonín Štigler [email protected]
+ * \date 2023
+ */
+/*
+ * Copyright (C) 2023 CESNET
+ *
+ * LICENSE TERMS
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of the Company nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ *
+ *
+ */
+
+#include <iostream>
+
+#include "mpls.hpp"
+
+namespace ipxp {
+
+int RecordExtMPLS::REGISTERED_ID = -1;
+
+__attribute__((constructor)) static void register_this_plugin()
+{
+   static PluginRecord rec = PluginRecord("mpls", [](){return new MPLSPlugin();});
+   register_plugin(&rec);
+   RecordExtMPLS::REGISTERED_ID = register_extension();
+}
+
+ProcessPlugin *MPLSPlugin::copy()
+{
+   return new MPLSPlugin(*this);
+}
+
+int MPLSPlugin::post_create(Flow &rec, const Packet &pkt)
+{
+   if (pkt.mplsTop == 0) {
+      return 0;
+   }
+
+   auto ext = new RecordExtMPLS();
+   ext->mpls = pkt.mplsTop;
+
+   rec.add_extension(ext);
+   return 0;
+}
+
+}
+

process/mpls.hpp

@@ -0,0 +1,131 @@
+/**
+ * \file mpls.hpp
+ * \brief Plugin for parsing mpls traffic.
+ * \author Jakub Antonín Štigler [email protected]
+ * \date 2023
+ */
+/*
+ * Copyright (C) 2023 CESNET
+ *
+ * LICENSE TERMS
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of the Company nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ *
+ *
+ */
+
+#ifndef IPXP_PROCESS_MPLS_HPP
+#define IPXP_PROCESS_MPLS_HPP
+
+#include <cstring>
+#include <string>
+#include <sstream>
+
+#ifdef WITH_NEMEA
+  #include "fields.h"
+#endif
+
+#include <ipfixprobe/process.hpp>
+#include <ipfixprobe/flowifc.hpp>
+#include <ipfixprobe/packet.hpp>
+#include <ipfixprobe/ipfix-elements.hpp>
+
+namespace ipxp {
+
+#define MPLS_LABEL_SECTION_LENGTH 3
+
+#define MPLS_UNIREC_TEMPLATE "MPLS_TOP_LABEL_STACK_SECTION"
+
+UR_FIELDS (
+   bytes MPLS_TOP_LABEL_STACK_SECTION
+)
+
+/**
+ * \brief Flow record extension header for storing parsed MPLS data.
+ */
+struct RecordExtMPLS : public RecordExt {
+   static int REGISTERED_ID;
+
+   // Contents are (from MSb to LSb):
+   //   20-bit - Label,
+   //   3-bit  - Traffic class / EXP,
+   //   1-bit  - Bottom of stack (true if last),
+   //   8-bit  - TTL (Time To Live)
+   uint32_t mpls;
+
+   RecordExtMPLS() : RecordExt(REGISTERED_ID), mpls(0) { }
+
+#ifdef WITH_NEMEA
+   void fill_unirec(ur_template_t *tmplt, void *record) override
+   {
+      auto v = htonl(mpls);
+      auto arr = reinterpret_cast<uint8_t *>(&v);
+      ur_set_var(tmplt, record, F_MPLS_TOP_LABEL_STACK_SECTION, arr, MPLS_LABEL_SECTION_LENGTH);
+   }
+
+   const char *get_unirec_tmplt() const
+   {
+      return MPLS_UNIREC_TEMPLATE;
+   }
+#endif
+
+   int fill_ipfix(uint8_t *buffer, int size) override
+   {
+      if (size < MPLS_LABEL_SECTION_LENGTH + 1) {
+         return -1;
+      }
+
+      buffer[0] = MPLS_LABEL_SECTION_LENGTH;
+      auto v = htonl(mpls);
+      auto arr = reinterpret_cast<uint8_t *>(&v);
+      memcpy(buffer + 2, arr, MPLS_LABEL_SECTION_LENGTH);
+
+      return MPLS_LABEL_SECTION_LENGTH + 1;
+   }
+
+   const char **get_ipfix_tmplt() const
+   {
+      static const char *ipfix_template[] = {
+         IPFIX_MPLS_TEMPLATE(IPFIX_FIELD_NAMES)
+         NULL
+      };
+      return ipfix_template;
+   }
+
+   std::string get_text() const
+   {
+      std::ostringstream out;
+      out << "mpls_label_1=\"" << (mpls >> 8) << '"';
+      return out.str();
+   }
+};
+
+/**
+ * \brief Process plugin for parsing MPLS packets.
+ */
+class MPLSPlugin : public ProcessPlugin
+{
+public:
+   OptionsParser *get_parser() const { return new OptionsParser("mpls", "Parse MPLS traffic"); }
+   std::string get_name() const { return "mpls"; }
+   RecordExt *get_ext() const { return new RecordExtMPLS(); }
+   ProcessPlugin *copy();
+
+   int post_create(Flow &rec, const Packet &pkt);
+};
+
+}
+#endif /* IPXP_PROCESS_MPLS_HPP */
+