|
| 1 | +/** |
| 2 | + * \file icmp.hpp |
| 3 | + * \brief Plugin for parsing icmp traffic. |
| 4 | + * \author Jakub Antonín Štigler xstigl00@[email protected] |
| 5 | + * \date 2023 |
| 6 | + */ |
| 7 | +/* |
| 8 | + * Copyright (C) 2023 CESNET |
| 9 | + * |
| 10 | + * LICENSE TERMS |
| 11 | + * |
| 12 | + * Redistribution and use in source and binary forms, with or without |
| 13 | + * modification, are permitted provided that the following conditions |
| 14 | + * are met: |
| 15 | + * 1. Redistributions of source code must retain the above copyright |
| 16 | + * notice, this list of conditions and the following disclaimer. |
| 17 | + * 2. Redistributions in binary form must reproduce the above copyright |
| 18 | + * notice, this list of conditions and the following disclaimer in |
| 19 | + * the documentation and/or other materials provided with the |
| 20 | + * distribution. |
| 21 | + * 3. Neither the name of the Company nor the names of its contributors |
| 22 | + * may be used to endorse or promote products derived from this |
| 23 | + * software without specific prior written permission. |
| 24 | + * |
| 25 | + * ALTERNATIVELY, provided that this notice is retained in full, this |
| 26 | + * product may be distributed under the terms of the GNU General Public |
| 27 | + * License (GPL) version 2 or later, in which case the provisions |
| 28 | + * of the GPL apply INSTEAD OF those given above. |
| 29 | + * |
| 30 | + * This software is provided as is'', and any express or implied |
| 31 | + * warranties, including, but not limited to, the implied warranties of |
| 32 | + * merchantability and fitness for a particular purpose are disclaimed. |
| 33 | + * In no event shall the company or contributors be liable for any |
| 34 | + * direct, indirect, incidental, special, exemplary, or consequential |
| 35 | + * damages (including, but not limited to, procurement of substitute |
| 36 | + * goods or services; loss of use, data, or profits; or business |
| 37 | + * interruption) however caused and on any theory of liability, whether |
| 38 | + * in contract, strict liability, or tort (including negligence or |
| 39 | + * otherwise) arising in any way out of the use of this software, even |
| 40 | + * if advised of the possibility of such damage. |
| 41 | + * |
| 42 | + */ |
| 43 | + |
| 44 | +#ifndef IPXP_PROCESS_ICMP_HPP |
| 45 | +#define IPXP_PROCESS_ICMP_HPP |
| 46 | + |
| 47 | +#include <cstring> |
| 48 | + |
| 49 | +#ifdef WITH_NEMEA |
| 50 | + #include "fields.h" |
| 51 | +#endif |
| 52 | + |
| 53 | +#include <sstream> |
| 54 | + |
| 55 | +#include <ipfixprobe/utils.hpp> |
| 56 | + |
| 57 | +#include <ipfixprobe/process.hpp> |
| 58 | +#include <ipfixprobe/flowifc.hpp> |
| 59 | +#include <ipfixprobe/packet.hpp> |
| 60 | +#include <ipfixprobe/ipfix-elements.hpp> |
| 61 | + |
| 62 | +namespace ipxp { |
| 63 | + |
| 64 | +#define ICMP_UNIREC_TEMPLATE "L4_ICMP_TYPE_CODE" |
| 65 | + |
| 66 | +UR_FIELDS ( |
| 67 | + uint16 L4_ICMP_TYPE_CODE |
| 68 | +) |
| 69 | + |
| 70 | +/** |
| 71 | + * \brief Flow record extension header for storing parsed ICMP data. |
| 72 | + */ |
| 73 | +struct RecordExtICMP : public RecordExt { |
| 74 | + static int REGISTERED_ID; |
| 75 | + |
| 76 | + uint16_t type_code; |
| 77 | + |
| 78 | + RecordExtICMP() : RecordExt(REGISTERED_ID) |
| 79 | + { |
| 80 | + type_code = 0; |
| 81 | + } |
| 82 | + |
| 83 | +#ifdef WITH_NEMEA |
| 84 | + virtual void fill_unirec(ur_template_t *tmplt, void *record) |
| 85 | + { |
| 86 | + ur_set(tmplt, record, F_L4_ICMP_TYPE_CODE, type_code); |
| 87 | + } |
| 88 | + |
| 89 | + const char *get_unirec_tmplt() const |
| 90 | + { |
| 91 | + return ICMP_UNIREC_TEMPLATE; |
| 92 | + } |
| 93 | +#endif |
| 94 | + |
| 95 | + virtual int fill_ipfix(uint8_t *buffer, int size) |
| 96 | + { |
| 97 | + const int LEN = 2; |
| 98 | + |
| 99 | + if (size < LEN) { |
| 100 | + return -1; |
| 101 | + } |
| 102 | + |
| 103 | + *reinterpret_cast<uint16_t *>(buffer) = ntohs(type_code); |
| 104 | + |
| 105 | + return LEN; |
| 106 | + } |
| 107 | + |
| 108 | + const char **get_ipfix_tmplt() const |
| 109 | + { |
| 110 | + static const char *ipfix_template[] = { |
| 111 | + IPFIX_ICMP_TEMPLATE(IPFIX_FIELD_NAMES) |
| 112 | + NULL |
| 113 | + }; |
| 114 | + return ipfix_template; |
| 115 | + } |
| 116 | + |
| 117 | + std::string get_text() const |
| 118 | + { |
| 119 | + // type is on the first byte, code is on the second byte |
| 120 | + auto *type_code = reinterpret_cast<const uint8_t *>(&this->type_code); |
| 121 | + |
| 122 | + std::ostringstream out; |
| 123 | + out << "type=\"" << static_cast<int>(type_code[0]) << '"' |
| 124 | + << ",code=\"" << static_cast<int>(type_code[1]) << '"'; |
| 125 | + |
| 126 | + return out.str(); |
| 127 | + } |
| 128 | +}; |
| 129 | + |
| 130 | +/** |
| 131 | + * \brief Process plugin for parsing ICMP packets. |
| 132 | + */ |
| 133 | +class ICMPPlugin : public ProcessPlugin |
| 134 | +{ |
| 135 | +public: |
| 136 | + OptionsParser *get_parser() const { return new OptionsParser("icmp", "Parse ICMP traffic"); } |
| 137 | + std::string get_name() const { return "icmp"; } |
| 138 | + RecordExt *get_ext() const { return new RecordExtICMP(); } |
| 139 | + ProcessPlugin *copy(); |
| 140 | + |
| 141 | + int post_create(Flow &rec, const Packet &pkt); |
| 142 | +}; |
| 143 | + |
| 144 | +} |
| 145 | +#endif /* IPXP_PROCESS_ICMP_HPP */ |
| 146 | + |
0 commit comments