Skip to content

Commit 915d0fe

Browse files
Zainullin DamirZainullin Damir
authored andcommitted
++
1 parent 969b3bc commit 915d0fe

File tree

11 files changed

+253
-189
lines changed

11 files changed

+253
-189
lines changed

src/plugins/process/bstats/README.md

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,14 @@ The **BurstStats Plugin** extends flow records with burst packet statistics to p
1111

1212
| Field Name | Data Type | Description |
1313
|-----------------|-----------|-------------------------------------------------------------|
14-
| `SBI_BRST_PACKETS`| `uint32_t` | Array of packet counts in each burst (source -> destination) |
15-
| `SBI_BRST_BYTES` | `uint32_t` | Array of bytes in each burst in source-to-destination direction |
16-
| `SBI_BRST_TIME_START` | `Timestamp` | Array of burst start times in source-to-destination direction |
17-
| `SBI_BRST_TIME_STOP` | `Timestamp` | Array of burst end times in source-to-destination direction |
18-
| `DBI_BRST_PACKETS`| `uint32_t` | Array of packets in each burst in destination-to-source direction |
19-
| `DBI_BRST_BYTES` | `uint32_t` | Array of bytes in each burst in destination-to-source direction |
20-
| `DBI_BRST_TIME_START` | `Timestamp` | Array of burst start times in destination-to-source direction |
21-
| `DBI_BRST_TIME_STOP` | `Timestamp` | Array of burst end times in destination-to-source direction |
14+
| `SBI_BRST_PACKETS`| `uint32_t` | Array of packet counts in each burst (source destination) |
15+
| `SBI_BRST_BYTES` | `uint32_t` | Array of bytes in each burst (source → destination) |
16+
| `SBI_BRST_TIME_START` | `Timestamp` | Array of burst start times (source → destination) |
17+
| `SBI_BRST_TIME_STOP` | `Timestamp` | Array of burst end times (source → destination) |
18+
| `DBI_BRST_PACKETS`| `uint32_t` | Array of packets in each burst (destination → source) |
19+
| `DBI_BRST_BYTES` | `uint32_t` | Array of bytes in each burst (destination → source) |
20+
| `DBI_BRST_TIME_START` | `Timestamp` | Array of burst start times (destination → source) |
21+
| `DBI_BRST_TIME_STOP` | `Timestamp` | Array of burst end times (destination → source) |
2222

2323
## Usage
2424

src/plugins/process/dns/README.md

Lines changed: 26 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,41 @@
11
# DNS Plugin
22

3-
The **DNS Plugin** is a module for the IPFIXprobe exporter, designed to analyze DNS traffic.
3+
The **DNS Plugin** extends flow records with DNS query and response information.
44

55
## Features
66

7-
- Extends basic flow export data.
8-
- Extracts and exports additional fields from network flows.
9-
7+
- Immediately removes flow if DNS query or response has been parsed.
8+
- Extracts and exports DNS fields if flow contains DNS information.
109

1110
## Output Fields
1211

1312
| Field Name | Data Type | Description |
14-
|-----------------|-----------|-------------------------------------------------------------|
15-
| IP_TTL | uint8_t | IP time-to-live in source-to-destination direction |
16-
| IP_TTL_REV | uint8_t | IP time-to-live in destination-to-source direction |
17-
| IP_FLG | uint8_t | IP flags in source-to-destination direction |
18-
| IP_FLG_REV | uint8_t | IP flags in destination-to-source direction |
19-
| TCP_WIN | uint16_t | TCP window size in source-to-destination direction |
20-
| TCP_WIN_REV | uint16_t | TCP window size in destination-to-source direction |
21-
| TCP_OPT | uint64_t | TCP options in source-to-destination direction |
22-
| TCP_OPT_REV | uint64_t | TCP options in destination-to-source direction |
23-
| TCP_MSS | uint32_t | TCP maximum segment size in source-to-destination direction |
24-
| TCP_MSS_REV | uint32_t | TCP maximum segment size in destination-to-source direction |
25-
| TCP_SYN_SIZE | uint16_t | TCP syn packet size (only one in bidirectional flow) |
13+
|-----------------|-----------|----------------------------------------|
14+
| `DNS_ID`| `uint16_t` | Unique identifier of the processed DNS query |
15+
| `DNS_ANSWERS`| `uint16_t` | Number of answers in the processed DNS response |
16+
| `DNS_RCODE`| `uint8_t` | Response code of the processed DNS response |
17+
| `DNS_QTYPE`| `uint16_t` | Type of the DNS query |
18+
| `DNS_CLASS`| `uint16_t` | Class of the DNS query |
19+
| `DNS_NAME`| `string` | Domain name in the DNS query |
20+
| `DNS_RR_TTL`| `uint32_t` | Time-to-live of the first DNS response |
21+
| `DNS_RLENGTH`| `uint16_t` | Length of the first DNS response |
22+
| `DNS_RDATA`| `bytes` | Data of the first DNS response |
23+
| `DNS_PSIZE`| `uint16_t` | Length of the first DNS additional record from response |
24+
| `DNS_DO`| `uint8_t` | DNSSEC OK flag of the first DNS additional record from response |
2625

2726
## Usage
2827

29-
Once enabled, the plugin will automatically process flows and add the export fields to each record.
28+
### YAML Configuration
29+
30+
Add the plugin to your ipfixprobe YAML configuration:
31+
32+
```yaml
33+
process_plugins:
34+
- dns
35+
```
3036
31-
1. ``` make install ```.
32-
2. ``` ipfixprobe -p "basicplus" ... " ```
33-
3. Extracted values are exported to the output interface.
37+
### CLI Usage
3438
35-
## Support
39+
You can also enable the plugin directly from the command line:
3640
37-
For issues or feature requests, please open an issue in the [IPFIXprobe repository](https://github.com/CESNET/ipfixprobe).
41+
```ipfixprobe -p dns ...```
Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# DNSSD Plugin
2+
3+
The **DNSSD Plugin** extends flow records with DNS-SD (DNS Service Discovery) query and response information.
4+
5+
## Features
6+
7+
- Extracts and exports DNS-SD fields if flow contains DNS-SD information.
8+
9+
## Parameters
10+
11+
| Long name | Short name | Type | Default | Description |
12+
|-----------|------------|--------|---------|-------------------------------------------------------------|
13+
| `txt` | `t` | `Path to file` | **Disabled** | If no file provided, processes all DNSSD TXT records. If a file is provided, only processes TXT records listed in the file. Whitelist format is `service.domain,txt_key1,txt_key2,...` |
14+
15+
## Output Fields
16+
17+
| Field Name | Data Type | Description |
18+
|-----------------|-----------|----------------------------------------|
19+
| `DNS_ID`| `uint16_t` | Unique identifier of the processed DNS query |
20+
| `DNS_ANSWERS`| `uint16_t` | Number of answers in the processed DNS response |
21+
| `DNS_RCODE`| `uint8_t` | Response code of the processed DNS response |
22+
| `DNS_QTYPE`| `uint16_t` | Type of the DNS query |
23+
| `DNS_CLASS`| `uint16_t` | Class of the DNS query |
24+
| `DNS_NAME`| `string` | Domain name in the DNS query |
25+
| `DNS_RR_TTL`| `uint32_t` | Time-to-live of the first DNS response |
26+
| `DNS_RLENGTH`| `uint16_t` | Length of the first DNS response |
27+
| `DNS_RDATA`| `bytes` | Data of the first DNS response |
28+
| `DNS_PSIZE`| `uint16_t` | Length of the first DNS additional record from response |
29+
| `DNS_DO`| `uint8_t` | DNSSEC OK flag of the first DNS additional record from response |
30+
31+
## Usage
32+
33+
### YAML Configuration
34+
35+
Add the plugin to your ipfixprobe YAML configuration:
36+
37+
```yaml
38+
process_plugins:
39+
- dns
40+
```
41+
42+
### CLI Usage
43+
44+
You can also enable the plugin directly from the command line:
45+
46+
```ipfixprobe -p dns ...```

src/plugins/process/dnssd/src/dnssd.cpp

Lines changed: 54 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -14,24 +14,20 @@
1414

1515
#include "dnssd.hpp"
1616

17-
#include <iostream>
17+
#include "dnssdOptionsParser.hpp"
1818

19-
#include <ipfixprobe/pluginFactory/pluginManifest.hpp>
20-
#include <ipfixprobe/pluginFactory/pluginRegistrar.hpp>
19+
#include <iostream>
2120

22-
//#include <pluginManifest.hpp>
23-
//#include <pluginRegistrar.hpp>
24-
//#include <pluginFactory.hpp>
21+
#include <dnsParser/dnsParser.hpp>
22+
#include <dnsParser/dnsQueryType.hpp>
2523
#include <fieldGroup.hpp>
2624
#include <fieldManager.hpp>
25+
#include <ipfixprobe/pluginFactory/pluginManifest.hpp>
26+
#include <ipfixprobe/pluginFactory/pluginRegistrar.hpp>
2727
#include <utils.hpp>
28-
#include <dnsParser/dnsParser.hpp>
29-
#include <dnsParser/dnsQueryType.hpp>
30-
#include <utils/stringViewUtils.hpp>
31-
#include <utils/stringUtils.hpp>
3228
#include <utils/spanUtils.hpp>
33-
34-
#include "dnssdOptionsParser.hpp"
29+
#include <utils/stringUtils.hpp>
30+
#include <utils/stringViewUtils.hpp>
3531

3632
namespace ipxp {
3733

@@ -47,31 +43,35 @@ static const PluginManifest dnssdPluginManifest = {
4743
},
4844
};
4945

50-
static FieldGroup createDNSSDSchema(FieldManager& fieldManager, FieldHandlers<DNSSDFields>& handlers)
46+
static FieldGroup
47+
createDNSSDSchema(FieldManager& fieldManager, FieldHandlers<DNSSDFields>& handlers)
5148
{
5249
FieldGroup schema = fieldManager.createFieldGroup("dnssd");
5350

54-
handlers.insert(DNSSDFields::DNSSD_QUERIES, schema.addScalarField("DNSSD_QUERIES", [](const void* context) {
55-
return toStringView(static_cast<const DNSSDData*>(context)->queries);
56-
}));
51+
handlers.insert(
52+
DNSSDFields::DNSSD_QUERIES,
53+
schema.addScalarField("DNSSD_QUERIES", [](const void* context) {
54+
return toStringView(static_cast<const DNSSDData*>(context)->queries);
55+
}));
5756

58-
handlers.insert(DNSSDFields::DNSSD_RESPONSES, schema.addScalarField("DNSSD_RESPONSES", [](const void* context) {
59-
return toStringView(static_cast<const DNSSDData*>(context)->responses);
60-
}));
57+
handlers.insert(
58+
DNSSDFields::DNSSD_RESPONSES,
59+
schema.addScalarField("DNSSD_RESPONSES", [](const void* context) {
60+
return toStringView(static_cast<const DNSSDData*>(context)->responses);
61+
}));
6162

6263
return schema;
6364
}
6465

65-
DNSSDPlugin::DNSSDPlugin([[maybe_unused]]const std::string& params, FieldManager& manager)
66+
DNSSDPlugin::DNSSDPlugin([[maybe_unused]] const std::string& params, FieldManager& manager)
6667
{
6768
createDNSSDSchema(manager, m_fieldHandlers);
6869
}
6970

7071
PluginInitResult DNSSDPlugin::onInit(const FlowContext& flowContext, void* pluginContext)
7172
{
7273
constexpr uint16_t DNSSD_PORT = 5353;
73-
if (flowContext.packet.src_port != DNSSD_PORT &&
74-
flowContext.packet.dst_port != DNSSD_PORT) {
74+
if (flowContext.packet.src_port != DNSSD_PORT && flowContext.packet.dst_port != DNSSD_PORT) {
7575
return {
7676
.constructionState = ConstructionState::NotConstructed,
7777
.updateRequirement = UpdateRequirement::NoUpdateNeeded,
@@ -83,7 +83,10 @@ PluginInitResult DNSSDPlugin::onInit(const FlowContext& flowContext, void* plugi
8383
// TODO USE VALUES FROM DISSECTOR
8484
constexpr std::size_t TCP = 6;
8585
const bool isDNSoverTCP = (flowContext.packet.ip_proto == TCP);
86-
if (!parseDNSSD(toSpan<const std::byte>(flowContext.packet.payload, flowContext.packet.payload_len), isDNSoverTCP, *pluginData)) {
86+
if (!parseDNSSD(
87+
toSpan<const std::byte>(flowContext.packet.payload, flowContext.packet.payload_len),
88+
isDNSoverTCP,
89+
*pluginData)) {
8790
return {
8891
.constructionState = ConstructionState::Constructed,
8992
.updateRequirement = UpdateRequirement::NoUpdateNeeded,
@@ -104,7 +107,10 @@ PluginUpdateResult DNSSDPlugin::onUpdate(const FlowContext& flowContext, void* p
104107
// TODO USE VALUES FROM DISSECTOR
105108
constexpr std::size_t TCP = 6;
106109
const bool isDNSoverTCP = (flowContext.packet.ip_proto == TCP);
107-
if (!parseDNSSD(toSpan<const std::byte>(flowContext.packet.payload, flowContext.packet.payload_len), isDNSoverTCP, *pluginData)) {
110+
if (!parseDNSSD(
111+
toSpan<const std::byte>(flowContext.packet.payload, flowContext.packet.payload_len),
112+
isDNSoverTCP,
113+
*pluginData)) {
108114
return {
109115
.updateRequirement = UpdateRequirement::NoUpdateNeeded,
110116
.flowAction = FlowAction::RemovePlugin,
@@ -133,7 +139,7 @@ bool DNSSDPlugin::parseAnswer(const DNSRecord& answer, DNSSDData& pluginData) no
133139
return true;
134140
}
135141

136-
DNSSDRecord& record = pluginData.findOrInsert(answer.name);
142+
DNSSDRecord& record = pluginData.findOrInsert(answer.name);
137143
record.txtContent.append(txt.content);
138144
record.txtContent.push_back(':');
139145
}
@@ -149,25 +155,22 @@ bool DNSSDPlugin::parseAnswer(const DNSRecord& answer, DNSSDData& pluginData) no
149155
}
150156

151157
bool DNSSDPlugin::parseDNSSD(
152-
std::span<const std::byte> payload,
158+
std::span<const std::byte> payload,
153159
const bool isDNSOverTCP,
154160
DNSSDData& pluginData) noexcept
155161
{
156162
DNSParser parser;
157163

158-
std::function<bool(const DNSQuestion& query)>
159-
queryParser = [&](const DNSQuestion& query) {
164+
std::function<bool(const DNSQuestion& query)> queryParser = [&](const DNSQuestion& query) {
160165
pluginData.findOrInsert(query.name);
161166
return false;
162167
};
163168

164-
auto answerParser = [&](const DNSRecord& answer) {
165-
return parseAnswer(answer, pluginData);
166-
};
169+
auto answerParser = [&](const DNSRecord& answer) { return parseAnswer(answer, pluginData); };
167170

168-
const bool parsed = parser.parse(
169-
payload, isDNSOverTCP, queryParser, answerParser,
170-
answerParser, answerParser);
171+
const bool parsed
172+
= parser
173+
.parse(payload, isDNSOverTCP, queryParser, answerParser, answerParser, answerParser);
171174
if (!parsed) {
172175
return false;
173176
}
@@ -185,13 +188,18 @@ PluginExportResult DNSSDPlugin::onExport(const FlowRecord& flowRecord, void* plu
185188
};
186189
}
187190

188-
concatenateRangeTo(pluginData.requests | std::views::transform([](const DNSSDRecord& record) {
189-
return record.requestName.toString();
190-
}), pluginData.queries, ';');
191-
concatenateRangeTo(pluginData.requests | std::views::transform([](const DNSSDRecord& record) {
192-
return record.toString();
193-
}), pluginData.responses, ';');
194-
191+
concatenateRangeTo(
192+
pluginData.requests | std::views::transform([](const DNSSDRecord& record) {
193+
return record.requestName.toString();
194+
}),
195+
pluginData.queries,
196+
';');
197+
concatenateRangeTo(
198+
pluginData.requests
199+
| std::views::transform([](const DNSSDRecord& record) { return record.toString(); }),
200+
pluginData.responses,
201+
';');
202+
195203
m_fieldHandlers[DNSSDFields::DNSSD_QUERIES].setAsAvailable(flowRecord);
196204
m_fieldHandlers[DNSSDFields::DNSSD_RESPONSES].setAsAvailable(flowRecord);
197205

@@ -200,7 +208,7 @@ PluginExportResult DNSSDPlugin::onExport(const FlowRecord& flowRecord, void* plu
200208
};
201209
}
202210

203-
void DNSSDPlugin::onDestroy(void* pluginContext)
211+
void DNSSDPlugin::onDestroy(void* pluginContext)
204212
{
205213
std::destroy_at(reinterpret_cast<DNSSDData*>(pluginContext));
206214
}
@@ -213,6 +221,9 @@ PluginDataMemoryLayout DNSSDPlugin::getDataMemoryLayout() const noexcept
213221
};
214222
}
215223

216-
static const PluginRegistrar<DNSSDPlugin, PluginFactory<ProcessPlugin, const std::string&, FieldManager&>> dnssdRegistrar(dnssdPluginManifest);
224+
static const PluginRegistrar<
225+
DNSSDPlugin,
226+
PluginFactory<ProcessPlugin, const std::string&, FieldManager&>>
227+
dnssdRegistrar(dnssdPluginManifest);
217228

218229
} // namespace ipxp

src/plugins/process/dnssd/src/dnssd.hpp

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -14,16 +14,17 @@
1414

1515
#pragma once
1616

17-
#include <sstream>
18-
#include <string>
19-
#include <processPlugin.hpp>
20-
#include <fieldManager.hpp>
21-
#include <fieldHandlersEnum.hpp>
22-
2317
#include "dnssdData.hpp"
2418
#include "dnssdFields.hpp"
2519
#include "serviceFilter.hpp"
2620

21+
#include <sstream>
22+
#include <string>
23+
24+
#include <fieldHandlersEnum.hpp>
25+
#include <fieldManager.hpp>
26+
#include <processPlugin.hpp>
27+
2728
namespace ipxp {
2829

2930
/**
@@ -32,7 +33,6 @@ namespace ipxp {
3233
*/
3334
class DNSSDPlugin : public ProcessPlugin {
3435
public:
35-
3636
/**
3737
* @brief Constructs the DNSSD plugin.
3838
*
@@ -91,12 +91,12 @@ class DNSSDPlugin : public ProcessPlugin {
9191

9292
private:
9393
bool parseDNSSD(
94-
std::span<const std::byte> payload,
94+
std::span<const std::byte> payload,
9595
const bool isDNSoverTCP,
9696
DNSSDData& pluginData) noexcept;
9797
bool parseAnswer(const DNSRecord& answer, DNSSDData& pluginData) noexcept;
9898

99-
//std::optional<std::string> m_configFilename;
99+
// std::optional<std::string> m_configFilename;
100100
FieldHandlers<DNSSDFields> m_fieldHandlers;
101101
std::optional<ServiceFilter> m_serviceFilter;
102102
};

src/plugins/process/dnssd/src/dnssdData.hpp

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,11 @@
99

1010
#pragma once
1111

12-
#include <boost/static_string.hpp>
13-
1412
#include "dnssdRecord.hpp"
1513

16-
namespace ipxp
17-
{
14+
#include <boost/static_string.hpp>
15+
16+
namespace ipxp {
1817

1918
/**
2019
* @struct DNSSDData
@@ -46,7 +45,6 @@ struct DNSSDData {
4645
requests.emplace_back(name);
4746
return requests.back();
4847
}
49-
};
48+
};
5049

5150
} // namespace ipxp
52-

0 commit comments

Comments
 (0)