++

Author: Damir Zainullin

include/ipfixprobe/packet.hpp

@@ -51,6 +51,9 @@ struct Packet : public Record {
 	uint16_t ethertype;
 
 	uint16_t ip_len; /**< Length of IP header + its payload */
+		uint16_t tcp_window;
+	uint64_t tcp_options;
+	uint32_t tcp_mss;
 	uint16_t ip_payload_len; /**< Length of IP payload */
 	uint8_t ip_version;
 	uint8_t ip_ttl;

include/ipfixprobe/pluginFactory/utils.hpp

@@ -0,0 +1,232 @@
+/**
+ * \file utils.hpp
+ * \brief Utility functions
+ * \author Jiri Havranek <[email protected]>
+ * \date 2021
+ */
+/*
+ * Copyright (C) 2021 CESNET
+ *
+ * LICENSE TERMS
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of the Company nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ *
+ *
+ */
+
+#ifndef IPXP_UTILS_HPP
+#define IPXP_UTILS_HPP
+
+#include <algorithm>
+#include <cctype>
+#include <cstdint>
+#include <limits>
+#include <set>
+#include <sstream>
+#include <stdexcept>
+#include <string>
+#include <type_traits>
+#include <utility>
+#include <vector>
+
+#include <sys/time.h>
+
+namespace ipxp {
+
+void parse_range(
+	const std::string& arg,
+	std::string& from,
+	std::string& to,
+	const std::string& delim = "-");
+bool str2bool(std::string str);
+void trim_str(std::string& str);
+uint32_t variable2ipfix_buffer(uint8_t* buffer2write, uint8_t* buffer2read, uint16_t len);
+
+template<typename T>
+constexpr T const& max(const T& a, const T& b)
+{
+	return a > b ? a : b;
+}
+
+/*
+ * \brief Count number of '1' bits
+ * \param [in] num Number to count ones in
+ * \return Number of ones counted
+ */
+template<typename T>
+static constexpr unsigned bitcount(T num)
+{
+	static_assert(!std::is_signed<T>(), "bitcount function is for unsigned types only");
+	return num == 0 ? 0 : (bitcount<T>(num >> 1) + (num & 1));
+}
+
+template<typename T>
+static constexpr bool is_fpoint()
+{
+	return std::is_floating_point<T>();
+}
+
+template<typename T>
+static constexpr bool is_uint()
+{
+	return std::is_integral<T>() && std::is_unsigned<T>();
+}
+
+template<typename T>
+static constexpr bool is_sint()
+{
+	return std::is_integral<T>() && std::is_signed<T>();
+}
+
+// Use of SFINAE to implement specific conversion function variants
+
+template<typename T>
+T str2num(std::string str, typename std::enable_if<is_fpoint<T>()>::type* = nullptr)
+{
+	size_t pos;
+	double tmp;
+
+	trim_str(str);
+	try {
+		tmp = std::stold(str, &pos);
+	} catch (std::out_of_range& e) {
+		throw std::invalid_argument(str);
+	}
+	if (pos != str.size() || tmp < std::numeric_limits<T>::min()
+		|| tmp > std::numeric_limits<T>::max()) {
+		throw std::invalid_argument(str);
+	}
+
+	return static_cast<T>(tmp);
+}
+
+template<typename T>
+T str2num(std::string str, typename std::enable_if<is_sint<T>()>::type* = nullptr)
+{
+	long long tmp;
+	size_t pos;
+
+	trim_str(str);
+	try {
+		tmp = std::stoll(str, &pos, 0);
+	} catch (std::out_of_range& e) {
+		throw std::invalid_argument(str);
+	}
+	if (pos != str.size() || tmp < std::numeric_limits<T>::min()
+		|| tmp > std::numeric_limits<T>::max()) {
+		throw std::invalid_argument(str);
+	}
+
+	return static_cast<T>(tmp);
+}
+
+template<typename T>
+T str2num(std::string str, typename std::enable_if<is_uint<T>()>::type* = nullptr)
+{
+	unsigned long long tmp;
+	size_t pos;
+
+	trim_str(str);
+	try {
+		tmp = std::stoull(str, &pos, 0);
+	} catch (std::out_of_range& e) {
+		throw std::invalid_argument(str);
+	}
+	if (pos != str.size() || tmp < std::numeric_limits<T>::min()
+		|| tmp > std::numeric_limits<T>::max()) {
+		throw std::invalid_argument(str);
+	}
+
+	return static_cast<T>(tmp);
+}
+
+/**
+ * @brief Convert struct Timeval to microseconds
+ */
+uint64_t timeval2usec(const struct timeval& tv);
+
+/**
+ * @brief Convert vector to string, e.g. for error messages
+ */
+template<typename T>
+std::string vec2str(const std::vector<T>& vec)
+{
+	std::stringstream ss;
+	bool first = true;
+	for (auto& item : vec) {
+		if (!first)
+			ss << ", ";
+		ss << item;
+		first = false;
+	}
+	return ss.str();
+}
+
+/**
+ * @brief Copy uint32 in little endian byte order to destination in host byte order
+ */
+void memcpy_le32toh(uint32_t* dest, const uint32_t* src);
+
+constexpr static inline
+timeval operator+(const timeval& a, const timeval& b) noexcept
+{
+	constexpr time_t USEC_IN_SEC = 1'000'000;
+
+	timeval result{};
+	result.tv_sec = a.tv_sec + b.tv_sec;
+	result.tv_usec = a.tv_usec + b.tv_usec;
+	if (result.tv_usec >= USEC_IN_SEC) {
+		result.tv_sec++;
+		result.tv_usec -= USEC_IN_SEC;
+	}
+	return result;
+}
+
+constexpr static inline
+timeval operator-(const timeval& a) noexcept
+{
+	timeval result{};
+	result.tv_sec = -a.tv_sec;
+	result.tv_usec = -a.tv_usec;
+	return result;
+}
+
+constexpr static inline
+timeval operator-(const timeval& a, const timeval& b) noexcept
+{
+	return a + (-b);
+}
+
+constexpr static inline
+bool operator>(const timeval& a, const timeval& b) noexcept
+{
+	return std::tie(a.tv_sec, a.tv_usec) > std::tie(b.tv_sec, b.tv_usec);
+}
+
+constexpr static inline
+bool operator<(const timeval& a, const timeval& b) noexcept
+{
+	return std::tie(a.tv_sec, a.tv_usec) < std::tie(b.tv_sec, b.tv_usec);
+}
+
+constexpr static inline
+bool operator==(const timeval& a, const timeval& b) noexcept
+{
+	return not (a < b) and not (b < a);
+}
+
+} // namespace ipxp
+
+#endif /* IPXP_UTILS_HPP */

process-plugin-api/dummyProcessPlugin.hpp

@@ -131,8 +131,8 @@ static FieldSchema createDummySchema()
 }
 
 class DummyPlugin
-	: private FieldHandlers<DummyFields>
-	, public ProcessPlugin {
+	//: private FieldHandlers<DummyFields>,
+	: public ProcessPlugin {
 public:
 	DummyPlugin(const std::string& params, FieldManager& manager)
 	{
@@ -164,11 +164,10 @@ class DummyPlugin
 		return FlowAction::RequestNoData;
 	}
 
-	FlowAction onFlowUpdate(FlowRecord& flowRecord, const Packet& packet, const PacketOfFlowData& data) override
+	FlowAction onFlowUpdate(FlowRecord& flowRecord, const Packet& packet) override
 	{
 		(void) flowRecord;
 		(void) packet;
-		(void) data;
 
 		m_exportData.packets[Direction::Forward] = {1, 2, 3, 4, 5, 6};
 		m_fieldHandlers[DummyFields::PACKETS].setAsAvailable(flowRecord);
@@ -194,6 +193,7 @@ class DummyPlugin
 
 private:
 	DummyExport m_exportData;
+	FieldHandlers<DummyFields> m_fieldHandlers;
 };
 
 } // namespace ipxp

process-plugin-api/fieldSchema.hpp

@@ -14,6 +14,25 @@
 
 namespace ipxp {
 
+template<typename Field>
+using FieldPair = std::pair<Field, std::string_view>;
+
+template<typename Field>
+using BiflowFieldPair = std::pair<FieldPair<Field>, FieldPair<Field>>;
+
+template<typename Field>
+using FieldVariant = std::variant<FieldPair<Field>, BiflowFieldPair<Field>>;
+
+template<typename Field>
+FieldVariant<Field> makeBiflowPair(FieldPair<Field> field1, FieldPair<Field> field2) {
+    return FieldVariant<Field>(BiflowFieldPair<Field>{field1, field2});
+}
+
+template<typename Field>
+FieldVariant<Field> makeFieldPair(Field field, std::string_view name) {
+    return FieldVariant<Field>(FieldPair<Field>{field, name});
+}
+
 /**
  * @brief Represents the schema of a flow record, including field definitions and biflow mappings.
  *
@@ -89,6 +108,17 @@ class FieldSchema {
 			BiflowPair {std::string(forwardFieldName), std::string(reverseFieldName)});
 	}
 
+	template<typename Field>
+	void addBiflowPairs(const std::vector<FieldVariant<Field>>& pairs)
+	{
+		for (const FieldVariant<Field>& fieldVariant : pairs) {
+			if (std::holds_alternative<BiflowFieldPair<Field>>(fieldVariant)) {
+				const auto& [field1, field2] = std::get<BiflowFieldPair<Field>>(fieldVariant);
+				addBiflowPair(field1.second, field2.second);
+			}
+		}
+	}
+
 	/**
 	 * @brief Returns all registered fields in this schema.
 	 *

process-plugin-api/ipx

@@ -12,7 +12,6 @@ int main()
 	ipxp::FlowRecordBuilder builder;
 	ipxp::FieldManager manager;
 	ipxp::Packet packet;
-	ipxp::PacketOfFlowData data;
 
 	builder.addProcessPlugin("dummy", "params", manager);
 
@@ -23,7 +22,7 @@ int main()
 			[&](ipxp::ProcessPlugin* plugin) { plugin->onFlowCreate(flowRecord, packet); });
 
 		flowRecord.forEachPlugin(
-			[&](ipxp::ProcessPlugin* plugin) { plugin->onFlowUpdate(flowRecord, packet, data); });
+			[&](ipxp::ProcessPlugin* plugin) { plugin->onFlowUpdate(flowRecord, packet); });
 	} catch (std::exception& ex) {
 		std::cout << ex.what() << "\n";
 		return 1;

process-plugin-api/main.cpp

@@ -19,9 +19,11 @@ struct Packet {
     uint32_t tcpMss;
     TcpFlags tcpFlags;
 
-    uint32_t actualLength;
+    uint32_t realLength;
     uint32_t receivedLength;
 
+    Direction direction;
+
 };
 
 } // namespace ipxp

process-plugin-api/packet.hpp

@@ -0,0 +1,27 @@
+#pragma once
+
+#include <sys/time.h>
+#include <directionalField.hpp>
+#include <utils.hpp>
+
+namespace ipxp
+{
+
+struct Burst {
+    
+    constexpr static timeval MAX_INTERPACKET_TIMEDIFF = {1, 0};
+
+    uint32_t& packets;
+	uint32_t& bytes;
+	timeval& start;
+	timeval& end;
+
+    constexpr inline
+    bool belongs(const timeval& time) const noexcept 
+    {
+        return time - end < MAX_INTERPACKET_TIMEDIFF;
+    }
+};
+
+
+} // namespace ipxp