diff --git a/ChangeLog b/ChangeLog index 79a90a4..5e54665 100755 --- a/ChangeLog +++ b/ChangeLog @@ -1,9 +1,14 @@ +2017-12-28 +- Add sampling elements ID 302,304,305. put them identcal to ID 48,49,50 +- Add option to label filter terms. syntax: ( ) %labelname. + 2017-12-27 - Add ipfix delta timestamp elements 158/159. - Update sflow code to commit 7322984 of https://github.com/sflow/sflowtool - Cleanup sflow code - uncomment unnecessary code - Fix header includes" - Fix 64bit fts compat issue in fts_compat.c +- Add more detailed autogen.sh - softlink bootstrap 2017-12-22 - Fix potential memory leaks in nfpcapd diff --git a/bin/grammar.y b/bin/grammar.y index 19219c5..b2d4543 100755 --- a/bin/grammar.y +++ b/bin/grammar.y @@ -1,4 +1,5 @@ /* + * Copyright (c) 2017 * Copyright (c) 2016 * Copyright (c) 2004-2008, SWITCH - Teleinformatikdienste fuer Lehre und Forschung * All rights reserved. @@ -2096,6 +2097,10 @@ expr: term { $$ = $1.self; } | expr AND expr { $$ = Connect_AND($1, $3); } | NOT expr %prec NEGATE { $$ = Invert($2); } | '(' expr ')' { $$ = $2; } + | '(' expr ')' '%' STRING { + $$ = $2; + AddLabel($2, $5); + } ; %% diff --git a/bin/netflow_v9.c b/bin/netflow_v9.c index f49587f..ea53f02 100644 --- a/bin/netflow_v9.c +++ b/bin/netflow_v9.c @@ -1391,7 +1391,30 @@ uint16_t offset_std_sampler_interval, offset_std_sampler_algorithm, found_std_sa uint16_t length = Get_val16(p); p = p + 2; offset += length; - dbg_printf("Scope field Type: %u, length %u\n", type, length); +#ifdef DEVEL + printf("Scope field: Type "); + switch (type) { + case 1: + printf("(1) - System"); + break; + case 2: + printf("(2) - Interface"); + break; + case 3: + printf("(3) - Line Card"); + break; + case 4: + printf("(4) - NetFlow Cache"); + break; + case 5: + printf("(5) - Template"); + break; + default: + printf("(%u) - Unknown", type); + break; + } + printf(", length %u\n", length); +#endif } for ( ; i<(nr_scopes+nr_options); i++ ) { @@ -1429,16 +1452,19 @@ uint16_t offset_std_sampler_interval, offset_std_sampler_algorithm, found_std_sa break; // individual samplers - case NF9_FLOW_SAMPLER_ID: + case NF9_FLOW_SAMPLER_ID: // depricated + case NF_SELECTOR_ID: offset_sampler_id = offset; sampler_id_length = length; found_sampler++; break; - case FLOW_SAMPLER_MODE: + case FLOW_SAMPLER_MODE: // // depricated + case NF_SELECTOR_ALGORITHM: offset_sampler_mode = offset; found_sampler++; break; - case NF9_FLOW_SAMPLER_RANDOM_INTERVAL: + case NF9_FLOW_SAMPLER_RANDOM_INTERVAL: // depricated + case NF_SAMPLING_INTERVAL: offset_sampler_interval = offset; offset_std_sampler_interval = offset; found_sampler++; diff --git a/bin/netflow_v9.h b/bin/netflow_v9.h index 7dbf568..b07775f 100644 --- a/bin/netflow_v9.h +++ b/bin/netflow_v9.h @@ -217,9 +217,13 @@ typedef struct common_header_s { #define NF9_ENGINE_ID 39 #define NF9_FLOW_SAMPLER_ID 48 -#define FLOW_SAMPLER_MODE 49 +#define FLOW_SAMPLER_MODE 49 #define NF9_FLOW_SAMPLER_RANDOM_INTERVAL 50 +#define NF_SELECTOR_ID 302 +#define NF_SELECTOR_ALGORITHM 304 +#define NF_SAMPLING_INTERVAL 305 + // #define NF9_MIN_TTL 52 // #define NF9_MAX_TTL 53 // #define NF9_IPV4_IDENT 54 diff --git a/bin/nftest.c b/bin/nftest.c index 58aa48f..5bdae04 100644 --- a/bin/nftest.c +++ b/bin/nftest.c @@ -440,6 +440,7 @@ void *p; flow_record.V4.srcaddr = 0xac200710; flow_record.V4.dstaddr = 0x0a0a0a0b; ret = check_filter_block("src ip 172.32.7.16", &flow_record, 1); + ret = check_filter_block("( src ip 172.32.7.16 ) %MyLabel", &flow_record, 1); ret = check_filter_block("src ip 172.32.7.15", &flow_record, 0); ret = check_filter_block("dst ip 10.10.10.11", &flow_record, 1); ret = check_filter_block("dst ip 10.10.10.10", &flow_record, 0); diff --git a/bin/nftree.c b/bin/nftree.c index 20f75d2..e855ed2 100644 --- a/bin/nftree.c +++ b/bin/nftree.c @@ -244,6 +244,7 @@ uint32_t NewBlock(uint32_t offset, uint64_t mask, uint64_t value, uint16_t comp, FilterTree[n].comp = comp; FilterTree[n].function = flow_procs_map[function].function; FilterTree[n].fname = flow_procs_map[function].name; + FilterTree[n].label = NULL; FilterTree[n].data = data; if ( comp > 0 || function > 0 ) Extended = 1; @@ -383,15 +384,17 @@ void DumpList(FilterEngine_data_t *args) { for (i=1; ifilter[i].invert ) - printf("Index: %u, Offset: %u, Mask: %.16llx, Value: %.16llx, Superblock: %u, Numblocks: %u, !OnTrue: %u, !OnFalse: %u Comp: %u Function: %s\n", + printf("Index: %u, Offset: %u, Mask: %.16llx, Value: %.16llx, Superblock: %u, Numblocks: %u, !OnTrue: %u, !OnFalse: %u Comp: %u Function: %s, Label: %s\n", i, args->filter[i].offset, (unsigned long long)args->filter[i].mask, (unsigned long long)args->filter[i].value, args->filter[i].superblock, - args->filter[i].numblocks, args->filter[i].OnTrue, args->filter[i].OnFalse, args->filter[i].comp, args->filter[i].fname); + args->filter[i].numblocks, args->filter[i].OnTrue, args->filter[i].OnFalse, + args->filter[i].comp, args->filter[i].fname, args->filter[i].label ? args->filter[i].label : ""); else - printf("Index: %u, Offset: %u, Mask: %.16llx, Value: %.16llx, Superblock: %u, Numblocks: %u, OnTrue: %u, OnFalse: %u Comp: %u Function: %s\n", + printf("Index: %u, Offset: %u, Mask: %.16llx, Value: %.16llx, Superblock: %u, Numblocks: %u, OnTrue: %u, OnFalse: %u Comp: %u Function: %s, Label: %s\n", i, args->filter[i].offset, (unsigned long long)args->filter[i].mask, (unsigned long long)args->filter[i].value, args->filter[i].superblock, - args->filter[i].numblocks, args->filter[i].OnTrue, args->filter[i].OnFalse, args->filter[i].comp, args->filter[i].fname); + args->filter[i].numblocks, args->filter[i].OnTrue, args->filter[i].OnFalse, + args->filter[i].comp, args->filter[i].fname, args->filter[i].label ? args->filter[i].label : ""); if ( args->filter[i].OnTrue > (memblocks * MAXBLOCKS) || args->filter[i].OnFalse > (memblocks * MAXBLOCKS) ) { fprintf(stderr, "Tree pointer out of range for index %u. *** ABORT ***\n", i); exit(255); @@ -500,6 +503,10 @@ int evaluate, invert; } /* End of RunExtendedFilter */ +void AddLabel(uint32_t index, char *label) { + FilterTree[index].label = strdup(label); +} // End of AddLabel + uint32_t AddIdent(char *Ident) { uint32_t num; diff --git a/bin/nftree.h b/bin/nftree.h index be67494..6873b98 100644 --- a/bin/nftree.h +++ b/bin/nftree.h @@ -65,6 +65,7 @@ typedef struct FilterBlock { uint16_t comp; /* comperator */ flow_proc_t function; /* function for flow processing */ char *fname; /* ascii function name */ + char *label; /* label, if any */ void *data; /* any additional data for this block */ } FilterBlock_t; @@ -164,6 +165,11 @@ uint32_t Connect_OR(uint32_t b1, uint32_t b2); */ uint32_t Invert(uint32_t a ); +/* + * Add label to filter index + */ +void AddLabel(uint32_t index, char *label); + /* * Add Ident to Identlist */