Skip to content

Commit d26c57f

Browse files
Lukas955Lukas955
authored
Merge pull request #19 from CESNET/sedlak-filter
Sedlak filter
2 parents e4e707a + 0781ef3 commit d26c57f

98 files changed

Lines changed: 11295 additions & 36 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,10 @@ cmake-build-release/
1010
# JetBrains files
1111
.idea/
1212

13+
# VS Code files
14+
.vscode/
15+
16+
1317
# Prerequisites
1418
*.d
1519

‎config/system/aliases.xml‎

Lines changed: 83 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,13 @@
2323
<!-- Source IP address (IPv4 or IPv6) -->
2424
<element>
2525
<name>SRC IP</name>
26+
<alias>src ip</alias>
2627
<alias>srcip</alias>
28+
<alias>src host</alias>
2729
<alias>srchost</alias>
2830

2931
<!-- possible data types: ipv4Address/ipv6Address -->
30-
<source mode="anyOf">
32+
<source mode="firstOf">
3133
<id>iana:sourceIPv4Address</id>
3234
<id>iana:sourceIPv6Address</id>
3335
</source>
@@ -36,11 +38,13 @@
3638
<!-- Destination IP address (IPv4 or IPv6) -->
3739
<element>
3840
<name>DST IP</name>
41+
<alias>dst ip</alias>
3942
<alias>dstip</alias>
43+
<alias>dst host</alias>
4044
<alias>dsthost</alias>
4145

4246
<!-- possible data types: ipv4Address/ipv6Address -->
43-
<source mode="anyOf">
47+
<source mode="firstOf">
4448
<id>iana:destinationIPv4Address</id>
4549
<id>iana:destinationIPv6Address</id>
4650
</source>
@@ -54,8 +58,10 @@
5458

5559
<!-- possible data types: ipv4Address/ipv6Address -->
5660
<source mode="anyOf">
57-
<id>@srcip</id>
58-
<id>@dstip</id>
61+
<id>iana:sourceIPv4Address</id>
62+
<id>iana:sourceIPv6Address</id>
63+
<id>iana:destinationIPv4Address</id>
64+
<id>iana:destinationIPv6Address</id>
5965
</source>
6066
</element>
6167

@@ -64,7 +70,6 @@
6470
<name>Flow Start</name>
6571
<alias>flowstart</alias>
6672

67-
<dataType>dateTimeMilliseconds</dataType>
6873
<aggregation>
6974
<method>min</method>
7075
<order>ascendent</order>
@@ -83,7 +88,6 @@
8388
<name>Flow End</name>
8489
<alias>flowend</alias>
8590

86-
<dataType>dateTimeMilliseconds</dataType>
8791
<aggregation>
8892
<method>max</method>
8993
<order>ascendent</order>
@@ -97,47 +101,91 @@
97101
</source>
98102
</element>
99103

100-
<!-- Flow duration (calculation example) -->
101104
<element>
102-
<name>Duration</name>
103-
<alias>duration</alias>
105+
<name>Protocol</name>
104106

105-
<dataType>dateTimeMilliseconds</dataType>
106-
<aggregation>
107-
<method>sum</method>
108-
<order>descendent</order>
109-
</aggregation>
107+
<alias>protocol</alias>
108+
<alias>proto</alias>
110109

111-
<source mode="firstOf">
112-
<!-- First, try to calculate the duration -->
113-
<calculated expr="$1 - $2">
114-
<arg id="1">@flowEnd</arg>
115-
<arg id="2">@flowStart</arg>
116-
</calculated>
117-
<!-- If calculation failed, try to find other elements -->
118-
<id>iana:flowDurationMilliseconds</id>
119-
<id>iana:flowDurationMicroseconds</id>
110+
<source>
111+
<id>iana:protocolIdentifier</id>
120112
</source>
121113
</element>
122114

123-
<!-- Bytes per second (another calculated value) -->
124115
<element>
125-
<name>Bytes per second</name>
126-
<alias>bps</alias>
116+
<name>IPv4 Address</name>
127117

128-
<dataType>float64</dataType>
129-
<aggregation>
130-
<method>sum</method>
131-
<order>descendent</order>
132-
</aggregation>
118+
<alias>ip4</alias>
119+
<alias>ipv4</alias>
120+
<alias>ipv4addr</alias>
121+
<alias>ipv4address</alias>
122+
123+
<source>
124+
<id>iana:sourceIPv4Address</id>
125+
<id>iana:destinationIPv4Address</id>
126+
</source>
127+
</element>
128+
129+
<element>
130+
<name>IPv6 Address</name>
131+
132+
<alias>ip6</alias>
133+
<alias>ipv6</alias>
134+
<alias>ipv6addr</alias>
135+
<alias>ipv6address</alias>
133136

134137
<source>
135-
<calculated expr="($1 * 1000) / $2">
136-
<arg id="1">iana:octetDeltaCount</arg>
137-
<arg id="2">@duration</arg>
138-
</calculated>
138+
<id>iana:sourceIPv6Address</id>
139+
<id>iana:destinationIPv6Address</id>
139140
</source>
140141
</element>
142+
143+
<element>
144+
<name>Port</name>
145+
146+
<alias>port</alias>
147+
148+
<source>
149+
<id>iana:sourceTransportPort</id>
150+
<id>iana:destinationTransportPort</id>
151+
</source>
152+
</element>
153+
154+
<element>
155+
<name>Source Port</name>
156+
157+
<alias>srcport</alias>
158+
<alias>sourceport</alias>
159+
<alias>src port</alias>
160+
161+
<source>
162+
<id>iana:sourceTransportPort</id>
163+
</source>
164+
</element>
165+
166+
<element>
167+
<name>Destination Port</name>
168+
169+
<alias>dstport</alias>
170+
<alias>destport</alias>
171+
<alias>destinationport</alias>
172+
<alias>dst port</alias>
173+
174+
<source>
175+
<id>iana:destinationTransportPort</id>
176+
</source>
177+
</element>
178+
179+
<element>
180+
<name>TCP Flags</name>
181+
182+
<alias>tcpflags</alias>
183+
184+
<source>
185+
<id>iana:tcpControlBits</id>
186+
</source>
187+
</element>
188+
141189
</ipfix-aliases>
142190

143191
<!-- TODO: How to express "net a.b.c.d/XX"? -->

‎config/system/mappings.xml‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
<ipfix-mapping>
2+
<group>
3+
<name>Protocol</name>
4+
5+
<!-- Alias or Element name -->
6+
<match>Protocol</match>
7+
8+
<item-list mode="caseInsensitive">
9+
<item>
10+
<key>TCP</key>
11+
<value>6</value>
12+
</item>
13+
<item>
14+
<key>UDP</key>
15+
<value>17</value>
16+
</item>
17+
</item-list>
18+
</group>
19+
20+
<group>
21+
<name>TCP Flags</name>
22+
23+
<match>TCP Flags</match>
24+
25+
<item-list mode="caseInsensitive">
26+
<item>
27+
<key>FIN</key>
28+
<value>1</value>
29+
</item>
30+
<item>
31+
<key>SYN</key>
32+
<value>2</value>
33+
</item>
34+
<item>
35+
<key>RST</key>
36+
<value>4</value>
37+
</item>
38+
<item>
39+
<key>PSH</key>
40+
<value>8</value>
41+
</item>
42+
<item>
43+
<key>ACK</key>
44+
<value>16</value>
45+
</item>
46+
<item>
47+
<key>URG</key>
48+
<value>32</value>
49+
</item>
50+
<item>
51+
<key>ECE</key>
52+
<value>64</value>
53+
</item>
54+
<item>
55+
<key>CWR</key>
56+
<value>128</value>
57+
</item>
58+
<item>
59+
<key>NS</key>
60+
<value>256</value>
61+
</item>
62+
</item-list>
63+
</group>
64+
65+
</ipfix-mapping>

‎examples/custom_trie.c‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
#include <stdio.h>
2+
#include <libfds.h>
3+
#include <assert.h>
4+
5+
6+
int
7+
ip_list_to_trie(fds_filter_value_u *val, fds_filter_value_u *res)
8+
{
9+
printf("hello from trie constructor\n");
10+
11+
struct fds_trie *trie = fds_trie_create();
12+
if (!trie) {
13+
return FDS_ERR_NOMEM;
14+
}
15+
for (int i = 0; i < val->list.len; i++) {
16+
int ret = fds_trie_add(trie, val->list.items[i].ip.version, val->list.items[i].ip.addr, val->list.items[i].ip.prefix);
17+
if (!ret) {
18+
return FDS_ERR_NOMEM;
19+
}
20+
}
21+
// free(val->list.items);
22+
res->p = trie;
23+
return FDS_OK;
24+
}
25+
26+
void
27+
destroy_trie(fds_filter_value_u *val)
28+
{
29+
fds_trie_destroy(val->p);
30+
}
31+
32+
void
33+
ip_in_trie(fds_filter_value_u *left, fds_filter_value_u *right, fds_filter_value_u *result)
34+
{
35+
result->b = fds_trie_find(right->p, left->ip.version, left->ip.addr, left->ip.prefix);
36+
}
37+
38+
#define FDS_FDT_TRIE (FDS_FDT_CUSTOM | 1) // const int doesn't work here?
39+
40+
const fds_filter_op_s trie_ops[] = {
41+
FDS_FILTER_DEF_CONSTRUCTOR(FDS_FDT_IP | FDS_FDT_LIST, ip_list_to_trie, FDS_FDT_TRIE),
42+
FDS_FILTER_DEF_DESTRUCTOR(FDS_FDT_TRIE, destroy_trie),
43+
FDS_FILTER_DEF_BINARY_OP(FDS_FDT_IP, "in", FDS_FDT_TRIE, ip_in_trie, FDS_FDT_BOOL),
44+
FDS_FILTER_END_OP_LIST
45+
};
46+
47+
int
48+
main(int argc, char *argv[])
49+
{
50+
int exit_code = EXIT_SUCCESS;
51+
int res;
52+
fds_filter_opts_t *opts = NULL;
53+
fds_filter_t *filter = NULL;
54+
55+
opts = fds_filter_create_default_opts();
56+
if (!opts) {
57+
printf("error: create default opts failed\n");
58+
exit_code = EXIT_FAILURE;
59+
goto cleanup;
60+
}
61+
62+
if (!fds_filter_opts_extend_ops(opts, trie_ops)) {
63+
printf("error: extend ops failed\n");
64+
exit_code = EXIT_FAILURE;
65+
goto cleanup;
66+
}
67+
68+
const char *expr = "127.0.0.1 in [127.0.0.1, 127.0.0.2, 192.168.1.21, 1.1.1.1, 8.8.8.8, 4.4.4.4]";
69+
res = fds_filter_create(&filter, expr, opts);
70+
if (res != FDS_OK) {
71+
fds_filter_error_s *err = fds_filter_get_error(filter);
72+
printf("error creating filter: %d: %s\n", err->code, err->msg);
73+
exit_code = EXIT_FAILURE;
74+
goto cleanup;
75+
}
76+
77+
res = fds_filter_eval(filter, NULL);
78+
if (res) {
79+
printf("filter passed\n");
80+
} else {
81+
printf("filter didn't pass\n");
82+
}
83+
84+
cleanup:
85+
fds_filter_destroy(filter);
86+
fds_filter_destroy_opts(opts);
87+
return exit_code;
88+
}

‎examples/filter.c‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
#include <stdio.h>
2+
#include <stdlib.h>
3+
#include <assert.h>
4+
5+
#include <libfds.h>
6+
7+
int main(int argc, char *argv[]) {
8+
if (argc < 0) {
9+
fprintf(stderr, "Usage: filter <expr>\n");
10+
return 1;
11+
}
12+
13+
fds_filter_opts_t *opts = fds_filter_create_default_opts();
14+
assert(opts);
15+
16+
fds_filter_t *filter;
17+
int ret = fds_filter_create(&filter, argv[1], opts);
18+
if (ret != FDS_OK) {
19+
fds_filter_error_s *err = fds_filter_get_error(filter);
20+
printf("(%d) %s\n", err->code, err->msg);
21+
printf("%s\n", argv[1]);
22+
const char *p = argv[1];
23+
while (p < err->cursor_begin) { printf(" "); p++; }
24+
while (p < err->cursor_end) { printf("^"); p++; }
25+
printf("\n");
26+
fds_filter_destroy(filter);
27+
fds_filter_destroy_opts(opts);
28+
return 1;
29+
}
30+
fds_filter_eval(filter, NULL);
31+
fds_filter_destroy(filter);
32+
fds_filter_destroy_opts(opts);
33+
return 0;
34+
}

‎include/CMakeLists.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,13 @@ set(SUB_HEADERS
1515
libfds/iemgr.h
1616
libfds/drec.h
1717
libfds/file.h
18+
libfds/filter.h
1819
libfds/ipfix_parsers.h
1920
libfds/ipfix_structs.h
21+
libfds/ipfix_filter.h
2022
libfds/template.h
2123
libfds/template_mgr.h
24+
libfds/trie.h
2225
libfds/xml_parser.h
2326
)
2427

0 commit comments

Comments
 (0)