fluent-plugin-netflow 0.2.2 → 0.2.3
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.travis.yml +1 -2
- data/VERSION +1 -1
- data/lib/fluent/plugin/netflow_records.rb +1 -1
- data/lib/fluent/plugin/parser_netflow.rb +12 -12
- data/test/test_parser_netflow.rb +1 -1
- metadata +3 -3
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 9dc74b8e02addf45039fb1a007eb294a2a12d5e5
|
4
|
+
data.tar.gz: fd17e359f2840a2fa13157b75485ff882b635727
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 41c9bf911cc335d22fa696976483334e548efb98dbfa03e5bd3e5d73ed277084fe3860799e88bb519ed731c3ccbd8837a686537618b5ba3a22757572ca940c53
|
7
|
+
data.tar.gz: aff98859ff756a1b85b7a43da91313d3c1a495ea794f076d12f6057bf1f1132459af79319b4e459883c19fd074b45b294fe3671e1c22ad2a5be7160c967e7b6d
|
data/.travis.yml
CHANGED
data/VERSION
CHANGED
@@ -1 +1 @@
|
|
1
|
-
0.2.
|
1
|
+
0.2.3
|
@@ -112,7 +112,7 @@ module Fluent
|
|
112
112
|
array :templates, read_until: lambda { array.num_bytes == flowset_length - 4 } do
|
113
113
|
uint16 :template_id
|
114
114
|
uint16 :field_count
|
115
|
-
array :
|
115
|
+
array :template_fields, initial_length: :field_count do
|
116
116
|
uint16 :field_type
|
117
117
|
uint16 :field_length
|
118
118
|
end
|
@@ -31,7 +31,7 @@ module Fluent
|
|
31
31
|
filename = File.expand_path('../netflow_fields.yaml', __FILE__)
|
32
32
|
|
33
33
|
begin
|
34
|
-
@
|
34
|
+
@template_fields = YAML.load_file(filename)
|
35
35
|
rescue => e
|
36
36
|
raise ConfigError, "Bad syntax in definitions file #{filename}, error_class = #{e.class.name}, error = #{e.message}"
|
37
37
|
end
|
@@ -40,7 +40,7 @@ module Fluent
|
|
40
40
|
if @definitions
|
41
41
|
raise ConfigError, "definitions file #{@definitions} doesn't exist" unless File.exist?(@definitions)
|
42
42
|
begin
|
43
|
-
@
|
43
|
+
@template_fields['option'].merge!(YAML.load_file(@definitions))
|
44
44
|
rescue => e
|
45
45
|
raise ConfigError, "Bad syntax in definitions file #{@definitions}, error_class = #{e.class.name}, error = #{e.message}"
|
46
46
|
end
|
@@ -201,16 +201,16 @@ module Fluent
|
|
201
201
|
def handle_v9_flowset_template(host, pdu, flowset)
|
202
202
|
flowset.flowset_data.templates.each do |template|
|
203
203
|
catch (:field) do
|
204
|
-
|
205
|
-
template.
|
204
|
+
template_fields = []
|
205
|
+
template.template_fields.each do |field|
|
206
206
|
entry = netflow_field_for(field.field_type, field.field_length)
|
207
207
|
throw :field unless entry
|
208
208
|
|
209
|
-
|
209
|
+
template_fields += entry
|
210
210
|
end
|
211
211
|
# We get this far, we have a list of fields
|
212
212
|
key = "#{host}|#{pdu.source_id}|#{template.template_id}"
|
213
|
-
@templates[key, @cache_ttl] = BinData::Struct.new(endian: :big, fields:
|
213
|
+
@templates[key, @cache_ttl] = BinData::Struct.new(endian: :big, fields: template_fields)
|
214
214
|
# Purge any expired templates
|
215
215
|
@templates.cleanup!
|
216
216
|
end
|
@@ -222,20 +222,20 @@ module Fluent
|
|
222
222
|
def handle_v9_flowset_options_template(host, pdu, flowset)
|
223
223
|
flowset.flowset_data.templates.each do |template|
|
224
224
|
catch (:field) do
|
225
|
-
|
225
|
+
template_fields = []
|
226
226
|
|
227
227
|
NETFLOW_V9_FIELD_CATEGORIES.each do |category|
|
228
228
|
template["#{category}_fields"].each do |field|
|
229
229
|
entry = netflow_field_for(field.field_type, field.field_length, category)
|
230
230
|
throw :field unless entry
|
231
231
|
|
232
|
-
|
232
|
+
template_fields += entry
|
233
233
|
end
|
234
234
|
end
|
235
235
|
|
236
236
|
# We get this far, we have a list of fields
|
237
237
|
key = "#{host}|#{pdu.source_id}|#{template.template_id}"
|
238
|
-
@templates[key, @cache_ttl] = BinData::Struct.new(endian: :big, fields:
|
238
|
+
@templates[key, @cache_ttl] = BinData::Struct.new(endian: :big, fields: template_fields)
|
239
239
|
# Purge any expired templates
|
240
240
|
@templates.cleanup!
|
241
241
|
end
|
@@ -265,8 +265,8 @@ module Fluent
|
|
265
265
|
|
266
266
|
array = BinData::Array.new(type: template, initial_length: length / template.num_bytes)
|
267
267
|
|
268
|
-
|
269
|
-
|
268
|
+
template_fields = array.read(flowset.flowset_data)
|
269
|
+
template_fields.each do |r|
|
270
270
|
if is_sampler?(r)
|
271
271
|
sampler_key = "#{host}|#{pdu.source_id}|#{r.flow_sampler_id}"
|
272
272
|
register_sampler_v9 sampler_key, r
|
@@ -307,7 +307,7 @@ module Fluent
|
|
307
307
|
end
|
308
308
|
|
309
309
|
def netflow_field_for(type, length, category='option')
|
310
|
-
unless field = @
|
310
|
+
unless field = @template_fields[category][type]
|
311
311
|
$log.warn "Skip unsupported field", type: type, length: length
|
312
312
|
return [:skip, nil, {length: length}]
|
313
313
|
end
|
data/test/test_parser_netflow.rb
CHANGED
@@ -20,7 +20,7 @@ class NetflowParserTest < Test::Unit::TestCase
|
|
20
20
|
test 'parse v5 binary data, dumped by netflow-generator' do
|
21
21
|
# generated by https://github.com/mshindo/NetFlow-Generator
|
22
22
|
parser = create_parser
|
23
|
-
raw_data = File.
|
23
|
+
raw_data = File.binread(File.join(__dir__, "dump/netflow.v5.dump"))
|
24
24
|
bytes_for_1record = 72
|
25
25
|
assert_equal bytes_for_1record, raw_data.size
|
26
26
|
parsed = []
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: fluent-plugin-netflow
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.2.
|
4
|
+
version: 0.2.3
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Masahiro Nakagawa
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2016-
|
11
|
+
date: 2016-07-28 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: fluentd
|
@@ -123,7 +123,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
123
123
|
version: '0'
|
124
124
|
requirements: []
|
125
125
|
rubyforge_project:
|
126
|
-
rubygems_version: 2.
|
126
|
+
rubygems_version: 2.5.1
|
127
127
|
signing_key:
|
128
128
|
specification_version: 4
|
129
129
|
summary: Netflow plugin for Fluentd
|