fluent-plugin-netflow 0.2.2 → 0.2.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.travis.yml +1 -2
- data/VERSION +1 -1
- data/lib/fluent/plugin/netflow_records.rb +1 -1
- data/lib/fluent/plugin/parser_netflow.rb +12 -12
- data/test/test_parser_netflow.rb +1 -1
- metadata +3 -3
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 9dc74b8e02addf45039fb1a007eb294a2a12d5e5
|
4
|
+
data.tar.gz: fd17e359f2840a2fa13157b75485ff882b635727
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 41c9bf911cc335d22fa696976483334e548efb98dbfa03e5bd3e5d73ed277084fe3860799e88bb519ed731c3ccbd8837a686537618b5ba3a22757572ca940c53
|
7
|
+
data.tar.gz: aff98859ff756a1b85b7a43da91313d3c1a495ea794f076d12f6057bf1f1132459af79319b4e459883c19fd074b45b294fe3671e1c22ad2a5be7160c967e7b6d
|
data/.travis.yml
CHANGED
data/VERSION
CHANGED
@@ -1 +1 @@
|
|
1
|
-
0.2.
|
1
|
+
0.2.3
|
@@ -112,7 +112,7 @@ module Fluent
|
|
112
112
|
array :templates, read_until: lambda { array.num_bytes == flowset_length - 4 } do
|
113
113
|
uint16 :template_id
|
114
114
|
uint16 :field_count
|
115
|
-
array :
|
115
|
+
array :template_fields, initial_length: :field_count do
|
116
116
|
uint16 :field_type
|
117
117
|
uint16 :field_length
|
118
118
|
end
|
@@ -31,7 +31,7 @@ module Fluent
|
|
31
31
|
filename = File.expand_path('../netflow_fields.yaml', __FILE__)
|
32
32
|
|
33
33
|
begin
|
34
|
-
@
|
34
|
+
@template_fields = YAML.load_file(filename)
|
35
35
|
rescue => e
|
36
36
|
raise ConfigError, "Bad syntax in definitions file #{filename}, error_class = #{e.class.name}, error = #{e.message}"
|
37
37
|
end
|
@@ -40,7 +40,7 @@ module Fluent
|
|
40
40
|
if @definitions
|
41
41
|
raise ConfigError, "definitions file #{@definitions} doesn't exist" unless File.exist?(@definitions)
|
42
42
|
begin
|
43
|
-
@
|
43
|
+
@template_fields['option'].merge!(YAML.load_file(@definitions))
|
44
44
|
rescue => e
|
45
45
|
raise ConfigError, "Bad syntax in definitions file #{@definitions}, error_class = #{e.class.name}, error = #{e.message}"
|
46
46
|
end
|
@@ -201,16 +201,16 @@ module Fluent
|
|
201
201
|
def handle_v9_flowset_template(host, pdu, flowset)
|
202
202
|
flowset.flowset_data.templates.each do |template|
|
203
203
|
catch (:field) do
|
204
|
-
|
205
|
-
template.
|
204
|
+
template_fields = []
|
205
|
+
template.template_fields.each do |field|
|
206
206
|
entry = netflow_field_for(field.field_type, field.field_length)
|
207
207
|
throw :field unless entry
|
208
208
|
|
209
|
-
|
209
|
+
template_fields += entry
|
210
210
|
end
|
211
211
|
# We get this far, we have a list of fields
|
212
212
|
key = "#{host}|#{pdu.source_id}|#{template.template_id}"
|
213
|
-
@templates[key, @cache_ttl] = BinData::Struct.new(endian: :big, fields:
|
213
|
+
@templates[key, @cache_ttl] = BinData::Struct.new(endian: :big, fields: template_fields)
|
214
214
|
# Purge any expired templates
|
215
215
|
@templates.cleanup!
|
216
216
|
end
|
@@ -222,20 +222,20 @@ module Fluent
|
|
222
222
|
def handle_v9_flowset_options_template(host, pdu, flowset)
|
223
223
|
flowset.flowset_data.templates.each do |template|
|
224
224
|
catch (:field) do
|
225
|
-
|
225
|
+
template_fields = []
|
226
226
|
|
227
227
|
NETFLOW_V9_FIELD_CATEGORIES.each do |category|
|
228
228
|
template["#{category}_fields"].each do |field|
|
229
229
|
entry = netflow_field_for(field.field_type, field.field_length, category)
|
230
230
|
throw :field unless entry
|
231
231
|
|
232
|
-
|
232
|
+
template_fields += entry
|
233
233
|
end
|
234
234
|
end
|
235
235
|
|
236
236
|
# We get this far, we have a list of fields
|
237
237
|
key = "#{host}|#{pdu.source_id}|#{template.template_id}"
|
238
|
-
@templates[key, @cache_ttl] = BinData::Struct.new(endian: :big, fields:
|
238
|
+
@templates[key, @cache_ttl] = BinData::Struct.new(endian: :big, fields: template_fields)
|
239
239
|
# Purge any expired templates
|
240
240
|
@templates.cleanup!
|
241
241
|
end
|
@@ -265,8 +265,8 @@ module Fluent
|
|
265
265
|
|
266
266
|
array = BinData::Array.new(type: template, initial_length: length / template.num_bytes)
|
267
267
|
|
268
|
-
|
269
|
-
|
268
|
+
template_fields = array.read(flowset.flowset_data)
|
269
|
+
template_fields.each do |r|
|
270
270
|
if is_sampler?(r)
|
271
271
|
sampler_key = "#{host}|#{pdu.source_id}|#{r.flow_sampler_id}"
|
272
272
|
register_sampler_v9 sampler_key, r
|
@@ -307,7 +307,7 @@ module Fluent
|
|
307
307
|
end
|
308
308
|
|
309
309
|
def netflow_field_for(type, length, category='option')
|
310
|
-
unless field = @
|
310
|
+
unless field = @template_fields[category][type]
|
311
311
|
$log.warn "Skip unsupported field", type: type, length: length
|
312
312
|
return [:skip, nil, {length: length}]
|
313
313
|
end
|
data/test/test_parser_netflow.rb
CHANGED
@@ -20,7 +20,7 @@ class NetflowParserTest < Test::Unit::TestCase
|
|
20
20
|
test 'parse v5 binary data, dumped by netflow-generator' do
|
21
21
|
# generated by https://github.com/mshindo/NetFlow-Generator
|
22
22
|
parser = create_parser
|
23
|
-
raw_data = File.
|
23
|
+
raw_data = File.binread(File.join(__dir__, "dump/netflow.v5.dump"))
|
24
24
|
bytes_for_1record = 72
|
25
25
|
assert_equal bytes_for_1record, raw_data.size
|
26
26
|
parsed = []
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: fluent-plugin-netflow
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.2.
|
4
|
+
version: 0.2.3
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Masahiro Nakagawa
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2016-
|
11
|
+
date: 2016-07-28 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: fluentd
|
@@ -123,7 +123,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
123
123
|
version: '0'
|
124
124
|
requirements: []
|
125
125
|
rubyforge_project:
|
126
|
-
rubygems_version: 2.
|
126
|
+
rubygems_version: 2.5.1
|
127
127
|
signing_key:
|
128
128
|
specification_version: 4
|
129
129
|
summary: Netflow plugin for Fluentd
|