logstash-codec-sflow 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: a9773b581653d998b843923848706abfe5851dad
-  data.tar.gz: 92c48583c7b35ecdf55bd707e4196b671149cc91
+  metadata.gz: cd2eaaabdcac4aa04d07417a080f816d3ca10312
+  data.tar.gz: ed4a423a37954b8d3828da46f46b721c3970f208
 SHA512:
-  metadata.gz: 74eb65d450dbc9b1dc05dd784a1d0b7efca1eb8f82cc09d978049d672a98802dbdcd36ce652475baa31222c9cfadb5c814a7bed2277845584db6c1ecb8877331
-  data.tar.gz: 68dcb680539c692397aeaecaa4cc7f80fa5f381f7852450115e9b27c09609b19cf9acd3f822bc648d1c20defa63cd79944fea6ebd0bb20f8c630b8155eeaa943
+  metadata.gz: a4a26572a0c3cd25e870f3858be947ef83489932b20f097a5d8e7032954db83c3980e169acb1f3a96d9b562e1398fb6e02e4dfa2eb1650b9325ed07eaa164c56
+  data.tar.gz: 9ecbdf91625700f3a3396ff712b9a89bd2d5ba26858660d36be61a570ee479b9da8067bc58d5f1b4191e6301b674fc5358773dfd4d2aa243c13c66abc83f26f1

data/lib/logstash/codecs/sflow.rb

@@ -7,31 +7,21 @@ class LogStash::Codecs::Sflow < LogStash::Codecs::Base
   config_name 'sflow'
 
   # Specify which sflow must not be send in the event
-  config :optional_removed_field, :validate => :array, :default => ['sflow_version', 'ip_version', 'header_size',
-                                                                    'ip_header_length', 'ip_dscp', 'ip_ecn',
-                                                                    'ip_total_length', 'ip_identification', 'ip_flags',
-                                                                    'ip_fragment_offset', 'ip_ttl', 'ip_checksum',
-                                                                    'ip_options', 'tcp_seq_number', 'tcp_ack_number',
-                                                                    'tcp_header_length', 'tcp_reserved', 'tcp_is_nonce',
-                                                                    'tcp_is_cwr', 'tcp_is_ecn_echo', 'tcp_is_urgent',
-                                                                    'tcp_is_ack', 'tcp_is_push', 'tcp_is_reset',
-                                                                    'tcp_is_syn', 'tcp_is_fin', 'tcp_window_size',
-                                                                    'tcp_checksum', 'tcp_urgent_pointer', 'tcp_options']
+  config :optional_removed_field, :validate => :array, :default => %w(sflow_version ip_version header_size ip_header_length ip_dscp ip_ecn ip_total_length ip_identification ip_flags ip_fragment_offset ip_ttl ip_checksum ip_options tcp_seq_number tcp_ack_number tcp_header_length tcp_reserved tcp_is_nonce tcp_is_cwr tcp_is_ecn_echo tcp_is_urgent tcp_is_ack tcp_is_push tcp_is_reset tcp_is_syn tcp_is_fin tcp_window_size tcp_checksum tcp_urgent_pointer tcp_options)
 
 
   def initialize(params = {})
     super(params)
     @threadsafe = false
-    @removed_field = ['record_length', 'record_count', 'record_entreprise', 'record_format', 'sample_entreprise',
-                      'sample_format', 'sample_length', 'sample_count', 'sample_header', 'layer3', 'layer4',
-                      'tcp_nbits', 'ip_nbits'] | @optional_removed_field
+    # noinspection RubyResolve
+    @removed_field = %w(record_length record_count record_entreprise record_format sample_entreprise sample_format sample_length sample_count sample_header layer3 layer4 layer4_data header udata) | @optional_removed_field
   end
 
   # def initialize
 
   public
   def register
-    require "logstash/codecs/sflow/datagram"
+    require 'logstash/codecs/sflow/datagram'
   end
 
   # def register
@@ -100,15 +90,13 @@ class LogStash::Codecs::Sflow < LogStash::Codecs::Base
               end
             end
 
-            if record['record_data']['sample_header'].has_key?("layer3")
+            if record['record_data']['sample_header'].has_key?('layer3')
               record['record_data']['sample_header']['layer3']['header'].each_pair do |k, v|
                 unless k.to_s.eql? 'record_data' or @removed_field.include? k.to_s
                   event["#{k}"] = v
                 end
               end
-            end
 
-            unless record['record_data']['sample_header']['layer3']['header']['layer4'].to_s.eql? ''
               record['record_data']['sample_header']['layer3']['header']['layer4'].each_pair do |k, v|
                 unless k.to_s.eql? 'record_data' or @removed_field.include? k.to_s
                   event["#{k}"] = v
@@ -171,4 +159,4 @@ class LogStash::Codecs::Sflow < LogStash::Codecs::Base
       yield event
     end
   end # def decode
-end # class LogStash::Filters::Sflow
+end # class LogStash::Filters::Sflow

data/lib/logstash/codecs/sflow/counter_record.rb

@@ -2,6 +2,7 @@
 
 require 'bindata'
 
+# noinspection RubyResolve
 class GenericInterface < BinData::Record
   endian :big
   uint32 :interface_index
@@ -25,6 +26,7 @@ class GenericInterface < BinData::Record
   uint32 :promiscous_mode
 end
 
+# noinspection RubyResolve
 class EthernetInterfaces < BinData::Record
   endian :big
   uint32 :dot3StatsAlignmentErrors
@@ -42,6 +44,7 @@ class EthernetInterfaces < BinData::Record
   uint32 :dot3StatsSymbolErrors
 end
 
+# noinspection RubyResolve
 class TokenRing < BinData::Record
   endian :big
   uint32 :dot5StatsLineErrors
@@ -64,6 +67,7 @@ class TokenRing < BinData::Record
   uint32 :dot5StatsFreqErrors
 end
 
+# noinspection RubyResolve
 class HundredBaseVG < BinData::Record
   endian :big
   uint32 :dot12InHighPriorityFrames
@@ -82,6 +86,7 @@ class HundredBaseVG < BinData::Record
   uint64 :dot12HCOutHighPriorityOctets
 end
 
+# noinspection RubyResolve
 class Vlan < BinData::Record
   endian :big
   uint32 :vlan_id
@@ -93,6 +98,7 @@ class Vlan < BinData::Record
 end
 
 
+# noinspection RubyResolve
 class ProcessorInformation < BinData::Record
   endian :big
   uint32 :five_sec_cpu_percent
@@ -102,6 +108,7 @@ class ProcessorInformation < BinData::Record
   uint64 :free_memory
 end
 
+# noinspection RubyResolve
 class HttpCounters < BinData::Record
   endian :big
   uint32 :method_option_count

data/lib/logstash/codecs/sflow/datagram.rb

@@ -4,6 +4,7 @@ require 'bindata'
 require 'logstash/codecs/sflow/util'
 require 'logstash/codecs/sflow/sample'
 
+# noinspection RubyResolve
 class SFlow < BinData::Record
   endian :big
   uint32 :sflow_version
@@ -21,8 +22,8 @@ class SFlow < BinData::Record
     bit12 :sample_format
     uint32 :sample_length
     choice :sample_data, :selection => lambda { "#{sample_entreprise}-#{sample_format}" } do
-      flow_sample "0-1"
-      counter_sample "0-2"
+      flow_sample '0-1'
+      counter_sample '0-2'
       skip :default, :length => :sample_length
     end
   end

data/lib/logstash/codecs/sflow/flow_record.rb

@@ -4,6 +4,7 @@ require 'bindata'
 require 'logstash/codecs/sflow/util'
 require 'logstash/codecs/sflow/packet_header'
 
+# noinspection RubyResolve
 class RawPacketHeader < BinData::Record
   endian :big
   uint32 :protocol
@@ -17,6 +18,7 @@ class RawPacketHeader < BinData::Record
   end
 end
 
+# noinspection RubyResolve
 class EthernetFrameData < BinData::Record
   endian :big
   uint32 :packet_length
@@ -27,6 +29,7 @@ class EthernetFrameData < BinData::Record
   uint32 :type
 end
 
+# noinspection RubyResolve
 class IP4Data < BinData::Record
   endian :big
   uint32 :ip_packet_length
@@ -39,6 +42,7 @@ class IP4Data < BinData::Record
   uint32 :type
 end
 
+# noinspection RubyResolve
 class IP6Data < BinData::Record
   endian :big
   uint32 :ip_packet_length
@@ -51,6 +55,7 @@ class IP6Data < BinData::Record
   uint32 :ip_priority
 end
 
+# noinspection RubyResolve
 class ExtendedSwitchData < BinData::Record
   endian :big
   uint32 :src_vlan
@@ -59,6 +64,7 @@ class ExtendedSwitchData < BinData::Record
   uint32 :dst_priority
 end
 
+# noinspection RubyResolve
 class ExtendedRouterData < BinData::Record
   endian :big
   uint32 :ip_version

data/lib/logstash/codecs/sflow/packet_header.rb

@@ -4,6 +4,16 @@ require 'bindata'
 require 'logstash/codecs/sflow/util'
 
 
+# noinspection RubyResolve
+class UnknownHeader < BinData::Record
+  mandatory_parameter :size_header
+
+  endian :big
+  bit :udata, :nbits => :size_header
+end
+
+
+# noinspection RubyResolve,RubyResolve
 class TcpHeader < BinData::Record
   mandatory_parameter :size_header
 
@@ -29,22 +39,27 @@ class TcpHeader < BinData::Record
   array :tcp_options, :initial_length => lambda { (((tcp_header_length * 4) - 20)/4).ceil }, :onlyif => :is_options? do
     string :tcp_option, :length => 4, :pad_byte => "\0"
   end
-  bit :nbits => lambda { size_header - (tcp_header_length * 4 * 8) }
+  bit :layer4_data, :nbits => lambda { size_header - (tcp_header_length * 4 * 8) }
 
   def is_options?
     tcp_header_length.to_i > 5
   end
 end
 
+# noinspection RubyResolve
 class UdpHeader < BinData::Record
+  mandatory_parameter :size_header
+
   endian :big
   uint16 :src_port
   uint16 :dst_port
   uint16 :udp_length
   uint16 :udp_checksum
-  skip :length => lambda { udp_length - 64 } #skip udp data
+  #skip :length => lambda { udp_length - 64 } #skip udp data
+  bit :layer4_data, :nbits => lambda { size_header - 64 } #skip udp data
 end
 
+# noinspection RubyResolve,RubyResolve
 class IPV4Header < BinData::Record
   mandatory_parameter :size_header
 
@@ -66,8 +81,8 @@ class IPV4Header < BinData::Record
   end
   choice :layer4, :selection => :ip_protocol do
     tcp_header 6, :size_header => lambda { size_header - (ip_header_length * 4 * 8) }
-    udp_header 17
-    bit :default, :nbits => lambda { size_header - (ip_header_length * 4 * 8) }
+    udp_header 17, :size_header => lambda { size_header - (ip_header_length * 4 * 8) }
+    unknown_header :default, :size_header => lambda { size_header - (ip_header_length * 4 * 8) }
   end
 
   def is_options?
@@ -75,6 +90,8 @@ class IPV4Header < BinData::Record
   end
 end
 
+
+# noinspection RubyResolve
 class IPHeader < BinData::Record
   mandatory_parameter :size_header
 
@@ -82,10 +99,11 @@ class IPHeader < BinData::Record
   bit4 :ip_version
   choice :header, :selection => :ip_version do
     ipv4_header 4, :size_header => :size_header
-    bit :default, :nbits => lambda { size_header - 4 }
+    unknown_header :default, :size_header => lambda { size_header - 4 }
   end
 end
 
+# noinspection RubyResolve
 class EthernetHeader < BinData::Record
   mandatory_parameter :size_header
 
@@ -95,6 +113,6 @@ class EthernetHeader < BinData::Record
   uint16 :eth_type
   choice :layer3, :selection => :eth_type do
     ip_header 2048, :size_header => lambda { size_header - (14 * 8) }
-    bit :default, :nbits => lambda { size_header - (14 * 8) }
+    unknown_header :default, :size_header => lambda { size_header - (14 * 8) }
   end
-end
+end

data/lib/logstash/codecs/sflow/sample.rb

@@ -4,9 +4,10 @@ require 'bindata'
 require 'logstash/codecs/sflow/flow_record'
 require 'logstash/codecs/sflow/counter_record'
 
+# noinspection RubyResolve
 class FlowSample < BinData::Record
   endian :big
-  uint32 :sequence_number
+  uint32 :flow_sequence_number
   uint8 :source_id_type
   uint24 :source_id_index
   uint32 :sampling_rate
@@ -20,17 +21,18 @@ class FlowSample < BinData::Record
     bit12 :record_format
     uint32 :record_length
     choice :record_data, :selection => lambda { "#{record_entreprise}-#{record_format}" } do
-      raw_packet_header "0-1"
-      ethernet_frame_data "0-2"
-      ip4_data "0-3"
-      ip6_data "0-4"
-      extended_switch_data "0-1001"
-      extended_router_data "0-1002"
+      raw_packet_header '0-1'
+      ethernet_frame_data '0-2'
+      ip4_data '0-3'
+      ip6_data '0-4'
+      extended_switch_data '0-1001'
+      extended_router_data '0-1002'
       skip :default, :length => :record_length
     end
   end
 end
 
+# noinspection RubyResolve
 class CounterSample < BinData::Record
   endian :big
   uint32 :sample_seq_number
@@ -42,13 +44,13 @@ class CounterSample < BinData::Record
     bit12 :record_format
     uint32 :record_length
     choice :record_data, :selection => lambda { "#{record_entreprise}-#{record_format}" } do
-      generic_interface "0-1"
-      ethernet_interfaces "0-2"
-      token_ring "0-3"
-      hundred_base_vg "0-4"
-      vlan "0-5"
-      processor_information "0-1001"
-      http_counters "0-2201"
+      generic_interface '0-1'
+      ethernet_interfaces '0-2'
+      token_ring '0-3'
+      hundred_base_vg '0-4'
+      vlan '0-5'
+      processor_information '0-1001'
+      http_counters '0-2201'
       skip :default, :length => :record_length
     end
     #processor_information :record_data

data/lib/logstash/codecs/sflow/util.rb

@@ -3,6 +3,7 @@
 require 'bindata'
 require 'ipaddr'
 
+# noinspection RubyResolve
 class MacAddress < BinData::Primitive
   array :bytes, :type => :uint8, :initial_length => 6
 
@@ -12,17 +13,18 @@ class MacAddress < BinData::Primitive
   end
 
   def get
-    self.bytes.collect { |byte| byte.value.to_s(16).rjust(2, '0') }.join(":")
+    self.bytes.collect { |byte| byte.value.to_s(16).rjust(2, '0') }.join(':')
   end
 end
 
+# noinspection RubyResolve,RubyResolve,RubyResolve
 class IP4Addr < BinData::Primitive
   endian :big
   uint32 :storage
 
   def set(val)
     ip = IPAddr.new(val)
-    if !ip.ipv4?
+    unless ip.ipv4?
       raise ArgumentError, "invalid IPv4 address '#{val}'"
     end
     self.storage = ip.to_i
@@ -33,13 +35,14 @@ class IP4Addr < BinData::Primitive
   end
 end
 
+# noinspection RubyResolve
 class IP6Addr < BinData::Primitive
   endian :big
   uint128 :storage
 
   def set(val)
     ip = IPAddr.new(val)
-    if !ip.ipv6?
+    unless ip.ipv6?
       raise ArgumentError, "invalid IPv6 address `#{val}'"
     end
     self.storage = ip.to_i

data/logstash-codec-sflow.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name = 'logstash-codec-sflow'
-  s.version = '0.2.0'
+  s.version = '0.3.0'
   s.licenses = ['Apache License (2.0)']
   s.summary = "The sflow codec is for decoding SFlow v5 flows."
   s.description = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"

data/spec/codecs/sflow/packet_header_spec.rb

@@ -6,7 +6,7 @@ require "logstash/codecs/sflow/packet_header"
 describe UdpHeader do
   it "should decode udp header" do
     payload = IO.read(File.join(File.dirname(__FILE__), "udp.dat"), :mode => "rb")
-    decoded = UdpHeader.read(payload)
+    decoded = UdpHeader.new(:size_header => payload.bytesize * 8).read(payload)
 
     decoded["src_port"].to_s.should eq("20665")
     decoded["dst_port"].to_s.should eq("514")

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-codec-sflow
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Nicolas Fraison
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2015-12-13 00:00:00.000000000 Z
+date: 2015-12-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement