Pavel Odintsov
parent
bc095bc1c3
commit
db79cfb259
GPG Key ID:
4AEE18F83AFDEB23
@ -22,7 +22,7 @@ Supported packet capture engines
|
||||
--------------------------------
|
||||
- NetFlow v5, v9
|
||||
- IPFIX
|
||||
-  v4 (will be deprecated in 1.1.7), v5
|
||||
-  v5
|
||||
- PCAP
|
||||
- AF_PACKET
|
||||
- Netmap
|
||||
|
||||
@ -77,7 +77,7 @@ SET(CMAKE_SKIP_BUILD_RPATH FALSE)
|
||||
# Create builds in current folder with install RPATH
|
||||
SET(CMAKE_BUILD_WITH_INSTALL_RPATH TRUE)
|
||||
|
||||
SET(CMAKE_INSTALL_RPATH "${CMAKE_INSTALL_RPATH};${FASTNETMON_LIBRARIES_GLOBAL_PATH}/libhiredis_0_13/lib;${FASTNETMON_LIBRARIES_GLOBAL_PATH}/log4cpp1.1.1/lib;${FASTNETMON_LIBRARIES_GLOBAL_PATH}/luajit_2.0.4/lib;${FASTNETMON_LIBRARIES_GLOBAL_PATH}/ndpi/lib;${FASTNETMON_LIBRARIES_GLOBAL_PATH}/pf_ring_6.0.3/lib;${FASTNETMON_LIBRARIES_GLOBAL_PATH}/json-c-0.13/lib;${FASTNETMON_LIBRARIES_GLOBAL_PATH}/mongo_c_driver_1_1_9/lib;${FASTNETMON_LIBRARIES_GLOBAL_PATH}/grpc_1_27_3_e73882dc0fcedab1ffe789e44ed6254819639ce3/lib;${FASTNETMON_LIBRARIES_GLOBAL_PATH}/protobuf_3.11.4/lib")
|
||||
SET(CMAKE_INSTALL_RPATH "${CMAKE_INSTALL_RPATH};${FASTNETMON_LIBRARIES_GLOBAL_PATH}/libhiredis_0_13/lib;${FASTNETMON_LIBRARIES_GLOBAL_PATH}/log4cpp1.1.1/lib;${FASTNETMON_LIBRARIES_GLOBAL_PATH}/ndpi/lib;${FASTNETMON_LIBRARIES_GLOBAL_PATH}/pf_ring_6.0.3/lib;${FASTNETMON_LIBRARIES_GLOBAL_PATH}/json-c-0.13/lib;${FASTNETMON_LIBRARIES_GLOBAL_PATH}/mongo_c_driver_1_1_9/lib;${FASTNETMON_LIBRARIES_GLOBAL_PATH}/grpc_1_27_3_e73882dc0fcedab1ffe789e44ed6254819639ce3/lib;${FASTNETMON_LIBRARIES_GLOBAL_PATH}/protobuf_3.11.4/lib")
|
||||
|
||||
message(STATUS "C++ compilation flags: ${CMAKE_CXX_FLAGS_RELEASE}")
|
||||
|
||||
@ -208,7 +208,6 @@ add_library(ipfix_rfc STATIC ipfix_rfc.cpp)
|
||||
add_library(fastnetmon_packet_parser STATIC fastnetmon_packet_parser.c)
|
||||
|
||||
# -DENABLE_SNABBSWITCH_SUPPORT=ON ..
|
||||
# Please also comment out line: set(ENABLE_LUA_SUPPORT yes) if you want SnabbSwitch support
|
||||
if (ENABLE_SNABBSWITCH_SUPPORT)
|
||||
add_definitions(-DSNABB_SWITCH)
|
||||
add_library(snabbswitch_plugin STATIC snabbswitch_plugin/snabbswitch_collector.cpp)
|
||||
@ -288,31 +287,6 @@ if (ENABLE_DPI_SUPPORT)
|
||||
target_link_libraries(fast_dpi ${NDPI_LIBRARIES})
|
||||
endif()
|
||||
|
||||
# We do not enable it by default, it's testing feature
|
||||
# If you want it please build with:
|
||||
# cmake -DENABLE_LUA_SUPPORT=ON ..
|
||||
option(ENABLE_LUA_SUPPORT "Enable Lua support" OFF)
|
||||
if (ENABLE_LUA_SUPPORT)
|
||||
message(STATUS "We will enable LuaJIT support")
|
||||
|
||||
add_definitions(-DENABLE_LUA_HOOKS)
|
||||
|
||||
set(LUAJIT_CUSTOM_INSTALL_PATH "${FASTNETMON_LIBRARIES_GLOBAL_PATH}/luajit_2.0.4")
|
||||
|
||||
link_directories("${LUAJIT_CUSTOM_INSTALL_PATH}/lib")
|
||||
include_directories("${LUAJIT_CUSTOM_INSTALL_PATH}/include")
|
||||
|
||||
find_library(LUAJIT_LIBRARY_PATH NAMES luajit-5.1 PATHS "${LUAJIT_CUSTOM_INSTALL_PATH}/lib" NO_DEFAULT_PATH)
|
||||
|
||||
if (NOT LUAJIT_LIBRARY_PATH)
|
||||
message(FATAL_ERROR "Could not find luajit library")
|
||||
endif()
|
||||
|
||||
target_link_libraries(netflow_plugin ${LUAJIT_LIBRARY_PATH})
|
||||
target_link_libraries(sflow_plugin ${LUAJIT_LIBRARY_PATH})
|
||||
target_link_libraries(fast_library ${LUAJIT_LIBRARY_PATH})
|
||||
endif()
|
||||
|
||||
# pcap plugin
|
||||
add_library(pcap_plugin STATIC pcap_plugin/pcap_collector.cpp)
|
||||
target_link_libraries(pcap_plugin pcap)
|
||||
@ -582,11 +556,6 @@ target_link_libraries(fastnetmon ${LOG4CPP_LIBRARY_PATH})
|
||||
|
||||
target_link_libraries(fastnetmon ${CMAKE_THREAD_LIBS_INIT})
|
||||
|
||||
if (ENABLE_LUA_SUPPORT)
|
||||
target_link_libraries(fast_library ${LUAJIT_LIBRARY_PATH})
|
||||
target_link_libraries(fastnetmon ${LUAJIT_LIBRARY_PATH})
|
||||
endif()
|
||||
|
||||
# Our libs
|
||||
target_link_libraries(fastnetmon patricia)
|
||||
target_link_libraries(fastnetmon fastnetmon_pcap_format)
|
||||
|
||||
@ -918,67 +918,6 @@ bool manage_interface_promisc_mode(std::string interface_name, bool switch_on) {
|
||||
|
||||
#endif
|
||||
|
||||
#ifdef ENABLE_LUA_HOOKS
|
||||
lua_State* init_lua_jit(std::string lua_hooks_path) {
|
||||
extern log4cpp::Category& logger;
|
||||
|
||||
lua_State* lua_state = luaL_newstate();
|
||||
|
||||
if (lua_state == NULL) {
|
||||
logger << log4cpp::Priority::ERROR << "Can't create LUA session";
|
||||
|
||||
return NULL;
|
||||
}
|
||||
|
||||
// load libraries
|
||||
luaL_openlibs(lua_state);
|
||||
|
||||
int lua_load_file_result = luaL_dofile(lua_state, lua_hooks_path.c_str());
|
||||
|
||||
if (lua_load_file_result != 0) {
|
||||
logger << log4cpp::Priority::ERROR << "LuaJIT can't load file correctly from path: " << lua_hooks_path
|
||||
<< " disable LUA support";
|
||||
|
||||
return NULL;
|
||||
}
|
||||
|
||||
return lua_state;
|
||||
}
|
||||
|
||||
bool call_lua_function(std::string function_name,
|
||||
lua_State* lua_state_param,
|
||||
std::string client_addres_in_string_format,
|
||||
void* ptr) {
|
||||
extern log4cpp::Category& logger;
|
||||
|
||||
/* Function name */
|
||||
lua_getfield(lua_state_param, LUA_GLOBALSINDEX, function_name.c_str());
|
||||
|
||||
/* Function params */
|
||||
lua_pushstring(lua_state_param, client_addres_in_string_format.c_str());
|
||||
lua_pushlightuserdata(lua_state_param, ptr);
|
||||
|
||||
// Call with 1 argumnents and 1 result
|
||||
lua_call(lua_state_param, 2, 1);
|
||||
|
||||
if (lua_gettop(lua_state_param) == 1) {
|
||||
bool result = lua_toboolean(lua_state_param, -1) == 1 ? true : false;
|
||||
|
||||
// pop returned value
|
||||
lua_pop(lua_state_param, 1);
|
||||
|
||||
return result;
|
||||
} else {
|
||||
logger << log4cpp::Priority::ERROR << "We got " << lua_gettop(lua_state_param)
|
||||
<< " return values from the LUA, it's error, please check your LUA code";
|
||||
return false;
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
#endif
|
||||
|
||||
json_object* serialize_attack_description_to_json(attack_details& current_attack) {
|
||||
json_object* jobj = json_object_new_object();
|
||||
|
||||
|
||||
@ -24,10 +24,6 @@
|
||||
|
||||
#include "libpatricia/patricia.h"
|
||||
|
||||
#ifdef ENABLE_LUA_HOOKS
|
||||
#include <luajit-2.0/lua.hpp>
|
||||
#endif
|
||||
|
||||
#include "fast_endianless.hpp"
|
||||
|
||||
#define TCP_FIN_FLAG_SHIFT 1
|
||||
@ -106,14 +102,6 @@ subnet_t convert_subnet_from_string_to_binary_with_cidr_format(std::string subne
|
||||
bool manage_interface_promisc_mode(std::string interface_name, bool switch_on);
|
||||
#endif
|
||||
|
||||
#ifdef ENABLE_LUA_HOOKS
|
||||
lua_State* init_lua_jit(std::string lua_hooks_path);
|
||||
bool call_lua_function(std::string function_name,
|
||||
lua_State* lua_state_param,
|
||||
std::string client_addres_in_string_format,
|
||||
void* ptr);
|
||||
#endif
|
||||
|
||||
std::string serialize_attack_description(attack_details& current_attack);
|
||||
attack_type_t detect_attack_type(attack_details& current_attack);
|
||||
std::string get_printable_attack_name(attack_type_t attack);
|
||||
|
||||
@ -161,21 +161,13 @@ netflow_sampling_ratio = 1
|
||||
# We could try to get smoother data with this option, i.e. we will divide counters on collection interval time
|
||||
netflow_divide_counters_on_interval_length = off
|
||||
|
||||
# Process each netflow packet with LUA
|
||||
# This option is not default and you need build it additionally
|
||||
# netflow_lua_hooks_path = /usr/src/fastnetmon/src/netflow_hooks.lua
|
||||
|
||||
# sFLOW configuration
|
||||
# sFlow configuration
|
||||
|
||||
# It's possible to specify multiple ports here, using commas as delimiter
|
||||
sflow_port = 6343
|
||||
# sflow_port = 6343,6344
|
||||
sflow_host = 0.0.0.0
|
||||
|
||||
# process each sFLOW packet with LUA
|
||||
# This option is not default and you need build it additionally
|
||||
# sflow_lua_hooks_path = /usr/src/fastnetmon/src/sflow_hooks.lua
|
||||
|
||||
# sFlow processing QinQ
|
||||
sflow_qinq_process = off
|
||||
|
||||
|
||||
@ -202,7 +202,6 @@ if ($use_modern_pf_ring) {
|
||||
}
|
||||
|
||||
my $we_have_ndpi_support = '1';
|
||||
my $we_have_luajit_support = '';
|
||||
my $we_have_hiredis_support = '1';
|
||||
my $we_have_log4cpp_support = '1';
|
||||
my $we_have_pfring_support = '';
|
||||
@ -519,10 +518,6 @@ sub main {
|
||||
install_ndpi_dependencies();
|
||||
}
|
||||
|
||||
if ($we_have_luajit_support) {
|
||||
install_luajit_dependencies();
|
||||
}
|
||||
|
||||
if ($we_have_protobuf_support) {
|
||||
install_protobuf_dependencies();
|
||||
}
|
||||
@ -559,13 +554,6 @@ sub main {
|
||||
install_ndpi();
|
||||
}
|
||||
|
||||
if ($we_have_luajit_support) {
|
||||
install_luajit_dependencies();
|
||||
|
||||
install_luajit();
|
||||
install_luajit_libs();
|
||||
}
|
||||
|
||||
if ($we_have_hiredis_support) {
|
||||
install_hiredis();
|
||||
}
|
||||
@ -690,91 +678,6 @@ sub download_file {
|
||||
}
|
||||
}
|
||||
|
||||
sub install_luajit_dependencies {
|
||||
if ($os_type eq 'freebsd') {
|
||||
exec_command("pkg install -y gcc gmake");
|
||||
}
|
||||
}
|
||||
|
||||
sub install_luajit {
|
||||
chdir $temp_folder_for_building_project;
|
||||
|
||||
my $archive_file_name = "LuaJIT-2.0.4.tar.gz";
|
||||
|
||||
my $luajit_install_path = "$library_install_folder/luajit_2.0.4";
|
||||
|
||||
if (-e $luajit_install_path && defined($ENV{'CI'})) {
|
||||
print "Luajit was installed already\n";
|
||||
return 1;
|
||||
}
|
||||
|
||||
print "Download Luajit\n";
|
||||
|
||||
my $luajit_download_result = download_file(
|
||||
"http://luajit.org/download/$archive_file_name",
|
||||
$archive_file_name,
|
||||
'6e533675180300e85d12c4bbeea2d0e41ad21172'
|
||||
);
|
||||
|
||||
unless ($luajit_download_result) {
|
||||
fast_die("Can't download luajit");
|
||||
}
|
||||
|
||||
print "Unpack Luajit\n";
|
||||
exec_command("tar -xf LuaJIT-2.0.4.tar.gz");
|
||||
chdir "LuaJIT-2.0.4";
|
||||
|
||||
if ($os_type eq 'macosx' or $os_type eq 'freebsd') {
|
||||
# FreeBSD's sed has slightly different syntax
|
||||
exec_command("sed -i -e 's#export PREFIX= /usr/local#export PREFIX= $luajit_install_path#' Makefile");
|
||||
} else {
|
||||
# Standard Linux sed
|
||||
exec_command("sed -i 's#export PREFIX= /usr/local#export PREFIX= $luajit_install_path#' Makefile");
|
||||
}
|
||||
|
||||
print "Build and install Luajit\n";
|
||||
if ($os_type eq 'freebsd') {
|
||||
exec_command('gmake CC=gcc48 CXX=g++48 CPP="gcc48 -E" install')
|
||||
} else {
|
||||
exec_command("make $make_options install");
|
||||
}
|
||||
}
|
||||
|
||||
sub install_luajit_libs {
|
||||
install_lua_lpeg();
|
||||
install_lua_json();
|
||||
}
|
||||
|
||||
sub install_lua_lpeg {
|
||||
print "Install LUA lpeg module\n";
|
||||
|
||||
print "Download archive\n";
|
||||
chdir $temp_folder_for_building_project;
|
||||
|
||||
my $archive_file_name = 'lpeg-0.12.2.tar.gz';
|
||||
|
||||
my $lpeg_download_result = download_file("http://www.inf.puc-rio.br/~roberto/lpeg/$archive_file_name",
|
||||
$archive_file_name, '69eda40623cb479b4a30fb3720302d3a75f45577');
|
||||
|
||||
unless ($lpeg_download_result) {
|
||||
fast_die("Can't download lpeg");
|
||||
}
|
||||
|
||||
exec_command("tar -xf lpeg-0.12.2.tar.gz");
|
||||
chdir "lpeg-0.12.2";
|
||||
|
||||
# Set path
|
||||
print "Install lpeg library\n";
|
||||
if ($os_type eq 'macosx' or $os_type eq 'freebsd') {
|
||||
exec_command("sed -i -e 's#LUADIR = ../lua/#LUADIR = $library_install_folder/luajit_2.0.4/include/luajit-2.0#' makefile");
|
||||
} else {
|
||||
exec_command("sed -i 's#LUADIR = ../lua/#LUADIR = $library_install_folder/luajit_2.0.4/include/luajit-2.0#' makefile");
|
||||
}
|
||||
|
||||
exec_command("make $make_options");
|
||||
exec_command("cp lpeg.so $library_install_folder/luajit_2.0.4/lib/lua/5.1");
|
||||
}
|
||||
|
||||
sub install_json_c {
|
||||
my $archive_name = 'json-c-0.13-20171207.tar.gz';
|
||||
my $install_path = "$library_install_folder/json-c-0.13";
|
||||
@ -815,30 +718,6 @@ sub install_json_c {
|
||||
exec_command("make $make_options install");
|
||||
}
|
||||
|
||||
sub install_lua_json {
|
||||
print "Install LUA json module\n";
|
||||
|
||||
chdir $temp_folder_for_building_project;
|
||||
|
||||
print "Download archive\n";
|
||||
|
||||
my $archive_file_name = '1.3.3.tar.gz';
|
||||
|
||||
my $lua_json_download_result = download_file("https://github.com/harningt/luajson/archive/$archive_file_name", $archive_file_name,
|
||||
'53455f697c3f1d7cc955202062e97bbafbea0779');
|
||||
|
||||
unless ($lua_json_download_result) {
|
||||
fast_die("Can't download lua json");
|
||||
}
|
||||
|
||||
exec_command("tar -xf $archive_file_name");
|
||||
|
||||
chdir "luajson-1.3.3";
|
||||
|
||||
print "Install it\n";
|
||||
exec_command("PREFIX=$library_install_folder/luajit_2.0.4 make $make_options install");
|
||||
}
|
||||
|
||||
sub install_init_scripts {
|
||||
# Init file for any systemd aware distro
|
||||
my $systemd_distro = '';
|
||||
@ -1929,11 +1808,6 @@ sub install_fastnetmon {
|
||||
system("sed -i 's/netmap_plugin fastnetmon_packet_parser/netmap_plugin fastnetmon_packet_parser unified_parser/' ../CMakeLists.txt")
|
||||
}
|
||||
|
||||
# We do not need LUA by default
|
||||
unless ($we_have_luajit_support) {
|
||||
$cmake_params .= " -DENABLE_LUA_SUPPORT=OFF ";
|
||||
}
|
||||
|
||||
# We use $configure_options to pass CC and CXX variables about custom compiler when we use it
|
||||
if ((defined($ENV{'TRAVIS'}) && $ENV{'TRAVIS'}) or (defined($ENV{'CI'}) && $ENV{'CI'})) {
|
||||
system("$configure_options $ld_library_path_for_make $cmake_path .. $cmake_params");
|
||||
|
||||
@ -1,58 +0,0 @@
|
||||
package.path = package.path .. ";/usr/share/lua/5.1/?.lua"
|
||||
|
||||
local json = require("json")
|
||||
|
||||
-- We have this library bundled only in luajit:
|
||||
-- g++ lua_integration.cpp -lluajit-5.1
|
||||
|
||||
-- Before production use, please call your code with luajit CLI
|
||||
local ffi = require("ffi")
|
||||
|
||||
-- Load declaration from the inside separate header file
|
||||
-- This code should be in sync with https://github.com/pavel-odintsov/fastnetmon/blob/master/src/netflow_plugin/netflow.h
|
||||
-- And we use uintXX_t instead u_intXX_t here
|
||||
ffi.cdef([[typedef struct __attribute__((packed)) NF5_FLOW {
|
||||
uint32_t src_ip, dest_ip, nexthop_ip;
|
||||
uint16_t if_index_in, if_index_out;
|
||||
uint32_t flow_packets, flow_octets;
|
||||
uint32_t flow_start, flow_finish;
|
||||
uint16_t src_port, dest_port;
|
||||
uint8_t pad1;
|
||||
uint8_t tcp_flags, protocol, tos;
|
||||
uint16_t src_as, dest_as;
|
||||
uint8_t src_mask, dst_mask;
|
||||
uint16_t pad2;
|
||||
} NF5_FLOW_t;]])
|
||||
|
||||
-- Load json file once
|
||||
local json_file = io.open("/usr/src/fastnetmon/src/tests/netflow_exclude.json", "r")
|
||||
local decoded = json.decode(json_file:read("*all"))
|
||||
|
||||
--for k, v in pairs(decoded) do
|
||||
-- for kk, vv in pairs(v) do
|
||||
-- print(k, kk, vv)
|
||||
-- end
|
||||
--end
|
||||
|
||||
function process_netflow(flow_agent_ip, flow)
|
||||
local netlflow5_t = ffi.typeof('NF5_FLOW_t*')
|
||||
local lua_flow = ffi.cast(netlflow5_t, flow)
|
||||
|
||||
--print ("We got this packets from: ", flow_agent_ip)
|
||||
-- TODO: PLEASE BE AWARE! Thid code will read json file for every netflow packet
|
||||
--print ("Flow packets and bytes: ", lua_flow.flow_packets, lua_flow.flow_octets)
|
||||
--print ("In interface :", lua_flow.if_index_in, " out interface: ", lua_flow.if_index_out)
|
||||
|
||||
for agent_ip, ports_table in pairs(decoded) do
|
||||
if agent_ip == flow_agent_ip then
|
||||
for port_number, port_description in pairs(ports_table) do
|
||||
if lua_flow.if_index_in == port_number then
|
||||
-- We found this port in ignore list
|
||||
return false
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
return true
|
||||
end
|
||||
@ -128,7 +128,6 @@ int main(int argc, char* argv[]) {
|
||||
// Required by Netmap and PF_RING plugins
|
||||
// We use fake interface name here because netmap could make server unreachable :)
|
||||
configuration_map["interfaces"] = "ethXXX";
|
||||
configuration_map["sflow_lua_hooks_path"] = "/usr/src/fastnetmon_lua/src/sflow_hooks.lua";
|
||||
|
||||
if (strstr(argv[1], "sflow") != NULL) {
|
||||
std::cout << "Starting sflow" << std::endl;
|
||||
|
||||
@ -172,7 +172,7 @@ DOC
|
||||
put_text_to_file("$rpm_sources_path/systemd_init", $systemd_init_script);
|
||||
|
||||
# Create files list from archive
|
||||
# ./luajit_2.0.4/
|
||||
# ./libname_1.2.3/
|
||||
my @files_list = `tar -tf /root/rpmbuild/SOURCES/archive.tar.gz`;
|
||||
chomp @files_list;
|
||||
|
||||
|
||||
@ -1,223 +0,0 @@
|
||||
local json = require("json")
|
||||
|
||||
-- We have this library bundled only in luajit:
|
||||
-- g++ lua_integration.cpp -lluajit-5.1
|
||||
|
||||
-- Before production use, please call your code with luajit CLI
|
||||
local ffi = require("ffi")
|
||||
|
||||
-- Load declaration from the inside separate header file
|
||||
-- This code should be in sync with https://github.com/pavel-odintsov/fastnetmon/blob/master/src/sflow_plugin/sflow_data.h
|
||||
-- We have changed all defines to actual values
|
||||
ffi.cdef([[
|
||||
typedef unsigned char u_char;
|
||||
typedef long time_t;
|
||||
|
||||
typedef struct _SFLIf_counters {
|
||||
uint32_t ifIndex;
|
||||
uint32_t ifType;
|
||||
uint64_t ifSpeed;
|
||||
uint32_t ifDirection; /* Derived from MAU MIB (RFC 2668)
|
||||
0 = unknown, 1 = full-duplex,
|
||||
2 = half-duplex, 3 = in, 4 = out */
|
||||
uint32_t ifStatus; /* bit field with the following bits assigned:
|
||||
bit 0 = ifAdminStatus (0 = down, 1 = up)
|
||||
bit 1 = ifOperStatus (0 = down, 1 = up) */
|
||||
uint64_t ifInOctets;
|
||||
uint32_t ifInUcastPkts;
|
||||
uint32_t ifInMulticastPkts;
|
||||
uint32_t ifInBroadcastPkts;
|
||||
uint32_t ifInDiscards;
|
||||
uint32_t ifInErrors;
|
||||
uint32_t ifInUnknownProtos;
|
||||
uint64_t ifOutOctets;
|
||||
uint32_t ifOutUcastPkts;
|
||||
uint32_t ifOutMulticastPkts;
|
||||
uint32_t ifOutBroadcastPkts;
|
||||
uint32_t ifOutDiscards;
|
||||
uint32_t ifOutErrors;
|
||||
uint32_t ifPromiscuousMode;
|
||||
} SFLIf_counters;
|
||||
|
||||
typedef struct { uint32_t addr; } SFLIPv4;
|
||||
|
||||
typedef struct { u_char addr[16]; } SFLIPv6;
|
||||
|
||||
typedef union _SFLAddress_value {
|
||||
SFLIPv4 ip_v4;
|
||||
SFLIPv6 ip_v6;
|
||||
} SFLAddress_value;
|
||||
|
||||
typedef struct _SFLAddress {
|
||||
uint32_t type; /* enum SFLAddress_type */
|
||||
SFLAddress_value address;
|
||||
} SFLAddress;
|
||||
typedef struct _SFSample {
|
||||
SFLAddress sourceIP;
|
||||
SFLAddress agent_addr;
|
||||
uint32_t agentSubId;
|
||||
|
||||
/* the raw pdu */
|
||||
uint8_t* rawSample;
|
||||
uint32_t rawSampleLen;
|
||||
uint8_t* endp;
|
||||
time_t pcapTimestamp;
|
||||
|
||||
/* decode cursor */
|
||||
uint32_t* datap;
|
||||
|
||||
uint32_t datagramVersion;
|
||||
uint32_t sampleType;
|
||||
uint32_t elementType;
|
||||
uint32_t ds_class;
|
||||
uint32_t ds_index;
|
||||
|
||||
/* generic interface counter sample */
|
||||
SFLIf_counters ifCounters;
|
||||
|
||||
/* sample stream info */
|
||||
uint32_t sysUpTime;
|
||||
uint32_t sequenceNo;
|
||||
uint32_t sampledPacketSize;
|
||||
uint32_t samplesGenerated;
|
||||
uint32_t meanSkipCount;
|
||||
uint32_t samplePool;
|
||||
uint32_t dropEvents;
|
||||
|
||||
/* the sampled header */
|
||||
uint32_t packet_data_tag;
|
||||
uint32_t headerProtocol;
|
||||
uint8_t* header;
|
||||
int headerLen;
|
||||
uint32_t stripped;
|
||||
|
||||
/* header decode */
|
||||
int gotIPV4;
|
||||
int gotIPV4Struct;
|
||||
int offsetToIPV4;
|
||||
int gotIPV6;
|
||||
int gotIPV6Struct;
|
||||
int offsetToIPV6;
|
||||
int offsetToPayload;
|
||||
SFLAddress ipsrc;
|
||||
SFLAddress ipdst;
|
||||
uint32_t dcd_ipProtocol;
|
||||
uint32_t dcd_ipTos;
|
||||
uint32_t dcd_ipTTL;
|
||||
uint32_t dcd_sport;
|
||||
uint32_t dcd_dport;
|
||||
uint32_t dcd_tcpFlags;
|
||||
uint32_t ip_fragmentOffset;
|
||||
uint32_t udp_pduLen;
|
||||
|
||||
/* ports */
|
||||
uint32_t inputPortFormat;
|
||||
uint32_t outputPortFormat;
|
||||
uint32_t inputPort;
|
||||
uint32_t outputPort;
|
||||
|
||||
/* ethernet */
|
||||
uint32_t eth_type;
|
||||
uint32_t eth_len;
|
||||
uint8_t eth_src[8];
|
||||
uint8_t eth_dst[8];
|
||||
|
||||
/* vlan */
|
||||
uint32_t in_outer_vlan;
|
||||
uint32_t in_vlan;
|
||||
uint32_t in_priority;
|
||||
uint32_t internalPriority;
|
||||
uint32_t out_vlan;
|
||||
uint32_t out_priority;
|
||||
int vlanFilterReject;
|
||||
|
||||
/* extended data fields */
|
||||
uint32_t num_extended;
|
||||
uint32_t extended_data_tag;
|
||||
|
||||
/* IP forwarding info */
|
||||
SFLAddress nextHop;
|
||||
uint32_t srcMask;
|
||||
uint32_t dstMask;
|
||||
|
||||
/* BGP info */
|
||||
SFLAddress bgp_nextHop;
|
||||
uint32_t my_as;
|
||||
uint32_t src_as;
|
||||
uint32_t src_peer_as;
|
||||
uint32_t dst_as_path_len;
|
||||
uint32_t* dst_as_path;
|
||||
/* note: version 4 dst as path segments just get printed, not stored here, however
|
||||
* the dst_peer and dst_as are filled in, since those are used for netflow encoding
|
||||
*/
|
||||
uint32_t dst_peer_as;
|
||||
uint32_t dst_as;
|
||||
|
||||
uint32_t communities_len;
|
||||
uint32_t* communities;
|
||||
uint32_t localpref;
|
||||
|
||||
/* user id */
|
||||
uint32_t src_user_charset;
|
||||
uint32_t src_user_len;
|
||||
char src_user[200 + 1];
|
||||
uint32_t dst_user_charset;
|
||||
uint32_t dst_user_len;
|
||||
char dst_user[200 + 1];
|
||||
|
||||
/* url */
|
||||
uint32_t url_direction;
|
||||
uint32_t url_len;
|
||||
char url[200 + 1];
|
||||
uint32_t host_len;
|
||||
char host[200 + 1];
|
||||
|
||||
/* mpls */
|
||||
SFLAddress mpls_nextHop;
|
||||
|
||||
/* nat */
|
||||
SFLAddress nat_src;
|
||||
SFLAddress nat_dst;
|
||||
|
||||
/* counter blocks */
|
||||
uint32_t statsSamplingInterval;
|
||||
uint32_t counterBlockVersion;
|
||||
|
||||
/* exception handler context */
|
||||
//jmp_buf env;
|
||||
} SFSample;
|
||||
]])
|
||||
|
||||
-- Load json file once
|
||||
local json_file = io.open("/usr/src/fastnetmon/src/tests/netflow_exclude.json", "r")
|
||||
local decoded = json.decode(json_file:read("*all"))
|
||||
|
||||
|
||||
function process_sflow(flow_agent_ip, flow)
|
||||
local sflow_t = ffi.typeof('SFSample*')
|
||||
local lua_sflow = ffi.cast(sflow_t, flow)
|
||||
|
||||
--print ("We got this packets from: ", flow_agent_ip)
|
||||
-- TODO: PLEASE BE AWARE! Thid code will read json file for every packet
|
||||
--print ("Flow packets and bytes: ", lua_flow.flow_packets, lua_flow.flow_octets)
|
||||
print ("Agent IP", flow_agent_ip," in interface :", lua_sflow.inputPort, " out interface: ", lua_sflow.outputPort)
|
||||
|
||||
for agent_ip, ports_table in pairs(decoded) do
|
||||
if agent_ip == flow_agent_ip then
|
||||
for port_number, port_description in pairs(ports_table) do
|
||||
if lua_sflow.outputPort == port_number then
|
||||
-- We found this port in ignore list
|
||||
return false
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
--for k,v in pairs(decoded) do
|
||||
-- for kk, vv in pairs(v) do
|
||||
-- --print(k, kk, vv)
|
||||
-- end
|
||||
--end
|
||||
|
||||
return true
|
||||
end
|
||||
@ -1,49 +0,0 @@
|
||||
#include <lua5.1/lua.hpp>
|
||||
|
||||
// Heh, we have luajit only for Debian Jessie and should think about custom compilation
|
||||
// https://packages.debian.org/search?keywords=luajit
|
||||
|
||||
// This code will NOT work with lua 5.2 because 5.1 and 5.2 really incompatible:
|
||||
// http://lists.opensuse.org/opensuse-factory/2012-01/msg00265.html
|
||||
// Ubuntu 14.04 also has it: http://packages.ubuntu.com/trusty/luajit
|
||||
|
||||
// apt-get install -y lua5.1 lua-json liblua5.1-dev
|
||||
// g++ lua_integration.cpp -lluajit-5.1
|
||||
|
||||
// Unfortunately, we haven't support for FFI in standard lua and should switch to luajit:
|
||||
// Info about bundled modules to luajit: http://luajit.org/extensions.html
|
||||
// apt-get install -y libluajit-5.1-dev
|
||||
int main() {
|
||||
typedef struct netflow_struct {
|
||||
int packets;
|
||||
int bytes;
|
||||
} netflow_t;
|
||||
netflow_t flow;
|
||||
|
||||
flow.packets = 55;
|
||||
flow.bytes = 77;
|
||||
|
||||
lua_State* L = luaL_newstate();
|
||||
// load libraries
|
||||
luaL_openlibs(L);
|
||||
|
||||
luaL_dofile(L, "json_parser.lua");
|
||||
// luaL_dostring(L, "a = 10 + 5");
|
||||
// lua_getglobal(L, "a");
|
||||
// int i = lua_tointeger(L, -1);
|
||||
// printf("%d\n", i);
|
||||
lua_getfield(L, LUA_GLOBALSINDEX, "process_netflow");
|
||||
// lua_pushstring(L, "first_arg");
|
||||
|
||||
lua_pushlightuserdata(L, (void*)&flow);
|
||||
|
||||
// Call with 1 argumnents and 1 result
|
||||
lua_call(L, 1, 1);
|
||||
|
||||
printf("Lua gettop: %d\n", lua_gettop(L));
|
||||
printf("Boolean result: %d\n", lua_toboolean(L, -1));
|
||||
|
||||
lua_close(L);
|
||||
|
||||
return 0;
|
||||
}
|
||||
@ -1,169 +0,0 @@
|
||||
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
|
||||
index a65734b..8a52b0b 100644
|
||||
--- a/src/CMakeLists.txt
|
||||
+++ b/src/CMakeLists.txt
|
||||
@@ -5,6 +5,13 @@ cmake_minimum_required (VERSION 2.8)
|
||||
# Debian 7 - 2.8.9
|
||||
# CentOS 6 - 2.8.12
|
||||
|
||||
+# We should set compiler berfor project() call
|
||||
+if (ENABLE_BUILD_IN_CPP_11_CUSTOM_ENVIRONMENT)
|
||||
+ # We use custom compiler too
|
||||
+ set(CMAKE_C_COMPILER "/opt/gcc520/bin/gcc")
|
||||
+ set(CMAKE_CXX_COMPILER "/opt/gcc520/bin/g++")
|
||||
+endif()
|
||||
+
|
||||
project(FastNetMon)
|
||||
|
||||
# Unfortunately, Debian Squeeze haven't support for this feature
|
||||
@@ -20,11 +27,42 @@ set (FASTNETMON_VERSION_MINOR 1)
|
||||
|
||||
# cmake -DENABLE_BUILD_IN_CPP_11_CUSTOM_ENVIRONMENT=ON ..
|
||||
if (ENABLE_BUILD_IN_CPP_11_CUSTOM_ENVIRONMENT)
|
||||
- # We use custom compiler too
|
||||
- set(CMAKE_C_COMPILER "/opt/gcc520/bin/gcc")
|
||||
- set(CMAKE_CXX_COMPILER "/opt/gcc520/bin/g++")
|
||||
+ # Set blank sysroot
|
||||
+ #set(CMAKE_SYSROOT "/opt/glibc_2.22")
|
||||
+
|
||||
+ set(MY_LINK_DIRECTORIES "/opt/glibc_2.22/lib;/opt/gcc520/lib64;/opt/boost_1_58_0/stage/lib;/opt/libhiredis_0_13/lib;/opt/log4cpp1.1.1/lib;/opt/luajit_2.0.4/lib;/opt/ndpi/lib;/opt/pf_ring/lib;/opt/json-c-0.12/lib")
|
||||
+ set(MY_INCLUDE_DIRECTORIES "/opt/glibc_2.22/include")
|
||||
+
|
||||
+ # TODO: onlt temp code
|
||||
+ include_directories("/usr/include/x86_64-linux-gnu")
|
||||
+ include_directories("/usr/include")
|
||||
+ #include_directories("/usr/src/linux-headers-3.16.0-4-common/include/uapi")
|
||||
+
|
||||
+ # Remove all standard path's for C and C++ compilers
|
||||
+ set(CMAKE_CXX_IMPLICIT_LINK_DIRECTORIES "")
|
||||
+ set(CMAKE_CXX_IMPLICIT_INCLUDE_DIRECTORIES "")
|
||||
+ set(CMAKE_CXX_IMPLICIT_LINK_LIBRARIES "")
|
||||
+
|
||||
+ set(CMAKE_C_IMPLICIT_LINK_DIRECTORIES "")
|
||||
+ set(CMAKE_C_IMPLICIT_INCLUDE_DIRECTORIES "")
|
||||
+ set(CMAKE_C_IMPLICIT_LINK_LIBRARIES "")
|
||||
+
|
||||
+ # Remove all default paths for platform
|
||||
+ set(CMAKE_PLATFORM_IMPLICIT_LINK_DIRECTORIES "")
|
||||
+ set(CMAKE_SYSTEM_INCLUDE_PATH "${MY_INCLUDE_DIRECTORIES}")
|
||||
+
|
||||
+ set(CMAKE_C_IMPLICIT_LINK_DIRECTORIES "${MY_LINK_DIRECTORIES}")
|
||||
+ set(CMAKE_C_IMPLICIT_INCLUDE_DIRECTORIES "${MY_LINK_DIRECTORIES}")
|
||||
+ set(CMAKE_C_IMPLICIT_LINK_LIBRARIES "c")
|
||||
+
|
||||
+ # Specify path's to custom compiled gcc and glibc
|
||||
+ set(CMAKE_CXX_IMPLICIT_LINK_LIBRARIES "stdc++;gcc;gcc_s;m;c")
|
||||
+ set(CMAKE_CXX_IMPLICIT_INCLUDE_DIRECTORIES "${MY_LINK_DIRECTORIES}")
|
||||
+ set(CMAKE_CXX_IMPLICIT_LINK_DIRECTORIES "${MY_LINK_DIRECTORIES}")
|
||||
|
||||
set(BOOST_INCLUDEDIR "/opt/boost_1_58_0")
|
||||
+ include_directories("${BOOST_INCLUDEDIR}")
|
||||
+
|
||||
set(BOOST_LIBRARYDIR "/opt/boost_1_58_0/stage/lib/")
|
||||
|
||||
# It's really nice part of this custom build process :)
|
||||
@@ -32,6 +70,9 @@ if (ENABLE_BUILD_IN_CPP_11_CUSTOM_ENVIRONMENT)
|
||||
|
||||
# Disable warning from Boost when compiling with gcc 5.2
|
||||
set(CMAKE_CXX_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE} -Wno-deprecated-declarations")
|
||||
+
|
||||
+ # Specify custom ld-linux dynamic linker path
|
||||
+ set(CMAKE_CXX_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE} -Wl,--dynamic-linker=/opt/glibc_2.22/lib/ld-linux-x86-64.so.2")
|
||||
|
||||
# Specify full RPATH for build tree
|
||||
SET(CMAKE_SKIP_BUILD_RPATH FALSE)
|
||||
@@ -39,7 +80,7 @@ if (ENABLE_BUILD_IN_CPP_11_CUSTOM_ENVIRONMENT)
|
||||
# Create builds in current folder with install RPATH
|
||||
SET(CMAKE_BUILD_WITH_INSTALL_RPATH TRUE)
|
||||
|
||||
- SET(CMAKE_INSTALL_RPATH "/opt/gcc520/lib64;/opt/boost_1_58_0/stage/lib;/opt/libhiredis_0_13/lib;/opt/log4cpp1.1.1/lib;/opt/luajit_2.0.4/lib;/opt/ndpi/lib;/opt/pf_ring/lib;/opt/json-c-0.12/lib")
|
||||
+ SET(CMAKE_INSTALL_RPATH "${MY_LINK_DIRECTORIES}")
|
||||
endif()
|
||||
|
||||
# It's pretty safe and provide big speedup for our packet processor and patricia code
|
||||
@@ -169,7 +210,15 @@ endif()
|
||||
add_library(pcap_plugin STATIC pcap_plugin/pcap_collector.cpp)
|
||||
target_link_libraries(pcap_plugin pcap)
|
||||
|
||||
-find_package(Threads)
|
||||
+#find_package(Threads)
|
||||
+
|
||||
+#if (Threads_FOUND)
|
||||
+# message(STATUS "We found threads library")
|
||||
+#else()
|
||||
+# message(FATAL_ERROR "We can't find threads library")
|
||||
+#endif()
|
||||
+# TODO: fix this hack
|
||||
+set(CMAKE_THREAD_LIBS_INIT "-lpthread")
|
||||
|
||||
if (ENABLE_PFRING_SUPPORT)
|
||||
add_library(pfring_plugin STATIC pfring_plugin/pfring_collector.cpp)
|
||||
@@ -247,7 +296,7 @@ if (LOG4CPP_INCLUDES_FOLDER AND LOG4CPP_LIBRARY_PATH)
|
||||
include_directories(${LOG4CPP_INCLUDES_FOLDER})
|
||||
message(STATUS "We have found log4cpp and will build project")
|
||||
else()
|
||||
- message(STATUS "We can't find log4cpp. We can't build project")
|
||||
+ message(FATAL_ERROR "We can't find log4cpp. We can't build project")
|
||||
endif()
|
||||
|
||||
### Look for jsonc
|
||||
@@ -259,7 +308,7 @@ if (JSONC_INCLUDES_FOLDER AND JSONC_LIBRARY_PATH)
|
||||
include_directories(${JSONC_INCLUDES_FOLDER})
|
||||
message(STATUS "We have found json-c library correctly: ${JSONC_LIBRARY_PATH}")
|
||||
else()
|
||||
- message(STATUS "We can't find json-c library! Can't build project")
|
||||
+ message(FATAL_ERROR "We can't find json-c library! Can't build project")
|
||||
endif()
|
||||
|
||||
target_link_libraries(fast_library ${JSONC_LIBRARY_PATH})
|
||||
diff --git a/src/tests/patch_for_custom_libc.patch b/src/tests/patch_for_custom_libc.patch
|
||||
index 6426400..c7ea4ff 100644
|
||||
--- a/src/tests/patch_for_custom_libc.patch
|
||||
+++ b/src/tests/patch_for_custom_libc.patch
|
||||
@@ -1,46 +0,0 @@
|
||||
-diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
|
||||
-index a65734b..406a5b9 100644
|
||||
---- a/src/CMakeLists.txt
|
||||
-+++ b/src/CMakeLists.txt
|
||||
-@@ -27,11 +27,32 @@ if (ENABLE_BUILD_IN_CPP_11_CUSTOM_ENVIRONMENT)
|
||||
- set(BOOST_INCLUDEDIR "/opt/boost_1_58_0")
|
||||
- set(BOOST_LIBRARYDIR "/opt/boost_1_58_0/stage/lib/")
|
||||
-
|
||||
-+ # Remove all system directories with default libraries
|
||||
-+ message(STATUS "CMAKE_CXX_IMPLICIT_LINK_DIRECTORIES=${CMAKE_CXX_IMPLICIT_LINK_DIRECTORIES}")
|
||||
-+ set(CMAKE_CXX_IMPLICIT_LINK_DIRECTORIES "")
|
||||
-+
|
||||
-+ message(STATUS "CMAKE_CXX_IMPLICIT_INCLUDE_DIRECTORIES = ${CMAKE_CXX_IMPLICIT_INCLUDE_DIRECTORIES}")
|
||||
-+ set(CMAKE_CXX_IMPLICIT_INCLUDE_DIRECTORIES "/opt/glibc_2.22/include")
|
||||
-+
|
||||
-+ set(CMAKE_CXX_IMPLICIT_LINK_DIRECTORIES "/opt/glibc_2.22/lib;/opt/gcc520/lib64;/opt/glibc_2.22/lib;/opt/gcc520/lib/gcc/x86_64-unknown-linux-gnu/5.2.0")
|
||||
-+ include_directories("/opt/glibc_2.22/include")
|
||||
-+
|
||||
-+ message(STATUS "CMAKE_CXX_IMPLICIT_LINK_LIBRARIES=${CMAKE_CXX_IMPLICIT_LINK_LIBRARIES}")
|
||||
-+ set(CMAKE_CXX_IMPLICIT_LINK_LIBRARIES "")
|
||||
-+ set(CMAKE_CXX_IMPLICIT_LINK_LIBRARIES "stdc++;gcc;gcc_s;m;c")
|
||||
-+
|
||||
-+ message(STATUS "CMAKE_CXX_IMPLICIT_LINK_LIBRARIES=${CMAKE_CXX_IMPLICIT_LINK_LIBRARIES}")
|
||||
-+
|
||||
- # It's really nice part of this custom build process :)
|
||||
- set(CMAKE_CXX_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE} -std=c++11")
|
||||
-
|
||||
- # Disable warning from Boost when compiling with gcc 5.2
|
||||
- set(CMAKE_CXX_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE} -Wno-deprecated-declarations")
|
||||
-+
|
||||
-+ # Pass custom ld-linux for our own binary
|
||||
-+ set(CMAKE_CXX_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE} -Wl,--dynamic-linker=/opt/glibc_2.22/lib/ld-linux-x86-64.so.2")
|
||||
-+
|
||||
-+ set(CMAKE_CXX_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE} -nodefaultlibs -nostdinc -nostdinc++")
|
||||
-
|
||||
- # Specify full RPATH for build tree
|
||||
- SET(CMAKE_SKIP_BUILD_RPATH FALSE)
|
||||
-@@ -39,7 +60,7 @@ if (ENABLE_BUILD_IN_CPP_11_CUSTOM_ENVIRONMENT)
|
||||
- # Create builds in current folder with install RPATH
|
||||
- SET(CMAKE_BUILD_WITH_INSTALL_RPATH TRUE)
|
||||
-
|
||||
-- SET(CMAKE_INSTALL_RPATH "/opt/gcc520/lib64;/opt/boost_1_58_0/stage/lib;/opt/libhiredis_0_13/lib;/opt/log4cpp1.1.1/lib;/opt/luajit_2.0.4/lib;/opt/ndpi/lib;/opt/pf_ring/lib;/opt/json-c-0.12/lib")
|
||||
-+ SET(CMAKE_INSTALL_RPATH "/opt/glibc_2.22/lib;/opt/gcc520/lib64;/opt/boost_1_58_0/stage/lib;/opt/libhiredis_0_13/lib;/opt/log4cpp1.1.1/lib;/opt/luajit_2.0.4/lib;/opt/ndpi/lib;/opt/pf_ring/lib;/opt/json-c-0.12/lib")
|
||||
- endif()
|
||||
-
|
||||
- # It's pretty safe and provide big speedup for our packet processor and patricia code
|
||||
Loading…
Reference in New Issue
Block a user