diff --git a/netflow_plugin/netflow_collector.cpp b/netflow_plugin/netflow_collector.cpp index 4396d71..2802a92 100644 --- a/netflow_plugin/netflow_collector.cpp +++ b/netflow_plugin/netflow_collector.cpp @@ -80,6 +80,50 @@ std::string print_peer_nf9_template(struct peer_nf9_template& field_template) { return buffer.str(); } +struct NF10_OPTIONS_HEADER_COMMON { + u_int16_t flowset_id; + u_int16_t length; +}; + +struct NF10_OPTIONS_HEADER { + u_int16_t template_id; + u_int16_t field_count; + u_int16_t scope_field_count; +}; + +// https://tools.ietf.org/html/rfc5101#page-18 +int process_netflow_v10_options_template(u_int8_t *pkt, size_t len, u_int32_t source_id) { + struct NF10_OPTIONS_HEADER_COMMON* options_template_header = (struct NF10_OPTIONS_HEADER_COMMON*)pkt; + + if (len < sizeof(*options_template_header)) { + logger<< log4cpp::Priority::ERROR<<"Short netflow ipfix options template header"; + return 1; + } + + if (ntohs(options_template_header->flowset_id) != NF10_OPTIONS_FLOWSET_ID) { + logger<< log4cpp::Priority::ERROR + <<"Function process_netflow_v10_options_template expects only NF10_OPTIONS_FLOWSET_ID but got another id: " + <flowset_id); + return 1; + } + + struct NF10_OPTIONS_HEADER* options_nested_header = (struct NF10_OPTIONS_HEADER*)(pkt + sizeof(struct NF10_OPTIONS_HEADER_COMMON*)); + + // Yes, I should convert it to host byter order but it broke it! + // WTF?? + u_int16_t template_id = options_nested_header->template_id; + + if (template_id <= 255) { + logger<< log4cpp::Priority::ERROR<<"Template ID for options template should be bigger then 255"; + return 1; + } + + u_int16_t field_count = ntohs(options_nested_header->field_count); + u_int16_t scope_field_count = ntohs(options_nested_header->scope_field_count); + + logger<< log4cpp::Priority::INFO<<"Options template id: "<