Implement #15

Author: phaag

README.md

@@ -101,19 +101,25 @@ func main() {
     }
 
     // get NAT xlate ports
-    if natXlatePort := flowRecord.NatXlatePort(); natXlatePort == nil {
+    if natXlatePort := flowRecord.NatXlatePort(); natXlatePort != nil {
       fmt.Printf("  Src X-Port  : %d\n", natXlatePort.XlateSrcPort)
       fmt.Printf("  Dst X-Port  : %d\n", natXlatePort.XlateDstPort)
     }
 
     // get nat port block and print
-    if natPortBlock := flowRecord.NatPortBlock(); natPortBlock == nil {
+    if natPortBlock := flowRecord.NatPortBlock(); natPortBlock != nil {
       fmt.Printf("  NAT pstart  : %d\n", natPortBlock.BlockStart)
 			fmt.Printf("  NAT pend    : %d\n", natPortBlock.BlockEnd)
 			fmt.Printf("  NAT pstep   : %d\n", natPortBlock.BlockStep)
 			fmt.Printf("  NAT psize   : %d\n", natPortBlock.BlockSize)
 		}
-   
+ 
+    // get IP info extension
+    if ipInfo := flowRecord.IpInfo(); ipInfo != nil {
+      fmt.Pprintf("  IP ttl      : %d\n", ipInfo.Ttl)
+		  fmt.Pprintf("  IP fragment : %s%s\n", ipInfo.FragmentFlags)
+    }
+    
 		/*
 			// other extension
 			// see nfxV3.go for all fields in the respectiv records

defs.go

@@ -45,12 +45,15 @@ const (
 	EXflowIdID         = uint16(C.EXflowIdID)
 	EXnokiaNatID       = uint16(C.EXnokiaNatID)
 	EXnokiaNatStringID = uint16(C.EXnokiaNatStringID)
+	EXipInfoID         = uint16(C.EXipInfoID)
 )
 
 const (
 	V3_FLAG_EVENT   = uint(C.V3_FLAG_EVENT)
 	V3_FLAG_SAMPLED = uint(C.V3_FLAG_SAMPLED)
 	V3_FLAG_ANON    = uint(C.V3_FLAG_ANON)
+	FlagMF          = uint8(C.flagMF)
+	FlagDF          = uint8(C.flagDF)
 )
 
 const (
@@ -77,6 +80,7 @@ type EXnatPortBlock C.struct_EXnatPortBlock_s
 type EXflowId C.struct_EXflowId_s
 type EXnokiaNat C.struct_EXnokiaNat_s
 type EXnokiaNatString string
+type EXipInfo C.struct_EXipInfo_s
 
 type EXbgpNextHop struct {
 	IP net.IP

nfxV3.go

@@ -239,10 +239,7 @@ typedef struct EXflowMisc_s {
     uint8_t flowEndReason;
 #define OFFflowEndReason offsetof(EXflowMisc_t, flowEndReason)
 #define SIZEflowEndReason MemberSize(EXflowMisc_t, flowEndReason)
-    uint8_t revTcpFlags;
-    uint8_t fragmentFlags;
-#define OFFfragmentFlags offsetof(EXflowMisc_t, fragmentFlags)
-#define SIZEfragmentFlags MemberSize(EXflowMisc_t, fragmentFlags)
+    uint16_t align;
 } EXflowMisc_t;
 #define EXflowMiscSize (sizeof(EXflowMisc_t) + sizeof(elementHeader_t))
 
@@ -686,8 +683,22 @@ typedef struct EXnokiaNatString_s {
 } EXnokiaNatString_t;
 #define EXnokiaNatStringSize (sizeof(EXnokiaNatString_t) + sizeof(elementHeader_t))
 
+#define EXipInfoID 42
+typedef struct EXipInfo_s {
+    uint8_t ttl;
+#define OFFipTTL offsetof(EXipInfo_t, ttl)
+#define SIZEipTTL MemberSize(EXipInfo_t, ttl)
+#define flagMF 0x20
+#define flagDF 0x40
+    uint8_t fragmentFlags;
+#define OFFfragmentFlags offsetof(EXipInfo_t, fragmentFlags)
+#define SIZEfragmentFlags MemberSize(EXipInfo_t, fragmentFlags)
+    uint16_t align;  // unused for nfpcapd
+} EXipInfo_t;
+#define EXipInfoSize (sizeof(EXipInfo_t) + sizeof(elementHeader_t))
+
 // max possible elements
-#define MAXEXTENSIONS 42
+#define MAXEXTENSIONS 43
 
 // push a fixed length extension to the v3 record
 // h v3 record header
@@ -747,16 +758,17 @@ static const struct extensionTable_s {
     uint32_t id;    // id number
     uint32_t size;  // number of bytes incl. header, 0xFFFF for dyn length
     char *name;     // name of extension
-} extensionTable[] = {
-    {0, 0, "EXnull"},          EXTENSION(EXgenericFlow),   EXTENSION(EXipv4Flow),     EXTENSION(EXipv6Flow),     EXTENSION(EXflowMisc),
-    EXTENSION(EXcntFlow),      EXTENSION(EXvLan),          EXTENSION(EXasRouting),    EXTENSION(EXbgpNextHopV4), EXTENSION(EXbgpNextHopV6),
-    EXTENSION(EXipNextHopV4),  EXTENSION(EXipNextHopV6),   EXTENSION(EXipReceivedV4), EXTENSION(EXipReceivedV6), EXTENSION(EXmplsLabel),
-    EXTENSION(EXmacAddr),      EXTENSION(EXasAdjacent),    EXTENSION(EXlatency),      EXTENSION(EXsamplerInfo),  EXTENSION(EXnselCommon),
-    EXTENSION(EXnatXlateIPv4), EXTENSION(EXnatXlateIPv6),  EXTENSION(EXnatXlatePort), EXTENSION(EXnselAcl),      EXTENSION(EXnselUser),
-    EXTENSION(EXnatCommon),    EXTENSION(EXnatPortBlock),  EXTENSION(EXnbarApp),      EXTENSION(EXlabel),        EXTENSION(EXinPayload),
-    EXTENSION(EXoutPayload),   EXTENSION(EXtunIPv4),       EXTENSION(EXtunIPv6),      EXTENSION(EXobservation),  EXTENSION(EXinmonMeta),
-    EXTENSION(EXinmonFrame),   EXTENSION(EXvrf),           EXTENSION(EXpfinfo),       EXTENSION(EXlayer2),       EXTENSION(EXflowId),
-    EXTENSION(EXnokiaNat),     EXTENSION(EXnokiaNatString)};
+} extensionTable[] = {{0, 0, "EXnull"},          EXTENSION(EXgenericFlow),    EXTENSION(EXipv4Flow),     EXTENSION(EXipv6Flow),
+                      EXTENSION(EXflowMisc),     EXTENSION(EXcntFlow),        EXTENSION(EXvLan),         EXTENSION(EXasRouting),
+                      EXTENSION(EXbgpNextHopV4), EXTENSION(EXbgpNextHopV6),   EXTENSION(EXipNextHopV4),  EXTENSION(EXipNextHopV6),
+                      EXTENSION(EXipReceivedV4), EXTENSION(EXipReceivedV6),   EXTENSION(EXmplsLabel),    EXTENSION(EXmacAddr),
+                      EXTENSION(EXasAdjacent),   EXTENSION(EXlatency),        EXTENSION(EXsamplerInfo),  EXTENSION(EXnselCommon),
+                      EXTENSION(EXnatXlateIPv4), EXTENSION(EXnatXlateIPv6),   EXTENSION(EXnatXlatePort), EXTENSION(EXnselAcl),
+                      EXTENSION(EXnselUser),     EXTENSION(EXnatCommon),      EXTENSION(EXnatPortBlock), EXTENSION(EXnbarApp),
+                      EXTENSION(EXlabel),        EXTENSION(EXinPayload),      EXTENSION(EXoutPayload),   EXTENSION(EXtunIPv4),
+                      EXTENSION(EXtunIPv6),      EXTENSION(EXobservation),    EXTENSION(EXinmonMeta),    EXTENSION(EXinmonFrame),
+                      EXTENSION(EXvrf),          EXTENSION(EXpfinfo),         EXTENSION(EXlayer2),       EXTENSION(EXflowId),
+                      EXTENSION(EXnokiaNat),     EXTENSION(EXnokiaNatString), EXTENSION(EXipInfo)};
 
 typedef struct record_map_s {
     recordHeaderV3_t *recordHeader;

nfxV3.h

@@ -383,3 +383,13 @@ func (flowRecord *FlowRecordV3) NokiaNatString() EXnokiaNatString {
 	bytes := flowRecord.rawRecord[offset : offset+size]
 	return (EXnokiaNatString)(string(bytes[:]))
 }
+
+// Returns the ipInfo extension from the *FlowRecordV3 object
+func (flowRecord *FlowRecordV3) IpInfo() *EXipInfo {
+	offset := flowRecord.extOffset[EXipInfoID].offset
+	if offset == 0 {
+		return nil
+	}
+	ipInfo := (*EXipInfo)(unsafe.Pointer(&flowRecord.rawRecord[offset]))
+	return ipInfo
+}

record.go

@@ -104,6 +104,7 @@ func (flowRecord *FlowRecordV3) String() string {
 	s += flowRecord.dumpEXflowId()
 	s += flowRecord.dumpEXnokiaNAT()
 	s += flowRecord.dumpEXnokiaNatString()
+	s += flowRecord.dumpEXipInfoString()
 
 	return s
 }
@@ -321,3 +322,24 @@ func (flowRecord *FlowRecordV3) dumpEXnokiaNatString() string {
 	}
 	return fmt.Sprintf("  Flow ID     : %v\n", natString)
 }
+
+func (flowRecord *FlowRecordV3) dumpEXipInfoString() string {
+	var ipInfo *EXipInfo
+	if ipInfo = flowRecord.IpInfo(); ipInfo == nil {
+		return ""
+	}
+
+	var DF string = "--"
+	var MF string = "--"
+	if ipInfo.FragmentFlags&FlagMF != 0 {
+		MF = "MF"
+	}
+	if ipInfo.FragmentFlags&FlagDF != 0 {
+		DF = "DF"
+	}
+	var s string = "" +
+		fmt.Sprintf("  IP ttl      : %d\n", ipInfo.Ttl) +
+		fmt.Sprintf("  IP fragment : %s%s\n", DF, MF)
+
+	return s
+}