ipfix icon indicating copy to clipboard operation
ipfix copied to clipboard

Add Marshal and LookupTemplateRecords functions

Open floren opened this issue 7 years ago • 5 comments
trafficstars

I needed to unpack a Message, check which templates the data records referred to, attach those templates, and re-package the message as a binary IPFIX message. Here's a workflow:

	msg, _ := s.ParseBuffer(buf)
	templates, _ := s.LookupTemplateRecords(msg)
	msg.TemplateRecords = templates
	repacked, _ := s.Marshal(msg)

LookupTemplateRecords returns a []TemplateRecord representing all the templates referred to by the data records of the given Message. It returns an error if it doesn't have the specified templates available (hasn't seen a template record yet)

Marshal simply re-packs the given message as binary; you could for example receive a packet, parse it, modify it, then re-Marshal it and send it out to a final IPFIX collector.

floren avatar Aug 23 '18 16:08 floren

Neat

calmh avatar Aug 23 '18 17:08 calmh

Checking in on this, is this functionality you're interested in? I think it's a useful addition for situations where you're not an endpoint, just a stop along the way to an eventual endpoint.

floren avatar Sep 05 '18 15:09 floren

Yes, I just forgot about it and didn't get around to review, sorry! At first I was worried that it was single purpose, but it looks like it can marshal pretty much all that we can unmarshal? One thing I reacted to on the initial pass was that it was all in one big function; but I didn't look at the details yet. It's on my todo list so I won't forget!

calmh avatar Sep 05 '18 15:09 calmh

Yes, I apologize for the single giant function. It's a little ugly because I wanted to avoid allocations wherever possible; my first pass did something like 12 allocs per call to Marshall, while the current one only does 1 allocation. It's still not nearly as fast as the unpacking functions, but at least it's nicer to the allocator. Unfortunately this ended up with a giant function which tracks an offset into the buffer the whole way through.

floren avatar Sep 05 '18 16:09 floren

That's a valid reason; I'd probably like to explore whether it can be handled by passing around the buffer and maybe offset, maybe adding an allocation here and there if required for clarity... (But again, I didn't really stare at the code yet so maybe I'm talking out of my ass.)

calmh avatar Sep 05 '18 16:09 calmh