class Fluent::PcapngInput

Constants

DOUBLE
LONG
STRING
TIME

Public Class Methods

new() click to toggle source
Calls superclass method
# File lib/fluent/plugin/in_pcapng.rb, line 33
def initialize
  super
end

Public Instance Methods

build_extra_flags(extra_flags) click to toggle source
# File lib/fluent/plugin/in_pcapng.rb, line 104
def build_extra_flags(extra_flags)
  options = ""
  valid_flag_re = /(?:-[a-zA-Z]|--[a-z\-]+)/
  extra_flags.each do |i|
    if !i.match(/^#{valid_flag_re}/)
      raise ArgumentError, format("Invalid flags in extra_flags %s", i)
    end

    # escape given flags here because it is easier to understand, or write,
    # extra_flags in fluentd config.
    (k, v) = i.split(/\s+/, 2)
    options += "#{Shellwords.escape(k)} "
    options += "#{Shellwords.escape(v)} " if v
  end
  return options
end
build_options(fields) click to toggle source
# File lib/fluent/plugin/in_pcapng.rb, line 96
def build_options(fields)
  options = ""
  fields.each do |field|
    options += "-e #{Shellwords.escape(field)} "
  end
  return options
end
collect_tshark_output(stdout) click to toggle source
# File lib/fluent/plugin/in_pcapng.rb, line 121
def collect_tshark_output(stdout)
  collected = []
  begin
    readlines_nonblock(stdout).each do |line|
      array = CSV.parse(line).flatten
      collected << array
    end
  rescue => e
    log.error "pcapng failed to read or parse line", :error => e.to_s,
      :error_class => e.class.to_s
  end

  collected.each do |ary|
    router.emit(@tag, Engine.now, generate_record(ary))
  end
rescue => e
  log.error "pcapng failed to collect output from tshark",
    :error => e.to_s,
    :error_class => e.class.to_s
end
configure(conf) click to toggle source
Calls superclass method
# File lib/fluent/plugin/in_pcapng.rb, line 48
def configure(conf)
  super

  if @fields != nil and @fields == []
    raise ConfigError, "'fields' option is required on pcapng input"
  end

  if @types and @types.length != @fields.length
    raise ConfigError, "'types' length must be equal to 'fields' length"
  end
end
convert_type(val, type) click to toggle source
# File lib/fluent/plugin/in_pcapng.rb, line 173
def convert_type val, type
  v = val.to_s.gsub("\"", "")
  v = "" if val == nil
  case type
  when LONG
    if v.is_a?(String) and v.match(/^0x[0-9a-fA-F]+$/)
      v = v.hex
    else
      v = v.to_i
    end
  when DOUBLE
    v = v.to_f
  when TIME
    v = Time.parse(v)
  end
  return v
end
convert_types(array) click to toggle source
# File lib/fluent/plugin/in_pcapng.rb, line 167
def convert_types(array)
  return [array, @types].transpose.map{|val, type|
    convert_type(val, type)
  }
end
generate_record(array) click to toggle source
# File lib/fluent/plugin/in_pcapng.rb, line 155
def generate_record(array)
  fields = @fields
  if fields.length != array.length
    return {}
  end
  carray = convert_types(array)
  if @convertdot
    fields = fields.map{|field| field.gsub(".", @convertdot)}
  end
  return Hash[[fields, carray].transpose]
end
readlines_nonblock(io) click to toggle source
# File lib/fluent/plugin/in_pcapng.rb, line 142
def readlines_nonblock(io)
  @nbbuffer = "" if @nbbuffer == nil
  @nbbuffer += io.read_nonblock(65535)
  lines = []
  while idx = @nbbuffer.index("\n")
    lines << @nbbuffer[0..idx-1]
    @nbbuffer = @nbbuffer[idx+1..-1]
  end
  return lines
rescue
  return []
end
run() click to toggle source
# File lib/fluent/plugin/in_pcapng.rb, line 77
def run
  options = build_options(@fields)
  options += build_extra_flags(@extra_flags)
  cmdline = "tshark -i #{Shellwords.escape(@interface)} -T fields -E separator=\",\" -E quote=d #{options}"
  log.debug format("pcapng: %s", cmdline)
  _stdin, stdout, stderr, @th_tshark = *Open3.popen3(cmdline)

  while @th_tshark.alive?
    collect_tshark_output(stdout)
  end
  stderr.each do |l|
    log.error(l.chomp)
  end
  raise RuntimeError, "tshark is not running"
rescue => e
  log.error "unexpected error", :error => e.to_s
  log.error_backtrace e.backtrace
end
shutdown() click to toggle source
# File lib/fluent/plugin/in_pcapng.rb, line 66
def shutdown
  if @th_tshark and @th_tshark.alive?
    Process.kill("INT", @th_tshark.pid)
  end
  @thread.join
rescue => e
  log.error "pcapng failed to shutdown", :error => e.to_s,
    :error_class => e.class.to_s
  log.error_backtrace e.backtrace
end
start() click to toggle source
Calls superclass method
# File lib/fluent/plugin/in_pcapng.rb, line 60
def start
  super

  @thread = Thread.new(&method(:run))
end