flow-import.c

netflow,抓包

      if (cfdmask & CF_BYTESMASK)
        *((u_int32*)(rec+fo.dOctets)) = ui32;
    }

    if (index & CF_IPNEXTHOPMASK) {
      if ((rlen = fread(&ui32, sizeof (ui32), 1, stdin) != 1))
        goto done;
      ui32 = ntohl(ui32);
      if (cfdmask & CF_IPNEXTHOPMASK)
        *((u_int32*)(rec+fo.nexthop)) = ui32;
    }

    if (index & CF_STARTTIMEMASK) {
      if ((rlen = fread(&ui32, sizeof (ui32), 1, stdin) != 1))
        goto done;
      ui32 = ntohl(ui32);
      Start = ui32;
      if (cfdmask & CF_STARTTIMEMASK)
        *((u_int32*)(rec+fo.unix_secs)) = ui32;
    }

    if (index & CF_ENDTIMEMASK) {
      if ((rlen = fread(&ui32, sizeof (ui32), 1, stdin) != 1))
        goto done;
      ui32 = ntohl(ui32);
      if (cfdmask & CF_ENDTIMEMASK) {
        if (Start)
          *((u_int32*)(rec+fo.Last)) = (ui32 - Start) * 1000;
        else
          *((u_int32*)(rec+fo.unix_secs)) = ui32;
        
      }
    }

    if (index & CF_PROTOCOLMASK) {
      if ((rlen = fread(&ui8, sizeof (ui8), 1, stdin) != 1))
        goto done;
      if (cfdmask & CF_PROTOCOLMASK)
        *((u_int8*)(rec+fo.prot)) = ui8;
    }

    if (index & CF_TOSMASK) {
      if ((rlen = fread(&ui8, sizeof (ui8), 1, stdin) != 1))
        goto done;
      if (cfdmask & CF_TOSMASK)
        *((u_int8*)(rec+fo.tos)) = ui8;
    }

    if (index & CF_SRCASMASK) {
      if ((rlen = fread(&ui16, sizeof (ui16), 1, stdin) != 1))
        goto done;
      ui16 = ntohs(ui16);
      if (cfdmask & CF_SRCASMASK)
        *((u_int16*)(rec+fo.src_as)) = ui16;
    }

    if (index & CF_DSTASMASK) {
      if ((rlen = fread(&ui16, sizeof (ui16), 1, stdin) != 1))
        goto done;
      ui16 = ntohs(ui16);
      if (cfdmask & CF_DSTASMASK)
        *((u_int16*)(rec+fo.dst_as)) = ui16;
    }

    if (index & CF_SRCMASKLENMASK) {
      if ((rlen = fread(&ui8, sizeof (ui8), 1, stdin) != 1))
        goto done;
      if (cfdmask & CF_SRCMASKLENMASK)
        *((u_int8*)(rec+fo.src_mask)) = ui8;
    }

    if (index & CF_DSTMASKLENMASK) {
      if ((rlen = fread(&ui8, sizeof (ui8), 1, stdin) != 1))
        goto done;
      if (cfdmask & CF_DSTMASKLENMASK)
        *((u_int8*)(rec+fo.dst_mask)) = ui8;
    }

    if (index & CF_TCPFLAGSMASK) {
      if ((rlen = fread(&ui8, sizeof (ui8), 1, stdin) != 1))
        goto done;
      if (cfdmask & CF_TCPFLAGSMASK)
        *((u_int8*)(rec+fo.tcp_flags)) = ui8;
    }

    if (index & CF_INPUTENCAPMASK) {
      if ((rlen = fread(&ui8, sizeof (ui8), 1, stdin) != 1))
        goto done;
      if (cfdmask & CF_INPUTENCAPMASK)
        *((u_int8*)(rec+fo.in_encaps)) = ui8;
    }

    if (index & CF_OUTPUTENCAPMASK) {
      if ((rlen = fread(&ui8, sizeof (ui8), 1, stdin) != 1))
        goto done;
      if (cfdmask & CF_OUTPUTENCAPMASK)
        *((u_int8*)(rec+fo.out_encaps)) = ui8;
    }

    if (index & CF_PEERNEXTHOPMASK) {
      if ((rlen = fread(&ui32, sizeof (ui32), 1, stdin) != 1))
        goto done;
      ui32 = ntohl(ui32);
      if (cfdmask & CF_PEERNEXTHOPMASK)
        *((u_int32*)(rec+fo.peer_nexthop)) = ui32;
    }

    if (index & CF_ENGINETYPEMASK) {
      if ((rlen = fread(&ui8, sizeof (ui8), 1, stdin) != 1))
        goto done;
      if (cfdmask & CF_ENGINETYPEMASK)
        *((u_int8*)(rec+fo.engine_type)) = ui8;
    }

    if (index & CF_ENGINEIDMASK) {
      if ((rlen = fread(&ui8, sizeof (ui8), 1, stdin) != 1))
        goto done;
      if (cfdmask & CF_ENGINEIDMASK)
        *((u_int8*)(rec+fo.engine_id)) = ui8;
    }


    if (ftio_write(ftio, rec) < 0) {
      fterr_warnx("ftio_write(): failed");
      return -1;
    }

    ++opt->records;

    ret = 0;

  }

done:

  return ret;

} /* format0 */

int format1(struct ftio *ftio, struct options *opt)
{
  fterr_warnx("Not implemented");
  return -1;
} /* format1 */

/*
 * function: format2
 *
 * import from ASCII CSV format
*/
int format2(struct ftio *ftio, struct options *opt)
{
  struct fts3rec_offsets fo;
  u_char buf[FT_IO_MAXREC];
  char inbuf[1024], *inbufp, *field;
  char *rec, *c;
  u_int64 dmask, inmask;
  int ret;

  rec = (char*)&buf;

  fts3rec_compute_offsets(&fo, &opt->ftv);

  dmask = 0;
  dmask = ( opt->ftv.d_version == 8 ? 
	    v8mask[opt->ftv.agg_method] : vXmask[opt->ftv.d_version] );
  if(!dmask) {
    fterr_warnx("unsupported export version");
    return -1;
  }

  /* no user specified format then default to one appropriate for version */
  if (!opt->set_format)
    inmask = dmask;
  else
    inmask = opt->ft_mask;

  ret = -1;
  while (!(feof(stdin))) {

    ret = 0;

    if (!fgets(inbuf, 1024, stdin))
      goto done;

    for (field = inbuf; *field; ++field)
      if (*field == '\n') {
        *field = 0;
        break;
      }

    /* inline mask? */
    if (!opt->records && inbuf[0] == '#' && inbuf[1] == ':') {

      if (ftxfield_parse(inbuf+2, &inmask) < 0) {
        fterr_warnx("ftxfield_parse(): failed");
        return -1;
      }

    }

    for (c = inbuf; *c && isspace(*c); ++c);
    if (*c == '#')
      continue;

    ret = -1;

    bzero(rec, FT_IO_MAXREC);

    inbufp = inbuf;

    if (inmask & FT_XFIELD_UNIX_SECS) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_UNIX_SECS))
        *((u_int32*)(rec+fo.unix_secs)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_UNIX_NSECS) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_UNIX_NSECS))
        *((u_int32*)(rec+fo.unix_nsecs)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_SYSUPTIME) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_SYSUPTIME))
        *((u_int32*)(rec+fo.sysUpTime)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_EXADDR) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_EXADDR))
        *((u_int32*)(rec+fo.exaddr)) = scan_ip(field);
    }

    if (inmask & FT_XFIELD_DFLOWS) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_DFLOWS))
        *((u_int32*)(rec+fo.dFlows)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_DPKTS) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_DPKTS))
        *((u_int32*)(rec+fo.dPkts)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_DOCTETS) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_DOCTETS))
        *((u_int32*)(rec+fo.dOctets)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_FIRST) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_FIRST))
        *((u_int32*)(rec+fo.First)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_LAST) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_LAST))
        *((u_int32*)(rec+fo.Last)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_ENGINE_TYPE) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_ENGINE_TYPE))
        *((u_int8*)(rec+fo.engine_type)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_ENGINE_ID) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_ENGINE_ID))
        *((u_int8*)(rec+fo.engine_id)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_SRCADDR) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_SRCADDR))
        *((u_int32*)(rec+fo.srcaddr)) = scan_ip(field);
    }

    if (inmask & FT_XFIELD_DSTADDR) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_DSTADDR))
        *((u_int32*)(rec+fo.dstaddr)) = scan_ip(field);
    }

    if (inmask & FT_XFIELD_NEXTHOP) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_NEXTHOP))
        *((u_int32*)(rec+fo.nexthop)) = scan_ip(field);
    }

    if (inmask & FT_XFIELD_INPUT) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_INPUT))
        *((u_int16*)(rec+fo.input)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_OUTPUT) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_OUTPUT))
        *((u_int16*)(rec+fo.output)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_SRCPORT) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_SRCPORT))
        *((u_int16*)(rec+fo.srcport)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_DSTPORT) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_DSTPORT))
        *((u_int16*)(rec+fo.dstport)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_PROT) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_PROT))
        *((u_int8*)(rec+fo.prot)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_TOS) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_TOS))
        *((u_int8*)(rec+fo.tos)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_TCP_FLAGS) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_TCP_FLAGS))
        *((u_int8*)(rec+fo.tcp_flags)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_SRC_MASK) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_SRC_MASK))
        *((u_int8*)(rec+fo.src_mask)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_DST_MASK) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_DST_MASK))
        *((u_int8*)(rec+fo.dst_mask)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_SRC_AS) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_SRC_AS))
        *((u_int16*)(rec+fo.src_as)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_DST_AS) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_DST_AS))
        *((u_int16*)(rec+fo.dst_as)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_IN_ENCAPS) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_IN_ENCAPS))
        *((u_int8*)(rec+fo.in_encaps)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_OUT_ENCAPS) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_OUT_ENCAPS))
        *((u_int8*)(rec+fo.out_encaps)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_PEER_NEXTHOP) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_PEER_NEXTHOP))
        *((u_int32*)(rec+fo.peer_nexthop)) = scan_ip(field);
    }

    if (inmask & FT_XFIELD_ROUTER_SC) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_ROUTER_SC))
        *((u_int32*)(rec+fo.router_sc)) = scan_ip(field);
    }

    if (inmask & FT_XFIELD_MARKED_TOS) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_MARKED_TOS))
        *((u_int8*)(rec+fo.marked_tos)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_EXTRA_PKTS) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_EXTRA_PKTS))
        *((u_int32*)(rec+fo.extra_pkts)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_SRC_TAG) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_SRC_TAG))
        *((u_int32*)(rec+fo.src_tag)) = strtoul(field, (char **)0L, 0);
    }

    if (inmask & FT_XFIELD_DST_TAG) {
      field = strsep(&inbufp, ",");
      if (field && (dmask & FT_XFIELD_DST_TAG))
        *((u_int32*)(rec+fo.dst_tag)) = strtoul(field, (char **)0L, 0);
    }
      
    if (ftio_write(ftio, rec) < 0) {
      fterr_warnx("ftio_write(): failed");
      goto done;
    }

    ++opt->records;

  } /* while */

done:

  return ret;

} /* format2 */

/*