[flow-tools] flow-report tag-mask option

[Mark Fullmer]

It's a bug.  The current implementation incorrectly assumes the tags
are added locally.

Diff for 0.63, will probably work for 0.62 too.

Index: ftstat.c
===================================================================
RCS file: /usr/home/djnz-cvsroot/flow-tools/lib/ftstat.c,v
retrieving revision 1.26
diff -c -r1.26 ftstat.c
*** ftstat.c	12 Dec 2002 14:03:45 -0000	1.26
--- ftstat.c	12 Dec 2002 22:56:04 -0000
***************
*** 3081,3088 ****
  
      ftsrpt = ftsrpti->rpt;
  
!     /* if the tag mask option is set apply the masks */
!     if (active_def->ftd && (ftsrpt->options & FT_STAT_OPT_TAG_MASK)) {
  
        /* preserve tags */
        FT_RECGET_SRC_TAG(cur,rec,*fo);
--- 3081,3092 ----
  
      ftsrpt = ftsrpti->rpt;
  
!     /*
!      * if the tag mask option is set apply the masks, not this can only
!      * be set if the tags exist.
!      *
!      */
!     if (ftsrpt->options & FT_STAT_OPT_TAG_MASK) {
  
        /* preserve tags */
        FT_RECGET_SRC_TAG(cur,rec,*fo);
***************
*** 3106,3112 ****
  
      /* restore tags */
  restore_tag:
!     if (active_def->ftd && (ftsrpt->options & FT_STAT_OPT_TAG_MASK)) {
  
        *((u_int32*)(rec+(*fo).src_tag)) = cur.src_tag;
        *((u_int32*)(rec+(*fo).dst_tag)) = cur.dst_tag;
--- 3110,3116 ----
  
      /* restore tags */
  restore_tag:
!     if (ftsrpt->options & FT_STAT_OPT_TAG_MASK) {
  
        *((u_int32*)(rec+(*fo).src_tag)) = cur.src_tag;
        *((u_int32*)(rec+(*fo).dst_tag)) = cur.dst_tag;
***************
*** 3589,3594 ****
--- 3593,3599 ----
    lp->cur_rpt->tag_mask_dst = strtoul(lp->word, (char**)0L, 0);
  
    lp->cur_rpt->options |= FT_STAT_OPT_TAG_MASK;
+   lp->cur_rpt->xfields |= FT_XFIELD_SRC_TAG|FT_XFIELD_DST_TAG;
  
    return 0;

mark  

On Tue, Dec 10, 2002 at 11:04:29AM -0800, Clayton Fiske wrote:
> On Thu, Dec 05, 2002 at 09:11:58AM +0800, Horatio B. Bogbindero wrote:
> > Quoting Clayton Fiske <clay@bloomcounty.org>:
> > 
> > > Am I doing something wrong, or does the tag-mask option not work
> > > in flow-report configs? My config is:
> > > 
> > > stat-report test
> > >   type source/destination-tag
> > >   fields +octets,-flows,-packets,-duration,-bps,-pps
> > >   tag-mask 0xFF0000 0xFF0000
> > >   format ascii
> > >   output /var/ft/cfg/report.test
> > > 
> > > Whether I change the tag-mask to 0xFFFF00 or 0x0F0000 or any other
> > > combo, it seems to report by the full tags instead of the masked
> > > ones.
> > > 
> > 
> > are you using version 0.62?
> > 
> > it does not seem that you are applying the tag at all. does
> > you stat-definition line look like this?
> > 
> > stat-definition test-def
> >   tag MY_TAG
> 
> Well, the flows are already tagged when they are fed into flow-report.
> Do I have to tag them again to get the tag mask to work?
> 
> -c
> 
> 
> _______________________________________________
> flow-tools@splintered.net
> http://www.splintered.net/sw/flow-tools