varlen fields. exclude nat stuff

Author: Koos85

lib/ipflow/field.py

@@ -10,7 +10,7 @@ class Field:
     )
 
     def __init__(self, field_id: int, length: int):
-        self._fmt = FIELD_TYPE_FMT.get(field_id, f'{length}s')
+        self._fmt = FIELD_TYPE_FMT.get((field_id, length), f'{length}x')
         self.id = field_id
         self.length = length
 

lib/ipflow/field_type.py

@@ -26,27 +26,51 @@ class FieldType(Enum):
     IPV6_DST_MASK = 30
     IPV6_NEXT_HOP = 62
 
+    # NAT
+    # postNATSourceIPv4Address = 225
+    # postNATDestinationIPv4Address = 226
+    # postNAPTSourceTransportPort = 227
+    # postNAPTDestinationTransportPort = 228
+    # natOriginatingAddressRealm = 229
+    # natEvent = 230
+
 
 FIELD_TYPE_FMT = {
-    1: 'L',
-    2: 'L',
-    4: 'B',
-    5: 'B',
-    6: 'B',
-    7: 'H',
-    10: 'H',
-    11: 'H',
-    14: 'H',
-    21: 'L',
-    22: 'L',
-    # 27: 'LLLL',
-    # 28: 'LLLL',
-    # 62: 'LLLL',
-    # 63: 'LLLL',
-    227: 'H',  # postNAPTSourceTransportPort
-    228: 'H',  # postNAPTDestinationTransportPort
-    230: 'B',  # natEvent
-    323: 'Q',
+    (1, 4): 'L',
+    (1, 8): 'Q',  # also uint64
+    (2, 4): 'L',
+    (2, 8): 'Q',  # also uint64
+    (3, 4): 'L',
+    (3, 8): 'Q',  # also uint64
+    (4, 1): 'B',
+    (5, 1): 'B',
+    (6, 1): 'B',
+    (7, 2): 'H',
+    (8, 4): '4s',
+    (9, 1): 'B',
+    (10, 2): 'H',
+    (11, 2): 'H',
+    (12, 4): '4s',
+    (13, 1): 'B',
+    (14, 2): 'H',
+    (15, 4): '4s',
+    (21, 4): 'L',
+    (21, 8): 'Q',  # also uint64
+    (22, 4): 'L',
+    (22, 8): 'Q',  # also uint64
+    (27, 16): '16s',
+    (28, 16): '16s',
+    (29, 1): 'B',
+    (30, 1): 'B',
+    (62, 16): '16s',
+
+    # NAT
+    # (225, 4): '4s',
+    # (226, 4): '4s',
+    # (227, 2): 'H',
+    # (228, 2): 'H',
+    # (229, 1): 'B',
+    # (230, 1): 'B',
 }
 
 FIELD_TYPE_FUNC = {
@@ -56,8 +80,8 @@ class FieldType(Enum):
     27: lambda a: str(ipaddress.IPv6Address(a)),  # IPV6_SRC_ADDR
     28: lambda a: str(ipaddress.IPv6Address(a)),  # IPV6_DST_ADDR
     62: lambda a: str(ipaddress.IPv6Address(a)),  # IPV6_NEXT_HOP
-    63: lambda a: str(ipaddress.IPv6Address(a)),  # BGP_IPV6_NEXT_HOP
 
-    225: lambda a: str(ipaddress.IPv4Address(a)),
-    226: lambda a: str(ipaddress.IPv4Address(a)),
+    # NAT
+    # 225: lambda a: str(ipaddress.IPv4Address(a)),
+    # 226: lambda a: str(ipaddress.IPv4Address(a)),
 }