func (h *PacketHeader) Unmarshal(r io.Reader) error {
if err := read.Uint16(&h.Version, r); err != nil {
return err
}
if err := read.Uint16(&h.Count, r); err != nil {
return err
}
// The spec says at most 24 flows in one packet, but reality disagrees.
if h.Count < 1 || h.Count > 32 {
return fmt.Errorf("protocol error: %d flows out of bounds", h.Count)
}
var u uint32
if err := read.Uint32(&u, r); err != nil {
return err
}
h.SysUptime = time.Duration(u)
var t uint64
if err := read.Uint64(&t, r); err != nil {
return err
}
h.Unix = time.Unix(int64(t>>32), int64(t&0xffffffff))
if err := read.Uint32(&h.FlowSequence, r); err != nil {
return err
}
if err := read.Uint8(&h.EngineType, r); err != nil {
return err
}
if err := read.Uint8(&h.EngineID, r); err != nil {
return err
}
if err := read.Uint16(&h.SamplingInterval, r); err != nil {
return err
}
return nil
}
func (otr *OptionsTemplateRecord) Unmarshal(r io.Reader) error {
if err := read.Uint16(&otr.TemplateID, r); err != nil {
return err
}
if err := read.Uint16(&otr.FieldCount, r); err != nil {
return err
}
if err := read.Uint16(&otr.ScopeFieldCount, r); err != nil {
return err
}
if otr.ScopeFieldCount > otr.FieldCount {
return errProtocol(fmt.Sprintf("scope field count %d higher than field count %d", otr.ScopeFieldCount, otr.FieldCount))
}
buffer := new(bytes.Buffer)
buffer.ReadFrom(r)
if debug {
hexdump(buffer.Bytes())
}
otr.ScopeFields = make(FieldSpecifiers, otr.ScopeFieldCount)
if err := otr.ScopeFields.Unmarshal(buffer); err != nil {
return err
}
otr.Fields = make(FieldSpecifiers, otr.FieldCount-otr.ScopeFieldCount)
if err := otr.Fields.Unmarshal(buffer); err != nil {
return err
}
return nil
}
func (fs *FieldSpecifier) Unmarshal(r io.Reader) error {
if err := read.Uint16(&fs.InformationElementID, r); err != nil {
if debug {
debugLog.Println("error reading information element id", err)
}
return err
}
if err := read.Uint16(&fs.Length, r); err != nil {
if debug {
debugLog.Println("error reading length", err)
}
return err
}
// If the Enterprise bit is one, the Information Element identifier
// identifies an enterprise-specific Information Element, and the Enterprise
// Number field MUST be present.
if fs.InformationElementID&EnterpriseBit > 0 {
fs.EnterpriseBitSet = true
fs.InformationElementID ^= EnterpriseBit
if err := read.Uint32(&fs.EnterpriseNumber, r); err != nil {
if debug {
debugLog.Println("error reading enterprise number", err)
}
return err
}
}
return nil
}
func (f *FieldSpecifier) Unmarshal(r io.Reader) error {
if err := read.Uint16(&f.Type, r); err != nil {
return err
}
if err := read.Uint16(&f.Length, r); err != nil {
return err
}
return nil
}
func (h *FlowSetHeader) Unmarshal(r io.Reader) error {
if err := read.Uint16(&h.ID, r); err != nil {
return err
}
if err := read.Uint16(&h.Length, r); err != nil {
return err
}
return nil
}
func (tr *TemplateRecord) Unmarshal(r io.Reader) error {
if err := read.Uint16(&tr.TemplateID, r); err != nil {
return err
}
if err := read.Uint16(&tr.FieldCount, r); err != nil {
return err
}
tr.Fields = make(FieldSpecifiers, tr.FieldCount)
if err := tr.Fields.Unmarshal(r); err != nil {
return err
}
return nil
}
// Unmarshal a message header from a reader.
func (h *MessageHeader) Unmarshal(r io.Reader) error {
if err := read.Uint16(&h.Version, r); err != nil {
return err
}
if err := read.Uint16(&h.Length, r); err != nil {
return err
}
if err := read.Uint32(&h.ExportTime, r); err != nil {
return err
}
if err := read.Uint32(&h.SequenceNumber, r); err != nil {
return err
}
if err := read.Uint32(&h.ObservationDomainID, r); err != nil {
return err
}
return nil
}
func (h *PacketHeader) Unmarshal(r io.Reader) error {
if err := read.Uint16(&h.Version, r); err != nil {
return err
}
if err := read.Uint16(&h.Count, r); err != nil {
return err
}
if err := read.Uint32(&h.SysUpTime, r); err != nil {
return err
}
if err := read.Uint32(&h.UnixSecs, r); err != nil {
return err
}
if err := read.Uint32(&h.SequenceNumber, r); err != nil {
return err
}
if err := read.Uint32(&h.SourceID, r); err != nil {
return err
}
return nil
}
func (r *FlowRecord) Unmarshal(h io.Reader) error {
r.SrcAddr = make(net.IP, 4)
if _, err := h.Read(r.SrcAddr); err != nil { // 0-3
return err
}
r.DstAddr = make(net.IP, 4)
if _, err := h.Read(r.DstAddr); err != nil { // 4-7
return err
}
r.NextHop = make(net.IP, 4)
if _, err := h.Read(r.NextHop); err != nil { // 8-11
return err
}
if err := read.Uint16(&r.Input, h); err != nil { // 12-13
return err
}
if err := read.Uint16(&r.Output, h); err != nil { // 14-15
return err
}
if err := read.Uint32(&r.Packets, h); err != nil { // 16-19
return err
}
if err := read.Uint32(&r.Bytes, h); err != nil { // 20-23
return err
}
if err := read.Uint32(&r.First, h); err != nil { // 24-27
return err
}
if err := read.Uint32(&r.Last, h); err != nil { // 28-31
return err
}
if err := read.Uint16(&r.SrcPort, h); err != nil { // 32-33
return err
}
if err := read.Uint16(&r.DstPort, h); err != nil { // 34-35
return err
}
if err := read.Uint8(&r.Pad1, h); err != nil { // 36
return err
}
if err := read.Uint8(&r.TCPFlags, h); err != nil { // 37
return err
}
if err := read.Uint8(&r.Protocol, h); err != nil { // 38
return err
}
if err := read.Uint8(&r.ToS, h); err != nil { // 39
return err
}
if err := read.Uint16(&r.SrcAS, h); err != nil { // 40-41
return err
}
if err := read.Uint16(&r.DstAS, h); err != nil { // 42-43
return err
}
if err := read.Uint8(&r.SrcMask, h); err != nil { // 44
return err
}
if err := read.Uint8(&r.DstMask, h); err != nil { // 45
return err
}
if err := read.Uint16(&r.Pad2, h); err != nil { // 46-47
return err
}
return nil
}
func (r *FlowRecord) Unmarshal(h io.Reader) error {
r.SrcAddr = make(net.IP, 4)
if _, err := h.Read(r.SrcAddr); err != nil {
return err
}
r.DstAddr = make(net.IP, 4)
if _, err := h.Read(r.DstAddr); err != nil {
return err
}
r.NextHop = make(net.IP, 4)
if _, err := h.Read(r.NextHop); err != nil {
return err
}
if err := read.Uint16(&r.Input, h); err != nil {
return err
}
if err := read.Uint16(&r.Output, h); err != nil {
return err
}
if err := read.Uint32(&r.Packets, h); err != nil {
return err
}
if err := read.Uint32(&r.Bytes, h); err != nil {
return err
}
if err := read.Uint32(&r.First, h); err != nil {
return err
}
if err := read.Uint32(&r.Last, h); err != nil {
return err
}
if err := read.Uint16(&r.SrcPort, h); err != nil {
return err
}
if err := read.Uint16(&r.DstPort, h); err != nil {
return err
}
if err := read.Uint16(&r.Pad1, h); err != nil {
return err
}
if err := read.Uint8(&r.Protocol, h); err != nil {
return err
}
if err := read.Uint8(&r.ToS, h); err != nil {
return err
}
if err := read.Uint8(&r.Flags, h); err != nil {
return err
}
if err := read.Uint8(&r.Pad2, h); err != nil {
return err
}
if err := read.Uint16(&r.Pad3, h); err != nil {
return err
}
if err := read.Uint32(&r.Reserved, h); err != nil {
return err
}
return nil
}
