15
15
import ipaddress
16
16
import struct
17
17
18
- __all__ = ["V9DataFlowSet" , "V9DataRecord" , "V9ExportPacket" , "V9Header" , "V9TemplateField" ,
18
+ __all__ = ["V9DataFlowSet" , "V9DataRecord" , "V9ExportPacket" , "V9Header" , "V9TemplateField" , "V9OptionsTemplateFlowSet"
19
19
"V9TemplateFlowSet" , "V9TemplateNotRecognized" , "V9TemplateRecord" ]
20
20
21
21
V9_FIELD_TYPES = {
@@ -194,8 +194,6 @@ def __init__(self, data, templates):
194
194
raise V9TemplateNotRecognized
195
195
196
196
template = templates [self .template_id ]
197
- if len (template .fields ) == 0 :
198
- return #ignore options templates at the moment
199
197
200
198
# As the field lengths are variable V9 has padding to next 32 Bit
201
199
padding_size = 4 - (self .length % 4 ) # 4 Byte
@@ -264,13 +262,18 @@ def __repr__(self):
264
262
self .template_id , self .field_count ,
265
263
' ' .join ([V9_FIELD_TYPES [field .field_type ] for field in self .fields ]))
266
264
265
+
267
266
class V9OptionsTemplateFlowSet :
267
+ """An options template flowset. Always uses flowset ID 1.
268
+ TODO: not handled at the moment, only stub implementation
269
+ """
268
270
def __init__ (self , data ):
269
271
pack = struct .unpack ('!HHH' , data [:6 ])
270
272
self .flowset_id = pack [0 ]
271
273
self .length = pack [1 ]
272
274
self .template_id = pack [2 ]
273
275
276
+
274
277
class V9TemplateFlowSet :
275
278
"""A template flowset, which holds an id that is used by data flowsets to
276
279
reference back to the template. The template then has fields which hold
@@ -348,6 +351,7 @@ def __init__(self, data, templates):
348
351
skipped_flowsets_offsets = []
349
352
while offset != len (data ):
350
353
flowset_id = struct .unpack ('!H' , data [offset :offset + 2 ])[0 ]
354
+
351
355
if flowset_id == 0 : # TemplateFlowSet always have id 0
352
356
tfs = V9TemplateFlowSet (data [offset :])
353
357
@@ -361,14 +365,13 @@ def __init__(self, data, templates):
361
365
# Update the templates with the provided templates, even if they are the same
362
366
self ._templates .update (tfs .templates )
363
367
offset += tfs .length
364
- elif flowset_id == 1 :
365
- otfs = V9OptionsTemplateFlowSet (data [offset :])
366
- if not self ._new_templates :
367
- if otfs .template_id not in self ._templates :
368
- self ._new_templates = True
369
368
370
- self ._templates .update ({otfs .template_id : V9TemplateRecord (otfs .template_id , 0 , {})})
369
+ elif flowset_id == 1 : # Option templates always use ID 1
370
+ # TODO: Options templates are ignored, to prevent template ID collision
371
+ # (if a collision can occur is not yet tested)
372
+ otfs = V9OptionsTemplateFlowSet (data [offset :])
371
373
offset += otfs .length
374
+
372
375
else :
373
376
try :
374
377
dfs = V9DataFlowSet (data [offset :], self ._templates )
0 commit comments