forked from elastic/beats
-
Notifications
You must be signed in to change notification settings - Fork 1
/
amqp_fields.go
199 lines (187 loc) · 5 KB
/
amqp_fields.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
package amqp
import (
"encoding/binary"
"math"
"strconv"
"strings"
"time"
"github.com/elastic/beats/libbeat/common"
"github.com/elastic/beats/libbeat/logp"
)
func getTable(fields common.MapStr, data []byte, offset uint32) (next uint32, err bool, exists bool) {
ret := common.MapStr{}
length := binary.BigEndian.Uint32(data[offset : offset+4])
// size declared too big
if length > uint32(len(data[offset+4:])) {
return 0, true, false
}
if length > 0 {
exists = true
err := fieldUnmarshal(ret, data[offset+4:offset+4+length], 0, length, -1)
if err {
logp.Warn("Error while parsing a field table")
return 0, true, false
}
if fields == nil {
fields = ret
} else {
fields.Update(ret)
}
}
return length + 4 + offset, false, exists
}
func getArray(fields common.MapStr, data []byte, offset uint32) (next uint32, err bool, exists bool) {
ret := common.MapStr{}
length := binary.BigEndian.Uint32(data[offset : offset+4])
// size declared too big
if length > uint32(len(data[offset+4:])) {
return 0, true, false
}
if length > 0 {
exists = true
err := fieldUnmarshal(ret, data[offset+4:offset+4+length], 0, length, 0)
if err {
logp.Warn("Error while parsing a field array")
return 0, true, false
}
if fields == nil {
fields = ret
} else {
fields.Update(ret)
}
}
return length + 4 + offset, false, exists
}
//The index parameter, when set at -1, indicates that the entry is a field table.
//If it's set at 0, it is an array.
func fieldUnmarshal(table common.MapStr, data []byte, offset uint32, length uint32, index int) (err bool) {
var name string
if offset >= length {
return false
}
//get name of the field. If it's an array, it will be the index parameter as a
//string. If it's a table, it will be the name of the field.
if index < 0 {
fieldName, offsetTemp, err := getShortString(data, offset+1, uint32(data[offset]))
if err {
logp.Warn("Failed to get short string in table")
return true
}
name = fieldName
offset = offsetTemp
} else {
name = strconv.Itoa(index)
index++
}
switch data[offset] {
case boolean:
if data[offset+1] == 1 {
table[name] = true
} else {
table[name] = false
}
offset += 2
case shortShortInt:
table[name] = int8(data[offset+1])
offset += 2
case shortShortUint:
table[name] = uint8(data[offset+1])
offset += 2
case shortInt:
table[name] = int16(binary.BigEndian.Uint16(data[offset+1 : offset+3]))
offset += 3
case shortUint:
table[name] = binary.BigEndian.Uint16(data[offset+1 : offset+3])
offset += 3
case longInt:
table[name] = int(binary.BigEndian.Uint32(data[offset+1 : offset+5]))
offset += 5
case longUint:
table[name] = binary.BigEndian.Uint32(data[offset+1 : offset+5])
offset += 5
case longLongInt:
table[name] = int64(binary.BigEndian.Uint64(data[offset+1 : offset+9]))
offset += 9
case longLongUint:
table[name] = binary.BigEndian.Uint64(data[offset+1 : offset+9])
offset += 9
case float:
bits := binary.BigEndian.Uint32(data[offset+1 : offset+5])
table[name] = math.Float32frombits(bits)
offset += 5
case double:
bits := binary.BigEndian.Uint64(data[offset+1 : offset+9])
table[name] = math.Float64frombits(bits)
offset += 9
case decimal:
scale := data[offset+1]
val := strings.Split(strconv.Itoa(int(binary.BigEndian.Uint32(data[offset+2:offset+6]))), "")
ret := make([]string, len(val)+1)
for i, j := 0, 0; i < len(val); i++ {
if i == len(val)-int(scale) {
ret[j] = "."
j++
}
ret[j] = val[i]
j++
}
table[name] = strings.Join(ret, "")
offset += 6
case shortString:
s, next, err := getShortString(data, offset+2, uint32(data[offset+1]))
if err {
logp.Warn("Failed to get short string in table")
return true
}
table[name] = s
offset = next
case longString:
s, next, err := getShortString(data, offset+5, binary.BigEndian.Uint32(data[offset+1:offset+5]))
if err {
logp.Warn("Failed to get long string in table")
return true
}
table[name] = s
offset = next
case fieldArray:
newMap := common.MapStr{}
next, err, _ := getArray(newMap, data, offset+1)
if err {
return true
}
table[name] = newMap
offset = next
case timestamp:
t := time.Unix(int64(binary.BigEndian.Uint64(data[offset+1:offset+9])), 0)
table[name] = t.Format(amqpTimeLayout)
offset += 9
case fieldTable:
newMap := common.MapStr{}
next, err, _ := getTable(newMap, data, offset+1)
if err {
return true
}
table[name] = newMap
offset = next
case noField:
table[name] = nil
offset++
case byteArray:
size := binary.BigEndian.Uint32(data[offset+1 : offset+5])
table[name] = bodyToByteArray(data[offset+1+size : offset+5+size])
offset += 5 + size
default:
//unkown field
return true
}
//advance to next field recursively
return fieldUnmarshal(table, data, offset, length, index)
}
// function to convert a body slice into a byte array
func bodyToByteArray(data []byte) string {
ret := make([]string, len(data))
for i, c := range data {
ret[i] = strconv.Itoa(int(c))
}
return "[" + strings.Join(ret, ", ") + "]"
}