Optimized template lookups

Author: Michael Mileusnich

src/lib.rs

@@ -390,12 +390,14 @@ mod tests {
                 field_type:
                     super::variable_versions::ipfix_lookup::IPFixField::PacketDeltaCount,
                 field_length: 2,
+                enterprise_number: None,
             },
             IPFixTemplateField {
                 field_type_number: 8,
                 field_type:
                     super::variable_versions::ipfix_lookup::IPFixField::SourceIpv4address,
                 field_length: 4,
+                enterprise_number: None,
             },
         ];
         let template = IPFixTemplate {

src/snapshots/netflow_parser__tests__it_parses_ipfix_options_template.snap

@@ -18,16 +18,14 @@ expression: "NetflowParser::default().parse_bytes(&packet)"
           template_id: 260
           field_count: 3
           scope_field_count: 1
-          scope_field_specifiers:
+          fields:
             - field_type_number: 123
               field_type: Enterprise
               field_length: 4
               enterprise_number: 2
-          field_specifiers:
             - field_type_number: 32809
               field_type: ExportedMessageTotalCount
               field_length: 2
             - field_type_number: 32810
               field_type: ExportedFlowRecordTotalCount
               field_length: 2
-

src/snapshots/netflow_parser__tests__it_parses_ipfix_options_template_with_data.snap

@@ -18,12 +18,11 @@ expression: "NetflowParser::default().parse_bytes(&packet)"
           template_id: 260
           field_count: 3
           scope_field_count: 1
-          scope_field_specifiers:
+          fields:
             - field_type_number: 123
               field_type: Enterprise
               field_length: 4
               enterprise_number: 2
-          field_specifiers:
             - field_type_number: 32809
               field_type: ExportedMessageTotalCount
               field_length: 2
@@ -46,4 +45,3 @@ expression: "NetflowParser::default().parse_bytes(&packet)"
                 DataNumber: 7710
               Enterprise:
                 DataNumber: 2
-

src/variable_versions/ipfix.rs

@@ -13,6 +13,7 @@ use crate::{NetflowByteParserVariable, NetflowPacketResult, ParsedNetflow};
 
 use nom::bytes::complete::take;
 use nom::error::{Error as NomError, ErrorKind};
+use nom::multi::count;
 use nom::number::complete::{be_u128, be_u32};
 use nom::Err as NomErr;
 use nom::IResult;
@@ -118,12 +119,12 @@ pub struct OptionsTemplate {
     pub template_id: u16,
     pub field_count: u16,
     pub scope_field_count: u16,
-    #[nom(Count = "scope_field_count")]
-    pub scope_field_specifiers: Vec<OptionsTemplateField>,
     #[nom(
-        Count = "(field_count.checked_sub(scope_field_count).unwrap_or(field_count)) as usize"
+        PreExec = "let combined_count = scope_field_count as usize + 
+                       field_count.checked_sub(scope_field_count).unwrap_or(field_count) as usize;",
+        Parse = "count(|i| TemplateField::parse(i, true), combined_count as usize)"
     )]
-    pub field_specifiers: Vec<OptionsTemplateField>,
+    pub fields: Vec<TemplateField>,
     #[nom(Cond = "!i.is_empty()")]
     #[serde(skip_serializing)]
     padding: Option<u16>,
@@ -133,23 +134,28 @@ pub struct OptionsTemplate {
 pub struct Template {
     pub template_id: u16,
     pub field_count: u16,
-    #[nom(Count = "field_count")]
+    #[nom(Parse = "count(|i| TemplateField::parse(i, false), field_count as usize)")]
     pub fields: Vec<TemplateField>,
 }
 
 #[derive(Debug, PartialEq, Eq, Clone, Serialize, Nom)]
-pub struct OptionsTemplateField {
+#[nom(ExtraArgs(options_template: bool))]
+pub struct TemplateField {
     pub field_type_number: u16,
     #[nom(Value(IPFixField::from(field_type_number)))]
     pub field_type: IPFixField,
-    field_length: u16,
+    pub field_length: u16,
     #[nom(
-        Cond = "field_type_number > 32767",
-        PostExec = "let field_type_number = field_type_number.overflowing_sub(32768).0;",
-        PostExec = "let field_type = set_entperprise_field(field_type, enterprise_number);"
+        Cond = "options_template && field_type_number > 32767",
+        PostExec = "let field_type_number = if options_template {
+                      field_type_number.overflowing_sub(32768).0
+                    } else { field_type_number };",
+        PostExec = "let field_type = if options_template {
+                      set_entperprise_field(field_type, enterprise_number)
+                    } else { field_type };"
     )]
     #[serde(skip_serializing_if = "Option::is_none")]
-    enterprise_number: Option<u32>,
+    pub enterprise_number: Option<u32>,
 }
 
 fn set_entperprise_field(field_type: IPFixField, enterprise_number: Option<u32>) -> IPFixField {
@@ -159,14 +165,6 @@ fn set_entperprise_field(field_type: IPFixField, enterprise_number: Option<u32>)
     }
 }
 
-#[derive(Debug, PartialEq, Eq, Clone, Serialize, PartialOrd, Ord, Nom)]
-pub struct TemplateField {
-    pub field_type_number: u16,
-    #[nom(Value(IPFixField::from(field_type_number)))]
-    pub field_type: IPFixField,
-    pub field_length: u16,
-}
-
 /// Parses options template
 fn parse_options_template(i: &[u8], length: u16) -> IResult<&[u8], OptionsTemplate> {
     let (remaining, taken) = take(length.checked_sub(4).unwrap_or(length))(i)?;
@@ -177,37 +175,26 @@ fn parse_options_template(i: &[u8], length: u16) -> IResult<&[u8], OptionsTempla
 // Hacky way when using Template as generic T to cast to a common field type.
 // We use OptionsTemplateField as it is the same as type Template Field but
 // with enterprise_field.  In TemplateField tpe enterprise_field is just None.
-trait CommonTemplateFields {
-    fn get_fields(&self) -> Vec<OptionsTemplateField>;
+trait CommonTemplate {
+    fn get_fields(&self) -> &Vec<TemplateField>;
 }
 
-impl CommonTemplateFields for Template {
-    fn get_fields(&self) -> Vec<OptionsTemplateField> {
-        self.fields
-            .iter()
-            .map(|f| OptionsTemplateField {
-                field_length: f.field_length,
-                field_type: f.field_type,
-                field_type_number: f.field_type_number,
-                enterprise_number: None,
-            })
-            .collect()
+impl CommonTemplate for Template {
+    fn get_fields(&self) -> &Vec<TemplateField> {
+        &self.fields
     }
 }
 
-impl CommonTemplateFields for OptionsTemplate {
-    fn get_fields(&self) -> Vec<OptionsTemplateField> {
-        let mut temp = vec![];
-        temp.append(&mut self.scope_field_specifiers.clone());
-        temp.append(&mut self.field_specifiers.clone());
-        temp
+impl CommonTemplate for OptionsTemplate {
+    fn get_fields(&self) -> &Vec<TemplateField> {
+        &self.fields
     }
 }
 
 /// Takes a byte stream and a cached template.
 /// Fields get matched to static types.
 /// Returns BTree of IPFix Types & Fields or IResult Error.
-fn parse_fields<'a, T: CommonTemplateFields>(
+fn parse_fields<'a, T: CommonTemplate>(
     i: &'a [u8],
     template: Option<&T>,
 ) -> IResult<&'a [u8], Vec<BTreeMap<IPFixField, FieldValue>>> {