From bebe1102d9823f5bd2650b3188e3a8ab03015454 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?D=C3=A1vid=20Benko?= Date: Wed, 7 Oct 2026 20:28:47 +0200 Subject: [PATCH 1/5] cmake: add ENABLE_PROCESS_QUIC option The QUIC process plugin is the only part of ipfixprobe that uses OpenSSL (to decrypt QUIC Initial packets), but it is always built, so OpenSSL is a hard build and runtime dependency of the whole project. Adds an `ENABLE_PROCESS_QUIC` option (default ON, so the default build is unchanged) and look up OpenSSL only when the plugin is enabled. This allows building ipfixprobe for small embedded devices without OpenSSL. --- CMakeLists.txt | 1 + README.md | 1 + cmake/dependencies.cmake | 4 +++- src/plugins/process/CMakeLists.txt | 4 +++- 4 files changed, 8 insertions(+), 2 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 96d6f65c0..baec03eb2 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -17,6 +17,7 @@ option(ENABLE_INPUT_DPDK "Enable build of input DPDK plugin" option(ENABLE_INPUT_NFB "Enable build of input NFB plugin" OFF) option(ENABLE_OUTPUT_UNIREC "Enable build of output UNIREC plugin" OFF) option(ENABLE_PROCESS_EXPERIMENTAL "Enable build of experimental process plugins" OFF) +option(ENABLE_PROCESS_QUIC "Enable build of QUIC process plugin (requires OpenSSL)" ON) option(ENABLE_MILLISECONDS_TIMESTAMP "Compile ipfixprobe with miliseconds timestamp precesion" OFF) option(ENABLE_NEMEA "Enable build of NEMEA plugins" OFF) diff --git a/README.md b/README.md index bff4f1038..779a58207 100644 --- a/README.md +++ b/README.md @@ -117,6 +117,7 @@ You can enable or disable optional plugins and features via CMake flags: | `-DENABLE_INPUT_DPDK=ON` | OFF | Enable high-speed DPDK input plugin (requires `dpdk-devel`) | | `-DENABLE_INPUT_NFB=ON` | OFF | Enable input plugin for CESNET NFB/NDP cards (requires `netcope-common`) | | `-DENABLE_PROCESS_EXPERIMENTAL=ON` | OFF | Enable experimental process plugins | +| `-DENABLE_PROCESS_QUIC=OFF` | ON | Disable QUIC process plugin (drops the `openssl` dependency) | | `-DENABLE_NEMEA=ON` | OFF | Enable support for NEMEA modules (requires `nemea-framework-devel` ) | Run the command to view all available build options: diff --git a/cmake/dependencies.cmake b/cmake/dependencies.cmake index 2459ed45c..49cd81b73 100644 --- a/cmake/dependencies.cmake +++ b/cmake/dependencies.cmake @@ -5,7 +5,9 @@ find_package(Threads REQUIRED) find_package(Atomic REQUIRED) find_package(Unwind REQUIRED) find_package(LZ4 REQUIRED) -find_package(OpenSSL REQUIRED) +if (ENABLE_PROCESS_QUIC) + find_package(OpenSSL REQUIRED) +endif() if (ENABLE_INPUT_PCAP) pkg_check_modules(PCAP REQUIRED libpcap) diff --git a/src/plugins/process/CMakeLists.txt b/src/plugins/process/CMakeLists.txt index a47322075..b84f68c2b 100644 --- a/src/plugins/process/CMakeLists.txt +++ b/src/plugins/process/CMakeLists.txt @@ -18,7 +18,9 @@ add_subdirectory(dnssd) add_subdirectory(netbios) add_subdirectory(passiveDns) add_subdirectory(smtp) -add_subdirectory(quic) +if (ENABLE_PROCESS_QUIC) + add_subdirectory(quic) +endif() add_subdirectory(tls) add_subdirectory(http) From e6dd96f75b2c8b5fc15777f50284de079e0512ad Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?D=C3=A1vid=20Benko?= Date: Wed, 7 Oct 2026 20:28:55 +0200 Subject: [PATCH 2/5] cmake: look up ur_processor.sh instead of hard-coding its path The UniRec field generator was always run from /usr/bin/nemea/ur_processor.sh on the build host. In cross builds (e.g. OpenWrt) the script is staged elsewhere and the build host may not have Nemea installed at all. Look the script up with find_program(), keeping /usr/bin/nemea as a search path, so that the location can be overridden with -DUR_PROCESSOR=. --- src/plugins/CMakeLists.txt | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/plugins/CMakeLists.txt b/src/plugins/CMakeLists.txt index 5b385d601..d854790cf 100644 --- a/src/plugins/CMakeLists.txt +++ b/src/plugins/CMakeLists.txt @@ -15,8 +15,13 @@ if(ENABLE_NEMEA OR ENABLE_OUTPUT_UNIREC) ${OUTPUT_DIR}/fields.h ) + find_program(UR_PROCESSOR ur_processor.sh + PATHS /usr/bin/nemea + REQUIRED + ) + execute_process( - COMMAND /usr/bin/nemea/ur_processor.sh -i ${CMAKE_CURRENT_SOURCE_DIR} -o ${OUTPUT_DIR} + COMMAND ${UR_PROCESSOR} -i ${CMAKE_CURRENT_SOURCE_DIR} -o ${OUTPUT_DIR} WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR} RESULT_VARIABLE SCRIPT_RESULT ) From 9ddc0df2f95d4da06a46db683d24bf7b35f0a9a2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?D=C3=A1vid=20Benko?= Date: Wed, 7 Oct 2026 20:55:12 +0200 Subject: [PATCH 3/5] process: fix build on 32-bit targets On 32-bit targets size_t is not the same type as uint64_t or unsigned long, which breaks the build in two places: - tlsParser: quic_get_variable_length() takes the offset as uint64_t&, but parse_quic_user_agent() passes a size_t, so the reference cannot bind. Declares the offset as uint64_t. - tls: std::min() is called with a size_t and an unsigned long literal, so template argument deduction fails. Uses std::min instead. --- src/plugins/process/common/tlsParser/tls_parser.cpp | 2 +- src/plugins/process/tls/src/tls.cpp | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/plugins/process/common/tlsParser/tls_parser.cpp b/src/plugins/process/common/tlsParser/tls_parser.cpp index 9d451c44b..40e9ec50d 100644 --- a/src/plugins/process/common/tlsParser/tls_parser.cpp +++ b/src/plugins/process/common/tlsParser/tls_parser.cpp @@ -526,7 +526,7 @@ void TLSParser::parse_quic_user_agent( = quic_transport_parameters_begin + extension_length; for (const uint8_t* parameter = quic_transport_parameters_begin; parameter < quic_transport_parameters_end;) { - size_t offset = 0UL; + uint64_t offset = 0UL; const size_t parameter_id = quic_get_variable_length(parameter, offset); const size_t parameter_length = quic_get_variable_length(parameter, offset); if (parameter + offset + parameter_length > quic_transport_parameters_end) { diff --git a/src/plugins/process/tls/src/tls.cpp b/src/plugins/process/tls/src/tls.cpp index 14db859a8..96de190c3 100644 --- a/src/plugins/process/tls/src/tls.cpp +++ b/src/plugins/process/tls/src/tls.cpp @@ -307,9 +307,9 @@ static std::string get_ja4_string(const TLSParser& parser, uint8_t ip_proto) const char sni_label = parser.get_server_names().empty() ? 'i' : 'd'; - const uint8_t ciphers_count = std::min(parser.get_cipher_suits().size(), 99UL); + const uint8_t ciphers_count = std::min(parser.get_cipher_suits().size(), 99); - const uint8_t extension_count = std::min(parser.get_extensions().size(), 99UL); + const uint8_t extension_count = std::min(parser.get_extensions().size(), 99); const auto alpn_label = get_alpn_label(parser); From b85a277793624c94d93fd2ab356a7d99bf0d6d21 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?D=C3=A1vid=20Benko?= Date: Wed, 21 Oct 2026 21:31:38 +0200 Subject: [PATCH 4/5] tls: allocate the TLS_EXT_TYPE array before filling it fill_unirec() allocates the QUIC_TLS_EXT_TYPE array instead of the TLS_EXT_TYPE array that it fills afterwards. The allocation fails, because the field is not part of the TLS template, and the array is then grown by ur_array_set() one element at a time, which moves the rest of the record on every element. Allocates the TLS_EXT_TYPE array instead. The exported data does not change. --- src/plugins/process/tls/src/tls.hpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/plugins/process/tls/src/tls.hpp b/src/plugins/process/tls/src/tls.hpp index 9a844330e..294034ae1 100644 --- a/src/plugins/process/tls/src/tls.hpp +++ b/src/plugins/process/tls/src/tls.hpp @@ -80,7 +80,7 @@ struct RecordExtTLS : public RecordExt { ur_set_string(tmplt, record, F_TLS_ALPN, alpn); ur_set_var(tmplt, record, F_TLS_JA3, ja3, sizeof(ja3)); ur_set_string(tmplt, record, F_TLS_JA4, ja4); - ur_array_allocate(tmplt, record, F_QUIC_TLS_EXT_TYPE, extensions_buffer_size); + ur_array_allocate(tmplt, record, F_TLS_EXT_TYPE, extensions_buffer_size); for (auto i = 0U; i < extensions_buffer_size; i++) { ur_array_set(tmplt, record, F_TLS_EXT_TYPE, i, extension_types[i]); } From e0dfe15579c342e526302373f90c90250c810f8a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?D=C3=A1vid=20Benko?= Date: Fri, 23 Oct 2026 15:43:59 +0200 Subject: [PATCH 5/5] CI: fix editorconfig check with editorconfig-checker 4 editorconfig-checker 4.0.0 renamed its binary from `ec` to `editorconfig-checker`, so the check fails with "command not found" since the unpinned image was updated. Calls the binary by its new name and pins the image to major version 4, so that future breaking releases do not break the CI. --- .github/workflows/check.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 31ee2371e..0d74a23aa 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -19,9 +19,9 @@ jobs: editor-config: runs-on: ubuntu-latest - container: mstruebing/editorconfig-checker + container: mstruebing/editorconfig-checker:4 steps: - name: Check out repository code uses: actions/checkout@v4 - name: Check editorconfig - run: ec --exclude .git --exclude tests/functional/inputs + run: editorconfig-checker --exclude .git --exclude tests/functional/inputs