layers/netflow: NFv9/10 flow record type fix #4813
Conversation
This commit fixes the Python types of a number of fields defined in Netflowv9/10 for the following pre-defined fields (mostly the ones in RFC3954 https://datatracker.ietf.org/doc/html/rfc3954). It appears that in absence of an assigned field type, it defaults to BytesField instead of IntField. Fields: * IN_BYTES, IN_PKTS, OUT_BYTES, OUT_PKTS: IntField (4 bytes). Please note code doesn't seem to support the larget 8byte optional length. * MUL_DST_PKTS, MUL_DST_BYTES: same as above * INPUT_SNMP, OUTPUT_SNMP: ShortField (2 bytes), iface index. Note: code doesn't seem to support optional larger values (undefined max. length, but 8 bytes might be sufficient). Note there are _many_ other field types defined that are not part of the spec / unknown without field type and length. Fixes secdev#4810 Signed-off-by: Marc Sune <[email protected]>
Remove unnecessary `print()` in _GenNetflowRecordV9(). Fixes secdev#4810 Signed-off-by: Marc Sune <[email protected]>
|
This comes from #4810. I've revised a number of fields. A couple of thoughts:
cc @gpotter2 |
| 78: _N910F("MPLS_LABEL_9", length=3), | ||
| 79: _N910F("MPLS_LABEL_10", length=3), | ||
| 70: _N910F("MPLS_LABEL_1", length=3, | ||
| field=IntField), |
There was a problem hiding this comment.
An IntField is 4 octets long, this probably won't work.
| 30: _N910F("IPV6_DST_MASK", length=1, | ||
| field=ByteField), | ||
| field=IP6Field), |
There was a problem hiding this comment.
IP6Field expects a full IPv6 address, probably won't work with a 1bytes long data.
There was a problem hiding this comment.
It will, it's 1byte value because it's the length of the mask in contiguos bits:
Length of the IPv6
IPV6_DST_MASK 30 1 destination mask in
contiguous bits
Ack. It would be good to support the 8bytes counters, as this is a commonly used thing. |
This commit fixes the Python types of a number of fields defined in Netflowv9/10 for the following pre-defined fields (mostly the ones in RFC3954 https://datatracker.ietf.org/doc/html/rfc3954).
It appears that in absence of an assigned field type, it defaults to BytesField instead of IntField. Fields:
Note there are many other field types defined that are not part of the spec / unknown without field type and length.
Fixes #4810