layers/netflow: NFv9/10 flow record type fix#4813
layers/netflow: NFv9/10 flow record type fix#4813msune wants to merge 2 commits intosecdev:masterfrom
Conversation
This commit fixes the Python types of a number of fields defined in Netflowv9/10 for the following pre-defined fields (mostly the ones in RFC3954 https://datatracker.ietf.org/doc/html/rfc3954). It appears that in absence of an assigned field type, it defaults to BytesField instead of IntField. Fields: * IN_BYTES, IN_PKTS, OUT_BYTES, OUT_PKTS: IntField (4 bytes). Please note code doesn't seem to support the larget 8byte optional length. * MUL_DST_PKTS, MUL_DST_BYTES: same as above * INPUT_SNMP, OUTPUT_SNMP: ShortField (2 bytes), iface index. Note: code doesn't seem to support optional larger values (undefined max. length, but 8 bytes might be sufficient). Note there are _many_ other field types defined that are not part of the spec / unknown without field type and length. Fixes secdev#4810 Signed-off-by: Marc Sune <marcdevel@gmail.com>
Remove unnecessary `print()` in _GenNetflowRecordV9(). Fixes secdev#4810 Signed-off-by: Marc Sune <marcdevel@gmail.com>
|
This comes from #4810. I've revised a number of fields. A couple of thoughts:
cc @gpotter2 |
gpotter2
left a comment
gpotter2
left a comment
There was a problem hiding this comment.
Thanks for looking into this, we likely should try to adapt the code so that it supports NBytesField to support integer values of arbitrary lengths. Right now this code likely won't work.
| 78: _N910F("MPLS_LABEL_9", length=3), | ||
| 79: _N910F("MPLS_LABEL_10", length=3), | ||
| 70: _N910F("MPLS_LABEL_1", length=3, | ||
| field=IntField), |
There was a problem hiding this comment.
An IntField is 4 octets long, this probably won't work.
| field=IP6Field), | ||
| 30: _N910F("IPV6_DST_MASK", length=1, | ||
| field=ByteField), | ||
| field=IP6Field), |
There was a problem hiding this comment.
IP6Field expects a full IPv6 address, probably won't work with a 1bytes long data.
There was a problem hiding this comment.
It will, it's 1byte value because it's the length of the mask in contiguos bits:
Length of the IPv6
IPV6_DST_MASK 30 1 destination mask in
contiguous bits
Ack. It would be good to support the 8bytes counters, as this is a commonly used thing. |
2 participants
This commit fixes the Python types of a number of fields defined in Netflowv9/10 for the following pre-defined fields (mostly the ones in RFC3954 https://datatracker.ietf.org/doc/html/rfc3954).
It appears that in absence of an assigned field type, it defaults to BytesField instead of IntField. Fields:
Note there are many other field types defined that are not part of the spec / unknown without field type and length.
Fixes #4810