paulmataruso/goflow2
1
0
Fork 0
mirror of https://github.com/openobserve/goflow2.git synced 2025-11-04 05:53:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

decoder: fix netflow flowsets decoding (#218)

Browse Source 
* decoder was only reading the first FlowSet of those messages, resulting in unaccounted flows

Co-authored-by: lspgn <lspgn@users.noreply.github.com>
This commit is contained in:
Thibaud Cheruy
2023-09-29 05:11:18 +02:00
committed by GitHub
parent 34a0c1618e
commit 2a8f999a95
1 changed files with 156 additions and 150 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
decoders/netflow/netflow.go
View File

@@ -282,10 +282,18 @@ func DecodeDataSet(version uint16, payload *bytes.Buffer, listFields []Field) ([
return records, nil return records, nil
} }
func DecodeMessageCommon(payload *bytes.Buffer, templates NetFlowTemplateSystem, obsDomainId uint32, size, version uint16) (interface{}, error) { func DecodeMessageCommon(payload *bytes.Buffer, templates NetFlowTemplateSystem, obsDomainId uint32, size, version uint16) (flowSets []interface{}, err error) {
var flowSet interface{}
for i := 0; ((i < int(size) && version == 9) || version == 10) && payload.Len() > 0; i++ { for i := 0; ((i < int(size) && version == 9) || version == 10) && payload.Len() > 0; i++ {
if flowSet, err := DecodeMessageCommonFlowSet(payload, templates, obsDomainId, version); err != nil {
return flowSets, err
} else {
flowSets = append(flowSets, flowSet)
}
}
return flowSets, err
}
func DecodeMessageCommonFlowSet(payload *bytes.Buffer, templates NetFlowTemplateSystem, obsDomainId uint32, version uint16) (flowSet interface{}, err error) {
fsheader := FlowSetHeader{} fsheader := FlowSetHeader{}
if err := utils.BinaryDecoder(payload, if err := utils.BinaryDecoder(payload,
&fsheader.Id, &fsheader.Id,
@@ -384,7 +392,7 @@ func DecodeMessageCommon(payload *bytes.Buffer, templates NetFlowTemplateSystem,
dataReader := bytes.NewBuffer(payload.Next(nextrelpos)) dataReader := bytes.NewBuffer(payload.Next(nextrelpos))
if templates == nil { if templates == nil {
continue return flowSet, &FlowError{version, "Templates", obsDomainId, fsheader.Id, fmt.Errorf("No templates")}
} }
template, err := templates.GetTemplate(version, obsDomainId, fsheader.Id) template, err := templates.GetTemplate(version, obsDomainId, fsheader.Id)
@@ -430,9 +438,7 @@ func DecodeMessageCommon(payload *bytes.Buffer, templates NetFlowTemplateSystem,
} else { } else {
return flowSet, &FlowError{version, "Decode", obsDomainId, fsheader.Id, fmt.Errorf("ID error")} return flowSet, &FlowError{version, "Decode", obsDomainId, fsheader.Id, fmt.Errorf("ID error")}
} }
return flowSet, err
}
return flowSet, nil
} }
func DecodeMessageNetFlow(payload *bytes.Buffer, templates NetFlowTemplateSystem, packetNFv9 *NFv9Packet) error { func DecodeMessageNetFlow(payload *bytes.Buffer, templates NetFlowTemplateSystem, packetNFv9 *NFv9Packet) error {
@@ -449,8 +455,8 @@ func DecodeMessageNetFlow(payload *bytes.Buffer, templates NetFlowTemplateSystem
/*size = packetNFv9.Count /*size = packetNFv9.Count
packetNFv9.Version = version packetNFv9.Version = version
obsDomainId = packetNFv9.SourceId*/ obsDomainId = packetNFv9.SourceId*/
flowSet, err := DecodeMessageCommon(payload, templates, packetNFv9.SourceId, packetNFv9.Count, 9) flowSets, err := DecodeMessageCommon(payload, templates, packetNFv9.SourceId, packetNFv9.Count, 9)
packetNFv9.FlowSets = append(packetNFv9.FlowSets, flowSet) packetNFv9.FlowSets = flowSets
if err != nil { if err != nil {
return &DecoderError{"NetFlowV9", err} return &DecoderError{"NetFlowV9", err}
} }
@@ -470,8 +476,8 @@ func DecodeMessageIPFIX(payload *bytes.Buffer, templates NetFlowTemplateSystem,
/*size = packetIPFIX.Length /*size = packetIPFIX.Length
packetIPFIX.Version = version packetIPFIX.Version = version
obsDomainId = packetIPFIX.ObservationDomainId*/ obsDomainId = packetIPFIX.ObservationDomainId*/
flowSet, err := DecodeMessageCommon(payload, templates, packetIPFIX.ObservationDomainId, packetIPFIX.Length, 10) flowSets, err := DecodeMessageCommon(payload, templates, packetIPFIX.ObservationDomainId, packetIPFIX.Length, 10)
packetIPFIX.FlowSets = append(packetIPFIX.FlowSets, flowSet) packetIPFIX.FlowSets = flowSets
if err != nil { if err != nil {
return &DecoderError{"IPFIX", err} return &DecoderError{"IPFIX", err}
} }