diff --git a/CHANGELOG.md b/CHANGELOG.md index 791a9c47a826e..e215b10844354 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog +## Unreleased + +### Important Changes + +- PR [#16403](https://github.com/influxdata/telegraf/pull/16403) ensures consistency of the NetFlow plugin's + `ip_version` field type by enforcing "IPv4", "IPv6", or "unknown" string values. Previously the `ip_version` could + become an (unsigned) integer when parsing raw-packets' headers especially with SFlow v5 input. Please watch + out for type-conflicts on the output side! + ## v1.33.1 [2025-01-10] ### Important Changes diff --git a/plugins/inputs/netflow/sflow_v5.go b/plugins/inputs/netflow/sflow_v5.go index 7ac616bf54ebd..ad942c2ff6371 100644 --- a/plugins/inputs/netflow/sflow_v5.go +++ b/plugins/inputs/netflow/sflow_v5.go @@ -380,7 +380,7 @@ func (d *sflowv5Decoder) decodeRawHeaderSample(record *sflow.SampledHeader) (map fields["vlan_priority"] = l.Priority fields["vlan_drop_eligible"] = l.DropEligible case *layers.IPv4: - fields["ip_version"] = l.Version + fields["ip_version"] = decodePacketIPVersion(l.Version) fields["ipv4_inet_header_len"] = l.IHL fields["src_tos"] = l.TOS fields["ipv4_total_len"] = l.Length @@ -404,7 +404,7 @@ func (d *sflowv5Decoder) decodeRawHeaderSample(record *sflow.SampledHeader) (map fields["fragment_offset"] = l.FragOffset fields["ip_total_len"] = l.Length case *layers.IPv6: - fields["ip_version"] = l.Version + fields["ip_version"] = decodePacketIPVersion(l.Version) fields["ipv6_total_len"] = l.Length fields["ttl"] = l.HopLimit fields["protocol"] = mapL4Proto(uint8(l.NextHeader)) diff --git a/plugins/inputs/netflow/testcases/sflow_issue_15918/expected.out b/plugins/inputs/netflow/testcases/sflow_issue_15918/expected.out index 6ae474285b5c3..ade00a4d46dbf 100644 --- a/plugins/inputs/netflow/testcases/sflow_issue_15918/expected.out +++ b/plugins/inputs/netflow/testcases/sflow_issue_15918/expected.out @@ -1,7 +1,7 @@ netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,in_broadcast_packets_total=2502106u,in_bytes=21286022420858u,in_dropped_packets=0u,in_errors=0u,in_mcast_packets_total=81495048u,in_snmp=101u,in_unicast_packets_total=1153749508u,in_unknown_protocol=0u,interface=101u,interface_type=6u,ip_version="IPv4",out_broadcast_packets_total=1251275u,out_bytes=8929238553590u,out_dropped_packets=0u,out_errors=0u,out_mcast_packets_total=3753944u,out_unicast_packets_total=3892490465u,promiscuous=0u,seq_number=300415u,speed=1000000000u,status="up",sys_uptime=2042523538u 1728660319352704090 -netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,datalink_frame_type="IPv4",direction="ingress",dst="192.168.101.2",dst_port=2055u,fragment_flags="........",fragment_offset=0u,in_snmp=96u,in_src_mac="00:09:0f:09:00:01",in_total_packets=687103949u,ip_total_len=1248u,ip_version=4u,ipv4_id=49746u,ipv4_inet_header_len=5u,ipv4_total_len=1268u,l2_bytes=1286u,l2_protocol="ETHERNET-ISO8023",out_dst_mac="48:21:0b:3b:76:59",out_snmp=95u,protocol="udp",sampling_drops=8731u,sampling_interval=200u,seq_number=2404916u,src="192.168.227.2",src_port=49469u,src_tos=0u,sys_uptime=2042523538u,ttl=63u,vlan_dst=154u,vlan_dst_priority=0u,vlan_src=154u,vlan_src_priority=0u 1728660319352704090 -netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,datalink_frame_type="IPv4",direction="egress",dst="192.168.100.104",dst_port=52851u,fragment_flags="......D.",fragment_offset=0u,in_snmp=60u,in_src_mac="dc:2c:6e:b9:1a:c6",in_total_packets=804503573u,ip_total_len=525u,ip_version=4u,ipv4_id=0u,ipv4_inet_header_len=5u,ipv4_total_len=545u,l2_bytes=563u,l2_protocol="ETHERNET-ISO8023",out_dst_mac="00:09:0f:09:00:00",out_snmp=60u,protocol="udp",sampling_drops=14255907u,sampling_interval=200u,seq_number=20451226u,src="142.250.200.99",src_port=443u,src_tos=0u,sys_uptime=2042523538u,ttl=51u,vlan_dst=250u,vlan_dst_priority=0u,vlan_src=250u,vlan_src_priority=4294967295u 1728660319352704090 -netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,datalink_frame_type="IPv6",direction="egress",dst="ff02::16",in_snmp=76u,in_src_mac="00:e0:4c:68:00:5c",in_total_packets=1062946518u,ip_total_len=56u,ip_version=6u,ipv6_total_len=56u,l2_bytes=114u,l2_protocol="ETHERNET-ISO8023",out_dst_mac="33:33:00:00:00:16",protocol="hopopt",sampling_drops=30750u,sampling_interval=200u,seq_number=899357u,src="fe80::f3a8:9738:cab4:2286",sys_uptime=2042523538u,ttl=1u,vlan_dst=153u,vlan_dst_priority=0u,vlan_src=153u,vlan_src_priority=4294967295u 1728660319352704090 -netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,datalink_frame_type="IPv4",direction="egress",dst="142.250.185.14",dst_port=443u,fragment_flags="......D.",fragment_offset=0u,in_snmp=101u,in_src_mac="00:09:0f:09:00:00",in_total_packets=840275157u,ip_total_len=39u,ip_version=4u,ipv4_id=40468u,ipv4_inet_header_len=5u,ipv4_total_len=59u,l2_bytes=77u,l2_protocol="ETHERNET-ISO8023",out_dst_mac="00:00:5e:00:01:7b",out_snmp=101u,protocol="udp",sampling_drops=14100530u,sampling_interval=200u,seq_number=20640786u,src="192.168.153.106",src_port=64969u,src_tos=0u,sys_uptime=2042523538u,ttl=127u,vlan_dst=250u,vlan_dst_priority=0u,vlan_src=250u,vlan_src_priority=4294967295u 1728660319352704090 -netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,datalink_frame_type="IPv4",direction="ingress",dst="192.168.153.106",dst_port=64969u,fragment_flags="......D.",fragment_offset=0u,in_snmp=6u,in_src_mac="00:09:0f:09:00:08",in_total_packets=774315870u,ip_total_len=681u,ip_version=4u,ipv4_id=0u,ipv4_inet_header_len=5u,ipv4_total_len=701u,l2_bytes=719u,l2_protocol="ETHERNET-ISO8023",out_dst_mac="7c:8a:e1:be:20:52",out_snmp=97u,protocol="udp",sampling_drops=2262938u,sampling_interval=200u,seq_number=17418932u,src="142.250.185.14",src_port=443u,src_tos=0u,sys_uptime=2042523538u,ttl=50u,vlan_dst=153u,vlan_dst_priority=0u,vlan_src=153u,vlan_src_priority=0u 1728660319352704090 -netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,datalink_frame_type="IPv6",direction="egress",dst="ff02::1:3",dst_port=5355u,in_snmp=72u,in_src_mac="00:e0:4c:68:00:5c",in_total_packets=1172072178u,ip_total_len=35u,ip_version=6u,ipv6_total_len=35u,l2_bytes=93u,l2_protocol="ETHERNET-ISO8023",out_dst_mac="33:33:00:01:00:03",protocol="udp",sampling_drops=27512u,sampling_interval=200u,seq_number=704213u,src="fe80::f3a8:9738:cab4:2286",src_port=49770u,sys_uptime=2042523538u,ttl=1u,vlan_dst=153u,vlan_dst_priority=0u,vlan_src=153u,vlan_src_priority=4294967295u 1728660319352704090 +netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,datalink_frame_type="IPv4",direction="ingress",dst="192.168.101.2",dst_port=2055u,fragment_flags="........",fragment_offset=0u,in_snmp=96u,in_src_mac="00:09:0f:09:00:01",in_total_packets=687103949u,ip_total_len=1248u,ip_version="IPv4",ipv4_id=49746u,ipv4_inet_header_len=5u,ipv4_total_len=1268u,l2_bytes=1286u,l2_protocol="ETHERNET-ISO8023",out_dst_mac="48:21:0b:3b:76:59",out_snmp=95u,protocol="udp",sampling_drops=8731u,sampling_interval=200u,seq_number=2404916u,src="192.168.227.2",src_port=49469u,src_tos=0u,sys_uptime=2042523538u,ttl=63u,vlan_dst=154u,vlan_dst_priority=0u,vlan_src=154u,vlan_src_priority=0u 1728660319352704090 +netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,datalink_frame_type="IPv4",direction="egress",dst="192.168.100.104",dst_port=52851u,fragment_flags="......D.",fragment_offset=0u,in_snmp=60u,in_src_mac="dc:2c:6e:b9:1a:c6",in_total_packets=804503573u,ip_total_len=525u,ip_version="IPv4",ipv4_id=0u,ipv4_inet_header_len=5u,ipv4_total_len=545u,l2_bytes=563u,l2_protocol="ETHERNET-ISO8023",out_dst_mac="00:09:0f:09:00:00",out_snmp=60u,protocol="udp",sampling_drops=14255907u,sampling_interval=200u,seq_number=20451226u,src="142.250.200.99",src_port=443u,src_tos=0u,sys_uptime=2042523538u,ttl=51u,vlan_dst=250u,vlan_dst_priority=0u,vlan_src=250u,vlan_src_priority=4294967295u 1728660319352704090 +netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,datalink_frame_type="IPv6",direction="egress",dst="ff02::16",in_snmp=76u,in_src_mac="00:e0:4c:68:00:5c",in_total_packets=1062946518u,ip_total_len=56u,ip_version="IPv6",ipv6_total_len=56u,l2_bytes=114u,l2_protocol="ETHERNET-ISO8023",out_dst_mac="33:33:00:00:00:16",protocol="hopopt",sampling_drops=30750u,sampling_interval=200u,seq_number=899357u,src="fe80::f3a8:9738:cab4:2286",sys_uptime=2042523538u,ttl=1u,vlan_dst=153u,vlan_dst_priority=0u,vlan_src=153u,vlan_src_priority=4294967295u 1728660319352704090 +netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,datalink_frame_type="IPv4",direction="egress",dst="142.250.185.14",dst_port=443u,fragment_flags="......D.",fragment_offset=0u,in_snmp=101u,in_src_mac="00:09:0f:09:00:00",in_total_packets=840275157u,ip_total_len=39u,ip_version="IPv4",ipv4_id=40468u,ipv4_inet_header_len=5u,ipv4_total_len=59u,l2_bytes=77u,l2_protocol="ETHERNET-ISO8023",out_dst_mac="00:00:5e:00:01:7b",out_snmp=101u,protocol="udp",sampling_drops=14100530u,sampling_interval=200u,seq_number=20640786u,src="192.168.153.106",src_port=64969u,src_tos=0u,sys_uptime=2042523538u,ttl=127u,vlan_dst=250u,vlan_dst_priority=0u,vlan_src=250u,vlan_src_priority=4294967295u 1728660319352704090 +netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,datalink_frame_type="IPv4",direction="ingress",dst="192.168.153.106",dst_port=64969u,fragment_flags="......D.",fragment_offset=0u,in_snmp=6u,in_src_mac="00:09:0f:09:00:08",in_total_packets=774315870u,ip_total_len=681u,ip_version="IPv4",ipv4_id=0u,ipv4_inet_header_len=5u,ipv4_total_len=701u,l2_bytes=719u,l2_protocol="ETHERNET-ISO8023",out_dst_mac="7c:8a:e1:be:20:52",out_snmp=97u,protocol="udp",sampling_drops=2262938u,sampling_interval=200u,seq_number=17418932u,src="142.250.185.14",src_port=443u,src_tos=0u,sys_uptime=2042523538u,ttl=50u,vlan_dst=153u,vlan_dst_priority=0u,vlan_src=153u,vlan_src_priority=0u 1728660319352704090 +netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,datalink_frame_type="IPv6",direction="egress",dst="ff02::1:3",dst_port=5355u,in_snmp=72u,in_src_mac="00:e0:4c:68:00:5c",in_total_packets=1172072178u,ip_total_len=35u,ip_version="IPv6",ipv6_total_len=35u,l2_bytes=93u,l2_protocol="ETHERNET-ISO8023",out_dst_mac="33:33:00:01:00:03",protocol="udp",sampling_drops=27512u,sampling_interval=200u,seq_number=704213u,src="fe80::f3a8:9738:cab4:2286",src_port=49770u,sys_uptime=2042523538u,ttl=1u,vlan_dst=153u,vlan_dst_priority=0u,vlan_src=153u,vlan_src_priority=4294967295u 1728660319352704090 diff --git a/plugins/inputs/netflow/type_conversion.go b/plugins/inputs/netflow/type_conversion.go index 2301a7e91170d..a851e0abc71d3 100644 --- a/plugins/inputs/netflow/type_conversion.go +++ b/plugins/inputs/netflow/type_conversion.go @@ -328,6 +328,17 @@ func decodeIPVersion(b []byte) (interface{}, error) { return strconv.FormatUint(uint64(b[0]), 10), nil } +func decodePacketIPVersion(v uint8) string { + switch v { + case 4: + return "IPv4" + case 6: + return "IPv6" + default: + return "unknown" + } +} + func decodeDirection(b []byte) (interface{}, error) { switch b[0] { case 0: