From 128b2055615da50804531c05bb81dca5315bd012 Mon Sep 17 00:00:00 2001 From: jlgonzalez Date: Wed, 15 Jan 2025 13:31:31 +0100 Subject: [PATCH 1/6] fix: convert ip_version field to string --- plugins/inputs/netflow/sflow_v5.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/plugins/inputs/netflow/sflow_v5.go b/plugins/inputs/netflow/sflow_v5.go index 7ac616bf54ebd..717162535404b 100644 --- a/plugins/inputs/netflow/sflow_v5.go +++ b/plugins/inputs/netflow/sflow_v5.go @@ -380,7 +380,7 @@ func (d *sflowv5Decoder) decodeRawHeaderSample(record *sflow.SampledHeader) (map fields["vlan_priority"] = l.Priority fields["vlan_drop_eligible"] = l.DropEligible case *layers.IPv4: - fields["ip_version"] = l.Version + fields["ip_version"] = decodeSflowIPVersion(uint32(l.Version)) fields["ipv4_inet_header_len"] = l.IHL fields["src_tos"] = l.TOS fields["ipv4_total_len"] = l.Length @@ -404,7 +404,7 @@ func (d *sflowv5Decoder) decodeRawHeaderSample(record *sflow.SampledHeader) (map fields["fragment_offset"] = l.FragOffset fields["ip_total_len"] = l.Length case *layers.IPv6: - fields["ip_version"] = l.Version + fields["ip_version"] = decodeSflowIPVersion(uint32(l.Version)) fields["ipv6_total_len"] = l.Length fields["ttl"] = l.HopLimit fields["protocol"] = mapL4Proto(uint8(l.NextHeader)) From d53de6f088b4dfcc4ae4c6658108d59556646c7d Mon Sep 17 00:00:00 2001 From: jlgonzalez Date: Wed, 15 Jan 2025 13:44:21 +0100 Subject: [PATCH 2/6] Revert "fix: convert ip_version field to string" This reverts commit 128b2055615da50804531c05bb81dca5315bd012. --- plugins/inputs/netflow/sflow_v5.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/plugins/inputs/netflow/sflow_v5.go b/plugins/inputs/netflow/sflow_v5.go index 717162535404b..7ac616bf54ebd 100644 --- a/plugins/inputs/netflow/sflow_v5.go +++ b/plugins/inputs/netflow/sflow_v5.go @@ -380,7 +380,7 @@ func (d *sflowv5Decoder) decodeRawHeaderSample(record *sflow.SampledHeader) (map fields["vlan_priority"] = l.Priority fields["vlan_drop_eligible"] = l.DropEligible case *layers.IPv4: - fields["ip_version"] = decodeSflowIPVersion(uint32(l.Version)) + fields["ip_version"] = l.Version fields["ipv4_inet_header_len"] = l.IHL fields["src_tos"] = l.TOS fields["ipv4_total_len"] = l.Length @@ -404,7 +404,7 @@ func (d *sflowv5Decoder) decodeRawHeaderSample(record *sflow.SampledHeader) (map fields["fragment_offset"] = l.FragOffset fields["ip_total_len"] = l.Length case *layers.IPv6: - fields["ip_version"] = decodeSflowIPVersion(uint32(l.Version)) + fields["ip_version"] = l.Version fields["ipv6_total_len"] = l.Length fields["ttl"] = l.HopLimit fields["protocol"] = mapL4Proto(uint8(l.NextHeader)) From c563c45579e1ffdc00e979df870c90a7d7248d19 Mon Sep 17 00:00:00 2001 From: jlgonzalez Date: Wed, 15 Jan 2025 13:49:20 +0100 Subject: [PATCH 3/6] fix(inputs.netflow): convert ip_version field to string --- plugins/inputs/netflow/sflow_v5.go | 4 ++-- .../testcases/sflow_issue_15918/expected.out | 12 ++++++------ plugins/inputs/netflow/type_conversion.go | 13 +++++++++++++ 3 files changed, 21 insertions(+), 8 deletions(-) diff --git a/plugins/inputs/netflow/sflow_v5.go b/plugins/inputs/netflow/sflow_v5.go index 7ac616bf54ebd..ad942c2ff6371 100644 --- a/plugins/inputs/netflow/sflow_v5.go +++ b/plugins/inputs/netflow/sflow_v5.go @@ -380,7 +380,7 @@ func (d *sflowv5Decoder) decodeRawHeaderSample(record *sflow.SampledHeader) (map fields["vlan_priority"] = l.Priority fields["vlan_drop_eligible"] = l.DropEligible case *layers.IPv4: - fields["ip_version"] = l.Version + fields["ip_version"] = decodePacketIPVersion(l.Version) fields["ipv4_inet_header_len"] = l.IHL fields["src_tos"] = l.TOS fields["ipv4_total_len"] = l.Length @@ -404,7 +404,7 @@ func (d *sflowv5Decoder) decodeRawHeaderSample(record *sflow.SampledHeader) (map fields["fragment_offset"] = l.FragOffset fields["ip_total_len"] = l.Length case *layers.IPv6: - fields["ip_version"] = l.Version + fields["ip_version"] = decodePacketIPVersion(l.Version) fields["ipv6_total_len"] = l.Length fields["ttl"] = l.HopLimit fields["protocol"] = mapL4Proto(uint8(l.NextHeader)) diff --git a/plugins/inputs/netflow/testcases/sflow_issue_15918/expected.out b/plugins/inputs/netflow/testcases/sflow_issue_15918/expected.out index 6ae474285b5c3..ade00a4d46dbf 100644 --- a/plugins/inputs/netflow/testcases/sflow_issue_15918/expected.out +++ b/plugins/inputs/netflow/testcases/sflow_issue_15918/expected.out @@ -1,7 +1,7 @@ netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,in_broadcast_packets_total=2502106u,in_bytes=21286022420858u,in_dropped_packets=0u,in_errors=0u,in_mcast_packets_total=81495048u,in_snmp=101u,in_unicast_packets_total=1153749508u,in_unknown_protocol=0u,interface=101u,interface_type=6u,ip_version="IPv4",out_broadcast_packets_total=1251275u,out_bytes=8929238553590u,out_dropped_packets=0u,out_errors=0u,out_mcast_packets_total=3753944u,out_unicast_packets_total=3892490465u,promiscuous=0u,seq_number=300415u,speed=1000000000u,status="up",sys_uptime=2042523538u 1728660319352704090 -netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,datalink_frame_type="IPv4",direction="ingress",dst="192.168.101.2",dst_port=2055u,fragment_flags="........",fragment_offset=0u,in_snmp=96u,in_src_mac="00:09:0f:09:00:01",in_total_packets=687103949u,ip_total_len=1248u,ip_version=4u,ipv4_id=49746u,ipv4_inet_header_len=5u,ipv4_total_len=1268u,l2_bytes=1286u,l2_protocol="ETHERNET-ISO8023",out_dst_mac="48:21:0b:3b:76:59",out_snmp=95u,protocol="udp",sampling_drops=8731u,sampling_interval=200u,seq_number=2404916u,src="192.168.227.2",src_port=49469u,src_tos=0u,sys_uptime=2042523538u,ttl=63u,vlan_dst=154u,vlan_dst_priority=0u,vlan_src=154u,vlan_src_priority=0u 1728660319352704090 -netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,datalink_frame_type="IPv4",direction="egress",dst="192.168.100.104",dst_port=52851u,fragment_flags="......D.",fragment_offset=0u,in_snmp=60u,in_src_mac="dc:2c:6e:b9:1a:c6",in_total_packets=804503573u,ip_total_len=525u,ip_version=4u,ipv4_id=0u,ipv4_inet_header_len=5u,ipv4_total_len=545u,l2_bytes=563u,l2_protocol="ETHERNET-ISO8023",out_dst_mac="00:09:0f:09:00:00",out_snmp=60u,protocol="udp",sampling_drops=14255907u,sampling_interval=200u,seq_number=20451226u,src="142.250.200.99",src_port=443u,src_tos=0u,sys_uptime=2042523538u,ttl=51u,vlan_dst=250u,vlan_dst_priority=0u,vlan_src=250u,vlan_src_priority=4294967295u 1728660319352704090 -netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,datalink_frame_type="IPv6",direction="egress",dst="ff02::16",in_snmp=76u,in_src_mac="00:e0:4c:68:00:5c",in_total_packets=1062946518u,ip_total_len=56u,ip_version=6u,ipv6_total_len=56u,l2_bytes=114u,l2_protocol="ETHERNET-ISO8023",out_dst_mac="33:33:00:00:00:16",protocol="hopopt",sampling_drops=30750u,sampling_interval=200u,seq_number=899357u,src="fe80::f3a8:9738:cab4:2286",sys_uptime=2042523538u,ttl=1u,vlan_dst=153u,vlan_dst_priority=0u,vlan_src=153u,vlan_src_priority=4294967295u 1728660319352704090 -netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,datalink_frame_type="IPv4",direction="egress",dst="142.250.185.14",dst_port=443u,fragment_flags="......D.",fragment_offset=0u,in_snmp=101u,in_src_mac="00:09:0f:09:00:00",in_total_packets=840275157u,ip_total_len=39u,ip_version=4u,ipv4_id=40468u,ipv4_inet_header_len=5u,ipv4_total_len=59u,l2_bytes=77u,l2_protocol="ETHERNET-ISO8023",out_dst_mac="00:00:5e:00:01:7b",out_snmp=101u,protocol="udp",sampling_drops=14100530u,sampling_interval=200u,seq_number=20640786u,src="192.168.153.106",src_port=64969u,src_tos=0u,sys_uptime=2042523538u,ttl=127u,vlan_dst=250u,vlan_dst_priority=0u,vlan_src=250u,vlan_src_priority=4294967295u 1728660319352704090 -netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,datalink_frame_type="IPv4",direction="ingress",dst="192.168.153.106",dst_port=64969u,fragment_flags="......D.",fragment_offset=0u,in_snmp=6u,in_src_mac="00:09:0f:09:00:08",in_total_packets=774315870u,ip_total_len=681u,ip_version=4u,ipv4_id=0u,ipv4_inet_header_len=5u,ipv4_total_len=701u,l2_bytes=719u,l2_protocol="ETHERNET-ISO8023",out_dst_mac="7c:8a:e1:be:20:52",out_snmp=97u,protocol="udp",sampling_drops=2262938u,sampling_interval=200u,seq_number=17418932u,src="142.250.185.14",src_port=443u,src_tos=0u,sys_uptime=2042523538u,ttl=50u,vlan_dst=153u,vlan_dst_priority=0u,vlan_src=153u,vlan_src_priority=0u 1728660319352704090 -netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,datalink_frame_type="IPv6",direction="egress",dst="ff02::1:3",dst_port=5355u,in_snmp=72u,in_src_mac="00:e0:4c:68:00:5c",in_total_packets=1172072178u,ip_total_len=35u,ip_version=6u,ipv6_total_len=35u,l2_bytes=93u,l2_protocol="ETHERNET-ISO8023",out_dst_mac="33:33:00:01:00:03",protocol="udp",sampling_drops=27512u,sampling_interval=200u,seq_number=704213u,src="fe80::f3a8:9738:cab4:2286",src_port=49770u,sys_uptime=2042523538u,ttl=1u,vlan_dst=153u,vlan_dst_priority=0u,vlan_src=153u,vlan_src_priority=4294967295u 1728660319352704090 +netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,datalink_frame_type="IPv4",direction="ingress",dst="192.168.101.2",dst_port=2055u,fragment_flags="........",fragment_offset=0u,in_snmp=96u,in_src_mac="00:09:0f:09:00:01",in_total_packets=687103949u,ip_total_len=1248u,ip_version="IPv4",ipv4_id=49746u,ipv4_inet_header_len=5u,ipv4_total_len=1268u,l2_bytes=1286u,l2_protocol="ETHERNET-ISO8023",out_dst_mac="48:21:0b:3b:76:59",out_snmp=95u,protocol="udp",sampling_drops=8731u,sampling_interval=200u,seq_number=2404916u,src="192.168.227.2",src_port=49469u,src_tos=0u,sys_uptime=2042523538u,ttl=63u,vlan_dst=154u,vlan_dst_priority=0u,vlan_src=154u,vlan_src_priority=0u 1728660319352704090 +netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,datalink_frame_type="IPv4",direction="egress",dst="192.168.100.104",dst_port=52851u,fragment_flags="......D.",fragment_offset=0u,in_snmp=60u,in_src_mac="dc:2c:6e:b9:1a:c6",in_total_packets=804503573u,ip_total_len=525u,ip_version="IPv4",ipv4_id=0u,ipv4_inet_header_len=5u,ipv4_total_len=545u,l2_bytes=563u,l2_protocol="ETHERNET-ISO8023",out_dst_mac="00:09:0f:09:00:00",out_snmp=60u,protocol="udp",sampling_drops=14255907u,sampling_interval=200u,seq_number=20451226u,src="142.250.200.99",src_port=443u,src_tos=0u,sys_uptime=2042523538u,ttl=51u,vlan_dst=250u,vlan_dst_priority=0u,vlan_src=250u,vlan_src_priority=4294967295u 1728660319352704090 +netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,datalink_frame_type="IPv6",direction="egress",dst="ff02::16",in_snmp=76u,in_src_mac="00:e0:4c:68:00:5c",in_total_packets=1062946518u,ip_total_len=56u,ip_version="IPv6",ipv6_total_len=56u,l2_bytes=114u,l2_protocol="ETHERNET-ISO8023",out_dst_mac="33:33:00:00:00:16",protocol="hopopt",sampling_drops=30750u,sampling_interval=200u,seq_number=899357u,src="fe80::f3a8:9738:cab4:2286",sys_uptime=2042523538u,ttl=1u,vlan_dst=153u,vlan_dst_priority=0u,vlan_src=153u,vlan_src_priority=4294967295u 1728660319352704090 +netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,datalink_frame_type="IPv4",direction="egress",dst="142.250.185.14",dst_port=443u,fragment_flags="......D.",fragment_offset=0u,in_snmp=101u,in_src_mac="00:09:0f:09:00:00",in_total_packets=840275157u,ip_total_len=39u,ip_version="IPv4",ipv4_id=40468u,ipv4_inet_header_len=5u,ipv4_total_len=59u,l2_bytes=77u,l2_protocol="ETHERNET-ISO8023",out_dst_mac="00:00:5e:00:01:7b",out_snmp=101u,protocol="udp",sampling_drops=14100530u,sampling_interval=200u,seq_number=20640786u,src="192.168.153.106",src_port=64969u,src_tos=0u,sys_uptime=2042523538u,ttl=127u,vlan_dst=250u,vlan_dst_priority=0u,vlan_src=250u,vlan_src_priority=4294967295u 1728660319352704090 +netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,datalink_frame_type="IPv4",direction="ingress",dst="192.168.153.106",dst_port=64969u,fragment_flags="......D.",fragment_offset=0u,in_snmp=6u,in_src_mac="00:09:0f:09:00:08",in_total_packets=774315870u,ip_total_len=681u,ip_version="IPv4",ipv4_id=0u,ipv4_inet_header_len=5u,ipv4_total_len=701u,l2_bytes=719u,l2_protocol="ETHERNET-ISO8023",out_dst_mac="7c:8a:e1:be:20:52",out_snmp=97u,protocol="udp",sampling_drops=2262938u,sampling_interval=200u,seq_number=17418932u,src="142.250.185.14",src_port=443u,src_tos=0u,sys_uptime=2042523538u,ttl=50u,vlan_dst=153u,vlan_dst_priority=0u,vlan_src=153u,vlan_src_priority=0u 1728660319352704090 +netflow,source=127.0.0.1,version=sFlowV5 agent_ip="192.168.227.2",agent_subid=0u,datalink_frame_type="IPv6",direction="egress",dst="ff02::1:3",dst_port=5355u,in_snmp=72u,in_src_mac="00:e0:4c:68:00:5c",in_total_packets=1172072178u,ip_total_len=35u,ip_version="IPv6",ipv6_total_len=35u,l2_bytes=93u,l2_protocol="ETHERNET-ISO8023",out_dst_mac="33:33:00:01:00:03",protocol="udp",sampling_drops=27512u,sampling_interval=200u,seq_number=704213u,src="fe80::f3a8:9738:cab4:2286",src_port=49770u,sys_uptime=2042523538u,ttl=1u,vlan_dst=153u,vlan_dst_priority=0u,vlan_src=153u,vlan_src_priority=4294967295u 1728660319352704090 diff --git a/plugins/inputs/netflow/type_conversion.go b/plugins/inputs/netflow/type_conversion.go index 2301a7e91170d..29d119e0062f0 100644 --- a/plugins/inputs/netflow/type_conversion.go +++ b/plugins/inputs/netflow/type_conversion.go @@ -328,6 +328,19 @@ func decodeIPVersion(b []byte) (interface{}, error) { return strconv.FormatUint(uint64(b[0]), 10), nil } +func decodePacketIPVersion(v uint8) string { + switch v { + case 0: + return "unknown" + case 4: + return "IPv4" + case 6: + return "IPv6" + default: + return "unknown" + } +} + func decodeDirection(b []byte) (interface{}, error) { switch b[0] { case 0: From 3520e9a021b9bdd4b5f969f12c814c5db61939de Mon Sep 17 00:00:00 2001 From: jlgonzalez Date: Wed, 15 Jan 2025 13:53:11 +0100 Subject: [PATCH 4/6] refactor(inputs.netflow): remove unnecesary case in switch statement --- plugins/inputs/netflow/type_conversion.go | 2 -- 1 file changed, 2 deletions(-) diff --git a/plugins/inputs/netflow/type_conversion.go b/plugins/inputs/netflow/type_conversion.go index 29d119e0062f0..a851e0abc71d3 100644 --- a/plugins/inputs/netflow/type_conversion.go +++ b/plugins/inputs/netflow/type_conversion.go @@ -330,8 +330,6 @@ func decodeIPVersion(b []byte) (interface{}, error) { func decodePacketIPVersion(v uint8) string { switch v { - case 0: - return "unknown" case 4: return "IPv4" case 6: From cb05ae6ddbee60e1acb92da1481962a586be2981 Mon Sep 17 00:00:00 2001 From: jlgonzalez Date: Fri, 17 Jan 2025 08:41:52 +0100 Subject: [PATCH 5/6] docs(inputs.netflow): add breaking change information in changelog about `ip_version` value --- CHANGELOG.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 791a9c47a826e..c7b8da177132d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,12 @@ # Changelog +## v1.33.2 [2025-01-17] + +### Important Changes + +- `ip_version` field of the NetFlow input plugin (while using sFlowV5 protocol) will now consistently return values as text. The possible values will be "IPv4", "IPv6", or "unknown". Previously, this field could return inconsistent results, sometimes as text and other times as a numeric value. This change aims to enhance clarity and reliability in the data output. + ## v1.33.1 [2025-01-10] ### Important Changes From 9293cf74a59b0264f271c43e87c98b2036ba4d81 Mon Sep 17 00:00:00 2001 From: Jose Luis Gonzalez Calvo <90149790+joseluisgonzalezca@users.noreply.github.com> Date: Fri, 17 Jan 2025 11:04:04 +0100 Subject: [PATCH 6/6] docs(inputs.netflow): update CHANGELOG.md to provide more insight about the breaking change Co-authored-by: Sven Rebhan <36194019+srebhan@users.noreply.github.com> --- CHANGELOG.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c7b8da177132d..e215b10844354 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,11 +1,14 @@ # Changelog -## v1.33.2 [2025-01-17] +## Unreleased ### Important Changes -- `ip_version` field of the NetFlow input plugin (while using sFlowV5 protocol) will now consistently return values as text. The possible values will be "IPv4", "IPv6", or "unknown". Previously, this field could return inconsistent results, sometimes as text and other times as a numeric value. This change aims to enhance clarity and reliability in the data output. +- PR [#16403](https://github.com/influxdata/telegraf/pull/16403) ensures consistency of the NetFlow plugin's + `ip_version` field type by enforcing "IPv4", "IPv6", or "unknown" string values. Previously the `ip_version` could + become an (unsigned) integer when parsing raw-packets' headers especially with SFlow v5 input. Please watch + out for type-conflicts on the output side! ## v1.33.1 [2025-01-10]