Skip to content
This repository was archived by the owner on Feb 19, 2025. It is now read-only.

Fix: Decoding of IPFIX templates with Enterprise Number field #68

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Fix: Decoding of IPFIX templates with Enterprise Number field #68

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 36 additions & 3 deletions decoders/netflow/netflow.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ import (
"bytes"
"encoding/binary"
"fmt"
"math"
"sync"

"github.com/cloudflare/goflow/v3/decoders/utils"
Expand Down Expand Up @@ -90,7 +91,7 @@ func DecodeIPFIXOptionsTemplateSet(payload *bytes.Buffer) ([]IPFIXOptionsTemplat
return records, nil
}

func DecodeTemplateSet(payload *bytes.Buffer) ([]TemplateRecord, error) {
func DecodeNFv9TemplateSet(payload *bytes.Buffer) ([]TemplateRecord, error) {
records := make([]TemplateRecord, 0)
var err error
for payload.Len() >= 4 {
Expand All @@ -117,6 +118,38 @@ func DecodeTemplateSet(payload *bytes.Buffer) ([]TemplateRecord, error) {
return records, nil
}

func DecodeIPFIXTemplateSet(payload *bytes.Buffer) ([]TemplateRecord, error) {
records := make([]TemplateRecord, 0)
var err error
for payload.Len() >= 4 {
templateRecord := TemplateRecord{}
err = utils.BinaryDecoder(payload, &templateRecord.TemplateId, &templateRecord.FieldCount)
if err != nil {
break
}

if int(templateRecord.FieldCount) < 0 {
return records, NewErrorDecodingNetFlow("Error decoding TemplateSet: zero count.")
}

fields := make([]Field, int(templateRecord.FieldCount))
for i := 0; i < int(templateRecord.FieldCount); i++ {
field := Field{}
err = utils.BinaryDecoder(payload, &field)
if field.Type > math.MaxInt16 {
field.Type = field.Type - math.MaxInt16
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is off by one, you need

field.Type -= 1 << 15

Because:

1000000000000001

needs to turn into just '1', so you need to subtract

1000000000000000

not

0111111111111111

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, will update. (could've sworn it was in my fork)

// Skip Enterprise Number field - rfc7011#section-3.2
_ = payload.Next(4)
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skipping the 4 bytes fixes the parsing, but I think it needs to track that this was a PEN field inside the Field type. In the data that I have the resulting Type will be 1 or 2. The later bits will then just treat those fields as as IPFIX_FIELD_octetDeltaCount or IPFIX_FIELD_packetDeltaCount which would be wrong.

}
fields[i] = field
}
templateRecord.Fields = fields
records = append(records, templateRecord)
}

return records, nil
}

func GetTemplateSize(template []Field) int {
sum := 0
for _, templateField := range template {
Expand Down Expand Up @@ -347,7 +380,7 @@ func DecodeMessage(payload *bytes.Buffer, templates NetFlowTemplateSystem) (inte

if fsheader.Id == 0 && version == 9 {
templateReader := bytes.NewBuffer(payload.Next(nextrelpos))
records, err := DecodeTemplateSet(templateReader)
records, err := DecodeNFv9TemplateSet(templateReader)
if err != nil {
return returnItem, err
}
Expand Down Expand Up @@ -384,7 +417,7 @@ func DecodeMessage(payload *bytes.Buffer, templates NetFlowTemplateSystem) (inte

} else if fsheader.Id == 2 && version == 10 {
templateReader := bytes.NewBuffer(payload.Next(nextrelpos))
records, err := DecodeTemplateSet(templateReader)
records, err := DecodeIPFIXTemplateSet(templateReader)
if err != nil {
return returnItem, err
}
Expand Down