mirror/netsampler-goflow2
1
0
Fork 0
mirror of https://github.com/netsampler/goflow2.git synced 2024-05-06 15:54:52 +00:00
Code Issues Projects Releases Wiki Activity

decoder: fix netflow flowsets decoding (#218)

Browse Source 
* decoder was only reading the first FlowSet of those messages, resulting in unaccounted flows

Co-authored-by: lspgn <lspgn@users.noreply.github.com>
This commit is contained in:
Thibaud Cheruy
2023-09-29 05:11:18 +02:00
committed by GitHub
parent 34a0c1618e
commit 2a8f999a95
1 changed files with 156 additions and 150 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
decoders/netflow/netflow.go
View File

@ -282,10 +282,18 @@ func DecodeDataSet(version uint16, payload *bytes.Buffer, listFields []Field) ([
return records, nil
}
func DecodeMessageCommon(payload *bytes.Buffer, templates NetFlowTemplateSystem, obsDomainId uint32, size, version uint16) (interface{}, error) {
var flowSet interface{}
func DecodeMessageCommon(payload *bytes.Buffer, templates NetFlowTemplateSystem, obsDomainId uint32, size, version uint16) (flowSets []interface{}, err error) {
for i := 0; ((i < int(size) && version == 9) || version == 10) && payload.Len() > 0; i++ {
if flowSet, err := DecodeMessageCommonFlowSet(payload, templates, obsDomainId, version); err != nil {
return flowSets, err
} else {
flowSets = append(flowSets, flowSet)
}
}
return flowSets, err
}
func DecodeMessageCommonFlowSet(payload *bytes.Buffer, templates NetFlowTemplateSystem, obsDomainId uint32, version uint16) (flowSet interface{}, err error) {
fsheader := FlowSetHeader{}
if err := utils.BinaryDecoder(payload,
&fsheader.Id,
@ -384,7 +392,7 @@ func DecodeMessageCommon(payload *bytes.Buffer, templates NetFlowTemplateSystem,
dataReader := bytes.NewBuffer(payload.Next(nextrelpos))
if templates == nil {
continue
return flowSet, &FlowError{version, "Templates", obsDomainId, fsheader.Id, fmt.Errorf("No templates")}
}
template, err := templates.GetTemplate(version, obsDomainId, fsheader.Id)
@ -430,9 +438,7 @@ func DecodeMessageCommon(payload *bytes.Buffer, templates NetFlowTemplateSystem,
} else {
return flowSet, &FlowError{version, "Decode", obsDomainId, fsheader.Id, fmt.Errorf("ID error")}
}
}
return flowSet, nil
return flowSet, err
}
func DecodeMessageNetFlow(payload *bytes.Buffer, templates NetFlowTemplateSystem, packetNFv9 *NFv9Packet) error {
@ -449,8 +455,8 @@ func DecodeMessageNetFlow(payload *bytes.Buffer, templates NetFlowTemplateSystem
/*size = packetNFv9.Count
packetNFv9.Version = version
obsDomainId = packetNFv9.SourceId*/
flowSet, err := DecodeMessageCommon(payload, templates, packetNFv9.SourceId, packetNFv9.Count, 9)
packetNFv9.FlowSets = append(packetNFv9.FlowSets, flowSet)
flowSets, err := DecodeMessageCommon(payload, templates, packetNFv9.SourceId, packetNFv9.Count, 9)
packetNFv9.FlowSets = flowSets
if err != nil {
return &DecoderError{"NetFlowV9", err}
}
@ -470,8 +476,8 @@ func DecodeMessageIPFIX(payload *bytes.Buffer, templates NetFlowTemplateSystem,
/*size = packetIPFIX.Length
packetIPFIX.Version = version
obsDomainId = packetIPFIX.ObservationDomainId*/
flowSet, err := DecodeMessageCommon(payload, templates, packetIPFIX.ObservationDomainId, packetIPFIX.Length, 10)
packetIPFIX.FlowSets = append(packetIPFIX.FlowSets, flowSet)
flowSets, err := DecodeMessageCommon(payload, templates, packetIPFIX.ObservationDomainId, packetIPFIX.Length, 10)
packetIPFIX.FlowSets = flowSets
if err != nil {
return &DecoderError{"IPFIX", err}
}