-
-
Notifications
You must be signed in to change notification settings - Fork 2.2k
layers/netflow: NFv9/10 flow record type fix #4813
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
This commit fixes the Python types of a number of fields defined in Netflowv9/10 for the following pre-defined fields (mostly the ones in RFC3954 https://datatracker.ietf.org/doc/html/rfc3954). It appears that in absence of an assigned field type, it defaults to BytesField instead of IntField. Fields: * IN_BYTES, IN_PKTS, OUT_BYTES, OUT_PKTS: IntField (4 bytes). Please note code doesn't seem to support the larget 8byte optional length. * MUL_DST_PKTS, MUL_DST_BYTES: same as above * INPUT_SNMP, OUTPUT_SNMP: ShortField (2 bytes), iface index. Note: code doesn't seem to support optional larger values (undefined max. length, but 8 bytes might be sufficient). Note there are _many_ other field types defined that are not part of the spec / unknown without field type and length. Fixes secdev#4810 Signed-off-by: Marc Sune <marcdevel@gmail.com>
Remove unnecessary `print()` in _GenNetflowRecordV9(). Fixes secdev#4810 Signed-off-by: Marc Sune <marcdevel@gmail.com>
This comes from #4810. I've revised a number of fields.
A couple of thoughts:
- I didn't test the changes, I am just opening this Draft PR for discussion.
- I assumed this was the case, but I'd like someone to confirm:
It appears that in absence of an assigned field type, it defaults to BytesField instead of IntField. Fields:
- I am not sure which coverage exists for this layer, and where should that coverage be added (not familiar with Scapy's testing approach). Some directions might help here.
cc @gpotter2
@gpotter2
gpotter2
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for looking into this, we likely should try to adapt the code so that it supports NBytesField to support integer values of arbitrary lengths. Right now this code likely won't work.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
An IntField is 4 octets long, this probably won't work.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah, it's a 24 bit value.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
IP6Field expects a full IPv6 address, probably won't work with a 1bytes long data.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It will, it's 1byte value because it's the length of the mask in contiguos bits:
Length of the IPv6
IPV6_DST_MASK 30 1 destination mask in
contiguous bits
msune
commented
Aug 7, 2025
we likely should try to adapt the code so that it supports NBytesField to support integer values of arbitrary lengths. Right now this code likely won't work.
Ack. It would be good to support the 8bytes counters, as this is a commonly used thing.
This commit fixes the Python types of a number of fields defined in Netflowv9/10 for the following pre-defined fields (mostly the ones in RFC3954 https://datatracker.ietf.org/doc/html/rfc3954).
It appears that in absence of an assigned field type, it defaults to BytesField instead of IntField. Fields:
Note there are many other field types defined that are not part of the spec / unknown without field type and length.
Fixes #4810