Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x-pack/filebeat/input/netflow: record IPv6 src and dst addresses #29383

Merged
merged 2 commits into from
Dec 13, 2021
Merged

x-pack/filebeat/input/netflow: record IPv6 src and dst addresses #29383

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3562fae
x-pack/filebeat/input/netflow: record IPv6 src and dst addresses
efd6 Dec 13, 2021
5228ab7
x-pack/filebeat/input/netflow: make IP addresses unique in document
efd6 Dec 13, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -198,6 +198,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
- Fix opening files on Windows in filestream so open files can be deleted. {issue}29113[29113] {pull}29180[29180]
- Fix handling of escaped newlines in the `decode_cef` processor. {issue}16995[16995] {pull}29268[29268]
- Fix `panw` module ingest errors for GLOBALPROTECT logs {pull}29154[29154]
- Fix handling of IPv6 addresses in netflow flow events. {issue}19210[19210] {pull}29383[29383]

*Heartbeat*

Expand Down
32 changes: 31 additions & 1 deletion x-pack/filebeat/input/netflow/convert.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,11 @@
package netflow

import (
"bytes"
"encoding/base64"
"encoding/binary"
"net"
"sort"
"strconv"
"strings"
"time"
Expand Down Expand Up @@ -196,6 +198,10 @@ func flowToBeatEvent(flow record.Record, internalNetworks []string) (event beat.
ecsSource["ip"] = ip
relatedIP = append(relatedIP, ip)
ecsSource["locality"] = getIPLocality(internalNetworks, ip).String()
} else if ip, found := getKeyIP(flow.Fields, "sourceIPv6Address"); found {
ecsSource["ip"] = ip
relatedIP = append(relatedIP, ip)
ecsSource["locality"] = getIPLocality(internalNetworks, ip).String()
}
if sourcePort, found := getKeyUint64(flow.Fields, "sourceTransportPort"); found {
ecsSource["port"] = sourcePort
Expand All @@ -209,6 +215,10 @@ func flowToBeatEvent(flow record.Record, internalNetworks []string) (event beat.
ecsDest["ip"] = ip
relatedIP = append(relatedIP, ip)
ecsDest["locality"] = getIPLocality(internalNetworks, ip).String()
} else if ip, found := getKeyIP(flow.Fields, "destinationIPv6Address"); found {
ecsDest["ip"] = ip
relatedIP = append(relatedIP, ip)
ecsDest["locality"] = getIPLocality(internalNetworks, ip).String()
}
if destPort, found := getKeyUint64(flow.Fields, "destinationTransportPort"); found {
ecsDest["port"] = destPort
Expand Down Expand Up @@ -321,11 +331,31 @@ func flowToBeatEvent(flow record.Record, internalNetworks []string) (event beat.
event.Fields["network"] = ecsNetwork
}
if len(relatedIP) > 0 {
event.Fields["related"] = common.MapStr{"ip": relatedIP}
event.Fields["related"] = common.MapStr{"ip": uniqueIPs(relatedIP)}
}
return
}

// unique returns ips lexically sorted and with repeated elements
// omitted.
func uniqueIPs(ips []net.IP) []net.IP {
if len(ips) < 2 {
return ips
}
sort.Slice(ips, func(i, j int) bool { return bytes.Compare(ips[i], ips[j]) < 0 })
curr := 0
for i, ip := range ips {
if ip.Equal(ips[curr]) {
continue
}
curr++
if curr < i {
ips[curr], ips[i] = ips[i], nil
}
}
return ips[:curr+1]
}

func getKeyUint64(dict record.Map, key string) (value uint64, found bool) {
iface, found := dict[key]
if !found {
Expand Down
4 changes: 2 additions & 2 deletions ...t/input/netflow/testdata/golden/IPFIX-Barracuda-extended-uniflow-template-256.golden.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,8 +169,8 @@
},
"related": {
"ip": [
"64.235.151.76",
"10.236.5.4"
"10.236.5.4",
"64.235.151.76"
]
},
"source": {
Expand Down
16 changes: 8 additions & 8 deletions x-pack/filebeat/input/netflow/testdata/golden/IPFIX-Barracuda-firewall.golden.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,8 +145,8 @@
},
"related": {
"ip": [
"10.99.252.50",
"10.99.130.239"
"10.99.130.239",
"10.99.252.50"
]
},
"source": {
Expand Down Expand Up @@ -225,8 +225,8 @@
},
"related": {
"ip": [
"10.99.130.239",
"10.98.243.20"
"10.98.243.20",
"10.99.130.239"
]
},
"source": {
Expand Down Expand Up @@ -385,8 +385,8 @@
},
"related": {
"ip": [
"10.99.168.140",
"10.98.243.20"
"10.98.243.20",
"10.99.168.140"
]
},
"source": {
Expand Down Expand Up @@ -545,8 +545,8 @@
},
"related": {
"ip": [
"10.99.168.140",
"10.98.243.20"
"10.98.243.20",
"10.99.168.140"
]
},
"source": {
Expand Down
Loading