feat(inputs.netflow): Add more fields for sFlow extended gateway packets (#15521)

This commit is contained in:
Sven Rebhan 2024-06-25 09:38:14 -04:00 committed by GitHub
parent c5fcddc583
commit 5903ed6a47
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 16 additions and 0 deletions

View File

@ -5,6 +5,8 @@ import (
"encoding/hex" "encoding/hex"
"fmt" "fmt"
"net" "net"
"strconv"
"strings"
"time" "time"
"github.com/gopacket/gopacket" "github.com/gopacket/gopacket"
@ -246,12 +248,19 @@ func (d *sflowv5Decoder) decodeFlowRecords(records []sflow.FlowRecord) (map[stri
fields["dst_mask"] = record.DstMaskLen fields["dst_mask"] = record.DstMaskLen
case sflow.ExtendedGateway: case sflow.ExtendedGateway:
var err error var err error
fields["next_hop_ip_version"] = record.NextHopIPVersion
if err != nil {
return nil, fmt.Errorf("decoding 'next_hop' failed: %w", err)
}
fields["next_hop"], err = decodeIP(record.NextHop) fields["next_hop"], err = decodeIP(record.NextHop)
if err != nil { if err != nil {
return nil, fmt.Errorf("decoding 'next_hop' failed: %w", err) return nil, fmt.Errorf("decoding 'next_hop' failed: %w", err)
} }
fields["bgp_as"] = record.AS
fields["bgp_src_as"] = record.SrcAS fields["bgp_src_as"] = record.SrcAS
fields["bgp_dst_as"] = record.ASDestinations fields["bgp_dst_as"] = record.ASDestinations
fields["bgp_as_path_type"] = record.ASPathType
fields["bgp_as_path_length"] = record.ASPathLength
fields["bgp_next_hop"], err = decodeIP(record.NextHop) fields["bgp_next_hop"], err = decodeIP(record.NextHop)
if err != nil { if err != nil {
return nil, fmt.Errorf("decoding 'bgp_next_hop' failed: %w", err) return nil, fmt.Errorf("decoding 'bgp_next_hop' failed: %w", err)
@ -260,6 +269,13 @@ func (d *sflowv5Decoder) decodeFlowRecords(records []sflow.FlowRecord) (map[stri
if len(record.ASPath) > 0 { if len(record.ASPath) > 0 {
fields["bgp_next_as"] = record.ASPath[0] fields["bgp_next_as"] = record.ASPath[0]
} }
fields["community_length"] = record.CommunitiesLength
parts := make([]string, 0, len(record.Communities))
for _, c := range record.Communities {
parts = append(parts, "0x"+strconv.FormatUint(uint64(c), 16))
}
fields["communities"] = strings.Join(parts, ",")
fields["local_pref"] = record.LocalPref
default: default:
return nil, fmt.Errorf("unhandled flow record type %T", r.Data) return nil, fmt.Errorf("unhandled flow record type %T", r.Data)
} }