logstash-codec-netflow 4.0.0 → 4.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 4d93e056a9df39efb7dff2feb887a661a4231313
-  data.tar.gz: f2e47894941ea4090de24a78028e4b6ec4efc3a6
+  metadata.gz: 02d79c8d4e3e6e62b887d17e9161f30bdce7b397
+  data.tar.gz: ea75c8b08e31ab585ef4c47f06aefff54e23c75f
 SHA512:
-  metadata.gz: a5cdc4f265bb0e91fcd0db9ce19e3b678bc04cb640a094742ba45b38b881526a563ba51342a982d377103eb55a9ee89cc455d03481cf4e409a6065166d2a772c
-  data.tar.gz: 64e22086639e4595a4b0a3fd988471d5c095b4370046df7d732d03531336bc47a60129c3a57fa267099660951e36f1b99603c04e1b02c431882086b0372b540d
+  metadata.gz: dc7647f8b95859bccc245a83d991f7d757b5a34a86e6c8b2c4d407d61994fafd322da4628a2a6108d283e226cfc9b1f5ff38626952177af255dc34717b52de8d
+  data.tar.gz: 9a2627caa77a373b0a5223df7e6c2bd1a1f19340a515f4488f5129f409484ed39360a219561b8a1afec36e13bc0f87a47013190ab92995caf5dd30d7f2d76761

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 4.0.1
+
+  - Fixed IPFIX options template parsing for Juniper MX240 JunOS 15.1 
+
 ## 4.0.0
 
   - Added support for RFC6759 decoding of application_id. **This is a breaking change to the way application_id is decoded. The format changes from e.g. 0:40567 to 0..12356..40567**

data/lib/logstash/codecs/netflow.rb

@@ -102,6 +102,7 @@ class LogStash::Codecs::Netflow < LogStash::Codecs::Base
   end # def register
 
   def decode(payload, metadata = nil, &block)
+#   BinData::trace_reading do
     header = Header.read(payload)
 
     unless @versions.include?(header.version)
@@ -126,13 +127,16 @@ class LogStash::Codecs::Netflow < LogStash::Codecs::Base
 #      end
      end
     elsif header.version == 10
+#     BinData::trace_reading do
       flowset = IpfixPDU.read(payload)
       flowset.records.each do |record|
         decode_ipfix(flowset, record).each { |event| yield(event) }
       end
+#     end
     else
       @logger.warn("Unsupported Netflow version v#{header.version}")
     end
+#   end
   rescue BinData::ValidityError, IOError => e
     @logger.warn("Invalid netflow packet received (#{e})")
   end

data/lib/logstash/codecs/netflow/util.rb

@@ -443,7 +443,7 @@ end
 
 class IpfixOptionFlowset < BinData::Record
   endian :big
-  array  :templates, :read_until => lambda { flowset_length - 4 - array.num_bytes <= 2 } do
+  array  :templates, :read_until => lambda { flowset_length - 4 } do
     uint16 :template_id
     uint16 :field_count
     uint16 :scope_count, :assert => lambda { scope_count > 0 }
@@ -459,6 +459,7 @@ class IpfixOptionFlowset < BinData::Record
       uint16 :field_length
       uint32 :enterprise_id, :onlyif => lambda { enterprise != 0 }
     end
+    string  :padding, :read_length => lambda { flowset_length - 4 - 2 - 2 - 2 - scope_fields.num_bytes - option_fields.num_bytes }
   end
 end
 

data/logstash-codec-netflow.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-codec-netflow'
-  s.version         = '4.0.0'
+  s.version         = '4.0.1'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "Reads Netflow v5, Netflow v9 and IPFIX data"
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"

data/spec/codecs/netflow_spec.rb

@@ -1161,6 +1161,51 @@ describe LogStash::Codecs::Netflow do
 
   end
 
+  context "IPFIX options template from Juniper MX240 JunOS 15.1 R6 S3" do
+    let(:data) do
+      packets = []
+      packets << IO.read(File.join(File.dirname(__FILE__), "ipfix_test_juniper_mx240_junos151r6s3_opttpl512.dat"), :mode => "rb")
+      packets << IO.read(File.join(File.dirname(__FILE__), "ipfix_test_juniper_mx240_junos151r6s3_data512.dat"), :mode => "rb")
+    end
+
+    let(:json_events) do
+      events = []
+      events << <<-END
+      {
+        "@timestamp": "2018-06-01T15:11:53.000Z",
+        "@version": "1",
+        "netflow": {
+          "exportProtocolVersion": 10,
+          "exportingProcessId": 2,
+          "flowActiveTimeout": 60,
+          "exportTransportProtocol": 17,
+          "flowIdleTimeout": 60,
+          "exportedFlowRecordTotalCount": 76,
+          "exportedMessageTotalCount": 76,
+          "samplingInterval": 1000,
+          "exporterIPv6Address": "::",
+          "systemInitTimeMilliseconds": 1262761598000,
+          "version": 10,
+          "exporterIPv4Address": "10.0.0.1"
+        }
+      }
+      END
+
+      events.map{|event| event.gsub(/\s+/, "")}
+    end
+
+    it "should decode raw data" do
+      expect(decode.size).to eq(1)
+      expect(decode[0].get("[netflow][exporterIPv4Address]")).to eq("10.0.0.1")
+    end
+
+    it "should serialize to json" do
+      expect(JSON.parse(decode[0].to_json)).to eq(JSON.parse(json_events[0]))
+    end
+
+  end
+
+
   context "IPFIX Nokia BRAS" do
     let(:data) do
       packets = []

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-codec-netflow
 version: !ruby/object:Gem::Version
-  version: 4.0.0
+  version: 4.0.1
 platform: ruby
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2018-05-31 00:00:00.000000000 Z
+date: 2018-06-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
@@ -85,6 +85,8 @@ files:
 - spec/codecs/ipfix_test_barracuda_extended_uniflow_data256.dat
 - spec/codecs/ipfix_test_barracuda_extended_uniflow_tpl256.dat
 - spec/codecs/ipfix_test_barracuda_tpl.dat
+- spec/codecs/ipfix_test_juniper_mx240_junos151r6s3_data512.dat
+- spec/codecs/ipfix_test_juniper_mx240_junos151r6s3_opttpl512.dat
 - spec/codecs/ipfix_test_mikrotik_data258.dat
 - spec/codecs/ipfix_test_mikrotik_data259.dat
 - spec/codecs/ipfix_test_mikrotik_tpl.dat
@@ -203,6 +205,8 @@ test_files:
 - spec/codecs/ipfix_test_barracuda_extended_uniflow_data256.dat
 - spec/codecs/ipfix_test_barracuda_extended_uniflow_tpl256.dat
 - spec/codecs/ipfix_test_barracuda_tpl.dat
+- spec/codecs/ipfix_test_juniper_mx240_junos151r6s3_data512.dat
+- spec/codecs/ipfix_test_juniper_mx240_junos151r6s3_opttpl512.dat
 - spec/codecs/ipfix_test_mikrotik_data258.dat
 - spec/codecs/ipfix_test_mikrotik_data259.dat
 - spec/codecs/ipfix_test_mikrotik_tpl.dat