search

Edgio / vflow

Enterprise Network Flow Collector (IPFIX, sFlow, Netflow)
http://www.verizonmedia.com
Apache License 2.0
1.07k stars 226 forks source link

Error in parse strings with variable length #80

Closed testsgmr closed 5 years ago

testsgmr commented 5 years ago

According to RFC7011 Section 6.1.6, "The string is sent as an array of zero or more octets using Information Element fixed or variable length." we can have a variable length "In the Template Set, the Information Element Field Length is as 65535. This reserved length value notifies the that the value of the Information Element will be carried the Information Element content itself." but this is not supported by vFlow and use 65535 for the size of all of the strings.

pforemski commented 5 years ago

Agreed, found this after 1h of debugging. Had to trace the ambiguous 'ipfix.go:232: "can not read the data"' error message to actually arrive at ipfix/decoder.go Decoder.decodeData()'s first loop - which is the source of this error message.

This is so disappointing that vFlow actually does not implement IPFIX - but rather a subset of the RFC.

mehrdadrad commented 5 years ago

@mohamadrezarostami thanks for catching this! pls resolve the conflict https://github.com/VerizonDigital/vflow/pull/81 BTW our routers send fix len for string/octets

testsgmr commented 5 years ago

@mehrdadrad I fix it ,but I don't know why tests doesn't pass :(

mehrdadrad commented 5 years ago

@mohamadrezarostami I merged a bug fix right after you changed the decodeData, pls first update your repo then add getDataLength feature to the decodeData. thanks!

testsgmr commented 5 years ago

@mehrdadrad I fix it.