logstash-plugins / logstash-codec-netflow

Apache License 2.0
79 stars 88 forks source link

[IPFIX] Fix parsing when using buffered (TCP) input #194

Open Abazigal opened 2 years ago

Abazigal commented 2 years ago

When using a TCP input, packets' data are buffered before logstash tries do decode them. Therefore, our decode() function will receive chunks of "random" sizes, that might contain 2 PDUs, 3.4 PDUs, etc.

The current code parses only one PDU and discards the rest of the payload. Therefore, we can easily miss a PDU, and the next call will most likely parse the middle of a PDU, which will result in an error. The file ipfix.dat used during CI is actually a good example : it contains 3 IPFIX messages. But so far, the code is only considering the first one, hence the 7 flows returned instead of the 13 that the file contains.

This commit makes sure each call consumes all the PDUs available in the payload, and the remaining data (beginning of another PDU) are buffered to be reused in the next call.

cla-checker-service[bot] commented 2 years ago

💚 CLA has been signed

Abazigal commented 2 years ago

The remaining CI issue comes from master.