Merge pull request #24 from debugloop/master

Add VRF information to flow messages
cloudflare · May 1, 2019 · 959ed13 · 959ed13
2 parents 637826a + ae8bf02
commit 959ed13
Show file tree

Hide file tree

Showing 5 changed files with 105 additions and 66 deletions.
diff --git a/README.md b/README.md
@@ -172,6 +172,8 @@ The format is the following:
 | FragmentId | IP Fragment Identifier |
 | FragmentOffset | IP Fragment Offset |
 | IPv6FlowLabel | IPv6 Flow Label |
+| IngressVrfId | Ingress VRF ID |
+| EgressVrfId | Egress VRF ID |
 
 ### Implementation notes
 

diff --git a/decoders/netflow/nfv9.go b/decoders/netflow/nfv9.go
@@ -213,7 +213,7 @@ func NFv9TypeToString(typeId uint16) string {
 		84:  "SAMPLER_NAME",
 		85:  "IN_ PERMANENT _BYTES",
 		86:  "IN_ PERMANENT _PKTS",
-		87:  "* Vendor Proprietary*",
+		87:  "*Vendor Proprietary*",
 		88:  "FRAGMENT_OFFSET",
 		89:  "FORWARDING STATUS",
 		90:  "MPLS PAL RD",
@@ -229,6 +229,8 @@ func NFv9TypeToString(typeId uint16) string {
 		102: "layer2packetSectionOffset",
 		103: "layer2packetSectionSize",
 		104: "layer2packetSectionData",
+		234: "ingressVRFID",
+		235: "egressVRFID",
 	}
 
 	if typeId > 104 || typeId == 0 {

diff --git a/pb/flow.pb.go b/pb/flow.pb.go
diff --git a/pb/flow.proto b/pb/flow.proto
@@ -22,7 +22,7 @@ message FlowMessage {
   uint64 TimeFlow = 5;
 
   // Source/destination addresses
-  bytes SrcIP = 6; 
+  bytes SrcIP = 6;
   bytes DstIP = 7;
 
   // To be deprecated
@@ -89,4 +89,8 @@ message FlowMessage {
   uint32 FragmentOffset = 36;
 
   uint32 IPv6FlowLabel = 37;
-}
+
+  // VRF
+  uint32 IngressVrfId = 38;
+  uint32 EgressVrfId = 39;
+}
diff --git a/producer/producer_nf.go b/producer/producer_nf.go
@@ -231,13 +231,13 @@ func ConvertNetFlowDataSet(version uint16, baseTime uint32, uptime uint32, recor
 		case netflow.NFV9_FIELD_ICMP_TYPE:
 			var icmpTypeCode uint16
 			DecodeUNumber(v, &icmpTypeCode)
-			flowMessage.IcmpType = uint32(icmpTypeCode>>8)
-			flowMessage.IcmpCode = uint32(icmpTypeCode&0xff)
+			flowMessage.IcmpType = uint32(icmpTypeCode >> 8)
+			flowMessage.IcmpCode = uint32(icmpTypeCode & 0xff)
 		case netflow.IPFIX_FIELD_icmpTypeCodeIPv6:
 			var icmpTypeCode uint16
 			DecodeUNumber(v, &icmpTypeCode)
-			flowMessage.IcmpType = uint32(icmpTypeCode>>8)
-			flowMessage.IcmpCode = uint32(icmpTypeCode&0xff)
+			flowMessage.IcmpType = uint32(icmpTypeCode >> 8)
+			flowMessage.IcmpCode = uint32(icmpTypeCode & 0xff)
 		case netflow.IPFIX_FIELD_icmpTypeIPv4:
 			DecodeUNumber(v, &(flowMessage.IcmpType))
 		case netflow.IPFIX_FIELD_icmpTypeIPv6:
@@ -259,6 +259,11 @@ func ConvertNetFlowDataSet(version uint16, baseTime uint32, uptime uint32, recor
 		case netflow.NFV9_FIELD_DST_VLAN:
 			DecodeUNumber(v, &(flowMessage.DstVlan))
 
+		case netflow.IPFIX_FIELD_ingressVRFID:
+			DecodeUNumber(v, &(flowMessage.IngressVrfId))
+		case netflow.IPFIX_FIELD_egressVRFID:
+			DecodeUNumber(v, &(flowMessage.EgressVrfId))
+
 		case netflow.NFV9_FIELD_IPV4_IDENT:
 			DecodeUNumber(v, &(flowMessage.FragmentId))
 		case netflow.NFV9_FIELD_FRAGMENT_OFFSET: