Add MPLS decoding for IPFIX (cloudflare#95)

* Add MPLS decoding for IPFIX Co-authored-by: David Roy <[email protected]>
tgragnato · Jul 21, 2022 · e0abb7b · e0abb7b
1 parent 0020934
commit e0abb7b
Show file tree

Hide file tree

Showing 3 changed files with 69 additions and 39 deletions.
diff --git a/pb/flow.pb.go b/pb/flow.pb.go
diff --git a/pb/flow.proto b/pb/flow.proto
@@ -99,6 +99,7 @@ message FlowMessage {
   uint32 MPLS3Label = 60; // Third Label
   uint32 MPLSLastTTL = 61; // Last TTL
   uint32 MPLSLastLabel = 62; // Last Label
+  bytes MPLSLabelIP = 65; // MPLS TOP Label IP 
 
   uint32 ObservationDomainID = 70;
   uint32 ObservationPointID = 71;

diff --git a/producer/producer_nf.go b/producer/producer_nf.go
@@ -336,6 +336,25 @@ func ConvertNetFlowDataSet(version uint16, baseTime uint32, uptime uint32, recor
 		case netflow.NFV9_FIELD_DIRECTION:
 			DecodeUNumber(v, &(flowMessage.FlowDirection))
 
+		//MPLS
+		case netflow.IPFIX_FIELD_mplsTopLabelStackSection:
+			var mplsLabel uint32
+			DecodeUNumber(v, &mplsLabel)
+			flowMessage.MPLS1Label = uint32(mplsLabel >> 4)
+			flowMessage.HasMPLS = true
+		case netflow.IPFIX_FIELD_mplsLabelStackSection2:
+			var mplsLabel uint32
+			DecodeUNumber(v, &mplsLabel)
+			flowMessage.MPLS2Label = uint32(mplsLabel >> 4)
+		case netflow.IPFIX_FIELD_mplsLabelStackSection3:
+			var mplsLabel uint32
+			DecodeUNumber(v, &mplsLabel)
+			flowMessage.MPLS3Label = uint32(mplsLabel >> 4)
+		case netflow.IPFIX_FIELD_mplsTopLabelIPv4Address:
+			flowMessage.MPLSLabelIP = v
+		case netflow.IPFIX_FIELD_mplsTopLabelIPv6Address:
+			flowMessage.MPLSLabelIP = v
+
 		default:
 			if version == 9 {
 				// NetFlow v9 time works with a differential based on router's uptime