CWSL_DIGI icon indicating copy to clipboard operation
CWSL_DIGI copied to clipboard

fix: correct byte order in IPFIX set length fields

Open dchristle opened this issue 1 year ago • 0 comments

This PR fixes two critical bugs in the PSKReporter upload code.

The first bug is incorrect bit shifting that caused malformed FlowSet Length values in IPFIX packets. Changes shifts from >>16 to >>8 in both getSenderRecord() and getReceiverInformation() to properly encode length fields in big-endian format.

The impact of this bug is data loss for any IPFIX data set that has more than 255 bytes in it. For example, the sender information spot data payload is lost in the below packet, since Set 5 has a malformed length of 0, even though it contains several hundred bytes of spot sender information.

wireshark_1

The second bug is that the sender information template descriptor for the case w/o a locator has the wrong length. This means the template bytes are truncated early by 6 bytes, which will make the receiver have an incorrect template. The extra 6 bytes are then erroneously treated as the template ID (2 bytes), size (2 bytes), and subsequent data, for whatever set is next. This corrupts decoding that set - as now the template used to decode it is wrong, the length is wrong, etc.

The above screenshot shows this: 30351 is the enterprise ID used for PSKReporter fields, which is mistakenly interpreted as the template ID of the next flow. This has a knock-on effect -- Set 5 has ID 61444, which doesn't correspond to any of the valid template IDs. In reality, what should be Set 4 is ending too early due to the bad length, so whatever bytes appear are mistakenly interpreted as a 5th set with a random template ID/length/payload.

dchristle avatar Nov 02 '24 22:11 dchristle