layers/netflow: NFv9/10 flow record type fix
This commit fixes the Python types of a number of fields defined in Netflowv9/10 for the following pre-defined fields (mostly the ones in RFC3954 https://datatracker.ietf.org/doc/html/rfc3954).
It appears that in absence of an assigned field type, it defaults to BytesField instead of IntField. Fields:
- IN_BYTES, IN_PKTS, OUT_BYTES, OUT_PKTS: IntField (4 bytes). Please note code doesn't seem to support the larget 8byte optional length.
- MUL_DST_PKTS, MUL_DST_BYTES: same as above
- INPUT_SNMP, OUTPUT_SNMP: ShortField (2 bytes), iface index. Note: code doesn't seem to support optional larger values (undefined max. length, but 8 bytes might be sufficient).
Note there are many other field types defined that are not part of the spec / unknown without field type and length.
Fixes #4810
This comes from #4810. I've revised a number of fields.
A couple of thoughts:
- I didn't test the changes, I am just opening this Draft PR for discussion.
- I assumed this was the case, but I'd like someone to confirm:
It appears that in absence of an assigned field type, it defaults to BytesField instead of IntField. Fields:
- I am not sure which coverage exists for this layer, and where should that coverage be added (not familiar with Scapy's testing approach). Some directions might help here.
cc @gpotter2
we likely should try to adapt the code so that it supports NBytesField to support integer values of arbitrary lengths. Right now this code likely won't work.
Ack. It would be good to support the 8bytes counters, as this is a commonly used thing.