Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Cisco ASA netflow handling #5729

Merged
merged 2 commits into from Mar 21, 2019

Conversation

Projects
None yet
2 participants
@mpfz0r
Copy link
Member

mpfz0r commented Feb 27, 2019

Don't try to parse ASA acl ids.
Improve parsing of strings:
Empty strings are received as a byte array full of zeros.
Properly convert them to empty Strings.

At some point Cisco decided to stop including packet and byte counters
in their netflow data. toMessageString expected them to always be
there and would trigger an NPE.
Try to fallback on Ciscos flow delta counters, so we have at least
something meaningful in the message field.
Fixes #5715

mpfz0r added some commits Jan 18, 2019

Fix more Cisco ASA netflow parsing issues
Don't try to parse ASA acl ids.
Improve parsing of strings:
Empty strings are received as a byte array full of zeros.
Properly convert them to empty Strings.

Add a test pcap for ASA netflow data.
Handle ASA netflow data without byte and packet counters
At some point Cisco decided to stop including packet and byte counters
in their netflow data. `toMessageString` expected them to always be
there and would trigger an NPE.
Try to fallback on Ciscos flow delta counters, so we have at least
something meaningful in the message field.

Fixes #5715

@mpfz0r mpfz0r requested a review from kroepke Mar 4, 2019

@mpfz0r mpfz0r removed the request for review from kroepke Mar 15, 2019

@dennisoelkers dennisoelkers self-assigned this Mar 21, 2019

@dennisoelkers dennisoelkers merged commit 74640ab into master Mar 21, 2019

4 checks passed

ci-web-linter Jenkins build graylog-pr-linter-check 3398 has succeeded
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details
graylog-project/pr Jenkins build graylog-project-pr-snapshot 3208 has succeeded
Details
license/cla Contributor License Agreement is signed.
Details

@dennisoelkers dennisoelkers deleted the issue-5715 branch Mar 21, 2019

mpfz0r added a commit that referenced this pull request Mar 21, 2019

Fix Cisco ASA netflow handling (#5729)
* Fix more Cisco ASA netflow parsing issues

Don't try to parse ASA acl ids.
Improve parsing of strings:
Empty strings are received as a byte array full of zeros.
Properly convert them to empty Strings.

Add a test pcap for ASA netflow data.

* Handle ASA netflow data without byte and packet counters

At some point Cisco decided to stop including packet and byte counters
in their netflow data. `toMessageString` expected them to always be
there and would trigger an NPE.
Try to fallback on Ciscos flow delta counters, so we have at least
something meaningful in the message field.

Fixes #5715

(cherry picked from commit 74640ab)

dennisoelkers added a commit that referenced this pull request Mar 21, 2019

Fix Cisco ASA netflow handling (#5729) (#5792)
* Fix more Cisco ASA netflow parsing issues

Don't try to parse ASA acl ids.
Improve parsing of strings:
Empty strings are received as a byte array full of zeros.
Properly convert them to empty Strings.

Add a test pcap for ASA netflow data.

* Handle ASA netflow data without byte and packet counters

At some point Cisco decided to stop including packet and byte counters
in their netflow data. `toMessageString` expected them to always be
there and would trigger an NPE.
Try to fallback on Ciscos flow delta counters, so we have at least
something meaningful in the message field.

Fixes #5715

(cherry picked from commit 74640ab)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.