Fix private IP ingestion in network_interface_unix and network_interface_windows. - #9884
Conversation
…ace_windows queries
| OR (split(ia.address, '.', 0) = '192' AND split(ia.address, '.', 1) = '168') | ||
| ) | ||
| -- Private IPv6 addresses start with 'fc' or 'fd'. | ||
| OR (inet_aton(ia.address) IS NULL AND regex_match(lower(ia.address), '^f[cd][0-9a-f][0-9a-f]:[0-9a-f:]+', 0) IS NOT NULL) |
There was a problem hiding this comment.
This is more for my own understanding, but according to this ULAs are in the range fc00::/7 so shouldn't using ^f[cd] as the reg-exp suffice here?
There was a problem hiding this comment.
True. I was a little defensive and wanted to check that it looks like a IPv6 address, but maybe we can assume we are always getting a valid IPv6 string from this column... and just do ^f[cd] as you propose.
There was a problem hiding this comment.
Defensive is good, let's keep it that way. I was just curious about it.
Codecov ReportBase: 60.63% // Head: 60.57% // Decreases project coverage by
📣 This organization is not using Codecov’s GitHub App Integration. We recommend you install it so Codecov can continue to function properly for your repositories. Learn more Additional details and impacted files@@ Coverage Diff @@
## main #9884 +/- ##
==========================================
- Coverage 60.63% 60.57% -0.07%
==========================================
Files 492 492
Lines 49416 49788 +372
==========================================
+ Hits 29964 30157 +193
- Misses 16662 16823 +161
- Partials 2790 2808 +18
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. ☔ View full report at Codecov. |
…erface_windows`. (#9884) #8924 This is reproduced in dogfood for `dogfood-centos-box` and `dogfood-ubuntu-box` where their "Private IP" is also their "Public IP". Given that these hosts have their "Primary IP" configured to be their "Public IP" alongside their "Private IP", the `network_interface_unix` and `network_interface_windows` queries are now changed to ingest only private IPs for the "Private IP" field. - [X] Changes file added for user-visible changes in `changes/` or `orbit/changes/`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or docs/Contributing/API-for-contributors.md)~ - ~[ ] Documented any permissions changes~ - ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements)~ - ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for new osquery data ingestion features.~ - ~[ ] Added/updated tests~ - [X] Manual QA for all new/changed functionality - ~For Orbit and Fleet Desktop changes:~ - ~[ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux.~ - ~[ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
3 participants
#8924
This is reproduced in dogfood for
dogfood-centos-boxanddogfood-ubuntu-boxwhere their "Private IP" is also their "Public IP". Given that these hosts have their "Primary IP" configured to be their "Public IP" alongside their "Private IP", thenetwork_interface_unixandnetwork_interface_windowsqueries are now changed to ingest only private IPs for the "Private IP" field.changes/ororbit/changes/.See Changes files for more information.
[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or docs/Contributing/API-for-contributors.md)[ ] Documented any permissions changes[ ] Input data is properly validated,SELECT *is avoided, SQL injection is prevented (using placeholders for values in statements)[ ] Added support on fleet's osquery simulatorcmd/osquery-perffor new osquery data ingestion features.[ ] Added/updated testsFor Orbit and Fleet Desktop changes:[ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux.[ ] Auto-update manual QA, from released version of component to new version (see tools/tuf/test).