Skip to content

packetbeat/decoder: reconstruct IPv4 fragments#33296

Merged
efd6 merged 5 commits intoelastic:mainfrom
efd6:33012-reconstruct_fragments
Oct 24, 2022
Merged

packetbeat/decoder: reconstruct IPv4 fragments#33296
efd6 merged 5 commits intoelastic:mainfrom
efd6:33012-reconstruct_fragments

Conversation

@efd6
Copy link
Copy Markdown
Contributor

@efd6 efd6 commented Oct 10, 2022 •
edited
Loading

What does this PR do?

This adds IPv4 fragmented packet reconstruction to the packet decoder.

Why is it important?

This is important because without reconstruction we are potentially blind to UDP traffic that has been sent with fragmentation, for example UDP EDNS0 DNS requests.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

  • [ ]

How to test this PR locally

go test in the packetbeat/decoder package will test this enhancement.

Related issues

Use cases

Screenshots

Logs

@efd6 efd6 self-assigned this Oct 10, 2022
@efd6 efd6 requested a review from a team as a code owner October 10, 2022 23:53
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Oct 10, 2022
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Oct 10, 2022

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Oct 10, 2022
@efd6 efd6 marked this pull request as draft October 10, 2022 23:54
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Oct 11, 2022 •
edited by jenkins-beats-ci bot
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2022-10-12T20:40:40.512+0000

  • Duration: 44 min 50 sec

Test stats 🧪

Test Results
Failed 0
Passed 1721
Skipped 19
Total 1740

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

  • /package : Generate the packages and run the E2E tests.

  • /beats-tester : Run the installation tests with beats-tester.

  • run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

@efd6 efd6 force-pushed the 33012-reconstruct_fragments branch 4 times, most recently from 4287d3a to 1b60c25 Compare October 11, 2022 05:37
@efd6 efd6 marked this pull request as ready for review October 11, 2022 07:13
@efd6 efd6 force-pushed the 33012-reconstruct_fragments branch from 586a561 to e2f0140 Compare October 12, 2022 20:40
andrewkroh
andrewkroh approved these changes Oct 24, 2022
View reviewed changes
Copy link
Copy Markdown
Member

@andrewkroh andrewkroh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@efd6 efd6 merged commit 4e8236f into elastic:main Oct 24, 2022
chrisberkhout pushed a commit that referenced this pull request Jun 1, 2023
@efd6 @chrisberkhout
packetbeat/decoder: reconstruct IPv4 fragments (#33296)
5b0112b 
This teaches the decoder how to handle IPv4 packets that have been marked
as fragmented by retaining a packet ID-keyed cache of IPv4 fragment with
TTL awareness. Incoming packets are compared with the available fragments
in the cache and a reassembled packet is produced if possible. Otherwise
the fragment is added to the cache if there are no fragments with the same
packet ID that have exceeded their TTL, purging all packet fragments that
have exceeded their TTL.

Also a test for effectiveness of the addition with a real-world case to
the protos/dns package showing that the response part of a fragmented
EDNS0 conversation stream reconstructs the DNS response.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@andrewkroh andrewkroh andrewkroh approved these changes

Assignees

@efd6 efd6

Labels

8.6 candidate backport-skip Skip notification from the automated backport with mergify enhancement Packetbeat

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Packetbeat add support for reconstruction of fragmented UDP packets network_traffic: document that fragmented UDP packets are not reconstructed

3 participants

@efd6 @elasticmachine @andrewkroh