packetbeat/decoder: reconstruct IPv4 fragments #33296
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
efd6
added
enhancement
Packetbeat
Team:Security-External Integrations
backport-skip
botelastic
bot
added
the
needs_team
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
botelastic
bot
removed
the
needs_team
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
💚 Flaky test reportTests succeeded. 🤖 GitHub commentsExpand to view the GitHub comments
To re-run your PR in the CI, just comment with:
|
efd6
force-pushed
the
33012-reconstruct_fragments
branch
4 times, most recently
from
4287d3a to
1b60c25
Compare
Naive approach assuming in-order packets. Includes partial code clean-up.
efd6
force-pushed
the
33012-reconstruct_fragments
branch
from
586a561 to
e2f0140
Compare
chrisberkhout
pushed a commit
that referenced
this pull request
Jun 1, 2023
This teaches the decoder how to handle IPv4 packets that have been marked as fragmented by retaining a packet ID-keyed cache of IPv4 fragment with TTL awareness. Incoming packets are compared with the available fragments in the cache and a reassembled packet is produced if possible. Otherwise the fragment is added to the cache if there are no fragments with the same packet ID that have exceeded their TTL, purging all packet fragments that have exceeded their TTL. Also a test for effectiveness of the addition with a real-world case to the protos/dns package showing that the response part of a fragmented EDNS0 conversation stream reconstructs the DNS response.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
This adds IPv4 fragmented packet reconstruction to the packet decoder.
Why is it important?
This is important because without reconstruction we are potentially blind to UDP traffic that has been sent with fragmentation, for example UDP EDNS0 DNS requests.
Checklist
I have made corresponding changes to the documentationI have made corresponding change to the default configuration filesCHANGELOG.next.asciidocorCHANGELOG-developer.next.asciidoc.Author's Checklist
How to test this PR locally
go testin the packetbeat/decoder package will test this enhancement.Related issues
Use cases
Screenshots
Logs