From ebf144fd182317f374d6af5c683ce3be5741bfc6 Mon Sep 17 00:00:00 2001 From: Andrew Kroh Date: Thu, 18 Feb 2021 09:54:47 -0500 Subject: [PATCH 1/3] Document netflow internal_networks and set default Documentation for the `internal_networks` option of the Netflow input and module was missing. Also the module's manifest did not declare the option so if it was not set in the module config it would cause an error. I did not see where a default was set for the netflow input's internal_networks option so I set that to `private` to keep the old behavior before this was configurable. Fixes #24094 --- CHANGELOG.next.asciidoc | 1 + filebeat/docs/modules/netflow.asciidoc | 7 +++++++ x-pack/filebeat/docs/inputs/input-netflow.asciidoc | 11 +++++++++++ x-pack/filebeat/input/netflow/config.go | 1 + x-pack/filebeat/module/netflow/_meta/docs.asciidoc | 7 +++++++ x-pack/filebeat/module/netflow/log/manifest.yml | 1 + 6 files changed, 28 insertions(+) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 641f7a769a9b..417ae051e3ab 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -387,6 +387,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Fix Logstash module handling of logstash.log.log_event.action field. {issue}20709[20709] - aws/s3access dataset was populating event.duration using the wrong unit. {pull}23920[23920] - Zoom module pipeline failed to ingest some chat_channel events. {pull}23904[23904] +- Fix Netlow module issue with missing `internal_networks` config parameter. {issue}24094[24094] {pull}24110[24110] *Heartbeat* diff --git a/filebeat/docs/modules/netflow.asciidoc b/filebeat/docs/modules/netflow.asciidoc index ebb40dfd5c97..04df016ab7b3 100644 --- a/filebeat/docs/modules/netflow.asciidoc +++ b/filebeat/docs/modules/netflow.asciidoc @@ -72,6 +72,13 @@ details. monitor sequence numbers in the Netflow packets to detect an Exporting Process reset. See <> for details. +`var.internal_networks`:: A list of CIDR ranges describing the IP addresses that +you consider internal. This is used in determining the values of +`source.locality`, `destination.locality`, and `flow.locality`. The values +can be either a CIDR value or one of the named ranged supported by the +<> condition. The default value is `[private]` +which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal. + *`var.tags`*:: A list of tags to include in events. Including `forwarded` indicates that the diff --git a/x-pack/filebeat/docs/inputs/input-netflow.asciidoc b/x-pack/filebeat/docs/inputs/input-netflow.asciidoc index 840ad70ec053..b53881cc9618 100644 --- a/x-pack/filebeat/docs/inputs/input-netflow.asciidoc +++ b/x-pack/filebeat/docs/inputs/input-netflow.asciidoc @@ -120,6 +120,17 @@ cause flow loss until the exporter provides new templates. If set to `false`, if the exporter process is reset. This option is only applicable to Netflow V9 and IPFIX. Default is `true`. +[float] +[[internal_networks]] +==== `internal_networks` + +A list of CIDR ranges describing the IP addresses that you consider internal. +This is used in determining the values of `source.locality`, +`destination.locality`, and `flow.locality`. The values can be either a CIDR +value or one of the named ranges supported by the +<> condition. The default value is `[private]` +which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal. + [id="{beatname_lc}-input-{type}-common-options"] include::../../../../filebeat/docs/inputs/input-common-options.asciidoc[] diff --git a/x-pack/filebeat/input/netflow/config.go b/x-pack/filebeat/input/netflow/config.go index 4d795a44eecc..b13b6722ab61 100644 --- a/x-pack/filebeat/input/netflow/config.go +++ b/x-pack/filebeat/input/netflow/config.go @@ -33,6 +33,7 @@ var defaultConfig = config{ ForwarderConfig: harvester.ForwarderConfig{ Type: inputName, }, + InternalNetworks: []string{"private"}, Protocols: []string{"v5", "v9", "ipfix"}, ExpirationTimeout: time.Minute * 30, PacketQueueSize: 8192, diff --git a/x-pack/filebeat/module/netflow/_meta/docs.asciidoc b/x-pack/filebeat/module/netflow/_meta/docs.asciidoc index 830b397ec457..09ffda3d0244 100644 --- a/x-pack/filebeat/module/netflow/_meta/docs.asciidoc +++ b/x-pack/filebeat/module/netflow/_meta/docs.asciidoc @@ -67,6 +67,13 @@ details. monitor sequence numbers in the Netflow packets to detect an Exporting Process reset. See <> for details. +`var.internal_networks`:: A list of CIDR ranges describing the IP addresses that +you consider internal. This is used in determining the values of +`source.locality`, `destination.locality`, and `flow.locality`. The values +can be either a CIDR value or one of the named ranges supported by the +<> condition. The default value is `[private]` +which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal. + *`var.tags`*:: A list of tags to include in events. Including `forwarded` indicates that the diff --git a/x-pack/filebeat/module/netflow/log/manifest.yml b/x-pack/filebeat/module/netflow/log/manifest.yml index e46428b2fc0b..250c2b414e93 100644 --- a/x-pack/filebeat/module/netflow/log/manifest.yml +++ b/x-pack/filebeat/module/netflow/log/manifest.yml @@ -17,6 +17,7 @@ var: - name: detect_sequence_reset - name: tags default: [forwarded] + - name: internal_networks ingest_pipeline: ingest/pipeline.yml input: config/netflow.yml From 64f4b580e54243341fa8ef5272dd89ac82c9f3a2 Mon Sep 17 00:00:00 2001 From: Andrew Kroh Date: Thu, 18 Feb 2021 10:19:48 -0500 Subject: [PATCH 2/3] Fix module config file --- x-pack/filebeat/module/netflow/log/config/netflow.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/x-pack/filebeat/module/netflow/log/config/netflow.yml b/x-pack/filebeat/module/netflow/log/config/netflow.yml index 65baa78eaacf..dd111c35097c 100644 --- a/x-pack/filebeat/module/netflow/log/config/netflow.yml +++ b/x-pack/filebeat/module/netflow/log/config/netflow.yml @@ -6,7 +6,7 @@ expiration_timeout: '{{.expiration_timeout}}' queue_size: {{.queue_size}} {{if .internal_networks}} -internal_hosts: +internal_networks: {{range .internal_networks}} - '{{ . }}' {{end}} From d10a383e0ddb4e69d889e39acdd60e6aaf8959a5 Mon Sep 17 00:00:00 2001 From: Andrew Kroh Date: Thu, 18 Feb 2021 11:01:06 -0500 Subject: [PATCH 3/3] Generate docs --- filebeat/docs/modules/netflow.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/filebeat/docs/modules/netflow.asciidoc b/filebeat/docs/modules/netflow.asciidoc index 04df016ab7b3..c3ab408b24d6 100644 --- a/filebeat/docs/modules/netflow.asciidoc +++ b/filebeat/docs/modules/netflow.asciidoc @@ -75,7 +75,7 @@ reset. See <> for details. `var.internal_networks`:: A list of CIDR ranges describing the IP addresses that you consider internal. This is used in determining the values of `source.locality`, `destination.locality`, and `flow.locality`. The values -can be either a CIDR value or one of the named ranged supported by the +can be either a CIDR value or one of the named ranges supported by the <> condition. The default value is `[private]` which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.