diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 9ccb9f8bcc35..bf7dc1134ed0 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -11,6 +11,8 @@ https://github.com/elastic/beats/compare/v8.2.0\...main[Check the HEAD diff] *Affecting all Beats* +- Fix namespacing on self-monitoring {pull}32336[32336] +- Fix formatting of hardware addresses populated by the add-host-metadata processor. {issue}32264[32264] {pull}32265[32265] *Auditbeat* diff --git a/libbeat/processors/util/netinfo.go b/libbeat/processors/util/netinfo.go index 3112152db195..d4e694e5fa49 100644 --- a/libbeat/processors/util/netinfo.go +++ b/libbeat/processors/util/netinfo.go @@ -41,10 +41,8 @@ func GetNetInfo() (ipList []string, hwList []string, err error) { continue } - hw := i.HardwareAddr.String() - // Skip empty hardware addresses - if hw != "" { - hwList = append(hwList, hw) + if len(i.HardwareAddr) != 0 { + hwList = append(hwList, formatHardwareAddr(i.HardwareAddr)) } addrs, err := i.Addrs() @@ -67,6 +65,19 @@ func GetNetInfo() (ipList []string, hwList []string, err error) { return ipList, unique(hwList), errs.Err() } +// formatHardwareAddr formats hardware addresses according to the ECS spec. +func formatHardwareAddr(addr net.HardwareAddr) string { + buf := make([]byte, 0, len(addr)*3-1) + for _, b := range addr { + if len(buf) != 0 { + buf = append(buf, '-') + } + const hexDigit = "0123456789ABCDEF" + buf = append(buf, hexDigit[b>>4], hexDigit[b&0xf]) + } + return string(buf) +} + // unique returns addrs lexically sorted and with repeated elements // omitted. func unique(addrs []string) []string { diff --git a/libbeat/processors/util/netinfo_test.go b/libbeat/processors/util/netinfo_test.go index 186f00debf3e..17c47f965a65 100644 --- a/libbeat/processors/util/netinfo_test.go +++ b/libbeat/processors/util/netinfo_test.go @@ -18,13 +18,16 @@ package util import ( + "net" "reflect" + "regexp" "sort" + "strings" "testing" ) func TestUnique(t *testing.T) { - var tests = [][]string{ + tests := [][]string{ {}, {"a"}, {"a", "a"}, @@ -54,3 +57,31 @@ func TestUnique(t *testing.T) { } } } + +func TestFormatHardwareAddr(t *testing.T) { + tests := []string{ + "00:00:5e:00:53:01", + "02:00:5e:10:00:00:00:01", + "00:00:00:00:fe:80:00:00:00:00:00:00:02:00:5e:10:00:00:00:01", + "00-00-5e-00-53-01", + "02-00-5e-10-00-00-00-01", + "00-00-00-00-fe-80-00-00-00-00-00-00-02-00-5e-10-00-00-00-01", + "0000.5e00.5301", + "0200.5e10.0000.0001", + "0000.0000.fe80.0000.0000.0000.0200.5e10.0000.0001", + } + + spec := regexp.MustCompile(`[0-9A-F]{2}(?:[0-9A-F]{2})*`) + for _, test := range tests { + addr, err := net.ParseMAC(test) + if err != nil { + t.Errorf("failed to parse test case %q", test) + continue + } + got := formatHardwareAddr(addr) + want := strings.ToUpper(strings.ReplaceAll(addr.String(), ":", "-")) + if got != want || !spec.MatchString(got) { + t.Errorf("unexpected format for %q: got:%q want:%q", test, got, want) + } + } +}