fix: Supports V9 Data & Templates for IPFix

RELEASES.md

@@ -1,6 +1,7 @@
 # 0.5.6
 * Simplify V9/IPFix Parse function.
 * Added more cases for DataNumber Parsing.
+* IPFix now supports V9 Templates/Options Templates.
 
 # 0.5.5
 * More IPFIx/V9 Cleanup.

src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_with_v9_options_template_packet.snap

@@ -0,0 +1,106 @@
+---
+source: src/tests.rs
+expression: "NetflowParser::default().parse_bytes(&packet)"
+---
+- IPFix:
+    header:
+      version: 10
+      length: 115
+      export_time: 1744871721
+      sequence_number: 100000
+      observation_domain_id: 0
+    flowsets:
+      - header:
+          header_id: 1
+          length: 14
+        body:
+          V9OptionsTemplate:
+            template_id: 1256
+            options_scope_length: 1
+            options_length: 6
+            scope_fields: []
+            option_fields:
+              - field_type_number: 34
+                field_type: SamplingInterval
+                field_length: 4
+      - header:
+          header_id: 1256
+          length: 8
+        body:
+          V9OptionsData:
+            scope_fields: []
+            options_fields:
+              - field_type: SamplingInterval
+                field_value:
+                  - 0
+                  - 0
+                  - 0
+                  - 1
+      - header:
+          header_id: 2
+          length: 44
+        body:
+          Template:
+            template_id: 258
+            field_count: 9
+            fields:
+              - field_type_number: 8
+                field_type: SourceIpv4address
+                field_length: 4
+              - field_type_number: 12
+                field_type: DestinationIpv4address
+                field_length: 4
+              - field_type_number: 7
+                field_type: SourceTransportPort
+                field_length: 2
+              - field_type_number: 11
+                field_type: DestinationTransportPort
+                field_length: 2
+              - field_type_number: 4
+                field_type: ProtocolIdentifier
+                field_length: 1
+              - field_type_number: 2
+                field_type: PacketDeltaCount
+                field_length: 4
+              - field_type_number: 1
+                field_type: OctetDeltaCount
+                field_length: 4
+              - field_type_number: 22
+                field_type: FlowStartSysUpTime
+                field_length: 4
+              - field_type_number: 21
+                field_type: FlowEndSysUpTime
+                field_length: 4
+      - header:
+          header_id: 258
+          length: 33
+        body:
+          Data:
+            fields:
+              - 0:
+                  - SourceIpv4address
+                  - Ip4Addr: 70.70.1.1
+              - 1:
+                  - DestinationIpv4address
+                  - Ip4Addr: 120.120.1.1
+              - 2:
+                  - SourceTransportPort
+                  - DataNumber: 12345
+              - 3:
+                  - DestinationTransportPort
+                  - DataNumber: 32777
+              - 4:
+                  - ProtocolIdentifier
+                  - DataNumber: 6
+              - 5:
+                  - PacketDeltaCount
+                  - DataNumber: 100
+              - 6:
+                  - OctetDeltaCount
+                  - DataNumber: 125000000
+              - 7:
+                  - FlowStartSysUpTime
+                  - DataNumber: 1744871721
+              - 8:
+                  - FlowEndSysUpTime
+                  - DataNumber: 1744871721

src/snapshots/netflow_parser__tests__base_tests__it_parses_v9_data_cached_template.snap

@@ -23,4 +23,3 @@ expression: parser.parse_bytes(&packet)
                 1:
                   - Ipv4SrcAddr
                   - Ip4Addr: 9.9.9.8
-

src/tests.rs

@@ -481,4 +481,11 @@ mod base_tests {
         let result = parser.parse_bytes(&packet);
         assert_yaml_snapshot!(result);
     }
+
+    #[test]
+    fn it_parses_ipfix_with_v9_options_template_packet() {
+        let hex = r#"000a00736800a129000186a0000000000001000e04e8000100060022000404e80008000000010002002c0102000900080004000c000400070002000b00020004000100020004000100040016000400150004010200214646010178780101303980090600000064077359406800a1296800a129"#;
+        let packet = hex::decode(hex).unwrap();
+        assert_yaml_snapshot!(NetflowParser::default().parse_bytes(&packet));
+    }
 }