Skip to content

Commit

Permalink
[Auditbeat] Host dataset: Sort IPv4 addresses before IPv6 (#9953) (#9991
Browse files Browse the repository at this point in the history
)

Changes the `host` dataset to sort IPv4 addresses of a network interface before IPv6 addresses. This matters because the first IP address of the first non-loopback interface will be used in the `message` string, and the IPv4 address (if it exists) should be easier to read and the more "expected" one for the user.

(cherry picked from commit 204264a)
Christoph Wurm authored Jan 11, 2019

Unverified

This user has not yet uploaded their public signing key.
1 parent 00a905c commit c275916
Showing 1 changed file with 28 additions and 22 deletions.
50 changes: 28 additions & 22 deletions x-pack/auditbeat/module/system/host/host.go
Original file line number Diff line number Diff line change
@@ -73,7 +73,7 @@ type Host struct {
// Uptime() in types.HostInfo recalculates the uptime every time it is called -
// so storing it permanently here.
uptime time.Duration
addrs []net.Addr
ips []net.IP
macs []net.HardwareAddr
}

@@ -124,8 +124,8 @@ func (host *Host) toMapStr() common.MapStr {
}

var ipStrings []string
for _, addr := range host.addrs {
ipStrings = append(ipStrings, ipString(addr))
for _, ip := range host.ips {
ipStrings = append(ipStrings, ip.String())
}
mapstr.Put("ip", ipStrings)

@@ -141,17 +141,6 @@ func (host *Host) toMapStr() common.MapStr {
return mapstr
}

func ipString(addr net.Addr) string {
switch v := addr.(type) {
case *net.IPNet:
return v.IP.String()
case *net.IPAddr:
return v.IP.String()
default:
return ""
}
}

func init() {
mb.Registry.MustAddMetricSet(moduleName, metricsetName, New,
mb.DefaultMetricSet(),
@@ -303,15 +292,15 @@ func getHost() (*Host, error) {
return nil, errors.Wrap(err, "failed to load host information")
}

addrs, macs, err := getNetInfo()
ips, macs, err := getNetInfo()
if err != nil {
return nil, err
}

host := &Host{
info: sysinfoHost.Info(),
uptime: sysinfoHost.Info().Uptime(),
addrs: addrs,
ips: ips,
macs: macs,
}

@@ -333,8 +322,8 @@ func hostEvent(host *Host, eventType string, action eventAction) mb.Event {

func hostMessage(host *Host, action eventAction) string {
var firstIP string
if len(host.addrs) > 0 {
firstIP = ipString(host.addrs[0])
if len(host.ips) > 0 {
firstIP = host.ips[0].String()
}

// Hostname + IP of the first non-loopback interface.
@@ -434,8 +423,9 @@ func (ms *MetricSet) restoreStateFromDisk() error {

// getNetInfo is originally copied from libbeat/processors/add_host_metadata.go.
// TODO: Maybe these two can share an implementation?
func getNetInfo() ([]net.Addr, []net.HardwareAddr, error) {
var addrList []net.Addr
func getNetInfo() ([]net.IP, []net.HardwareAddr, error) {
var ipv4List []net.IP
var ipv6List []net.IP
var hwList []net.HardwareAddr

// Get all interfaces and loop through them
@@ -462,8 +452,24 @@ func getNetInfo() ([]net.Addr, []net.HardwareAddr, error) {
continue
}

addrList = append(addrList, addrs...)
for _, addr := range addrs {
var ip net.IP
switch v := addr.(type) {
case *net.IPNet:
ip = v.IP
case *net.IPAddr:
ip = v.IP
default:
continue
}

if ip.To4() != nil {
ipv4List = append(ipv4List, ip)
} else {
ipv6List = append(ipv6List, ip)
}
}
}

return addrList, hwList, errs.Err()
return append(ipv4List, ipv6List...), hwList, errs.Err()
}

0 comments on commit c275916

Please sign in to comment.