diff --git a/docs/transformers/transform_trafficreducer.md b/docs/transformers/transform_trafficreducer.md index d0a54ccb..d6d31ba6 100644 --- a/docs/transformers/transform_trafficreducer.md +++ b/docs/transformers/transform_trafficreducer.md @@ -24,7 +24,8 @@ Options: > Interval in seconds to aggregate and process the traffic. * `unique-fields` (array of strings) - > Define custom fields for uniqueness matching. This allows greater flexibility in detecting repetitive traffic. + > Define custom fields for uniqueness matching (limited to string and integer values). + > This allows greater flexibility in detecting repetitive traffic. > Complete list of [fields](../dnsconversions.md#json-encoding) available. Default values: @@ -39,6 +40,7 @@ transforms: - dnstap.identity - dnstap.operation - network.query-ip + - network.response-ip - dns.qname - dns.qtype ``` diff --git a/pkgconfig/transformers.go b/pkgconfig/transformers.go index 47b148b7..8df48ca9 100644 --- a/pkgconfig/transformers.go +++ b/pkgconfig/transformers.go @@ -42,7 +42,7 @@ type ConfigTransformers struct { RepetitiveTrafficDetector bool `yaml:"repetitive-traffic-detector" default:"false"` QnamePlusOne bool `yaml:"qname-plus-one" default:"false"` WatchInterval int `yaml:"watch-interval" default:"5"` - UniqueFields []string `yaml:"unique-fields" default:"[\"dnstap.identity\", \"dnstap.operation\", \"network.query-ip\", \"dns.qname\", \"dns.qtype\"]"` + UniqueFields []string `yaml:"unique-fields" default:"[\"dnstap.identity\", \"dnstap.operation\", \"network.query-ip\", \"network.response-ip\", \"dns.qname\", \"dns.qtype\"]"` } `yaml:"reducer"` Filtering struct { Enable bool `yaml:"enable" default:"false"` diff --git a/transformers/reducer.go b/transformers/reducer.go index 5b7c1018..c2f6d97f 100644 --- a/transformers/reducer.go +++ b/transformers/reducer.go @@ -148,7 +148,14 @@ func (t *ReducerTransform) repetitiveTrafficDetector(dm *dnsutils.DNSMessage) (i dmValue := reflect.ValueOf(dm).Elem() // Get the struct value of the DNSMessage for _, field := range t.config.Reducer.UniqueFields { if value, found := dnsutils.GetFieldByJSONTag(dmValue, field); found { - t.strBuilder.WriteString(fmt.Sprintf("%v", value.Interface())) // Append field value + // Check if the field's kind is either int or string + switch value.Kind() { + case reflect.Int, reflect.String: + t.strBuilder.WriteString(fmt.Sprintf("%v", value.Interface())) // Append field value + default: + // Skip unsupported types + continue + } } } diff --git a/transformers/reducer_test.go b/transformers/reducer_test.go index fccfe4c9..236de071 100644 --- a/transformers/reducer_test.go +++ b/transformers/reducer_test.go @@ -81,7 +81,7 @@ func TestReducer_RepetitiveTrafficDetector(t *testing.T) { dnsMessagesIn []dnsutils.DNSMessage }{ { - name: "norepeat", + name: "no_reduce", dnsMessagesIn: []dnsutils.DNSMessage{ { DNSTap: dnsutils.DNSTap{Operation: "CLIENT_QUERY"}, @@ -104,27 +104,50 @@ func TestReducer_RepetitiveTrafficDetector(t *testing.T) { }, }, { - name: "reduce", + name: "reduce_default_unique_fields", + dnsMessagesIn: []dnsutils.DNSMessage{ + { + DNSTap: dnsutils.DNSTap{Operation: "CLIENT_QUERY", Identity: "test"}, + DNS: dnsutils.DNS{Qname: "hello.world", Qtype: "A"}, + NetworkInfo: dnsutils.DNSNetInfo{QueryIP: "127.0.0.1", ResponseIP: "8.8.8.8"}, + }, + { + DNSTap: dnsutils.DNSTap{Operation: "CLIENT_QUERY", Identity: "test"}, + DNS: dnsutils.DNS{Qname: "hello.world", Qtype: "A"}, + NetworkInfo: dnsutils.DNSNetInfo{QueryIP: "127.0.0.1", ResponseIP: "8.8.8.8"}, + }, + }, + dnsMessagesOut: []dnsutils.DNSMessage{ + { + Reducer: &dnsutils.TransformReducer{Occurrences: 2}, + }, + }, + }, + { + name: "no_reduce_responseip_different", dnsMessagesIn: []dnsutils.DNSMessage{ { DNSTap: dnsutils.DNSTap{Operation: "CLIENT_QUERY"}, DNS: dnsutils.DNS{Qname: "hello.world", Qtype: "A"}, - NetworkInfo: dnsutils.DNSNetInfo{QueryIP: "127.0.0.1"}, + NetworkInfo: dnsutils.DNSNetInfo{QueryIP: "127.0.0.1", ResponseIP: "1.1.1.1"}, }, { DNSTap: dnsutils.DNSTap{Operation: "CLIENT_QUERY"}, DNS: dnsutils.DNS{Qname: "hello.world", Qtype: "A"}, - NetworkInfo: dnsutils.DNSNetInfo{QueryIP: "127.0.0.1"}, + NetworkInfo: dnsutils.DNSNetInfo{QueryIP: "127.0.0.1", ResponseIP: "8.8.8.8"}, }, }, dnsMessagesOut: []dnsutils.DNSMessage{ { - Reducer: &dnsutils.TransformReducer{Occurrences: 2}, + Reducer: &dnsutils.TransformReducer{Occurrences: 1}, + }, + { + Reducer: &dnsutils.TransformReducer{Occurrences: 1}, }, }, }, { - name: "norepeat_qtype", + name: "no_reduce_qtype_different", dnsMessagesIn: []dnsutils.DNSMessage{ { DNSTap: dnsutils.DNSTap{Operation: "CLIENT_QUERY"},