fix: get pod ips from TCP protocol in ip-ip encapsulation

[Ishmeet]

Added a check if this IPv4 header represents IPIP protocol encapsulation.
If so, then set srcIP and dstIP from next IPv4 header representing TCP protocol.
So we can get pod IPs instead of host IPs.

[lspgn]

Hi @Ishmeet,
Thank you for the contribution!
Need to double check that a truncated packet does not raise a panic

Have you tried also with custom mapping? I'm not super fond of replacing with the content of the encapsulation

[Ishmeet]

Hi @Ishmeet, Thank you for the contribution! Need to double check that a truncated packet does not raise a panic

Have you tried also with custom mapping? I'm not super fond of replacing with the content of the encapsulation

Hi there @lspgn,

I tried custom mappings, (the below one). It parses src/dest ips from the inner ipv4 header. But when there is no encapsulation in sflow packet, then it parses some random values. For my use case, I want to have src/dest ips from inner ipv4 if IPIP encapsulation exists otherwise if encapsulation not exist then I require ips from the outer ipv4 header.

{
  "flow_config": {
    "sflow": {
      "mapping": [
        {
          "layer": 4,
          "offset": 96,
          "length": 32,
          "destination": "CustomInteger1"
        },
        {
          "layer": 4,
          "offset": 128,
          "length": 32,
          "destination": "CustomInteger2"
        }
      ]
    }
  },
  "name_map": {
    "CustomIPv41": "IP Foo",
    "CustomIPv42": "IP Bar"
  }
}

[lspgn]

Are you able to use the v2?
The following PR adds the ability to decode IPIP with custom mapping
#235
One of the change in the custom mapping is the conditional decoding where you can specify ipip for instance

For my use case, I want to have src/dest ips from inner ipv4 if IPIP encapsulation exists otherwise if encapsulation not exist then I require ips from the outer ipv4 header.

Unfortunately that would break other people's implementation.
I'll see if I can update the code.