Fix integer overflow in IPFIX exporter delta calculation#7785
Open
Av1ralS1ngh wants to merge 1 commit intoantrea-io:mainfrom
Open
Fix integer overflow in IPFIX exporter delta calculation#7785Av1ralS1ngh wants to merge 1 commit intoantrea-io:mainfrom
Av1ralS1ngh wants to merge 1 commit intoantrea-io:mainfrom
Conversation
Use uint64 arithmetic for delta calculation to prevent overflow. Add test case for overflow scenario.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The IPFIX exporter computes delta counts for packets and bytes by subtracting the previous counter value from the current one. The original code cast both
uint64operands toint64before subtraction, which silently overflows when counter values exceedmath.MaxInt64(~9.2 × 10¹⁸).This change removes the
int64casts and performs the subtraction directly inuint64arithmetic, which is correct for monotonically increasing counters and also handles wrap-around naturally. A conditional log is emitted when the current value is less than the previous value (counter reset), preserving observability without altering the exported value.What changed:
pkg/agent/flowexporter/exporter/ipfix.go: replacedint64casts with directuint64subtraction forpacketDeltaCount,octetDeltaCount,reversePacketDeltaCount, andreverseOctetDeltaCount.pkg/agent/flowexporter/exporter/ipfix_overflow_test.go[NEW]: table-driven test covering normal deltas, values exceedingMaxInt64, and counter-reset scenarios.Fixes Integer overflow in IPFIX exporter delta calculation #7783