v058

[mikemiles-dev]

0.5.8

• IPFIx Protocol Identifier now parsers as ProtocolIdentifier Field Type and not UnsignedDataNumber.
• IPix added Application ID Data Type.
• IPFix now supports some Cisco PEN fields listed below:

    CiscoServerBytesNetwork = 8337,
    CiscoClientBytesNetwork = 8338,
    CiscoServicesWaasSegment = 9252,
    CiscoServicesWaasPassthroughReason = 9253,
    CiscoAppHttpUriStatistics = 9357,
    CiscoAppCategoryName = 12232,
    CiscoAppGroupName = 12234,
    CiscoAppHttpHost = 12235,
    CiscoClientIpv4Address = 12236,
    CiscoServerIpv4Address = 12237,
    CiscoClientL4Port = 12240,
    CiscoServerL4Port = 12241,
    CiscoConnectionId = 12242,
    CiscoAppBusiness = 12244,

[Copilot]

Pull Request Overview

This PR updates the IPFIX parsing functionality to version 0.5.8 by introducing a new Application ID data type, changing the mapping for Protocol Identifier to ProtocolType, and adding support for new Cisco PEN fields. Key changes include:

• Updating the IPFIX field enum and conversion logic to support Cisco fields.
• Introducing a new ApplicationId struct and extending FieldValue support.
• Refreshing tests and snapshots to align with the updated protocol field definitions.

Reviewed Changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/variable_versions/snapshots/netflow_parser__variable_versions__ipfix_lookup__ipfix_lookup_tests__it_tests_field_lookup.snap	Updated unknown field value annotations in test snapshots.
src/variable_versions/snapshots/netflow_parser__variable_versions__ipfix_lookup__ipfix_lookup_tests__it_tests_field_data_type_lookup.snap	Revised field data type mapping (ProtocolType and ApplicationId).
src/variable_versions/ipfix_lookup.rs	Removed a previously derived Nom attribute and added extensive Cisco field mappings.
src/variable_versions/ipfix.rs	Adjusted template field parsing to use IPFixField::from(field_type_number) instead of a hardcoded enterprise branch.
src/variable_versions/data_number.rs	Introduced a new ApplicationId struct and updated FieldValue to support it.
Various snapshot files	Updated snapshot contents to reflect new field type names and field values.
RELEASES.md, Cargo.toml	Updated release notes and bumped package version to 0.5.8.

Comments suppressed due to low confidence (4)

src/variable_versions/ipfix.rs:330

• Changing the enterprise field mapping from a fixed IPFixField::Enterprise to IPFixField::from(field_type_number) is a significant behavioral update. Please verify that this new mapping correctly handles both enterprise and non‐enterprise cases as intended by the protocol specification.

                        IPFixField::from(field_type_number)

src/variable_versions/data_number.rs:181

• Consider adding documentation comments for the ApplicationId struct and its fields to clarify their roles, expected value ranges, and how they integrate with the overall IPFIX parser.

pub struct ApplicationId {

src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_options_template_with_data.snap:23

• [nitpick] Please verify that the new field type name 'AssignedforNetFlowv9compatibility' is clear and consistent with project naming conventions. If possible, consider a naming that more explicitly describes its purpose or origin.

                field_type: AssignedforNetFlowv9compatibility

src/variable_versions/ipfix_lookup.rs:9

• The removal of the #[derive(Nom)] attribute could affect parsing functionality. Please confirm that the necessary parsing behavior is maintained or that equivalent functionality is implemented elsewhere.

#[derive(Debug, Hash, PartialEq, Eq, Clone, Ord, PartialOrd, Copy, Serialize)]