From 3a4eca992f30f0c29a034b8a3167c67f12778dce Mon Sep 17 00:00:00 2001 From: Tomas Vrana Date: Wed, 29 Oct 2025 16:31:57 +0100 Subject: [PATCH 1/4] fieldClassifier: adding missing parameter to README.md --- modules/fieldClassifier/README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/modules/fieldClassifier/README.md b/modules/fieldClassifier/README.md index c4693ca..f7403a3 100644 --- a/modules/fieldClassifier/README.md +++ b/modules/fieldClassifier/README.md @@ -82,6 +82,10 @@ module takes the following parameters: * Specify if the geolocation should be done for source, destination or both IP addresses. Possible values are `src`, `dst` or `both`. Default is `both`. +* `-c`, `--cacheCapacity` number + + * Specify the capacity of the internal cache (number of entries). Default is `4000`. + ## Geolite parameters * `--pathGeolite` path From bd11d0c07cd4789308c92b8383d267a3cc7a6be1 Mon Sep 17 00:00:00 2001 From: Tomas Vrana Date: Tue, 4 Nov 2025 22:44:43 +0100 Subject: [PATCH 2/4] fieldClassifier: bufix: std::byte fields not being copied to output changelog: Bugfixes in . --- modules/fieldClassifier/src/fieldClassifier.cpp | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/modules/fieldClassifier/src/fieldClassifier.cpp b/modules/fieldClassifier/src/fieldClassifier.cpp index 10b84fd..93b3760 100644 --- a/modules/fieldClassifier/src/fieldClassifier.cpp +++ b/modules/fieldClassifier/src/fieldClassifier.cpp @@ -412,13 +412,9 @@ void FieldClassifier::fillInputFieldsToOutput( break; } case DataType::BYTES: { - // Nemea::UnirecArray const arr - // = input->getFieldAsUnirecArray(fieldId); - // output->setFieldFromUnirecArray(arr, fieldId); - - // std::byte value = input->getFieldAsType(fieldId); - // output->setFieldFromType(value, fieldId); - + Nemea::UnirecArray const arr + = input->getFieldAsUnirecArray(fieldId); + output->setFieldFromUnirecArray(arr, fieldId); break; } case DataType::A_INT8: { From 77aeaa3a4a97e8dc4a903373d680394760c9fe52 Mon Sep 17 00:00:00 2001 From: Tomas Vrana Date: Tue, 4 Nov 2025 23:03:49 +0100 Subject: [PATCH 3/4] fieldClassifier: removing unnecessary extern declaration --- modules/fieldClassifier/src/fieldClassifier.cpp | 2 -- 1 file changed, 2 deletions(-) diff --git a/modules/fieldClassifier/src/fieldClassifier.cpp b/modules/fieldClassifier/src/fieldClassifier.cpp index 93b3760..123995d 100644 --- a/modules/fieldClassifier/src/fieldClassifier.cpp +++ b/modules/fieldClassifier/src/fieldClassifier.cpp @@ -12,8 +12,6 @@ #include "plugins/plugin.hpp" #include -extern int g_debug_level; - namespace NFieldClassifier { void FieldClassifier::handleParams(int argc, char** argv, argparse::ArgumentParser& parser) { From 0e8ae1240bcf36d41be41a90c6399092d41fc8ca Mon Sep 17 00:00:00 2001 From: Tomas Vrana Date: Tue, 25 Nov 2025 17:00:51 +0100 Subject: [PATCH 4/4] fieldClassifier: bugfix: asn overflow after saved to uint16 changelog: Bugfixes in . --- modules/fieldClassifier/src/plugins/asn.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/fieldClassifier/src/plugins/asn.cpp b/modules/fieldClassifier/src/plugins/asn.cpp index 56280f2..98ad30a 100644 --- a/modules/fieldClassifier/src/plugins/asn.cpp +++ b/modules/fieldClassifier/src/plugins/asn.cpp @@ -30,7 +30,7 @@ void ASN::storeParameters(argparse::ArgumentParser& parser) FieldDefinition ASN::defineFields() { // list of all fields provided by this plugin - FieldDefinition allFields = {{"ASN", DataType::UINT16}, {"ASO", DataType::STRING}}; + FieldDefinition allFields = {{"ASN", DataType::UINT32}, {"ASO", DataType::STRING}}; return allFields; } @@ -53,7 +53,7 @@ bool ASN::getData(DataMap& dataMap, std::string& ipAddr) } if (dataMap.find("ASN") != dataMap.end()) { err = MMDB_get_value(&result.entry, &entryData, "autonomous_system_number", NULL); - dataMap.at("ASN") = checkEntryData() ? entryData.uint16 : EMPTY_UINT16; + dataMap.at("ASN") = checkEntryData() ? entryData.uint32 : EMPTY_UINT16; } if (dataMap.find("ASO") != dataMap.end()) { err = MMDB_get_value(&result.entry, &entryData, "autonomous_system_organization", NULL);