marcpardo/netring
1
0
Fork 0
Code Issues 9 Pull requests 1 Projects Releases 6 Packages Wiki Activity Actions

Adopt flowscope 0.22 (bundles 0.21): version bump, migration & inherited fixes #132

New issue
Closed
opened 2026-07-03 18:09:54 +00:00 by p13marc · 1 comment
p13marc commented 2026-07-03 18:09:54 +00:00 (Migrated from github.com)
Copy link

flowscope 0.22.0 published 2026-07-03 (it bundles the never-published 0.21.0 — one bump absorbs both waves). netring is on 0.20. This issue tracks the version bump + migration; the new-capability adoption rides the existing roadmap issues (#127 #128 #130 #121 #120 #122 #124), each updated with the concrete 0.22 APIs.

Breaking changes that hit netring (verified against master)

  • flowscope::parser_kinds removed (flowscope#139). All five builtin Protocol::NAME constants use it: src/protocol/builtin/{icmp,tls,dns,tls_handshake,http}.rs (e.g. icmp.rs:21). Migrate to the per-module PARSER_KIND constants (unchanged) or ParserKind::as_str() — slugs are byte-identical, no wire change.
  • OwnedAnomaly::new takes typed DetectorKind (flowscope#133). src/anomaly/eve_sink.rs:103 builds with a &'static str kind → wrap in DetectorKind::Other(kind). Serialization is byte-identical (each variant emits the 0.20 slug), so EVE/NDJSON consumers are unaffected.
  • DetectorScore::name() → kind() -> DetectorKind (flowscope#131/#133). netring re-exports DetectorScore (src/anomaly/mod.rs:65, prelude) — audit detector_macro.rs and the pattern_detector! examples; downstream impls of DetectorScore must rename.
  • FlowEvent::Packet / Event::Packet are variant-level #[non_exhaustive] + gain source_idx: Option<u32> (flowscope#121). Match sites need .. (src/monitor/run.rs:1796,2532,2770); netring-side synthetic construction (src/async_adapters/session_stream.rs:484,754,790 tests) must go through flowscope::test_helpers::events.
  • QuicUdpParser is stateful (flowscope#135) — netring already calls QuicUdpParser::new() (src/protocol/builtin/quic.rs:41), so this compiles as-is, but note it now keeps per-DCID CRYPTO reassembly state (bounded: 1024 conns, 5 s TTL); its on_tick must keep being driven (datagram streams already do).

Fixes netring inherits by bumping (worth release-note callouts + tests)

  • ICMPv6 errors no longer misdetected as ICMPv4 — netring's on_icmp_error / IcmpError path was silently blind to ICMPv6 Destination Unreachable (incl. Address Unreachable) and mislabeled v6 Time Exceeded. Add a regression test on the netring side; this likely changes observed event streams for IPv6-heavy deployments (in the good direction).
  • Post-quantum ClientHello coverage — X25519MLKEM768 ClientHellos (~1.4 KiB, Chrome/Firefox default) no longer lose SNI/ALPN/JA3/JA4 when split across TCP segments or QUIC Initials. Directly improves netring's TlsFingerprint / QUIC-SNI features. New TlsClientHello::{key_share_groups, pq_key_share} + TlsHandshake::pq_key_share are worth surfacing on TlsFingerprint.
  • v4_only()/v6_only() are now true family filters — check the .icmp_v4_only()/.icmp_v6_only() builder docs still describe reality.

Cheap wins to take in the same bump

  • DetectorKind::attack_technique() — prereq for #127 (ATT&CK tagging); the EVE writer already emits anomaly.attack_technique upstream, so netring's EveSink parity is worth checking.
  • flowscope::fingerprint unified namespace — prereq for #128; also consider re-exporting it as netring's one fingerprint import site.
  • correlate::BandwidthByKey<K> + Attribution + ByteSemantics — the upstream half of #130 now exists.
  • dns::NameMap (pDNS, provenance-tagged, TTL-driven) — the natural enrichment store for #120's DNS handler.
  • New correlate primitives (EwmaVar, FirstSeen, CountingBloomFilter, Cusum/PageHinkley, DdSketch/WindowedQuantiles) — feed #121/#122; no netring action needed beyond the re-export audit of netring::correlate.

Process

Same lockstep pattern as the 0.20 bump (#108): bump + mechanical migration first (this issue), capability adoption as separate PRs under their own issues. docs/migration-0.20-to-0.21.md + docs/migration-0.21-to-0.22.md upstream are the reference. Run the netring migration doc (docs/MIGRATING_0.28_TO_0.29.md) for whatever surfaces change.

flowscope **0.22.0 published 2026-07-03** (it bundles the never-published 0.21.0 — one bump absorbs both waves). netring is on 0.20. This issue tracks the version bump + migration; the new-capability adoption rides the existing roadmap issues (#127 #128 #130 #121 #120 #122 #124), each updated with the concrete 0.22 APIs. ## Breaking changes that hit netring (verified against master) - [ ] **`flowscope::parser_kinds` removed** (flowscope#139). All five builtin `Protocol::NAME` constants use it: `src/protocol/builtin/{icmp,tls,dns,tls_handshake,http}.rs` (e.g. `icmp.rs:21`). Migrate to the per-module `PARSER_KIND` constants (unchanged) or `ParserKind::as_str()` — slugs are byte-identical, no wire change. - [ ] **`OwnedAnomaly::new` takes typed `DetectorKind`** (flowscope#133). `src/anomaly/eve_sink.rs:103` builds with a `&'static str` kind → wrap in `DetectorKind::Other(kind)`. Serialization is byte-identical (each variant emits the 0.20 slug), so EVE/NDJSON consumers are unaffected. - [ ] **`DetectorScore::name()` → `kind() -> DetectorKind`** (flowscope#131/#133). netring re-exports `DetectorScore` (`src/anomaly/mod.rs:65`, prelude) — audit `detector_macro.rs` and the `pattern_detector!` examples; downstream impls of `DetectorScore` must rename. - [ ] **`FlowEvent::Packet` / `Event::Packet` are variant-level `#[non_exhaustive]`** + gain `source_idx: Option<u32>` (flowscope#121). Match sites need `..` (`src/monitor/run.rs:1796,2532,2770`); netring-side synthetic construction (`src/async_adapters/session_stream.rs:484,754,790` tests) must go through `flowscope::test_helpers::events`. - [ ] **`QuicUdpParser` is stateful** (flowscope#135) — netring already calls `QuicUdpParser::new()` (`src/protocol/builtin/quic.rs:41`), so this compiles as-is, but note it now keeps per-DCID CRYPTO reassembly state (bounded: 1024 conns, 5 s TTL); its `on_tick` must keep being driven (datagram streams already do). ## Fixes netring inherits by bumping (worth release-note callouts + tests) - [ ] **ICMPv6 errors no longer misdetected as ICMPv4** — netring's `on_icmp_error` / `IcmpError` path was silently blind to ICMPv6 Destination Unreachable (incl. Address Unreachable) and mislabeled v6 Time Exceeded. Add a regression test on the netring side; this likely changes observed event streams for IPv6-heavy deployments (in the good direction). - [ ] **Post-quantum ClientHello coverage** — X25519MLKEM768 ClientHellos (~1.4 KiB, Chrome/Firefox default) no longer lose SNI/ALPN/JA3/JA4 when split across TCP segments or QUIC Initials. Directly improves netring's `TlsFingerprint` / QUIC-SNI features. New `TlsClientHello::{key_share_groups, pq_key_share}` + `TlsHandshake::pq_key_share` are worth surfacing on `TlsFingerprint`. - [ ] **`v4_only()`/`v6_only()` are now true family filters** — check the `.icmp_v4_only()`/`.icmp_v6_only()` builder docs still describe reality. ## Cheap wins to take in the same bump - [ ] `DetectorKind::attack_technique()` — prereq for #127 (ATT&CK tagging); the EVE writer already emits `anomaly.attack_technique` upstream, so netring's `EveSink` parity is worth checking. - [ ] `flowscope::fingerprint` unified namespace — prereq for #128; also consider re-exporting it as netring's one fingerprint import site. - [ ] `correlate::BandwidthByKey<K>` + `Attribution` + `ByteSemantics` — the upstream half of #130 now exists. - [ ] `dns::NameMap` (pDNS, provenance-tagged, TTL-driven) — the natural enrichment store for #120's DNS handler. - [ ] New `correlate` primitives (`EwmaVar`, `FirstSeen`, `CountingBloomFilter`, `Cusum`/`PageHinkley`, `DdSketch`/`WindowedQuantiles`) — feed #121/#122; no netring action needed beyond the re-export audit of `netring::correlate`. ## Process Same lockstep pattern as the 0.20 bump (#108): bump + mechanical migration first (this issue), capability adoption as separate PRs under their own issues. `docs/migration-0.20-to-0.21.md` + `docs/migration-0.21-to-0.22.md` upstream are the reference. Run the netring migration doc (`docs/MIGRATING_0.28_TO_0.29.md`) for whatever surfaces change.
p13marc commented 2026-07-03 21:48:44 +00:00 (Migrated from github.com)
Copy link

Done in cda7a3d (0.29.0). Bumped flowscope 0.20 → 0.22; flow now pulls flowscope/analysis. Adopts typed DetectorKind (+ATT&CK), Detector/DetectorRegistry, app_proto, NameMap, BandwidthByKey, WindowedQuantiles, IpFragmentReassembler. All downstream mechanical breaks fixed; just ci green.

Done in `cda7a3d` (0.29.0). Bumped flowscope 0.20 → 0.22; `flow` now pulls `flowscope/analysis`. Adopts typed `DetectorKind` (+ATT&CK), `Detector`/`DetectorRegistry`, `app_proto`, `NameMap`, `BandwidthByKey`, `WindowedQuantiles`, `IpFragmentReassembler`. All downstream mechanical breaks fixed; `just ci` green.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
afxdp-hardening
afxdp-tier2-hardening
afxdp-monitor-multiqueue
afxdp-multiqueue
afxdp-promiscuous
0.25-dev
0.24-dev
0.21-dev
0.29.0
0.28.0
0.27.0
0.26.0
0.25.0
0.24.0
0.22.0
0.21.0
0.18.0
0.15.0
0.14.0
0.13.1
0.13.0
0.11.0
0.9.0
0.8.0
0.7.0-alpha.3
0.7.0-alpha.2
0.7.0-alpha.1
0.7.0-alpha.0
0.6.0
0.5.0
0.4.0
0.2.0
0.1.0
Labels
Clear labels   
bug
Something isn't working

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
question
Further information is requested

  
roadmap
Forward-looking roadmap item (2026 capability/redesign pass)

  
wontfix
This will not be worked on

No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
roadmap
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
marcpardo/netring#132
No description provided.