packetbeat: preparation for npcap addition #29017

efd6 · 2021-11-18T03:36:08Z

What does this PR do?

This does largely mechanical cleanup of code under packetbeat, but also includes minor bug fixes.

Why is it important?

This is preparatory for changes to add npcap support for integrations.

Checklist

My code follows the style guidelines of this project
I have commented my code, particularly in hard-to-understand areas
~~- [ ] I have made corresponding changes to the documentation~~
~~- [ ] I have made corresponding change to the default configuration files~~
I have added tests that prove my fix is effective or that my feature works
I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

Confirm manual changes are consistent with original code intention. Mechanical changes are marked with a git-generate stanza.

How to test this PR locally

Related issues

Relates Deploying npcap with Network Packet Capture integration integrations#2132

Use cases

N/A

Screenshots

N/A

Logs

N/A

[git-generate] gofmt -w -s ./packetbeat

Note that a recent gofumpt is required since the latest release panics in procs/zsyscall_windows.go. [git-generate] go install mvdan.cc/gofumpt@7ca7e6c gofumpt -w ./packetbeat

Address the following output from staticcheck. Checked lines are fixed here. - [ ] beater/processor.go:143:15: error strings should not be capitalized (ST1005) - [ ] decoder/decoder.go:142:15: error strings should not be capitalized (ST1005) - [ ] flows/flowid_test.go:57:6: func addUDP is unused (U1000) - [x] flows/flows_test.go:58:2: this value of err is never used (SA4006) - [x] flows/flows_test.go:59:2: this value of err is never used (SA4006) - [x] flows/flows_test.go:60:2: this value of err is never used (SA4006) - [x] flows/flows_test.go:61:2: this value of err is never used (SA4006) - [x] flows/flows_test.go:62:2: this value of err is never used (SA4006) - [x] flows/worker.go:110:17: should use time.Until instead of t.Sub(time.Now()) (S1024) - [ ] pb/event.go:435:13: error strings should not be capitalized (ST1005) - [x] procs/procs.go:216:55: should use time.Since instead of time.Now().Sub (S1012) - [x] protos/amqp/amqp.go:90:5: should omit comparison to bool constant, can be simplified to !amqp.hideConnectionInformation (S1002) - [ ] protos/amqp/amqp_fields.go:48:4: this value of fields is never used (SA4006) **BUG** - [ ] protos/amqp/amqp_fields.go:73:4: this value of fields is never used (SA4006) **BUG** - [x] protos/amqp/amqp_parser.go:77:22: func (*amqpStream).prepareForNewMessage is unused (U1000) - [x] protos/amqp/amqp_parser.go:162:5: should omit comparison to bool constant, can be simplified to amqp.parseHeaders (S1002) - [x] protos/amqp/amqp_parser.go:345:12: should omit comparison to bool constant, can be simplified to m.isRequest (S1002) - [x] protos/amqp/amqp_parser.go:347:12: should omit comparison to bool constant, can be simplified to !m.isRequest (S1002) - [x] protos/amqp/amqp_parser.go:353:9: should omit comparison to bool constant, can be simplified to amqp.hideConnectionInformation (S1002) - [x] protos/amqp/amqp_test.go:672:2: this value of private is never used (SA4006) - [x] protos/amqp/amqp_test.go:739:2: this value of private is never used (SA4006) - [x] protos/cassandra/cassandra.go:203:25: func (*connection).dropStreams is unused (U1000) - [ ] protos/cassandra/internal/gocql/array_decoder.go:29:6: func readInt is unused (U1000) - [ ] protos/cassandra/internal/gocql/marshal.go:279:6: func getApacheCassandraType is unused (U1000) - [x] protos/cassandra/internal/gocql/marshal.go:352:7: receiver name should be a reflection of its identity; don't use generic names such as "this" or "self" (ST1006) - [ ] protos/cassandra/internal/gocql/marshal.go:569:2: const flagValues is unused (U1000) - [ ] protos/cassandra/internal/gocql/marshal.go:570:2: const flagSkipMetaData is unused (U1000) - [ ] protos/cassandra/internal/gocql/marshal.go:571:2: const flagPageSize is unused (U1000) - [ ] protos/cassandra/internal/gocql/marshal.go:572:2: const flagWithPagingState is unused (U1000) - [ ] protos/cassandra/internal/gocql/marshal.go:573:2: const flagWithSerialConsistency is unused (U1000) - [ ] protos/cassandra/internal/gocql/marshal.go:574:2: const flagDefaultTimestamp is unused (U1000) - [ ] protos/cassandra/internal/gocql/marshal.go:575:2: const flagWithNameValues is unused (U1000) - [x] protos/cassandra/parser.go:72:2: field transactionTimeout is unused (U1000) - [ ] protos/cassandra/parser.go:79:22: error strings should not be capitalized (ST1005) - [x] protos/cassandra/pub.go:36:2: field ignoredOps is unused (U1000) - [ ] protos/dhcpv4/option_ip_addresses.go:42:15: error strings should not be capitalized (ST1005) - [x] protos/dns/dns.go:68:2: const query is unused (U1000) - [x] protos/dns/dns.go:69:2: const response is unused (U1000) - [x] protos/dns/dns.go:206:2: field responseTime is unused (U1000) - [x] protos/http/http.go:929:24: func (*messageList).last is unused (U1000) - [ ] protos/http/http_parser.go:264:18: error strings should not be capitalized (ST1005) - [ ] protos/http/http_parser.go:271:16: error strings should not be capitalized (ST1005) - [x] protos/http/http_test.go:59:22: func (*eventStore).empty is unused (U1000) - [x] protos/http/http_test.go:541:2: this value of msg is never used (SA4006) - [x] protos/http/http_test.go:647:2: this value of complete is never used (SA4006) - [x] protos/http/http_test.go:647:2: this value of ok is never used (SA4006) - [x] protos/http/http_test.go:653:2: this value of complete is never used (SA4006) - [x] protos/http/http_test.go:653:2: this value of ok is never used (SA4006) - [x] protos/http/http_test.go:658:2: this value of complete is never used (SA4006) - [x] protos/http/http_test.go:658:2: this value of ok is never used (SA4006) - [x] protos/http/http_test.go:673:2: this value of complete is never used (SA4006) - [x] protos/http/http_test.go:673:2: this value of ok is never used (SA4006) - [x] protos/icmp/icmp.go:260:25: func (*icmpPlugin).getTransaction is unused (U1000) - [ ] protos/icmp/message.go:93:2: logp.WTF is deprecated: Use logp.NewLogger and its Panic or DPanic methods. (SA1019) - [ ] protos/icmp/message.go:104:2: logp.WTF is deprecated: Use logp.NewLogger and its Panic or DPanic methods. (SA1019) - [ ] protos/icmp/message.go:115:2: logp.WTF is deprecated: Use logp.NewLogger and its Panic or DPanic methods. (SA1019) - [ ] protos/icmp/message.go:136:2: logp.WTF is deprecated: Use logp.NewLogger and its Panic or DPanic methods. (SA1019) - [ ] protos/icmp/message.go:147:2: logp.WTF is deprecated: Use logp.NewLogger and its Panic or DPanic methods. (SA1019) - [x] protos/memcache/binary.go:31:6: type memcacheMagic is unused (U1000) - [x] protos/memcache/binary.go:60:2: var extraValue is unused (U1000) - [ ] protos/memcache/errors.go:26:5: var errNotImplemented is unused (U1000) - [ ] protos/memcache/errors.go:33:2: var errExpectedNumber is unused (U1000) - [ ] protos/memcache/errors.go:35:2: var errExpectedCRLF is unused (U1000) - [ ] protos/memcache/errors.go:54:2: var errResponseUnknownTransaction is unused (U1000) - [x] protos/memcache/parse.go:29:2: const codeSpace is unused (U1000) - [x] protos/memcache/parse.go:29:2: only the first constant in this group has an explicit type (SA9004) - [x] protos/memcache/parse.go:30:2: const codeTab is unused (U1000) - [x] protos/memcache/plugin_tcp.go:63:7: const defaultTCPTransDuration is unused (U1000) - [ ] protos/memcache/plugin_tcp.go:377:4: logp.WTF is deprecated: Use logp.NewLogger and its Panic or DPanic methods. (SA1019) - [x] protos/memcache/text.go:410:6: func makeValue2Arg is unused (U1000) - [x] protos/mongodb/mongodb_parser.go:118:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:119:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:120:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:165:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:166:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:167:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:169:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:181:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:232:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:233:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:236:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:237:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:277:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:278:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:279:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:290:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:291:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:292:2: this value of err is never used (SA4006) - [ ] protos/mongodb/mongodb_parser.go:401:13: error strings should not be capitalized (ST1005) - [x] protos/mongodb/mongodb_parser.go:436:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:461:2: this value of err is never used (SA4006) - [ ] protos/mongodb/mongodb_parser.go:470:24: error strings should not be capitalized (ST1005) - [x] protos/mongodb/mongodb_test.go:163:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_test.go:174:2: this value of err is never used (SA4006) - [x] protos/mysql/mysql.go:65:2: field fields is unused (U1000) - [x] protos/mysql/mysql.go:66:2: field rows is unused (U1000) - [x] protos/mysql/mysql.go:86:2: field params is unused (U1000) - [x] protos/mysql/mysql.go:944:4: empty branch (SA9003) - [x] protos/mysql/mysql_test.go:52:22: func (*eventStore).empty is unused (U1000) - [x] protos/mysql/mysql_test.go:679:3: this value of private is never used (SA4006) - [x] protos/nfs/xdr.go:43:15: func (*xdr).getInt is unused (U1000) - [x] protos/nfs/xdr.go:55:15: func (*xdr).getHyper is unused (U1000) - [x] protos/pgsql/pgsql.go:432:5: should omit nil check; len() for nil slices is defined as zero (S1009) - [x] protos/pgsql/pgsql_test.go:49:22: func (*eventStore).empty is unused (U1000) - [x] protos/protos_test.go:74:2: redundant return statement (S1023) - [x] protos/protos_test.go:103:2: redundant return statement (S1023) - [ ] protos/sip/parser.go:254:18: error strings should not be capitalized (ST1005) - [ ] protos/sip/parser.go:261:16: error strings should not be capitalized (ST1005) - [x] protos/tcp/tcp.go:291:6: func tcpSeqBefore is unused (U1000) - [ ] protos/tcp/tcp.go:309:17: error strings should not be capitalized (ST1005) - [x] protos/tcp/tcp_test.go:200:76: redundant return statement (S1023) - [ ] protos/thrift/thrift.go:272:10: error strings should not be capitalized (ST1005) - [ ] protos/thrift/thrift.go:279:10: error strings should not be capitalized (ST1005) - [x] protos/thrift/thrift_idl.go:52:28: should use make([]*string, max + 1) instead (S1019) - [ ] protos/thrift/thrift_idl.go:94:19: error strings should not be capitalized (ST1005) - [x] protos/thrift/thrift_test.go:125:2: this value of m is never used (SA4006) - [x] protos/thrift/thrift_test.go:133:2: this value of m is never used (SA4006) - [x] protos/thrift/thrift_test.go:153:2: this value of m is never used (SA4006) - [ ] protos/tls/alerts.go:72:15: error strings should not be capitalized (ST1005) - [ ] protos/tls/parse.go:21:2: package crypto/dsa is deprecated: DSA is a legacy algorithm, and modern alternatives such as Ed25519 (implemented by package crypto/ed25519) should be used instead. Keys with 1024-bit moduli (L1024N160 parameters) are cryptographically weak, while bigger keys are not widely supported. Note that FIPS 186-5 no longer approves DSA for signature generation. (SA1019) - [x] protos/tls/parse.go:56:2: only the first constant in this group has an explicit type (SA9004) - [x] protos/tls/parse.go:65:2: only the first constant in this group has an explicit type (SA9004) - [x] protos/tls/parse_test.go:128:6: func mapInt is unused (U1000) - [x] protos/tls/parse_test.go:175:2: this value of err is never used (SA4006) - [x] protos/tls/tls.go:175:5: don't use Yoda conditions (ST1017) - [x] protos/tls/tls_test.go:327:2: this value of err is never used (SA4006) - [x] protos/tls/tls_test.go:390:2: this value of err is never used (SA4006) - [x] protos/tls/tls_test.go:402:2: this value of err is never used (SA4006) - [x] protos/tls/tls_test.go:434:2: this value of err is never used (SA4006) - [x] protos/tls/tls_test.go:441:2: this value of err is never used (SA4006) - [ ] protos/udp/udp.go:93:17: error strings should not be capitalized (ST1005) - [x] protos/udp/udp_test.go:81:2: redundant return statement (S1023) - [ ] scripts/mage/config.go:28:2: const configTemplateGlob is unused (U1000) - [ ] scripts/mage/package.go:69:4: the surrounding loop is unconditionally terminated (SA4004) - [ ] sniffer/afpacket.go:40:19: error strings should not be capitalized (ST1005) - [ ] sniffer/afpacket_nonlinux.go:36:14: error strings should not be capitalized (ST1005) - [ ] sniffer/afpacket_nonlinux.go:40:19: error strings should not be capitalized (ST1005) - [ ] sniffer/afpacket_nonlinux.go:44:9: error strings should not be capitalized (ST1005) - [x] sniffer/device.go:65:13: the argument is already a string, there's no need to use fmt.Sprintf (S1025) - [ ] sniffer/device.go:84:15: error strings should not be capitalized (ST1005) - [ ] sniffer/device.go:89:15: error strings should not be capitalized (ST1005) - [ ] sniffer/device.go:100:14: error strings should not be capitalized (ST1005) - [ ] sniffer/file.go:82:20: error strings should not be capitalized (ST1005) - [x] sniffer/sniffer.go:42:2: field dumper is unused (U1000) - [ ] sniffer/sniffer.go:150:10: error strings should not be capitalized (ST1005) - [ ] sniffer/sniffer.go:195:11: error strings should not be capitalized (ST1005) - [ ] sniffer/sniffer.go:226:15: error strings should not be capitalized (ST1005) - [ ] sniffer/sniffer.go:250:10: error strings should not be capitalized (ST1005) - [ ] sniffer/sniffer_test.go:55:2: this value of blockSize is never used (SA4006) - [ ] sniffer/sniffer_test.go:55:2: this value of frameSize is never used (SA4006) - [ ] sniffer/sniffer_test.go:55:2: this value of numBlocks is never used (SA4006) - [ ] sniffer/sniffer_test.go:61:2: this value of err is never used (SA4006)

…tion The previous code would drop data rather than fill the fields common.MapStr. This change larifies that it is the caller's responsibility to provide a valid destination.

elasticmachine · 2021-11-18T05:07:09Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2021-11-29T23:37:52.346+0000
Duration: 86 min 33 sec
Commit: a41fd11

Test stats 🧪

Test	Results
Failed	0
Passed	4945
Skipped	54
Total	4999

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.
/package : Generate the packages and run the E2E tests.
/beats-tester : Run the installation tests with beats-tester.
run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

elasticmachine · 2021-11-18T07:22:57Z

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

…stions - [ ] flows/table.go:88:21: could remove embedded field "rawFlowID" from selector (QF1008) - [x] pb/event.go:240:2: could use tagged switch on f.Network.Transport (QF1002) - [x] protos/cassandra/config.go:48:5: could apply De Morgan's law (QF1001) - [x] protos/cassandra/internal/gocql/array_decoder.go:166:5: could apply De Morgan's law (QF1001) - [x] protos/cassandra/internal/gocql/stream_decoder.go:152:5: could apply De Morgan's law (QF1001) - [ ] protos/dhcpv4/dhcpv4.go:80:11: could remove embedded field "dhcpv4Config" from selector (QF1008) - [ ] protos/memcache/memcache.go:183:5: could remove embedded field "tcpConfig" from selector (QF1008) - [x] protos/memcache/memcache.go:257:3: could use tagged switch on prev.command.code (QF1003) - [ ] protos/memcache/memcache.go:377:4: could remove embedded field "Transaction" from selector (QF1008) - [ ] protos/memcache/plugin_tcp.go:115:4: could remove embedded field "Stream" from selector (QF1008) - [ ] protos/memcache/plugin_tcp.go:443:9: could remove embedded field "Stream" from selector (QF1008) - [x] protos/mongodb/mongodb.go:345:4: could use tagged switch on t.method (QF1003) - [x] protos/mysql/mysql.go:688:4: could use tagged switch on msg.typ (QF1003) - [x] protos/mysql/mysql.go:698:3: could use tagged switch on msg.typ (QF1003) - [ ] protos/redis/redis.go:120:4: could remove embedded field "Stream" from selector (QF1008) - [ ] protos/redis/redis.go:237:4: could remove embedded field "Stream" from selector (QF1008) - [ ] protos/redis/redis_test.go:215:5: could remove embedded field "Stream" from selector (QF1008) - [ ] protos/redis/redis_test.go:255:6: could remove embedded field "Stream" from selector (QF1008) - [x] protos/sip/parser.go:272:5: could apply De Morgan's law (QF1001) - [ ] protos/tls/parse.go:552:18: could remove embedded field "Parameters" from selector (QF1008) - [ ] protos/tls/tls.go:226:4: could remove embedded field "Stream" from selector (QF1008) Embedded field selector simplification are not applied because in many cases these probably should not be embedded fields or they clarify the intention.

andrewkroh

LGTM. Lot's of good clean up here. Do you think any of this is worth a changelog mention? Like the error handling improvements in mongodb?

efd6 · 2021-11-29T20:20:48Z

Yes, I'll do that.

efd6 · 2021-11-29T20:24:24Z

Should ask: can significant clean ups be considered bugfix in the context of the changelog and is it OK to add multiple changelog lines in a PR?

efd6 · 2021-11-29T22:56:32Z

@andrewkroh PTAL

andrewkroh · 2021-11-30T00:42:35Z

can significant clean ups be considered bugfix

There's no hard rules on this so yes. It lacks specificity, but it would be good to know about if you were trying to track down a behavior change.

and is it OK to add multiple changelog lines in a PR?

Yes, AFAIK that's OK (I've done this a few times). You cannot have individual entries that span multiple lines (I think it trips up someone's scripting used to generate the final changelog file).

* packetbeat: run gofmt -s * packetbeat/protos/tls: prep for gofumpt * packetbeat: run gofumpt * packetbeat: clean up lint Address the following output from staticcheck. Checked lines are fixed here. - [ ] beater/processor.go:143:15: error strings should not be capitalized (ST1005) - [ ] decoder/decoder.go:142:15: error strings should not be capitalized (ST1005) - [ ] flows/flowid_test.go:57:6: func addUDP is unused (U1000) - [x] flows/flows_test.go:58:2: this value of err is never used (SA4006) - [x] flows/flows_test.go:59:2: this value of err is never used (SA4006) - [x] flows/flows_test.go:60:2: this value of err is never used (SA4006) - [x] flows/flows_test.go:61:2: this value of err is never used (SA4006) - [x] flows/flows_test.go:62:2: this value of err is never used (SA4006) - [x] flows/worker.go:110:17: should use time.Until instead of t.Sub(time.Now()) (S1024) - [ ] pb/event.go:435:13: error strings should not be capitalized (ST1005) - [x] procs/procs.go:216:55: should use time.Since instead of time.Now().Sub (S1012) - [x] protos/amqp/amqp.go:90:5: should omit comparison to bool constant, can be simplified to !amqp.hideConnectionInformation (S1002) - [ ] protos/amqp/amqp_fields.go:48:4: this value of fields is never used (SA4006) **BUG** - [ ] protos/amqp/amqp_fields.go:73:4: this value of fields is never used (SA4006) **BUG** - [x] protos/amqp/amqp_parser.go:77:22: func (*amqpStream).prepareForNewMessage is unused (U1000) - [x] protos/amqp/amqp_parser.go:162:5: should omit comparison to bool constant, can be simplified to amqp.parseHeaders (S1002) - [x] protos/amqp/amqp_parser.go:345:12: should omit comparison to bool constant, can be simplified to m.isRequest (S1002) - [x] protos/amqp/amqp_parser.go:347:12: should omit comparison to bool constant, can be simplified to !m.isRequest (S1002) - [x] protos/amqp/amqp_parser.go:353:9: should omit comparison to bool constant, can be simplified to amqp.hideConnectionInformation (S1002) - [x] protos/amqp/amqp_test.go:672:2: this value of private is never used (SA4006) - [x] protos/amqp/amqp_test.go:739:2: this value of private is never used (SA4006) - [x] protos/cassandra/cassandra.go:203:25: func (*connection).dropStreams is unused (U1000) - [ ] protos/cassandra/internal/gocql/array_decoder.go:29:6: func readInt is unused (U1000) - [ ] protos/cassandra/internal/gocql/marshal.go:279:6: func getApacheCassandraType is unused (U1000) - [x] protos/cassandra/internal/gocql/marshal.go:352:7: receiver name should be a reflection of its identity; don't use generic names such as "this" or "self" (ST1006) - [ ] protos/cassandra/internal/gocql/marshal.go:569:2: const flagValues is unused (U1000) - [ ] protos/cassandra/internal/gocql/marshal.go:570:2: const flagSkipMetaData is unused (U1000) - [ ] protos/cassandra/internal/gocql/marshal.go:571:2: const flagPageSize is unused (U1000) - [ ] protos/cassandra/internal/gocql/marshal.go:572:2: const flagWithPagingState is unused (U1000) - [ ] protos/cassandra/internal/gocql/marshal.go:573:2: const flagWithSerialConsistency is unused (U1000) - [ ] protos/cassandra/internal/gocql/marshal.go:574:2: const flagDefaultTimestamp is unused (U1000) - [ ] protos/cassandra/internal/gocql/marshal.go:575:2: const flagWithNameValues is unused (U1000) - [x] protos/cassandra/parser.go:72:2: field transactionTimeout is unused (U1000) - [ ] protos/cassandra/parser.go:79:22: error strings should not be capitalized (ST1005) - [x] protos/cassandra/pub.go:36:2: field ignoredOps is unused (U1000) - [ ] protos/dhcpv4/option_ip_addresses.go:42:15: error strings should not be capitalized (ST1005) - [x] protos/dns/dns.go:68:2: const query is unused (U1000) - [x] protos/dns/dns.go:69:2: const response is unused (U1000) - [x] protos/dns/dns.go:206:2: field responseTime is unused (U1000) - [x] protos/http/http.go:929:24: func (*messageList).last is unused (U1000) - [ ] protos/http/http_parser.go:264:18: error strings should not be capitalized (ST1005) - [ ] protos/http/http_parser.go:271:16: error strings should not be capitalized (ST1005) - [x] protos/http/http_test.go:59:22: func (*eventStore).empty is unused (U1000) - [x] protos/http/http_test.go:541:2: this value of msg is never used (SA4006) - [x] protos/http/http_test.go:647:2: this value of complete is never used (SA4006) - [x] protos/http/http_test.go:647:2: this value of ok is never used (SA4006) - [x] protos/http/http_test.go:653:2: this value of complete is never used (SA4006) - [x] protos/http/http_test.go:653:2: this value of ok is never used (SA4006) - [x] protos/http/http_test.go:658:2: this value of complete is never used (SA4006) - [x] protos/http/http_test.go:658:2: this value of ok is never used (SA4006) - [x] protos/http/http_test.go:673:2: this value of complete is never used (SA4006) - [x] protos/http/http_test.go:673:2: this value of ok is never used (SA4006) - [x] protos/icmp/icmp.go:260:25: func (*icmpPlugin).getTransaction is unused (U1000) - [ ] protos/icmp/message.go:93:2: logp.WTF is deprecated: Use logp.NewLogger and its Panic or DPanic methods. (SA1019) - [ ] protos/icmp/message.go:104:2: logp.WTF is deprecated: Use logp.NewLogger and its Panic or DPanic methods. (SA1019) - [ ] protos/icmp/message.go:115:2: logp.WTF is deprecated: Use logp.NewLogger and its Panic or DPanic methods. (SA1019) - [ ] protos/icmp/message.go:136:2: logp.WTF is deprecated: Use logp.NewLogger and its Panic or DPanic methods. (SA1019) - [ ] protos/icmp/message.go:147:2: logp.WTF is deprecated: Use logp.NewLogger and its Panic or DPanic methods. (SA1019) - [x] protos/memcache/binary.go:31:6: type memcacheMagic is unused (U1000) - [x] protos/memcache/binary.go:60:2: var extraValue is unused (U1000) - [ ] protos/memcache/errors.go:26:5: var errNotImplemented is unused (U1000) - [ ] protos/memcache/errors.go:33:2: var errExpectedNumber is unused (U1000) - [ ] protos/memcache/errors.go:35:2: var errExpectedCRLF is unused (U1000) - [ ] protos/memcache/errors.go:54:2: var errResponseUnknownTransaction is unused (U1000) - [x] protos/memcache/parse.go:29:2: const codeSpace is unused (U1000) - [x] protos/memcache/parse.go:29:2: only the first constant in this group has an explicit type (SA9004) - [x] protos/memcache/parse.go:30:2: const codeTab is unused (U1000) - [x] protos/memcache/plugin_tcp.go:63:7: const defaultTCPTransDuration is unused (U1000) - [ ] protos/memcache/plugin_tcp.go:377:4: logp.WTF is deprecated: Use logp.NewLogger and its Panic or DPanic methods. (SA1019) - [x] protos/memcache/text.go:410:6: func makeValue2Arg is unused (U1000) - [x] protos/mongodb/mongodb_parser.go:118:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:119:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:120:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:165:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:166:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:167:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:169:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:181:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:232:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:233:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:236:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:237:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:277:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:278:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:279:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:290:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:291:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:292:2: this value of err is never used (SA4006) - [ ] protos/mongodb/mongodb_parser.go:401:13: error strings should not be capitalized (ST1005) - [x] protos/mongodb/mongodb_parser.go:436:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:461:2: this value of err is never used (SA4006) - [ ] protos/mongodb/mongodb_parser.go:470:24: error strings should not be capitalized (ST1005) - [x] protos/mongodb/mongodb_test.go:163:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_test.go:174:2: this value of err is never used (SA4006) - [x] protos/mysql/mysql.go:65:2: field fields is unused (U1000) - [x] protos/mysql/mysql.go:66:2: field rows is unused (U1000) - [x] protos/mysql/mysql.go:86:2: field params is unused (U1000) - [x] protos/mysql/mysql.go:944:4: empty branch (SA9003) - [x] protos/mysql/mysql_test.go:52:22: func (*eventStore).empty is unused (U1000) - [x] protos/mysql/mysql_test.go:679:3: this value of private is never used (SA4006) - [x] protos/nfs/xdr.go:43:15: func (*xdr).getInt is unused (U1000) - [x] protos/nfs/xdr.go:55:15: func (*xdr).getHyper is unused (U1000) - [x] protos/pgsql/pgsql.go:432:5: should omit nil check; len() for nil slices is defined as zero (S1009) - [x] protos/pgsql/pgsql_test.go:49:22: func (*eventStore).empty is unused (U1000) - [x] protos/protos_test.go:74:2: redundant return statement (S1023) - [x] protos/protos_test.go:103:2: redundant return statement (S1023) - [ ] protos/sip/parser.go:254:18: error strings should not be capitalized (ST1005) - [ ] protos/sip/parser.go:261:16: error strings should not be capitalized (ST1005) - [x] protos/tcp/tcp.go:291:6: func tcpSeqBefore is unused (U1000) - [ ] protos/tcp/tcp.go:309:17: error strings should not be capitalized (ST1005) - [x] protos/tcp/tcp_test.go:200:76: redundant return statement (S1023) - [ ] protos/thrift/thrift.go:272:10: error strings should not be capitalized (ST1005) - [ ] protos/thrift/thrift.go:279:10: error strings should not be capitalized (ST1005) - [x] protos/thrift/thrift_idl.go:52:28: should use make([]*string, max + 1) instead (S1019) - [ ] protos/thrift/thrift_idl.go:94:19: error strings should not be capitalized (ST1005) - [x] protos/thrift/thrift_test.go:125:2: this value of m is never used (SA4006) - [x] protos/thrift/thrift_test.go:133:2: this value of m is never used (SA4006) - [x] protos/thrift/thrift_test.go:153:2: this value of m is never used (SA4006) - [ ] protos/tls/alerts.go:72:15: error strings should not be capitalized (ST1005) - [ ] protos/tls/parse.go:21:2: package crypto/dsa is deprecated: DSA is a legacy algorithm, and modern alternatives such as Ed25519 (implemented by package crypto/ed25519) should be used instead. Keys with 1024-bit moduli (L1024N160 parameters) are cryptographically weak, while bigger keys are not widely supported. Note that FIPS 186-5 no longer approves DSA for signature generation. (SA1019) - [x] protos/tls/parse.go:56:2: only the first constant in this group has an explicit type (SA9004) - [x] protos/tls/parse.go:65:2: only the first constant in this group has an explicit type (SA9004) - [x] protos/tls/parse_test.go:128:6: func mapInt is unused (U1000) - [x] protos/tls/parse_test.go:175:2: this value of err is never used (SA4006) - [x] protos/tls/tls.go:175:5: don't use Yoda conditions (ST1017) - [x] protos/tls/tls_test.go:327:2: this value of err is never used (SA4006) - [x] protos/tls/tls_test.go:390:2: this value of err is never used (SA4006) - [x] protos/tls/tls_test.go:402:2: this value of err is never used (SA4006) - [x] protos/tls/tls_test.go:434:2: this value of err is never used (SA4006) - [x] protos/tls/tls_test.go:441:2: this value of err is never used (SA4006) - [ ] protos/udp/udp.go:93:17: error strings should not be capitalized (ST1005) - [x] protos/udp/udp_test.go:81:2: redundant return statement (S1023) - [ ] scripts/mage/config.go:28:2: const configTemplateGlob is unused (U1000) - [ ] scripts/mage/package.go:69:4: the surrounding loop is unconditionally terminated (SA4004) - [ ] sniffer/afpacket.go:40:19: error strings should not be capitalized (ST1005) - [ ] sniffer/afpacket_nonlinux.go:36:14: error strings should not be capitalized (ST1005) - [ ] sniffer/afpacket_nonlinux.go:40:19: error strings should not be capitalized (ST1005) - [ ] sniffer/afpacket_nonlinux.go:44:9: error strings should not be capitalized (ST1005) - [x] sniffer/device.go:65:13: the argument is already a string, there's no need to use fmt.Sprintf (S1025) - [ ] sniffer/device.go:84:15: error strings should not be capitalized (ST1005) - [ ] sniffer/device.go:89:15: error strings should not be capitalized (ST1005) - [ ] sniffer/device.go:100:14: error strings should not be capitalized (ST1005) - [ ] sniffer/file.go:82:20: error strings should not be capitalized (ST1005) - [x] sniffer/sniffer.go:42:2: field dumper is unused (U1000) - [ ] sniffer/sniffer.go:150:10: error strings should not be capitalized (ST1005) - [ ] sniffer/sniffer.go:195:11: error strings should not be capitalized (ST1005) - [ ] sniffer/sniffer.go:226:15: error strings should not be capitalized (ST1005) - [ ] sniffer/sniffer.go:250:10: error strings should not be capitalized (ST1005) - [x] sniffer/sniffer_test.go:55:2: this value of blockSize is never used (SA4006) - [x] sniffer/sniffer_test.go:55:2: this value of frameSize is never used (SA4006) - [x] sniffer/sniffer_test.go:55:2: this value of numBlocks is never used (SA4006) - [x] sniffer/sniffer_test.go:61:2: this value of err is never used (SA4006) * packetbeat/protos/amqp: clean up conditions * packetbeat/protos/cassandra: simplify ignored operations check * packetbeat/protos/icmp: simplify selector expression * packetbeat/sniffer: improve device name formatting logic * packetbeat/protos/amqp: clarify expectation for common.MapStr destination The previous code would drop data rather than fill the fields common.MapStr. This change clarifies that it is the caller's responsibility to provide a valid destination. * packetbeat: apply condition simplification staticcheck quickfix suggestions - [ ] flows/table.go:88:21: could remove embedded field "rawFlowID" from selector (QF1008) - [x] pb/event.go:240:2: could use tagged switch on f.Network.Transport (QF1002) - [x] protos/cassandra/config.go:48:5: could apply De Morgan's law (QF1001) - [x] protos/cassandra/internal/gocql/array_decoder.go:166:5: could apply De Morgan's law (QF1001) - [x] protos/cassandra/internal/gocql/stream_decoder.go:152:5: could apply De Morgan's law (QF1001) - [ ] protos/dhcpv4/dhcpv4.go:80:11: could remove embedded field "dhcpv4Config" from selector (QF1008) - [ ] protos/memcache/memcache.go:183:5: could remove embedded field "tcpConfig" from selector (QF1008) - [x] protos/memcache/memcache.go:257:3: could use tagged switch on prev.command.code (QF1003) - [ ] protos/memcache/memcache.go:377:4: could remove embedded field "Transaction" from selector (QF1008) - [ ] protos/memcache/plugin_tcp.go:115:4: could remove embedded field "Stream" from selector (QF1008) - [ ] protos/memcache/plugin_tcp.go:443:9: could remove embedded field "Stream" from selector (QF1008) - [x] protos/mongodb/mongodb.go:345:4: could use tagged switch on t.method (QF1003) - [x] protos/mysql/mysql.go:688:4: could use tagged switch on msg.typ (QF1003) - [x] protos/mysql/mysql.go:698:3: could use tagged switch on msg.typ (QF1003) - [ ] protos/redis/redis.go:120:4: could remove embedded field "Stream" from selector (QF1008) - [ ] protos/redis/redis.go:237:4: could remove embedded field "Stream" from selector (QF1008) - [ ] protos/redis/redis_test.go:215:5: could remove embedded field "Stream" from selector (QF1008) - [ ] protos/redis/redis_test.go:255:6: could remove embedded field "Stream" from selector (QF1008) - [x] protos/sip/parser.go:272:5: could apply De Morgan's law (QF1001) - [ ] protos/tls/parse.go:552:18: could remove embedded field "Parameters" from selector (QF1008) - [ ] protos/tls/tls.go:226:4: could remove embedded field "Stream" from selector (QF1008) Embedded field selector simplification are not applied because in many cases these probably should not be embedded fields or they clarify the intention. (cherry picked from commit 74bc6cd)

* upstream/master: (577 commits) Remove Journalbeat (elastic#29131) Add note that there is no warranty or support for generator code (elastic#28797) packetbeat: preparation for npcap addition (elastic#29017) Use the generic helper for opening file to read in filestream (elastic#29180) Workflow for macos (elastic#29174) Fix `decode_json_fields` processor to always add error key (elastic#29107) Workflow for macos (elastic#29156) Fix agent download timeout values in yaml files (elastic#29039) Added workflow file for builds with macos (elastic#29148) CI: enable AWS cloud testing on a PR basis if changes in certain files (elastic#29047) Remove links to Journalbeat (elastic#29134) Fix rds metadata in cloudwatch metricset (elastic#29106) [mergify]: notify conflicts in PRs that are still open (elastic#29122) Use NamedWatcher in Agent's k8s provider (elastic#29095) override host on statsd metricset (elastic#29103) Skip config check in autodiscover for duplicated configurations (elastic#29048) Change "filebeat.config.modules.enabled" to "true" (elastic#28769) Remove deprecated spool queue from Beats (elastic#28869) Add `beat` field back to beat.stats (elastic#29094) Revert "Move labels and annotations under kubernetes.namespace. (elastic#27917)" (elastic#29069) ...

* packetbeat: run gofmt -s * packetbeat/protos/tls: prep for gofumpt * packetbeat: run gofumpt * packetbeat: clean up lint Address the following output from staticcheck. Checked lines are fixed here. - [ ] beater/processor.go:143:15: error strings should not be capitalized (ST1005) - [ ] decoder/decoder.go:142:15: error strings should not be capitalized (ST1005) - [ ] flows/flowid_test.go:57:6: func addUDP is unused (U1000) - [x] flows/flows_test.go:58:2: this value of err is never used (SA4006) - [x] flows/flows_test.go:59:2: this value of err is never used (SA4006) - [x] flows/flows_test.go:60:2: this value of err is never used (SA4006) - [x] flows/flows_test.go:61:2: this value of err is never used (SA4006) - [x] flows/flows_test.go:62:2: this value of err is never used (SA4006) - [x] flows/worker.go:110:17: should use time.Until instead of t.Sub(time.Now()) (S1024) - [ ] pb/event.go:435:13: error strings should not be capitalized (ST1005) - [x] procs/procs.go:216:55: should use time.Since instead of time.Now().Sub (S1012) - [x] protos/amqp/amqp.go:90:5: should omit comparison to bool constant, can be simplified to !amqp.hideConnectionInformation (S1002) - [ ] protos/amqp/amqp_fields.go:48:4: this value of fields is never used (SA4006) **BUG** - [ ] protos/amqp/amqp_fields.go:73:4: this value of fields is never used (SA4006) **BUG** - [x] protos/amqp/amqp_parser.go:77:22: func (*amqpStream).prepareForNewMessage is unused (U1000) - [x] protos/amqp/amqp_parser.go:162:5: should omit comparison to bool constant, can be simplified to amqp.parseHeaders (S1002) - [x] protos/amqp/amqp_parser.go:345:12: should omit comparison to bool constant, can be simplified to m.isRequest (S1002) - [x] protos/amqp/amqp_parser.go:347:12: should omit comparison to bool constant, can be simplified to !m.isRequest (S1002) - [x] protos/amqp/amqp_parser.go:353:9: should omit comparison to bool constant, can be simplified to amqp.hideConnectionInformation (S1002) - [x] protos/amqp/amqp_test.go:672:2: this value of private is never used (SA4006) - [x] protos/amqp/amqp_test.go:739:2: this value of private is never used (SA4006) - [x] protos/cassandra/cassandra.go:203:25: func (*connection).dropStreams is unused (U1000) - [ ] protos/cassandra/internal/gocql/array_decoder.go:29:6: func readInt is unused (U1000) - [ ] protos/cassandra/internal/gocql/marshal.go:279:6: func getApacheCassandraType is unused (U1000) - [x] protos/cassandra/internal/gocql/marshal.go:352:7: receiver name should be a reflection of its identity; don't use generic names such as "this" or "self" (ST1006) - [ ] protos/cassandra/internal/gocql/marshal.go:569:2: const flagValues is unused (U1000) - [ ] protos/cassandra/internal/gocql/marshal.go:570:2: const flagSkipMetaData is unused (U1000) - [ ] protos/cassandra/internal/gocql/marshal.go:571:2: const flagPageSize is unused (U1000) - [ ] protos/cassandra/internal/gocql/marshal.go:572:2: const flagWithPagingState is unused (U1000) - [ ] protos/cassandra/internal/gocql/marshal.go:573:2: const flagWithSerialConsistency is unused (U1000) - [ ] protos/cassandra/internal/gocql/marshal.go:574:2: const flagDefaultTimestamp is unused (U1000) - [ ] protos/cassandra/internal/gocql/marshal.go:575:2: const flagWithNameValues is unused (U1000) - [x] protos/cassandra/parser.go:72:2: field transactionTimeout is unused (U1000) - [ ] protos/cassandra/parser.go:79:22: error strings should not be capitalized (ST1005) - [x] protos/cassandra/pub.go:36:2: field ignoredOps is unused (U1000) - [ ] protos/dhcpv4/option_ip_addresses.go:42:15: error strings should not be capitalized (ST1005) - [x] protos/dns/dns.go:68:2: const query is unused (U1000) - [x] protos/dns/dns.go:69:2: const response is unused (U1000) - [x] protos/dns/dns.go:206:2: field responseTime is unused (U1000) - [x] protos/http/http.go:929:24: func (*messageList).last is unused (U1000) - [ ] protos/http/http_parser.go:264:18: error strings should not be capitalized (ST1005) - [ ] protos/http/http_parser.go:271:16: error strings should not be capitalized (ST1005) - [x] protos/http/http_test.go:59:22: func (*eventStore).empty is unused (U1000) - [x] protos/http/http_test.go:541:2: this value of msg is never used (SA4006) - [x] protos/http/http_test.go:647:2: this value of complete is never used (SA4006) - [x] protos/http/http_test.go:647:2: this value of ok is never used (SA4006) - [x] protos/http/http_test.go:653:2: this value of complete is never used (SA4006) - [x] protos/http/http_test.go:653:2: this value of ok is never used (SA4006) - [x] protos/http/http_test.go:658:2: this value of complete is never used (SA4006) - [x] protos/http/http_test.go:658:2: this value of ok is never used (SA4006) - [x] protos/http/http_test.go:673:2: this value of complete is never used (SA4006) - [x] protos/http/http_test.go:673:2: this value of ok is never used (SA4006) - [x] protos/icmp/icmp.go:260:25: func (*icmpPlugin).getTransaction is unused (U1000) - [ ] protos/icmp/message.go:93:2: logp.WTF is deprecated: Use logp.NewLogger and its Panic or DPanic methods. (SA1019) - [ ] protos/icmp/message.go:104:2: logp.WTF is deprecated: Use logp.NewLogger and its Panic or DPanic methods. (SA1019) - [ ] protos/icmp/message.go:115:2: logp.WTF is deprecated: Use logp.NewLogger and its Panic or DPanic methods. (SA1019) - [ ] protos/icmp/message.go:136:2: logp.WTF is deprecated: Use logp.NewLogger and its Panic or DPanic methods. (SA1019) - [ ] protos/icmp/message.go:147:2: logp.WTF is deprecated: Use logp.NewLogger and its Panic or DPanic methods. (SA1019) - [x] protos/memcache/binary.go:31:6: type memcacheMagic is unused (U1000) - [x] protos/memcache/binary.go:60:2: var extraValue is unused (U1000) - [ ] protos/memcache/errors.go:26:5: var errNotImplemented is unused (U1000) - [ ] protos/memcache/errors.go:33:2: var errExpectedNumber is unused (U1000) - [ ] protos/memcache/errors.go:35:2: var errExpectedCRLF is unused (U1000) - [ ] protos/memcache/errors.go:54:2: var errResponseUnknownTransaction is unused (U1000) - [x] protos/memcache/parse.go:29:2: const codeSpace is unused (U1000) - [x] protos/memcache/parse.go:29:2: only the first constant in this group has an explicit type (SA9004) - [x] protos/memcache/parse.go:30:2: const codeTab is unused (U1000) - [x] protos/memcache/plugin_tcp.go:63:7: const defaultTCPTransDuration is unused (U1000) - [ ] protos/memcache/plugin_tcp.go:377:4: logp.WTF is deprecated: Use logp.NewLogger and its Panic or DPanic methods. (SA1019) - [x] protos/memcache/text.go:410:6: func makeValue2Arg is unused (U1000) - [x] protos/mongodb/mongodb_parser.go:118:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:119:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:120:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:165:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:166:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:167:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:169:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:181:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:232:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:233:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:236:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:237:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:277:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:278:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:279:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:290:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:291:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:292:2: this value of err is never used (SA4006) - [ ] protos/mongodb/mongodb_parser.go:401:13: error strings should not be capitalized (ST1005) - [x] protos/mongodb/mongodb_parser.go:436:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_parser.go:461:2: this value of err is never used (SA4006) - [ ] protos/mongodb/mongodb_parser.go:470:24: error strings should not be capitalized (ST1005) - [x] protos/mongodb/mongodb_test.go:163:2: this value of err is never used (SA4006) - [x] protos/mongodb/mongodb_test.go:174:2: this value of err is never used (SA4006) - [x] protos/mysql/mysql.go:65:2: field fields is unused (U1000) - [x] protos/mysql/mysql.go:66:2: field rows is unused (U1000) - [x] protos/mysql/mysql.go:86:2: field params is unused (U1000) - [x] protos/mysql/mysql.go:944:4: empty branch (SA9003) - [x] protos/mysql/mysql_test.go:52:22: func (*eventStore).empty is unused (U1000) - [x] protos/mysql/mysql_test.go:679:3: this value of private is never used (SA4006) - [x] protos/nfs/xdr.go:43:15: func (*xdr).getInt is unused (U1000) - [x] protos/nfs/xdr.go:55:15: func (*xdr).getHyper is unused (U1000) - [x] protos/pgsql/pgsql.go:432:5: should omit nil check; len() for nil slices is defined as zero (S1009) - [x] protos/pgsql/pgsql_test.go:49:22: func (*eventStore).empty is unused (U1000) - [x] protos/protos_test.go:74:2: redundant return statement (S1023) - [x] protos/protos_test.go:103:2: redundant return statement (S1023) - [ ] protos/sip/parser.go:254:18: error strings should not be capitalized (ST1005) - [ ] protos/sip/parser.go:261:16: error strings should not be capitalized (ST1005) - [x] protos/tcp/tcp.go:291:6: func tcpSeqBefore is unused (U1000) - [ ] protos/tcp/tcp.go:309:17: error strings should not be capitalized (ST1005) - [x] protos/tcp/tcp_test.go:200:76: redundant return statement (S1023) - [ ] protos/thrift/thrift.go:272:10: error strings should not be capitalized (ST1005) - [ ] protos/thrift/thrift.go:279:10: error strings should not be capitalized (ST1005) - [x] protos/thrift/thrift_idl.go:52:28: should use make([]*string, max + 1) instead (S1019) - [ ] protos/thrift/thrift_idl.go:94:19: error strings should not be capitalized (ST1005) - [x] protos/thrift/thrift_test.go:125:2: this value of m is never used (SA4006) - [x] protos/thrift/thrift_test.go:133:2: this value of m is never used (SA4006) - [x] protos/thrift/thrift_test.go:153:2: this value of m is never used (SA4006) - [ ] protos/tls/alerts.go:72:15: error strings should not be capitalized (ST1005) - [ ] protos/tls/parse.go:21:2: package crypto/dsa is deprecated: DSA is a legacy algorithm, and modern alternatives such as Ed25519 (implemented by package crypto/ed25519) should be used instead. Keys with 1024-bit moduli (L1024N160 parameters) are cryptographically weak, while bigger keys are not widely supported. Note that FIPS 186-5 no longer approves DSA for signature generation. (SA1019) - [x] protos/tls/parse.go:56:2: only the first constant in this group has an explicit type (SA9004) - [x] protos/tls/parse.go:65:2: only the first constant in this group has an explicit type (SA9004) - [x] protos/tls/parse_test.go:128:6: func mapInt is unused (U1000) - [x] protos/tls/parse_test.go:175:2: this value of err is never used (SA4006) - [x] protos/tls/tls.go:175:5: don't use Yoda conditions (ST1017) - [x] protos/tls/tls_test.go:327:2: this value of err is never used (SA4006) - [x] protos/tls/tls_test.go:390:2: this value of err is never used (SA4006) - [x] protos/tls/tls_test.go:402:2: this value of err is never used (SA4006) - [x] protos/tls/tls_test.go:434:2: this value of err is never used (SA4006) - [x] protos/tls/tls_test.go:441:2: this value of err is never used (SA4006) - [ ] protos/udp/udp.go:93:17: error strings should not be capitalized (ST1005) - [x] protos/udp/udp_test.go:81:2: redundant return statement (S1023) - [ ] scripts/mage/config.go:28:2: const configTemplateGlob is unused (U1000) - [ ] scripts/mage/package.go:69:4: the surrounding loop is unconditionally terminated (SA4004) - [ ] sniffer/afpacket.go:40:19: error strings should not be capitalized (ST1005) - [ ] sniffer/afpacket_nonlinux.go:36:14: error strings should not be capitalized (ST1005) - [ ] sniffer/afpacket_nonlinux.go:40:19: error strings should not be capitalized (ST1005) - [ ] sniffer/afpacket_nonlinux.go:44:9: error strings should not be capitalized (ST1005) - [x] sniffer/device.go:65:13: the argument is already a string, there's no need to use fmt.Sprintf (S1025) - [ ] sniffer/device.go:84:15: error strings should not be capitalized (ST1005) - [ ] sniffer/device.go:89:15: error strings should not be capitalized (ST1005) - [ ] sniffer/device.go:100:14: error strings should not be capitalized (ST1005) - [ ] sniffer/file.go:82:20: error strings should not be capitalized (ST1005) - [x] sniffer/sniffer.go:42:2: field dumper is unused (U1000) - [ ] sniffer/sniffer.go:150:10: error strings should not be capitalized (ST1005) - [ ] sniffer/sniffer.go:195:11: error strings should not be capitalized (ST1005) - [ ] sniffer/sniffer.go:226:15: error strings should not be capitalized (ST1005) - [ ] sniffer/sniffer.go:250:10: error strings should not be capitalized (ST1005) - [x] sniffer/sniffer_test.go:55:2: this value of blockSize is never used (SA4006) - [x] sniffer/sniffer_test.go:55:2: this value of frameSize is never used (SA4006) - [x] sniffer/sniffer_test.go:55:2: this value of numBlocks is never used (SA4006) - [x] sniffer/sniffer_test.go:61:2: this value of err is never used (SA4006) * packetbeat/protos/amqp: clean up conditions * packetbeat/protos/cassandra: simplify ignored operations check * packetbeat/protos/icmp: simplify selector expression * packetbeat/sniffer: improve device name formatting logic * packetbeat/protos/amqp: clarify expectation for common.MapStr destination The previous code would drop data rather than fill the fields common.MapStr. This change clarifies that it is the caller's responsibility to provide a valid destination. * packetbeat: apply condition simplification staticcheck quickfix suggestions - [ ] flows/table.go:88:21: could remove embedded field "rawFlowID" from selector (QF1008) - [x] pb/event.go:240:2: could use tagged switch on f.Network.Transport (QF1002) - [x] protos/cassandra/config.go:48:5: could apply De Morgan's law (QF1001) - [x] protos/cassandra/internal/gocql/array_decoder.go:166:5: could apply De Morgan's law (QF1001) - [x] protos/cassandra/internal/gocql/stream_decoder.go:152:5: could apply De Morgan's law (QF1001) - [ ] protos/dhcpv4/dhcpv4.go:80:11: could remove embedded field "dhcpv4Config" from selector (QF1008) - [ ] protos/memcache/memcache.go:183:5: could remove embedded field "tcpConfig" from selector (QF1008) - [x] protos/memcache/memcache.go:257:3: could use tagged switch on prev.command.code (QF1003) - [ ] protos/memcache/memcache.go:377:4: could remove embedded field "Transaction" from selector (QF1008) - [ ] protos/memcache/plugin_tcp.go:115:4: could remove embedded field "Stream" from selector (QF1008) - [ ] protos/memcache/plugin_tcp.go:443:9: could remove embedded field "Stream" from selector (QF1008) - [x] protos/mongodb/mongodb.go:345:4: could use tagged switch on t.method (QF1003) - [x] protos/mysql/mysql.go:688:4: could use tagged switch on msg.typ (QF1003) - [x] protos/mysql/mysql.go:698:3: could use tagged switch on msg.typ (QF1003) - [ ] protos/redis/redis.go:120:4: could remove embedded field "Stream" from selector (QF1008) - [ ] protos/redis/redis.go:237:4: could remove embedded field "Stream" from selector (QF1008) - [ ] protos/redis/redis_test.go:215:5: could remove embedded field "Stream" from selector (QF1008) - [ ] protos/redis/redis_test.go:255:6: could remove embedded field "Stream" from selector (QF1008) - [x] protos/sip/parser.go:272:5: could apply De Morgan's law (QF1001) - [ ] protos/tls/parse.go:552:18: could remove embedded field "Parameters" from selector (QF1008) - [ ] protos/tls/tls.go:226:4: could remove embedded field "Stream" from selector (QF1008) Embedded field selector simplification are not applied because in many cases these probably should not be embedded fields or they clarify the intention. (cherry picked from commit 74bc6cd) Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com>

* upstream/master: [libbeat] Fix add_labels flattening of arrays values (elastic#29211) Change elastic-agent pprof default to false (elastic#29155) elastic#28472 fix flaky tests in libbeat fmtstr to use time.UTC instead of time.Local (elastic#28473) Adopt `parsers` in Filebeat's journald input (elastic#29070) [Elastic Agent] Add process error handling guidelines (elastic#29152) winlogbeat/sys/winevent: use reflect IsZero method (elastic#29190) Remove Journalbeat (elastic#29131) Add note that there is no warranty or support for generator code (elastic#28797) packetbeat: preparation for npcap addition (elastic#29017) Use the generic helper for opening file to read in filestream (elastic#29180) Workflow for macos (elastic#29174) Fix `decode_json_fields` processor to always add error key (elastic#29107)

efd6 added 7 commits November 18, 2021 11:16

packetbeat: run gofmt -s

e5db55d

[git-generate] gofmt -w -s ./packetbeat

packetbeat/protos/tls: prep for gofumpt

2c125b4

packetbeat: run gofumpt

1f3d7b6

Note that a recent gofumpt is required since the latest release panics in procs/zsyscall_windows.go. [git-generate] go install mvdan.cc/gofumpt@7ca7e6c gofumpt -w ./packetbeat

packetbeat/protos/amqp: clean up conditions

02f473e

packetbeat/protos/cassandra: simplify ignored operations check

fb62b48

packetbeat/protos/icmp: simplify selector expression

6b90585

efd6 added bug cleanup Team:Security-External Integrations backport-v8.0.0 Automated backport with mergify 8.1 candidate labels Nov 18, 2021

botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Nov 18, 2021

efd6 added 2 commits November 18, 2021 14:23

packetbeat/sniffer: improve device name formatting logic

ada33a1

packetbeat/protos/amqp: clarify expectation for common.MapStr destina…

5d98c13

…tion The previous code would drop data rather than fill the fields common.MapStr. This change larifies that it is the caller's responsibility to provide a valid destination.

efd6 marked this pull request as ready for review November 18, 2021 07:22

efd6 requested a review from a team as a code owner November 18, 2021 07:22

This was referenced Nov 24, 2021

x-pack/packetbeat: install Npcap at start-up when required #29112

Merged

libbeat,packetbeat,x-pack/filebeat/input/netflow: unify gopacket dependencies #29167

Merged

andrewkroh approved these changes Nov 29, 2021

View reviewed changes

add CHANGELOG notes

a41fd11

efd6 force-pushed the packetbeat/gardening branch from 2a66926 to a41fd11 Compare November 29, 2021 23:37

efd6 merged commit 74bc6cd into elastic:master Nov 30, 2021

efd6 deleted the packetbeat/gardening branch November 30, 2021 01:07

mergify bot mentioned this pull request Nov 30, 2021

[8.0](backport #29017) packetbeat: preparation for npcap addition #29186

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

packetbeat: preparation for npcap addition #29017

packetbeat: preparation for npcap addition #29017

efd6 commented Nov 18, 2021 •

edited

Loading

elasticmachine commented Nov 18, 2021 •

edited by jenkins-beats-ci bot

Loading

Build stats

Test stats 🧪

elasticmachine commented Nov 18, 2021

andrewkroh left a comment

efd6 commented Nov 29, 2021

efd6 commented Nov 29, 2021

efd6 commented Nov 29, 2021

andrewkroh commented Nov 30, 2021

packetbeat: preparation for npcap addition #29017

packetbeat: preparation for npcap addition #29017

Conversation

efd6 commented Nov 18, 2021 • edited Loading

What does this PR do?

Why is it important?

Checklist

Author's Checklist

How to test this PR locally

Related issues

Use cases

Screenshots

Logs

elasticmachine commented Nov 18, 2021 • edited by jenkins-beats-ci bot Loading

💚 Build Succeeded

Build stats

Test stats 🧪

💚 Flaky test report

🤖 GitHub comments

elasticmachine commented Nov 18, 2021

andrewkroh left a comment

Choose a reason for hiding this comment

efd6 commented Nov 29, 2021

efd6 commented Nov 29, 2021

efd6 commented Nov 29, 2021

andrewkroh commented Nov 30, 2021

efd6 commented Nov 18, 2021 •

edited

Loading

elasticmachine commented Nov 18, 2021 •

edited by jenkins-beats-ci bot

Loading