libbeat/processors/util: make mac address rendering conform to ECS

CHANGELOG.next.asciidoc

@@ -11,6 +11,8 @@ https://github.com/elastic/beats/compare/v8.2.0\...main[Check the HEAD diff]
 *Affecting all Beats*
 
 
+- Fix namespacing on self-monitoring {pull}32336[32336]
+- Fix formatting of hardware addresses populated by the add-host-metadata processor. {issue}32264[32264] {pull}32265[32265]
 
 *Auditbeat*
 

libbeat/processors/util/netinfo.go

@@ -41,10 +41,8 @@ func GetNetInfo() (ipList []string, hwList []string, err error) {
 			continue
 		}
 
-		hw := i.HardwareAddr.String()
-		// Skip empty hardware addresses
-		if hw != "" {
-			hwList = append(hwList, hw)
+		if len(i.HardwareAddr) != 0 {
+			hwList = append(hwList, formatHardwareAddr(i.HardwareAddr))
 		}
 
 		addrs, err := i.Addrs()
@@ -67,6 +65,19 @@ func GetNetInfo() (ipList []string, hwList []string, err error) {
 	return ipList, unique(hwList), errs.Err()
 }
 
+// formatHardwareAddr formats hardware addresses according to the ECS spec.
+func formatHardwareAddr(addr net.HardwareAddr) string {
+	buf := make([]byte, 0, len(addr)*3-1)
+	for _, b := range addr {
+		if len(buf) != 0 {
+			buf = append(buf, '-')
+		}
+		const hexDigit = "0123456789ABCDEF"
+		buf = append(buf, hexDigit[b>>4], hexDigit[b&0xf])
+	}
+	return string(buf)
+}
+
 // unique returns addrs lexically sorted and with repeated elements
 // omitted.
 func unique(addrs []string) []string {

libbeat/processors/util/netinfo_test.go

@@ -18,13 +18,16 @@
 package util
 
 import (
+	"net"
 	"reflect"
+	"regexp"
 	"sort"
+	"strings"
 	"testing"
 )
 
 func TestUnique(t *testing.T) {
-	var tests = [][]string{
+	tests := [][]string{
 		{},
 		{"a"},
 		{"a", "a"},
@@ -54,3 +57,31 @@ func TestUnique(t *testing.T) {
 		}
 	}
 }
+
+func TestFormatHardwareAddr(t *testing.T) {
+	tests := []string{
+		"00:00:5e:00:53:01",
+		"02:00:5e:10:00:00:00:01",
+		"00:00:00:00:fe:80:00:00:00:00:00:00:02:00:5e:10:00:00:00:01",
+		"00-00-5e-00-53-01",
+		"02-00-5e-10-00-00-00-01",
+		"00-00-00-00-fe-80-00-00-00-00-00-00-02-00-5e-10-00-00-00-01",
+		"0000.5e00.5301",
+		"0200.5e10.0000.0001",
+		"0000.0000.fe80.0000.0000.0000.0200.5e10.0000.0001",
+	}
+
+	spec := regexp.MustCompile(`[0-9A-F]{2}(?:[0-9A-F]{2})*`)
+	for _, test := range tests {
+		addr, err := net.ParseMAC(test)
+		if err != nil {
+			t.Errorf("failed to parse test case %q", test)
+			continue
+		}
+		got := formatHardwareAddr(addr)
+		want := strings.ToUpper(strings.ReplaceAll(addr.String(), ":", "-"))
+		if got != want || !spec.MatchString(got) {
+			t.Errorf("unexpected format for %q: got:%q want:%q", test, got, want)
+		}
+	}
+}