layers/netflow: NFv9/10 flow record type fix

[msune]

This commit fixes the Python types of a number of fields defined in Netflowv9/10 for the following pre-defined fields (mostly the ones in RFC3954 https://datatracker.ietf.org/doc/html/rfc3954).

It appears that in absence of an assigned field type, it defaults to BytesField instead of IntField. Fields:

• IN_BYTES, IN_PKTS, OUT_BYTES, OUT_PKTS: IntField (4 bytes). Please note code doesn't seem to support the larget 8byte optional length.
• MUL_DST_PKTS, MUL_DST_BYTES: same as above
• INPUT_SNMP, OUTPUT_SNMP: ShortField (2 bytes), iface index. Note: code doesn't seem to support optional larger values (undefined max. length, but 8 bytes might be sufficient).

Note there are many other field types defined that are not part of the spec / unknown without field type and length.

Fixes #4810

[msune]

This comes from #4810. I've revised a number of fields.

A couple of thoughts:

• I didn't test the changes, I am just opening this Draft PR for discussion.
• I assumed this was the case, but I'd like someone to confirm:

It appears that in absence of an assigned field type, it defaults to BytesField instead of IntField. Fields:

• I am not sure which coverage exists for this layer, and where should that coverage be added (not familiar with Scapy's testing approach). Some directions might help here.

cc @gpotter2

[gpotter2]

Thanks for looking into this, we likely should try to adapt the code so that it supports NBytesField to support integer values of arbitrary lengths. Right now this code likely won't work.

[msune]

we likely should try to adapt the code so that it supports NBytesField to support integer values of arbitrary lengths. Right now this code likely won't work.

Ack. It would be good to support the 8bytes counters, as this is a commonly used thing.

[gpotter2]

Thanks again a lot for the PR and sorry for the gazillion years of wait...

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.28%. Comparing base (e3273c4) to head (dc12582).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #4813   +/-   ##
=======================================
  Coverage   80.27%   80.28%           
=======================================
  Files         375      375           
  Lines       92476    92480    +4     
=======================================
+ Hits        74238    74245    +7     
+ Misses      18238    18235    -3     

Files with missing lines	Coverage Δ
scapy/layers/netflow.py	90.57% <100.00%> (+0.11%)	⬆️

... and 4 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.