-
Notifications
You must be signed in to change notification settings - Fork 1.9k
Description
Bug Report
Describe the bug
When binding to :: rather than 127.0.0.1, to support dual stack operations, you would not expect the source_address_key changing, but it does, because inet_ntop doesn't properly detect IPv4-mapped IPv6 addresses, retulting in IP addresses like ::ffff:192.0.2.123 rather than 192.0.2.123 in the source_address_key output.
[0] syslog: [[1773567148.159789000, {}], {"pri"=>"13", "time"=>"2026-03-15T09:32:28.159789+00:00", "host"=>"ace7e86ecd9f", "ident"=>"fluent-bit", "pid"=>"-", "msgid"=>"-", "extradata"=>"[timeQuality tzKnown="1" isSynced="1" syncAccuracy="465500"]", "message"=>"hello there", "source"=>"udp://::ffff:127.0.0.1:56402"}]
(Also note that there are no brackets around the IPv6 literal, this is a seperate bug #11558, this bug is to make it not use IPv4-mapped IPv6-addresses at all in this case.)
To Reproduce
- Steps to reproduce the problem:
Create a fluent bit configuration like this test one:
[SERVICE]
flush 1
daemon Off
log_level info
parsers_file ../conf/parsers.conf
[INPUT]
name syslog
tag syslog
listen ::
mode udp
parser syslog-rfc5424
source_address_key source
[OUTPUT]
name stdout
match *
Run fluent bit with this configuration using a command similar to ../build/bin/fluent-bit -c syslog-to-stdout.conf
Send a test message into the logger to IPv4 localhost using a command similar to logger -d -n 127.0.0.1 -P 5140 --rfc5424 "hello there"
[0] syslog: [[1773567148.159789000, {}], {"pri"=>"13", "time"=>"2026-03-15T09:32:28.159789+00:00", "host"=>"ace7e86ecd9f", "ident"=>"fluent-bit", "pid"=>"-", "msgid"=>"-", "extradata"=>"[timeQuality tzKnown="1" isSynced="1" syncAccuracy="465500"]", "message"=>"hello there", "source"=>"udp://::ffff:127.0.0.1:56402"}]
Expected behavior
Fluent bit should emit an IPv4 literal, not an IPv4-mapped IPv6 address. For example, the appropriate source URL would be udp://127.0.0.1:56402
Screenshots
Your Environment
- Version used: Latest "master" branch of Fluent bit as of commit acad02a)
- Configuration: See above
- Environment name and version (e.g. Kubernetes? What version?): Dev container
- Server type and version: n/a
- Operating System and version: Ubuntu 25.10
- Filters and plugins: syslog input
Additional context
This will block anyone who wants to transition from binding Fluent Bit to 0.0.0.0, to bind on :: instead, to go to dual stack, because the source address field will change.
It should possible for me to unmangle them using some kind of filter, but I shouldn't have to do it, and if I end up using a filter, it'll probably break once this is actually fixed.