Skip to content

Fluent bit syslog input should not emit IPv4-mapped IPv6-addresses when using source_address_key #11560

@pv2b

Description

@pv2b

Bug Report

Describe the bug
When binding to :: rather than 127.0.0.1, to support dual stack operations, you would not expect the source_address_key changing, but it does, because inet_ntop doesn't properly detect IPv4-mapped IPv6 addresses, retulting in IP addresses like ::ffff:192.0.2.123 rather than 192.0.2.123 in the source_address_key output.

[0] syslog: [[1773567148.159789000, {}], {"pri"=>"13", "time"=>"2026-03-15T09:32:28.159789+00:00", "host"=>"ace7e86ecd9f", "ident"=>"fluent-bit", "pid"=>"-", "msgid"=>"-", "extradata"=>"[timeQuality tzKnown="1" isSynced="1" syncAccuracy="465500"]", "message"=>"hello there", "source"=>"udp://::ffff:127.0.0.1:56402"}]

(Also note that there are no brackets around the IPv6 literal, this is a seperate bug #11558, this bug is to make it not use IPv4-mapped IPv6-addresses at all in this case.)

To Reproduce

  • Steps to reproduce the problem:

Create a fluent bit configuration like this test one:

[SERVICE]
    flush        1
    daemon       Off
    log_level    info
    parsers_file ../conf/parsers.conf

[INPUT]
    name         syslog
    tag          syslog
    listen       ::
    mode         udp
    parser       syslog-rfc5424
    source_address_key source

[OUTPUT]
    name         stdout
    match        *

Run fluent bit with this configuration using a command similar to ../build/bin/fluent-bit -c syslog-to-stdout.conf

Send a test message into the logger to IPv4 localhost using a command similar to logger -d -n 127.0.0.1 -P 5140 --rfc5424 "hello there"

[0] syslog: [[1773567148.159789000, {}], {"pri"=>"13", "time"=>"2026-03-15T09:32:28.159789+00:00", "host"=>"ace7e86ecd9f", "ident"=>"fluent-bit", "pid"=>"-", "msgid"=>"-", "extradata"=>"[timeQuality tzKnown="1" isSynced="1" syncAccuracy="465500"]", "message"=>"hello there", "source"=>"udp://::ffff:127.0.0.1:56402"}]

Expected behavior

Fluent bit should emit an IPv4 literal, not an IPv4-mapped IPv6 address. For example, the appropriate source URL would be udp://127.0.0.1:56402

Screenshots

Your Environment

  • Version used: Latest "master" branch of Fluent bit as of commit acad02a)
  • Configuration: See above
  • Environment name and version (e.g. Kubernetes? What version?): Dev container
  • Server type and version: n/a
  • Operating System and version: Ubuntu 25.10
  • Filters and plugins: syslog input

Additional context

This will block anyone who wants to transition from binding Fluent Bit to 0.0.0.0, to bind on :: instead, to go to dual stack, because the source address field will change.

It should possible for me to unmangle them using some kind of filter, but I shouldn't have to do it, and if I end up using a filter, it'll probably break once this is actually fixed.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions