Fix inconsistent DecodeTCPFlags output

Author: jotak

pkg/pipeline/transform/transform_network.go

@@ -141,8 +141,10 @@ func (n *Network) Transform(inputEntry config.GenericMap) (config.GenericMap, bo
 		case api.NetworkDecodeTCPFlags:
 			if anyFlags, ok := outputEntry[rule.DecodeTCPFlags.Input]; ok && anyFlags != nil {
 				if flags, err := util.ConvertToUint(anyFlags); err == nil {
-					if flags := util.DecodeTCPFlags(flags); len(flags) > 0 {
-						outputEntry[rule.DecodeTCPFlags.Output] = flags
+					strFlags := util.DecodeTCPFlags(flags)
+					// If input==output (ie. we're rewritting in place), always write the result even if empty/nil, to avoid having inconsistent output types
+					if len(strFlags) > 0 || rule.DecodeTCPFlags.Output == rule.DecodeTCPFlags.Input {
+						outputEntry[rule.DecodeTCPFlags.Output] = strFlags
 					}
 				}
 			}

pkg/pipeline/transform/transform_network_test.go

@@ -624,3 +624,29 @@ func Test_DecodeTCPFlagsDefaultValue(t *testing.T) {
 	require.True(t, ok)
 	require.Equal(t, config.GenericMap{"TcpFlags": uint(0), "TcpFlagsString": "unknown"}, flow)
 }
+
+func Test_DecodeTCPFlagsConsistentOutput(t *testing.T) {
+	dec, err := NewTransformNetwork(config.StageParam{
+		Transform: &config.Transform{
+			Network: &api.TransformNetwork{
+				Rules: []api.NetworkTransformRule{
+					{
+						Type: "decode_tcp_flags",
+						DecodeTCPFlags: &api.NetworkGenericRule{
+							Input:  "TcpFlags",
+							Output: "TcpFlags",
+						},
+					},
+				},
+			},
+		},
+	}, nil)
+	require.NoError(t, err)
+
+	var ok bool
+	flow := config.GenericMap{"TcpFlags": uint(0)}
+	flow, ok = dec.Transform(flow)
+	require.True(t, ok)
+	var nilValue []string
+	require.Equal(t, config.GenericMap{"TcpFlags": nilValue}, flow)
+}