[packetbeat] panic when parsing HTTP host header with non-standard format

[moonD4rk]

For confirmed bugs, please report:

• Version: 8.9.1
• Operating System: Linux
• Discuss Forum URL: https://discuss.elastic.co/t/bug-panic-when-packetbeat-parsing-http-host-header-with-non-standard-format/342258
• Steps to Reproduce:

Summary:

Packetbeat(all version) encounters a panic when parsing HTTP requests that have a non-standard Host header. The issue occurs in the function extractHostHeader and manifests as an "index out of range" panic.

Steps to Reproduce:

1. Use Packetbeat to capture HTTP traffic.
2. Make an HTTP request where the Host header is of the form :12345 (just a port number without the hostname).

Expected Result:

Packetbeat should handle non-standard Host headers gracefully, either by ignoring them or logging an error message.

Actual Result:

Packetbeat panics with "index out of range".

panic: runtime error: index out of range [0] with length 0

goroutine 130 [running]:
*****/protos/http.extractHostHeader({0xc01cf26ea8, 0x3})
        *****/protos/http/http.go:737 +0x21b
*****/protos/http.(*httpPlugin).newTransaction(0xc0000f4f70, 0xc0073d8c80, 0xc0    073d9180)
        *****/protos/http/http.go:541 +0xbff
*****/protos/http.(*httpPlugin).correlate(0xc0000f4f70, 0xc02930e9c0)
        *****/protos/http/http.go:483 +0x111
*****/protos/http.(*httpPlugin).handleHTTP(0xc0000f4f70, 0xc02930e9c0, 0xc0073d    9180, 0x7f1aef56cf18?, 0xa0?)
        *****/protos/http/http.go:442 +0x3fb
*****/protos/http.(*httpPlugin).messageComplete(...)
        *****/protos/http/http.go:233

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[efd6]

This is confirmed by https://play.golang.com/p/63bKtUHq7Wv.

Really we should be using https://pkg.go.dev/net#SplitHostPort.

func extractHostHeader(header string) (host string, port int) {
	if header == "" || net.ParseIP(header) != nil {
		return header, port
	}
	host, ps, err := net.SplitHostPort(header)
	if err != nil {
		return header, port
	}
	host = strings.TrimPrefix(host, "[")
	host = strings.TrimSuffix(host, "]")
	pi, err := strconv.ParseInt(ps, 10, 16)
	if err != nil {
		return host, port
	}
	return host, int(pi)
}