[7.12] Fix handling of non-integer port values in community_id proces…

…sor (#70236)
elastic · Mar 10, 2021 · 3bcc170 · 3bcc170
1 parent c5445b1
commit 3bcc170
Show file tree

Hide file tree

Showing 2 changed files with 43 additions and 11 deletions.
diff --git a/x-pack/plugin/ingest/src/main/java/org/elasticsearch/xpack/ingest/CommunityIdProcessor.java b/x-pack/plugin/ingest/src/main/java/org/elasticsearch/xpack/ingest/CommunityIdProcessor.java
@@ -169,17 +169,16 @@ private Flow buildFlow(IngestDocument d) {
             case Tcp:
             case Udp:
             case Sctp:
-                flow.sourcePort = parseIntFromObjectOrString(d.getFieldValue(sourcePortField, Object.class, ignoreMissing), "source port");
-                if (flow.sourcePort == 0) {
-                    throw new IllegalArgumentException("invalid source port [0]");
+                Object sourcePortValue = d.getFieldValue(sourcePortField, Object.class, ignoreMissing);
+                flow.sourcePort = parseIntFromObjectOrString(sourcePortValue, "source port");
+                if (flow.sourcePort < 1 || flow.sourcePort > 65535) {
+                    throw new IllegalArgumentException("invalid source port [" + sourcePortValue + "]");
                 }
 
-                flow.destinationPort = parseIntFromObjectOrString(
-                    d.getFieldValue(destinationPortField, Object.class, ignoreMissing),
-                    "destination port"
-                );
-                if (flow.destinationPort == 0) {
-                    throw new IllegalArgumentException("invalid destination port [0]");
+                Object destinationPortValue = d.getFieldValue(destinationPortField, Object.class, ignoreMissing);
+                flow.destinationPort = parseIntFromObjectOrString(destinationPortValue, "destination port");
+                if (flow.destinationPort < 1 || flow.sourcePort > 65535) {
+                    throw new IllegalArgumentException("invalid destination port [" + destinationPortValue + "]");
                 }
                 break;
             case Icmp:
@@ -215,7 +214,7 @@ static int parseIntFromObjectOrString(Object o, String fieldName) {
         if (o == null) {
             return 0;
         } else if (o instanceof Number) {
-            return (int) o;
+            return ((Number) o).intValue();
         } else if (o instanceof String) {
             try {
                 return Integer.parseInt((String) o);

diff --git a/...plugin/ingest/src/test/java/org/elasticsearch/xpack/ingest/CommunityIdProcessorTests.java b/...plugin/ingest/src/test/java/org/elasticsearch/xpack/ingest/CommunityIdProcessorTests.java
@@ -105,7 +105,8 @@ public void testBeatsInvalidDestinationPort() throws Exception {
         Map<String, Object> destination = (Map<String, Object>) event.get("destination");
         destination.put("port", null);
         IllegalArgumentException e = expectThrows(IllegalArgumentException.class, () -> testCommunityIdProcessor(event, null));
-        assertThat(e.getMessage(), containsString("invalid destination port [0]"));
+        // slightly modified from the beats test in that this one reports the actual invalid value rather than '0'
+        assertThat(e.getMessage(), containsString("invalid destination port [null]"));
     }
 
     public void testBeatsUnknownProtocol() throws Exception {
@@ -268,6 +269,38 @@ public void testStringAndNumber() throws Exception {
         testCommunityIdProcessor(event, "1:KF3iG9XD24nhlSy4r1TcYIr5mfE=");
     }
 
+    public void testLongsForNumericValues() throws Exception {
+        event = buildEvent();
+        @SuppressWarnings("unchecked")
+        Map<String, Object> source2 = (Map<String, Object>) event.get("source");
+        source2.put("port", 34855L);
+        testCommunityIdProcessor(event, "1:LQU9qZlK+B5F3KDmev6m5PMibrg=");
+    }
+
+    public void testFloatsForNumericValues() throws Exception {
+        event = buildEvent();
+        @SuppressWarnings("unchecked")
+        Map<String, Object> source2 = (Map<String, Object>) event.get("source");
+        source2.put("port", 34855.0);
+        testCommunityIdProcessor(event, "1:LQU9qZlK+B5F3KDmev6m5PMibrg=");
+    }
+
+    public void testInvalidPort() throws Exception {
+        event = buildEvent();
+        @SuppressWarnings("unchecked")
+        Map<String, Object> source = (Map<String, Object>) event.get("source");
+        source.put("port", 0);
+        IllegalArgumentException e = expectThrows(IllegalArgumentException.class, () -> testCommunityIdProcessor(event, null));
+        assertThat(e.getMessage(), containsString("invalid source port [0]"));
+
+        event = buildEvent();
+        @SuppressWarnings("unchecked")
+        Map<String, Object> source2 = (Map<String, Object>) event.get("source");
+        source2.put("port", 65536);
+        e = expectThrows(IllegalArgumentException.class, () -> testCommunityIdProcessor(event, null));
+        assertThat(e.getMessage(), containsString("invalid source port [65536]"));
+    }
+
     public void testIgnoreMissing() throws Exception {
         @SuppressWarnings("unchecked")
         Map<String, Object> network = (Map<String, Object>) event.get("network");