Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Mapping API: Improve IP address validation #7131

Closed
polyfractal opened this issue Aug 1, 2014 · 0 comments

Comments

Projects
None yet
3 participants
@polyfractal
Copy link
Member

commented Aug 1, 2014

When indexing IPs, the IP parser is too lenient. For example:

PUT /ipaddr/
{
  "mappings" : {
    "temp" : {
      "properties" : {
        "addr" : {
          "type" : "ip"
        }
      }
    }
  }
}

POST ipaddr/temp
{
  "addr" : "127.0.011.1111111"
}

This address is considered "valid", since the parser only checks for 4 dots. If there are four dots, the, string is split and each numeric is shifted to obtain the resulting Long. (source)

This IP is therefore "converted" into an entirely different IP:

GET ipaddr/temp/_search?search_type=count
{
  "aggs": {
    "ips": {
      "terms": {
        "field": "addr"
      }
    }
  }
}

{
...
   "aggregations": {
      "ips": {
         "buckets": [
            {
               "key": 2131820359,
               "key_as_string": "127.16.255.71",
               "doc_count": 1
            }
         ]
      }
   }
}

@spinscale spinscale self-assigned this Aug 4, 2014

@spinscale spinscale removed the adoptme label Aug 4, 2014

spinscale added a commit to spinscale/elasticsearch that referenced this issue Aug 8, 2014

Mapping API: Improve IP address validation
Until now, IP addresses were only checked for four dots, which
allowed invalid values like 127.0.0.111111

This adds an additional check for validation.

Closes elastic#7131

spinscale added a commit that referenced this issue Aug 8, 2014

Mapping API: Improve IP address validation
Until now, IP addresses were only checked for four dots, which
allowed invalid values like 127.0.0.111111

This adds an additional check for validation.

Closes #7131

@spinscale spinscale changed the title IP Parsing is not strict enough Mapping API: Improve IP address validation Aug 8, 2014

spinscale added a commit that referenced this issue Sep 8, 2014

Mapping API: Improve IP address validation
Until now, IP addresses were only checked for four dots, which
allowed invalid values like 127.0.0.111111

This adds an additional check for validation.

Closes #7131
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.