[fortinet_fortigate] Fix NPE in VPN swap script for admin events. - #20399
Conversation
ie-ops
added
bugfix
|
Pinging @elastic/integration-experience (Team:Integration-Experience) |
✅ Elastic Docs Style Checker (Vale)No issues found on modified lines! The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
|
✅ All changelog entries have the correct PR link. |
|
No issues across the latest commits f8a844b.
🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills
|
🚀 Benchmarks reportTo see the full report comment with |
💚 Build Succeeded
|
|
Tick the box to add this pull request to the merge queue (same as
|
|
Package fortinet_fortigate - 1.36.9 containing this change is available at https://epr.elastic.co/package/fortinet_fortigate/1.36.9/ |
3 participants
Executive summary
A NullPointerException was thrown in the VPN swap script processor when processing administrative VPN events (e.g., SSL setting changes via ha_daemon) that carry no srcip or dstip fields. In those cases ctx.destination is never populated, so the assignment ctx.source = ctx.destination silently sets ctx.source to null; the subsequent ctx.source.user = tmp.user then throws. The fix inserts a null guard immediately after the swap assignment to initialize ctx.source to an empty map before any field access, preventing the NPE while still correctly preserving the user field from the original source context.
Proposed commit message
Root cause
The script processor (tag: script_345a587b) swaps ctx.source and ctx.destination for all VPN subtype events, but administrative VPN events (e.g. logid 0101041988, logdesc='SSL setting changed') carry no IP address fields, leaving ctx.destination null after earlier ECS-mapping processors. The script then assigns ctx.source = null and subsequently attempts ctx.source.user = tmp.user, throwing a NullPointerException because ctx.source is null.
Approach
In the Painless script (tag: script_345a587b) in event.yml, add a null-initialiser for ctx.source immediately after the swap assignment so that when ctx.destination is null (i.e., no IP address fields present for administrative VPN events like 'SSL setting changed'), the subsequent user-copy block does not throw a NullPointerException. Specifically, insert
if (ctx.source == null) { ctx.source = [:]; }afterctx.source = ctx.destination;. Also add a new pipeline test fixture containing the sanitized administrative VPN event to exercise this branch. The on_failure handler already uses correct Mustache syntax so no change is needed there.Implementation
ctx.source = ctx.destination;, insertif (ctx.source == null) { ctx.source = [:]; }so that the user-copy block operates on a valid (possibly empty) map rather than null.<190>date=2026-06-26 time=10:54:36 devname="device-name-example-001" devid="SN000000000001" eventtime=1782482075598222761 tz="-0300" logid="0101041988" type="event" subtype="vpn" level="information" vd="root" logdesc="SSL setting changed" action="info" user="admin.access" ui="ha_daemon" msg="User changed SSL setting"to packages/fortinet_fortigate/data_stream/log/_dev/test/pipeline/test-fortinet-7-4.log.elastic-package test pipeline --generate(or manually craft the expected JSON) to confirm no pipeline_error is set and source.user.name is 'admin.access'.elastic-package test pipelineto confirm the new test fixture passes and no existing fixtures regress.Pipeline changes
ctx.source = ctx.destination;, addif (ctx.source == null) { ctx.source = [:]; }to prevent NPE when ctx.destination is null for administrative VPN events without IP fields.Field / mapping changes
—
Sanitized error message
Processor 'script' with tag 'script_345a587b' in pipeline 'logs-fortinet_fortigate.log-event' failed with message '[on_failure_message]'Sanitized log (
event_sanitizedexcerpt)<190>date=2026-06-26 time=10:54:36 devname="device-name-example-001" devid="SN000000000001" eventtime=1782482075598222761 tz="-0300" logid="0101041988" type="event" subtype="vpn" level="information" vd="root" logdesc="SSL setting changed" action="info" user="admin.access" ui="ha_daemon" msg="User changed SSL setting"Reviewer concerns
• If an event has no srcip, no dstip, and no user field, the swap script will now leave ctx.source as an empty map {}. Depending on whether later processors clean up empty objects, this could result in a sparse source:{} field being indexed in edge-case documents — benign but worth verifying with additional log samples from similar administrative events.
• The changelog PR link is a placeholder (#1) and must be updated to the real PR URL before merging.
Self-review findings
—
Risk and classification
Links
2deb93dffd8edb60