[Packetbeat] rpc fragment bounds checking #47803
Open
+339
−86
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This test caused a crash prior to this PR
pcap captured when running the following:
```bash
nc -l 12049 >/dev/null
```
and in a different shell
```python
import socket, struct, time
dest = ("127.0.0.1", 12049)
frag_header = struct.pack("!I", 0x80000001)
payload = b"\x00"
with socket.create_connection(dest, timeout=5) as sock:
sock.sendall(frag_header + payload)
time.sleep(0.2)
```
botelastic
bot
added
the
needs_team
Contributor
🤖 GitHub commentsJust comment with:
|
Contributor
|
This pull request does not have a backport label.
To fixup this pull request, you need to add the backport labels for the needed
|
nicholasberlin
added
the
Team:Security-Linux Platform
Contributor
|
Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform) |
botelastic
bot
removed
the
needs_team
nicholasberlin
added
backport-8.19
| # If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added. | ||
| # NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number. | ||
| # Please provide it if you are adding a fragment for a different PR. | ||
| # pr: https://github.com/owner/repo/1234 |
Contributor
There was a problem hiding this comment.
Suggested change
| # pr: https://github.com/owner/repo/1234 | |
| pr: https://github.com/elastic/beats/pull/47803 |
| # OPTIONAL to manually add other issue URLs | ||
| # Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of). | ||
| # If not present is automatically filled by the tooling with the issue linked to the PR number. | ||
| # issue: https://github.com/owner/repo/1234 |
Contributor
There was a problem hiding this comment.
Does a public issue for this one exist?
| if _, err := xdr.getUInt(); err != nil { | ||
| return err | ||
| } | ||
| } |
Contributor
There was a problem hiding this comment.
will adding here return nil be better for consistency?
Comment on lines
+40
to
+58
| v, err := xdr.getUInt() | ||
| require.NoError(t, err) | ||
| assert.Equal(t, uint32(0x800000e0), v) | ||
|
|
||
| v, err = xdr.getUInt() | ||
| require.NoError(t, err) | ||
| assert.Equal(t, uint32(0xb54921ab), v) | ||
|
|
||
| hv, err := xdr.getUHyper() | ||
| require.NoError(t, err) | ||
| assert.Equal(t, uint64(2), hv) | ||
|
|
||
| v, err = xdr.getUInt() | ||
| require.NoError(t, err) | ||
| assert.Equal(t, uint32(4), v) | ||
|
|
||
| str, err := xdr.getString() | ||
| require.NoError(t, err) | ||
| assert.Equal(t, "test string", str) |
Contributor
There was a problem hiding this comment.
Would it be nice to add cases when there are errors? Not only happy path
(I guess you did this with the python test and pcap below, right? Asking also about the unit test if it would make sense to add failure scenarios)
mykola-elastic
approved these changes
Nov 27, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed commit message
When the NFS protocol is enabled in Packetbeat, crafted ONC RPC/NFS traffic can cause the application to panic and exit due to unchecked XDR length fields and undersized RPC records. This affects both request and reply parsing paths.
This PR adds bounds checking and ignores malformed fragments via new error propagation.
Checklist
I have made corresponding changes to the documentationI have made corresponding change to the default configuration filesstresstest.shscript to run them under stress conditions and race detector to verify their stability../changelog/fragmentsusing the changelog tool.Author's Checklist
How to test this PR locally
There is a new test included in this PR, could revert the changes of the first commit and run the tests and see things go sideways.