Add header validation regexp

Author: limhud

lib/logstash/filters/sip.rb

@@ -46,6 +46,9 @@ class LogStash::Filters::SIP < LogStash::Filters::Base
   # An array specifying the headers/values to not add to the event
   config :exclude_keys, :validate => :array, :default => []
 
+  # A regex to validate headers
+  config :header_regex, :validate => :string, :default => '.*'
+
   class InvalidURIError < StandardError; end
 
   public
@@ -97,7 +100,7 @@ def parse_uri(name, text)
     return parts
   end
 
-  def parse(text, fields)
+  def parse(event_id, text, fields)
     # replace "\r\n" for new-lines, and strip leading whitespace
     text = text.gsub("\r\n", "\n")
     # replace ^M for new-lines, and strip leading whitespace
@@ -131,13 +134,14 @@ def parse(text, fields)
     end
 
     # process the headers (name : value)
+    header_regex = Regexp.new(@header_regex)
     if parts.length > 1
       fields['headers'] = parts[1]
       headers = parts[1].split("\n")
       headers.each do |header|
         name, value = header.split(':', 2)
-        if name.nil? || value.nil?
-          @logger.debug? and @logger.debug("invalid header: <#{header}>")
+        if !(header_regex.match(header)) || name.nil? || value.nil?
+          @logger.warn("invalid header in #{event_id}: <#{header}>")
           next
         end
         name = name.strip.downcase.gsub('-', '_')
@@ -156,20 +160,21 @@ def parse(text, fields)
       end
     end
     #print "SIP fields: ", fields, "\n"
-    @logger.debug? and @logger.debug("SIP fields ", fields)
+    @logger.debug? and @logger.debug("SIP fields for #{event_id}", fields)
   end
 
   public
   def filter(event)
     fields = Hash.new
     value = event.get(@source)
+    event_id = event.get('_id')
 
     case value
     when nil
       # Nothing to do
     when String
       begin
-        parse(value, fields)
+        parse(event_id, value, fields)
       rescue => e
         event.tag("_sipparsefailure")
         @logger.error("Failed to parse SIP message (#{e.backtrace.first}: #{e.message} / #{e.class})", :value => value)