Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Packetbeat dies after ERR Dns ParseUdp #2872

Closed
inqueue opened this issue Oct 27, 2016 · 0 comments
Closed

Packetbeat dies after ERR Dns ParseUdp #2872

inqueue opened this issue Oct 27, 2016 · 0 comments
Assignees
@andrewkroh
Labels
bug Packetbeat

Comments

@inqueue
Copy link
Member

inqueue commented Oct 27, 2016

Packetbeat 5.0
Ubuntu 10.04

2016-10-27T11:03:57Z ERR Dns ParseUdp. Recovering, but please report this: runtime error: index out of range.
2016-10-27T11:03:57Z ERR Stacktrace: goroutine 16 [running]:
runtime/debug.Stack(0xb7ffb4, 0x2b, 0xc4220b6a00)
        /usr/local/go/src/runtime/debug/stack.go:24 +0x79
github.com/elastic/beats/libbeat/logp.Recover(0xb60e89, 0xc)
        /go/src/github.com/elastic/beats/libbeat/logp/log.go:114 +0x138
panic(0xa8f300, 0xc420014090)
        /usr/local/go/src/runtime/panic.go:458 +0x243
github.com/elastic/beats/packetbeat/protos/dns.rrsToMapStrs(0xc421779340, 0x7, 0x7, 0xc4220b6d70, 0xc4211cd6d8, 0x6)
        /go/src/github.com/elastic/beats/packetbeat/protos/dns/dns.go:549 +0x451
github.com/elastic/beats/packetbeat/protos/dns.addDnsToMapStr(0xc421d41ec0, 0xc4211e4360, 0xc4220b0101)
        /go/src/github.com/elastic/beats/packetbeat/protos/dns/dns.go:486 +0x908
github.com/elastic/beats/packetbeat/protos/dns.(*Dns).publishTransaction(0xc421314e00, 0xc421de3080)
        /go/src/github.com/elastic/beats/packetbeat/protos/dns/dns.go:386 +0xb77
github.com/elastic/beats/packetbeat/protos/dns.(*Dns).receivedDnsResponse(0xc421314e00, 0xc4220b7a28, 0xc421de1c80)
        /go/src/github.com/elastic/beats/packetbeat/protos/dns/dns.go:349 +0x272
github.com/elastic/beats/packetbeat/protos/dns.(*Dns).ParseUdp(0xc421314e00, 0xc421de1b00)
        /go/src/github.com/elastic/beats/packetbeat/protos/dns/dns_udp.go:39 +0x37c
github.com/elastic/beats/packetbeat/protos/udp.(*Udp).Process(0xc4211ec460, 0xc4200ceec0, 0xc421de1b00)
        /go/src/github.com/elastic/beats/packetbeat/protos/udp/udp.go:59 +0x293
github.com/elastic/beats/packetbeat/decoder.(*DecoderStruct).onUDP(0xc420096d00, 0xc421de1b00)
        /go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:295 +0xd9
github.com/elastic/beats/packetbeat/decoder.(*DecoderStruct).process(0xc420096d00, 0xc421de1b00, 0x2d, 0xff, 0x1100aa0, 0xc420096d00)
        /go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:253 +0x299
github.com/elastic/beats/packetbeat/decoder.(*DecoderStruct).OnPacket(0xc420096d00, 0xc4200dd1ac, 0xff, 0xff, 0xc421d41aa0)
        /go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:164 +0x343
github.com/elastic/beats/packetbeat/sniffer.(*SnifferSetup).Run(0xc42131e660, 0xbcd018, 0xc421236440)
        /go/src/github.com/elastic/beats/packetbeat/sniffer/sniffer.go:371 +0x493
github.com/elastic/beats/packetbeat/beater.(*Packetbeat).Run.func2(0xc421236440, 0xc4200dd400, 0xc4200d2e40)
        /go/src/github.com/elastic/beats/packetbeat/beater/packetbeat.go:155 +0x6a
created by github.com/elastic/beats/packetbeat/beater.(*Packetbeat).Run
        /go/src/github.com/elastic/beats/packetbeat/beater/packetbeat.go:159 +0x1b2

2016-10-27T11:04:08Z INFO Non-zero metrics in the last 30s: dns.unmatched_responses=1 libbeat.logstash.publish.read_bytes=594 libbeat.publisher.published_events=190 libbeat.logstash.call_count.PublishEvents=15 libbeat.logstash.publish.write_bytes=27641 libbeat.logstash.published_and_acked_events=187 libbeat.publisher.messages_in_worker_queues=40

It runs for a while until at some point, presumably, it comes across a DNS packet it does not like. I will work on getting a pcap.
@andrewkroh andrewkroh self-assigned this Oct 27, 2016
andrewkroh added a commit to andrewkroh/beats that referenced this issue Oct 28, 2016
@andrewkroh
Fix 'index out of range' bug in Packetbeat DNS protocol plugin
cbde106 
When converting resource records into MapStrs the code can run into an index out of range exception when processing OPT psuedo resource records. The code reduces the size of a slice by creating a new, smaller slice and copies the existing data to the smaller slice. But the code did not account for the fact that the length of the slice was smaller when indexing.

Fixes elastic#2872
@andrewkroh andrewkroh mentioned this issue Oct 28, 2016
Merged
ruflin pushed a commit that referenced this issue Oct 31, 2016
@andrewkroh @ruflin
Fix 'index out of range' bug in Packetbeat DNS protocol plugin (#2875)
e8b1307 
When converting resource records into MapStrs the code can run into an index out of range exception when processing OPT psuedo resource records. The code reduces the size of a slice by creating a new, smaller slice and copies the existing data to the smaller slice. But the code did not account for the fact that the length of the slice was smaller when indexing.

* Added a DNS test case for rrsToMapStrs with a OPT resource record

Fixes #2872
andrewkroh added a commit to andrewkroh/beats that referenced this issue Nov 1, 2016
@andrewkroh
Fix 'index out of range' bug in Packetbeat DNS protocol plugin
7412ef6 
When converting resource records into MapStrs the code can run into an index out of range exception when processing OPT psuedo resource records. The code reduces the size of a slice by creating a new, smaller slice and copies the existing data to the smaller slice. But the code did not account for the fact that the length of the slice was smaller when indexing.

Fixes elastic#2872

(cherry picked from commit cbde106)
@andrewkroh andrewkroh mentioned this issue Nov 1, 2016
Merged
ruflin pushed a commit that referenced this issue Nov 3, 2016
@andrewkroh @ruflin
Fix 'index out of range' bug in Packetbeat DNS protocol plugin
fbad6fb 
When converting resource records into MapStrs the code can run into an index out of range exception when processing OPT psuedo resource records. The code reduces the size of a slice by creating a new, smaller slice and copies the existing data to the smaller slice. But the code did not account for the fact that the length of the slice was smaller when indexing.

Fixes #2872

(cherry picked from commit cbde106)
leweafan pushed a commit to leweafan/beats that referenced this issue Apr 28, 2023
@andrewkroh @ruflin
Fix 'index out of range' bug in Packetbeat DNS protocol plugin
229644a 
When converting resource records into MapStrs the code can run into an index out of range exception when processing OPT psuedo resource records. The code reduces the size of a slice by creating a new, smaller slice and copies the existing data to the smaller slice. But the code did not account for the fact that the length of the slice was smaller when indexing.

Fixes elastic#2872

(cherry picked from commit cbde106)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@andrewkroh andrewkroh

Labels
bug Packetbeat
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@andrewkroh @inqueue