Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Packetbeat dies after ERR Dns ParseUdp #2872

Closed
inqueue opened this issue Oct 27, 2016 · 0 comments
Closed

Packetbeat dies after ERR Dns ParseUdp #2872

inqueue opened this issue Oct 27, 2016 · 0 comments
Assignees

Comments

@inqueue
Copy link
Member

inqueue commented Oct 27, 2016

Packetbeat 5.0
Ubuntu 10.04

2016-10-27T11:03:57Z ERR Dns ParseUdp. Recovering, but please report this: runtime error: index out of range.
2016-10-27T11:03:57Z ERR Stacktrace: goroutine 16 [running]:
runtime/debug.Stack(0xb7ffb4, 0x2b, 0xc4220b6a00)
        /usr/local/go/src/runtime/debug/stack.go:24 +0x79
github.com/elastic/beats/libbeat/logp.Recover(0xb60e89, 0xc)
        /go/src/github.com/elastic/beats/libbeat/logp/log.go:114 +0x138
panic(0xa8f300, 0xc420014090)
        /usr/local/go/src/runtime/panic.go:458 +0x243
github.com/elastic/beats/packetbeat/protos/dns.rrsToMapStrs(0xc421779340, 0x7, 0x7, 0xc4220b6d70, 0xc4211cd6d8, 0x6)
        /go/src/github.com/elastic/beats/packetbeat/protos/dns/dns.go:549 +0x451
github.com/elastic/beats/packetbeat/protos/dns.addDnsToMapStr(0xc421d41ec0, 0xc4211e4360, 0xc4220b0101)
        /go/src/github.com/elastic/beats/packetbeat/protos/dns/dns.go:486 +0x908
github.com/elastic/beats/packetbeat/protos/dns.(*Dns).publishTransaction(0xc421314e00, 0xc421de3080)
        /go/src/github.com/elastic/beats/packetbeat/protos/dns/dns.go:386 +0xb77
github.com/elastic/beats/packetbeat/protos/dns.(*Dns).receivedDnsResponse(0xc421314e00, 0xc4220b7a28, 0xc421de1c80)
        /go/src/github.com/elastic/beats/packetbeat/protos/dns/dns.go:349 +0x272
github.com/elastic/beats/packetbeat/protos/dns.(*Dns).ParseUdp(0xc421314e00, 0xc421de1b00)
        /go/src/github.com/elastic/beats/packetbeat/protos/dns/dns_udp.go:39 +0x37c
github.com/elastic/beats/packetbeat/protos/udp.(*Udp).Process(0xc4211ec460, 0xc4200ceec0, 0xc421de1b00)
        /go/src/github.com/elastic/beats/packetbeat/protos/udp/udp.go:59 +0x293
github.com/elastic/beats/packetbeat/decoder.(*DecoderStruct).onUDP(0xc420096d00, 0xc421de1b00)
        /go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:295 +0xd9
github.com/elastic/beats/packetbeat/decoder.(*DecoderStruct).process(0xc420096d00, 0xc421de1b00, 0x2d, 0xff, 0x1100aa0, 0xc420096d00)
        /go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:253 +0x299
github.com/elastic/beats/packetbeat/decoder.(*DecoderStruct).OnPacket(0xc420096d00, 0xc4200dd1ac, 0xff, 0xff, 0xc421d41aa0)
        /go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:164 +0x343
github.com/elastic/beats/packetbeat/sniffer.(*SnifferSetup).Run(0xc42131e660, 0xbcd018, 0xc421236440)
        /go/src/github.com/elastic/beats/packetbeat/sniffer/sniffer.go:371 +0x493
github.com/elastic/beats/packetbeat/beater.(*Packetbeat).Run.func2(0xc421236440, 0xc4200dd400, 0xc4200d2e40)
        /go/src/github.com/elastic/beats/packetbeat/beater/packetbeat.go:155 +0x6a
created by github.com/elastic/beats/packetbeat/beater.(*Packetbeat).Run
        /go/src/github.com/elastic/beats/packetbeat/beater/packetbeat.go:159 +0x1b2

2016-10-27T11:04:08Z INFO Non-zero metrics in the last 30s: dns.unmatched_responses=1 libbeat.logstash.publish.read_bytes=594 libbeat.publisher.published_events=190 libbeat.logstash.call_count.PublishEvents=15 libbeat.logstash.publish.write_bytes=27641 libbeat.logstash.published_and_acked_events=187 libbeat.publisher.messages_in_worker_queues=40

It runs for a while until at some point, presumably, it comes across a DNS packet it does not like. I will work on getting a pcap.

@andrewkroh andrewkroh self-assigned this Oct 27, 2016
andrewkroh added a commit to andrewkroh/beats that referenced this issue Oct 28, 2016
When converting resource records into MapStrs the code can run into an index out of range exception when processing OPT psuedo resource records. The code reduces the size of a slice by creating a new, smaller slice and copies the existing data to the smaller slice. But the code did not account for the fact that the length of the slice was smaller when indexing.

Fixes elastic#2872
ruflin pushed a commit that referenced this issue Oct 31, 2016
When converting resource records into MapStrs the code can run into an index out of range exception when processing OPT psuedo resource records. The code reduces the size of a slice by creating a new, smaller slice and copies the existing data to the smaller slice. But the code did not account for the fact that the length of the slice was smaller when indexing.

* Added a DNS test case for rrsToMapStrs with a OPT resource record

Fixes #2872
andrewkroh added a commit to andrewkroh/beats that referenced this issue Nov 1, 2016
When converting resource records into MapStrs the code can run into an index out of range exception when processing OPT psuedo resource records. The code reduces the size of a slice by creating a new, smaller slice and copies the existing data to the smaller slice. But the code did not account for the fact that the length of the slice was smaller when indexing.

Fixes elastic#2872

(cherry picked from commit cbde106)
ruflin pushed a commit that referenced this issue Nov 3, 2016
When converting resource records into MapStrs the code can run into an index out of range exception when processing OPT psuedo resource records. The code reduces the size of a slice by creating a new, smaller slice and copies the existing data to the smaller slice. But the code did not account for the fact that the length of the slice was smaller when indexing.

Fixes #2872

(cherry picked from commit cbde106)
leweafan pushed a commit to leweafan/beats that referenced this issue Apr 28, 2023
When converting resource records into MapStrs the code can run into an index out of range exception when processing OPT psuedo resource records. The code reduces the size of a slice by creating a new, smaller slice and copies the existing data to the smaller slice. But the code did not account for the fact that the length of the slice was smaller when indexing.

Fixes elastic#2872

(cherry picked from commit cbde106)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants