Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix NPE in Logfile Audit Filter #38120

Merged
merged 7 commits into from
Feb 3, 2019
Merged

Fix NPE in Logfile Audit Filter #38120

merged 7 commits into from
Feb 3, 2019

Conversation

albertzaharovits
Copy link
Contributor

The culprit in #38097 is an IndicesRequest that has no indices; but instead of #indices() returning null or String[0] it returned String[] {null} . This tripped the audit filter.

I have addressed this in two ways:

  • #indices() returning String[] {null} is treated as null and String[0], i.e. no indices
  • null values among the roles and indices lists, which are unexpected, will never again stumble the audit filter; null values are treated as special values that will not match any policy, i.e. their events will always be printed.

Closes #38097

@albertzaharovits albertzaharovits self-assigned this Jan 31, 2019
@elasticmachine
Copy link
Collaborator

Pinging @elastic/es-security

tvernum
tvernum approved these changes Feb 1, 2019
View reviewed changes
Copy link
Contributor

@tvernum tvernum left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, but I left a suggestion on a possible readability improvement.

...security/src/main/java/org/elasticsearch/xpack/security/audit/logfile/LoggingAuditTrail.java Outdated
this.roles = () -> roles.filter(r -> r.length > 0).filter(r -> r.length > 1 || r[0] != null).map(Arrays::stream)
.orElse(Stream.of(""));
this.indices = () -> indices.filter(i -> i.length > 0).filter(i -> i.length > 1 || i[0] != null).map(Arrays::stream)
.orElse(Stream.of(""));
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is fine, but I think I would be confused by it if I hadn't already read the PR description.
I think something like this is more readable?

   opt.filter(a -> Arrays.stream(a).anyMatch(Objects::nonNull)).map(Arrays::stream).orElse(Stream.of(""));

It's slightly different, in that it will treat { null, null, null } (etc) as "empty", but I think that's OK.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

preciate Tim, I went on with your suggestion!

@albertzaharovits albertzaharovits merged commit 3c1544d into elastic:master Feb 3, 2019
@albertzaharovits albertzaharovits deleted the fix-bug-38097 branch February 3, 2019 08:34
@albertzaharovits albertzaharovits mentioned this pull request Feb 3, 2019
Merged
albertzaharovits added a commit to albertzaharovits/elasticsearch that referenced this pull request Feb 3, 2019
@albertzaharovits
Fix NPE in Logfile Audit Filter (elastic#38120)
7744fdf 
The culprit in elastic#38097 is an `IndicesRequest` that has no indices,
but instead of `request.indices()` returning `null` or `String[0]`
it returned `String[] {null}` . This tripped the audit filter.

I have addressed this in two ways:
1. `request.indices()` returning `String[] {null}` is treated as `null`
    or `String[0]`, i.e. no indices
2. `null` values among the roles and indices lists, which are
    unexpected, will never again stumble the audit filter; `null` values
    are treated as special values that will not match any policy,
    i.e. their events will always be printed.

Closes elastic#38097
albertzaharovits added a commit to albertzaharovits/elasticsearch that referenced this pull request Feb 3, 2019
@albertzaharovits
Fix NPE in Logfile Audit Filter (elastic#38120)
9861a40 
The culprit in elastic#38097 is an `IndicesRequest` that has no indices,
but instead of `request.indices()` returning `null` or `String[0]`
it returned `String[] {null}` . This tripped the audit filter.

I have addressed this in two ways:
1. `request.indices()` returning `String[] {null}` is treated as `null`
    or `String[0]`, i.e. no indices
2. `null` values among the roles and indices lists, which are
    unexpected, will never again stumble the audit filter; `null` values
    are treated as special values that will not match any policy,
    i.e. their events will always be printed.

Closes elastic#38097
albertzaharovits added a commit that referenced this pull request Feb 3, 2019
@albertzaharovits
Fix NPE in Logfile Audit Filter (#38120) (#38273)
de7accb 
The culprit in #38097 is an `IndicesRequest` that has no indices,
but instead of `request.indices()` returning `null` or `String[0]`
it returned `String[] {null}` . This tripped the audit filter.

I have addressed this in two ways:
1. `request.indices()` returning `String[] {null}` is treated as `null`
    or `String[0]`, i.e. no indices
2. `null` values among the roles and indices lists, which are
    unexpected, will never again stumble the audit filter; `null` values
    are treated as special values that will not match any policy,
    i.e. their events will always be printed.

Closes #38097
albertzaharovits added a commit that referenced this pull request Feb 3, 2019
@albertzaharovits
Fix NPE in Logfile Audit Filter (#38120) (#38274)
83fed50 
The culprit in #38097 is an `IndicesRequest` that has no indices,
but instead of `request.indices()` returning `null` or `String[0]`
it returned `String[] {null}` . This tripped the audit filter.

I have addressed this in two ways:
1. `request.indices()` returning `String[] {null}` is treated as `null`
    or `String[0]`, i.e. no indices
2. `null` values among the roles and indices lists, which are
    unexpected, will never again stumble the audit filter; `null` values
    are treated as special values that will not match any policy,
    i.e. their events will always be printed.

Closes #38097
albertzaharovits added a commit that referenced this pull request Feb 3, 2019
@albertzaharovits
Fix NPE in Logfile Audit Filter (#38120) (#38271)
72a36b4 
The culprit in #38097 is an `IndicesRequest` that has no indices,
but instead of `request.indices()` returning `null` or `String[0]`
it returned `String[] {null}` . This tripped the audit filter.

I have addressed this in two ways:
1. `request.indices()` returning `String[] {null}` is treated as `null`
    or `String[0]`, i.e. no indices
2. `null` values among the roles and indices lists, which are
    unexpected, will never again stumble the audit filter; `null` values
    are treated as special values that will not match any policy,
    i.e. their events will always be printed.

Closes #38097
jasontedor added a commit to jasontedor/elasticsearch that referenced this pull request Feb 4, 2019
@jasontedor
Merge remote-tracking branch 'elastic/6.x' into retention-lease-backg…
c885905 
…round-sync-6.x

* elastic/6.x:
  Fix testRestoreIncreasesPrimaryTerms on 6.x (elastic#38314)
  SQL: Remove exceptions from Analyzer (elastic#38260) (elastic#38287)
  SQL: Move metrics tracking inside PlanExecutor (elastic#38259) (elastic#38288)
  Backport of elastic#38311: Move TokenService to seqno powered cas
  Handle scheduler exceptions (elastic#38183)
  Mute MlMigrationFullClusterRestartIT#testMigration (elastic#38316)
  6.x Backport of elastic#38278: Move ML Optimistic Concurrency Control to Seq No
  Cleanup construction of interceptors (elastic#38296)
  Throw if two inner_hits have the same name (elastic#37645) (elastic#38194)
  AsyncTwoPhaseIndexerTests race condition fixed elastic#38195 Backport#37830
  Enable SSL in reindex with security QA tests (elastic#38293)
  Ensure ILM policies run safely on leader indices  (elastic#38140)
  Introduce ssl settings to reindex from remote (elastic#38292)
  Fix ordering problem in add or renew lease test (elastic#38281)
  Mute ReplicationTrackerRetentionLeaseTests#testAddOrRenewRetentionLease (elastic#38276)
  Fix NPE in Logfile Audit Filter (elastic#38120) (elastic#38271)
  Enable trace log in FollowerFailOverIT (elastic#38148)
  SQL: Generate relevant error message when grouping functions are not used in GROUP BY (elastic#38017)
jasontedor added a commit to jasontedor/elasticsearch that referenced this pull request Feb 8, 2019
@jasontedor
Merge branch '6.6' into docker-from-artifacts-6.6
8c938a9 
* 6.6: (121 commits)
  [DOCS] Add warning about bypassing ML PUT APIs (elastic#38608)
  fix dissect doc "ip" --> "clientip" (elastic#38512)
  bad formatted JSON object (elastic#38515)
  SQL: Fix issue with IN not resolving to underlying keyword field (elastic#38440)
  Update ilm-api.asciidoc, point to REMOVE policy (elastic#38235)
  Backport changes to the release notes script. (elastic#38347)
  Change the milliseconds precision to 3 digits for intervals. (elastic#38297)
  SecuritySettingsSource license.self_generated: trial (elastic#38233) (elastic#38398)
  Fix IndexAuditTrail rolling upgrade on rollover edge 2 (elastic#38286) (elastic#38381)
  Cleanup construction of interceptors (elastic#38388)
  Skip unsupported languages for tests (elastic#38328) (elastic#38385)
  [ILM][TEST] increase assertBusy timeout (elastic#36864) (elastic#38354)
  Docs: Drop inline callout from scroll example (elastic#38340) (elastic#38365)
  Preserve ILM operation mode when creating new lifecycles (elastic#38134) (elastic#38230)
  [ML] Add explanation so far to file structure finder exceptions (elastic#38337)
  ML: Fix error race condition on stop _all datafeeds and close _all jobs (elastic#38113) (elastic#38211) (elastic#38222)
  SQL: Generate relevant error message when grouping functions are not used in GROUP BY (elastic#38017)
  Fix NPE in Logfile Audit Filter (elastic#38120) (elastic#38273)
  Enable trace log in FollowerFailOverIT (elastic#38148)
  Replace awaitBusy with assertBusy in atLeastDocsIndexed (elastic#38190)
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jaymode jaymode jaymode approved these changes

@tvernum tvernum tvernum approved these changes

Assignees

@albertzaharovits albertzaharovits

Labels
>bug :Security/Audit X-Pack Audit logging v6.5.5 v6.6.1 v6.7.0 v7.0.0-beta1
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@albertzaharovits @elasticmachine @tvernum @jaymode @colings86