{"action":"closed","issue":{"url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow/issues/18","repository_url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow","labels_url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow/issues/18/labels{/name}","comments_url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow/issues/18/comments","events_url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow/issues/18/events","html_url":"https://github.com/logstash-plugins/logstash-codec-netflow/issues/18","id":103849073,"number":18,"title":"Denial of service by sending invalid netflow packets to logstash-codec-netflow","user":{"login":"jorritfolmer","id":11555154,"avatar_url":"https://avatars.githubusercontent.com/u/11555154?v=3","gravatar_id":"","url":"https://api.github.com/users/jorritfolmer","html_url":"https://github.com/jorritfolmer","followers_url":"https://api.github.com/users/jorritfolmer/followers","following_url":"https://api.github.com/users/jorritfolmer/following{/other_user}","gists_url":"https://api.github.com/users/jorritfolmer/gists{/gist_id}","starred_url":"https://api.github.com/users/jorritfolmer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jorritfolmer/subscriptions","organizations_url":"https://api.github.com/users/jorritfolmer/orgs","repos_url":"https://api.github.com/users/jorritfolmer/repos","events_url":"https://api.github.com/users/jorritfolmer/events{/privacy}","received_events_url":"https://api.github.com/users/jorritfolmer/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-08-29T12:25:52Z","updated_at":"2016-05-05T07:43:25Z","closed_at":"2016-05-05T07:43:25Z","body":"Based on issue #17, I've been fuzzing the netflow codec with `ProxyFuzz.py` and a Netflow stream to see if crashes on other invalid input as well. `ProxyFuzz.py` does random bitflipping, adding data etc.\r\nSo far I've found it crashes like this:\r\n\r\n```\r\nException in inputworker \r\n{\"exception\"=>#<IOError: data truncated>, \r\n \"backtrace\"=>[\"/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.1.0/lib/bindata/io.rb:83:in `readbytes'\", \"/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.1.0/lib/bindata/string.rb:110:in `read_and_return_value'\", \"/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.1.0/lib/bindata/base_primitive.rb:124:in `do_read'\", \"(eval):2:in `do_read'\", \"/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.1.0/lib/bindata/struct.rb:131:in `do_read'\", \"org/jruby/RubyArray.java:1613:in `each'\", \"/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.1.0/lib/bindata/struct.rb:131:in `do_read'\", \"/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.1.0/lib/bindata/array.rb:301:in `do_read'\", \"org/jruby/RubyKernel.java:1511:in `loop'\", \"/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.1.0/lib/bindata/array.rb:299:in `do_read'\", \"/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.1.0/lib/bindata/struct.rb:131:in `do_read'\", \"org/jruby/RubyArray.java:1613:in `each'\", \"/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.1.0/lib/bindata/struct.rb:131:in `do_read'\", \"/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.1.0/lib/bindata/base.rb:146:in `read'\", \"/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.1.0/lib/bindata/base.rb:23:in `read'\", \"/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow-1.0.0/lib/logstash/codecs/netflow.rb:136:in `decode'\", \"/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-1.0.0/lib/logstash/inputs/udp.rb:95:in `inputworker'\", \"/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-1.0.0/lib/logstash/inputs/udp.rb:74:in `udp_listener'\"],\r\n :level=>:error\r\n}\r\n```\r\n\r\non this input:\r\n```\r\nInternet Protocol Version 4, Src: 172.16.32.201 (172.16.32.201), Dst: 172.16.32.202 (172.16.32.202)\r\n    Version: 4\r\n    Header Length: 20 bytes\r\n    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))\r\n    Total Length: 1424\r\n    Identification: 0xbe66 (48742)\r\n    Flags: 0x02 (Don't Fragment)\r\n    Fragment offset: 0\r\n    Time to live: 64\r\n    Protocol: UDP (17)\r\n    Header checksum: 0xdd42 [correct]\r\n    Source: 172.16.32.201 (172.16.32.201)\r\n    Destination: 172.16.32.202 (172.16.32.202)\r\n    [Source GeoIP: Unknown]\r\n    [Destination GeoIP: Unknown]\r\nUser Datagram Protocol, Src Port: 53906 (53906), Dst Port: iop (2055)\r\n    Source Port: 53906 (53906)\r\n    Destination Port: iop (2055)\r\n    Length: 1404\r\n    Checksum: 0x17cc [correct]\r\n    [Stream index: 0]\r\nCisco NetFlow/IPFIX\r\n    Version: 10\r\n    Length: 1396\r\n    Timestamp: Aug 27, 2015 16:04:56.000000000 CEST\r\n    FlowSequence: 4997093\r\n    Observation Domain Id: 0\r\n    Set 1\r\n        FlowSet Id: (Data) (269)\r\n        FlowSet Length: 100\r\n        Data (96 bytes), no template found\r\n    Set 2\r\n        FlowSet Id: (Data) (268)\r\n        FlowSet Length: 504\r\n        Data (500 bytes), no template found\r\n```\r\n"}}