Skip to content

Commit

Permalink
Handle and log invalid IP address errors
Browse files Browse the repository at this point in the history
If the filter get any invalid input for the anonymize_ipv4_network
mode, it will crash the whole Logstash pipeline because of an
unhandled ArgumentError thrown by the IPAddr class.
Furthermore, the causing event got lost during the crash, so
post-mortem analysis were not possible.

Now, ArgumentError is catched and an error message is logged.
The value to be anonymized is kept in the event in the identified form
and the event gets processed further as usual.

Fixes logstash-plugins#3.
  • Loading branch information
plusserver-admin committed Sep 6, 2016
1 parent 325cbb1 commit d74724c
Showing 1 changed file with 12 additions and 7 deletions.
19 changes: 12 additions & 7 deletions lib/logstash/filters/anonymize.rb
Original file line number Diff line number Diff line change
Expand Up @@ -39,26 +39,31 @@ def filter(event)
@fields.each do |field|
next unless event.include?(field)
if event.get(field).is_a?(Array)
event.set(field, event.get(field).collect { |v| anonymize(v) })
event.set(field, event.get(field).collect { |v| anonymize(event, field, v) })
else
event.set(field, anonymize(event.get(field)))
event.set(field, anonymize(event, field, event.get(field)))
end
end
end # def filter

private
def anonymize_ipv4_network(ip_string)
# in JRuby 1.7.11 outputs as US-ASCII
IPAddr.new(ip_string).mask(@key.to_i).to_s.force_encoding(Encoding::UTF_8)
def anonymize_ipv4_network(event, field, ip_string)
begin
# in JRuby 1.7.11 outputs as US-ASCII
IPAddr.new(ip_string).mask(@key.to_i).to_s.force_encoding(Encoding::UTF_8)
rescue ArgumentError => e
@logger.error("Anonymize: Invalid IP address received", :field => field, :value => ip_string, :exception => e, :backtrace => e.backtrace)
return ip_string
end
end

def anonymize_openssl(data)
def anonymize_openssl(event, field, data)
digest = algorithm()
# in JRuby 1.7.11 outputs as ASCII-8BIT
OpenSSL::HMAC.hexdigest(digest, @key, data).force_encoding(Encoding::UTF_8)
end

def anonymize_murmur3(value)
def anonymize_murmur3(event, field, value)
case value
when Fixnum
MurmurHash3::V32.int_hash(value)
Expand Down

0 comments on commit d74724c

Please sign in to comment.