Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cherry-pick #17188 to 7.x: Harden system/package parsing of deb size #17190

Merged
merged 1 commit into from
Mar 24, 2020

Conversation

adriansr
Copy link
Contributor

@adriansr adriansr commented Mar 23, 2020

Cherry-pick of PR #17188 to 7.x branch. Original message:

What does this PR do?

Fixes system/package dataset parsing of Deb package's Installed-Size field in order to:

  • Do not fail package enumeration when a malformed value is found.
  • Understand prefixes k/K, m/M and G/b to report a size in line with what the maintainer meant.

Why is it important?

Deb packages report their installed size in a field, Installed-Size, which is an integer interpreted as KiB. Some rare third-party packages are adding a unit at the end of this field, by mistake:

Installed-Size: 65M

System tools dpkg/apt ignore everything after the number. However, Auditbeat is currently failing to parse the list of packages once this malformed field is reached.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • n/a I have made corresponding changes to the documentation
  • n/a I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works

How to test this PR locally

To generate a package with a malformed Installed-Size:

dpkg-deb -R /var/cache/apt/archives/some-package.deb target_dir
vim target_dir/DEBIAN/control
dpkg-deb -b target_dir new-package.deb

Related issues

Fixes #16661

Logs

failed to get packages: error getting DEB packages: error converting 356K to int: strconv.ParseUint: parsing "356K": invalid syntax

failed to get packages: error getting DEB packages: error converting 25G to int: strconv.ParseUint: parsing "25G": invalid syntax

* Harden system/package parsing of deb size

Deb packages report their installed size in a field, Installed-Size,
which is an integer interpreted as KiB. Some unofficial packages are
adding a unit at the end of this field:

Installed-Size: 65M

System tools dpkg/apt ignore everything after the number.
Auditbeat is currently failing to parse the list of installed packages
once this mistake is reached.

This updates the dataset to:
- Do not fail when installed size can't be parsed.
- Understand prefixes k/K, m/M and G/b.

Fixes elastic#16661

(cherry picked from commit b131405)
@adriansr adriansr merged commit b4d235a into elastic:7.x Mar 24, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants