filebeat/input/udp: callback passed to udp.New does not safely handle nil addresses

[efd6]

On Windows in filebeat/inputsource/common/dgram when a long UDP message is received, it is passed to the callback to be forwarded.

Error reading from the socket read udp [::]:9001: wsarecvfrom: A message sent on a datagram socket was larger than the internal message buffer or some other network limit, or the buffer used to receive a datagram into was smaller than the datagram itself.

beats/filebeat/inputsource/common/dgram/handler.go

Lines 79 to 84 in a1a6bd8

	// On Windows send the current buffer and mark it as truncated.
	// The buffer will have content but length will return 0, addr will be nil.
	if family == inputsource.FamilyUDP && isLargerThanBuffer(err) {
	callback(buffer, inputsource.NetworkMetadata{RemoteAddr: addr, Truncated: true})
	continue
	}

The comment here notes that the addr will be nil.

However, in the case that the callback is provided by the UDP input, the RemoteAddr field is deference with the String method.

beats/filebeat/input/udp/input.go

Lines 67 to 82 in a1a6bd8

	callback := func(data []byte, metadata inputsource.NetworkMetadata) {
	forwarder.Send(beat.Event{
	Timestamp: time.Now(),
	Meta: mapstr.M{
	"truncated": metadata.Truncated,
	},
	Fields: mapstr.M{
	"message": string(data),
	"log": mapstr.M{
	"source": mapstr.M{
	"address": metadata.RemoteAddr.String(),
	},
	},
	},
	})
	}

This results in a nil pointer deference.

runtime error: invalid memory address or nil pointer dereference

github.com/elastic/elastic-agent-libs/logp.(*Logger).Recover
        /go/pkg/mod/github.com/elastic/[email protected]/logp/logger.go:218
runtime.gopanic
        /usr/local/go/src/runtime/panic.go:1047
runtime.panicmem
        /usr/local/go/src/runtime/panic.go:221
runtime.sigpanic
        /usr/local/go/src/runtime/signal_windows.go:254
github.com/elastic/beats/v7/filebeat/input/udp.NewInput.func1
        /go/src/github.com/elastic/beats/filebeat/input/udp/input.go:77
github.com/elastic/beats/v7/filebeat/inputsource/common/dgram.DatagramReaderFactory.func1.1
        /go/src/github.com/elastic/beats/filebeat/inputsource/common/dgram/handler.go:82
github.com/elastic/beats/v7/filebeat/inputsource/common/dgram.(*Listener).connectAndRun
        /go/src/github.com/elastic/beats/filebeat/inputsource/common/dgram/server.go:122
github.com/elastic/beats/v7/filebeat/inputsource/common/dgram.(*Listener).Start.func1
        /go/src/github.com/elastic/beats/filebeat/inputsource/common/dgram/server.go:112
github.com/elastic/go-concert/unison.(*TaskGroup).Go.func1
        /go/pkg/mod/github.com/elastic/[email protected]/unison/taskgroup.go:163

The callback definition should check for a nil net.Addr and not attempt to render it in the case that it is nil.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)