[checkpoint] Expand and fix IANA number handling #13568

ash-darin · 2025-04-16T11:08:27Z

Enhancement

Proposed commit message

Add handling of IANA protocol number 114.

Add handling of unknown IANA numbers. When no protocol.transport is set, dashboards for this integration simply do not show the traffic for that protocol. With adding the number as a fallback, these show up now.

Fix recognition of IANA protocol number 0. IANA protocol number 0 only translates to "hopopt" if the underlying protocol is IPv6. For IPv4 the number "0" is undefined ("reserved") and according to "/etc/protocols" in most Linux distributions is recognized to denote the internet protocol v4 itself. Labeling protocol number 0 as "hopopt" in general is therefore wrong.

# Internet (IP) protocols
#
# Updated from http://www.iana.org/assignments/protocol-numbers and other
# sources.
# New protocols will be added on request if they have been officially
# assigned by IANA and are not historical.
# If you need a huge list of used numbers please install the nmap package.

ip      0       IP              # internet protocol, pseudo protocol number
hopopt  0       HOPOPT          # IPv6 Hop-by-Hop Option [RFC1883]

Checklist

I have reviewed [tips for building integrations]
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Open the dasboard "[Check Point] Time and Traffic" and look at the box "Transport". If you see numeric protocols, these are now visible.

elasticmachine · 2025-04-16T12:00:58Z

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

taylor-swanson

Top-level manifest.yml needs its version updated to 1.39.1.

We will also need pipeline test cases for these new additions.

Aside from the question about the IP address, changes otherwise seem fine to me.

taylor-swanson · 2025-04-16T12:43:24Z

packages/checkpoint/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml

@@ -799,7 +799,9 @@ processors:
      if: ctx?.network?.iana_number != null
      source: |
        def iana_number = ctx.network.iana_number;
-        if (iana_number == '0') {
+        if (iana_number == '0' && ctx.source?.ip == '0.0.0.0') {


Will source IP always be 0.0.0.0 or could it be any other IP address in this situation?

Will source IP always be 0.0.0.0 or could it be any other IP address in this situation?

It's the only observed occurrance. I could not determine other cases where iana_number was "0". checkpoint.service (translated to destination.port), checkpoint.s_port (translated to source.port) are also "0" in the observed cases but I chose source.ip as it clearly shows we are dealing with IPv4. dst is also "0.0.0.0"

I'm currently trying to figure out how to handle service (iana_number) = 4294967295 (2^32-1) (that denotes a port scan apparently). s_port can be "0" with multiple services.

My concern around the IP is mostly if we get something that isn't 0.0.0.0 and it skips over that if branch since it didn't match. I don't know enough about the product to know if it will always use 0.0.0.0 for this case, hence my hesitation. It would be easier to test for the IPv6 case, since you just need to test if a colon (:) exists in the IP.

Something like this:

if (ctx.source?.ip?.contains(':') && iana_number == '0') { ctx.network.transport = 'hopopt'; } else if (iana_number == '1') {

I probably wouldn't even bother with setting ip for the alternate case, since ip is both not a transport protocol and isn't a registered IANA protocol. Letting the default case handle it would probably be just as effective.

I changed the handling in your sense and added handling of "iana_number" 4294967295. setting "iana_number" to null is simply a placeholder as the "if else" can not be empty apparently and "iana_number" is no longer used after this point.

ash-darin · 2025-04-16T16:28:54Z

Top-level manifest.yml needs its version updated to 1.39.1.

We will also need pipeline test cases for these new additions.

I do not know how to craft those and probably do not have the rights to do it.

taylor-swanson

I do not know how to craft those and probably do not have the rights to do it.

You absolutely can!

Basically, you just need to drop in a few logs that test the various cases into data_stream/firewall/_dev/test/pipeline (test-checkpoint.log) and run the pipeline tests with the generate flag:

cd packages/checkpoint
elastic-package test pipeline -v -g

Verify the newly added lines in the corresponding expected file (test-checkpoint.log-expected.json), then commit everything.

If you don't have elastic-package set up with a stack (I highly recommend you do), I can add this for you, but I do request those logs. I can see at least 4 logs:

iana_number 0 and an IPv4 address (0.0.0.0 is fine)
iana_number 0 and an IPv6 address
iana_number 114
iana_number not explicitly handled

taylor-swanson · 2025-04-17T13:20:21Z

packages/checkpoint/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml

@@ -799,7 +799,9 @@ processors:
      if: ctx?.network?.iana_number != null
      source: |
        def iana_number = ctx.network.iana_number;
-        if (iana_number == '0') {
+        if (iana_number == '0' && ctx.source?.ip == '0.0.0.0') {


My concern around the IP is mostly if we get something that isn't 0.0.0.0 and it skips over that if branch since it didn't match. I don't know enough about the product to know if it will always use 0.0.0.0 for this case, hence my hesitation. It would be easier to test for the IPv6 case, since you just need to test if a colon (:) exists in the IP.

Something like this:

if (ctx.source?.ip?.contains(':') && iana_number == '0') { ctx.network.transport = 'hopopt'; } else if (iana_number == '1') {

I probably wouldn't even bother with setting ip for the alternate case, since ip is both not a transport protocol and isn't a registered IANA protocol. Letting the default case handle it would probably be just as effective.

add IPv6 detection, leave proto "0" to the default case. exclude proto = "4294967295", which denotes a detected port scan.

ash-darin · 2025-04-22T09:44:20Z

packages/checkpoint/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml

        } else if (iana_number == '132') {
            ctx.network.transport = 'sctp';
+        } else if (iana_number == '4294967295') {


Do nothing. "4294967295" is not a protocol number and apparently a placeholder in case of a port scan. Therefore do not fill network.transport with this number.

ash-darin · 2025-04-22T10:13:40Z

packages/checkpoint/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml

@@ -285,6 +285,7 @@ processors:
      type: long
      ignore_failure: true
      ignore_missing: true
+      if: "ctx?.destination?.port != '4294967295'"


This is clearly not a port in the networking sense. This is set as a placeholder if there is a port scan.

ash-darin · 2025-05-15T08:53:31Z

@taylor-swanson I added two test cases, dereived from real logs to

packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-checkpoint.log

https://github.com/elastic/integrations/pull/13568/files#diff-1927ffbc8092290a6b2dca7d6f33e110f0872118e9bdd13f5f6c3a895d80bce6

Is that correct and sufficient?

taylor-swanson · 2025-05-20T13:37:55Z

/test

taylor-swanson

We also need to update the test expected file, which can be done by running:

elastic-package test pipeline -g

taylor-swanson · 2025-05-20T14:01:09Z

packages/checkpoint/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml

@@ -285,6 +285,7 @@ processors:
      type: long
      ignore_failure: true
      ignore_missing: true
+      if: "ctx?.destination?.port != '4294967295'"


Suggested change

if: "ctx?.destination?.port != '4294967295'"

if: "ctx.checkpoint?.service != '4294967295'"

ash-darin · 2025-05-22T10:44:58Z

We also need to update the test expected file, which can be done by running:
elastic-package test pipeline -g

I can not do this, as I do not have a complete build environment on my computer. I take it, this is not integrated into this build environment here in github?

- Bump version to next minor, since this is an enhancement and includes a new field addition - Fix if statement - Generate expected test file - Add new field for 'source' - Update readme

taylor-swanson · 2025-05-22T13:17:23Z

We also need to update the test expected file, which can be done by running:
elastic-package test pipeline -g
I can not do this, as I do not have a complete build environment on my computer. I take it, this is not integrated into this build environment here in github?

No worries, I can make the changes.

taylor-swanson · 2025-05-22T14:06:38Z

/test

elastic-vault-github-plugin-prod · 2025-05-22T14:33:34Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

elastic-sonarqube · 2025-05-22T14:33:47Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

elasticmachine · 2025-05-22T14:34:30Z

💚 Build Succeeded

Buildkite Build
Commit: 32c43a7

History

💔 Build #26139 failed 09d7ab3

elastic-vault-github-plugin-prod · 2025-05-22T16:06:07Z

Package checkpoint - 1.40.0 containing this change is available at https://epr.elastic.co/package/checkpoint/1.40.0/

- Add handling of IANA protocol number 114. - Add handling of unknown IANA numbers. When no protocol.transport is set, dashboards for this integration simply do not show the traffic for that protocol. With adding the number as a fallback, these show up now. - Fix recognition of IANA protocol number 0. IANA protocol number 0 only translates to "hopopt" if the underlying protocol is IPv6. For IPv4 the number "0" is undefined ("reserved") and according to "/etc/protocols" in most Linux distributions is recognized to denote the internet protocol v4 itself. Labeling protocol number 0 as "hopopt" in general is therefore wrong.

ash-darin added 3 commits April 16, 2025 13:05

update IANA handling

c9bc50c

Update changelog.yml

36dc18c

Update changelog.yml with PR number

c5c1f84

ash-darin marked this pull request as ready for review April 16, 2025 11:20

ash-darin requested a review from a team as a code owner April 16, 2025 11:20

ash-darin added 2 commits April 16, 2025 13:30

integrate check for 0.0.0.0 into painless script

dda6222

fixed indent

8456c42

andrewkroh added Integration:checkpoint Check Point Team:Security-Deployment and Devices Deployment and Devices Security team [elastic/sec-deployment-and-devices] labels Apr 16, 2025

taylor-swanson changed the title ~~Expand and fix IANA number handling~~ [checkpoint] Expand and fix IANA number handling Apr 16, 2025

taylor-swanson reviewed Apr 16, 2025

View reviewed changes

Update manifest.yml to reflect new version number

8323604

taylor-swanson reviewed Apr 17, 2025

View reviewed changes

change protocol detection

e201637

add IPv6 detection, leave proto "0" to the default case. exclude proto = "4294967295", which denotes a detected port scan.

ash-darin commented Apr 22, 2025

View reviewed changes

ash-darin added 2 commits April 22, 2025 12:09

Merge branch 'elastic:main' into ash-darin-patch-2

6a3a7fd

handle destination "port" 4294967295

cb57c2e

ash-darin commented Apr 22, 2025

View reviewed changes

ash-darin added 5 commits April 22, 2025 12:29

Update changelog.yml to reflect recent changes.

0ce17ad

Merge branch 'elastic:main' into ash-darin-patch-2

de9ceb5

Merge branch 'elastic:main' into ash-darin-patch-2

207ed57

Add test cases to testing log

1ab7983

Merge branch 'elastic:main' into ash-darin-patch-2

afd8cf0

Merge branch 'main' into ash-darin-patch-2

09d7ab3

taylor-swanson reviewed May 20, 2025

View reviewed changes

Address review comments

32c43a7

- Bump version to next minor, since this is an enhancement and includes a new field addition - Fix if statement - Generate expected test file - Add new field for 'source' - Update readme

taylor-swanson approved these changes May 22, 2025

View reviewed changes

taylor-swanson merged commit 5261127 into elastic:main May 22, 2025
8 checks passed

	if: "ctx?.destination?.port != '4294967295'"
	if: "ctx.checkpoint?.service != '4294967295'"

[checkpoint] Expand and fix IANA number handling #13568

[checkpoint] Expand and fix IANA number handling #13568

Uh oh!

Conversation

ash-darin commented Apr 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

How to test this PR locally

Uh oh!

elasticmachine commented Apr 16, 2025

Uh oh!

taylor-swanson left a comment

Choose a reason for hiding this comment

Uh oh!

taylor-swanson Apr 16, 2025

Choose a reason for hiding this comment

Uh oh!

ash-darin Apr 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ash-darin Apr 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

taylor-swanson Apr 17, 2025

Choose a reason for hiding this comment

Uh oh!

ash-darin Apr 22, 2025

Choose a reason for hiding this comment

Uh oh!

ash-darin commented Apr 16, 2025

Uh oh!

taylor-swanson left a comment

Choose a reason for hiding this comment

Uh oh!

taylor-swanson Apr 17, 2025

Choose a reason for hiding this comment

Uh oh!

ash-darin Apr 22, 2025

Choose a reason for hiding this comment

Uh oh!

ash-darin Apr 22, 2025

Choose a reason for hiding this comment

Uh oh!

ash-darin commented May 15, 2025

Uh oh!

taylor-swanson commented May 20, 2025

Uh oh!

taylor-swanson left a comment

Choose a reason for hiding this comment

Uh oh!

taylor-swanson May 20, 2025

Choose a reason for hiding this comment

Uh oh!

ash-darin commented May 22, 2025

Uh oh!

taylor-swanson commented May 22, 2025

Uh oh!

taylor-swanson commented May 22, 2025

Uh oh!

elastic-vault-github-plugin-prod bot commented May 22, 2025

🚀 Benchmarks report

Uh oh!

elastic-sonarqube bot commented May 22, 2025

Quality Gate passed

Uh oh!

elasticmachine commented May 22, 2025

💚 Build Succeeded

History

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod bot commented May 22, 2025

Uh oh!

Uh oh!

ash-darin commented Apr 16, 2025 •

edited

Loading

ash-darin Apr 16, 2025 •

edited

Loading

ash-darin Apr 16, 2025 •

edited

Loading