Repository navigation
[9.5](backport #8230) [Asset Inventory][AWS] ELBv2: resolve IPAddresses from DNSName when API returns none - #8604
Merged
Merged
Conversation
…PI returns none (#8230) ## Summary Stacked on #8229 (forward-port of #7277). **Review #8229 first; this PR's diff shows only the ELBv2 DNS fallback on top of it.** ### Problem `entity.Details.IPAddresses` is always empty for real-world ALBs and NLBs. The AWS API field `AvailabilityZones[].LoadBalancerAddresses[].IpAddress` is only populated for NLBs with explicitly assigned Elastic IPs — across 200 sampled internet-facing NLBs it was empty on all of them. The classic ELB (v1) fetcher was given a DNS-resolution fallback in #7277; ELBv2 was not. ### Fix Mirror the ELBv1 pattern in the `elb_v2` package: - **`elb_v2.go`**: add unexported `hostResolver` interface (`LookupHost`) + `resolver` field on `Provider`; set `net.DefaultResolver` in `NewElbV2Provider`. - **`load_balancer_v2.go`**: add `dnsResolvedIPs []string` field; `GetIPAddresses()` returns it as a fallback when the API slice is empty; add `NewElasticLoadBalancerInfo` constructor for testability. - **`provider_v2.go`**: after listeners are fetched, if `GetIPAddresses()` is still empty, resolve `DNSName` via the injected resolver, sort the result, soft-fail on error (a DNS outage must not fail the fetch cycle). - **`provider_v2_test.go`**: add per-case `resolver` column with four cases: DNS fallback used + sorted, resolver error soft-fail, API IPs win (resolver not called), and the existing error path. - **`fetcher_elb_test.go`**: switch ELBv2 case to `NewElasticLoadBalancerInfo` with pre-resolved IPs; assert `IPAddresses` in expected `Details`. ### Caveat DNS-resolved IPs are point-in-time. ALB/NLB addresses rotate and vary by resolver vantage point. This matches what the classic ELB fetcher already does and what InfoSec's legacy scripts do — parity, not a new compromise. ### Related - Closes https://github.com/elastic/security-team/issues/18294 - Stacked on: #8229 ## Checklist - [x] Tests added (DNS fallback, soft-fail, API-wins paths) - [x] Mocks updated (`mockHostResolver` added to `elb_v2_mock.go`) (cherry picked from commit d05cca1)
gurevichdmitry
approved these changes
Sep 27, 2026
Contributor
Author
|
This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stacked on #8229 (forward-port of #7277). Review #8229 first; this PR's diff shows only the ELBv2 DNS fallback on top of it.
Problem
entity.Details.IPAddressesis always empty for real-world ALBs and NLBs. The AWS API fieldAvailabilityZones[].LoadBalancerAddresses[].IpAddressis only populated for NLBs with explicitly assigned Elastic IPs — across 200 sampled internet-facing NLBs it was empty on all of them. The classic ELB (v1) fetcher was given a DNS-resolution fallback in #7277; ELBv2 was not.Fix
Mirror the ELBv1 pattern in the
elb_v2package:elb_v2.go: add unexportedhostResolverinterface (LookupHost) +resolverfield onProvider; setnet.DefaultResolverinNewElbV2Provider.load_balancer_v2.go: adddnsResolvedIPs []stringfield;GetIPAddresses()returns it as a fallback when the API slice is empty; addNewElasticLoadBalancerInfoconstructor for testability.provider_v2.go: after listeners are fetched, ifGetIPAddresses()is still empty, resolveDNSNamevia the injected resolver, sort the result, soft-fail on error (a DNS outage must not fail the fetch cycle).provider_v2_test.go: add per-caseresolvercolumn with four cases: DNS fallback used + sorted, resolver error soft-fail, API IPs win (resolver not called), and the existing error path.fetcher_elb_test.go: switch ELBv2 case toNewElasticLoadBalancerInfowith pre-resolved IPs; assertIPAddressesin expectedDetails.Caveat
DNS-resolved IPs are point-in-time. ALB/NLB addresses rotate and vary by resolver vantage point. This matches what the classic ELB fetcher already does and what InfoSec's legacy scripts do — parity, not a new compromise.
Related
Checklist
mockHostResolveradded toelb_v2_mock.go)This is an automatic backport of pull request [Asset Inventory][AWS] ELBv2: resolve IPAddresses from DNSName when API returns none #8230 done by Mergify.