Rewrite the mac address regexing

- there's no need for the beginning/end match (that's implied as far as I can tell)
- drop some unnecessary groups
- use non-capturing groups since we're just looking for a match
- as a consequence this can be constructed with String.join
- add a few more tests

Author: joegallo

modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CefParser.java

@@ -33,7 +33,6 @@
 import java.util.regex.MatchResult;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
-import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
 import static java.time.temporal.ChronoField.DAY_OF_MONTH;
@@ -69,16 +68,17 @@ final class CefParser {
 
     // Comprehensive regex pattern to match various MAC address formats
     private static final Pattern MAC_ADDRESS_PATTERN = Pattern.compile(
-        Stream.of(
+        String.join(
+            "|",
             // Combined colon and hyphen separated 6-group patterns
-            "(([0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2})",
+            "(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}",
             // Dot-separated 6-group pattern
-            "([0-9A-Fa-f]{4}\\.){2}[0-9A-Fa-f]{4}",
+            "(?:[0-9A-Fa-f]{4}\\.){2}[0-9A-Fa-f]{4}",
             // Combined colon and hyphen separated 8-group patterns
-            "([0-9A-Fa-f]{2}[:-]){7}[0-9A-Fa-f]{2}",
+            "(?:[0-9A-Fa-f]{2}[:-]){7}[0-9A-Fa-f]{2}",
             // Dot-separated EUI-64
-            "([0-9A-Fa-f]{4}\\.){3}[0-9A-Fa-f]{4}"
-        ).collect(Collectors.joining("|", "^(", ")$"))
+            "(?:[0-9A-Fa-f]{4}\\.){3}[0-9A-Fa-f]{4}"
+        )
     );
     private static final int EUI48_HEX_LENGTH = 48 / 4;
     private static final int EUI64_HEX_LENGTH = 64 / 4;

modules/ingest-common/src/test/java/org/elasticsearch/ingest/common/CefProcessorTests.java

@@ -970,10 +970,12 @@ public void testToMacAddressWithSeparators() {
         });
     }
 
-    public void testInvalidMacAddressSeparator() {
+    public void testInvalidMacAddresses() {
         CefParser parser = new CefParser(ZoneId.of("UTC"), false);
-        IllegalArgumentException e = expectThrows(IllegalArgumentException.class, () -> parser.toMACAddress("00|0D|60|AF|1B|61"));
-        assertThat(e.getMessage(), equalTo("Invalid MAC address format"));
+        for (String invalid : List.of("00|0D|60|AF|1B|61", "00:0D:60:AF:1B:61 foo", "0000:0D:60:AF:1B:61")) {
+            IllegalArgumentException e = expectThrows(IllegalArgumentException.class, () -> parser.toMACAddress(invalid));
+            assertThat(e.getMessage(), equalTo("Invalid MAC address format"));
+        }
     }
 
     public void testEUI48ToMacAddressWithOutSeparators() {