Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[docker plugin] Refactor pipeline reader for data safety #14375

Conversation

fearful-symmetry
Copy link
Contributor

@fearful-symmetry fearful-symmetry commented Nov 1, 2019

Thanks a ton to @urso for helping me understand what was actually going on here.

What is this?

This addresses an item mentioned in #13990 :

The code that reads from the FIFO pipe is a mess, and copied from docker's example plugin. The protobuf reader is questionable, and we might want to implement our own reader.

The issue is that the original reader, Uint32DelimitedReader, can improperly scroll through the buffer and leave it in an invalid state.

A FIFO reader from docker is a stream, consisting of a length header and a body. This new reader takes a three-step approach when it comes to scrolling through the buffer:

  1. If length header <0, we have bad data, and we cycle through the frames until we get a valid length.
  2. If length is valid but larger than the max buffer size, we disregard length bytes and continue.
  3. If length is valid and we can consume everything into the buffer, continue.

How do I test this?

On a host that has docker, run mage build and mage install. After that, connect to a running container with a command like: docker run --log-driver=ossifrage/dockerlogbeat:0.0.1 --log-opt output.elasticsearch.hosts="172.18.0.2:9200" --log-opt output.elasticsearch.index="dockerbeat-test" -it debian:jessie /bin/bash

@fearful-symmetry fearful-symmetry added the Team:Integrations Label for the Integrations team label Nov 1, 2019
@fearful-symmetry fearful-symmetry self-assigned this Nov 1, 2019
@fearful-symmetry fearful-symmetry requested review from urso and a team November 6, 2019 14:12
x-pack/dockerlogbeat/pipereader/reader.go Outdated Show resolved Hide resolved
x-pack/dockerlogbeat/pipereader/reader.go Show resolved Hide resolved
x-pack/dockerlogbeat/pipereader/reader.go Outdated Show resolved Hide resolved
@fearful-symmetry
Copy link
Contributor Author

Removed a bunch of dependencies that are no longer needed with this PR, hence the impressive diff.

if err != nil {
return errors.Wrap(err, "error getting length frame")
}
fmt.Fprintf(os.Stderr, "Got header specifying length %d\n", lenFrame)
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

debug message?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bah, I completely forgot I put those in.

return nil, errors.Wrapf(err, "error opening logger fifo: %q", file)
}

return &PipeReader{fifoPipe: inputFile, byteOrder: binary.BigEndian, lenFrameBuf: make([]byte, 4), bodyBuf: nil, maxSize: 2e6}, nil
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

consider calling NewReaderFromReadCloser

if err != nil {
return errors.Wrap(err, "error reading buffer")
}
return proto.Unmarshal(readBuf[:lenFrame], log)
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: given len(readBuf) == lenFrame we don't need readBuf[:lenFrame].

@fearful-symmetry fearful-symmetry merged commit 4cc73ac into elastic:feature/dockerbeat Nov 13, 2019
leweafan pushed a commit to leweafan/beats that referenced this pull request Apr 28, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Team:Integrations Label for the Integrations team
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants