ossec-logcollector blocked and loops endlessly when a NUL character appears in monitored log file

[ybonnamy]

Hi,

i'm monitoring a proprietary application log file with ossec, unfortunatly my monitoring appears to stop from time to time. After raising log level, it appeared that ossec-logcollector loops endlessly with such debug output :

2016/08/04 09:17:52 ossec-logcollector: Message not complete. Trying again: '2016-08-04 06:25:28,601 INFO  [ajp-bio-8009-exec-2442-com.mccsoft.diapason.service.Login] Login failed: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903C8, comment: AcceptSecurityContext error, data 52e, v2580'
2016/08/04 09:17:52 ossec-logcollector: Message not complete. Trying again: '2016-08-04 06:25:28,601 INFO  [ajp-bio-8009-exec-2442-com.mccsoft.diapason.service.Login] Login failed: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903C8, comment: AcceptSecurityContext error, data 52e, v2580'
2016/08/04 09:17:54 ossec-logcollector: Message not complete. Trying again: '2016-08-04 06:25:28,601 INFO  [ajp-bio-8009-exec-2442-com.mccsoft.diapason.service.Login] Login failed: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903C8, comment: AcceptSecurityContext error, data 52e, v2580'
2016/08/04 09:17:54 ossec-logcollector: Message not complete. Trying again: '2016-08-04 06:25:28,601 INFO  [ajp-bio-8009-exec-2442-com.mccsoft.diapason.service.Login] Login failed: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903C8, comment: AcceptSecurityContext error, data 52e, v2580'
2016/08/04 09:17:56 ossec-logcollector: Message not complete. Trying again: '2016-08-04 06:25:28,601 INFO  [ajp-bio-8009-exec-2442-com.mccsoft.diapason.service.Login] Login failed: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903C8, comment: AcceptSecurityContext error, data 52e, v2580'
2016/08/04 09:17:56 ossec-logcollector: Message not complete. Trying again: '2016-08-04 06:25:28,601 INFO  [ajp-bio-8009-exec-2442-com.mccsoft.diapason.service.Login] Login failed: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903C8, comment: AcceptSecurityContext error, data 52e, v2580'

in the monitored logfile, the content is :

2016-08-04 06:25:28,601 INFO  [ajp-bio-8009-exec-2442-com.mccsoft.diapason.service.Login] Login failed: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903C8, comment: AcceptSecurityContext error, data 52e, v2580^@]

so it looks as if the ^@ we can see at the end is disturbing ossec-logcollector
if i look quickly at the ossec-hids-2.8.3/src/logcollector/read_syslog.csource code, i see no way it could exit this endless loop.

Thanks for your help.

[ybonnamy]

actually it is a NUL character , 00 in Hex , ^@ was just how vim displayed it. attached a sample.
log.withNUL.txt

[ybonnamy]

easy way to reproduce if /var/log/message is monitored :
dd if=/dev/zero bs=1 count=1 >> /var/log/messages

such a command could probably be used to trig a DOS of the monitoring of some other files

[ybonnamy]

if ever no solution was found here, here is the workaround i could use :

--- ./src/logcollector/read_syslog.c.orig       2015-10-12 23:21:06.000000000 +0200
+++ ./src/logcollector/read_syslog.c    2016-08-08 15:08:56.278924850 +0200
@@ -44,7 +44,13 @@
         {
             *p = '\0';
         }
-
+       /* debug issue #913 detect NUL char */
+        else if ((p = strrchr(str, '\0')) != NULL)
+        {
+                debug1("debug913 NUL found" );
+               /* replace NUL with a dot */
+               *p = '.';
+        }
         /* If we didn't get the new line, because the
          * size is large, send what we got so far.
          */

(please note that this workaround elaboration was an awful trial and error process , i'm not a C++ developper at all)

[ybonnamy]

14 months later, bug still exist with ossec-hids-agent-2.9.2 on RHEL7, it's still too easy to defeat ossec-logcollector injecting a nul character in a monitored log file.

[ddpbsd]

@ybonnamy Thanks for reporting, fixing, and reminding us that you fixed it. Pull request #1318 should hopefully fix the problem.