log-pcap: fix segfault on lz4 compressed pcaps #6875

oxagast · 2022-01-27T16:16:11Z

Moved a file existence check to fix segfault if Suricata tries to write to an lz4 compressed .pcap file if you don't have permission to write to it. Also removed the previous code that would log this elsewhere, so you don't get double log entries.

https://redmine.openinfosecfoundation.org/issues/5022

…te to the file.

codecov · 2022-01-27T18:42:03Z

Codecov Report

Merging #6875 (30960b2) into master (f8e1430) will decrease coverage by 0.16%.
The diff coverage is n/a.

❗ Current head 30960b2 differs from pull request most recent head 4fa3b55. Consider uploading reports for the commit 4fa3b55 to get more accurate results

@@            Coverage Diff             @@
##           master    #6875      +/-   ##
==========================================
- Coverage   77.72%   77.56%   -0.17%     
==========================================
  Files         628      628              
  Lines      186493   186921     +428     
==========================================
+ Hits       144959   144992      +33     
- Misses      41534    41929     +395

Flag	Coverage Δ
fuzzcorpus	`57.72% <ø> (-0.67%)`	⬇️
suricata-verify	`53.54% <ø> (-0.54%)`	⬇️
unittests	`62.72% <ø> (-0.49%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

oxagast

Fixed the formatting so checks don't fail.

jufajardini

Thanks for your interest in contributing to Suricata!

We would appreciate if you followed our code submission criteria :)
Especially:

commit message formatting
commit message and naming convention (so something like: log-pcap: fix segfault on lz4 compressed pcaps and then detail more in the commit body? )
don't add unnecessary commits (if the formatting fix covers your code changes only, please squash them ;) )

Also, have you signed the Suricata Contribution Agreement?

oxagast · 2022-01-28T05:00:06Z

Hi,
Thanks for the tips. I've signed the contribution agreement, yes. I've also edited the title of the PR to reflect naming conventions. As for the second commit that was only edited formatting, I didn't think that it would allow a merge if the automated checks didn't pass. Now I'm not sure what you mean by squash the latest change with only formatting edits though, I didn't know there was a way to remove edits from the version tracker once they were committed and pushed. Is there a way to do that? Or do you just mean marge the two commits?

Edit: I think I figured out how to squash them with git merge master --squash.

commit 30960b2 Author: Marshall Whittaker <marshallwhittaker@gmail.com> Date: Thu Jan 27 13:52:56 2022 -0500 Run the clang 9 formatting script on code fix for lz4 pcap segfault. log-pcap: fix segfault on lz4 compressed pcaps

victorjulien

See inline comments

victorjulien · 2022-01-28T06:58:17Z

src/log-pcap.c

@@ -576,6 +576,12 @@ static int PcapLog (ThreadVars *t, void *thread_data, const Packet *p)
            SCLogError(SC_ERR_FSEEK, "fseek failed: %s", strerror(errno));
            return TM_ECODE_FAILED;
        }
+        comp->file = fopen(pl->filename, "w");


I don't see a check for comp->file here, which suggests it might be already open and this would leak the previous descriptor. We're in the packet path here, so we would call this for each packet.

If comp->file is null here, I think it means we didn't properly error check something during setup. I think the issue should be handled during setup/initialization (or file rotation)

victorjulien · 2022-01-28T06:59:12Z

src/log-pcap.c

-                        "Error opening file for compressed output: %s",
-                        strerror(errno));
+                /*              took this out so that it won't print twice, but still would function
+                   same SCLogError(SC_ERR_OPENING_FILE, "Error opening file for compressed output:


if removing output please just remove it instead of leaving it as a comment. It is fine to have a comment explaining why there is no error message here

jufajardini · 2022-01-28T08:58:36Z

Hi, Thanks for the tips. I've signed the contribution agreement, yes. I've also edited the title of the PR to reflect naming conventions. As for the second commit that was only edited formatting, I didn't think that it would allow a merge if the automated checks didn't pass. Now I'm not sure what you mean by squash the latest change with only formatting edits though, I didn't know there was a way to remove edits from the version tracker once they were committed and pushed. Is there a way to do that? Or do you just mean marge the two commits?

Edit: I think I figured out how to squash them with git merge master --squash.

Kudos! Now you can follow those with the next PR submission :) Can you also create a ticket on our redmine project, to go with that iteration?

oxagast · 2022-01-30T01:22:57Z

Probably correct to check if this directory is writeable on startup. I didn't happen to look, is everything else (that's working properly) also checked this way? I'm guessing that if the perms somhow got changed incorrectly while Suricata is running it would also fail that way, but the risk is much lower and the performance implications may not be worth doing it in the packet thread.
I have created a ticket on redmine with a backtrace.

inashivb · 2022-01-31T07:25:03Z

Probably correct to check if this directory is writeable on startup. I didn't happen to look, is everything else (that's working properly) also checked this way?

Sounds about right to me. Directory should exist and be writable if we are willing to write something in there.

suricata-qa · 2022-04-26T15:08:03Z

Warning: no commits in this PR have specified the following ticket(s):

5022 - https://redmine.openinfosecfoundation.org/issues/5022

Please update the commit(s) and submit a new PR.

catenacyber · 2022-07-06T13:33:53Z

@oxagast are you still working on this ?

oxagast · 2022-07-06T13:35:25Z

Sorry, I completely forgot about this. I'll have to take another look into it. Thanks for reminding me.

oxagast · 2022-07-06T16:31:47Z

So I just recompiled the latest version out of OSIF:master and it seems it is already fixed. Before Suricata would try to log the .lz4 compressed logs to a separate directory under the default logging dir. If that dir was not writable it would fault. However now it seem Suricata has changed where it is dropping the .lz4 logs, and is now putting them in the default (or user specified) logging directory, not in a sub-directory. So it seems to be fixed, either intentionally or unintentionally. I'll now close this issue.

Thanks!

Bug: OISF#6875.

Bug: OISF#6875. (cherry picked from commit 0be3ba8)

Fixed segfault on using lz4 compressed pcaps if you are unable to wri…

e2f53ed

…te to the file.

oxagast requested a review from a team as a code owner January 27, 2022 16:16

Run the clang 9 formatting script on code fix for lz4 pcap segfault.

30960b2

oxagast commented Jan 27, 2022

View reviewed changes

jufajardini requested changes Jan 27, 2022

View reviewed changes

oxagast changed the title ~~Segfault on using lz4 compressed pcaps if you are unable to write to file~~ log-pcap: fix segfault on lz4 compressed pcaps Jan 28, 2022

oxagast added 2 commits January 28, 2022 00:13

Squashed commit of the following:

ef7e4a5

commit 30960b2 Author: Marshall Whittaker <marshallwhittaker@gmail.com> Date: Thu Jan 27 13:52:56 2022 -0500 Run the clang 9 formatting script on code fix for lz4 pcap segfault. log-pcap: fix segfault on lz4 compressed pcaps

Merge github.com:oxagast/suricata into HEAD

4765356

oxagast requested a review from jufajardini January 28, 2022 05:23

victorjulien requested changes Jan 28, 2022

View reviewed changes

victorjulien added the needs ticket Needs (link to) redmine ticket label Jan 28, 2022

oxagast added 2 commits January 30, 2022 10:41

Merge https://github.com/OISF/suricata

c2bb99b

Edited old code out of the comment.

4fa3b55

victorjulien removed the needs ticket Needs (link to) redmine ticket label Feb 2, 2022

suricata-qa added the needs ticket Needs (link to) redmine ticket label Apr 26, 2022

catenacyber added the needs rebase Needs rebase to master label Jul 6, 2022

oxagast closed this Jul 6, 2022

victorjulien added a commit to victorjulien/suricata that referenced this pull request Mar 20, 2024

eve/alert: fix validation check

92598fd

Bug: OISF#6875.

victorjulien added a commit to victorjulien/suricata that referenced this pull request Mar 22, 2024

eve/alert: fix validation check

0be3ba8

Bug: OISF#6875.

jlucovsky pushed a commit to jlucovsky/suricata that referenced this pull request Aug 18, 2024

eve/alert: fix validation check

6c03f8b

Bug: OISF#6875. (cherry picked from commit 0be3ba8)

jlucovsky pushed a commit to jlucovsky/suricata that referenced this pull request Sep 3, 2024

eve/alert: fix validation check

0bffb2e

Bug: OISF#6875. (cherry picked from commit 0be3ba8)

jlucovsky pushed a commit to jlucovsky/suricata that referenced this pull request Sep 11, 2024

eve/alert: fix validation check

6280cee

Bug: OISF#6875. (cherry picked from commit 0be3ba8)

victorjulien added a commit to victorjulien/suricata that referenced this pull request Sep 14, 2024

eve/alert: fix validation check

22b8c2a

Bug: OISF#6875. (cherry picked from commit 0be3ba8)

victorjulien added a commit to victorjulien/suricata that referenced this pull request Sep 23, 2024

eve/alert: fix validation check

13b1d93

Bug: OISF#6875. (cherry picked from commit 0be3ba8)

victorjulien added a commit to victorjulien/suricata that referenced this pull request Sep 24, 2024

eve/alert: fix validation check

b5851d2

Bug: OISF#6875. (cherry picked from commit 0be3ba8)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

log-pcap: fix segfault on lz4 compressed pcaps #6875

log-pcap: fix segfault on lz4 compressed pcaps #6875

oxagast commented Jan 27, 2022 •

edited by victorjulien

Loading

codecov bot commented Jan 27, 2022 •

edited

Loading

oxagast left a comment

jufajardini left a comment

oxagast commented Jan 28, 2022 •

edited

Loading

victorjulien left a comment

victorjulien Jan 28, 2022

victorjulien Jan 28, 2022

victorjulien Jan 28, 2022

jufajardini commented Jan 28, 2022

oxagast commented Jan 30, 2022

inashivb commented Jan 31, 2022

suricata-qa commented Apr 26, 2022

catenacyber commented Jul 6, 2022

oxagast commented Jul 6, 2022

oxagast commented Jul 6, 2022

log-pcap: fix segfault on lz4 compressed pcaps #6875

log-pcap: fix segfault on lz4 compressed pcaps #6875

Conversation

oxagast commented Jan 27, 2022 • edited by victorjulien Loading

codecov bot commented Jan 27, 2022 • edited Loading

Codecov Report

oxagast left a comment

Choose a reason for hiding this comment

jufajardini left a comment

Choose a reason for hiding this comment

oxagast commented Jan 28, 2022 • edited Loading

victorjulien left a comment

Choose a reason for hiding this comment

victorjulien Jan 28, 2022

Choose a reason for hiding this comment

victorjulien Jan 28, 2022

Choose a reason for hiding this comment

victorjulien Jan 28, 2022

Choose a reason for hiding this comment

jufajardini commented Jan 28, 2022

oxagast commented Jan 30, 2022

inashivb commented Jan 31, 2022

suricata-qa commented Apr 26, 2022

catenacyber commented Jul 6, 2022

oxagast commented Jul 6, 2022

oxagast commented Jul 6, 2022

oxagast commented Jan 27, 2022 •

edited by victorjulien

Loading

codecov bot commented Jan 27, 2022 •

edited

Loading

oxagast commented Jan 28, 2022 •

edited

Loading