auparse, stdin, and AUPARSE_CB_EVENT_READY

Hi,

I made a audispd plugin, which reads from stdin and sends the strings to auparse_feed() (auditd-2.1.3).

This works fine on the command line.

When called from audispd however, it gives AUPARSE_CB_EVENT_READY for each single message, instead of after a complete event has been parsed.

So when you have 4 messages for one event:
- each of them appear as a single event when the plugin is started via audispd.
- a single even for all 4 messages appear when the plugin is started on the command line (and the log data fed via stdin, like cat test | audispd-testplugin)

Looking at the write code it looks ok (audisp/audispd.c):

static int write_to_plugin(event_t *e, const char *string, size_t string_len,
.. (note that i'm using string type so its the string code part) if (conf->p->format == F_STRING) {
do {
rc = write(conf->p->plug_pipe[1], string, string_len); } while (rc < 0 && errno == EINTR);
}

Do you know what causes this behavior, and/or how to "fix" it?

Thanks

Below patch "fixes" it. The problem is that if you have a node name included in the message, and that it's a long hostname, it's just not copying a long enough string, and it will fail to parse the message serial. When the serial is incorrect, auparse will fail to group them and notify with AUPARSE_CB_EVENT_READY as a consequence.

Now, I write this "fixes" it because if you have a really, really long hostname, it will fail in the same manner.

@@ -680,7 +680,7 @@
        int rc = 1;
 
         e->host = NULL;
-       tmp = strndupa(b, 80);
+       tmp = strndupa(b, 100);
        ptr = strtok(tmp, " ");
        if (ptr) {
                // Optionally grab the node - may or may not be included

A probably better fix is then:
- tmp = strndupa(b, 80);
+ tmp = strndupa(b, MAX_AUDIT_MESSAGE_LENGTH);

Or:
- tmp = strndupa(b, 80);
+ tmp = strndup(b); //potentially dangerous?

Or just do away with strtok and avoid duping strings.

Guillaume

Yes. It looks like we support names up to 255 bytes. So, the "fix" needs more to it. This also affects ausearch/report as well. Since this points directly to the problem, the real fix should be straight forward.

Sure, that's the long term plan.

-Steve

This should fix it:
https://fedorahosted.org/audit/changeset?671

-Steve