|
| 1 | +/* |
| 2 | + * Regression: stale JSON queue flag drops the first alert after rotation |
| 3 | + * |
| 4 | + * ANT-2026-NCEH7RB6 / CWE-372 |
| 5 | + * |
| 6 | + * jqueue_next() reopens alerts.json when the inode changes or the file |
| 7 | + * shrinks, then returns that read directly. An empty new file sets |
| 8 | + * JQUEUE_READ_FAILED and the flag is not cleared. The next call parses a |
| 9 | + * real alert and deletes it because the flag is still set. The read |
| 10 | + * position has already moved past the record. |
| 11 | + * |
| 12 | + * Build (from src/): |
| 13 | + * make -f tests/regressions/Makefile issue_nceh7rb6_json_rotate_flag |
| 14 | + * |
| 15 | + * Run: |
| 16 | + * ./issue_nceh7rb6_json_rotate_flag |
| 17 | + */ |
| 18 | + |
| 19 | +#include <stdio.h> |
| 20 | +#include <stdlib.h> |
| 21 | +#include <string.h> |
| 22 | +#include <unistd.h> |
| 23 | + |
| 24 | +#include "shared.h" |
| 25 | +#include "cJSON.h" |
| 26 | +#include "json-queue.h" |
| 27 | + |
| 28 | +const char *__local_name __attribute__((weak)) = |
| 29 | + "issue-nceh7rb6-json-rotate-flag"; |
| 30 | + |
| 31 | +static int failures = 0; |
| 32 | + |
| 33 | +static void expect(int cond, const char *msg) |
| 34 | +{ |
| 35 | + if (cond) { |
| 36 | + printf(" ok: %s\n", msg); |
| 37 | + } else { |
| 38 | + printf(" FAIL: %s\n", msg); |
| 39 | + failures++; |
| 40 | + } |
| 41 | +} |
| 42 | + |
| 43 | +static int write_all(const char *path, const char *text) |
| 44 | +{ |
| 45 | + FILE *fp = fopen(path, "w"); |
| 46 | + |
| 47 | + if (!fp) { |
| 48 | + return -1; |
| 49 | + } |
| 50 | + if (fputs(text, fp) == EOF) { |
| 51 | + fclose(fp); |
| 52 | + return -1; |
| 53 | + } |
| 54 | + return fclose(fp) == 0 ? 0 : -1; |
| 55 | +} |
| 56 | + |
| 57 | +static int append_line(const char *path, const char *id) |
| 58 | +{ |
| 59 | + FILE *fp = fopen(path, "a"); |
| 60 | + int rc; |
| 61 | + |
| 62 | + if (!fp) { |
| 63 | + return -1; |
| 64 | + } |
| 65 | + rc = fprintf(fp, "{\"id\":\"%s\"}\n", id); |
| 66 | + if (fclose(fp) != 0 || rc < 0) { |
| 67 | + return -1; |
| 68 | + } |
| 69 | + return 0; |
| 70 | +} |
| 71 | + |
| 72 | +static const char *alert_id(cJSON *obj) |
| 73 | +{ |
| 74 | + cJSON *id; |
| 75 | + |
| 76 | + if (!obj) { |
| 77 | + return NULL; |
| 78 | + } |
| 79 | + id = cJSON_GetObjectItem(obj, "id"); |
| 80 | + if (!id || id->type != cJSON_String || !id->valuestring) { |
| 81 | + return NULL; |
| 82 | + } |
| 83 | + return id->valuestring; |
| 84 | +} |
| 85 | + |
| 86 | +static void take(file_queue *queue, const char *want, const char *msg) |
| 87 | +{ |
| 88 | + cJSON *obj = jqueue_next(queue); |
| 89 | + const char *got = alert_id(obj); |
| 90 | + |
| 91 | + expect(got != NULL && strcmp(got, want) == 0, msg); |
| 92 | + cJSON_Delete(obj); |
| 93 | +} |
| 94 | + |
| 95 | +/* New empty alerts.json, then the first alert of the day. */ |
| 96 | +static void test_inode_rotation(const char *dir) |
| 97 | +{ |
| 98 | + char path[256]; |
| 99 | + file_queue queue; |
| 100 | + |
| 101 | + snprintf(path, sizeof(path), "%s/rotate.json", dir); |
| 102 | + expect(write_all(path, "{\"id\":\"before\"}\n") == 0, "write the old day's file"); |
| 103 | + |
| 104 | + jqueue_init(&queue); |
| 105 | + expect(jqueue_open_path(&queue, path, 0) == 0, "open the old day's file"); |
| 106 | + take(&queue, "before", "alert before rotation is forwarded"); |
| 107 | + |
| 108 | + expect(unlink(path) == 0, "unlink the old day's file"); |
| 109 | + expect(write_all(path, "") == 0, "new day's file is empty"); |
| 110 | + expect(jqueue_next(&queue) == NULL, "empty new file yields nothing"); |
| 111 | + |
| 112 | + expect(append_line(path, "attacker") == 0, "first alert of the day is written"); |
| 113 | + take(&queue, "attacker", "first alert after rotation is forwarded"); |
| 114 | + |
| 115 | + expect(append_line(path, "after") == 0, "later alert is written"); |
| 116 | + take(&queue, "after", "alert after the first of the day is forwarded"); |
| 117 | + jqueue_close(&queue); |
| 118 | +} |
| 119 | + |
| 120 | +/* Alert already in the new file when the inode change is noticed. */ |
| 121 | +static void test_alert_already_present(const char *dir) |
| 122 | +{ |
| 123 | + char path[256]; |
| 124 | + file_queue queue; |
| 125 | + |
| 126 | + snprintf(path, sizeof(path), "%s/present.json", dir); |
| 127 | + expect(write_all(path, "{\"id\":\"before\"}\n") == 0, "write file before a filled rotation"); |
| 128 | + |
| 129 | + jqueue_init(&queue); |
| 130 | + expect(jqueue_open_path(&queue, path, 0) == 0, "open file before a filled rotation"); |
| 131 | + take(&queue, "before", "pre-rotation alert is forwarded"); |
| 132 | + |
| 133 | + expect(unlink(path) == 0, "replace the file"); |
| 134 | + expect(write_all(path, "{\"id\":\"already\"}\n") == 0, "new file already holds an alert"); |
| 135 | + take(&queue, "already", "alert written before the reopen is forwarded"); |
| 136 | + jqueue_close(&queue); |
| 137 | +} |
| 138 | + |
| 139 | +/* Same inode, file truncated, then one new alert. */ |
| 140 | +static void test_truncate(const char *dir) |
| 141 | +{ |
| 142 | + char path[256]; |
| 143 | + file_queue queue; |
| 144 | + FILE *fp; |
| 145 | + |
| 146 | + snprintf(path, sizeof(path), "%s/trunc.json", dir); |
| 147 | + expect(write_all(path, "{\"id\":\"before\"}\n") == 0, "write file before truncate"); |
| 148 | + |
| 149 | + jqueue_init(&queue); |
| 150 | + expect(jqueue_open_path(&queue, path, 0) == 0, "open file before truncate"); |
| 151 | + take(&queue, "before", "alert before truncate is forwarded"); |
| 152 | + |
| 153 | + fp = fopen(path, "w"); |
| 154 | + expect(fp != NULL, "truncate the same inode"); |
| 155 | + if (fp) { |
| 156 | + fclose(fp); |
| 157 | + } |
| 158 | + expect(jqueue_next(&queue) == NULL, "truncated empty file yields nothing"); |
| 159 | + |
| 160 | + expect(append_line(path, "attacker") == 0, "first alert after truncate is written"); |
| 161 | + take(&queue, "attacker", "first alert after truncate is forwarded"); |
| 162 | + jqueue_close(&queue); |
| 163 | +} |
| 164 | + |
| 165 | +int main(void) |
| 166 | +{ |
| 167 | + char dir[] = "/tmp/nceh7rb6-XXXXXX"; |
| 168 | + |
| 169 | + printf("JSON queue flag after alerts.json rotation\n"); |
| 170 | + if (!mkdtemp(dir)) { |
| 171 | + perror("mkdtemp"); |
| 172 | + return 1; |
| 173 | + } |
| 174 | + |
| 175 | + test_inode_rotation(dir); |
| 176 | + test_alert_already_present(dir); |
| 177 | + test_truncate(dir); |
| 178 | + |
| 179 | + { |
| 180 | + const char *names[] = {"rotate.json", "present.json", "trunc.json", NULL}; |
| 181 | + char path[256]; |
| 182 | + int i; |
| 183 | + |
| 184 | + for (i = 0; names[i]; i++) { |
| 185 | + snprintf(path, sizeof(path), "%s/%s", dir, names[i]); |
| 186 | + unlink(path); |
| 187 | + } |
| 188 | + } |
| 189 | + rmdir(dir); |
| 190 | + |
| 191 | + if (failures) { |
| 192 | + printf("FAIL: %d JSON rotation check(s)\n", failures); |
| 193 | + return 1; |
| 194 | + } |
| 195 | + printf("ok\n"); |
| 196 | + return 0; |
| 197 | +} |
0 commit comments