Merge pull request ossec#2472 from atomicturtle/fix/ant-2026-2bepxi8w-syslog-tcp-framing

Forward every complete line from a syslog-over-TCP recv()

Author: atomicturtle

.github/workflows/make-multi-platform.yml

@@ -121,6 +121,8 @@ jobs:
           ./src/issue_739qmecr_readsecmsg_uncompress
           make -C src -f tests/regressions/Makefile issue_qy1shlvv_syslog_tcp_idle
           ./src/issue_qy1shlvv_syslog_tcp_idle
+          make -C src -f tests/regressions/Makefile issue_2bepxi8w_syslog_tcp_frame
+          ./src/issue_2bepxi8w_syslog_tcp_frame
           make -C src -f tests/regressions/Makefile issue_2nlm3gpl_crypto_method_auth
           ./src/issue_2nlm3gpl_crypto_method_auth
           make -C src -f tests/regressions/Makefile issue_kzajsoet_syscheck_fifo

CHANGELOG.md

@@ -29,6 +29,7 @@ Unrelease 4.5.0 changes
 
 **Security Fixes**
 
+- @atomicturtle - Forward every complete line from a syslog-over-TCP ``recv()``. ``ossec-remoted`` cut at the first newline and parked the rest without scanning again, so lines that shared a segment were glued onto the next segment as one event, or dropped on close, CRLF, or a full buffer. The worker now appends into the incomplete prefix and drains every complete line before the next read (ANT-2026-2BEPXI8W)
 - @atomicturtle - Stop daily reports from leaking per alert in ``ossec-monitord``. ``os_ReportdStart()`` left the ``OS_StrBreak()`` group array and the top-entry list nodes behind; with reports running in a thread that memory stayed for the life of the daemon. The group array is freed after the loop, and each top-entry list's nodes are released with the hash table (covered with ANT-2026-AVE66YB6) (ANT-2026-M3W3LJEQ)
 - @atomicturtle - Bound every plain SMTP socket in ``ossec-maild`` and ``ossec-monitord`` to 60 seconds per reply or write. ``OS_Sendmail()`` read through a bare ``recv()`` with no timeout, so a relay that accepted and stayed silent held a sender thread forever. After ``maild.max_workers`` such threads, no further alert e-mail was sent until ``ossec-maild`` was restarted. A timed-out read fails like any other failed reply and releases the worker (ANT-2026-FR6DKH31)
 - @atomicturtle - Keep a timed-out active response listed until its ``delete`` has exited. ``ossec-execd`` forked ``delete`` and dropped the entry at once, so the next alert for that address could run ``add`` while ``delete`` was still running. A set-style target such as ``hosts.deny`` or a PF table then lost the block, and later alerts skipped the script because execd still listed the address. A request for that same script and address now waits for the in-flight ``delete`` and is then a new block. A request for a different address does not wait (ANT-2026-8WBHQ0QF)

src/remoted/remoted.h

@@ -96,6 +96,15 @@ int remoted_send_syslog_msg(remoted_listener *listener, const char *msg,
  */
 int syslog_tcp_should_close_on_recv(int r_sz, int err, int pool_should_drop);
 
+/* Drain every complete TCP syslog line from storage_buffer, strip CR and
+ * leading <PRI>, and keep any incomplete tail at the front. send_fn returns
+ * <0 to stop. Returns 0 on success or -1 if send_fn failed.
+ * ANT-2026-2BEPXI8W.
+ */
+int syslog_tcp_drain_complete_lines(char *storage_buffer, size_t *sb_used,
+                                    int (*send_fn)(const char *msg, void *ctx),
+                                    void *ctx);
+
 /* Rate limit logging of input rejected before authentication.
  * Returns 1 if the caller should log the rejection, 0 if it was only counted.
  * Uses remoted_self: call from the listener thread only.

src/remoted/syslog_tcp_frame.c

@@ -0,0 +1,61 @@
+/* Copyright (C) 2026 Atomicorp, Inc.
+ * All rights reserved.
+ *
+ * This program is a free software; you can redistribute it
+ * and/or modify it under the terms of the GNU General Public
+ * License (version 2) as published by the FSF - Free Software
+ * Foundation.
+ */
+
+#include "shared.h"
+#include "remoted.h"
+
+#include <string.h>
+
+/* Forward every complete TCP syslog line in storage_buffer. Strip a trailing
+ * CR and a leading <PRI> on each line, leave any incomplete rest at the front,
+ * and update *sb_used. send_fn returns <0 to abort. ANT-2026-2BEPXI8W.
+ */
+int syslog_tcp_drain_complete_lines(char *storage_buffer, size_t *sb_used,
+                                    int (*send_fn)(const char *msg, void *ctx),
+                                    void *ctx)
+{
+    char *line;
+    char *line_end;
+    char *buffer_pt;
+
+    if (!storage_buffer || !sb_used || !send_fn) {
+        return (-1);
+    }
+
+    line = storage_buffer;
+    while ((line_end = strchr(line, '\n')) != NULL) {
+        *line_end = '\0';
+
+        buffer_pt = strchr(line, '\r');
+        if (buffer_pt) {
+            *buffer_pt = '\0';
+        }
+
+        if (line[0] == '<') {
+            buffer_pt = strchr(line + 1, '>');
+            if (buffer_pt) {
+                buffer_pt++;
+            } else {
+                buffer_pt = line;
+            }
+        } else {
+            buffer_pt = line;
+        }
+
+        if (send_fn(buffer_pt, ctx) < 0) {
+            return (-1);
+        }
+
+        line = line_end + 1;
+    }
+
+    *sb_used = strlen(line);
+    memmove(storage_buffer, line, *sb_used + 1);
+    return (0);
+}

src/remoted/syslogtcp.c

@@ -111,39 +111,58 @@ static void syslog_client_drop_pending(void *arg)
     free(client);
 }
 
+typedef struct {
+    remoted_listener *listener;
+    const char *srcip;
+} syslog_send_ctx;
+
+static int syslog_worker_send(const char *msg, void *ctx)
+{
+    syslog_send_ctx *send_ctx = (syslog_send_ctx *)ctx;
+
+    return remoted_send_syslog_msg(send_ctx->listener, msg, send_ctx->srcip);
+}
+
 /* Handle each client connection in a worker thread */
 static void *syslog_client_worker(void *arg)
 {
     syslog_client_arg *client = (syslog_client_arg *)arg;
     remoted_listener *listener = client->listener;
     int client_socket = client->client_socket;
     char srcip[IPSIZE + 1];
-    int sb_size = OS_MAXSTR;
+    size_t sb_used = 0;
     int r_sz = 0;
+    syslog_send_ctx send_ctx;
 
-    char buffer[OS_MAXSTR + 2];
     char storage_buffer[OS_MAXSTR + 2];
-    char tmp_buffer[OS_MAXSTR + 2];
-
-    char *buffer_pt = NULL;
 
     strncpy(srcip, client->srcip, IPSIZE);
     srcip[IPSIZE] = '\0';
     free(client);
 
+    send_ctx.listener = listener;
+    send_ctx.srcip = srcip;
+
     os_block_worker_signals();
 
-    memset(buffer, '\0', OS_MAXSTR + 2);
     memset(storage_buffer, '\0', OS_MAXSTR + 2);
-    memset(tmp_buffer, '\0', OS_MAXSTR + 2);
 
     while (1) {
         if (remoted_shutting_down) {
             close(client_socket);
             return NULL;
         }
 
-        if ((r_sz = syslog_recv_buffer(client_socket, buffer, OS_MAXSTR - 2)) <= 0) {
+        /* A line that fills the whole buffer without a newline is dropped */
+        if (sb_used >= OS_MAXSTR - 2) {
+            merror("%s: Full buffer receiving from: '%s'", ARGV0, srcip);
+            sb_used = 0;
+            storage_buffer[0] = '\0';
+        }
+
+        /* Append behind the incomplete line kept from the previous recv() */
+        if ((r_sz = syslog_recv_buffer(client_socket, storage_buffer + sb_used,
+                                       OS_MAXSTR - (int)sb_used)) <= 0) {
             if (remoted_shutting_down) {
                 close(client_socket);
                 return NULL;
@@ -170,65 +189,24 @@ static void *syslog_client_worker(void *arg)
             return NULL;
         }
 
-        buffer_pt = strchr(buffer, '\n');
-        if (!buffer_pt) {
-            if ((sb_size - r_sz) <= 2) {
-                merror("%s: Full buffer receiving from: '%s'", ARGV0, srcip);
-                sb_size = OS_MAXSTR;
-                storage_buffer[0] = '\0';
-                continue;
-            }
+        /* Map embedded NULs to spaces so strchr/strlen framing cannot drop
+         * later complete lines (same as read_syslog / ANT-2026-RNCE3SO7). */
+        {
+            int i;
 
-            strncat(storage_buffer, buffer, sb_size);
-            sb_size -= r_sz;
-            continue;
-        }
-
-        if (*(buffer_pt + 1) != '\0') {
-            *buffer_pt = '\0';
-            buffer_pt++;
-            strncpy(tmp_buffer, buffer_pt, OS_MAXSTR);
-        }
-
-        if ((sb_size - r_sz) <= 2) {
-            merror("%s: Full buffer receiving from: '%s'.", ARGV0, srcip);
-            sb_size = OS_MAXSTR;
-            storage_buffer[0] = '\0';
-            tmp_buffer[0] = '\0';
-            continue;
-        }
-
-        strncat(storage_buffer, buffer, sb_size);
-
-        buffer_pt = strchr(storage_buffer, '\r');
-        if (buffer_pt) {
-            *buffer_pt = '\0';
-        }
-
-        if (storage_buffer[0] == '<') {
-            buffer_pt = strchr(storage_buffer + 1, '>');
-            if (buffer_pt) {
-                buffer_pt++;
-            } else {
-                buffer_pt = storage_buffer;
+            for (i = 0; i < r_sz; i++) {
+                if (storage_buffer[sb_used + (size_t)i] == '\0') {
+                    storage_buffer[sb_used + (size_t)i] = ' ';
+                }
             }
-        } else {
-            buffer_pt = storage_buffer;
         }
+        sb_used += (size_t)r_sz;
 
-        if (remoted_send_syslog_msg(listener, buffer_pt, srcip) < 0) {
+        if (syslog_tcp_drain_complete_lines(storage_buffer, &sb_used,
+                                            syslog_worker_send, &send_ctx) < 0) {
             close(client_socket);
             return NULL;
         }
-
-        if (tmp_buffer[0] != '\0') {
-            strncpy(storage_buffer, tmp_buffer, OS_MAXSTR);
-            sb_size = OS_MAXSTR - (strlen(storage_buffer) + 1);
-            tmp_buffer[0] = '\0';
-        } else {
-            storage_buffer[0] = '\0';
-            sb_size = OS_MAXSTR;
-        }
     }
 }
 

src/tests/regressions/Makefile

@@ -28,6 +28,7 @@ REGRESSION_BINS = \
 	issue_fbj3la25_rids_counter_reload \
 	issue_ja2nxew1_reject_log \
 	issue_qy1shlvv_syslog_tcp_idle \
+	issue_2bepxi8w_syslog_tcp_frame \
 	issue_1611_local_ip_bind \
 	issue_1668_agent_hostname \
 	issue_1668_ossecalert_hostname \
@@ -206,6 +207,16 @@ issue_qy1shlvv_syslog_tcp_idle: tests/regressions/issue_qy1shlvv_syslog_tcp_idle
 		-Wl,--start-group shared.a os_regex.a -Wl,--end-group \
 		-lpcre2-8 -lm -lpthread -lssl -lcrypto
 
+# ANT-2026-2BEPXI8W: TCP syslog must drain every complete line per recv.
+issue_2bepxi8w_syslog_tcp_frame: \
+		tests/regressions/issue_2bepxi8w_syslog_tcp_frame.c \
+		remoted/syslog_tcp_frame.c shared.a
+	$(CC) $(CFLAGS) -I./remoted -o $@ \
+		tests/regressions/issue_2bepxi8w_syslog_tcp_frame.c \
+		remoted/syslog_tcp_frame.c \
+		-Wl,--start-group shared.a os_regex.a -Wl,--end-group \
+		-lpcre2-8 -lm -lpthread -lssl -lcrypto
+
 
 issue_1611_local_ip_bind: tests/regressions/issue_1611_local_ip_bind.c os_net.a shared.a
 	$(CC) $(CFLAGS) -o $@ tests/regressions/issue_1611_local_ip_bind.c \