Merge pull request ossec#2462 from atomicturtle/fix/ant-2026-9knxmd94-wildcard-cap

Cap how many files one wildcard location opens

Author: atomicturtle

.github/workflows/make-multi-platform.yml

@@ -91,6 +91,8 @@ jobs:
           ./src/issue_nceh7rb6_json_rotate_flag
           make -C src -f tests/regressions/Makefile issue_ygx1kkkt_dated_log_tail
           ./src/issue_ygx1kkkt_dated_log_tail
+          make -C src -f tests/regressions/Makefile issue_9knxmd94_wildcard_cap
+          ./src/issue_9knxmd94_wildcard_cap
           make -C src -f tests/regressions/Makefile issue_rxknzj1n_smtp_dot_escape
           ./src/issue_rxknzj1n_smtp_dot_escape
           make -C src -f tests/regressions/Makefile issue_fbj3la25_rids_counter_reload

CHANGELOG.md

@@ -29,6 +29,7 @@ Unrelease 4.5.0 changes
 
 **Security Fixes**
 
+- @atomicturtle - Stop one wildcard ``<location>`` from opening every match. ``logcollector.max_wildcard_files`` (default 256) keeps the first matches and logs the rest. ``ossec-logcollector`` raises its open-file limit to the number of configured files plus 128, so several wildcard blocks still leave room for later logs, commands, and ``ossec.log``. A pattern that already matches more than 256 files monitors only the first 256 until the option is raised (ANT-2026-9KNXMD94)
 - @atomicturtle - Read a date-based log to its current end before the expanded name changes. ``update_fname()`` was closing the old file at the start of the poll, so lines written in the last ``loop_timeout`` never reached ``ossec-analysisd``. The lines are read while the location is still the old name. A name that has not changed is left alone (ANT-2026-YGX1KKKT)
 - @atomicturtle - Forward the first JSON ``syslog_output`` alert written after ``alerts.json`` rotates or is truncated. ``jqueue_next()`` left ``JQUEUE_READ_FAILED`` set when the new file was still empty, and the next call parsed a good alert and deleted it. The alert stayed in ``alerts.json`` and still drove mail, the database, and active response (ANT-2026-NCEH7RB6)
 - @atomicturtle - Keep real ``syslog_output`` fields whose text happens to look like a placeholder. The default, CEF, and Splunk formatters dropped a value when a single character lined up with ``(none)``, ``(no user)``, or ``unknown``, so a user named ``anna``, a host ``inn.example.org``, or a location starting with ``(n`` never reached the receiver. Only the exact strings ``(none)`` and ``(no user)`` are left out. A user named ``unknown`` is still forwarded (ANT-2026-9Q8LR4NY)

etc/internal_options.conf

@@ -90,6 +90,11 @@ logcollector.open_attempts=8
 # before the other files are looked at [0..1000000]. 0 disables the limit.
 logcollector.max_lines=10000
 
+# Maximum files one wildcard <location> may monitor [1..100000].
+# Extra matches are not opened. Raise this, and the process file limit
+# follows, when one pattern legitimately matches more than 256 files.
+logcollector.max_wildcard_files=256
+
 # Logcollector - If it should accept remote commands from the manager
 logcollector.remote_commands=0
 

src/config/localfile-config.c

@@ -18,6 +18,16 @@ static void init_empty_logreader(logreader *lr)
     lr->ign = 360;
 }
 
+/* One wildcard must not add an unbounded number of open files.
+ * Unset means the shipped default. */
+static int wildcard_file_cap(const logreader_config *log_config)
+{
+    if (!log_config || log_config->max_wildcard_files <= 0) {
+        return 256;
+    }
+    return log_config->max_wildcard_files;
+}
+
 #ifdef WIN32
 /* True if path has a real * / ? wildcard (ignore '?' in a \\?\ prefix). */
 static int localfile_has_win_wildcard(const char *path)
@@ -223,7 +233,16 @@ int Read_Localfile(XML_NODE node, void *d1, __attribute__((unused)) void *d2)
                     glob_set = pl + 1;
                 }
 
+                int cap = wildcard_file_cap(log_config);
+
                 for (g = 0; paths[g] != NULL; g++) {
+                    if (g >= cap) {
+                        merror(GLOB_MAXFILES, __local_name, node[i]->content, cap);
+                        for (; paths[g] != NULL; g++) {
+                            free(paths[g]);
+                        }
+                        break;
+                    }
                     /* Expanded names are real files. A '%' in the filename
                      * is literal (for example 100%done.log), not a strftime
                      * template. The template lives on the configured location.
@@ -273,7 +292,14 @@ int Read_Localfile(XML_NODE node, void *d1, __attribute__((unused)) void *d2)
                 }
 
 
+                int cap = wildcard_file_cap(log_config);
+
                 while (g.gl_pathv[glob_offset] != NULL) {
+                    if (glob_offset >= cap) {
+                        merror(GLOB_MAXFILES, __local_name, node[i]->content, cap);
+                        break;
+                    }
+
                     /* Check for strftime on globs too */
                     if (strchr(g.gl_pathv[glob_offset], '%')) {
                         struct tm *p;

src/config/localfile-config.h

@@ -55,6 +55,8 @@ typedef struct _logreader {
 typedef struct _logreader_config {
     int agent_cfg;
     int accept_remote;
+    /* Max names one wildcard <location> may add. 0 means unset. */
+    int max_wildcard_files;
     logreader *config;
 } logreader_config;
 

src/error_messages/error_messages.h

@@ -35,6 +35,7 @@
 //#define PIPE_ERROR    "%s(1120): ERROR: Pipe error."
 #define GLOB_ERROR    "%s(1121): ERROR: Glob error. Invalid pattern: '%s'."
 #define GLOB_NFOUND   "%s(1122): ERROR: No file found by pattern: '%s'."
+#define GLOB_MAXFILES "%s(1954): ERROR: Too many files found by pattern: '%s'. Only the first %d are monitored (logcollector.max_wildcard_files)."
 #define UNLINK_ERROR  "%s(1123): ERROR: Unable to delete file: '%s'."
 #define RENAME_ERROR  "%s(1124): ERROR: Could not rename file '%s' to '%s' due to [(%d)-(%s)]."
 #define INT_ERROR     "%s(1125): ERROR: Internal error (undefined)."

src/logcollector/config.c

@@ -22,6 +22,8 @@ int LogCollectorConfig(const char *cfgfile, int accept_remote)
     log_config.config = NULL;
     log_config.agent_cfg = 0;
     log_config.accept_remote = accept_remote;
+    log_config.max_wildcard_files = getDefine_Int("logcollector",
+                                  "max_wildcard_files", 1, 100000);
 
     if (ReadConfig(modules, cfgfile, &log_config, NULL) < 0) {
         return (OS_INVALID);

src/logcollector/logcollector.c

@@ -10,6 +10,10 @@
 #include "shared.h"
 #include "logcollector.h"
 
+#ifndef WIN32
+#include <sys/resource.h>
+#endif
+
 /* Prototypes */
 int update_fname(int i);
 static void clear_logreader_entry(int idx);
@@ -748,6 +752,54 @@ int update_fname(int i)
     return (0);
 }
 
+/* Raise the soft open-file limit so the files this process will keep
+ * open, plus the queue, the log, and command pipes, fit. One wildcard is
+ * already capped; several wildcard blocks can still pass that cap.
+ */
+void logcollector_raise_nofile(int nfiles)
+{
+#ifndef WIN32
+    struct rlimit rl;
+    rlim_t need;
+    rlim_t hard;
+
+    if (nfiles < 0) {
+        nfiles = 0;
+    }
+    need = (rlim_t)nfiles + 128;
+    if (getrlimit(RLIMIT_NOFILE, &rl) < 0) {
+        return;
+    }
+    if (rl.rlim_cur >= need) {
+        return;
+    }
+
+    hard = rl.rlim_max;
+    if (hard < need) {
+        rl.rlim_max = need;
+    }
+    rl.rlim_cur = need;
+    if (setrlimit(RLIMIT_NOFILE, &rl) == 0) {
+        return;
+    }
+
+    /* Stay inside the hard limit this process is allowed to use. */
+    if (getrlimit(RLIMIT_NOFILE, &rl) < 0) {
+        return;
+    }
+    if (rl.rlim_cur < hard) {
+        rl.rlim_cur = hard;
+        if (setrlimit(RLIMIT_NOFILE, &rl) == 0) {
+            return;
+        }
+    }
+    merror("%s: WARN: Unable to raise the open-file limit to %llu (%s).",
+           ARGV0, (unsigned long long)need, strerror(errno));
+#else
+    (void)nfiles;
+#endif
+}
+
 /* Open, get the fileno, seek to the end and update mtime */
 int handle_file(int i, int do_fseek, int do_log)
 {

src/logcollector/logcollector.h

@@ -29,6 +29,9 @@ void LogCollectorStart(void) __attribute__((noreturn));
 /* Handle files */
 int handle_file(int i, int do_fseek, int do_log);
 
+/* Raise RLIMIT_NOFILE to cover nfiles plus a reserve for the queue and log. */
+void logcollector_raise_nofile(int nfiles);
+
 /* Per-visit line budget for file readers (logcollector.max_lines). */
 void logr_begin_read(void);
 int logr_consume_line(int drop_it);

src/logcollector/main.c

@@ -137,6 +137,13 @@ int main(int argc, char **argv)
         logff[1].logformat = NULL;
 
         merror(NO_FILE, ARGV0);
+    } else {
+        int nfiles = 0;
+
+        while (logff[nfiles].file || logff[nfiles].command) {
+            nfiles++;
+        }
+        logcollector_raise_nofile(nfiles);
     }
 
     /* Start signal handler */