Merge pull request ossec#2467 from atomicturtle/fix/ant-2026-pttdw7pw-ipv6-case

Give one spelling to an IPv6 address before ossec-execd blocks it

Author: atomicturtle

.github/workflows/make-multi-platform.yml

@@ -101,6 +101,8 @@ jobs:
           ./src/issue_c82ab02v_location_id
           make -C src -f tests/regressions/Makefile issue_see999rq_srcip_quote
           ./src/issue_see999rq_srcip_quote
+          make -C src -f tests/regressions/Makefile issue_pttdw7pw_ipv6_case
+          ./src/issue_pttdw7pw_ipv6_case
           make -C src -f tests/regressions/Makefile issue_rxknzj1n_smtp_dot_escape
           ./src/issue_rxknzj1n_smtp_dot_escape
           make -C src -f tests/regressions/Makefile issue_fbj3la25_rids_counter_reload

CHANGELOG.md

@@ -29,6 +29,7 @@ Unrelease 4.5.0 changes
 
 **Security Fixes**
 
+- @atomicturtle - Give ``ossec-execd`` one spelling of a literal address before it compares, stores, or runs a block. ``2001:DB8::7`` and ``2001:db8::7`` were two timeouts, so ``pf.sh`` deleted the one PF entry at the first timeout while execd still counted the other spelling as blocked. Later alerts then skipped the add. A ``::ffff:`` address is handed to the script as its IPv4 form, which is what analysisd already does. Host names, ``-``, CIDR, and a leading ``!`` are unchanged (ANT-2026-PTTDW7PW)
 - @atomicturtle - Keep the closing quote when ``ossec-dbd`` stores a long ``srcip`` or ``dstip``. ``sql_nullable_str()`` wrote the address into a 49-byte buffer, so 47 characters or more cut off the quote and both MySQL and PostgreSQL rejected the ``INSERT``. The address is now cut to the 46-character column width and the alert is stored. The full log line is unchanged (ANT-2026-SEE999RQ)
 - @atomicturtle - Widen the MySQL location id from ``SMALLINT UNSIGNED`` to ``INT UNSIGNED``. ``location.id`` stopped at 65,535, so one agent sending a new location per alert filled the counter and ``ossec-dbd`` then dropped every alert whose location was not already stored. Existing databases stay 16-bit until ``upgrade-location-id-mysql.sql`` is applied. PostgreSQL already uses ``SERIAL`` (ANT-2026-C82AB02V)
 - @atomicturtle - Do not follow a symlink when ``ossec-dbd`` reads ``queue/agent-info``. That directory belongs to ``ossecr`` and ``ossec-dbd`` runs as root, so ``stat`` and ``fopen`` copied the first line of the link target into the agent table, including a root-only file. A keepalive is stored only when it is one regular file (ANT-2026-5Z4OX04E)

src/os_execd/execd.c

@@ -203,6 +203,43 @@ void FreeTimeoutEntry(timeout_data *timeout_entry)
     free(timeout_entry);
 }
 
+/* One spelling for a literal address. Host names, "-", CIDR, and a
+ * leading "!" are left for the caller to use unchanged. pf stores the
+ * parsed address, so 2001:DB8::7 and 2001:db8::7 must not be two blocks.
+ */
+int CanonicalIP(const char *ip, char *dst, size_t dstlen)
+{
+    os_ip parsed;
+    char canon[INET6_ADDRSTRLEN];
+    size_t n;
+
+    if (!ip || !dst || dstlen == 0) {
+        return (0);
+    }
+    if (ip[0] == '\0' || ip[0] == '!' || strcmp(ip, "-") == 0 || strchr(ip, '/')) {
+        return (0);
+    }
+
+    memset(&parsed, 0, sizeof(parsed));
+    if (OS_IsValidIP(ip, &parsed) != 1) {
+        free(parsed.ip);
+        return (0);
+    }
+    if (satop((struct sockaddr *)&parsed.ss, canon, sizeof(canon)) != 0 ||
+            canon[0] == '\0') {
+        free(parsed.ip);
+        return (0);
+    }
+    free(parsed.ip);
+
+    n = strlen(canon);
+    if (n + 1 > dstlen) {
+        return (0);
+    }
+    memcpy(dst, canon, n + 1);
+    return (1);
+}
+
 #ifndef WIN32
 
 /* Main function on the execd. Does all the data receiving, etc. */
@@ -391,6 +428,19 @@ static void ExecdStart(int q)
             i++;
         }
 
+        /* One spelling before the list compare, the repeated-offender
+         * key, the add command, and the stored delete. */
+        if (timeout_args[3]) {
+            char canon[INET6_ADDRSTRLEN];
+
+            if (CanonicalIP(timeout_args[3], canon, sizeof(canon)) &&
+                    strcmp(timeout_args[3], canon) != 0) {
+                free(timeout_args[3]);
+                os_strdup(canon, timeout_args[3]);
+            }
+            cmd_args[3] = timeout_args[3];
+        }
+
         /* Check if this command was already executed (or incomplete). */
         added_before = ExecdTimeoutDupCheck(timeout_list, timeout_args,
                                             curr_time, repeated_hash);

src/os_execd/execd.h

@@ -49,6 +49,11 @@ typedef struct _timeout_data {
 
 void FreeTimeoutEntry(timeout_data *timeout_entry);
 
+/* 1 if ip is a literal address and dst holds its canonical text.
+ * Host names, "-", CIDR, and a leading "!" return 0.
+ */
+int CanonicalIP(const char *ip, char *dst, size_t dstlen);
+
 /* Returns 1 if request is incomplete or already on the timeout list. */
 int ExecdTimeoutDupCheck(OSList *timeout_list, char **timeout_args,
                          time_t curr_time, OSHash *repeated_hash);

src/os_execd/win_execd.c

@@ -104,6 +104,7 @@ void WinExecdRun(char *exec_msg)
     char *cmd_user;
     char *cmd_ip;
     char buffer[OS_MAXSTR + 1];
+    char canon[INET6_ADDRSTRLEN];
 
     timeout_data *timeout_entry;
 
@@ -147,6 +148,10 @@ void WinExecdRun(char *exec_msg)
     OS_WinExecdCleanArg(cmd_ip);
     OS_WinExecdCleanArg(tmp_msg);
 
+    if (CanonicalIP(cmd_ip, canon, sizeof(canon))) {
+        cmd_ip = canon;
+    }
+
     /* Get the command to execute (valid name) */
     command = GetCommandbyName(name, &timeout_value);
     if (!command) {

src/tests/regressions/Makefile

@@ -58,6 +58,7 @@ REGRESSION_BINS = \
 	issue_5z4ox04e_agent_info_symlink \
 	issue_c82ab02v_location_id \
 	issue_see999rq_srcip_quote \
+	issue_pttdw7pw_ipv6_case \
 	multiline_underflow \
 	win_network_path \
 	checksum_short_message \
@@ -1239,6 +1240,18 @@ issue_see999rq_srcip_quote: \
 		-Wl,--start-group shared.a os_regex.a -Wl,--end-group \
 		-lpcre2-8 -lm -lpthread -lssl -lcrypto
 
+# ANT-2026-PTTDW7PW: two spellings of one IPv6 address are one block.
+issue_pttdw7pw_ipv6_case: \
+		tests/regressions/issue_pttdw7pw_ipv6_case.c \
+		os_execd/execd.c shared.a
+	$(CC) $(CFLAGS) -Dmain=execd_main -c os_execd/execd.c -o os_execd/execd-ptt.o
+	$(CC) $(CFLAGS) -o $@ \
+		tests/regressions/issue_pttdw7pw_ipv6_case.c \
+		os_execd/execd-ptt.o \
+		os_execd/exec.c os_execd/config.c os_execd/timeout_dup.c \
+		-Wl,--start-group shared.a os_regex.a os_net.a os_xml.a os_crypto.a -Wl,--end-group \
+		-lpcre2-8 -lm -lpthread -lssl -lcrypto
+
 # ANT-2026-5Z4OX04E: ossec-dbd must not follow an agent-info symlink.
 # KEYS_FILE and AGENTINFO_DIR point at the harness tree.
 issue_5z4ox04e_agent_info_symlink: \

src/tests/regressions/issue_pttdw7pw_ipv6_case.c

@@ -0,0 +1,80 @@
+/*
+ * Regression: ossec-execd treats two IPv6 spellings as two blocks
+ *
+ * ANT-2026-PTTDW7PW / CWE-178
+ *
+ * ExecdStart() compares the srcip text with strcmp(). 2001:DB8::7 and
+ * 2001:db8::7 are one address to pf, so the first timeout deletes the
+ * table entry while execd still counts the other spelling as blocked.
+ * A literal address must have one spelling before it is compared,
+ * stored, or handed to the script. Host names, "-", CIDR, and a
+ * leading "!" stay as written.
+ *
+ * Build (from src/):
+ *   make -f tests/regressions/Makefile issue_pttdw7pw_ipv6_case
+ *
+ * Run:
+ *   ./issue_pttdw7pw_ipv6_case
+ */
+
+#include <stdio.h>
+#include <string.h>
+
+#include "shared.h"
+#include "os_execd/execd.h"
+
+static int failures = 0;
+
+static void expect(int cond, const char *msg)
+{
+    if (cond) {
+        printf("  ok:   %s\n", msg);
+    } else {
+        printf("  FAIL: %s\n", msg);
+        failures++;
+    }
+}
+
+static void same_spelling(const char *a, const char *b, const char *want, const char *msg)
+{
+    char ca[64];
+    char cb[64];
+    int ra;
+    int rb;
+
+    ca[0] = '\0';
+    cb[0] = '\0';
+    ra = CanonicalIP(a, ca, sizeof(ca));
+    rb = CanonicalIP(b, cb, sizeof(cb));
+    expect(ra == 1 && rb == 1 && strcmp(ca, cb) == 0 && strcmp(ca, want) == 0, msg);
+}
+
+int main(void)
+{
+    char dst[64];
+
+    printf("execd IPv6 address spelling\n");
+
+    same_spelling("2001:DB8::7", "2001:db8::7", "2001:db8::7",
+                  "IPv6 letter case is one spelling");
+    same_spelling("::ffff:192.0.2.1", "192.0.2.1", "192.0.2.1",
+                  "an IPv4-mapped address is the IPv4 address");
+    same_spelling("192.0.2.1", "192.0.2.1", "192.0.2.1",
+                  "an IPv4 address stays dotted decimal");
+
+    expect(CanonicalIP("mail.example", dst, sizeof(dst)) == 0,
+           "a host name is left unchanged");
+    expect(CanonicalIP("-", dst, sizeof(dst)) == 0,
+           "a dash user placeholder is left unchanged");
+    expect(CanonicalIP("2001:db8::/64", dst, sizeof(dst)) == 0,
+           "a CIDR prefix is left unchanged");
+    expect(CanonicalIP("!192.0.2.1", dst, sizeof(dst)) == 0,
+           "a negated address is left unchanged");
+
+    if (failures) {
+        printf("FAIL: %d IPv6 spelling check(s)\n", failures);
+        return 1;
+    }
+    printf("ok\n");
+    return 0;
+}