https://github.com/rsyslog/rsyslog/issues/4268

Opened an issue above. Attached patch is tested and it works in our
environment. Please review. Thank you.

On Fri, May 1, 2020 at 12:04 AM Rainer Gerhards <[email protected]>
wrote:

> Please open an issue at GitHub, so that we can have a look.
>
> Sent from phone, thus brief.
>
> Prasad Koya via rsyslog <[email protected]> schrieb am Fr., 1.
> Mai 2020, 03:15:
>
>> Hi Florian
>>
>> Found a bug in rsyslog-8.29.0. I see the issue exists in master branch as
>> well:
>>
>> https://github.com/rsyslog/rsyslog/blob/v8-stable/plugins/omudpspoof/omudpspoof.c#L513
>>
>> When the issue happens, rsyslogd goes into infinite loop and syslogging
>> stops. Reproducible when udpspoof module is in play. I can provide rsyslog
>> debugs, write up a bug report and send out patch for review. Could
>> you/someone let me know how to proceed?
>>
>> Please see rsyslog debugs below when this happens:
>>
>> 6411.556251553:main Q:Reg/w0  : omudpspoof.c: omudpspoof: stage 2:
>> MF:0, hdrOffs 1480, pktLen 213
>>
>> goes onto sending remaining fragments of packet. Here rsyslog a tight
>> loop without checking if sendto() returned -1.
>>
>> 6411.556152334:main Q:Reg/w0  : omudpspoof.c: inside omudpspoof.c:doAction
>> 6411.556158073:main Q:Reg/w0  : omudpspoof.c: omudpspoof doTryResume
>> entered, netns ns-management
>> 6411.556163370:main Q:Reg/w0  : omudpspoof.c: XXX doTryResume:811 ret 0
>> 6411.556169877:main Q:Reg/w0  : omudpspoof.c:
>> 2400:db08:face::1:514/omudpspoof, src 'fdfd:5c41:712d:e037::af0:42ac',
>> msg strt '<167>Apr 29 20:13:30 nfc317 ProcMgr-worker:
>> %PROCMGR-7-PROCESSES_ADOPTED: ProcMgr (PID=2085) adopted running
>> processes:  (KernelNetworkInfo, PID=2688) (PhyEthtool, PID=2816) (Qos,
>> PID=2691) (MicrosemiAgent, PID=2820) (McastCommon6, PID=2695)
>> (CpuComplex, P'
>> 6411.556175383:main Q:Reg/w0  : omudpspoof.c: UDPSend: pSockArray iS
>> NULL...
>> 6411.556180090:main Q:Reg/w0  : omudpspoof.c: omudpspoof doTryResume
>> entered, netns ns-management
>> 6411.556185246:main Q:Reg/w0  : omudpspoof.c: XXX doTryResume:811 ret 0
>> 6411.556192330:main Q:Reg/w0  : omudpspoof.c: UDPSend: len 1685 maxpktlen
>> 1480
>> 6411.556197614:main Q:Reg/w0  : omudpspoof.c: omudpspoof: stage 1:
>> MF:1, hdrOffs 0, pktLen 1472
>> 6411.556238583:main Q:Reg/w0  : omudpspoof.c: omudpspoof: write error
>> (total len 1685): pktLen 1500, sent -1, fd 21:
>> libnet_write_raw_ipv6(): -1 bytes written (Network is unreachable)
>>
>> 6411.556245275:main Q:Reg/w0  : omudpspoof.c: UDPSend: msgOffs 1472
>> pktLen 1472 len 1685
>> 6411.556251553:main Q:Reg/w0  : omudpspoof.c: omudpspoof: stage 2:
>> MF:0, hdrOffs 1480, pktLen 213
>> 6411.556261332:main Q:Reg/w0  : omudpspoof.c: omudpspoof: fragment
>> write error len 1713, sent -1: libnet_pblock_coalesce(): packet
>> assembly cannot find an IPv6 header
>>
>> 6411.556266762:main Q:Reg/w0  : omudpspoof.c: omudpspoof: stage 2:
>> MF:0, hdrOffs 1480, pktLen 213
>> 6411.556273235:main Q:Reg/w0  : omudpspoof.c: omudpspoof: fragment
>> write error len 1713, sent -1: libnet_pblock_coalesce(): packet
>> assembly cannot find an IPv6 header
>>
>> 6411.556281863:main Q:Reg/w0  : omudpspoof.c: omudpspoof: stage 2:
>> MF:0, hdrOffs 1480, pktLen 213
>> 6411.556288126:main Q:Reg/w0  : omudpspoof.c: omudpspoof: fragment
>> write error len 1713, sent -1: libnet_pblock_coalesce(): packet
>> assembly cannot find an IPv6 header
>>
>> 6411.556293197:main Q:Reg/w0  : omudpspoof.c: omudpspoof: stage 2:
>> MF:0, hdrOffs 1480, pktLen 213
>> 6411.556299583:main Q:Reg/w0  : omudpspoof.c: omudpspoof: fragment
>> write error len 1713, sent -1: libnet_pblock_coalesce(): packet
>> assembly cannot find an IPv6 header
>>
>> 6411.556304892:main Q:Reg/w0  : omudpspoof.c: omudpspoof: stage 2:
>> MF:0, hdrOffs 1480, pktLen 213
>> 6411.556310991:main Q:Reg/w0  : omudpspoof.c: omudpspoof: fragment
>> write error len 1713, sent -1: libnet_pblock_coalesce(): packet
>> assembly cannot find an IPv6 header
>>
>>
>> On Tue, Apr 28, 2020 at 8:27 AM Florian Riedl via rsyslog <
>> [email protected]> wrote:
>>
>> > Hi all,
>> >
>> > today, we release rsyslog 8.2004.0. This release provides mostly
>> > bugfixes for rsyslog.
>> >
>> > There are a number of ksi bugfixes, so if your are using this, check
>> > out the changes. Another notable change is the addition of support for
>> > libreSSL in the openssl implementation.
>> >
>> > Also, there were fixes and changes for imfile, omprog, openssl drivers
>> > and many more.
>> >
>> > The next release will happen some time in June.
>> >
>> > ChangeLog:
>> >
>> > https://github.com/rsyslog/rsyslog/blob/v8-stable/ChangeLog
>> >
>> > Download:
>> >
>> > https://www.rsyslog.com/downloads/download-v8-stable/
>> >
>> > As always, feedback is appreciated.
>> >
>> >
>> > The Adiscon Team
>> > _______________________________________________
>> > rsyslog mailing list
>> > https://lists.adiscon.net/mailman/listinfo/rsyslog
>> > http://www.rsyslog.com/professional-services/
>> > What's up with rsyslog? Follow https://twitter.com/rgerhards
>> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
>> > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
>> > DON'T LIKE THAT.
>> >
>> _______________________________________________
>> rsyslog mailing list
>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
>> DON'T LIKE THAT.
>>
>

Attachment: rsyslog-8.29.0-arista-return-error-udpsend-fail.patch
Description: Binary data

_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Reply via email to