Pull request #4184: appid: log error message instead of fatal error if appid stats...

Merge in SNORT/snort3 from ~SATHIRKA/snort3:appid_stats_fatalerr_fix to master

Squashed commit of the following:

commit c1e4352680234f9dcd5e7a2a9747798fe45983d7
Author: Sreeja Athirkandathil Narayanan <sathirka@cisco.com>
Date:   Mon Jan 29 14:39:14 2024 -0500

    appid: log error message instead of fatal error if appid stats logfile is not accessible

diff --git a/src/log/log.cc b/src/log/log.cc
index 1ce93e4a6756aae7b94d371d3d870587e02c35dd..47b4cd083edf58b3f823ebcc5ae6e61b30985a60 100644 (file)
--- a/src/log/log.cc
+++ b/src/log/log.cc
@@ -68,7 +68,7 @@ void CreateTCPFlagString(const tcp::TCPHdr* const tcph, char* flagBuffer)
  * Returns: file handle
  *
  ***************************************************************************/
-FILE* OpenAlertFile(const char* filearg)
+FILE* OpenAlertFile(const char* filearg, bool is_critical)
 {
     FILE* file;
 
@@ -80,8 +80,10 @@ FILE* OpenAlertFile(const char* filearg)
 
     if ((file = fopen(filename, "a")) == nullptr)
     {
-        FatalError("OpenAlertFile() => fopen() alert file %s: %s\n",
-            filename, get_error(errno));
+        if (is_critical)
+            FatalError("OpenAlertFile() => fopen() alert file %s: %s\n", filename, get_error(errno));
+        else
+            ErrorMessage("OpenAlertFile() => fopen() alert file %s: %s\n", filename, get_error(errno));
     }
     else
         setvbuf(file, (char*)nullptr, _IOLBF, (size_t)0);

diff --git a/src/log/log.h b/src/log/log.h
index 54de25fba47e6ff6cba283dcdc15e2a0c851a8f7..8fbd38f145c6e261c61a17535a31e1b545bd3206 100644 (file)
--- a/src/log/log.h
+++ b/src/log/log.h
@@ -33,7 +33,7 @@ struct Packet;
 SO_PUBLIC void CreateTCPFlagString(const tcp::TCPHdr* const, char*);
 }
 
-FILE* OpenAlertFile(const char*);
+FILE* OpenAlertFile(const char*, bool is_critical=true);
 int RollAlertFile(const char*);
 
 void OpenLogger();

diff --git a/src/log/text_log.cc b/src/log/text_log.cc
index a0c0b574daeae61f186ebe023df117ea3c6c31e8..d71146adcd7616195d08b1ad0ca76a13c826c1ac 100644 (file)
--- a/src/log/text_log.cc
+++ b/src/log/text_log.cc
@@ -67,7 +67,7 @@ struct TextLog
  * TextLog_Open/Close: open/close associated log file
  *-------------------------------------------------------------------
  */
-static FILE* TextLog_Open(const char* name)
+static FILE* TextLog_Open(const char* name, bool is_critical=true)
 {
     if ( name && !strcasecmp(name, "stdout") )
     {
@@ -79,7 +79,7 @@ static FILE* TextLog_Open(const char* name)
 #endif
     }
 
-    return OpenAlertFile(name);
+    return OpenAlertFile(name, is_critical);
 }
 
 static void TextLog_Close(FILE* file)
@@ -116,7 +116,7 @@ void TextLog_Reset(TextLog* const txt)
  *-------------------------------------------------------------------
  */
 TextLog* TextLog_Init(
-    const char* name, unsigned int maxBuf, size_t maxFile)
+    const char* name, unsigned int maxBuf, size_t maxFile, bool is_critical)
 {
     TextLog* txt;
 
@@ -126,7 +126,14 @@ TextLog* TextLog_Init(
     txt = (TextLog*)snort_alloc(sizeof(TextLog)+maxBuf);
 
     txt->name = name ? snort_strdup(name) : nullptr;
-    txt->file = TextLog_Open(txt->name);
+    txt->file = TextLog_Open(txt->name, is_critical);
+    if (!txt->file)
+    {
+        if ( txt->name )
+            snort_free(txt->name);
+        snort_free(txt);
+        return nullptr;
+    }
     txt->size = TextLog_Size(txt->file);
     txt->last = time(nullptr);
     txt->maxFile = maxFile;

diff --git a/src/log/text_log.h b/src/log/text_log.h
index 079cd558e787fa630efbe12d0fc93f160dce0a2c..1f3010dd2256029bbfdcfbb442a0e091968d47b2 100644 (file)
--- a/src/log/text_log.h
+++ b/src/log/text_log.h
@@ -49,7 +49,7 @@ struct TextLog;
 namespace snort
 {
 SO_PUBLIC TextLog* TextLog_Init(
-    const char* name, unsigned int maxBuf = 0, size_t maxFile = 0);
+    const char* name, unsigned int maxBuf = 0, size_t maxFile = 0, bool is_critical=true);
 SO_PUBLIC void TextLog_Term(TextLog*);
 
 SO_PUBLIC bool TextLog_Putc(TextLog* const, char);

diff --git a/src/network_inspectors/appid/appid_stats.cc b/src/network_inspectors/appid/appid_stats.cc
index aaca7171b9c4c7226722f090dcf3b2fa88881206..ec6e3a134bbec65909b7843ca3dd3304dcb5de91 100644 (file)
--- a/src/network_inspectors/appid/appid_stats.cc
+++ b/src/network_inspectors/appid/appid_stats.cc
@@ -89,12 +89,14 @@ StatsBucket* AppIdStatistics::get_stats_bucket(time_t start_time)
 
 void AppIdStatistics::open_stats_log_file()
 {
-    log = TextLog_Init(appid_stats_filename, 4096, roll_size);
+    log = TextLog_Init(appid_stats_filename, 4096, roll_size, false);
+    if (!log)
+        log_err = true;
 }
 
 void AppIdStatistics::dump_statistics()
 {
-    if ( !log_buckets )
+    if ( !log_buckets or log_err )
         return;
 
     if ( !log )
@@ -104,6 +106,11 @@ void AppIdStatistics::dump_statistics()
 
     while ((bucket = (struct StatsBucket*)sflist_remove_head(log_buckets)) != nullptr)
     {
+        if (log_err)
+        {
+            delete bucket;
+            continue;
+        }
         if ( bucket->app_record_cnt )
         {
             for (auto& it : bucket->apps_tree)

diff --git a/src/network_inspectors/appid/appid_stats.h b/src/network_inspectors/appid/appid_stats.h
index ca8b44a0e6212f12c4533eb45f174495e665e578..4e6fc54d4eb0f921d52f09dbc66a2e87c9513fe2 100644 (file)
--- a/src/network_inspectors/appid/appid_stats.h
+++ b/src/network_inspectors/appid/appid_stats.h
@@ -96,6 +96,7 @@ private:
     time_t bucket_interval = 0;
     time_t bucket_end = 0;
     size_t roll_size = 0;
+    bool log_err = false;
 };
 
 #endif