Bug 11574 - saving remote syslog settings in WebUI causes crash
Summary: saving remote syslog settings in WebUI causes crash
Status: CLOSED FIXED
Alias: None
Product: IPFire
Classification: Unclassified
Component: --- (show other bugs)
Version: 2
Hardware: x86_64 Linux
: Will affect almost no one Major Usability
Assignee: Michael Tremer
QA Contact:
URL:
Keywords:
Depends on:
Blocks: 11540
  Show dependency treegraph
 
Reported: 2018-01-09 17:50 UTC by Peter Müller
Modified: 2018-02-06 19:23 UTC (History)
1 user (show)

See Also:


Attachments
syslog.conf on the machines upgraded from Core Update 116 (614 bytes, text/plain)
2018-01-17 16:56 UTC, Peter Müller
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Peter Müller 2018-01-09 17:50:06 UTC
Saving the settings results in a segfault caused by the C program:

Jan  7 14:00:01 firewall kernel: syslogdctrl[32260]: segfault at 0 ip 00006d5bca1970f2 sp 000079c0d1549018 error 6 in libc-2.25.so[6d5bca0f1000+1ba000]
Jan  7 14:00:01 firewall kernel: grsec: Segmentation fault occurred at            (nil) in /usr/local/bin/syslogdctrl[syslogdctrl:32260] uid/euid:0/0 gid/egid:0/0, parent /srv/web/ipfire/cgi-bin/logs.cgi/config.dat[config.dat:32167] uid/euid:99/99 gid/egid:99/99

This happens for both UDP and TCP and can be easily reproduced by trying to configure a remote syslog server in the WebUI.

It is related to https://bugzilla.ipfire.org/show_bug.cgi?id=11540 .
Comment 1 Michael Tremer 2018-01-10 17:35:11 UTC
I cannot reproduce this with the final release of C117. What is your configuration?
Comment 2 Peter Müller 2018-01-10 20:41:14 UTC
My configuration is:
- remote syslog enabled
- IP: 10.XXX.XXX.XXX
- protocol: TCP (also crashes with UDP)

The relevant files have these SHA256 checksums:
63958e3bcc2502aef821ab5011e6616787d3b3f5833c394b460fe293c1e04195  /usr/local/bin/syslogdctrl
dfe90b1791d584c8db9b0ae9326b80ce9b2952ae069b4aa659af3c4cc6078ccd  /srv/web/ipfire/cgi-bin/logs.cgi/config.dat

I am running on Core 117 (upgraded from 116) at x86_64.

The WebUI displays: "Das Hilfsprogramm hat einen Fehlercode gemeldet 0.04296875",
the /var/log/messages file:

Jan 10 20:40:24 firewall kernel: syslogdctrl[21677]: segfault at 0 ip 00007c02792860f2 sp 00007ea3804df648 error 6 in libc-2.25.so[7c02791e0000+1ba000]
Jan 10 20:40:24 firewall kernel: grsec: Segmentation fault occurred at            (nil) in /usr/local/bin/syslogdctrl[syslogdctrl:21677] uid/euid:0/0 gid/egid:0/0, parent /srv/web/ipfire/cgi-bin/logs.cgi/config.dat[config.dat:21675] uid/euid:99/99 gid/egid:99/99

Strange. :-| If you need further information, please contact me.
Comment 3 Peter Müller 2018-01-16 15:59:12 UTC
Tested on a second machine upgraded from Core Update 116: Same behaviour, same error code.
Comment 4 Michael Tremer 2018-01-16 22:44:55 UTC
Could you send the configuration file that the binary is reading?
Comment 5 Peter Müller 2018-01-17 16:56:57 UTC
Created attachment 553 [details]
syslog.conf on the machines upgraded from Core Update 116
Comment 6 Michael Tremer 2018-01-19 01:06:01 UTC
/var/ipfire/logging/settings, please :)
Comment 7 utica.college 2018-01-21 20:09:40 UTC
I'm getting same error after upgraded from 116. I even wiped my machine and installed core update 117 from scratch and I still have same issue and I'm not getting any logs sent out to the syslog server.

Here's my /var/ipfire/logging/settings

ENABLE_REMOTELOG=on
LOGWATCH_LEVEL=High
LOGWATCH_KEEP=56
LOGVIEW_VIEWSIZE=150
REMOTELOG_PROTOCOL=udp
REMOTELOG_ADDR=192.168.2.2
LOGVIEW_REVERSE=off
Comment 8 Michael Tremer 2018-01-22 14:22:43 UTC
https://cgit.ipfire.org/ipfire-2.x.git/commit/?h=next&id=1e7b718cd47379089adba9b9f5c9c4a7630235a4

Could anyone confirm that this patch solves the problem?

https://nightly.ipfire.org/next/
Comment 9 Peter Müller 2018-02-06 19:23:51 UTC
(In reply to Michael Tremer from comment #8)
> https://cgit.ipfire.org/ipfire-2.x.git/commit/
> ?h=next&id=1e7b718cd47379089adba9b9f5c9c4a7630235a4
> 
> Could anyone confirm that this patch solves the problem?
> 
> https://nightly.ipfire.org/next/
Sorry for the delay.

Yes, it solves the problem initially. However, since sysklogd is unable to do remote logging via anything else than UDP, we need to switch to another software first. I think Erik is currently testing rsyslog.

In my opinion, this can be closed. If it can't, please reopen.