[syslog-ng] found a release-critical bug, 3.17.2

[Laszlo Budai]

Hi,

we are in the middle of an investigation of a partial-write issue and found a bug that can lead to message loss in some circumstances, even when reliable diskbuffer is used.
We marked this bug as release critical. Fortunately we fixed the issue a few minutes ago, so we are going to release 3.17.2 that contains the fix ( https://github.com/balabit/syslog-ng/pull/2224 ).


We don't have an automated testcase for this, actually it is in progress(this is why we didn't catch the bug), but sharing the manual reproduction:

* listen with netcat (and use pv tool to make partial write happen)
  nc -l 61002 | pv -L 40
* run syslog-ng with the following config:
@version: 3.17
options {
   time_reopen(3);
   stats_level(1);
};
source s_network {
   network(ip("127.0.0.1")
   port(5555));
};

destination d_network {
   network("127.0.0.1" disk_buffer(mem-buf-size(1000) disk-buf-size(1048576) reliable(yes) dir('/tmp/dq'))
   ip_protocol(4)
   port(6666)
   so-sndbuf(4096));
};

log {
  source(s_network);
  destination(d_network);

  flags(flow-control);
};

* send logs
  loggen -r 100000 -I 200 127.0.0.1 10001 --inet

* wait a few seconds then stop netcat

* result: syslog-ng will drops all the incoming messages


regards,
Laszlo Budai

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20180810/585f52bd/attachment.html>