seclog: fix kernel null termination and improve alignment and seq number

Author: ernestl

seclog/audit_linux.go

@@ -101,16 +101,23 @@ func (aw *AuditWriter) Close() error {
 // The header layout follows struct nlmsghdr from
 // https://github.com/torvalds/linux/blob/254f49634ee16a731174d2ae34bc50bd5f45e731/include/uapi/linux/netlink.h#L45
 func (aw *AuditWriter) buildMessage(payload []byte) []byte {
-	totalLen := syscall.SizeofNlMsghdr + uint32(len(payload))
-	buf := make([]byte, nlmsgAlign(totalLen))
+	// The kernel forcibly null-terminates the payload data. We include an extra
+	// byte to avoid overwriting message data.
+	totalLen := nlmsgAlign(syscall.SizeofNlMsghdr + uint32(len(payload)) + 1)
+	buf := make([]byte, totalLen)
 
 	// Write header in native byte order (netlink uses host endianness).
+	//   [0:4]   uint32 Length of message including header
+	//   [4:6]   uint16 Message content type
+	//   [6:8]   uint16 Flags
+	//   [8:12]  uint32 Sequence number
+	//   [12:16] uint32 Sending process port ID
 	// TODO: Upgrade from fire-and-forget to use NLM_F_ACK and handle
 	// acknowledgments.
 	arch.Endian().PutUint32(buf[0:4], totalLen)
 	arch.Endian().PutUint16(buf[4:6], auditTrustedApp)
-	arch.Endian().PutUint16(buf[6:8], syscall.NLM_F_REQUEST) // fire-and-forget, no ACK
-	arch.Endian().PutUint32(buf[8:12], aw.seq.Add(1))
+	arch.Endian().PutUint16(buf[6:8], syscall.NLM_F_REQUEST)
+	arch.Endian().PutUint32(buf[8:12], aw.nextSeq())
 	arch.Endian().PutUint32(buf[12:16], 0)
 
 	// Write payload.
@@ -122,3 +129,13 @@ func (aw *AuditWriter) buildMessage(payload []byte) []byte {
 func nlmsgAlign(size uint32) uint32 {
 	return (size + 3) &^ 3
 }
+
+// nextSeq returns the next non-zero sequence number, skipping zero on
+// wrap to allow unambiguous ACK matching (mirrors audit-userspace).
+func (aw *AuditWriter) nextSeq() uint32 {
+	s := aw.seq.Add(1)
+	if s == 0 {
+		s = aw.seq.Add(1)
+	}
+	return s
+}

seclog/audit_linux_test.go

@@ -137,12 +137,12 @@ func (s *AuditSuite) TestBuildMessageHeaderLayout(c *C) {
 	payload := []byte("hello")
 	msg := seclog.AuditWriterBuildMessage(aw, payload)
 
-	// Total length: 16 (header) + 5 (payload) = 21, aligned to 24.
+	// Total length: NLMSG_SPACE(5 + 1) = align(22) = 24.
 	c.Assert(len(msg), Equals, 24)
 
 	// nlmsghdr fields in native byte order.
 	totalLen := arch.Endian().Uint32(msg[0:4])
-	c.Check(totalLen, Equals, uint32(21))
+	c.Check(totalLen, Equals, uint32(24))
 
 	msgType := arch.Endian().Uint16(msg[4:6])
 	c.Check(msgType, Equals, uint16(seclog.AuditTrustedApp))
@@ -159,8 +159,9 @@ func (s *AuditSuite) TestBuildMessageHeaderLayout(c *C) {
 	// Payload follows header.
 	c.Check(string(msg[syscall.SizeofNlMsghdr:syscall.SizeofNlMsghdr+5]), Equals, "hello")
 
-	// Padding bytes after payload should be zero.
+	// NUL byte for kernel null-termination.
 	c.Check(msg[21], Equals, byte(0))
+	// Padding bytes should be zero.
 	c.Check(msg[22], Equals, byte(0))
 	c.Check(msg[23], Equals, byte(0))
 }
@@ -181,27 +182,44 @@ func (s *AuditSuite) TestBuildMessageSequenceIncrements(c *C) {
 	c.Check(seq3, Equals, uint32(3))
 }
 
+func (s *AuditSuite) TestBuildMessageSequenceSkipsZero(c *C) {
+	aw := &seclog.AuditWriter{}
+
+	// Set sequence just before wraparound.
+	seclog.AuditWriterSetSeq(aw, ^uint32(0)) // math.MaxUint32
+
+	msg1 := seclog.AuditWriterBuildMessage(aw, []byte("x"))
+	msg2 := seclog.AuditWriterBuildMessage(aw, []byte("y"))
+
+	seq1 := arch.Endian().Uint32(msg1[8:12])
+	seq2 := arch.Endian().Uint32(msg2[8:12])
+
+	// Should skip 0 and go to 1, then 2.
+	c.Check(seq1, Equals, uint32(1))
+	c.Check(seq2, Equals, uint32(2))
+}
+
 func (s *AuditSuite) TestBuildMessageAlignedPayload(c *C) {
 	aw := &seclog.AuditWriter{}
 
-	// Payload of exactly 4 bytes: total = 20 which is already aligned.
+	// Payload of exactly 4 bytes: NLMSG_SPACE(4 + 1) = align(21) = 24.
 	msg := seclog.AuditWriterBuildMessage(aw, []byte("abcd"))
-	c.Check(len(msg), Equals, 20)
+	c.Check(len(msg), Equals, 24)
 
 	totalLen := arch.Endian().Uint32(msg[0:4])
-	c.Check(totalLen, Equals, uint32(20))
+	c.Check(totalLen, Equals, uint32(24))
 }
 
 func (s *AuditSuite) TestBuildMessageEmptyPayload(c *C) {
 	aw := &seclog.AuditWriter{}
 
 	msg := seclog.AuditWriterBuildMessage(aw, []byte{})
 
-	// 16-byte header, already aligned.
-	c.Check(len(msg), Equals, 16)
+	// NLMSG_SPACE(0 + 1) = align(17) = 20.
+	c.Check(len(msg), Equals, 20)
 
 	totalLen := arch.Endian().Uint32(msg[0:4])
-	c.Check(totalLen, Equals, uint32(16))
+	c.Check(totalLen, Equals, uint32(20))
 }
 
 func (s *AuditSuite) TestNlmsgAlignAlreadyAligned(c *C) {

seclog/export_audit_linux_test.go

@@ -33,6 +33,10 @@ func AuditWriterBuildMessage(aw *AuditWriter, payload []byte) []byte {
 	return aw.buildMessage(payload)
 }
 
+func AuditWriterSetSeq(aw *AuditWriter, val uint32) {
+	aw.seq.Store(val)
+}
+
 func MockSyscallOps(ops syscallOps) (restore func()) {
 	return testutil.Mock(&sys, ops)
 }