Close idle tcp connections

[sdvendramini]

Related issue
#17706

Description

With these changes the manager will be able to close inactive sockets when an agent tries to connect from a new connection. The behavior will depend on the time configured in a new setting of internal_options.

Configuration options

• ossec.conf:

  <remote>
    <connection>secure</connection>
    <port>1514</port>
    <protocol>tcp</protocol>
    <queue_size>131072</queue_size>
    <tcp>
        <connection_overtake_time>120</connection_overtake_time>
    </tcp>
  </remote>

Logs/Alerts example

• New log when an inactive socket it's closed:
  2023/07/28 12:39:37 wazuh-remoted[154028] secure.c:531 at HandleSecureMessage(): DEBUG: Idle socket [4] from agent ID '001' will be closed.

Tests

• Compilation without warnings in every supported platform
  • Linux
• Source installation
• Source upgrade
• Review logs syntax and correct language

• Memory tests for Linux
  • Scan-build report
  • ThreadSanitizer
  • Coverity

• Added unit tests (for new features)
• Stress test for affected components

[sdvendramini]

• Coverge Unit Tests report:

[sdvendramini]

• Thread Sanitizer without any warning:

2023/08/04 16:06:25 wazuh-remoted[570096] manager.c:395 at save_controlmsg(): DEBUG: save_controlmsg(): inserting 'Microsoft Windows Server 2022 Standard Evaluation [Ver: 10.0.20348.1787] - Wazuh v4.4.3 / ab73af41699f13fdd81903b5f23d8d00
d0f51333bf62a0d4dbe082107c77e1a4 merged.mg
#"_agent_ip":10.0.2.15
'
2023/08/04 16:06:25 wazuh-remoted[570096] manager.c:1402 at lookfor_agent_group(): DEBUG: Agent '006' group is 'default'
2023/08/04 16:06:27 wazuh-remoted[570096] state.c:161 at rem_write_state(): DEBUG: Updating state file.
2023/08/04 16:06:31 wazuh-remoted[570096] secure.c:382 at rem_keyupdate_main(): DEBUG: Checking for keys file changes.
2023/08/04 16:06:31 wazuh-remoted[570096] manager.c:764 at c_files(): DEBUG: Updating shared files sums.
2023/08/04 16:06:31 wazuh-remoted[570096] manager.c:786 at c_files(): DEBUG: End updating shared files sums.
2023/08/04 16:06:32 wazuh-remoted[570096] state.c:161 at rem_write_state(): DEBUG: Updating state file.
2023/08/04 16:06:36 wazuh-remoted[570096] secure.c:262 at handle_new_tcp_connection(): DEBUG: New TCP connection [17]
2023/08/04 16:06:36 wazuh-remoted[570096] secure.c:536 at HandleSecureMessage(): WARNING: Agent key already in use: agent ID '006'
2023/08/04 16:06:36 wazuh-remoted[570096] secure.c:769 at _close_sock(): DEBUG: TCP peer disconnected [17]
2023/08/04 16:06:37 wazuh-remoted[570096] state.c:161 at rem_write_state(): DEBUG: Updating state file.
2023/08/04 16:06:41 wazuh-remoted[570096] manager.c:764 at c_files(): DEBUG: Updating shared files sums.
2023/08/04 16:06:41 wazuh-remoted[570096] manager.c:786 at c_files(): DEBUG: End updating shared files sums.
2023/08/04 16:06:41 wazuh-remoted[570096] secure.c:382 at rem_keyupdate_main(): DEBUG: Checking for keys file changes.
2023/08/04 16:06:42 wazuh-remoted[570096] state.c:161 at rem_write_state(): DEBUG: Updating state file.
2023/08/04 16:06:46 wazuh-remoted[570096] secure.c:262 at handle_new_tcp_connection(): DEBUG: New TCP connection [17]
2023/08/04 16:06:46 wazuh-remoted[570096] secure.c:536 at HandleSecureMessage(): WARNING: Agent key already in use: agent ID '006'
2023/08/04 16:06:46 wazuh-remoted[570096] secure.c:769 at _close_sock(): DEBUG: TCP peer disconnected [17]
2023/08/04 16:06:47 wazuh-remoted[570096] state.c:161 at rem_write_state(): DEBUG: Updating state file.
2023/08/04 16:06:51 wazuh-remoted[570096] manager.c:764 at c_files(): DEBUG: Updating shared files sums.
2023/08/04 16:06:51 wazuh-remoted[570096] manager.c:786 at c_files(): DEBUG: End updating shared files sums.
2023/08/04 16:06:51 wazuh-remoted[570096] secure.c:382 at rem_keyupdate_main(): DEBUG: Checking for keys file changes.
2023/08/04 16:06:52 wazuh-remoted[570096] state.c:161 at rem_write_state(): DEBUG: Updating state file.
2023/08/04 16:06:56 wazuh-remoted[570096] secure.c:262 at handle_new_tcp_connection(): DEBUG: New TCP connection [17]
2023/08/04 16:06:56 wazuh-remoted[570096] secure.c:536 at HandleSecureMessage(): WARNING: Agent key already in use: agent ID '006'
2023/08/04 16:06:56 wazuh-remoted[570096] secure.c:769 at _close_sock(): DEBUG: TCP peer disconnected [17]
2023/08/04 16:06:57 wazuh-remoted[570096] state.c:161 at rem_write_state(): DEBUG: Updating state file.
2023/08/04 16:07:01 wazuh-remoted[570096] manager.c:764 at c_files(): DEBUG: Updating shared files sums.
2023/08/04 16:07:01 wazuh-remoted[570096] manager.c:786 at c_files(): DEBUG: End updating shared files sums.
2023/08/04 16:07:01 wazuh-remoted[570096] secure.c:382 at rem_keyupdate_main(): DEBUG: Checking for keys file changes.
2023/08/04 16:07:02 wazuh-remoted[570096] state.c:161 at rem_write_state(): DEBUG: Updating state file.
2023/08/04 16:07:06 wazuh-remoted[570096] secure.c:262 at handle_new_tcp_connection(): DEBUG: New TCP connection [17]
2023/08/04 16:07:06 wazuh-remoted[570096] secure.c:536 at HandleSecureMessage(): WARNING: Agent key already in use: agent ID '006'
2023/08/04 16:07:06 wazuh-remoted[570096] secure.c:769 at _close_sock(): DEBUG: TCP peer disconnected [17]
2023/08/04 16:07:07 wazuh-remoted[570096] state.c:161 at rem_write_state(): DEBUG: Updating state file.
2023/08/04 16:07:11 wazuh-remoted[570096] manager.c:764 at c_files(): DEBUG: Updating shared files sums.
2023/08/04 16:07:11 wazuh-remoted[570096] manager.c:786 at c_files(): DEBUG: End updating shared files sums.
2023/08/04 16:07:11 wazuh-remoted[570096] secure.c:382 at rem_keyupdate_main(): DEBUG: Checking for keys file changes.
2023/08/04 16:07:12 wazuh-remoted[570096] state.c:161 at rem_write_state(): DEBUG: Updating state file.
2023/08/04 16:07:16 wazuh-remoted[570096] secure.c:262 at handle_new_tcp_connection(): DEBUG: New TCP connection [17]
2023/08/04 16:07:16 wazuh-remoted[570096] secure.c:536 at HandleSecureMessage(): WARNING: Agent key already in use: agent ID '006'
2023/08/04 16:07:16 wazuh-remoted[570096] secure.c:769 at _close_sock(): DEBUG: TCP peer disconnected [17]
2023/08/04 16:07:17 wazuh-remoted[570096] state.c:161 at rem_write_state(): DEBUG: Updating state file.
2023/08/04 16:07:21 wazuh-remoted[570096] manager.c:764 at c_files(): DEBUG: Updating shared files sums.
2023/08/04 16:07:21 wazuh-remoted[570096] manager.c:786 at c_files(): DEBUG: End updating shared files sums.
2023/08/04 16:07:21 wazuh-remoted[570096] secure.c:382 at rem_keyupdate_main(): DEBUG: Checking for keys file changes.
2023/08/04 16:07:23 wazuh-remoted[570096] state.c:161 at rem_write_state(): DEBUG: Updating state file.
2023/08/04 16:07:26 wazuh-remoted[570096] secure.c:262 at handle_new_tcp_connection(): DEBUG: New TCP connection [17]
2023/08/04 16:07:26 wazuh-remoted[570096] secure.c:532 at HandleSecureMessage(): DEBUG: Close idle socket [12] to agent ID '006'
2023/08/04 16:07:26 wazuh-remoted[570096] secure.c:692 at HandleSecureMessage(): DEBUG: TCP socket 17 added to keystore.
2023/08/04 16:07:26 wazuh-remoted[570096] secure.c:769 at _close_sock(): DEBUG: TCP peer disconnected [12]
2023/08/04 16:07:26 wazuh-remoted[570096] manager.c:289 at save_controlmsg(): DEBUG: Agent WIN-912S6EO05V4 sent HC_STARTUP from '192.168.56.1'
2023/08/04 16:07:26 wazuh-remoted[570096] secure.c:689 at HandleSecureMessage(): DEBUG: TCP socket 17 already in keystore. Updating...
2023/08/04 16:07:26 wazuh-remoted[570096] manager.c:395 at save_controlmsg(): DEBUG: save_controlmsg(): inserting 'Microsoft Windows Server 2022 Standard Evaluation [Ver: 10.0.20348.1787] - Wazuh v4.4.3 / ab73af41699f13fdd81903b5f23d8d00
d0f51333bf62a0d4dbe082107c77e1a4 merged.mg
#"_agent_ip":10.0.2.15
'

[sdvendramini]

• Coverity without new defects: