From a89d81f27582e4236633b990727ca98ee4e6c80b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Thu, 6 Aug 2020 16:12:17 +0200 Subject: [PATCH] Check if Filebeat log harvester tries to open named pipe (#20450) ## What does this PR do? This PR adds a check before opening a file for harvester Filebeat. If the file is a named pipe, an error is returned and the file is not opened. ## Why is it important? Previously if someone wanted to open a named pipe without a writer, Filebeat hangs. ## Related issues Closes #18682 --- CHANGELOG.next.asciidoc | 1 + filebeat/input/log/harvester.go | 8 ++++++++ 2 files changed, 9 insertions(+) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index d9e51467d70..08cae0a9b1c 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -507,6 +507,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Add support for additional fields and FirewallMatchEvent type events in CrowdStrike module {pull}20138[20138] - Add event.ingested for Suricata module {pull}20220[20220] - Add event.ingested to all Filebeat modules. {pull}20386[20386] +- Return error when log harvester tries to open a named pipe. {issue}18682[18682] {pull}20450[20450] *Heartbeat* diff --git a/filebeat/input/log/harvester.go b/filebeat/input/log/harvester.go index 9dc93202951..5afcf6e799a 100644 --- a/filebeat/input/log/harvester.go +++ b/filebeat/input/log/harvester.go @@ -505,6 +505,14 @@ func (h *Harvester) shouldExportLine(line string) bool { // is returned and the harvester is closed. The file will be picked up again the next time // the file system is scanned func (h *Harvester) openFile() error { + fi, err := os.Stat(h.state.Source) + if err != nil { + return fmt.Errorf("failed to stat source file %s: %v", h.state.Source, err) + } + if fi.Mode()&os.ModeNamedPipe != 0 { + return fmt.Errorf("failed to open file %s, named pipes are not supported", h.state.Source) + } + f, err := file_helper.ReadOpen(h.state.Source) if err != nil { return fmt.Errorf("Failed opening %s: %s", h.state.Source, err)