Skip to content

Commit

Permalink
auiditd: Do not count buffered log bytes (#19)
Browse files Browse the repository at this point in the history
Buffered bytes were getting counted when reading audit log files causing
it to sometimes read past a new line. This resulted in invalid log lines
getting parsed by golibaudit and erroring out.
  • Loading branch information
pereztr5 authored Mar 27, 2023
1 parent 42ce485 commit a248450
Showing 1 changed file with 8 additions and 20 deletions.
28 changes: 8 additions & 20 deletions internal/auditd/dirreader.go
Original file line number Diff line number Diff line change
Expand Up @@ -354,32 +354,20 @@ func readFilePathLines(ctx context.Context, fsi fileSystem, filePath string, l c
// It writes each line to the lines chan and returns the number of
// bytes read from reader.
func readLines(ctx context.Context, reader io.Reader, lines chan<- string) (int64, error) {
counter := &readCounter{reader: reader}

scanner := bufio.NewScanner(counter)
scanner := bufio.NewScanner(reader)
var numBytesRead int64

for scanner.Scan() {
line := scanner.Text()
numBytesRead += int64(len(line) + 1)

select {
case <-ctx.Done():
return counter.count, ctx.Err()
case lines <- scanner.Text():
return numBytesRead, ctx.Err()
case lines <- line:
// continue.
}
}

return counter.count, scanner.Err()
}

// readCounter counts the number of bytes read from the inner reader.
type readCounter struct {
reader io.Reader
count int64
}

// Read reads from the inner reader field, functioning identically to
// io.Reader. It tracks the number of bytes read from the reader.
func (o *readCounter) Read(p []byte) (int, error) {
n, err := o.reader.Read(p)
o.count += int64(n)
return n, err
return numBytesRead, scanner.Err()
}

0 comments on commit a248450

Please sign in to comment.