Feature/csyslog tcp tls - #2293
Merged
Merged
Conversation
ossec-csyslogd truncated forwarded alerts at 2048 bytes, cutting ~3KB Graylog CEF payloads. Use OS_MAXSTR (6144) and harden field_add helpers (ossec#1762).
Allow ossec-csyslogd to forward alerts over TCP (newline framing) or TLS with optional peer verification, addressing large CEF/JSON delivery beyond UDP MTU limits (ossec#1762).
Contributor
There was a problem hiding this comment.
Pull request overview
This PR extends ossec-csyslogd’s syslog_output destinations to support larger outbound alert payloads and optional TCP/TLS transports, aiming to prevent truncation of long CEF/JSON/syslog messages and enable reliable forwarding over TCP/TLS.
Changes:
- Increase csyslogd’s outbound alert assembly buffer from 2048 to
OS_MAXSTR(OS_CSYSLOG_MAX). - Add per-destination transport options:
protocol(udp/tcp),tls,tls_verify,tls_ca, with TCP/TLS connection/reconnect helpers. - Add OpenSSL-backed TLS client support (SNI + optional peer/hostname/IP verification) for
syslog_output.
Reviewed changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| src/os_csyslogd/main.c | Switch pre-chroot connect flow to support UDP/TCP(+TLS) and log transport type. |
| src/os_csyslogd/csyslogd.h | Introduce OS_CSYSLOG_MAX and transport helper prototypes; make send API mutable for reconnect state. |
| src/os_csyslogd/csyslogd.c | Increase field assembly buffers and adjust truncation/append logic for larger messages. |
| src/os_csyslogd/alert.c | Build outbound syslog/CEF/JSON/Splunk messages up to OS_CSYSLOG_MAX and send via new transport helper. |
| src/os_csyslogd/csyslog_send.c | Implement connect/send/close helpers for UDP/TCP/TLS with retry and socket options. |
| src/os_csyslogd/csyslog_tls.h | Declare TLS helper APIs gated by LIBOPENSSL_ENABLED. |
| src/os_csyslogd/csyslog_tls.c | Implement TLS context creation, handshake, verification, and write retry logic via OpenSSL. |
| src/config/csyslogd-config.h | Extend SyslogConfig with protocol/TLS settings and runtime TLS state pointers. |
| src/config/csyslogd-config.c | Parse protocol/tls/tls_verify/tls_ca, enforce TLS⇒TCP, and initialize new config fields. |
| CHANGELOG.md | Document TCP/TLS support and buffer increase. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Flatten embedded CR/LF before newline framing, cap TLS WANT_* waits to ~10s, create SSL_CTX before connect so CA loads survive chroot, and guard field_add_truncated against size_t underflow.
Use non-blocking connect with a 10s poll deadline, guard field_add_truncate size_t math, free multi-line logmsg, avoid mid-JSON truncation, and fix cefescape early-return when no escaping is needed.
Start versioning the local testsuite harness and cover Ubuntu 26.04 LTS alongside the existing distro Matrix for agent/server builds.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ossec-csyslogdalert assemble buffer from 2048 toOS_MAXSTR(6144) so long CEF/JSON/syslog payloads are not cut mid-field (Long syslog messages being truncated when forwarded by syslog_output to graylog. #1762).protocol(udp|tcp),tls,tls_verify, andtls_caon each<syslog_output>destination.LIBOPENSSL_ENABLED) with peer/hostname (or IP) verification whentls_verify=yes.atomicturtle:ossec-docs:docs/csyslog-tcp-tls.Related