fix: include the agent uuid in the inventory tables id calculation

wazuh · Dec 11, 2024 · db77063 · db77063
1 parent 0aca1c3
commit db77063
Show file tree

Hide file tree

Showing 7 changed files with 126 additions and 78 deletions.
diff --git a/src/agent/src/agent.cpp b/src/agent/src/agent.cpp
@@ -29,7 +29,8 @@ Agent::Agent(const std::string& configFilePath, std::unique_ptr<ISignalHandler>
           { return m_configurationParser->GetConfig<T>(std::move(table), std::move(key)); })
     , m_moduleManager([this](Message message) -> int { return m_messageQueue->push(std::move(message)); },
                       m_configurationParser,
-                      [this](std::function<void()> task) { m_taskManager.EnqueueTask(std::move(task)); })
+                      [this](std::function<void()> task) { m_taskManager.EnqueueTask(std::move(task)); },
+                      m_agentInfo.GetUUID())
     , m_commandHandler(m_dataPath)
 {
     // Check if agent is registered

diff --git a/src/modules/include/moduleManager.hpp b/src/modules/include/moduleManager.hpp
@@ -13,10 +13,12 @@ class ModuleManager {
 public:
     ModuleManager(const std::function<int(Message)>& pushMessage,
                 std::shared_ptr<configuration::ConfigurationParser> configurationParser,
-                const std::function<void(std::function<void()>)>& createTask)
+                const std::function<void(std::function<void()>)>& createTask,
+                const std::string& uuid)
         : m_pushMessage(pushMessage)
         , m_configurationParser(std::move(configurationParser))
         , m_createTask(createTask)
+        , m_agentUUID(uuid)
     {}
     ~ModuleManager() = default;
 
@@ -54,4 +56,5 @@ class ModuleManager {
     std::function<int(Message)> m_pushMessage;
     std::shared_ptr<configuration::ConfigurationParser> m_configurationParser;
     std::function<void(std::function<void()>)> m_createTask;
+    std::string m_agentUUID;
 };
diff --git a/src/modules/inventory/include/inventory.hpp b/src/modules/inventory/include/inventory.hpp
@@ -27,7 +27,6 @@ class Inventory {
             static Inventory s_instance;
             return s_instance;
         }
-
         void Start();
         void Setup(std::shared_ptr<const configuration::ConfigurationParser> configurationParser);
         void Stop();
@@ -42,6 +41,11 @@ class Inventory {
                     const std::string& normalizerType);
         virtual void SendDeltaEvent(const std::string& data);
 
+        const std::string& AgentUUID() const { return m_agentUUID; };
+        void SetAgentUUID(const std::string& agentUUID) {
+            m_agentUUID = agentUUID;
+        }
+
     private:
         Inventory();
         ~Inventory() = default;
@@ -83,6 +87,7 @@ class Inventory {
         std::string CalculateBase64Id(const nlohmann::json& data, const std::string& table);
 
         const std::string                           m_moduleName {"inventory"};
+        std::string                                 m_agentUUID {""};   // Agent UUID
         std::shared_ptr<ISysInfo>                   m_spInfo;
         std::function<void(const std::string&)>     m_reportDiffFunction;
         bool                                        m_enabled;          // Main switch

diff --git a/src/modules/inventory/src/inventoryImp.cpp b/src/modules/inventory/src/inventoryImp.cpp
@@ -12,6 +12,7 @@ constexpr std::time_t INVENTORY_DEFAULT_INTERVAL { 3600000 };
 constexpr auto UNKNOWN_VALUE {" "};
 constexpr auto EMPTY_VALUE {""};
 constexpr auto UNKNOWN_DATE = nullptr;
+constexpr size_t MAX_ID_SIZE = 512;
 
 constexpr auto QUEUE_SIZE
 {
@@ -299,7 +300,7 @@ std::string Inventory::GetPrimaryKeys([[maybe_unused]] const nlohmann::json& dat
 std::string Inventory::CalculateBase64Id(const nlohmann::json& data, const std::string& table)
 {
     std::string primaryKey = GetPrimaryKeys(data, table);
-    std::string baseId = Name() + ":" + table + ":" + primaryKey;
+    std::string baseId = AgentUUID() + ":" + primaryKey;
     std::string idBase64;
     idBase64.resize(boost::beast::detail::base64::encoded_size(baseId.size()));
     boost::beast::detail::base64::encode(&idBase64[0], baseId.c_str(), baseId.size());
@@ -324,9 +325,18 @@ void Inventory::NotifyChange(ReturnTypeCallback result, const nlohmann::json& da
                 msg["operation"] = OPERATION_MAP.at(result);
                 msg["data"] = EcsData(item, table);
                 msg["id"] = CalculateBase64Id(msg["data"], table);
-                msg["data"]["@timestamp"] = m_scanTime;
-                const auto msgToSend{msg.dump()};
-                m_reportDiffFunction(msgToSend);
+
+                if (msg["id"].is_string() && msg["id"].get<std::string>().size() <= MAX_ID_SIZE)
+                {
+                    msg["data"]["@timestamp"] = m_scanTime;
+                    const auto msgToSend{msg.dump()};
+                    m_reportDiffFunction(msgToSend);
+                }
+                else
+                {
+                    LogWarn("Event discarded for exceeding maximum size allowed in id field. Actual: {}, Maximum: {}", msg["id"].get<std::string>().size(), MAX_ID_SIZE);
+                    LogTrace("Event discarded: {}", msg.dump());
+                }
             }
         }
         else
@@ -337,9 +347,19 @@ void Inventory::NotifyChange(ReturnTypeCallback result, const nlohmann::json& da
             msg["operation"] = OPERATION_MAP.at(result);
             msg["data"] = EcsData(data, table);
             msg["id"] = CalculateBase64Id(msg["data"], table);
-            msg["data"]["@timestamp"] = m_scanTime;
-            const auto msgToSend{msg.dump()};
-            m_reportDiffFunction(msgToSend);
+
+            if (msg["id"].is_string() && msg["id"].get<std::string>().size() <= MAX_ID_SIZE)
+            {
+                msg["data"]["@timestamp"] = m_scanTime;
+                const auto msgToSend{msg.dump()};
+                m_reportDiffFunction(msgToSend);
+            }
+            else
+            {
+                LogWarn("Event discarded for exceeding maximum size allowed in id field. Actual: {}, Maximum: {}", msg["id"].get<std::string>().size(), MAX_ID_SIZE);
+                LogTrace("Event discarded: {}", msg.dump());
+            }
+
             // LCOV_EXCL_STOP
         }
     }