Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Stop agent execution when it is not registered #378

Merged
merged 3 commits into from
Dec 3, 2024

Conversation

TomasTurina
Copy link
Member

@TomasTurina TomasTurina commented Dec 2, 2024

Related issue
#359

Description

This PR prevents an agent from continuing to run indefinitely in the following scenarios:

  • The agent has not been previously registered.
  • The server does not recognize the agent during authentication.
  • The agent key used to authenticate is invalid.

Logs/Alerts example

###Agent not registered:

# ./wazuh-agent --run --config-file wazuh-agent.yml 
[2024-12-02 19:33:11.138] [wazuh-agent] [info] [INFO] [process_options_unix.cpp:24] [StartAgent] Starting wazuh-agent
[2024-12-02 19:33:11.168] [wazuh-agent] [info] [INFO] [communicator.hpp:55] [Communicator] Using insecure connection.
[2024-12-02 19:33:11.169] [wazuh-agent] [critical] [CRITICAL] [main.cpp:98] [main] An error occurred: The agent is not registered.

Agent not exists error (API):

# ./wazuh-agent --run --config-file wazuh-agent.yml 
[2024-12-02 19:34:46.700] [wazuh-agent] [info] [INFO] [process_options_unix.cpp:24] [StartAgent] Starting wazuh-agent
[2024-12-02 19:34:46.706] [wazuh-agent] [info] [INFO] [communicator.hpp:55] [Communicator] Using insecure connection.
[2024-12-02 19:34:46.712] [wazuh-agent] [critical] [CRITICAL] [main.cpp:98] [main] An error occurred: Agent does not exist.

Agent key invalid error (API):

# ./wazuh-agent --run --config-file wazuh-agent.yml 
[2024-12-02 19:35:31.394] [wazuh-agent] [info] [INFO] [process_options_unix.cpp:24] [StartAgent] Starting wazuh-agent
[2024-12-02 19:35:31.397] [wazuh-agent] [info] [INFO] [communicator.hpp:55] [Communicator] Using insecure connection.
[2024-12-02 19:35:31.402] [wazuh-agent] [critical] [CRITICAL] [main.cpp:98] [main] An error occurred: Invalid key.

Tests

  • Compilation without warnings in every supported platform
    • Linux
    • Windows
    • MAC OS X

@TomasTurina TomasTurina self-assigned this Dec 2, 2024
@TomasTurina TomasTurina linked an issue Dec 2, 2024 that may be closed by this pull request
@TomasTurina TomasTurina changed the title Feat/359 stop agent when not registered Stop agent execution when it is not registered Dec 2, 2024
@TomasTurina TomasTurina force-pushed the feat/359-stop-agent-when-not-registered branch from 85d07cc to bef68dc Compare December 2, 2024 19:43
@TomasTurina TomasTurina marked this pull request as ready for review December 2, 2024 19:43
@TomasTurina TomasTurina force-pushed the feat/359-stop-agent-when-not-registered branch 2 times, most recently from 9df5849 to 3aebc9c Compare December 2, 2024 19:47

if (message == "Invalid key" || message == "Agent does not exist")
{
throw std::runtime_error(message);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we won't throw if the response code is unauthorized or forbidden and if the message does not match. Would that be OK? because this looks like it is very coupled to the specific string we will find in the message.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These are the messages that the server uses to indicate that the agent has not been recognized. Since this cannot be guessed by just analyzing the error code, we need to verify the message. cc @wazuh/devel-pyserver

@TomasTurina TomasTurina force-pushed the feat/359-stop-agent-when-not-registered branch from 3aebc9c to afdfdf0 Compare December 3, 2024 02:30
@TomasTurina TomasTurina merged commit 3103973 into master Dec 3, 2024
5 checks passed
@TomasTurina TomasTurina deleted the feat/359-stop-agent-when-not-registered branch December 3, 2024 02:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Change agent behavior at startup
2 participants