Nicogp
commented
2 weeks ago I started working on the issue
- Added the new endpoint
- Changed the wdb_global_recalculate_agent_groups_hash function to receive the old hash as a parameter and update the db in case it changes.
Branch: https://github.com/wazuh/wazuh/tree/fix/23422-groups-hash
First tests (single node):
root@nico-VirtualBox:/home/nico# python3 wdb-query.py 'global sql update agent set group_sync_status="syncreq" w
here id=2'
[]
root@nico-VirtualBox:/home/nico# python3 wdb-query.py "global sql update agent set group_hash=Null where id=2"
[]
root@nico-VirtualBox:/home/nico# python3 wdb-query.py "global sql select id,group_hash,group_sync_status from agent"
[
{
"id": 0,
"group_sync_status": "synced"
},
{
"id": 1,
"group_hash": "37a8eec1",
"group_sync_status": "synced"
},
{
"id": 2,
"group_sync_status": "syncreq"
}
]
root@nico-VirtualBox:/home/nico# python3 wdb-query.py "global recalculate-agent-group-hashes"
ok
root@nico-VirtualBox:/home/nico# python3 wdb-query.py "global sql select id,group_hash,group_sync_status from agent"
[
{
"id": 0,
"group_sync_status": "synced"
},
{
"id": 1,
"group_hash": "37a8eec1",
"group_sync_status": "synced"
},
{
"id": 2,
"group_hash": "0da05cf3",
"group_sync_status": "synced"
}
]
root@nico-VirtualBox:/home/nico#
Description
A condition was discovered that could lead the cluster to enter an infinite loop to synchronize agent groups information.
When the master node fails to set the
group_hashcolumn for any agent in theglobal.db, this column remains empty until a new group modification occurs, which is something that doesn't happen very often. By synchronizing these columns in the cluster, the worker nodes receive the information and recalculate the hashes, producing a different result than the master which has some empty hashes. The master does not synchronize the hashes of empty groups, the worker nodes calculate them and that is why this happens.To fix this bug, it is proposed to implement a new endpoint in WazuhDB that the framework can use to make the manager recalculate all agent group hashes. This way the master will be able to recalculate bad group hashes without having to wait for the agent to change groups.
This new endpoint will be called
recalculate-agent-group-hashes. It will not receive any parameters, it will simply iterate the list of all agents and recalculate thegroup_hashfor all of them. About thegroup_sync_statuscolumn, it will be set tosyncedifgroup_hashdoesn't change and tosyncreqif it does (depending on if it's a worker or master node).