Details
-
Type:
Incident report
-
Status: Closed
-
Priority:
Blocker
-
Resolution: Fixed
-
Affects Version/s: 3.0.1, 3.2.0alpha1
-
Fix Version/s: 3.0.2rc1, 3.2.0alpha1
-
Component/s: Proxy (P), Server (S)
-
Labels:
Description
Discoverer memset()'s DC_ITEM structure with zeros and passes it to get_value_agent() where item->tls_connect == 0 is interpreted not ZBX_TCP_SEC_UNENCRYPTED.
Obviously, nothing good will happen if encryption support was compiled in when zbx_tcp_connect() gets tls_connect == 0, tls_arg1 == NULL and tls_arg2 == NULL.
If encryption support was not compiled in get_value_agent() will fail with error: "A TLS connection is configured to be used with agent but support for TLS was not compiled into %s."
Also, in this scenario zbx_tcp_close() is called for uninitialized socket.
Introduced with ZBXNEXT-1263.
Activity
(1) Documentation. We should mention in the network discovery page that only unencrpyted Zabbix agent checks are supported until ZBXNEXT-3215 is implemented.
Glebs Ivanovskis Updated pages:
- https://www.zabbix.com/documentation/3.0/manual/discovery/network_discovery#overview
- https://www.zabbix.com/documentation/3.0/manual/discovery/network_discovery/rule#rule_attributes
- https://www.zabbix.com/documentation/3.0/manual/encryption#limitations
Dear Sandis Neilands, please have a look and then I will copy changes to 3.2 documentation.
RESOLVED
Sandis Neilands Content is OK. Martins Valkovskis, please check the language.
Martins Valkovskis Done. I also copied the changes to 3.2.
Sandis Neilands CLOSED.
Successfully tested both build with and without encryption. For build with encryption tested cases where encryption for agent is and is not enabled.
Fixed in pre-3.0.2rc1 r59344, pre-3.1.0 (trunk) r59345.
Fix for version 3.0 is available in development branch svn://svn.zabbix.com/branches/dev/ZBX-10571 revision 59129.