Amazon-ssm-agent: Session manager dropping characters from output

Created on 18 Dec 2018  路  5Comments  路  Source: aws/amazon-ssm-agent

A simple test case is the best way to illustrate the bug. For the following shell snippet (on Linux, although I assume Windows has a similar problem):

printf '\xc8'; sleep 1; printf '\x80 123'; sleep 1; printf '456\n'

Running on my local computer produces the expected output:

葊 123456

Running inside a shell in SSM session manager:

葊 12456

Note \xc8\x80 is the UTF-8 representation of \u0200 or

I've tested this against SSM agents with versions 2.3.274.0 and 2.3.344.0 (latest) and both exhibit the bug.

The culprit appears to be writePump in https://github.com/aws/amazon-ssm-agent/blob/c7f64dd6682154ee2a710d0dccf0034d868c5037/agent/session/plugins/shell/shell.go#L246
In particular:

  • if it encounters an unfinished UTF-8 sequence, it will delay processing it until the next iteration of the loop when there is more data (this is fine)
  • BUT it does all of its bookkeeping based on n, which is the number of bytes read from the pty, however this is incorrect if there is any data carried over from the previous iteration (i.e. due to an unfinished UTF-8 sequence). So, if there are x bytes carried over from the previous iteration and n bytes read in the current iteration, then there are x+n bytes in total, but writePump only processes the first n bytes and drops the remaining x.

The example given includes sleeps between the various printfs to force SSM to read \xc8 and \x80 123 in separate iterations of the loop. You can achieve the same thing without sleep by printing enough data to fill the read buffer instead (which appears to be 1024 bytes).

Most helpful comment

I've noticed tcpdump doesn't work in Session Manager. I wonder if this is a related problem...

All 5 comments

Thanks for brining this to our attention and sharing details. We will look into this issue.

We have released a fix for this issue in version 2.3.479.0. Please let us know in case of further queries. Thanks!

I've noticed tcpdump doesn't work in Session Manager. I wonder if this is a related problem...

I'm running version 2.3.444.0 of the agent...

@minusdavid The issue with tcpdump is rather related to this: https://github.com/aws/amazon-ssm-agent/issues/108

Apparmor is blocking it if used via SSM, unfortunately I have no solution for it yet.

Was this page helpful?
0 / 5 - 0 ratings

Related issues

JeremiahO1 picture JeremiahO1  路  4Comments

pbobov picture pbobov  路  5Comments

johnnyplaydrums picture johnnyplaydrums  路  5Comments

shockie picture shockie  路  3Comments

thedevopsmachine picture thedevopsmachine  路  4Comments