summaryrefslogtreecommitdiffstats
path: root/usr.sbin/syslogd (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Instead of having global variables containing the libevent structures,bluhm2015-09-101-46/+64
| | | | | | allocate them with malloc. This makes the address space layout more random. OK deraadt@ benno@
* Convert syslogd TLS connect to use handshake callback. The bt_hostnamebluhm2015-09-103-51/+48
| | | | | | | | | | can go away as the callback does not need the hostname anymore. Call tls_handshake() until successful. Remove the function tls_socket() as it has a bad prefix. Just call tls_client(), tls_configure() and tls_connect_socket() after the TCP socket has been created. There is no need to wait until TCP connect has finished. OK beck@ jsing@
* reduce .Nd to one line and kill .Tn while hereschwarze2015-09-101-5/+3
|
* Make syslogd compile again after recent libtls changes. Adapt tobluhm2015-09-101-18/+16
| | | | | | new tls_read() and tls_write() calling semantics, adapt to TLS_WANT_POLLIN and TLS_WANT_POLLOUT renaming. OK beck@
* To double the receive buffer of a socketpair does not help as sendingbluhm2015-09-091-14/+25
| | | | | | | | | | | | | checks the send buffer size. So double both buffer sizes. Moreover the default for sending is 2048 and for receiving is 4096. This makes the existing double buffer algorithm inconsistent. It is better to make the buffers large enough to hold 8 full length messages. Just make sure that it does not shrink. Keep the approach that doubles the buffer sizes. When we are low on buffers and cannot reach the full size, increase it as much as possible. While there, add consistent error messages. OK benno@
* In sendsyslog(2) I got the plural s of messages right. The messagesbluhm2015-09-031-7/+9
| | | | | of syslogd(8) should be alike. syslogd: dropped 1 message OK lteo@ millert@
* Instead of creating a line buffer on the stack, tcp_readcb() canbluhm2015-09-031-7/+5
| | | | | use the global linebuf like the other libevent read callbacks. OK jung@
* Bind the *:514 UDP socket of syslogd with SO_REUSEADDR. This avoidsbluhm2015-09-011-7/+8
| | | | | | | conflicts with other processes bound to a specific address with the same port. Syslogd uses this socket basically for outgoing traffic to remote UDP log servers, so increase the chance that it works. OK jung@ benno@
* The !prog and +host features allow to select log messages from abluhm2015-08-311-27/+9
| | | | | | | | | specific programm or host. It does not make sense to truncate the string from the config at some character from a list. Just take whatever the user specified as progname or hostname. If it contains funky charactes it will not match and the action is not taken. This fixes matching with IP addresses if syslogd is started with -n. OK semarie@
* When syslogd is reloading a modified config, it does a reexec onbluhm2015-08-271-4/+8
| | | | | | | | itself. For this it uses the original arguments of main(). The function loghost_parse() modifies the optarg memory it is operating on. To prevent that the exec arguments have been tampered, pass a copy of optarg to loghost_parse(). OK deraadt@
* strlcpy() accesses the source string until it finds NUL, even ifbluhm2015-08-251-3/+5
| | | | | | | it is behind the size limit. As msg is not NUL-terminated in this case, it depended on memory content wether syslogd will crash. So using memcpy() and setting the NUL explicitly is the correct way. OK deraadt@
* Do not reconnect outgoing TCP connections too aggressively. Inbluhm2015-07-201-18/+19
| | | | | | case the receiver closes the connection, wait for a second to give him a chance to recover. OK benno@
* Do not accept sockets when syslogd reaches the file descriptorbluhm2015-07-201-19/+58
| | | | | | limit. Instead disable the listen event and wait for a second. Keep a reserve of 5 file descriptors. OK benno@
* For incoming TCP message streams autodetect wether the method isbluhm2015-07-191-28/+114
| | | | | octet counting or non transparent framing. OK benno@
* As libtls previously did not set SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER,bluhm2015-07-183-23/+4
| | | | | | | | syslogd had to drop messages after tls_write() returned TLS_{READ,WRITE}_AGAIN. Now after libtls has been fixed, remove the workaround. Messages are stored in the libevent write buffer as we can safely do a realloc(3) now. OK reyk@
* When incrementing msg, decrement msglen. Otherwise too much databluhm2015-07-161-2/+4
| | | | | could be written into the log file. OK benno@
* During fd passing, receive_fd() tries to read the result value andbluhm2015-07-091-1/+4
| | | | | | | | the file descriptor. If the fd limit is exhausted, recvmsg(2) fails. The kernel discards the fd, but the result value stays in the socket. It has to be read on its own to keep the privsep parent and syslogd child in sync. OK benno@
* Set f_hostname to NULL after free() to avoid a double free whenbluhm2015-07-091-1/+2
| | | | | both !host and memory buffer are used. OK jung@
* Do not explain multiple times how to put brackets around IPv6bluhm2015-07-071-15/+1
| | | | | | | addresses in syslogd(8). Using brackets to separate an IPv6 address from the port number is common practice and we keep the text in syslog.conf(5). OK jmc@
* When syslogd is invoked with -T listen_address, it creates a TCPbluhm2015-07-074-17/+202
| | | | | | | | | socket and accepts incomming messages. At the moment, only RFC 6587 3.4.2. Non-Transparent-Framing format with new-line separator is supprted for incomming messsages. Outgoing messages are encoded as 3.4.1. Octet Counting. Autodetection of incomming format will be implemented later. OK deraadt@ jmc@ millert@
* Remove some unneeded includes. OK deraadt@millert2015-07-067-28/+9
|
* Let syslogd run with non-blocking sockets. Replace the existingbluhm2015-07-051-26/+14
| | | | | | | fcntl(O_NONBLOCK) with the simpler SOCK_NONBLOCK and add this flag to the UDP sockets. React to EWOULDBLOCK although it should not happen. OK benno@
* To avoid copying the socket creation code for upcoming TCP listenbluhm2015-07-021-117/+114
| | | | | again, move it to the common function socket_bind(). OK millert@
* Sort the syslogd getopt string and switch cases according to thebluhm2015-06-301-13/+13
| | | | | man page. This makes it easier to check wether both are consistent. OK jung@
* Add a -U command line switch for syslogd to specify an explict bindbluhm2015-06-304-17/+109
| | | | | | | address to receive UDP packets. One advantge over -u and the * sockets is that you can bind to localhost and divert the packets with pf. It is also possible to use a non standard port. OK jung@ jmc@
* Add the possiblity to store all syslog messages received from abluhm2015-06-292-35/+84
| | | | | | | specific host into a single log file. For programs this is already implemented for !prog blocks. So do the same with +host for hostnames. Based on a diff from Gregory Edigarov; OK jung@ sthen@
* put -F before -f in the options list;jmc2015-06-151-4/+4
|
* Implement a -F switch, that tells syslogd to stay in foreground.bluhm2015-06-152-7/+14
| | | | OK benno@; input millert@; no objections deraadt@
* Close the lock pipe before dupping /dev/null to stdio.bluhm2015-06-121-2/+2
| | | | | This works even if the file descriptor is 0 or 1 or 2. input and OK millert@
* If fork fails, print an error message before exit.bluhm2015-06-121-2/+2
| | | | OK doug@ djm@
* Use getline instead of fgets to allow arbitrary line length intobias2015-03-301-4/+11
| | | | | | | configuration file. Also make sure that we fully parsed it. If not, avoid to start a half-baked syslogd. with input by and ok bluhm@
* Explain in a comment that atoi() is safe here.bluhm2015-02-241-1/+2
| | | | OK deraadt@
* Rename tls_config_insecure_noverifyhost() tojsing2015-02-221-2/+2
| | | | | | | tls_config_insecure_noverifyname(), so that it is more accurate and keeps inline with the distinction between DNS hostname and server name. Requested by tedu@ during s2k15.
* Set the TLS ciphers to "compat" mode, restoring the previous behaviour.jsing2015-02-221-2/+5
|
* When syslogd is writing over TLS, the error "SSL3_WRITE_PENDING:badbluhm2015-02-203-4/+23
| | | | | | | | | | | | | | | write retry" may occur. Unfortunately libtls tls_write() has inherited the strange semantics regarding partial writes and buffer movement from SSL_write(). This will be investigated after unlock, the goal is to have the behavior of write(2) in libtls. For now add a workaround in syslogd. If tls_write() indicates that it needs a read or write again, stop modifying the output buffer. Instead drop and count the syslog messages. After writing over TLS was successful, continue to queue the messages. This solution has minimum inpact and will be improved after 5.7 release. discussed with tedu@ reyk@ jsing@; OK tedu@
* Call tls_config_set_protocols(TLS_PROTOCOLS_ALL) also if the hostnamebluhm2015-02-141-4/+4
| | | | | and certificate are not verified. OK jsing@
* When too many -a requests on the syslogd command line cannot bebluhm2015-02-131-6/+3
| | | | | | fulfilled, it is better to fail hard. Then the user can adjust rc.conf.local or the #define MAXUNIX. OK millert@
* Change TLS_PROTOCOLS_DEFAULT to be TLSv1.2 only. Add a TLS_PROTOCOLS_ALLjsing2015-02-121-1/+3
| | | | | | | | that includes all currently supported protocols (TLSv1.0, TLSv1.1 and TLSv1.2). Change all users of libtls to use TLS_PROTOCOLS_ALL so that they maintain existing behaviour. Discussed with tedu@ and reyk@.
* Oops, I accidently reverted the two previous commits in syslog.conf.5.bluhm2015-02-101-2/+5
| | | | Bring back revision 1.29.
* Make error check consistent in all recvfrom(2) callbacks.bluhm2015-02-102-7/+4
| | | | OK henning@
* Fix typo in previous commit.bluhm2015-02-101-2/+2
|
* Specifying the port is non-optional for (non-TLS) syslog over TCP, ok bluhm@sthen2015-02-101-3/+6
|
* Fix format string of -m error message.bluhm2015-02-091-2/+2
| | | | OK deraadt@
* Implement octet counting for sending syslog over TCP and TLS streams.bluhm2015-02-081-9/+46
| | | | | For TCP the standard recommends it, but TLS must use this framing. OK henning@
* Use ebuf[ERRBUFSIZE] instead of ebuf[256] everywhere.reyk2015-02-081-9/+10
| | | | OK bluhm@
* use strtonum() instead of atoi(); ok bluhmderaadt2015-02-071-2/+6
|
* To get reliable TCP and TLS logging, report when messages get lost.bluhm2015-02-061-7/+67
| | | | | | | | If the log server refuses to receive messages and the buffer gets full, count the dropped messages. Log the counter when the server accepts messages again. If there are messages in the buffer when a signal is received, count and log them. tested sthen@; OK henning@
* As a result of the recommendations in RFC 5424, 5425, 5426 set thebluhm2015-02-021-10/+17
| | | | | | | | | | | | maximum syslog message size to 8192 octets. Restrict UDP sending to 1180 octets payload to avoid fragmentation. This is more than the 1024 we supported before. Also truncate the line in printline() to exactly 8192 bytes regardless of visual encoding. That is a more predictable behavior and makes testing easier. Although syslog(3) does not support long messages yet, make sure that /dev/log can receive them. OK deraadt@
* The error buffer in syslogd might be too small for the TLS errors.bluhm2015-01-311-22/+22
| | | | | Increase it to 256 bytes and call it ebuf everywhere. OK sthen@
* Document the syslogd certificate validation options.bluhm2015-01-301-3/+11
| | | | OK jmc@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.