summaryrefslogtreecommitdiffstats
path: root/usr.sbin/syslogd (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* normalize a few more tame request orderings, to help reviewderaadt2015-10-101-2/+2
|
* If syslogd is started with -S, it accepts TLS connections to receivebluhm2015-10-096-50/+224
| | | | | | encrypted messages. The server certificates are taken from /etc/ssl like relayd does. OK benno@ beck@ deraadt@
* A fork(2) is used in ttymsg() to delay the message to a tty if itbluhm2015-10-091-2/+2
| | | | | blocks. Fix the potential syslogd's death, add "proc" to pledge. OK deraadt@
* catch up to tame() -> pledge() renamederaadt2015-10-091-3/+3
|
* Tame syslogd privsep child with "stdio rpath unix inet recvfd".bluhm2015-10-091-1/+4
| | | | With and OK deraadt@
* Delete the final, inscrutable NOSTRICT and VARARGS lint commentsguenther2015-09-291-3/+2
| | | | ok millert@
* Misuse of libevent in TLS read and write might have caused strangebluhm2015-09-201-56/+39
| | | | | | | | | | | | | | | event loss in syslogd. The ev_read and ev_write event structures were used for both EV_READ and EV_WRITE events intermixedly. The correct way is to use each event for its read and write purpose and instead switch the handler. Then libevent is no longer confused. When doing TLS read and a TLS_WANT_POLLOUT occures, call event_set() for the write event to change the callback to read. As there might be an event scheduled on the event, call event_del() before event_set(). After a successful TLS read, change back the write event. Add analog code for TLS write and handshake. OK beck@
* It is not necessary to reset errno to 0 since we use logerrorx().bluhm2015-09-121-5/+1
| | | | Spotted by jung@
* Instead of printing errno strings here and there, add a logerrorx()bluhm2015-09-111-52/+66
| | | | | | | | to syslogd that does not do that. Use it for anything that does not look like a system call or library call around it. Also add logerrorctx() that prints the TLS error instead. Reduce the maximum CAfile limit to 50MB, requested by Bob. OK beck@
* Syslog does not need the global list of TCP clients, libevent handlesbluhm2015-09-111-8/+1
| | | | | everything. OK benno@
* Instead of having global variables containing the libevent structures,bluhm2015-09-101-46/+64
| | | | | | allocate them with malloc. This makes the address space layout more random. OK deraadt@ benno@
* Convert syslogd TLS connect to use handshake callback. The bt_hostnamebluhm2015-09-103-51/+48
| | | | | | | | | | can go away as the callback does not need the hostname anymore. Call tls_handshake() until successful. Remove the function tls_socket() as it has a bad prefix. Just call tls_client(), tls_configure() and tls_connect_socket() after the TCP socket has been created. There is no need to wait until TCP connect has finished. OK beck@ jsing@
* reduce .Nd to one line and kill .Tn while hereschwarze2015-09-101-5/+3
|
* Make syslogd compile again after recent libtls changes. Adapt tobluhm2015-09-101-18/+16
| | | | | | new tls_read() and tls_write() calling semantics, adapt to TLS_WANT_POLLIN and TLS_WANT_POLLOUT renaming. OK beck@
* To double the receive buffer of a socketpair does not help as sendingbluhm2015-09-091-14/+25
| | | | | | | | | | | | | checks the send buffer size. So double both buffer sizes. Moreover the default for sending is 2048 and for receiving is 4096. This makes the existing double buffer algorithm inconsistent. It is better to make the buffers large enough to hold 8 full length messages. Just make sure that it does not shrink. Keep the approach that doubles the buffer sizes. When we are low on buffers and cannot reach the full size, increase it as much as possible. While there, add consistent error messages. OK benno@
* In sendsyslog(2) I got the plural s of messages right. The messagesbluhm2015-09-031-7/+9
| | | | | of syslogd(8) should be alike. syslogd: dropped 1 message OK lteo@ millert@
* Instead of creating a line buffer on the stack, tcp_readcb() canbluhm2015-09-031-7/+5
| | | | | use the global linebuf like the other libevent read callbacks. OK jung@
* Bind the *:514 UDP socket of syslogd with SO_REUSEADDR. This avoidsbluhm2015-09-011-7/+8
| | | | | | | conflicts with other processes bound to a specific address with the same port. Syslogd uses this socket basically for outgoing traffic to remote UDP log servers, so increase the chance that it works. OK jung@ benno@
* The !prog and +host features allow to select log messages from abluhm2015-08-311-27/+9
| | | | | | | | | specific programm or host. It does not make sense to truncate the string from the config at some character from a list. Just take whatever the user specified as progname or hostname. If it contains funky charactes it will not match and the action is not taken. This fixes matching with IP addresses if syslogd is started with -n. OK semarie@
* When syslogd is reloading a modified config, it does a reexec onbluhm2015-08-271-4/+8
| | | | | | | | itself. For this it uses the original arguments of main(). The function loghost_parse() modifies the optarg memory it is operating on. To prevent that the exec arguments have been tampered, pass a copy of optarg to loghost_parse(). OK deraadt@
* strlcpy() accesses the source string until it finds NUL, even ifbluhm2015-08-251-3/+5
| | | | | | | it is behind the size limit. As msg is not NUL-terminated in this case, it depended on memory content wether syslogd will crash. So using memcpy() and setting the NUL explicitly is the correct way. OK deraadt@
* Do not reconnect outgoing TCP connections too aggressively. Inbluhm2015-07-201-18/+19
| | | | | | case the receiver closes the connection, wait for a second to give him a chance to recover. OK benno@
* Do not accept sockets when syslogd reaches the file descriptorbluhm2015-07-201-19/+58
| | | | | | limit. Instead disable the listen event and wait for a second. Keep a reserve of 5 file descriptors. OK benno@
* For incoming TCP message streams autodetect wether the method isbluhm2015-07-191-28/+114
| | | | | octet counting or non transparent framing. OK benno@
* As libtls previously did not set SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER,bluhm2015-07-183-23/+4
| | | | | | | | syslogd had to drop messages after tls_write() returned TLS_{READ,WRITE}_AGAIN. Now after libtls has been fixed, remove the workaround. Messages are stored in the libevent write buffer as we can safely do a realloc(3) now. OK reyk@
* When incrementing msg, decrement msglen. Otherwise too much databluhm2015-07-161-2/+4
| | | | | could be written into the log file. OK benno@
* During fd passing, receive_fd() tries to read the result value andbluhm2015-07-091-1/+4
| | | | | | | | the file descriptor. If the fd limit is exhausted, recvmsg(2) fails. The kernel discards the fd, but the result value stays in the socket. It has to be read on its own to keep the privsep parent and syslogd child in sync. OK benno@
* Set f_hostname to NULL after free() to avoid a double free whenbluhm2015-07-091-1/+2
| | | | | both !host and memory buffer are used. OK jung@
* Do not explain multiple times how to put brackets around IPv6bluhm2015-07-071-15/+1
| | | | | | | addresses in syslogd(8). Using brackets to separate an IPv6 address from the port number is common practice and we keep the text in syslog.conf(5). OK jmc@
* When syslogd is invoked with -T listen_address, it creates a TCPbluhm2015-07-074-17/+202
| | | | | | | | | socket and accepts incomming messages. At the moment, only RFC 6587 3.4.2. Non-Transparent-Framing format with new-line separator is supprted for incomming messsages. Outgoing messages are encoded as 3.4.1. Octet Counting. Autodetection of incomming format will be implemented later. OK deraadt@ jmc@ millert@
* Remove some unneeded includes. OK deraadt@millert2015-07-067-28/+9
|
* Let syslogd run with non-blocking sockets. Replace the existingbluhm2015-07-051-26/+14
| | | | | | | fcntl(O_NONBLOCK) with the simpler SOCK_NONBLOCK and add this flag to the UDP sockets. React to EWOULDBLOCK although it should not happen. OK benno@
* To avoid copying the socket creation code for upcoming TCP listenbluhm2015-07-021-117/+114
| | | | | again, move it to the common function socket_bind(). OK millert@
* Sort the syslogd getopt string and switch cases according to thebluhm2015-06-301-13/+13
| | | | | man page. This makes it easier to check wether both are consistent. OK jung@
* Add a -U command line switch for syslogd to specify an explict bindbluhm2015-06-304-17/+109
| | | | | | | address to receive UDP packets. One advantge over -u and the * sockets is that you can bind to localhost and divert the packets with pf. It is also possible to use a non standard port. OK jung@ jmc@
* Add the possiblity to store all syslog messages received from abluhm2015-06-292-35/+84
| | | | | | | specific host into a single log file. For programs this is already implemented for !prog blocks. So do the same with +host for hostnames. Based on a diff from Gregory Edigarov; OK jung@ sthen@
* put -F before -f in the options list;jmc2015-06-151-4/+4
|
* Implement a -F switch, that tells syslogd to stay in foreground.bluhm2015-06-152-7/+14
| | | | OK benno@; input millert@; no objections deraadt@
* Close the lock pipe before dupping /dev/null to stdio.bluhm2015-06-121-2/+2
| | | | | This works even if the file descriptor is 0 or 1 or 2. input and OK millert@
* If fork fails, print an error message before exit.bluhm2015-06-121-2/+2
| | | | OK doug@ djm@
* Use getline instead of fgets to allow arbitrary line length intobias2015-03-301-4/+11
| | | | | | | configuration file. Also make sure that we fully parsed it. If not, avoid to start a half-baked syslogd. with input by and ok bluhm@
* Explain in a comment that atoi() is safe here.bluhm2015-02-241-1/+2
| | | | OK deraadt@
* Rename tls_config_insecure_noverifyhost() tojsing2015-02-221-2/+2
| | | | | | | tls_config_insecure_noverifyname(), so that it is more accurate and keeps inline with the distinction between DNS hostname and server name. Requested by tedu@ during s2k15.
* Set the TLS ciphers to "compat" mode, restoring the previous behaviour.jsing2015-02-221-2/+5
|
* When syslogd is writing over TLS, the error "SSL3_WRITE_PENDING:badbluhm2015-02-203-4/+23
| | | | | | | | | | | | | | | write retry" may occur. Unfortunately libtls tls_write() has inherited the strange semantics regarding partial writes and buffer movement from SSL_write(). This will be investigated after unlock, the goal is to have the behavior of write(2) in libtls. For now add a workaround in syslogd. If tls_write() indicates that it needs a read or write again, stop modifying the output buffer. Instead drop and count the syslog messages. After writing over TLS was successful, continue to queue the messages. This solution has minimum inpact and will be improved after 5.7 release. discussed with tedu@ reyk@ jsing@; OK tedu@
* Call tls_config_set_protocols(TLS_PROTOCOLS_ALL) also if the hostnamebluhm2015-02-141-4/+4
| | | | | and certificate are not verified. OK jsing@
* When too many -a requests on the syslogd command line cannot bebluhm2015-02-131-6/+3
| | | | | | fulfilled, it is better to fail hard. Then the user can adjust rc.conf.local or the #define MAXUNIX. OK millert@
* Change TLS_PROTOCOLS_DEFAULT to be TLSv1.2 only. Add a TLS_PROTOCOLS_ALLjsing2015-02-121-1/+3
| | | | | | | | that includes all currently supported protocols (TLSv1.0, TLSv1.1 and TLSv1.2). Change all users of libtls to use TLS_PROTOCOLS_ALL so that they maintain existing behaviour. Discussed with tedu@ and reyk@.
* Oops, I accidently reverted the two previous commits in syslog.conf.5.bluhm2015-02-101-2/+5
| | | | Bring back revision 1.29.
* Make error check consistent in all recvfrom(2) callbacks.bluhm2015-02-102-7/+4
| | | | OK henning@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.