summaryrefslogtreecommitdiff
path: root/usr.sbin/syslogd
AgeCommit message (Collapse)Author
2015-09-09To double the receive buffer of a socketpair does not help as sendingAlexander Bluhm
checks the send buffer size. So double both buffer sizes. Moreover the default for sending is 2048 and for receiving is 4096. This makes the existing double buffer algorithm inconsistent. It is better to make the buffers large enough to hold 8 full length messages. Just make sure that it does not shrink. Keep the approach that doubles the buffer sizes. When we are low on buffers and cannot reach the full size, increase it as much as possible. While there, add consistent error messages. OK benno@
2015-09-03In sendsyslog(2) I got the plural s of messages right. The messagesAlexander Bluhm
of syslogd(8) should be alike. syslogd: dropped 1 message OK lteo@ millert@
2015-09-03Instead of creating a line buffer on the stack, tcp_readcb() canAlexander Bluhm
use the global linebuf like the other libevent read callbacks. OK jung@
2015-09-01Bind the *:514 UDP socket of syslogd with SO_REUSEADDR. This avoidsAlexander Bluhm
conflicts with other processes bound to a specific address with the same port. Syslogd uses this socket basically for outgoing traffic to remote UDP log servers, so increase the chance that it works. OK jung@ benno@
2015-08-31The !prog and +host features allow to select log messages from aAlexander Bluhm
specific programm or host. It does not make sense to truncate the string from the config at some character from a list. Just take whatever the user specified as progname or hostname. If it contains funky charactes it will not match and the action is not taken. This fixes matching with IP addresses if syslogd is started with -n. OK semarie@
2015-08-27When syslogd is reloading a modified config, it does a reexec onAlexander Bluhm
itself. For this it uses the original arguments of main(). The function loghost_parse() modifies the optarg memory it is operating on. To prevent that the exec arguments have been tampered, pass a copy of optarg to loghost_parse(). OK deraadt@
2015-08-25strlcpy() accesses the source string until it finds NUL, even ifAlexander Bluhm
it is behind the size limit. As msg is not NUL-terminated in this case, it depended on memory content wether syslogd will crash. So using memcpy() and setting the NUL explicitly is the correct way. OK deraadt@
2015-07-20Do not reconnect outgoing TCP connections too aggressively. InAlexander Bluhm
case the receiver closes the connection, wait for a second to give him a chance to recover. OK benno@
2015-07-20Do not accept sockets when syslogd reaches the file descriptorAlexander Bluhm
limit. Instead disable the listen event and wait for a second. Keep a reserve of 5 file descriptors. OK benno@
2015-07-19For incoming TCP message streams autodetect wether the method isAlexander Bluhm
octet counting or non transparent framing. OK benno@
2015-07-18As libtls previously did not set SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER,Alexander Bluhm
syslogd had to drop messages after tls_write() returned TLS_{READ,WRITE}_AGAIN. Now after libtls has been fixed, remove the workaround. Messages are stored in the libevent write buffer as we can safely do a realloc(3) now. OK reyk@
2015-07-16When incrementing msg, decrement msglen. Otherwise too much dataAlexander Bluhm
could be written into the log file. OK benno@
2015-07-09During fd passing, receive_fd() tries to read the result value andAlexander Bluhm
the file descriptor. If the fd limit is exhausted, recvmsg(2) fails. The kernel discards the fd, but the result value stays in the socket. It has to be read on its own to keep the privsep parent and syslogd child in sync. OK benno@
2015-07-09Set f_hostname to NULL after free() to avoid a double free whenAlexander Bluhm
both !host and memory buffer are used. OK jung@
2015-07-07Do not explain multiple times how to put brackets around IPv6Alexander Bluhm
addresses in syslogd(8). Using brackets to separate an IPv6 address from the port number is common practice and we keep the text in syslog.conf(5). OK jmc@
2015-07-07When syslogd is invoked with -T listen_address, it creates a TCPAlexander Bluhm
socket and accepts incomming messages. At the moment, only RFC 6587 3.4.2. Non-Transparent-Framing format with new-line separator is supprted for incomming messsages. Outgoing messages are encoded as 3.4.1. Octet Counting. Autodetection of incomming format will be implemented later. OK deraadt@ jmc@ millert@
2015-07-06Remove some unneeded includes. OK deraadt@Todd C. Miller
2015-07-05Let syslogd run with non-blocking sockets. Replace the existingAlexander Bluhm
fcntl(O_NONBLOCK) with the simpler SOCK_NONBLOCK and add this flag to the UDP sockets. React to EWOULDBLOCK although it should not happen. OK benno@
2015-07-02To avoid copying the socket creation code for upcoming TCP listenAlexander Bluhm
again, move it to the common function socket_bind(). OK millert@
2015-06-30Sort the syslogd getopt string and switch cases according to theAlexander Bluhm
man page. This makes it easier to check wether both are consistent. OK jung@
2015-06-30Add a -U command line switch for syslogd to specify an explict bindAlexander Bluhm
address to receive UDP packets. One advantge over -u and the * sockets is that you can bind to localhost and divert the packets with pf. It is also possible to use a non standard port. OK jung@ jmc@
2015-06-29Add the possiblity to store all syslog messages received from aAlexander Bluhm
specific host into a single log file. For programs this is already implemented for !prog blocks. So do the same with +host for hostnames. Based on a diff from Gregory Edigarov; OK jung@ sthen@
2015-06-15put -F before -f in the options list;Jason McIntyre
2015-06-15Implement a -F switch, that tells syslogd to stay in foreground.Alexander Bluhm
OK benno@; input millert@; no objections deraadt@
2015-06-12Close the lock pipe before dupping /dev/null to stdio.Alexander Bluhm
This works even if the file descriptor is 0 or 1 or 2. input and OK millert@
2015-06-12If fork fails, print an error message before exit.Alexander Bluhm
OK doug@ djm@
2015-03-30Use getline instead of fgets to allow arbitrary line length inTobias Stoeckmann
configuration file. Also make sure that we fully parsed it. If not, avoid to start a half-baked syslogd. with input by and ok bluhm@
2015-02-24Explain in a comment that atoi() is safe here.Alexander Bluhm
OK deraadt@
2015-02-22Rename tls_config_insecure_noverifyhost() toJoel Sing
tls_config_insecure_noverifyname(), so that it is more accurate and keeps inline with the distinction between DNS hostname and server name. Requested by tedu@ during s2k15.
2015-02-22Set the TLS ciphers to "compat" mode, restoring the previous behaviour.Joel Sing
2015-02-20When syslogd is writing over TLS, the error "SSL3_WRITE_PENDING:badAlexander Bluhm
write retry" may occur. Unfortunately libtls tls_write() has inherited the strange semantics regarding partial writes and buffer movement from SSL_write(). This will be investigated after unlock, the goal is to have the behavior of write(2) in libtls. For now add a workaround in syslogd. If tls_write() indicates that it needs a read or write again, stop modifying the output buffer. Instead drop and count the syslog messages. After writing over TLS was successful, continue to queue the messages. This solution has minimum inpact and will be improved after 5.7 release. discussed with tedu@ reyk@ jsing@; OK tedu@
2015-02-14Call tls_config_set_protocols(TLS_PROTOCOLS_ALL) also if the hostnameAlexander Bluhm
and certificate are not verified. OK jsing@
2015-02-13When too many -a requests on the syslogd command line cannot beAlexander Bluhm
fulfilled, it is better to fail hard. Then the user can adjust rc.conf.local or the #define MAXUNIX. OK millert@
2015-02-12Change TLS_PROTOCOLS_DEFAULT to be TLSv1.2 only. Add a TLS_PROTOCOLS_ALLJoel Sing
that includes all currently supported protocols (TLSv1.0, TLSv1.1 and TLSv1.2). Change all users of libtls to use TLS_PROTOCOLS_ALL so that they maintain existing behaviour. Discussed with tedu@ and reyk@.
2015-02-10Oops, I accidently reverted the two previous commits in syslog.conf.5.Alexander Bluhm
Bring back revision 1.29.
2015-02-10Make error check consistent in all recvfrom(2) callbacks.Alexander Bluhm
OK henning@
2015-02-10Fix typo in previous commit.Alexander Bluhm
2015-02-10Specifying the port is non-optional for (non-TLS) syslog over TCP, ok bluhm@Stuart Henderson
2015-02-09Fix format string of -m error message.Alexander Bluhm
OK deraadt@
2015-02-08Implement octet counting for sending syslog over TCP and TLS streams.Alexander Bluhm
For TCP the standard recommends it, but TLS must use this framing. OK henning@
2015-02-08Use ebuf[ERRBUFSIZE] instead of ebuf[256] everywhere.Reyk Floeter
OK bluhm@
2015-02-07use strtonum() instead of atoi(); ok bluhmTheo de Raadt
2015-02-06To get reliable TCP and TLS logging, report when messages get lost.Alexander Bluhm
If the log server refuses to receive messages and the buffer gets full, count the dropped messages. Log the counter when the server accepts messages again. If there are messages in the buffer when a signal is received, count and log them. tested sthen@; OK henning@
2015-02-02As a result of the recommendations in RFC 5424, 5425, 5426 set theAlexander Bluhm
maximum syslog message size to 8192 octets. Restrict UDP sending to 1180 octets payload to avoid fragmentation. This is more than the 1024 we supported before. Also truncate the line in printline() to exactly 8192 bytes regardless of visual encoding. That is a more predictable behavior and makes testing easier. Although syslog(3) does not support long messages yet, make sure that /dev/log can receive them. OK deraadt@
2015-01-31The error buffer in syslogd might be too small for the TLS errors.Alexander Bluhm
Increase it to 256 bytes and call it ebuf everywhere. OK sthen@
2015-01-30Document the syslogd certificate validation options.Alexander Bluhm
OK jmc@
2015-01-30Start TLS after the TCP connect has finished. Call the TLS connectAlexander Bluhm
callback when the connected socket is writable. This avoids calling a NULL error callback. OK deraadt@
2015-01-28If not explicitly disabled, syslogd verifies the x509 certificateAlexander Bluhm
and hostname of the TLS server before sending any messages to it. Per default /etc/ssl/cert.pem is used as CA file. OK deraadt@
2015-01-20Document how to send syslog messages over TCP or TLS.Alexander Bluhm
OK jmc@
2015-01-19Replace HOST_NAME_MAX+1 with NI_MAXHOST when the hostname is usedAlexander Bluhm
with getaddrinfo() or getnameinfo(), but keep HOST_NAME_MAX+1 when the hostname comes from gethostname(). No binary change; OK deraadt@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-22 08:21:05 +0000