summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--ChangeLog21
-rwxr-xr-xconfigure20
-rw-r--r--configure.ac2
-rw-r--r--doc/index.html7
-rw-r--r--doc/manual.html3
-rw-r--r--doc/rsconf1_dircreatemode.html10
-rw-r--r--doc/rsconf1_dirgroup.html2
-rw-r--r--doc/rsconf1_dirowner.html2
-rw-r--r--doc/rsconf1_filegroup.html2
-rw-r--r--doc/rsconf1_fileowner.html2
-rw-r--r--doc/rsyslog_conf_global.html11
-rw-r--r--doc/rsyslog_php_syslog_ng.html4
-rw-r--r--doc/rsyslog_recording_pri.html2
-rw-r--r--doc/rsyslog_tls.html2
-rw-r--r--plugins/imudp/imudp.c5
-rw-r--r--runtime/datetime.c119
-rw-r--r--runtime/datetime.h4
-rw-r--r--runtime/net.c44
-rw-r--r--runtime/net.h4
-rw-r--r--runtime/parser.c13
-rw-r--r--runtime/rsyslog.h1
-rw-r--r--tools/rsyslogd.815
-rw-r--r--tools/syslogd.c122
23 files changed, 291 insertions, 126 deletions
diff --git a/ChangeLog b/ChangeLog
index b84ad4d..3b16824 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,22 @@
---------------------------------------------------------------------------
+Version 4.4.2 [v4-stable] (rgerhards), 2009-10-09
+- bugfix: invalid handling of zero-sized messages, could lead to mis-
+ addressing and potential memory corruption/segfault
+- bugfix: zero-sized UDP messages are no longer processed
+ until now, they were forwarded to processing, but this makes no sense
+ Also, it looks like the system seems to provide a zero return code
+ on a UDP recvfrom() from time to time for some internal reasons. These
+ "receives" are now silently ignored.
+- bugfix: random data could be appended to message, possibly causing
+ segfaults
+- bugfix: reverse lookup reduction logic in imudp do DNS queries too often
+ A comparison was done between the current and the former source address.
+ However, this was done on the full sockaddr_storage structure and not
+ on the host address only. This has now been changed for IPv4 and IPv6.
+ The end result of this bug could be a higher UDP message loss rate than
+ necessary (note that UDP message loss can not totally be avoided due
+ to the UDP spec)
+---------------------------------------------------------------------------
Version 4.4.1 [v4-stable] (rgerhards), 2009-09-02
- features requiring Java are automatically disabled if Java is not
present (thanks to Michael Biebl for his help!)
@@ -233,6 +251,8 @@ version before switching to this one.
---------------------------------------------------------------------------
Version 3.22.2 [v3-stable] (rgerhards), 2009-07-??
- bugfix: sending syslog messages with zip compression did not work
+- clarified use of $ActionsSendStreamDriver[AuthMode/PermittedPeers]
+ in doc set (require TLS drivers)
---------------------------------------------------------------------------
Version 3.22.1 [v3-stable] (rgerhards), 2009-07-02
- bugfix: invalid error message issued if $inlcudeConfig was on an empty
@@ -1381,6 +1401,7 @@ Version 2.0.8 V2-STABLE (rgerhards), 2008-??-??
connection broke, but not if there was a problem with statement
execution. The most probable case for such a case would be invalid
sql inside the template, and this is now much easier to diagnose.
+- doc bugfix: default for $DirCreateMode incorrectly stated
---------------------------------------------------------------------------
Version 2.0.7 V2-STABLE (rgerhards), 2008-04-14
- bugfix: the default for $DirCreateMode was 0644, and as such wrong.
diff --git a/configure b/configure
index f8961ef..d2947ef 100755
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
#! /bin/sh
# Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.63 for rsyslog 4.4.1.
+# Generated by GNU Autoconf 2.63 for rsyslog 4.4.2.
#
# Report bugs to <rsyslog@lists.adiscon.com>.
#
@@ -745,8 +745,8 @@ SHELL=${CONFIG_SHELL-/bin/sh}
# Identity of this package.
PACKAGE_NAME='rsyslog'
PACKAGE_TARNAME='rsyslog'
-PACKAGE_VERSION='4.4.1'
-PACKAGE_STRING='rsyslog 4.4.1'
+PACKAGE_VERSION='4.4.2'
+PACKAGE_STRING='rsyslog 4.4.2'
PACKAGE_BUGREPORT='rsyslog@lists.adiscon.com'
ac_unique_file="ChangeLog"
@@ -1601,7 +1601,7 @@ if test "$ac_init_help" = "long"; then
# Omit some internal or obsolete options to make the list less imposing.
# This message is too long to be a string in the A/UX 3.1 sh.
cat <<_ACEOF
-\`configure' configures rsyslog 4.4.1 to adapt to many kinds of systems.
+\`configure' configures rsyslog 4.4.2 to adapt to many kinds of systems.
Usage: $0 [OPTION]... [VAR=VALUE]...
@@ -1671,7 +1671,7 @@ fi
if test -n "$ac_init_help"; then
case $ac_init_help in
- short | recursive ) echo "Configuration of rsyslog 4.4.1:";;
+ short | recursive ) echo "Configuration of rsyslog 4.4.2:";;
esac
cat <<\_ACEOF
@@ -1815,7 +1815,7 @@ fi
test -n "$ac_init_help" && exit $ac_status
if $ac_init_version; then
cat <<\_ACEOF
-rsyslog configure 4.4.1
+rsyslog configure 4.4.2
generated by GNU Autoconf 2.63
Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001,
@@ -1829,7 +1829,7 @@ cat >config.log <<_ACEOF
This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.
-It was created by rsyslog $as_me 4.4.1, which was
+It was created by rsyslog $as_me 4.4.2, which was
generated by GNU Autoconf 2.63. Invocation command line was
$ $0 $@
@@ -2678,7 +2678,7 @@ fi
# Define the identity of the package.
PACKAGE='rsyslog'
- VERSION='4.4.1'
+ VERSION='4.4.2'
cat >>confdefs.h <<_ACEOF
@@ -20625,7 +20625,7 @@ exec 6>&1
# report actual input values of CONFIG_FILES etc. instead of their
# values after options handling.
ac_log="
-This file was extended by rsyslog $as_me 4.4.1, which was
+This file was extended by rsyslog $as_me 4.4.2, which was
generated by GNU Autoconf 2.63. Invocation command line was
CONFIG_FILES = $CONFIG_FILES
@@ -20688,7 +20688,7 @@ Report bugs to <bug-autoconf@gnu.org>."
_ACEOF
cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
ac_cs_version="\\
-rsyslog config.status 4.4.1
+rsyslog config.status 4.4.2
configured by $0, generated by GNU Autoconf 2.63,
with options \\"`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`\\"
diff --git a/configure.ac b/configure.ac
index 059d68c..66a2d70 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2,7 +2,7 @@
# Process this file with autoconf to produce a configure script.
AC_PREREQ(2.61)
-AC_INIT([rsyslog],[4.4.1],[rsyslog@lists.adiscon.com])
+AC_INIT([rsyslog],[4.4.2],[rsyslog@lists.adiscon.com])
AM_INIT_AUTOMAKE
AC_CONFIG_SRCDIR([ChangeLog])
AC_CONFIG_MACRO_DIR([m4])
diff --git a/doc/index.html b/doc/index.html
index 349c8e5..b3b336a 100644
--- a/doc/index.html
+++ b/doc/index.html
@@ -25,8 +25,7 @@ To do the really cool things, though,
you need to learn a bit about its new features.
The man pages offer a bare minimum of information (and are still quite long). Read the
<a href="manual.html">html documentation</a> instead.
-When you change the configuration,
-remember to restart (or HUP) rsyslogd, because otherwise it won't use your
-new settings (and you'll end up totally puzzled why this great config of yours
-does not even work a bit...;))
+When you change the configuration, remember to restart rsyslogd, because otherwise
+it will not use your new settings (and you'll end up totally puzzled why this great
+config of yours does not even work a bit...;))
</body></html>
diff --git a/doc/manual.html b/doc/manual.html
index e61132c..5d43cb2 100644
--- a/doc/manual.html
+++ b/doc/manual.html
@@ -19,7 +19,7 @@ rsyslog support</a> available directly from the source!</p>
<p><b>Please visit the <a href="http://www.rsyslog.com/sponsors">rsyslog sponsor's page</a>
to honor the project sponsors or become one yourself!</b> We are very grateful for any help towards the
project goals.</p>
-<p><b>This documentation is for version 4.4.1 (v4-stable) of rsyslog.</b>
+<p><b>This documentation is for version 4.4.2 (v4-stable) of rsyslog.</b>
Visit the <i> <a href="http://www.rsyslog.com/doc-status.html">rsyslog status page</a></i></b> to obtain current
version information and project status.
</p><p><b>If you like rsyslog, you might
@@ -44,7 +44,6 @@ the links below for the</b><br></p><ul>
<li><a href="generic_design.html">backgrounder on
generic syslog application design</a><!-- not good as it currently is ;) <li><a href="contributors.html">contributor &quot;Hall of Fame&quot;</a>--></li>
<li><a href="modules.html">description of rsyslog modules</a></li>
-<li><a href="man_rsyslogd.html">rsyslogd man page</a> (heavily outdated)</li>
</ul>
<p><b>We have some in-depth papers on</b></p>
<ul>
diff --git a/doc/rsconf1_dircreatemode.html b/doc/rsconf1_dircreatemode.html
index 9a9c61e..b22b6c5 100644
--- a/doc/rsconf1_dircreatemode.html
+++ b/doc/rsconf1_dircreatemode.html
@@ -7,9 +7,13 @@
<h2>$DirCreateMode</h2>
<p><b>Type:</b> global configuration directive</p>
-<p><b>Default:</b> 0644</p>
+<p><b>Default:</b> 0700</p>
<p><b>Description:</b></p>
<p>This is the same as $FileCreateMode, but for directories automatically generated.</p>
+<p>Please visit the
+<a target="_blank" href="http://lists.adiscon.net/pipermail/rsyslog/2009-April/001986.html">rsyslog mailing list
+archive</a>
+to understand why the default is so restrictive.</p>
<p><b>Sample:</b></p>
<p><code><b></b></code></p>
@@ -17,8 +21,8 @@
index</a>] [<a href="http://www.rsyslog.com/">rsyslog site</a>]</p>
<p><font size="2">This documentation is part of the
<a href="http://www.rsyslog.com/">rsyslog</a> project.<br>
-Copyright &copy; 2007 by <a href="http://www.gerhards.net/rainer">Rainer Gerhards</a> and
+Copyright &copy; 2007-2009 by <a href="http://www.gerhards.net/rainer">Rainer Gerhards</a> and
<a href="http://www.adiscon.com/">Adiscon</a>. Released under the GNU GPL
-version 2 or higher.</font></p>
+version 3 or higher.</font></p>
</body>
</html>
diff --git a/doc/rsconf1_dirgroup.html b/doc/rsconf1_dirgroup.html
index de07012..4bc8692 100644
--- a/doc/rsconf1_dirgroup.html
+++ b/doc/rsconf1_dirgroup.html
@@ -9,7 +9,7 @@
<p><b>Type:</b> global configuration directive</p>
<p><b>Default:</b> </p>
<p><b>Description:</b></p>
-<p>Set the group for directories newly created. Please note that this setting does not affect the group of directories already existing. The parameter is a group name, for which the groupid is obtained by rsyslogd on startup and on HUPing. Interim changes to the user mapping are not detected.</p>
+<p>Set the group for directories newly created. Please note that this setting does not affect the group of directories already existing. The parameter is a group name, for which the groupid is obtained by rsyslogd on during startup processing. Interim changes to the user mapping are not detected.</p>
<p><b>Sample:</b></p>
<p><code><b>$DirGroup loggroup</b></code></p>
diff --git a/doc/rsconf1_dirowner.html b/doc/rsconf1_dirowner.html
index da8e252..f779c00 100644
--- a/doc/rsconf1_dirowner.html
+++ b/doc/rsconf1_dirowner.html
@@ -9,7 +9,7 @@
<p><b>Type:</b> global configuration directive</p>
<p><b>Default:</b> </p>
<p><b>Description:</b></p>
-<p>Set the file owner for directories newly created. Please note that this setting does not affect the owner of directories already existing. The parameter is a user name, for which the userid is obtained by rsyslogd on startup and on HUPing. Interim changes to the user mapping are not detected.</p>
+<p>Set the file owner for directories newly created. Please note that this setting does not affect the owner of directories already existing. The parameter is a user name, for which the userid is obtained by rsyslogd during startup processing. Interim changes to the user mapping are not detected.</p>
<p><b>Sample:</b></p>
<p><code><b>$DirOwner loguser</b></code></p>
diff --git a/doc/rsconf1_filegroup.html b/doc/rsconf1_filegroup.html
index dd5b8ad..935f074 100644
--- a/doc/rsconf1_filegroup.html
+++ b/doc/rsconf1_filegroup.html
@@ -9,7 +9,7 @@
<p><b>Type:</b> global configuration directive</p>
<p><b>Default:</b> </p>
<p><b>Description:</b></p>
-<p>Set the group for dynaFiles newly created. Please note that this setting does not affect the group of files already existing. The parameter is a group name, for which the groupid is obtained by rsyslogd on startup and on HUPing. Interim changes to the user mapping are not detected.</p>
+<p>Set the group for dynaFiles newly created. Please note that this setting does not affect the group of files already existing. The parameter is a group name, for which the groupid is obtained by rsyslogd during startup processing. Interim changes to the user mapping are not detected.</p>
<p><b>Sample:</b></p>
<p><code><b>$FileGroup loggroup</b></code></p>
diff --git a/doc/rsconf1_fileowner.html b/doc/rsconf1_fileowner.html
index 935cfff..62125c8 100644
--- a/doc/rsconf1_fileowner.html
+++ b/doc/rsconf1_fileowner.html
@@ -9,7 +9,7 @@
<p><b>Type:</b> global configuration directive</p>
<p><b>Default:</b> </p>
<p><b>Description:</b></p>
-<p>Set the file owner for dynaFiles newly created. Please note that this setting does not affect the owner of files already existing. The parameter is a user name, for which the userid is obtained by rsyslogd on startup and on HUPing. Interim changes to the user mapping are not detected.</p>
+<p>Set the file owner for dynaFiles newly created. Please note that this setting does not affect the owner of files already existing. The parameter is a user name, for which the userid is obtained by rsyslogd during startup processing. Interim changes to the user mapping are not detected.</p>
<p><b>Sample:</b></p>
<p><code><b>$FileOwner loguser</b></code></p>
diff --git a/doc/rsyslog_conf_global.html b/doc/rsyslog_conf_global.html
index 778e18f..7dda046 100644
--- a/doc/rsyslog_conf_global.html
+++ b/doc/rsyslog_conf_global.html
@@ -91,10 +91,13 @@ default 60000 (1 minute)]</li>
<li><a href="rsconf1_actionresumeinterval.html">$ActionResumeInterval</a></li>
<li>$ActionResumeRetryCount &lt;number&gt; [default 0, -1 means eternal]</li>
<li>$ActionSendResendLastMsgOnReconn &lt;[on/<b>off</b>]&gt; specifies if the last message is to be resend when a connecition broken and has been reconnedcted. May increase reliability, but comes at the risk of message duplication.
-<li>$ActionSendStreamDriver &lt;driver basename&gt; just like $DefaultNetstreamDriver, but for the specific action
-</li><li>$ActionSendStreamDriverMode &lt;mode&gt;, default 0, mode to use with the stream driver
-(driver-specific)</li><li>$ActionSendStreamDriverAuthMode &lt;mode&gt;,&nbsp; authentication mode to use with the stream driver
-(driver-specific)</li><li>$ActionSendStreamDriverPermittedPeer &lt;ID&gt;,&nbsp; accepted fingerprint (SHA1) or name of remote peer
+<li>$ActionSendStreamDriver &lt;driver basename&gt; just like $DefaultNetstreamDriver, but for the specific action</li>
+<li>$ActionSendStreamDriverMode &lt;mode&gt;, default 0, mode to use with the stream driver (driver-specific)</li>
+<li>$ActionSendStreamDriverAuthMode &lt;mode&gt;,&nbsp; authentication mode to use with the stream driver. Note that this directive requires TLS
+netstream drivers. For all others, it will be ignored.
+(driver-specific)</li>
+<li>$ActionSendStreamDriverPermittedPeer &lt;ID&gt;,&nbsp; accepted fingerprint (SHA1) or name of remote peer. Note that this directive requires TLS
+netstream drivers. For all others, it will be ignored.
(driver-specific) -<span style="font-weight: bold;"> directive may go away</span>!</li>
<li><b>$ActionSendUDPRebindInterval</b> nbr</a>- [available since 4.3.2] - instructs the UDP send
action to rebind the send socket every nbr of messages sent. Zero, the default, means
diff --git a/doc/rsyslog_php_syslog_ng.html b/doc/rsyslog_php_syslog_ng.html
index 9e72275..bf48a1e 100644
--- a/doc/rsyslog_php_syslog_ng.html
+++ b/doc/rsyslog_php_syslog_ng.html
@@ -107,7 +107,7 @@ server machine, &quot;syslog&quot; is the database name (default from the schema
and &quot;pass&quot; are the logon credentials. Use a user with low privileges, insert into the
logs table is sufficient. &quot;syslog-ng&quot; is the template name and tells rsyslogd to
use the SQL statement shown above.</p>
-<p>Once you have made the changes, all you need to do is reload (or HUP)
+<p>Once you have made the changes, all you need to do is restart
rsyslogd. Then, you should see syslog messages flow into your database - and
show up in php-syslog-ng.</p>
<h2>Conclusion</h2>
@@ -148,4 +148,4 @@ no Front-Cover Texts, and no Back-Cover Texts. A copy of the license can be
viewed at <a href="http://www.gnu.org/copyleft/fdl.html">
http://www.gnu.org/copyleft/fdl.html</a>.</p>
</body>
-</html> \ No newline at end of file
+</html>
diff --git a/doc/rsyslog_recording_pri.html b/doc/rsyslog_recording_pri.html
index 1dcf00c..cf11e3e 100644
--- a/doc/rsyslog_recording_pri.html
+++ b/doc/rsyslog_recording_pri.html
@@ -62,7 +62,7 @@ semicolon:</p>
<p>That's all you need to do. There is one common pitfall: you need to define
the template before you use it in a selector line. Otherwise, you will receive
an error.</p>
-<p>Once you have applied the changes, you need to restart or HUP rsyslogd. It
+<p>Once you have applied the changes, you need to restart rsyslogd. It
will then pick the new configuration.</p>
<h2>What if I do not want rsyslogd to be the standard syslogd?</h2>
<p>If you do not want to switch to rsyslog, you can still use it as a setup aid.
diff --git a/doc/rsyslog_tls.html b/doc/rsyslog_tls.html
index e37d26a..bb312c7 100644
--- a/doc/rsyslog_tls.html
+++ b/doc/rsyslog_tls.html
@@ -128,7 +128,7 @@ This is all you need to do. You can use the rest of your rsyslog.conf
together with this configuration. The way messages are received does
not interfer with any other option, so you are able to do anything else
you like without any restrictions.
-<p>Restart (or HUP) rsyslogd. The server should now be fully
+<p>Restart rsyslogd. The server should now be fully
operational.</p>
<h3>Client Setup</h3>
<p>The client setup is equally&nbsp;simple. You need less
diff --git a/plugins/imudp/imudp.c b/plugins/imudp/imudp.c
index 57aec9b..6f4a638 100644
--- a/plugins/imudp/imudp.c
+++ b/plugins/imudp/imudp.c
@@ -178,9 +178,12 @@ processSocket(int fd, struct sockaddr_storage *frominetPrev, int *pbIsPermitted,
ABORT_FINALIZE(RS_RET_ERR);
}
+ if(lenRcvBuf == 0)
+ continue; /* this looks a bit strange, but practice shows it happens... */
+
/* if we reach this point, we had a good receive and can process the packet received */
/* check if we have a different sender than before, if so, we need to query some new values */
- if(memcmp(&frominet, frominetPrev, socklen) != 0) {
+ if(net.CmpHost(&frominet, frominetPrev, socklen) != 0) {
CHKiRet(net.cvthname(&frominet, fromHost, fromHostFQDN, fromHostIP));
memcpy(frominetPrev, &frominet, socklen); /* update cache indicator */
/* Here we check if a host is permitted to send us
diff --git a/runtime/datetime.c b/runtime/datetime.c
index 40ab4e9..99caaf9 100644
--- a/runtime/datetime.c
+++ b/runtime/datetime.c
@@ -140,6 +140,7 @@ static void getCurrTime(struct syslogTime *t, time_t *ttSeconds)
* DO NOT PUT ANY OTHER CODE IN THIS BEGIN ... END BLOCK!!!!
*/
+
/**
* Parse a 32 bit integer number from a string.
*
@@ -147,17 +148,21 @@ static void getCurrTime(struct syslogTime *t, time_t *ttSeconds)
* must be positioned at the first digit. Will be updated
* so that on return it points to the first character AFTER
* the integer parsed.
+ * \param pLenStr pointer to string length, decremented on exit by
+ * characters processed
+ * Note that if an empty string (len < 1) is passed in,
+ * the method always returns zero.
* \retval The number parsed.
*/
-
-static int srSLMGParseInt32(uchar** ppsz)
+static int srSLMGParseInt32(uchar** ppsz, int *pLenStr)
{
register int i;
i = 0;
- while(isdigit((int) **ppsz)) {
+ while(*pLenStr > 0 && isdigit((int) **ppsz)) {
i = i * 10 + **ppsz - '0';
++(*ppsz);
+ --(*pLenStr);
}
return i;
@@ -169,9 +174,13 @@ static int srSLMGParseInt32(uchar** ppsz)
* updates the parse pointer position. The pTime parameter
* is guranteed to be updated only if a new valid timestamp
* could be obtained (restriction added 2008-09-16 by rgerhards).
+ * This method now also checks the maximum string length it is passed.
+ * If a *valid* timestamp is found, the string length is decremented
+ * by the number of characters processed. If it is not a valid timestamp,
+ * the length is kept unmodified. -- rgerhards, 2009-09-23
*/
static rsRetVal
-ParseTIMESTAMP3339(struct syslogTime *pTime, uchar** ppszTS)
+ParseTIMESTAMP3339(struct syslogTime *pTime, uchar** ppszTS, int *pLenStr)
{
uchar *pszTS = *ppszTS;
/* variables to temporarily hold time information while we parse */
@@ -186,6 +195,7 @@ ParseTIMESTAMP3339(struct syslogTime *pTime, uchar** ppszTS)
char OffsetMode; /* UTC offset + or - */
char OffsetHour; /* UTC offset in hours */
int OffsetMinute; /* UTC offset in minutes */
+ int lenStr;
/* end variables to temporarily hold time information while we parse */
DEFiRet;
@@ -193,48 +203,55 @@ ParseTIMESTAMP3339(struct syslogTime *pTime, uchar** ppszTS)
assert(ppszTS != NULL);
assert(pszTS != NULL);
- year = srSLMGParseInt32(&pszTS);
+ lenStr = *pLenStr;
+ year = srSLMGParseInt32(&pszTS, &lenStr);
/* We take the liberty to accept slightly malformed timestamps e.g. in
* the format of 2003-9-1T1:0:0. This doesn't hurt on receiving. Of course,
* with the current state of affairs, we would never run into this code
* here because at postion 11, there is no "T" in such cases ;)
*/
- if(*pszTS++ != '-')
+ if(lenStr == 0 || *pszTS++ != '-')
ABORT_FINALIZE(RS_RET_INVLD_TIME);
- month = srSLMGParseInt32(&pszTS);
+ --lenStr;
+ month = srSLMGParseInt32(&pszTS, &lenStr);
if(month < 1 || month > 12)
ABORT_FINALIZE(RS_RET_INVLD_TIME);
- if(*pszTS++ != '-')
+ if(lenStr == 0 || *pszTS++ != '-')
ABORT_FINALIZE(RS_RET_INVLD_TIME);
- day = srSLMGParseInt32(&pszTS);
+ --lenStr;
+ day = srSLMGParseInt32(&pszTS, &lenStr);
if(day < 1 || day > 31)
ABORT_FINALIZE(RS_RET_INVLD_TIME);
- if(*pszTS++ != 'T')
+ if(lenStr == 0 || *pszTS++ != 'T')
ABORT_FINALIZE(RS_RET_INVLD_TIME);
+ --lenStr;
- hour = srSLMGParseInt32(&pszTS);
+ hour = srSLMGParseInt32(&pszTS, &lenStr);
if(hour < 0 || hour > 23)
ABORT_FINALIZE(RS_RET_INVLD_TIME);
- if(*pszTS++ != ':')
+ if(lenStr == 0 || *pszTS++ != ':')
ABORT_FINALIZE(RS_RET_INVLD_TIME);
- minute = srSLMGParseInt32(&pszTS);
+ --lenStr;
+ minute = srSLMGParseInt32(&pszTS, &lenStr);
if(minute < 0 || minute > 59)
ABORT_FINALIZE(RS_RET_INVLD_TIME);
- if(*pszTS++ != ':')
+ if(lenStr == 0 || *pszTS++ != ':')
ABORT_FINALIZE(RS_RET_INVLD_TIME);
- second = srSLMGParseInt32(&pszTS);
+ --lenStr;
+ second = srSLMGParseInt32(&pszTS, &lenStr);
if(second < 0 || second > 60)
ABORT_FINALIZE(RS_RET_INVLD_TIME);
/* Now let's see if we have secfrac */
- if(*pszTS == '.') {
+ if(lenStr > 0 && *pszTS == '.') {
+ --lenStr;
uchar *pszStart = ++pszTS;
- secfrac = srSLMGParseInt32(&pszTS);
+ secfrac = srSLMGParseInt32(&pszTS, &lenStr);
secfracPrecision = (int) (pszTS - pszStart);
} else {
secfracPrecision = 0;
@@ -242,23 +259,27 @@ ParseTIMESTAMP3339(struct syslogTime *pTime, uchar** ppszTS)
}
/* check the timezone */
- if(*pszTS == 'Z')
- {
+ if(lenStr == 0)
+ ABORT_FINALIZE(RS_RET_INVLD_TIME);
+
+ if(*pszTS == 'Z') {
+ --lenStr;
pszTS++; /* eat Z */
OffsetMode = 'Z';
OffsetHour = 0;
OffsetMinute = 0;
} else if((*pszTS == '+') || (*pszTS == '-')) {
OffsetMode = *pszTS;
+ --lenStr;
pszTS++;
- OffsetHour = srSLMGParseInt32(&pszTS);
+ OffsetHour = srSLMGParseInt32(&pszTS, &lenStr);
if(OffsetHour < 0 || OffsetHour > 23)
ABORT_FINALIZE(RS_RET_INVLD_TIME);
- if(*pszTS++ != ':')
+ if(lenStr == 0 || *pszTS++ != ':')
ABORT_FINALIZE(RS_RET_INVLD_TIME);
- OffsetMinute = srSLMGParseInt32(&pszTS);
+ OffsetMinute = srSLMGParseInt32(&pszTS, &lenStr);
if(OffsetMinute < 0 || OffsetMinute > 59)
ABORT_FINALIZE(RS_RET_INVLD_TIME);
} else {
@@ -267,10 +288,12 @@ ParseTIMESTAMP3339(struct syslogTime *pTime, uchar** ppszTS)
}
/* OK, we actually have a 3339 timestamp, so let's indicated this */
- if(*pszTS == ' ')
+ if(lenStr > 0 && *pszTS == ' ') {
+ --lenStr;
++pszTS;
- else
+ } else {
ABORT_FINALIZE(RS_RET_INVLD_TIME);
+ }
/* we had success, so update parse pointer and caller-provided timestamp */
*ppszTS = pszTS;
@@ -286,6 +309,7 @@ ParseTIMESTAMP3339(struct syslogTime *pTime, uchar** ppszTS)
pTime->OffsetMode = OffsetMode;
pTime->OffsetHour = OffsetHour;
pTime->OffsetMinute = OffsetMinute;
+ *pLenStr = lenStr;
finalize_it:
RETiRet;
@@ -304,9 +328,13 @@ finalize_it:
* permits us to use a pre-aquired timestamp and thus avoids to do
* a (costly) time() call. Thanks to David Lang for insisting on
* time() call reduction ;).
+ * This method now also checks the maximum string length it is passed.
+ * If a *valid* timestamp is found, the string length is decremented
+ * by the number of characters processed. If it is not a valid timestamp,
+ * the length is kept unmodified. -- rgerhards, 2009-09-23
*/
static rsRetVal
-ParseTIMESTAMP3164(struct syslogTime *pTime, uchar** ppszTS)
+ParseTIMESTAMP3164(struct syslogTime *pTime, uchar** ppszTS, int *pLenStr)
{
/* variables to temporarily hold time information while we parse */
int month;
@@ -316,6 +344,7 @@ ParseTIMESTAMP3164(struct syslogTime *pTime, uchar** ppszTS)
int minute;
int second;
/* end variables to temporarily hold time information while we parse */
+ int lenStr;
uchar *pszTS;
DEFiRet;
@@ -323,6 +352,8 @@ ParseTIMESTAMP3164(struct syslogTime *pTime, uchar** ppszTS)
pszTS = *ppszTS;
assert(pszTS != NULL);
assert(pTime != NULL);
+ assert(pLenStr != NULL);
+ lenStr = *pLenStr;
/* If we look at the month (Jan, Feb, Mar, Apr, May, Jun, Jul, Aug, Sep, Oct, Nov, Dec),
* we may see the following character sequences occur:
@@ -341,6 +372,9 @@ ParseTIMESTAMP3164(struct syslogTime *pTime, uchar** ppszTS)
* june, when it first manifested. This also lead to invalid parsing of the rest
* of the message, as the time stamp was not detected to be correct. - rgerhards
*/
+ if(lenStr < 3)
+ ABORT_FINALIZE(RS_RET_INVLD_TIME);
+
switch(*pszTS++)
{
case 'J':
@@ -455,26 +489,31 @@ ParseTIMESTAMP3164(struct syslogTime *pTime, uchar** ppszTS)
ABORT_FINALIZE(RS_RET_INVLD_TIME);
}
+ lenStr -= 3;
+
/* done month */
- if(*pszTS++ != ' ')
+ if(lenStr == 0 || *pszTS++ != ' ')
ABORT_FINALIZE(RS_RET_INVLD_TIME);
/* we accept a slightly malformed timestamp when receiving. This is
* we accept one-digit days
*/
- if(*pszTS == ' ')
+ if(*pszTS == ' ') {
+ --lenStr;
++pszTS;
+ }
- day = srSLMGParseInt32(&pszTS);
+ day = srSLMGParseInt32(&pszTS, &lenStr);
if(day < 1 || day > 31)
ABORT_FINALIZE(RS_RET_INVLD_TIME);
- if(*pszTS++ != ' ')
+ if(lenStr == 0 || *pszTS++ != ' ')
ABORT_FINALIZE(RS_RET_INVLD_TIME);
+ --lenStr;
/* time part */
- hour = srSLMGParseInt32(&pszTS);
+ hour = srSLMGParseInt32(&pszTS, &lenStr);
if(hour > 1970 && hour < 2100) {
/* if so, we assume this actually is a year. This is a format found
* e.g. in Cisco devices.
@@ -484,23 +523,26 @@ ParseTIMESTAMP3164(struct syslogTime *pTime, uchar** ppszTS)
year = hour;
/* re-query the hour, this time it must be valid */
- if(*pszTS++ != ' ')
+ if(lenStr == 0 || *pszTS++ != ' ')
ABORT_FINALIZE(RS_RET_INVLD_TIME);
- hour = srSLMGParseInt32(&pszTS);
+ --lenStr;
+ hour = srSLMGParseInt32(&pszTS, &lenStr);
}
if(hour < 0 || hour > 23)
ABORT_FINALIZE(RS_RET_INVLD_TIME);
- if(*pszTS++ != ':')
+ if(lenStr == 0 || *pszTS++ != ':')
ABORT_FINALIZE(RS_RET_INVLD_TIME);
- minute = srSLMGParseInt32(&pszTS);
+ --lenStr;
+ minute = srSLMGParseInt32(&pszTS, &lenStr);
if(minute < 0 || minute > 59)
ABORT_FINALIZE(RS_RET_INVLD_TIME);
- if(*pszTS++ != ':')
+ if(lenStr == 0 || *pszTS++ != ':')
ABORT_FINALIZE(RS_RET_INVLD_TIME);
- second = srSLMGParseInt32(&pszTS);
+ --lenStr;
+ second = srSLMGParseInt32(&pszTS, &lenStr);
if(second < 0 || second > 60)
ABORT_FINALIZE(RS_RET_INVLD_TIME);
@@ -508,8 +550,10 @@ ParseTIMESTAMP3164(struct syslogTime *pTime, uchar** ppszTS)
* invalid format, it occurs frequently enough (e.g. with Cisco devices)
* to permit it as a valid case. -- rgerhards, 2008-09-12
*/
- if(*pszTS++ == ':')
+ if(lenStr == 0 || *pszTS++ == ':') {
++pszTS; /* just skip past it */
+ --lenStr;
+ }
/* we had success, so update parse pointer and caller-provided timestamp
* fields we do not have are not updated in the caller's timestamp. This
@@ -526,6 +570,7 @@ ParseTIMESTAMP3164(struct syslogTime *pTime, uchar** ppszTS)
pTime->second = second;
pTime->secfracPrecision = 0;
pTime->secfrac = 0;
+ *pLenStr = lenStr;
finalize_it:
RETiRet;
diff --git a/runtime/datetime.h b/runtime/datetime.h
index efb0a0a..6377a4a 100644
--- a/runtime/datetime.h
+++ b/runtime/datetime.h
@@ -36,8 +36,8 @@ typedef struct datetime_s {
/* interfaces */
BEGINinterface(datetime) /* name must also be changed in ENDinterface macro! */
void (*getCurrTime)(struct syslogTime *t, time_t *ttSeconds);
- rsRetVal (*ParseTIMESTAMP3339)(struct syslogTime *pTime, uchar** ppszTS);
- rsRetVal (*ParseTIMESTAMP3164)(struct syslogTime *pTime, uchar** pszTS);
+ rsRetVal (*ParseTIMESTAMP3339)(struct syslogTime *pTime, uchar** ppszTS, int *);
+ rsRetVal (*ParseTIMESTAMP3164)(struct syslogTime *pTime, uchar** pszTS, int *);
int (*formatTimestampToMySQL)(struct syslogTime *ts, char* pDst, size_t iLenDst);
int (*formatTimestampToPgSQL)(struct syslogTime *ts, char *pDst, size_t iLenDst);
int (*formatTimestamp3339)(struct syslogTime *ts, char* pBuf, size_t iLenBuf);
diff --git a/runtime/net.c b/runtime/net.c
index db2d7e3..5cafe52 100644
--- a/runtime/net.c
+++ b/runtime/net.c
@@ -1496,6 +1496,49 @@ int *create_udp_socket(uchar *hostname, uchar *pszPort, int bIsServer)
}
+/* check if two provided socket addresses point to the same host. Note that the
+ * length of the sockets must be provided as third parameter. This is necessary to
+ * compare non IPv4/v6 hosts, in which case we do a simple memory compare of the
+ * address structure (in that case, the same host may not reliably be detected).
+ * Note that we need to do the comparison not on the full structure, because it contains things
+ * like the port, which we do not need to look at when thinking about hostnames. So we look
+ * at the relevant fields, what means a somewhat more complicated processing.
+ * Also note that we use a non-standard calling interface, as this is much more natural and
+ * it looks extremely unlikely that we get an exception of any kind here. What we
+ * return is mimiced after memcmp(), and as such useful for building binary trees
+ * (the order relation may be a bit arbritrary, but at least it is consistent).
+ * rgerhards, 2009-09-03
+ */
+static int CmpHost(struct sockaddr_storage *s1, struct sockaddr_storage* s2, size_t socklen)
+{
+ int ret;
+
+ if(((struct sockaddr*) s1)->sa_family != ((struct sockaddr*) s2)->sa_family) {
+ ret = memcmp(s1, s2, socklen);
+ goto finalize_it;
+ }
+
+ if(((struct sockaddr*) s1)->sa_family == AF_INET) {
+ if(((struct sockaddr_in *) s1)->sin_addr.s_addr == ((struct sockaddr_in*)s2)->sin_addr.s_addr) {
+ ret = 0;
+ } else if(((struct sockaddr_in *) s1)->sin_addr.s_addr < ((struct sockaddr_in*)s2)->sin_addr.s_addr) {
+ ret = -1;
+ } else {
+ ret = 1;
+ }
+ } else if(((struct sockaddr*) s1)->sa_family == AF_INET6) {
+ /* IPv6 addresses are always 16 octets long */
+ ret = memcmp(((struct sockaddr_in6 *)s1)->sin6_addr.s6_addr, ((struct sockaddr_in6*)s2)->sin6_addr.s6_addr, 16);
+ } else {
+ ret = memcmp(s1, s2, socklen);
+ }
+
+dbgprintf("CmpHost returns %d\n", ret);
+finalize_it:
+ return ret;
+}
+
+
/* queryInterface function
* rgerhards, 2008-03-05
*/
@@ -1524,6 +1567,7 @@ CODESTARTobjQueryInterface(net)
pIf->AddPermittedPeer = AddPermittedPeer;
pIf->DestructPermittedPeers = DestructPermittedPeers;
pIf->PermittedPeerWildcardMatch = PermittedPeerWildcardMatch;
+ pIf->CmpHost = CmpHost;
finalize_it:
ENDobjQueryInterface(net)
diff --git a/runtime/net.h b/runtime/net.h
index 092c311..ec364b1 100644
--- a/runtime/net.h
+++ b/runtime/net.h
@@ -146,11 +146,13 @@ BEGINinterface(net) /* name must also be changed in ENDinterface macro! */
rsRetVal (*AddPermittedPeer)(permittedPeers_t **ppRootPeer, uchar *pszID);
rsRetVal (*DestructPermittedPeers)(permittedPeers_t **ppRootPeer);
rsRetVal (*PermittedPeerWildcardMatch)(permittedPeers_t *pPeer, uchar *pszNameToMatch, int *pbIsMatching);
+ /* v5 interface additions */
+ int (*CmpHost)(struct sockaddr_storage *, struct sockaddr_storage*, size_t);
/* data members - these should go away over time... TODO */
int *pACLAddHostnameOnFail; /* add hostname to acl when DNS resolving has failed */
int *pACLDontResolve; /* add hostname to acl instead of resolving it to IP(s) */
ENDinterface(net)
-#define netCURR_IF_VERSION 4 /* increment whenever you change the interface structure! */
+#define netCURR_IF_VERSION 5 /* increment whenever you change the interface structure! */
/* prototypes */
PROTOTYPEObj(net);
diff --git a/runtime/parser.c b/runtime/parser.c
index 0b45bfd..7eff080 100644
--- a/runtime/parser.c
+++ b/runtime/parser.c
@@ -167,6 +167,7 @@ sanitizeMessage(msg_t *pMsg)
size_t iMaxLine;
assert(pMsg != NULL);
+ assert(pMsg->iLenRawMsg > 0);
# ifdef USE_NETZIP
CHKiRet(uncompressMessage(pMsg));
@@ -274,6 +275,7 @@ finalize_it:
RETiRet;
}
+
/* Parse a received message. The object's rawmsg property is taken and
* parsed according to the relevant standards. This can later be
* extended to support configured parsers.
@@ -284,16 +286,21 @@ rsRetVal parseMsg(msg_t *pMsg)
DEFiRet;
uchar *msg;
int pri;
+ int lenMsg;
int iPriText;
+ if(pMsg->iLenRawMsg == 0)
+ ABORT_FINALIZE(RS_RET_EMPTY_MSG);
+
CHKiRet(sanitizeMessage(pMsg));
/* we needed to sanitize first, because we otherwise do not have a C-string we can print... */
DBGPRINTF("msg parser: flags %x, from '%s', msg '%s'\n", pMsg->msgFlags, pMsg->pszRcvFrom, pMsg->pszRawMsg);
/* pull PRI */
- pri = DEFUPRI;
+ lenMsg = pMsg->iLenRawMsg;
msg = pMsg->pszRawMsg;
+ pri = DEFUPRI;
iPriText = 0;
if(*msg == '<') {
/* while we process the PRI, we also fill the PRI textual representation
@@ -301,7 +308,7 @@ rsRetVal parseMsg(msg_t *pMsg)
* but it offers us performance...
*/
pri = 0;
- while(isdigit((int) *++msg)) {
+ while(--lenMsg > 0 && isdigit((int) *++msg)) {
pMsg->bufPRI[iPriText++ % 4] = *msg; /* mod 4 to guard against malformed messages! */
pri = 10 * pri + (*msg - '0');
}
@@ -342,7 +349,7 @@ rsRetVal parseMsg(msg_t *pMsg)
/* finalize message object */
pMsg->msgFlags &= ~NEEDS_PARSING; /* this message is now parsed */
- MsgPrepareEnqueue(pMsg); /* "historical" name - preparese for multi-threading */
+ MsgPrepareEnqueue(pMsg); /* "historical" name - prepare for multi-threading */
finalize_it:
RETiRet;
diff --git a/runtime/rsyslog.h b/runtime/rsyslog.h
index 32177a9..835fff2 100644
--- a/runtime/rsyslog.h
+++ b/runtime/rsyslog.h
@@ -280,6 +280,7 @@ enum rsRetVal_ /** return value. All methods return this if not specified oth
RS_RET_ACTION_FAILED = -2123, /**< action failed and is now suspended (consider this permanent for the time being) */
RS_RET_NONFATAL_CONFIG_ERR = -2124, /**< non-fatal error during config processing */
RS_RET_FILENAME_INVALID = -2140, /**< filename invalid, not found, no access, ... */
+ RS_RET_EMPTY_MSG = -2143, /**< provided (raw) MSG is empty */
/* RainerScript error messages (range 1000.. 1999) */
RS_RET_SYSVAR_NOT_FOUND = 1001, /**< system variable could not be found (maybe misspelled) */
diff --git a/tools/rsyslogd.8 b/tools/rsyslogd.8
index 7d4b5e0..6ac30e4 100644
--- a/tools/rsyslogd.8
+++ b/tools/rsyslogd.8
@@ -248,20 +248,17 @@ kill -HUP $(cat /var/run/rsyslogd.pid)
.B HUP
This lets
.B rsyslogd
-perform a re-initialization. All open files are closed, the
-configuration file (default is
-.IR /etc/rsyslog.conf ")"
-will be reread and the
-.BR rsyslog (3)
-facility is started again.
+perform close all open files.
+Also, in v3 a full restart will be done in order to read changed configuration files.
Note that this means a full rsyslogd restart is done. This has, among others,
the consequence that TCP and other connections are torn down. Also, if any
queues are not running in disk assisted mode or are not set to persist data
on shutdown, queue data is lost. HUPing rsyslogd is an extremely expensive
operation and should only be done when actually necessary. Actually, it is
-a rsyslgod stop immediately followed by a restart. Future versions will probably
-include a special handling which only closes files, but will not cause any
-of the other effects.
+a rsyslgod stop immediately followed by a restart. Future versions will remove
+this restart functionality of HUP (it will go away in v5). So it is advised to use
+HUP only for closing files, and a "real restart" (e.g. /etc/rc.d/rsyslogd restart)
+to activate configuration changes.
.TP
.B TERM ", " INT ", " QUIT
.B Rsyslogd
diff --git a/tools/syslogd.c b/tools/syslogd.c
index ff6369c..5f6b480 100644
--- a/tools/syslogd.c
+++ b/tools/syslogd.c
@@ -1242,10 +1242,12 @@ msgConsumer(void __attribute__((unused)) *notNeeded, void *pUsr)
* to after the terminating SP. The caller must ensure that the
* provided buffer is large enough to hold the to be extracted value.
* Returns 0 if everything is fine or 1 if either the field is not
- * SP-terminated or any other error occurs.
- * rger, 2005-11-24
+ * SP-terminated or any other error occurs. -- rger, 2005-11-24
+ * The function now receives the size of the string and makes sure
+ * that it does not process more than that. The *pLenStr counter is
+ * updated on exit. -- rgerhards, 2009-09-23
*/
-static int parseRFCField(uchar **pp2parse, uchar *pResult)
+static int parseRFCField(uchar **pp2parse, uchar *pResult, int *pLenStr)
{
uchar *p2parse;
int iRet = 0;
@@ -1257,14 +1259,17 @@ static int parseRFCField(uchar **pp2parse, uchar *pResult)
p2parse = *pp2parse;
/* this is the actual parsing loop */
- while(*p2parse && *p2parse != ' ') {
+ while(*pLenStr > 0 && *p2parse != ' ') {
*pResult++ = *p2parse++;
+ --(*pLenStr);
}
- if(*p2parse == ' ')
+ if(*pLenStr > 0 && *p2parse == ' ') {
++p2parse; /* eat SP, but only if not at end of string */
- else
+ --(*pLenStr);
+ } else {
iRet = 1; /* there MUST be an SP! */
+ }
*pResult = '\0';
/* set the new parse pointer */
@@ -1280,20 +1285,24 @@ static int parseRFCField(uchar **pp2parse, uchar *pResult)
* to after the terminating SP. The caller must ensure that the
* provided buffer is large enough to hold the to be extracted value.
* Returns 0 if everything is fine or 1 if either the field is not
- * SP-terminated or any other error occurs.
- * rger, 2005-11-24
+ * SP-terminated or any other error occurs. -- rger, 2005-11-24
+ * The function now receives the size of the string and makes sure
+ * that it does not process more than that. The *pLenStr counter is
+ * updated on exit. -- rgerhards, 2009-09-23
*/
-static int parseRFCStructuredData(uchar **pp2parse, uchar *pResult)
+static int parseRFCStructuredData(uchar **pp2parse, uchar *pResult, int *pLenStr)
{
uchar *p2parse;
int bCont = 1;
int iRet = 0;
+ int lenStr;
assert(pp2parse != NULL);
assert(*pp2parse != NULL);
assert(pResult != NULL);
p2parse = *pp2parse;
+ lenStr = *pLenStr;
/* this is the actual parsing loop
* Remeber: structured data starts with [ and includes any characters
@@ -1301,40 +1310,55 @@ static int parseRFCStructuredData(uchar **pp2parse, uchar *pResult)
* structured data. There may also be \] inside the structured data, which
* do NOT terminate an element.
*/
- if(*p2parse != '[')
+ if(lenStr == 0 || *p2parse != '[')
return 1; /* this is NOT structured data! */
if(*p2parse == '-') { /* empty structured data? */
*pResult++ = '-';
++p2parse;
+ --lenStr;
} else {
while(bCont) {
- if(*p2parse == '\0') {
- iRet = 1; /* this is not valid! */
- bCont = 0;
- } else if(*p2parse == '\\' && *(p2parse+1) == ']') {
+ if(lenStr < 2) {
+ /* we now need to check if we have only structured data */
+ if(lenStr > 0 && *p2parse == ']') {
+ *pResult++ = *p2parse;
+ p2parse++;
+ lenStr--;
+ bCont = 0;
+ } else {
+ iRet = 1; /* this is not valid! */
+ bCont = 0;
+ }
+ } else if(*p2parse == '\\' && *(p2parse+1) == ']') {
/* this is escaped, need to copy both */
*pResult++ = *p2parse++;
*pResult++ = *p2parse++;
+ lenStr -= 2;
} else if(*p2parse == ']' && *(p2parse+1) == ' ') {
/* found end, just need to copy the ] and eat the SP */
*pResult++ = *p2parse;
p2parse += 2;
+ lenStr -= 2;
bCont = 0;
} else {
*pResult++ = *p2parse++;
+ --lenStr;
}
}
}
- if(*p2parse == ' ')
+ if(lenStr > 0 && *p2parse == ' ') {
++p2parse; /* eat SP, but only if not at end of string */
- else
+ --lenStr;
+ } else {
iRet = 1; /* there MUST be an SP! */
+ }
*pResult = '\0';
/* set the new parse pointer */
*pp2parse = p2parse;
+ *pLenStr = lenStr;
return 0;
}
@@ -1359,23 +1383,26 @@ int parseRFCSyslogMsg(msg_t *pMsg, int flags)
{
uchar *p2parse;
uchar *pBuf;
+ int lenMsg;
int bContParse = 1;
BEGINfunc
assert(pMsg != NULL);
assert(pMsg->pszRawMsg != NULL);
p2parse = pMsg->pszRawMsg + pMsg->offAfterPRI; /* point to start of text, after PRI */
+ lenMsg = pMsg->iLenRawMsg - pMsg->offAfterPRI;
- /* do a sanity check on the version and eat it */
+ /* do a sanity check on the version and eat it (the caller checked this already) */
assert(p2parse[0] == '1' && p2parse[1] == ' ');
p2parse += 2;
+ lenMsg -= 2;
/* Now get us some memory we can use as a work buffer while parsing.
* We simply allocated a buffer sufficiently large to hold all of the
* message, so we can not run into any troubles. I think this is
* more wise then to use individual buffers.
*/
- if((pBuf = malloc(sizeof(uchar) * ustrlen(p2parse) + 1)) == NULL)
+ if((pBuf = malloc(sizeof(uchar) * (lenMsg + 1))) == NULL)
return 1;
/* IMPORTANT NOTE:
@@ -1386,7 +1413,7 @@ int parseRFCSyslogMsg(msg_t *pMsg, int flags)
*/
/* TIMESTAMP */
- if(datetime.ParseTIMESTAMP3339(&(pMsg->tTIMESTAMP), &p2parse) == RS_RET_OK) {
+ if(datetime.ParseTIMESTAMP3339(&(pMsg->tTIMESTAMP), &p2parse, &lenMsg) == RS_RET_OK) {
if(flags & IGNDATE) {
/* we need to ignore the msg data, so simply copy over reception date */
memcpy(&pMsg->tTIMESTAMP, &pMsg->tRcvdAt, sizeof(struct syslogTime));
@@ -1398,7 +1425,7 @@ int parseRFCSyslogMsg(msg_t *pMsg, int flags)
/* HOSTNAME */
if(bContParse) {
- parseRFCField(&p2parse, pBuf);
+ parseRFCField(&p2parse, pBuf, &lenMsg);
MsgSetHOSTNAME(pMsg, pBuf);
} else {
/* we can not parse, so we get the system we
@@ -1409,30 +1436,30 @@ int parseRFCSyslogMsg(msg_t *pMsg, int flags)
/* APP-NAME */
if(bContParse) {
- parseRFCField(&p2parse, pBuf);
+ parseRFCField(&p2parse, pBuf, &lenMsg);
MsgSetAPPNAME(pMsg, (char*)pBuf);
}
/* PROCID */
if(bContParse) {
- parseRFCField(&p2parse, pBuf);
+ parseRFCField(&p2parse, pBuf, &lenMsg);
MsgSetPROCID(pMsg, (char*)pBuf);
}
/* MSGID */
if(bContParse) {
- parseRFCField(&p2parse, pBuf);
+ parseRFCField(&p2parse, pBuf, &lenMsg);
MsgSetMSGID(pMsg, (char*)pBuf);
}
/* STRUCTURED-DATA */
if(bContParse) {
- parseRFCStructuredData(&p2parse, pBuf);
+ parseRFCStructuredData(&p2parse, pBuf, &lenMsg);
MsgSetStructuredData(pMsg, (char*)pBuf);
}
/* MSG */
- MsgSetMSG(pMsg, (char*)p2parse);
+ MsgSetMSG(pMsg, (lenMsg == 0) ? "" : (char*)p2parse);
free(pBuf);
ENDfunc
@@ -1460,11 +1487,15 @@ int parseLegacySyslogMsg(msg_t *pMsg, int flags)
char *pWork;
cstr_t *pStrB;
int iCnt;
+ int lenMsg;
int bTAGCharDetected;
BEGINfunc
assert(pMsg != NULL);
assert(pMsg->pszRawMsg != NULL);
+ lenMsg = pMsg->iLenRawMsg - (pMsg->offAfterPRI + 1);
+RUNLOG_VAR("%d", pMsg->offAfterPRI);
+RUNLOG_VAR("%d", lenMsg);
p2parse = pMsg->pszRawMsg + pMsg->offAfterPRI; /* point to start of text, after PRI */
/* Check to see if msg contains a timestamp. We start by assuming
@@ -1473,13 +1504,14 @@ int parseLegacySyslogMsg(msg_t *pMsg, int flags)
* message. There we go from high-to low precison and are done
* when we find a matching one. -- rgerhards, 2008-09-16
*/
- if(datetime.ParseTIMESTAMP3339(&(pMsg->tTIMESTAMP), &p2parse) == RS_RET_OK) {
+ if(datetime.ParseTIMESTAMP3339(&(pMsg->tTIMESTAMP), &p2parse, &lenMsg) == RS_RET_OK) {
/* we are done - parse pointer is moved by ParseTIMESTAMP3339 */;
- } else if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), &p2parse) == RS_RET_OK) {
+ } else if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), &p2parse, &lenMsg) == RS_RET_OK) {
/* we are done - parse pointer is moved by ParseTIMESTAMP3164 */;
- } else if(*p2parse == ' ') { /* try to see if it is slighly malformed - HP procurve seems to do that sometimes */
+ } else if(*p2parse == ' ' && lenMsg > 1) { /* try to see if it is slighly malformed - HP procurve seems to do that sometimes */
++p2parse; /* move over space */
- if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), &p2parse) == RS_RET_OK) {
+ --lenMsg;
+ if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), &p2parse, &lenMsg) == RS_RET_OK) {
/* indeed, we got it! */
/* we are done - parse pointer is moved by ParseTIMESTAMP3164 */;
} else {
@@ -1487,6 +1519,7 @@ int parseLegacySyslogMsg(msg_t *pMsg, int flags)
* for this try.
*/
--p2parse;
+ ++lenMsg;
}
}
@@ -1520,14 +1553,15 @@ int parseLegacySyslogMsg(msg_t *pMsg, int flags)
/* the memory allocated is far too much in most cases. But on the plus side,
* it is quite fast... - rgerhards, 2007-09-20
*/
- if((pBuf = malloc(sizeof(char)* (ustrlen(p2parse) +1))) == NULL)
+ if((pBuf = malloc(sizeof(char) * (lenMsg + 1))) == NULL)
return 1;
pWork = pBuf;
/* this is the actual parsing loop */
- while(*p2parse && *p2parse != ' ' && *p2parse != ':') {
+ while(lenMsg > 0 && *p2parse != ' ' && *p2parse != ':') {
if(*p2parse == '[' || *p2parse == ']' || *p2parse == '/')
bTAGCharDetected = 1;
*pWork++ = *p2parse++;
+ --lenMsg;
}
/* we need to handle ':' seperately, because it terminates the
* TAG - so we also need to terminate the parser here!
@@ -1539,13 +1573,17 @@ int parseLegacySyslogMsg(msg_t *pMsg, int flags)
* will be true and the parse pointer remain as is. This is perfectly
* well.
*/
- if(*p2parse == ':') {
- bTAGCharDetected = 1;
- /* We will move hostname to tag, so preserve ':' (otherwise we
- * will needlessly change the message format) */
- *pWork++ = *p2parse++;
- } else if(*p2parse == ' ')
- ++p2parse;
+ if(lenMsg > 0) {
+ if(*p2parse == ':') {
+ bTAGCharDetected = 1;
+ /* We will move hostname to tag, so preserve ':' (otherwise we
+ * will needlessly change the message format) */
+ *pWork++ = *p2parse++;
+ } else if(*p2parse == ' ') {
+ ++p2parse;
+ }
+ --lenMsg;
+ }
*pWork = '\0';
MsgAssignHOSTNAME(pMsg, pBuf);
}
@@ -1584,12 +1622,14 @@ int parseLegacySyslogMsg(msg_t *pMsg, int flags)
rsCStrSetAllocIncrement(pStrB, 33);
pWork = pBuf;
iCnt = 0;
- while(*p2parse && *p2parse != ':' && *p2parse != ' ') {
+ while(lenMsg > 0 && *p2parse != ':' && *p2parse != ' ') {
cstrAppendChar(pStrB, *p2parse++);
++iCnt;
+ --lenMsg;
}
- if(*p2parse == ':') {
+ if(lenMsg > 0 && *p2parse == ':') {
++p2parse;
+ --lenMsg;
cstrAppendChar(pStrB, ':');
}
cstrFinalize(pStrB);
@@ -1625,7 +1665,7 @@ int parseLegacySyslogMsg(msg_t *pMsg, int flags)
}
/* The rest is the actual MSG */
- MsgSetMSG(pMsg, (char*)p2parse);
+ MsgSetMSG(pMsg, (lenMsg == 0) ? "" : (char*)p2parse);
ENDfunc
return 0; /* all ok */
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-10 21:16:44 +0000