Merge branch 'v3-stable' into beta

Conflicts:
	ChangeLog
	configure.ac
	doc/manual.html

12 files changed, 112 insertions, 15 deletions

diff --git a/ChangeLog b/ChangeLog
index 9b26d06e..98fa105e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,8 +1,9 @@
 ---------------------------------------------------------------------------
-Version 3.21.8  [BETA] (rgerhards), 2008-11-??
+Version 3.21.8  [BETA] (rgerhards), 2008-12-04
 - bugfix: imklog did not compile on FreeBSD
 - security bugfix: $AllowedSender was not honored, all senders were
   permitted instead
+- merged in all other changes from 3.20.1 (see there)
 ---------------------------------------------------------------------------
 Version 3.21.7  [BETA] (rgerhards), 2008-11-11
 - this is the new beta branch, based on the former 3.21.6 devel
@@ -123,15 +124,21 @@ Version 3.21.0  [DEVEL] (rgerhards), 2008-07-18
 - imported all changes from 3.18.1 until today (some quite important,
   see below)
 ---------------------------------------------------------------------------
-Version 3.20.1 [v3-stable] (rgerhards), 2008-11-??
+Version 3.20.1 [v3-stable] (rgerhards), 2008-112-04
 - security bugfix: $AllowedSender was not honored, all senders were
   permitted instead
 - enhance: regex nomatch option "ZERO" has been added
   This allows to return the string 0 if a regular expression is
   not found. This is probably useful for storing numerical values into
   database columns.
+- bugfix: memory leak in gtls netstream driver fixed
+  memory was lost each time a TLS session was torn down. This could 
+  result in a considerable memory leak if it happened quite frequently
+  (potential system crash condition)
 - doc update: documented how to specify multiple property replacer
   options + link to new online regex generator tool added
+- minor bufgfix: very small memory leak in gtls netstream driver
+  around a handful of bytes (< 20) for each HUP
 - improved debug output for regular expressions inside property replacer
   RE's seem to be a big trouble spot and I would like to have more
   information inside the debug log. So I decided to add some additional
diff --git a/configure.ac b/configure.ac
index a4745b74..32b8e016 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2,7 +2,7 @@
 # Process this file with autoconf to produce a configure script.
 
 AC_PREREQ(2.61)
-AC_INIT([rsyslog],[3.21.7],[rsyslog@lists.adiscon.com])
+AC_INIT([rsyslog],[3.21.8],[rsyslog@lists.adiscon.com])
 AM_INIT_AUTOMAKE
 AC_CONFIG_SRCDIR([ChangeLog])
 AC_CONFIG_HEADERS([config.h])
diff --git a/doc/manual.html b/doc/manual.html
index 352d5257..5de125e3 100644
--- a/doc/manual.html
+++ b/doc/manual.html
@@ -16,7 +16,7 @@ relay chains while at the same time being very easy to setup for the
 novice user. And as we know what enterprise users really need, there is
 also <a href="professional_support.html">professional
 rsyslog support</a> available directly from the source!</p>
-<p><b>This documentation is for version 3.21.7 (beta branch) of rsyslog.</b>
+<p><b>This documentation is for version 3.21.8 (beta branch) of rsyslog.</b>
 Visit the <i> <a href="http://www.rsyslog.com/doc-status.html">rsyslog status page</a></i></b> to obtain current
 version information and project status.
 </p><p><b>If you like rsyslog, you might
diff --git a/runtime/net.c b/runtime/net.c
index 096e0a1d..1472b4db 100644
--- a/runtime/net.c
+++ b/runtime/net.c
@@ -104,8 +104,10 @@ setAllowRoot(struct AllowedSenders **ppAllowRoot, uchar *pszType)
 		*ppAllowRoot = pAllowedSenders_UDP;
 	else if(!strcmp((char*)pszType, "TCP"))
 		*ppAllowRoot = pAllowedSenders_TCP;
+#ifdef USE_GSSAPI
 	else if(!strcmp((char*)pszType, "GSS"))
 		*ppAllowRoot = pAllowedSenders_GSS;
+#endif
 	else {
 		dbgprintf("program error: invalid allowed sender ID '%s', denying...\n", pszType);
 		ABORT_FINALIZE(RS_RET_CODE_ERR); /* everything is invalid for an invalid type */
diff --git a/runtime/netstrm.c b/runtime/netstrm.c
index 2f4a1964..ffa1c578 100644
--- a/runtime/netstrm.c
+++ b/runtime/netstrm.c
@@ -265,6 +265,17 @@ GetRemoteIP(netstrm_t *pThis, uchar **ppsz)
 }
 
 
+/* get remote addr - slim wrapper for NSD driver function */
+static rsRetVal
+GetRemAddr(netstrm_t *pThis, struct sockaddr_storage **ppAddr)
+{
+	DEFiRet;
+	ISOBJ_TYPE_assert(pThis, netstrm);
+	iRet = pThis->Drvr.GetRemAddr(pThis->pDrvrData, ppAddr);
+	RETiRet;
+}
+
+
 /* open a connection to a remote host (server).
  * rgerhards, 2008-03-19
  */
@@ -320,6 +331,7 @@ CODESTARTobjQueryInterface(netstrm)
 	pIf->AcceptConnReq = AcceptConnReq;
 	pIf->GetRemoteHName = GetRemoteHName;
 	pIf->GetRemoteIP = GetRemoteIP;
+	pIf->GetRemAddr = GetRemAddr;
 	pIf->SetDrvrMode = SetDrvrMode;
 	pIf->SetDrvrAuthMode = SetDrvrAuthMode;
 	pIf->SetDrvrPermPeers = SetDrvrPermPeers;
diff --git a/runtime/netstrm.h b/runtime/netstrm.h
index 1a97ef23..3ab790e8 100644
--- a/runtime/netstrm.h
+++ b/runtime/netstrm.h
@@ -61,8 +61,16 @@ BEGINinterface(netstrm) /* name must also be changed in ENDinterface macro! */
 	 * this interface. -- rgerhards, 2008-05-05
 	 */
 	rsRetVal (*GetSock)(netstrm_t *pThis, int *pSock);
+	rsRetVal (*GetRemAddr)(netstrm_t *pThis, struct sockaddr_storage **ppAddr);
+	/* getRemAddr() is an aid needed by the legacy ACL system. It exposes the remote
+	 * peer's socket addr structure, so that the legacy matching functions can work on
+	 * it. Note that this ties netstream drivers to things that can be implemented over
+	 * sockets - not really desirable, but not the end of the world... TODO: should be
+	 * reconsidered when a new ACL system is build. -- rgerhards, 2008-12-01
+	 */
 ENDinterface(netstrm)
-#define netstrmCURR_IF_VERSION 2 /* increment whenever you change the interface structure! */
+#define netstrmCURR_IF_VERSION 3 /* increment whenever you change the interface structure! */
+/* interface version 3 added GetRemAddr() */
 
 /* prototypes */
 PROTOTYPEObj(netstrm);
diff --git a/runtime/netstrms.c b/runtime/netstrms.c
index 2b754ecc..6b28e7ea 100644
--- a/runtime/netstrms.c
+++ b/runtime/netstrms.c
@@ -104,6 +104,10 @@ CODESTARTobjDestruct(netstrms)
 		obj.ReleaseObj(__FILE__, pThis->pDrvrName+2, pThis->pDrvrName, (void*) &pThis->Drvr);
 		free(pThis->pDrvrName);
 	}
+	if(pThis->pszDrvrAuthMode != NULL) {
+		free(pThis->pszDrvrAuthMode);
+		pThis->pszDrvrAuthMode = NULL;
+	}
 	if(pThis->pBaseDrvrName != NULL) {
 		free(pThis->pBaseDrvrName);
 		pThis->pBaseDrvrName = NULL;
diff --git a/runtime/nsd.h b/runtime/nsd.h
index 1811f078..f0c9b9b6 100644
--- a/runtime/nsd.h
+++ b/runtime/nsd.h
@@ -27,6 +27,8 @@
 #ifndef INCLUDED_NSD_H
 #define INCLUDED_NSD_H
 
+#include <sys/socket.h>
+
 enum nsdsel_waitOp_e {
 	NSDSEL_RD = 1,
 	NSDSEL_WR = 2,
@@ -60,8 +62,16 @@ BEGINinterface(nsd) /* name must also be changed in ENDinterface macro! */
 	 * OS sockets. This interface is primarily meant as an internal aid for
 	 * those drivers that utilize the nsd_ptcp to do some of their work.
 	 */
+	rsRetVal (*GetRemAddr)(nsd_t *pThis, struct sockaddr_storage **ppAddr);
+	/* getRemAddr() is an aid needed by the legacy ACL system. It exposes the remote
+	 * peer's socket addr structure, so that the legacy matching functions can work on
+	 * it. Note that this ties netstream drivers to things that can be implemented over
+	 * sockets - not really desirable, but not the end of the world... TODO: should be
+	 * reconsidered when a new ACL system is build. -- rgerhards, 2008-12-01
+	 */
 ENDinterface(nsd)
-#define nsdCURR_IF_VERSION 3 /* increment whenever you change the interface structure! */
+#define nsdCURR_IF_VERSION 4 /* increment whenever you change the interface structure! */
+/* interface version 4 added GetRemAddr() */
 
 /* interface  for the select call */
 BEGINinterface(nsdsel) /* name must also be changed in ENDinterface macro! */
diff --git a/runtime/nsd_gtls.c b/runtime/nsd_gtls.c
index 08623da8..3a79a015 100644
--- a/runtime/nsd_gtls.c
+++ b/runtime/nsd_gtls.c
@@ -1229,7 +1229,6 @@ SetAuthMode(nsd_t *pNsd, uchar *mode)
 /* TODO: clear stored IDs! */
 
 finalize_it:
-dbgprintf("gtls auth mode %d set\n", pThis->authMode);
 	RETiRet;
 }
 
@@ -1342,6 +1341,20 @@ GetRemoteHName(nsd_t *pNsd, uchar **ppszHName)
 }
 
 
+/* Provide access to the sockaddr_storage of the remote peer. This
+ * is needed by the legacy ACL system. --- gerhards, 2008-12-01
+ */
+static rsRetVal
+GetRemAddr(nsd_t *pNsd, struct sockaddr_storage **ppAddr)
+{
+	DEFiRet;
+	nsd_gtls_t *pThis = (nsd_gtls_t*) pNsd;
+	ISOBJ_TYPE_assert(pThis, nsd_gtls);
+	iRet = nsd_ptcp.GetRemAddr(pThis->pTcp, ppAddr);
+	RETiRet;
+}
+
+
 /* get the remote host's IP address. The returned string must be freed by the
  * caller. -- rgerhards, 2008-04-25
  */
@@ -1477,6 +1490,13 @@ Rcv(nsd_t *pNsd, uchar *pBuf, ssize_t *pLenBuf)
 
 	if(pThis->lenRcvBuf == 0) { /* EOS */
 		*pLenBuf = 0;
+		/* in this case, we also need to free the receive buffer, if we
+		 * allocated one. -- rgerhards, 2008-12-03
+		 */
+		if(pThis->pszRcvBuf != NULL) {
+			free(pThis->pszRcvBuf);
+			pThis->pszRcvBuf = NULL;
+		}
 		ABORT_FINALIZE(RS_RET_CLOSED);
 	}
 
@@ -1646,6 +1666,7 @@ CODESTARTobjQueryInterface(nsd_gtls)
 	pIf->CheckConnection = CheckConnection;
 	pIf->GetRemoteHName = GetRemoteHName;
 	pIf->GetRemoteIP = GetRemoteIP;
+	pIf->GetRemAddr = GetRemAddr;
 finalize_it:
 ENDobjQueryInterface(nsd_gtls)
 
diff --git a/runtime/nsd_ptcp.c b/runtime/nsd_ptcp.c
index 4cb46380..cc531ca0 100644
--- a/runtime/nsd_ptcp.c
+++ b/runtime/nsd_ptcp.c
@@ -91,6 +91,24 @@ CODESTARTobjDestruct(nsd_ptcp)
 ENDobjDestruct(nsd_ptcp)
 
 
+/* Provide access to the sockaddr_storage of the remote peer. This
+ * is needed by the legacy ACL system. --- gerhards, 2008-12-01
+ */
+static rsRetVal
+GetRemAddr(nsd_t *pNsd, struct sockaddr_storage **ppAddr)
+{
+	nsd_ptcp_t *pThis = (nsd_ptcp_t*) pNsd;
+	DEFiRet;
+
+	ISOBJ_TYPE_assert((pThis), nsd_ptcp);
+	assert(ppAddr != NULL);
+
+	*ppAddr = &(pThis->remAddr);
+
+	RETiRet;
+}
+
+
 /* Provide access to the underlying OS socket. This is primarily
  * useful for other drivers (like nsd_gtls) who utilize ourselfs
  * for some of their functionality. -- rgerhards, 2008-04-18
@@ -320,6 +338,12 @@ AcceptConnReq(nsd_t *pNsd, nsd_t **ppNew)
 	/* construct our object so that we can use it... */
 	CHKiRet(nsd_ptcpConstruct(&pNew));
 
+	/* for the legacy ACL code, we need to preserve addr. While this is far from
+	 * begin perfect (from an abstract design perspective), we need this to prevent
+	 * breaking everything. TODO: we need to implement a new ACL module to get rid
+	 * of this function. -- rgerhards, 2008-12-01
+	 */
+	memcpy(&pNew->remAddr, &addr, sizeof(struct sockaddr_storage));
 	CHKiRet(FillRemHost(pNew, (struct sockaddr*) &addr));
 
 	/* set the new socket to non-blocking IO -TODO:do we really need to do this here? Do we always want it? */
@@ -716,6 +740,7 @@ CODESTARTobjQueryInterface(nsd_ptcp)
 	pIf->Construct = (rsRetVal(*)(nsd_t**)) nsd_ptcpConstruct;
 	pIf->Destruct = (rsRetVal(*)(nsd_t**)) nsd_ptcpDestruct;
 	pIf->Abort = Abort;
+	pIf->GetRemAddr = GetRemAddr;
 	pIf->GetSock = GetSock;
 	pIf->SetSock = SetSock;
 	pIf->SetMode = SetMode;
diff --git a/runtime/nsd_ptcp.h b/runtime/nsd_ptcp.h
index efd3ed05..b94cc018 100644
--- a/runtime/nsd_ptcp.h
+++ b/runtime/nsd_ptcp.h
@@ -24,6 +24,8 @@
 #ifndef INCLUDED_NSD_PTCP_H
 #define INCLUDED_NSD_PTCP_H
 
+#include <sys/socket.h>
+
 #include "nsd.h"
 typedef nsd_if_t nsd_ptcp_if_t; /* we just *implement* this interface */
 
@@ -32,6 +34,7 @@ struct nsd_ptcp_s {
 	BEGINobjInstance; /* Data to implement generic object - MUST be the first data element! */
 	uchar *pRemHostIP; /**< IP address of remote peer (currently used in server mode, only) */
 	uchar *pRemHostName; /**< host name of remote peer (currently used in server mode, only) */
+	struct sockaddr_storage remAddr; /**< remote addr as sockaddr - used for legacy ACL code */
 	int sock;	/**< the socket we use for regular, single-socket, operations */
 };
 
diff --git a/tcpsrv.c b/tcpsrv.c
index 17fd58d3..885edba3 100644
--- a/tcpsrv.c
+++ b/tcpsrv.c
@@ -308,10 +308,10 @@ static rsRetVal
 SessAccept(tcpsrv_t *pThis, tcps_sess_t **ppSess, netstrm_t *pStrm)
 {
 	DEFiRet;
-	tcps_sess_t *pSess;
+	tcps_sess_t *pSess = NULL;
 	netstrm_t *pNewStrm = NULL;
 	int iSess = -1;
-	struct sockaddr_storage addr;
+	struct sockaddr_storage *addr;
 	uchar *fromHostFQDN = NULL;
 	uchar *fromHostIP = NULL;
 
@@ -335,13 +335,14 @@ SessAccept(tcpsrv_t *pThis, tcps_sess_t **ppSess, netstrm_t *pStrm)
 	/* get the host name */
 	CHKiRet(netstrm.GetRemoteHName(pNewStrm, &fromHostFQDN));
 	CHKiRet(netstrm.GetRemoteIP(pNewStrm, &fromHostIP));
+	CHKiRet(netstrm.GetRemAddr(pNewStrm, &addr));
 	/* TODO: check if we need to strip the domain name here -- rgerhards, 2008-04-24 */
 
 	/* Here we check if a host is permitted to send us messages. If it isn't, we do not further
 	 * process the message but log a warning (if we are configured to do this).
 	 * rgerhards, 2005-09-26
 	 */
-	if(!pThis->pIsPermittedHost((struct sockaddr*) &addr, (char*) fromHostFQDN, pThis->pUsr, pSess->pUsr)) {
+	if(!pThis->pIsPermittedHost((struct sockaddr*) addr, (char*) fromHostFQDN, pThis->pUsr, pSess->pUsr)) {
 		dbgprintf("%s is not an allowed sender\n", fromHostFQDN);
 		if(glbl.GetOption_DisallowWarning()) {
 			errno = 0;
@@ -354,7 +355,9 @@ SessAccept(tcpsrv_t *pThis, tcps_sess_t **ppSess, netstrm_t *pStrm)
 	 * means we can finally fill in the session object.
 	 */
 	CHKiRet(tcps_sess.SetHost(pSess, fromHostFQDN));
+	fromHostFQDN = NULL; /* we handed this string over */
 	CHKiRet(tcps_sess.SetHostIP(pSess, fromHostIP));
+	fromHostIP = NULL; /* we handed this string over */
 	CHKiRet(tcps_sess.SetStrm(pSess, pNewStrm));
 	pNewStrm = NULL; /* prevent it from being freed in error handler, now done in tcps_sess! */
 	CHKiRet(tcps_sess.SetMsgIdx(pSess, 0));
@@ -367,14 +370,16 @@ SessAccept(tcpsrv_t *pThis, tcps_sess_t **ppSess, netstrm_t *pStrm)
 
 	*ppSess = pSess;
 	pThis->pSessions[iSess] = pSess;
+	pSess = NULL; /* this is now also handed over */
 
 finalize_it:
 	if(iRet != RS_RET_OK) {
-		if(iSess != -1) {
-			if(pThis->pSessions[iSess] != NULL)
-				tcps_sess.Destruct(&pThis->pSessions[iSess]);
-		}
-		iSess = -1; // TODO: change this to be fully iRet compliant ;)
+		if(pSess != NULL)
+			tcps_sess.Destruct(&pSess);
+		if(fromHostFQDN != NULL)
+			free(fromHostFQDN);
+		if(fromHostIP != NULL)
+			free(fromHostIP);
 		if(pNewStrm != NULL)
 			netstrm.Destruct(&pNewStrm);
 	}