Merge branch 'v5-devel'

Conflicts:
	ChangeLog
	configure.ac
	doc/manual.html
	plugins/imuxsock/imuxsock.c
	runtime/modules.c

5 files changed, 250 insertions, 49 deletions

diff --git a/ChangeLog b/ChangeLog
index 03229548..0eb38330 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -23,6 +23,11 @@ Version 6.3.7  [DEVEL] 2011-0?-??
 - bugfix: potential abort after reading invalid X.509 certificate
   closes: http://bugzilla.adiscon.com/show_bug.cgi?id=290
   Thanks to Tomas Heinrich for the patch
+- enhanced module loader to not rely on PATH_MAX
+- imuxsock: added capability to "annotate" messages with "trusted
+  information", which contains some properties obtained from the system
+  and as such sure to not be faked. This is inspired by the similiar idea
+  introduced in systemd.
 ---------------------------------------------------------------------------
 Version 6.3.6  [DEVEL] 2011-09-19
 - added $InputRELPServerBindRuleset directive to specify rulesets for RELP
@@ -317,7 +322,14 @@ expected that interfaces, even new ones, break during the initial
   syslog plain tcp input plugin (NOT supporting TLS!)
   [ported from v4]
 ---------------------------------------------------------------------------
-Version 5.9.4  [V5-DEVEL], 2011-0?-??
+Version 5.9.5  [V5-DEVEL], 20??-??-??
+- enhanced module loader to not rely on PATH_MAX
+---------------------------------------------------------------------------
+Version 5.9.4  [V5-DEVEL], 2011-11-29
+- imuxsock: added capability to "annotate" messages with "trusted
+  information", which contains some properties obtained from the system
+  and as such sure to not be faked. This is inspired by the similiar idea
+  introduced in systemd.
 - removed dependency on gcrypt for recently-enough GnuTLS
   see: http://bugzilla.adiscon.com/show_bug.cgi?id=289
 - bugfix: imuxsock did no longer ignore message-provided timestamp, if
diff --git a/doc/imuxsock.html b/doc/imuxsock.html
index 58b3ae54..f80bc598 100644
--- a/doc/imuxsock.html
+++ b/doc/imuxsock.html
@@ -49,6 +49,15 @@ are places as quickly as possible into the processing queues. If you would like
 flow control, you need to enable it via the $SystemLogSocketFlowControl and
 $InputUnixListenSocketFlowControl config directives. Just make sure you thought about
 the implications. Note that for many systems, turning on flow control does not hurt.
+<p>Starting with rsyslog 5.9.4,
+<b><a href="http://www.rsyslog.com/what-are-trusted-properties/">trusted syslog properties</a>
+are available</b>. These require a recent enough Linux Kernel and access to the /proc file
+system. In other words, this may not work on all platforms and may not work fully when
+privileges are dropped (depending on how they are dropped). Note that trusted properties
+can be very useful, but also typically cause the message to grow rather large. Also, the
+format of log messages is obviously changed by adding the trusted properties at the end.
+For these reasons, the feature is <b>not enabled by default</b>. If you want to use it,
+you must turn it on (via $SystemLogSocketAnnotate and $InputUnixListenSocketAnnotate).
 <p><b>Configuration Directives</b>:</p>
 <ul>
 <li><b>$InputUnixListenSocketIgnoreMsgTimestamp</b> [<b>on</b>/off]
@@ -115,7 +124,12 @@ shall be used inside messages taken from the <b>next</b> $AddUnixListenSocket so
 the hostname must be specified before the $AddUnixListenSocket configuration directive, and it
 will only affect the next one and then automatically be reset. This functionality is provided so
 that the local hostname can be overridden in cases where that is desired.</li>
+<li><b>$InputUnixListenSocketAnnotate</b> &lt;on/<b>off</b>&gt; turn on annotation/trusted
+properties for the non-system log socket in question.</li>
+<li><b>$SystemLogSocketAnnotate</b> &lt;on/<b>off</b>&gt; turn on annotation/trusted
+properties for the system log socket.</li>
 </ul>
+
 <b>Caveats/Known Bugs:</b><br>
 <ul>
 <li>There is a compile-time limit of 50 concurrent sockets. If you need more, you need to
@@ -151,17 +165,21 @@ $InputUnixListenSocketHostName /var/run/sshd/dev/log
 </textarea>
 <p>The following sample is used to turn off input rate limiting on the system log
 socket.
-<textarea rows="6" cols="70">$ModLoad imuxsock # needs to be done just once
+<textarea rows="4" cols="70">$ModLoad imuxsock # needs to be done just once
 
 $SystemLogRateLimitInterval 0 # turn off rate limiting
 </textarea>
+<p>The following sample is used activate message annotation and thus trusted properties
+on the system log socket.
+<textarea rows="4" cols="70">$ModLoad imuxsock # needs to be done just once
+
+$SystemLogSocketAnnotate on
+</textarea>
 <p>[<a href="rsyslog_conf.html">rsyslog.conf overview</a>]
 [<a href="manual.html">manual index</a>] [<a href="http://www.rsyslog.com/">rsyslog site</a>]</p>
 <p><font size="2">This documentation is part of the
-<a href="http://www.rsyslog.com/">rsyslog</a>
-project.<br>
-Copyright &copy; 2008-2010 by <a href="http://www.gerhards.net/rainer">Rainer
-Gerhards</a> and
+<a href="http://www.rsyslog.com/">rsyslog</a> project.<br>
+Copyright &copy; 2008-2011 by <a href="http://www.gerhards.net/rainer">Rainer Gerhards</a> and
 <a href="http://www.adiscon.com/">Adiscon</a>.
 Released under the GNU GPL version 3 or higher.</font></p>
 </body></html>
diff --git a/plugins/imuxsock/imuxsock.c b/plugins/imuxsock/imuxsock.c
index cf4211e7..fa36a962 100644
--- a/plugins/imuxsock/imuxsock.c
+++ b/plugins/imuxsock/imuxsock.c
@@ -34,6 +34,7 @@
 #include <string.h>
 #include <errno.h>
 #include <unistd.h>
+#include <fcntl.h>
 #include <sys/stat.h>
 #include <sys/un.h>
 #include <sys/socket.h>
@@ -140,6 +141,7 @@ typedef struct lstn_s {
 	sbool bParseHost;	/* should parser parse host name?  read-only after startup */
 	sbool bCreatePath;	/* auto-creation of socket directory? */
 	sbool bUseCreds;	/* pull original creator credentials from socket */
+	sbool bAnnotate;	/* annotate events with trusted properties */
 	sbool bWritePid;	/* write original PID into tag */
 	sbool bUseSysTimeStamp;	/* use timestamp from system (instead of from message) */
 } lstn_t;
@@ -176,6 +178,8 @@ static struct configSettings_s {
 	int ratelimitBurstSysSock;
 	int ratelimitSeverity;
 	int ratelimitSeveritySysSock;
+	int bAnnotate;			/* annotate trusted properties */
+	int bAnnotateSysSock;		/* same, for system log socket */
 } cs;
 
 struct instanceConf_s {
@@ -189,6 +193,7 @@ struct instanceConf_s {
 	int ratelimitInterval;		/* interval in seconds, 0 = off */
 	int ratelimitBurst;		/* max nbr of messages in interval */
 	int ratelimitSeverity;
+	int bAnnotate;			/* annotate trusted properties */
 	struct instanceConf_s *next;
 };
 
@@ -201,6 +206,7 @@ struct modConfData_s {
 	int ratelimitSeveritySysSock;
 	sbool bOmitLocalLogging;
 	sbool bWritePidSysSock;
+	int bAnnotateSysSock;
 	sbool bUseSysTimeStamp;
 };
 static modConfData_t *loadModConf = NULL;/* modConf ptr to use for the current load process */
@@ -325,6 +331,7 @@ static rsRetVal addInstance(void __attribute__((unused)) *pVal, uchar *pNewVal)
 	inst->bCreatePath = cs.bCreatePath;
 	inst->bUseSysTimeStamp = cs.bUseSysTimeStamp;
 	inst->bWritePid = cs.bWritePid;
+	inst->bAnnotate = cs.bAnnotate;
 	inst->next = NULL;
 
 	/* node created, let's add to config */
@@ -386,7 +393,8 @@ addListner(instanceConf_t *inst)
 		listeners[nfd].flags = inst->bIgnoreTimestamp ? IGNDATE : NOFLAG;
 		listeners[nfd].bCreatePath = inst->bCreatePath;
 		listeners[nfd].sockName = ustrdup(inst->sockName);
-		listeners[nfd].bUseCreds = (inst->bWritePid || inst->ratelimitInterval) ? 1 : 0;
+		listeners[nfd].bUseCreds = (inst->bWritePid || inst->ratelimitInterval || inst->bAnnotate) ? 1 : 0;
+		listeners[nfd].bAnnotate = inst->bAnnotate;
 		listeners[nfd].bWritePid = inst->bWritePid;
 		listeners[nfd].bUseSysTimeStamp = inst->bUseSysTimeStamp;
 		nfd++;
@@ -509,6 +517,7 @@ openLogSocket(lstn_t *pLstn)
 	}
 #	else /* HAVE_SCM_CREDENTIALS */
 	pLstn->bUseCreds = 0;
+	pLstn->bAnnotate = 0;
 #	endif /* HAVE_SCM_CREDENTIALS */
 
 finalize_it:
@@ -591,6 +600,103 @@ fixPID(uchar *bufTAG, int *lenTag, struct ucred *cred)
 }
 
 
+/* Get an "trusted property" from the system. Returns an empty string if the
+ * property can not be obtained. Inspired by similiar functionality inside
+ * journald. Currently works with Linux /proc filesystem, only.
+ */
+static rsRetVal
+getTrustedProp(struct ucred *cred, char *propName, uchar *buf, size_t lenBuf, int *lenProp)
+{
+	int fd;
+	int i;
+	int lenRead;
+	char namebuf[1024];
+	DEFiRet;
+
+	if(snprintf(namebuf, sizeof(namebuf), "/proc/%lu/%s", (long unsigned) cred->pid,
+		propName) >= (int) sizeof(namebuf)) {
+		ABORT_FINALIZE(RS_RET_ERR);
+	}
+
+	if((fd = open(namebuf, O_RDONLY)) == -1) {
+		DBGPRINTF("error reading '%s'\n", namebuf);
+		*lenProp = 0;
+		FINALIZE;
+	}
+	if((lenRead = read(fd, buf, lenBuf - 1)) == -1) {
+		DBGPRINTF("error reading file data for '%s'\n", namebuf);
+		*lenProp = 0;
+		close(fd);
+		FINALIZE;
+	}
+	
+	/* we strip after the first \n */
+	for(i = 0 ; i < lenRead ; ++i) {
+		if(buf[i] == '\n')
+			break;
+		else if(iscntrl(buf[i]))
+			buf[i] = ' ';
+	}
+	buf[i] = '\0';
+	*lenProp = i;
+
+	close(fd);
+
+finalize_it:
+	RETiRet;
+}
+
+
+/* read the exe trusted property path (so far, /proc fs only)
+ */
+static rsRetVal
+getTrustedExe(struct ucred *cred, uchar *buf, size_t lenBuf, int* lenProp)
+{
+	int lenRead;
+	char namebuf[1024];
+	DEFiRet;
+
+	if(snprintf(namebuf, sizeof(namebuf), "/proc/%lu/exe", (long unsigned) cred->pid)
+		>= (int) sizeof(namebuf)) {
+		ABORT_FINALIZE(RS_RET_ERR);
+	}
+
+	if((lenRead = readlink(namebuf, (char*)buf, lenBuf - 1)) == -1) {
+		DBGPRINTF("error reading link '%s'\n", namebuf);
+		*lenProp = 0;
+		FINALIZE;
+	}
+	
+	buf[lenRead] = '\0';
+	*lenProp = lenRead;
+
+finalize_it:
+	RETiRet;
+}
+
+
+/* copy a trusted property in escaped mode. That is, the property can contain
+ * any character and so it must be properly quoted AND escaped.
+ * It is assumed the output buffer is large enough. Returns the number of
+ * characters added.
+ */
+static inline int
+copyescaped(uchar *dstbuf, uchar *inbuf, int inlen)
+{
+	int iDst, iSrc;
+
+	*dstbuf = '"';
+	for(iDst=1, iSrc=0 ; iSrc < inlen ; ++iDst, ++iSrc) {
+		if(inbuf[iSrc] == '"' || inbuf[iSrc] == '\\') {
+			dstbuf[iDst++] = '\\';
+		}
+		dstbuf[iDst] = inbuf[iSrc];
+	}
+	dstbuf[iDst++] = '"';
+	return iDst;
+}
+
+
 /* submit received message to the queue engine
  * We now parse the message according to expected format so that we
  * can also mangle it if necessary.
@@ -610,6 +716,11 @@ SubmitMsg(uchar *pRcv, int lenRcv, lstn_t *pLstn, struct ucred *cred, struct tim
 	struct syslogTime st;
 	time_t tt;
 	rs_ratelimit_state_t *ratelimiter = NULL;
+	int lenProp;
+	uchar propBuf[1024];
+	uchar msgbuf[8192];
+	uchar *pmsgbuf;
+	int toffs; /* offset for trusted properties */
 	DEFiRet;
 
 	/* TODO: handle format errors?? */
@@ -647,6 +758,47 @@ SubmitMsg(uchar *pRcv, int lenRcv, lstn_t *pLstn, struct ucred *cred, struct tim
 		FINALIZE;
 	}
 
+	/* created trusted properties */
+	if(cred != NULL && pLstn->bAnnotate) {
+		if((unsigned) (lenRcv + 4096) < sizeof(msgbuf)) {
+			pmsgbuf = msgbuf;
+		} else {
+			CHKmalloc(pmsgbuf = malloc(lenRcv+4096));
+		}
+		memcpy(pmsgbuf, pRcv, lenRcv);
+		memcpy(pmsgbuf+lenRcv, " @[", 3);
+		toffs = lenRcv + 3; /* next free location */
+		lenProp = snprintf((char*)propBuf, sizeof(propBuf), "_PID=%lu _UID=%lu _GID=%lu",
+			 		(long unsigned) cred->pid, (long unsigned) cred->uid, 
+					(long unsigned) cred->gid);
+		memcpy(pmsgbuf+toffs, propBuf, lenProp);
+		toffs = toffs + lenProp;
+		getTrustedProp(cred, "comm", propBuf, sizeof(propBuf), &lenProp);
+		if(lenProp) {
+			memcpy(pmsgbuf+toffs, " _COMM=", 7);
+			memcpy(pmsgbuf+toffs+7, propBuf, lenProp);
+			toffs = toffs + 7 + lenProp;
+		}
+		getTrustedExe(cred, propBuf, sizeof(propBuf), &lenProp);
+		if(lenProp) {
+			memcpy(pmsgbuf+toffs, " _EXE=", 6);
+			memcpy(pmsgbuf+toffs+6, propBuf, lenProp);
+			toffs = toffs + 6 + lenProp;
+		}
+		getTrustedProp(cred, "cmdline", propBuf, sizeof(propBuf), &lenProp);
+		if(lenProp) {
+			memcpy(pmsgbuf+toffs, " _CMDLINE=", 10);
+			toffs = toffs + 10 + 
+				copyescaped(pmsgbuf+toffs+10, propBuf, lenProp);
+		}
+		/* finalize string */
+		pmsgbuf[toffs] = ']';
+		pmsgbuf[toffs+1] = '\0';
+		pRcv = pmsgbuf;
+		lenRcv = toffs + 1;
+	}
+
+
 	/* we now create our own message object and submit it to the queue */
 	CHKiRet(msgConstructWithTime(&pMsg, &st, tt));
 	MsgSetRawMsg(pMsg, (char*)pRcv, lenRcv);
@@ -777,14 +929,11 @@ static rsRetVal readSocket(lstn_t *pLstn)
 		cred = NULL;
 		ts = NULL;
 		if(pLstn->bUseCreds || pLstn->bUseSysTimeStamp) {
-			dbgprintf("XXX: pre CM loop, length of control message %d\n", (int) msgh.msg_controllen);
 			for(cm = CMSG_FIRSTHDR(&msgh); cm; cm = CMSG_NXTHDR(&msgh, cm)) {
-				dbgprintf("XXX: in CM loop, %d, %d\n", cm->cmsg_level, cm->cmsg_type);
 #				if HAVE_SCM_CREDENTIALS
 				if(   pLstn->bUseCreds
 				   && cm->cmsg_level == SOL_SOCKET && cm->cmsg_type == SCM_CREDENTIALS) {
 					cred = (struct ucred*) CMSG_DATA(cm);
-					dbgprintf("XXX: got credentials pid %d\n", (int) cred->pid);
 					break;
 				}
 #				endif /* HAVE_SCM_CREDENTIALS */
@@ -798,7 +947,6 @@ static rsRetVal readSocket(lstn_t *pLstn)
 				}
 #				endif /* HAVE_SO_TIMESTAMP */
 			}
-			dbgprintf("XXX: post CM loop\n");
 		}
 		CHKiRet(SubmitMsg(pRcv, iRcvd, pLstn, cred, ts));
 	} else if(iRcvd < 0 && errno != EINTR) {
@@ -850,6 +998,7 @@ activateListeners()
 	listeners[0].ratelimitSev = runModConf->ratelimitSeveritySysSock;
 	listeners[0].bUseCreds = (runModConf->bWritePidSysSock || runModConf->ratelimitIntervalSysSock) ? 1 : 0;
 	listeners[0].bWritePid = runModConf->bWritePidSysSock;
+	listeners[0].bAnnotate = runModConf->bAnnotateSysSock;
 	listeners[0].bUseSysTimeStamp = runModConf->bUseSysTimeStamp;
 
 	sd_fds = sd_listen_fds(0);
@@ -1075,6 +1224,8 @@ static rsRetVal resetConfigVariables(uchar __attribute__((unused)) *pp, void __a
 	cs.bUseSysTimeStampSysSock = 1;
 	cs.bWritePid = 0;
 	cs.bWritePidSysSock = 0;
+	cs.bAnnotate = 0;
+	cs.bAnnotateSysSock = 0;
 	cs.bCreatePath = DFLT_bCreatePath;
 	cs.ratelimitInterval = DFLT_ratelimitInterval;
 	cs.ratelimitIntervalSysSock = DFLT_ratelimitInterval;
@@ -1118,6 +1269,7 @@ CODEmodInit_QueryRegCFSLineHdlr
 	listeners[0].fd = -1;
 	listeners[0].bParseHost = 0;
 	listeners[0].bUseCreds = 0;
+	listeners[0].bAnnotate = 0;
 	listeners[0].bCreatePath = 0;
 	listeners[0].bUseSysTimeStamp = 1;
 
@@ -1147,6 +1299,8 @@ CODEmodInit_QueryRegCFSLineHdlr
 		NULL, &cs.pLogHostName, STD_LOADABLE_MODULE_ID, eConfObjGlobal));
 	CHKiRet(omsdRegCFSLineHdlr((uchar *)"inputunixlistensocketflowcontrol", 0, eCmdHdlrBinary,
 		NULL, &cs.bUseFlowCtl, STD_LOADABLE_MODULE_ID, eConfObjGlobal));
+	CHKiRet(omsdRegCFSLineHdlr((uchar *)"inputunixlistensocketannotate", 0, eCmdHdlrBinary,
+		NULL, &cs.bAnnotate, STD_LOADABLE_MODULE_ID, eConfObjGlobal));
 	CHKiRet(omsdRegCFSLineHdlr((uchar *)"inputunixlistensocketcreatepath", 0, eCmdHdlrBinary,
 		NULL, &cs.bCreatePath, STD_LOADABLE_MODULE_ID, eConfObjGlobal));
 	CHKiRet(omsdRegCFSLineHdlr((uchar *)"inputunixlistensocketusesystimestamp", 0, eCmdHdlrBinary,
@@ -1175,6 +1329,8 @@ CODEmodInit_QueryRegCFSLineHdlr
 		setSystemLogFlowControl, NULL, STD_LOADABLE_MODULE_ID, eConfObjGlobal));
 	CHKiRet(omsdRegCFSLineHdlr((uchar *)"systemlogusesystimestamp", 0, eCmdHdlrBinary,
 		NULL, &cs.bUseSysTimeStampSysSock, STD_LOADABLE_MODULE_ID, eConfObjGlobal));
+	CHKiRet(omsdRegCFSLineHdlr((uchar *)"systemlogsocketannotate", 0, eCmdHdlrBinary,
+		NULL, &cs.bAnnotateSysSock, STD_LOADABLE_MODULE_ID, eConfObjGlobal));
 	CHKiRet(omsdRegCFSLineHdlr((uchar *)"systemlogusepidfromsystem", 0, eCmdHdlrBinary,
 		NULL, &cs.bWritePidSysSock, STD_LOADABLE_MODULE_ID, eConfObjGlobal));
 	CHKiRet(omsdRegCFSLineHdlr((uchar *)"systemlogratelimitinterval", 0, eCmdHdlrInt,
diff --git a/runtime/modules.c b/runtime/modules.c
index 0f132bdf..e5475780 100644
--- a/runtime/modules.c
+++ b/runtime/modules.c
@@ -950,20 +950,32 @@ Load(uchar *pModName, sbool bConfLoad)
 	DEFiRet;
 	
 	size_t iPathLen, iModNameLen;
-	uchar szPath[PATH_MAX];
+	uchar *pModNameCmp;
 	int bHasExtension;
         void *pModHdlr, *pModInit;
 	modInfo_t *pModInfo;
 	uchar *pModDirCurr, *pModDirNext;
 	int iLoadCnt;
 	struct dlhandle_s *pHandle = NULL;
+#	ifdef PATH_MAX
+	uchar pathBuf[PATH_MAX+1];
+#	else
+	uchar pathBuf[4096];
+#	endif
+	uchar *pPathBuf = pathBuf;
+	size_t lenPathBuf = sizeof(pathBuf);
 
 	assert(pModName != NULL);
 	dbgprintf("Requested to load module '%s'\n", pModName);
 
+	iModNameLen = strlen((char*)pModName);
+	/* overhead for a full path is potentially 1 byte for a slash,
+	 * three bytes for ".so" and one byte for '\0'.
+	 */
+#	define PATHBUF_OVERHEAD 1 + iModNameLen + 3 + 1
+
 	pthread_mutex_lock(&mutLoadUnload);
 
-	iModNameLen = strlen((char *) pModName);
 	if(iModNameLen > 3 && !strcmp((char *) pModName + iModNameLen - 3, ".so")) {
 		iModNameLen -= 3;
 		bHasExtension = TRUE;
@@ -983,13 +995,19 @@ Load(uchar *pModName, sbool bConfLoad)
 	pModDirNext = NULL;
 	pModHdlr    = NULL;
 	iLoadCnt    = 0;
-	do {
-		/* now build our load module name */
+	do {	/* now build our load module name */
 		if(*pModName == '/' || *pModName == '.') {
-			*szPath = '\0';	/* we do not need to append the path - its already in the module name */
+			if(lenPathBuf < PATHBUF_OVERHEAD) {
+				if(pPathBuf != pathBuf) /* already malloc()ed memory? */
+					free(pPathBuf);
+				/* we always alloc enough memory for everything we potentiall need to add */
+				lenPathBuf = PATHBUF_OVERHEAD;
+				CHKmalloc(pPathBuf = malloc(sizeof(char)*lenPathBuf));
+			}
+			*pPathBuf = '\0';	/* we do not need to append the path - its already in the module name */
 			iPathLen = 0;
 		} else {
-			*szPath = '\0';
+			*pPathBuf = '\0';
 
 			iPathLen = strlen((char *)pModDirCurr);
 			pModDirNext = (uchar *)strchr((char *)pModDirCurr, ':');
@@ -1002,47 +1020,40 @@ Load(uchar *pModName, sbool bConfLoad)
 					continue;
 				}
 				break;
-			} else if(iPathLen > sizeof(szPath) - 1) {
-				errmsg.LogError(0, NO_ERRCODE, "could not load module '%s', "
-						"module path too long\n", pModName);
-				ABORT_FINALIZE(RS_RET_MODULE_LOAD_ERR_PATHLEN);
+			} else if(iPathLen > lenPathBuf - PATHBUF_OVERHEAD) {
+				if(pPathBuf != pathBuf) /* already malloc()ed memory? */
+					free(pPathBuf);
+				/* we always alloc enough memory for everything we potentiall need to add */
+				lenPathBuf = iPathLen + PATHBUF_OVERHEAD;
+				CHKmalloc(pPathBuf = malloc(sizeof(char)*lenPathBuf));
 			}
 
-			strncat((char *) szPath, (char *)pModDirCurr, iPathLen);
-			iPathLen = strlen((char*) szPath);
+			memcpy((char *) pPathBuf, (char *)pModDirCurr, iPathLen);
+			if((pPathBuf[iPathLen - 1] != '/')) {
+				/* we have space, made sure in previous check */
+				pPathBuf[iPathLen++] = '/';
+			}
+			pPathBuf[iPathLen] = '\0';
 
 			if(pModDirNext)
 				pModDirCurr = pModDirNext + 1;
-
-			if((szPath[iPathLen - 1] != '/')) {
-				if((iPathLen <= sizeof(szPath) - 2)) {
-					szPath[iPathLen++] = '/';
-					szPath[iPathLen] = '\0';
-				} else {
-					errmsg.LogError(0, RS_RET_MODULE_LOAD_ERR_PATHLEN,
-						"could not load module '%s', path too long\n", pModName);
-					ABORT_FINALIZE(RS_RET_MODULE_LOAD_ERR_PATHLEN);
-				}
-			}
 		}
 
 		/* ... add actual name ... */
-		strncat((char *) szPath, (char *) pModName, sizeof(szPath) - iPathLen - 1);
+		strncat((char *) pPathBuf, (char *) pModName, lenPathBuf - iPathLen - 1);
 
 		/* now see if we have an extension and, if not, append ".so" */
 		if(!bHasExtension) {
-			strncat((char *) szPath, ".so", sizeof(szPath) - strlen((char*) szPath) - 1);
+			/* we do not have an extension and so need to add ".so"
+			 * TODO: I guess this is highly importable, so we should change the
+			 * algo over time... -- rgerhards, 2008-03-05
+			 */
+			strncat((char *) pPathBuf, ".so", lenPathBuf - strlen((char*) pPathBuf) - 1);
 			iPathLen += 3;
 		}
 
-		if(iPathLen + strlen((char*) pModName) >= sizeof(szPath)) {
-			errmsg.LogError(0, RS_RET_MODULE_LOAD_ERR_PATHLEN,
-					"could not load module '%s', path too long\n", pModName);
-			ABORT_FINALIZE(RS_RET_MODULE_LOAD_ERR_PATHLEN);
-		}
-
 		/* complete load path constructed, so ... GO! */
-		dbgprintf("loading module '%s'\n", szPath);
+		dbgprintf("loading module '%s'\n", pPathBuf);
 
 		/* see if we have this one already */
 		for (pHandle = pHandles; pHandle; pHandle = pHandle->next) {
@@ -1054,7 +1065,7 @@ Load(uchar *pModName, sbool bConfLoad)
 
 		/* not found, try to dynamically link it */
 		if (!pModHdlr) {
-			pModHdlr = dlopen((char *) szPath, RTLD_NOW);
+			pModHdlr = dlopen((char *) pPathBuf, RTLD_NOW);
 		}
 
 		iLoadCnt++;
@@ -1063,23 +1074,23 @@ Load(uchar *pModName, sbool bConfLoad)
 
 	if(!pModHdlr) {
 		if(iLoadCnt) {
-			errmsg.LogError(0, RS_RET_MODULE_LOAD_ERR_DLOPEN,
-					"could not load module '%s', dlopen: %s\n", szPath, dlerror());
+			errmsg.LogError(0, RS_RET_MODULE_LOAD_ERR_DLOPEN, "could not load module '%s', dlopen: %s\n",
+					pPathBuf, dlerror());
 		} else {
-			errmsg.LogError(0, NO_ERRCODE, "could not load module '%s', ModDir was '%s'\n", szPath,
+			errmsg.LogError(0, NO_ERRCODE, "could not load module '%s', ModDir was '%s'\n", pPathBuf,
 			                               ((pModDir == NULL) ? _PATH_MODDIR : (char *)pModDir));
 		}
 		ABORT_FINALIZE(RS_RET_MODULE_LOAD_ERR_DLOPEN);
 	}
 	if(!(pModInit = dlsym(pModHdlr, "modInit"))) {
 		errmsg.LogError(0, RS_RET_MODULE_LOAD_ERR_NO_INIT,
-			 	"could not load module '%s', dlsym: %s\n", szPath, dlerror());
+			 	"could not load module '%s', dlsym: %s\n", pPathBuf, dlerror());
 		dlclose(pModHdlr);
 		ABORT_FINALIZE(RS_RET_MODULE_LOAD_ERR_NO_INIT);
 	}
 	if((iRet = doModInit(pModInit, (uchar*) pModName, pModHdlr, &pModInfo)) != RS_RET_OK) {
 		errmsg.LogError(0, RS_RET_MODULE_LOAD_ERR_INIT_FAILED,
-				"could not load module '%s', rsyslog error %d\n", szPath, iRet);
+				"could not load module '%s', rsyslog error %d\n", pPathBuf, iRet);
 		dlclose(pModHdlr);
 		ABORT_FINALIZE(RS_RET_MODULE_LOAD_ERR_INIT_FAILED);
 	}
@@ -1087,6 +1098,8 @@ Load(uchar *pModName, sbool bConfLoad)
 		addModToCnfList(pModInfo);
 
 finalize_it:
+	if(pPathBuf != pathBuf) /* used malloc()ed memory? */
+		free(pPathBuf);
 	pthread_mutex_unlock(&mutLoadUnload);
 	RETiRet;
 }
diff --git a/runtime/nsd_gtls.c b/runtime/nsd_gtls.c
index 96f0d342..c2db9c94 100644
--- a/runtime/nsd_gtls.c
+++ b/runtime/nsd_gtls.c
@@ -55,7 +55,9 @@
 #define CRLFILE "crl.pem"
 
 
+#if GNUTLS_VERSION_NUMBER <= 0x020b00
 GCRY_THREAD_OPTION_PTHREAD_IMPL;
+#endif
 MODULE_TYPE_LIB
 MODULE_TYPE_KEEP