diff options
author | Rainer Gerhards <rgerhards@adiscon.com> | 2007-12-19 07:45:32 +0000 |
---|---|---|
committer | Rainer Gerhards <rgerhards@adiscon.com> | 2007-12-19 07:45:32 +0000 |
commit | 3cdb6743f792f9b6705b352c9e4a5b502b1f5993 (patch) | |
tree | 7376e1c66c8394055fb1d79aa47abdca65c7a0a2 /syslogd.c | |
parent | 83da22c61ec3a3cb3911112591b22aa7d4d037b8 (diff) | |
download | rsyslog-3cdb6743f792f9b6705b352c9e4a5b502b1f5993.tar.gz rsyslog-3cdb6743f792f9b6705b352c9e4a5b502b1f5993.tar.xz rsyslog-3cdb6743f792f9b6705b352c9e4a5b502b1f5993.zip |
applied enhanced gss-api functionality provided by varmojfekoj
Diffstat (limited to 'syslogd.c')
-rw-r--r-- | syslogd.c | 88 |
1 files changed, 68 insertions, 20 deletions
@@ -633,6 +633,10 @@ static struct AllowedSenders *pAllowedSenders_UDP = NULL; /* the roots of the al struct AllowedSenders *pAllowedSenders_TCP = NULL; /* lists. If NULL, all senders are ok! */ static struct AllowedSenders *pLastAllowedSenders_UDP = NULL; /* and now the pointers to the last */ static struct AllowedSenders *pLastAllowedSenders_TCP = NULL; /* element in the respective list */ +#ifdef USE_GSSAPI +struct AllowedSenders *pAllowedSenders_GSS = NULL; +static struct AllowedSenders *pLastAllowedSenders_GSS = NULL; +#endif #endif /* #ifdef SYSLOG_INET */ int option_DisallowWarning = 1; /* complain if message from disallowed sender is received */ @@ -926,12 +930,24 @@ static void PrintAllowedSenders(int iListToPrint) struct AllowedSenders *pSender; uchar szIP[64]; - assert((iListToPrint == 1) || (iListToPrint == 2)); + assert((iListToPrint == 1) || (iListToPrint == 2) +#ifdef USE_GSSAPI + || (iListToPrint == 3) +#endif + ); printf("\nAllowed %s Senders:\n", - (iListToPrint == 1) ? "UDP" : "TCP"); - pSender = (iListToPrint == 1) ? - pAllowedSenders_UDP : pAllowedSenders_TCP; + (iListToPrint == 1) ? "UDP" : +#ifdef USE_GSSAPI + (iListToPrint == 3) ? "GSS" : +#endif + "TCP"); + + pSender = (iListToPrint == 1) ? pAllowedSenders_UDP : +#ifdef USE_GSSAPI + (iListToPrint == 3) ? pAllowedSenders_GSS : +#endif + pAllowedSenders_TCP; if(pSender == NULL) { printf("\tNo restrictions set.\n"); } else { @@ -1054,7 +1070,6 @@ int isAllowedSender(struct AllowedSenders *pAllowRoot, struct sockaddr *pFrom, c if (MaskCmp (&(pAllow->allowedSender), pAllow->SignificantBits, pFrom, pszFromHost)) return 1; } - dbgprintf("%s is not an allowed sender\n", pszFromHost); return 0; } #endif /* #ifdef SYSLOG_INET */ @@ -1615,7 +1630,7 @@ void getCurrTime(struct syslogTime *t) static int usage(void) { fprintf(stderr, "usage: rsyslogd [-46AdhqQvw] [-l hostlist] [-m markinterval] [-n] [-p path]\n" \ - " [-s domainlist] [-r[port]] [-tport[,max-sessions]] [-f conffile] [-i pidfile] [-x]\n"); + " [-s domainlist] [-r[port]] [-tport[,max-sessions]] [-gport[,max-sessions]] [-f conffile] [-i pidfile] [-x]\n"); exit(1); /* "good" exit - done to terminate usage() */ } @@ -3507,6 +3522,10 @@ static void die(int sig) if(sockTCPLstn != NULL && *sockTCPLstn) { deinit_tcp_listener(); } +#ifdef USE_GSSAPI + if(bEnableTCP & ALLOWEDMETHOD_GSS) + TCPSessGSSDeinit(); +#endif #endif /* Clean-up files. */ @@ -3597,6 +3616,11 @@ static rsRetVal addAllowedSenderLine(char* pName, uchar** ppRestOfConfLine) } else if(!strcasecmp(pName, "tcp")) { ppRoot = &pAllowedSenders_TCP; ppLast = &pLastAllowedSenders_TCP; +#ifdef USE_GSSAPI + } else if(!strcasecmp(pName, "gss")) { + ppRoot = &pAllowedSenders_GSS; + ppLast = &pLastAllowedSenders_GSS; +#endif } else { logerrorSz("Invalid protocol '%s' in allowed sender " "list, line ignored", pName); @@ -4103,6 +4127,9 @@ static void dbgPrintInitInfo(void) /* now the allowedSender lists: */ PrintAllowedSenders(1); /* UDP */ PrintAllowedSenders(2); /* TCP */ +#ifdef USE_GSSAPI + PrintAllowedSenders(3); /* GSS */ +#endif printf("\n"); #endif /* #ifdef SYSLOG_INET */ @@ -4284,9 +4311,19 @@ init(void) clearAllowedSenders (pAllowedSenders_TCP); pAllowedSenders_TCP = NULL; } +#ifdef USE_GSSAPI + if (pAllowedSenders_GSS != NULL) { + clearAllowedSenders (pAllowedSenders_GSS); + pAllowedSenders_GSS = NULL; + } +#endif } - assert(pAllowedSenders_UDP == NULL && pAllowedSenders_TCP == NULL); + assert(pAllowedSenders_UDP == NULL && pAllowedSenders_TCP == NULL +#ifdef USE_GSSAPI + && pAllowedSenders_GSS == NULL +#endif + ); #endif /* I was told by an IPv6 expert that calling getservbyname() seems to be * still valid, at least for the use case we have. So I re-enabled that @@ -4421,16 +4458,17 @@ init(void) * user-selectable option. rgerhards, 2007-06-21 */ # ifdef USE_GSSAPI - if(bEnableTCP == 2) { + if(bEnableTCP & ALLOWEDMETHOD_GSS) { if(TCPSessGSSInit()) { logerror("GSS-API initialization failed\n"); - bEnableTCP = -1; + bEnableTCP &= ~(ALLOWEDMETHOD_GSS); } } + if(bEnableTCP) # endif - if((sockTCPLstn = create_tcp_socket()) != NULL) { - dbgprintf("Opened %d syslog TCP port(s).\n", *sockTCPLstn); - } + if((sockTCPLstn = create_tcp_socket()) != NULL) { + dbgprintf("Opened %d syslog TCP port(s).\n", *sockTCPLstn); + } } } #endif @@ -5642,6 +5680,7 @@ static rsRetVal processSelectAfter(int maxfds, int nfds, fd_set *pReadfds, fd_se (struct sockaddr *)&frominet, (char*)fromHostFQDN)) { printchopped((char*)fromHost, line, l, finet[i+1], 1); } else { + dbgprintf("%s is not an allowed sender\n", (char*)fromHostFQDN); if(option_DisallowWarning) { logerrorSz("UDP message from disallowed sender %s discarded", (char*)fromHost); @@ -5666,7 +5705,7 @@ static rsRetVal processSelectAfter(int maxfds, int nfds, fd_set *pReadfds, fd_se if (FD_ISSET(sockTCPLstn[i+1], pReadfds)) { dbgprintf("New connect on TCP inetd socket: #%d\n", sockTCPLstn[i+1]); # ifdef USE_GSSAPI - if(bEnableTCP == 2) + if(bEnableTCP & ALLOWEDMETHOD_GSS) TCPSessGSSAccept(sockTCPLstn[i+1]); else # endif @@ -5687,14 +5726,15 @@ static rsRetVal processSelectAfter(int maxfds, int nfds, fd_set *pReadfds, fd_se /* Receive message */ # ifdef USE_GSSAPI - if(bEnableTCP == 2) + int allowedMethods = pTCPSessions[iTCPSess].allowedMethods; + if(allowedMethods & ALLOWEDMETHOD_GSS) state = TCPSessGSSRecv(iTCPSess, buf, sizeof(buf)); else # endif state = recv(fdSess, buf, sizeof(buf), 0); if(state == 0) { # ifdef USE_GSSAPI - if(bEnableTCP == 2) + if(allowedMethods & ALLOWEDMETHOD_GSS) TCPSessGSSClose(iTCPSess); else { # endif @@ -5709,7 +5749,7 @@ static rsRetVal processSelectAfter(int maxfds, int nfds, fd_set *pReadfds, fd_se logerrorInt("TCP session %d will be closed, error ignored\n", fdSess); # ifdef USE_GSSAPI - if(bEnableTCP == 2) + if(allowedMethods & ALLOWEDMETHOD_GSS) TCPSessGSSClose(iTCPSess); else # endif @@ -5724,7 +5764,7 @@ static rsRetVal processSelectAfter(int maxfds, int nfds, fd_set *pReadfds, fd_se "previous messages for reason(s)\n", iTCPSess); # ifdef USE_GSSAPI - if(bEnableTCP == 2) + if(allowedMethods & ALLOWEDMETHOD_GSS) TCPSessGSSClose(iTCPSess); else # endif @@ -6039,6 +6079,11 @@ static void printVersion(void) #else printf("\tSYSLOG_INET (Internet/remote support):\tNo\n"); #endif +#if defined(SYSLOG_INET) && defined(USE_GSSAPI) + printf("\tFEATURE_GSSAPI (GSSAPI Kerberos 5 support):\tYes\n"); +#else + printf("\tFEATURE_GSSAPI (GSSAPI Kerberos 5 support):\tNo\n"); +#endif #ifndef NDEBUG printf("\tFEATURE_DEBUG (debug build, slow code):\tYes\n"); #else @@ -6182,8 +6227,9 @@ int main(int argc, char **argv) break; case 'g': /* enable tcp gssapi logging */ #if defined(SYSLOG_INET) && defined(USE_GSSAPI) - configureTCPListen(optarg); - bEnableTCP = 2; + if (!bEnableTCP) + configureTCPListen(optarg); + bEnableTCP |= ALLOWEDMETHOD_GSS; #else fprintf(stderr, "rsyslogd: -g not valid - not compiled with gssapi support"); #endif @@ -6241,7 +6287,9 @@ int main(int argc, char **argv) break; case 't': /* enable tcp logging */ #ifdef SYSLOG_INET - configureTCPListen(optarg); + if (!bEnableTCP) + configureTCPListen(optarg); + bEnableTCP |= ALLOWEDMETHOD_TCP; #else fprintf(stderr, "rsyslogd: -t not valid - not compiled with network support"); #endif |