/* omfwd.c * This is the implementation of the build-in forwarding output module. * * NOTE: read comments in module-template.h to understand how this file * works! * * File begun on 2007-07-20 by RGerhards (extracted from syslogd.c) * This file is under development and has not yet arrived at being fully * self-contained and a real object. So far, it is mostly an excerpt * of the "old" message code without any modifications. However, it * helps to have things at the right place one we go to the meat of it. * * Copyright 2007 Rainer Gerhards and Adiscon GmbH. * * This file is part of rsyslog. * * Rsyslog is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * Rsyslog is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with Rsyslog. If not, see . * * A copy of the GPL can be found in the file "COPYING" in this distribution. */ #include "config.h" #ifdef SYSLOG_INET #include "rsyslog.h" #include #include #include #include #include #include #include #include #include #include #include #include #ifdef USE_PTHREADS #include #else #include #endif #ifdef USE_GSSAPI #include #endif #include "syslogd.h" #include "syslogd-types.h" #include "srUtils.h" #include "net.h" #include "omfwd.h" #include "template.h" #include "msg.h" #include "tcpsyslog.h" #include "cfsysline.h" #include "module-template.h" #ifdef USE_GSSAPI #include "gss-misc.h" #endif #ifdef SYSLOG_INET #define INET_SUSPEND_TIME 60 /* equal to 1 minute * rgerhards, 2005-07-26: This was 3 minutes. As the * same timer is used for tcp based syslog, we have * reduced it. However, it might actually be worth * thinking about a buffered tcp sender, which would be * a much better alternative. When that happens, this * time here can be re-adjusted to 3 minutes (or, * even better, made configurable). */ #define INET_RETRY_MAX 30 /* maximum of retries for gethostbyname() */ /* was 10, changed to 30 because we reduced INET_SUSPEND_TIME by one third. So * this "fixes" some of implications of it (see comment on INET_SUSPEND_TIME). * rgerhards, 2005-07-26 */ #endif /* internal structures */ DEF_OMOD_STATIC_DATA typedef struct _instanceData { char f_hname[MAXHOSTNAMELEN+1]; short sock; /* file descriptor */ enum { /* TODO: we shoud revisit these definitions */ eDestFORW, eDestFORW_SUSP, eDestFORW_UNKN } eDestState; int iRtryCnt; struct addrinfo *f_addr; int compressionLevel; /* 0 - no compression, else level for zlib */ char *port; int protocol; TCPFRAMINGMODE tcp_framing; # define FORW_UDP 0 # define FORW_TCP 1 /* following fields for TCP-based delivery */ enum TCPSendStatus { TCP_SEND_NOTCONNECTED = 0, TCP_SEND_CONNECTING = 1, TCP_SEND_READY = 2 } status; char *savedMsg; int savedMsgLen; /* length of savedMsg in octets */ time_t ttSuspend; /* time selector was suspended */ # ifdef USE_PTHREADS pthread_mutex_t mtxTCPSend; # endif # ifdef USE_GSSAPI gss_ctx_id_t gss_context; OM_uint32 gss_flags; # endif } instanceData; #ifdef USE_GSSAPI static char *gss_base_service_name = NULL; static enum gss_mode_t { GSSMODE_NONE, GSSMODE_MIC, GSSMODE_ENC } gss_mode; #endif BEGINcreateInstance CODESTARTcreateInstance ENDcreateInstance BEGINisCompatibleWithFeature CODESTARTisCompatibleWithFeature if(eFeat == sFEATURERepeatedMsgReduction) iRet = RS_RET_OK; ENDisCompatibleWithFeature BEGINfreeInstance CODESTARTfreeInstance switch (pData->eDestState) { case eDestFORW: case eDestFORW_SUSP: freeaddrinfo(pData->f_addr); /* fall through */ case eDestFORW_UNKN: if(pData->port != NULL) free(pData->port); break; } # ifdef USE_PTHREADS /* delete any mutex objects, if present */ if(pData->protocol == FORW_TCP) { pthread_mutex_destroy(&pData->mtxTCPSend); } # endif # ifdef USE_GSSAPI if (gss_mode != GSSMODE_NONE) { OM_uint32 maj_stat, min_stat; if (pData->gss_context != GSS_C_NO_CONTEXT) { maj_stat = gss_delete_sec_context(&min_stat, pData->gss_context, GSS_C_NO_BUFFER); if (maj_stat != GSS_S_COMPLETE) display_status("deleting context", maj_stat, min_stat); } } /* this is meant to be done when module is unloaded, but since this module is static... */ if (gss_base_service_name != NULL) { free(gss_base_service_name); gss_base_service_name = NULL; } # endif ENDfreeInstance BEGINdbgPrintInstInfo CODESTARTdbgPrintInstInfo printf("%s", pData->f_hname); ENDdbgPrintInstInfo /* CODE FOR SENDING TCP MESSAGES */ /* get send status * rgerhards, 2005-10-24 */ static void TCPSendSetStatus(instanceData *pData, enum TCPSendStatus iNewState) { assert(pData != NULL); assert(pData->protocol == FORW_TCP); assert( (iNewState == TCP_SEND_NOTCONNECTED) || (iNewState == TCP_SEND_CONNECTING) || (iNewState == TCP_SEND_READY)); /* there can potentially be a race condition, so guard by mutex */ # ifdef USE_PTHREADS pthread_mutex_lock(&pData->mtxTCPSend); # endif pData->status = iNewState; # ifdef USE_PTHREADS pthread_mutex_unlock(&pData->mtxTCPSend); # endif } /* set send status * rgerhards, 2005-10-24 */ static enum TCPSendStatus TCPSendGetStatus(instanceData *pData) { enum TCPSendStatus eState; assert(pData != NULL); assert(pData->protocol == FORW_TCP); /* there can potentially be a race condition, so guard by mutex */ # ifdef USE_PTHREADS pthread_mutex_lock(&pData->mtxTCPSend); # endif eState = pData->status; # ifdef USE_PTHREADS pthread_mutex_unlock(&pData->mtxTCPSend); # endif return eState; } /* Initialize TCP sockets (for sender) * This is done once per selector line, if not yet initialized. */ static int TCPSendCreateSocket(instanceData *pData, struct addrinfo *addrDest) { int fd; struct addrinfo *r; assert(pData != NULL); r = addrDest; while(r != NULL) { fd = socket(r->ai_family, r->ai_socktype, r->ai_protocol); if (fd != -1) { /* We can not allow the TCP sender to block syslogd, at least * not in a single-threaded design. That would cause rsyslogd to * loose input messages - which obviously also would affect * other selector lines, too. So we do set it to non-blocking and * handle the situation ourselfs (by discarding messages). IF we run * dual-threaded, however, the situation is different: in this case, * the receivers and the selector line processing are only loosely * coupled via a memory buffer. Now, I think, we can afford the extra * wait time. Thus, we enable blocking mode for TCP if we compile with * pthreads. * rgerhards, 2005-10-25 */ # ifndef USE_PTHREADS /* set to nonblocking - rgerhards 2005-07-20 */ fcntl(fd, F_SETFL, fcntl(fd, F_GETFL) | O_NONBLOCK); # endif if (connect (fd, r->ai_addr, r->ai_addrlen) != 0) { if(errno == EINPROGRESS) { /* this is normal - will complete during select */ TCPSendSetStatus(pData, TCP_SEND_CONNECTING); return fd; } else { char errStr[1024]; dbgprintf("create tcp connection failed, reason %s", strerror_r(errno, errStr, sizeof(errStr))); } } else { TCPSendSetStatus(pData, TCP_SEND_READY); return fd; } close(fd); } else { char errStr[1024]; dbgprintf("couldn't create send socket, reason %s", strerror_r(errno, errStr, sizeof(errStr))); } r = r->ai_next; } dbgprintf("no working socket could be obtained"); return -1; } #ifdef USE_GSSAPI static int TCPSendGSSInit(instanceData *pData) { int s = -1; char *base; OM_uint32 maj_stat, min_stat, init_sec_min_stat, *sess_flags, ret_flags; gss_buffer_desc out_tok, in_tok; gss_buffer_t tok_ptr; gss_name_t target_name; gss_ctx_id_t *context; assert(pData != NULL); base = (gss_base_service_name == NULL) ? "host" : gss_base_service_name; out_tok.length = strlen(pData->f_hname) + strlen(base) + 2; if ((out_tok.value = malloc(out_tok.length)) == NULL) return -1; strcpy(out_tok.value, base); strcat(out_tok.value, "@"); strcat(out_tok.value, pData->f_hname); dbgprintf("GSS-API service name: %s\n", out_tok.value); tok_ptr = GSS_C_NO_BUFFER; context = &pData->gss_context; *context = GSS_C_NO_CONTEXT; maj_stat = gss_import_name(&min_stat, &out_tok, GSS_C_NT_HOSTBASED_SERVICE, &target_name); free(out_tok.value); out_tok.value = NULL; out_tok.length = 0; if (maj_stat != GSS_S_COMPLETE) { display_status("parsing name", maj_stat, min_stat); goto fail; } sess_flags = &pData->gss_flags; *sess_flags = GSS_C_MUTUAL_FLAG; if (gss_mode == GSSMODE_MIC) { *sess_flags |= GSS_C_INTEG_FLAG; } if (gss_mode == GSSMODE_ENC) { *sess_flags |= GSS_C_CONF_FLAG; } dbgprintf("GSS-API requested context flags:\n"); display_ctx_flags(*sess_flags); do { maj_stat = gss_init_sec_context(&init_sec_min_stat, GSS_C_NO_CREDENTIAL, context, target_name, GSS_C_NO_OID, *sess_flags, 0, NULL, tok_ptr, NULL, &out_tok, &ret_flags, NULL); if (tok_ptr != GSS_C_NO_BUFFER) free(in_tok.value); if (maj_stat != GSS_S_COMPLETE && maj_stat != GSS_S_CONTINUE_NEEDED) { display_status("initializing context", maj_stat, init_sec_min_stat); goto fail; } if (s == -1) if ((s = pData->sock = TCPSendCreateSocket(pData, pData->f_addr)) == -1) goto fail; if (out_tok.length != 0) { dbgprintf("GSS-API Sending init_sec_context token (length: %d)\n", out_tok.length); if (send_token(s, &out_tok) < 0) { goto fail; } } gss_release_buffer(&min_stat, &out_tok); if (maj_stat == GSS_S_CONTINUE_NEEDED) { dbgprintf("GSS-API Continue needed...\n"); if (recv_token(s, &in_tok) <= 0) { goto fail; } tok_ptr = &in_tok; } } while (maj_stat == GSS_S_CONTINUE_NEEDED); dbgprintf("GSS-API Provided context flags:\n"); *sess_flags = ret_flags; display_ctx_flags(*sess_flags); dbgprintf("GSS-API Context initialized\n"); gss_release_name(&min_stat, &target_name); return 0; fail: logerror("GSS-API Context initialization failed\n"); gss_release_name(&min_stat, &target_name); gss_release_buffer(&min_stat, &out_tok); if (*context != GSS_C_NO_CONTEXT) { gss_delete_sec_context(&min_stat, context, GSS_C_NO_BUFFER); *context = GSS_C_NO_CONTEXT; } if (s != -1) close(s); pData->sock = -1; return -1; } static int TCPSendGSSSend(instanceData *pData, char *msg, size_t len) { int s; gss_ctx_id_t *context; OM_uint32 maj_stat, min_stat; gss_buffer_desc in_buf, out_buf; assert(pData != NULL); assert(msg != NULL); assert(len > 0); s = pData->sock; context = &pData->gss_context; in_buf.value = msg; in_buf.length = len; maj_stat = gss_wrap(&min_stat, *context, (gss_mode == GSSMODE_ENC) ? 1 : 0, GSS_C_QOP_DEFAULT, &in_buf, NULL, &out_buf); if (maj_stat != GSS_S_COMPLETE) { display_status("wrapping message", maj_stat, min_stat); goto fail; } if (send_token(s, &out_buf) < 0) { goto fail; } gss_release_buffer(&min_stat, &out_buf); return 0; fail: close(s); pData->sock = -1; TCPSendSetStatus(pData, TCP_SEND_NOTCONNECTED); gss_delete_sec_context(&min_stat, context, GSS_C_NO_BUFFER); *context = GSS_C_NO_CONTEXT; gss_release_buffer(&min_stat, &out_buf); return -1; } #endif /* #ifdef USE_GSSAPI */ /* Sends a TCP message. It is first checked if the * session is open and, if not, it is opened. Then the send * is tried. If it fails, one silent re-try is made. If the send * fails again, an error status (-1) is returned. If all goes well, * 0 is returned. The TCP session is NOT torn down. * For now, EAGAIN is ignored (causing message loss) - but it is * hard to do something intelligent in this case. With this * implementation here, we can not block and/or defer. Things are * probably a bit better when we move to liblogging. The alternative * would be to enhance the current select server with buffering and * write descriptors. This seems not justified, given the expected * short life span of this code (and the unlikeliness of this event). * rgerhards 2005-07-06 * This function is now expected to stay. Libloging won't be used for * that purpose. I have added the param "len", because it is known by the * caller and so safes us some time. Also, it MUST be given because there * may be NULs inside msg so that we can not rely on strlen(). Please note * that the restrictions outlined above do not existin in multi-threaded * mode, which we assume will now be most often used. So there is no * real issue with the potential message loss in single-threaded builds. * rgerhards, 2006-11-30 * * In order to support compressed messages via TCP, we must support an * octet-counting based framing (LF may be part of the compressed message). * We are now supporting the same mode that is available in IETF I-D * syslog-transport-tls-05 (current at the time of this writing). This also * eases things when we go ahead and implement that framing. I have now made * available two cases where this framing is used: either by explitely * specifying it in the config file or implicitely when sending a compressed * message. In the later case, compressed and uncompressed messages within * the same session have different framings. If it is explicitely set to * octet-counting, only this framing mode is used within the session. * rgerhards, 2006-12-07 */ static int TCPSend(instanceData *pData, char *msg, size_t len) { int retry = 0; int done = 0; int bIsCompressed; int lenSend; char *buf = NULL; /* if this is non-NULL, it MUST be freed before return! */ enum TCPSendStatus eState; TCPFRAMINGMODE framingToUse; assert(pData != NULL); assert(msg != NULL); assert(len > 0); bIsCompressed = *msg == 'z'; /* cache this, so that we can modify the message buffer */ /* select framing for this record. If we have a compressed record, we always need to * use octet counting because the data potentially contains all control characters * including LF. */ framingToUse = bIsCompressed ? TCP_FRAMING_OCTET_COUNTING : pData->tcp_framing; do { /* try to send message */ if(pData->sock <= 0) { /* we need to open the socket first */ # ifdef USE_GSSAPI if(gss_mode != GSSMODE_NONE) { if(TCPSendGSSInit(pData) != 0) return -1; } else # endif if((pData->sock = TCPSendCreateSocket(pData, pData->f_addr)) <= 0) return -1; } eState = TCPSendGetStatus(pData); /* cache info */ if(eState == TCP_SEND_CONNECTING) { /* In this case, we save the buffer. If we have a * system with few messages, that hopefully prevents * message loss at all. However, we make no further attempts, * just the first message is saved. So we only try this * if there is not yet a saved message present. * rgerhards 2005-07-20 */ if(pData->savedMsg == NULL) { pData->savedMsg = malloc(len * sizeof(char)); if(pData->savedMsg == NULL) return 0; /* nothing we can do... */ memcpy(pData->savedMsg, msg, len); pData->savedMsgLen = len; } return 0; } else if(eState != TCP_SEND_READY) /* This here is debatable. For the time being, we * accept the loss of a single message (e.g. during * connection setup in favour of not messing with * wait time and timeouts. The reason is that such * things might otherwise cost us considerable message * loss on the receiving side (even at a timeout set * to just 1 second). - rgerhards 2005-07-20 */ return 0; /* now check if we need to add a line terminator. We need to * copy the string in memory in this case, this is probably * quicker than using writev and definitely quicker than doing * two socket calls. * rgerhards 2005-07-22 *//* * Some messages already contain a \n character at the end * of the message. We append one only if we there is not * already one. This seems the best fit, though this also * means the message does not arrive unaltered at the final * destination. But in the spirit of legacy syslog, this is * probably the best to do... * rgerhards 2005-07-20 */ /* Build frame based on selected framing */ if(framingToUse == TCP_FRAMING_OCTET_STUFFING) { if((*(msg+len-1) != '\n')) { if(buf != NULL) free(buf); /* in the malloc below, we need to add 2 to the length. The * reason is that we a) add one character and b) len does * not take care of the '\0' byte. Up until today, it was just * +1 , which caused rsyslogd to sometimes dump core. * I have added this comment so that the logic is not accidently * changed again. rgerhards, 2005-10-25 */ if((buf = malloc((len + 2) * sizeof(char))) == NULL) { /* extreme mem shortage, try to solve * as good as we can. No point in calling * any alarms, they might as well run out * of memory (the risk is very high, so we * do NOT risk that). If we have a message of * more than 1 byte (what I guess), we simply * overwrite the last character. * rgerhards 2005-07-22 */ if(len > 1) { *(msg+len-1) = '\n'; } else { /* we simply can not do anything in * this case (its an error anyhow...). */ } } else { /* we got memory, so we can copy the message */ memcpy(buf, msg, len); /* do not copy '\0' */ *(buf+len) = '\n'; *(buf+len+1) = '\0'; msg = buf; /* use new one */ ++len; /* care for the \n */ } } } else { /* Octect-Counting * In this case, we need to always allocate a buffer. This is because * we need to put a header in front of the message text */ char szLenBuf[16]; int iLenBuf; /* important: the printf-mask is "%d" because there must be a * space after the len! *//* The chairs of the IETF syslog-sec WG have announced that it is * consensus to do the octet count on the SYSLOG-MSG part only. I am * now changing the code to reflect this. Hopefully, it will not change * once again (there can no compatibility layer programmed for this). * To be on the save side, I just comment the code out. I mark these * comments with "IETF20061218". * rgerhards, 2006-12-19 */ iLenBuf = snprintf(szLenBuf, sizeof(szLenBuf)/sizeof(char), "%d ", (int) len); /* IETF20061218 iLenBuf = snprintf(szLenBuf, sizeof(szLenBuf)/sizeof(char), "%d ", len + iLenBuf);*/ if((buf = malloc((len + iLenBuf) * sizeof(char))) == NULL) { /* we are out of memory. This is an extreme situation. We do not * call any alarm handlers because they most likely run out of mem, * too. We are brave enough to call debug output, though. Other than * that, there is nothing left to do. We can not sent the message (as * in case of the other framing, because the message is incomplete. * We could, however, send two chunks (header and text separate), but * that would cause a lot of complexity in the code. So we think it * is appropriate enough to just make sure we do not crash in this * very unlikely case. For this, it is justified just to loose * the message. Rgerhards, 2006-12-07 */ dbgprintf("Error: out of memory when building TCP octet-counted " "frame. Message is lost, trying to continue.\n"); return 0; } memcpy(buf, szLenBuf, iLenBuf); /* header */ memcpy(buf + iLenBuf, msg, len); /* message */ len += iLenBuf; /* new message size */ msg = buf; /* set message buffer */ } /* frame building complete, on to actual sending */ # ifdef USE_GSSAPI if(gss_mode != GSSMODE_NONE) { if(TCPSendGSSSend(pData, msg, len) == 0) { if(buf != NULL) { free(buf); } return 0; } else { if(retry == 0) { ++retry; /* try to recover */ continue; } else { if(buf != NULL) free(buf); dbgprintf("message not (tcp)send"); return -1; } } } else { # endif lenSend = send(pData->sock, msg, len, 0); dbgprintf("TCP sent %d bytes, requested %d, msg: '%s'\n", lenSend, len, bIsCompressed ? "***compressed***" : msg); if((unsigned)lenSend == len) { /* all well */ if(buf != NULL) { free(buf); } return 0; } else if(lenSend != -1) { /* no real error, could "just" not send everything... * For the time being, we ignore this... * rgerhards, 2005-10-25 */ dbgprintf("message not completely (tcp)send, ignoring %d\n", lenSend); # if USE_PTHREADS usleep(1000); /* experimental - might be benefitial in this situation */ # endif if(buf != NULL) free(buf); return 0; } switch(errno) { case EMSGSIZE: dbgprintf("message not (tcp)send, too large\n"); /* This is not a real error, so it is not flagged as one */ if(buf != NULL) free(buf); return 0; break; case EINPROGRESS: case EAGAIN: dbgprintf("message not (tcp)send, would block\n"); # if USE_PTHREADS usleep(1000); /* experimental - might be benefitial in this situation */ # endif /* we loose this message, but that's better than loosing * all ;) */ /* This is not a real error, so it is not flagged as one */ if(buf != NULL) free(buf); return 0; break; default: dbgprintf("message not (tcp)send"); break; } if(retry == 0) { ++retry; /* try to recover */ close(pData->sock); TCPSendSetStatus(pData, TCP_SEND_NOTCONNECTED); pData->sock = -1; } else { if(buf != NULL) free(buf); return -1; } # ifdef USE_GSSAPI } # endif } while(!done); /* warning: do ... while() */ /*NOT REACHED*/ if(buf != NULL) free(buf); return -1; /* only to avoid compiler warning! */ } /* get the syslog forward port from selector_t. The passed in * struct must be one that is setup for forwarding. * rgerhards, 2007-06-28 * We may change the implementation to try to lookup the port * if it is unspecified. So far, we use the IANA default auf 514. */ static char *getFwdSyslogPt(instanceData *pData) { assert(pData != NULL); if(pData->port == NULL) return("514"); else return(pData->port); } /* try to resume connection if it is not ready * rgerhards, 2007-08-02 */ static rsRetVal doTryResume(instanceData *pData) { DEFiRet; struct addrinfo *res; struct addrinfo hints; unsigned e; switch (pData->eDestState) { case eDestFORW_SUSP: iRet = RS_RET_OK; /* the actual check happens during doAction() only */ pData->eDestState = eDestFORW; break; case eDestFORW_UNKN: /* The remote address is not yet known and needs to be obtained */ dbgprintf(" %s\n", pData->f_hname); memset(&hints, 0, sizeof(hints)); /* port must be numeric, because config file syntax requests this */ /* TODO: this code is a duplicate from cfline() - we should later create * a common function. */ hints.ai_flags = AI_NUMERICSERV; hints.ai_family = family; hints.ai_socktype = pData->protocol == FORW_UDP ? SOCK_DGRAM : SOCK_STREAM; if((e = getaddrinfo(pData->f_hname, getFwdSyslogPt(pData), &hints, &res)) == 0) { dbgprintf("%s found, resuming.\n", pData->f_hname); pData->f_addr = res; pData->iRtryCnt = 0; pData->eDestState = eDestFORW; } else { iRet = RS_RET_SUSPENDED; } break; case eDestFORW: /* rgerhards, 2007-09-11: this can not happen, but I've included it to * a) make the compiler happy, b) detect any logic errors */ assert(0); break; } return iRet; } BEGINtryResume CODESTARTtryResume iRet = doTryResume(pData); ENDtryResume BEGINdoAction char *psz; /* temporary buffering */ register unsigned l; struct addrinfo *r; int i; unsigned lsent = 0; int bSendSuccess; CODESTARTdoAction switch (pData->eDestState) { case eDestFORW_SUSP: dbgprintf("internal error in omfwd.c, eDestFORW_SUSP in doAction()!\n"); iRet = RS_RET_SUSPENDED; break; case eDestFORW_UNKN: dbgprintf("doAction eDestFORW_UNKN\n"); iRet = doTryResume(pData); break; case eDestFORW: dbgprintf(" %s:%s/%s\n", pData->f_hname, getFwdSyslogPt(pData), pData->protocol == FORW_UDP ? "udp" : "tcp"); if ( 0) // TODO: think about this strcmp(getHOSTNAME(f->f_pMsg), LocalHostName) && NoHops ) /* what we need to do is get the hostname as an additonal string (during parseSe..). Then, * we can compare that string to LocalHostName. That way, we do not need to access the * msgobject, and everything is clean. The question remains, though, if that functionality * here actually makes sense or not. If we really need it, it might make more sense to compare * the target IP address to the IP addresses of the local machene - that is a far better way of * handling things than to relay on the error-prone hostname property. * rgerhards, 2007-07-27 */ dbgprintf("Not sending message to remote.\n"); else { pData->ttSuspend = time(NULL); psz = (char*) ppString[0]; l = strlen((char*) psz); if (l > MAXLINE) l = MAXLINE; # ifdef USE_NETZIP /* Check if we should compress and, if so, do it. We also * check if the message is large enough to justify compression. * The smaller the message, the less likely is a gain in compression. * To save CPU cycles, we do not try to compress very small messages. * What "very small" means needs to be configured. Currently, it is * hard-coded but this may be changed to a config parameter. * rgerhards, 2006-11-30 */ if(pData->compressionLevel && (l > MIN_SIZE_FOR_COMPRESS)) { Bytef out[MAXLINE+MAXLINE/100+12] = "z"; uLongf destLen = sizeof(out) / sizeof(Bytef); uLong srcLen = l; int ret; ret = compress2((Bytef*) out+1, &destLen, (Bytef*) psz, srcLen, pData->compressionLevel); dbgprintf("Compressing message, length was %d now %d, return state %d.\n", l, (int) destLen, ret); if(ret != Z_OK) { /* if we fail, we complain, but only in debug mode * Otherwise, we are silent. In any case, we ignore the * failed compression and just sent the uncompressed * data, which is still valid. So this is probably the * best course of action. * rgerhards, 2006-11-30 */ dbgprintf("Compression failed, sending uncompressed message\n"); } else if(destLen+1 < l) { /* only use compression if there is a gain in using it! */ dbgprintf("there is gain in compression, so we do it\n"); psz = (char*) out; l = destLen + 1; /* take care for the "z" at message start! */ } ++destLen; } # endif if(pData->protocol == FORW_UDP) { /* forward via UDP */ if(finet != NULL) { /* we need to track if we have success sending to the remote * peer. Success is indicated by at least one sendto() call * succeeding. We track this be bSendSuccess. We can not simply * rely on lsent, as a call might initially work, but a later * call fails. Then, lsent has the error status, even though * the sendto() succeeded. * rgerhards, 2007-06-22 */ bSendSuccess = FALSE; for (r = pData->f_addr; r; r = r->ai_next) { for (i = 0; i < *finet; i++) { lsent = sendto(finet[i+1], psz, l, 0, r->ai_addr, r->ai_addrlen); if (lsent == l) { bSendSuccess = TRUE; break; } else { int eno = errno; char errStr[1024]; dbgprintf("sendto() error: %d = %s.\n", eno, strerror_r(eno, errStr, sizeof(errStr))); } } if (lsent == l && !send_to_all) break; } /* finished looping */ if (bSendSuccess == FALSE) { dbgprintf("error forwarding via udp, suspending\n"); iRet = RS_RET_SUSPENDED; } } } else { /* forward via TCP */ if(TCPSend(pData, psz, l) != 0) { /* error! */ dbgprintf("error forwarding via tcp, suspending\n"); pData->eDestState = eDestFORW_SUSP; iRet = RS_RET_SUSPENDED; } } } break; } ENDdoAction BEGINparseSelectorAct uchar *q; int i; int error; int bErr; struct addrinfo hints, *res; CODESTARTparseSelectorAct CODE_STD_STRING_REQUESTparseSelectorAct(1) if(*p == '@') { if((iRet = createInstance(&pData)) != RS_RET_OK) goto finalize_it; ++p; /* eat '@' */ if(*p == '@') { /* indicator for TCP! */ pData->protocol = FORW_TCP; ++p; /* eat this '@', too */ /* in this case, we also need a mutex... */ # ifdef USE_PTHREADS pthread_mutex_init(&pData->mtxTCPSend, 0); # endif } else { pData->protocol = FORW_UDP; } /* we are now after the protocol indicator. Now check if we should * use compression. We begin to use a new option format for this: * @(option,option)host:port * The first option defined is "z[0..9]" where the digit indicates * the compression level. If it is not given, 9 (best compression) is * assumed. An example action statement might be: * @@(z5,o)127.0.0.1:1400 * Which means send via TCP with medium (5) compresion (z) to the local * host on port 1400. The '0' option means that octet-couting (as in * IETF I-D syslog-transport-tls) is to be used for framing (this option * applies to TCP-based syslog only and is ignored when specified with UDP). * That is not yet implemented. * rgerhards, 2006-12-07 */ if(*p == '(') { /* at this position, it *must* be an option indicator */ do { ++p; /* eat '(' or ',' (depending on when called) */ /* check options */ if(*p == 'z') { /* compression */ # ifdef USE_NETZIP ++p; /* eat */ if(isdigit((int) *p)) { int iLevel; iLevel = *p - '0'; ++p; /* eat */ pData->compressionLevel = iLevel; } else { logerrorInt("Invalid compression level '%c' specified in " "forwardig action - NOT turning on compression.", *p); } # else logerror("Compression requested, but rsyslogd is not compiled " "with compression support - request ignored."); # endif /* #ifdef USE_NETZIP */ } else if(*p == 'o') { /* octet-couting based TCP framing? */ ++p; /* eat */ /* no further options settable */ pData->tcp_framing = TCP_FRAMING_OCTET_COUNTING; } else { /* invalid option! Just skip it... */ logerrorInt("Invalid option %c in forwarding action - ignoring.", *p); ++p; /* eat invalid option */ } /* the option processing is done. We now do a generic skip * to either the next option or the end of the option * block. */ while(*p && *p != ')' && *p != ',') ++p; /* just skip it */ } while(*p && *p == ','); /* Attention: do.. while() */ if(*p == ')') ++p; /* eat terminator, on to next */ else /* we probably have end of string - leave it for the rest * of the code to handle it (but warn the user) */ logerror("Option block not terminated in forwarding action."); } /* extract the host first (we do a trick - we replace the ';' or ':' with a '\0') * now skip to port and then template name. rgerhards 2005-07-06 */ for(q = p ; *p && *p != ';' && *p != ':' ; ++p) /* JUST SKIP */; pData->port = NULL; if(*p == ':') { /* process port */ uchar * tmp; *p = '\0'; /* trick to obtain hostname (later)! */ tmp = ++p; for(i=0 ; *p && isdigit((int) *p) ; ++p, ++i) /* SKIP AND COUNT */; pData->port = malloc(i + 1); if(pData->port == NULL) { logerror("Could not get memory to store syslog forwarding port, " "using default port, results may not be what you intend\n"); /* we leave f_forw.port set to NULL, this is then handled by * getFwdSyslogPt(). */ } else { memcpy(pData->port, tmp, i); *(pData->port + i) = '\0'; } } /* now skip to template */ bErr = 0; while(*p && *p != ';') { if(*p && *p != ';' && !isspace((int) *p)) { if(bErr == 0) { /* only 1 error msg! */ bErr = 1; errno = 0; logerror("invalid selector line (port), probably not doing " "what was intended"); } } ++p; } /* TODO: make this if go away! */ if(*p == ';') { *p = '\0'; /* trick to obtain hostname (later)! */ strcpy(pData->f_hname, (char*) q); *p = ';'; } else strcpy(pData->f_hname, (char*) q); /* process template */ if((iRet = cflineParseTemplateName(&p, *ppOMSR, 0, OMSR_NO_RQD_TPL_OPTS, (uchar*) " StdFwdFmt")) != RS_RET_OK) goto finalize_it; /* first set the pData->eDestState */ memset(&hints, 0, sizeof(hints)); /* port must be numeric, because config file syntax requests this */ hints.ai_flags = AI_NUMERICSERV; hints.ai_family = family; hints.ai_socktype = pData->protocol == FORW_UDP ? SOCK_DGRAM : SOCK_STREAM; if( (error = getaddrinfo(pData->f_hname, getFwdSyslogPt(pData), &hints, &res)) != 0) { pData->eDestState = eDestFORW_UNKN; pData->iRtryCnt = INET_RETRY_MAX; pData->ttSuspend = time(NULL); } else { pData->eDestState = eDestFORW; pData->f_addr = res; } /* * Otherwise the host might be unknown due to an * inaccessible nameserver (perhaps on the same * host). We try to get the ip number later, like * FORW_SUSP. */ } else { iRet = RS_RET_CONFLINE_UNPROCESSED; } /* TODO: do we need to call freeInstance if we failed - this is a general question for * all output modules. I'll address it lates as the interface evolves. rgerhards, 2007-07-25 */ CODE_STD_FINALIZERparseSelectorAct ENDparseSelectorAct BEGINneedUDPSocket CODESTARTneedUDPSocket iRet = RS_RET_TRUE; ENDneedUDPSocket BEGINonSelectReadyWrite CODESTARTonSelectReadyWrite dbgprintf("tcp send socket %d ready for writing.\n", pData->sock); TCPSendSetStatus(pData, TCP_SEND_READY); /* Send stored message (if any) */ if(pData->savedMsg != NULL) { if(TCPSend(pData, pData->savedMsg, pData->savedMsgLen) != 0) { /* error! */ pData->eDestState = eDestFORW_SUSP; errno = 0; logerror("error forwarding via tcp, suspending..."); } free(pData->savedMsg); pData->savedMsg = NULL; } ENDonSelectReadyWrite BEGINgetWriteFDForSelect CODESTARTgetWriteFDForSelect if( (pData->eDestState == eDestFORW) && (pData->protocol == FORW_TCP) && TCPSendGetStatus(pData) == TCP_SEND_CONNECTING) { *fd = pData->sock; iRet = RS_RET_OK; } ENDgetWriteFDForSelect BEGINmodExit CODESTARTmodExit ENDmodExit BEGINqueryEtryPt CODESTARTqueryEtryPt CODEqueryEtryPt_STD_OMOD_QUERIES ENDqueryEtryPt #ifdef USE_GSSAPI static rsRetVal setGSSMode(void *pVal, uchar *mode) { if (!strcmp((char *) mode, "none")) { gss_mode = GSSMODE_NONE; free(mode); dbgprintf("GSS-API gssmode set to GSSMODE_NONE\n"); } else if (!strcmp((char *) mode, "integrity")) { gss_mode = GSSMODE_MIC; free(mode); dbgprintf("GSS-API gssmode set to GSSMODE_MIC\n"); } else if (!strcmp((char *) mode, "encryption")) { gss_mode = GSSMODE_ENC; free(mode); dbgprintf("GSS-API gssmode set to GSSMODE_ENC\n"); } else { logerrorSz("unknown gssmode parameter: %s", (char *) mode); free(mode); return RS_RET_ERR; } return RS_RET_OK; } static rsRetVal resetConfigVariables(uchar __attribute__((unused)) *pp, void __attribute__((unused)) *pVal) { gss_mode = GSSMODE_NONE; if (gss_base_service_name != NULL) { free(gss_base_service_name); gss_base_service_name = NULL; } return RS_RET_OK; } #endif /* #ifdef USE_GSSAPI */ BEGINmodInit(Fwd) CODESTARTmodInit *ipIFVersProvided = 1; /* so far, we only support the initial definition */ CODEmodInit_QueryRegCFSLineHdlr # ifdef USE_GSSAPI CHKiRet(omsdRegCFSLineHdlr((uchar *)"gssforwardservicename", 0, eCmdHdlrGetWord, NULL, &gss_base_service_name, STD_LOADABLE_MODULE_ID)); CHKiRet(omsdRegCFSLineHdlr((uchar *)"gssmode", 0, eCmdHdlrGetWord, setGSSMode, &gss_mode, STD_LOADABLE_MODULE_ID)); CHKiRet(omsdRegCFSLineHdlr((uchar *)"resetconfigvariables", 1, eCmdHdlrCustomHandler, resetConfigVariables, NULL, STD_LOADABLE_MODULE_ID)); # endif ENDmodInit #endif /* #ifdef SYSLOG_INET */ /* * vi:set ai: */