1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
|
/* omfwd.c
* This is the implementation of the build-in forwarding output module.
*
* File begun on 2007-07-20 by RGerhards (extracted from syslogd.c)
* This file is under development and has not yet arrived at being fully
* self-contained and a real object. So far, it is mostly an excerpt
* of the "old" message code without any modifications. However, it
* helps to have things at the right place one we go to the meat of it.
*
* Copyright 2007 Rainer Gerhards and Adiscon GmbH.
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
*
* A copy of the GPL can be found in the file "COPYING" in this distribution.
*/
#include "config.h"
#ifdef SYSLOG_INET
#include <stdio.h>
#include <stdarg.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <netinet/in.h>
#include <netdb.h>
#include <fnmatch.h>
#include <assert.h>
#include <errno.h>
#include "rsyslog.h"
#include "syslogd.h"
#include "syslogd-types.h"
#include "srUtils.h"
#include "net.h"
#include "omfwd.h"
#include "template.h"
#include "msg.h"
#include "tcpsyslog.h"
/*
* This table contains plain text for h_errno errors used by the
* net subsystem.
*/
static const char *sys_h_errlist[] = {
"No problem", /* NETDB_SUCCESS */
"Authoritative answer: host not found", /* HOST_NOT_FOUND */
"Non-authoritative answer: host not found, or serverfail", /* TRY_AGAIN */
"Non recoverable errors", /* NO_RECOVERY */
"Valid name, no data record of requested type", /* NO_DATA */
"no address, look for MX record" /* NO_ADDRESS */
};
/* call the shell action
* returns 0 if it succeeds, something else otherwise
*/
int doActionFwd(selector_t *f)
{
char *psz; /* temporary buffering */
register unsigned l;
int i;
unsigned e, lsent = 0;
int bSendSuccess;
time_t fwd_suspend;
struct addrinfo *res, *r;
struct addrinfo hints;
assert(f != NULL);
switch (f->f_type) {
case F_FORW_SUSP:
fwd_suspend = time(NULL) - f->f_un.f_forw.ttSuspend;
if ( fwd_suspend >= INET_SUSPEND_TIME ) {
dprintf("\nForwarding suspension over, retrying FORW ");
f->f_type = F_FORW;
goto f_forw;
}
else {
dprintf(" %s\n", f->f_un.f_forw.f_hname);
dprintf("Forwarding suspension not over, time left: %d.\n",
INET_SUSPEND_TIME - fwd_suspend);
}
break;
/* The trick is to wait some time, then retry to get the
* address. If that fails retry x times and then give up.
*
* You'll run into this problem mostly if the name server you
* need for resolving the address is on the same machine, but
* is started after syslogd.
*/
case F_FORW_UNKN:
/* The remote address is not yet known and needs to be obtained */
dprintf(" %s\n", f->f_un.f_forw.f_hname);
fwd_suspend = time(NULL) - f->f_un.f_forw.ttSuspend;
if(fwd_suspend >= INET_SUSPEND_TIME) {
dprintf("Forwarding suspension to unknown over, retrying\n");
memset(&hints, 0, sizeof(hints));
/* port must be numeric, because config file syntax requests this */
/* TODO: this code is a duplicate from cfline() - we should later create
* a common function.
*/
hints.ai_flags = AI_NUMERICSERV;
hints.ai_family = family;
hints.ai_socktype = f->f_un.f_forw.protocol == FORW_UDP ? SOCK_DGRAM : SOCK_STREAM;
if((e = getaddrinfo(f->f_un.f_forw.f_hname,
getFwdSyslogPt(f), &hints, &res)) != 0) {
dprintf("Failure: %s\n", sys_h_errlist[h_errno]);
dprintf("Retries: %d\n", f->f_prevcount);
if ( --f->f_prevcount < 0 ) {
dprintf("Giving up.\n");
f->f_type = F_UNUSED;
}
else
dprintf("Left retries: %d\n", f->f_prevcount);
}
else {
dprintf("%s found, resuming.\n", f->f_un.f_forw.f_hname);
f->f_un.f_forw.f_addr = res;
f->f_prevcount = 0;
f->f_type = F_FORW;
goto f_forw;
}
}
else
dprintf("Forwarding suspension not over, time " \
"left: %d\n", INET_SUSPEND_TIME - fwd_suspend);
break;
case F_FORW:
f_forw:
dprintf(" %s:%s/%s\n", f->f_un.f_forw.f_hname, getFwdSyslogPt(f),
f->f_un.f_forw.protocol == FORW_UDP ? "udp" : "tcp");
iovCreate(f);
if ( strcmp(getHOSTNAME(f->f_pMsg), LocalHostName) && NoHops )
dprintf("Not sending message to remote.\n");
else {
f->f_un.f_forw.ttSuspend = time(NULL);
psz = iovAsString(f);
l = f->f_iLenpsziov;
if (l > MAXLINE)
l = MAXLINE;
# ifdef USE_NETZIP
/* Check if we should compress and, if so, do it. We also
* check if the message is large enough to justify compression.
* The smaller the message, the less likely is a gain in compression.
* To save CPU cycles, we do not try to compress very small messages.
* What "very small" means needs to be configured. Currently, it is
* hard-coded but this may be changed to a config parameter.
* rgerhards, 2006-11-30
*/
if(f->f_un.f_forw.compressionLevel && (l > MIN_SIZE_FOR_COMPRESS)) {
Bytef out[MAXLINE+MAXLINE/100+12] = "z";
uLongf destLen = sizeof(out) / sizeof(Bytef);
uLong srcLen = l;
int ret;
ret = compress2((Bytef*) out+1, &destLen, (Bytef*) psz,
srcLen, f->f_un.f_forw.compressionLevel);
dprintf("Compressing message, length was %d now %d, return state %d.\n",
l, (int) destLen, ret);
if(ret != Z_OK) {
/* if we fail, we complain, but only in debug mode
* Otherwise, we are silent. In any case, we ignore the
* failed compression and just sent the uncompressed
* data, which is still valid. So this is probably the
* best course of action.
* rgerhards, 2006-11-30
*/
dprintf("Compression failed, sending uncompressed message\n");
} else if(destLen+1 < l) {
/* only use compression if there is a gain in using it! */
dprintf("there is gain in compression, so we do it\n");
psz = (char*) out;
l = destLen + 1; /* take care for the "z" at message start! */
}
++destLen;
}
# endif
if(f->f_un.f_forw.protocol == FORW_UDP) {
/* forward via UDP */
if(finet != NULL) {
/* we need to track if we have success sending to the remote
* peer. Success is indicated by at least one sendto() call
* succeeding. We track this be bSendSuccess. We can not simply
* rely on lsent, as a call might initially work, but a later
* call fails. Then, lsent has the error status, even though
* the sendto() succeeded.
* rgerhards, 2007-06-22
*/
bSendSuccess = FALSE;
for (r = f->f_un.f_forw.f_addr; r; r = r->ai_next) {
for (i = 0; i < *finet; i++) {
lsent = sendto(finet[i+1], psz, l, 0,
r->ai_addr, r->ai_addrlen);
if (lsent == l) {
bSendSuccess = TRUE;
break;
} else {
int eno = errno;
dprintf("sendto() error: %d = %s.\n",
eno, strerror(eno));
}
}
if (lsent == l && !send_to_all)
break;
}
/* finished looping */
if (bSendSuccess == FALSE) {
f->f_type = F_FORW_SUSP;
errno = 0;
logerror("error forwarding via udp, suspending");
}
}
} else {
/* forward via TCP */
if(TCPSend(f, psz, l) != 0) {
/* error! */
f->f_type = F_FORW_SUSP;
errno = 0;
logerror("error forwarding via tcp, suspending...");
}
}
}
break;
}
return 0;
}
#endif /* #ifdef SYSLOG_INET */
/*
* vi:set ai:
*/
|
