jimzah/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src.git synced 2024-11-26 20:12:44 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

syslogd: Add rfc3164-strict format option

Browse Source 
The syslogd bsd/rfc3164 message format does not strictly conform to the
format recommended in RFC 3164 when syslog messages are forwarded from
remote hosts.

The new strict/rfc3164-strict format generates messages that conform
with the RFC 3164 recommended format. The existing format is maintained
for backwards compatibility.

PR: 220246
This commit is contained in:
Michal Scigocki 2024-11-19 07:10:34 +00:00
parent 00bdc8bba0
commit 2fd46ebde9
5 changed files with 169 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
usr.sbin/syslogd/syslogd.8
View File

@ -269,14 +269,23 @@ The values
.Ar bsd
and
.Ar rfc3164
are used to generate RFC 3164 log messages.
are used to generate legacy RFC 3164 log messages.
The values
.Ar strict
and
.Ar rfc3164-strict
are used to generate log messages using the RFC 3164 recommended format,
where messages sent over the network include the hostname,
and messages forwarded by a relay exclude the
.Dq Forwarded from
field.
The values
.Ar syslog
and
.Ar rfc5424
are used to generate RFC 5424 log messages,
having RFC 3339 timestamps with microsecond precision.
The default is to generate RFC 3164 log messages.
The default is to generate legacy RFC 3164 log messages.
.It Fl o
Prefix kernel messages with the full kernel boot file as determined by
.Xr getbootfile 3 .

12
usr.sbin/syslogd/syslogd.c
View File

@ -421,6 +421,7 @@ static bool KeepKernFac; /* Keep remotely logged kernel facility */
static bool needdofsync = true; /* Are any file(s) waiting to be fsynced? */
static struct pidfh *pfh;
static bool RFC3164OutputFormat = true; /* Use legacy format by default. */
static bool RFC3164OutputFormatStrict = false; /* Use recommended format. */
struct iovlist;
@ -730,7 +731,11 @@ main(int argc, char *argv[])
else if (strcmp(optarg, "syslog") == 0 ||
strcmp(optarg, "rfc5424") == 0)
RFC3164OutputFormat = false;
else
else if (strcmp(optarg, "strict") == 0 ||
strcmp(optarg, "rfc3164-strict") == 0) {
RFC3164OutputFormat = true;
RFC3164OutputFormatStrict = true;
} else
usage();
break;
case 'o':
@ -2061,7 +2066,10 @@ fprintlog_rfc3164(struct filed *f, const char *hostname, const char *app_name,
iovlist_append(&il, priority_number);
iovlist_append(&il, ">");
iovlist_append(&il, timebuf);
if (strcasecmp(hostname, LocalHostName) != 0) {
if (RFC3164OutputFormatStrict) {
iovlist_append(&il, " ");
iovlist_append(&il, hostname);
} else if (strcasecmp(hostname, LocalHostName) != 0) {
iovlist_append(&il, " Forwarded from ");
iovlist_append(&il, hostname);
iovlist_append(&il, ":");

42
usr.sbin/syslogd/tests/syslogd_basic_format_test.sh
View File

@ -77,6 +77,46 @@ O_flag_rfc3164_basic_cleanup()
syslogd_stop_by_ref "${SERVER_REF}"
}
atf_test_case "O_flag_strict_basic" "cleanup"
O_flag_strict_basic_head()
{
atf_set descr "strict format test on local syslog message"
atf_set require.progs "logger"
}
O_flag_strict_basic_body()
{
local format="strict"
local logfile="${PWD}/O_flag_${format}_basic.log"
setup_basic_format_test "${format}" "${logfile}"
atf_check -s exit:0 -o match:"${REGEX_RFC3164_LOGFILE}" cat "${logfile}"
}
O_flag_strict_basic_cleanup()
{
syslogd_stop_by_ref "${SERVER_REF}"
}
atf_test_case "O_flag_rfc3164strict_basic" "cleanup"
O_flag_rfc3164strict_basic_head()
{
atf_set descr "rfc3164-strict format test on local syslog message"
atf_set require.progs "logger"
}
O_flag_rfc3164strict_basic_body()
{
local format="rfc3164-strict"
local logfile="${PWD}/O_flag_${format}_basic.log"
setup_basic_format_test "${format}" "${logfile}"
atf_check -s exit:0 -o match:"${REGEX_RFC3164_LOGFILE}" cat "${logfile}"
}
O_flag_rfc3164strict_basic_cleanup()
{
syslogd_stop_by_ref "${SERVER_REF}"
}
atf_test_case "O_flag_syslog_basic" "cleanup"
O_flag_syslog_basic_head()
{
@ -121,6 +161,8 @@ atf_init_test_cases()
{
atf_add_test_case "O_flag_bsd_basic"
atf_add_test_case "O_flag_rfc3164_basic"
atf_add_test_case "O_flag_strict_basic"
atf_add_test_case "O_flag_rfc3164strict_basic"
atf_add_test_case "O_flag_syslog_basic"
atf_add_test_case "O_flag_rfc5424_basic"
}

52
usr.sbin/syslogd/tests/syslogd_forwarded_format_test.sh
View File

@ -92,6 +92,56 @@ O_flag_rfc3164_forwarded_cleanup()
"${SYSLOGD_UDP_PORT_2}"
}
atf_test_case "O_flag_strict_forwarded" "cleanup"
O_flag_strict_forwarded_head()
{
atf_set descr "strict format test on a forwarded syslog message"
set_common_atf_metadata
}
O_flag_strict_forwarded_body()
{
local format="strict"
local logfile="${PWD}/${format}_forwarded.log"
local pcapfile="${PWD}/${format}_forwarded.pcap"
setup_forwarded_format_test "${format}" "${logfile}" "${pcapfile}"
atf_check -s exit:0 -o match:"${REGEX_RFC3164_LOGFILE}" cat "${logfile}"
atf_check -s exit:0 -e ignore -o match:"${REGEX_RFC3164_PAYLOAD}" \
tcpdump -A -r "${pcapfile}"
}
O_flag_strict_forwarded_cleanup()
{
syslogd_stop_on_ports \
"${SYSLOGD_UDP_PORT_1}" \
"${SYSLOGD_UDP_PORT_2}"
}
atf_test_case "O_flag_rfc3164strict_forwarded" "cleanup"
O_flag_rfc3164strict_forwarded_head()
{
atf_set descr "rfc3164-strict format test on a forwarded syslog message"
set_common_atf_metadata
}
O_flag_rfc3164strict_forwarded_body()
{
local format="rfc3164-strict"
local logfile="${PWD}/${format}_forwarded.log"
local pcapfile="${PWD}/${format}_forwarded.pcap"
setup_forwarded_format_test "${format}" "${logfile}" "${pcapfile}"
atf_check -s exit:0 -o match:"${REGEX_RFC3164_LOGFILE}" cat "${logfile}"
atf_check -s exit:0 -e ignore -o match:"${REGEX_RFC3164_PAYLOAD}" \
tcpdump -A -r "${pcapfile}"
}
O_flag_rfc3164strict_forwarded_cleanup()
{
syslogd_stop_on_ports \
"${SYSLOGD_UDP_PORT_1}" \
"${SYSLOGD_UDP_PORT_2}"
}
atf_test_case "O_flag_syslog_forwarded" "cleanup"
O_flag_syslog_forwarded_head()
{
@ -203,6 +253,8 @@ atf_init_test_cases()
{
atf_add_test_case "O_flag_bsd_forwarded"
atf_add_test_case "O_flag_rfc3164_forwarded"
atf_add_test_case "O_flag_strict_forwarded"
atf_add_test_case "O_flag_rfc3164strict_forwarded"
atf_add_test_case "O_flag_syslog_forwarded"
atf_add_test_case "O_flag_rfc5424_forwarded"

54
usr.sbin/syslogd/tests/syslogd_relayed_format_test.sh
View File

@ -97,6 +97,58 @@ O_flag_rfc3164_relayed_cleanup()
"${SYSLOGD_UDP_PORT_3}"
}
atf_test_case "O_flag_strict_relayed" "cleanup"
O_flag_strict_relayed_head()
{
atf_set descr "strict format test on a relayed syslog message"
set_common_atf_metadata
}
O_flag_strict_relayed_body()
{
local format="strict"
local logfile="${PWD}/${format}_relayed.log"
local pcapfile="${PWD}/${format}_relayed.pcap"
setup_relayed_format_test "${format}" "${logfile}" "${pcapfile}"
atf_check -s exit:0 -o match:"${REGEX_RFC3164_LOGFILE}" cat "${logfile}"
atf_check -s exit:0 -e ignore -o match:"${REGEX_RFC3164_PAYLOAD}" \
tcpdump -A -r "${pcapfile}"
}
O_flag_strict_relayed_cleanup()
{
syslogd_stop_on_ports \
"${SYSLOGD_UDP_PORT_1}" \
"${SYSLOGD_UDP_PORT_2}" \
"${SYSLOGD_UDP_PORT_3}"
}
atf_test_case "O_flag_rfc3164strict_relayed" "cleanup"
O_flag_rfc3164strict_relayed_head()
{
atf_set descr "rfc3164-strict format test on a relayed syslog message"
set_common_atf_metadata
}
O_flag_rfc3164strict_relayed_body()
{
local format="rfc3164-strict"
local logfile="${PWD}/${format}_relayed.log"
local pcapfile="${PWD}/${format}_relayed.pcap"
setup_relayed_format_test "${format}" "${logfile}" "${pcapfile}"
atf_check -s exit:0 -o match:"${REGEX_RFC3164_LOGFILE}" cat "${logfile}"
atf_check -s exit:0 -e ignore -o match:"${REGEX_RFC3164_PAYLOAD}" \
tcpdump -A -r "${pcapfile}"
}
O_flag_rfc3164strict_relayed_cleanup()
{
syslogd_stop_on_ports \
"${SYSLOGD_UDP_PORT_1}" \
"${SYSLOGD_UDP_PORT_2}" \
"${SYSLOGD_UDP_PORT_3}"
}
atf_test_case "O_flag_syslog_relayed" "cleanup"
O_flag_syslog_relayed_head()
{
@ -153,6 +205,8 @@ atf_init_test_cases()
{
atf_add_test_case "O_flag_bsd_relayed"
atf_add_test_case "O_flag_rfc3164_relayed"
atf_add_test_case "O_flag_strict_relayed"
atf_add_test_case "O_flag_rfc3164strict_relayed"
atf_add_test_case "O_flag_syslog_relayed"
atf_add_test_case "O_flag_rfc5424_relayed"
}