This change fixes Bug 293879, where ereregex filters in syslogd
did not handle alternation correctly.

The issue appears to come from mixing up two different kinds of
flags: syslogd's internal serialized filter flags in
usr.sbin/syslogd/syslogd.h, and the regex compilation flags from
include/regex.h. ereregex was storing REG_EXTENDED in cmp_flags,
even though cmp_flags is meant to carry syslogd's own FILT_FLAG_*
values for configuration serialization and reconstruction.

REG_EXTENDED has the same bit value as FILT_FLAG_EXCLUDE, so the
filter could be reconstructed with the wrong semantics.

The fix stores FILT_FLAG_EXTENDED instead, allowing syslogd to
correctly REG_EXTENDED when compiling the regex.

A test was also added for both ereregex and !ereregex filters.

PR: 293879
Signed-off-by: tzyt <zyt2006613@outlook.com>
Fixes: 2567168dc4986
MFC after: 1 week
Reviewed-by: markj, ngie
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2088

syslogd_start() waits for the local log socket to appear before
returning, to ensure that the daemon is ready to handle log messages.
Some tests start two daemons, so by default the socket already exists
when the second daemon is started, so syslogd_start() returns early.
The test subsequently sends a message to this second daemon, which
sometimes isn't ready.

Define a separate log socket for the second daemon.  Add a check to
syslogd_start() to help catch this type of bug.

Reviewed by:	jlduran
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D54800

- In syslogd_start(), assign the lo0 address in the specified jail.
- Use the correct netmask.

Reviewed by:	jlduran
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D54799

I occasionally see failures in the syslogd test suite.  The problem is
that the tests are racy: they send a message using logger(1), then
immediately check whether the message was logged to a log file.  If the
syslogd instance under test doesn't get a chance to run before the
second step, the test fails.

This change reworks things to avoid the race while minimizing the amount
of time sleeping.
1) Each test uses a single logfile, so have them use a new common
   variable, SYSLOGD_LOGFILE, instead of something test-specific.
2) In syslogd_start(), if the configuration references SYSLOGD_LOGFILE,
   wait for it to be created by syslogd before returning.
3) Add a helper syslogd_check_log(), to check for a given log entry in
   the last line of SYSLOGD_LOGFILE, instead of using atf_check
   directly.
4) In syslogd_check_log(), poll the logfile until the desired log entry
   appears, or the test times out.

With this change, I was able to run the tests 1000 times in a loop with
4-way parallelism without seeing any test failures.  Without the change
I usually get a failure within 10 loops.

Reviewed by:	jlduran
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D54779

This is just for consistency with all other logger(1) invocations, which
happen from the syslogd_log() function.

No functional change intended.

Reviewed by:	jlduran
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D54778

Pipe actions spawn a process based on the command provided in the
syslogd configuration file. When a HUP signal is received, enter
the process into the deadq instead of immediately killing it.
This matches the behavior of syslogd prior to it being Capsicumized.

Fixes: d2d180fb7736

Take a cue from vnet.subr and abstract module loading, jail creation and
cleanup.

Note that the way jails are created differs slightly from vnet.subr, to
maintain the current style of the tests.

Reported by:	Jenkins
Reviewed by:	markj
Approved by:	emaste (mentor)
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D48949

Prior to commit 4ecbee2760f7, syslogd used its listening socket(s) to
forward messages to remote hosts, when so configured.  As a consequence,
they are sent from the address+port to which those sockets are bound,
typically 0.0.0.0:514.

When in capability mode, sendto() is not permitted, so we instead
pre-create sockets and connect them to the forwarding addresses, letting
the kernel pick an ephemeral source port.  However, this doesn't match
syslogd's previous behaviour, breaking some setups.

So, restore the old behaviour by binding forwarding sockets to the
addresses on which syslogd is listening.  Since we cannot use the same
sockets for receiving messages and also for forwarding them, use
SO_REUSEPORT to enable duplicate bindings to port 514, relying on the
existing behaviour that the first socket bound to that port is the one
that actually receives messages.

Add some regression tests to cover this and related functionality of
syslogd's -a option.

Reviewed by:	jfree
Reported by:	Michael Butler <imb@protected-networks.net>
Fixes:		4ecbee2760f7 ("syslogd: Open forwarding socket descriptors")
Differential Revision:	https://reviews.freebsd.org/D48222

RFC 3164 and RFC 5424 syslog message format tests and minor refactor of
existing tests to reuse components in new tests.

Reviewed by:	markj
MFC after:	3 weeks
Pull Request:	https://github.com/freebsd/freebsd-src/pull/1536

The basic case previously tested if messages are correctly logged over
UNIX, INET, and INET6 transport. This single case can be split up into
three separate cases to decrease code complexity and offer more granular
results.

Both INET and INET6 cases will be skipped if the kernel does not
support the corresponding transport.

Reviewed by:	zlei, markj
Differential Revision:	https://reviews.freebsd.org/D47650