This change fixes Bug 293879, where ereregex filters in syslogd
did not handle alternation correctly.

The issue appears to come from mixing up two different kinds of
flags: syslogd's internal serialized filter flags in
usr.sbin/syslogd/syslogd.h, and the regex compilation flags from
include/regex.h. ereregex was storing REG_EXTENDED in cmp_flags,
even though cmp_flags is meant to carry syslogd's own FILT_FLAG_*
values for configuration serialization and reconstruction.

REG_EXTENDED has the same bit value as FILT_FLAG_EXCLUDE, so the
filter could be reconstructed with the wrong semantics.

The fix stores FILT_FLAG_EXTENDED instead, allowing syslogd to
correctly REG_EXTENDED when compiling the regex.

A test was also added for both ereregex and !ereregex filters.

PR: 293879
Signed-off-by: tzyt <zyt2006613@outlook.com>
Fixes: 2567168dc4986
MFC after: 1 week
Reviewed-by: markj, ngie
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2088

Wordsmith mentions throughout the manual of syslog and dmesg, to clearly
differentiate them in an externally consisteny way, increasing operator
onboarding speed and elegance.

The daemon that handles general system messages, syslog, describes them
as "system messages", and "messages" is the standard filename. Rewrite
syslog related manual titles to align search results with this, and hier
entries to align the index. Use care to maintain keywords and not add
extra lines. Newsyslog trades "maintain" with "rotate" for visibility.

MFC after:	3 days
Reviewed by:	markj
Closes:		https://github.com/freebsd/freebsd-src/pull/2067

Normally, syslogd reacts only to SIGTERM, and ignores SIGINT and SIGQUIT
unless in debug mode.  Extend that to also apply when running in the
foreground.  Take this opportunity to comment the event loop.

MFC after:	1 week
Reviewed by:	jfree
Differential Revision:	https://reviews.freebsd.org/D55886

This fixes INET feature detection with kernel configs
that do not include the kern.conftxt sysctl, such as
riscv64 currently[0].

[0] https://ci.freebsd.org/view/Test/job/FreeBSD-main-riscv64-test/16514/testReport/usr.sbin.syslogd/syslogd_forwarded_format_test/O_flag_bsd_forwarded_legacy/

Reviewed by:	markj
Approved by:	emaste (mentor)
MFC after:	3 days
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D55383

Make parse_selector() print a warning to stderr and continue parsing the
config if it encounters an invalid facility or priority.  Note that
because the parsing is done from a casper service, there isn't a good
mechanism to log errors; the warnings are visible only when syslogd is
started in debug mode.

Reported by:	Doug Hardie <bc979@lafn.org>
MFC after:	1 week
Fixes:		f4b4a10abb26 ("syslogd: Move selector parsing into its own function")
Reviewed by:	jfree, jlduran, eugen, delphij
Differential Revision:	https://reviews.freebsd.org/D55033

syslogd_start() waits for the local log socket to appear before
returning, to ensure that the daemon is ready to handle log messages.
Some tests start two daemons, so by default the socket already exists
when the second daemon is started, so syslogd_start() returns early.
The test subsequently sends a message to this second daemon, which
sometimes isn't ready.

Define a separate log socket for the second daemon.  Add a check to
syslogd_start() to help catch this type of bug.

Reviewed by:	jlduran
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D54800

- In syslogd_start(), assign the lo0 address in the specified jail.
- Use the correct netmask.

Reviewed by:	jlduran
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D54799

I occasionally see failures in the syslogd test suite.  The problem is
that the tests are racy: they send a message using logger(1), then
immediately check whether the message was logged to a log file.  If the
syslogd instance under test doesn't get a chance to run before the
second step, the test fails.

This change reworks things to avoid the race while minimizing the amount
of time sleeping.
1) Each test uses a single logfile, so have them use a new common
   variable, SYSLOGD_LOGFILE, instead of something test-specific.
2) In syslogd_start(), if the configuration references SYSLOGD_LOGFILE,
   wait for it to be created by syslogd before returning.
3) Add a helper syslogd_check_log(), to check for a given log entry in
   the last line of SYSLOGD_LOGFILE, instead of using atf_check
   directly.
4) In syslogd_check_log(), poll the logfile until the desired log entry
   appears, or the test times out.

With this change, I was able to run the tests 1000 times in a loop with
4-way parallelism without seeing any test failures.  Without the change
I usually get a failure within 10 loops.

Reviewed by:	jlduran
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D54779

This is just for consistency with all other logger(1) invocations, which
happen from the syslogd_log() function.

No functional change intended.

Reviewed by:	jlduran
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D54778

Pipe actions spawn a process based on the command provided in the
syslogd configuration file. When a HUP signal is received, enter
the process into the deadq instead of immediately killing it.
This matches the behavior of syslogd prior to it being Capsicumized.

Fixes: d2d180fb7736