Reviewed by:	jfree, kib
MFC after:	3 weeks
Differential Revision:	https://reviews.freebsd.org/D58160

Since syslogd was converted to run in a Capsicum sandbox, it needs to
explicitly connect() its forwarding sockets rather than using sendmsg().
At the time syslogd starts during boot, some of its forwarding
destinations may not be routable, in which case connect() fails.

Fix this by making connect() failures non-fatal, and use cap_net to
lazily connect sockets once something actually tries logging to the
destination.

Add a regression test.

Reported by:	ae
Reviewed by:	ae
Discussed with:	jfree
Fixes:		4ecbee2760f7 ("syslogd: Open forwarding socket descriptors")
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D57394

* Instead of an error string, return the usual 0 or -1 and let the caller
  figure out what, if anything, to tell the user.

* Avoid string manipulations by opening /dev first and using openat()
  with O_RESOLVE_BENEATH.

* Add a boolean argument which, if false, causes ttymsg() to return
  without sending the message if the tty's group-writable bit is not
  set.  This saves programs that respect this setting (like syslogd(8))
  from having to check before calling ttymsg().

* Update all callers.

The observable effect of this change is minimal except for slightly
different error messages when ttymsg() fails.  However, syslogd(8) will
no longer print spurious error messages on the console after trying and
failing to write a log message to an X11 session.

PR:		295171
MFC after:	1 week
Reviewed by:	jfree, markj
Differential Revision:	https://reviews.freebsd.org/D57018

nvlist_take_string_array(9) takes ownership of the array and its
strings. casper_ttymsg() freed neither, leaking memory on every
F_CONSOLE and F_TTY message. On long-running systems with high
error-rate syslog traffic routed to /dev/console, syslogd.casper grew
to hundreds of MB.

Use nvlist_get_string_array(9) to borrow the array instead. Update
casper_wallmsg() similarly.

Approved by:    src (des)
Closes:         https://github.com/freebsd/freebsd-src/pull/2222
Fixes:          61a29eca550b ("syslogd: Log messages using libcasper")
MFC after:      3 days
MFC to:         stable/15
PR:             295488
Reported by:    Pat Maddox <pat@patmaddox.com>
Reviewed by:    markj
Tested by:      dch

This change fixes Bug 293879, where ereregex filters in syslogd
did not handle alternation correctly.

The issue appears to come from mixing up two different kinds of
flags: syslogd's internal serialized filter flags in
usr.sbin/syslogd/syslogd.h, and the regex compilation flags from
include/regex.h. ereregex was storing REG_EXTENDED in cmp_flags,
even though cmp_flags is meant to carry syslogd's own FILT_FLAG_*
values for configuration serialization and reconstruction.

REG_EXTENDED has the same bit value as FILT_FLAG_EXCLUDE, so the
filter could be reconstructed with the wrong semantics.

The fix stores FILT_FLAG_EXTENDED instead, allowing syslogd to
correctly REG_EXTENDED when compiling the regex.

A test was also added for both ereregex and !ereregex filters.

PR: 293879
Signed-off-by: tzyt <zyt2006613@outlook.com>
Fixes: 2567168dc4986
MFC after: 1 week
Reviewed-by: markj, ngie
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2088

Wordsmith mentions throughout the manual of syslog and dmesg, to clearly
differentiate them in an externally consisteny way, increasing operator
onboarding speed and elegance.

The daemon that handles general system messages, syslog, describes them
as "system messages", and "messages" is the standard filename. Rewrite
syslog related manual titles to align search results with this, and hier
entries to align the index. Use care to maintain keywords and not add
extra lines. Newsyslog trades "maintain" with "rotate" for visibility.

MFC after:	3 days
Reviewed by:	markj
Closes:		https://github.com/freebsd/freebsd-src/pull/2067

Normally, syslogd reacts only to SIGTERM, and ignores SIGINT and SIGQUIT
unless in debug mode.  Extend that to also apply when running in the
foreground.  Take this opportunity to comment the event loop.

MFC after:	1 week
Reviewed by:	jfree
Differential Revision:	https://reviews.freebsd.org/D55886

This fixes INET feature detection with kernel configs
that do not include the kern.conftxt sysctl, such as
riscv64 currently[0].

[0] https://ci.freebsd.org/view/Test/job/FreeBSD-main-riscv64-test/16514/testReport/usr.sbin.syslogd/syslogd_forwarded_format_test/O_flag_bsd_forwarded_legacy/

Reviewed by:	markj
Approved by:	emaste (mentor)
MFC after:	3 days
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D55383

Make parse_selector() print a warning to stderr and continue parsing the
config if it encounters an invalid facility or priority.  Note that
because the parsing is done from a casper service, there isn't a good
mechanism to log errors; the warnings are visible only when syslogd is
started in debug mode.

Reported by:	Doug Hardie <bc979@lafn.org>
MFC after:	1 week
Fixes:		f4b4a10abb26 ("syslogd: Move selector parsing into its own function")
Reviewed by:	jfree, jlduran, eugen, delphij
Differential Revision:	https://reviews.freebsd.org/D55033

syslogd_start() waits for the local log socket to appear before
returning, to ensure that the daemon is ready to handle log messages.
Some tests start two daemons, so by default the socket already exists
when the second daemon is started, so syslogd_start() returns early.
The test subsequently sends a message to this second daemon, which
sometimes isn't ready.

Define a separate log socket for the second daemon.  Add a check to
syslogd_start() to help catch this type of bug.

Reviewed by:	jlduran
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D54800