|
|
|
|
#include <stdarg.h>
|
|
|
|
|
#include <sys/socket.h>
|
|
|
|
|
#include <stdio.h>
|
|
|
|
|
#include <unistd.h>
|
|
|
|
|
#include <syslog.h>
|
|
|
|
|
#include <time.h>
|
|
|
|
|
#include <signal.h>
|
|
|
|
|
#include <string.h>
|
|
|
|
|
#include <pthread.h>
|
|
|
|
|
#include <errno.h>
|
|
|
|
|
#include <fcntl.h>
|
|
|
|
|
#include "libc.h"
|
|
|
|
|
|
make all objects used with atomic operations volatile
the memory model we use internally for atomics permits plain loads of
values which may be subject to concurrent modification without
requiring that a special load function be used. since a compiler is
free to make transformations that alter the number of loads or the way
in which loads are performed, the compiler is theoretically free to
break this usage. the most obvious concern is with atomic cas
constructs: something of the form tmp=*p;a_cas(p,tmp,f(tmp)); could be
transformed to a_cas(p,*p,f(*p)); where the latter is intended to show
multiple loads of *p whose resulting values might fail to be equal;
this would break the atomicity of the whole operation. but even more
fundamental breakage is possible.
with the changes being made now, objects that may be modified by
atomics are modeled as volatile, and the atomic operations performed
on them by other threads are modeled as asynchronous stores by
hardware which happens to be acting on the request of another thread.
such modeling of course does not itself address memory synchronization
between cores/cpus, but that aspect was already handled. this all
seems less than ideal, but it's the best we can do without mandating a
C11 compiler and using the C11 model for atomics.
in the case of pthread_once_t, the ABI type of the underlying object
is not volatile-qualified. so we are assuming that accessing the
object through a volatile-qualified lvalue via casts yields volatile
access semantics. the language of the C standard is somewhat unclear
on this matter, but this is an assumption the linux kernel also makes,
and seems to be the correct interpretation of the standard.
11 years ago
|
|
|
static volatile int lock[2];
|
fix multiple bugs in syslog interfaces
1. as reported by William Haddon, the value returned by snprintf was
wrongly used as a length passed to sendto, despite it possibly
exceeding the buffer length. this could lead to invalid reads and
leaking additional data to syslog.
2. openlog was storing a pointer to the ident string passed by the
caller, rather than copying it. this bug is shared with (and even
documented in) other implementations like glibc, but such behavior
does not seem to meet the requirements of the standard.
3. extremely long ident provided to openlog, or corrupt ident due to
the above issue, could possibly have resulted in buffer overflows.
despite having the potential for smashing the stack, i believe the
impact is low since ident points to a short string literal in typical
application usage (and per the above bug, other usages will break
horribly on other implementations).
4. when used with LOG_NDELAY, openlog was not connecting the
newly-opened socket; sendto was being used instead. this defeated the
main purpose of LOG_NDELAY: preparing for chroot.
5. the default facility was not being used at all, so all messages
without an explicit facility passed to syslog were getting logged at
the kernel facility.
6. setlogmask was not thread-safe; no synchronization was performed
updating the mask. the fix uses atomics rather than locking to avoid
introducing a lock in the fast path for messages whose priority is not
in the mask.
7. in some code paths, the syslog lock was being unlocked twice; this
could result in releasing a lock that was actually held by a different
thread.
some additional enhancements to syslog such as a default identifier
based on argv[0] or similar may still be desired; at this time, only
the above-listed bugs have been fixed.
13 years ago
|
|
|
static char log_ident[32];
|
|
|
|
|
static int log_opt;
|
|
|
|
|
static int log_facility = LOG_USER;
|
|
|
|
|
static int log_mask = 0xff;
|
|
|
|
|
static int log_fd = -1;
|
|
|
|
|
|
|
|
|
|
int setlogmask(int maskpri)
|
|
|
|
|
{
|
|
|
|
|
LOCK(lock);
|
|
|
|
|
int ret = log_mask;
|
|
|
|
|
if (maskpri) log_mask = maskpri;
|
|
|
|
|
UNLOCK(lock);
|
|
|
|
|
return ret;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static const struct {
|
|
|
|
|
short sun_family;
|
|
|
|
|
char sun_path[9];
|
|
|
|
|
} log_addr = {
|
|
|
|
|
AF_UNIX,
|
|
|
|
|
"/dev/log"
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
void closelog(void)
|
|
|
|
|
{
|
|
|
|
|
int cs;
|
|
|
|
|
pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cs);
|
|
|
|
|
LOCK(lock);
|
|
|
|
|
close(log_fd);
|
|
|
|
|
log_fd = -1;
|
|
|
|
|
UNLOCK(lock);
|
|
|
|
|
pthread_setcancelstate(cs, 0);
|
|
|
|
|
}
|
|
|
|
|
|
fix multiple bugs in syslog interfaces
1. as reported by William Haddon, the value returned by snprintf was
wrongly used as a length passed to sendto, despite it possibly
exceeding the buffer length. this could lead to invalid reads and
leaking additional data to syslog.
2. openlog was storing a pointer to the ident string passed by the
caller, rather than copying it. this bug is shared with (and even
documented in) other implementations like glibc, but such behavior
does not seem to meet the requirements of the standard.
3. extremely long ident provided to openlog, or corrupt ident due to
the above issue, could possibly have resulted in buffer overflows.
despite having the potential for smashing the stack, i believe the
impact is low since ident points to a short string literal in typical
application usage (and per the above bug, other usages will break
horribly on other implementations).
4. when used with LOG_NDELAY, openlog was not connecting the
newly-opened socket; sendto was being used instead. this defeated the
main purpose of LOG_NDELAY: preparing for chroot.
5. the default facility was not being used at all, so all messages
without an explicit facility passed to syslog were getting logged at
the kernel facility.
6. setlogmask was not thread-safe; no synchronization was performed
updating the mask. the fix uses atomics rather than locking to avoid
introducing a lock in the fast path for messages whose priority is not
in the mask.
7. in some code paths, the syslog lock was being unlocked twice; this
could result in releasing a lock that was actually held by a different
thread.
some additional enhancements to syslog such as a default identifier
based on argv[0] or similar may still be desired; at this time, only
the above-listed bugs have been fixed.
13 years ago
|
|
|
static void __openlog()
|
|
|
|
|
{
|
handle loss of syslog socket connection
when traditional syslogd implementations are restarted, the old server
socket ceases to exist and a new unix socket with the same pathname is
created. when this happens, the default destination address associated
with the client socket via connect is no longer valid, and attempts to
send produce errors. this happens despite the socket being datagram
type, and is in contrast to the behavior that would be seen with an IP
datagram (UDP) socket.
in order to avoid a situation where the application is unable to send
further syslog messages without calling closelog, this patch makes
syslog attempt to reconnect the socket when send returns an error
indicating a lost connection.
additionally, initial failure to connect the socket no longer results
in the socket being closed. this ensures that an application which
calls openlog to reserve the socket file descriptor will not run into
a situation where transient connection failure (e.g. due to syslogd
restart) prevents fd reservation. however, applications which may be
unable to connect the socket later (e.g. due to chroot, restricted
permissions, seccomp, etc.) will still fail to log if the syslog
socket cannot be connected at openlog time or if it has to be
reconnected later.
11 years ago
|
|
|
log_fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0);
|
|
|
|
|
if (log_fd >= 0) connect(log_fd, (void *)&log_addr, sizeof log_addr);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void openlog(const char *ident, int opt, int facility)
|
|
|
|
|
{
|
|
|
|
|
int cs;
|
|
|
|
|
pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cs);
|
|
|
|
|
LOCK(lock);
|
fix multiple bugs in syslog interfaces
1. as reported by William Haddon, the value returned by snprintf was
wrongly used as a length passed to sendto, despite it possibly
exceeding the buffer length. this could lead to invalid reads and
leaking additional data to syslog.
2. openlog was storing a pointer to the ident string passed by the
caller, rather than copying it. this bug is shared with (and even
documented in) other implementations like glibc, but such behavior
does not seem to meet the requirements of the standard.
3. extremely long ident provided to openlog, or corrupt ident due to
the above issue, could possibly have resulted in buffer overflows.
despite having the potential for smashing the stack, i believe the
impact is low since ident points to a short string literal in typical
application usage (and per the above bug, other usages will break
horribly on other implementations).
4. when used with LOG_NDELAY, openlog was not connecting the
newly-opened socket; sendto was being used instead. this defeated the
main purpose of LOG_NDELAY: preparing for chroot.
5. the default facility was not being used at all, so all messages
without an explicit facility passed to syslog were getting logged at
the kernel facility.
6. setlogmask was not thread-safe; no synchronization was performed
updating the mask. the fix uses atomics rather than locking to avoid
introducing a lock in the fast path for messages whose priority is not
in the mask.
7. in some code paths, the syslog lock was being unlocked twice; this
could result in releasing a lock that was actually held by a different
thread.
some additional enhancements to syslog such as a default identifier
based on argv[0] or similar may still be desired; at this time, only
the above-listed bugs have been fixed.
13 years ago
|
|
|
|
|
|
|
|
if (ident) {
|
|
|
|
|
size_t n = strnlen(ident, sizeof log_ident - 1);
|
|
|
|
|
memcpy(log_ident, ident, n);
|
|
|
|
|
log_ident[n] = 0;
|
|
|
|
|
} else {
|
|
|
|
|
log_ident[0] = 0;
|
|
|
|
|
}
|
|
|
|
|
log_opt = opt;
|
|
|
|
|
log_facility = facility;
|
|
|
|
|
|
|
|
|
|
if ((opt & LOG_NDELAY) && log_fd<0) __openlog();
|
|
|
|
|
|
|
|
|
|
UNLOCK(lock);
|
|
|
|
|
pthread_setcancelstate(cs, 0);
|
|
|
|
|
}
|
|
|
|
|
|
handle loss of syslog socket connection
when traditional syslogd implementations are restarted, the old server
socket ceases to exist and a new unix socket with the same pathname is
created. when this happens, the default destination address associated
with the client socket via connect is no longer valid, and attempts to
send produce errors. this happens despite the socket being datagram
type, and is in contrast to the behavior that would be seen with an IP
datagram (UDP) socket.
in order to avoid a situation where the application is unable to send
further syslog messages without calling closelog, this patch makes
syslog attempt to reconnect the socket when send returns an error
indicating a lost connection.
additionally, initial failure to connect the socket no longer results
in the socket being closed. this ensures that an application which
calls openlog to reserve the socket file descriptor will not run into
a situation where transient connection failure (e.g. due to syslogd
restart) prevents fd reservation. however, applications which may be
unable to connect the socket later (e.g. due to chroot, restricted
permissions, seccomp, etc.) will still fail to log if the syslog
socket cannot be connected at openlog time or if it has to be
reconnected later.
11 years ago
|
|
|
static int is_lost_conn(int e)
|
|
|
|
|
{
|
|
|
|
|
return e==ECONNREFUSED || e==ECONNRESET || e==ENOTCONN || e==EPIPE;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void _vsyslog(int priority, const char *message, va_list ap)
|
|
|
|
|
{
|
|
|
|
|
char timebuf[16];
|
|
|
|
|
time_t now;
|
|
|
|
|
struct tm tm;
|
|
|
|
|
char buf[1024];
|
|
|
|
|
int errno_save = errno;
|
|
|
|
|
int pid;
|
|
|
|
|
int l, l2;
|
|
|
|
|
int hlen;
|
|
|
|
|
int fd;
|
|
|
|
|
|
|
|
|
|
if (log_fd < 0) __openlog();
|
|
|
|
|
|
fix multiple bugs in syslog interfaces
1. as reported by William Haddon, the value returned by snprintf was
wrongly used as a length passed to sendto, despite it possibly
exceeding the buffer length. this could lead to invalid reads and
leaking additional data to syslog.
2. openlog was storing a pointer to the ident string passed by the
caller, rather than copying it. this bug is shared with (and even
documented in) other implementations like glibc, but such behavior
does not seem to meet the requirements of the standard.
3. extremely long ident provided to openlog, or corrupt ident due to
the above issue, could possibly have resulted in buffer overflows.
despite having the potential for smashing the stack, i believe the
impact is low since ident points to a short string literal in typical
application usage (and per the above bug, other usages will break
horribly on other implementations).
4. when used with LOG_NDELAY, openlog was not connecting the
newly-opened socket; sendto was being used instead. this defeated the
main purpose of LOG_NDELAY: preparing for chroot.
5. the default facility was not being used at all, so all messages
without an explicit facility passed to syslog were getting logged at
the kernel facility.
6. setlogmask was not thread-safe; no synchronization was performed
updating the mask. the fix uses atomics rather than locking to avoid
introducing a lock in the fast path for messages whose priority is not
in the mask.
7. in some code paths, the syslog lock was being unlocked twice; this
could result in releasing a lock that was actually held by a different
thread.
some additional enhancements to syslog such as a default identifier
based on argv[0] or similar may still be desired; at this time, only
the above-listed bugs have been fixed.
13 years ago
|
|
|
if (!(priority & LOG_FACMASK)) priority |= log_facility;
|
|
|
|
|
|
|
|
|
|
now = time(NULL);
|
|
|
|
|
gmtime_r(&now, &tm);
|
|
|
|
|
strftime(timebuf, sizeof timebuf, "%b %e %T", &tm);
|
|
|
|
|
|
|
|
|
|
pid = (log_opt & LOG_PID) ? getpid() : 0;
|
|
|
|
|
l = snprintf(buf, sizeof buf, "<%d>%s %n%s%s%.0d%s: ",
|
|
|
|
|
priority, timebuf, &hlen, log_ident, "["+!pid, pid, "]"+!pid);
|
|
|
|
|
errno = errno_save;
|
|
|
|
|
l2 = vsnprintf(buf+l, sizeof buf - l, message, ap);
|
|
|
|
|
if (l2 >= 0) {
|
fix multiple bugs in syslog interfaces
1. as reported by William Haddon, the value returned by snprintf was
wrongly used as a length passed to sendto, despite it possibly
exceeding the buffer length. this could lead to invalid reads and
leaking additional data to syslog.
2. openlog was storing a pointer to the ident string passed by the
caller, rather than copying it. this bug is shared with (and even
documented in) other implementations like glibc, but such behavior
does not seem to meet the requirements of the standard.
3. extremely long ident provided to openlog, or corrupt ident due to
the above issue, could possibly have resulted in buffer overflows.
despite having the potential for smashing the stack, i believe the
impact is low since ident points to a short string literal in typical
application usage (and per the above bug, other usages will break
horribly on other implementations).
4. when used with LOG_NDELAY, openlog was not connecting the
newly-opened socket; sendto was being used instead. this defeated the
main purpose of LOG_NDELAY: preparing for chroot.
5. the default facility was not being used at all, so all messages
without an explicit facility passed to syslog were getting logged at
the kernel facility.
6. setlogmask was not thread-safe; no synchronization was performed
updating the mask. the fix uses atomics rather than locking to avoid
introducing a lock in the fast path for messages whose priority is not
in the mask.
7. in some code paths, the syslog lock was being unlocked twice; this
could result in releasing a lock that was actually held by a different
thread.
some additional enhancements to syslog such as a default identifier
based on argv[0] or similar may still be desired; at this time, only
the above-listed bugs have been fixed.
13 years ago
|
|
|
if (l2 >= sizeof buf - l) l = sizeof buf - 1;
|
|
|
|
|
else l += l2;
|
|
|
|
|
if (buf[l-1] != '\n') buf[l++] = '\n';
|
handle loss of syslog socket connection
when traditional syslogd implementations are restarted, the old server
socket ceases to exist and a new unix socket with the same pathname is
created. when this happens, the default destination address associated
with the client socket via connect is no longer valid, and attempts to
send produce errors. this happens despite the socket being datagram
type, and is in contrast to the behavior that would be seen with an IP
datagram (UDP) socket.
in order to avoid a situation where the application is unable to send
further syslog messages without calling closelog, this patch makes
syslog attempt to reconnect the socket when send returns an error
indicating a lost connection.
additionally, initial failure to connect the socket no longer results
in the socket being closed. this ensures that an application which
calls openlog to reserve the socket file descriptor will not run into
a situation where transient connection failure (e.g. due to syslogd
restart) prevents fd reservation. however, applications which may be
unable to connect the socket later (e.g. due to chroot, restricted
permissions, seccomp, etc.) will still fail to log if the syslog
socket cannot be connected at openlog time or if it has to be
reconnected later.
11 years ago
|
|
|
if (send(log_fd, buf, l, 0) < 0 && (!is_lost_conn(errno)
|
|
|
|
|
|| connect(log_fd, (void *)&log_addr, sizeof log_addr) < 0
|
|
|
|
|
|| send(log_fd, buf, l, 0) < 0)
|
|
|
|
|
&& (log_opt & LOG_CONS)) {
|
|
|
|
|
fd = open("/dev/console", O_WRONLY|O_NOCTTY|O_CLOEXEC);
|
|
|
|
|
if (fd >= 0) {
|
|
|
|
|
dprintf(fd, "%.*s", l-hlen, buf+hlen);
|
|
|
|
|
close(fd);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
if (log_opt & LOG_PERROR) dprintf(2, "%.*s", l-hlen, buf+hlen);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void __vsyslog(int priority, const char *message, va_list ap)
|
|
|
|
|
{
|
|
|
|
|
int cs;
|
|
|
|
|
if (!(log_mask & LOG_MASK(priority&7)) || (priority&~0x3ff)) return;
|
|
|
|
|
pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cs);
|
|
|
|
|
LOCK(lock);
|
|
|
|
|
_vsyslog(priority, message, ap);
|
|
|
|
|
UNLOCK(lock);
|
|
|
|
|
pthread_setcancelstate(cs, 0);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void syslog(int priority, const char *message, ...)
|
|
|
|
|
{
|
|
|
|
|
va_list ap;
|
|
|
|
|
va_start(ap, message);
|
|
|
|
|
__vsyslog(priority, message, ap);
|
|
|
|
|
va_end(ap);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
weak_alias(__vsyslog, vsyslog);
|
