commit - 5d394e24523f08a36306342663d7036d728fb66e
commit + 37ed6014e6a950279c73fe895cfade2a997a6086
blob - e4b50292d6907c48f100eb18ca357f447f0ab75b
blob + 8fb7701d0472b2d2834fc8e4545e668e82e51a5b
--- hce.c
+++ hce.c
-/* $OpenBSD: hce.c,v 1.78 2017/12/18 21:45:57 benno Exp $ */
+/* $OpenBSD: hce.c,v 1.79 2018/08/06 17:31:31 benno Exp $ */
/*
* Copyright (c) 2006 Pierre-Yves Ritschard <pyr@openbsd.org>
struct ctl_status st;
struct timeval tv_now, tv_dur;
u_long duration;
- u_int logopt;
+ u_int logopt = RELAYD_OPT_LOGHOSTCHECK;
struct host *h, *hostnst;
int hostup;
const char *msg;
proc_compose(env->sc_ps, PROC_PFE, IMSG_HOST_STATUS, &st, sizeof(st));
if (host->up != host->last_up)
logopt = RELAYD_OPT_LOGUPDATE;
- else
- logopt = RELAYD_OPT_LOGNOTIFY;
getmonotime(&tv_now);
timersub(&tv_now, &host->cte.tv_start, &tv_dur);
blob - 85b01d266b8d6593823f5196ccf35604f20cb3ca
blob + 2af04c27bd9fef155b8f3c34ba10bfb8bf08da82
--- parse.y
+++ parse.y
-/* $OpenBSD: parse.y,v 1.226 2018/07/11 07:39:22 krw Exp $ */
+/* $OpenBSD: parse.y,v 1.227 2018/08/06 17:31:31 benno Exp $ */
/*
* Copyright (c) 2007 - 2014 Reyk Floeter <reyk@openbsd.org>
%token SNMP SOCKET SPLICE SSL STICKYADDR STYLE TABLE TAG TAGGED TCP TIMEOUT TLS
%token TO ROUTER RTLABEL TRANSPARENT TRAP UPDATES URL VIRTUAL WITH TTL RTABLE
%token MATCH PARAMS RANDOM LEASTSTATES SRCHASH KEY CERTIFICATE PASSWORD ECDHE
-%token EDH TICKETS
+%token EDH TICKETS CONNECTION CONNECTIONS ERRORS STATE CHANGES CHECKS
%token <v.string> STRING
%token <v.number> NUMBER
%type <v.string> hostname interface table value optstring
trap : /* nothing */ { $$ = 0; }
| TRAP { $$ = 1; }
-loglevel : UPDATES { $$ = RELAYD_OPT_LOGUPDATE; }
- | ALL { $$ = RELAYD_OPT_LOGALL; }
+loglevel : UPDATES { /* remove 6.4-current */
+ $$ = RELAYD_OPT_LOGUPDATE;
+ log_warnx("log updates deprecated, "
+ "update configuration");
+ }
+ | STATE CHANGES { $$ = RELAYD_OPT_LOGUPDATE; }
+ | HOST CHECKS { $$ = RELAYD_OPT_LOGHOSTCHECK; }
+ | ALL { /* remove 6.4-current */
+ $$ = (RELAYD_OPT_LOGHOSTCHECK|
+ RELAYD_OPT_LOGCON|
+ RELAYD_OPT_LOGCONERR);
+ log_warnx("log all deprecated, "
+ "update configuration");
+ }
+ | CONNECTION { $$ = (RELAYD_OPT_LOGCON |
+ RELAYD_OPT_LOGCONERR); }
+ | CONNECTION ERRORS { $$ = RELAYD_OPT_LOGCONERR; }
;
rdr : REDIRECT STRING {
{ "ca", CA },
{ "cache", CACHE },
{ "cert", CERTIFICATE },
+ { "changes", CHANGES },
{ "check", CHECK },
+ { "checks", CHECKS },
{ "ciphers", CIPHERS },
{ "code", CODE },
+ { "connection", CONNECTION },
{ "cookie", COOKIE },
{ "demote", DEMOTE },
{ "destination", DESTINATION },
{ "ecdhe", ECDHE },
{ "edh", EDH },
{ "error", ERROR },
+ { "errors", ERRORS },
{ "expect", EXPECT },
{ "external", EXTERNAL },
{ "file", FILENAME },
{ "source-hash", SRCHASH },
{ "splice", SPLICE },
{ "ssl", SSL },
+ { "state", STATE },
{ "sticky-address", STICKYADDR },
{ "style", STYLE },
{ "table", TABLE },
blob - 9a7f60d6f86778b9a765003378e7591a6b7265ce
blob + 8ebd0bd1c1487f179fb6fe1fecb7b9e52bafb521
--- relay.c
+++ relay.c
-/* $OpenBSD: relay.c,v 1.239 2018/06/10 20:41:47 benno Exp $ */
+/* $OpenBSD: relay.c,v 1.240 2018/08/06 17:31:31 benno Exp $ */
/*
* Copyright (c) 2006 - 2014 Reyk Floeter <reyk@openbsd.org>
&rlay->rl_sessions, con);
timersub(&tv_now, &con->se_tv_last, &tv);
if (timercmp(&tv, &rlay->rl_conf.timeout, >=))
- relay_close(con, "hard timeout");
+ relay_close(con, "hard timeout", 1);
}
}
case RELAY_PROTO_HTTP:
if (relay_httpdesc_init(out) == -1) {
relay_close(con,
- "failed to allocate http descriptor");
+ "failed to allocate http descriptor", 1);
return;
}
con->se_out.toread = TOREAD_HTTP_HEADER;
bufferevent_enable(con->se_in.bev, EV_READ);
if (relay_splice(&con->se_out) == -1)
- relay_close(con, strerror(errno));
+ relay_close(con, strerror(errno), 1);
}
void
case RELAY_PROTO_HTTP:
if (relay_httpdesc_init(&con->se_in) == -1) {
relay_close(con,
- "failed to allocate http descriptor");
+ "failed to allocate http descriptor", 1);
return;
}
con->se_in.toread = TOREAD_HTTP_HEADER;
con->se_in.bev = bufferevent_new(con->se_in.s, inrd, inwr,
relay_error, &con->se_in);
if (con->se_in.bev == NULL) {
- relay_close(con, "failed to allocate input buffer event");
+ relay_close(con, "failed to allocate input buffer event", 1);
return;
}
bufferevent_enable(con->se_in.bev, EV_READ|EV_WRITE);
if (relay_splice(&con->se_in) == -1)
- relay_close(con, strerror(errno));
+ relay_close(con, strerror(errno), 1);
}
void
return;
done:
- relay_close(con, "last write (done)");
+ relay_close(con, "last write (done)", 0);
return;
fail:
- relay_close(con, strerror(errno));
+ relay_close(con, strerror(errno), 1);
}
void
return;
done:
- relay_close(con, "last read (done)");
+ relay_close(con, "last read (done)", 0);
return;
fail:
- relay_close(con, strerror(errno));
+ relay_close(con, strerror(errno), 1);
}
/*
case -1:
goto fail;
case 0:
- relay_close(con, "buffer event timeout");
+ relay_close(con, "buffer event timeout", 1);
break;
case 1:
cre->timedout = 1;
break;
}
} else {
- relay_close(con, "buffer event timeout");
+ relay_close(con, "buffer event timeout", 1);
}
return;
}
case -1:
goto fail;
case 0:
- relay_close(con, "splice timeout");
+ relay_close(con, "splice timeout", 1);
return;
case 1:
bufferevent_enable(bev, EV_READ);
break;
}
} else if (cre->dst->timedout) {
- relay_close(con, "splice timeout");
+ relay_close(con, "splice timeout", 1);
return;
}
if (relay_spliceadjust(cre) == -1)
} else if (cre->toread == TOREAD_UNLIMITED || cre->toread == 0)
return;
- relay_close(con, "done");
+ relay_close(con, "done", 0);
return;
}
- relay_close(con, "buffer event error");
+ relay_close(con, "buffer event error", 1);
return;
fail:
- relay_close(con, strerror(errno));
+ relay_close(con, strerror(errno), 1);
}
void
/* Pre-allocate output buffer */
con->se_out.output = evbuffer_new();
if (con->se_out.output == NULL) {
- relay_close(con, "failed to allocate output buffer");
+ relay_close(con, "failed to allocate output buffer", 1);
return;
}
slen = sizeof(con->se_out.ss);
if (getsockname(s, (struct sockaddr *)&con->se_out.ss,
&slen) == -1) {
- relay_close(con, "peer lookup failed");
+ relay_close(con, "peer lookup failed", 1);
return;
}
con->se_out.port = relay_socket_getport(&con->se_out.ss);
con->se_out.ss.ss_family = AF_UNSPEC;
} else if (rlay->rl_conf.flags & F_NATLOOK) {
if ((cnl = calloc(1, sizeof(*cnl))) == NULL) {
- relay_close(con, "failed to allocate nat lookup");
+ relay_close(con, "failed to allocate nat lookup", 1);
return;
}
slen = sizeof(cnl->dst);
if (getsockname(s,
(struct sockaddr *)&cnl->dst, &slen) == -1) {
- relay_close(con, "failed to get local address");
+ relay_close(con, "failed to get local address", 1);
return;
}
if (con->se_out.ss.ss_family == AF_UNSPEC && cnl->in == -1 &&
rlay->rl_conf.dstss.ss_family == AF_UNSPEC &&
TAILQ_EMPTY(&rlay->rl_tables)) {
- relay_close(con, "session NAT lookup failed");
+ relay_close(con, "session NAT lookup failed", 1);
return;
}
if (cnl->in != -1) {
if (bcmp(&rlay->rl_conf.ss, &out->ss, sizeof(out->ss)) == 0 &&
out->port == rlay->rl_conf.port) {
log_debug("%s: session %d: looping", __func__, con->se_id);
- relay_close(con, "session aborted");
+ relay_close(con, "session aborted", 1);
return;
}
if (rlay->rl_proto->request == NULL)
fatalx("invalide UDP session");
if ((*rlay->rl_proto->request)(con) == -1)
- relay_close(con, "session failed");
+ relay_close(con, "session failed", 1);
return;
}
if (rlay->rl_conf.fwdmode == FWD_TRANS)
relay_bindanyreq(con, 0, IPPROTO_TCP);
else if (relay_connect(con) == -1) {
- relay_close(con, "session failed");
+ relay_close(con, "session failed", 1);
return;
}
}
struct rsession *con = arg;
if (con->se_bnds == -1) {
- relay_close(con, "bindany failed, invalid socket");
+ relay_close(con, "bindany failed, invalid socket", 1);
return;
}
if (relay_connect(con) == -1)
- relay_close(con, "session failed");
+ relay_close(con, "session failed", 1);
}
void
}
void
-relay_close(struct rsession *con, const char *msg)
+relay_close(struct rsession *con, const char *msg, int err)
{
char ibuf[128], obuf[128], *ptr = NULL;
struct relay *rlay = con->se_relay;
if (con->se_out.bev != NULL)
bufferevent_disable(con->se_out.bev, EV_READ|EV_WRITE);
- if ((env->sc_conf.opts & RELAYD_OPT_LOGUPDATE) && msg != NULL) {
+ if ((env->sc_conf.opts & (RELAYD_OPT_LOGCON|RELAYD_OPT_LOGCONERR)) &&
+ msg != NULL) {
bzero(&ibuf, sizeof(ibuf));
bzero(&obuf, sizeof(obuf));
(void)print_host(&con->se_in.ss, ibuf, sizeof(ibuf));
ptr = evbuffer_readln(con->se_log, NULL,
EVBUFFER_EOL_CRLF);
}
- log_info("relay %s, "
- "session %d (%d active), %s, %s -> %s:%d, "
- "%s%s%s", rlay->rl_conf.name, con->se_id, relay_sessions,
- con->se_tag != 0 ? tag_id2name(con->se_tag) : "0", ibuf,
- obuf, ntohs(con->se_out.port), msg, ptr == NULL ? "" : ",",
- ptr == NULL ? "" : ptr);
+ if (err == 0 && (env->sc_conf.opts & RELAYD_OPT_LOGCON))
+ log_info("relay %s, "
+ "session %d (%d active), %s, %s -> %s:%d, "
+ "%s%s%s", rlay->rl_conf.name, con->se_id,
+ relay_sessions, con->se_tag != 0 ?
+ tag_id2name(con->se_tag) : "0", ibuf, obuf,
+ ntohs(con->se_out.port), msg, ptr == NULL ?
+ "" : ",", ptr == NULL ? "" : ptr);
+ if (err == 1 && (env->sc_conf.opts & RELAYD_OPT_LOGCONERR))
+ log_warn("relay %s, "
+ "session %d (%d active), %s, %s -> %s:%d, "
+ "%s%s%s", rlay->rl_conf.name, con->se_id,
+ relay_sessions, con->se_tag != 0 ?
+ tag_id2name(con->se_tag) : "0", ibuf, obuf,
+ ntohs(con->se_out.port), msg, ptr == NULL ?
+ "" : ",", ptr == NULL ? "" : ptr);
free(ptr);
}
return;
err:
- relay_close(con, errstr);
+ relay_close(con, errstr, 1);
}
void
char *msg;
if (event == EV_TIMEOUT) {
- relay_close(con, "TLS handshake timeout");
+ relay_close(con, "TLS handshake timeout", 1);
return;
}
con->se_in.tlscert = NULL;
if (con->se_in.tlscert == NULL)
relay_close(con,
- "could not create certificate");
+ "could not create certificate", 1);
else
relay_session(con);
return;
} else {
if (asprintf(&msg, "TLS handshake error: %s",
tls_error(cre->tls)) >= 0) {
- relay_close(con, msg);
+ relay_close(con, msg, 1);
free(msg);
} else {
- relay_close(con, "TLS handshake error");
+ relay_close(con, "TLS handshake error", 1);
}
return;
}
blob - cf493f8c887622cda08ce7c9b1171d686d47e251
blob + a9d27bfe60517ded05c87a6c524ffce4099e62ac
--- relay_http.c
+++ relay_http.c
-/* $OpenBSD: relay_http.c,v 1.70 2017/11/27 16:25:50 benno Exp $ */
+/* $OpenBSD: relay_http.c,v 1.71 2018/08/06 17:31:31 benno Exp $ */
/*
* Copyright (c) 2006 - 2016 Reyk Floeter <reyk@openbsd.org>
action = relay_test(proto, cre);
switch (action) {
case RES_FAIL:
- relay_close(con, "filter rule failed");
+ relay_close(con, "filter rule failed", 1);
return;
case RES_BAD:
relay_abort_http(con, 400, "Bad Request",
}
}
if (con->se_done) {
- relay_close(con, "last http read (done)");
+ relay_close(con, "last http read (done)", 0);
return;
}
switch (relay_splice(cre)) {
case -1:
- relay_close(con, strerror(errno));
+ relay_close(con, strerror(errno), 1);
case 1:
return;
case 0:
/* The callback readcb() might have freed the session. */
return;
done:
- relay_close(con, "last http content read");
+ relay_close(con, "last http content read", 0);
return;
fail:
- relay_close(con, strerror(errno));
+ relay_close(con, strerror(errno), 1);
}
void
*/
if (sscanf(line, "%llx", &llval) != 1 || llval < 0) {
free(line);
- relay_close(con, "invalid chunk size");
+ relay_close(con, "invalid chunk size", 1);
return;
}
return;
done:
- relay_close(con, "last http chunk read (done)");
+ relay_close(con, "last http chunk read (done)", 0);
return;
fail:
- relay_close(con, strerror(errno));
+ relay_close(con, strerror(errno), 1);
}
void
/* In some cases this function may be called from generic places */
if (rlay->rl_proto->type != RELAY_PROTO_HTTP ||
(rlay->rl_proto->flags & F_RETURN) == 0) {
- relay_close(con, msg);
+ relay_close(con, msg, 0);
return;
}
done:
free(body);
if (asprintf(&httpmsg, "%s (%03d %s)", msg, code, httperr) == -1)
- relay_close(con, msg);
+ relay_close(con, msg, 1);
else {
- relay_close(con, httpmsg);
+ relay_close(con, httpmsg, 1);
free(httpmsg);
}
}
blob - fe5a1d587eda423cff74feeef6c08e8eab10d67b
blob + 74d55feb794c4b796882e2b5af937eba57b7a208
--- relay_udp.c
+++ relay_udp.c
-/* $OpenBSD: relay_udp.c,v 1.48 2018/04/18 12:10:54 claudio Exp $ */
+/* $OpenBSD: relay_udp.c,v 1.49 2018/08/06 17:31:31 benno Exp $ */
/*
* Copyright (c) 2007 - 2013 Reyk Floeter <reyk@openbsd.org>
(priv = (*proto->validate)(con, rlay, &ss, buf, len)) == NULL)
return;
- relay_close(con, "unknown response");
+ relay_close(con, "unknown response", 1);
free(priv);
}
/* Pre-allocate output buffer */
con->se_out.output = evbuffer_new();
if (con->se_out.output == NULL) {
- relay_close(con, "failed to allocate output buffer");
+ relay_close(con, "failed to allocate output buffer", 1);
return;
}
con->se_haslog = 0;
con->se_log = evbuffer_new();
if (con->se_log == NULL) {
- relay_close(con, "failed to allocate log buffer");
+ relay_close(con, "failed to allocate log buffer", 1);
return;
}
if (rlay->rl_conf.flags & F_NATLOOK) {
if ((cnl = calloc(1, sizeof(*cnl))) == NULL) {
- relay_close(con, "failed to allocate natlookup");
+ relay_close(con, "failed to allocate natlookup", 1);
return;
}
}
/* Save the received data */
if (evbuffer_add(con->se_out.output, buf, len) == -1) {
- relay_close(con, "failed to store buffer");
+ relay_close(con, "failed to store buffer", 1);
free(cnl);
return;
}
if (sig != EV_TIMEOUT)
fatalx("invalid timeout event");
- relay_close(con, "udp timeout");
+ relay_close(con, "udp timeout", 1);
}
/*
} else {
priv = con->se_priv;
if (priv == NULL || key != priv->dp_inkey) {
- relay_close(con, "invalid response");
+ relay_close(con, "invalid response", 1);
return (NULL);
}
relay_dns_result(con, buf, len);
slen = con->se_out.ss.ss_len;
if (sendto(rlay->rl_s, buf, len, 0,
(struct sockaddr *)&con->se_in.ss, slen) == -1) {
- relay_close(con, "response failed");
+ relay_close(con, "response failed", 1);
return;
}
- relay_close(con, "session closed");
+ relay_close(con, "session closed", 0);
}
int
blob - 0ce53b41d5db8dd7b730a17dc00d1e05a36a8cdc
blob + c2e675adf671cc213fce308ee970c637ac193d08
--- relayd.c
+++ relayd.c
-/* $OpenBSD: relayd.c,v 1.171 2017/11/29 15:24:50 benno Exp $ */
+/* $OpenBSD: relayd.c,v 1.172 2018/08/06 17:31:31 benno Exp $ */
/*
* Copyright (c) 2007 - 2016 Reyk Floeter <reyk@openbsd.org>
/* cleanup sessions */
while ((con =
SPLAY_ROOT(&rlay->rl_sessions)) != NULL)
- relay_close(con, NULL);
+ relay_close(con, NULL, 0);
/* cleanup relay */
if (rlay->rl_bev != NULL)
blob - 125bd685bb2627ae4d52987b63df4942e669621c
blob + dd40a50946be46513af2f3ad1ef3eb457ae17ea9
--- relayd.conf.5
+++ relayd.conf.5
-.\" $OpenBSD: relayd.conf.5,v 1.185 2018/06/18 06:04:25 jmc Exp $
+.\" $OpenBSD: relayd.conf.5,v 1.186 2018/08/06 17:31:31 benno Exp $
.\"
.\" Copyright (c) 2006 - 2016 Reyk Floeter <reyk@openbsd.org>
.\" Copyright (c) 2006, 2007 Pierre-Yves Ritschard <pyr@openbsd.org>
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\"
-.Dd $Mdocdate: June 18 2018 $
+.Dd $Mdocdate: August 6 2018 $
.Dt RELAYD.CONF 5
.Os
.Sh NAME
The default interval is 10 seconds.
.It Xo
.Ic log
-.Pq Ic updates Ns | Ns Ic all
+.Pq Ic state changes Ns | Ns Ic host checks
.Xc
-Log state notifications after completed host checks.
-Either only log the
-.Ic updates
-to new states or log
-.Ic all
-state notifications, even if the state didn't change.
+Log host checks:
+Either log only the
+.Ic state changes
+of hosts or log all
+.Ic host checks
+that were run, even if the state didn't change.
The host state can be
.Dq up
(the health check completed successfully),
or
.Dq unknown
(the host is disabled or has not been checked yet).
+.It Xo
+.Ic log connection Op Ic errors
+.Xc
+When using relays, log all TCP connections.
+Optionally log only
+.Ic connection errors.
.It Ic prefork Ar number
When using relays, run the specified number of processes to handle
relayed connections.
blob - bcf47a6f709cb539de1d4aa5d60814e1946e8639
blob + ac43aa50608b45d8ab7ba0f9699b9a07b556e819
--- relayd.h
+++ relayd.h
-/* $OpenBSD: relayd.h,v 1.249 2018/04/18 12:10:54 claudio Exp $ */
+/* $OpenBSD: relayd.h,v 1.250 2018/08/06 17:31:31 benno Exp $ */
/*
* Copyright (c) 2006 - 2016 Reyk Floeter <reyk@openbsd.org>
#define RELAYD_OPT_VERBOSE 0x01
#define RELAYD_OPT_NOACTION 0x04
#define RELAYD_OPT_LOGUPDATE 0x08
-#define RELAYD_OPT_LOGNOTIFY 0x10
-#define RELAYD_OPT_LOGALL 0x18
+#define RELAYD_OPT_LOGHOSTCHECK 0x10
+#define RELAYD_OPT_LOGCON 0x20
+#define RELAYD_OPT_LOGCONERR 0x40
/* control.c */
int control_init(struct privsep *, struct control_sock *);
int relay_session_cmp(struct rsession *, struct rsession *);
char *relay_load_fd(int, off_t *);
int relay_load_certfiles(struct relay *);
-void relay_close(struct rsession *, const char *);
+void relay_close(struct rsession *, const char *, int);
int relay_reset_event(struct ctl_relay_event *);
void relay_natlook(int, short, void *);
void relay_session(struct rsession *);
