From owner-freebsd-audit  Sun Aug 11  9:32: 5 2002
Delivered-To: freebsd-audit@freebsd.org
Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id CB26637B400; Sun, 11 Aug 2002 09:32:01 -0700 (PDT)
Received: from salmon.maths.tcd.ie (salmon.maths.tcd.ie [134.226.81.11])
	by mx1.FreeBSD.org (Postfix) with SMTP
	id A802143E6E; Sun, 11 Aug 2002 09:32:00 -0700 (PDT)
	(envelope-from dwmalone@maths.tcd.ie)
Received: from walton.maths.tcd.ie by salmon.maths.tcd.ie with SMTP
          id <aa70079@salmon>; 11 Aug 2002 17:31:59 +0100 (BST)
To: freebsd-gnats-submit@FreeBSD.org, sanewo@ba2.so-net.ne.jp
Cc: freebsd-audit@FreeBSD.org
Subject: Re: bin/28935: syslogd -u doesn't treat * as "all levels"
X-Request-Do: 
Date: Sun, 11 Aug 2002 17:31:58 +0100
From: David Malone <dwmalone@maths.tcd.ie>
Message-ID:  <200208111731.aa70079@salmon.maths.tcd.ie>
Sender: owner-freebsd-audit@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-audit.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-audit>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-audit>
X-Loop: FreeBSD.ORG

This is a possible patch for:

	http://www.freebsd.org/cgi/query-pr.cgi?pr=bin/28935

which points out that "*" means completly the wrong thing if you
run syslogd -u. It would seem to make more sense to consider "*"
as having an explicit set of comparison flags "<=>".

This also patch adds a "!" comparison flag which should be compatable
with the same flag in the Linux version of syslogd. I'm not sure I
find the linux semtics that intuative, but there is little point in
being incompatable.

	David.


Index: syslog.conf.5
===================================================================
RCS file: /cvs/FreeBSD-CVS/src/usr.sbin/syslogd/syslog.conf.5,v
retrieving revision 1.26
diff -u -r1.26 syslog.conf.5
--- syslog.conf.5	16 May 2002 02:28:39 -0000	1.26
+++ syslog.conf.5	11 Aug 2002 16:20:16 -0000
@@ -85,7 +85,7 @@
 a period
 .Pq Dq \&. ,
 an optional set of comparison flags
-.Pq Bq <=> ,
+.Pq Bo ! Bc Bq <=> ,
 and a
 .Em level ,
 with no intervening white-space.
@@ -123,6 +123,15 @@
 level equal or greater than
 .Em level
 will be logged.
+Comparison flags beginning with
+.Do ! Dc
+will have their logical sense inverted.
+Thus
+.Dq !=info
+means all levels except info and
+.Dq !notice
+has the same meaning as
+.Dq <notice .
 .Pp
 The
 .Em level
Index: syslogd.c
===================================================================
RCS file: /cvs/FreeBSD-CVS/src/usr.sbin/syslogd/syslogd.c,v
retrieving revision 1.104
diff -u -r1.104 syslogd.c
--- syslogd.c	25 Jul 2002 15:45:41 -0000	1.104
+++ syslogd.c	11 Aug 2002 16:05:16 -0000
@@ -1591,6 +1591,7 @@
 	for (p = line; *p && *p != '\t' && *p != ' ';) {
 		int pri_done;
 		int pri_cmp;
+		int pri_invert;
 
 		/* find the end of this facility name list */
 		for (q = p; *q && *q != '\t' && *q != ' ' && *q++ != '.'; )
@@ -1599,6 +1600,11 @@
 		/* get the priority comparison */
 		pri_cmp = 0;
 		pri_done = 0;
+		pri_invert = 0;
+		if (*q == '!') {
+			pri_invert = 1;
+			q++;
+		}
 		while (!pri_done) {
 			switch (*q) {
 			case '<':
@@ -1618,11 +1624,6 @@
 				break;
 			}
 		}
-		if (!pri_cmp)
-			pri_cmp = (UniquePriority)
-				  ? (PRI_EQ)
-				  : (PRI_EQ | PRI_GT)
-				  ;
 
 		/* collect priority name */
 		for (bp = buf; *q && !strchr("\t,; ", *q); )
@@ -1636,6 +1637,7 @@
 		/* decode priority name */
 		if (*buf == '*') {
 			pri = LOG_PRIMASK + 1;
+			pri_cmp = PRI_LT | PRI_EQ | PRI_GT;
 		} else {
 			pri = decode(buf, prioritynames);
 			if (pri < 0) {
@@ -1645,6 +1647,13 @@
 				return;
 			}
 		}
+		if (!pri_cmp)
+			pri_cmp = (UniquePriority)
+				  ? (PRI_EQ)
+				  : (PRI_EQ | PRI_GT)
+				  ;
+		if (pri_invert)
+			pri_cmp ^= PRI_LT | PRI_EQ | PRI_GT;
 
 		/* scan facilities */
 		while (*p && !strchr("\t.; ", *p)) {

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-audit" in the body of the message