Blame SOURCES/rsyslog-8.2102.0-nsd_ossl-better-logs.patch

49a8b5
diff --git a/runtime/nsd_ossl.c b/runtime/nsd_ossl.c
49a8b5
index e55b014b2c..431ea738b8 100644
49a8b5
--- a/runtime/nsd_ossl.c
49a8b5
+++ b/runtime/nsd_ossl.c
49a8b5
@@ -210,7 +210,8 @@ void osslLastSSLErrorMsg(int ret, SSL *ssl, int severity, const char* pszCallSou
49a8b5
 
49a8b5
 	/* Loop through ERR_get_error */
49a8b5
 	while ((un_error = ERR_get_error()) > 0){
49a8b5
-		LogMsg(0, RS_RET_NO_ERRCODE, severity, "OpenSSL Error Stack: %s", ERR_error_string(un_error, NULL) );
49a8b5
+		LogMsg(0, RS_RET_NO_ERRCODE, severity,
49a8b5
+			"nsd_ossl:OpenSSL Error Stack: %s", ERR_error_string(un_error, NULL) );
49a8b5
 	}
49a8b5
 }
49a8b5
 
49a8b5
@@ -721,9 +722,10 @@ osslChkPeerFingerprint(nsd_ossl_t *pThis, X509 *pCert)
49a8b5
 		if(pThis->bReportAuthErr == 1) {
49a8b5
 			errno = 0;
49a8b5
 			LogError(0, RS_RET_INVALID_FINGERPRINT,
49a8b5
-			"nsd_ossl:error:"
49a8b5
-			" peer fingerprint '%s' unknown - we are "
49a8b5
-			"not permitted to talk to it", cstrGetSzStrNoNULL(pstrFingerprint));
49a8b5
+				"nsd_ossl:error: peer fingerprint '%s' unknown - we are "
49a8b5
+				"not permitted to talk to it", cstrGetSzStrNoNULL(pstrFingerprint));
49a8b5
+			LogMsg(0, RS_RET_NO_ERRCODE, LOG_INFO,
49a8b5
+				"nsd_ossl:TLS session terminated with remote syslog server.");
49a8b5
 			pThis->bReportAuthErr = 0;
49a8b5
 		}
49a8b5
 		ABORT_FINALIZE(RS_RET_INVALID_FINGERPRINT);
49a8b5
@@ -834,8 +836,10 @@ osslChkPeerName(nsd_ossl_t *pThis, X509 *pCert)
49a8b5
 			cstrFinalize(pStr);
49a8b5
 			errno = 0;
49a8b5
 			LogError(0, RS_RET_INVALID_FINGERPRINT, "nsd_ossl:error: peer name not authorized -  "
49a8b5
-					"not permitted to talk to it. Names: %s",
49a8b5
-					cstrGetSzStrNoNULL(pStr));
49a8b5
+				"not permitted to talk to it. Names: %s",
49a8b5
+				cstrGetSzStrNoNULL(pStr));
49a8b5
+			LogMsg(0, RS_RET_NO_ERRCODE, LOG_INFO,
49a8b5
+				"nsd_ossl:TLS session terminated with remote syslog server.");
49a8b5
 			pThis->bReportAuthErr = 0;
49a8b5
 		}
49a8b5
 		ABORT_FINALIZE(RS_RET_INVALID_FINGERPRINT);
49a8b5
@@ -871,8 +875,10 @@ osslChkPeerID(nsd_ossl_t *pThis)
49a8b5
 		if(pThis->bReportAuthErr == 1) {
49a8b5
 			errno = 0;
49a8b5
 			LogError(0, RS_RET_TLS_NO_CERT, "nsd_ossl:error: peer did not provide a certificate, "
49a8b5
-					"not permitted to talk to it");
49a8b5
+				"not permitted to talk to it");
49a8b5
 			pThis->bReportAuthErr = 0;
49a8b5
+			LogMsg(0, RS_RET_NO_ERRCODE, LOG_INFO,
49a8b5
+				"nsd_ossl:TLS session terminated with remote syslog server.");
49a8b5
 		}
49a8b5
 		ABORT_FINALIZE(RS_RET_TLS_NO_CERT);
49a8b5
 	}
49a8b5
@@ -905,15 +911,19 @@ osslChkPeerCertValidity(nsd_ossl_t *pThis)
49a8b5
 		if (iVerErr == X509_V_ERR_CERT_HAS_EXPIRED) {
49a8b5
 			if (pThis->permitExpiredCerts == OSSL_EXPIRED_DENY) {
49a8b5
 				LogError(0, RS_RET_CERT_EXPIRED,
49a8b5
-					"nsd_ossl:CertValidity check"
49a8b5
-"- not permitted to talk to peer: certificate expired: %s",
49a8b5
+					"nsd_ossl:CertValidity check - not permitted to talk to peer: "
49a8b5
+					"certificate expired: %s",
49a8b5
 					X509_verify_cert_error_string(iVerErr));
49a8b5
+				LogMsg(0, RS_RET_NO_ERRCODE, LOG_INFO,
49a8b5
+					"nsd_ossl:TLS session terminated with remote syslog server.");
49a8b5
 				ABORT_FINALIZE(RS_RET_CERT_EXPIRED);
49a8b5
 			} else if (pThis->permitExpiredCerts == OSSL_EXPIRED_WARN) {
49a8b5
 				LogMsg(0, RS_RET_NO_ERRCODE, LOG_WARNING,
49a8b5
-					"nsd_ossl:CertValidity check"
49a8b5
-"- warning talking to peer: certificate expired: %s",
49a8b5
+					"nsd_ossl:CertValidity check - warning talking to peer: "
49a8b5
+					"certificate expired: %s",
49a8b5
 					X509_verify_cert_error_string(iVerErr));
49a8b5
+				LogMsg(0, RS_RET_NO_ERRCODE, LOG_INFO,
49a8b5
+					"nsd_ossl:TLS session terminated with remote syslog server.");
49a8b5
 			} else {
49a8b5
 				dbgprintf("osslChkPeerCertValidity: talking to peer: certificate expired: %s\n",
49a8b5
 					X509_verify_cert_error_string(iVerErr));
49a8b5
@@ -921,6 +931,8 @@ osslChkPeerCertValidity(nsd_ossl_t *pThis)
49a8b5
 		} else {
49a8b5
 			LogError(0, RS_RET_CERT_INVALID, "nsd_ossl:not permitted to talk to peer: "
49a8b5
 				"certificate validation failed: %s", X509_verify_cert_error_string(iVerErr));
49a8b5
+			LogMsg(0, RS_RET_NO_ERRCODE, LOG_INFO,
49a8b5
+				"nsd_ossl:TLS session terminated with remote syslog server.");
49a8b5
 			ABORT_FINALIZE(RS_RET_CERT_INVALID);
49a8b5
 		}
49a8b5
 	} else {
49a8b5
@@ -1384,7 +1396,7 @@ osslPostHandshakeCheck(nsd_ossl_t *pNsd)
49a8b5
 	#if OPENSSL_VERSION_NUMBER >= 0x10002000L
49a8b5
 	if(SSL_get_shared_curve(pNsd->ssl, -1) == 0) {
49a8b5
 		LogError(0, RS_RET_NO_ERRCODE, "nsd_ossl:"
49a8b5
-"No shared curve between syslog client and server.");
49a8b5
+		"No shared curve between syslog client and server.");
49a8b5
 	}
49a8b5
 	#endif
49a8b5
 	sslCipher = (const SSL_CIPHER*) SSL_get_current_cipher(pNsd->ssl);
49a8b5
@@ -1446,8 +1458,6 @@ osslHandshakeCheck(nsd_ossl_t *pNsd)
49a8b5
 				resErr == SSL_ERROR_WANT_WRITE) {
49a8b5
 				pNsd->rtryCall = osslRtry_handshake;
49a8b5
 				pNsd->rtryOsslErr = resErr; /* Store SSL ErrorCode into*/
49a8b5
-				LogError(0, RS_RET_NO_ERRCODE, "nsd_ossl:"
49a8b5
-"TLS handshake failed between syslog client and server.");
49a8b5
 				dbgprintf("osslHandshakeCheck: OpenSSL Client handshake does not complete "
49a8b5
 					"immediately - setting to retry (this is OK and normal)\n");
49a8b5
 				FINALIZE;
49a8b5
@@ -1458,6 +1468,8 @@ osslHandshakeCheck(nsd_ossl_t *pNsd)
49a8b5
 				ABORT_FINALIZE(RS_RET_NO_ERRCODE /*RS_RET_RETRY*/);
49a8b5
 			} else {
49a8b5
 				osslLastSSLErrorMsg(res, pNsd->ssl, LOG_ERR, "osslHandshakeCheck Client");
49a8b5
+				LogMsg(0, RS_RET_NO_ERRCODE, LOG_INFO,
49a8b5
+					"nsd_ossl:TLS session terminated with remote syslog server.");
49a8b5
 				ABORT_FINALIZE(RS_RET_NO_ERRCODE);
49a8b5
 			}
49a8b5
 		}
49a8b5
@@ -1738,8 +1750,8 @@ Connect(nsd_t *pNsd, int family, uchar *port, uchar *host, char *device)
49a8b5
 	conn = BIO_new_socket(pPtcp->sock, BIO_CLOSE /*BIO_NOCLOSE*/);
49a8b5
 	dbgprintf("Connect: Init conn BIO[%p] done\n", (void *)conn);
49a8b5
 
49a8b5
-	LogMsg(0, RS_RET_NO_ERRCODE, LOG_INFO, "nsd_ossl:"
49a8b5
-"TLS Connection initiated with remote syslog server.");
49a8b5
+	LogMsg(0, RS_RET_NO_ERRCODE, LOG_INFO, "nsd_ossl: "
49a8b5
+		"TLS Connection initiated with remote syslog server.");
49a8b5
 	/*if we reach this point we are in tls mode */
49a8b5
 	DBGPRINTF("Connect: TLS Mode\n");
49a8b5
 	if(!(pThis->ssl = SSL_new(ctx))) {