59 static int log_on_stderr = 1;
60 static int log_stderr_fd = STDERR_FILENO;
61 static int log_facility = LOG_AUTH;
73 /* textual representation of log-facilities/levels */
122 	int i;  in log_facility_number()
145 	int i;  in log_level_number()
197     int on_stderr)  in log_init()
207 		    (int) level);  in log_init()
260 		    (int) facility);  in log_init()
278 int
281 	/* no-op if log_init has not been called */  in log_change_level()
297 		return -1;  in log_change_level()
301 int
311 	int fd;  in log_redirect_stderr_to()
321 	if ((fd = open(logfile, O_WRONLY|O_CREAT|O_APPEND, 0600)) == -1) {  in log_redirect_stderr_to()
339 do_log(LogLevel level, int force, const char *suffix, const char *fmt,  in do_log()
348 	int pri = LOG_INFO;  in do_log()
349 	int saved_errno = errno;  in do_log()
412 		    (int)sizeof msgbuf - 3, fmtbuf);  in do_log()
429 sshlog(const char *file, const char *func, int line, int showfunc,  in sshlog()
440 sshlogdie(const char *file, const char *func, int line, int showfunc,  in sshlogdie()
453 sshlogv(const char *file, const char *func, int line, int showfunc,  in sshlogv()
457 	int forced = 0;  in sshlogv()
486 sshlogdirect(LogLevel level, int forced, const char *fmt, ...)  in sshlogdirect()
499  * maintained and when it exceeds a threshold further events are dropped
500  * until the rate falls back below that threshold.
502  * To prevent flipping in and out of rate-limiting, there is a hysteresis
503  * timer that delays leaving the rate-limited state.
505  * While in the rate-limited state, events can be periodically allowed though
528 log_ratelimit_init(struct log_ratelimit_ctx *rl, u_int threshold,  in log_ratelimit_init()  argument
532 	rl->threshold = threshold;  in log_ratelimit_init()
533 	rl->max_accum = max_accum;  in log_ratelimit_init()
534 	rl->hysteresis = hysteresis;  in log_ratelimit_init()
535 	rl->log_every = log_every;  in log_ratelimit_init()
537 	    rl, rl->threshold, rl->max_accum, rl->hysteresis, rl->log_every));  in log_ratelimit_init()
541  * check whether a log event should be dropped because of rate-limiting.
542  * returns non-zero if the event should be dropped. If events_since_last
546 int
547 log_ratelimit(struct log_ratelimit_ctx *rl, time_t now, int *active,  in log_ratelimit()
553 	    "accum=%u since=%ld since_last=%u", rl, rl->threshold,  in log_ratelimit()
554 	    rl->max_accum, rl->hysteresis,  in log_ratelimit()
555 	    rl->log_every, rl->accumulated_events,  in log_ratelimit()
556 	    rl->last_event == 0 ? -1 : (long)(now - rl->last_event),  in log_ratelimit()
557 	    rl->ratelimited_events));  in log_ratelimit()
564 		*active = rl->ratelimit_active;  in log_ratelimit()
567 	if (rl->last_event <= 0)  in log_ratelimit()
568 		rl->last_event = now;  in log_ratelimit()
569 	if (now > rl->last_event) {  in log_ratelimit()
570 		uint64_t n = now - rl->last_event;  in log_ratelimit()
574 		if (rl->accumulated_events < (u_int)n)  in log_ratelimit()
575 			rl->accumulated_events = 0;  in log_ratelimit()
577 			rl->accumulated_events -= (u_int)n;  in log_ratelimit()
578 		RLDBG(("decay: accum=%u", rl->accumulated_events));  in log_ratelimit()
580 	rl->accumulated_events++; /* add this event */  in log_ratelimit()
581 	if (rl->accumulated_events > rl->max_accum)  in log_ratelimit()
582 		rl->accumulated_events = rl->max_accum;  in log_ratelimit()
583 	olast_event = rl->last_event;  in log_ratelimit()
584 	rl->last_event = now;  in log_ratelimit()
585 	RLDBG(("check threshold: accum=%u vs thresh=%u",  in log_ratelimit()
586 	    rl->accumulated_events, rl->threshold));  in log_ratelimit()
588 	/* Are we under threshold? */  in log_ratelimit()
589 	if (rl->accumulated_events < rl->threshold) {  in log_ratelimit()
590 		if (!rl->ratelimit_active)  in log_ratelimit()
592 		RLDBG(("under threshold: hys=%u since_hys=%ld since_last=%ld",  in log_ratelimit()
593 		    rl->hysteresis, rl->hysteresis_start == 0 ? -1 :  in log_ratelimit()
594 		    (long)(now - rl->hysteresis_start),  in log_ratelimit()
595 		    olast_event == 0 ? -1 : (long)(now - olast_event)));  in log_ratelimit()
596 		if (rl->hysteresis_start == 0) {  in log_ratelimit()
597 			/* active, but under threshold; hysteresis */  in log_ratelimit()
598 			if (olast_event + rl->hysteresis < now) {  in log_ratelimit()
604 			rl->hysteresis_start = now;  in log_ratelimit()
605 		} else if (rl->hysteresis_start + rl->hysteresis < now) {  in log_ratelimit()
610 				*events_dropped = rl->ratelimited_events;  in log_ratelimit()
613 			rl->ratelimit_active = 0;  in log_ratelimit()
614 			rl->ratelimit_start = 0;  in log_ratelimit()
615 			rl->last_log = 0;  in log_ratelimit()
616 			rl->hysteresis_start = 0;  in log_ratelimit()
617 			rl->ratelimited_events = 0;  in log_ratelimit()
621 	} else if (!rl->ratelimit_active) {  in log_ratelimit()
622 		/* Transition to rate-limiting */  in log_ratelimit()
624 		rl->ratelimit_active = 1;  in log_ratelimit()
625 		rl->ratelimit_start = now;  in log_ratelimit()
626 		rl->last_log = now;  in log_ratelimit()
627 		rl->hysteresis_start = 0;  in log_ratelimit()
628 		rl->ratelimited_events = 1;  in log_ratelimit()
632 	} else if (rl->hysteresis_start != 0) {  in log_ratelimit()
633 		/* active and over threshold; reset hysteresis timer */  in log_ratelimit()
635 		rl->hysteresis_start = 0;  in log_ratelimit()
638 	/* over threshold or in hysteresis period; log periodically */  in log_ratelimit()
641 	RLDBG(("log_every=%u since_log=%ld", rl->log_every,  in log_ratelimit()
642 	    (long)(now - rl->last_log)));  in log_ratelimit()
643 	if (rl->log_every > 0 && now >= rl->last_log + rl->log_every) {  in log_ratelimit()
644 		RLDBG(("periodic: since_last=%u", rl->ratelimited_events));  in log_ratelimit()
645 		rl->last_log = now;  in log_ratelimit()
647 			*events_dropped = rl->ratelimited_events;  in log_ratelimit()
648 			rl->ratelimited_events = 0;  in log_ratelimit()
654 	rl->ratelimited_events++;  in log_ratelimit()
655 	RLDBG(("drop: ratelimited_events=%u", rl->ratelimited_events));  in log_ratelimit()