From nobody Wed Jan 28 05:08:03 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4f19Jg6ZqXz6QLWl for ; Wed, 28 Jan 2026 05:08:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4f19Jg5QBRz45F7 for ; Wed, 28 Jan 2026 05:08:03 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1769576883; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=SIPg8ZGjQqllbbUasjWR5dzHyRZ8lcv09NWRyFx/buw=; b=OFyNA4PQJNmXPgk1ChE7xXSRDWXh7iW7/09qj2NI0RuxNLOwiZ7x02OTuh7tCzF1h/XcN0 sxaMb+57gjpSiYkWm5B3hbTHkvark0SsDp6IepryW4GLJpPZ2ayG6jc3wn1UkSoNKoE+im CTmJ6ObjK24i7Divy2urhXsLr98ANx/QDMV7lINc9n+pxqF0jObqqWs3YPWCVSn4Y9VBUS epnDLuN8/H2Hn8SYrGQqR8m3Vai+aiYOAOrB8DbCCAf60+IXDcnr1nkx4WwJJ7kKAVluAU oYdq8LYmT6pse5+IudY6aDQM3XF07icd4R84nxHR+y/8TxcW9CWRje/lObfQMQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1769576883; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=SIPg8ZGjQqllbbUasjWR5dzHyRZ8lcv09NWRyFx/buw=; b=W4F6nQ+U+eIfk6dtUSL5C287GPQL929pOYPMAlOBaYDxqJi7yVI5HhPMGb8sfNeZUg66xv ETxbTXD5n/KON2PaLRTrdgCOamAGm3Vs68SwaQW+QFcw62taZNUKs6BpXbGHG/1ABn3B+y 51MrjbRfjtrW6aRw7jfbEQCdNz2b0LOtrkhn39zYpKsqm+GkWoMwUFLeH8H0k6My3/bGNn IguYzyDxcsD1d91+LOqYafmQW3EQHvO8Wf7gOcus7QW6w3L1vwNrBbQhv7H42g6OG+2nOK +S5ZIRRwhdO7QDwn7k4007LRwYMFnpLvQwfaS0AOBjnRRi+jgtfmmhi8FqCU7Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1769576883; a=rsa-sha256; cv=none; b=kUOMSw+A7G893XODfAeYaW3eTXGxu5Q3/LnNUF0da3CPG8tiWva4NhLCxNq2dstcgNKlI+ ZWAjuFMNEUYyv6IYx/fmc0GbIj5gBlngbFEtdo4QtUaTO6JqfK0e3quldl0a7frHTAYy7a pEQX+sLmJCrBqv/RQUJvwUmaDMlDbyvAKlGB3NI10+Kw9rU1pj3dfKcZgLtULXRASEp7M6 sOl+XOPuiurijKVOIE8xEtIUZJgu6BGvJhocPvjh20sbH2R3nzShYhP/Gy6o1+xyTOA0Hd /sEgCeBttcjDWFzujb6vsfWEUxKThl23xZZHAYKvVwpx+78v9YOS+moxTfihuw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4f19Jg4R23zfp1 for ; Wed, 28 Jan 2026 05:08:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3ab7b by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 28 Jan 2026 05:08:03 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Joseph Mingrone Subject: git: 223ebd5a04c4 - stable/13 - periodic: Support RFC 5424 syslog timestamps List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jrm X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: 223ebd5a04c444b239037e89a0dbbc637c287bed Auto-Submitted: auto-generated Date: Wed, 28 Jan 2026 05:08:03 +0000 Message-Id: <697999b3.3ab7b.50dad5ba@gitrepo.freebsd.org> The branch stable/13 has been updated by jrm: URL: https://cgit.FreeBSD.org/src/commit/?id=223ebd5a04c444b239037e89a0dbbc637c287bed commit 223ebd5a04c444b239037e89a0dbbc637c287bed Author: Joseph Mingrone AuthorDate: 2026-01-08 19:22:58 +0000 Commit: Joseph Mingrone CommitDate: 2026-01-28 05:05:49 +0000 periodic: Support RFC 5424 syslog timestamps This is based on an initial implementation by michaelo in https://reviews.freebsd.org/D54361. PR: 270497 Reported by: michaelo Reviewed by: michaelo Tested by: michaelo MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D54606 (cherry picked from commit 8ac6427b1bb95470f6c755202d1c0391ed8eefbd) --- usr.sbin/periodic/etc/daily/460.status-mail-rejects | 13 ++++++++++--- usr.sbin/periodic/etc/security/800.loginfail | 11 +++++++++-- usr.sbin/periodic/etc/security/900.tcpwrap | 11 +++++++++-- 3 files changed, 28 insertions(+), 7 deletions(-) diff --git a/usr.sbin/periodic/etc/daily/460.status-mail-rejects b/usr.sbin/periodic/etc/daily/460.status-mail-rejects index f64a8cb75a24..74ebe6b171ce 100755 --- a/usr.sbin/periodic/etc/daily/460.status-mail-rejects +++ b/usr.sbin/periodic/etc/daily/460.status-mail-rejects @@ -36,8 +36,15 @@ case "$daily_status_mail_rejects_enable" in echo echo Checking for rejected mail hosts: - yesterday=$(date -v-1d '+%b %e') - today=$(date '+%b %e') + # Support both RFC 3164 (traditional) and RFC 5424 syslog timestamps. + today_3164="$(date '+%b %e ')" + today_5424="$(date -I)" + prefix_today="(^${today_3164}|^<[0-9]{1,3}>1 ${today_5424}T)" + + yesterday_3164="$(date -v-1d '+%b %e ')" + yesterday_5424="$(date -v-1d -I)" + prefix_yesterday="(^${yesterday_3164}|^<[0-9]{1,3}>1 ${yesterday_5424}T)" + n=$(($daily_status_mail_rejects_logs - 2)) rc=$({ while [ $n -ge 0 ] @@ -55,7 +62,7 @@ case "$daily_status_mail_rejects_enable" in n=$(($n - 1)) done cat /var/log/maillog - } | sed -Ene "/^$today/q" -e "/^$yesterday/{"' + } | sed -En -e "/$prefix_today/q" -e "/$prefix_yesterday/{"' s/.*ruleset=check_relay,.* relay=([^,]+), reject=([^ ]*).*/\2 check_relay \1/p t end s/.*ruleset=check_rcpt,.* arg1=,]+).* reject=([^ ]+) .* ([^ ]+)/\2 check_rcpt \1 \3/p diff --git a/usr.sbin/periodic/etc/security/800.loginfail b/usr.sbin/periodic/etc/security/800.loginfail index 19bf9a4b3b91..91564185b653 100755 --- a/usr.sbin/periodic/etc/security/800.loginfail +++ b/usr.sbin/periodic/etc/security/800.loginfail @@ -39,7 +39,14 @@ fi LOG="${security_status_logdir}" -yesterday=`date -v-1d "+%b %e "` +# Support both RFC 3164 (traditional) and RFC 5424 syslog timestamps. +yesterday_3164="$(date -v-1d '+%b %e ')" +prefix_3164="^${yesterday_3164}" + +yesterday_5424="$(date -v-1d -I)" +prefix_5424="^<[0-9]{1,3}>1 ${yesterday_5424}T" + +prefix="(${prefix_3164}|${prefix_5424})" catmsgs() { find ${LOG} -name 'auth.log.*' -mtime -2 | @@ -57,7 +64,7 @@ if check_yesno_period security_status_loginfail_enable then echo "" echo "${host} login failures:" - n=$(catmsgs | egrep -ia "^$yesterday.*: .*\b(fail(ures?|ed)?|invalid|bad|illegal|auth.*error)\b" | + n=$(catmsgs | egrep -ia "${prefix}.*\b(fail(ures?|ed)?|invalid|bad|illegal|auth.*error)\b" | tee /dev/stderr | wc -l) [ $n -gt 0 ] && rc=1 || rc=0 fi diff --git a/usr.sbin/periodic/etc/security/900.tcpwrap b/usr.sbin/periodic/etc/security/900.tcpwrap index bbbc04a03988..8f6f17ebd756 100755 --- a/usr.sbin/periodic/etc/security/900.tcpwrap +++ b/usr.sbin/periodic/etc/security/900.tcpwrap @@ -39,7 +39,14 @@ fi LOG="${security_status_logdir}" -yesterday=`date -v-1d "+%b %e "` +# Support both RFC 3164 (traditional) and RFC 5424 syslog timestamps. +yesterday_3164="$(date -v-1d '+%b %e ')" +prefix_3164="^${yesterday_3164}" + +yesterday_5424="$(date -v-1d -I)" +prefix_5424="^<[0-9]{1,3}>1 ${yesterday_5424}T" + +prefix="(${prefix_3164}|${prefix_5424})" catmsgs() { find ${LOG} -name 'messages.*' -mtime -2 | @@ -57,7 +64,7 @@ if check_yesno_period security_status_tcpwrap_enable then echo "" echo "${host} refused connections:" - n=$(catmsgs | grep -i "^$yesterday.*refused connect" | + n=$(catmsgs | egrep -ia "${prefix}.*refused connect" | tee /dev/stderr | wc -l) [ $n -gt 0 ] && rc=1 || rc=0 fi