[rsyslog] directing logs to a broadcast address fails

[Tom Metro]

Rainer Gerhards wrote:
>> I'll try doing the backport. As long as there aren't any
>> interdependencies that can't be met (like reliance on a newer kernel or
>> shared library), it should just be a matter of grabbing the newer
>> package source and rebuilding. Then when the OS eventually gets
>> upgraded, it'll automatically get updated too.
> 
> Ahhhh! I was thinking about backporting a patch. ...  I think a
> backport to the older distro should be fairly painless. You may run into
> gnutls issues, if you do, let me know. They should be easy to address (at
> least I hope so).

The backport was straight forward. A few compile warnings. A bunch of 
packaging warnings (apparently one of the Debian tools checks for 
unresolved symbols within the packaged libraries). But it installed and 
ran OK (I'll post the procedure separately), and after merging the 1.x 
and 3.x conf file, didn't log any warnings on startup.

But it didn't fix the broadcast problem. As the apparently identical 
version works on Ubuntu 8.10, this suggests the problem is in one of the 
shared libraries.

Although...
/usr/local/src/rsyslog-3.18.1# fgrep -r setsockopt . | fgrep -i broadcast

produces no output, which seems suspicious. "fgrep -ir broadcast ." also 
turns up nothing relevant. I'd expect SO_BROADCAST to appear somewhere.

Maybe the rsyslog code hasn't change, but the underlying libraries 
lifted the requirement of an SO_BROADCAST flag in order for a socket to 
permit broadcast packets?

I tried the following patch to explicitly enable the SO_BROADCAST flag:

--- rsyslog-3.18.1.orig/omfwd.c
+++ rsyslog-3.18.1/omfwd.c
@@ -356,6 +356,11 @@
                 if(pData->protocol == FORW_UDP) {
                         if(pData->pSockArray == NULL) {
                                 pData->pSockArray = 
net.create_udp_socket((uchar*)pData->f_hname, NULL, 0);
+                               int on = 1;
+                               if (setsockopt(*pData->pSockArray, 
SOL_SOCKET, SO_BROADCAST,
+                                 (char *) &on, sizeof(on)) < 0 ) {
+                                       errmsg.LogError(NO_ERRCODE, 
"setsockopt(SO_BROADCAST)");
+                               }
                         }
                 }
                 pData->ttSuspend = time(NULL);


But that didn't fix it either.

(On a side note, the above code uses net.create_udp_socket() to create 
the UDP socket for forwarding, yet that function contains a bunch of 
error checking for a listening socket that isn't applicable, and 
potentially quite misleading, if it got triggered.)

  -Tom