Hi Florian Found a bug in rsyslog-8.29.0. I see the issue exists in master branch as well: https://github.com/rsyslog/rsyslog/blob/v8-stable/plugins/omudpspoof/omudpspoof.c#L513
When the issue happens, rsyslogd goes into infinite loop and syslogging stops. Reproducible when udpspoof module is in play. I can provide rsyslog debugs, write up a bug report and send out patch for review. Could you/someone let me know how to proceed? Please see rsyslog debugs below when this happens: 6411.556251553:main Q:Reg/w0 : omudpspoof.c: omudpspoof: stage 2: MF:0, hdrOffs 1480, pktLen 213 goes onto sending remaining fragments of packet. Here rsyslog a tight loop without checking if sendto() returned -1. 6411.556152334:main Q:Reg/w0 : omudpspoof.c: inside omudpspoof.c:doAction 6411.556158073:main Q:Reg/w0 : omudpspoof.c: omudpspoof doTryResume entered, netns ns-management 6411.556163370:main Q:Reg/w0 : omudpspoof.c: XXX doTryResume:811 ret 0 6411.556169877:main Q:Reg/w0 : omudpspoof.c: 2400:db08:face::1:514/omudpspoof, src 'fdfd:5c41:712d:e037::af0:42ac', msg strt '<167>Apr 29 20:13:30 nfc317 ProcMgr-worker: %PROCMGR-7-PROCESSES_ADOPTED: ProcMgr (PID=2085) adopted running processes: (KernelNetworkInfo, PID=2688) (PhyEthtool, PID=2816) (Qos, PID=2691) (MicrosemiAgent, PID=2820) (McastCommon6, PID=2695) (CpuComplex, P' 6411.556175383:main Q:Reg/w0 : omudpspoof.c: UDPSend: pSockArray iS NULL... 6411.556180090:main Q:Reg/w0 : omudpspoof.c: omudpspoof doTryResume entered, netns ns-management 6411.556185246:main Q:Reg/w0 : omudpspoof.c: XXX doTryResume:811 ret 0 6411.556192330:main Q:Reg/w0 : omudpspoof.c: UDPSend: len 1685 maxpktlen 1480 6411.556197614:main Q:Reg/w0 : omudpspoof.c: omudpspoof: stage 1: MF:1, hdrOffs 0, pktLen 1472 6411.556238583:main Q:Reg/w0 : omudpspoof.c: omudpspoof: write error (total len 1685): pktLen 1500, sent -1, fd 21: libnet_write_raw_ipv6(): -1 bytes written (Network is unreachable) 6411.556245275:main Q:Reg/w0 : omudpspoof.c: UDPSend: msgOffs 1472 pktLen 1472 len 1685 6411.556251553:main Q:Reg/w0 : omudpspoof.c: omudpspoof: stage 2: MF:0, hdrOffs 1480, pktLen 213 6411.556261332:main Q:Reg/w0 : omudpspoof.c: omudpspoof: fragment write error len 1713, sent -1: libnet_pblock_coalesce(): packet assembly cannot find an IPv6 header 6411.556266762:main Q:Reg/w0 : omudpspoof.c: omudpspoof: stage 2: MF:0, hdrOffs 1480, pktLen 213 6411.556273235:main Q:Reg/w0 : omudpspoof.c: omudpspoof: fragment write error len 1713, sent -1: libnet_pblock_coalesce(): packet assembly cannot find an IPv6 header 6411.556281863:main Q:Reg/w0 : omudpspoof.c: omudpspoof: stage 2: MF:0, hdrOffs 1480, pktLen 213 6411.556288126:main Q:Reg/w0 : omudpspoof.c: omudpspoof: fragment write error len 1713, sent -1: libnet_pblock_coalesce(): packet assembly cannot find an IPv6 header 6411.556293197:main Q:Reg/w0 : omudpspoof.c: omudpspoof: stage 2: MF:0, hdrOffs 1480, pktLen 213 6411.556299583:main Q:Reg/w0 : omudpspoof.c: omudpspoof: fragment write error len 1713, sent -1: libnet_pblock_coalesce(): packet assembly cannot find an IPv6 header 6411.556304892:main Q:Reg/w0 : omudpspoof.c: omudpspoof: stage 2: MF:0, hdrOffs 1480, pktLen 213 6411.556310991:main Q:Reg/w0 : omudpspoof.c: omudpspoof: fragment write error len 1713, sent -1: libnet_pblock_coalesce(): packet assembly cannot find an IPv6 header On Tue, Apr 28, 2020 at 8:27 AM Florian Riedl via rsyslog < [email protected]> wrote: > Hi all, > > today, we release rsyslog 8.2004.0. This release provides mostly > bugfixes for rsyslog. > > There are a number of ksi bugfixes, so if your are using this, check > out the changes. Another notable change is the addition of support for > libreSSL in the openssl implementation. > > Also, there were fixes and changes for imfile, omprog, openssl drivers > and many more. > > The next release will happen some time in June. > > ChangeLog: > > https://github.com/rsyslog/rsyslog/blob/v8-stable/ChangeLog > > Download: > > https://www.rsyslog.com/downloads/download-v8-stable/ > > As always, feedback is appreciated. > > > The Adiscon Team > _______________________________________________ > rsyslog mailing list > https://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
