git: 2018defe9b98 - stable/15 - syslogd: Fix ereregex property filters and add test

The branch stable/15 has been updated by ngie:

URL: https://cgit.FreeBSD.org/src/commit/?id=2018defe9b98a378dbc98ab53c8d000e922fe0b8

commit 2018defe9b98a378dbc98ab53c8d000e922fe0b8
Author:     tzyt <zyt2006613@outlook.com>
AuthorDate: 2026-03-22 08:40:57 +0000
Commit:     Enji Cooper <ngie@FreeBSD.org>
CommitDate: 2026-05-27 22:09:07 +0000

    syslogd: Fix ereregex property filters and add test
    
    This change fixes Bug 293879, where ereregex filters in syslogd
    did not handle alternation correctly.
    
    The issue appears to come from mixing up two different kinds of
    flags: syslogd's internal serialized filter flags in
    usr.sbin/syslogd/syslogd.h, and the regex compilation flags from
    include/regex.h. ereregex was storing REG_EXTENDED in cmp_flags,
    even though cmp_flags is meant to carry syslogd's own FILT_FLAG_*
    values for configuration serialization and reconstruction.
    
    REG_EXTENDED has the same bit value as FILT_FLAG_EXCLUDE, so the
    filter could be reconstructed with the wrong semantics.
    
    The fix stores FILT_FLAG_EXTENDED instead, allowing syslogd to
    correctly REG_EXTENDED when compiling the regex.
    
    A test was also added for both ereregex and !ereregex filters.
    
    PR: 293879
    Signed-off-by: tzyt <zyt2006613@outlook.com>
    Fixes: 2567168dc4986
    MFC after: 1 week
    Reviewed-by: markj, ngie
    Pull-Request: https://github.com/freebsd/freebsd-src/pull/2088
    (cherry picked from commit 69042706604752f42072f422671a72c49343ac45)
---
 usr.sbin/syslogd/syslogd.c             |  2 +-
 usr.sbin/syslogd/tests/syslogd_test.sh | 22 ++++++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/usr.sbin/syslogd/syslogd.c b/usr.sbin/syslogd/syslogd.c
index ee15fa70807d..3a446baf504b 100644
--- a/usr.sbin/syslogd/syslogd.c
+++ b/usr.sbin/syslogd/syslogd.c
@@ -2818,7 +2818,7 @@ prop_filter_compile(const char *cfilter)
 		pfilter.cmp_type = FILT_CMP_REGEX;
 	else if (strcasecmp(argv[1], "ereregex") == 0) {
 		pfilter.cmp_type = FILT_CMP_REGEX;
-		pfilter.cmp_flags |= REG_EXTENDED;
+		pfilter.cmp_flags |= FILT_FLAG_EXTENDED;
 	} else {
 		dprintf("unknown cmp function");
 		goto error;
diff --git a/usr.sbin/syslogd/tests/syslogd_test.sh b/usr.sbin/syslogd/tests/syslogd_test.sh
index 1f235c476c49..253a26258959 100644
--- a/usr.sbin/syslogd/tests/syslogd_test.sh
+++ b/usr.sbin/syslogd/tests/syslogd_test.sh
@@ -238,6 +238,28 @@ prop_filter_body()
     syslogd_check_log_nomatch "prop1: FreeBSD"
     syslogd_check_log_nomatch "prop2: freebsd"
     syslogd_check_log "prop3: Solaris"
+
+    printf ":msg,ereregex,\"substring1|substring2\"\nuser.debug\t${SYSLOGD_LOGFILE}\n" \
+        > "${SYSLOGD_CONFIG}"
+    syslogd_reload
+
+    syslogd_log -p user.debug -t "prop1" -h "${SYSLOGD_LOCAL_SOCKET}" "substring1"
+    syslogd_check_log "prop1: substring1"
+    syslogd_log -p user.debug -t "prop2" -h "${SYSLOGD_LOCAL_SOCKET}" "substring2"
+    syslogd_check_log "prop2: substring2"
+    syslogd_log -p user.debug -t "prop3" -h "${SYSLOGD_LOCAL_SOCKET}" "substring3"
+    syslogd_check_log_nomatch "prop3: substring3"
+
+    printf ":msg,!ereregex,\"substring1|substring2\"\nuser.debug\t${SYSLOGD_LOGFILE}\n" \
+        > "${SYSLOGD_CONFIG}"
+    syslogd_reload
+
+    syslogd_log -p user.debug -t "prop1" -h "${SYSLOGD_LOCAL_SOCKET}" "substring1"
+    syslogd_check_log_nomatch "prop1: substring1"
+    syslogd_log -p user.debug -t "prop2" -h "${SYSLOGD_LOCAL_SOCKET}" "substring2"
+    syslogd_check_log_nomatch "prop2: substring2"
+    syslogd_log -p user.debug -t "prop3" -h "${SYSLOGD_LOCAL_SOCKET}" "substring3"
+    syslogd_check_log "prop3: substring3"
 }
 prop_filter_cleanup()
 {