ivykis: updated to latest commit in ivykis-0.30 branch

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
tfuuid: rename to cryptofuncs

Some further crypto related functions are to be added to syslog-ng, I'd
like to avoid the profileration of modules just for single functions.

Thus "cryptofuncs" is born, a place for stuff that depeeds on OpenSSL.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
$(hash): New template function to calculate the hash of its inputs

This patch adds a family of new template functions called
$(hash), $(md5), $(md4), $(sha1), $(sha256), $(sha512)

These can be used to calculate the cryptographic hash of its arguments.

As it uses the SHA1() function from OpenSSL, it is only available if syslog-ng
is compiled using --enable-ssl.

One use case for it can be when you'd like to anonymize sensitive parts of the
log message (eg. the user name) you parsed out using patterndb before storing
or forwarding it for further analysis but would like to retain the ability to
correlate messages along this value. Beware though that such simple anonymization
can be broken if there's enough data available, see

    http://arxiv.org/pdf/cs/0610105v2.pdf for references and examples.

Another use-case is to generate quasi-unique-ids for data, using the
--length option that truncates the length of the hash to a shorter form.
In real life the chances of the collision is slim, but still makes it
possible to use a shorter id, than in most cases is unique, especially
when constrained to a time period, which is often the case for logs.

Syntax:
  $(<method> [opts] $arg1 $arg2 $arg3...)

Options:
  --length N, -l N    Truncate the hash to the first N characters

The generic name "hash" refers to md5. Arguments are concatenated w/o the
use of additional characters.

Thanks for the original idea to Martin Grauel.

Signed-off-by: Peter Gyongyosi <gyp@balabit.hu>
Signed-off-by: Gergely Nagy <algernon@balabit.hu>
Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
cryptofuncs: refactor hash related tests to a separate unit test program

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
msg_parse_lib: rearranged includes

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
value-pairs: clarified some error messages

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
libtest: added assert_template_format_with_context() function

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
tfjson: added skeleton unit tests
test_template: remove cryptofuncs unit tests

As they were moved to a separate test program in an earlier commit.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
basicfuncs: unit tests moved to a separate program

Continuing the refactor to independent unit tests, this patch moves stuff
from test_template to modules/basicfuncs/tests using the new
template_lib.c in libtest.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
test_template_speed: indent output so that unit test runs are more readable

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
test_template: refactor to use testutils

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
fixed invalid declarations for bison generated yyparse() functions

The new bison finally declares the yyparse() function in its header, which
revealed a couple of invalid declarations in a couple of parsers.

This patch fixes that.

Reported-By: Conrad Hoffmann <ch@bitfehler.net>
Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
afsocket: added error warning messages on so-rcvbuf/so-sndbuf failures

This patch checks if the setsockopt to change the socket buffer sizes
actually succeeds, and emits a warning if it doesn't. Otherwise it can be
difficult to detect udp drops due to receive buffer sizing issues, when
the kernel limits syslog-ng's attempt to increase the buffer.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
afsocket: Implement tcp_keepalive_time(), intvl() and probes()

Three new options are introduced this patch to control various TCP
keepalive related parameters

  tcp-keepalive-time()   - equivalent to /proc/sys/net/ipv4/tcp_keepalive_time
  tcp-keepalive-probes() - equivalent to /proc/sys/net/ipv4/tcp_keepalive_probes
  tcp-keepalive-intvl()  - equivalent to /proc/sys/net/ipv4/tcp_keepalive_intvl
  tcp-keepalive()        - an alias to the earlier so-keepalive() option to match the keepalive related params

With these new options one can control on a per-source basis the parameters
governing TCP keepalives.

While these options can be specified for all socket related sources,
it only makes sense for TCP-based transports.

By default, it's value is 0, which means using the kernel default (2
hours).

These options only work on platforms which provide TCP_KEEPCNT,
TCP_KEEPIDLE and TCP_KEEPINTVL setsockopts, which is only Linux as
far as I know.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
tcp(): enable TCP keepalive by default

This patch enables SO_KEEPALIVE by default and changes the various
keepalive timers so that broken connections would be detected within
2minutes, 60 seconds idle time, 10 seconds between keepalive probes and
6 failed probe means that the connection got broken.

The keepalive parameter setup only works on Linux.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
jsonparser: Clone the marker() setting when cloning the parser

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
afsmtp: Fix the module linkage

Use $(MODULE_DEPS_LIBS) and $(MODULE_LDFLAGS) instead of trying to
grab all the libs.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
jsonparser: Handle every kind of invalid input gracefully

Previously, we used json_tokener_parse_ex(), which always returned
NULL in case of an error. A while ago, we switched to
json_tokener_parse() instead, which never returns NULL, and instead,
modifies the returned object to be an integer casted to pointer in
case of an error.

This resulted in the json-parser segfaulting whenever it encountered
invalid input.

The best course of action is to switch back to
json_tokener_parse_ex(), because that way we can easily see when an
error happened, and we even have easy access to the error message.

In the long run, we should probably move back the tokener to the
LogJSONParser object, and protect it with a mutex, for a bit better
performance.

Reported-by: Eun Kyung <ekyung01@googlemail.com>
Signed-off-by: Gergely Nagy <algernon@balabit.hu>
db-parser(): implement a MAC address parser

The MACADDR parser matches the standard format for printing MAC-48
addresses in human-friendly form, whis consists of is six groups of
two hexadecimal digits, separated colons (:)

Signed-off-by: Balint Kovacs <blint@balabit.hu>