system-source: Use so_rcvbuf(8192) on Linux

Some Linux kernel messages are particularly long (iscsi, for example),
so in order to not get garbage out, we need to increase the socket
buffer size, and 8k is big enough for now.

Reported-by: shih dane <daneshih1125@gmail.com>
Signed-off-by: Gergely Nagy <algernon@balabit.hu>
Major copyright & license fixups

Update all the copyright years in pretty much any file touched in the
past 2-2.5 years, and clarify the licensing situation:

lib/ is LGPL2.1+, modules/ is GPL2+, both with an OpenSSL
exception. Updated the top-level COPYING file to reflect the changed
paths too, and LGPL.txt was replaced with the text of LGPL 2.1
(instead of LGPL 3, when the sources were under 2.1+).

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
tfgeoip: $(geoip) template function

This implements a $(geoip) template function using libgeoip, based on
a patch from Csaba Major. The function can be used to look up the
2-letter country code of any IPv4 address or host passed to the function.

Currently only the 2-letter codes are supported, and only from the
default database, and only for IPv4 addresses (or hosts). Adding
further functionality can be done on demand, however.

Signed-off-by: Csaba Major <csaba.major@balabit.com>
Signed-off-by: Gergely Nagy <algernon@balabit.hu>
configure: Support silent rules, if available

Building with silent rules enabled has the advantage of producing
shorter output, and making warnings and other anomalies stand out
better. Building verbosely is still the default, but silent rules can
now be turned on by passing V=0 to make.

Silent rules support is only available if using a recent enough
automake to build the makefiles.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
Silence a few warnings

A couple of files were using strlen(), memcmp() and similar things
from <string.h> without explicitly including it, and the gcc on
FreeBSD9 complained about that - lets silence that by explicitly
including said header. While there, also add other missing include
statements.

Furthermore, a few mismatched prototype warnings, unused variables and
other minor things were cleaned up aswell.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
plugin: Fix a minor memory leak in plugin_list_modules()

When listing modules, the configuration was not used anywhere: it was
just allocated and never free'd.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
ivykis: Update to the latest 0.30 stable

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
Improved silent-rules support

This adds a few harmless things to the lex/yacc and doc building
rules, so their output will be shortened when using V=0. The variables
have no effect when using an automake that does not support
silent-rules, so it's completely backwards compatible.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
value-pairs: Support rekey outside of key()

There are situations where one would like to apply transformations to
keys selected by the scope, without having to re-list the selected
keys in the config (such as default transformations for mongodb and
format-json). For this to work, we need to be able to use rekey
outside of key(), so that the pattern given to rekey will not be
explicitly added to the set.

In other words, this allows us to write transformations that work on
the already assembled set, without adding new elements to it.

For the command-line variant, this is done with the new --rekey
option, which is exactly like --key, except it does not add the
pattern to the set.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
Use value-pairs transformations in mongodb and format-json

For both mongodb and json, leading dots are not allowed on key
names. The mongodb destination had a guard against this, and replaced
leading dots with an underscore, format-json did not.

With this patch, both will forcibly add a value-pair key
transformation that replaces the first leading dot. This covers the
most common cases, but makes the mongodb destination vulnerable to
keys like ".foo..bar". However, it is not the purpose of the driver to
guard against corner cases.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
dbparser: support inheriting properties in a corellation action

This patch implements an inherit-properties attribute for message type
actions is patterndb correlation. In case this is set to TRUE, the
triggering log message is cloned and all name-value pairs (including
tags) are automagically copied to the emitted message. The values set
in the values XML subtree overwrite the original values. In case it is
set to FALSE or unspecified, a new message is generated and only the
values set manually are added to it.

   <actions>
     <action>
       <message inherit-properties='TRUE'>
         <values>
           <value name="PROGRAM">my-program-name</value>
           <value name="MSG">Hello new message!</value>
           <value name="contextid">${session-id}@2</value>
         </values>
       </message>
     </action>
   </actions>

Signed-off-by: Balint Kovacs <blint@blint.hu>
Signed-off-by: Gergely Nagy <algernon@balabit.hu>