system-source: Stricter /dev/kmsg requirements on Linux

On Linux 3.2, /dev/kmsg is present, is seekable, is pollable with
poll(), but not with epoll(). This leads to a run-time abort, because
syslog-ng can't monitor the file in this case. To fix the situation,
tighten the requirements in system-source, and check not only for
seekability, but pollability too.

Reported-by: Martin Bagge / brother <brother@bsnet.se>
Signed-off-by: Gergely Nagy <algernon@balabit.hu>
system-source: Use /dev/log on HP-UX

Using /dev/pipe on HP-UX was a mistake, use /dev/log instead, as the
original shell script did.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
afstreams: Fix the CPPFLAGS for the module

It should look for files under both ${top_srcdir} and ${top_builddir},
not twice at the same place.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
afstreams: Migrate to new, working APIs

The afstreams module has been broken for more than a year, this patch
brings it back from the dead by migrating it to newer APIs and all.

Based on a patch by Balazs Scheidler <bazsi@balabit.hu>.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
system-source: Fix the uname() call on Solaris

On Solaris, uname() can return any positive value, and that indicates
success. Pretty much everywhere else, only 0 does. Thankfully, -1
signals failure everywhere, so check for that.

This makes system() work on Solaris again.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
affile: fixed a pipe permission problem

When syslog-ng creates a pipe, create it with user-specified permissions
or restrictive ones (0600) by default, instead of creating it with broad
read-write permissions (0666) and patching it up later.

Signed-off-by: Budai Laszlo <lbudai@balabit.hu>
Signed-off-by: Gergely Nagy <algernon@balabit.hu>
gprocess: setsid() does not depend on isatty()

On HPUX, during boot the console does not considered as a tty, so syslog-ng does not
call setsid, the tty is not detached and the supervisor is killed at the end of the boot.
setsid() does not and should not depend on isatty(), and anyways setsid() is considered
more unix way than ioctl().

Signed-off-by: Juhasz Viktor <jviktor@balabit.hu>
Signed-off-by: Viktor Tusa <tusa@balabit.hu>
logqueue-fifo: use after free in function log_queue_fifo_ack_backlog

Signed-off-by: Daniel Gados <gdani@balabit.hu>
persist-state: fix memory leak in persist_state_rename_entry

The old key was leaked when renaming a persist-state key. This patch fixes
that leak.

Signed-off-by: Juhasz Viktor <jviktor@balabit.hu>
Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
persist-state: free the SerializeArchive used for loading the state in persist_state_load_v4

Signed-off-by: Viktor Juhasz <jviktor@balabit.hu>
Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
stats: fix a failing assertion when stats_level() is changed

When stats-level() is changed and syslog-ng is reloaded, an assertion failed
in the facility counters unregistration. The reason was that
the unregistration used the 'other' category instead of the one assigned
to the given facility code.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
.travis.yml: Update for the new branch structure

Update the Travis-CI control file for the new branch structure.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
afuser: remove alarm workaround

The Linux kernel used to have a bug that caused the afuser driver
to block even if O_NONBLOCK is set in the open flags. It was fixed
a long time ago, and alarm() is incompatible with multithreaded programs,
thus get rid off the alarm() call to detect blocked ttys.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
README.md: add new file to describe syslog-ng

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
README.md: Various improvements

Rearrange the README a little bit, putting the source installation docs
at the top, adding more links, and rewording a few things here and
there.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
Makefile.am: Use the -no-install libtool flag for tests

When building test programs (anything in ${check_PROGRAMS}) add
-no-install to the list of LDFLAGS, so that libtool stops generating a
useless wrapper for them. This makes debugging the check programs
easier, and also avoids a lot of shell launching for no good reason.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
linux-kmsg-format: Correctly calculate time diffs on 32-bit platforms

On 32-bit platforms, explicitly cast struct timeval members to 64-bit,
so the time difference calculations will not be truncated.

Reported-by: Jakub Wilk <jwilk@debian.org>
Signed-off-by: Gergely Nagy <algernon@balabit.hu>
redis: Fix the host() and port() options

The host() and port() options were not declared in the parser, only in
the grammar, thus using them led to a syntax error. Declare them for the
parser too.

Reported-by: Otto Berger <otto@bergerdata.de>
Signed-off-by: Gergely Nagy <algernon@balabit.hu>
syslogformat: Only set PROGRAM to kernel when the message is local

When the message is not local, do not override - or set - the value of
PROGRAM, there's other ways to do that. Doing an unconditional setting
breaks setups where kernel messages are forwarded between syslog-ng
instances:

The first syslog-ng sees "<4>Some message..." on /proc/kmsg, sets
PROGRAM to "kernel", and sends it over on tcp as "<4>kernel: Some
message...". The second syslog-ng sees that, from the facility it sees
that it's a kernel message, and sets PROGRAM to kernel again.

But when a message is from the kernel, we don't parse the rest, we don't
extract the program, we treat the rest of the message as MESSAGE, so in
this case, we'd end up with "<4>kernel: kernel: Some message", and each
hop would add another "kernel: ".

If we only set this when the message is local, we avoid this. The
downside is, that on the remote end, PROGRAM will not be set.

Reported-by: Matyas Koszik <koszik@atw.hu>
Signed-off-by: Gergely Nagy <algernon@balabit.hu>
Link to SSL-using modules to libsyslog-ng-crypto too

Since OpenSSL needs some initialization to work properly, link afql to
libsyslog-ng-crypto to do that. If we don't do this, then loading
afsql (or any other module that uses OpenSSL) before anything that uses
libsyslog-ng-crypto (like afsocket) will fail and result in a
segmentation fault.

Affected modules are: afsql, afmongodb and afsmtp.

Reported-by: Imre Lazar <imre@balabit.hu>
Signed-off-by: Gergely Nagy <algernon@balabit.hu>