libtest: add assert_log_message_doesn_have_tag() function

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
libtest: add support for a NULL expected value in assert_log_message_value()

Which means it should be unset or the zero string.

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
db-parser: add comment about locking to the state expiry function

It is not trivial that the expire function that removes the correlation
state is actually protected by a lock. Document this fact.

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
db-parser: remove PDBInput from patterndb external interfaces

Instead of requiring our callers to instantiate this structure, do so in a
wrapper function, also as an automatic variable, so performance should be
the same.

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
db-parser: fixed e2e style parser testing in test_patterndb

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
db-parser: refactor test_patterndb

This patch massively refactors the old test_patterndb program, which is a
kind of integration test.  It's not yet completely done, but is _way_ better
than it used to be.

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
db-parser: move the code that runs an action to PDBAction

Earlier the code that actually performed the things the action needed to do
was associated with PDBRule, change this.

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
db-parser: rename PDBInput to PDBLookupParams

This name is somewhat easier to understand.

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
db-parser: remove the passing around of the emit function

The emit function is available in the PatternDB instance, so it is
superficial to pass both.  This patch removes the excess arguments in favour
of using the function from the PatternDB instance.

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
db-parser: split pdb_action_run() into is_triggered & execute

This patch splits pdb_action_run() into two functions, the first
one checks whether the action is really triggered by checking
the various conditions. Execute performs the action with no questions
asked. The old pdb_action_run() just invokes both.

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
db-parser: rename first args to PDBAction functions to self

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
db-parser: reorder pdb_rule_run_actions() arguments to match pdb_action_run()

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
db-parser: extract pdb_action_generate_default_message()

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
db-parser: move inherit_properties to the content field where it belongs

This field was erroneously in the PDBAction struct whereas it should have
been part of its "content" member, as it is completely RAC_MESSAGE specific.
There are currently no other action types though.

The patch also renames inherit_properties to inherit_mode in preparation of
the "context" inherit mode.

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
db-parser: refactor pdb_action_generate_default_message() to smaller functions

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
db-parser: extract pdb_context_get_last_message()

Instead of peeking into PDBContext's message list to get the last message,
create a designated function for this purpose.

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
db-parser: use explicit enum references in the data structure

Following a review comment by Viktor Juhasz, I've named all the enums
in patterndb-int.h and referenced it from all around the data structure
to make their relations more explicit.

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
Merge pull request #289 from balabit/f/dbparser-testing

F/dbparser testing
libtest: add assert_log_message_value_by_name() function

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
libtest: fix compilation warning in assert_msg_field_equals_non_fatal()

WIP: a very similar function is available in msg_parse_lib