timeutils: Support Tzif3 format timezone files too

The latest tzdata release added a new tzif version, with some minor
changes. This patch adds support for the format to our zone info parser,
and fixes #86.

Reported-by: Peter Czanik <czanik@balabit.hu>
Signed-off-by: Gergely Nagy <algernon@balabit.hu>
json-parser: Fix cloning when no marker is set

When cloning a json-parser, only clone the marker if it is set in the
original, otherwise we may end up crashing trying to strlen(NULL).

Reported-by: Fabien Wernli <bugzilla.balabit@faxm0dem.org>
Signed-off-by: Gergely Nagy <algernon@balabit.hu>
tfgeoip: Handle the failed lookup case gracefully

When a GeoIP lookup fails, do not try to use the result, as trying to
append NULL to a GString results in a GLib warning, which is not nice.

Reported-by: Fabien Wernli
Signed-off-by: Gergely Nagy <algernon@balabit.hu>
system(): Don't use /dev/klog in a FreeBSD jail

When figuring out what to expand system() to, check whether we're in a
jail when running on FreeBSD, and don't include /dev/klog if we are.
This fixes #93.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
nvtable: fix an NV registry corruption in the unit tests

nv_registry_add_alias() used the passed in pointer to the alias verbatim,
without copying it.  However the unit test program generated alias names
dynamically, e.g.  editing the memory area that was used to store the hash
table key.

Since this wasn't intuitive at all, this patch changes the code so that the
key in the NV registry is now always duplicated before insertion.

Signed-off-by: Igor Ippolitov <iippolitov@gmail.com>
Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
afmongodb: Mark host() and port() obsolete

The host() and port() options should have been marked obsolete a while
ago, fix that now, and suggest using servers() instead. This fixes #92.

Reported-by: Andras Mitzki <micek@balabit.hu>
Signed-off-by: Gergely Nagy <algernon@madhouse-project.org>
value-pairs: Handle SDATA enterprise IDs correctly

RFC5424 SDATA IDs are of the form "[win@18372.4 foo=bar]", which
translates to "sdata.win@18372.4.foo=bar" internally. In this case, we
should not split the "4" into a separate object, but treat it as part of
the sdata ID.

To do this, the name splitting was enhanced, and instead of splitting by
every dot, it will look for @ too, and only split a token off after
that, if a dot is followed by a non-number. A test case to verify the
behaviour is also included.

Signed-off-by: Tibor Benke <btibi@balabit.hu>
Signed-off-by: Gergely Nagy <algernon@balabit.hu>
value-pairs: Restructure vp_walker_name_split()

Instead of splitting tokens into an array of gchar*s, use a GPtrArray
instead, so that vp_walker_name_value_split() does not have to copy from
a pointer array to a string array.

Also introduce vp_walker_name_combine_prefix(), a short function to
replace the g_strjoinv() we used before.

The advantage of this is that it's much easier to extend later, for
example with array support. The code of vp_walker_name_split() becomes
easier to follow too.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
value-pairs: replace trash stack with own stack implementation

Because of the g_trash_stack and its usage problems could arise when
the strict-aliasing compile option was set leading to bad value-pairs
expansion. With the own implementation the bogous usage of g_trash_stack
is supposed to be eliminated.

Signed-off-by: Daniel Gados <gdani@balabit.hu>
afamqp: Make the username() and password() options mandatory

For the destination to work, we need both username() and password()
supplied, otherwise the underlying library will crash. If either of
those is unset, fail the driver initialization. This fixes #80.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
patterndb: Fix test_patterndb crash when testing outside-of-rule db lookups.

First test_patterndb_tags_outside_of_rule() nulls out the messages pointer,
then it calls clean_pattern_db(), which unconditionally dereferences it.

This will never work.

Guard the use of messages in clean_pattern_db() with a nullity check.

Signed-off-by: Nick Alcock <nix@esperi.org.uk>
plugin.c: Use G_MODULE_BIND_LAZY instead of G_MODULE_BIND_LOCAL

When we have a situation where we load a syslog-ng module, linked
against a certain library, and that module tries to load a plugin that
requires the library the module is linked against, but the plugin isn't,
using BIND_LOCAL will result in symbol lookup errors. Not using it will
correctly resolve the symbols previously loaded.

This is needed to be able to load Lua, Perl, etc modules.

On some exotic platforms (like AIX), where the linker tends to act
strangely, this may cause problems. If it does, we should likely use
BIND_LOCAL there.

Signed-off-by: Gergely Nagy <algernon@madhouse-project.org>
Fix the memory leak problem for mutex

Signed-off-by: Xufeng Zhang <xufeng.zhang@windriver.com>
Signed-off-by: Tusa Viktor <tusa@balabit.hu>
rewrite-expr-grammar.ym: Free up token.

Reported-by: Xufeng Zhang <xufeng.zhang@windriver.com>
Signed-off-by: Viktor Tusa <tusavik@gmail.com>
ValuePairs: fixed some memory leak

  * free all the content of the g_ptr_array, not just the array itself
    (Viktor Tusa fixed it in 3.6)
  * free the g_ptr_array() when failed to split the vp names
    (found by Balazs Scheidler)