value-pairs: Ignore empty values in SDATA too

The value-pairs framework ignored empty values when they were explicitly
specified as such, but when they came through via SDATA or any other
means, it treated them as empty strings, and allowed them through. This
was inconsistent, and a waste too.

This patch corrects that behaviour, and empty-valued SDATA members will
not pass through anymore.

Reported-by: Lucas McLane <lucas@clicksecurity.com>
Signed-off-by: Gergely Nagy <algernon@balabit.hu>
Merge pull request #28 from balabit/merge/f/value-pairs/skip-empty

value-pairs: Ignore empty values in SDATA too
value-pairs: Handle SDATA enterprise IDs correctly

RFC5424 SDATA IDs are of the form "[win@18372.4 foo=bar]", which
translates to "sdata.win@18372.4.foo=bar" internally. In this case, we
should not split the "4" into a separate object, but treat it as part of
the sdata ID.

To do this, the name splitting was enhanced, and instead of splitting by
every dot, it will look for @ too, and only split a token off after
that, if a dot is followed by a non-number. A test case to verify the
behaviour is also included.

Signed-off-by: Tibor Benke <btibi@balabit.hu>
Signed-off-by: Gergely Nagy <algernon@balabit.hu>
configure.ac: Correctly detect newer json-c too

Newer json-c had the pkg-config module renamed from json to json-c, and
while a compatiliby shim is available, we should not rely on that, but
detect json-c AND json as well.

To do that, we try the newer json-c first, and fall back to json if it
is not found.

Reported-by: Fabien Wernli <cpan@faxm0dem.org>
Signed-off-by: Gergely Nagy <algernon@balabit.hu>
Merge pull request #30 from balabit/merge/f/json-c

configure.ac: Correctly detect newer json-c too
Merge pull request #29 from balabit/merge/f/value-pairs/sdata-enterprise-id

value-pairs: Handle SDATA enterprise IDs correctly
value-pairs: Restructure vp_walker_name_split()

Instead of splitting tokens into an array of gchar*s, use a GPtrArray
instead, so that vp_walker_name_value_split() does not have to copy from
a pointer array to a string array.

Also introduce vp_walker_name_combine_prefix(), a short function to
replace the g_strjoinv() we used before.

The advantage of this is that it's much easier to extend later, for
example with array support. The code of vp_walker_name_split() becomes
easier to follow too.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
logproto: Fix the framed server free method

The LogProtoFramedServer free method did not call the free_method of its
super class, which resulted in memory & FD leaks when using a syslog()
source. This patch corrects that.

Reported-by: Andras Mitzki <micek@balabit.hu>
Signed-off-by: Gergely Nagy <algernon@balabit.hu>
stats: factor out common code from stats_register_counter() and stats_register_dynamic_counter()

This patch extracts common code from two stats function, eliminating some
duplication on the way.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
logmsg: forget the stored MSGHDR value in case PID is set

When a message comes in, syslog-ng automatically stores the MSGHDR as it
looked like initially in order to be able to reproduce the message
in its original form.

The syslog-ng parser sometimes skips spaces, so otherwise the reproduced
message might somewhat be different.

However, if the nvpairs that make up $MSGHDR are changed, this behaviour
is quite unintuitive, resulting the changes to be ignored in the MSGHDR.

This patch adds a similar treatment to the PID nvpair as was already
present for PROGRAM.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
Merge pull request #33 from balabit/merge/f/logproto/framed-leak-fix

logproto: Fix the framed server free method
Merge pull request #31 from balabit/merge/f/value-pairs/name-split-restructure

value-pairs: Restructure vp_walker_name_split()
mainloop: Deinit the dns thread cache when reverting the config

When reloading the configuration and the new config fails to initialize,
syslog-ng reverts to the old config. But by that time,
dns_cache_thread_init() has already been called (when trying to init the
new config), and dns_cache_thread_deinit() never got called. So when we
tried to cfg_init() the old config, it called dns_cache_thread_init()
again, and triggered an assertion.

To fix the issue, the main thread's dns_cache_thread_init()/_deinit()
were moved to apphook instead, and dropped from cfg_init()/cfg_deinit().

Reported-by: Andras Mitzki <micek@balabit.hu>
Signed-off-by: Gergely Nagy <algernon@balabit.hu>
pdbtool: Initialize module_path

With the reloc patch that went in a while ago, module_path has to be
explicitly initialized, otherwise it will remain empty. And if it
remains empty, and we try to split it, GLib will spew warnings at us.

This patch adds the initialisation.

Reported-by: Andras Mitzki <micek@balabit.hu>
Signed-off-by: Gergely Nagy <algernon@balabit.hu>
afmongodb: Add/restore authentication support

A long, long time ago, the MongoDB destination was able to authenticate
when connecting to MongoDB. This was broken soon after, and disabled,
with the username() and password() options going away in February this
year.

This patch brings these options back, and implements the authentication
functionality too.

While most of it will work with a libmongo-client older than 0.1.7, if
the driver falls back to a replica, it will not work until restarted.
When using libmongo-client 0.1.7+, that works too. For this reason, the
internal copy of libmongo-client is also updated for the fresh 0.1.7
release.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
Merge pull request #34 from balabit/merge/h/cfg-old-reload-crash

mainloop: Deinit the dns thread cache when reverting the config
Merge pull request #37 from balabit/merge/f/mongodb-auth

afmongodb: Add/restore authentication support
Merge pull request #35 from balabit/merge/h/pdbtool/module-path-init

pdbtool: Initialize module_path
transport: move files to a subdirectory in preparation of a split

In prepraration of splitting all LogTransport classes into separate
files, this patch moves all base files to the newly created subdirectory,
and patches Makefiles to make these compile properly from the new location.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
transport: extract LogTransportFile to a separate module

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>