completed multi-ruleset core support

... as well as added multi-ruleset support for imtcp

15 files changed, 226 insertions, 61 deletions

diff --git a/dirty.h b/dirty.h
index 7ae57d09..513886b5 100644
--- a/dirty.h
+++ b/dirty.h
@@ -53,7 +53,6 @@ extern int  bReduceRepeatMsgs;
 extern int bDropTrailingLF;
 extern uchar cCCEscapeChar;
 extern int  bEscapeCCOnRcv;
-extern ruleset_t *pCurrRuleset;
 #ifdef USE_NETZIP
 /* config param: minimum message size to try compression. The smaller
  * the message, the less likely is any compression gain. We check for
diff --git a/doc/rsyslog_conf_global.html b/doc/rsyslog_conf_global.html
index a909b00c..d58bcac0 100644
--- a/doc/rsyslog_conf_global.html
+++ b/doc/rsyslog_conf_global.html
@@ -108,6 +108,9 @@ that no rebind is done. This directive is useful for use with load-balancers.</l
 <li>$DefaultNetstreamDriver &lt;drivername&gt;, the default <a href="netstream.html">network stream driver</a> to use. Defaults to&nbsp;ptcp.$DefaultNetstreamDriverCAFile &lt;/path/to/cafile.pem&gt;</li>
 <li>$DefaultNetstreamDriverCertFile &lt;/path/to/certfile.pem&gt;</li>
 <li>$DefaultNetstreamDriverKeyFile &lt;/path/to/keyfile.pem&gt;</li>
+<li><b>$DefaultRuleset</b> <i>name</i> - changes the default ruleset for unbound inputs to
+the provided <i>name</i> (the default default ruleset is named
+&quot;RSYSLOG_DefaultRuleset&quot;).
 <li><b>$CreateDirs</b> [<b>on</b>/off] - create directories on an as-needed basis</li>
 <li><a href="rsconf1_dircreatemode.html">$DirCreateMode</a></li>
 <li><a href="rsconf1_dirgroup.html">$DirGroup</a></li>
@@ -208,8 +211,11 @@ line is that n is large enough to get a good idea which message was repeated but
 large enough for the whole message. (Introduced with 4.1.5). Once set, it affects all following actions.</li>
 <li><a href="rsconf1_repeatedmsgreduction.html">$RepeatedMsgReduction</a></li>
 <li><a href="rsconf1_resetconfigvariables.html">$ResetConfigVariables</a></li>
-<li><b>$Ruleset</b> name - starts a new ruleset. All following actions belong to
-that new rule set.</li>
+<li><b>$Ruleset</b> <i>name</i> - starts a new ruleset or switches back to one already defined.
+All following actions belong to that new rule set.
+the <i>name</i> does not yet exist, it is created. To swith back to rsyslog's
+default ruleset, specify &quot;RSYSLOG_DefaultRuleset&quot;) as the name.
+All following actions belong to that new rule set.</li>
 <li><b>$OptimizeForUniprocessor</b> [on/<b>off</b>] - turns on optimizatons which lead to better
 performance on uniprocessors. If you run on multicore-machiens, turning this off lessens CPU load. The
 default may change as uniprocessor systems become less common. [available since 4.1.0]</li>
diff --git a/plugins/imtcp/imtcp.c b/plugins/imtcp/imtcp.c
index 84e660bc..e1f513c8 100644
--- a/plugins/imtcp/imtcp.c
+++ b/plugins/imtcp/imtcp.c
@@ -61,6 +61,7 @@
 #include "netstrm.h"
 #include "errmsg.h"
 #include "tcpsrv.h"
+#include "ruleset.h"
 #include "net.h" /* for permittedPeers, may be removed when this is removed */
 
 MODULE_TYPE_INPUT
@@ -72,6 +73,7 @@ DEFobjCurrIf(tcps_sess)
 DEFobjCurrIf(net)
 DEFobjCurrIf(netstrm)
 DEFobjCurrIf(errmsg)
+DEFobjCurrIf(ruleset)
 
 /* Module static data */
 static tcpsrv_t *pOurTcpsrv = NULL;  /* our TCP server(listener) TODO: change for multiple instances */
@@ -84,6 +86,7 @@ static int iStrmDrvrMode = 0; /* mode for stream driver, driver-dependent (0 mos
 static int iAddtlFrameDelim = TCPSRV_NO_ADDTL_DELIMITER; /* addtl frame delimiter, e.g. for netscreen, default none */
 static uchar *pszStrmDrvrAuthMode = NULL; /* authentication mode to use */
 static uchar *pszInputName = NULL; /* value for inputname property, NULL is OK and handled by core engine */
+static ruleset_t *pBindRuleset = NULL; /* ruleset to bind listener to (use system default if unspecified) */
 
 
 /* callbacks */
@@ -157,6 +160,27 @@ finalize_it:
 }
 
 
+/* accept a new ruleset to bind. Checks if it exists and complains, if not */
+static rsRetVal setRuleset(void __attribute__((unused)) *pVal, uchar *pszName)
+{
+	ruleset_t *pRuleset;
+	rsRetVal localRet;
+	DEFiRet;
+
+	localRet = ruleset.GetRuleset(&pRuleset, pszName);
+	if(localRet == RS_RET_NOT_FOUND) {
+		errmsg.LogError(0, NO_ERRCODE, "error: ruleset '%s' not found - ignored", pszName);
+	}
+	CHKiRet(localRet);
+	pBindRuleset = pRuleset;
+	DBGPRINTF("imtcp current bind ruleset %p: '%s'\n", pRuleset, pszName);
+
+finalize_it:
+	free(pszName); /* no longer needed */
+	RETiRet;
+}
+
+
 static rsRetVal addTCPListener(void __attribute__((unused)) *pVal, uchar *pNewVal)
 {
 	DEFiRet;
@@ -180,7 +204,8 @@ static rsRetVal addTCPListener(void __attribute__((unused)) *pVal, uchar *pNewVa
 		}
 	}
 
-	/* initialized, now add socket */
+	/* initialized, now add socket and listener params */
+	CHKiRet(tcpsrv.SetRuleset(pOurTcpsrv, pBindRuleset));
 	CHKiRet(tcpsrv.SetInputName(pOurTcpsrv, pszInputName == NULL ?
 						UCHAR_CONSTANT("imtcp") : pszInputName));
 	tcpsrv.configureTCPListen(pOurTcpsrv, pNewVal);
@@ -240,6 +265,7 @@ CODESTARTmodExit
 	objRelease(tcps_sess, LM_TCPSRV_FILENAME);
 	objRelease(tcpsrv, LM_TCPSRV_FILENAME);
 	objRelease(errmsg, CORE_COMPONENT);
+	objRelease(ruleset, CORE_COMPONENT);
 ENDmodExit
 
 
@@ -249,14 +275,10 @@ resetConfigVariables(uchar __attribute__((unused)) *pp, void __attribute__((unus
 	iTCPSessMax = 200;
 	iStrmDrvrMode = 0;
 	iAddtlFrameDelim = TCPSRV_NO_ADDTL_DELIMITER;
-	if(pszInputName != NULL) {
-		free(pszInputName);
-		pszInputName = NULL;
-	}
-	if(pszStrmDrvrAuthMode != NULL) {
-		free(pszStrmDrvrAuthMode);
-		pszStrmDrvrAuthMode = NULL;
-	}
+	free(pszInputName);
+	pszInputName = NULL;
+	free(pszStrmDrvrAuthMode);
+	pszStrmDrvrAuthMode = NULL;
 	return RS_RET_OK;
 }
 
@@ -279,6 +301,7 @@ CODEmodInit_QueryRegCFSLineHdlr
 	CHKiRet(objUse(tcps_sess, LM_TCPSRV_FILENAME));
 	CHKiRet(objUse(tcpsrv, LM_TCPSRV_FILENAME));
 	CHKiRet(objUse(errmsg, CORE_COMPONENT));
+	CHKiRet(objUse(ruleset, CORE_COMPONENT));
 
 	/* register config file handlers */
 	CHKiRet(omsdRegCFSLineHdlr(UCHAR_CONSTANT("inputtcpserverrun"), 0, eCmdHdlrGetWord,
@@ -295,6 +318,8 @@ CODEmodInit_QueryRegCFSLineHdlr
 				   NULL, &iAddtlFrameDelim, STD_LOADABLE_MODULE_ID));
 	CHKiRet(omsdRegCFSLineHdlr(UCHAR_CONSTANT("inputtcpserverinputname"), 0,
 				   eCmdHdlrGetWord, NULL, &pszInputName, STD_LOADABLE_MODULE_ID));
+	CHKiRet(omsdRegCFSLineHdlr(UCHAR_CONSTANT("inputtcpserverbindruleset"), 0,
+				   eCmdHdlrGetWord, setRuleset, NULL, STD_LOADABLE_MODULE_ID));
 	CHKiRet(omsdRegCFSLineHdlr(UCHAR_CONSTANT("resetconfigvariables"), 1, eCmdHdlrCustomHandler,
 		resetConfigVariables, NULL, STD_LOADABLE_MODULE_ID));
 ENDmodInit
diff --git a/runtime/cfsysline.c b/runtime/cfsysline.c
index e1e4a6a4..c39e54f6 100644
--- a/runtime/cfsysline.c
+++ b/runtime/cfsysline.c
@@ -814,7 +814,7 @@ rsRetVal regCfSysLineHdlr(uchar *pCmdName, int bChainingPermitted, ecslCmdHdrlTy
 		CHKiRet(cslcConstruct(&pThis, bChainingPermitted));
 		CHKiRet_Hdlr(cslcAddHdlr(pThis, eType, pHdlr, pData, pOwnerCookie)) {
 			cslcDestruct(pThis);
-			goto finalize_it;
+			FINALIZE;
 		}
 		/* important: add to list, AFTER everything else is OK. Else
 		 * we mess up things in the error case.
@@ -825,7 +825,7 @@ rsRetVal regCfSysLineHdlr(uchar *pCmdName, int bChainingPermitted, ecslCmdHdrlTy
 		}
 		CHKiRet_Hdlr(llAppend(&llCmdList, pMyCmdName, (void*) pThis)) {
 			cslcDestruct(pThis);
-			goto finalize_it;
+			FINALIZE;
 		}
 	} else {
 		/* command already exists, are we allowed to chain? */
@@ -834,7 +834,7 @@ rsRetVal regCfSysLineHdlr(uchar *pCmdName, int bChainingPermitted, ecslCmdHdrlTy
 		}
 		CHKiRet_Hdlr(cslcAddHdlr(pThis, eType, pHdlr, pData, pOwnerCookie)) {
 			cslcDestruct(pThis);
-			goto finalize_it;
+			FINALIZE;
 		}
 	}
 
diff --git a/runtime/conf.c b/runtime/conf.c
index 81b6c081..dbc54fd4 100644
--- a/runtime/conf.c
+++ b/runtime/conf.c
@@ -1152,7 +1152,7 @@ cflineClassic(uchar *p, rule_t **ppRule)
 			CHKiRet(ruleset.AddRule(rule.GetAssRuleset(*ppRule), ppRule));
 		}
 		CHKiRet(rule.Construct(ppRule)); /* create "fresh" selector */
-		CHKiRet(rule.SetAssRuleset(*ppRule, pCurrRuleset)); /* create "fresh" selector */
+		CHKiRet(rule.SetAssRuleset(*ppRule, ruleset.GetCurrent())); /* create "fresh" selector */
 		CHKiRet(rule.ConstructFinalize(*ppRule)); /* create "fresh" selector */
 		CHKiRet(cflineDoFilter(&p, *ppRule)); /* pull filters */
 	}
diff --git a/runtime/msg.c b/runtime/msg.c
index dbc3c779..10f283aa 100644
--- a/runtime/msg.c
+++ b/runtime/msg.c
@@ -46,6 +46,7 @@
 #include "regexp.h"
 #include "atomic.h"
 #include "unicode-helper.h"
+#include "ruleset.h"
 
 /* static data */
 DEFobjStaticHelpers
@@ -1166,13 +1167,21 @@ void MsgAssignTAG(msg_t *pMsg, uchar *pBuf)
 }
 
 
+/* rgerhards 2009-06-12: set associated ruleset
+ */
+void MsgSetRuleset(msg_t *pMsg, ruleset_t *pRuleset)
+{
+	assert(pMsg != NULL);
+	pMsg->pRuleset = pRuleset;
+}
+
+
 /* rgerhards 2004-11-16: set TAG in msg object
  */
 void MsgSetTAG(msg_t *pMsg, char* pszTAG)
 {
 	assert(pMsg != NULL);
-	if(pMsg->pszTAG != NULL)
-		free(pMsg->pszTAG);
+	free(pMsg->pszTAG);
 	pMsg->iLenTAG = strlen(pszTAG);
 	if((pMsg->pszTAG = malloc(pMsg->iLenTAG + 1)) != NULL)
 		memcpy(pMsg->pszTAG, pszTAG, pMsg->iLenTAG + 1);
diff --git a/runtime/msg.h b/runtime/msg.h
index a14f6b15..b42f641f 100644
--- a/runtime/msg.h
+++ b/runtime/msg.h
@@ -120,6 +120,7 @@ short bDoLock; /* use the mutex? */
         char *pszTIMESTAMP_PgSQL;/* TIMESTAMP as PgSQL formatted string (always 21 characters) */
         char *pszTIMESTAMP_SecFrac;/* TIMESTAMP fractional seconds (always 6 characters) */
 	int msgFlags;		/* flags associated with this message */
+	ruleset_t *pRuleset;	/* ruleset to be used for processing this message */
 };
 
 
@@ -167,6 +168,7 @@ char *getPROCID(msg_t *pM);
 rsRetVal MsgSetMSGID(msg_t *pMsg, char* pszMSGID);
 void MsgAssignTAG(msg_t *pMsg, uchar *pBuf);
 void MsgSetTAG(msg_t *pMsg, char* pszTAG);
+void MsgSetRuleset(msg_t *pMsg, ruleset_t*);
 rsRetVal MsgSetFlowControlType(msg_t *pMsg, flowControl_t eFlowCtl);
 char *getTAG(msg_t *pM);
 int getHOSTNAMELen(msg_t *pM);
diff --git a/runtime/obj.c b/runtime/obj.c
index 8b9c9c83..f38b1d7f 100644
--- a/runtime/obj.c
+++ b/runtime/obj.c
@@ -1279,8 +1279,8 @@ objClassExit(void)
 
 	/* TODO: implement the class exits! */
 #if 0
-	cfsyslineInit(pModInfo);
-	varClassInit(pModInfo);
+	cfsyslineExit(pModInfo);
+	varClassExit(pModInfo);
 #endif
 	errmsgClassExit();
 	moduleClassExit();
diff --git a/runtime/rsyslog.c b/runtime/rsyslog.c
index 3496bb0d..6f732f0e 100644
--- a/runtime/rsyslog.c
+++ b/runtime/rsyslog.c
@@ -152,12 +152,10 @@ rsrtInit(char **ppErrObj, obj_if_t *pObjIF)
 		CHKiRet(datetimeClassInit(NULL));
 		if(ppErrObj != NULL) *ppErrObj = "msg";
 		CHKiRet(msgClassInit(NULL));
-		if(ppErrObj != NULL) *ppErrObj = "wti";
-		CHKiRet(wtiClassInit(NULL));
-		if(ppErrObj != NULL) *ppErrObj = "wtp";
-		CHKiRet(wtpClassInit(NULL));
-		if(ppErrObj != NULL) *ppErrObj = "queue";
-		CHKiRet(qqueueClassInit(NULL));
+		if(ppErrObj != NULL) *ppErrObj = "ctok_token";
+		CHKiRet(ctok_tokenClassInit(NULL));
+		if(ppErrObj != NULL) *ppErrObj = "ctok";
+		CHKiRet(ctokClassInit(NULL));
 		if(ppErrObj != NULL) *ppErrObj = "vmstk";
 		CHKiRet(vmstkClassInit(NULL));
 		if(ppErrObj != NULL) *ppErrObj = "sysvar";
@@ -168,16 +166,18 @@ rsrtInit(char **ppErrObj, obj_if_t *pObjIF)
 		CHKiRet(vmopClassInit(NULL));
 		if(ppErrObj != NULL) *ppErrObj = "vmprg";
 		CHKiRet(vmprgClassInit(NULL));
-		if(ppErrObj != NULL) *ppErrObj = "ctok_token";
-		CHKiRet(ctok_tokenClassInit(NULL));
-		if(ppErrObj != NULL) *ppErrObj = "ctok";
-		CHKiRet(ctokClassInit(NULL));
 		if(ppErrObj != NULL) *ppErrObj = "expr";
 		CHKiRet(exprClassInit(NULL));
 		if(ppErrObj != NULL) *ppErrObj = "rule";
 		CHKiRet(ruleClassInit(NULL));
 		if(ppErrObj != NULL) *ppErrObj = "ruleset";
 		CHKiRet(rulesetClassInit(NULL));
+		if(ppErrObj != NULL) *ppErrObj = "wti";
+		CHKiRet(wtiClassInit(NULL));
+		if(ppErrObj != NULL) *ppErrObj = "wtp";
+		CHKiRet(wtpClassInit(NULL));
+		if(ppErrObj != NULL) *ppErrObj = "queue";
+		CHKiRet(qqueueClassInit(NULL));
 		if(ppErrObj != NULL) *ppErrObj = "conf";
 		CHKiRet(confClassInit(NULL));
 
diff --git a/runtime/ruleset.c b/runtime/ruleset.c
index f9edde8b..93d40e24 100644
--- a/runtime/ruleset.c
+++ b/runtime/ruleset.c
@@ -40,6 +40,7 @@
 
 #include "rsyslog.h"
 #include "obj.h"
+#include "msg.h"
 #include "ruleset.h"
 #include "rule.h"
 #include "errmsg.h"
@@ -53,6 +54,8 @@ DEFobjCurrIf(errmsg)
 DEFobjCurrIf(rule)
 
 linkedList_t llRulesets; /* this is NOT a pointer - no typo here ;) */
+ruleset_t *pCurrRuleset = NULL; /* currently "active" ruleset */
+ruleset_t *pDfltRuleset = NULL; /* currentl default ruleset, e.g. for binding to actions which have no other */
 
 /* ---------- linked-list key handling functions ---------- */
 
@@ -147,12 +150,15 @@ DEFFUNC_llExecFunc(processMsgDoRules)
  * rgerhards, 2005-10-13
  */
 static rsRetVal
-processMsg(ruleset_t *pThis, msg_t *pMsg)
+processMsg(msg_t *pMsg)
 {
+	ruleset_t *pThis;
 	DEFiRet;
-	ISOBJ_TYPE_assert(pThis, ruleset);
 	assert(pMsg != NULL);
 
+	pThis = (pMsg->pRuleset == NULL) ? pDfltRuleset : pMsg->pRuleset;
+	ISOBJ_TYPE_assert(pThis, ruleset);
+
 	CHKiRet(llExecFunc(&pThis->llRules, processMsgDoRules, pMsg));
 
 finalize_it:
@@ -200,6 +206,69 @@ finalize_it:
 }
 
 
+/* get current ruleset
+ * We use a non-standard calling interface, as nothing can go wrong and it
+ * is really much more natural to return the pointer directly.
+ */
+static ruleset_t*
+GetCurrent(void)
+{
+	return pCurrRuleset;
+}
+
+
+/* Find the ruleset with the given name and return a pointer to its object.
+ */
+static rsRetVal
+GetRuleset(ruleset_t **ppRuleset, uchar *pszName)
+{
+	DEFiRet;
+	assert(ppRuleset != NULL);
+	assert(pszName != NULL);
+
+	CHKiRet(llFind(&llRulesets, pszName, (void*) ppRuleset));
+
+finalize_it:
+	RETiRet;
+}
+
+
+/* Set a new default rule set. If the default can not be found, no change happens.
+ */
+static rsRetVal
+SetDefaultRuleset(uchar *pszName)
+{
+	ruleset_t *pRuleset;
+	DEFiRet;
+	assert(pszName != NULL);
+
+	CHKiRet(GetRuleset(&pRuleset, pszName));
+	pDfltRuleset = pRuleset;
+	dbgprintf("default rule set changed to %p: '%s'\n", pRuleset, pszName);
+
+finalize_it:
+	RETiRet;
+}
+
+
+/* Set a new current rule set. If the ruleset can not be found, no change happens.
+ */
+static rsRetVal
+SetCurrRuleset(uchar *pszName)
+{
+	ruleset_t *pRuleset;
+	DEFiRet;
+	assert(pszName != NULL);
+
+	CHKiRet(GetRuleset(&pRuleset, pszName));
+	pCurrRuleset = pRuleset;
+	dbgprintf("current rule set changed to %p: '%s'\n", pRuleset, pszName);
+
+finalize_it:
+	RETiRet;
+}
+
+
 /* destructor we need to destruct rules inside our linked list contents.
  */
 static rsRetVal
@@ -237,6 +306,13 @@ rulesetConstructFinalize(ruleset_t *pThis)
 	CHKmalloc(keyName = ustrdup(pThis->pszName));
 	CHKiRet(llAppend(&llRulesets, keyName, pThis));
 
+	/* this now also is the new current ruleset */
+	pCurrRuleset = pThis;
+
+	/* and also the default, if so far none has been set */
+	if(pDfltRuleset == NULL)
+		pDfltRuleset = pThis;
+
 finalize_it:
 	RETiRet;
 }
@@ -336,6 +412,10 @@ CODESTARTobjQueryInterface(ruleset)
 	pIf->ProcessMsg = processMsg;
 	pIf->SetName = setName;
 	pIf->DebugPrintAll = debugPrintAll;
+	pIf->GetCurrent = GetCurrent;
+	pIf->GetRuleset = GetRuleset;
+	pIf->SetDefaultRuleset = SetDefaultRuleset;
+	pIf->SetCurrRuleset = SetCurrRuleset;
 finalize_it:
 ENDobjQueryInterface(ruleset)
 
diff --git a/runtime/ruleset.h b/runtime/ruleset.h
index b609e6b3..32571687 100644
--- a/runtime/ruleset.h
+++ b/runtime/ruleset.h
@@ -44,8 +44,12 @@ BEGINinterface(ruleset) /* name must also be changed in ENDinterface macro! */
 	rsRetVal (*IterateAllActions)(rsRetVal (*pFunc)(void*, void*), void* pParam);
 	rsRetVal (*DestructAllActions)(void);
 	rsRetVal (*AddRule)(ruleset_t *pThis, rule_t **ppRule);
-	rsRetVal (*ProcessMsg)(ruleset_t *pThis, msg_t *pMsg);
 	rsRetVal (*SetName)(ruleset_t *pThis, uchar *pszName);
+	rsRetVal (*ProcessMsg)(msg_t *pMsg);
+	rsRetVal (*GetRuleset)(ruleset_t **ppThis, uchar*);
+	rsRetVal (*SetDefaultRuleset)(uchar*);
+	rsRetVal (*SetCurrRuleset)(uchar*);
+	ruleset_t* (*GetCurrent)(void);
 ENDinterface(ruleset)
 #define rulesetCURR_IF_VERSION 1 /* increment whenever you change the interface structure! */
 
diff --git a/tcps_sess.c b/tcps_sess.c
index 62d51f66..d6bcd51b 100644
--- a/tcps_sess.c
+++ b/tcps_sess.c
@@ -254,6 +254,7 @@ defaultDoSubmitMessage(tcps_sess_t *pThis)
 	pMsg->msgFlags  = NEEDS_PARSING | PARSE_HOSTNAME;
 	pMsg->bParseHOSTNAME = 1;
 	MsgSetRcvFrom(pMsg, pThis->fromHost);
+	MsgSetRuleset(pMsg, pThis->pLstnInfo->pRuleset);
 	CHKiRet(MsgSetRcvFromIP(pMsg, pThis->fromHostIP));
 	CHKiRet(submitMsg(pMsg));
 
diff --git a/tcpsrv.c b/tcpsrv.c
index 3516b2e3..95409d2f 100644
--- a/tcpsrv.c
+++ b/tcpsrv.c
@@ -69,6 +69,7 @@
 #include "netstrm.h"
 #include "nssel.h"
 #include "errmsg.h"
+#include "ruleset.h"
 #include "unicode-helper.h"
 
 MODULE_TYPE_LIB
@@ -81,6 +82,7 @@ MODULE_TYPE_LIB
 DEFobjStaticHelpers
 DEFobjCurrIf(conf)
 DEFobjCurrIf(glbl)
+DEFobjCurrIf(ruleset)
 DEFobjCurrIf(tcps_sess)
 DEFobjCurrIf(errmsg)
 DEFobjCurrIf(net)
@@ -104,6 +106,8 @@ addNewLstnPort(tcpsrv_t *pThis, uchar *pszPort)
 	CHKmalloc(pEntry = malloc(sizeof(tcpLstnPortList_t)));
 	pEntry->pszPort = pszPort;
 	pEntry->pSrv = pThis;
+RUNLOG_VAR("%p", pThis->pRuleset);
+	pEntry->pRuleset = pThis->pRuleset;
 	CHKmalloc(pEntry->pszInputName = ustrdup(pThis->pszInputName));
 
 	/* and add to list */
@@ -755,6 +759,16 @@ finalize_it:
 }
 
 
+/* Set the ruleset (ptr) to use */
+static rsRetVal
+SetRuleset(tcpsrv_t *pThis, ruleset_t *pRuleset)
+{
+	DEFiRet;
+	pThis->pRuleset = pRuleset;
+	RETiRet;
+}
+
+
 /* here follows a number of methods that shuffle authentication settings down
  * to the drivers. Drivers not supporting these settings may return an error
  * state.
@@ -855,6 +869,7 @@ CODESTARTobjQueryInterface(tcpsrv)
 	pIf->SetCBOnRegularClose = SetCBOnRegularClose;
 	pIf->SetCBOnErrClose = SetCBOnErrClose;
 	pIf->SetOnMsgReceive = SetOnMsgReceive;
+	pIf->SetRuleset = SetRuleset;
 
 finalize_it:
 ENDobjQueryInterface(tcpsrv)
@@ -868,6 +883,7 @@ CODESTARTObjClassExit(tcpsrv)
 	/* release objects we no longer need */
 	objRelease(tcps_sess, DONT_LOAD_LIB);
 	objRelease(conf, CORE_COMPONENT);
+	objRelease(ruleset, CORE_COMPONENT);
 	objRelease(glbl, CORE_COMPONENT);
 	objRelease(errmsg, CORE_COMPONENT);
 	objRelease(netstrms, DONT_LOAD_LIB);
@@ -891,6 +907,7 @@ BEGINObjClassInit(tcpsrv, 1, OBJ_IS_LOADABLE_MODULE) /* class, version - CHANGE
 	CHKiRet(objUse(tcps_sess, DONT_LOAD_LIB));
 	CHKiRet(objUse(conf, CORE_COMPONENT));
 	CHKiRet(objUse(glbl, CORE_COMPONENT));
+	CHKiRet(objUse(ruleset, CORE_COMPONENT));
 
 	/* set our own handlers */
 	OBJSetMethodHandler(objMethod_DEBUGPRINT, tcpsrvDebugPrint);
diff --git a/tcpsrv.h b/tcpsrv.h
index 2d174ce0..a6076e67 100644
--- a/tcpsrv.h
+++ b/tcpsrv.h
@@ -38,6 +38,7 @@ struct tcpLstnPortList_s {
 	uchar *pszPort;			/**< the ports the listener shall listen on */
 	uchar *pszInputName;		/**< value to be used as input name */
 	tcpsrv_t *pSrv;			/**< pointer to higher-level server instance */
+	ruleset_t *pRuleset;		/**< associated ruleset */
 	tcpLstnPortList_t *pNext;	/**< next port or NULL */
 };
 
@@ -50,6 +51,7 @@ struct tcpsrv_s {
 	int iDrvrMode;		/**< mode of the stream driver to use */
 	uchar *pszDrvrAuthMode;	/**< auth mode of the stream driver to use */
 	uchar *pszInputName;	/**< value to be used as input name */
+	ruleset_t *pRuleset;	/**< ruleset to bind to */
 	permittedPeers_t *pPermPeers;/**< driver's permitted peers */
 	int iLstnMax;		/**< max nbr of listeners currently supported */
 	netstrm_t **ppLstn;	/**< our netstream listners */
@@ -107,6 +109,7 @@ BEGINinterface(tcpsrv) /* name must also be changed in ENDinterface macro! */
 	rsRetVal (*SetSessMax)(tcpsrv_t *pThis, int iMaxSess);	/* 2009-04-09 */
 	/* added v6 */
 	rsRetVal (*SetOnMsgReceive)(tcpsrv_t *pThis, rsRetVal (*OnMsgReceive)(tcps_sess_t*, uchar*, int)); /* 2009-05-24 */
+	rsRetVal (*SetRuleset)(tcpsrv_t *pThis, ruleset_t*); /* 2009-06-12 */
 ENDinterface(tcpsrv)
 #define tcpsrvCURR_IF_VERSION 6 /* increment whenever you change the interface structure! */
 /* change for v4:
diff --git a/tools/syslogd.c b/tools/syslogd.c
index 05c61059..99bf281d 100644
--- a/tools/syslogd.c
+++ b/tools/syslogd.c
@@ -249,8 +249,6 @@ int	repeatinterval[2] = { 30, 60 };	/* # of secs before flush */
 
 #define LIST_DELIMITER	':'		/* delimiter between two hosts */
 
-ruleset_t *pCurrRuleset; /* ruleset that is currently being processed */
-
 static pid_t ppid; /* This is a quick and dirty hack used for spliting main/startup thread */
 
 typedef struct legacyOptsLL_s {
@@ -952,7 +950,7 @@ msgConsumer(void __attribute__((unused)) *notNeeded, void *pUsr)
 	if((pMsg->msgFlags & NEEDS_PARSING) != 0) {
 		parseMsg(pMsg);
 	}
-	ruleset.ProcessMsg(pCurrRuleset, pMsg);
+	ruleset.ProcessMsg(pMsg);
 	msgDestruct(&pMsg);
 
 	RETiRet;
@@ -2172,6 +2170,7 @@ init(void)
 	rsRetVal localRet;
 	int iNbrActions;
 	int bHadConfigErr = 0;
+	ruleset_t *pRuleset;
 	char cbuf[BUFSIZ];
 	char bufStartUpMsg[512];
 	struct sigaction sigAct;
@@ -2217,10 +2216,10 @@ init(void)
 
 	conf.ReInitConf();
 
-	// TODO: move to the right place
-	ruleset.Construct(&pCurrRuleset);
-	ruleset.SetName(pCurrRuleset, UCHAR_CONSTANT("RSYSLOG_DefaultRuleset"));
-	ruleset.ConstructFinalize(pCurrRuleset);
+	/* construct the default ruleset */
+	ruleset.Construct(&pRuleset);
+	ruleset.SetName(pRuleset, UCHAR_CONSTANT("RSYSLOG_DefaultRuleset"));
+	ruleset.ConstructFinalize(pRuleset);
 
 	/* open the configuration file */
 	localRet = conf.processConfFile(ConfFile);
@@ -2259,7 +2258,7 @@ init(void)
 		} else {
 			dbgprintf("error %d obtaining controlling terminal, not using that emergency rule\n", errno);
 		}
-		ruleset.AddRule(pCurrRuleset, &pRule);
+		ruleset.AddRule(ruleset.GetCurrent(), &pRule);
 	}
 
 	legacyOptsHook();
@@ -2398,25 +2397,45 @@ finalize_it:
 }
 
 
-/* Begin a new rule set. The new rule set is created, and all rules that now
- * follow go into that rule set.
- * TODO: we may later add the capability to switch back to an already existing
- * rule set.
- * NOTE: pCurrRuleset is NOT desructed and must not be! The ruleset class keeps
- * a list of all known rule sets, and can destruct them at the end of execution.
- * pCurrRuleset is just a shortcut so that "everyone" knows which ruleset to
- * extend.
- * TODO: A problem with this function is the way config lines are processed. The rule
- * is actually only written when the next rule is completely read. That way, this
- * (past) rule goes into the wrong (new) ruleset. I need to see how to fix this best...
- * rgerhards, 2009-06-10
+/* Switch the default ruleset (that, what servcies bind to if nothing specific
+ * is specified).
+ * rgerhards, 2009-06-12
+ */
+static rsRetVal
+setDefaultRuleset(void __attribute__((unused)) *pVal, uchar *pszName)
+{
+	DEFiRet;
+
+	CHKiRet(ruleset.SetDefaultRuleset(pszName));
+
+finalize_it:
+	free(pszName); /* no longer needed */
+	RETiRet;
+}
+
+
+/* Switch to either an already existing rule set or start a new one. The
+ * named rule set becomes the new "current" rule set (what means that new
+ * actions are added to it).
+ * rgerhards, 2009-06-12
  */
-static rsRetVal beginNewRuleset(void __attribute__((unused)) *pVal, uchar *pszName)
+static rsRetVal
+setCurrRuleset(void __attribute__((unused)) *pVal, uchar *pszName)
 {
+	ruleset_t *pRuleset;
+	rsRetVal localRet;
 	DEFiRet;
-	CHKiRet(ruleset.Construct(&pCurrRuleset));
-	CHKiRet(ruleset.SetName(pCurrRuleset, pszName));
-	CHKiRet(ruleset.ConstructFinalize(pCurrRuleset));
+
+	localRet = ruleset.SetCurrRuleset(pszName);
+
+	if(localRet == RS_RET_NOT_FOUND) {
+		DBGPRINTF("begin new current rule set '%s'\n", pszName);
+		CHKiRet(ruleset.Construct(&pRuleset));
+		CHKiRet(ruleset.SetName(pRuleset, pszName));
+		CHKiRet(ruleset.ConstructFinalize(pRuleset));
+	} else {
+		ABORT_FINALIZE(localRet);
+	}
 
 finalize_it:
 	free(pszName); /* no longer needed */
@@ -2658,7 +2677,7 @@ static rsRetVal loadBuildInModules(void)
 	}
 
 	/* dirty, but this must be for the time being: the usrmsg module must always be
-	 * loaded as last module. This is because it processes any time of action selector.
+	 * loaded as last module. This is because it processes any type of action selector.
 	 * If we load it before other modules, these others will never have a chance of
 	 * working with the config file. We may change that implementation so that a user name
 	 * must start with an alnum, that would definitely help (but would it break backwards
@@ -2666,8 +2685,7 @@ static rsRetVal loadBuildInModules(void)
 	 * User names now must begin with:
 	 *   [a-zA-Z0-9_.]
 	 */
-	if((iRet = module.doModInit(modInitUsrMsg, (uchar*) "builtin-usrmsg", NULL)) != RS_RET_OK)
-		RETiRet;
+	CHKiRet(module.doModInit(modInitUsrMsg, (uchar*) "builtin-usrmsg", NULL));
 
 	/* ok, initialization of the command handler probably does not 100% belong right in
 	 * this space here. However, with the current design, this is actually quite a good
@@ -2677,7 +2695,8 @@ static rsRetVal loadBuildInModules(void)
 	 * This, I think, is the right thing to do. -- rgerhards, 2007-07-31
 	 */
 	CHKiRet(regCfSysLineHdlr((uchar *)"actionresumeretrycount", 0, eCmdHdlrInt, NULL, &glbliActionResumeRetryCount, NULL));
-	CHKiRet(regCfSysLineHdlr((uchar *)"ruleset", 0, eCmdHdlrGetWord, beginNewRuleset, NULL, NULL));
+	CHKiRet(regCfSysLineHdlr((uchar *)"defaultruleset", 0, eCmdHdlrGetWord, setDefaultRuleset, NULL, NULL));
+	CHKiRet(regCfSysLineHdlr((uchar *)"ruleset", 0, eCmdHdlrGetWord, setCurrRuleset, NULL, NULL));
 	CHKiRet(regCfSysLineHdlr((uchar *)"mainmsgqueuefilename", 0, eCmdHdlrGetWord, NULL, &pszMainMsgQFName, NULL));
 	CHKiRet(regCfSysLineHdlr((uchar *)"mainmsgqueuesize", 0, eCmdHdlrInt, NULL, &iMainMsgQueueSize, NULL));
 	CHKiRet(regCfSysLineHdlr((uchar *)"mainmsgqueuehighwatermark", 0, eCmdHdlrInt, NULL, &iMainMsgQHighWtrMark, NULL));