added ERE support in filter conditions

new comparison operation "ereregex"

7 files changed, 54 insertions, 14 deletions

diff --git a/ChangeLog b/ChangeLog
index ba2a6c13..f1bc354c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,7 @@
 ---------------------------------------------------------------------------
 Version 4.1.5  [DEVEL] (rgerhards), 2009-02-??
+- added ERE support in filter conditions
+  new comparison operation "ereregex"
 - added new config directive $RepeatedMsgContainsOriginalMsg so that the
   "last message repeated n times" messages, if generated, may
   have an alternate format that contains the message that is being repeated
diff --git a/doc/rsyslog_conf_filter.html b/doc/rsyslog_conf_filter.html
index cf21ff95..1d30d8ae 100644
--- a/doc/rsyslog_conf_filter.html
+++ b/doc/rsyslog_conf_filter.html
@@ -141,7 +141,13 @@ once they are implemented, it can make very much sense
 <tr>
 <td>regex</td>
 <td>Compares the property against the provided POSIX
-regular
+BRE regular
+expression.</td>
+</tr>
+<tr>
+<td>ereregex</td>
+<td>Compares the property against the provided POSIX
+ERE regular
 expression.</td>
 </tr>
 </tbody>
diff --git a/runtime/conf.c b/runtime/conf.c
index f71d5669..c5208d86 100644
--- a/runtime/conf.c
+++ b/runtime/conf.c
@@ -873,6 +873,8 @@ static rsRetVal cflineProcessPropFilter(uchar **pline, register selector_t *f)
 		f->f_filterData.prop.operation = FIOP_STARTSWITH;
 	} else if(!rsCStrOffsetSzStrCmp(pCSCompOp, iOffset, (unsigned char*) "regex", 5)) {
 		f->f_filterData.prop.operation = FIOP_REGEX;
+	} else if(!rsCStrOffsetSzStrCmp(pCSCompOp, iOffset, (unsigned char*) "ereregex", 8)) {
+		f->f_filterData.prop.operation = FIOP_EREREGEX;
 	} else {
 		errmsg.LogError(0, NO_ERRCODE, "error: invalid compare operation '%s' - ignoring selector",
 		           (char*) rsCStrGetSzStrNoNULL(pCSCompOp));
diff --git a/runtime/stringbuf.c b/runtime/stringbuf.c
index 93d1e1ef..150439a1 100644
--- a/runtime/stringbuf.c
+++ b/runtime/stringbuf.c
@@ -694,6 +694,32 @@ int rsCStrCaseInsensitveStartsWithSzStr(cstr_t *pCS1, uchar *psz, size_t iLenSz)
 		return -1; /* pCS1 is less then psz */
 }
 
+#if 0
+/* check if a CStr object matches a POSIX ERE regex.
+ * added 2009-03-04 by rgerhards
+ * TODO: we should merge this with rsCStrSzStrMatchReg
+ */
+rsRetVal rsCStrSzStrMatchRegexERE(cstr_t *pCS1, uchar *psz)
+{
+	regex_t preq;
+	DEFiRet;
+
+	BEGINfunc
+
+	if(objUse(regexp, LM_REGEXP_FILENAME) == RS_RET_OK) {
+		regexp.regcomp(&preq, (char*) rsCStrGetSzStr(pCS1), REG_EXTENDED);
+		ret = regexp.regexec(&preq, (char*) psz, 0, NULL, 0);
+		regexp.regfree(&preq);
+	} else {
+		ret = 1; /* simulate "not found" */
+	}
+
+	ENDfunc
+	RETiRet;
+}
+#endif
+
+
 /* check if a CStr object matches a regex.
  * msamia@redhat.com 2007-07-12
  * @return returns 0 if matched
@@ -701,25 +727,23 @@ int rsCStrCaseInsensitveStartsWithSzStr(cstr_t *pCS1, uchar *psz, size_t iLenSz)
  * rgerhards, 2007-07-16: bug is no real bug, because rsyslogd ensures there
  * never is a \0 *inside* a property string.
  * Note that the function returns -1 if regexp functionality is not available.
- * TODO: change calling interface! -- rgerhards, 2008-03-07
+ * rgerhards: 2009-03-04: ERE support added, via parameter iType: 0 - BRE, 1 - ERE
  */
-int rsCStrSzStrMatchRegex(cstr_t *pCS1, uchar *psz)
+rsRetVal rsCStrSzStrMatchRegex(cstr_t *pCS1, uchar *psz, int iType)
 {
 	regex_t preq;
-	int ret;
-
-	BEGINfunc
+	DEFiRet;
 
 	if(objUse(regexp, LM_REGEXP_FILENAME) == RS_RET_OK) {
-		regexp.regcomp(&preq, (char*) rsCStrGetSzStr(pCS1), 0);
-		ret = regexp.regexec(&preq, (char*) psz, 0, NULL, 0);
+		regexp.regcomp(&preq, (char*) rsCStrGetSzStr(pCS1), iType == 1 ? REG_EXTENDED : 0);
+		CHKiRet(regexp.regexec(&preq, (char*) psz, 0, NULL, 0));
 		regexp.regfree(&preq);
 	} else {
-		ret = 1; /* simulate "not found" */
+		ABORT_FINALIZE(RS_RET_NOT_FOUND);
 	}
 
-	ENDfunc
-	return ret;
+finalize_it:
+	RETiRet;
 }
 
 
diff --git a/runtime/stringbuf.h b/runtime/stringbuf.h
index c1966449..f3e08439 100644
--- a/runtime/stringbuf.h
+++ b/runtime/stringbuf.h
@@ -136,7 +136,7 @@ int rsCStrCaseInsensitiveLocateInSzStr(cstr_t *pThis, uchar *sz);
 int rsCStrStartsWithSzStr(cstr_t *pCS1, uchar *psz, size_t iLenSz);
 int rsCStrCaseInsensitveStartsWithSzStr(cstr_t *pCS1, uchar *psz, size_t iLenSz);
 int rsCStrSzStrStartsWithCStr(cstr_t *pCS1, uchar *psz, size_t iLenSz);
-int rsCStrSzStrMatchRegex(cstr_t *pCS1, uchar *psz);
+rsRetVal rsCStrSzStrMatchRegex(cstr_t *pCS1, uchar *psz, int iType);
 rsRetVal rsCStrConvertToNumber(cstr_t *pStr, number_t *pNumber);
 rsRetVal rsCStrConvertToBool(cstr_t *pStr, number_t *pBool);
 rsRetVal rsCStrAppendCStr(cstr_t *pThis, cstr_t *pstrAppend);
diff --git a/tools/syslogd.c b/tools/syslogd.c
index 9ced4562..6b8ce82f 100644
--- a/tools/syslogd.c
+++ b/tools/syslogd.c
@@ -1071,7 +1071,12 @@ static rsRetVal shouldProcessThisMessage(selector_t *f, msg_t *pMsg, int *bProce
 			break;
 		case FIOP_REGEX:
 			if(rsCStrSzStrMatchRegex(f->f_filterData.prop.pCSCompValue,
-					  (unsigned char*) pszPropVal) == 0)
+					  (unsigned char*) pszPropVal, 0) == RS_RET_OK)
+				bRet = 1;
+			break;
+		case FIOP_EREREGEX:
+			if(rsCStrSzStrMatchRegex(f->f_filterData.prop.pCSCompValue,
+					  (unsigned char*) pszPropVal, 1) == RS_RET_OK)
 				bRet = 1;
 			break;
 		default:
diff --git a/tools/syslogd.h b/tools/syslogd.h
index e866a16b..f1b11a91 100644
--- a/tools/syslogd.h
+++ b/tools/syslogd.h
@@ -70,7 +70,8 @@ struct filed {
 				FIOP_CONTAINS  = 1,	/* contains string? */
 				FIOP_ISEQUAL  = 2,	/* is (exactly) equal? */
 				FIOP_STARTSWITH = 3,	/* starts with a string? */
- 				FIOP_REGEX = 4		/* matches a regular expression? */
+ 				FIOP_REGEX = 4,		/* matches a (BRE) regular expression? */
+ 				FIOP_EREREGEX = 5	/* matches a ERE regular expression? */
 			} operation;
 			cstr_t *pCSCompValue;	/* value to "compare" against */
 			char isNegated;			/* actually a boolean ;) */