1 files changed, 82 insertions, 101 deletions

diff --git a/runtime/msg.c b/runtime/msg.c
index dbc3c779..65041a31 100644
--- a/runtime/msg.c
+++ b/runtime/msg.c
@@ -46,6 +46,7 @@
 #include "regexp.h"
 #include "atomic.h"
 #include "unicode-helper.h"
+#include "ruleset.h"
 
 /* static data */
 DEFobjStaticHelpers
@@ -104,6 +105,7 @@ static syslogCODE rs_facilitynames[] =
 
 /* some forward declarations */
 static int getAPPNAMELen(msg_t *pM);
+static int getProtocolVersion(msg_t *pM);
 
 /* The following functions will support advanced output module
  * multithreading, once this is implemented. Currently, we
@@ -342,7 +344,6 @@ CODESTARTobjDestruct(msg)
 	if(currRefCount == 0)
 	{
 		/* DEV Debugging Only! dbgprintf("msgDestruct\t0x%lx, RefCount now 0, doing DESTROY\n", (unsigned long)pThis); */
-		free(pThis->pszUxTradMsg);
 		free(pThis->pszRawMsg);
 		free(pThis->pszTAG);
 		free(pThis->pszHOSTNAME);
@@ -364,7 +365,6 @@ CODESTARTobjDestruct(msg)
 		free(pThis->pszTIMESTAMP_SecFrac);
 		free(pThis->pszTIMESTAMP_MySQL);
 		free(pThis->pszTIMESTAMP_PgSQL);
-		free(pThis->pszPRI);
 		if(pThis->pCSProgName != NULL)
 			rsCStrDestruct(&pThis->pCSProgName);
 		if(pThis->pCSStrucData != NULL)
@@ -437,14 +437,18 @@ msg_t* MsgDup(msg_t* pOld)
 	pNew->msgFlags = pOld->msgFlags;
 	pNew->iProtocolVersion = pOld->iProtocolVersion;
 	pNew->ttGenTime = pOld->ttGenTime;
+	/* enable this, if someone actually uses UxTradMsg, delete after some  time has
+	 * passed and nobody complained -- rgerhards, 2009-06-16
+	pNew->offAfterPRI = pOld->offAfterPRI;
+	*/
+	memcpy(pNew->bufPRI, pOld->bufPRI, pOld->iLenPRI);
+	pNew->iLenPRI = pOld->iLenPRI;
 	tmpCOPYSZ(Severity);
 	tmpCOPYSZ(SeverityStr);
 	tmpCOPYSZ(Facility);
 	tmpCOPYSZ(FacilityStr);
-	tmpCOPYSZ(PRI);
 	tmpCOPYSZ(RawMsg);
 	tmpCOPYSZ(MSG);
-	tmpCOPYSZ(UxTradMsg);
 	tmpCOPYSZ(TAG);
 	tmpCOPYSZ(HOSTNAME);
 	tmpCOPYSZ(RcvFrom);
@@ -493,10 +497,13 @@ static rsRetVal MsgSerialize(msg_t *pThis, strm_t *pStrm)
 	objSerializeSCALAR(pStrm, ttGenTime, INT);
 	objSerializeSCALAR(pStrm, tRcvdAt, SYSLOGTIME);
 	objSerializeSCALAR(pStrm, tTIMESTAMP, SYSLOGTIME);
+	/* enable this, if someone actually uses UxTradMsg, delete after some  time has
+	 * passed and nobody complained -- rgerhards, 2009-06-16
+	objSerializeSCALAR(pStrm, offsAfterPRI, SHORT);
+	*/
 
 	objSerializePTR(pStrm, pszRawMsg, PSZ);
 	objSerializePTR(pStrm, pszMSG, PSZ);
-	objSerializePTR(pStrm, pszUxTradMsg, PSZ);
 	objSerializePTR(pStrm, pszTAG, PSZ);
 	objSerializePTR(pStrm, pszHOSTNAME, PSZ);
 	objSerializePTR(pStrm, pszInputName, PSZ);
@@ -587,7 +594,7 @@ static rsRetVal aquirePROCIDFromTAG(msg_t *pM)
 	}
 
 	/* OK, finaally we could obtain a PROCID. So let's use it ;) */
-	CHKiRet(rsCStrFinish(pM->pCSPROCID));
+	CHKiRet(cstrFinalize(pM->pCSPROCID));
 
 finalize_it:
 	RETiRet;
@@ -629,7 +636,7 @@ static rsRetVal aquireProgramName(msg_t *pM)
 		    ; ++i) {
 			CHKiRet(rsCStrAppendChar(pM->pCSProgName, pM->pszTAG[i]));
 		}
-		CHKiRet(rsCStrFinish(pM->pCSProgName));
+		CHKiRet(cstrFinalize(pM->pCSProgName));
 	}
 finalize_it:
 	RETiRet;
@@ -670,7 +677,7 @@ void setProtocolVersion(msg_t *pM, int iNewVersion)
 	pM->iProtocolVersion = iNewVersion;
 }
 
-int getProtocolVersion(msg_t *pM)
+static int getProtocolVersion(msg_t *pM)
 {
 	assert(pM != NULL);
 	return(pM->iProtocolVersion);
@@ -689,7 +696,7 @@ int getMSGLen(msg_t *pM)
 }
 
 
-char *getRawMsg(msg_t *pM)
+static char *getRawMsg(msg_t *pM)
 {
 	if(pM == NULL)
 		return "";
@@ -700,16 +707,17 @@ char *getRawMsg(msg_t *pM)
 			return (char*)pM->pszRawMsg;
 }
 
+
+/* enable this, if someone actually uses UxTradMsg, delete after some  time has
+ * passed and nobody complained -- rgerhards, 2009-06-16
 char *getUxTradMsg(msg_t *pM)
 {
 	if(pM == NULL)
 		return "";
 	else
-		if(pM->pszUxTradMsg == NULL)
-			return "";
-		else
-			return (char*)pM->pszUxTradMsg;
+		return (char*)pM->pszRawMsg + pM->offAfterPRI;
 }
+*/
 
 char *getMSG(msg_t *pM)
 {
@@ -723,44 +731,34 @@ char *getMSG(msg_t *pM)
 }
 
 
-/* Get PRI value in text form */
-char *getPRI(msg_t *pM)
+/* Get PRI value as integer */
+static int getPRIi(msg_t *pM)
 {
-	int pri;
-	BEGINfunc
+	assert(pM != NULL);
+	return (pM->iFacility << 3) + (pM->iSeverity);
+}
+
 
+/* Get PRI value in text form */
+static inline char *getPRI(msg_t *pM)
+{
 	if(pM == NULL)
 		return "";
 
+	/* there are some cases where bufPRI may not contain a valid string,
+	 * and then we need to build it.
+	 */
 	MsgLock(pM);
-	if(pM->pszPRI == NULL) {
-		/* OK, we need to construct it...  we use a 5 byte buffer - as of 
-		 * RFC 3164, it can't be longer. Should it still be, snprintf will truncate...
-		 * Note that we do not use the LOG_MAKEPRI macro. This macro
-		 * is a simple add of the two values under FreeBSD 7. So we implement
-		 * the logic in our own code. This is a change from a bug
-		 * report. -- rgerhards, 2008-07-14
-		 */
-		pri = pM->iFacility * 8 + pM->iSeverity;
-		if((pM->pszPRI = malloc(5)) == NULL) return "";
-		pM->iLenPRI = snprintf((char*)pM->pszPRI, 5, "%d", pri);
+	if(pM->bufPRI[0] == '\0') {
+		snprintf((char*)pM->bufPRI, sizeof(pM->bufPRI), "<%d>", getPRIi(pM));
 	}
 	MsgUnlock(pM);
 
-	ENDfunc
-	return (char*)pM->pszPRI;
+	return (char*)pM->bufPRI;
 }
 
 
-/* Get PRI value as integer */
-int getPRIi(msg_t *pM)
-{
-	assert(pM != NULL);
-	return (pM->iFacility << 3) + (pM->iSeverity);
-}
-
-
-char *getTimeReported(msg_t *pM, enum tplFormatTypes eFmt)
+static inline char *getTimeReported(msg_t *pM, enum tplFormatTypes eFmt)
 {
 	BEGINfunc
 	if(pM == NULL)
@@ -838,7 +836,7 @@ char *getTimeReported(msg_t *pM, enum tplFormatTypes eFmt)
 	return "INVALID eFmt OPTION!";
 }
 
-char *getTimeGenerated(msg_t *pM, enum tplFormatTypes eFmt)
+static inline char *getTimeGenerated(msg_t *pM, enum tplFormatTypes eFmt)
 {
 	BEGINfunc
 	if(pM == NULL)
@@ -917,7 +915,7 @@ char *getTimeGenerated(msg_t *pM, enum tplFormatTypes eFmt)
 }
 
 
-char *getSeverity(msg_t *pM)
+static inline char *getSeverity(msg_t *pM)
 {
 	if(pM == NULL)
 		return "";
@@ -934,7 +932,7 @@ char *getSeverity(msg_t *pM)
 }
 
 
-char *getSeverityStr(msg_t *pM)
+static inline char *getSeverityStr(msg_t *pM)
 {
 	syslogCODE *c;
 	int val;
@@ -964,7 +962,7 @@ char *getSeverityStr(msg_t *pM)
 	return((char*)pM->pszSeverityStr);
 }
 
-char *getFacility(msg_t *pM)
+static inline char *getFacility(msg_t *pM)
 {
 	if(pM == NULL)
 		return "";
@@ -983,7 +981,7 @@ char *getFacility(msg_t *pM)
 	return((char*)pM->pszFacility);
 }
 
-char *getFacilityStr(msg_t *pM)
+static inline char *getFacilityStr(msg_t *pM)
 {
         syslogCODE *c;
         int val;
@@ -1035,6 +1033,17 @@ MsgSetFlowControlType(msg_t *pMsg, flowControl_t eFlowCtl)
 	RETiRet;
 }
 
+/* set offset after which PRI in raw msg starts
+ * rgerhards, 2009-06-16
+ */
+rsRetVal
+MsgSetAfterPRIOffs(msg_t *pMsg, short offs)
+{
+	assert(pMsg != NULL);
+	pMsg->offAfterPRI = offs;
+	return RS_RET_OK;
+}
+
 
 /* rgerhards 2004-11-24: set APP-NAME in msg object
  * TODO: revisit msg locking code!
@@ -1090,7 +1099,7 @@ finalize_it:
 
 /* rgerhards, 2005-11-24
  */
-int getPROCIDLen(msg_t *pM)
+static inline int getPROCIDLen(msg_t *pM)
 {
 	assert(pM != NULL);
 	MsgLock(pM);
@@ -1135,19 +1144,10 @@ finalize_it:
 	RETiRet;
 }
 
-/* rgerhards, 2005-11-24
- */
-#if 0 /* This method is currently not called, be we like to preserve it */
-static int getMSGIDLen(msg_t *pM)
-{
-	return (pM->pCSMSGID == NULL) ? 1 : rsCStrLen(pM->pCSMSGID);
-}
-#endif
-
 
 /* rgerhards, 2005-11-24
  */
-char *getMSGID(msg_t *pM)
+static inline char *getMSGID(msg_t *pM)
 {
 	return (pM->pCSMSGID == NULL) ? "-" : (char*) rsCStrGetSzStrNoNULL(pM->pCSMSGID);
 }
@@ -1166,13 +1166,21 @@ void MsgAssignTAG(msg_t *pMsg, uchar *pBuf)
 }
 
 
+/* rgerhards 2009-06-12: set associated ruleset
+ */
+void MsgSetRuleset(msg_t *pMsg, ruleset_t *pRuleset)
+{
+	assert(pMsg != NULL);
+	pMsg->pRuleset = pRuleset;
+}
+
+
 /* rgerhards 2004-11-16: set TAG in msg object
  */
 void MsgSetTAG(msg_t *pMsg, char* pszTAG)
 {
 	assert(pMsg != NULL);
-	if(pMsg->pszTAG != NULL)
-		free(pMsg->pszTAG);
+	free(pMsg->pszTAG);
 	pMsg->iLenTAG = strlen(pszTAG);
 	if((pMsg->pszTAG = malloc(pMsg->iLenTAG + 1)) != NULL)
 		memcpy(pMsg->pszTAG, pszTAG, pMsg->iLenTAG + 1);
@@ -1229,7 +1237,7 @@ static int getTAGLen(msg_t *pM)
 #endif
 
 
-char *getTAG(msg_t *pM)
+static inline char *getTAG(msg_t *pM)
 {
 	char *ret;
 
@@ -1272,7 +1280,7 @@ char *getHOSTNAME(msg_t *pM)
 }
 
 
-uchar *getInputName(msg_t *pM)
+static uchar *getInputName(msg_t *pM)
 {
 	if(pM == NULL)
 		return (uchar*) "";
@@ -1339,7 +1347,7 @@ static int getStructuredDataLen(msg_t *pM)
 /* get the "STRUCTURED-DATA" as sz string
  * rgerhards, 2005-11-24
  */
-char *getStructuredData(msg_t *pM)
+static inline char *getStructuredData(msg_t *pM)
 {
 	return (pM->pCSStrucData == NULL) ? "-" : (char*) rsCStrGetSzStrNoNULL(pM->pCSStrucData);
 }
@@ -1465,14 +1473,13 @@ static int getAPPNAMELen(msg_t *pM)
 }
 
 /* rgerhards 2008-09-10: set pszInputName in msg object
+ * rgerhards, 2009-06-16
  */
-void MsgSetInputName(msg_t *pMsg, uchar* pszInputName)
+void MsgSetInputName(msg_t *pMsg, uchar* pszInputName, size_t lenInputName)
 {
 	assert(pMsg != NULL);
-	if(pMsg->pszInputName != NULL)
-		free(pMsg->pszInputName);
-
-	pMsg->iLenInputName = ustrlen(pszInputName);
+	free(pMsg->pszInputName);
+	pMsg->iLenInputName = lenInputName;
 	if((pMsg->pszInputName = malloc(pMsg->iLenInputName + 1)) != NULL) {
 		memcpy(pMsg->pszInputName, pszInputName, pMsg->iLenInputName + 1);
 	}
@@ -1549,40 +1556,6 @@ void MsgSetHOSTNAME(msg_t *pMsg, uchar* pszHOSTNAME)
 }
 
 
-/* Set the UxTradMsg to a caller-provided string. This is thought
- * to be a heap buffer that the caller will no longer use. This
- * function is a performance optimization over MsgSetUxTradMsg().
- * rgerhards 2004-11-19
- */
-#if 0 /* This method is currently not called, be we like to preserve it */
-static void MsgAssignUxTradMsg(msg_t *pMsg, char *pBuf)
-{
-	assert(pMsg != NULL);
-	assert(pBuf != NULL);
-	pMsg->iLenUxTradMsg = strlen(pBuf);
-	pMsg->pszUxTradMsg = pBuf;
-}
-#endif
-
-
-/* rgerhards 2004-11-17: set the traditional Unix message in msg object
- */
-int MsgSetUxTradMsg(msg_t *pMsg, char* pszUxTradMsg)
-{
-	assert(pMsg != NULL);
-	assert(pszUxTradMsg != NULL);
-	pMsg->iLenUxTradMsg = strlen(pszUxTradMsg);
-	if(pMsg->pszUxTradMsg != NULL)
-		free(pMsg->pszUxTradMsg);
-	if((pMsg->pszUxTradMsg = malloc(pMsg->iLenUxTradMsg + 1)) != NULL)
-		memcpy(pMsg->pszUxTradMsg, pszUxTradMsg, pMsg->iLenUxTradMsg + 1);
-	else
-		dbgprintf("Could not allocate memory for pszUxTradMsg buffer.");
-
-	return(0);
-}
-
-
 /* rgerhards 2004-11-09: set MSG in msg object
  */
 void MsgSetMSG(msg_t *pMsg, char* pszMSG)
@@ -1761,8 +1734,11 @@ char *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe,
 		pRes = getMSG(pMsg);
 	} else if(!strcmp((char*) pName, "rawmsg")) {
 		pRes = getRawMsg(pMsg);
+	/* enable this, if someone actually uses UxTradMsg, delete after some  time has
+	 * passed and nobody complained -- rgerhards, 2009-06-16
 	} else if(!strcmp((char*) pName, "uxtradmsg")) {
 		pRes = getUxTradMsg(pMsg);
+	*/
 	} else if(!strcmp((char*) pName, "inputname")) {
 		pRes = (char*) getInputName(pMsg);
 	} else if(!strcmp((char*) pName, "fromhost")) {
@@ -2486,14 +2462,19 @@ rsRetVal MsgSetProperty(msg_t *pThis, var_t *pProp)
 		pThis->msgFlags = pProp->val.num;
 	} else if(isProp("pszRawMsg")) {
 		MsgSetRawMsg(pThis, (char*) rsCStrGetSzStrNoNULL(pProp->val.pStr));
+ 	/* enable this, if someone actually uses UxTradMsg, delete after some  time has
+	 * passed and nobody complained -- rgerhards, 2009-06-16
+	} else if(isProp("offAfterPRI")) {
+		pThis->offAfterPRI = pProp->val.num;
+	*/
 	} else if(isProp("pszMSG")) {
 		MsgSetMSG(pThis, (char*) rsCStrGetSzStrNoNULL(pProp->val.pStr));
 	} else if(isProp("pszUxTradMsg")) {
-		MsgSetUxTradMsg(pThis, (char*) rsCStrGetSzStrNoNULL(pProp->val.pStr));
+		/*IGNORE*/; /* this *was* a property, but does no longer exist */
 	} else if(isProp("pszTAG")) {
 		MsgSetTAG(pThis, (char*) rsCStrGetSzStrNoNULL(pProp->val.pStr));
 	} else if(isProp("pszInputName")) {
-		MsgSetInputName(pThis, rsCStrGetSzStrNoNULL(pProp->val.pStr));
+		MsgSetInputName(pThis, rsCStrGetSzStrNoNULL(pProp->val.pStr), rsCStrLen(pProp->val.pStr));
 	} else if(isProp("pszRcvFromIP")) {
 		MsgSetRcvFromIP(pThis, rsCStrGetSzStrNoNULL(pProp->val.pStr));
 	} else if(isProp("pszRcvFrom")) {