From a4745f2afac60c28be53088050e9481b30926361 Mon Sep 17 00:00:00 2001
From: Rainer Gerhards <rgerhards@adiscon.com>
Date: Wed, 31 Aug 2011 11:17:30 +0200
Subject: bugfix: mark message processing did not work correctly

---
 ChangeLog               |  1 +
 action.c                | 48 +++++++++++++++++++++++-------------------------
 plugins/immark/immark.c |  1 +
 3 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index e0650aaa..de4e4b5d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,7 @@
 ---------------------------------------------------------------------------
 Version 5.8.5  [V5-stable] (rgerhards/al), 2011-09-01
 - bugfix/security: off-by-two bug in legacy syslog parser, CVE-2011-3200
+- bugfix: mark message processing did not work correctly
 - bugfix: potential hang condition during tag emulation
 - bugfix: too-early string termination during tag emulation
 - bugfix: The NUL-Byte for the syslogtag was not copied in MsgDup (msg.c)
diff --git a/action.c b/action.c
index 50699c01..951b4724 100644
--- a/action.c
+++ b/action.c
@@ -960,7 +960,7 @@ tryDoAction(action_t *pAction, batch_t *pBatch, int *pnElem)
 	i = pBatch->iDoneUpTo;	/* all messages below that index are processed */
 	iElemProcessed = 0;
 	iCommittedUpTo = i;
-dbgprintf("XXXXX:     tryDoAction %p, pnElem %d, nElem %d\n", pAction, *pnElem, pBatch->nElem);
+dbgprintf("XXXXX:  tryDoAction %p, pnElem %d, nElem %d\n", pAction, *pnElem, pBatch->nElem);
 	while(iElemProcessed <= *pnElem && i < pBatch->nElem) {
 		if(*(pBatch->pbShutdownImmediate))
 			ABORT_FINALIZE(RS_RET_FORCE_TERM);
@@ -1481,7 +1481,6 @@ doSubmitToActionQNotAllMarkBatch(action_t *pAction, batch_t *pBatch)
 	time_t now = 0;
 	time_t lastAct;
 	int i;
-	int bProcessMarkMsgs = 0;
 	int bModifiedFilter;
 	sbool FilterSave[1024];
 	sbool *pFilterSave;
@@ -1495,33 +1494,32 @@ doSubmitToActionQNotAllMarkBatch(action_t *pAction, batch_t *pBatch)
 
 	bModifiedFilter = 0;
 	for(i = 0 ; i < batchNumMsgs(pBatch) ; ++i) {
+		if(!pBatch->pElem[i].bFilterOK)
+			continue;
 		pFilterSave[i] = pBatch->pElem[i].bFilterOK;
-		if(((msg_t*)(pBatch->pElem[i].pUsrp))->msgFlags & MARK) {
-			/* check if we need to write or not */
-			if(now == 0) {
-				now = datetime.GetTime(NULL); /* good time call - the only one done */
-				/* CAS loop, we write back a bit early, but that's OK... */
-				/* we use reception time, not dequeue time - this is considered more appropriate and
-				 * also faster ;) -- rgerhards, 2008-09-17 */
-				do {
-					lastAct = pAction->f_time;
-					if((now - lastAct) <  MarkInterval / 2) {
-						DBGPRINTF("action was recently called, ignoring mark message\n");
-						bProcessMarkMsgs = 0;
-					} else {
-						bProcessMarkMsgs = 1;
-					}
-				} while(ATOMIC_CAS_time_t(&pAction->f_time, lastAct,
-					((msg_t*)(pBatch->pElem[i].pUsrp))->ttGenTime, &pAction->mutCAS) == 0);
-			}
-			if(bProcessMarkMsgs) {
-				pBatch->pElem[i].bFilterOK = 0;
-				bModifiedFilter = 1;
+		if(now == 0) {
+			now = datetime.GetTime(NULL); /* good time call - the only one done */
+		}
+		/* CAS loop, we write back a bit early, but that's OK... */
+		/* we use reception time, not dequeue time - this is considered more appropriate and
+		 * also faster ;) -- rgerhards, 2008-09-17 */
+		do {
+			lastAct = pAction->f_time;
+			if(((msg_t*)(pBatch->pElem[i].pUsrp))->msgFlags & MARK) {
+				if((now - lastAct) < MarkInterval / 2) {
+					pBatch->pElem[i].bFilterOK = 0;
+					bModifiedFilter = 1;
+					DBGPRINTF("action was recently called, ignoring mark message\n");
+					break; /* do not update timestamp for non-written mark messages */
+				}
 			}
+		} while(ATOMIC_CAS_time_t(&pAction->f_time, lastAct,
+			((msg_t*)(pBatch->pElem[i].pUsrp))->ttGenTime, &pAction->mutCAS) == 0);
+		if(pBatch->pElem[i].bFilterOK) {
+			DBGPRINTF("Called action(NotAllMark), processing batch[%d] via '%s'\n",
+				  i, module.GetStateName(pAction->pMod));
 		}
 	}
-	
-	DBGPRINTF("Called action(NotAllMark), logging to %s\n", module.GetStateName(pAction->pMod));
 
 	iRet = doSubmitToActionQBatch(pAction, pBatch);
 
diff --git a/plugins/immark/immark.c b/plugins/immark/immark.c
index 6410003d..baac13a6 100644
--- a/plugins/immark/immark.c
+++ b/plugins/immark/immark.c
@@ -87,6 +87,7 @@ CODESTARTrunInput
 		if(glbl.GetGlobalInputTermState() == 1)
 			break; /* terminate input! */
 
+		dbgprintf("immark: injecting mark message\n");
 		logmsgInternal(NO_ERRCODE, LOG_INFO, (uchar*)"-- MARK --", MARK);
 	}
 ENDrunInput
-- 
cgit