- syslog-ng - lists.balabit.hu

How to use parsed results from program pattern?
by Daniel Walter 29 Aug '13

29 Aug '13

Hi folks, the documentation (https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.4-gui…) states multiple times that program patterns and message patterns work the same way. "You can also use parsers in the program pattern if needed, and use the parsed results later. For example: <pattern>postfix\@ESTRING:.postfix.component:[@</pattern>" I try to achieve exactly this behaviour. But my foobar.pdb (see attachment or http://pastebin.com/aZKMKmkc) seems not to work. I tested it with pdbtool: pdbtool -v test foobar.pdb Testing message program='imapd(foo)' message='connect from 192.168.2.179 (192.168.2.179)' Match name='.classifier.rule_id', value='foobaz', expected='foobaz' Match name='IPA', value='192.168.2.179', expected='192.168.2.179' Match name='IPB', value='192.168.2.179', expected='192.168.2.179' Wrong match name='FOOA', value='', expected='foo' Wrong match name='FOOB', value='', expected='foo' What I am doing wrong? How can I use the parsed results from program pattern later? Tested with syslog version: syslog-ng 3.4.3 Installer-Version: 3.4.3 Revision: ssh+git://algernon@git.balabit/var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.4#no_branch#64d670f3cbfb90769f3c7f0fdd9c70bb9136ec5b Compile-Date: Aug 27 2013 17:55:45 Available-Modules: afsocket-tls,cryptofuncs,affile,afsocket,syslogformat,dbparser,afsocket-notls,basicfuncs,json-plugin,system-source,afmongodb,afamqp,afprog,afuser,confgen,csvparser Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-Linux-Caps: on Enable-Pcre: on And: syslog-ng 3.3.9 Installer-Version: 3.3.9 Revision: 3.3.9-1 (/) Compile-Date: May 26 2013 11:36:00 Default-Modules: affile,afprog,afsocket,afuser,afsql,basicfuncs,csvparser,dbparser,syslogformat Available-Modules: afsocket-notls,basicfuncs,confgen,afsocket,convertfuncs,syslogformat,afuser,csvparser,dbparser,affile,afsocket-tls,afprog Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: on Enable-Pcre: on Best Regards, Daniel

2 1

Re: [syslog-ng] patterndb and intrusion prevention
by Valentijn Sessink 29 Aug '13

29 Aug '13

Hi Florian, Thank you for your explanation. You are using the "program" destination, which works fine. The problem I am experiencing only shows up when using "file" output, as there seems to be a problem with lseek in combination with the proc filesystem. Best regards, Valentijn -- Mobile - hence terse.

2 1

patterndb and intrusion prevention
by Matt Zagrabelny 28 Aug '13

28 Aug '13

Greetings, In 2011, Bazsi posted an entry [1] about a fellow named Valentijn Sessink doing some interesting work with patterndb and the iptables xt_recent module. I am mostly there (following Valentijn's example), but am having issues. Specifically, it does not seem that syslog-ng is writing the IPs to the xt_recent proc "file". Syslog-ng is writing them to a regular log file, though: # cat /proc/net/xt_recent/syslogblock # other-system$ ssh doug@system other-system$ # cat /var/log/syslogblock 2013-07-30 16:26:42 Failed password for invalid user doug from 131.212.109.58 port 37867 ssh2 +131.212.109.58 2013-07-30 16:26:42 Failed password for invalid user doug from 131.212.109.58 port 37867 ssh2 +131.212.109.58 2013-07-30 16:45:26 Failed none for invalid user doug from 131.212.109.58 port 37956 ssh2 +131.212.109.58 # cat /proc/net/xt_recent/syslogblock # I can add the host by hand to the xt_recent file: # echo '+131.212.109.58' > /proc/net/xt_recent/syslogblock # echo '+131.212.109.58' > /proc/net/xt_recent/syslogblock # echo '+131.212.109.58' > /proc/net/xt_recent/syslogblock # cat /proc/net/xt_recent/syslogblock src=131.212.109.58 ttl: 0 last_seen: 5445045124 oldest_pkt: 3 5445044388, 5445044844, 5445045124 The above is the expected output. Here are my configs: $ cat /etc/syslog-ng/conf.d/ssh-failure-iptables-recent-block.conf # a destination; we have a dual destination here, a file to see the # blocked hosts, and an iptables-destination in /proc to block them. destination d_syslogblock { file( "/proc/net/xt_recent/syslogblock" template("+${usracct.device}\n") ); file( "/var/log/syslogblock" template("$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC $MSG +${usracct.device}\n") ); }; # a parser for the pattern-DB we made in step 1 parser pattern_db { db_parser( file("/var/lib/syslog-ng/patterndb.xml") ); }; # a filter to filter the parser results filter f_syslogblock { tags("secevt") and match( "REJECT" value("secevt.verdict") ); }; # and finally, the log itself: log { source(s_src); parser(pattern_db); filter(f_syslogblock); destination(d_syslogblock); };

3 5

[Bug 155] New: Compilation failure in 3.3.3: the Darwin linker does not accept "--whole-archive"
by bugzilla＠bugzilla.balabit.com 26 Aug '13

26 Aug '13

https://bugzilla.balabit.com/show_bug.cgi?id=155 Summary: Compilation failure in 3.3.3: the Darwin linker does not accept "--whole-archive" Product: syslog-ng Version: 3.3.x Platform: Macintosh OS/Version: Mac OS Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jacknagel(a)gmail.com Type of the Report: bug Estimated Hours: 0.0 Trying to compile 3.3.3 on Mac OS X 10.6.8/XCode 4.2, I get this: libtool: link: /usr/bin/llvm-gcc -std=gnu99 -dynamiclib -o .libs/libsyslog-ng-3.3.3.dylib [...] ld: unknown option: --whole-archive collect2: ld returned 1 exit status some cursory googling reveals that the Darwin linker does not accept "--whole-archive". I'd be happy to help test a patch. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 11

[Bug 173] New: Compile issues with syslog-ng_3.3.4.tar.gz
by bugzilla＠bugzilla.balabit.com 26 Aug '13

26 Aug '13

https://bugzilla.balabit.com/show_bug.cgi?id=173 Summary: Compile issues with syslog-ng_3.3.4.tar.gz Product: syslog-ng Version: 3.3.x Platform: Other OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: mark.ulmer(a)apollogrp.edu Type of the Report: bug Estimated Hours: 0.0 Bazsi, I've been working to get a version of 3.3.x compiled on our RHEL 5.6 server for quite some time. I finally have found part of what I think is an issue that might need to be resolved on my side. I don't know. So the latest eventlog-0.2.12 compiles, makes and installs fine. Then in compiling syslog-ng-3.3.4 I get the following error: checking sanity checking Glib headers... no configure: error: Glib headers inconsistent with current compiler setting. You might be using 32 bit Glib with a 64 bit compiler, check PKG_CONFIG_PATH I see in the config.log it's looing for include files in /usr/include/glib-2.0/glib-2.0. The path on my server only has one level glib-2.0. I've tried work arounds and this still gets replicated to lower modules with the same duplicated path level. Go you have a suggestion for me to get past this? Thanks in advance for your assistance. Mark Ulmer Phoenix, AZ, USA -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

4 9

[Bug 248] New: template parsing does not split ", " argument of --scope
by bugzilla＠bugzilla.balabit.com 26 Aug '13

26 Aug '13

https://bugzilla.balabit.com/show_bug.cgi?id=248 Summary: template parsing does not split "," argument of --scope Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.balabit(a)faxm0dem.org Type of the Report: --- Estimated Hours: 0.0 As stated in paragraph 2.8.4.(Structuring macros, metadata, and other value-pairs) of the documentation, in example 2.1. (Using the value-pairs() option) it should be possible to pass multiple coma separated values to a template. However, this seems to be broken: Error parsing config, Error compiling template (Error parsing value-pairs: unknown scope all-nv-pairs,rfc5423) in /opt/etc/syslog-ng.conf at line 44, column 14: template("$(format-json --scope all-nv-pairs,rfc5423 )\\n"); ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The workaround is to specify '--scope $scope' multiple times -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 5

[Bug 249] New: pdbtool segfaults when using --module switch
by bugzilla＠bugzilla.balabit.com 26 Aug '13

26 Aug '13

https://bugzilla.balabit.com/show_bug.cgi?id=249 Summary: pdbtool segfaults when using --module switch Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.balabit(a)faxm0dem.org Type of the Report: --- Estimated Hours: 0.0 Core was generated by `/opt/bin/pdbtool test --validate --color-out /tmp/collectd.pdb -d --module test'. Program terminated with signal 11, Segmentation fault. #0 0x00007f528910ca5f in plugin_load_module (module_name=0x159d8a0 "test", cfg=0x0, args=0x0) at plugin.c:346 346 if (cfg->lexer) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

[Bug 246] New: Enhancement: add support for array values
by bugzilla＠bugzilla.balabit.com 26 Aug '13

26 Aug '13

https://bugzilla.balabit.com/show_bug.cgi?id=246 Summary: Enhancement: add support for array values Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.balabit(a)faxm0dem.org Type of the Report: --- Estimated Hours: 0.0 It would be great to support arrays in addition to name-value pairs and tags. This would for instance allow for a @TAGS array, instead of the space-separated $TAGS string, which you need to parse on the remote end when sending json format to an application. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

syslog-ng to receive remote messages from sysklogd and rsyslog?
by subin 25 Aug '13

25 Aug '13

Hi, I have syslog-ng v3.1.3-3 on Debian 6 listening on a network interface. 1. Is it possible/compatible for syslog-ng to receive messages over network from sysklogd(v1.4.1-17) and rsyslog(v3.18.6-4)? 2. In the event of syslog-ng getting restarted (part of logrotate scripts) would the messages be queued up on the remote syslog services? Or would there be any loss of log-data? Thanks.

2 2

[PATCH (3.5) 1/3] tests: Add a testcase for log_template_compile function
by Juhász Viktor 24 Aug '13

24 Aug '13

test_template_compile: new unit test implemented. Main goal of this test is to help the refactoring the log_template_compile monster function Signed-off-by: Juhasz Viktor <jviktor(a)balabit.hu> --- tests/unit/Makefile.am | 5 + tests/unit/test_template_compile.c | 320 ++++++++++++++++++++++++++++++++++++ 2 files changed, 325 insertions(+) diff --git a/tests/unit/Makefile.am b/tests/unit/Makefile.am index 8841834..af5730f 100644 --- a/tests/unit/Makefile.am +++ b/tests/unit/Makefile.am @@ -8,6 +8,7 @@ tests_unit_TESTS = \ tests/unit/test_serialize \ tests/unit/test_msgparse \ tests/unit/test_template \ + tests/unit/test_template_compile \ tests/unit/test_template_speed \ tests/unit/test_dnscache \ tests/unit/test_findcrlf \ @@ -56,6 +57,10 @@ tests_unit_test_template_LDADD = \ $(unit_test_extra_modules) \ $(PREOPEN_BASICFUNCS) +tests_unit_test_template_compile_CFLAGS = $(TEST_CFLAGS) +tests_unit_test_template_compile_LDADD = \ + $(TEST_LDADD) $(unit_test_extra_modules) + tests_unit_test_template_speed_LDADD = \ $(TEST_LDADD) $(unit_test_extra_modules) diff --git a/tests/unit/test_template_compile.c b/tests/unit/test_template_compile.c new file mode 100644 index 0000000..23fed4f --- /dev/null +++ b/tests/unit/test_template_compile.c @@ -0,0 +1,320 @@ +#include "templates.c" +#include "logmsg.h" +#include "testutils.h" +#include "cfg.h" +#include "plugin.h" + +#define SIMPLE_STRING "Test String" +#define SIMPLE_MACRO "${MESSAGE}" +#define SIMPLE_MACRO_UNBRACE "$MESSAGE" +#define SIMPLE_MACRO_UNBRACE_ADD_TEXT "$MESSAGE test value" +#define SIMPLE_MACRO_MSGREF "${MESSAGE}@1" +#define SIMPLE_MACRO_INVALID_REF "${MESSAGE}(a)gmail.com" +#define SIMPLE_MACRO_ADD_TEXT "${MESSAGE}test value" +#define ESCAPED_CHAR "Test \\$STRING" +#define VALID_SUBST "${MESSAGE:-default value}" +#define TRICKY_VALUE "$$VALUE_NAME" +#define TRICKY_VALUE_2 "$:VALUE_NAME" +#define TRICKY_VALUE_3 "$${VALUE_NAME}" +#define TRICKY_VALUE_4 "\\" +#define TRICKY_VALUE_5 "$" +#define TRICKY_VALUE_6 "${MESSAGE:-}" +#define TRICKY_VALUE_7 "${}" + +#define INVALID_MACRO "${MESSAGE" +#define INVALID_SUBST "${MESSAGE:1}" + +#define SIMPLE_VALUE "${VALUE_NAME}" +#define SIMPLE_VALUE_UNBRACE "$VALUE_NAME" +#define SIMPLE_VALUE_ESCAPED "${VALUE\\}NAME}" + +#define SIMPLE_TEMPLATE_FUNCTION "$(hello)" +#define SIMPLE_TEMPLATE_FUNCTION_WITH_ADDITIONAL_TEXT "$(hello)test value" +#define COMPLICATED_TEMPLATE_FUNCTION "$( hello \\tes\t\t\t value(xyz) \"value with spaces\" 'test value with spa\"ces')@2" +#define COMPLICATED_TEMPLATE_FUNCTION_BAD_1 "$( hello \\tes\t\t\t value(xyz \"value with spaces\" 'test value with spa\"ces')" +#define COMPLICATED_TEMPLATE_FUNCTION_BAD_2 "$( hello \\tes\t\t\t value xyz \"value with spaces\" 'test value with spa\"ces'" + +#define SIMPLE_UNKNOWN_FUNCTION "$(unknown function)" + +static void +hello(LogMessage *msg, int argc, GString *argv[], GString *result) +{ + return; +} + +TEMPLATE_FUNCTION_SIMPLE(hello); +Plugin hello_plugin = TEMPLATE_FUNCTION_PLUGIN(hello, "hello"); + + +GlobalConfig *configuration; +static void +hide_internal_message(LogMessage *msg) +{ + log_msg_unref(msg); + return; +} + +#define assert_common_element(actual, expected) \ + assert_string(actual.text, expected.text, ASSERTION_ERROR("Bad compiled template text")); \ + if (expected.default_value) \ + { \ + assert_string(actual.default_value, expected.default_value, ASSERTION_ERROR("Bad compiled template default value")); \ + } \ + else \ + { \ + assert_gpointer(actual.default_value, NULL, ASSERTION_ERROR("Bad compiled template default value")); \ + } \ + assert_gint(actual.msg_ref, expected.msg_ref, ASSERTION_ERROR("Bad compiled template msg_ref")); + +#define assert_value_element(actual, expected) \ + assert_gint(actual.type, LTE_VALUE, ASSERTION_ERROR("Bad compiled template type")); \ + assert_common_element(actual, expected); \ + assert_gint(actual.value_handle, expected.value_handle, ASSERTION_ERROR("Bad compiled template macro")); + +#define assert_macro_element(actual, expected) \ + assert_gint(actual.type, LTE_MACRO, ASSERTION_ERROR("Bad compiled template type")); \ + assert_common_element(actual, expected); \ + assert_gint(actual.macro, expected.macro, ASSERTION_ERROR("Bad compiled template macro")); + +#define assert_func_element(actual, expected) \ + assert_gint(actual.type, LTE_FUNC, ASSERTION_ERROR("Bad compiled template type")); \ + assert_common_element(actual, expected); \ + assert_gpointer(actual.func.ops, expected.func.ops, ASSERTION_ERROR("Bad compiled template macro")); + +#define assert_bad_element(actual, expected, expected_error_message) \ + assert_string(err->message, expected_error_message, ASSERTION_ERROR("Bad error message")); \ + assert_macro_element(actual, expected) + + +#define assert_template_compile(template_string) \ + assert_true(log_template_compile(template, template_string, &err), ASSERTION_ERROR("Can't compile template")); \ + assert_string(template->template, template_string, ASSERTION_ERROR("Bad stored template")); + +#define assert_failed_template_compile(template_string) assert_false(log_template_compile(template, template_string, &err), ASSERTION_ERROR("Can compile bad template")); + +#define fill_expected_template_element(element, text, default_value, spec, type, msg_ref) {\ + element.text; \ + element.default_value; \ + element.spec; \ + element.type; \ + element.msg_ref; } + + + +void +test_template_compile_macro() +{ + GError *err = NULL; + LogTemplateElem *element; + LogTemplateElem expected_element; + LogTemplate *template = log_template_new(configuration, NULL); + + assert_template_compile(SIMPLE_STRING); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = SIMPLE_STRING, default_value = NULL, macro = M_NONE, type = LTE_MACRO, msg_ref = 0); + assert_macro_element(element[0], expected_element); + + assert_template_compile(SIMPLE_MACRO); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "", default_value = NULL, macro = M_MESSAGE, type = LTE_MACRO, msg_ref = 0); + assert_macro_element(element[0], expected_element); + + assert_template_compile(SIMPLE_MACRO_ADD_TEXT); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "", default_value = NULL, macro = M_MESSAGE, type = LTE_MACRO, msg_ref = 0); + assert_macro_element(element[0], expected_element); + element = (LogTemplateElem *)template->compiled_template->next->data; + fill_expected_template_element(expected_element, text = "test value", default_value = NULL, macro = M_NONE, type = LTE_MACRO, msg_ref = 0); + assert_macro_element(element[0], expected_element); + + assert_template_compile(SIMPLE_MACRO_UNBRACE); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "", default_value = NULL, macro = M_MESSAGE, type = LTE_MACRO, msg_ref = 0); + assert_macro_element(element[0], expected_element); + + assert_template_compile(SIMPLE_MACRO_UNBRACE_ADD_TEXT); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "", default_value = NULL, macro = M_MESSAGE, type = LTE_MACRO, msg_ref = 0); + assert_macro_element(element[0], expected_element); + element = (LogTemplateElem *)template->compiled_template->next->data; + fill_expected_template_element(expected_element, text = " test value", default_value = NULL, macro = M_NONE, type = LTE_MACRO, msg_ref = 0); + assert_macro_element(element[0], expected_element); + + assert_template_compile(SIMPLE_MACRO_MSGREF); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "", default_value = NULL, macro = M_MESSAGE, type = LTE_MACRO, msg_ref = 2); + assert_macro_element(element[0], expected_element); + + assert_template_compile(SIMPLE_MACRO_INVALID_REF); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "", default_value = NULL, macro = M_MESSAGE, type = LTE_MACRO, msg_ref = 1); + assert_macro_element(element[0], expected_element); + element = (LogTemplateElem *)template->compiled_template->next->data; + fill_expected_template_element(expected_element, text = "gmail.com", default_value = NULL, macro = M_NONE, type = LTE_MACRO, msg_ref = 0); + assert_macro_element(element[0], expected_element); + + assert_template_compile(ESCAPED_CHAR); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "Test $STRING", default_value = NULL, macro = M_NONE, type = LTE_MACRO, msg_ref = 0); + assert_macro_element(element[0], expected_element); + + assert_template_compile(VALID_SUBST); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "", default_value = "default value", macro = M_MESSAGE, type = LTE_MACRO, msg_ref = 0); + assert_macro_element(element[0], expected_element); + + assert_template_compile(TRICKY_VALUE); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "$VALUE_NAME", default_value = NULL, macro = M_NONE, type = LTE_MACRO, msg_ref = 0); + assert_macro_element(element[0], expected_element); + + assert_template_compile(TRICKY_VALUE_2); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "$:VALUE_NAME", default_value = NULL, macro = M_NONE, type = LTE_MACRO, msg_ref = 0); + assert_macro_element(element[0], expected_element); + + assert_template_compile(TRICKY_VALUE_3); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "${VALUE_NAME}", default_value = NULL, macro = M_NONE, type = LTE_MACRO, msg_ref = 0); + assert_macro_element(element[0], expected_element); + + assert_template_compile(TRICKY_VALUE_4); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "", default_value = NULL, macro = M_NONE, type = LTE_MACRO, msg_ref = 0); + assert_macro_element(element[0], expected_element); + + assert_template_compile(TRICKY_VALUE_5); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "$", default_value = NULL, macro = M_NONE, type = LTE_MACRO, msg_ref = 0); + assert_macro_element(element[0], expected_element); + + assert_template_compile(TRICKY_VALUE_6); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "", default_value = "", macro = M_MESSAGE, type = LTE_MACRO, msg_ref = 0); + assert_macro_element(element[0], expected_element); + + log_template_unref(template); +} + +void +test_template_compile_value() +{ + GError *err = NULL; + LogTemplateElem *element; + LogTemplateElem expected_element; + LogTemplate *template = log_template_new(configuration, NULL); + + assert_template_compile(SIMPLE_VALUE); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "", default_value = NULL, value_handle = log_msg_get_value_handle("VALUE_NAME"), type = LTE_VALUE, msg_ref = 0); + assert_value_element(element[0], expected_element); + + assert_template_compile(SIMPLE_VALUE_UNBRACE); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "", default_value = NULL, value_handle = log_msg_get_value_handle("VALUE_NAME"), type = LTE_VALUE, msg_ref = 0); + assert_value_element(element[0], expected_element); + + assert_template_compile(SIMPLE_VALUE_ESCAPED); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "", default_value = NULL, value_handle = log_msg_get_value_handle("VALUE\\"), type = LTE_VALUE, msg_ref = 0); + assert_value_element(element[0], expected_element); + + assert_template_compile(TRICKY_VALUE_7); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "", default_value = NULL, value_handle = log_msg_get_value_handle(""), type = LTE_VALUE, msg_ref = 0); + assert_value_element(element[0], expected_element); + + log_template_unref(template); +} + +void +test_template_compile_func() +{ + GError *err = NULL; + LogTemplateElem *element; + LogTemplateElem expected_element; + LogTemplate *template = log_template_new(configuration, NULL); + plugin_register(configuration, &hello_plugin, 1); + + assert_template_compile(SIMPLE_TEMPLATE_FUNCTION); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "", default_value = NULL, func.ops = hello_construct(&hello_plugin, configuration, LL_CONTEXT_TEMPLATE_FUNC, "hello"), type = LTE_FUNC, msg_ref = 0); + assert_func_element(element[0], expected_element); + + assert_template_compile(COMPLICATED_TEMPLATE_FUNCTION); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "", default_value = NULL, func.ops = hello_construct(&hello_plugin, configuration, LL_CONTEXT_TEMPLATE_FUNC, "hello"), type = LTE_FUNC, msg_ref = 3); + assert_func_element(element[0], expected_element); + + assert_template_compile(SIMPLE_TEMPLATE_FUNCTION_WITH_ADDITIONAL_TEXT); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "", default_value = NULL, func.ops = hello_construct(&hello_plugin, configuration, LL_CONTEXT_TEMPLATE_FUNC, "hello"), type = LTE_FUNC, msg_ref = 0); + assert_func_element(element[0], expected_element); + element = (LogTemplateElem *)template->compiled_template->next->data; + fill_expected_template_element(expected_element, text = "test value", default_value = NULL, macro = M_NONE, type = LTE_MACRO, msg_ref = 0); + assert_macro_element(element[0], expected_element); + + log_template_unref(template); +} + +void +test_template_compile_negativ_tests() +{ + GError *err = NULL; + LogTemplateElem *element; + LogTemplateElem expected_element; + LogTemplate *template = log_template_new(configuration, NULL); + + assert_failed_template_compile(INVALID_MACRO); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "error in template: ${MESSAGE", default_value = NULL, macro = M_NONE, type = LTE_MACRO, msg_ref = 0); + assert_bad_element(element[0], expected_element, "Invalid macro, '}' is missing, error_pos='9'"); + g_clear_error(&err); + + + assert_failed_template_compile(INVALID_SUBST); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "error in template: ${MESSAGE:1}", default_value = NULL, macro = M_NONE, type = LTE_MACRO, msg_ref = 0); + assert_bad_element(element[0], expected_element, "Unknown substitution function, error_pos='10'"); + g_clear_error(&err); + + + assert_failed_template_compile(COMPLICATED_TEMPLATE_FUNCTION_BAD_1); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "error in template: $( hello \\tes\t\t\t value(xyz \"value with spaces\" 'test value with spa\"ces')", default_value = NULL, macro = M_NONE, type = LTE_MACRO, msg_ref = 0); + assert_bad_element(element[0], expected_element, "Invalid template function reference, missing function name or inbalanced '(', error_pos='73'"); + g_clear_error(&err); + + assert_failed_template_compile(COMPLICATED_TEMPLATE_FUNCTION_BAD_2); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "error in template: $( hello \\tes\t\t\t value xyz \"value with spaces\" 'test value with spa\"ces'", default_value = NULL, macro = M_NONE, type = LTE_MACRO, msg_ref = 0); + assert_bad_element(element[0], expected_element, "Invalid template function reference, missing function name or inbalanced '(', error_pos='72'"); + g_clear_error(&err); + + assert_failed_template_compile(SIMPLE_UNKNOWN_FUNCTION); + element = (LogTemplateElem *)template->compiled_template->data; + fill_expected_template_element(expected_element, text = "error in template: $(unknown function)", default_value = NULL, macro = M_NONE, type = LTE_MACRO, msg_ref = 0); + assert_bad_element(element[0], expected_element, "Unknown template function unknown"); + g_clear_error(&err); + + log_template_unref(template); +} + +int main(int argc, char **argv) +{ + msg_init(FALSE); + configuration = cfg_new(0x305); + log_msg_registry_init(); + log_template_global_init(); + + msg_set_post_func(hide_internal_message); + + test_template_compile_macro(); + test_template_compile_value(); + test_template_compile_func(); + test_template_compile_negativ_tests(); + + log_msg_registry_deinit(); + msg_deinit(); + return 0; +} --

3 2