From 71550a96fb273e8da723e9cf6ac77bbea8480695 Mon Sep 17 00:00:00 2001
From: Dominic Cleal <dcleal@redhat.com>
Date: Mon, 2 Jun 2014 12:51:19 +0100
Subject: [PATCH] Rsyslog: parse property filters and file actions with complex
 templates

Fixes RHBZ#1083016

(cherry picked from commit 74816cdcf599cf005b78d9a686dcedc84faf38b4)

Conflicts:
	NEWS
---
 lenses/rsyslog.aug            | 24 ++++++++++++++++++++----
 lenses/syslog.aug             |  2 +-
 lenses/tests/test_rsyslog.aug | 22 ++++++++++++++++++++++
 3 files changed, 43 insertions(+), 5 deletions(-)

diff --git a/lenses/rsyslog.aug b/lenses/rsyslog.aug
index 6a1b03a..943847f 100644
--- a/lenses/rsyslog.aug
+++ b/lenses/rsyslog.aug
@@ -23,16 +23,21 @@ module Rsyslog =
 
 autoload xfm
 
-let macro = [ key /$[A-Za-z0-9]+/ . Sep.space . store Rx.neg1 . Util.comment_or_eol ]
+let macro_rx = /[^,# \n\t][^#\n]*[^,# \n\t]|[^,# \n\t]/
+let macro = [ key /$[A-Za-z0-9]+/ . Sep.space . store macro_rx . Util.comment_or_eol ]
 
 (* View: users
    Map :omusrmsg: and a list of users, or a single *
 *)
-let omusrmsg = Util.del_str ":omusrmsg:" . 
+let omusrmsg = Util.del_str ":omusrmsg:" .
                  Syslog.label_opt_list_or "omusrmsg" (store Syslog.word)
                                           Syslog.comma "*"
 
-let action = Syslog.action | omusrmsg
+(* View: file_tmpl
+   File action with a specified template *)
+let file_tmpl = Syslog.file . [ label "template" . Util.del_str ";" . store Rx.word ]
+
+let action = Syslog.action | omusrmsg | file_tmpl
 
 (* View: entry
    An entry contains selectors and an action
@@ -40,7 +45,18 @@ let action = Syslog.action | omusrmsg
 let entry = [ label "entry" . Syslog.selectors . Syslog.sep_tab .
               [ label "action" . action ] . Util.eol ]
 
-let entries = ( Syslog.empty | Syslog.comment | entry | macro )*
+(* View: prop_filter
+   Parses property-based filters, which start with ":" and the property name *)
+let prop_filter =
+     let sep = Sep.comma . Util.del_ws_spc
+  in let prop_name = [ Util.del_str ":" . label "property" . store Rx.word ]
+  in let prop_oper = [ label "operation" . store /[A-Za-z!-]+/ ]
+  in let prop_val  = [ label "value" . Quote.do_dquote (store /[^\n"]*/) ]
+  in let prop_act  = [ label "action" . action ]
+  in [ label "filter" . prop_name . sep . prop_oper . sep . prop_val .
+       Sep.space . prop_act . Util.eol ]
+
+let entries = ( Syslog.empty | Syslog.comment | entry | macro | prop_filter )*
 
 let lns = entries . ( Syslog.program | Syslog.hostname )*
 
diff --git a/lenses/syslog.aug b/lenses/syslog.aug
index 97c721e..47f52e9 100644
--- a/lenses/syslog.aug
+++ b/lenses/syslog.aug
@@ -115,7 +115,7 @@ module Syslog =
 	(* Variable: file_r
 	 a file begins with a / and get almost anything else after
 	 *)
-	let file_r     = /\/[^ \t\n]+/
+	let file_r     = /\/[^ \t\n;]+/
 
 	(* Variable: loghost_r
 	 Matches a hostname, that is labels speparated by dots, labels can't
diff --git a/lenses/tests/test_rsyslog.aug b/lenses/tests/test_rsyslog.aug
index bf85129..46b24c3 100644
--- a/lenses/tests/test_rsyslog.aug
+++ b/lenses/tests/test_rsyslog.aug
@@ -117,3 +117,25 @@ test Rsyslog.lns get conf =
       { "omusrmsg" = "foo" }
       { "omusrmsg" = "bar" } }
   }
+
+(* Parse complex $template lines, RHBZ#1083016 *)
+test Rsyslog.lns get "$template SpiceTmpl,\"%TIMESTAMP%.%TIMESTAMP:::date-subseconds% %syslogtag% %syslogseverity-text%:%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\\n\"\n" =
+  { "$template" = "SpiceTmpl,\"%TIMESTAMP%.%TIMESTAMP:::date-subseconds% %syslogtag% %syslogseverity-text%:%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\\n\"" }
+
+(* Parse property-based filters, RHBZ#1083016 *)
+test Rsyslog.lns get ":programname, startswith, \"spice-vdagent\" /var/log/spice-vdagent.log;SpiceTmpl\n" =
+  { "filter"
+    { "property" = "programname" }
+    { "operation" = "startswith" }
+    { "value" = "spice-vdagent" }
+    { "action"
+      { "file" = "/var/log/spice-vdagent.log" }
+      { "template" = "SpiceTmpl" } } }
+
+test Rsyslog.lns get ":msg, !contains, \"error\" /var/log/noterror.log\n" =
+  { "filter"
+    { "property" = "msg" }
+    { "operation" = "!contains" }
+    { "value" = "error" }
+    { "action"
+      { "file" = "/var/log/noterror.log" } } }