1 files changed, 955 insertions, 160 deletions

diff --git a/grammar/rainerscript.c b/grammar/rainerscript.c
index e458187c..9440dd2f 100644
--- a/grammar/rainerscript.c
+++ b/grammar/rainerscript.c
@@ -2,7 +2,7 @@
  *
  * Module begun 2011-07-01 by Rainer Gerhards
  *
- * Copyright 2011 Rainer Gerhards and Adiscon GmbH.
+ * Copyright 2011-2012 Rainer Gerhards and Adiscon GmbH.
  *
  * This file is part of the rsyslog runtime library.
  *
@@ -37,10 +37,50 @@
 #include <libestr.h>
 #include "rsyslog.h"
 #include "rainerscript.h"
+#include "conf.h"
 #include "parserif.h"
+#include "rsconf.h"
 #include "grammar.h"
 #include "queue.h"
 #include "srUtils.h"
+#include "regexp.h"
+#include "obj.h"
+
+DEFobjCurrIf(obj)
+DEFobjCurrIf(regexp)
+
+void cnfexprOptimize(struct cnfexpr *expr);
+
+char*
+getFIOPName(unsigned iFIOP)
+{
+	char *pRet;
+	switch(iFIOP) {
+		case FIOP_CONTAINS:
+			pRet = "contains";
+			break;
+		case FIOP_ISEQUAL:
+			pRet = "isequal";
+			break;
+		case FIOP_STARTSWITH:
+			pRet = "startswith";
+			break;
+		case FIOP_REGEX:
+			pRet = "regex";
+			break;
+		case FIOP_EREREGEX:
+			pRet = "ereregex";
+			break;
+		case FIOP_ISEMPTY:
+			pRet = "isempty";
+			break;
+		default:
+			pRet = "NOP";
+			break;
+	}
+	return pRet;
+}
+
 
 void
 readConfFile(FILE *fp, es_str_t **str)
@@ -93,6 +133,77 @@ readConfFile(FILE *fp, es_str_t **str)
 	es_addChar(str, '\0');
 }
 
+struct objlst*
+objlstNew(struct cnfobj *o)
+{
+	struct objlst *lst;
+
+	if((lst = malloc(sizeof(struct objlst))) != NULL) {
+		lst->next = NULL;
+		lst->obj = o;
+	}
+cnfobjPrint(o);
+
+	return lst;
+}
+
+/* add object to end of object list, always returns pointer to root object */
+struct objlst*
+objlstAdd(struct objlst *root, struct cnfobj *o)
+{
+	struct objlst *l;
+	struct objlst *newl;
+	
+	newl = objlstNew(o);
+	if(root == 0) {
+		root = newl;
+	} else { /* find last, linear search ok, as only during config phase */
+		for(l = root ; l->next != NULL ; l = l->next)
+			;
+		l->next = newl;
+	}
+	return root;
+}
+
+/* add stmt to current script, always return root stmt pointer */
+struct cnfstmt*
+scriptAddStmt(struct cnfstmt *root, struct cnfstmt *s)
+{
+	struct cnfstmt *l;
+	
+	if(root == NULL) {
+		root = s;
+	} else { /* find last, linear search ok, as only during config phase */
+		for(l = root ; l->next != NULL ; l = l->next)
+			;
+		l->next = s;
+	}
+	return root;
+}
+
+void
+objlstDestruct(struct objlst *lst)
+{
+	struct objlst *toDel;
+
+	while(lst != NULL) {
+		toDel = lst;
+		lst = lst->next;
+		cnfobjDestruct(toDel->obj);
+		free(toDel);
+	}
+}
+
+void
+objlstPrint(struct objlst *lst)
+{
+	dbgprintf("objlst %p:\n", lst);
+	while(lst != NULL) {
+		cnfobjPrint(lst->obj);
+		lst = lst->next;
+	}
+}
+
 struct nvlst*
 nvlstNew(es_str_t *name, es_str_t *value)
 {
@@ -576,6 +687,7 @@ cnfobjNew(enum cnfobjType objType, struct nvlst *lst)
 		nvlstChkDupes(lst);
 		o->objType = objType;
 		o->nvlst = lst;
+		o->subobjs = NULL;
 	}
 
 	return o;
@@ -586,6 +698,7 @@ cnfobjDestruct(struct cnfobj *o)
 {
 	if(o != NULL) {
 		nvlstDestruct(o->nvlst);
+		objlstDestruct(o->subobjs);
 		free(o);
 	}
 }
@@ -598,117 +711,6 @@ cnfobjPrint(struct cnfobj *o)
 }
 
 
-struct cnfactlst*
-cnfactlstNew(enum cnfactType actType, struct nvlst *lst, char *actLine)
-{
-	struct cnfactlst *actlst;
-
-	if((actlst = malloc(sizeof(struct cnfactlst))) != NULL) {
-		actlst->next = NULL;
-		actlst->syslines = NULL;
-		actlst->actType = actType;
-		actlst->lineno = yylineno;
-		actlst->cnfFile = strdup(cnfcurrfn);
-		if(actType == CNFACT_V2)
-			actlst->data.lst = lst;
-		else
-			actlst->data.legActLine = actLine;
-	}
-	return actlst;
-}
-
-struct cnfactlst*
-cnfactlstAddSysline(struct cnfactlst* actlst, char *line)
-{
-	struct cnfcfsyslinelst *cflst;
-
-	if((cflst = malloc(sizeof(struct cnfcfsyslinelst))) != NULL)   {
-		cflst->line = line;
-		if(actlst->syslines == NULL) {
-			cflst->next = NULL;
-		} else {
-			cflst->next = actlst->syslines;
-		}
-		actlst->syslines = cflst;
-	}
-	return actlst;
-}
-
-
-void
-cnfactlstDestruct(struct cnfactlst *actlst)
-{
-	struct cnfactlst *toDel;
-
-	while(actlst != NULL) {
-		toDel = actlst;
-		actlst = actlst->next;
-		free(toDel->cnfFile);
-		cnfcfsyslinelstDestruct(toDel->syslines);
-		if(toDel->actType == CNFACT_V2)
-			nvlstDestruct(toDel->data.lst);
-		else
-			free(toDel->data.legActLine);
-		free(toDel);
-	}
-	
-}
-
-static inline struct cnfcfsyslinelst*
-cnfcfsyslinelstReverse(struct cnfcfsyslinelst *lst)
-{
-	struct cnfcfsyslinelst *curr, *prev;
-	if(lst == NULL)
-		return NULL;
-	prev = NULL;
-	while(lst != NULL) {
-		curr = lst;
-		lst = lst->next;
-		curr->next = prev;
-		prev = curr;
-	}
-	return prev;
-}
-
-struct cnfactlst*
-cnfactlstReverse(struct cnfactlst *actlst)
-{
-	struct cnfactlst *curr, *prev;
-
-	prev = NULL;
-	while(actlst != NULL) {
-		//dbgprintf("reversing: %s\n", actlst->data.legActLine);
-		curr = actlst;
-		actlst = actlst->next;
-		curr->syslines = cnfcfsyslinelstReverse(curr->syslines);
-		curr->next = prev;
-		prev = curr;
-	}
-	return prev;
-}
-
-void
-cnfactlstPrint(struct cnfactlst *actlst)
-{
-	struct cnfcfsyslinelst *cflst;
-
-	while(actlst != NULL) {
-		dbgprintf("aclst %p: ", actlst);
-		if(actlst->actType == CNFACT_V2) {
-			dbgprintf("V2 action type: ");
-			nvlstPrint(actlst->data.lst);
-		} else {
-			dbgprintf("legacy action line: '%s'\n",
-				actlst->data.legActLine);
-		}
-		for(  cflst = actlst->syslines
-		    ; cflst != NULL ; cflst = cflst->next) {
-			dbgprintf("action:cfsysline: '%s'\n", cflst->line);
-		}
-		actlst = actlst->next;
-	}
-}
-
 struct cnfexpr*
 cnfexprNew(unsigned nodetype, struct cnfexpr *l, struct cnfexpr *r)
 {
@@ -735,32 +737,111 @@ done:
  * try to convert it to one. The semantics from es_str2num()
  * are used (bSuccess tells if the conversion went well or not).
  */
-static inline long long
+static long long
 var2Number(struct var *r, int *bSuccess)
 {
 	long long n;
 	if(r->datatype == 'S') {
 		n = es_str2num(r->d.estr, bSuccess);
 	} else {
-		n = r->d.n;
-		if(bSuccess)
+		if(r->datatype == 'J') {
+			n = (r->d.json == NULL) ? 0 : json_object_get_int(r->d.json);
+		} else {
+			n = r->d.n;
+		}
+		if(bSuccess != NULL)
 			*bSuccess = 1;
 	}
 	return n;
 }
 
-/* ensure that retval is a string; if string is no number,
- * emit error message and set number to 0.
+/* ensure that retval is a string
  */
 static inline es_str_t *
 var2String(struct var *r, int *bMustFree)
 {
+	es_str_t *estr;
+	char *cstr;
+	rs_size_t lenstr;
 	if(r->datatype == 'N') {
 		*bMustFree = 1;
-		return es_newStrFromNumber(r->d.n);
+		estr = es_newStrFromNumber(r->d.n);
+	} else if(r->datatype == 'J') {
+		*bMustFree = 1;
+		if(r->d.json == NULL) {
+			cstr = "",
+			lenstr = 0;
+		} else {
+			cstr = (char*)json_object_get_string(r->d.json);
+			lenstr = strlen(cstr);
+		}
+		estr = es_newStrFromCStr(cstr, lenstr);
+	} else {
+		*bMustFree = 0;
+		estr = r->d.estr;
+	}
+	return estr;
+}
+
+static uchar*
+var2CString(struct var *r, int *bMustFree)
+{
+	uchar *cstr;
+	es_str_t *estr;
+	estr = var2String(r, bMustFree);
+	cstr = (uchar*) es_str2cstr(estr, NULL);
+	if(*bMustFree)
+		es_deleteStr(estr);
+	*bMustFree = 1;
+	return cstr;
+}
+
+rsRetVal
+doExtractField(uchar *str, uchar delim, int matchnbr, uchar **resstr)
+{
+	int iCurrFld;
+	int iLen;
+	uchar *pBuf;
+	uchar *pFld;
+	uchar *pFldEnd;
+	DEFiRet;
+
+	/* first, skip to the field in question */
+	iCurrFld = 1;
+	pFld = str;
+	while(*pFld && iCurrFld < matchnbr) {
+		/* skip fields until the requested field or end of string is found */
+		while(*pFld && (uchar) *pFld != delim)
+			++pFld; /* skip to field terminator */
+		if(*pFld == delim) {
+			++pFld; /* eat it */
+			++iCurrFld;
+		}
+	}
+	dbgprintf("field() field requested %d, field found %d\n", matchnbr, iCurrFld);
+	
+	if(iCurrFld == matchnbr) {
+		/* field found, now extract it */
+		/* first of all, we need to find the end */
+		pFldEnd = pFld;
+		while(*pFldEnd && *pFldEnd != delim)
+			++pFldEnd;
+		--pFldEnd; /* we are already at the delimiter - so we need to
+			    * step back a little not to copy it as part of the field. */
+		/* we got our end pointer, now do the copy */
+		iLen = pFldEnd - pFld + 1; /* the +1 is for an actual char, NOT \0! */
+		CHKmalloc(pBuf = MALLOC((iLen + 1) * sizeof(char)));
+		/* now copy */
+		memcpy(pBuf, pFld, iLen);
+		pBuf[iLen] = '\0'; /* terminate it */
+		if(*(pFldEnd+1) != '\0')
+			++pFldEnd; /* OK, skip again over delimiter char */
+		*resstr = pBuf;
+	} else {
+		ABORT_FINALIZE(RS_RET_FIELD_NOT_FOUND);
 	}
-	*bMustFree = 0;
-	return r->d.estr;
+finalize_it:
+	RETiRet;
 }
 
 /* Perform a function call. This has been moved out of cnfExprEval in order
@@ -774,7 +855,13 @@ doFuncCall(struct cnffunc *func, struct var *ret, void* usrptr)
 	int bMustFree;
 	es_str_t *estr;
 	char *str;
+	uchar *resStr;
+	int retval;
 	struct var r[CNFFUNC_MAX_ARGS];
+	int delim;
+	int matchnbr;
+	struct funcData_prifilt *pPrifilt;
+	rsRetVal localRet;
 
 	dbgprintf("rainerscript: executing function id %d\n", func->fID);
 	switch(func->fID) {
@@ -816,6 +903,7 @@ doFuncCall(struct cnffunc *func, struct var *ret, void* usrptr)
 		es_tolower(estr);
 		ret->datatype = 'S';
 		ret->d.estr = estr;
+		if(r[0].datatype == 'S') es_deleteStr(r[0].d.estr);
 		break;
 	case CNFFUNC_CSTR:
 		cnfexprEval(func->expr[0], &r[0], usrptr);
@@ -824,6 +912,7 @@ doFuncCall(struct cnffunc *func, struct var *ret, void* usrptr)
 			estr = es_strdup(estr);
 		ret->datatype = 'S';
 		ret->d.estr = estr;
+		if(r[0].datatype == 'S') es_deleteStr(r[0].d.estr);
 		break;
 	case CNFFUNC_CNUM:
 		if(func->expr[0]->nodetype == 'N') {
@@ -838,6 +927,57 @@ doFuncCall(struct cnffunc *func, struct var *ret, void* usrptr)
 		}
 		ret->datatype = 'N';
 		break;
+	case CNFFUNC_RE_MATCH:
+		cnfexprEval(func->expr[0], &r[0], usrptr);
+		str = (char*) var2CString(&r[0], &bMustFree);
+		retval = regexp.regexec(func->funcdata, str, 0, NULL, 0);
+		if(retval == 0)
+			ret->d.n = 1;
+		else {
+			ret->d.n = 0;
+			if(retval != REG_NOMATCH) {
+				DBGPRINTF("re_match: regexec returned error %d\n", retval);
+			}
+		}
+		ret->datatype = 'N';
+		if(bMustFree) free(str);
+		free(str);
+		if(r[0].datatype == 'S') es_deleteStr(r[0].d.estr);
+		break;
+	case CNFFUNC_FIELD:
+		cnfexprEval(func->expr[0], &r[0], usrptr);
+		cnfexprEval(func->expr[1], &r[1], usrptr);
+		cnfexprEval(func->expr[2], &r[2], usrptr);
+		str = (char*) var2CString(&r[0], &bMustFree);
+		delim = var2Number(&r[1], NULL);
+		matchnbr = var2Number(&r[2], NULL);
+		localRet = doExtractField((uchar*)str, (char) delim, matchnbr, &resStr);
+		if(localRet == RS_RET_OK) {
+			ret->d.estr = es_newStrFromCStr((char*)resStr, strlen((char*)resStr));
+			free(resStr);
+		} else if(localRet == RS_RET_OK) {
+			ret->d.estr = es_newStrFromCStr("***FIELD NOT FOUND***",
+					sizeof("***FIELD NOT FOUND***")-1);
+		} else {
+			ret->d.estr = es_newStrFromCStr("***ERROR in field() FUNCTION***",
+					sizeof("***ERROR in field() FUNCTION***")-1);
+		}
+		ret->datatype = 'S';
+		if(bMustFree) free(str);
+		if(r[0].datatype == 'S') es_deleteStr(r[0].d.estr);
+		if(r[1].datatype == 'S') es_deleteStr(r[1].d.estr);
+		if(r[2].datatype == 'S') es_deleteStr(r[2].d.estr);
+		break;
+	case CNFFUNC_PRIFILT:
+		pPrifilt = (struct funcData_prifilt*) func->funcdata;
+		if( (pPrifilt->pmask[((msg_t*)usrptr)->iFacility] == TABLE_NOPRI) ||
+		   ((pPrifilt->pmask[((msg_t*)usrptr)->iFacility]
+			    & (1<<((msg_t*)usrptr)->iSeverity)) == 0) )
+			ret->d.n = 0;
+		else
+			ret->d.n = 1;
+		ret->datatype = 'N';
+		break;
 	default:
 		if(Debug) {
 			fname = es_str2cstr(func->fname, NULL);
@@ -850,6 +990,27 @@ doFuncCall(struct cnffunc *func, struct var *ret, void* usrptr)
 	}
 }
 
+static inline void
+evalVar(struct cnfvar *var, void *usrptr, struct var *ret)
+{
+	rsRetVal localRet;
+	es_str_t *estr;
+	struct json_object *json;
+
+	if(var->name[0] == '$' && var->name[1] == '!') {
+		/* TODO: unify string libs */
+		estr = es_newStrFromBuf(var->name+1, strlen(var->name)-1);
+		localRet = msgGetCEEPropJSON((msg_t*)usrptr, estr, &json);
+		es_deleteStr(estr);
+		ret->datatype = 'J';
+		ret->d.json = (localRet == RS_RET_OK) ? json : NULL;
+	} else {
+		ret->datatype = 'S';
+		ret->d.estr = cnfGetVar(var->name, usrptr);
+	}
+
+}
+
 #define FREE_BOTH_RET \
 		if(r.datatype == 'S') es_deleteStr(r.d.estr); \
 		if(l.datatype == 'S') es_deleteStr(l.d.estr)
@@ -891,7 +1052,7 @@ cnfexprEval(struct cnfexpr *expr, struct var *ret, void* usrptr)
 	int bMustFree, bMustFree2;
 	long long n_r, n_l;
 
-	//dbgprintf("eval expr %p, type '%c'(%u)\n", expr, expr->nodetype, expr->nodetype);
+	dbgprintf("eval expr %p, type '%c'(%u)\n", expr, expr->nodetype, expr->nodetype);
 	switch(expr->nodetype) {
 	/* note: comparison operations are extremely similar. The code can be copyied, only
 	 * places flagged with "CMP" need to be changed.
@@ -1163,8 +1324,15 @@ cnfexprEval(struct cnfexpr *expr, struct var *ret, void* usrptr)
 		ret->d.estr = es_strdup(((struct cnfstringval*)expr)->estr);
 		break;
 	case 'V':
+		evalVar((struct cnfvar*)expr, usrptr, ret);
+		break;
+	case '&':
+		/* TODO: think about optimization, should be possible ;) */
+		PREP_TWO_STRINGS;
 		ret->datatype = 'S';
-		ret->d.estr = cnfGetVar(((struct cnfvar*)expr)->name, usrptr);
+		ret->d.estr = es_strdup(estr_l);
+		es_addStr(&ret->d.estr, estr_r);
+		FREE_TWO_STRINGS;
 		break;
 	case '+':
 		COMP_NUM_BINOP(+);
@@ -1199,6 +1367,80 @@ cnfexprEval(struct cnfexpr *expr, struct var *ret, void* usrptr)
 	}
 }
 
+//---------------------------------------------------------
+
+static inline void
+cnffuncDestruct(struct cnffunc *func)
+{
+	unsigned short i;
+
+	for(i = 0 ; i < func->nParams ; ++i) {
+		cnfexprDestruct(func->expr[i]);
+	}
+	/* some functions require special destruction */
+	switch(func->fID) {
+		case CNFFUNC_RE_MATCH:
+			if(func->funcdata != NULL)
+				regexp.regfree(func->funcdata);
+			break;
+		default:break;
+	}
+	free(func->funcdata);
+	free(func->fname);
+}
+
+/* Destruct an expression and all sub-expressions contained in it.
+ */
+void
+cnfexprDestruct(struct cnfexpr *expr)
+{
+
+	dbgprintf("cnfexprDestruct expr %p, type '%c'(%u)\n", expr, expr->nodetype, expr->nodetype);
+	switch(expr->nodetype) {
+	case CMP_NE:
+	case CMP_EQ:
+	case CMP_LE:
+	case CMP_GE:
+	case CMP_LT:
+	case CMP_GT:
+	case CMP_STARTSWITH:
+	case CMP_STARTSWITHI:
+	case CMP_CONTAINS:
+	case CMP_CONTAINSI:
+	case OR:
+	case AND:
+	case '&':
+	case '+':
+	case '-':
+	case '*':
+	case '/':
+	case '%': /* binary */
+		cnfexprDestruct(expr->l);
+		cnfexprDestruct(expr->r);
+		break;
+	case NOT: 
+	case 'M': /* unary */
+		cnfexprDestruct(expr->r);
+		break;
+	case 'N':
+		break;
+	case 'S':
+		es_deleteStr(((struct cnfstringval*)expr)->estr);
+		break;
+	case 'V':
+		free(((struct cnfvar*)expr)->name);
+		break;
+	case 'F':
+		cnffuncDestruct((struct cnffunc*)expr);
+		break;
+	default:break;
+	}
+	free(expr);
+}
+
+//---- END
+
+
 /* Evaluate an expression as a bool. This is added because expressions are
  * mostly used inside filters, and so this function is quite common and
  * important.
@@ -1219,6 +1461,22 @@ doIndent(int indent)
 	for(i = 0 ; i < indent ; ++i)
 		dbgprintf("  ");
 }
+
+static void
+pmaskPrint(uchar *pmask, int indent)
+{
+	int i;
+	doIndent(indent);
+	dbgprintf("pmask: ");
+	for (i = 0; i <= LOG_NFACILITIES; i++)
+		if (pmask[i] == TABLE_NOPRI)
+			dbgprintf(" X ");
+		else
+			dbgprintf("%2X ", pmask[i]);
+	dbgprintf("\n");
+}
+
+
 void
 cnfexprPrint(struct cnfexpr *expr, int indent)
 {
@@ -1322,10 +1580,16 @@ cnfexprPrint(struct cnfexpr *expr, int indent)
 		func = (struct cnffunc*) expr;
 		cstrPrint("function '", func->fname);
 		dbgprintf("' (id:%d, params:%hu)\n", func->fID, func->nParams);
+		if(func->fID == CNFFUNC_PRIFILT) {
+			struct funcData_prifilt *pD;
+			pD = (struct funcData_prifilt*) func->funcdata;
+			pmaskPrint(pD->pmask, indent+1);
+		}
 		for(i = 0 ; i < func->nParams ; ++i) {
 			cnfexprPrint(func->expr[i], indent+1);
 		}
 		break;
+	case '&':
 	case '+':
 	case '-':
 	case '*':
@@ -1339,11 +1603,88 @@ cnfexprPrint(struct cnfexpr *expr, int indent)
 		cnfexprPrint(expr->r, indent+1);
 		break;
 	default:
-		dbgprintf("error: unknown nodetype %u\n",
-			(unsigned) expr->nodetype);
+		dbgprintf("error: unknown nodetype %u['%c']\n",
+			(unsigned) expr->nodetype, (char) expr->nodetype);
 		break;
 	}
 }
+void
+cnfstmtPrint(struct cnfstmt *root, int indent)
+{
+	struct cnfstmt *stmt;
+	//dbgprintf("stmt %p, indent %d, type '%c'\n", expr, indent, expr->nodetype);
+	for(stmt = root ; stmt != NULL ; stmt = stmt->next) {
+		switch(stmt->nodetype) {
+		case S_NOP:
+			doIndent(indent); dbgprintf("NOP\n");
+			break;
+		case S_STOP:
+			doIndent(indent); dbgprintf("STOP\n");
+			break;
+		case S_ACT:
+			doIndent(indent); dbgprintf("ACTION %p (%s)\n", stmt->d.act, stmt->printable);
+			break;
+		case S_IF:
+			doIndent(indent); dbgprintf("IF\n");
+			cnfexprPrint(stmt->d.s_if.expr, indent+1);
+			doIndent(indent); dbgprintf("THEN\n");
+			cnfstmtPrint(stmt->d.s_if.t_then, indent+1);
+			if(stmt->d.s_if.t_else != NULL) {
+				doIndent(indent); dbgprintf("ELSE\n");
+				cnfstmtPrint(stmt->d.s_if.t_else, indent+1);
+			}
+			doIndent(indent); dbgprintf("END IF\n");
+			break;
+		case S_SET:
+			doIndent(indent); dbgprintf("SET %s =\n",
+				          stmt->d.s_set.varname);
+			cnfexprPrint(stmt->d.s_set.expr, indent+1);
+			doIndent(indent); dbgprintf("END SET\n");
+			break;
+		case S_UNSET:
+			doIndent(indent); dbgprintf("UNSET %s\n",
+				          stmt->d.s_unset.varname);
+			break;
+		case S_PRIFILT:
+			doIndent(indent); dbgprintf("PRIFILT '%s'\n", stmt->printable);
+			pmaskPrint(stmt->d.s_prifilt.pmask, indent);
+			cnfstmtPrint(stmt->d.s_prifilt.t_then, indent+1);
+			if(stmt->d.s_prifilt.t_else != NULL) {
+				doIndent(indent); dbgprintf("ELSE\n");
+				cnfstmtPrint(stmt->d.s_prifilt.t_else, indent+1);
+			}
+			doIndent(indent); dbgprintf("END PRIFILT\n");
+			break;
+		case S_PROPFILT:
+			doIndent(indent); dbgprintf("PROPFILT\n");
+			doIndent(indent); dbgprintf("\tProperty.: '%s'\n",
+				propIDToName(stmt->d.s_propfilt.propID));
+			if(stmt->d.s_propfilt.propName != NULL) {
+				char *cstr;
+				cstr = es_str2cstr(stmt->d.s_propfilt.propName, NULL);
+				doIndent(indent);
+				dbgprintf("\tCEE-Prop.: '%s'\n", cstr);
+				free(cstr);
+			}
+			doIndent(indent); dbgprintf("\tOperation: ");
+			if(stmt->d.s_propfilt.isNegated)
+				dbgprintf("NOT ");
+			dbgprintf("'%s'\n", getFIOPName(stmt->d.s_propfilt.operation));
+			if(stmt->d.s_propfilt.pCSCompValue != NULL) {
+				doIndent(indent); dbgprintf("\tValue....: '%s'\n",
+				       rsCStrGetSzStrNoNULL(stmt->d.s_propfilt.pCSCompValue));
+			}
+			doIndent(indent); dbgprintf("THEN\n");
+			cnfstmtPrint(stmt->d.s_propfilt.t_then, indent+1);
+			doIndent(indent); dbgprintf("END PROPFILT\n");
+			break;
+		default:
+			dbgprintf("error: unknown stmt type %u\n",
+				(unsigned) stmt->nodetype);
+			break;
+		}
+	}
+}
 
 struct cnfnumval*
 cnfnumvalNew(long long val)
@@ -1367,6 +1708,7 @@ cnfstringvalNew(es_str_t *estr)
 	return strval;
 }
 
+
 struct cnfvar*
 cnfvarNew(char *name)
 {
@@ -1378,63 +1720,407 @@ cnfvarNew(char *name)
 	return var;
 }
 
-struct cnfrule *
-cnfruleNew(enum cnfFiltType filttype, struct cnfactlst *actlst)
+struct cnfstmt *
+cnfstmtNew(unsigned s_type)
+{
+	struct cnfstmt* cnfstmt;
+	if((cnfstmt = malloc(sizeof(struct cnfstmt))) != NULL) {
+		cnfstmt->nodetype = s_type;
+		cnfstmt->printable = NULL;
+		cnfstmt->next = NULL;
+	}
+	return cnfstmt;
+}
+
+void
+cnfstmtDestruct(struct cnfstmt *root)
+{
+	struct cnfstmt *stmt, *todel;
+	for(stmt = root ; stmt != NULL ; ) {
+		switch(stmt->nodetype) {
+		case S_NOP:
+		case S_STOP:
+			break;
+		case S_ACT:
+			actionDestruct(stmt->d.act);
+			break;
+		case S_IF:
+			cnfexprDestruct(stmt->d.s_if.expr);
+			if(stmt->d.s_if.t_then != NULL) {
+				cnfstmtDestruct(stmt->d.s_if.t_then);
+			}
+			if(stmt->d.s_if.t_else != NULL) {
+				cnfstmtDestruct(stmt->d.s_if.t_else);
+			}
+			break;
+		case S_SET:
+			free(stmt->d.s_set.varname);
+			cnfexprDestruct(stmt->d.s_set.expr);
+			break;
+		case S_UNSET:
+			free(stmt->d.s_set.varname);
+			break;
+		case S_PRIFILT:
+			cnfstmtDestruct(stmt->d.s_prifilt.t_then);
+			cnfstmtDestruct(stmt->d.s_prifilt.t_else);
+			break;
+		case S_PROPFILT:
+			if(stmt->d.s_propfilt.propName != NULL)
+				es_deleteStr(stmt->d.s_propfilt.propName);
+			if(stmt->d.s_propfilt.regex_cache != NULL)
+				rsCStrRegexDestruct(&stmt->d.s_propfilt.regex_cache);
+			if(stmt->d.s_propfilt.pCSCompValue != NULL)
+				cstrDestruct(&stmt->d.s_propfilt.pCSCompValue);
+			cnfstmtDestruct(stmt->d.s_propfilt.t_then);
+			break;
+		default:
+			dbgprintf("error: unknown stmt type during destruct %u\n",
+				(unsigned) stmt->nodetype);
+			break;
+		}
+		free(stmt->printable);
+		todel = stmt;
+		stmt = stmt->next;
+		free(todel);
+	}
+}
+
+struct cnfstmt *
+cnfstmtNewSet(char *var, struct cnfexpr *expr)
+{
+	struct cnfstmt* cnfstmt;
+	if((cnfstmt = cnfstmtNew(S_SET)) != NULL) {
+		cnfstmt->d.s_set.varname = (uchar*) var;
+		cnfstmt->d.s_set.expr = expr;
+	}
+	return cnfstmt;
+}
+
+struct cnfstmt *
+cnfstmtNewUnset(char *var)
+{
+	struct cnfstmt* cnfstmt;
+	if((cnfstmt = cnfstmtNew(S_UNSET)) != NULL) {
+		cnfstmt->d.s_unset.varname = (uchar*) var;
+	}
+	return cnfstmt;
+}
+
+struct cnfstmt *
+cnfstmtNewPRIFILT(char *prifilt, struct cnfstmt *t_then)
+{
+	struct cnfstmt* cnfstmt;
+	if((cnfstmt = cnfstmtNew(S_PRIFILT)) != NULL) {
+		cnfstmt->printable = (uchar*)prifilt;
+		cnfstmt->d.s_prifilt.t_then = t_then;
+		cnfstmt->d.s_prifilt.t_else = NULL;
+		DecodePRIFilter((uchar*)prifilt, cnfstmt->d.s_prifilt.pmask);
+	}
+	return cnfstmt;
+}
+
+struct cnfstmt *
+cnfstmtNewPROPFILT(char *propfilt, struct cnfstmt *t_then)
+{
+	struct cnfstmt* cnfstmt;
+	rsRetVal lRet;
+	if((cnfstmt = cnfstmtNew(S_PROPFILT)) != NULL) {
+		cnfstmt->printable = (uchar*)propfilt;
+		cnfstmt->d.s_propfilt.t_then = t_then;
+		cnfstmt->d.s_propfilt.propName = NULL;
+		cnfstmt->d.s_propfilt.regex_cache = NULL;
+		cnfstmt->d.s_propfilt.pCSCompValue = NULL;
+		lRet = DecodePropFilter((uchar*)propfilt, cnfstmt);
+	}
+	return cnfstmt;
+}
+
+struct cnfstmt *
+cnfstmtNewAct(struct nvlst *lst)
+{
+	struct cnfstmt* cnfstmt;
+	if((cnfstmt = cnfstmtNew(S_ACT)) == NULL) 
+		goto done;
+	if(actionNewInst(lst, &cnfstmt->d.act) != RS_RET_OK) {
+	// TODO:RS_RET_WARN?
+		parser_errmsg("errors occured in file '%s' around line %d",
+			      cnfcurrfn, yylineno);
+		cnfstmt->nodetype = S_NOP; /* disable action! */
+		goto done;
+	}
+	cnfstmt->printable = (uchar*)strdup("action()");
+done:	return cnfstmt;
+}
+
+struct cnfstmt *
+cnfstmtNewLegaAct(char *actline)
+{
+	struct cnfstmt* cnfstmt;
+	rsRetVal localRet;
+	if((cnfstmt = cnfstmtNew(S_ACT)) == NULL) 
+		goto done;
+	cnfstmt->printable = (uchar*)strdup((char*)actline);
+	localRet = cflineDoAction(loadConf, (uchar**)&actline, &cnfstmt->d.act);
+	if(localRet != RS_RET_OK && localRet != RS_RET_OK_WARN) {
+		parser_errmsg("%s occured in file '%s' around line %d",
+			      (localRet == RS_RET_OK_WARN) ? "warnings" : "errors",
+			      cnfcurrfn, yylineno);
+		if(localRet != RS_RET_OK_WARN) {
+			cnfstmt->nodetype = S_NOP; /* disable action! */
+			goto done;
+		}
+	}
+done:	return cnfstmt;
+}
+
+
+/* returns 1 if the two expressions are constants, 0 otherwise
+ * if both are constants, the expression subtrees are destructed
+ * (this is an aid for constant folding optimizing) 
+ */
+static int
+getConstNumber(struct cnfexpr *expr, long long *l, long long *r)
+{
+	int ret = 0;
+	cnfexprOptimize(expr->l);
+	cnfexprOptimize(expr->r);
+	if(expr->l->nodetype == 'N') {
+		if(expr->r->nodetype == 'N') {
+			ret = 1;
+			*l = ((struct cnfnumval*)expr->l)->val;
+			*r = ((struct cnfnumval*)expr->r)->val;
+			cnfexprDestruct(expr->l);
+			cnfexprDestruct(expr->r);
+		} else if(expr->r->nodetype == 'S') {
+			ret = 1;
+			*l = ((struct cnfnumval*)expr->l)->val;
+			*r = es_str2num(((struct cnfstringval*)expr->r)->estr, NULL);
+			cnfexprDestruct(expr->l);
+			cnfexprDestruct(expr->r);
+		}
+	} else if(expr->l->nodetype == 'S') {
+		if(expr->r->nodetype == 'N') {
+			ret = 1;
+			*l = es_str2num(((struct cnfstringval*)expr->l)->estr, NULL);
+			*r = ((struct cnfnumval*)expr->r)->val;
+			cnfexprDestruct(expr->l);
+			cnfexprDestruct(expr->r);
+		} else if(expr->r->nodetype == 'S') {
+			ret = 1;
+			*l = es_str2num(((struct cnfstringval*)expr->l)->estr, NULL);
+			*r = es_str2num(((struct cnfstringval*)expr->r)->estr, NULL);
+			cnfexprDestruct(expr->l);
+			cnfexprDestruct(expr->r);
+		}
+	}
+	return ret;
+}
+
+
+/* constant folding for string concatenation */
+static inline void
+constFoldConcat(struct cnfexpr *expr)
 {
-	struct cnfrule* cnfrule;
-	if((cnfrule = malloc(sizeof(struct cnfrule))) != NULL) {
-		cnfrule->nodetype = 'R';
-		cnfrule->filttype = filttype;
-		cnfrule->actlst = cnfactlstReverse(actlst);
+	es_str_t *estr;
+	cnfexprOptimize(expr->l);
+	cnfexprOptimize(expr->r);
+	if(expr->l->nodetype == 'S') {
+		if(expr->r->nodetype == 'S') {
+			estr = ((struct cnfstringval*)expr->l)->estr;
+			((struct cnfstringval*)expr->l)->estr = NULL;
+			es_addStr(&estr, ((struct cnfstringval*)expr->r)->estr);
+			cnfexprDestruct(expr->l);
+			cnfexprDestruct(expr->r);
+			expr->nodetype = 'S';
+			((struct cnfstringval*)expr)->estr = estr;
+		} else if(expr->r->nodetype == 'N') {
+			es_str_t *numstr;
+			estr = ((struct cnfstringval*)expr->l)->estr;
+			((struct cnfstringval*)expr->l)->estr = NULL;
+			numstr = es_newStrFromNumber(((struct cnfnumval*)expr->r)->val);
+			es_addStr(&estr, numstr);
+			es_deleteStr(numstr);
+			cnfexprDestruct(expr->l);
+			cnfexprDestruct(expr->r);
+			expr->nodetype = 'S';
+			((struct cnfstringval*)expr)->estr = estr;
+		}
+	} else if(expr->l->nodetype == 'N') {
+		if(expr->r->nodetype == 'S') {
+			estr = es_newStrFromNumber(((struct cnfnumval*)expr->l)->val);
+			es_addStr(&estr, ((struct cnfstringval*)expr->r)->estr);
+			cnfexprDestruct(expr->l);
+			cnfexprDestruct(expr->r);
+			expr->nodetype = 'S';
+			((struct cnfstringval*)expr)->estr = estr;
+		} else if(expr->r->nodetype == 'S') {
+			es_str_t *numstr;
+			estr = es_newStrFromNumber(((struct cnfnumval*)expr->l)->val);
+			numstr = es_newStrFromNumber(((struct cnfnumval*)expr->r)->val);
+			es_addStr(&estr, numstr);
+			es_deleteStr(numstr);
+			cnfexprDestruct(expr->l);
+			cnfexprDestruct(expr->r);
+			expr->nodetype = 'S';
+			((struct cnfstringval*)expr)->estr = estr;
+		}
 	}
-	return cnfrule;
 }
 
+
+/* (recursively) optimize an expression */
 void
-cnfrulePrint(struct cnfrule *rule)
+cnfexprOptimize(struct cnfexpr *expr)
 {
-	dbgprintf("------ start rule %p:\n", rule);
-	dbgprintf("%s: ", cnfFiltType2str(rule->filttype));
-	switch(rule->filttype) {
-	case CNFFILT_NONE:
+	long long ln, rn;
+
+	dbgprintf("optimize expr %p, type '%c'(%u)\n", expr, expr->nodetype, expr->nodetype);
+	switch(expr->nodetype) {
+	case '&':
+		constFoldConcat(expr);
 		break;
-	case CNFFILT_PRI:
-	case CNFFILT_PROP:
-		dbgprintf("%s\n", rule->filt.s);
+	case '+':
+		if(getConstNumber(expr, &ln, &rn))  {
+			expr->nodetype = 'N';
+			((struct cnfnumval*)expr)->val = ln + rn;
+		}
 		break;
-	case CNFFILT_SCRIPT:
-		dbgprintf("\n");
-		cnfexprPrint(rule->filt.expr, 0);
+	case '-':
+		if(getConstNumber(expr, &ln, &rn))  {
+			expr->nodetype = 'N';
+			((struct cnfnumval*)expr)->val = ln - rn;
+		}
+		break;
+	case '*':
+		if(getConstNumber(expr, &ln, &rn))  {
+			expr->nodetype = 'N';
+			((struct cnfnumval*)expr)->val = ln * rn;
+		}
+		break;
+	case '/':
+		if(getConstNumber(expr, &ln, &rn))  {
+			expr->nodetype = 'N';
+			((struct cnfnumval*)expr)->val = ln / rn;
+		}
+		break;
+	case '%':
+		if(getConstNumber(expr, &ln, &rn))  {
+			expr->nodetype = 'N';
+			((struct cnfnumval*)expr)->val = ln % rn;
+		}
+		break;
+	default:/* nodetype we cannot optimize */
 		break;
 	}
-	cnfactlstPrint(rule->actlst);
-	dbgprintf("------ end rule %p\n", rule);
+
 }
 
-/* note: the sysline itself was already freed during processing
- * and as such MUST NOT be freed again!
+/* removes NOPs from a statement list and returns the
+ * first non-NOP entry.
  */
-void
-cnfcfsyslinelstDestruct(struct cnfcfsyslinelst *cfslst)
+static inline struct cnfstmt *
+removeNOPs(struct cnfstmt *root)
 {
-	struct cnfcfsyslinelst *toDel;
-	while(cfslst != NULL) {
-		toDel = cfslst;
-		cfslst = cfslst->next;
-		free(toDel);
+	struct cnfstmt *stmt, *toDel, *prevstmt = NULL;
+	struct cnfstmt *newRoot = NULL;
+	
+	if(root == NULL) goto done;
+	stmt = root;
+	while(stmt != NULL) {
+		if(stmt->nodetype == S_NOP) {
+			if(prevstmt != NULL)
+				/* end chain, is rebuild if more non-NOPs follow */
+				prevstmt->next = NULL;
+			toDel = stmt;
+			stmt = stmt->next;
+			cnfstmtDestruct(toDel);
+		} else {
+			if(newRoot == NULL)
+				newRoot = stmt;
+			if(prevstmt != NULL)
+				prevstmt->next = stmt;
+			prevstmt = stmt;
+			stmt = stmt->next;
+		}
 	}
+done:	return newRoot;
 }
 
+
+static inline void
+cnfstmtOptimizeIf(struct cnfstmt *stmt)
+{
+	struct cnfstmt *t_then, *t_else;
+	struct cnfexpr *expr;
+	struct cnffunc *func;
+	struct funcData_prifilt *prifilt;
+
+	expr = stmt->d.s_if.expr;
+	cnfexprOptimize(expr);
+	stmt->d.s_if.t_then = removeNOPs(stmt->d.s_if.t_then);
+	stmt->d.s_if.t_else = removeNOPs(stmt->d.s_if.t_else);
+	cnfstmtOptimize(stmt->d.s_if.t_then);
+	cnfstmtOptimize(stmt->d.s_if.t_else);
+
+	if(stmt->d.s_if.expr->nodetype == 'F') {
+		func = (struct cnffunc*)expr;
+		   if(func->fID == CNFFUNC_PRIFILT) {
+			DBGPRINTF("optimize IF to PRIFILT\n");
+			t_then = stmt->d.s_if.t_then;
+			t_else = stmt->d.s_if.t_else;
+			stmt->nodetype = S_PRIFILT;
+			prifilt = (struct funcData_prifilt*) func->funcdata;
+			memcpy(stmt->d.s_prifilt.pmask, prifilt->pmask,
+				sizeof(prifilt->pmask));
+			stmt->d.s_prifilt.t_then = t_then;
+			stmt->d.s_prifilt.t_else = t_else;
+			stmt->printable = (uchar*)
+				es_str2cstr(((struct cnfstringval*)func->expr[0])->estr, NULL);
+			cnfexprDestruct(expr);
+		}
+	}
+}
+
+/* (recursively) optimize a statement */
 void
-cnfruleDestruct(struct cnfrule *rule)
+cnfstmtOptimize(struct cnfstmt *root)
 {
-	if(   rule->filttype == CNFFILT_PRI
-	   || rule->filttype == CNFFILT_PROP)
-		free(rule->filt.s);
-	cnfactlstDestruct(rule->actlst);
-	free(rule);
+	struct cnfstmt *stmt;
+	if(root == NULL) goto done;
+	for(stmt = root ; stmt != NULL ; stmt = stmt->next) {
+dbgprintf("RRRR: stmtOptimize: stmt %p, nodetype %u\n", stmt, stmt->nodetype);
+		switch(stmt->nodetype) {
+		case S_IF:
+			cnfstmtOptimizeIf(stmt);
+			break;
+		case S_PRIFILT:
+			stmt->d.s_prifilt.t_then = removeNOPs(stmt->d.s_prifilt.t_then);
+			cnfstmtOptimize(stmt->d.s_prifilt.t_then);
+			break;
+		case S_PROPFILT:
+			stmt->d.s_propfilt.t_then = removeNOPs(stmt->d.s_propfilt.t_then);
+			cnfstmtOptimize(stmt->d.s_propfilt.t_then);
+			break;
+		case S_SET:
+			cnfexprOptimize(stmt->d.s_set.expr);
+			break;
+		case S_STOP:
+		case S_UNSET:
+		case S_ACT: /* nothing to do */
+			break;
+		case S_NOP:
+			DBGPRINTF("optimizer error: we see a NOP, how come?\n");
+			break;
+		default:
+			dbgprintf("error: unknown stmt type %u during optimizer run\n",
+				(unsigned) stmt->nodetype);
+			break;
+		}
+	}
+done: /*EMPTY*/;
 }
 
+
 struct cnffparamlst *
 cnffparamlstNew(struct cnfexpr *expr, struct cnffparamlst *next)
 {
@@ -1488,11 +2174,90 @@ funcName2ID(es_str_t *fname, unsigned short nParams)
 			return CNFFUNC_INVALID;
 		}
 		return CNFFUNC_CNUM;
+	} else if(!es_strbufcmp(fname, (unsigned char*)"re_match", sizeof("re_match") - 1)) {
+		if(nParams != 2) {
+			parser_errmsg("number of parameters for re_match() must be two "
+				      "but is %d.", nParams);
+			return CNFFUNC_INVALID;
+		}
+		return CNFFUNC_RE_MATCH;
+	} else if(!es_strbufcmp(fname, (unsigned char*)"field", sizeof("field") - 1)) {
+		if(nParams != 3) {
+			parser_errmsg("number of parameters for field() must be three "
+				      "but is %d.", nParams);
+			return CNFFUNC_INVALID;
+		}
+		return CNFFUNC_FIELD;
+	} else if(!es_strbufcmp(fname, (unsigned char*)"prifilt", sizeof("prifilt") - 1)) {
+		if(nParams != 1) {
+			parser_errmsg("number of parameters for prifilt() must be one "
+				      "but is %d.", nParams);
+			return CNFFUNC_INVALID;
+		}
+		return CNFFUNC_PRIFILT;
 	} else {
 		return CNFFUNC_INVALID;
 	}
 }
 
+
+static inline rsRetVal
+initFunc_re_match(struct cnffunc *func)
+{
+	rsRetVal localRet;
+	char *regex = NULL;
+	regex_t *re;
+	DEFiRet;
+
+	func->funcdata = NULL;
+	if(func->expr[1]->nodetype != 'S') {
+		parser_errmsg("param 2 of re_match() must be a constant string");
+		FINALIZE;
+	}
+
+	CHKmalloc(re = malloc(sizeof(regex_t)));
+	func->funcdata = re;
+
+	regex = es_str2cstr(((struct cnfstringval*) func->expr[1])->estr, NULL);
+	
+	if((localRet = objUse(regexp, LM_REGEXP_FILENAME)) == RS_RET_OK) {
+		if(regexp.regcomp(re, (char*) regex, REG_EXTENDED) != 0) {
+			parser_errmsg("cannot compile regex '%s'", regex);
+			ABORT_FINALIZE(RS_RET_ERR);
+		}
+	} else { /* regexp object could not be loaded */
+		parser_errmsg("could not load regex support - regex ignored");
+		ABORT_FINALIZE(RS_RET_ERR);
+	}
+
+finalize_it:
+	free(regex);
+	RETiRet;
+}
+
+
+static inline rsRetVal
+initFunc_prifilt(struct cnffunc *func)
+{
+	struct funcData_prifilt *pData;
+	uchar *cstr;
+	DEFiRet;
+
+	func->funcdata = NULL;
+	if(func->expr[0]->nodetype != 'S') {
+		parser_errmsg("param 1 of prifilt() must be a constant string");
+		FINALIZE;
+	}
+
+	CHKmalloc(pData = calloc(1, sizeof(struct funcData_prifilt)));
+	func->funcdata = pData;
+	cstr = (uchar*)es_str2cstr(((struct cnfstringval*) func->expr[0])->estr, NULL);
+	CHKiRet(DecodePRIFilter(cstr, pData->pmask));
+	free(cstr);
+finalize_it:
+	RETiRet;
+}
+
 struct cnffunc *
 cnffuncNew(es_str_t *fname, struct cnffparamlst* paramlst)
 {
@@ -1510,6 +2275,7 @@ cnffuncNew(es_str_t *fname, struct cnffparamlst* paramlst)
 		func->nodetype = 'F';
 		func->fname = fname;
 		func->nParams = nParams;
+		func->funcdata = NULL;
 		func->fID = funcName2ID(fname, nParams);
 		/* shuffle params over to array (access speed!) */
 		param = paramlst;
@@ -1519,6 +2285,17 @@ cnffuncNew(es_str_t *fname, struct cnffparamlst* paramlst)
 			param = param->next;
 			free(toDel);
 		}
+		/* some functions require special initialization */
+		switch(func->fID) {
+			case CNFFUNC_RE_MATCH:
+				/* need to compile the regexp in param 2, so this MUST be a constant */
+				initFunc_re_match(func);
+				break;
+			case CNFFUNC_PRIFILT:
+				initFunc_prifilt(func);
+				break;
+			default:break;
+		}
 	}
 	return func;
 }
@@ -1617,6 +2394,24 @@ cstrPrint(char *text, es_str_t *estr)
 	free(str);
 }
 
+char *
+rmLeadingSpace(char *s)
+{
+	char *p;
+	for(p = s ; *p && isspace(*p) ; ++p)
+		;
+	return(p);
+}
+
+/* init must be called once before any parsing of the script files start */
+rsRetVal
+initRainerscript(void)
+{
+	DEFiRet;
+	CHKiRet(objGetObjInterface(&obj));
+finalize_it:
+	RETiRet;
+}
 
 /* we need a function to check for octal digits */
 static inline int