patterndb: Add support for nested quotted string in @QSTRING@

[smortex]

When using 2 chars to match quoted strings (e.g. (), [], {}`), we
want to detect nesting to capture the whole containing expression.

Matching (foo (bar (baz) qux)) quux against @QSTRING::()@ previously
captured (foo (bar (baz) and now capture (foo (bar (baz) qux)).

Fixes: #4716

Signed-off-by: Romain Tartière romain@blogreen.org

[kira-syslogng]

This user does not have permission to start the build. Can one of the admins verify this patch and start the build?
(admin: you have the next options (make sure you checked the code):
"ok to test" to accept this pull request (and further changes) for testing
"test this please" for a one time test run
"add to whitelist" add author of a Pull Request to whitelist (globally, be careful, it means this user can trigger kira for any PR)
do nothing -> CI won't start)

[kira-syslogng]

This user does not have permission to start the build. Can one of the admins verify this patch and start the build?
(admin: you have the next options (make sure you checked the code):
"ok to test" to accept this pull request (and further changes) for testing
"test this please" for a one time test run
"add to whitelist" add author of a Pull Request to whitelist (globally, be careful, it means this user can trigger kira for any PR)
do nothing -> CI won't start)

[alltilla]

@kira-syslogng test this please

[smortex]

/__w/syslog-ng/syslog-ng/modules/correlation/radix.c:783:18: error: unused variable ‘state’ [-Werror=unused-variable]

Ooops, fixed!

[bazsi]

while this works I'd try to retain the simplified case where you don't have separate starting/ending quotes.

strchr() is probably much faster than the loop implemented here.

e.g. I'd create two functions, one for the simple case, one for the nested case and decide which one to call in a wrapper that checks param[0] and param[1]

[bazsi]

I like this a lot, thanks for contributing it and I don't think that this needs a separate parser. Previously QSTRING did not support quote pairs, and you just added it as a new feature, which also happens to support nesting.

The syntax we implemented in db-parser() is not the best one, but this change retains conventions and is not breaking compatibility.

[smortex]

Previously QSTRING did not support quote pairs

I think it did, I use it 😁

I split the code in 2 distinct functions as suggested, makes it a bit more readable.

[bazsi]

Approved. Thanks a lot.

[bazsi]

Before merging, could you please add a NEWS file snippet? I am not sure if this can still get into 4.5.0 which is being prepared right now: #4719

[MrAnno]

Let's include this one in v4.5.0. We'll add the entry manually.