From 259190844b30cf78ea1efa2d2186256ad39a5286 Mon Sep 17 00:00:00 2001
From: Szilard Parrag <szilard.parrag@axoflow.com>
Date: Mon, 2 Sep 2024 11:22:18 +0200
Subject: [PATCH 01/12] lib/filterx: extract FilterXError

Signed-off-by: Szilard Parrag <szilard.parrag@axoflow.com>
---
 lib/filterx/CMakeLists.txt  |  2 ++
 lib/filterx/Makefile.am     |  2 ++
 lib/filterx/filterx-error.c | 33 +++++++++++++++++++++++++++++
 lib/filterx/filterx-error.h | 41 +++++++++++++++++++++++++++++++++++++
 lib/filterx/filterx-eval.c  |  9 --------
 lib/filterx/filterx-eval.h  |  9 +-------
 6 files changed, 79 insertions(+), 17 deletions(-)
 create mode 100644 lib/filterx/filterx-error.c
 create mode 100644 lib/filterx/filterx-error.h

diff --git a/lib/filterx/CMakeLists.txt b/lib/filterx/CMakeLists.txt
index 3db0f51b14..67d0be0d28 100644
--- a/lib/filterx/CMakeLists.txt
+++ b/lib/filterx/CMakeLists.txt
@@ -12,6 +12,7 @@ set(FILTERX_HEADERS
     filterx/expr-template.h
     filterx/filterx-config.h
     filterx/filterx-eval.h
+    filterx/filterx-error.h
     filterx/filterx-expr.h
     filterx/filterx-globals.h
     filterx/filterx-object.h
@@ -66,6 +67,7 @@ set(FILTERX_SOURCES
     filterx/expr-template.c
     filterx/filterx-config.c
     filterx/filterx-eval.c
+    filterx/filterx-error.c
     filterx/filterx-expr.c
     filterx/filterx-globals.c
     filterx/filterx-object.c
diff --git a/lib/filterx/Makefile.am b/lib/filterx/Makefile.am
index 7cd6b732e9..d716c9f60f 100644
--- a/lib/filterx/Makefile.am
+++ b/lib/filterx/Makefile.am
@@ -20,6 +20,7 @@ filterxinclude_HEADERS = 			\
 	lib/filterx/object-primitive.h		\
 	lib/filterx/filterx-scope.h		\
 	lib/filterx/filterx-eval.h		\
+	lib/filterx/filterx-error.h		\
 	lib/filterx/object-extractor.h		\
 	lib/filterx/object-json.h		\
 	lib/filterx/object-json-internal.h		\
@@ -73,6 +74,7 @@ filterx_sources = 				\
 	lib/filterx/object-primitive.c		\
 	lib/filterx/filterx-scope.c		\
 	lib/filterx/filterx-eval.c		\
+	lib/filterx/filterx-error.c		\
 	lib/filterx/object-extractor.c		\
 	lib/filterx/object-json.c		\
 	lib/filterx/object-json-object.c		\
diff --git a/lib/filterx/filterx-error.c b/lib/filterx/filterx-error.c
new file mode 100644
index 0000000000..11652329e4
--- /dev/null
+++ b/lib/filterx/filterx-error.c
@@ -0,0 +1,33 @@
+/*
+ * Copyright (c) 2023 Balazs Scheidler <balazs.scheidler@axoflow.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ * As an additional exemption you are allowed to compile & link against the
+ * OpenSSL libraries as published by the OpenSSL project. See the file
+ * COPYING for details.
+ *
+ */
+
+#include "filterx/filterx-error.h"
+
+void
+filterx_eval_clear_error(FilterXError *error)
+{
+  filterx_object_unref(error->object);
+  if (error->free_info)
+    g_free(error->info);
+  memset(error, 0, sizeof(*error));
+}
diff --git a/lib/filterx/filterx-error.h b/lib/filterx/filterx-error.h
new file mode 100644
index 0000000000..57a0a6cba6
--- /dev/null
+++ b/lib/filterx/filterx-error.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2023 Balazs Scheidler <balazs.scheidler@axoflow.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ * As an additional exemption you are allowed to compile & link against the
+ * OpenSSL libraries as published by the OpenSSL project. See the file
+ * COPYING for details.
+ *
+ */
+
+
+#ifndef FILTERX_ERROR_H_INCLUDED
+#define FILTERX_ERROR_H_INCLUDED
+
+#include "filterx/filterx-scope.h"
+#include "filterx/filterx-expr.h"
+#include "template/eval.h"
+
+typedef struct _FilterXError
+{
+  const gchar *message;
+  FilterXExpr *expr;
+  FilterXObject *object;
+  gchar *info;
+  gboolean free_info;
+} FilterXError;
+
+#endif
diff --git a/lib/filterx/filterx-eval.c b/lib/filterx/filterx-eval.c
index 0d7ecea330..9f7f095675 100644
--- a/lib/filterx/filterx-eval.c
+++ b/lib/filterx/filterx-eval.c
@@ -54,15 +54,6 @@ filterx_eval_set_context(FilterXEvalContext *context)
   eval_context = context;
 }
 
-static void
-filterx_eval_clear_error(FilterXError *error)
-{
-  filterx_object_unref(error->object);
-  if (error->free_info)
-    g_free(error->info);
-  memset(error, 0, sizeof(*error));
-}
-
 void
 filterx_eval_push_error(const gchar *message, FilterXExpr *expr, FilterXObject *object)
 {
diff --git a/lib/filterx/filterx-eval.h b/lib/filterx/filterx-eval.h
index e923c3777d..3af8556047 100644
--- a/lib/filterx/filterx-eval.h
+++ b/lib/filterx/filterx-eval.h
@@ -25,16 +25,9 @@
 
 #include "filterx/filterx-scope.h"
 #include "filterx/filterx-expr.h"
+#include "filterx/filterx-error.h"
 #include "template/eval.h"
 
-typedef struct _FilterXError
-{
-  const gchar *message;
-  FilterXExpr *expr;
-  FilterXObject *object;
-  gchar *info;
-  gboolean free_info;
-} FilterXError;
 
 typedef struct _FilterXEvalContext FilterXEvalContext;
 struct _FilterXEvalContext

From c6c02a67dc1b1b22f3362824fee5a5bdd908fde3 Mon Sep 17 00:00:00 2001
From: Szilard Parrag <szilard.parrag@axoflow.com>
Date: Mon, 2 Sep 2024 11:32:35 +0200
Subject: [PATCH 02/12] lib/filterx: rename FilterXError cleaning function

Signed-off-by: Szilard Parrag <szilard.parrag@axoflow.com>
---
 lib/filterx/filterx-error.c | 2 +-
 lib/filterx/filterx-error.h | 3 +++
 lib/filterx/filterx-eval.c  | 7 ++++---
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/lib/filterx/filterx-error.c b/lib/filterx/filterx-error.c
index 11652329e4..6f4a9b4356 100644
--- a/lib/filterx/filterx-error.c
+++ b/lib/filterx/filterx-error.c
@@ -24,7 +24,7 @@
 #include "filterx/filterx-error.h"
 
 void
-filterx_eval_clear_error(FilterXError *error)
+filterx_error_clear(FilterXError *error)
 {
   filterx_object_unref(error->object);
   if (error->free_info)
diff --git a/lib/filterx/filterx-error.h b/lib/filterx/filterx-error.h
index 57a0a6cba6..5856e585f5 100644
--- a/lib/filterx/filterx-error.h
+++ b/lib/filterx/filterx-error.h
@@ -38,4 +38,7 @@ typedef struct _FilterXError
   gboolean free_info;
 } FilterXError;
 
+void filterx_error_clear(FilterXError *error);
+
+
 #endif
diff --git a/lib/filterx/filterx-eval.c b/lib/filterx/filterx-eval.c
index 9f7f095675..07db68ed76 100644
--- a/lib/filterx/filterx-eval.c
+++ b/lib/filterx/filterx-eval.c
@@ -21,6 +21,7 @@
  *
  */
 #include "filterx/filterx-eval.h"
+#include "filterx/filterx-error.h"
 #include "filterx/filterx-expr.h"
 #include "logpipe.h"
 #include "scratch-buffers.h"
@@ -61,7 +62,7 @@ filterx_eval_push_error(const gchar *message, FilterXExpr *expr, FilterXObject *
 
   if (context)
     {
-      filterx_eval_clear_error(&context->error);
+      filterx_error_clear(&context->error);
       context->error.message = message;
       context->error.expr = expr;
       context->error.object = filterx_object_ref(object);
@@ -77,7 +78,7 @@ filterx_eval_push_error_info(const gchar *message, FilterXExpr *expr, gchar *inf
 
   if (context)
     {
-      filterx_eval_clear_error(&context->error);
+      filterx_error_clear(&context->error);
       context->error.message = message;
       context->error.expr = expr;
       context->error.object = NULL;
@@ -96,7 +97,7 @@ filterx_eval_clear_errors(void)
 {
   FilterXEvalContext *context = filterx_eval_get_context();
 
-  filterx_eval_clear_error(&context->error);
+  filterx_error_clear(&context->error);
 }
 
 const gchar *

From 40805288f20de45fa72fefc49763577b8fe074e3 Mon Sep 17 00:00:00 2001
From: Szilard Parrag <szilard.parrag@axoflow.com>
Date: Mon, 2 Sep 2024 11:43:26 +0200
Subject: [PATCH 03/12] lib/filterx: extract FilterXError formatting

Signed-off-by: Szilard Parrag <szilard.parrag@axoflow.com>
---
 lib/filterx/filterx-error.c | 33 +++++++++++++++++++++++++++++++++
 lib/filterx/filterx-error.h |  1 +
 lib/filterx/filterx-eval.c  | 27 +--------------------------
 3 files changed, 35 insertions(+), 26 deletions(-)

diff --git a/lib/filterx/filterx-error.c b/lib/filterx/filterx-error.c
index 6f4a9b4356..ffcacc41f6 100644
--- a/lib/filterx/filterx-error.c
+++ b/lib/filterx/filterx-error.c
@@ -22,6 +22,7 @@
  */
 
 #include "filterx/filterx-error.h"
+#include "scratch-buffers.h"
 
 void
 filterx_error_clear(FilterXError *error)
@@ -31,3 +32,35 @@ filterx_error_clear(FilterXError *error)
     g_free(error->info);
   memset(error, 0, sizeof(*error));
 }
+
+EVTTAG *
+filterx_error_format(FilterXError *error)
+{
+
+  if (!error->message)
+    return evt_tag_str("error", "Error information unset");
+
+  const gchar *extra_info = NULL;
+
+  if (error->info)
+    {
+      extra_info = error->info;
+    }
+  else if (error->object)
+    {
+      GString *buf = scratch_buffers_alloc();
+
+      if (!filterx_object_repr(error->object, buf))
+        {
+          LogMessageValueType t;
+          if (!filterx_object_marshal(error->object, buf, &t))
+            g_assert_not_reached();
+        }
+      extra_info = buf->str;
+    }
+
+  return evt_tag_printf("error", "%s%s%s",
+                        error->message,
+                        extra_info ? ": " : "",
+                        extra_info ? : "");
+}
diff --git a/lib/filterx/filterx-error.h b/lib/filterx/filterx-error.h
index 5856e585f5..1fe9a3b04b 100644
--- a/lib/filterx/filterx-error.h
+++ b/lib/filterx/filterx-error.h
@@ -39,6 +39,7 @@ typedef struct _FilterXError
 } FilterXError;
 
 void filterx_error_clear(FilterXError *error);
+EVTTAG *filterx_error_format(FilterXError *error);
 
 
 #endif
diff --git a/lib/filterx/filterx-eval.c b/lib/filterx/filterx-eval.c
index 07db68ed76..f7ae2ba8ed 100644
--- a/lib/filterx/filterx-eval.c
+++ b/lib/filterx/filterx-eval.c
@@ -113,32 +113,7 @@ filterx_format_last_error(void)
 {
   FilterXEvalContext *context = filterx_eval_get_context();
 
-  if (!context->error.message)
-    return evt_tag_str("error", "Error information unset");
-
-  const gchar *extra_info = NULL;
-
-  if (context->error.info)
-    {
-      extra_info = context->error.info;
-    }
-  else if (context->error.object)
-    {
-      GString *buf = scratch_buffers_alloc();
-
-      if (!filterx_object_repr(context->error.object, buf))
-        {
-          LogMessageValueType t;
-          if (!filterx_object_marshal(context->error.object, buf, &t))
-            g_assert_not_reached();
-        }
-      extra_info = buf->str;
-    }
-
-  return evt_tag_printf("error", "%s%s%s",
-                        context->error.message,
-                        extra_info ? ": " : "",
-                        extra_info ? : "");
+  return filterx_error_format(&context->error);
 }
 
 EVTTAG *

From 2d9be940a95132b31ff1dd2ed9dc01bcad37f683 Mon Sep 17 00:00:00 2001
From: Szilard Parrag <szilard.parrag@axoflow.com>
Date: Thu, 5 Sep 2024 16:11:07 +0200
Subject: [PATCH 04/12] lib/filterx: extract FilterXError location formatting

Signed-off-by: Szilard Parrag <szilard.parrag@axoflow.com>
---
 lib/filterx/filterx-error.c | 6 ++++++
 lib/filterx/filterx-error.h | 1 +
 lib/filterx/filterx-eval.c  | 2 +-
 3 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/lib/filterx/filterx-error.c b/lib/filterx/filterx-error.c
index ffcacc41f6..9d3f5e8302 100644
--- a/lib/filterx/filterx-error.c
+++ b/lib/filterx/filterx-error.c
@@ -64,3 +64,9 @@ filterx_error_format(FilterXError *error)
                         extra_info ? ": " : "",
                         extra_info ? : "");
 }
+
+EVTTAG *
+filterx_error_format_location(FilterXError *error)
+{
+  return filterx_expr_format_location_tag(error->expr);
+}
diff --git a/lib/filterx/filterx-error.h b/lib/filterx/filterx-error.h
index 1fe9a3b04b..f8050f8d80 100644
--- a/lib/filterx/filterx-error.h
+++ b/lib/filterx/filterx-error.h
@@ -40,6 +40,7 @@ typedef struct _FilterXError
 
 void filterx_error_clear(FilterXError *error);
 EVTTAG *filterx_error_format(FilterXError *error);
+EVTTAG *filterx_error_format_location(FilterXError *error);
 
 
 #endif
diff --git a/lib/filterx/filterx-eval.c b/lib/filterx/filterx-eval.c
index f7ae2ba8ed..6fb44226e0 100644
--- a/lib/filterx/filterx-eval.c
+++ b/lib/filterx/filterx-eval.c
@@ -121,7 +121,7 @@ filterx_format_last_error_location(void)
 {
   FilterXEvalContext *context = filterx_eval_get_context();
 
-  return filterx_expr_format_location_tag(context->error.expr);
+  return filterx_error_format_location(&context->error);
 }
 
 

From 7ae16e51fbc1876a53196264eccf00ae9b4909d2 Mon Sep 17 00:00:00 2001
From: Szilard Parrag <szilard.parrag@axoflow.com>
Date: Wed, 4 Sep 2024 15:57:42 +0200
Subject: [PATCH 05/12] lib/filterx: extract FilterXError values setting into
 function

Signed-off-by: Szilard Parrag <szilard.parrag@axoflow.com>
---
 lib/filterx/filterx-error.c | 15 +++++++++++++++
 lib/filterx/filterx-error.h |  2 ++
 lib/filterx/filterx-eval.c  | 12 +++---------
 3 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/lib/filterx/filterx-error.c b/lib/filterx/filterx-error.c
index 9d3f5e8302..0d52f57e2b 100644
--- a/lib/filterx/filterx-error.c
+++ b/lib/filterx/filterx-error.c
@@ -70,3 +70,18 @@ filterx_error_format_location(FilterXError *error)
 {
   return filterx_expr_format_location_tag(error->expr);
 }
+
+void
+filterx_error_set_values(FilterXError *error, const gchar *message, FilterXExpr *expr, FilterXObject *object)
+{
+  error->message = message;
+  error->expr = expr;
+  error->object = filterx_object_ref(object);
+}
+
+void
+filterx_error_set_info(FilterXError *error, gchar *info, gboolean free_info)
+{
+  error->info = info;
+  error->free_info = free_info;
+}
diff --git a/lib/filterx/filterx-error.h b/lib/filterx/filterx-error.h
index f8050f8d80..51ff708e8c 100644
--- a/lib/filterx/filterx-error.h
+++ b/lib/filterx/filterx-error.h
@@ -41,6 +41,8 @@ typedef struct _FilterXError
 void filterx_error_clear(FilterXError *error);
 EVTTAG *filterx_error_format(FilterXError *error);
 EVTTAG *filterx_error_format_location(FilterXError *error);
+void filterx_error_set_info(FilterXError *error, gchar *info, gboolean free_info);
+void filterx_error_set_values(FilterXError *error, const gchar *message, FilterXExpr *expr, FilterXObject *object);
 
 
 #endif
diff --git a/lib/filterx/filterx-eval.c b/lib/filterx/filterx-eval.c
index 6fb44226e0..796873dd1c 100644
--- a/lib/filterx/filterx-eval.c
+++ b/lib/filterx/filterx-eval.c
@@ -63,10 +63,7 @@ filterx_eval_push_error(const gchar *message, FilterXExpr *expr, FilterXObject *
   if (context)
     {
       filterx_error_clear(&context->error);
-      context->error.message = message;
-      context->error.expr = expr;
-      context->error.object = filterx_object_ref(object);
-      context->error.info = NULL;
+      filterx_error_set_values(&context->error, message, expr, object);
     }
 }
 
@@ -79,11 +76,8 @@ filterx_eval_push_error_info(const gchar *message, FilterXExpr *expr, gchar *inf
   if (context)
     {
       filterx_error_clear(&context->error);
-      context->error.message = message;
-      context->error.expr = expr;
-      context->error.object = NULL;
-      context->error.info = info;
-      context->error.free_info = free_info;
+      filterx_error_set_values(&context->error, message, expr, NULL);
+      filterx_error_set_info(&context->error, info, free_info);
     }
   else
     {

From 2b8e8df532ddfd6aedc72612a3563b50fdf0768e Mon Sep 17 00:00:00 2001
From: Szilard Parrag <szilard.parrag@axoflow.com>
Date: Mon, 2 Sep 2024 12:40:50 +0200
Subject: [PATCH 06/12] lib/filterx: introduce FilterXResult type

Signed-off-by: Szilard Parrag <szilard.parrag@axoflow.com>
---
 lib/filterx/filterx-eval.c | 9 ++++++---
 lib/filterx/filterx-eval.h | 8 +++++++-
 lib/filterx/filterx-pipe.c | 8 ++++----
 3 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/lib/filterx/filterx-eval.c b/lib/filterx/filterx-eval.c
index 796873dd1c..2afb3e00ac 100644
--- a/lib/filterx/filterx-eval.c
+++ b/lib/filterx/filterx-eval.c
@@ -149,12 +149,12 @@ filterx_eval_store_weak_ref(FilterXObject *object)
     }
 }
 
-gboolean
+FilterXEvalResult
 filterx_eval_exec(FilterXEvalContext *context, FilterXExpr *expr, LogMessage *msg)
 {
   context->msgs = &msg;
   context->num_msg = 1;
-  gboolean success = FALSE;
+  FilterXEvalResult success = FXE_FAILURE;
 
   FilterXObject *res = filterx_expr_eval(expr);
   if (!res)
@@ -165,7 +165,10 @@ filterx_eval_exec(FilterXEvalContext *context, FilterXExpr *expr, LogMessage *ms
       filterx_eval_clear_errors();
       goto fail;
     }
-  success = filterx_object_truthy(res);
+  if (filterx_object_truthy(res))
+    success = FXE_SUCCESS;
+  else
+    success = FXE_FAILURE;
   filterx_object_unref(res);
   /* NOTE: we only store the results into the message if the entire evaluation was successful */
 fail:
diff --git a/lib/filterx/filterx-eval.h b/lib/filterx/filterx-eval.h
index 3af8556047..ae134c9dec 100644
--- a/lib/filterx/filterx-eval.h
+++ b/lib/filterx/filterx-eval.h
@@ -29,6 +29,12 @@
 #include "template/eval.h"
 
 
+typedef enum _FilterXEvalResult
+{
+  FXE_SUCCESS,
+  FXE_FAILURE,
+} FilterXEvalResult;
+
 typedef struct _FilterXEvalContext FilterXEvalContext;
 struct _FilterXEvalContext
 {
@@ -46,7 +52,7 @@ FilterXScope *filterx_eval_get_scope(void);
 void filterx_eval_push_error(const gchar *message, FilterXExpr *expr, FilterXObject *object);
 void filterx_eval_push_error_info(const gchar *message, FilterXExpr *expr, gchar *info, gboolean free_info);
 void filterx_eval_set_context(FilterXEvalContext *context);
-gboolean filterx_eval_exec(FilterXEvalContext *context, FilterXExpr *expr, LogMessage *msg);
+FilterXEvalResult filterx_eval_exec(FilterXEvalContext *context, FilterXExpr *expr, LogMessage *msg);
 void filterx_eval_sync_scope_and_message(FilterXScope *scope, LogMessage *msg);
 const gchar *filterx_eval_get_last_error(void);
 EVTTAG *filterx_format_last_error(void);
diff --git a/lib/filterx/filterx-pipe.c b/lib/filterx/filterx-pipe.c
index d57d04d1de..99cf301734 100644
--- a/lib/filterx/filterx-pipe.c
+++ b/lib/filterx/filterx-pipe.c
@@ -51,7 +51,7 @@ log_filterx_pipe_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_o
   LogFilterXPipe *self = (LogFilterXPipe *) s;
   FilterXEvalContext eval_context;
   LogPathOptions local_path_options;
-  gboolean res;
+  FilterXEvalResult eval_res;
 
   path_options = log_path_options_chain(&local_path_options, path_options);
   filterx_eval_init_context(&eval_context, path_options->filterx_context);
@@ -62,17 +62,17 @@ log_filterx_pipe_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_o
             evt_tag_msg_reference(msg));
 
   NVTable *payload = nv_table_ref(msg->payload);
-  res = filterx_eval_exec(&eval_context, self->block, msg);
+  eval_res = filterx_eval_exec(&eval_context, self->block, msg);
 
   msg_trace("<<<<<< filterx rule evaluation result",
-            evt_tag_str("result", res ? "matched" : "unmatched"),
+            evt_tag_str("result", eval_res == FXE_SUCCESS ? "matched" : "unmatched"),
             evt_tag_str("rule", self->name),
             log_pipe_location_tag(s),
             evt_tag_int("dirty", filterx_scope_is_dirty(eval_context.scope)),
             evt_tag_msg_reference(msg));
 
   local_path_options.filterx_context = &eval_context;
-  if (res)
+  if (eval_res == FXE_SUCCESS)
     {
       log_pipe_forward_msg(s, msg, path_options);
     }

From f3987799908facbef80f989a7aa90682c24a18ae Mon Sep 17 00:00:00 2001
From: Szilard Parrag <szilard.parrag@axoflow.com>
Date: Mon, 2 Sep 2024 13:06:53 +0200
Subject: [PATCH 07/12] lib/filterx: add FXE_DROP to FilterXEvalResult to
 prepare for drop keyword

Signed-off-by: Szilard Parrag <szilard.parrag@axoflow.com>
---
 lib/filterx/filterx-eval.c | 31 ++++++++++++++++++++++++++-----
 lib/filterx/filterx-eval.h |  2 ++
 lib/filterx/filterx-pipe.c | 18 +++++++++++++-----
 3 files changed, 41 insertions(+), 10 deletions(-)

diff --git a/lib/filterx/filterx-eval.c b/lib/filterx/filterx-eval.c
index 2afb3e00ac..6094861c07 100644
--- a/lib/filterx/filterx-eval.c
+++ b/lib/filterx/filterx-eval.c
@@ -154,7 +154,7 @@ filterx_eval_exec(FilterXEvalContext *context, FilterXExpr *expr, LogMessage *ms
 {
   context->msgs = &msg;
   context->num_msg = 1;
-  FilterXEvalResult success = FXE_FAILURE;
+  FilterXEvalResult result = FXE_FAILURE;
 
   FilterXObject *res = filterx_expr_eval(expr);
   if (!res)
@@ -165,15 +165,14 @@ filterx_eval_exec(FilterXEvalContext *context, FilterXExpr *expr, LogMessage *ms
       filterx_eval_clear_errors();
       goto fail;
     }
+
   if (filterx_object_truthy(res))
-    success = FXE_SUCCESS;
-  else
-    success = FXE_FAILURE;
+    result = FXE_SUCCESS;
   filterx_object_unref(res);
   /* NOTE: we only store the results into the message if the entire evaluation was successful */
 fail:
   filterx_scope_set_dirty(context->scope);
-  return success;
+  return result;
 }
 
 void
@@ -208,3 +207,25 @@ filterx_eval_deinit_context(FilterXEvalContext *context)
   filterx_scope_unref(context->scope);
   filterx_eval_set_context(context->previous_context);
 }
+
+EVTTAG *
+filterx_format_eval_result(FilterXEvalResult result)
+{
+  const gchar *eval_result = NULL;
+  switch (result)
+    {
+    case FXE_SUCCESS:
+      eval_result = g_strdup("matched");
+      break;
+    case FXE_DROP:
+      eval_result = g_strdup("explicitly dropped");
+      break;
+    case FXE_FAILURE:
+      eval_result = g_strdup("unmatched");
+      break;
+    default:
+      g_assert_not_reached();
+      break;
+    }
+  return evt_tag_printf("result", "%s", eval_result);
+}
diff --git a/lib/filterx/filterx-eval.h b/lib/filterx/filterx-eval.h
index ae134c9dec..6e4c7a28a7 100644
--- a/lib/filterx/filterx-eval.h
+++ b/lib/filterx/filterx-eval.h
@@ -33,6 +33,7 @@ typedef enum _FilterXEvalResult
 {
   FXE_SUCCESS,
   FXE_FAILURE,
+  FXE_DROP,
 } FilterXEvalResult;
 
 typedef struct _FilterXEvalContext FilterXEvalContext;
@@ -58,6 +59,7 @@ const gchar *filterx_eval_get_last_error(void);
 EVTTAG *filterx_format_last_error(void);
 EVTTAG *filterx_format_last_error_location(void);
 void filterx_eval_clear_errors(void);
+EVTTAG *filterx_format_eval_result(FilterXEvalResult result);
 
 void filterx_eval_store_weak_ref(FilterXObject *object);
 
diff --git a/lib/filterx/filterx-pipe.c b/lib/filterx/filterx-pipe.c
index 99cf301734..7fb0fa34a4 100644
--- a/lib/filterx/filterx-pipe.c
+++ b/lib/filterx/filterx-pipe.c
@@ -65,22 +65,30 @@ log_filterx_pipe_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_o
   eval_res = filterx_eval_exec(&eval_context, self->block, msg);
 
   msg_trace("<<<<<< filterx rule evaluation result",
-            evt_tag_str("result", eval_res == FXE_SUCCESS ? "matched" : "unmatched"),
+            filterx_format_eval_result(eval_res),
             evt_tag_str("rule", self->name),
             log_pipe_location_tag(s),
             evt_tag_int("dirty", filterx_scope_is_dirty(eval_context.scope)),
             evt_tag_msg_reference(msg));
 
   local_path_options.filterx_context = &eval_context;
-  if (eval_res == FXE_SUCCESS)
+  switch (eval_res)
     {
+    case FXE_SUCCESS:
       log_pipe_forward_msg(s, msg, path_options);
-    }
-  else
-    {
+      break;
+
+    case FXE_FAILURE:
       if (path_options->matched)
         (*path_options->matched) = FALSE;
+    /* FALLTHROUGH */
+    case FXE_DROP:
       log_msg_drop(msg, path_options, AT_PROCESSED);
+      break;
+
+    default:
+      g_assert_not_reached();
+      break;
     }
 
   filterx_eval_deinit_context(&eval_context);

From c40a1cc275b67749378710e446a7e4e7adbc2a74 Mon Sep 17 00:00:00 2001
From: Szilard Parrag <szilard.parrag@axoflow.com>
Date: Wed, 4 Sep 2024 13:44:05 +0200
Subject: [PATCH 08/12] lib/filterx: add drop keyword for explicitly dropping
 messages

Signed-off-by: Szilard Parrag <szilard.parrag@axoflow.com>
---
 lib/filterx/CMakeLists.txt     |  2 ++
 lib/filterx/Makefile.am        |  2 ++
 lib/filterx/expr-compound.c    |  5 ++++
 lib/filterx/expr-drop.c        | 46 ++++++++++++++++++++++++++++++++++
 lib/filterx/expr-drop.h        | 31 +++++++++++++++++++++++
 lib/filterx/filterx-eval.c     |  6 +++--
 lib/filterx/filterx-eval.h     |  8 ++++++
 lib/filterx/filterx-grammar.ym |  3 +++
 lib/filterx/filterx-parser.c   |  1 +
 9 files changed, 102 insertions(+), 2 deletions(-)
 create mode 100644 lib/filterx/expr-drop.c
 create mode 100644 lib/filterx/expr-drop.h

diff --git a/lib/filterx/CMakeLists.txt b/lib/filterx/CMakeLists.txt
index 67d0be0d28..09c9247249 100644
--- a/lib/filterx/CMakeLists.txt
+++ b/lib/filterx/CMakeLists.txt
@@ -10,6 +10,7 @@ set(FILTERX_HEADERS
     filterx/expr-setattr.h
     filterx/expr-set-subscript.h
     filterx/expr-template.h
+    filterx/expr-drop.h
     filterx/filterx-config.h
     filterx/filterx-eval.h
     filterx/filterx-error.h
@@ -65,6 +66,7 @@ set(FILTERX_SOURCES
     filterx/expr-setattr.c
     filterx/expr-set-subscript.c
     filterx/expr-template.c
+    filterx/expr-drop.c
     filterx/filterx-config.c
     filterx/filterx-eval.c
     filterx/filterx-error.c
diff --git a/lib/filterx/Makefile.am b/lib/filterx/Makefile.am
index d716c9f60f..4f3b60e16d 100644
--- a/lib/filterx/Makefile.am
+++ b/lib/filterx/Makefile.am
@@ -15,6 +15,7 @@ filterxinclude_HEADERS = 			\
 	lib/filterx/expr-plus.h	\
 	lib/filterx/expr-variable.h		\
 	lib/filterx/expr-comparison.h		\
+	lib/filterx/expr-drop.h		\
 	lib/filterx/filterx-object.h		\
 	lib/filterx/filterx-weakrefs.h		\
 	lib/filterx/object-primitive.h		\
@@ -69,6 +70,7 @@ filterx_sources = 				\
 	lib/filterx/expr-plus.c	\
 	lib/filterx/expr-variable.c		\
 	lib/filterx/expr-comparison.c		\
+	lib/filterx/expr-drop.c		\
 	lib/filterx/filterx-object.c		\
 	lib/filterx/filterx-weakrefs.c		\
 	lib/filterx/object-primitive.c		\
diff --git a/lib/filterx/expr-compound.c b/lib/filterx/expr-compound.c
index 187c7cc061..dc35af63fe 100644
--- a/lib/filterx/expr-compound.c
+++ b/lib/filterx/expr-compound.c
@@ -84,6 +84,11 @@ _eval_exprs(FilterXCompoundExpr *self, FilterXObject **result)
   for (gint i = 0; i < self->exprs->len; i++)
     {
       filterx_object_unref(*result);
+      FilterXEvalContext *context = filterx_eval_get_context();
+
+      if (context->eval_control_modifier == FXC_DROP)
+        /* code flow modifier detected, short circuiting */
+        return TRUE;
 
       FilterXExpr *expr = g_ptr_array_index(self->exprs, i);
       if (!_eval_expr(expr, result))
diff --git a/lib/filterx/expr-drop.c b/lib/filterx/expr-drop.c
new file mode 100644
index 0000000000..feb8457b82
--- /dev/null
+++ b/lib/filterx/expr-drop.c
@@ -0,0 +1,46 @@
+/*
+ * Copyright (c) 2024 Axoflow
+ * Copyright (c) 2024 Szilard Parrag <szilard.parrag@axoflow.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ * As an additional exemption you are allowed to compile & link against the
+ * OpenSSL libraries as published by the OpenSSL project. See the file
+ * COPYING for details.
+ *
+ */
+
+#include "filterx/expr-drop.h"
+#include "filterx/filterx-eval.h"
+#include "filterx/object-primitive.h"
+
+static FilterXObject *
+_eval(FilterXExpr *s)
+{
+  FilterXEvalContext *context = filterx_eval_get_context();
+  context->eval_control_modifier = FXC_DROP;
+
+  return filterx_boolean_new(TRUE);
+}
+
+FilterXExpr *
+filterx_expr_drop_msg(void)
+{
+  FilterXExpr *self = g_new0(FilterXExpr, 1);
+  filterx_expr_init_instance(self);
+  self->eval = _eval;
+
+  return self;
+}
diff --git a/lib/filterx/expr-drop.h b/lib/filterx/expr-drop.h
new file mode 100644
index 0000000000..f448ce6380
--- /dev/null
+++ b/lib/filterx/expr-drop.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2024 Axoflow
+ * Copyright (c) 2024 Szilard Parrag <szilard.parrag@axoflow.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ * As an additional exemption you are allowed to compile & link against the
+ * OpenSSL libraries as published by the OpenSSL project. See the file
+ * COPYING for details.
+ *
+ */
+
+#ifndef FILTERX_EXPR_DROP_H_INCLUDED
+#define FILTERX_EXPR_DROP_H_INCLUDED
+#include "filterx/expr-function.h"
+
+FilterXExpr *filterx_expr_drop_msg(void);
+
+#endif
diff --git a/lib/filterx/filterx-eval.c b/lib/filterx/filterx-eval.c
index 6094861c07..cad5910026 100644
--- a/lib/filterx/filterx-eval.c
+++ b/lib/filterx/filterx-eval.c
@@ -165,8 +165,9 @@ filterx_eval_exec(FilterXEvalContext *context, FilterXExpr *expr, LogMessage *ms
       filterx_eval_clear_errors();
       goto fail;
     }
-
-  if (filterx_object_truthy(res))
+  if (context->eval_control_modifier == FXC_DROP)
+    result = FXE_DROP;
+  else if (filterx_object_truthy(res))
     result = FXE_SUCCESS;
   filterx_object_unref(res);
   /* NOTE: we only store the results into the message if the entire evaluation was successful */
@@ -196,6 +197,7 @@ filterx_eval_init_context(FilterXEvalContext *context, FilterXEvalContext *previ
     context->weak_refs = g_ptr_array_new_with_free_func((GDestroyNotify) filterx_object_unref);
   context->previous_context = previous_context;
 
+  context->eval_control_modifier = FXC_NOTSET;
   filterx_eval_set_context(context);
 }
 
diff --git a/lib/filterx/filterx-eval.h b/lib/filterx/filterx-eval.h
index 6e4c7a28a7..5a42b0a5ad 100644
--- a/lib/filterx/filterx-eval.h
+++ b/lib/filterx/filterx-eval.h
@@ -36,6 +36,13 @@ typedef enum _FilterXEvalResult
   FXE_DROP,
 } FilterXEvalResult;
 
+
+typedef enum _FilterXEvalControl
+{
+  FXC_NOTSET,
+  FXC_DROP
+} FilterXEvalControl;
+
 typedef struct _FilterXEvalContext FilterXEvalContext;
 struct _FilterXEvalContext
 {
@@ -45,6 +52,7 @@ struct _FilterXEvalContext
   FilterXError error;
   LogTemplateEvalOptions template_eval_options;
   GPtrArray *weak_refs;
+  FilterXEvalControl eval_control_modifier;
   FilterXEvalContext *previous_context;
 };
 
diff --git a/lib/filterx/filterx-grammar.ym b/lib/filterx/filterx-grammar.ym
index b7c8c2a292..c3e3b65b83 100644
--- a/lib/filterx/filterx-grammar.ym
+++ b/lib/filterx/filterx-grammar.ym
@@ -55,6 +55,7 @@
 #include "filterx/expr-plus.h"
 #include "filterx/expr-null-coalesce.h"
 #include "filterx/expr-plus-generator.h"
+#include "filterx/expr-drop.h"
 
 #include "template/templates.h"
 
@@ -103,6 +104,7 @@ construct_template_expr(LogTemplate *template)
 %token KW_ENUM
 %token KW_ISSET
 %token KW_DECLARE
+%token KW_DROP
 
 %type <ptr> block
 %type <ptr> stmts
@@ -362,6 +364,7 @@ expr
 	| ternary				{ $$ = $1; }
 	| default				{ $$ = $1; }
 	| KW_ISSET '(' expr ')'			{ $$ = filterx_isset_new($3); }
+	| KW_DROP                   { $$ = filterx_expr_drop_msg(); }
 	| regexp_match				{ $$ = $1; }
 	;
 
diff --git a/lib/filterx/filterx-parser.c b/lib/filterx/filterx-parser.c
index 6c7b77c52a..04b8da770b 100644
--- a/lib/filterx/filterx-parser.c
+++ b/lib/filterx/filterx-parser.c
@@ -50,6 +50,7 @@ static CfgLexerKeyword filterx_keywords[] =
 
   { "isset",              KW_ISSET },
   { "declare",            KW_DECLARE },
+  { "drop",               KW_DROP },
 
   { CFG_KEYWORD_STOP },
 };

From b5e0a2062243364ecabbfeeb19c277cbc0f001bf Mon Sep 17 00:00:00 2001
From: Szilard Parrag <szilard.parrag@axoflow.com>
Date: Thu, 5 Sep 2024 15:46:04 +0200
Subject: [PATCH 09/12] lib/filterx: add E2E test for drop

Signed-off-by: Szilard Parrag <szilard.parrag@axoflow.com>
---
 .../functional_tests/filterx/test_filterx.py  | 42 +++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/tests/light/functional_tests/filterx/test_filterx.py b/tests/light/functional_tests/filterx/test_filterx.py
index 4aff1ed4d0..60416b12bc 100644
--- a/tests/light/functional_tests/filterx/test_filterx.py
+++ b/tests/light/functional_tests/filterx/test_filterx.py
@@ -2039,3 +2039,45 @@ def test_list_range_check_out_of_range(config, syslog_ng):
     syslog_ng.start(config)
     assert file_false.get_stats()["processed"] == 1
     assert file_false.read_log() == "foobar\n"
+
+
+def test_drop(config, syslog_ng):
+    file_true = config.create_file_destination(file_name="dest-true.log", template="'$MSG\n'")
+    file_false = config.create_file_destination(file_name="dest-false.log", template="'$MSG\n'")
+
+    raw_conf = f"""
+@version: {config.get_version()}
+
+options {{ stats(level(1)); }};
+
+source genmsg {{
+    example-msg-generator(num(1) template("foo"));
+    example-msg-generator(num(1) template("bar"));
+}};
+
+destination dest_true {{
+    {render_statement(file_true)};
+}};
+
+destination dest_false {{
+    {render_statement(file_false)};
+}};
+
+log {{
+    source(genmsg);
+    if {{
+        filterx {{ {"if ($MSG =~ 'foo') {drop;};"} \n}};
+        destination(dest_true);
+    }} else {{
+        destination(dest_false);
+    }};
+}};
+"""
+    config.set_raw_config(raw_conf)
+
+    syslog_ng.start(config)
+
+    assert "processed" in file_true.get_stats()
+    assert file_true.get_stats()["processed"] == 1
+    assert file_true.read_log() == 'bar\n'
+    assert syslog_ng.wait_for_message_in_console_log("filterx rule evaluation result; result='explicitly dropped'") != []

From 41f49d9edd9f34fc1b5c2ead95065a804a2731a8 Mon Sep 17 00:00:00 2001
From: Szilard Parrag <szilard.parrag@axoflow.com>
Date: Mon, 2 Sep 2024 13:28:03 +0200
Subject: [PATCH 10/12] lib/filterx: implement done keyword for immediate
 forwarding

Signed-off-by: Szilard Parrag <szilard.parrag@axoflow.com>
---
 lib/filterx/CMakeLists.txt     |  2 ++
 lib/filterx/Makefile.am        |  2 ++
 lib/filterx/expr-compound.c    |  2 +-
 lib/filterx/expr-done.c        | 47 ++++++++++++++++++++++++++++++++++
 lib/filterx/expr-done.h        | 32 +++++++++++++++++++++++
 lib/filterx/filterx-eval.h     |  3 ++-
 lib/filterx/filterx-grammar.ym |  3 +++
 lib/filterx/filterx-parser.c   |  1 +
 8 files changed, 90 insertions(+), 2 deletions(-)
 create mode 100644 lib/filterx/expr-done.c
 create mode 100644 lib/filterx/expr-done.h

diff --git a/lib/filterx/CMakeLists.txt b/lib/filterx/CMakeLists.txt
index 09c9247249..73c85e6ad2 100644
--- a/lib/filterx/CMakeLists.txt
+++ b/lib/filterx/CMakeLists.txt
@@ -11,6 +11,7 @@ set(FILTERX_HEADERS
     filterx/expr-set-subscript.h
     filterx/expr-template.h
     filterx/expr-drop.h
+    filterx/expr-done.h
     filterx/filterx-config.h
     filterx/filterx-eval.h
     filterx/filterx-error.h
@@ -67,6 +68,7 @@ set(FILTERX_SOURCES
     filterx/expr-set-subscript.c
     filterx/expr-template.c
     filterx/expr-drop.c
+    filterx/expr-done.c
     filterx/filterx-config.c
     filterx/filterx-eval.c
     filterx/filterx-error.c
diff --git a/lib/filterx/Makefile.am b/lib/filterx/Makefile.am
index 4f3b60e16d..872396548e 100644
--- a/lib/filterx/Makefile.am
+++ b/lib/filterx/Makefile.am
@@ -16,6 +16,7 @@ filterxinclude_HEADERS = 			\
 	lib/filterx/expr-variable.h		\
 	lib/filterx/expr-comparison.h		\
 	lib/filterx/expr-drop.h		\
+	lib/filterx/expr-done.h		\
 	lib/filterx/filterx-object.h		\
 	lib/filterx/filterx-weakrefs.h		\
 	lib/filterx/object-primitive.h		\
@@ -71,6 +72,7 @@ filterx_sources = 				\
 	lib/filterx/expr-variable.c		\
 	lib/filterx/expr-comparison.c		\
 	lib/filterx/expr-drop.c		\
+	lib/filterx/expr-done.c		\
 	lib/filterx/filterx-object.c		\
 	lib/filterx/filterx-weakrefs.c		\
 	lib/filterx/object-primitive.c		\
diff --git a/lib/filterx/expr-compound.c b/lib/filterx/expr-compound.c
index dc35af63fe..8f7f839707 100644
--- a/lib/filterx/expr-compound.c
+++ b/lib/filterx/expr-compound.c
@@ -86,7 +86,7 @@ _eval_exprs(FilterXCompoundExpr *self, FilterXObject **result)
       filterx_object_unref(*result);
       FilterXEvalContext *context = filterx_eval_get_context();
 
-      if (context->eval_control_modifier == FXC_DROP)
+      if (context->eval_control_modifier == FXC_DROP || context->eval_control_modifier == FXC_DONE)
         /* code flow modifier detected, short circuiting */
         return TRUE;
 
diff --git a/lib/filterx/expr-done.c b/lib/filterx/expr-done.c
new file mode 100644
index 0000000000..8070f796fa
--- /dev/null
+++ b/lib/filterx/expr-done.c
@@ -0,0 +1,47 @@
+/*
+ * Copyright (c) 2024 Axoflow
+ * Copyright (c) 2024 Szilard Parrag <szilard.parrag@axoflow.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ * As an additional exemption you are allowed to compile & link against the
+ * OpenSSL libraries as published by the OpenSSL project. See the file
+ * COPYING for details.
+ *
+ */
+
+
+#include "filterx/expr-done.h"
+#include "filterx/filterx-eval.h"
+#include "filterx/object-primitive.h"
+
+static FilterXObject *
+_eval(FilterXExpr *s)
+{
+  FilterXEvalContext *context = filterx_eval_get_context();
+  context->eval_control_modifier = FXC_DONE;
+
+  return filterx_boolean_new(TRUE);
+}
+
+FilterXExpr *
+filterx_expr_done(void)
+{
+  FilterXExpr *self = g_new0(FilterXExpr, 1);
+  filterx_expr_init_instance(self);
+  self->eval = _eval;
+
+  return self;
+}
diff --git a/lib/filterx/expr-done.h b/lib/filterx/expr-done.h
new file mode 100644
index 0000000000..35a4112965
--- /dev/null
+++ b/lib/filterx/expr-done.h
@@ -0,0 +1,32 @@
+/*
+ * Copyright (c) 2024 Axoflow
+ * Copyright (c) 2024 Szilard Parrag <szilard.parrag@axoflow.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ * As an additional exemption you are allowed to compile & link against the
+ * OpenSSL libraries as published by the OpenSSL project. See the file
+ * COPYING for details.
+ *
+ */
+
+#ifndef FILTERX_FUNC_DONE_H_INCLUDED
+#define FILTERX_FUNC_DONE_H_INCLUDED
+
+#include "filterx/expr-function.h"
+
+FilterXExpr *filterx_expr_done(void);
+
+#endif
diff --git a/lib/filterx/filterx-eval.h b/lib/filterx/filterx-eval.h
index 5a42b0a5ad..ddccbcbf2a 100644
--- a/lib/filterx/filterx-eval.h
+++ b/lib/filterx/filterx-eval.h
@@ -40,7 +40,8 @@ typedef enum _FilterXEvalResult
 typedef enum _FilterXEvalControl
 {
   FXC_NOTSET,
-  FXC_DROP
+  FXC_DROP,
+  FXC_DONE
 } FilterXEvalControl;
 
 typedef struct _FilterXEvalContext FilterXEvalContext;
diff --git a/lib/filterx/filterx-grammar.ym b/lib/filterx/filterx-grammar.ym
index c3e3b65b83..4fcf6819f1 100644
--- a/lib/filterx/filterx-grammar.ym
+++ b/lib/filterx/filterx-grammar.ym
@@ -56,6 +56,7 @@
 #include "filterx/expr-null-coalesce.h"
 #include "filterx/expr-plus-generator.h"
 #include "filterx/expr-drop.h"
+#include "filterx/expr-done.h"
 
 #include "template/templates.h"
 
@@ -105,6 +106,7 @@ construct_template_expr(LogTemplate *template)
 %token KW_ISSET
 %token KW_DECLARE
 %token KW_DROP
+%token KW_DONE
 
 %type <ptr> block
 %type <ptr> stmts
@@ -365,6 +367,7 @@ expr
 	| default				{ $$ = $1; }
 	| KW_ISSET '(' expr ')'			{ $$ = filterx_isset_new($3); }
 	| KW_DROP                   { $$ = filterx_expr_drop_msg(); }
+	| KW_DONE                   { $$ = filterx_expr_done(); }
 	| regexp_match				{ $$ = $1; }
 	;
 
diff --git a/lib/filterx/filterx-parser.c b/lib/filterx/filterx-parser.c
index 04b8da770b..560bc4570a 100644
--- a/lib/filterx/filterx-parser.c
+++ b/lib/filterx/filterx-parser.c
@@ -51,6 +51,7 @@ static CfgLexerKeyword filterx_keywords[] =
   { "isset",              KW_ISSET },
   { "declare",            KW_DECLARE },
   { "drop",               KW_DROP },
+  { "done",               KW_DONE },
 
   { CFG_KEYWORD_STOP },
 };

From dd2a4a340d4548cc44234958389538800fd9f2ce Mon Sep 17 00:00:00 2001
From: Szilard Parrag <szilard.parrag@axoflow.com>
Date: Thu, 5 Sep 2024 15:46:26 +0200
Subject: [PATCH 11/12] lib/filterx: add E2E test for done

Signed-off-by: Szilard Parrag <szilard.parrag@axoflow.com>
---
 .../functional_tests/filterx/test_filterx.py  | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/tests/light/functional_tests/filterx/test_filterx.py b/tests/light/functional_tests/filterx/test_filterx.py
index 60416b12bc..d5b136dbc8 100644
--- a/tests/light/functional_tests/filterx/test_filterx.py
+++ b/tests/light/functional_tests/filterx/test_filterx.py
@@ -2081,3 +2081,25 @@ def test_drop(config, syslog_ng):
     assert file_true.get_stats()["processed"] == 1
     assert file_true.read_log() == 'bar\n'
     assert syslog_ng.wait_for_message_in_console_log("filterx rule evaluation result; result='explicitly dropped'") != []
+
+
+def test_done(config, syslog_ng):
+    (file_true, file_false) = create_config(
+        config,
+        msg="foo",
+        filterx_expr_1=r"""
+            if ($MSG =~ 'foo') {
+              declare var_wont_change = true;
+              done;
+              var_wont_change = false; # This will be skipped
+            };
+        """,
+        filterx_expr_2=r"""
+            $MSG = vars();
+        """,
+    )
+    syslog_ng.start(config)
+
+    assert file_true.get_stats()["processed"] == 1
+    assert "processed" not in file_false.get_stats()
+    assert file_true.read_log() == '{"MESSAGE":"foo","var_wont_change":true}\n'

From 1ad8eea7114806e7f89905648f52ae3460fdfc4d Mon Sep 17 00:00:00 2001
From: Szilard Parrag <szilard.parrag@axoflow.com>
Date: Thu, 5 Sep 2024 17:12:24 +0200
Subject: [PATCH 12/12] lib/filterx: add hint regarding unlikely drop/done
 occurence

Signed-off-by: Szilard Parrag <szilard.parrag@axoflow.com>
---
 lib/filterx/expr-compound.c | 2 +-
 lib/filterx/filterx-eval.c  | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/filterx/expr-compound.c b/lib/filterx/expr-compound.c
index 8f7f839707..0956ec36b7 100644
--- a/lib/filterx/expr-compound.c
+++ b/lib/filterx/expr-compound.c
@@ -86,7 +86,7 @@ _eval_exprs(FilterXCompoundExpr *self, FilterXObject **result)
       filterx_object_unref(*result);
       FilterXEvalContext *context = filterx_eval_get_context();
 
-      if (context->eval_control_modifier == FXC_DROP || context->eval_control_modifier == FXC_DONE)
+      if (G_UNLIKELY(context->eval_control_modifier == FXC_DROP || context->eval_control_modifier == FXC_DONE))
         /* code flow modifier detected, short circuiting */
         return TRUE;
 
diff --git a/lib/filterx/filterx-eval.c b/lib/filterx/filterx-eval.c
index cad5910026..51bd845ead 100644
--- a/lib/filterx/filterx-eval.c
+++ b/lib/filterx/filterx-eval.c
@@ -165,7 +165,8 @@ filterx_eval_exec(FilterXEvalContext *context, FilterXExpr *expr, LogMessage *ms
       filterx_eval_clear_errors();
       goto fail;
     }
-  if (context->eval_control_modifier == FXC_DROP)
+
+  if (G_UNLIKELY(context->eval_control_modifier == FXC_DROP))
     result = FXE_DROP;
   else if (filterx_object_truthy(res))
     result = FXE_SUCCESS;