lib: event_filter_match() - "field=" filter now matches nonexistent field

This makes sense, because event_filter_clear() also works by adding an empty
value to the event. So it wouldn't even be possible to differentiate between
empty and nonexistent fields unless larger changes were made.

diff --git a/src/lib/event-filter.c b/src/lib/event-filter.c
index 72ab1015dc6e19da62185f1e1e9868e61c2c98df..e3e692dbe01da13c7dd7bb3285f87015acd07f3b 100644 (file)
--- a/src/lib/event-filter.c
+++ b/src/lib/event-filter.c
@@ -458,14 +458,16 @@ event_match_field(struct event *event, const struct event_field *wanted_field)
        /* wanted_field has the value in all available formats */
        while ((field = event_find_field(event, wanted_field->key)) == NULL) {
                event = event_get_parent(event);
-               if (event == NULL)
-                       return FALSE;
+               if (event == NULL) {
+                       /* "field=" matches nonexistent field */
+                       return wanted_field->value.str[0] == '\0';
+               }
        }
        switch (field->value_type) {
        case EVENT_FIELD_VALUE_TYPE_STR:
                if (field->value.str[0] == '\0') {
-                       /* field was removed */
-                       return FALSE;
+                       /* field was removed, but it matches "field=" filter */
+                       return wanted_field->value.str[0] == '\0';
                }
                return wildcard_match_icase(field->value.str, wanted_field->value.str);
        case EVENT_FIELD_VALUE_TYPE_INTMAX:

diff --git a/src/lib/test-event-filter.c b/src/lib/test-event-filter.c
index 840c3c43e8d9924c3149dd149d71bf608d1569b5..cbaccccb5e33565cbe262bf6f184ab40b985d090 100644 (file)
--- a/src/lib/test-event-filter.c
+++ b/src/lib/test-event-filter.c
@@ -84,6 +84,7 @@ static void test_event_filter_clear_parent_fields(void)
        event_field_clear(child, "int");
 
        for (unsigned int i = 0; i < N_ELEMENTS(keys); i++) {
+               /* match any value */
                filter_fields[0].key = keys[i];
                filter = event_filter_create();
                event_filter_add(filter, &query);
@@ -93,6 +94,26 @@ static void test_event_filter_clear_parent_fields(void)
                event_filter_unref(&filter);
        }
 
+       /* match empty field */
+       filter_fields[0].key = "str";
+       filter_fields[0].value = "";
+       filter = event_filter_create();
+       event_filter_add(filter, &query);
+
+       test_assert(!event_filter_match(filter, parent, &failure_ctx));
+       test_assert(event_filter_match(filter, child, &failure_ctx));
+       event_filter_unref(&filter);
+
+       /* match nonexistent field */
+       filter_fields[0].key = "nonexistent";
+       filter_fields[0].value = "";
+       filter = event_filter_create();
+       event_filter_add(filter, &query);
+
+       test_assert(event_filter_match(filter, parent, &failure_ctx));
+       test_assert(event_filter_match(filter, child, &failure_ctx));
+       event_filter_unref(&filter);
+
        event_unref(&parent);
        event_unref(&child);
        test_end();