syslog-267.tar.gz

[apple/syslog.git] / libsystem_asl.tproj / src / asl_core.c

/*
 * Copyright (c) 2007-2013 Apple Inc.  All rights reserved.
 *
 * @APPLE_LICENSE_HEADER_START@
 *
 * This file contains Original Code and/or Modifications of Original Code
 * as defined in and that are subject to the Apple Public Source License
 * Version 2.0 (the 'License'). You may not use this file except in
 * compliance with the License. Please obtain a copy of the License at
 * http://www.opensource.apple.com/apsl/ and read it before using this
 * file.
 * 
 * The Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 * Please see the License for the specific language governing rights and
 * limitations under the License.
 * 
 * @APPLE_LICENSE_HEADER_END@
 */

#include <ctype.h>
#include <stdio.h>
#include <stdbool.h>
#include <asl.h>
#include <asl_string.h>
#include <asl_core.h>
#include <asl_private.h>
#include <string.h>
#include <membership.h>
#include <pthread.h>
#include <libkern/OSAtomic.h>
#include <servers/bootstrap.h>
#include <bootstrap_priv.h>
#include <mach/kern_return.h>
#include <mach/mach_init.h>
#include <mach/mach_vm.h>
#include <mach/vm_map.h>
#include <mach/vm_param.h>
#include <dispatch/dispatch.h>

const char *ASL_LEVEL_TO_STRING[] =
{
	ASL_STRING_EMERG,
	ASL_STRING_ALERT,
	ASL_STRING_CRIT,
	ASL_STRING_ERR,
	ASL_STRING_WARNING,
	ASL_STRING_NOTICE,
	ASL_STRING_INFO,
	ASL_STRING_DEBUG
};

static char *asl_filesystem_path_database = NULL;
static char *asl_filesystem_path_archive = NULL;

/*
 * Message ID generation
 */
static uint64_t _asl_core_msg_next_id = 1;
static pthread_mutex_t core_lock = PTHREAD_MUTEX_INITIALIZER;

#define mix(a, b, c) \
{ \
	a -= b; a -= c; a ^= (c>>13); \
	b -= c; b -= a; b ^= (a<< 8); \
	c -= a; c -= b; c ^= (b>>13); \
	a -= b; a -= c; a ^= (c>>12); \
	b -= c; b -= a; b ^= (a<<16); \
	c -= a; c -= b; c ^= (b>> 5); \
	a -= b; a -= c; a ^= (c>> 3); \
	b -= c; b -= a; b ^= (a<<10); \
	c -= a; c -= b; c ^= (b>>15); \
}

/*
 * Get ASL server mach port.
 * reset != 0 flushes cached port.
 * reset < 0 returns MACH_PORT_NULL
 */
mach_port_t
asl_core_get_service_port(int reset)
{
	static mach_port_t server_port = MACH_PORT_NULL;
	mach_port_t tmp;
	kern_return_t kstatus;
	
	if ((reset != 0) && (server_port != MACH_PORT_NULL))
	{
		mach_port_t tmp = server_port;
		server_port = MACH_PORT_NULL;
		mach_port_deallocate(mach_task_self(), tmp);
	}

	if (reset < 0) return MACH_PORT_NULL;

	if (server_port != MACH_PORT_NULL) return server_port;

	tmp = MACH_PORT_NULL;
	char *str = getenv("ASL_DISABLE");
	if ((str != NULL) && (!strcmp(str, "1"))) return MACH_PORT_NULL;

	kstatus = bootstrap_look_up2(bootstrap_port, ASL_SERVICE_NAME, &tmp, 0, BOOTSTRAP_PRIVILEGED_SERVER);
	if ((kstatus != KERN_SUCCESS) || (tmp == MACH_PORT_NULL)) return MACH_PORT_NULL;

	if (!OSAtomicCompareAndSwap32Barrier(MACH_PORT_NULL, tmp, (int32_t *)&server_port))
	{
		mach_port_deallocate(mach_task_self(), tmp);
	}

	return server_port;
}

/*
 * Hash is used to improve string search.
 */
uint32_t
asl_core_string_hash(const char *s, uint32_t inlen)
{
	uint32_t a, b, c, l, len;

	if (s == NULL) return 0;

	l = inlen;
	if (l == 0)
	{
		if (s[0] == '\0') return 0;
		l = strlen(s);
	}

	len = l;
	a = b = 0x9e3779b9;
	c = 0;

	while (len >= 12)
	{
		a += (s[0] + ((uint32_t)s[1]<<8) + ((uint32_t)s[ 2]<<16) + ((uint32_t)s[ 3]<<24));
		b += (s[4] + ((uint32_t)s[5]<<8) + ((uint32_t)s[ 6]<<16) + ((uint32_t)s[ 7]<<24));
		c += (s[8] + ((uint32_t)s[9]<<8) + ((uint32_t)s[10]<<16) + ((uint32_t)s[11]<<24));

		mix(a, b, c);

		s += 12;
		len -= 12;
	}

	c += l;
	switch(len)
	{
		case 11: c += ((uint32_t)s[10]<<24);
		case 10: c += ((uint32_t)s[9]<<16);
		case 9 : c += ((uint32_t)s[8]<<8);

		case 8 : b += ((uint32_t)s[7]<<24);
		case 7 : b += ((uint32_t)s[6]<<16);
		case 6 : b += ((uint32_t)s[5]<<8);
		case 5 : b += s[4];

		case 4 : a += ((uint32_t)s[3]<<24);
		case 3 : a += ((uint32_t)s[2]<<16);
		case 2 : a += ((uint32_t)s[1]<<8);
		case 1 : a += s[0];
	}

	mix(a, b, c);

	if (c == 0) c = 1;
	return c;
}

const char *
asl_core_error(uint32_t code)
{
	switch (code)
	{
		case ASL_STATUS_OK: return "Operation Succeeded";
		case ASL_STATUS_INVALID_ARG: return "Invalid Argument";
		case ASL_STATUS_INVALID_STORE: return "Invalid Data Store";
		case ASL_STATUS_INVALID_STRING: return "Invalid String";
		case ASL_STATUS_INVALID_ID: return "Invalid ID Number";
		case ASL_STATUS_INVALID_MESSAGE: return "Invalid Message";
		case ASL_STATUS_NOT_FOUND: return "Not Found";
		case ASL_STATUS_READ_FAILED: return "Read Operation Failed";
		case ASL_STATUS_WRITE_FAILED: return "Write Operation Failed";
		case ASL_STATUS_NO_MEMORY: return "System Memory Allocation Failed";
		case ASL_STATUS_ACCESS_DENIED: return "Access Denied";
		case ASL_STATUS_READ_ONLY: return "Read Only Access";
		case ASL_STATUS_WRITE_ONLY: return "Write Only Access";
		case ASL_STATUS_MATCH_FAILED: return "Match Failed";
		case ASL_STATUS_NO_RECORDS: return "No More Records";
	}

	return "Operation Failed";
}

const char *
asl_core_level_to_string(uint32_t level)
{
	if (level > ASL_LEVEL_DEBUG) return "invalid";
	return ASL_LEVEL_TO_STRING[level];
}

static ASL_STATUS
asl_core_check_user_access(int32_t msgu, int32_t readu)
{
	/* -1 means anyone may read */
	if (msgu == -1) return ASL_STATUS_OK;

	/* Check for exact match */
	if (msgu == readu) return ASL_STATUS_OK;

	return ASL_STATUS_ACCESS_DENIED;
}

static ASL_STATUS
asl_core_check_group_access(int32_t msgg, int32_t readu, int32_t readg)
{
	int check;
	uuid_t uu, gu;

	/* -1 means anyone may read */
	if (msgg == -1) return ASL_STATUS_OK;

	/* Check for exact match */
	if (msgg == readg) return ASL_STATUS_OK;

	/* Check if user (u) is in read group (msgg) */
	mbr_uid_to_uuid(readu, uu);
	mbr_gid_to_uuid(msgg, gu);

	check = 0;
	mbr_check_membership(uu, gu, &check);
	if (check != 0) return ASL_STATUS_OK;

	return ASL_STATUS_ACCESS_DENIED;
}

ASL_STATUS
asl_core_check_access(int32_t msgu, int32_t msgg, int32_t readu, int32_t readg, uint16_t flags)
{
	uint16_t uset, gset;

	/* root (uid 0) may always read */
	if (readu == 0) return ASL_STATUS_OK;

	uset = flags & ASL_MSG_FLAG_READ_UID_SET;
	gset = flags & ASL_MSG_FLAG_READ_GID_SET;

	/* if no access controls are set, anyone may read */
	if ((uset | gset) == 0) return ASL_STATUS_OK;

	/* if only uid is set, then access is only by uid match */
	if ((uset != 0) && (gset == 0)) return asl_core_check_user_access(msgu, readu);

	/* if only gid is set, then access is only by gid match */
	if ((uset == 0) && (gset != 0)) return asl_core_check_group_access(msgg, readu, readg);

	/* both uid and gid are set - check user, then group */
	if ((asl_core_check_user_access(msgu, readu)) == ASL_STATUS_OK) return ASL_STATUS_OK;
	return asl_core_check_group_access(msgg, readu, readg);
}

uint64_t
asl_core_htonq(uint64_t n)
{
#ifdef __BIG_ENDIAN__
	return n;
#else
	u_int32_t t;
	union
	{
		u_int64_t q;
		u_int32_t l[2];
	} x;

	x.q = n;
	t = x.l[0];
	x.l[0] = htonl(x.l[1]);
	x.l[1] = htonl(t);

	return x.q;
#endif
}

uint64_t
asl_core_ntohq(uint64_t n)
{
#ifdef __BIG_ENDIAN__
	return n;
#else
	u_int32_t t;
	union
	{
		u_int64_t q;
		u_int32_t l[2];
	} x;

	x.q = n;
	t = x.l[0];
	x.l[0] = ntohl(x.l[1]);
	x.l[1] = ntohl(t);

	return x.q;
#endif
}

uint64_t
asl_core_new_msg_id(uint64_t start)
{
	uint64_t out;

	pthread_mutex_lock(&core_lock);

	if (start != 0) _asl_core_msg_next_id = start;

	out = _asl_core_msg_next_id;
	_asl_core_msg_next_id++;

	pthread_mutex_unlock(&core_lock);

	return out;
}

const char *
asl_filesystem_path(uint32_t place)
{
	static dispatch_once_t once;

	dispatch_once(&once, ^{
		char *asl_var_log = NULL;
		const char *const_asl_var_log = "/var/log";

#if TARGET_IPHONE_SIMULATOR
		asl_var_log = getenv("SIMULATOR_LOG_ROOT");
#endif

		if (asl_var_log != NULL) const_asl_var_log = (const char *)asl_var_log;

		asprintf(&asl_filesystem_path_database, "%s/asl", const_asl_var_log);
		asprintf(&asl_filesystem_path_archive, "%s/asl.archive", const_asl_var_log);
	});

	switch (place)
	{
		case ASL_PLACE_DATABASE:
		{
			if (asl_filesystem_path_database == NULL) return ASL_PLACE_DATABASE_DEFAULT;
			return asl_filesystem_path_database;
		}
		case ASL_PLACE_ARCHIVE:
		{
			if (asl_filesystem_path_archive == NULL) return ASL_PLACE_ARCHIVE_DEFAULT;
			return asl_filesystem_path_archive;
		}
		default:
		{
			return NULL;
		}
	}

	return NULL;
}

#pragma mark -
#pragma mark data buffer encoding

/*
 * asl_core_encode_buffer
 * encode arbitrary data as a C string without embedded zero (nul) characters
 *
 * The routine computes a histogram of the input buffer and finds
 * the two least frequently used non-nul chars (L[0] and L[1]).
 *
 * L[0] is used to stand in for nul.
 * L[1] is used as the escape character.
 * Occurrences of nul in the data are encoded as L[0]
 * Occurrences of L[0] in the data are encoded as the sequence L[1] 1.
 * Occurrences of L[1] in the data are encoded as the sequence L[1] 2.
 *
 * The output string is preceded by L[0] L[1], and is nul terminated.
 * The output length is 2 + n + N(L[0]) + N(L[1]) + 1
 * where N(x) is the number of occurrences of x in the input string.
 * The worst case occurs when all characters are equally frequent,
 * In that case the output size will less that 1% larger than the input.
 */
char *
asl_core_encode_buffer(const char *in, uint32_t len)
{
	char *str;
	uint32_t i, j, k, outlen, breakit, min, hist[256];
	uint32_t lfu[2], save[2];
	uint8_t v;

	if (in == NULL) return NULL;
	if (len == 0) return NULL;

	memset(hist, 0, sizeof(hist));
	save[0] = 0;
	save[1] = 0;

	for (i = 0; i < len; i++)
	{
		v = in[i];
		hist[v]++;
	}

	for (j = 0; j < 2; j++)
	{
		lfu[j] = 1;
		min = hist[1];

		for (i = 2; i < 256; i++)
		{
			if (hist[i] < min)
			{
				lfu[j] = i;
				min = hist[i];

				/*
				 * Stop if there are no occurances or character i in the input.
				 * The minimum will never be less than zero.
				 */
				if (min == 0) break;

				/*
				 * When looking for the second least frequently used character,
				 * stop scanning if we hit the same minimum as we saw in the first
				 * pass.  There will be no smaller values.
				 */
				if ((j == 1) && (min == save[0])) break;
			}
		}

		save[j] = hist[lfu[j]];
		hist[lfu[j]] = (uint32_t)-1;
	}

	outlen = 2 + len + save[0] + save[1] + 1;

	str = malloc(outlen);
	if (str == NULL) return NULL;

	str[outlen - 1] = '\0';

	str[0] = lfu[0];
	str[1] = lfu[1];

	j = 2;

	for (i = 0; i < len; i++)
	{
		v = in[i];
		if (v == 0)
		{
			str[j++] = lfu[0];
			continue;
		}

		breakit = 0;
		for (k = 0; (k < 2) && (breakit == 0); k++)
		{
			if (v == lfu[k])
			{
				str[j++] = lfu[1];
				str[j++] = k + 1;
				breakit = 1;
			}
		}

		if (breakit == 1) continue;

		str[j++] = v;
	}

	return str;
}

/*
 * asl_core_decode_buffer
 * decode a string produced by asl_encode_buffer to recreate the original data
 */
int32_t
asl_core_decode_buffer(const char *in, char **buf, uint32_t *len)
{
	uint8_t v;
	uint32_t i, j, n, outlen;
	uint8_t lfu[2];
	char *out;

	if (buf == NULL) return -1;
	if (len == NULL) return -1;

	lfu[0] = in[0];
	lfu[1] = in[1];

	outlen = 0;

	/* strip trailing nul */
	n = strlen(in);

	/* determine output length and check for invalid input */
	for (i = 2; i < n; i++)
	{
		v = in[i];
		if (v == lfu[1])
		{
			i++;
			if (i == n) return -1;

			v = in[i];
			if ((v < 1) || (v > 2)) return -1;

			outlen++;
		}
		else outlen++;
	}

	if (outlen == 0) return -1;

	out = malloc(outlen);
	if (out == NULL) return -1;

	j = 0;
	for (i = 2; i < n; i++)
	{
		v = in[i];
		if (v == lfu[0])
		{
			out[j++] = 0;
		}
		else if (v == lfu[1])
		{
			i++;
			v = in[i];
			out[j++] = lfu[v - 1];
		}
		else out[j++] = v;
	}

	*len = outlen;
	*buf = out;
	return 0;
}

#pragma mark -
#pragma mark time parsing

/*
 * utility for converting a time string into a time_t
 * we only deal with the following formats:
 * dotted form YYYY.MM.DD hh:mm:ss UTC
 * ctime() form Mth dd hh:mm:ss (e.g. Aug 25 09:54:37)
 * absolute form - # seconds since the epoch (e.g. 1095789191)
 * relative time - seconds before or after now (e.g. -300, +43200)
 * relative time - days/hours/minutes/seconds before or after now (e.g. -1d, +6h, +30m, -10s)
 * ISO8601 - YYYY[-]MM[-]DDTHH[:]MM[:]SS optionally followed by Z or +/-HH[[:]MM]
 */

/*
 * light(er)-weight replcaement (in place of regex) for asl_core_parse_time
 */

#define MFLAG_INCLUDE 0x00000001
#define MFLAG_EXCLUDE 0x00000002

#define DIGITS "0123456789"
#define WHITESPACE "	 "

#define SECONDS_PER_MINUTE 60
#define SECONDS_PER_HOUR 3600
#define SECONDS_PER_DAY 86400
#define SECONDS_PER_WEEK 604800

/*
 * Match between mincount and maxcount characters in or not in mset.
 * maxcount == 0 means no limit.
 *
 */
bool
asl_core_str_match(const char *target, const char *mset, uint32_t mincount, uint32_t maxcount, uint32_t flags, uint32_t *length)
{
	const char *x;
	uint32_t n;
	
	if (length == NULL) length = &n;
	
	if (target == NULL) return (mincount == 0);
	
	for (x = target, *length = 0; *x != '\0'; x++, *length = *length + 1)
	{
		char *s;
		
		if ((*length == maxcount) && (maxcount > 0)) return true;
		if (mset == NULL) continue;
		
		s = strchr(mset, *x);
		if ((s == NULL) && (flags & MFLAG_EXCLUDE)) continue;
		if ((s != NULL) && (flags & MFLAG_INCLUDE)) continue;
		
		break;
	}
	
	return (*length >= mincount);
}

bool
asl_core_str_match_char(const char *target, const char c, uint32_t mincount, uint32_t flags, uint32_t *length)
{
	uint32_t n;
	
	if (length == NULL) length = &n;
	*length = 0;
	
	if (target == NULL) return (mincount == 0);
	
	if ((*target == c) && (flags & MFLAG_INCLUDE)) *length = 1;
	if ((*target != c) && (flags & MFLAG_EXCLUDE)) *length = 1;
	
	return (*length >= mincount);
}

uint32_t
asl_core_str_to_uint32(const char *target, uint32_t length)
{
	uint32_t i, d, out = 0;
	
	for (i = 0; i < length; i++)
	{
		d = target[i] - '0';
		out = (out * 10) + d;
	}
	
	return out;
}

static bool
asl_core_str_match_absolute_or_relative_time(const char *target, time_t *tval, uint32_t *tlen)
{
	uint32_t len;
	int32_t val, sign = 1;
	bool test;
	const char *p;
	time_t start = 0;
	
	if (target == NULL) return false;
	
	/* [+-] */
	p = target;
	test = asl_core_str_match(p, "+-", 0, 1, MFLAG_INCLUDE, &len);
	if (!test) return false;
	
	if (len == 1)
	{
		/* relative time */
		start = time(NULL);
		if (*p == '-') sign = -1;
	}
	
	/* [0-9]+ */
	p += len;
	test = asl_core_str_match(p, DIGITS, 1, 0, MFLAG_INCLUDE, &len);
	if (!test) return false;
	val = asl_core_str_to_uint32(p, len);
	
	/* [shmdw] */
	p += len;
	test = asl_core_str_match(p, "SsMmHhDdWw", 0, 1, MFLAG_INCLUDE, &len);
	if (!test) return false;
	
	if ((*p == 'M') || (*p == 'm')) val *= SECONDS_PER_MINUTE;
	else if ((*p == 'H') || (*p == 'h')) val *= SECONDS_PER_HOUR;
	else if ((*p == 'D') || (*p == 'd')) val *= SECONDS_PER_DAY;
	else if ((*p == 'W') || (*p == 'w')) val *= SECONDS_PER_WEEK;
	
	/* matched string must be followed by space, tab, newline (not counted in length) */
	p += len;
	if (*p != '\0')
	{
		test = asl_core_str_match(p, " \t\n", 1, 1, MFLAG_INCLUDE, &len);
		if (!test) return false;
	}
	
	if (tlen != NULL) *tlen = p - target;
	if (tval != NULL) *tval = start + (sign * val);
	
	return true;
}

static int
_month_num(const char *s)
{
	if (!strncasecmp(s, "jan", 3)) return  0;
	if (!strncasecmp(s, "feb", 3)) return  1;
	if (!strncasecmp(s, "mar", 3)) return  2;
	if (!strncasecmp(s, "apr", 3)) return  3;
	if (!strncasecmp(s, "may", 3)) return  4;
	if (!strncasecmp(s, "jun", 3)) return  5;
	if (!strncasecmp(s, "jul", 3)) return  6;
	if (!strncasecmp(s, "aug", 3)) return  7;
	if (!strncasecmp(s, "sep", 3)) return  8;
	if (!strncasecmp(s, "oct", 3)) return  9;
	if (!strncasecmp(s, "nov", 3)) return 10;
	if (!strncasecmp(s, "dec", 3)) return 11;
	return -1;
	
}

/*
 * Match ctime() format - Mth [D]D [h]h:mm:ss
 */
bool
asl_core_str_match_c_time(const char *target, time_t *tval, uint32_t *tlen)
{
	uint32_t len, y;
	bool test;
	const char *p;
	struct tm t;
	time_t now;
	
	if (target == NULL) return false;
	memset(&t, 0, sizeof(t));
	
	/* determine current date */
	now = time(NULL);
	localtime_r(&now, &t);
	y = t.tm_year;
	memset(&t, 0, sizeof(t));
	t.tm_year = y;
	
	/* Mth */
	p = target;
	t.tm_mon = _month_num(p);
	len = 3;
	if (t.tm_mon == -1) return false;
	
	/* whitespace */
	p += len;
	test = asl_core_str_match(p, WHITESPACE, 1, 0, MFLAG_INCLUDE, &len);
	if (!test) return false;
	
	/* [D]D */
	p += len;
	test = asl_core_str_match(p, DIGITS, 1, 2, MFLAG_INCLUDE, &len);
	if (!test) return false;
	t.tm_mday = asl_core_str_to_uint32(p, len);
	if (t.tm_mday > 31) return false;
	
	/* whitespace */
	p += len;
	test = asl_core_str_match(p, WHITESPACE, 1, 0, MFLAG_INCLUDE, &len);
	if (!test) return false;
	
	/* [h]h */
	p += len;
	test = asl_core_str_match(p, DIGITS, 1, 2, MFLAG_INCLUDE, &len);
	if (!test) return false;
	t.tm_hour = asl_core_str_to_uint32(p, len);
	if (t.tm_hour > 23) return false;
	
	/* : */
	p += len;
	if (*p != ':') return false;
	len = 1;
	
	/* mm */
	p += len;
	test = asl_core_str_match(p, DIGITS, 2, 2, MFLAG_INCLUDE, &len);
	if (!test) return false;
	t.tm_min = asl_core_str_to_uint32(p, len);
	if (t.tm_min > 59) return false;
	
	/* : */
	p += len;
	if (*p != ':') return false;
	len = 1;
	
	/* ss */
	p += len;
	test = asl_core_str_match(p, DIGITS, 2, 2, MFLAG_INCLUDE, &len);
	if (!test) return false;
	t.tm_sec = asl_core_str_to_uint32(p, len);
	if (t.tm_sec > 59) return false;
	
	/* matched string must be followed by space, tab, newline (not counted in length) */
	p += len;
	if (*p != '\0')
	{
		test = asl_core_str_match(p, " \t\n", 1, 1, MFLAG_INCLUDE, &len);
		if (!test) return false;
	}
	
	t.tm_isdst = -1;
	
	if (tlen != NULL) *tlen = p - target;
	if (tval != NULL) *tval = mktime(&t);
	
	return true;
}

/*
 * Match YYYY.[M]M.[D]D [h]h:mm:ss UTC
 */
static bool
asl_core_str_match_dotted_time(const char *target, time_t *tval, uint32_t *tlen)
{
	uint32_t len;
	bool test;
	const char *p;
	struct tm t;
	
	if (target == NULL) return false;
	memset(&t, 0, sizeof(t));
	
	/* YYYY */
	p = target;
	test = asl_core_str_match(p, DIGITS, 4, 4, MFLAG_INCLUDE, &len);
	if (!test) return false;
	t.tm_year = asl_core_str_to_uint32(p, len) - 1900;
	
	/* . */
	p += len;
	if (*p != '.') return false;
	len = 1;
	
	/* [M]M */
	p += len;
	test = asl_core_str_match(p, DIGITS, 1, 2, MFLAG_INCLUDE, &len);
	if (!test) return false;
	t.tm_mon = asl_core_str_to_uint32(p, len);
	if (t.tm_mon < 1) return false;
	if (t.tm_mon > 12) return false;
	t.tm_mon -= 1;
	
	/* . */
	p += len;
	if (*p != '.') return false;
	len = 1;
	
	/* [D]D */
	p += len;
	test = asl_core_str_match(p, DIGITS, 1, 2, MFLAG_INCLUDE, &len);
	if (!test) return false;
	t.tm_mday = asl_core_str_to_uint32(p, len);
	if (t.tm_mday > 31) return false;
	
	/* whitespace */
	p += len;
	test = asl_core_str_match(p, WHITESPACE, 1, 0, MFLAG_INCLUDE, &len);
	if (!test) return false;
	
	/* [h]h */
	p += len;
	test = asl_core_str_match(p, DIGITS, 1, 2, MFLAG_INCLUDE, &len);
	if (!test) return false;
	t.tm_hour = asl_core_str_to_uint32(p, len);
	if (t.tm_hour > 23) return false;
	
	/* : */
	p += len;
	if (*p != ':') return false;
	len = 1;
	
	/* mm */
	p += len;
	test = asl_core_str_match(p, DIGITS, 2, 2, MFLAG_INCLUDE, &len);
	if (!test) return false;
	t.tm_min = asl_core_str_to_uint32(p, len);
	if (t.tm_min > 59) return false;
	
	/* : */
	p += len;
	if (*p != ':') return false;
	len = 1;
	
	/* ss */
	p += len;
	test = asl_core_str_match(p, DIGITS, 2, 2, MFLAG_INCLUDE, &len);
	if (!test) return false;
	t.tm_sec = asl_core_str_to_uint32(p, len);
	if (t.tm_sec > 59) return false;
	
	/* whitespace */
	p += len;
	test = asl_core_str_match(p, WHITESPACE, 1, 0, MFLAG_INCLUDE, &len);
	if (!test) return false;
	
	/* UTC */
	p += len;
	if (strncmp(p, "UTC", 3)) return false;
	len = 3;
	
	/* matched string must be followed by space, tab, newline (not counted in length) */
	p += len;
	if (*p != '\0')
	{
		test = asl_core_str_match(p, " \t\n", 1, 1, MFLAG_INCLUDE, &len);
		if (!test) return false;
	}
	
	if (tlen != NULL) *tlen = p - target;
	if (tval != NULL) *tval = timegm(&t);
	
	return true;
}

/*
 * Match YYYY[-]MM[-]DD[Tt]hh[:]hh[:]ss[Zz] or YYYY[-]MM[-]DD[Tt]hh[:]hh[:]ss[+-][H]H[[:]MM]
 */
static bool
asl_core_str_match_iso_8601_time(const char *target, time_t *tval, uint32_t *tlen)
{
	uint32_t len;
	bool test;
	const char *p;
	struct tm t;
	int32_t tzh, tzs, sign = -1;
	
	if (target == NULL) return false;
	memset(&t, 0, sizeof(t));
	
	/* YYYY */
	p = target;
	test = asl_core_str_match(p, DIGITS, 4, 4, MFLAG_INCLUDE, &len);
	if (!test) return false;
	t.tm_year = asl_core_str_to_uint32(p, len) - 1900;
	
	/* [-] */
	p += len;
	test = asl_core_str_match_char(p, '-', 0, MFLAG_INCLUDE, &len);
	if (!test) return false;
	
	/* MM */
	p += len;
	test = asl_core_str_match(p, DIGITS, 2, 2, MFLAG_INCLUDE, &len);
	if (!test) return false;
	t.tm_mon = asl_core_str_to_uint32(p, len);
	if (t.tm_mon < 1) return false;
	if (t.tm_mon > 12) return false;
	t.tm_mon -= 1;
	
	/* [-] */
	p += len;
	test = asl_core_str_match_char(p, '-', 0, MFLAG_INCLUDE, &len);
	if (!test) return false;
	
	/* DD */
	p += len;
	test = asl_core_str_match(p, DIGITS, 2, 2, MFLAG_INCLUDE, &len);
	if (!test) return false;
	t.tm_mday = asl_core_str_to_uint32(p, len);
	if (t.tm_mday > 31) return false;
	
	/* T or t */
	p += len;
	test = asl_core_str_match(p, "Tt", 1, 1, MFLAG_INCLUDE, &len);
	if (!test) return false;
	
	/* hh */
	p += len;
	test = asl_core_str_match(p, DIGITS, 2, 2, MFLAG_INCLUDE, &len);
	if (!test) return false;
	t.tm_hour = asl_core_str_to_uint32(p, len);
	if (t.tm_hour > 23) return false;
	
	/* [:] */
	p += len;
	test = asl_core_str_match_char(p, ':', 0, MFLAG_INCLUDE, &len);
	if (!test) return false;
	
	/* mm */
	p += len;
	test = asl_core_str_match(p, DIGITS, 2, 2, MFLAG_INCLUDE, &len);
	if (!test) return false;
	t.tm_min = asl_core_str_to_uint32(p, len);
	if (t.tm_min > 59) return false;
	
	/* [:] */
	p += len;
	test = asl_core_str_match_char(p, ':', 0, MFLAG_INCLUDE, &len);
	if (!test) return false;
	
	/* ss */
	p += len;
	test = asl_core_str_match(p, DIGITS, 2, 2, MFLAG_INCLUDE, &len);
	if (!test) return false;
	t.tm_sec = asl_core_str_to_uint32(p, len);
	if (t.tm_sec > 59) return false;
	
	p += len;
	
	/* default to local time if we hit the end of the string */
	if ((*p == '\0') || (*p == ' ') || (*p == '\t') || (*p == '\n'))
	{
		t.tm_isdst = -1;
		
		if (tlen != NULL) *tlen = p - target;
		if (tval != NULL) *tval = mktime(&t);
		
		return true;
	}
	
	/* Z, z, +, or - */
	test = asl_core_str_match(p, "Zz+-", 1, 1, MFLAG_INCLUDE, &len);
	if (!test) return false;
	
	if ((*p == 'Z') || (*p == 'z'))
	{
		/* matched string must be followed by space, tab, newline (not counted in length) */
		p += len;
		if (*p != '\0')
		{
			test = asl_core_str_match(p, " \t\n", 1, 1, MFLAG_INCLUDE, &len);
			if (!test) return false;
		}
		
		if (tlen != NULL) *tlen = p - target;
		if (tval != NULL) *tval = timegm(&t);
		
		return true;
	}
	
	if (*p == '-') sign = 1;
	
	/* [h]h */
	p += len;
	test = asl_core_str_match(p, DIGITS, 1, 2, MFLAG_INCLUDE, &len);
	if (!test) return false;
	tzh = asl_core_str_to_uint32(p, len);
	if (tzh > 23) return false;
	
	/* [:] */
	p += len;
	test = asl_core_str_match_char(p, ':', 0, MFLAG_INCLUDE, &len);
	if (!test) return false;
	
	/* mm */
	p += len;
	test = asl_core_str_match(p, DIGITS, 0, 2, MFLAG_INCLUDE, &len);
	if (!test) return false;
	tzs = asl_core_str_to_uint32(p, len);
	if (tzs > 59) return false;
	
	t.tm_sec += (sign * (tzh * SECONDS_PER_HOUR) + (tzs * SECONDS_PER_MINUTE));
	
	/* matched string must be followed by space, tab, newline (not counted in length) */
	p += len;
	if (*p != '\0')
	{
		test = asl_core_str_match(p, " \t\n", 1, 1, MFLAG_INCLUDE, &len);
		if (!test) return false;
	}
	
	if (tlen != NULL) *tlen = p - target;
	if (tval != NULL) *tval = timegm(&t);
	
	return true;
}

time_t
asl_core_parse_time(const char *in, uint32_t *tlen)
{
	time_t tval = 0;
	uint32_t inlen;
	
	if (tlen != NULL) *tlen = 0;

	if (in == NULL) return -1;
	
	/*
	 * Heuristics to determine the string format.
	 * Warning: this code must be checked and may need to be adjusted if new formats are added.
	 */
	inlen = strlen(in);
	if (inlen == 0) return -1;
	
	/* leading plus or minus means it must be a relative time */
	if ((in[0] == '+') || (in[0] == '-'))
	{
		if (asl_core_str_match_absolute_or_relative_time(in, &tval, tlen)) return tval;
		return -1;
	}
	
	/* leading alphabetic char means it must be ctime() format */
	if (((in[0] >= 'a') && (in[0] <= 'z')) || ((in[0] >= 'A') && (in[0] <= 'Z')))
	{
		if (asl_core_str_match_c_time(in, &tval, tlen)) return tval;
		return -1;
	}
	
	/* only absolute, dotted, or iso8601 formats at this point */
	
	/* one to for chars means it must be absolute */
	if (inlen < 5)
	{
		if (asl_core_str_match_absolute_or_relative_time(in, &tval, tlen)) return tval;
		return -1;
	}
	
	/* check for dot */
	if (in[4] == '.')
	{
		if (asl_core_str_match_dotted_time(in, &tval, tlen)) return tval;
		return -1;
	}
	
	/* only absolute or iso8601 at this point */
	
	/* check for absolute first, since that's quicker */
	if (asl_core_str_match_absolute_or_relative_time(in, &tval, tlen)) return tval;
	
	if (asl_core_str_match_iso_8601_time(in, &tval, tlen)) return tval;
	
	return -1;
}

/*
 * asl_parse_time is old SPI used all over the place.
 */
time_t
asl_parse_time(const char *in)
{
	return asl_core_parse_time(in, NULL);
}