That way we are sure we have the current state still in the table. Also,
when deleting several days old events, we still have recent history.
This is to prevent the last event of too long active client from
dropping out.

In addition to keeping the current state in active_plugins, log the
history of changes into plugin_history. These tables are related in a
way that the last event for given client and plugin shall correspond to
the current state in active_clients.

Create the table for the plugin history storage. Update the clean up
script, so the history is cleaned up accordingly.

Make sure the client string is in lower-case before looking that up in a
dictionary.

With SELECT *, it is impossible to drop columns (needed during migration
to new data types).

Don't rollback the database when we don't use transactions (they are
useless here, with single select being done to refresh again and again).

Also, don't recycle the cursor, clean it up (it is reportedly better for
the DB).

So the main thread can still answer queries and not get blocked.

Refresh the data from DB every 15 minutes. If it fails, try again next
time.

So we don't access the DB all the time.

Some data come from attacker. And not all attackers know that passwords
should be in UTF8, so accept everything simply as raw data.

Allow changing the size of an IPset. The infrastructure should be able
to handle it now.

Ensure the inet→text conversion in build_fwup_sets.pl doesn't produce
/32 at the end, as ucollect master doesn't handle that.

Don't try to create the IPset if it already exists. It may be of wrong
size (which will be fixed on the refill). Also, recreate IPsets if they
are missing on refill (may be caused by a queue breakage during setup)
and handle leftover temporary sets.

Use sanity instead of assert in the fake plugin

Use a class variable where appropriate instead of overriding it in each
object.

Keep the attackers that drop out of the fake logs still blocked if they
get caught on the firewall. Do so by scanning the firewall logs for
addresses we would like to delete from the filter.

Sanity reports an error to logs, which may help us debug some of the
problems and crashes.

Also, fix result check at getsockname.

So we generate logout before the new login.

Recover from broken DB connection even if it happens in the
__connection.cursor()

Newer uci mandates flags are before commands. Older one doesn't mind
either way.

In case ipset terminates with error, wait with closing the output until
EOF comes. Closing it right away may cause losing error messages.

When the set size needs to be updated, warn about it, as the firewall
definitions need to be updated.

The firewall rules use names ending with _X, the plain ones are the
temporary sets.

These are filled with bare IP addresses for now. We need them for the
same purpose we had net:ip ones, but there needs to be interoperability
with firewall scripts and these use hash:net.

And try to make the chance of reaching the ipset max name length limit
(31 chars) smaller. We actually hit the limit in practice.

Make the timeout for reload of the sets longer. In case there's some
serious problem (like kmod-ipset not loaded), it wouldn't clutter logs
this way, but if it is recoverable, it'd recover after relatively short
time anyway.