Repository navigation
parser_syslog, in_syslog: fix handling of a priority on a later line - #5598
Merged
Merged
Conversation
… message The regexps that look for the PRI started with `^`, which matches at the start of any line. When the first line of a message was not a syslog header, the parser started from a later line that looked like one and silently dropped the text before it. `message_format auto` could also detect an RFC3164 message as RFC5424 from its second line. Anchor them with `\A` so a message without a header at its start is rejected, as `parser_engine string` already does. Signed-off-by: Lucas Barros <lucasbarros.kam@gmail.com>
Watson1978
added
the
backport to v1.19
Watson1978
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Which issue(s) this PR fixes:
Fixes #5593
What this PR does / why we need it:
RFC5424_PRI_REGEXP,RFC3164_PRI_REGEXPandREGEXP_DETECT_RFC5424inparser_syslog, andSYSLOG_REGEXPinin_syslog, started with^. Since^matches at the start of any line, a message whose first line is not a syslog header was parsed from a later line that looks like one, and the text before it was dropped without a warning. Withmessage_format auto, a message starting with an RFC3164 header could be detected as RFC5424 because of its second line.This PR anchors the four regexps with
\A, so the header is only looked for at the start of the message. Such messages are now rejected (and emitted asunmatched_linebyin_syslogwithemit_unmatched_lines true), which is whatparser_engine stringalready does. As noted in the issue, a message that starts with an empty line is also rejected now, the same as with the string parser.Tests:
test_priority_on_a_later_line_is_rejected: the RFC5424, RFC3164 and auto inputs from the issue, for both engines. On master the 3 regexp rows fail.test_auto_detects_rfc3164_when_a_later_line_looks_like_rfc5424: on master the regexp row parses the second line as RFC5424 and the string row raisesTimeParseError.test_priority_on_a_later_line_is_unmatched_when_input_parses_priorityintest_in_syslog.rb:<parse> @type nonewithfirst line\n<14>second line. On master it emits{"message":"second line"}.test/plugin/test_parser_syslog.rbandtest/plugin/test_in_syslog.rbpass locally (Ruby 4.0, macOS).Docs Changes:
N/A
Release Note:
parser_syslog, in_syslog: fix handling of a priority on a later line
A priority on a later line was used as the priority of the message, and the text before it was dropped. Such messages are now treated as unmatched.