diff options
| -rw-r--r-- | ChangeLog | 3 | ||||
| -rw-r--r-- | datetime.c | 17 | ||||
| -rw-r--r-- | datetime.h | 10 | ||||
| -rw-r--r-- | syslogd.c | 13 |
4 files changed, 34 insertions, 9 deletions
@@ -25,6 +25,9 @@ Version 3.18.4 (rgerhards), 2008-09-?? - bugfix: option value for legacy -a option could not be specified, resulting in strange operations. Thanks to Marius Tomaschewski for the patch. +- bugfix: colon after date should be ignored, but was not. This has + now been corrected. Required change to the internal ParseTIMESTAMP3164() + interface. --------------------------------------------------------------------------- Version 3.18.3 (rgerhards), 2008-08-18 - bugfix: imfile could cause a segfault upon rsyslogd HUP and termination @@ -265,10 +265,14 @@ ParseTIMESTAMP3339(struct syslogTime *pTime, char** ppszTS) * Returns TRUE on parse OK, FALSE on parse error. */ static int -ParseTIMESTAMP3164(struct syslogTime *pTime, char* pszTS) +ParseTIMESTAMP3164(struct syslogTime *pTime, char** ppszTS) { - assert(pTime != NULL); + char *pszTS; + + assert(ppszTS != NULL); + pszTS = *ppszTS; assert(pszTS != NULL); + assert(pTime != NULL); getCurrTime(pTime); /* obtain the current year and UTC offsets! */ @@ -435,13 +439,20 @@ ParseTIMESTAMP3164(struct syslogTime *pTime, char* pszTS) pTime->second = srSLMGParseInt32(&pszTS); if(pTime->second < 0 || pTime->second > 60) return FALSE; - if(*pszTS++ != ':') + + /* we provide support for an exter ":" after the date. While this is an + * invalid format, it occurs frequently enough (e.g. with Cisco devices) + * to permit it as a valid case. -- rgerhards, 2008-09-12 + */ + if(*pszTS++ == ':') + ++pszTS; /* OK, we actually have a 3164 timestamp, so let's indicate this * and fill the rest of the properties. */ pTime->timeType = 1; pTime->secfracPrecision = 0; pTime->secfrac = 0; + *ppszTS = pszTS; /* provide updated parse position back to caller */ return TRUE; } @@ -37,13 +37,19 @@ BEGINinterface(datetime) /* name must also be changed in ENDinterface macro! */ void (*getCurrTime)(struct syslogTime *t); //static int srSLMGParseInt32(char** ppsz); int (*ParseTIMESTAMP3339)(struct syslogTime *pTime, char** ppszTS); - int (*ParseTIMESTAMP3164)(struct syslogTime *pTime, char* pszTS); + int (*ParseTIMESTAMP3164)(struct syslogTime *pTime, char** pszTS); int (*formatTimestampToMySQL)(struct syslogTime *ts, char* pDst, size_t iLenDst); int (*formatTimestampToPgSQL)(struct syslogTime *ts, char *pDst, size_t iLenDst); int (*formatTimestamp3339)(struct syslogTime *ts, char* pBuf, size_t iLenBuf); int (*formatTimestamp3164)(struct syslogTime *ts, char* pBuf, size_t iLenBuf); ENDinterface(datetime) -#define datetimeCURR_IF_VERSION 1 /* increment whenever you change the interface structure! */ +#define datetimeCURR_IF_VERSION 2 /* increment whenever you change the interface structure! */ +/* interface changes: + * 1 - initial version + * 2 - not compatible to 1 - bugfix required ParseTIMESTAMP3164 to accept char ** as + * last parameter. Did not try to remain compatible as this is not something any + * third-party module should call. -- rgerhards, 2008.-09-12 + */ /* prototypes */ PROTOTYPEObj(datetime); @@ -1392,13 +1392,18 @@ static int parseLegacySyslogMsg(msg_t *pMsg, int flags) */ if(datetime.ParseTIMESTAMP3339(&(pMsg->tTIMESTAMP), &p2parse) == TRUE) { /* we are done - parse pointer is moved by ParseTIMESTAMP3339 */; - } else if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), p2parse) == TRUE) { - p2parse += 16; + } else if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), &p2parse) == TRUE) { + /* we are done - parse pointer is moved by ParseTIMESTAMP3164 */; } else if(*p2parse == ' ') { /* try to see if it is slighly malformed - HP procurve seems to do that sometimes */ - if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), p2parse+1) == TRUE) { + ++p2parse; /* move over space */ + if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), &p2parse) == TRUE) { /* indeed, we got it! */ - p2parse += 17; + /* we are done - parse pointer is moved by ParseTIMESTAMP3164 */; } else { + /* parse pointer needs to be restored, as we moved it off-by-one + * for this try. + */ + --p2parse; flags |= ADDDATE; } } else { |