Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[pkg/stanza] Fix issue where syslog octet parsing could truncate token #27294

Merged
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions .chloggen/pkg-stanza-syslog-octen-split.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
# Use this changelog template to create an entry for release notes.

# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
change_type: bug_fix

# The name of the component, or a single word describing the area of concern, (e.g. filelogreceiver)
component: syslogreceiver

# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
note: Fix issue where long tokens would be truncated prematurely

# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists.
issues: [27294]

# (Optional) One or more lines of additional information to render under the primary note.
# These lines will be padded with 2 spaces and then inserted directly into the document.
# Use pipe (|) for multiline entries.
subtext:

# If your change doesn't affect end users or the exported elements of any package,
# you should instead start your pull request title with [chore] or use the "Skip Changelog" label.
# Optional: The change log or logs in which this entry should be included.
# e.g. '[user]' or '[user, api]'
# Include 'user' if the change is relevant to end users.
# Include 'api' if there is a change to a library API.
# Default: '[user]'
change_logs: []
28 changes: 13 additions & 15 deletions pkg/stanza/operator/input/syslog/syslog.go
Original file line number Diff line number Diff line change
Expand Up @@ -150,34 +150,32 @@ func OctetSplitFuncBuilder(_ encoding.Encoding) (bufio.SplitFunc, error) {

func newOctetFrameSplitFunc(flushAtEOF bool) bufio.SplitFunc {
frameRegex := regexp.MustCompile(`^[1-9]\d*\s`)
return func(data []byte, atEOF bool) (advance int, token []byte, err error) {
return func(data []byte, atEOF bool) (int, []byte, error) {
frameLoc := frameRegex.FindIndex(data)
if frameLoc == nil {
// Flush if no more data is expected
if len(data) != 0 && atEOF && flushAtEOF {
token = data
advance = len(data)
return
return len(data), data, nil
}
return 0, nil, nil
}

frameMaxIndex := frameLoc[1]
// delimit space between length and log
// Remove the delimiter (space) between length and log, and parse the length
frameLenValue, err := strconv.Atoi(string(data[:frameMaxIndex-1]))
if err != nil {
return 0, nil, err // read more data and try again.
// This should not be possible because the regex matched.
// However, return an error just in case.
return 0, nil, err
}

advance = frameMaxIndex + frameLenValue
// the limitation here is that we can only line split within a single buffer
// the context of buffer length cannot be pass onto the next scan
capacity := cap(data)
if advance > capacity {
return capacity, data, nil
advance := frameMaxIndex + frameLenValue
if advance > len(data) {
if atEOF && flushAtEOF {
return len(data), data, nil
}
return 0, nil, nil
}
token = data[:advance]
err = nil
return
return advance, data[:advance], nil
}
}
3 changes: 1 addition & 2 deletions pkg/stanza/operator/input/syslog/syslog_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -243,8 +243,7 @@ func TestOctetFramingSplitFunc(t *testing.T) {
return newRaw
}(),
ExpectedTokens: []string{
`5000 ` + string(splittest.GenerateBytes(4091)),
`j`,
`5000 ` + string(splittest.GenerateBytes(4092)),
},
},
}
Expand Down