bugfix: colon after date should be ignored, but was not.

This has now been corrected. Required change to the
internal ParseTIMESTAMP3164() interface.

4 files changed, 34 insertions, 9 deletions

diff --git a/ChangeLog b/ChangeLog
index 35041e63..5491c407 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -25,6 +25,9 @@ Version 3.18.4 (rgerhards), 2008-09-??
 - bugfix: option value for legacy -a option could not be specified,
   resulting in strange operations. Thanks to Marius Tomaschewski
   for the patch.
+- bugfix: colon after date should be ignored, but was not. This has
+  now been corrected. Required change to the internal ParseTIMESTAMP3164()
+  interface.
 ---------------------------------------------------------------------------
 Version 3.18.3 (rgerhards), 2008-08-18
 - bugfix: imfile could cause a segfault upon rsyslogd HUP and termination
diff --git a/datetime.c b/datetime.c
index a4817a6d..a178d14c 100644
--- a/datetime.c
+++ b/datetime.c
@@ -265,10 +265,14 @@ ParseTIMESTAMP3339(struct syslogTime *pTime, char** ppszTS)
  * Returns TRUE on parse OK, FALSE on parse error.
  */
 static int
-ParseTIMESTAMP3164(struct syslogTime *pTime, char* pszTS)
+ParseTIMESTAMP3164(struct syslogTime *pTime, char** ppszTS)
 {
-	assert(pTime != NULL);
+	char *pszTS;
+
+	assert(ppszTS != NULL);
+	pszTS = *ppszTS;
 	assert(pszTS != NULL);
+	assert(pTime != NULL);
 
 	getCurrTime(pTime);	/* obtain the current year and UTC offsets! */
 
@@ -435,13 +439,20 @@ ParseTIMESTAMP3164(struct syslogTime *pTime, char* pszTS)
 	pTime->second = srSLMGParseInt32(&pszTS);
 	if(pTime->second < 0 || pTime->second > 60)
 		return FALSE;
-	if(*pszTS++ != ':')
+
+	/* we provide support for an exter ":" after the date. While this is an
+	 * invalid format, it occurs frequently enough (e.g. with Cisco devices)
+	 * to permit it as a valid case. -- rgerhards, 2008-09-12
+	 */
+	if(*pszTS++ == ':')
+		++pszTS;
 
 	/* OK, we actually have a 3164 timestamp, so let's indicate this
 	 * and fill the rest of the properties. */
 	pTime->timeType = 1;
  	pTime->secfracPrecision = 0;
 	pTime->secfrac = 0;
+	*ppszTS = pszTS; /* provide updated parse position back to caller */
 	return TRUE;
 }
 
diff --git a/datetime.h b/datetime.h
index a35dfe8a..9e115583 100644
--- a/datetime.h
+++ b/datetime.h
@@ -37,13 +37,19 @@ BEGINinterface(datetime) /* name must also be changed in ENDinterface macro! */
 	void (*getCurrTime)(struct syslogTime *t);
 	//static int srSLMGParseInt32(char** ppsz);
 	int (*ParseTIMESTAMP3339)(struct syslogTime *pTime, char** ppszTS);
-	int (*ParseTIMESTAMP3164)(struct syslogTime *pTime, char* pszTS);
+	int (*ParseTIMESTAMP3164)(struct syslogTime *pTime, char** pszTS);
 	int (*formatTimestampToMySQL)(struct syslogTime *ts, char* pDst, size_t iLenDst);
 	int (*formatTimestampToPgSQL)(struct syslogTime *ts, char *pDst, size_t iLenDst);
 	int (*formatTimestamp3339)(struct syslogTime *ts, char* pBuf, size_t iLenBuf);
 	int (*formatTimestamp3164)(struct syslogTime *ts, char* pBuf, size_t iLenBuf);
 ENDinterface(datetime)
-#define datetimeCURR_IF_VERSION 1 /* increment whenever you change the interface structure! */
+#define datetimeCURR_IF_VERSION 2 /* increment whenever you change the interface structure! */
+/* interface changes:
+ * 1 - initial version
+ * 2 - not compatible to 1 - bugfix required ParseTIMESTAMP3164 to accept char ** as
+ *     last parameter. Did not try to remain compatible as this is not something any
+ *     third-party module should call. -- rgerhards, 2008.-09-12
+ */
 
 /* prototypes */
 PROTOTYPEObj(datetime);
diff --git a/syslogd.c b/syslogd.c
index a5483d80..6855a8a5 100644
--- a/syslogd.c
+++ b/syslogd.c
@@ -1392,13 +1392,18 @@ static int parseLegacySyslogMsg(msg_t *pMsg, int flags)
 	 */
 	if(datetime.ParseTIMESTAMP3339(&(pMsg->tTIMESTAMP), &p2parse) == TRUE) {
 		/* we are done - parse pointer is moved by ParseTIMESTAMP3339 */;
-	} else if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), p2parse) == TRUE) {
-		p2parse += 16;
+	} else if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), &p2parse) == TRUE) {
+		/* we are done - parse pointer is moved by ParseTIMESTAMP3164 */;
 	} else if(*p2parse == ' ') { /* try to see if it is slighly malformed - HP procurve seems to do that sometimes */
-		if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), p2parse+1) == TRUE) {
+		++p2parse;	/* move over space */
+		if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), &p2parse) == TRUE) {
 			/* indeed, we got it! */
-			p2parse += 17;
+			/* we are done - parse pointer is moved by ParseTIMESTAMP3164 */;
 		} else {
+			/* parse pointer needs to be restored, as we moved it off-by-one
+			 * for this try.
+			 */
+			--p2parse;
 			flags |= ADDDATE;
 		}
 	} else {