From 18e1267d96bf37a3737d38885304a2dc1365abde Mon Sep 17 00:00:00 2001 From: Milan Bartos Date: Tue, 31 Jul 2012 17:16:51 +0200 Subject: fix problem with cutting first 16 characters from message with bAnnotate on modified: plugins/imuxsock/imuxsock.c --- plugins/imuxsock/imuxsock.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/plugins/imuxsock/imuxsock.c b/plugins/imuxsock/imuxsock.c index 76474724..2d9d4b5d 100644 --- a/plugins/imuxsock/imuxsock.c +++ b/plugins/imuxsock/imuxsock.c @@ -768,7 +768,11 @@ SubmitMsg(uchar *pRcv, int lenRcv, lstn_t *pLstn, struct ucred *cred, struct tim fixPID(bufParseTAG, &i, cred); MsgSetTAG(pMsg, bufParseTAG, i); - MsgSetMSGoffs(pMsg, pMsg->iLenRawMsg - lenMsg); + if (pLstn->bAnnotate) { + MsgSetMSGoffs(pMsg, pMsg->iLenRawMsg - lenMsg - 16); + } else { + MsgSetMSGoffs(pMsg, pMsg->iLenRawMsg - lenMsg); + } if(pLstn->bParseHost) { pMsg->msgFlags = pLstn->flags | PARSE_HOSTNAME; -- cgit From 6ed28016ca1a98f183f72d1d381a5027949ca965 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Tue, 16 Oct 2012 15:01:16 +0200 Subject: bugfix: imuxsock truncated head of received message This happened only under some circumstances. Thanks to Marius Tomaschwesky, Florian Piekert and Milan Bartos for their help in solving this issue. Note that Milan sent a patch, which solved the problem under some conditions (can be found somewhat earlier in git history). However, it did not handle the original root cause, and so did not fix the problem always. The main reason was that the date parser modifies the provided lenghts. That part of the API was not properly used by the caller (who decremented the length once more). --- ChangeLog | 4 ++++ plugins/imuxsock/imuxsock.c | 10 ++-------- 2 files changed, 6 insertions(+), 8 deletions(-) diff --git a/ChangeLog b/ChangeLog index 9574a84f..1edcb71f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,9 @@ --------------------------------------------------------------------------- Version 5.10.1 [V5-STABLE], 2012-0?-?? +- bugfix: imuxsock truncated head of received message + This happened only under some circumstances. Thanks to Marius + Tomaschwesky, Florian Piekert and Milan Bartos for their help in + solving this issue. - enable DNS resolution in imrelp Thanks to Apollon Oikonomopoulos for the patch - bugfix: invalid property name in property-filter could cause abort diff --git a/plugins/imuxsock/imuxsock.c b/plugins/imuxsock/imuxsock.c index 2d9d4b5d..cbb09b62 100644 --- a/plugins/imuxsock/imuxsock.c +++ b/plugins/imuxsock/imuxsock.c @@ -722,7 +722,7 @@ SubmitMsg(uchar *pRcv, int lenRcv, lstn_t *pLstn, struct ucred *cred, struct tim CHKiRet(msgConstructWithTime(&pMsg, &st, tt)); MsgSetRawMsg(pMsg, (char*)pRcv, lenRcv); parser.SanitizeMsg(pMsg); - lenMsg = pMsg->iLenRawMsg - offs; + lenMsg = pMsg->iLenRawMsg - offs; /* SanitizeMsg() may have changed the size */ MsgSetInputName(pMsg, pInputName); MsgSetFlowControlType(pMsg, pLstn->flowCtl); @@ -752,7 +752,6 @@ SubmitMsg(uchar *pRcv, int lenRcv, lstn_t *pLstn, struct ucred *cred, struct tim parse[15] = ' '; /* re-write \0 from fromatTimestamp3164 by SP */ /* update "counters" to reflect processed timestamp */ parse += 16; - lenMsg -= 16; } } @@ -767,12 +766,7 @@ SubmitMsg(uchar *pRcv, int lenRcv, lstn_t *pLstn, struct ucred *cred, struct tim if(pLstn->bWritePid) fixPID(bufParseTAG, &i, cred); MsgSetTAG(pMsg, bufParseTAG, i); - - if (pLstn->bAnnotate) { - MsgSetMSGoffs(pMsg, pMsg->iLenRawMsg - lenMsg - 16); - } else { - MsgSetMSGoffs(pMsg, pMsg->iLenRawMsg - lenMsg); - } + MsgSetMSGoffs(pMsg, pMsg->iLenRawMsg - lenMsg); if(pLstn->bParseHost) { pMsg->msgFlags = pLstn->flags | PARSE_HOSTNAME; -- cgit From a0c9fcfc77fb6b6bfa51a60760fd56a500f0083e Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Tue, 16 Oct 2012 15:19:49 +0200 Subject: doc: fix minor small but important typo in ChangeLog --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index db39911f..02555131 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,6 @@ --------------------------------------------------------------------------- Version 6.4.3 [V6-STABLE] 2012-??-?? -- change lumberjack cookie to "@cee" from "@cee " +- change lumberjack cookie to "@cee:" from "@cee: " CEE originally specified the cookie with SP, whereas other lumberjack tools used it without space. In order to keep interop with lumberjack, we now use the cookie without space as well. I hope this can be changed -- cgit