fluent-bit icon indicating copy to clipboard operation
fluent-bit copied to clipboard

in_syslog: fix null byte handling in message parsing

Open niedbalski opened this issue 5 months ago • 3 comments

Description

Null bytes in syslog messages are incorrectly treated as message delimiters, causing message fragmentation and parser errors. This violates RFC 6587 section 3.4.1 which specifies that for octet-counting framing, only the calculated length determines message boundaries, and section 3.4.2 which specifies newline as the delimiter for non-transparent framing.

Current behaviour

When a syslog message contains a null byte, the parser treats it as a message boundary:

[ warn] [input:syslog:syslog.0] error parsing log message with parser 'syslog-rfc5424'
[debug] [input:syslog:syslog.0] unparsed log message:  byte
  • Message gets split at the null byte position
  • First part gets processed normally
  • Second part fails to parse (invalid syslog format)
  • Results in parser errors and log spam

Expected behaviour

Null bytes should be preserved in message content and not treated as delimiters:

  • Complete message gets processed as single unit
  • Null byte preserved in final parsed message
  • No parser errors or message fragmentation

Changes

Modified syslog_prot_process() to skip null bytes when scanning for message boundaries, only treating newlines as delimiters per RFC 6587 section 3.4.2.

Fixes #2741

niedbalski avatar Jun 05 '25 10:06 niedbalski