fluent-bit
fluent-bit copied to clipboard
in_syslog: fix null byte handling in message parsing
Description
Null bytes in syslog messages are incorrectly treated as message delimiters, causing message fragmentation and parser errors. This violates RFC 6587 section 3.4.1 which specifies that for octet-counting framing, only the calculated length determines message boundaries, and section 3.4.2 which specifies newline as the delimiter for non-transparent framing.
Current behaviour
When a syslog message contains a null byte, the parser treats it as a message boundary:
[ warn] [input:syslog:syslog.0] error parsing log message with parser 'syslog-rfc5424'
[debug] [input:syslog:syslog.0] unparsed log message: byte
- Message gets split at the null byte position
- First part gets processed normally
- Second part fails to parse (invalid syslog format)
- Results in parser errors and log spam
Expected behaviour
Null bytes should be preserved in message content and not treated as delimiters:
- Complete message gets processed as single unit
- Null byte preserved in final parsed message
- No parser errors or message fragmentation
Changes
Modified syslog_prot_process() to skip null bytes when scanning for message boundaries, only treating newlines as delimiters per RFC 6587 section 3.4.2.
Fixes #2741