Graylog2 / Graylog2/graylog2-server

Incorrect Syslog RFC5424 Structured Data parsing

Open
#18,888 0 comments 0 reactions 0 assignees View on GitHub
bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

When we send structured data over a syslog connection, backslash character is deleted (even if escaped by another backslash).

## Expected Behavior
Escaped backslashes (ie. \\\\) should be correctly interpreted as a single backslash

RFC5424
Inside PARAM-VALUE, the characters '"' (ABNF %d34), '\\' (ABNF %d92), and ']' (ABNF %d93) MUST be escaped. This is necessary to avoid parsing errors. Escaping ']' would not strictly be necessary but is REQUIRED by this specification to avoid syslog application implementation errors. Each of these three characters MUST be escaped as '\\"', '\\\\', and '\\]' respectively.
The backslash is used for control character escaping for consistency with its use for escaping in other parts of the syslog message as well as in traditional syslog.
A backslash ('\\') followed by none of the three described characters is considered an invalid escape sequence. In this case, the backslash MUST be treated as a regular backslash and the following character as a regular character. Thus, the invalid sequence MUST not be altered.

## Current Behavior
Regardless of the number of backslashes we send in a structured data, they are deleted.
Ie. "C:\\\\Program Files\\\\MyFile" becomes "C:Program FilesMyFile"
Ie. "C:\\Program Files\\MyFile" becomes "C:Program FilesMyFile"

## Possible Solution
No workaround has been found yet

## Steps to Reproduce (for bugs)
Send RFC5424 structured data that contains \\ or \\\\ characters.

## Context
Receive fully compliant RFC5424 syslog messages

## Your Environment
* Graylog Version: v5.2.3 but also seen in v4.x
* Java Version: Graylog container
* OpenSearch Version: 2.11.1
* MongoDB Version: 5.0.23
* Operating System: Graylog container
* Browser version: Chromium 123

## Possible cause
In https://github.com/graylog-labs/syslog4j-graylog2/blob/master/src/main/java/org/graylog2/syslog4j/impl/message/structured/StructuredSyslogMessage.java#L348, I see a function **'unescape'** that removes all backslashes.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.