Still parse messages that don't contain an RFC 3164 timestamp.

The changes made in r326573 required that messages always start with an
RFC 3164 timestamp. It looks like certain devices, but also certain
logging libraries (Python 3's "logging" package) simply don't generate
RFC 3164 formatted messages containing a timestamp.

Make timestamps optional again. When the timestamp is missing, also
assume that the message contains no hostname. The first word of the
message likely already belongs to the message payload.

PR:		229236
Reported by:	Michael Grimm & Marek Zarychta
Reviewed by:	glebius (cursory)
MFC after:	1 week

1 files changed, 57 insertions, 55 deletions

diff --git a/usr.sbin/syslogd/syslogd.c b/usr.sbin/syslogd/syslogd.c
index afa83a4164a4..c61abde9dfb0 100644
--- a/usr.sbin/syslogd/syslogd.c
+++ b/usr.sbin/syslogd/syslogd.c
@@ -1172,68 +1172,70 @@ parsemsg_rfc3164(const char *from, int pri, char *msg)
 	size_t i, msglen;
 	char line[MAXLINE + 1];
 
-	/* Parse the timestamp provided by the remote side. */
-	if (strptime(msg, RFC3164_DATEFMT, &tm_parsed) !=
-	    msg + RFC3164_DATELEN || msg[RFC3164_DATELEN] != ' ') {
-		dprintf("Failed to parse TIMESTAMP from %s: %s\n", from, msg);
-		return;
-	}
-	msg += RFC3164_DATELEN + 1;
+	/*
+	 * Parse the TIMESTAMP provided by the remote side. If none is
+	 * found, assume this is not an RFC 3164 formatted message,
+	 * only containing a TAG and a MSG.
+	 */
+	timestamp = NULL;
+	if (strptime(msg, RFC3164_DATEFMT, &tm_parsed) ==
+	    msg + RFC3164_DATELEN && msg[RFC3164_DATELEN] == ' ') {
+		msg += RFC3164_DATELEN + 1;
+		if (!RemoteAddDate) {
+			struct tm tm_now;
+			time_t t_now;
+			int year;
 
-	if (!RemoteAddDate) {
-		struct tm tm_now;
-		time_t t_now;
-		int year;
+			/*
+			 * As the timestamp does not contain the year
+			 * number, daylight saving time information, nor
+			 * a time zone, attempt to infer it. Due to
+			 * clock skews, the timestamp may even be part
+			 * of the next year. Use the last year for which
+			 * the timestamp is at most one week in the
+			 * future.
+			 *
+			 * This loop can only run for at most three
+			 * iterations before terminating.
+			 */
+			t_now = time(NULL);
+			localtime_r(&t_now, &tm_now);
+			for (year = tm_now.tm_year + 1;; --year) {
+				assert(year >= tm_now.tm_year - 1);
+				timestamp_remote.tm = tm_parsed;
+				timestamp_remote.tm.tm_year = year;
+				timestamp_remote.tm.tm_isdst = -1;
+				timestamp_remote.usec = 0;
+				if (mktime(&timestamp_remote.tm) <
+				    t_now + 7 * 24 * 60 * 60)
+					break;
+			}
+			timestamp = &timestamp_remote;
+		}
 
 		/*
-		 * As the timestamp does not contain the year number,
-		 * daylight saving time information, nor a time zone,
-		 * attempt to infer it. Due to clock skews, the
-		 * timestamp may even be part of the next year. Use the
-		 * last year for which the timestamp is at most one week
-		 * in the future.
-		 *
-		 * This loop can only run for at most three iterations
-		 * before terminating.
+		 * A single space character MUST also follow the HOSTNAME field.
 		 */
-		t_now = time(NULL);
-		localtime_r(&t_now, &tm_now);
-		for (year = tm_now.tm_year + 1;; --year) {
-			assert(year >= tm_now.tm_year - 1);
-			timestamp_remote.tm = tm_parsed;
-			timestamp_remote.tm.tm_year = year;
-			timestamp_remote.tm.tm_isdst = -1;
-			timestamp_remote.usec = 0;
-			if (mktime(&timestamp_remote.tm) <
-			    t_now + 7 * 24 * 60 * 60)
+		msglen = strlen(msg);
+		for (i = 0; i < MIN(MAXHOSTNAMELEN, msglen); i++) {
+			if (msg[i] == ' ') {
+				if (RemoteHostname) {
+					msg[i] = '\0';
+					from = msg;
+				}
+				msg += i + 1;
 				break;
-		}
-		timestamp = &timestamp_remote;
-	} else
-		timestamp = NULL;
-
-	/*
-	 * A single space character MUST also follow the HOSTNAME field.
-	 */
-	msglen = strlen(msg);
-	for (i = 0; i < MIN(MAXHOSTNAMELEN, msglen); i++) {
-		if (msg[i] == ' ') {
-			if (RemoteHostname) {
-				msg[i] = '\0';
-				from = msg;
 			}
-			msg += i + 1;
-			break;
+			/*
+			 * Support non RFC compliant messages, without hostname.
+			 */
+			if (msg[i] == ':')
+				break;
+		}
+		if (i == MIN(MAXHOSTNAMELEN, msglen)) {
+			dprintf("Invalid HOSTNAME from %s: %s\n", from, msg);
+			return;
 		}
-		/*
-		 * Support non RFC compliant messages, without hostname.
-		 */
-		if (msg[i] == ':')
-			break;
-	}
-	if (i == MIN(MAXHOSTNAMELEN, msglen)) {
-		dprintf("Invalid HOSTNAME from %s: %s\n", from, msg);
-		return;
 	}
 
 	/* Remove the TAG, if present. */