From 3c4b083619e3917a541a1d5f96f7ec0eeaca3fdd Mon Sep 17 00:00:00 2001
From: Christopher Snell <chris.snell@gmail.com>
Date: Wed, 29 Jan 2014 16:26:41 -0800
Subject: [PATCH] Add parsing of RFC 5424-style packets

---
 server.go | 39 +++++++++++++++++++++++++++------------
 1 file changed, 27 insertions(+), 12 deletions(-)

diff --git a/server.go b/server.go
index a325fd9..bc311f8 100644
--- a/server.go
+++ b/server.go
@@ -99,7 +99,6 @@ func (s *Server) passToHandlers(m *Message) {
 }
 
 func (s *Server) receiver(c net.PacketConn) {
-	//q := (chan<- Message)(s.q)
 	buf := make([]byte, 1024)
 	for {
 		n, addr, err := c.ReadFrom(buf)
@@ -132,23 +131,39 @@ func (s *Server) receiver(c net.PacketConn) {
 		m.Severity = Severity(prio & 0x07)
 		m.Facility = Facility(prio >> 3)
 
+		hostnameOffset := 0
+		ts := time.Now()
+
 		// Parse header (if exists)
-		if hasPrio && len(pkt) >= 16 && pkt[15] == ' ' {
-			// Get timestamp
+		if hasPrio && len(pkt) >= 26 && pkt[25] == ' ' && pkt[15] != ' ' {
+			// OK, it looks like we're dealing with a RFC 5424-style packet
+			ts, err := time.Parse(time.RFC3339, string(pkt[:25]))
+			if err == nil && !ts.IsZero() {
+				// Time parsed correctly.  This is most certainly a RFC 5424-style packet.
+				// Hostname starts at pkt[26]
+				hostnameOffset = 26
+			}
+		} else if hasPrio && len(pkt) >= 16 && pkt[15] == ' ' {
+			// Looks like we're dealing with a RFC 3164-style packet
 			layout := "Jan _2 15:04:05"
 			ts, err := time.Parse(layout, string(pkt[:15]))
 			if err == nil && !ts.IsZero() {
-				// Get hostname
-				n = 16 + bytes.IndexByte(pkt[16:], ' ')
-				if n != 15 {
-					m.Timestamp = ts
-					m.Hostname = string(pkt[16:n])
-					pkt = pkt[n+1:]
-				}
+				// Time parsed correctly.   This is most certainly a RFC 3164-style packet.
+				hostnameOffset = 16
+			}
+		}
+
+		if hostnameOffset == 0 {
+			log.Printf("Packet did not parse correctly:\n%v\n", string(pkt[:]))
+		} else {
+			n = hostnameOffset + bytes.IndexByte(pkt[hostnameOffset:], ' ')
+			if n != hostnameOffset-1 {
+				m.Timestamp = ts
+				m.Hostname = string(pkt[hostnameOffset:n])
+				pkt = pkt[n+1:]
 			}
-			// TODO: check for version an new format of header as
-			// described in RFC 5424.
 		}
+		_ = hostnameOffset
 
 		// Parse msg part
 		msg := string(bytes.TrimRightFunc(pkt, isNulCrLf))