From: Willy Tarreau <w@1wt.eu>
Date: Tue, 6 Sep 2011 06:11:27 +0000 (+0200)
Subject: [MINOR] halog: support backslash-escaped quotes
X-Git-Tag: v1.5-dev8~130
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=61a40c7402dba11951e116a5789627162befaf62;p=thirdparty%2Fhaproxy.git

[MINOR] halog: support backslash-escaped quotes

Some syslog servers escape quotes, which make the resulting logs unusable
for URL processing since the parser looks for the first field beginning
with a quote. It now supports also fields starting with backslash and
quote in order to address this. No performance impact was measured.
---

diff --git a/contrib/halog/halog.c b/contrib/halog/halog.c
index 39e4320c84..32ca670993 100644
--- a/contrib/halog/halog.c
+++ b/contrib/halog/halog.c
@@ -1127,8 +1127,12 @@ void filter_count_url(const char *accept_field, const char *time_field, struct t
 	 * if there's nothing else.
 	 */
 	e = field_start(e, METH_FIELD - TIME_FIELD + 1); // avg 100 ns per line
-	while (*e != '"' && *e)
+	while (*e != '"' && *e) {
+		/* Note: some syslog servers escape quotes ! */
+		if (*e == '\\' && e[1] == '"')
+			break;
 		e = field_start(e, 2);
+	}
 
 	if (unlikely(!*e)) {
 		truncated_line(linenum, line);