journal: check filtering after parsing timestamp, identifier, pid, and so on

Otherwise, filtering regex with '^' does not work.

Fixes a bug in 87a13dabbd81c2e31fd5ac7b81cce61baf23e59c (v253).
Fixes #38361.

(cherry picked from commit c60a16ba8fa2a57af23f7653fd2316c26e06c577)

diff --git a/src/journal/journald-syslog.c b/src/journal/journald-syslog.c
index 867039b0906fc428c9021055602b631069ab0e13..c04115ab9f11e3834a797f8f038c9acdc1fdd1d7 100644 (file)
--- a/src/journal/journald-syslog.c
+++ b/src/journal/journald-syslog.c
@@ -374,9 +374,6 @@ void server_process_syslog_message(
         if (!client_context_test_priority(context, priority))
                 return;
 
-        if (client_context_check_keep_log(context, msg, strlen(msg)) <= 0)
-                return;
-
         syslog_ts = msg;
         syslog_ts_len = syslog_skip_timestamp(&msg);
         if (syslog_ts_len == 0)
@@ -385,6 +382,9 @@ void server_process_syslog_message(
 
         syslog_parse_identifier(&msg, &identifier, &pid);
 
+        if (client_context_check_keep_log(context, msg, strlen(msg)) <= 0)
+                return;
+
         if (s->forward_to_syslog)
                 forward_syslog_raw(s, priority, buf, raw_len, ucred, tv);