journal: check filtering after parsing timestamp, identifier, pid, and so on

Otherwise, filtering regex with '^' does not work.

Fixes a bug in 87a13dabbd81c2e31fd5ac7b81cce61baf23e59c (v253).
Fixes #38361.

diff --git a/src/journal/journald-syslog.c b/src/journal/journald-syslog.c
index 8e9c0e2b402ae32e7d0f4222c567b7790e125f04..277146d5932c93c8d27b1e45b2881d01512a1496 100644 (file)
--- a/src/journal/journald-syslog.c
+++ b/src/journal/journald-syslog.c
@@ -392,9 +392,6 @@ void manager_process_syslog_message(
         if (!client_context_test_priority(context, priority))
                 return;
 
-        if (client_context_check_keep_log(context, msg, strlen(msg)) <= 0)
-                return;
-
         syslog_ts = msg;
         syslog_ts_len = syslog_skip_timestamp(&msg);
         if (syslog_ts_len == 0)
@@ -403,6 +400,9 @@ void manager_process_syslog_message(
 
         syslog_parse_identifier(&msg, &identifier, &pid);
 
+        if (client_context_check_keep_log(context, msg, strlen(msg)) <= 0)
+                return;
+
         if (m->config.forward_to_syslog)
                 forward_syslog_raw(m, priority, buf, raw_len, ucred, tv);