Non-transparent transport of syslog messages

Gopkg.toml

@@ -72,7 +72,7 @@
 
 [[constraint]]
   name = "github.com/influxdata/go-syslog"
-  version = "1.0.1"
+  branch = "feature/rfc6587"
 
 [[constraint]]
   name = "github.com/influxdata/tail"

plugins/inputs/syslog/README.md

@@ -2,7 +2,8 @@
 
 The syslog plugin listens for syslog messages transmitted over
 [UDP](https://tools.ietf.org/html/rfc5426) or
-[TCP](https://tools.ietf.org/html/rfc5425).
+[TCP](https://tools.ietf.org/html/rfc6587) or
+[TLS](https://tools.ietf.org/html/rfc5425), with or without the octet counting framing.
 
 Syslog messages should be formatted according to
 [RFC 5424](https://tools.ietf.org/html/rfc5424).
@@ -37,6 +38,16 @@ Syslog messages should be formatted according to
   ## 0 means unlimited.
   # read_timeout = "5s"
 
+  ## The framing technique with which it is expected that messages are transported (default = "octet-counting").
+  ## Whether the messages come using the octect-counting (RFC5425#section-4.3.1, RFC6587#section-3.4.1),
+  ## or the non-transparent framing technique (RFC6587#section-3.4.2).
+  ## Must be one of "octect-counting", "non-transparent".
+  # framing = "octet-counting"
+
+  ## The trailer to be expected in case of non-trasparent framing (default = "LF").
+  ## Must be one of "LF", or "NUL".
+  # trailer = "LF"
+
   ## Whether to parse in best effort mode or not (default = false).
   ## By default best effort parsing is off.
   # best_effort = false
@@ -49,11 +60,18 @@ Syslog messages should be formatted according to
   # sdparam_separator = "_"
 ```
 
-#### Best Effort
+#### Message transport
+
+The `framing` option only applies to streams. It governs the way we expect to receive messages within the stream.
+Namely, with the [`"octet counting"`](https://tools.ietf.org/html/rfc5425#section-4.3) technique (default) or with the [`"non-transparent"`](https://tools.ietf.org/html/rfc6587#section-3.4.2) framing.
+
+The `trailer` option only applies when `framing` option is `"non-transparent"`. It must have one of the following values: `"LF"` (default), or `"NUL"`.
+
+#### Best effort
 
 The [`best_effort`](https://github.com/influxdata/go-syslog#best-effort-mode)
 option instructs the parser to extract partial but valid info from syslog
-messages.  If unset only full messages will be collected.
+messages. If unset only full messages will be collected.
 
 #### Rsyslog Integration
 

plugins/inputs/syslog/commons_test.go

@@ -0,0 +1,62 @@
+package syslog
+
+import (
+	"github.com/influxdata/telegraf/internal"
+	"github.com/influxdata/telegraf/testutil"
+	"time"
+)
+
+var (
+	pki = testutil.NewPKI("../../../testutil/pki")
+)
+
+type testCasePacket struct {
+	name           string
+	data           []byte
+	wantBestEffort *testutil.Metric
+	wantStrict     *testutil.Metric
+	werr           bool
+}
+
+type testCaseStream struct {
+	name           string
+	data           []byte
+	wantBestEffort []testutil.Metric
+	wantStrict     []testutil.Metric
+	werr           int // how many errors we expect in the strict mode?
+}
+
+func newUDPSyslogReceiver(address string, bestEffort bool) *Syslog {
+	return &Syslog{
+		Address: address,
+		now: func() time.Time {
+			return defaultTime
+		},
+		BestEffort: bestEffort,
+		Separator:  "_",
+	}
+}
+
+func newTCPSyslogReceiver(address string, keepAlive *internal.Duration, maxConn int, bestEffort bool, framing framing) *Syslog {
+	d := &internal.Duration{
+		Duration: defaultReadTimeout,
+	}
+	s := &Syslog{
+		Address: address,
+		now: func() time.Time {
+			return defaultTime
+		},
+		Framing:     framing,
+		ReadTimeout: d,
+		BestEffort:  bestEffort,
+		Separator:   "_",
+	}
+	if keepAlive != nil {
+		s.KeepAlivePeriod = keepAlive
+	}
+	if maxConn > 0 {
+		s.MaxConnections = maxConn
+	}
+
+	return s
+}

plugins/inputs/syslog/framing.go

@@ -0,0 +1,46 @@
+package syslog
+
+import (
+	"fmt"
+	"strings"
+)
+
+type framing int
+
+const (
+	// OctetCounting indicates the transparent framing technique for syslog transport.
+	OctetCounting framing = iota
+	// NonTransparent indicates the non-transparent framing technique for syslog transport.
+	NonTransparent
+)
+
+func (f framing) String() string {
+	switch f {
+	case OctetCounting:
+		return "OCTET-COUNTING"
+	case NonTransparent:
+		return "NON-TRANSPARENT"
+	}
+	return ""
+}
+
+// UnmarshalText implements encoding.TextUnmarshaler
+func (f *framing) UnmarshalText(data []byte) (err error) {
+	s := string(data)
+	switch strings.ToUpper(s) {
+	case "OCTET-COUNTING":
+		*f = OctetCounting
+	case "NON-TRANSPARENT":
+		*f = NonTransparent
+	}
+	return err
+}
+
+// MarshalText implements encoding.TextMarshaler
+func (f framing) MarshalText() ([]byte, error) {
+	s := f.String()
+	if s != "" {
+		return []byte(s), nil
+	}
+	return nil, fmt.Errorf("unknown framing")
+}