From b3819741a3d73b6662f4fcf2bedd49ef944f9195 Mon Sep 17 00:00:00 2001
From: Vadim Zhestikov <v.zhestikov@f5.com>
Date: Wed, 25 Mar 2026 10:24:04 -0700
Subject: [PATCH] Tests: add RFC 5424 syslog protocol version config parsing.

Test that the "rfc=" parameter of the syslog directive accepts
"rfc3164" and "rfc5424", and rejects unknown values.

Test the protocol-version-dependent tag validation: RFC 5424
(APP-NAME) allows hyphenated/dotted tags up to 48 printable
US-ASCII characters; RFC 3164 (TAG) restricts to alphanumeric
characters and underscore with a 32-character limit.
---
 t/syslog_rfc5424_config.t | 110 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 110 insertions(+)
 create mode 100644 t/syslog_rfc5424_config.t

diff --git a/t/syslog_rfc5424_config.t b/t/syslog_rfc5424_config.t
new file mode 100644
index 000000000..8c13b6044
--- /dev/null
+++ b/t/syslog_rfc5424_config.t
@@ -0,0 +1,110 @@
+#!/usr/bin/perl
+
+# (C) Nginx, Inc.
+
+# Tests for "rfc=" parameter of the syslog directive.
+# Uses "nginx -t" config-check mode; no server is started.
+
+###############################################################################
+
+use warnings;
+use strict;
+
+use Test::More;
+
+BEGIN { use FindBin; chdir($FindBin::Bin); }
+
+use lib 'lib';
+use Test::Nginx;
+
+###############################################################################
+
+select STDERR; $| = 1;
+select STDOUT; $| = 1;
+
+plan(skip_all => 'win32') if $^O eq 'MSWin32';
+
+my $t = Test::Nginx->new();
+
+###############################################################################
+
+# Write a minimal nginx.conf containing $syslog_param as a global error_log
+# directive and run "nginx -t" against it.  Returns combined stdout+stderr.
+
+sub config_check {
+	my ($syslog_param) = @_;
+
+	$t->write_file_expand('nginx.conf', <<"EOF");
+
+%%TEST_GLOBALS%%
+
+error_log $syslog_param info;
+
+daemon off;
+
+events {
+}
+
+EOF
+
+	my $testdir = $t->testdir();
+	return qx{$Test::Nginx::NGINX -t -p $testdir/ -c nginx.conf 2>&1};
+}
+
+###############################################################################
+
+my $out;
+
+# rfc=rfc3164 is the default and must be accepted explicitly.
+
+$out = config_check('syslog:server=127.0.0.1:5140,rfc=rfc3164');
+like($out, qr/test is successful/i, 'rfc=rfc3164 accepted');
+
+# rfc=rfc5424 must be accepted.
+
+$out = config_check('syslog:server=127.0.0.1:5140,rfc=rfc5424');
+like($out, qr/test is successful/i, 'rfc=rfc5424 accepted');
+
+# An unknown rfc= value must be rejected with a descriptive error.
+
+$out = config_check('syslog:server=127.0.0.1:5140,rfc=rfc9999');
+like($out, qr/unknown syslog "rfc" value/, 'rfc=rfc9999 rejected');
+
+# A hyphenated tag is printable ASCII and must be accepted with rfc5424.
+
+$out = config_check('syslog:server=127.0.0.1:5140,rfc=rfc5424,tag=my-app');
+like($out, qr/test is successful/i, 'rfc5424: hyphenated tag accepted');
+
+# The same hyphenated tag must be rejected with rfc3164.
+
+$out = config_check('syslog:server=127.0.0.1:5140,rfc=rfc3164,tag=my-app');
+like($out, qr/only allows alphanumeric/, 'rfc3164: hyphenated tag rejected');
+
+# A tag with a dot is printable ASCII and must be accepted with rfc5424.
+
+$out = config_check('syslog:server=127.0.0.1:5140,rfc=rfc5424,tag=nginx.1');
+like($out, qr/test is successful/i, 'rfc5424: dot in tag accepted');
+
+# A 33-character tag is within the rfc5424 limit (48) and must be accepted.
+
+my $tag33 = 'a' x 33;
+$out = config_check("syslog:server=127.0.0.1:5140,rfc=rfc5424,tag=$tag33");
+like($out, qr/test is successful/i, 'rfc5424: 33-char tag accepted');
+
+# The same 33-character tag exceeds the rfc3164 limit (32) and must fail.
+
+$out = config_check("syslog:server=127.0.0.1:5140,rfc=rfc3164,tag=$tag33");
+like($out, qr/tag length exceeds 32/, 'rfc3164: 33-char tag rejected');
+
+# A 49-character tag exceeds the maximum of both protocol versions (48).
+
+my $tag49 = 'a' x 49;
+$out = config_check("syslog:server=127.0.0.1:5140,rfc=rfc5424,tag=$tag49");
+like($out, qr/tag length exceeds 48/, 'rfc5424: 49-char tag rejected');
+
+$out = config_check("syslog:server=127.0.0.1:5140,rfc=rfc3164,tag=$tag49");
+like($out, qr/tag length exceeds 48/, 'rfc3164: 49-char tag rejected');
+
+done_testing;
+
+###############################################################################