mirror of
https://github.com/domainaware/parsedmarc.git
synced 2026-07-29 03:44:54 +00:00
Sean WhalenandClaude Fable 5
95e881bdb3
Review findings verified against the parsedmarc serializers, the UDM
field list, Google's parser troubleshooting doc, and the content-hub
parsers:
- Detect failure reports by feedback_type OR arrival_date_utc: the
text-format failure path synthesizes a feedback report with no
Feedback-Type field, so those rows had no feedback_type key and were
dropped as TAG_UNSUPPORTED.
- Detect SMTP TLS rows by policy_type OR result_type, and fall back to
receiving_mx_hostname for target.hostname, so failure-detail rows from
parsedmarc versions without the paired serializer fix still map.
- Merge (not replace) network.email.to and network.email.subject: both
are repeated fields per the UDM field list, so a scalar replace is a
type mismatch. The unguarded subject replace could have failed parsing
for every failure event with a subject.
- Guard testing with != "": parsedmarc emits the RFC 9990 t= flag as the
string "y"/"n", not a boolean, so the == "true"/"false" test could
never fire and dmarc_testing was never emitted. Drop testing from the
boolean convert list accordingly.
- Add on_error to the four numeric %{} interpolations (count,
source_asn, *_session_count) so a tenant where interpolating a
non-string field errors degrades to a missing additional.fields entry
instead of _failed_parsing_ (per the official parser tips doc).
- Drop the concatenated security_result.description strings: the tips
doc says not to pack multiple values into one UDM field, and every
value already lands individually in additional.fields.
- Use TAG_MALFORMED_MESSAGE for non-JSON input, matching the tips doc's
canonical not-JSON example (TAG_MALFORMED_ENCODING is for character
encoding problems).
- Map org_extra_contact_info/errors (aggregate) and the source
enrichment fields (failure) into additional.fields; the failure branch
previously dropped enrichment the aggregate branch kept.
- Replace the SMTP TLS success sample, which was not generated from this
repository's samples, with rfc8460.json output; regenerate all sample
events with the fixed serializer and name each event's source sample
file. All six samples are now byte-identical to real syslog output.
- Reorder the validation plan to start with the failure sample: it is
the only shape that emits JSON nulls, whose json{} interaction with
the pre-initialized "" fields is undocumented.
- Update Google doc links to docs.cloud.google.com (the old URLs 301)
and link the parser from the syslog section of the usage docs.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>