[syslog-ng]embedded newlines
Chuck Berg
syslog-ng@lists.balabit.hu
Mon, 23 Feb 2004 11:09:51 -0500
A message with an embedded newline will cause the next message to be mangled.
For example:
dream:~$ echo -ne '<27>test: test: foo\nfoo' | nc -u loghost 514
Produces this:
Feb 17 12:38:53 dream test: foo
Feb 17 12:38:54 xyzzy foo<38>Feb 17 12:38:54 sshd[18588]: Accepted publickey for nobody from 10.1.2.3 port 48651 ssh2
Where xyzzy is an innocent victim who just happened to send the next message.
I see that this has been discussed on the list several times over the past few
years. Is there no proper solution possible? Can't we just end the message at the
end of the packet (as if it was always null/newline terminated)?
It seems to me that no matter what the content of a message, it should not cause
another message to be mangled.