Subject: [Syslog] RE: Null character

From: "Rainer Gerhards" <[email-masked]>
Date: Thu, 24 Nov 2005 23:06:54 +0100

Andrew:

Thanks for that info. I've to admit I've always overlooked this.
Eventually, this creates a new situation.

Do you think we should support NUL natively (I mean without escaping it,
e.g. in  <000> as your syslogd does currently)?

Rainer 

> -----Original Message-----
> From: Andrew Ross [mailto:[email-masked]] 
> Sent: Thursday, November 24, 2005 11:04 PM
> To: Rainer Gerhards; [email-masked]
> Subject: Null character
> 
> 
> Rainer,
> 
> FWIIW, I've seen Netscreen, NetGear and some LinkSys devices 
> send a Null
> character at the end of each message. Not all versions of the 
> firmware would
> include the Null at the end which leads me to believe it may 
> be a bug in
> some releases of the firmware.
> 
> When sending syslog over TCP, Netscreen firewalls will 
> delimit each message
> with LF NULL.
> 
> This probably won't have any impact on the 'CLR' since it is 
> the very last
> character in the message, but I thought I would raise the 
> issue with you as
> a real-life case of a Null character being used.
> 
> Cheers
> 
> Andrew
> 
> 
> 
> 

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: "Anton Okmianski \(aokmians\)" <[email-masked]>
Date: Mon, 28 Nov 2005 11:01:33 -0500

Sounds like a CLR is becoming a CBR (crappy bigger rule)... 

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Darren Reed
> Sent: Thursday, November 24, 2005 6:00 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: [Syslog] Null character
> 
> > 
> > Rainer,
> > 
> > FWIIW, I've seen Netscreen, NetGear and some LinkSys devices send a 
> > Null character at the end of each message. Not all versions of the 
> > firmware would include the Null at the end which leads me 
> to believe 
> > it may be a bug in some releases of the firmware.
> > 
> > When sending syslog over TCP, Netscreen firewalls will delimit each 
> > message with LF NULL.
> > 
> > This probably won't have any impact on the 'CLR' since it 
> is the very 
> > last character in the message, but I thought I would raise 
> the issue 
> > with you as a real-life case of a Null character being used.
> 
> Buggy software does not equate to a "real-life case".
> 
> But to judge whether or not it is a bug requires knowing what 
> their protocol spec is.
> 
> In this case, it is a delimeter and that is not something 
> that requires escaping.  In fact, it would be a bug to escape 
> it if it were being used in this manner.
> 
> Darren
>