Subject: [Syslog] [Technical Errata Reported] RFC5424 (6927)

From: RFC Errata System <[email-masked]>
Date: Thu, 7 Apr 2022 03:12:53 -0700 (PDT)

The following errata report has been submitted for RFC5424,
"The Syslog Protocol".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid6927

--------------------------------------
Type: Technical
Reported by: Ulrich Windl <[email-masked]>

Section: 6

Original Text
-------------
SD-NAME         = 1*32PRINTUSASCII
                  ; except '=', SP, ']', %d34 (")
...

PRINTUSASCII    = %d33-126

Corrected Text
--------------
SD-NAME         = 1*32PRINTUSASCII
                  ; except '=', SP, ']', %d34 (")
...
PRINTUSASCII    = %d32-126

Notes
-----
When excluding SP %d32 from PRINTUSASCII, then it does not make sense to state "except ..SP .."
There are more issues with the grammar:
SD_NAME forbids ']', but it should also forbid '['

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC5424 (draft-ietf-syslog-protocol-23)
--------------------------------------
Title               : The Syslog Protocol
Publication Date    : March 2009
Author(s)           : R. Gerhards
Category            : PROPOSED STANDARD
Source              : Security Issues in Network Event Logging
Area                : Security
Stream              : IETF
Verifying Party     : IESG

---

From: Chris Lonvick <[email-masked]>
Date: Sun, 10 Apr 2022 14:10:37 -0500

Hi Ulrich,

I suggest rejecting this errata.

First, changing PRINTASCII to %d32-126 would allow SP characters in 
HOSTNAME, APP-NAME, PROCID, and MSGID, which goes against conventions. 
That can be corrected in the aBNF, but it would then get messy to 
"except SP" from each of those.

Second, iirc it was discussed in the WG and we wanted to keep it there 
for emphasis. This is depicted several times in the examples. While this 
discussion occurred after the RFC was published, I believe it reflects 
the consensus of the WG while the document was an ID under discussion:

https://mailarchive.ietf.org/arch/msg/syslog/_CeLGoDEivIPfsH5on9SbUioU3Y/

Regards,

Chris

On 4/7/22 5:12 AM, RFC Errata System wrote:
> _______________________________________________
> Syslog mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/syslog

---

From: "Ulrich Windl" <[email-masked]>
Date: Mon, 11 Apr 2022 08:41:43 +0200

>>> Chris Lonvick <[email-masked]> schrieb am 10.04.2022 um 21:10 in
> HOSTNAME, APP-NAME, PROCID, and MSGID, which goes against conventions. 

Hi!

at least it's quite confusing as "isprint()" in C is defines as "checks for
any printable character including space."
The PRINTASCII in the RFC is rather C's isgraph() (checks for any printable
character except space).

So why when PRINTASCII does NOT include SP is the RFC saying:?
      SD-NAME         = 1*32PRINTUSASCII
                        ; except ’=’, SP, ’]’, %d34 (")

To be fair the errata should fix the definition of PRINTASCII and say "except
SP" in the cases where it's not allowed.
For the implementers it does not mean a real change, but it makes the
specification less confusing.

As an alternative GRAPHASCII corresponding to isgraph() could be added and
used where needed.

> "except SP" from each of those.

While taling on the grammar: I also think that

      PARAM-VALUE     = UTF-8-STRING ; characters ’"’, ’\’ and
                                     ; ’]’ MUST be escaped.

is rather vage, because it's not saying that any unescaped character ’"’, ’\’,
or ’]’ terminates PRAM-VALUE.
Not saying so makes the value parsed depend on the context where PARAM-VALUE
is being used (which is a bad idea)

> https://mailarchive.ietf.org/arch/msg/syslog/_CeLGoDEivIPfsH5on9SbUioU3Y/ 

Thanks,
Regards
Ulrich Windl