RE: [Syslog] delineated datagrams

Balazs Scheidler <bazsi@balabit.hu> Thu, 10 August 2006 08:30 UTC

Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1GB5w6-0002l9-EZ; Thu, 10 Aug 2006 04:30:38 -0400
Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1GB5w5-0002l4-UR for syslog@ietf.org; Thu, 10 Aug 2006 04:30:37 -0400
Received: from balabit.hu ([82.141.167.23]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1GB5w4-0002jT-JS for syslog@ietf.org; Thu, 10 Aug 2006 04:30:37 -0400
Subject: RE: [Syslog] delineated datagrams
From: Balazs Scheidler <bazsi@balabit.hu>
To: Rainer Gerhards <rgerhards@hq.adiscon.com>
In-Reply-To: <577465F99B41C842AAFBE9ED71E70ABA174DD8@grfint2.intern.adiscon.com>
References: <577465F99B41C842AAFBE9ED71E70ABA174DD8@grfint2.intern.adiscon.com>
Content-Type: text/plain
Date: Thu, 10 Aug 2006 10:30:33 +0200
Message-Id: <1155198633.6525.1.camel@bzorp.balabit>
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Spam-Score: 0.0 (/)
X-Scan-Signature: 79899194edc4f33a41f49410777972f8
Cc: syslog@ietf.org, Tom Petch <nwnetworks@dial.pipex.com>
X-BeenThere: syslog@lists.ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Security Issues in Network Event Logging <syslog.lists.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/syslog>, <mailto:syslog-request@lists.ietf.org?subject=unsubscribe>
List-Archive: <http://www1.ietf.org/pipermail/syslog>
List-Post: <mailto:syslog@lists.ietf.org>
List-Help: <mailto:syslog-request@lists.ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/syslog>, <mailto:syslog-request@lists.ietf.org?subject=subscribe>
Errors-To: syslog-bounces@lists.ietf.org

On Thu, 2006-08-10 at 05:29 +0200, Rainer Gerhards wrote:
> Bazsi, all,
> 
> I am not really able to follow the thread, but let me put in an
> important thought.
> 
> We *must* allow LF inside the message. If we do not do that, it would
> cause problems with -protocol. This issue has been discussed at length,
> and there are good reasons for allowing it. So while I vote to use LF
> for record delineation, I also say that this means LF MUST be escaped if
> present in the actual message (transfer encoding). After being decoded,
> LF may be present in MSG.
> 
> Maybe this already has been said ;)

This makes sense. What about other control characters?

-- 
Bazsi


_______________________________________________
Syslog mailing list
Syslog@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/syslog