OpenBSD syslogd(8) escapes binary data with vis(3). Use the

VIS_NOSLASH option to avoid additional backslashes.  Although this
option prevents to decode binaries, it makes automatic post processing
easier.  Formats like JSON use backslash escaping themself, additional
escaping from syslogd would break SIEM systems.  vis protection was
introduced to avoid evil characters in log files and not to make
binary logging possible.
from Matthias Pitzl; OK deraadt@

diff --git a/regress/usr.sbin/syslogd/args-client-tcp-nontransp.pl b/regress/usr.sbin/syslogd/args-client-tcp-nontransp.pl
index a491706..34e4d9c 100644 (file)
--- a/regress/usr.sbin/syslogd/args-client-tcp-nontransp.pl
+++ b/regress/usr.sbin/syslogd/args-client-tcp-nontransp.pl
@@ -31,7 +31,7 @@ our %args = (
            qr/localhost de$/ => 1,
            qr/localhost fg$/ => 1,  # NUL terminates message
            qr/localhost hi $/ => 1,
-           qr/localhost jk\\\^G$/ => 1,  # bell character visual
+           qr/localhost jk\^G$/ => 1,  # bell character visual
            qr/localhost l$/ => 1,
            qr/localhost m$/ => 1,
            qr/localhost n$/ => 1,  # leading spaces are striped

diff --git a/regress/usr.sbin/syslogd/args-length-vis.pl b/regress/usr.sbin/syslogd/args-length-vis.pl
index c3f03c2..4cfce22 100644 (file)
--- a/regress/usr.sbin/syslogd/args-length-vis.pl
+++ b/regress/usr.sbin/syslogd/args-length-vis.pl
@@ -28,17 +28,16 @@ our %args = (
        # Jan 31 00:12:39 localhost 0123456789ABC...567
        loggrep => {
            get_charlog() => 11,
-           qr/^.{25} .{8182}foo\\M\^\@$/ => 1,
-           qr/^.{25} .{8183}foo\\M\^\@$/ => 1,
-           qr/^.{25} .{8184}foo\\M\^\@$/ => 1,
-           qr/^.{25} .{8185}foo\\M\^\@$/ => 1,
-           qr/^.{25} .{8186}foo\\M\^$/ => 1,
-           qr/^.{25} .{8187}foo\\M$/ => 1,
-           qr/^.{25} .{8188}foo\\$/ => 1,
+           qr/^.{25} .{8183}fooM\^\@$/ => 1,
+           qr/^.{25} .{8184}fooM\^\@$/ => 1,
+           qr/^.{25} .{8185}fooM\^\@$/ => 1,
+           qr/^.{25} .{8186}fooM\^\@$/ => 1,
+           qr/^.{25} .{8187}fooM\^$/ => 1,
+           qr/^.{25} .{8188}fooM$/ => 1,
            qr/^.{25} .{8189}foo$/ => 1,
            qr/^.{25} .{8190}fo$/ => 1,
            qr/^.{25} .{8191}f$/ => 1,
-           qr/^.{25} .{8192}$/ => 8,
+           qr/^.{25} .{8192}$/ => 7,
        },
     },
 );

diff --git a/usr.sbin/syslogd/syslogd.8 b/usr.sbin/syslogd/syslogd.8
index f31446f..038be05 100644 (file)
--- a/usr.sbin/syslogd/syslogd.8
+++ b/usr.sbin/syslogd/syslogd.8
@@ -1,4 +1,4 @@
-.\"    $OpenBSD: syslogd.8,v 1.60 2018/09/27 08:33:25 bluhm Exp $
+.\"    $OpenBSD: syslogd.8,v 1.61 2022/06/16 18:44:43 bluhm Exp $
 .\"
 .\" Copyright (c) 1983, 1986, 1991, 1993
 .\"    The Regents of the University of California.  All rights reserved.
@@ -30,7 +30,7 @@
 .\"     from: @(#)syslogd.8    8.1 (Berkeley) 6/6/93
 .\"    $NetBSD: syslogd.8,v 1.3 1996/01/02 17:41:48 perry Exp $
 .\"
-.Dd $Mdocdate: September 27 2018 $
+.Dd $Mdocdate: June 16 2022 $
 .Dt SYSLOGD 8
 .Os
 .Sh NAME
@@ -227,7 +227,8 @@ The message sent to
 should consist of a single line.
 Embedded new line characters are converted to spaces;
 binary data is encoded by
-.Xr vis 3 .
+.Xr vis 3 ,
+but no backslash is inserted.
 The message can contain a priority code, which should be a preceding
 decimal number in angle braces, for example,
 .Dq <5> .

diff --git a/usr.sbin/syslogd/syslogd.c b/usr.sbin/syslogd/syslogd.c
index 4942a89..d846e19 100644 (file)
--- a/usr.sbin/syslogd/syslogd.c
+++ b/usr.sbin/syslogd/syslogd.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: syslogd.c,v 1.274 2022/05/04 14:47:46 bluhm Exp $     */
+/*     $OpenBSD: syslogd.c,v 1.275 2022/06/16 18:44:43 bluhm Exp $     */
 
 /*
  * Copyright (c) 2014-2021 Alexander Bluhm <bluhm@genua.de>
@@ -1570,7 +1570,7 @@ printline(char *hname, char *msgstr)
                if (*p == '\n')
                        *q++ = ' ';
                else
-                       q = vis(q, *p, 0, 0);
+                       q = vis(q, *p, VIS_NOSLASH, 0);
        }
        line[LOG_MAXLINE] = *q = '\0';
 
@@ -1626,7 +1626,7 @@ printsys(char *msgstr)
                q = lp;
                while (*p && (c = *p++) != '\n' &&
                    q < &msg.m_msg[sizeof(msg.m_msg) - 4])
-                       q = vis(q, c, 0, 0);
+                       q = vis(q, c, VIS_NOSLASH, 0);
 
                logmsg(&msg, flags, LocalHostName);
        }