From: Gihyeon Ryu <rlgusryu@gmail.com>
Date: Wed, 11 Nov 2026 10:00:12 +0000 (+0000)
Subject: BUG/MINOR: log: don't let an LF in a forwarded message create new events
X-Git-Url: https://git.kaiwu.me/ngx_http_access_module.html?a=commitdiff_plain;h=fdfd607e84732539d67935f0e7babf092177e251;p=haproxy.git

BUG/MINOR: log: don't let an LF in a forwarded message create new events

A message received by a log-forward section over UDP or over TCP with
octet counting may contain CR or LF bytes. They are forwarded as is to
line-based outputs (rings, tcp@ servers, stdout/stderr), where each LF
starts a new event. A sender can then forge complete syslog lines with
any host name and program, which also defeats "option host".

syslog_process_message() now replaces every CR and LF but the trailing
ones with a space before parsing, so each received message gives one
line.

This should be backported to all stable branches.
---

diff --git a/src/log.c b/src/log.c
index 7e2ee16ec..08681070b 100644
--- a/src/log.c
+++ b/src/log.c
@@ -6117,6 +6117,24 @@ bad_format:
 	return;
 }
 
+/* Replace CR and LF with a space, except the trailing ones (already
+ * dropped by the send path), so a received message cannot create extra
+ * events on the outputs.
+ */
+static void syslog_flatten_message(struct buffer *buf)
+{
+	size_t len = buf->data;
+	size_t i;
+
+	while (len && (buf->area[len - 1] == '\n' || buf->area[len - 1] == 0))
+		len--;
+
+	for (i = 0; i < len; i++) {
+		if (buf->area[i] == '\n' || buf->area[i] == '\r')
+			buf->area[i] = ' ';
+	}
+}
+
 /* helper function for syslog handlers: process input message sent by
  * <saddr> and stored in <buf> according to <frontend> options, and send
  * it to frontend loggers
@@ -6138,6 +6156,8 @@ static void syslog_process_message(struct proxy *frontend, struct listener *l,
 	_HA_ATOMIC_INC(&cum_log_messages);
 	proxy_inc_fe_req_ctr(l, frontend, 0);
 
+	syslog_flatten_message(buf);
+
 	prepare_log_message(buf->area, buf->data, &level, &facility, metadata, &message, &size);
 
 	if (frontend->options3 & PR_O3_DONTPARSELOG)