Feature/315 local syslog newlines

CLAUDE.md

@@ -229,9 +229,15 @@ What that leaves for this file is where the answers live in the code:
   at the site with a link to the model rather than changing the code. `XmlConfigurator` and
   `XmlHierarchyConfigurator` carry these for the configuration-is-trusted paths, and
   `SystemStringFormat` for the format string.
-- `LocalSyslogAppender.EscapeNulCharacters` and `RemoteSyslogAppender.ValidateIdentity` are the two
+- `log4net.Appender.Internal.ContentEscape` and `RemoteSyslogAppender.ValidateIdentity` are the two
   sides of the content and structural-identifier rule: content is escaped and never rejected, a
   malformed identifier is reported rather than quietly repaired.
+- **A sink that cannot carry a character escapes it visibly, and never drops the character, the
+  rest of the record, or the event.** The escapes already in use are `\0` for NUL, `\r` and `\n`
+  for newlines, and `\uXXXX` for anything else, in `ContentEscape` and in
+  `RemoteSyslogAppender.AppendMessage`. Put new ones in `ContentEscape` rather than in the
+  appender: four appenders have needed the same two so far. Escaping before a length limit, not
+  after, since an escape is longer than what it replaces.
 - Deliberate secure-default choices belong in the changelog with their opt-out named, so that an
   upgrade surprise is searchable. See the entries for `SendTimeoutMillis`, `MatchTimeoutMillis` and
   `LockTimeoutMillis`.

doc/MailTemplate.Announce.txt

@@ -1,16 +1,16 @@
 To: announce@apache.org, dev@logging.apache.org
-Subject: [ANNOUNCE] Apache log4net 3.4.1 released
+Subject: [ANNOUNCE] Apache log4net 3.5.0 released
 
 Hi,
 
-the Apache log4net team is pleased to announce the 3.4.1 release.
+the Apache log4net team is pleased to announce the 3.5.0 release.
 
 For further information (support, download, etc.) see
 
 - https://logging.apache.org/log4net/release-notes.html
-- https://github.com/apache/logging-log4net/releases/tag/rel%2F3.4.1
-- https://www.nuget.org/packages/log4net/3.4.1
-- https://www.nuget.org/packages/log4net.Ext.Mail/3.4.1
+- https://github.com/apache/logging-log4net/releases/tag/rel%2F3.5.0
+- https://www.nuget.org/packages/log4net/3.5.0
+- https://www.nuget.org/packages/log4net.Ext.Mail/3.5.0
 
 Highlights of this release:
 

doc/MailTemplate.Result.txt

@@ -1,5 +1,5 @@
 To: dev@logging.apache.org
-Subject: [RESULT][VOTE] Release Apache Log4net 3.4.1
+Subject: [RESULT][VOTE] Release Apache Log4net 3.5.0
 
 and here is my +1.
 
@@ -9,6 +9,6 @@ I will continue the release process.
 Jan
 
 ---------------------------------------------------------------------------------------------------
-This is a vote to release the Apache Log4net 3.4.1.
+This is a vote to release the Apache Log4net 3.5.0.
 
 ...

doc/MailTemplate.txt

@@ -1,12 +1,12 @@
 To: dev@logging.apache.org
-Subject: [VOTE] Release Apache Log4net 3.4.1
+Subject: [VOTE] Release Apache Log4net 3.5.0
 
-This is a vote to release the Apache Log4net 3.4.1.
+This is a vote to release the Apache Log4net 3.5.0.
 
 Website: https://logging.staged.apache.org/log4net/release-notes.html
 GitHub: https://github.com/apache/logging-log4net
 Commit: <todo>
-Distribution: https://dist.apache.org/repos/dist/dev/logging/log4net/3.4.1
+Distribution: https://dist.apache.org/repos/dist/dev/logging/log4net/3.5.0
 Signing key: 0x7D24496A230E29D6349A99EF583E491578F02D5D
 Review kit: https://logging.staged.apache.org/log4net/release-review.html
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "log4net",
-  "version": "3.4.1",
+  "version": "3.5.0",
   "description": "Log4Net is a logging framework for .NET",
   "repository": {
     "type": "git",

pom.xml

@@ -25,7 +25,7 @@
   <packaging>pom</packaging>
   <groupId>org.apache.logging.log4net</groupId>
   <artifactId>apache-log4net</artifactId>
-  <version>3.4.1</version>
+  <version>3.5.0</version>
   <name>Apache log4net</name>
   <description>Logging framework for Microsoft .NET Framework.</description>
   <url>https://logging.apache.org/log4net</url>

scripts/build-preview.ps1

@@ -1,7 +1,7 @@
 #Requires -Version 7.4
 
 param(
-  $Version = '3.4.1',
+  $Version = '3.5.0',
   $Preview = '1'
 )
 

scripts/build-release.ps1

@@ -1,7 +1,7 @@
 #Requires -Version 7.4
 
 param(
-  $Version = '3.4.1'
+  $Version = '3.5.0'
 )
 
 Set-StrictMode -Version Latest

src/Directory.Build.props

@@ -22,7 +22,7 @@
     <NoWarn>$(NoWarn);CS1591</NoWarn>
   </PropertyGroup>
   <PropertyGroup Label="Package Versions">
-    <VersionPrefix>3.4.1</VersionPrefix>
+    <VersionPrefix>3.5.0</VersionPrefix>
     <Log4NetPackageVersion>3.4.0</Log4NetPackageVersion>
     <MailKitPackageVersion>4.17.0</MailKitPackageVersion>
     <SystemConfigurationConfigurationManagerPackageVersion>4.5.0</SystemConfigurationConfigurationManagerPackageVersion>

src/changelog/3.4.1/.release.xml → src/changelog/3.5.0/.release.xml

@@ -2,5 +2,5 @@
 <release xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xmlns="https://logging.apache.org/xml/ns"
          xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
-         date="2026-10-20"
-         version="3.4.1"/>
+         date="2026-11-01"
+         version="3.5.0"/>

src/changelog/3.4.1/313-require-powershell-74.xml → src/changelog/3.5.0/313-require-powershell-74.xml

@@ -9,6 +9,6 @@
  `$PSNativeCommandUseErrorActionPreference`, which exists only from 7.4, so under Windows PowerShell
  5.1 a failing `gpg --verify` was ignored and `verify-release.ps1` reported success and exited 0. The
  scripts now refuse to start on an older host, and the review instructions install PowerShell 7 and
- run the script with `pwsh` (audit da18b6fd-f004)
+ run the script with `pwsh` (audit 1231d72-f009)
   </description>
 </entry>

src/changelog/3.5.0/314-adonet-retry-cap.xml

@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns="https://logging.apache.org/xml/ns"
+       xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
+       type="fixed">
+  <issue id="314" link="https://github.com/apache/logging-log4net/pull/314"/>
+  <description format="asciidoc">
+    stop `AdoNetAppender` from retrying a whole batch one event at a time when none of them can be
+ written. Retrying after a rolled back transaction was added in 3.4.0 to save the events around
+ the one the database rejected, but a batch that fails outright, such as a missing table or a
+ missing permission, then cost one round trip per event: 513 instead of 1 for a full buffer. It
+ now gives up after five consecutive failures (implemented by @FreeAndNil)
+  </description>
+</entry>

src/changelog/3.5.0/314-ext-mail-background-sender.xml

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns="https://logging.apache.org/xml/ns"
+       xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
+       type="changed">
+  <issue id="314" link="https://github.com/apache/logging-log4net/pull/314"/>
+  <description format="asciidoc">
+    send mail from a background thread in the MailKit based `SmtpAppender`. The mail used to go out
+ while the appender lock was held, so the thread that logged, and every thread behind it, waited
+ for the SMTP server. The queue holds `sendQueueSize` mails (500) and a logging call waits at most
+ `enqueueTimeoutMillis` (5000) for room in it. Failures are still reported to the error handler,
+ but after the logging call has returned, and `Flush` now honours its timeout
+ (implemented by @FreeAndNil)
+  </description>
+</entry>

src/changelog/3.5.0/314-ext-mail-send-timeout.xml

@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns="https://logging.apache.org/xml/ns"
+       xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
+       type="changed">
+  <issue id="314" link="https://github.com/apache/logging-log4net/pull/314"/>
+  <description format="asciidoc">
+    bound a whole send in the MailKit based `SmtpAppender` to 15 seconds. MailKit waits 100 seconds
+ per operation by default, and the mail goes out while the appender lock is held, so an
+ unresponsive server suspended every thread logging through the appender. `SendTimeoutMillis` is a
+ deadline for the send as a whole, because a per operation timeout still allows a multiple of
+ itself overall (implemented by @FreeAndNil)
+  </description>
+</entry>

src/changelog/3.5.0/314-flush-reports-buffered-events.xml

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns="https://logging.apache.org/xml/ns"
+       xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
+       type="fixed">
+  <issue id="314" link="https://github.com/apache/logging-log4net/pull/314"/>
+  <description format="asciidoc">
+    report a buffering appender that is still holding events from `Flush`. It returned `true`
+ unconditionally, including for a `lossy` appender, where flushing deliberately does nothing and
+ every buffered event stays where it was (implemented by @FreeAndNil)
+  </description>
+</entry>

src/changelog/3.5.0/314-remote-syslog-background-sender.xml

@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns="https://logging.apache.org/xml/ns"
+       xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
+       type="fixed">
+  <issue id="314" link="https://github.com/apache/logging-log4net/pull/314"/>
+  <description format="asciidoc">
+    bound the queue `RemoteSyslogAppender` sends from. It was unbounded, so a syslog server that
+ stopped accepting datagrams grew it until the process ran out of memory, and shutdown waited five
+ seconds and then abandoned a drain that had no limit of its own. It now holds `sendQueueSize`
+ datagrams (500), a logging call waits at most `enqueueTimeoutMillis` (5000) for room, losses are
+ counted and reported, and `Flush` honours its timeout (implemented by @FreeAndNil)
+  </description>
+</entry>

src/changelog/3.5.0/314-remote-syslog-socket-and-connect.xml

@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns="https://logging.apache.org/xml/ns"
+       xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
+       type="fixed">
+  <issue id="314" link="https://github.com/apache/logging-log4net/pull/314"/>
+  <description format="asciidoc">
+    stop `RemoteSyslogAppender` from opening a second, unused UDP socket. It sends through the
+ connection its background pump owns, but also inherited one from `UdpAppender` that nothing ever
+ used, which bound `localPort` twice. A pump that cannot connect now reports it as well, instead
+ of ending unobserved and leaving every later event queued behind a sender that is gone
+ (implemented by @FreeAndNil)
+  </description>
+</entry>

src/changelog/3.5.0/314-smtpappender-send-timeout.xml

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns="https://logging.apache.org/xml/ns"
+       xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
+       type="changed">
+  <issue id="314" link="https://github.com/apache/logging-log4net/pull/314"/>
+  <description format="asciidoc">
+    bound a single send in `SmtpAppender` to 15 seconds. `SmtpClient.Timeout` defaults to 100
+ seconds and the appender never set it, and the mail goes out while the appender lock is held, so
+ a server that accepted the connection and then stopped answering suspended every thread logging
+ through the appender. Configurable with `SendTimeoutMillis` (implemented by @FreeAndNil)
+  </description>
+</entry>

src/changelog/3.5.0/315-eventlog-nul.xml

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns="https://logging.apache.org/xml/ns"
+       xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
+       type="fixed">
+  <issue id="315" link="https://github.com/apache/logging-log4net/pull/315"/>
+  <description format="asciidoc">
+    escape NUL characters in `EventLogAppender` content. `ReportEventW` takes a null terminated
+ string, so a NUL in logged content ended the stored record there and silently dropped whatever
+ the layout rendered after it, exception text and trailing fields included (CWE-158). `WriteEntry`
+ raises nothing, so the record simply stored short. Measured on Windows 11 build 26200: of a 45
+ character message with a NUL at 23, the 23 character prefix was stored and the rest was gone
+ (audit da18b6fd-f007)
+  </description>
+</entry>

src/changelog/3.5.0/315-eventlog-size-budget.xml

@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns="https://logging.apache.org/xml/ns"
+       xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
+       type="fixed">
+  <issue id="315" link="https://github.com/apache/logging-log4net/pull/315"/>
+  <description format="asciidoc">
+    stop `EventLogAppender` truncating to a size the event log then discards. The limit is a whole
+ record budget that the log name, the source and the machine name are spent from, so the fixed
+ 31837 was above the real ceiling: measured on Windows 11 build 26200, a record is stored while
+ `message + logName + applicationName` stays within 31736 characters, and one character beyond
+ that the service stores nothing and reports nothing. The whole event was lost rather than
+ shortened, and `applicationName` defaults to the app domain name, so a consumer with a long
+ assembly name lost more. The limit is now computed, and a truncation is reported through the
+ error handler, which is the only signal available (audit da18b6fd-f030)
+  </description>
+</entry>

src/changelog/3.5.0/315-local-syslog-newlines.xml

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns="https://logging.apache.org/xml/ns"
+       xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
+       type="fixed">
+  <issue id="315" link="https://github.com/apache/logging-log4net/pull/315"/>
+  <description format="asciidoc">
+    escape the newlines in logged content in `LocalSyslogAppender`, which passed them to
+ `syslog(3)` unchanged. A daemon that writes the message through to a line oriented log then
+ records everything after the newline as its own entry, so content could forge an authentic
+ looking record (CWE-117). `NewLineHandling` mirrors the option of the same name on
+ `RemoteSyslogAppender`, which already escaped by default; set it to `Keep` for the previous
+ behaviour (audit da18b6fd-f008)
+  </description>
+</entry>

src/changelog/3.5.0/315-outputdebugstring-nul.xml

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns="https://logging.apache.org/xml/ns"
+       xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
+       type="fixed">
+  <issue id="315" link="https://github.com/apache/logging-log4net/pull/315"/>
+  <description format="asciidoc">
+    escape NUL characters in `OutputDebugStringAppender` content. `OutputDebugStringW` takes a null
+ terminated string, so a NUL in logged content ended the record there and silently dropped whatever
+ the layout rendered after it, exception text and trailing fields included (CWE-158). The escape
+ `LocalSyslogAppender` already applied is now shared between the two (audit da18b6fd-f009)
+  </description>
+</entry>

src/changelog/3.5.0/315-pickup-dir-unencodable-content.xml

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns="https://logging.apache.org/xml/ns"
+       xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
+       type="fixed">
+  <issue id="315" link="https://github.com/apache/logging-log4net/pull/315"/>
+  <description format="asciidoc">
+    stop one logging event destroying a whole `SmtpPickupDirAppender` batch. `File.CreateText`
+ throws on content it cannot encode, such as an unpaired surrogate, which abandoned every buffered
+ event and left a truncated mail in the pickup directory for the service to send. Such content is
+ now written as a `\uXXXX` escape (audit da18b6fd-f011)
+  </description>
+</entry>

src/changelog/3.5.0/315-syslog-newline-handling-type.xml

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns="https://logging.apache.org/xml/ns"
+       xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
+       type="changed">
+  <issue id="315" link="https://github.com/apache/logging-log4net/pull/315"/>
+  <description format="asciidoc">
+    move `SyslogNewLineHandling` out of `RemoteSyslogAppender` to `log4net.Appender`, now that
+ `LocalSyslogAppender` uses it too. Configuration files are unaffected, they bind the value by
+ name, but code naming `RemoteSyslogAppender.SyslogNewLineHandling` has to drop the prefix
+ (implemented by @FreeAndNil)
+  </description>
+</entry>

src/changelog/3.5.0/315-syslog-non-ascii.xml

@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns="https://logging.apache.org/xml/ns"
+       xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
+       type="fixed">
+  <issue id="315" link="https://github.com/apache/logging-log4net/pull/315"/>
+  <description format="asciidoc">
+    escape the characters `RemoteSyslogAppender` cannot send instead of deleting them. RFC 3164
+ allows only the visible ASCII characters and space, and everything else was dropped silently, so
+ `Sch&#246;nwetter &#20320;&#22909;` reached the collector as `Schnwetter ` and a tab disappeared
+ from between its neighbours. Such characters are now written as a `\uXXXX` escape, which keeps
+ the record inside the allowed range and readable (audit da18b6fd-f035)
+  </description>
+</entry>

src/changelog/3.5.0/315-telnet-unencodable-content.xml

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns="https://logging.apache.org/xml/ns"
+       xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
+       type="fixed">
+  <issue id="315" link="https://github.com/apache/logging-log4net/pull/315"/>
+  <description format="asciidoc">
+    stop one logging event disconnecting every `TelnetAppender` client. The default writer encoding
+ throws on content it cannot encode, such as an unpaired surrogate, and `Send` reads any failure as
+ a client that hung up. Unpaired surrogates are now written as a `\uXXXX` escape, as elsewhere
+ (audit da18b6fd-f013)
+  </description>
+</entry>