shadowsocks/shadowsocks-rust · error

syslog identity contains null-byte ('\0')

Error message

syslog identity contains null-byte ('\0')

What it means

make_syslog_writer builds a syslog writer whose identity (program name tag) must be a C-compatible NUL-terminated string. CString::new fails if the caller-supplied identity contains a '\0' byte, and the .expect turns that into a panic with this message. The library refuses to silently truncate or sanitize the identity, so it aborts instead.

Source

Thrown at src/logging/tracing.rs:213

            4 => Facility::Auth,
            6 => Facility::Lpr,
            7 => Facility::News,
            8 => Facility::Uucp,
            9 => Facility::Cron,
            10 => Facility::AuthPriv,
            16 => Facility::Local0,
            17 => Facility::Local1,
            18 => Facility::Local2,
            19 => Facility::Local3,
            20 => Facility::Local4,
            21 => Facility::Local5,
            22 => Facility::Local6,
            23 => Facility::Local7,
            _ => panic!("unsupported syslog facility: {}", f),
        },
    };
    let options = Options::default();
    let identity = CString::new(identity).expect("syslog identity contains null-byte ('\\0')");

    match Syslog::new(identity, options, facility) {
        Some(l) => l,
        None => panic!("syslog is already initialized"),
    }
}

View on GitHub (pinned to 8eb0f0a65b)

Solutions

1. Sanitize the identity before passing it in: strip or replace any '\0' characters.
2. Validate the identity at config-load time and reject NUL bytes early with a clear user-facing error.
3. If the identity comes from env/args, trim it and check identity.contains('\0') before calling make_syslog_writer.

Example fix

// before
let identity = std::env::var("SYSLOG_IDENTITY").unwrap();
let writer = make_syslog_writer(facility, &identity);

// after
let identity = std::env::var("SYSLOG_IDENTITY").unwrap();
let identity = identity.replace('\0', "");
assert!(!identity.contains('\0'), "syslog identity must not contain NUL");
let writer = make_syslog_writer(facility, &identity);

fn validate_syslog_identity(identity: &str) -> Result<(), String> {
    if identity.contains('\0') {
        Err(format!("syslog identity contains null-byte: {:?}", identity))
    } else {
        Ok(())
    }
}

fn is_nul_free(s: &str) -> bool { !s.as_bytes().contains(&b'\0') }

let identity = CString::new(identity)
    .map_err(|_| format!("syslog identity contains null-byte: {:?}", identity))?;

When it happens

Trigger: Calling make_syslog_writer (via make_layer) with an identity string containing an embedded NUL byte, e.g. an identity read from an environment variable, argv, or config file that includes '\0'.

Common situations: Binary/unsafe input sourced into a logging identity; misparsed command-line arguments; a config value that was decoded from a byte buffer without NUL stripping; FFI-passed strings that kept their terminator.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• unsupported syslog facility: {}
• syslog is already initialized
• logging
• Failed to create file writer for logging
• missing manager config

AI-assisted analysis of shadowsocks/shadowsocks-rust@8eb0f0a65b (2026-09-09). Data as JSON: /api/errors/0dfdd964ef9e281c. Report an issue: GitHub.