From 361aee1de1b978e2bef879e1fdd8ce50aa014b2c Mon Sep 17 00:00:00 2001
From: Balazs Scheidler <balazs.scheidler@axoflow.com>
Date: Sun, 15 Oct 2023 20:40:02 +0200
Subject: [PATCH] news: added news entries

Signed-off-by: Balazs Scheidler <balazs.scheidler@axoflow.com>
---
 news/bugfix-4673.md  |  9 +++++++++
 news/feature-4673.md | 30 ++++++++++++++++++++++++++++++
 news/other-4673.md   |  3 +++
 3 files changed, 42 insertions(+)
 create mode 100644 news/bugfix-4673.md
 create mode 100644 news/feature-4673.md
 create mode 100644 news/other-4673.md

diff --git a/news/bugfix-4673.md b/news/bugfix-4673.md
new file mode 100644
index 00000000000..67b763be173
--- /dev/null
+++ b/news/bugfix-4673.md
@@ -0,0 +1,9 @@
+Fix `$PROTO` value for `transport(tls)` connections, previously it was set
+to "0" while in reality these are tcp connections (e.g. "6").
+
+Fix how syslog-ng sets $HOST for V4-mapped addresses in case of IPv6 source
+drivers (e.g. udp6()/tcp6() or when using ip-protocol(6) for tcp()/udp()).
+Previously V4-mapped addresses would be represented as
+"::ffff:<ipv4 address>". This is not wrong per-se, but would potentially
+cause the same host to be represented in multiple ways. With the fix,
+syslog-ng would just use "<ipv4 address>" in these cases.
diff --git a/news/feature-4673.md b/news/feature-4673.md
new file mode 100644
index 00000000000..dc7d0d4644c
--- /dev/null
+++ b/news/feature-4673.md
@@ -0,0 +1,30 @@
+`$TRANSPORT`: this is a new name-value pair that syslog-ng populates
+automatically.  It indicates the "transport" mechanism used to
+retrieve/receive the message.  It is up to the source driver to determine
+the value. Currently the following values were implemented:
+
+  BSD syslog drivers: `tcp()`, `udp()` & `network()`
+  * rfc3164+tls
+  * rfc3164+tcp
+  * rfc3164+udp
+  * rfc3164+proxied-tls
+  * rfc3164+<custom logproto like altp>
+
+  UNIX domain drivers: `unix-dgram()`, `unix-stream()`
+  * unix-stream
+  * unix-dgram
+
+  RFC5424 style syslog: `syslog()`:
+  * rfc5426: syslog over udp
+  * rfc5425: syslog over tls
+  * rfc6587: syslog over tcp
+  * rfc5424+<custom logproto like altp>: syslog over a logproto plugin
+
+  Other drivers:
+  * otlp: `otel()` driver
+  * mqtt: `mqtt()` driver
+  * hypr-api: `hypr-audit-source()` driver
+
+
+`$IP_PROTO`: indicate the IP protocol version used to retrieve/receive the
+message. Contains either "4" to indicate IPv4 and "6" to indicate IPv6.
diff --git a/news/other-4673.md b/news/other-4673.md
new file mode 100644
index 00000000000..66ab9443176
--- /dev/null
+++ b/news/other-4673.md
@@ -0,0 +1,3 @@
+`LogSource` and `LogFetcher`: additional documentation was added to these
+Python classes to cover explicit source-side batching functionalities (e.g.
+the `auto_close_batch` attribute and the `close_batch()` method).