rsyslog/rsyslog
1
0
Fork 0
mirror of https://github.com/rsyslog/rsyslog.git synced 2026-08-31 01:40:17 +02:00
Code Issues Packages Projects Releases Wiki Activity
1,849 Commits 124 Branches 513 Tags
Commit Graph

46 Commits

Author SHA1 Message Date
Rainer Gerhards
55e01da2ec somewhat improved plain tcp syslog reliability 
...by doing a connection check before sending. Credits to Martin
Schuette for providing the idea. Details are available at
http://blog.gerhards.net/2008/06/reliable-plain-tcp-syslog-once-again.html
 2008-06-09 12:40:54 +02:00
Rainer Gerhards
9c7207bb7b preparing 3.19.6 2008-06-06 11:25:06 +02:00
Rainer Gerhards
531f27a8c3 implemented wildcards inside certificate name check authentication 2008-05-27 14:49:45 +02:00
Rainer Gerhards
ae387d6900 client now provides cert even if it is not signed by one of the server's trusted CAs (gtls) 2008-05-27 09:46:30 +02:00
Rainer Gerhards
331a644202 protected gtls error string function by a mutex. 
Without it, we could have a race condition in extreme cases.
This was very remote, but now can no longer happen.
 2008-05-26 15:49:32 +02:00
Rainer Gerhards
fce6ddc99f fixed fingerprint generator 
fixed problem introduced earlier today
 2008-05-26 15:31:41 +02:00
Rainer Gerhards
7918bbe7fc fixed wrong cert expiration date check 2008-05-26 15:11:00 +02:00
Rainer Gerhards
bc5eb93e40 added certificate validity date check (gtls) 2008-05-26 14:47:36 +02:00
Rainer Gerhards
b674dd69bd added gtls name authentication based on common name (inside DN) 
also changed fingerprint gtls auth mode to new format fingerprint
 2008-05-26 12:53:49 +02:00
Rainer Gerhards
7b604269c7 added capability to auto-configure tls auth rule for client connecting to server 
must match hostname in send action
 2008-05-26 11:01:42 +02:00
Rainer Gerhards
f31a0537c6 improved gtls error reporting 2008-05-26 10:15:49 +02:00
Rainer Gerhards
3b5c252784 checking if client provided a cert and complain if not 2008-05-23 11:39:37 +02:00
Rainer Gerhards
57b2032235 added x509/name authentication (so far based on dnsName only) 2008-05-22 18:48:09 +02:00
Rainer Gerhards
0b2e858a42 added code to pull the subjectAltName - dNSName 2008-05-21 18:18:20 +02:00
Rainer Gerhards
68a2c3d512 implemented x509/certvalid "authentication" 2008-05-21 14:59:24 +02:00
Rainer Gerhards
cb8188da16 re-enabled anon mode (failed if client did not provide cert) 2008-05-21 11:04:01 +02:00
Rainer Gerhards
85b587f93d first implementation of TLS server client authentication check 
The TLS server now checks the client fingerprint. This works, but
is highly experimental. Needs to be refined for practice. Also:
- implemented permittedPeers helper construct to store names
- changed omfwd implementation to use new permittedPeers
 2008-05-19 18:52:44 +02:00
Rainer Gerhards
48684ceac5 improved error messages and corrected fingerprint format 2008-05-19 09:43:37 +02:00
Rainer Gerhards
edf41396ef regained netstream driver genericity; improved drivers 
- made action logic pass optional auth params only if they are
  actually configured
- added new authMode and Fingerprint methods to ptcp netstream
  driver (keeping them once again generic)
- added diagnostics messages when invalid auth modes were
  configured
 2008-05-17 11:19:12 +02:00
Rainer Gerhards
6ea98ec5ff added first rough ability to authenticate the server against its certificate 
This is very experimental and needs some more work. It probably even
segfaults - but the base code is there and running. The rest is
refinement.

While working on this, I did these two bugfixes:
- bugfix: small mem leak in omfwd on exit (strmdriver name was not freed)
- bugfix: $ActionSendStreamDriver had no effect
 2008-05-16 18:26:25 +02:00
Rainer Gerhards
29ebd4ab3e Merge branch 'master' into ietf-tls 2008-05-16 15:11:24 +02:00
Rainer Gerhards
09afe64f29 added fromhost-ip properties and some bugfixes 
- bugfix: TCP input modules did incorrectly set fromhost property
  (always blank)
- bugfix: imklog did not set fromhost property
- added "fromhost-ip" property
- added "RSYSLOG_DebugFormat" canned template
- bugfix: hostname and fromhost were swapped when a persisted message
  (in queued mode) was read in
 2008-05-16 13:36:41 +02:00
Rainer Gerhards
ffa17a25d2 client provides x.509 and server prints fingerprint 2008-05-15 16:58:25 +02:00
Rainer Gerhards
e623b1a06b added TODO item 2008-05-15 11:57:18 +02:00
Rainer Gerhards
d8b191a1f3 bugfix: TLS server went into an endless loop in some situations. 
Thanks to Michael Biebl for reporting the problem.
 2008-05-15 07:58:01 +02:00
Rainer Gerhards
d594f83a89 server's X509 cert fingerprint is obtained by client on connect 2008-05-08 16:00:57 +02:00
Rainer Gerhards
3d74096021 added a bit of doc (at least something...) 2008-05-08 13:24:20 +02:00
Rainer Gerhards
f027201679 bugfix: gtls netstram driver did not specify threading model 
(could possibly lead to "interesting effects" ;))
 2008-05-08 10:17:03 +02:00
Rainer Gerhards
442dad3521 limited number of unavoidable compiler warnings when compiling with GnuTLS 2008-05-07 12:33:18 +02:00
Rainer Gerhards
346a9e6379 added missing includes (noticed under SuSe Linux) 2008-05-06 18:32:59 +02:00
Rainer Gerhards
02795031a3 final touches for 3.19.0 2008-05-06 10:58:06 +02:00
Rainer Gerhards
fcbead3d4c trying to remove compiler warnings 2008-05-05 14:50:04 +02:00
Rainer Gerhards
74ab20fa5c made default certificate file locations configurable 
- added $DefaultNetstreamDriverCAFile config directive
- added $DefaultNetstreamDriverCertFile config directive
- added $DefaultNetstreamDriverKeyFile config directive
 2008-05-05 12:59:06 +02:00
Rainer Gerhards
b9cbb0d696 made imgssapi work with new netstrm driver model 
there were a couple of things where imgssapi was not compatible
with the new encapsulation. I did a somewhat dirty fix. The real
solution would be to turn gssapi functionality into a netstream
driver, which is too much for now (after all, we want to release
some time AND we need to have the code mature in practice
before we go for the next target...).
 2008-05-05 11:45:41 +02:00
Rainer Gerhards
da88900143 added $InputTCPServerStreamDriverMode config directive 2008-04-30 18:53:21 +02:00
Rainer Gerhards
1c2268faa8 restructured netstrm driver layer 
the new structure prevents repetitive loads and unloads of
driver files; it also has less overhead
The "select" and regular driver are now contained in a single
file.
 2008-04-30 17:41:17 +02:00
Rainer Gerhards
c370fc6305 server handshake now works with nonblocking sockets 2008-04-30 16:35:35 +02:00
Rainer Gerhards
b0d63ea8f2 made plain tcp syslog via TLS work on the server 
... but so far only in blocking mode
 2008-04-30 14:51:45 +02:00
Rainer Gerhards
a3ff7eaf85 added $ActionSendStreamDriverMode config directive 2008-04-28 14:21:58 +02:00
Rainer Gerhards
76e4eb29d4 fixed memory leaks 2008-04-28 08:09:21 +02:00
Rainer Gerhards
75cf92117c made gtls server driver work in plain tcp mode 2008-04-25 12:54:59 +02:00
Rainer Gerhards
af30c9f8f2 added select() driver for GnuTls 2008-04-24 20:10:24 +02:00
Rainer Gerhards
af50a76c3f made this compile with the new abstracted socket server calls 
undid some invalid changes during merge plus did a few wrappers.
Compiles, but does not yet work.
 2008-04-24 17:59:43 +02:00
Rainer Gerhards
d3b135ba9f improved TLS session closure 2008-04-18 18:52:51 +02:00
Rainer Gerhards
2069ab114e first working TLS-enabled plain TCP sender 
implemented a first working version of a TLS-enabled plain TCP
sender (but, of course, the implementation is insecure as it is)
 2008-04-18 18:29:02 +02:00
Rainer Gerhards
fd6c3bc36a set stage for TLS client implementation 2008-04-18 14:25:29 +02:00