125 Commits

Author SHA1 Message Date
Rainer Gerhards
8ffdf2df8f Merge branch 'beta' 2008-07-07 12:11:54 +02:00
Rainer Gerhards
aeef9bbe72 bugfix: machine certificate was required for client even in TLS anon mode
Reference: http://bugzilla.adiscon.com/show_bug.cgi?id=85
The fix also slightly improves performance by not storing certificates in
client sessions when there is no need to do so.
2008-07-02 11:56:54 +02:00
Rainer Gerhards
4fd9852957 Merge branch 'beta'
Conflicts:

	ChangeLog
	conf.c
	doc/Makefile.am
	doc/manual.html
	omfwd.c
	plugins/omgssapi/omgssapi.c

This was a bit hard to merge; if there are problems, they
may be in the area of the new "comment in action line" code
that came from the beta.
2008-07-01 15:09:07 +02:00
Rainer Gerhards
3f6c73a8b7 added (internal) error codes to error messages
Also added redirector to web description of error codes
closes bug http://bugzilla.adiscon.com/show_bug.cgi?id=20
2008-06-27 12:52:45 +02:00
Rainer Gerhards
d451808236 reduced number of compile warnings in -pedantic gcc mode 2008-06-27 10:10:47 +02:00
Rainer Gerhards
b5faa3c4ce misc small changes: corrected version, removed some debug output,
..., restructured makefile, added some troubleshooting to test case
(program rscript-parse.c has problem due to different structure alignment,
where I do not yet know the reason)
2008-06-27 09:13:11 +02:00
Rainer Gerhards
2c46f3de7d bugfix: gtls always read only 8 bytes per recv call 2008-06-25 15:47:50 +02:00
Rainer Gerhards
c01daffb94 fixed invalid state checking inside gtls retry handler 2008-06-25 08:30:01 +02:00
Rainer Gerhards
3f55816a77 gnu error status must be set after retry operation
... otherwise, we check an invalid error state.
2008-06-24 18:54:04 +02:00
Rainer Gerhards
75063e54b2 bugfix: gtls und ptcp netstream driver communicated invalid iRet
This was introduced due to recent interface change.
2008-06-24 18:27:52 +02:00
Rainer Gerhards
dd3e2cae9d improved gtls error reporting 2008-06-24 17:44:16 +02:00
Rainer Gerhards
b5d8f5d96a added support for EGAIN while trying to receive data on gTLS session
This maps to bugzilla bug 83: http://bugzilla.adiscon.com/show_bug.cgi?id=83
This is the first test version, posted to user for repro of the problem.

It contains code to handle the case, HOWEVER, I have not been able to test it
in a scenario where a retry actually happens while receiving (I dont't get this
in my environment). So I assume it is buggy and will probably not work.
2008-06-24 15:12:22 +02:00
Rainer Gerhards
b711a34a07 disabled compile warnings caused by third-party libraries 2008-06-23 11:29:47 +02:00
Rainer Gerhards
7b1a570d54 changed Rcv-Interface in tcpsrv subsystem
It is now iRet based. This enables us to communicate
more in-depth information to the upper peers. This is needed
to handle the EGAIN case on rcv (not yet implemented)
2008-06-23 10:29:15 +02:00
Rainer Gerhards
716ab25446 disabled in-depth GnuTLS debugging aid
This is a debug aid, only. Note that it may reveal sensitive
information, so it should never be active in production code.
Currently, this is a compile-time switch and requires code changes
to (de)activate.
2008-06-23 09:04:00 +02:00
Rainer Gerhards
083d52c861 bugfix: some error states were swapped
... in gnutls code, resulting in some hard too
understand error messages. Also genereally improved certificate
error messages a bit.

Also, added GnuTLS debugging support.
2008-06-20 08:53:58 +02:00
Rainer Gerhards
abc7034f0d begun step-by-step guide for TLS protected syslog 2008-06-18 14:40:08 +02:00
Rainer Gerhards
4f32b62990 begun building a testbench 2008-06-13 17:21:03 +02:00
Michael Biebl
34054198fe Fix linker flags for librsyslog and rsyslogd
Use $(dl_libs) and $(rt_libs) instead of -ldl and -lrt. This ensures
that rsyslog can be successfully built on *BSD.

Don't like rsyslogd against $(dl_libs) and $(rt_libs) anymore. This
functionality is now in librsyslog.

Signed-off-by: Rainer Gerhards <rgerhards@adiscon.com>
2008-06-11 17:02:11 +02:00
Rainer Gerhards
8c0ac28fd9 fixed syntax error (typo in var name) and cleaup 2008-06-10 08:18:10 +02:00
Rainer Gerhards
55e01da2ec somewhat improved plain tcp syslog reliability
...by doing a connection check before sending. Credits to Martin
Schuette for providing the idea. Details are available at
http://blog.gerhards.net/2008/06/reliable-plain-tcp-syslog-once-again.html
2008-06-09 12:40:54 +02:00
Rainer Gerhards
cf51333f76 fixed a bug with the new property replacer option
there was a copy&paste error in the timereported
property - thanks to Elizabeth for reporting it
2008-06-07 11:01:13 +02:00
Rainer Gerhards
2687d0010c added new property replacer option "time-subseconds"
enables to query just the subsecond part of a high-precision timestamp
2008-06-06 17:33:58 +02:00
Rainer Gerhards
9c7207bb7b preparing 3.19.6 2008-06-06 11:25:06 +02:00
Rainer Gerhards
eddaca33a8 enhanced property replacer to support multiple regex matches 2008-06-04 11:11:52 +02:00
Rainer Gerhards
67d4f3c8f3 bugfix: off-by-one bug during certificate check 2008-06-04 08:21:08 +02:00
Rainer Gerhards
57daa3388c bugfix: part of permittedPeer structure was not correctly initialized
thanks to varmojfekoj for spotting this
2008-06-03 18:40:55 +02:00
Rainer Gerhards
6a815063f3 capability for replacement text in no match regex case added
implemented in property replacer: if a regular expression does not match,
it can now either return "**NO MATCH** (default, as before), a blank
property or the full original property text
2008-05-30 15:18:03 +02:00
Rainer Gerhards
99f18190a1 enhanced property replacer's regex to support submatches
- enabled Posix ERE expressions inside the property replacer
  (previously BRE was permitted only)
- provided ability to specify that a regular expression submatch shall
  be used inside the property replacer
2008-05-29 12:48:15 +02:00
Rainer Gerhards
cd2cee6de2 Merge branch 'ietf-tls' 2008-05-27 14:51:04 +02:00
Rainer Gerhards
531f27a8c3 implemented wildcards inside certificate name check authentication 2008-05-27 14:49:45 +02:00
Rainer Gerhards
ae387d6900 client now provides cert even if it is not signed by one of the server's trusted CAs (gtls) 2008-05-27 09:46:30 +02:00
Rainer Gerhards
331a644202 protected gtls error string function by a mutex.
Without it, we could have a race condition in extreme cases.
This was very remote, but now can no longer happen.
2008-05-26 15:49:32 +02:00
Rainer Gerhards
fce6ddc99f fixed fingerprint generator
fixed problem introduced earlier today
2008-05-26 15:31:41 +02:00
Rainer Gerhards
7918bbe7fc fixed wrong cert expiration date check 2008-05-26 15:11:00 +02:00
Rainer Gerhards
bc5eb93e40 added certificate validity date check (gtls) 2008-05-26 14:47:36 +02:00
Rainer Gerhards
b674dd69bd added gtls name authentication based on common name (inside DN)
also changed fingerprint gtls auth mode to new format fingerprint
2008-05-26 12:53:49 +02:00
Rainer Gerhards
7b604269c7 added capability to auto-configure tls auth rule for client connecting to server
must match hostname in send action
2008-05-26 11:01:42 +02:00
Rainer Gerhards
f31a0537c6 improved gtls error reporting 2008-05-26 10:15:49 +02:00
Rainer Gerhards
3b5c252784 checking if client provided a cert and complain if not 2008-05-23 11:39:37 +02:00
Rainer Gerhards
57b2032235 added x509/name authentication (so far based on dnsName only) 2008-05-22 18:48:09 +02:00
Rainer Gerhards
0b2e858a42 added code to pull the subjectAltName - dNSName 2008-05-21 18:18:20 +02:00
Rainer Gerhards
8c927a854e fixed invalid prototype 2008-05-21 18:04:54 +02:00
Rainer Gerhards
76877065f6 bugfix: sender information (fromhost et al) was missing in imudp
thanks to sandiso for reporting this bug
2008-05-21 17:37:58 +02:00
Rainer Gerhards
68a2c3d512 implemented x509/certvalid "authentication" 2008-05-21 14:59:24 +02:00
Rainer Gerhards
ff446070be Merge branch 'ietf-tls'
Conflicts:

	ChangeLog
2008-05-21 12:23:41 +02:00
Tiziano Mueller
275595cdf8 bugfix: missing linker options caused build to fail on some systems.
Signed-off-by: Rainer Gerhards <rgerhards@adiscon.com>
2008-05-21 12:19:38 +02:00
Rainer Gerhards
cb8188da16 re-enabled anon mode (failed if client did not provide cert) 2008-05-21 11:04:01 +02:00
Rainer Gerhards
2b90fa41fd changed default GnuTLS key material to more reasonable values
We now also provide everything to sign with a common CA.
NOTE: none of this is for production use!
2008-05-20 15:13:17 +02:00
Rainer Gerhards
85b587f93d first implementation of TLS server client authentication check
The TLS server now checks the client fingerprint. This works, but
is highly experimental. Needs to be refined for practice. Also:
- implemented permittedPeers helper construct to store names
- changed omfwd implementation to use new permittedPeers
2008-05-19 18:52:44 +02:00