mirror of
https://github.com/rsyslog/rsyslog.git
synced 2026-06-19 21:02:57 +02:00
79febe5fd0
Admins often report "gibberish" when a TLS-enabled sender connects to a plain imtcp port. Making the mismatch explicit reduces operator confusion and support churn, and points directly to remediation. Impact: logs one explicit error per mismatched connection; no change to parsing or transport on plain listeners. Before/After: before, ClientHello bytes were ingested as binary with no hint; after, imtcp detects a TLS ClientHello on ptcp and logs a clear message with a troubleshooting URL. Technically, we add a small per-session probe in tcps_sess_t and sample the first 5 bytes of new sessions. If the record header matches a TLS handshake (type 0x16, version 0x03.00–0x04, length 40–16384) and the listener is plain TCP (streamDriver.mode=0), we emit a single error and disable further probing for that session. The probe is called from DataRcvd() and returns RS_RET_SERVER_NO_TLS when triggered; the session is otherwise left untouched. Runtime: introduce RS_RET_SERVER_NO_TLS (-2465) to tag the condition. Docs: add imtcp troubleshooting section and a dedicated FAQ page. Tests/tools: add test imtcp-tls-gibberish.sh and extend tcpflood with -H to send only a ClientHello (OpenSSL and GnuTLS paths tolerate early termination and non-blocking I/O for this mode).
22 lines
732 B
Bash
Executable File
22 lines
732 B
Bash
Executable File
#!/bin/bash
|
|
# added 2011-02-28 by Rgerhards
|
|
# This file is part of the rsyslog project, released under ASL 2.0
|
|
. ${srcdir:=.}/diag.sh init
|
|
export NUMMESSAGES=1
|
|
generate_conf
|
|
add_conf '
|
|
module(load="../plugins/imtcp/.libs/imtcp")
|
|
|
|
input(type="imtcp" port="0" listenPortFileName="'$RSYSLOG_DYNNAME'.tcpflood_port")
|
|
|
|
template(name="outfmt" type="string" string="%msg:F,58:2%\n")
|
|
:msg, contains, "msgnum:" action(type="omfile" file="'$RSYSLOG_OUT_LOG'" template="outfmt")
|
|
'
|
|
startup
|
|
tcpflood -H -p$TCPFLOOD_PORT -m$NUMMESSAGES -Ttls -x$srcdir/tls-certs/ca.pem -Z$srcdir/tls-certs/cert.pem -z$srcdir/tls-certs/key.pem
|
|
shutdown_when_empty
|
|
wait_shutdown
|
|
export EXPECTED=".* TLS handshake detected .*"
|
|
. $srcdir/diag.sh grep-check
|
|
exit_test
|