rsyslog / rsyslog/librelp

relp tls fingerprint authentication

Open
#25 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
32
Forks
39
Avg merge
2h 27m
Merged PRs (30d)
7

Description

Would you consider adding a feature to match tls.permittedpeer fingerprints with hostnames?

Currently if you have a list of peers using omrelp to write to a "master" node, which is using imrelp and tls.authmode="fingerprint" with a list of tls.permittedpeer fingerprints, any client peer can masquerade as any other client.

To avoid this we can check if $hostname and $fromhost-ip match, but it would be more robust to check against the fingerprint.

Maybe it's possible to populate a $fingerprint variable with the connection's TLS fingerprint?

Or have a hash for tls.permittedpeer with hostname -> fingerprint to automatically drop messages (or log separately perhaps) for hostname/fingerprint mismatch?

Thanks.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No files or tests are named. Start by tracing the imrelp TLS fingerprint authentication and tls.permittedpeer handling, then define how a connection fingerprint should be associated with a hostname and how mismatches should be handled; completion would require an agreed design and corresponding coverage.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
networking, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.