rsyslog / rsyslog/librelp

tls.authmode is ignored without own certificate and private key

Open
#263 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
32
Forks
39
Avg merge
2h 27m
Merged PRs (30d)
7

Description

I'm trying to setup rsyslog with relp over tls using openssl library. The server is configured with its own certificate signed by a CA with the following snippet :

module(load="imrelp" tls.tlslib="openssl")
input(type="imrelp" address="10.0.5.15" port="10514" ruleset="relp-noauth" tls="on"
      tls.cacert="/data/certs/pki/ca.crt"
      tls.mycert="/data/certs/pki/syslog.crt"
      tls.myprivkey="/data/certs/pki/syslog.key")

The clients do not have their own certificates but they are supposed to validate the one presented by the server (name + CA) using this configuration snippet :

module(load="omrelp" tls.tlslib="openssl")
action(type="omrelp" target="10.0.5.15" port="10514"
       tls="on" tls.authmode="name" tls.permittedpeer="syslog"
       tls.cacert="/data/certs/pki/ca.crt"
      )

My issue in this particular case is that the authmode on the client part is completely ignored. (changing the permittedpeer param has no effect). When ran in debug mode we can see the following message on the client :

relpTcpChkPeerAuth: anon mode - success

After some digging into the code of tcp.c , I found that authmode gets overwritten with "none" in both client and server modes when no own certificate is configured ; first for the server:

https://github.com/rsyslog/librelp/blob/27d9a8cab814780d637d9857b8cd5aff39155a20/src/tcp.c#L1776-L1779

same in client mode :

https://github.com/rsyslog/librelp/blob/27d9a8cab814780d637d9857b8cd5aff39155a20/src/tcp.c#L1890-L1894

My understanding is that authmode defines how I will authenticate the remote peer using information from the certificate presented by it. The fact that I don't myself have a certificate is not relevant, I only need a CA certificate and/or a permitted peer list to do this authentication (depending on the authmode value).

I can create a PR removing the else cause in both snippets above if you agree otherwise I would be curious to know the rationale of this choice. Note that when using omfwd with tls in rsyslog, remote peer certificate authentication is done even if the local peer does not have a certificate, using this snippet :

global(
    DefaultNetstreamDriverCAFile="/data/certs/pki/ca.crt"
)
action(type="omfwd" target="10.0.5.15" port="6514" protocol="tcp"
       streamdriver="ossl" streamdrivermode="1"
       streamdriverauthmode="x509/name"
       streamdriverpermittedpeers="syslog")

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in src/tcp.c at the server lines 1776-1779 and client lines 1890-1894 linked in the issue, then trace how authmode is selected when no local certificate is configured. Verify the intended behavior against the omfwd example and confirm that permittedpeer and peer-certificate validation remain effective without a client certificate.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
networking, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.