tls.authmode is ignored without own certificate and private key
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 32
- Forks
- 39
- Avg merge
- 2h 27m
- Merged PRs (30d)
- 7
Description
I'm trying to setup rsyslog with relp over tls using openssl library. The server is configured with its own certificate signed by a CA with the following snippet :
module(load="imrelp" tls.tlslib="openssl")
input(type="imrelp" address="10.0.5.15" port="10514" ruleset="relp-noauth" tls="on"
tls.cacert="/data/certs/pki/ca.crt"
tls.mycert="/data/certs/pki/syslog.crt"
tls.myprivkey="/data/certs/pki/syslog.key")
The clients do not have their own certificates but they are supposed to validate the one presented by the server (name + CA) using this configuration snippet :
module(load="omrelp" tls.tlslib="openssl")
action(type="omrelp" target="10.0.5.15" port="10514"
tls="on" tls.authmode="name" tls.permittedpeer="syslog"
tls.cacert="/data/certs/pki/ca.crt"
)
My issue in this particular case is that the authmode on the client part is completely ignored. (changing the permittedpeer param has no effect). When ran in debug mode we can see the following message on the client :
relpTcpChkPeerAuth: anon mode - success
After some digging into the code of tcp.c , I found that authmode gets overwritten with "none" in both client and server modes when no own certificate is configured ; first for the server:
same in client mode :
My understanding is that authmode defines how I will authenticate the remote peer using information from the certificate presented by it. The fact that I don't myself have a certificate is not relevant, I only need a CA certificate and/or a permitted peer list to do this authentication (depending on the authmode value).
I can create a PR removing the else cause in both snippets above if you agree otherwise I would be curious to know the rationale of this choice. Note that when using omfwd with tls in rsyslog, remote peer certificate authentication is done even if the local peer does not have a certificate, using this snippet :
global(
DefaultNetstreamDriverCAFile="/data/certs/pki/ca.crt"
)
action(type="omfwd" target="10.0.5.15" port="6514" protocol="tcp"
streamdriver="ossl" streamdrivermode="1"
streamdriverauthmode="x509/name"
streamdriverpermittedpeers="syslog")
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in src/tcp.c at the server lines 1776-1779 and client lines 1890-1894 linked in the issue, then trace how authmode is selected when no local certificate is configured. Verify the intended behavior against the omfwd example and confirm that permittedpeer and peer-certificate validation remain effective without a client certificate.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100