Commit message (Collapse) | Author | Age | Files | Lines | |
---|---|---|---|---|---|
* | somewhat improved plain tcp syslog reliability | Rainer Gerhards | 2008-06-09 | 1 | -0/+12 |
| | | | | | | ...by doing a connection check before sending. Credits to Martin Schuette for providing the idea. Details are available at http://blog.gerhards.net/2008/06/reliable-plain-tcp-syslog-once-again.html | ||||
* | preparing 3.19.6v3.19.6 | Rainer Gerhards | 2008-06-06 | 1 | -1/+1 |
| | |||||
* | implemented wildcards inside certificate name check authentication | Rainer Gerhards | 2008-05-27 | 1 | -6/+9 |
| | |||||
* | client now provides cert even if it is not signed by one of the server's ↵ | Rainer Gerhards | 2008-05-27 | 1 | -9/+163 |
| | | | | trusted CAs (gtls) | ||||
* | protected gtls error string function by a mutex. | Rainer Gerhards | 2008-05-26 | 1 | -1/+7 |
| | | | | | Without it, we could have a race condition in extreme cases. This was very remote, but now can no longer happen. | ||||
* | fixed fingerprint generator | Rainer Gerhards | 2008-05-26 | 1 | -2/+1 |
| | | | | fixed problem introduced earlier today | ||||
* | fixed wrong cert expiration date check | Rainer Gerhards | 2008-05-26 | 1 | -1/+1 |
| | |||||
* | added certificate validity date check (gtls) | Rainer Gerhards | 2008-05-26 | 1 | -10/+55 |
| | |||||
* | added gtls name authentication based on common name (inside DN) | Rainer Gerhards | 2008-05-26 | 1 | -7/+99 |
| | | | | also changed fingerprint gtls auth mode to new format fingerprint | ||||
* | added capability to auto-configure tls auth rule for client connecting to server | Rainer Gerhards | 2008-05-26 | 1 | -13/+51 |
| | | | | must match hostname in send action | ||||
* | improved gtls error reporting | Rainer Gerhards | 2008-05-26 | 1 | -2/+11 |
| | |||||
* | checking if client provided a cert and complain if not | Rainer Gerhards | 2008-05-23 | 1 | -1/+3 |
| | |||||
* | added x509/name authentication (so far based on dnsName only) | Rainer Gerhards | 2008-05-22 | 1 | -58/+137 |
| | |||||
* | added code to pull the subjectAltName - dNSName | Rainer Gerhards | 2008-05-21 | 1 | -2/+23 |
| | |||||
* | implemented x509/certvalid "authentication" | Rainer Gerhards | 2008-05-21 | 1 | -2/+271 |
| | |||||
* | re-enabled anon mode (failed if client did not provide cert) | Rainer Gerhards | 2008-05-21 | 1 | -3/+6 |
| | |||||
* | first implementation of TLS server client authentication check | Rainer Gerhards | 2008-05-19 | 1 | -18/+37 |
| | | | | | | | The TLS server now checks the client fingerprint. This works, but is highly experimental. Needs to be refined for practice. Also: - implemented permittedPeers helper construct to store names - changed omfwd implementation to use new permittedPeers | ||||
* | improved error messages and corrected fingerprint format | Rainer Gerhards | 2008-05-19 | 1 | -8/+21 |
| | |||||
* | regained netstream driver genericity; improved drivers | Rainer Gerhards | 2008-05-17 | 1 | -3/+6 |
| | | | | | | | | | - made action logic pass optional auth params only if they are actually configured - added new authMode and Fingerprint methods to ptcp netstream driver (keeping them once again generic) - added diagnostics messages when invalid auth modes were configured | ||||
* | added first rough ability to authenticate the server against its certificate | Rainer Gerhards | 2008-05-16 | 1 | -3/+70 |
| | | | | | | | | | | This is very experimental and needs some more work. It probably even segfaults - but the base code is there and running. The rest is refinement. While working on this, I did these two bugfixes: - bugfix: small mem leak in omfwd on exit (strmdriver name was not freed) - bugfix: $ActionSendStreamDriver had no effect | ||||
* | Merge branch 'master' into ietf-tls | Rainer Gerhards | 2008-05-16 | 1 | -1/+7 |
|\ | |||||
| * | added fromhost-ip properties and some bugfixes | Rainer Gerhards | 2008-05-16 | 1 | -1/+1 |
| | | | | | | | | | | | | | | | | | | | | - bugfix: TCP input modules did incorrectly set fromhost property (always blank) - bugfix: imklog did not set fromhost property - added "fromhost-ip" property - added "RSYSLOG_DebugFormat" canned template - bugfix: hostname and fromhost were swapped when a persisted message (in queued mode) was read in | ||||
| * | added TODO item | Rainer Gerhards | 2008-05-15 | 1 | -1/+1 |
| | | |||||
| * | bugfix: TLS server went into an endless loop in some situations. | Rainer Gerhards | 2008-05-15 | 1 | -0/+6 |
| | | | | | | | | Thanks to Michael Biebl for reporting the problem. | ||||
* | | client provides x.509 and server prints fingerprint | Rainer Gerhards | 2008-05-15 | 1 | -6/+31 |
|/ | |||||
* | server's X509 cert fingerprint is obtained by client on connect | Rainer Gerhards | 2008-05-08 | 1 | -187/+47 |
| | |||||
* | added a bit of doc (at least something...) | Rainer Gerhards | 2008-05-08 | 1 | -1/+233 |
| | |||||
* | bugfix: gtls netstram driver did not specify threading model | Rainer Gerhards | 2008-05-08 | 1 | -3/+7 |
| | | | | (could possibly lead to "interesting effects" ;)) | ||||
* | limited number of unavoidable compiler warnings when compiling with GnuTLS | Rainer Gerhards | 2008-05-07 | 1 | -2/+15 |
| | |||||
* | added missing includes (noticed under SuSe Linux) | Rainer Gerhards | 2008-05-06 | 1 | -0/+1 |
| | |||||
* | final touches for 3.19.0v3.19.0 | Rainer Gerhards | 2008-05-06 | 1 | -1/+0 |
| | |||||
* | trying to remove compiler warnings | Rainer Gerhards | 2008-05-05 | 1 | -2/+2 |
| | |||||
* | made default certificate file locations configurable | Rainer Gerhards | 2008-05-05 | 1 | -7/+21 |
| | | | | | | - added $DefaultNetstreamDriverCAFile config directive - added $DefaultNetstreamDriverCertFile config directive - added $DefaultNetstreamDriverKeyFile config directive | ||||
* | made imgssapi work with new netstrm driver model | Rainer Gerhards | 2008-05-05 | 1 | -1/+4 |
| | | | | | | | | | there were a couple of things where imgssapi was not compatible with the new encapsulation. I did a somewhat dirty fix. The real solution would be to turn gssapi functionality into a netstream driver, which is too much for now (after all, we want to release some time AND we need to have the code mature in practice before we go for the next target...). | ||||
* | added $InputTCPServerStreamDriverMode config directive | Rainer Gerhards | 2008-04-30 | 1 | -3/+3 |
| | |||||
* | restructured netstrm driver layer | Rainer Gerhards | 2008-04-30 | 1 | -0/+3 |
| | | | | | | | the new structure prevents repetitive loads and unloads of driver files; it also has less overhead The "select" and regular driver are now contained in a single file. | ||||
* | server handshake now works with nonblocking sockets | Rainer Gerhards | 2008-04-30 | 1 | -1/+8 |
| | |||||
* | made plain tcp syslog via TLS work on the server | Rainer Gerhards | 2008-04-30 | 1 | -5/+122 |
| | | | | ... but so far only in blocking mode | ||||
* | added $ActionSendStreamDriverMode config directive | Rainer Gerhards | 2008-04-28 | 1 | -3/+27 |
| | |||||
* | fixed memory leaks | Rainer Gerhards | 2008-04-28 | 1 | -3/+4 |
| | |||||
* | made gtls server driver work in plain tcp mode | Rainer Gerhards | 2008-04-25 | 1 | -6/+85 |
| | |||||
* | added select() driver for GnuTls | Rainer Gerhards | 2008-04-24 | 1 | -17/+5 |
| | |||||
* | made this compile with the new abstracted socket server calls | Rainer Gerhards | 2008-04-24 | 1 | -9/+2 |
| | | | | | undid some invalid changes during merge plus did a few wrappers. Compiles, but does not yet work. | ||||
* | improved TLS session closure | Rainer Gerhards | 2008-04-18 | 1 | -5/+22 |
| | |||||
* | first working TLS-enabled plain TCP sender | Rainer Gerhards | 2008-04-18 | 1 | -5/+112 |
| | | | | | implemented a first working version of a TLS-enabled plain TCP sender (but, of course, the implementation is insecure as it is) | ||||
* | set stage for TLS client implementation | Rainer Gerhards | 2008-04-18 | 1 | -0/+259 |