Todd C. Miller
8186b98208
Adapt sudoers iolog client to log server dual port changes.
...
The TLS handshake now occurs before the ServerHello message is read.
This fixes potential man-in-the-middle attacks and works better with
TLS 1.3.
2020-05-05 13:23:26 -06:00
Todd C. Miller
5034ea91be
Some new source files got created with my old email address.
2020-03-29 05:05:08 -06:00
Todd C. Miller
5635c22f6b
Add --disable-log-server and --disable-log-client configure options.
...
These can be used to optionally disable building sudo_logsrvd and
support for remote I/O logging in the sudoers plugin respectively.
2020-02-26 13:17:40 -07:00
Todd C. Miller
b9bea25592
Read ServerHello message synchronously before the command is executed.
...
Otherwise, the command could be run before the TLS handshake completes.
2020-01-31 19:48:27 -07:00
Laszlo Orban
6f3f45aa24
sudoers: disable SO_KEEPALIVE socket option based on log_server_disable_keepalive flag in sudoers
2020-01-22 10:52:18 -07:00
Todd C. Miller
c3bd025052
Store the server host name and IP in client_closure_fill().
...
Also check for getpeername() and inet_ntop() failure.
2020-01-20 14:03:41 -07:00
Todd C. Miller
2d91555e85
Fix handling of SSL_ERROR_WANT_{READ,WRITE} during normal I/O.
...
If we get SSL_ERROR_WANT_WRITE during SSL_read(), we need to resume
the SSL_read(), not call SSL_write() as we were doing. Likewise
for SSL_ERROR_WANT_READ received from SSL_write().
This introduces a flag so we call the proper callback even when
the I/O direction doesn't match the read/write calls.
2020-01-20 12:42:39 -07:00
Laszlo Orban
de02745a3f
save a pointer to the currently connected audit server in the closure object
2020-01-18 05:49:54 -07:00
Todd C. Miller
36b3362b99
Fix TLS connect when SSL_connect returns SSL_ERROR_WANT_READ.
...
We need to switch from SUDO_EV_WRITE to SUDO_EV_READ for this case.
Also make the tls connect events private to tls_timed_connect()
with their own closure. There is no need to store them in the
client closure.
2020-01-16 17:37:45 -07:00
Todd C. Miller
9d737441f4
Fix event loop called via I/O log close function.
...
We need to set events that were pending in the old base in the new one.
Fixes sending the final I/O log data and the ExitMessage to the server.
2019-12-07 08:42:12 -07:00
Laszlo Orban
24cda2592a
implement tls layer in iolog plugin
2019-11-28 15:58:56 +01:00
Todd C. Miller
3241b82a7e
Make a shallow copy of user_env in I/O plugin in case it is reallocated.
...
The policy plugin's session init function may reallocate the user
environment pointer. Fixes a use after free when PAM is used.
2019-11-18 10:29:11 -07:00
Todd C. Miller
82237194dd
Add support for logging to the log server
2019-11-15 13:41:51 -07:00
