isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
11,022 Commits 1 Branch 0 Tags
788708c9ff925a79ffdd56612f86d3dfc36d7232
Commit Graph

140 Commits

Author SHA1 Message Date
Laszlo Orban
829fb9db84 do client identity validation in logserver 2020-01-18 05:49:54 -07:00
Todd C. Miller
9b12b21eaa Fix TLS accept when SSL_accept() returns SSL_ERROR_WANT_WRITE. 
We need to switch from SUDO_EV_READ to SUDO_EV_WRITE for this case.
 2020-01-16 17:37:46 -07:00
Todd C. Miller
486ee2b71f debug_decl and debug_decl_vars now require a semicolon at the end. 2019-12-22 08:48:16 -07:00
Laszlo Orban
5e36cc655c cert files can contain the full chain of trust, so load all certs in every case for verification 2019-12-06 11:17:12 +01:00
Laszlo Orban
1dceb8bbb8 add default values for cert paths 2019-12-04 14:18:24 +01:00
Laszlo Orban
f5e0e2a4bb Merge pull request #11 from sudo-project/audit-server-tls-async 
Sudo audit Server - TLS protocol update
 2019-11-27 08:29:19 +01:00
Laszlo Orban
06a0f89704 disable timeout for the reader after ServerHello message 2019-11-26 14:07:56 +01:00
Laszlo Orban
21e7fdfd55 use event timeout instead of socket timeout 2019-11-26 08:36:02 +01:00
Todd C. Miller
1747e50090 Exit if the first call to logsrvd_conf_read() fails. 
It is not fatal if subsequent calls fail (due to SIGHUP) since we
keep a copy of the old config before installing the new one.
 2019-11-25 13:38:22 -07:00
Laszlo Orban
f67d0d13cf ServerHello message is now unencrypted, TLS communication has been refactored to full async 2019-11-22 11:11:55 +01:00
Laszlo Orban
33f6a16764 extend ServerHello message with two fields (tls, tls_checkpeer) 2019-11-22 11:11:55 +01:00
Todd C. Miller
810669c4f0 Check closure->ssl for non-NULL instead of logsrvd_conf_get_tls_opt(). 
It's a little more obvious this way and ssl is only non-NULL when the
tls option is enabled anyway.
 2019-11-17 08:06:37 -07:00
Todd C. Miller
5be951bd79 Init iolog_dir_fd and sock in connection_closure before adding to list. 
Otherwise we could close the wrong fds in the error path.
 2019-11-17 08:02:20 -07:00
Todd C. Miller
690f145d3f LibreSSL and older OpenSSL don't support SSL_CTX_set_ciphersuites(). 
Add a configure test and skip TLS 1.3 setup if it is missing.
We still accept the tls_ciphers13 config setting but it will be ignored.
 2019-11-15 13:19:28 -07:00
Todd C. Miller
68480b0959 Minor style nits that I missed during review. 2019-11-15 12:48:42 -07:00
Laszlo Orban
b9641816d6 set timeout value for the socket 2019-11-15 09:52:48 +01:00
Laszlo Orban
e201f104d4 make audit server openssl dependency optional; tls layer is compiled only if sudo is built with --enable-openssl feature switch 2019-11-15 09:52:48 +01:00
Laszlo Orban
9df5e6c11d fixed segfault when connection_closure_free() tries to remove a non-existent connection object from the list 2019-11-15 09:52:48 +01:00
Laszlo Orban
764fb3e6bd verify server/client certs with CA certificate chain file 2019-11-15 09:52:48 +01:00
Laszlo Orban
037fb9298e fix copy-paste mistake 2019-11-15 09:52:48 +01:00
Laszlo Orban
3615576481 process tls config params in the audit server and establish TLS connection accordingly 2019-11-15 09:52:48 +01:00
Todd C. Miller
f1d0c99e03 Move bufsize_roundup() -> sudo_pow2_roundup() in libsudo_util. 2019-11-02 12:03:44 -06:00
Todd C. Miller
74a0e686ac Redirect std{in,out,err} to /dev/null even when given the -n option. 2019-10-24 20:04:33 -06:00
Todd C. Miller
955fa11b53 Clear the write bit on the timing file for completed logs. 
This allows us to tell whether or not a log can be restarted.
 2019-10-24 20:04:33 -06:00
Todd C. Miller
e74134d04d Fix some warnings from the clang static analyzer. 2019-10-24 20:04:32 -06:00
Todd C. Miller
3394785f6d Add restart support for compresses I/O logs. 2019-10-24 20:04:32 -06:00
Todd C. Miller
66fc926959 Allow messages up to 2Mb in size. 2019-10-24 20:04:32 -06:00
Todd C. Miller
c25b6dc7ec Add OpenBSD malloc options. 2019-10-24 20:04:32 -06:00
Todd C. Miller
76eec78a33 Add basic support for event logging using a sudo-style log format. 2019-10-24 20:04:32 -06:00
Todd C. Miller
c7f0f9e0fc Return an error to the client on error instead of dropping the connection. 2019-10-24 20:04:32 -06:00
Todd C. Miller
216747476f Add long option support to logsrvd and sendlog. 2019-10-24 20:04:32 -06:00
Todd C. Miller
af7f65fdfd Mark logsrvd and sendlog strings for translation in the sudoers domain 2019-10-24 20:04:32 -06:00
Todd C. Miller
534aba7a3e Make the logsrvd port and list address configurable. 2019-10-24 20:04:32 -06:00
Todd C. Miller
077e9aebbf Rename ExecMessage -> AcceptMessage and add RejectMessage 2019-10-24 20:04:31 -06:00
Todd C. Miller
059b55ce72 Refactor code in sudoers that creates I/O log files to share with logsrvd. 2019-10-24 20:04:31 -06:00
Todd C. Miller
a808dd45c2 Add config file support for logsrvd 2019-10-24 20:04:31 -06:00
Todd C. Miller
240d589136 Command line option processing for logsrvd 2019-10-24 20:04:31 -06:00
Todd C. Miller
e76d2e8201 Add support for restarting I/O log transfers. 2019-10-24 20:04:30 -06:00
Todd C. Miller
706553f9d3 Add debugging for logsrvd and sendlog 2019-10-24 20:04:30 -06:00
Todd C. Miller
2272430716 Import proof of concept sudo log server. 2019-10-24 20:04:29 -06:00