Skip to content

Commit 6d4c6fb

Browse files
alexandr-san4ezalexandr-san4ez
committed
syslog: T4251: Rename "permitted-peers" to "permitted-peer" and improve TLS checks
- Renamed `permitted-peers` to `permitted-peer` across templates, schema, and tests. - Added support for multiple `permitted-peer` entries and trimmed empty values. - Replaced TLS/UDP warning with ConfigError for strict validation. - Updated tests to use TCP for TLS and verified new validation logic.
1 parent 34ce34f commit 6d4c6fb

File tree

4 files changed

+48
-18
lines changed

4 files changed

+48
-18
lines changed

‎data/templates/rsyslog/rsyslog.conf.j2‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -120,9 +120,12 @@ if prifilt("{{ tmp | join(',') }}") then {
120120
StreamDriverMode="1"
121121
# Select the authentication mode
122122
StreamDriverAuthMode="{{ auth_mode if auth_mode == 'anon' else 'x509/' + auth_mode }}"
123-
{% if tls.permitted_peers is vyos_defined and auth_mode in ('fingerprint', 'name') %}
123+
{% if tls.permitted_peer is vyos_defined and auth_mode in ('fingerprint', 'name') %}
124+
{% set permitted_peers = tls.permitted_peer | map('trim') | select | join(',') %}
125+
{% if permitted_peers %}
124126
# Only include permitted peers (list of allowed fingerprints or names)
125-
StreamDriverPermittedPeers="{{ tls.permitted_peers }}"
127+
StreamDriverPermittedPeers="{{ permitted_peers }}"
128+
{% endif %}
126129
{% endif %}
127130
{% if tls.ca_certificate_path is vyos_defined %}
128131
# Include the path to the CA certificate file

‎interface-definitions/system_syslog.xml.in‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -86,29 +86,30 @@
8686
</valueHelp>
8787
<valueHelp>
8888
<format>fingerprint</format>
89-
<description>Authenticate peer by matching its certificate fingerprint to a configured, permitted list (`permitted-peers` option)</description>
89+
<description>Authenticate peer by matching its certificate fingerprint to a configured, permitted list (`permitted-peer` option)</description>
9090
</valueHelp>
9191
<valueHelp>
9292
<format>certvalid</format>
9393
<description>Authenticate peer if it presents a certificate signed by a trusted CA</description>
9494
</valueHelp>
9595
<valueHelp>
9696
<format>name</format>
97-
<description>Authenticate peer by verifying its certificate subject name against a configured value (`permitted-peers` option)</description>
97+
<description>Authenticate peer by verifying its certificate subject name against a configured value (`permitted-peer` option)</description>
9898
</valueHelp>
9999
<constraint>
100100
<regex>(anon|fingerprint|certvalid|name)</regex>
101101
</constraint>
102102
</properties>
103103
<defaultValue>anon</defaultValue>
104104
</leafNode>
105-
<leafNode name="permitted-peers">
105+
<leafNode name="permitted-peer">
106106
<properties>
107-
<help>Comma-separated list of allowed peer certificate fingerprints or subject names</help>
107+
<help>Allowed peer certificate fingerprint or subject name</help>
108108
<valueHelp>
109109
<format>txt</format>
110-
<description>Comma-separated fingerprints or peer names.\nFor example:\n - 'SHA1:DD:23:E3:E7:70:F5:B4:13:44:16:78:A5:5A:8C:39:48:53:A6:DD:25,SHA256:10:C4:26:1D:CB:3C:AB:12:DB:1A:F0:47:37:AE:6D:D2:DE:66:B5:71:B7:2E:5B:BB:AE:0C:7E:7F:5F:0D:E9:64'\n - 'logs.example.com'</description>
110+
<description>Peer fingerprint - SHA1:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX or subject name - logs.example.com</description>
111111
</valueHelp>
112+
<multi/>
112113
</properties>
113114
</leafNode>
114115
</children>

‎smoketest/scripts/cli/test_system_syslog.py‎

Lines changed: 33 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -308,13 +308,13 @@ def test_remote_tls(self):
308308
'172.10.0.1': {
309309
'facility': {'all': {'level': 'debug'}},
310310
'port': '6514',
311-
'protocol': 'udp',
311+
'protocol': 'tcp',
312312
'tls': {},
313313
},
314314
'172.10.0.2': {
315315
'facility': {'all': {'level': 'debug'}},
316316
'port': '6514',
317-
'protocol': 'udp',
317+
'protocol': 'tcp',
318318
'tls': {
319319
'auth-mode': 'anon',
320320
},
@@ -336,7 +336,10 @@ def test_remote_tls(self):
336336
'ca-certificate': ca_cert_name,
337337
'certificate': client_cert_name,
338338
'auth-mode': 'fingerprint',
339-
'permitted-peers': 'SHA1:E1:DB:C4:FF:83:54:85:40:2D:56:E7:1A:C3:FF:70:22:0F:21:74:ED',
339+
'permitted-peer': [
340+
'SHA1:E1:DB:C4:FF:83:54:85:40:2D:56:E7:1A:C3:FF:70:22:0F:21:74:ED',
341+
' SHA1:FF:70:22:0F:21:74:ED:54:85:40:2D:56:E7:1A:C3:E1:DB:C4:FF:83 ',
342+
],
340343
},
341344
},
342345
'172.10.0.5': {
@@ -347,7 +350,10 @@ def test_remote_tls(self):
347350
'ca-certificate': ca_cert_name,
348351
'certificate': client_cert_name,
349352
'auth-mode': 'name',
350-
'permitted-peers': 'logs.example.com',
353+
'permitted-peer': [
354+
'logs.example.com',
355+
' ',
356+
],
351357
},
352358
},
353359
}
@@ -372,7 +378,12 @@ def test_remote_tls(self):
372378
tls = remote_options['tls']
373379
if tls:
374380
for key, value in tls.items():
375-
self.cli_set(remote_base + ['tls', key], value=value)
381+
if type(value) is list:
382+
values = value
383+
for value in values:
384+
self.cli_set(remote_base + ['tls', key], value=value)
385+
else:
386+
self.cli_set(remote_base + ['tls', key], value=value)
376387
else:
377388
self.cli_set(remote_base + ['tls'])
378389

@@ -412,13 +423,28 @@ def test_remote_tls(self):
412423
auth_mode = value if value == 'anon' else f'x509/{value}'
413424
self.assertIn(f'StreamDriverAuthMode="{auth_mode}"', config)
414425

415-
if 'permitted-peers' in tls:
416-
value = tls['permitted-peers']
426+
if 'permitted-peer' in tls:
427+
values = tls['permitted-peer']
428+
value = ','.join([v.strip() for v in values if v.strip()])
417429
self.assertIn(f'StreamDriverPermittedPeers="{value}"', config)
418430

419431
if not tls:
420432
self.assertIn(f'StreamDriverAuthMode="anon"', config)
421433

434+
def test_remote_tls_protocol_udp(self):
435+
remote_base = base_path + ['remote', '172.11.0.1']
436+
self.cli_set(remote_base + ['port'], value='6514')
437+
self.cli_set(remote_base + ['facility', 'all', 'level'], value='debug')
438+
self.cli_set(remote_base + ['protocol'], value='udp')
439+
self.cli_set(remote_base + ['tls'])
440+
441+
err_msg = "TLS is enabled for remote \"172.11.0.1\", but protocol is set to UDP"
442+
with self.assertRaisesRegex(ConfigSessionError, err_msg):
443+
self.cli_commit()
444+
445+
self.cli_set(base_path + ['remote', '172.11.0.1', 'protocol'], value='tcp')
446+
self.cli_commit()
447+
422448
def test_vrf_source_address(self):
423449
rhosts = {
424450
'169.254.0.10': { },

‎src/conf_mode/system_syslog.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -71,15 +71,15 @@ def _verify_tls_remote_options(remote, remote_options, syslog):
7171
if ca_certificate:
7272
verify_pki_ca_certificate(syslog, ca_certificate)
7373

74-
permitted_peers = dict_search('tls.permitted_peers', remote_options)
74+
permitted_peers = dict_search('tls.permitted_peer', remote_options)
7575
if not permitted_peers:
7676
if auth_mode == "fingerprint":
7777
raise ConfigError(
78-
f'Auth mode "fingerprint" for remote "{remote}" requires "permitted-peers" to be configured!'
78+
f'Auth mode "fingerprint" for remote "{remote}" requires "permitted-peer" to be configured!'
7979
)
8080
elif auth_mode == "name":
8181
raise ConfigError(
82-
f'Auth mode "name" for remote "{remote}" requires "permitted-peers" to specify allowed subject names!'
82+
f'Auth mode "name" for remote "{remote}" requires "permitted-peer" to specify allowed subject names!'
8383
)
8484

8585

@@ -181,7 +181,7 @@ def verify(syslog):
181181
_verify_tls_remote_options(remote, remote_options, syslog)
182182

183183
if 'protocol' in remote_options and remote_options['protocol'] == 'udp':
184-
Warning(
184+
raise ConfigError(
185185
f'TLS is enabled for remote "{remote}", but protocol is set to UDP. TLS is only supported with protocol TCP!'
186186
)
187187

0 commit comments

Comments
 (0)