Changeset 3483

Timestamp:

04/13/10 02:00:09 (2 years ago)

Author:

bldewolf

Message:

Fix TLS, resolving several bugs.

#878 * Corrected function name passed to constructor.
#879 * Change logging function passed by master to use Log4perl to allow
logging in both master and node.
#599 * Added directive "tls_match", which is a regex for matching against the
dumped certificate of the client.
* Add documentation for TLS to munin-node.conf.pod.
* Clean up logging in TLS.pm to reduce noise during normal operations.

Files:

• trunk/common/lib/Munin/Common/Config.pm (modified) (1 diff)
• trunk/common/lib/Munin/Common/TLS.pm (modified) (12 diffs)
• trunk/master/doc/munin.conf.pod.in (modified) (1 diff)
• trunk/master/lib/Munin/Master/Node.pm (modified) (2 diffs)
• trunk/node/doc/munin-node.conf.pod (modified) (1 diff)
• trunk/node/lib/Munin/Node/Config.pm (modified) (1 diff)
• trunk/node/lib/Munin/Node/Server.pm (modified) (2 diffs)

trunk/common/lib/Munin/Common/Config.pm

@@ -32 +32 @@
-        "service_order", "category_order", "version",
-        "tls_certificate", "tls_private_key", "tls_pem",
-
+ "tls_match",
-        "tls_ca_certificate", "graph_data_size", "colour",
-        "graph_printf", "ok", "unknown", "palette", "realservname",

trunk/common/lib/Munin/Common/TLS.pm

@@ -33 +33 @@
-        tls_vdepth         => $args->{tls_vdepth} || 0,
-        tls_verify         => $args->{tls_verify} || 0,
+        tls_match          => $args->{tls_match} || '',
-    };
-
@@ -210 +211 @@
-    my $err = &Net::SSLeay::print_errs("");
-    if (defined $err and length $err) {
-       
+        
-    }
-    Net::SSLeay::CTX_set_verify ($self->{tls_context}, 
@@ -217 +218 @@
-    $err = &Net::SSLeay::print_errs("");
-    if (defined $err and length $err) {
-       
+        
-    }
-    
@@ -230 +231 @@
-        my ($ok, $subj_cert, $issuer_cert, $depth, 
-            $errorcode, $arg, $chain) = @_;
-        #    $self->{logger}("ok is ${ok}");
-
-        $tls_verified->{"level"}++;
@@ -271 +271 @@
-    } while $p;
-    $cipher_list .= '\n';
-
+ if $self->{DEBUG}
-}
-
@@ -281 +281 @@
-    my $err = &Net::SSLeay::print_errs("");
-    if (defined $err and length $err) {
-TLS
+[TLS]
-    }
-    Net::SSLeay::set_wfd($self->{tls_session}, $self->{write_fd});
-    $err = &Net::SSLeay::print_errs("");
-    if (defined $err and length $err) {
-TLS
+[TLS]
-    }
-}
@@ -294 +294 @@
-    my ($self, $tls_verified) = @_;
-
-
+[TLS] 
-    my $res;
-    if ($self->_use_key_if_present()) {
@@ -302 +302 @@
-        $res = Net::SSLeay::connect($self->{tls_session});
-    }
-
+[TLS] 
-
-    my $err = &Net::SSLeay::print_errs("");
@@ -320 +320 @@
-        $self->{tls_session} = undef;
-    }
+    elsif ($self->{"tls_match"} and
+        Net::SSLeay::dump_peer_certificate($self->{tls_session}) !~ /$self->{tls_match}/)
+    { 
+        $self->{logger}("[ERROR] Could not match pattern \"" . $self->{tls_match} .
+                "\" in dump of certificate.");
+        $self->_on_unmatched_cert();
+        Net::SSLeay::free ($self->{tls_session});
+        Net::SSLeay::CTX_free ($self->{tls_context});
+        $self->{tls_session} = undef;
+    }
-    else
-    {
-
-
-
+ if $self->{DEBUG}
+ if $self->{DEBUG}
+ if $self->{DEBUG}
-    }
-}
@@ -350 +360 @@
-sub _on_unverified_cert {}
-
+# Redefine in sub class if needed
+sub _on_unmatched_cert {}
-
-sub read {
@@ -362 +374 @@
-    my $err = &Net::SSLeay::print_errs("");
-    if (defined $err and length $err) {
-TLS
+[TLS]
-        return;
-    }
+    $self->{logger}("DEBUG: < $_") if $self->{DEBUG};
+
-    if($_ eq '') { undef $_; } #returning '' signals EOF
-
-    $self->{logger}("DEBUG: < $_") if $self->{DEBUG};
-
-    return $_;
@@ -384 +397 @@
-    my $err = &Net::SSLeay::print_errs("");
-    if (defined $err and length $err) {
-TLS
+[TLS]
-        return 0;
-    }

trunk/master/doc/munin.conf.pod.in

@@ -174 +174 @@
-willing to go to reach a known, trusted CA when verifying a
-certificate.  Default is C<5>.  Affects: munin-update.
+
+=item B<tls_match> <value>
+
+This directive, if defined, searches a dump of the certificate provided by the
+remote host for the given regex.  The dump of the certificate is two lines of
+the form:
+
+        Subject Name: /C=c/ST=st/L=l/O=o/OU=ou/CN=cn/emailAddress=email
+        Issuer  Name: /C=c/ST=st/O=o/OU=ou/CN=cn/emailAddress=email
+
+So, for example, one could match the subject distinguished name by the directive:
+
+        tls_match Subject Name: /C=c/ST=st/L=l/O=o/OU=ou/CN=cn/emailAddress=email
+
+Note that the fields are dumped in the order they appear in the certificate.
+It's best to view the dump of the certificate by running munin-update in debug
+mode and reviewing the logs.
+
+Unfortunately, due to the limited functionality of the SSL module in use, it is
+not possible to provide finer-grained filtering.  By default this value is not
+defined.  Affects: munin-update.
-
-=item FIXME: This section MAY be complete, it may be missing a directive or two.

trunk/master/lib/Munin/Master/Node.pm

@@ -122 +122 @@
-    # value is therefore "disabled" (and not "auto" as before).
-    my $tls_requirement = $config->{tls};
-INFO
+DEBUG
-    return if $tls_requirement eq 'disabled';
+    my $logger = Log::Log4perl->get_logger("Munin::Master");
-    $self->{tls} = Munin::Common::TLSClient->new({
-        DEBUG        => $config->{debug},
-\&logger
+sub { $logger->warn(@_) }
-        read_fd      => fileno($self->{reader}),
-        read_func    => sub { _node_read_single($self) },
@@ -135 +136 @@
-        tls_vdepth   => $config->{tls_verify_depth},
-        tls_verify   => $config->{tls_verify_certificate},
+        tls_match    => $config->{tls_match},
-        write_fd     => fileno($self->{writer}),
-write_socket
+node_write
-    });
-

trunk/node/doc/munin-node.conf.pod

@@ -61 +61 @@
-directories will be overlooked.
-
+=item B<tls> <value>
+
+Can have four values. C<paranoid>, C<enabled>, C<auto>, and
+C<disabled>.  C<Paranoid> and C<enabled> require a TLS connection,
+while C<disabled> will not attempt one at all.
+
+The current default is C<disabled> because C<auto> is broken.  C<Auto>
+causes bad interaction between munin-update and munin-node if the node
+is unprepared to go to TLS.
+
+If you see data dropouts (gaps in graphs) please try to disable TLS.
+
+=item B<tls_verify_certificate> <value>
+
+This directive can be C<yes> or C<no>.  It determines if the remote
+certificate needs to be signed by a CA that is known locally.  Default
+is C<no>.
+
+=item B<tls_private_key> <value>
+
+This directive sets the location of the private key to be used for
+TLS.  Default is @@CONFDIR@@/munin-node.pem.  The private key and
+certificate can be stored in the same file.
+
+=item B<tls_certificate> <value>
+
+This directive sets the location of the TLS certificate to be used for
+TLS.  Default is @@CONFDIR@@/munin-node.pem.  The private key and
+certificate can be stored in the same file.
+
+=item B<tls_ca_certificate> <value>
+
+This directive sets the CA certificate to be used to verify the node's
+certificate, if tls_verify_certificate is set to C<yes>.  Default is
+@@CONFDIR@@/cacert.pem.
+
+=item B<tls_verify_depth> <value>
+
+This directive sets how many signings up a chain of signatures TLS is
+willing to go to reach a known, trusted CA when verifying a
+certificate.  Default is C<5>.
+
+=item B<tls_match> <value>
+
+This directive, if defined, searches a dump of the certificate provided by the
+remote host for the given regex.  The dump of the certificate is two lines of
+the form:
+
+        Subject Name: /C=c/ST=st/L=l/O=o/OU=ou/CN=cn/emailAddress=email
+        Issuer  Name: /C=c/ST=st/O=o/OU=ou/CN=cn/emailAddress=email
+
+So, for example, one could match the subject distinguished name by the directive:
+
+        tls_match Subject Name: /C=c/ST=st/L=l/O=o/OU=ou/CN=cn/emailAddress=email
+
+Note that the fields are dumped in the order they appear in the certificate.
+It's best to view the dump of the certificate by running munin-update in debug
+mode and reviewing the logs.
+
+Unfortunately, due to the limited functionality of the SSL module in use, it is
+not possible to provide finer-grained filtering.  By default this value is not
+defined.
+
-=back
-

trunk/node/lib/Munin/Node/Config.pm

@@ -88 +88 @@
-        tls_verify_certificate
-        tls_verify_depth
+        tls_match
-    );
-

trunk/node/lib/Munin/Node/Server.pm

@@ -249 +249 @@
-    my $tls_verify = $config->{tls_verify_certificate}
-                  || 'no';
+    my $tls_match  = $config->{tls_match};
-
-    my $depth = $config->{tls_verify_depth};
@@ -264 +265 @@
-        tls_vdepth   => $depth,
-        tls_verify   => $tls_verify,
+        tls_match    => $tls_match,
-        write_fd     => fileno(STDOUT),
-        write_func   => sub { print @_ },