Comments (6)
It's worth noting that, without the ability to specify a trusted CA, all TLS connections effectively have trustAllCertificates
set to true. The GELF protocol has nothing akin to verifying that the requested hostname matches the certificate subject like in HTTPS, so any certificate issued by a trusted root will be accepted.
from logback-gelf.
Thanks for bringing this up!
I doubt that configuring a trusted CA increases the security much as the domain name of the certificate (CN) is still not checked as defined in RFC 2818. An attacker with a certificate signed by the same CA (which is rather easy to obtain in larger enterprises) could still perform a MITM-attack. Maybe this domain name check should be added to the implementation as the logic is based on SSL/TLS and not HTTPS (in contrast to the specification and standard implementation in Java). LDAPS is using a similar implementation (RFC 4513) for example. But the Graylog guys should at least document something about that to not have completely different client implementations. Maybe RFC 7525 could be the basis for that.
As a first step, I've implemented a server certificate whitelist in the branch feature/explicit-certificate-trust.
Let me know what you think.
from logback-gelf.
Added certificate hostname verification (based on RFC 6125) per 2960bc4
from logback-gelf.
Hello. I am the person who put in #79 and am wondering about the MutualTLS. Has that also been added to the explicit-certificate-trust branch?
from logback-gelf.
@tparkercbn Not yet. As there was no feedback on the branch yet. It currently only contains server certificate whitelisting. I'm willing to invest more time on this if someone provides feedback.
from logback-gelf.
Hi @osiegmar. What would you like to have feedback on? We certainly can deploy and test in our environment if you are able to update the code to do mutual TLS.
Tom
from logback-gelf.
Related Issues (20)
- All newlines in short messages are replaced with whitespaces HOT 10
- GelfHttpAppender does not set Uri HOT 1
- Markers are sent with Brackets. Like "[MARKER_NAME]" instead of "MARKER_NAME" without brackets HOT 1
- Configurable max value length for key-value pairs and MDC HOT 6
- It reports only Sl4j logs not console logs HOT 3
- Macbook GelfUdpAppender garbled HOT 2
- GZIP Compression with GelfUdpAppender HOT 1
- Update logback-classic to 1.2.8 HOT 3
- Logback-classic release 1.2.9
- tcp configuration error HOT 3
- Add ability to log thread ID in addition to thread name HOT 2
- Enable adding multiple static fields via environment variable and/or logback.properties HOT 2
- Mutual TLS fails, HOT 1
- Add another method for adding static field to GelfEncoder HOT 2
- GelfMessage should fail on host = "", shortmessage="" HOT 4
- Add ability to log formatted time HOT 1
- Add use of structured arguments HOT 1
- JSON Encoding Performance HOT 1
- Several minor improvements HOT 1
- Faster MessageIdSupplier with less object allocation, error-prone HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from logback-gelf.