added TLS options for TLS cert verification or to turn off TLS

This fixes #2

Author: Jason McFarland

cb-defense-connector.py

@@ -88,10 +88,20 @@ def fix_response(data):
 def send_syslog_tls(server_url, port, data):
 
     unsecured_client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-    client_socket = ssl.wrap_socket(unsecured_client_socket,
-                                    ca_certs=config.get('general', 'ca_cert'),
-                                    cert_reqs=ssl.CERT_REQUIRED,
-                                    ssl_version=ssl.PROTOCOL_TLSv1)
+
+    if config.getboolean('general', 'tls_verify'):
+        cert_reqs = ssl.CERT_REQUIRED
+    else:
+        cert_reqs = ssl.CERT_NONE
+
+    if config.getboolean('general', 'tls_enabled'):
+        client_socket = ssl.wrap_socket(unsecured_client_socket,
+                                        ca_certs=config.get('general', 'ca_cert'),
+                                        cert_reqs=cert_reqs,
+                                        ssl_version=ssl.PROTOCOL_TLSv1)
+    else:
+        client_socket = unsecured_client_socket
+
     client_socket.connect((server_url, port))
     client_socket.send(data)
     client_socket.close()
@@ -208,36 +218,49 @@ def verify_config_parse_servers():
     #
     # Sanity check the general stanza this includes the tcp/tls host, port, template, and cert
     #
-    if not config.get('general', 'tcp_tls_host'):
+    if not config.has_option('general', 'tcp_tls_host'):
         logger.error('Error: A tcp_tls_host is required in the general stanza')
         sys.exit(-1)
-    if not config.get('general', 'tcp_tls_port'):
+    if not config.has_option('general', 'tcp_tls_port'):
         logger.error('Error: A tcp_tls_port is required in the general stanza')
         sys.exit(-1)
-    if not config.get('general', 'template'):
+    if not config.has_option('general', 'template'):
         logger.error('Error: A template is required in the general stanza')
         sys.exit(-1)
-    if not config.get('general', 'ca_cert'):
-        #
-        # A ca_cert is not required
-        #
-        config.set('general', 'ca_cert', '')
-        #
-        # Warn the user that certificate verification will not occur
-        #
-        logger.warning('Warning: A ca_cert was not found.  The remote tcp server certificate can NOT be verified')
-
+    if not config.has_option('general', 'ca_cert'):
+        logger.error("Error: Must specify ca_cert file path in the general stanza")
+        sys.exit(-1)
+    if not config.has_option('general', 'tls_enabled'):
+        logger.error("Error: Must specify tls_enabled in the general stanza")
+        sys.exit(-1)
+    if not config.has_option('general', 'tls_verify'):
+        logger.error("Error: Must specify tls_verify in config file")
+        sys.exit(-1)
 
     #
     # Sanity check the port
     #
     try:
-        int(config.get('general', 'tcp_tls_port'))
-    except Exception as e:
+        config.getint('general', 'tcp_tls_port')
+    except ValueError as e:
         logger.error(e.message)
         logger.error("Error: tcp_tls_port must be an integer")
         sys.exit(-1)
 
+    try:
+        config.getboolean('general', 'tls_enabled')
+    except ValueError as e:
+        logger.error(e.message)
+        logger.error("Error: tls_enabled must be either true or false")
+        sys.exit(-1)
+
+    try:
+        config.getboolean('general', 'tls_verify')
+    except ValueError as e:
+        logger.error(e.message)
+        logger.error("Error: tls_verify must be either true or false")
+        sys.exit(-1)
+
     #
     # Parse out multiple servers
     #

root/etc/cb/integrations/cb-defense/cb-defense-connector.conf.example

@@ -7,11 +7,21 @@
 #
 template = {{source}}|{{version}}|{{vendor}}|{{product}}|{{dev_version}}|{{signature}}|{{name}}|{{severity}}|{{extension}}
 
+#
+# Specify whether to use TLS over TCP connection.  If false, then the connector will use unencrypted tcp connection
+#
+tls_enabled = true
+
 #
 # Specify a file containing PEM-encoded CA certificates for verifying the peer server when using TLS+TCP syslog
 #
 ca_cert = /etc/cb/integrations/cb-defense/cert.pem
 
+#
+# Uncomment tls_verify and set to "false" in order to disable verification of the peer server certificate
+#
+tls_verify = true
+
 #
 # Specify a host to send notifications from all Cb Defense Servers
 #
@@ -22,17 +32,17 @@ tcp_tls_host = localhost
 #
 tcp_tls_port = 8888
 
-[cbdefenseserver1]
+[cbdefense1]
 
 #
 # Cb Defense Connector ID
 #
-connector_id = F8KFGNF100
+connector_id = F8KF111111
 
 #
 # Cb Defense API Key
 #
-api_key = WT9T3QDP4UGCK2NS96999999
+api_key = WT9T3QDP4UGCK2NS96111111
 
 #
 # Cb Defense Server URL
@@ -41,9 +51,10 @@ api_key = WT9T3QDP4UGCK2NS96999999
 server_url = https://server.yourcompany.com
 
 #
-# For more than one Cb Defense Servers, add another server using the following template including the stanza
+# For more than one Cb Defense Server, add another server using the following template including the stanza
 #
 #[cbdefenseserver2]
-#connector_id = F8KFGNFVS6
-#api_key = WT9T3QDP4UGCK2NS96JSGTDZ
-#server_url = https://server.yourcompany.com
+#connector_id = F8KF111111
+#api_key = WT9T3QDP4UGCK2NS96111111
+#server_url = https://server2.yourcompany.com
+