Skip to content

Commit 52240c5

Browse files
KbayeroJocLRojasylladamjabascal10
authored
Release/v10.9.2 (#1400)
* fix(sonicwall): optimize field parsing and clean double quotes * Upgrade pfSense filter to v2.1.0 with improved syslog parsing, optimized CSV processing for IPv4/IPv6 protocols and enhanced field handling * feat(agent): implement TLS support for syslog integrations. * fix(account): sanitize password in checkPassword method to prevent injection Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat(date-timezone): add New Zealand and Fiji timezones to the constants Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat(date-timezone): add New Zealand and Fiji timezones to the constants Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * fea: add tls connection options and setup steps for syslog integrations Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * fea: add tls connection options and setup steps for syslog integrations Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * fea: add tls connection options and setup steps for syslog integrations Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat: add tls connection options and setup steps for syslog integrations Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat(agent): validate TLS certificates before enabling TLS for integrations * feat: add tls connection options and setup steps for syslog integrations Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat: improve asset source sorting and display in assets view Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat(agent): add TLS support for syslog command generation and update argument handling Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat(agent): add TLS support for syslog command generation and update argument handling Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat(agent): refactor PowerShell command generation for TLS certificate loading Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat: add Liquibase changelogs for pfSense and SonicWall filter updates * Update CHANGELOG.md --------- Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> Co-authored-by: JocLRojas <joc.l.rojas02@gmail.com> Co-authored-by: Yadian Llada Lopez <yadian.llada@gmail.com> Co-authored-by: Manuel Abascal <mjabascal10@gmail.com>
1 parent e2e6ac6 commit 52240c5

File tree

26 files changed

+1839
-323
lines changed

26 files changed

+1839
-323
lines changed

‎CHANGELOG.md‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
1-
# UTMStack 10.9.1 Release Notes
1+
# UTMStack 10.9.2 Release Notes
22

3-
-- Dashboard Rendering with Time Filters
4-
Resolved performance issues affecting dashboard responsiveness when applying time-based filters.
3+
- Added new Pacific time zones (New Zealand and Fiji) to the Date Settings section.
4+
- Added TLS connection options and setup steps for secure Syslog integration
5+
- Improved sorting of asset sources in tables, ensuring consistent and predictable order for names, IPs, and combined entries.
6+
– Improved correlation rule handling for pfSense and SonicWall data sources to enhance detection accuracy and event normalization.

‎agent/config/const.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,12 @@ var (
3636
MESSAGE_HEADER = "utm_stack_agent_ds"
3737
BatchCapacity = 100
3838

39+
// TLS Configuration for Integrations
40+
IntegrationCertPath = filepath.Join(utils.GetMyPath(), "certs", "integration.crt")
41+
IntegrationKeyPath = filepath.Join(utils.GetMyPath(), "certs", "integration.key")
42+
IntegrationCAPath = filepath.Join(utils.GetMyPath(), "certs", "integration-ca.crt")
43+
44+
3945
// MaxConnectionTime = 120 * time.Second
4046
// SERV_NAME = "UTMStackAgent"
4147
// SERV_LOG = "utmstack_agent.log"

‎agent/main.go‎

Lines changed: 85 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -84,18 +84,88 @@ func main() {
8484
serv.InstallService()
8585
fmt.Println("[OK]")
8686
fmt.Println("UTMStackAgent service installed correctly")
87+
8788
case "enable-integration", "disable-integration":
8889
fmt.Println("Changing integration status ...")
8990
integration := os.Args[2]
9091
proto := os.Args[3]
9192

92-
port, err := modules.ChangeIntegrationStatus(integration, proto, (arg == "enable-integration"))
93+
tlsEnabled := false
94+
for _, arg := range os.Args[4:] {
95+
if arg == "--tls" {
96+
tlsEnabled = true
97+
break
98+
}
99+
}
100+
101+
var port string
102+
var err error
103+
104+
if arg == "enable-integration" && tlsEnabled {
105+
port, err = modules.ChangeIntegrationStatus(integration, proto, true, true)
106+
} else if arg == "enable-integration" {
107+
port, err = modules.ChangeIntegrationStatus(integration, proto, true, false)
108+
} else {
109+
port, err = modules.ChangeIntegrationStatus(integration, proto, false)
110+
}
111+
93112
if err != nil {
94-
fmt.Println("Error trying to change integration status: ", err)
113+
fmt.Println("Error:", err)
114+
os.Exit(1)
115+
}
116+
117+
if arg == "enable-integration" && tlsEnabled {
118+
fmt.Printf("Integration %s %s enabled with TLS on port %s\n", integration, proto, port)
119+
} else if arg == "enable-integration" {
120+
fmt.Printf("Integration %s %s enabled on port %s\n", integration, proto, port)
121+
} else {
122+
fmt.Printf("Integration %s %s disabled (port %s freed)\n", integration, proto, port)
123+
}
124+
time.Sleep(5 * time.Second)
125+
126+
case "load-tls-certs":
127+
if len(os.Args) < 4 {
128+
fmt.Println("Usage: ./utmstack_agent load-tls-certs <certificate_path> <private_key_path> [ca_certificate_path]")
129+
fmt.Println("Example: ./utmstack_agent load-tls-certs /path/to/server.crt /path/to/server.key /path/to/ca.crt")
130+
os.Exit(1)
131+
}
132+
133+
userCertPath := os.Args[2]
134+
userKeyPath := os.Args[3]
135+
var userCAPath string
136+
if len(os.Args) > 4 {
137+
userCAPath = os.Args[4]
138+
}
139+
140+
fmt.Println("Loading user TLS certificates ...")
141+
142+
fmt.Print("Validating certificate files ... ")
143+
if err := utils.ValidateIntegrationCertificates(userCertPath, userKeyPath); err != nil {
144+
fmt.Printf("\nError: Invalid certificate files: %v\n", err)
95145
os.Exit(1)
96146
}
97-
fmt.Printf("Action %s %s %s correctly in port %s\n", arg, integration, proto, port)
147+
fmt.Println("[OK]")
148+
149+
fmt.Print("Installing certificates ... ")
150+
src := utils.CertificateFiles{
151+
CertPath: userCertPath,
152+
KeyPath: userKeyPath,
153+
CAPath: userCAPath,
154+
}
155+
dest := utils.CertificateFiles{
156+
CertPath: config.IntegrationCertPath,
157+
KeyPath: config.IntegrationKeyPath,
158+
CAPath: config.IntegrationCAPath,
159+
}
160+
if err := utils.LoadUserCertificatesWithStruct(src, dest); err != nil {
161+
fmt.Printf("\nError loading certificates: %v\n", err)
162+
os.Exit(1)
163+
}
164+
fmt.Println("[OK]")
165+
166+
fmt.Println("TLS certificates loaded successfully!")
98167
time.Sleep(5 * time.Second)
168+
99169
case "change-port":
100170
fmt.Println("Changing integration port ...")
101171
integration := os.Args[2]
@@ -109,6 +179,7 @@ func main() {
109179
}
110180
fmt.Printf("Port changed correctly from %s to %s\n", old, port)
111181
time.Sleep(5 * time.Second)
182+
112183
case "uninstall":
113184
fmt.Print("Uninstalling UTMStackAgent service ...")
114185

@@ -160,6 +231,17 @@ func Help() {
160231
fmt.Println(" uninstall Uninstall the UTMStackAgent service")
161232
fmt.Println(" help Display this help message")
162233
fmt.Println()
234+
fmt.Println("TLS Certificate Management:")
235+
fmt.Println(" # Load your own certificates (RECOMMENDED)")
236+
fmt.Println(" ./utmstack_agent load-tls-certs /path/to/server.crt /path/to/server.key /path/to/ca.crt")
237+
fmt.Println(" ./utmstack_agent load-tls-certs /path/to/server.crt /path/to/server.key # Without CA")
238+
fmt.Println()
239+
fmt.Println("TLS Integration Examples:")
240+
fmt.Println(" ./utmstack_agent enable-integration syslog tcp --tls # Enable with TLS")
241+
fmt.Println(" ./utmstack_agent enable-integration syslog tcp # Enable without TLS (default)")
242+
fmt.Println(" ./utmstack_agent disable-integration syslog tcp # Disable (auto-disables TLS)")
243+
fmt.Println(" ./utmstack_agent check-tls-certs # Check certificate status")
244+
fmt.Println()
163245
fmt.Println("Note:")
164246
fmt.Println(" - Make sure to run commands with appropriate permissions.")
165247
fmt.Println(" - All commands require administrative privileges.")

‎agent/modules/configuration.go‎

Lines changed: 124 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,16 @@ import (
55
"net"
66
"os"
77
"strings"
8+
"time"
89

910
"github.com/utmstack/UTMStack/agent/config"
1011
"github.com/utmstack/UTMStack/agent/utils"
1112
)
1213

1314
type Port struct {
14-
IsListen bool `json:"enabled"`
15-
Port string `json:"value"`
15+
IsListen bool `json:"enabled"`
16+
Port string `json:"value"`
17+
TLSEnabled bool `json:"tls_enabled,omitempty"`
1618
}
1719

1820
type Integration struct {
@@ -59,7 +61,7 @@ func ConfigureCollectorFirstTime() error {
5961
return WriteCollectorConfig(integrations, config.CollectorFileName)
6062
}
6163

62-
func ChangeIntegrationStatus(logTyp string, proto string, isEnabled bool) (string, error) {
64+
func ChangeIntegrationStatus(logTyp string, proto string, isEnabled bool, tlsOptions ...bool) (string, error) {
6365
var port string
6466
cnf, err := ReadCollectorConfig()
6567
if err != nil {
@@ -78,9 +80,52 @@ func ChangeIntegrationStatus(logTyp string, proto string, isEnabled bool) (strin
7880
case "tcp":
7981
integration.TCP.IsListen = isEnabled
8082
port = integration.TCP.Port
83+
84+
// Handle TLS configuration if specified
85+
if len(tlsOptions) > 0 && isEnabled {
86+
if tlsOptions[0] {
87+
if !utils.CheckIfPathExist(config.IntegrationCertPath) || !utils.CheckIfPathExist(config.IntegrationKeyPath) {
88+
return "", fmt.Errorf("TLS certificates not found. Please load certificates first")
89+
}
90+
// Enable TLS
91+
integration.TCP.TLSEnabled = true
92+
mod := GetModule(logTyp)
93+
if mod != nil && mod.IsPortListen(proto) {
94+
mod.DisablePort(proto)
95+
time.Sleep(100 * time.Millisecond)
96+
err := mod.EnablePort(proto, true)
97+
if err != nil {
98+
return "", fmt.Errorf("error enabling TLS on running module: %v", err)
99+
}
100+
}
101+
} else {
102+
// Disable TLS
103+
integration.TCP.TLSEnabled = false
104+
mod := GetModule(logTyp)
105+
if mod != nil && mod.IsPortListen(proto) {
106+
mod.DisablePort(proto)
107+
time.Sleep(100 * time.Millisecond)
108+
err := mod.EnablePort(proto, false)
109+
if err != nil {
110+
return "", fmt.Errorf("error disabling TLS on running module: %v", err)
111+
}
112+
}
113+
}
114+
}
115+
116+
// Auto-disable TLS when disabling integration
117+
if !isEnabled {
118+
integration.TCP.TLSEnabled = false
119+
}
120+
81121
case "udp":
82122
integration.UDP.IsListen = isEnabled
83123
port = integration.UDP.Port
124+
125+
// TLS validation for UDP
126+
if len(tlsOptions) > 0 && tlsOptions[0] {
127+
return "", fmt.Errorf("TLS is not supported for UDP protocol. Use TCP for TLS connections")
128+
}
84129
}
85130

86131
cnf.Integrations[logTyp] = integration
@@ -145,7 +190,11 @@ func WriteCollectorConfig(integrations map[string]Integration, filename string)
145190
for name, integration := range integrations {
146191
fileContent += fmt.Sprintf(" \"%s\": {\n", name)
147192
if integration.TCP.Port != "" {
148-
fileContent += fmt.Sprintf(" \"tcp_port\": {\"enabled\": %t, \"value\": \"%s\"},\n", integration.TCP.IsListen, integration.TCP.Port)
193+
fileContent += fmt.Sprintf(" \"tcp_port\": {\"enabled\": %t, \"value\": \"%s\"", integration.TCP.IsListen, integration.TCP.Port)
194+
if integration.TCP.TLSEnabled {
195+
fileContent += fmt.Sprintf(", \"tls_enabled\": %t", integration.TCP.TLSEnabled)
196+
}
197+
fileContent += "},\n"
149198
}
150199
if integration.UDP.Port != "" {
151200
fileContent += fmt.Sprintf(" \"udp_port\": {\"enabled\": %t, \"value\": \"%s\"},\n", integration.UDP.IsListen, integration.UDP.Port)
@@ -184,3 +233,74 @@ func WriteCollectorConfigFromModules(mod []Module, filename string) error {
184233
}
185234
return WriteCollectorConfig(integrations, filename)
186235
}
236+
237+
func EnableTLSForIntegration(logTyp string, proto string) (string, error) {
238+
cnf, err := ReadCollectorConfig()
239+
if err != nil {
240+
return "", fmt.Errorf("error reading collector config: %v", err)
241+
}
242+
243+
if valid := config.ValidateModuleType(logTyp); valid == "nil" {
244+
return "", fmt.Errorf("invalid integration: %s", logTyp)
245+
}
246+
247+
integration := cnf.Integrations[logTyp]
248+
var port string
249+
250+
switch proto {
251+
case "tcp":
252+
if integration.TCP.Port == "" {
253+
return "", fmt.Errorf("TCP port not configured for %s", logTyp)
254+
}
255+
256+
port = integration.TCP.Port
257+
integration.TCP.TLSEnabled = true
258+
259+
mod := GetModule(logTyp)
260+
if mod != nil && mod.IsPortListen(proto) {
261+
mod.DisablePort(proto)
262+
time.Sleep(100 * time.Millisecond)
263+
err := mod.EnablePort(proto, true)
264+
if err != nil {
265+
return port, fmt.Errorf("error enabling TLS on running module: %v", err)
266+
}
267+
}
268+
case "udp":
269+
return "", fmt.Errorf("TLS not supported for UDP protocol")
270+
default:
271+
return "", fmt.Errorf("invalid protocol: %s", proto)
272+
}
273+
274+
cnf.Integrations[logTyp] = integration
275+
return port, WriteCollectorConfig(cnf.Integrations, config.CollectorFileName)
276+
}
277+
278+
func DisableTLSForIntegration(logTyp string, proto string) error {
279+
cnf, err := ReadCollectorConfig()
280+
if err != nil {
281+
return fmt.Errorf("error reading collector config: %v", err)
282+
}
283+
284+
integration := cnf.Integrations[logTyp]
285+
switch proto {
286+
case "tcp":
287+
integration.TCP.TLSEnabled = false
288+
289+
mod := GetModule(logTyp)
290+
if mod != nil && mod.IsPortListen(proto) {
291+
mod.DisablePort(proto)
292+
time.Sleep(100 * time.Millisecond)
293+
err := mod.EnablePort(proto, false)
294+
if err != nil {
295+
return fmt.Errorf("error disabling TLS on running module: %v", err)
296+
}
297+
}
298+
case "udp":
299+
return fmt.Errorf("TLS not supported for UDP protocol")
300+
default:
301+
return fmt.Errorf("invalid protocol: %s", proto)
302+
}
303+
304+
cnf.Integrations[logTyp] = integration
305+
return WriteCollectorConfig(cnf.Integrations, config.CollectorFileName)
306+
}

‎agent/modules/modules.go‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ type Module interface {
2020
IsPortListen(proto string) bool
2121
SetNewPort(proto string, port string)
2222
GetPort(proto string) string
23-
EnablePort(proto string)
23+
EnablePort(proto string, enableTLS bool) error
2424
DisablePort(proto string)
2525
}
2626

@@ -88,7 +88,12 @@ func StartModules() {
8888
if changeAllowed {
8989
moCache[index].SetNewPort(proto, port)
9090
if conf[1] {
91-
moCache[index].EnablePort(proto)
91+
enableTLS := proto == "tcp" && cnf.TCP.TLSEnabled
92+
93+
err := moCache[index].EnablePort(proto, enableTLS)
94+
if err != nil {
95+
utils.Logger.ErrorF("error enabling port for %s %s: %v", intType, proto, err)
96+
}
9297
}
9398
} else {
9499
utils.Logger.Info("change in port %s protocol %s not allowed for %s or out range %s-%s", port, proto, intType, config.PortRangeMin, config.PortRangeMax)

‎agent/modules/netflow.go‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -45,15 +45,20 @@ func GetNetflowModule() *NetflowModule {
4545
return netflowModule
4646
}
4747

48-
func (m *NetflowModule) EnablePort(proto string) {
48+
func (m *NetflowModule) EnablePort(proto string, enableTLS bool) error {
4949
if proto == "udp" && !m.IsEnabled {
50+
// NetFlow over UDP doesn't support TLS
51+
if enableTLS {
52+
utils.Logger.Info("TLS not supported for NetFlow (UDP protocol), ignoring TLS flag")
53+
}
54+
5055
utils.Logger.Info("Server %s listening in port: %s protocol: UDP", m.DataType, config.ProtoPorts[config.DataTypeNetflow].UDP)
5156
m.IsEnabled = true
5257

5358
port, err := strconv.Atoi(config.ProtoPorts[config.DataTypeNetflow].UDP)
5459
if err != nil {
5560
utils.Logger.ErrorF("error converting port to int: %v", err)
56-
return
61+
return err
5762
}
5863

5964
m.Listener, err = net.ListenUDP("udp", &net.UDPAddr{
@@ -62,7 +67,7 @@ func (m *NetflowModule) EnablePort(proto string) {
6267
})
6368
if err != nil {
6469
utils.Logger.ErrorF("error listening netflow: %v", err)
65-
return
70+
return err
6671
}
6772

6873
m.CTX, m.Cancel = context.WithCancel(context.Background())
@@ -122,6 +127,7 @@ func (m *NetflowModule) EnablePort(proto string) {
122127
}
123128
}()
124129
}
130+
return nil
125131
}
126132

127133
func (m *NetflowModule) DisablePort(proto string) {

0 commit comments

Comments
 (0)