OpenSSL¶
Platform/OpenSsl/ wraps OpenSSL for TLS transport
and keyed at-rest cryptography on hosted targets. It fills the
Stream role with TLS and the
SecurityPolicy role for at-rest
integrity and confidentiality.
What a TLS stream must do is the same whichever library provides it, and is stated once under TLS obligations. This page covers what this adapter needs, how credentials reach it, and where it does not yet meet that contract.
What it ships¶
| Header | What it is |
|---|---|
SolidSyslogOpenSslAesGcmPolicy.h |
A keyed AES-256-GCM security policy (OpenSSL reference integration) that encrypts and authenticates each stored record - confidentiality plus tamper-detection for store-and-forward. |
SolidSyslogOpenSslAesGcmPolicyErrors.h |
Error codes and Source identity for the OpenSslAesGcmPolicy adapter. |
SolidSyslogOpenSslHmacSha256Policy.h |
A keyed HMAC-SHA256 security policy (OpenSSL reference integration) that authenticates each stored record - tamper-detection for store-and-forward without encryption. |
SolidSyslogOpenSslHmacSha256PolicyErrors.h |
Error codes and Source identity for the OpenSslHmacSha256Policy adapter. |
SolidSyslogOpenSslStream.h |
TLS over an injected byte-transport Stream (OpenSSL reference integration), for a StreamSender that needs an encrypted channel. |
SolidSyslogOpenSslStreamErrors.h |
Error codes and Source identity for the OpenSslStream adapter. |
Requirements¶
OpenSSL 3.0 or later. The CMake configure fails below that rather than the build, so an older libssl is caught before anything compiles.
A SolidSyslogSleepFunction is required and has no default.
Credentials are file paths¶
Trust anchors, and for mutual TLS the client certificate chain and its private key, are PEM files named in the configuration. The adapter reads them, so it needs them present and readable by the process at the moment a connection is made, not at startup.
The SSL_CTX is rebuilt on every open, re-reading each file named in the
configuration. Rotation is therefore a file replacement and a reconnection:
replace the file, and the new material is in force on the next connection —
either through ordinary reconnection after an outage, or immediately by calling
SolidSyslogSender_Disconnect. Nothing needs to be reloaded and nothing needs to
be restarted.
Where it differs from the contract¶
Four differences at 0.1.0, each tracked. Read them before relying on the corresponding obligation.
A half-supplied client credential stops delivery¶
A certificate without its key, or a key without its certificate, is rejected when the stream opens, so nothing is delivered until the configuration is corrected. The contract asks for it to be reported with delivery continuing, on the grounds that the collector is the enforcement point for our own credential.
This adapter is stricter than the contract rather than weaker, and the stricter behaviour is safe. Tracked as #734.
An expired certificate stops delivery¶
A peer certificate that is expired or not yet valid fails the handshake, even where it still chains to a trusted anchor. The contract asks for it to be reported with delivery continuing, because clock skew is the dominant cause and a device with a wrong clock is one whose logs you still want. Tracked as #731.
The cipher policy does not bind a TLS 1.3 connection¶
The cipher list is passed to OpenSSL unchanged and pins nothing of the library's own, as the contract asks. It governs TLS 1.2 and below only. OpenSSL has kept TLS 1.3 ciphersuites in a separate list since 1.1.1, and this adapter sets a protocol floor without a ceiling, so against a modern peer the negotiated connection uses OpenSSL's own TLS 1.3 defaults and the configured list has no effect on it. Tracked as #733.
The configuration is not checked when the stream is created¶
A configuration missing something the stream cannot work without is accepted, and the fault appears on the first connection attempt rather than at setup. Tracked as #732.