diff --git a/include/fluent-bit/flb_oauth2.h b/include/fluent-bit/flb_oauth2.h index 62777abcfe5..ecfba30a3e0 100644 --- a/include/fluent-bit/flb_oauth2.h +++ b/include/fluent-bit/flb_oauth2.h @@ -93,10 +93,12 @@ struct flb_oauth2 { struct flb_upstream *u; }; -struct flb_oauth2 *flb_oauth2_create(struct flb_config *config, +struct flb_output_instance; + +struct flb_oauth2 *flb_oauth2_create(struct flb_output_instance *ins, const char *auth_url, int expire_sec); struct flb_oauth2 *flb_oauth2_create_from_config( - struct flb_config *config, + struct flb_output_instance *ins, const struct flb_oauth2_config *cfg); void flb_oauth2_destroy(struct flb_oauth2 *ctx); void flb_oauth2_config_destroy(struct flb_oauth2_config *cfg); diff --git a/plugins/filter_kubernetes/kube_meta.c b/plugins/filter_kubernetes/kube_meta.c index 40cb8460215..5596c892e18 100644 --- a/plugins/filter_kubernetes/kube_meta.c +++ b/plugins/filter_kubernetes/kube_meta.c @@ -2284,6 +2284,7 @@ int flb_kube_pod_association_init(struct flb_kube *ctx, struct flb_config *confi flb_plg_error(ctx->ins, "[kube_meta] could not create TLS config for pod association host"); return -1; } + flb_tls_set_verify_hostname(ctx->aws_pod_association_tls, ctx->tls_verify_hostname); ctx->aws_pod_association_upstream = flb_upstream_create(config, ctx->aws_pod_association_host, ctx->aws_pod_association_port, diff --git a/plugins/filter_nightfall/nightfall.c b/plugins/filter_nightfall/nightfall.c index 3e37d2a0bc4..29fd1cdf99d 100644 --- a/plugins/filter_nightfall/nightfall.c +++ b/plugins/filter_nightfall/nightfall.c @@ -103,6 +103,7 @@ static int cb_nightfall_init(struct flb_filter_instance *f_ins, flb_free(ctx); return -1; } + flb_tls_set_verify_hostname(ctx->tls, ctx->tls_verify_hostname); ctx->upstream = flb_upstream_create_url(config, FLB_FILTER_NIGHTFALL_API_URL, @@ -630,6 +631,11 @@ static struct flb_config_map config_map[] = { 0, FLB_TRUE, offsetof(struct flb_filter_nightfall, tls_verify), "Enable or disable verification of TLS peer certificate" }, + { + FLB_CONFIG_MAP_BOOL, "tls.verify_hostname", "off", + 0, FLB_TRUE, offsetof(struct flb_filter_nightfall, tls_verify_hostname), + "Enable or disable TLS hostname verification" + }, { FLB_CONFIG_MAP_STR, "tls.vhost", NULL, 0, FLB_TRUE, offsetof(struct flb_filter_nightfall, tls_vhost), diff --git a/plugins/filter_nightfall/nightfall.h b/plugins/filter_nightfall/nightfall.h index e190c1d5195..16e5e2cc519 100644 --- a/plugins/filter_nightfall/nightfall.h +++ b/plugins/filter_nightfall/nightfall.h @@ -45,6 +45,7 @@ struct flb_filter_nightfall { double sampling_rate; int tls_debug; int tls_verify; + int tls_verify_hostname; char *tls_ca_path; flb_sds_t tls_vhost; diff --git a/plugins/in_kubernetes_events/kubernetes_events_conf.c b/plugins/in_kubernetes_events/kubernetes_events_conf.c index d7b2fdc8ada..87433548415 100644 --- a/plugins/in_kubernetes_events/kubernetes_events_conf.c +++ b/plugins/in_kubernetes_events/kubernetes_events_conf.c @@ -121,6 +121,8 @@ static int network_init(struct k8s_events *ctx, struct flb_config *config) return -1; } + flb_tls_set_verify_hostname(ctx->tls, ctx->ins->tls_verify_hostname); + io_type = FLB_IO_TLS; } diff --git a/plugins/out_azure_blob/azure_blob_conf.c b/plugins/out_azure_blob/azure_blob_conf.c index 9c2d2300d7b..cb8144e37bf 100644 --- a/plugins/out_azure_blob/azure_blob_conf.c +++ b/plugins/out_azure_blob/azure_blob_conf.c @@ -316,6 +316,7 @@ static int flb_azure_blob_apply_remote_configuration(struct flb_azure_blob *cont char *port = NULL; char *uri = NULL; uint16_t port_as_short; + int io_flags = FLB_IO_TCP; /* Parse and split URL */ ret = flb_utils_url_split(context->configuration_endpoint_url, @@ -343,6 +344,9 @@ static int flb_azure_blob_apply_remote_configuration(struct flb_azure_blob *cont } if (scheme != NULL) { + if (strcasecmp(scheme, "https") == 0) { + io_flags = FLB_IO_TLS; + } flb_free(scheme); scheme = NULL; } @@ -369,11 +373,11 @@ static int flb_azure_blob_apply_remote_configuration(struct flb_azure_blob *cont } tls_context = flb_tls_create(FLB_TLS_CLIENT_MODE, - FLB_FALSE, + context->ins->tls_verify, FLB_FALSE, host, - NULL, - NULL, + context->ins->tls_ca_path, + context->ins->tls_ca_file, NULL, NULL, NULL); @@ -387,10 +391,11 @@ static int flb_azure_blob_apply_remote_configuration(struct flb_azure_blob *cont return -2; } + flb_tls_set_verify_hostname(tls_context, context->ins->tls_verify_hostname); upstream = flb_upstream_create_url(context->config, context->configuration_endpoint_url, - FLB_IO_TCP, + io_flags, tls_context); if (upstream == NULL) { diff --git a/plugins/out_azure_kusto/azure_kusto.c b/plugins/out_azure_kusto/azure_kusto.c index bb6883463c4..3e4ea0997fa 100644 --- a/plugins/out_azure_kusto/azure_kusto.c +++ b/plugins/out_azure_kusto/azure_kusto.c @@ -1003,7 +1003,7 @@ static int cb_azure_kusto_init(struct flb_output_instance *ins, struct flb_confi /* Create oauth2 context */ ctx->o = - flb_oauth2_create(ctx->config, ctx->oauth_url, FLB_AZURE_KUSTO_TOKEN_REFRESH); + flb_oauth2_create(ins, ctx->oauth_url, FLB_AZURE_KUSTO_TOKEN_REFRESH); if (!ctx->o) { flb_plg_error(ctx->ins, "cannot create oauth2 context"); if (ctx->buffering_enabled == FLB_TRUE) { diff --git a/plugins/out_azure_logs_ingestion/azure_logs_ingestion_conf.c b/plugins/out_azure_logs_ingestion/azure_logs_ingestion_conf.c index 69aa00f2053..1c7aa934665 100644 --- a/plugins/out_azure_logs_ingestion/azure_logs_ingestion_conf.c +++ b/plugins/out_azure_logs_ingestion/azure_logs_ingestion_conf.c @@ -190,7 +190,7 @@ struct flb_az_li* flb_az_li_ctx_create(struct flb_output_instance *ins, pthread_mutex_init(&ctx->token_mutex, NULL); /* Create oauth2 context */ - ctx->u_auth = flb_oauth2_create(config, ctx->auth_url, + ctx->u_auth = flb_oauth2_create(ins, ctx->auth_url, FLB_AZ_LI_TOKEN_TIMEOUT); if (!ctx->u_auth) { flb_plg_error(ins, "cannot create oauth2 context"); diff --git a/plugins/out_bigquery/bigquery.c b/plugins/out_bigquery/bigquery.c index 2701cf7d3ec..d48d8ab5512 100644 --- a/plugins/out_bigquery/bigquery.c +++ b/plugins/out_bigquery/bigquery.c @@ -737,6 +737,7 @@ static int cb_bigquery_init(struct flb_output_instance *ins, flb_bigquery_conf_destroy(ctx); return -1; } + flb_tls_set_verify_hostname(ctx->aws_tls, ins->tls_verify_hostname); ctx->aws_provider = flb_standard_chain_provider_create(config, ctx->aws_tls, @@ -776,6 +777,7 @@ static int cb_bigquery_init(struct flb_output_instance *ins, flb_bigquery_conf_destroy(ctx); return -1; } + flb_tls_set_verify_hostname(ctx->aws_sts_tls, ins->tls_verify_hostname); ctx->aws_sts_upstream = flb_upstream_create(config, ctx->aws_sts_endpoint, @@ -807,6 +809,7 @@ static int cb_bigquery_init(struct flb_output_instance *ins, flb_bigquery_conf_destroy(ctx); return -1; } + flb_tls_set_verify_hostname(ctx->google_sts_tls, ins->tls_verify_hostname); ctx->google_sts_upstream = flb_upstream_create_url(config, FLB_BIGQUERY_GOOGLE_STS_URL, @@ -835,6 +838,7 @@ static int cb_bigquery_init(struct flb_output_instance *ins, flb_bigquery_conf_destroy(ctx); return -1; } + flb_tls_set_verify_hostname(ctx->google_iam_tls, ins->tls_verify_hostname); ctx->google_iam_upstream = flb_upstream_create_url(config, FLB_BIGQUERY_GOOGLE_IAM_URL, @@ -854,7 +858,7 @@ static int cb_bigquery_init(struct flb_output_instance *ins, } /* Create oauth2 context */ - ctx->o = flb_oauth2_create(ctx->config, FLB_BIGQUERY_AUTH_URL, 3000); + ctx->o = flb_oauth2_create(ins, FLB_BIGQUERY_AUTH_URL, 3000); if (!ctx->o) { flb_plg_error(ctx->ins, "cannot create oauth2 context"); return -1; diff --git a/plugins/out_chronicle/chronicle.c b/plugins/out_chronicle/chronicle.c index d02ff3d4304..1334b5293ed 100644 --- a/plugins/out_chronicle/chronicle.c +++ b/plugins/out_chronicle/chronicle.c @@ -489,14 +489,14 @@ static int cb_chronicle_init(struct flb_output_instance *ins, io_flags, ins->tls); if (!ctx->u) { flb_plg_error(ctx->ins, "upstream creation failed"); - return -1; + goto error; } /* Create oauth2 context */ - ctx->o = flb_oauth2_create(ctx->config, FLB_CHRONICLE_AUTH_URL, 3000); + ctx->o = flb_oauth2_create(ins, FLB_CHRONICLE_AUTH_URL, 3000); if (!ctx->o) { flb_plg_error(ctx->ins, "cannot create oauth2 context"); - return -1; + goto error; } flb_output_upstream_set(ctx->u, ins); @@ -520,12 +520,21 @@ static int cb_chronicle_init(struct flb_output_instance *ins, if (ret != 0) { flb_plg_error(ctx->ins, "Validate log_type failed. '%s' is not supported. ret = %d", ctx->log_type, ret); - return -1; + goto error; } } } return 0; + +error: + if (ctx->u) { + flb_upstream_destroy(ctx->u); + } + pthread_mutex_destroy(&ctx->token_mutex); + flb_chronicle_conf_destroy(ctx); + flb_output_set_context(ins, NULL); + return -1; } enum chronicle_log_key_result { diff --git a/plugins/out_cloudwatch_logs/cloudwatch_logs.c b/plugins/out_cloudwatch_logs/cloudwatch_logs.c index f581406d928..fdf80f3341c 100644 --- a/plugins/out_cloudwatch_logs/cloudwatch_logs.c +++ b/plugins/out_cloudwatch_logs/cloudwatch_logs.c @@ -270,6 +270,7 @@ static int cb_cloudwatch_init(struct flb_output_instance *ins, flb_plg_error(ctx->ins, "Failed to create tls context"); goto error; } + flb_tls_set_verify_hostname(ctx->cred_tls, ins->tls_verify_hostname); ctx->client_tls = flb_tls_create(FLB_TLS_CLIENT_MODE, ins->tls_verify, @@ -284,6 +285,7 @@ static int cb_cloudwatch_init(struct flb_output_instance *ins, flb_plg_error(ctx->ins, "Failed to create tls context"); goto error; } + flb_tls_set_verify_hostname(ctx->client_tls, ins->tls_verify_hostname); ctx->aws_provider = flb_standard_chain_provider_create(config, ctx->cred_tls, @@ -320,6 +322,7 @@ static int cb_cloudwatch_init(struct flb_output_instance *ins, flb_errno(); goto error; } + flb_tls_set_verify_hostname(ctx->sts_tls, ins->tls_verify_hostname); ctx->base_aws_provider = ctx->aws_provider; diff --git a/plugins/out_es/es_conf.c b/plugins/out_es/es_conf.c index 79f2ddb2e9c..5ca393ad987 100644 --- a/plugins/out_es/es_conf.c +++ b/plugins/out_es/es_conf.c @@ -163,6 +163,8 @@ static int flb_es_node_ctx_aws_init(struct flb_es_node_ctx *node_ctx, flb_errno(); return -1; } + flb_tls_set_verify_hostname(node_ctx->aws_tls, + ins->tls_verify_hostname || node->tls_verify_hostname); provider = flb_standard_chain_provider_create(config, node_ctx->aws_tls, @@ -205,6 +207,8 @@ static int flb_es_node_ctx_aws_init(struct flb_es_node_ctx *node_ctx, flb_errno(); return -1; } + flb_tls_set_verify_hostname(node_ctx->aws_sts_tls, + ins->tls_verify_hostname || node->tls_verify_hostname); provider = flb_sts_provider_create(config, node_ctx->aws_sts_tls, @@ -759,6 +763,7 @@ struct flb_elasticsearch *flb_es_conf_create(struct flb_output_instance *ins, flb_es_conf_destroy(ctx); return NULL; } + flb_tls_set_verify_hostname(ctx->aws_tls, ins->tls_verify_hostname); tmp = flb_output_get_property("aws_region", ins); if (!tmp) { @@ -820,6 +825,7 @@ struct flb_elasticsearch *flb_es_conf_create(struct flb_output_instance *ins, flb_es_conf_destroy(ctx); return NULL; } + flb_tls_set_verify_hostname(ctx->aws_sts_tls, ins->tls_verify_hostname); ctx->aws_provider = flb_sts_provider_create(config, ctx->aws_sts_tls, diff --git a/plugins/out_gcs/gcs.c b/plugins/out_gcs/gcs.c index 9845efa1cc9..1cdf1761918 100644 --- a/plugins/out_gcs/gcs.c +++ b/plugins/out_gcs/gcs.c @@ -1967,7 +1967,7 @@ static int cb_gcs_init(struct flb_output_instance *ins, struct flb_config *confi flb_plg_info(ins, "using GCE/GKE metadata server authentication"); } - ctx->o = flb_oauth2_create(config, FLB_GCS_AUTH_URL, FLB_GCS_TOKEN_REFRESH); + ctx->o = flb_oauth2_create(ins, FLB_GCS_AUTH_URL, FLB_GCS_TOKEN_REFRESH); if (!ctx->o) { goto error; } diff --git a/plugins/out_http/http_conf.c b/plugins/out_http/http_conf.c index 7731b4ee025..ec8ab3e8398 100644 --- a/plugins/out_http/http_conf.c +++ b/plugins/out_http/http_conf.c @@ -383,7 +383,7 @@ struct flb_out_http *flb_http_conf_create(struct flb_output_instance *ins, return NULL; } - ctx->oauth2_ctx = flb_oauth2_create_from_config(config, &ctx->oauth2_config); + ctx->oauth2_ctx = flb_oauth2_create_from_config(ins, &ctx->oauth2_config); if (!ctx->oauth2_ctx) { flb_plg_error(ctx->ins, "failed to initialize oauth2 context"); flb_http_conf_destroy(ctx); diff --git a/plugins/out_kinesis_firehose/firehose.c b/plugins/out_kinesis_firehose/firehose.c index 431239de747..ef77b7d62c3 100644 --- a/plugins/out_kinesis_firehose/firehose.c +++ b/plugins/out_kinesis_firehose/firehose.c @@ -188,6 +188,7 @@ static int cb_firehose_init(struct flb_output_instance *ins, flb_plg_error(ctx->ins, "Failed to create tls context"); goto error; } + flb_tls_set_verify_hostname(ctx->cred_tls, ins->tls_verify_hostname); ctx->client_tls = flb_tls_create(FLB_TLS_CLIENT_MODE, FLB_TRUE, @@ -202,6 +203,7 @@ static int cb_firehose_init(struct flb_output_instance *ins, flb_plg_error(ctx->ins, "Failed to create tls context"); goto error; } + flb_tls_set_verify_hostname(ctx->client_tls, ins->tls_verify_hostname); ctx->aws_provider = flb_standard_chain_provider_create(config, ctx->cred_tls, @@ -238,6 +240,7 @@ static int cb_firehose_init(struct flb_output_instance *ins, flb_errno(); goto error; } + flb_tls_set_verify_hostname(ctx->sts_tls, ins->tls_verify_hostname); ctx->base_aws_provider = ctx->aws_provider; diff --git a/plugins/out_kinesis_streams/kinesis.c b/plugins/out_kinesis_streams/kinesis.c index 6a58b649191..46f543cc973 100644 --- a/plugins/out_kinesis_streams/kinesis.c +++ b/plugins/out_kinesis_streams/kinesis.c @@ -188,6 +188,7 @@ static int cb_kinesis_init(struct flb_output_instance *ins, flb_plg_error(ctx->ins, "Failed to create tls context"); goto error; } + flb_tls_set_verify_hostname(ctx->cred_tls, ins->tls_verify_hostname); ctx->client_tls = flb_tls_create(FLB_TLS_CLIENT_MODE, FLB_TRUE, @@ -202,6 +203,7 @@ static int cb_kinesis_init(struct flb_output_instance *ins, flb_plg_error(ctx->ins, "Failed to create tls context"); goto error; } + flb_tls_set_verify_hostname(ctx->client_tls, ins->tls_verify_hostname); ctx->aws_provider = flb_standard_chain_provider_create(config, ctx->cred_tls, @@ -245,6 +247,7 @@ static int cb_kinesis_init(struct flb_output_instance *ins, flb_errno(); goto error; } + flb_tls_set_verify_hostname(ctx->sts_tls, ins->tls_verify_hostname); ctx->base_aws_provider = ctx->aws_provider; diff --git a/plugins/out_opensearch/os_conf.c b/plugins/out_opensearch/os_conf.c index ffce0c29b47..f407355ad23 100644 --- a/plugins/out_opensearch/os_conf.c +++ b/plugins/out_opensearch/os_conf.c @@ -263,6 +263,7 @@ struct flb_opensearch *flb_os_conf_create(struct flb_output_instance *ins, flb_os_conf_destroy(ctx); return NULL; } + flb_tls_set_verify_hostname(ctx->aws_tls, ins->tls_verify_hostname); tmp = flb_output_get_property("aws_region", ins); if (!tmp) { @@ -324,6 +325,7 @@ struct flb_opensearch *flb_os_conf_create(struct flb_output_instance *ins, flb_os_conf_destroy(ctx); return NULL; } + flb_tls_set_verify_hostname(ctx->aws_sts_tls, ins->tls_verify_hostname); ctx->aws_provider = flb_sts_provider_create(config, ctx->aws_sts_tls, diff --git a/plugins/out_opentelemetry/opentelemetry.c b/plugins/out_opentelemetry/opentelemetry.c index 4ca2d4eb382..62c324ed3e7 100644 --- a/plugins/out_opentelemetry/opentelemetry.c +++ b/plugins/out_opentelemetry/opentelemetry.c @@ -205,7 +205,9 @@ int opentelemetry_legacy_post(struct opentelemetry_context *ctx, struct flb_slist_entry *val; struct flb_config_map_val *mv; struct flb_http_client *c; +#if defined(FLB_HAVE_SIGNV4) && defined(FLB_HAVE_AWS) flb_sds_t signature = NULL; +#endif compressed = FLB_FALSE; diff --git a/plugins/out_opentelemetry/opentelemetry_conf.c b/plugins/out_opentelemetry/opentelemetry_conf.c index c09cbf9eb2a..ab603e0a42f 100644 --- a/plugins/out_opentelemetry/opentelemetry_conf.c +++ b/plugins/out_opentelemetry/opentelemetry_conf.c @@ -455,7 +455,7 @@ struct opentelemetry_context *flb_opentelemetry_context_create(struct flb_output return NULL; } - ctx->oauth2_ctx = flb_oauth2_create_from_config(config, &ctx->oauth2_config); + ctx->oauth2_ctx = flb_oauth2_create_from_config(ins, &ctx->oauth2_config); if (!ctx->oauth2_ctx) { flb_plg_error(ctx->ins, "failed to initialize oauth2 context"); flb_opentelemetry_context_destroy(ctx); diff --git a/plugins/out_s3/s3.c b/plugins/out_s3/s3.c index e2c730d20b5..895b4a40a59 100644 --- a/plugins/out_s3/s3.c +++ b/plugins/out_s3/s3.c @@ -1424,6 +1424,7 @@ static int cb_s3_init(struct flb_output_instance *ins, flb_plg_error(ctx->ins, "Failed to create tls context"); return -1; } + flb_tls_set_verify_hostname(ctx->client_tls, ins->tls_verify_hostname); } /* AWS provider needs a separate TLS instance */ @@ -1440,6 +1441,7 @@ static int cb_s3_init(struct flb_output_instance *ins, flb_errno(); return -1; } + flb_tls_set_verify_hostname(ctx->provider_tls, ins->tls_verify_hostname); ctx->provider = flb_standard_chain_provider_create(config, ctx->provider_tls, @@ -1475,6 +1477,7 @@ static int cb_s3_init(struct flb_output_instance *ins, flb_errno(); return -1; } + flb_tls_set_verify_hostname(ctx->sts_provider_tls, ins->tls_verify_hostname); session_name = flb_sts_session_name(); if (!session_name) { @@ -2897,6 +2900,7 @@ static int blob_initialize_authorization_endpoint_upstream(struct flb_s3 *contex char *port = NULL; char *uri = NULL; int upstream_flags; + int io_flags = FLB_IO_TCP; context->authorization_endpoint_upstream = NULL; context->authorization_endpoint_tls_context = NULL; @@ -2914,6 +2918,9 @@ static int blob_initialize_authorization_endpoint_upstream(struct flb_s3 *contex } if (scheme != NULL) { + if (strcasecmp(scheme, "https") == 0) { + io_flags = FLB_IO_TLS; + } flb_free(scheme); scheme = NULL; @@ -2942,11 +2949,11 @@ static int blob_initialize_authorization_endpoint_upstream(struct flb_s3 *contex } tls_context = flb_tls_create(FLB_TLS_CLIENT_MODE, - FLB_FALSE, + context->ins->tls_verify, FLB_FALSE, host, - NULL, - NULL, + context->ins->tls_ca_path, + context->ins->tls_ca_file, NULL, NULL, NULL); @@ -2960,10 +2967,11 @@ static int blob_initialize_authorization_endpoint_upstream(struct flb_s3 *contex return -2; } + flb_tls_set_verify_hostname(tls_context, context->ins->tls_verify_hostname); upstream = flb_upstream_create_url(context->ins->config, context->authorization_endpoint_url, - FLB_IO_TCP, + io_flags, tls_context); if (upstream == NULL) { diff --git a/plugins/out_stackdriver/stackdriver.c b/plugins/out_stackdriver/stackdriver.c index 9c2e0a2a45e..bd56f9fcc5d 100644 --- a/plugins/out_stackdriver/stackdriver.c +++ b/plugins/out_stackdriver/stackdriver.c @@ -1397,7 +1397,7 @@ static int cb_stackdriver_init(struct flb_output_instance *ins, FLB_IO_TCP, NULL); /* Create oauth2 context */ - ctx->o = flb_oauth2_create(ctx->config, FLB_STD_AUTH_URL, 3000); + ctx->o = flb_oauth2_create(ins, FLB_STD_AUTH_URL, 3000); if (!ctx->u) { flb_plg_error(ctx->ins, "upstream creation failed"); diff --git a/src/aws/flb_aws_credentials.c b/src/aws/flb_aws_credentials.c index 37310676863..e989ab24372 100644 --- a/src/aws/flb_aws_credentials.c +++ b/src/aws/flb_aws_credentials.c @@ -389,6 +389,7 @@ struct flb_aws_provider *flb_managed_chain_provider_create(struct flb_output_ins flb_errno(); goto error; } + flb_tls_set_verify_hostname(cred_tls, ins->tls_verify_hostname); region = flb_output_get_property(config_key_region, ins); if (!region) { @@ -441,6 +442,7 @@ struct flb_aws_provider *flb_managed_chain_provider_create(struct flb_output_ins flb_errno(); goto error; } + flb_tls_set_verify_hostname(sts_tls, ins->tls_verify_hostname); aws_provider = flb_sts_provider_create(config, sts_tls, diff --git a/src/flb_oauth2.c b/src/flb_oauth2.c index f0dda0e1cf0..b621c2698aa 100644 --- a/src/flb_oauth2.c +++ b/src/flb_oauth2.c @@ -24,6 +24,7 @@ #include #include #include +#include #include #include #include @@ -358,7 +359,7 @@ void flb_oauth2_config_destroy(struct flb_oauth2_config *cfg) } static int oauth2_setup_upstream(struct flb_oauth2 *ctx, - struct flb_config *config, + struct flb_output_instance *ins, const char *auth_url) { int ret; @@ -421,11 +422,17 @@ static int oauth2_setup_upstream(struct flb_oauth2 *ctx, goto error; } + ret = flb_tls_set_verify_hostname(ctx->tls, ins->tls_verify_hostname); + if (ret != 0) { + flb_error("[oauth2] error setting TLS hostname verification"); + goto error; + } + if (strcmp(prot, "https") == 0) { - ctx->u = flb_upstream_create_url(config, auth_url, FLB_IO_TLS, ctx->tls); + ctx->u = flb_upstream_create_url(ins->config, auth_url, FLB_IO_TLS, ctx->tls); } else { - ctx->u = flb_upstream_create_url(config, auth_url, FLB_IO_TCP, NULL); + ctx->u = flb_upstream_create_url(ins->config, auth_url, FLB_IO_TCP, NULL); } if (!ctx->u) { @@ -1178,7 +1185,7 @@ static int oauth2_token_needs_refresh(struct flb_oauth2 *ctx, int force_refresh) return FLB_FALSE; } -struct flb_oauth2 *flb_oauth2_create(struct flb_config *config, +struct flb_oauth2 *flb_oauth2_create(struct flb_output_instance *ins, const char *auth_url, int expire_sec) { struct flb_oauth2_config cfg; @@ -1191,14 +1198,14 @@ struct flb_oauth2 *flb_oauth2_create(struct flb_config *config, cfg.token_url = flb_sds_create(auth_url); cfg.refresh_skew = FLB_OAUTH2_DEFAULT_SKEW_SECS; - ctx = flb_oauth2_create_from_config(config, &cfg); + ctx = flb_oauth2_create_from_config(ins, &cfg); flb_oauth2_config_destroy(&cfg); return ctx; } -struct flb_oauth2 *flb_oauth2_create_from_config(struct flb_config *config, +struct flb_oauth2 *flb_oauth2_create_from_config(struct flb_output_instance *ins, const struct flb_oauth2_config *cfg) { int ret; @@ -1260,7 +1267,7 @@ struct flb_oauth2 *flb_oauth2_create_from_config(struct flb_config *config, return NULL; } - ret = oauth2_setup_upstream(ctx, config, ctx->auth_url); + ret = oauth2_setup_upstream(ctx, ins, ctx->auth_url); if (ret != 0) { flb_oauth2_destroy(ctx); return NULL; diff --git a/src/wasm/http_client.c b/src/wasm/http_client.c index 25e6db14561..f00309e9175 100644 --- a/src/wasm/http_client.c +++ b/src/wasm/http_client.c @@ -283,7 +283,7 @@ int flb_wasm_http_read_response(struct flb_http_client *c, int id) } /* Native plugins may link these paths even when OAuth2 is disabled. */ -struct flb_oauth2 *flb_oauth2_create_from_config(struct flb_config *config, +struct flb_oauth2 *flb_oauth2_create_from_config(struct flb_output_instance *ins, const struct flb_oauth2_config *cfg) { flb_error("[oauth2] browser token acquisition is not implemented"); diff --git a/tests/internal/network_dns.c b/tests/internal/network_dns.c index 659cf0a4482..c3253f6ce40 100644 --- a/tests/internal/network_dns.c +++ b/tests/internal/network_dns.c @@ -66,6 +66,7 @@ static void test_dns_timeout(char *mode, int upstream_first, int timeout) struct flb_sched_timer *timer; struct flb_sched_timer *deadline = NULL; struct mk_list *head; + struct mk_list *tmp; struct mk_event_loop *evl; #ifdef FLB_SYSTEM_WINDOWS WSADATA wsa_data; @@ -144,18 +145,14 @@ static void test_dns_timeout(char *mode, int upstream_first, int timeout) TEST_CHECK(mk_list_size(&context.upstream->queue.destroy_queue) == 1); } - /* With a deadline, withhold DNS events to simulate an unresponsive server. - * Without one, let the configured resolver complete the .invalid lookup so - * the coroutine and lookup context can be cleaned up normally. + /* Withhold DNS events to simulate an unresponsive server. A disabled + * deadline must leave the lookup pending regardless of resolver behavior. */ - limit = time(NULL) + 5; + limit = time(NULL) + (timeout > 0 ? 5 : 1); while (!context.done && time(NULL) < limit) { mk_event_wait_2(evl, 100); mk_event_foreach(event, evl) { - if (timeout <= 0 && event->type == FLB_ENGINE_EV_CUSTOM) { - event->handler(event); - } - else if (event->type & FLB_ENGINE_EV_SCHED) { + if (event->type & FLB_ENGINE_EV_SCHED) { flb_sched_event_handler(test_env_config, event); } } @@ -166,13 +163,27 @@ static void test_dns_timeout(char *mode, int upstream_first, int timeout) flb_net_dns_lookup_context_cleanup(&dns); flb_time_msleep(10); } + if (timeout <= 0) { + TEST_CHECK(context.done == FLB_FALSE); + TEST_CHECK(mk_list_size(&dns.lookups) == 1); + + /* Destroy the pending lookup through deferred cleanup. c-ares reports + * ARES_EDESTRUCTION before cleanup resumes the coroutine, so this does + * not need a response from the host's configured DNS server. + */ + mk_list_foreach_safe(head, tmp, &dns.lookups) { + mk_list_del(head); + mk_list_add(head, &dns.lookups_drop); + } + flb_net_dns_lookup_context_cleanup(&dns); + } TEST_ASSERT(context.done == FLB_TRUE); if (!upstream_first) { if (timeout > 0) { TEST_CHECK(context.result == ARES_ETIMEOUT); } else { - TEST_CHECK(context.result != ARES_ETIMEOUT); + TEST_CHECK(context.result == ARES_EDESTRUCTION); } } else { diff --git a/tests/internal/oauth2.c b/tests/internal/oauth2.c index 05abfb3f5b7..c7a427b49ba 100644 --- a/tests/internal/oauth2.c +++ b/tests/internal/oauth2.c @@ -7,6 +7,7 @@ #include #include #include +#include #include #include #include @@ -519,6 +520,9 @@ static struct flb_oauth2 *create_oauth_ctx_with_user_agent(struct flb_config *co { struct flb_oauth2_config cfg; struct flb_oauth2 *ctx; + struct flb_output_instance ins = {0}; + + ins.config = config; memset(&cfg, 0, sizeof(cfg)); cfg.enabled = FLB_TRUE; @@ -533,7 +537,7 @@ static struct flb_oauth2 *create_oauth_ctx_with_user_agent(struct flb_config *co flb_sds_printf(&cfg.token_url, "http://127.0.0.1:%d/token", server->port); - ctx = flb_oauth2_create_from_config(config, &cfg); + ctx = flb_oauth2_create_from_config(&ins, &cfg); flb_oauth2_config_destroy(&cfg); @@ -603,6 +607,9 @@ static struct flb_oauth2 *create_legacy_oauth_ctx(struct flb_config *config, { flb_sds_t token_url; struct flb_oauth2 *ctx; + struct flb_output_instance ins = {0}; + + ins.config = config; token_url = flb_sds_create_size(64); TEST_CHECK(token_url != NULL); @@ -612,7 +619,7 @@ static struct flb_oauth2 *create_legacy_oauth_ctx(struct flb_config *config, flb_sds_printf(&token_url, "http://127.0.0.1:%d/token", server->port); - ctx = flb_oauth2_create(config, token_url, 300); + ctx = flb_oauth2_create(&ins, token_url, 300); flb_sds_destroy(token_url); return ctx; @@ -871,6 +878,9 @@ static struct flb_oauth2 *create_private_key_jwt_ctx(struct flb_config *config, { struct flb_oauth2 *ctx; struct flb_oauth2_config cfg; + struct flb_output_instance ins = {0}; + + ins.config = config; memset(&cfg, 0, sizeof(cfg)); @@ -887,7 +897,7 @@ static struct flb_oauth2 *create_private_key_jwt_ctx(struct flb_config *config, flb_sds_printf(&cfg.token_url, "http://127.0.0.1:%d/token", server->port); cfg.jwt_aud = flb_sds_create(cfg.token_url); - ctx = flb_oauth2_create_from_config(config, &cfg); + ctx = flb_oauth2_create_from_config(&ins, &cfg); flb_oauth2_config_destroy(&cfg); return ctx; @@ -1274,7 +1284,54 @@ void test_private_key_jwt_x5t_header(void) flb_config_exit(config); } +void test_hostname_verification_from_output_instance(void) +{ + int verify_hostname; + struct flb_config *config; + struct flb_oauth2 *ctx; + struct flb_output_instance ins = {0}; + struct flb_oauth2_config cfg = {0}; + + config = flb_config_init(); + TEST_CHECK(config != NULL); + if (!config) { + return; + } + + ins.config = config; + cfg.enabled = FLB_TRUE; + cfg.token_url = flb_sds_create("https://localhost/token"); + TEST_CHECK(cfg.token_url != NULL); + if (!cfg.token_url) { + flb_config_exit(config); + return; + } + + for (verify_hostname = FLB_FALSE; verify_hostname <= FLB_TRUE; verify_hostname++) { + ins.tls_verify_hostname = verify_hostname; + + ctx = flb_oauth2_create(&ins, cfg.token_url, 300); + TEST_CHECK(ctx != NULL); + if (ctx) { + TEST_CHECK(ctx->tls->verify_hostname == verify_hostname); + flb_oauth2_destroy(ctx); + } + + ctx = flb_oauth2_create_from_config(&ins, &cfg); + TEST_CHECK(ctx != NULL); + if (ctx) { + TEST_CHECK(ctx->tls->verify_hostname == verify_hostname); + flb_oauth2_destroy(ctx); + } + } + + flb_oauth2_config_destroy(&cfg); + flb_config_exit(config); +} + TEST_LIST = { + {"hostname_verification_from_output_instance", + test_hostname_verification_from_output_instance}, {"parse_refreshes_token_transactionally", test_parse_refreshes_token_transactionally}, {"parse_accepts_quoted_expires_in", test_parse_accepts_quoted_expires_in}, diff --git a/tests/runtime/out_s3.c b/tests/runtime/out_s3.c index be279b29ef3..2f885bbfea2 100644 --- a/tests/runtime/out_s3.c +++ b/tests/runtime/out_s3.c @@ -23,6 +23,7 @@ #define S3_TEST_WAIT_STEP_MS 10 #define S3_TEST_WAIT_TIMEOUT_MS 5000 #define S3_TEST_STARTUP_FILE_COUNT (CIO_MAX_CHUNKS_UP + 2) +#define S3_TEST_CA_FILE FLB_TESTS_DATA_PATH "/data/tls/ca_certificate.pem" /* not a real error code, but tests that the code can respond to any error */ #define ERROR_ACCESS_DENIED "\ @@ -46,6 +47,72 @@ static struct flb_s3 *get_s3_context(flb_ctx_t *ctx) return ins->context; } +static void flb_test_s3_hostname_verification_propagates(void) +{ + flb_ctx_t *ctx; + struct flb_s3 *s3; + int in_ffd; + int out_ffd; + int ret; + int verify_hostname; + + setenv("FLB_S3_PLUGIN_UNDER_TEST", "true", 1); + + for (verify_hostname = FLB_FALSE; verify_hostname <= FLB_TRUE; verify_hostname++) { + ctx = flb_create(); + TEST_CHECK(ctx != NULL); + if (ctx == NULL) { + break; + } + + in_ffd = flb_input(ctx, (char *) "lib", NULL); + TEST_CHECK(in_ffd >= 0); + flb_input_set(ctx, in_ffd, "tag", "test", NULL); + + out_ffd = flb_output(ctx, (char *) "s3", NULL); + TEST_CHECK(out_ffd >= 0); + flb_output_set(ctx, out_ffd, "match", "*", NULL); + flb_output_set(ctx, out_ffd, "region", "us-west-2", NULL); + flb_output_set(ctx, out_ffd, "bucket", "fluent", NULL); + flb_output_set(ctx, out_ffd, "authorization_endpoint_url", + "https://localhost:1443/authorize", NULL); + flb_output_set(ctx, out_ffd, "tls.ca_file", S3_TEST_CA_FILE, NULL); + if (verify_hostname == FLB_TRUE) { + flb_output_set(ctx, out_ffd, "tls.verify_hostname", "on", NULL); + } + + ret = flb_start(ctx); + TEST_CHECK(ret == 0); + if (ret == 0) { + s3 = get_s3_context(ctx); + TEST_CHECK(s3 != NULL); + if (s3 != NULL) { + TEST_CHECK(s3->client_tls != NULL); + TEST_CHECK(s3->provider_tls != NULL); + TEST_CHECK(s3->authorization_endpoint_tls_context != NULL); + if (s3->client_tls != NULL && s3->provider_tls != NULL) { + TEST_CHECK(s3->client_tls->verify_hostname == verify_hostname); + TEST_CHECK(s3->provider_tls->verify_hostname == verify_hostname); + } + if (s3->authorization_endpoint_tls_context != NULL) { + TEST_CHECK(s3->authorization_endpoint_tls_context->verify == FLB_TRUE); + TEST_CHECK(s3->authorization_endpoint_tls_context->verify_hostname == + verify_hostname); + TEST_CHECK(s3->authorization_endpoint_tls_context->ca_file != NULL); + if (s3->authorization_endpoint_tls_context->ca_file != NULL) { + TEST_CHECK(strcmp(s3->authorization_endpoint_tls_context->ca_file, + S3_TEST_CA_FILE) == 0); + } + } + } + flb_stop(ctx); + } + flb_destroy(ctx); + } + + unsetenv("FLB_S3_PLUGIN_UNDER_TEST"); +} + static int count_files_recursive(const char *path) { #ifdef FLB_SYSTEM_WINDOWS @@ -2483,6 +2550,7 @@ static void flb_test_s3_credentials_serialized(void) /* Test list */ TEST_LIST = { + {"hostname_verification_propagates", flb_test_s3_hostname_verification_propagates }, {"credentials_serialized", flb_test_s3_credentials_serialized }, {"multipart_success", flb_test_s3_multipart_success }, {"putobject_success", flb_test_s3_putobject_success },