From cfb7c8cb73f8806ae21fe016a756089e9940e5ce Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Thu, 22 Oct 2026 19:23:57 +0900 Subject: [PATCH 01/32] filter_kubernetes: honor TLS hostname verification for metadata Signed-off-by: Hiroshi Hatake --- plugins/filter_kubernetes/kube_meta.c | 1 + 1 file changed, 1 insertion(+) diff --git a/plugins/filter_kubernetes/kube_meta.c b/plugins/filter_kubernetes/kube_meta.c index 40cb8460215..5596c892e18 100644 --- a/plugins/filter_kubernetes/kube_meta.c +++ b/plugins/filter_kubernetes/kube_meta.c @@ -2284,6 +2284,7 @@ int flb_kube_pod_association_init(struct flb_kube *ctx, struct flb_config *confi flb_plg_error(ctx->ins, "[kube_meta] could not create TLS config for pod association host"); return -1; } + flb_tls_set_verify_hostname(ctx->aws_pod_association_tls, ctx->tls_verify_hostname); ctx->aws_pod_association_upstream = flb_upstream_create(config, ctx->aws_pod_association_host, ctx->aws_pod_association_port, From 2d7a93e5fb54627d327b5068e7f10de6ff903f61 Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Thu, 22 Oct 2026 19:24:07 +0900 Subject: [PATCH 02/32] filter_nightfall: support TLS hostname verification Signed-off-by: Hiroshi Hatake --- plugins/filter_nightfall/nightfall.c | 6 ++++++ plugins/filter_nightfall/nightfall.h | 1 + 2 files changed, 7 insertions(+) diff --git a/plugins/filter_nightfall/nightfall.c b/plugins/filter_nightfall/nightfall.c index 3e37d2a0bc4..29fd1cdf99d 100644 --- a/plugins/filter_nightfall/nightfall.c +++ b/plugins/filter_nightfall/nightfall.c @@ -103,6 +103,7 @@ static int cb_nightfall_init(struct flb_filter_instance *f_ins, flb_free(ctx); return -1; } + flb_tls_set_verify_hostname(ctx->tls, ctx->tls_verify_hostname); ctx->upstream = flb_upstream_create_url(config, FLB_FILTER_NIGHTFALL_API_URL, @@ -630,6 +631,11 @@ static struct flb_config_map config_map[] = { 0, FLB_TRUE, offsetof(struct flb_filter_nightfall, tls_verify), "Enable or disable verification of TLS peer certificate" }, + { + FLB_CONFIG_MAP_BOOL, "tls.verify_hostname", "off", + 0, FLB_TRUE, offsetof(struct flb_filter_nightfall, tls_verify_hostname), + "Enable or disable TLS hostname verification" + }, { FLB_CONFIG_MAP_STR, "tls.vhost", NULL, 0, FLB_TRUE, offsetof(struct flb_filter_nightfall, tls_vhost), diff --git a/plugins/filter_nightfall/nightfall.h b/plugins/filter_nightfall/nightfall.h index e190c1d5195..16e5e2cc519 100644 --- a/plugins/filter_nightfall/nightfall.h +++ b/plugins/filter_nightfall/nightfall.h @@ -45,6 +45,7 @@ struct flb_filter_nightfall { double sampling_rate; int tls_debug; int tls_verify; + int tls_verify_hostname; char *tls_ca_path; flb_sds_t tls_vhost; From 2777a043813ee9114407fbe6668d818c52d2d345 Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Thu, 22 Oct 2026 19:24:08 +0900 Subject: [PATCH 03/32] in_kubernetes_events: honor TLS hostname verification Signed-off-by: Hiroshi Hatake --- plugins/in_kubernetes_events/kubernetes_events_conf.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/plugins/in_kubernetes_events/kubernetes_events_conf.c b/plugins/in_kubernetes_events/kubernetes_events_conf.c index d7b2fdc8ada..87433548415 100644 --- a/plugins/in_kubernetes_events/kubernetes_events_conf.c +++ b/plugins/in_kubernetes_events/kubernetes_events_conf.c @@ -121,6 +121,8 @@ static int network_init(struct k8s_events *ctx, struct flb_config *config) return -1; } + flb_tls_set_verify_hostname(ctx->tls, ctx->ins->tls_verify_hostname); + io_type = FLB_IO_TLS; } From 8e4b998eecdbeff9007777ca890baad0935a6319 Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Thu, 22 Oct 2026 19:24:09 +0900 Subject: [PATCH 04/32] out_azure_blob: verify configuration endpoint hostname when enabled Signed-off-by: Hiroshi Hatake --- plugins/out_azure_blob/azure_blob_conf.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/plugins/out_azure_blob/azure_blob_conf.c b/plugins/out_azure_blob/azure_blob_conf.c index 9c2d2300d7b..cb8144e37bf 100644 --- a/plugins/out_azure_blob/azure_blob_conf.c +++ b/plugins/out_azure_blob/azure_blob_conf.c @@ -316,6 +316,7 @@ static int flb_azure_blob_apply_remote_configuration(struct flb_azure_blob *cont char *port = NULL; char *uri = NULL; uint16_t port_as_short; + int io_flags = FLB_IO_TCP; /* Parse and split URL */ ret = flb_utils_url_split(context->configuration_endpoint_url, @@ -343,6 +344,9 @@ static int flb_azure_blob_apply_remote_configuration(struct flb_azure_blob *cont } if (scheme != NULL) { + if (strcasecmp(scheme, "https") == 0) { + io_flags = FLB_IO_TLS; + } flb_free(scheme); scheme = NULL; } @@ -369,11 +373,11 @@ static int flb_azure_blob_apply_remote_configuration(struct flb_azure_blob *cont } tls_context = flb_tls_create(FLB_TLS_CLIENT_MODE, - FLB_FALSE, + context->ins->tls_verify, FLB_FALSE, host, - NULL, - NULL, + context->ins->tls_ca_path, + context->ins->tls_ca_file, NULL, NULL, NULL); @@ -387,10 +391,11 @@ static int flb_azure_blob_apply_remote_configuration(struct flb_azure_blob *cont return -2; } + flb_tls_set_verify_hostname(tls_context, context->ins->tls_verify_hostname); upstream = flb_upstream_create_url(context->config, context->configuration_endpoint_url, - FLB_IO_TCP, + io_flags, tls_context); if (upstream == NULL) { From 1eb72a671c2cdbec11d667d8c35688efdd1bd339 Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Thu, 22 Oct 2026 19:24:09 +0900 Subject: [PATCH 05/32] out_azure_kusto: honor TLS hostname verification for OAuth Signed-off-by: Hiroshi Hatake --- plugins/out_azure_kusto/azure_kusto.c | 1 + 1 file changed, 1 insertion(+) diff --git a/plugins/out_azure_kusto/azure_kusto.c b/plugins/out_azure_kusto/azure_kusto.c index bb6883463c4..1045232af88 100644 --- a/plugins/out_azure_kusto/azure_kusto.c +++ b/plugins/out_azure_kusto/azure_kusto.c @@ -1016,6 +1016,7 @@ static int cb_azure_kusto_init(struct flb_output_instance *ins, struct flb_confi flb_azure_kusto_conf_destroy(ctx); return -1; } + flb_tls_set_verify_hostname(ctx->o->tls, ins->tls_verify_hostname); flb_output_upstream_set(ctx->u, ins); flb_plg_debug(ctx->ins, "azure kusto init completed"); From be485e0d596fda3cc5bd251305d0a74eff25b7a9 Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Thu, 22 Oct 2026 19:24:10 +0900 Subject: [PATCH 06/32] out_azure_logs_ingestion: honor TLS hostname verification for OAuth Signed-off-by: Hiroshi Hatake --- plugins/out_azure_logs_ingestion/azure_logs_ingestion_conf.c | 1 + 1 file changed, 1 insertion(+) diff --git a/plugins/out_azure_logs_ingestion/azure_logs_ingestion_conf.c b/plugins/out_azure_logs_ingestion/azure_logs_ingestion_conf.c index 69aa00f2053..34f628ca0c5 100644 --- a/plugins/out_azure_logs_ingestion/azure_logs_ingestion_conf.c +++ b/plugins/out_azure_logs_ingestion/azure_logs_ingestion_conf.c @@ -197,6 +197,7 @@ struct flb_az_li* flb_az_li_ctx_create(struct flb_output_instance *ins, flb_az_li_ctx_destroy(ctx); return NULL; } + flb_tls_set_verify_hostname(ctx->u_auth->tls, ins->tls_verify_hostname); /* Create upstream context for Log Ingsetion endpoint */ ctx->u_dce = flb_upstream_create_url(config, ctx->dce_url, From 80700ee49c86dcc86099226905c095d2d4e0a09a Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Thu, 22 Oct 2026 19:24:10 +0900 Subject: [PATCH 07/32] out_bigquery: honor TLS hostname verification for credentials Signed-off-by: Hiroshi Hatake --- plugins/out_bigquery/bigquery.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/plugins/out_bigquery/bigquery.c b/plugins/out_bigquery/bigquery.c index 2701cf7d3ec..9f23e886be3 100644 --- a/plugins/out_bigquery/bigquery.c +++ b/plugins/out_bigquery/bigquery.c @@ -737,6 +737,7 @@ static int cb_bigquery_init(struct flb_output_instance *ins, flb_bigquery_conf_destroy(ctx); return -1; } + flb_tls_set_verify_hostname(ctx->aws_tls, ins->tls_verify_hostname); ctx->aws_provider = flb_standard_chain_provider_create(config, ctx->aws_tls, @@ -776,6 +777,7 @@ static int cb_bigquery_init(struct flb_output_instance *ins, flb_bigquery_conf_destroy(ctx); return -1; } + flb_tls_set_verify_hostname(ctx->aws_sts_tls, ins->tls_verify_hostname); ctx->aws_sts_upstream = flb_upstream_create(config, ctx->aws_sts_endpoint, @@ -807,6 +809,7 @@ static int cb_bigquery_init(struct flb_output_instance *ins, flb_bigquery_conf_destroy(ctx); return -1; } + flb_tls_set_verify_hostname(ctx->google_sts_tls, ins->tls_verify_hostname); ctx->google_sts_upstream = flb_upstream_create_url(config, FLB_BIGQUERY_GOOGLE_STS_URL, @@ -835,6 +838,7 @@ static int cb_bigquery_init(struct flb_output_instance *ins, flb_bigquery_conf_destroy(ctx); return -1; } + flb_tls_set_verify_hostname(ctx->google_iam_tls, ins->tls_verify_hostname); ctx->google_iam_upstream = flb_upstream_create_url(config, FLB_BIGQUERY_GOOGLE_IAM_URL, @@ -859,6 +863,7 @@ static int cb_bigquery_init(struct flb_output_instance *ins, flb_plg_error(ctx->ins, "cannot create oauth2 context"); return -1; } + flb_tls_set_verify_hostname(ctx->o->tls, ins->tls_verify_hostname); flb_output_upstream_set(ctx->u, ins); /* Get or renew the OAuth2 token */ From e909d62bca378f1354bb3d484bdcca4ad49cd37d Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Thu, 22 Oct 2026 19:24:11 +0900 Subject: [PATCH 08/32] out_chronicle: verify OAuth hostnames and clean up init failures Signed-off-by: Hiroshi Hatake --- plugins/out_chronicle/chronicle.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/plugins/out_chronicle/chronicle.c b/plugins/out_chronicle/chronicle.c index d02ff3d4304..b912888efc9 100644 --- a/plugins/out_chronicle/chronicle.c +++ b/plugins/out_chronicle/chronicle.c @@ -489,15 +489,16 @@ static int cb_chronicle_init(struct flb_output_instance *ins, io_flags, ins->tls); if (!ctx->u) { flb_plg_error(ctx->ins, "upstream creation failed"); - return -1; + goto error; } /* Create oauth2 context */ ctx->o = flb_oauth2_create(ctx->config, FLB_CHRONICLE_AUTH_URL, 3000); if (!ctx->o) { flb_plg_error(ctx->ins, "cannot create oauth2 context"); - return -1; + goto error; } + flb_tls_set_verify_hostname(ctx->o->tls, ins->tls_verify_hostname); flb_output_upstream_set(ctx->u, ins); if (ins->test_mode == FLB_FALSE) { @@ -520,12 +521,21 @@ static int cb_chronicle_init(struct flb_output_instance *ins, if (ret != 0) { flb_plg_error(ctx->ins, "Validate log_type failed. '%s' is not supported. ret = %d", ctx->log_type, ret); - return -1; + goto error; } } } return 0; + +error: + if (ctx->u) { + flb_upstream_destroy(ctx->u); + } + pthread_mutex_destroy(&ctx->token_mutex); + flb_chronicle_conf_destroy(ctx); + flb_output_set_context(ins, NULL); + return -1; } enum chronicle_log_key_result { From dfefcd6483be56d764ab6acf7d50918de8cd6e59 Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Thu, 22 Oct 2026 19:24:11 +0900 Subject: [PATCH 09/32] out_cloudwatch_logs: honor TLS hostname verification Signed-off-by: Hiroshi Hatake --- plugins/out_cloudwatch_logs/cloudwatch_logs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/plugins/out_cloudwatch_logs/cloudwatch_logs.c b/plugins/out_cloudwatch_logs/cloudwatch_logs.c index f581406d928..fdf80f3341c 100644 --- a/plugins/out_cloudwatch_logs/cloudwatch_logs.c +++ b/plugins/out_cloudwatch_logs/cloudwatch_logs.c @@ -270,6 +270,7 @@ static int cb_cloudwatch_init(struct flb_output_instance *ins, flb_plg_error(ctx->ins, "Failed to create tls context"); goto error; } + flb_tls_set_verify_hostname(ctx->cred_tls, ins->tls_verify_hostname); ctx->client_tls = flb_tls_create(FLB_TLS_CLIENT_MODE, ins->tls_verify, @@ -284,6 +285,7 @@ static int cb_cloudwatch_init(struct flb_output_instance *ins, flb_plg_error(ctx->ins, "Failed to create tls context"); goto error; } + flb_tls_set_verify_hostname(ctx->client_tls, ins->tls_verify_hostname); ctx->aws_provider = flb_standard_chain_provider_create(config, ctx->cred_tls, @@ -320,6 +322,7 @@ static int cb_cloudwatch_init(struct flb_output_instance *ins, flb_errno(); goto error; } + flb_tls_set_verify_hostname(ctx->sts_tls, ins->tls_verify_hostname); ctx->base_aws_provider = ctx->aws_provider; From 45196c482b2ef8027d91877c9ac2ab16f63b1c5c Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Thu, 22 Oct 2026 19:24:12 +0900 Subject: [PATCH 10/32] out_es: honor TLS hostname verification for AWS credentials Signed-off-by: Hiroshi Hatake --- plugins/out_es/es_conf.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/plugins/out_es/es_conf.c b/plugins/out_es/es_conf.c index 79f2ddb2e9c..5ca393ad987 100644 --- a/plugins/out_es/es_conf.c +++ b/plugins/out_es/es_conf.c @@ -163,6 +163,8 @@ static int flb_es_node_ctx_aws_init(struct flb_es_node_ctx *node_ctx, flb_errno(); return -1; } + flb_tls_set_verify_hostname(node_ctx->aws_tls, + ins->tls_verify_hostname || node->tls_verify_hostname); provider = flb_standard_chain_provider_create(config, node_ctx->aws_tls, @@ -205,6 +207,8 @@ static int flb_es_node_ctx_aws_init(struct flb_es_node_ctx *node_ctx, flb_errno(); return -1; } + flb_tls_set_verify_hostname(node_ctx->aws_sts_tls, + ins->tls_verify_hostname || node->tls_verify_hostname); provider = flb_sts_provider_create(config, node_ctx->aws_sts_tls, @@ -759,6 +763,7 @@ struct flb_elasticsearch *flb_es_conf_create(struct flb_output_instance *ins, flb_es_conf_destroy(ctx); return NULL; } + flb_tls_set_verify_hostname(ctx->aws_tls, ins->tls_verify_hostname); tmp = flb_output_get_property("aws_region", ins); if (!tmp) { @@ -820,6 +825,7 @@ struct flb_elasticsearch *flb_es_conf_create(struct flb_output_instance *ins, flb_es_conf_destroy(ctx); return NULL; } + flb_tls_set_verify_hostname(ctx->aws_sts_tls, ins->tls_verify_hostname); ctx->aws_provider = flb_sts_provider_create(config, ctx->aws_sts_tls, From a3158f9221f38af706d2205a6b463d8c65a64023 Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Thu, 22 Oct 2026 19:24:18 +0900 Subject: [PATCH 11/32] out_gcs: honor TLS hostname verification for OAuth Signed-off-by: Hiroshi Hatake --- plugins/out_gcs/gcs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/plugins/out_gcs/gcs.c b/plugins/out_gcs/gcs.c index 9845efa1cc9..df19dc46bdd 100644 --- a/plugins/out_gcs/gcs.c +++ b/plugins/out_gcs/gcs.c @@ -1971,6 +1971,7 @@ static int cb_gcs_init(struct flb_output_instance *ins, struct flb_config *confi if (!ctx->o) { goto error; } + flb_tls_set_verify_hostname(ctx->o->tls, ins->tls_verify_hostname); } ctx->u = flb_upstream_create(config, FLB_GCS_DEFAULT_HOST, FLB_GCS_DEFAULT_PORT, From 8b6cc121fe9644a2f09e022546c918e1e5e011fa Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Thu, 22 Oct 2026 19:24:18 +0900 Subject: [PATCH 12/32] out_http: honor TLS hostname verification for OAuth Signed-off-by: Hiroshi Hatake --- plugins/out_http/http_conf.c | 1 + 1 file changed, 1 insertion(+) diff --git a/plugins/out_http/http_conf.c b/plugins/out_http/http_conf.c index 7731b4ee025..acb0c914117 100644 --- a/plugins/out_http/http_conf.c +++ b/plugins/out_http/http_conf.c @@ -389,6 +389,7 @@ struct flb_out_http *flb_http_conf_create(struct flb_output_instance *ins, flb_http_conf_destroy(ctx); return NULL; } + flb_tls_set_verify_hostname(ctx->oauth2_ctx->tls, ins->tls_verify_hostname); } /* Set instance flags into upstream */ From d2934901cfb57d2692c39754f1017a5bf484a261 Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Thu, 22 Oct 2026 19:24:19 +0900 Subject: [PATCH 13/32] out_kinesis_firehose: honor TLS hostname verification Signed-off-by: Hiroshi Hatake --- plugins/out_kinesis_firehose/firehose.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/plugins/out_kinesis_firehose/firehose.c b/plugins/out_kinesis_firehose/firehose.c index 431239de747..ef77b7d62c3 100644 --- a/plugins/out_kinesis_firehose/firehose.c +++ b/plugins/out_kinesis_firehose/firehose.c @@ -188,6 +188,7 @@ static int cb_firehose_init(struct flb_output_instance *ins, flb_plg_error(ctx->ins, "Failed to create tls context"); goto error; } + flb_tls_set_verify_hostname(ctx->cred_tls, ins->tls_verify_hostname); ctx->client_tls = flb_tls_create(FLB_TLS_CLIENT_MODE, FLB_TRUE, @@ -202,6 +203,7 @@ static int cb_firehose_init(struct flb_output_instance *ins, flb_plg_error(ctx->ins, "Failed to create tls context"); goto error; } + flb_tls_set_verify_hostname(ctx->client_tls, ins->tls_verify_hostname); ctx->aws_provider = flb_standard_chain_provider_create(config, ctx->cred_tls, @@ -238,6 +240,7 @@ static int cb_firehose_init(struct flb_output_instance *ins, flb_errno(); goto error; } + flb_tls_set_verify_hostname(ctx->sts_tls, ins->tls_verify_hostname); ctx->base_aws_provider = ctx->aws_provider; From 40b3744cc67f09e4a977ba9c9da9adad700614d6 Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Thu, 22 Oct 2026 19:24:19 +0900 Subject: [PATCH 14/32] out_kinesis_streams: honor TLS hostname verification Signed-off-by: Hiroshi Hatake --- plugins/out_kinesis_streams/kinesis.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/plugins/out_kinesis_streams/kinesis.c b/plugins/out_kinesis_streams/kinesis.c index 6a58b649191..46f543cc973 100644 --- a/plugins/out_kinesis_streams/kinesis.c +++ b/plugins/out_kinesis_streams/kinesis.c @@ -188,6 +188,7 @@ static int cb_kinesis_init(struct flb_output_instance *ins, flb_plg_error(ctx->ins, "Failed to create tls context"); goto error; } + flb_tls_set_verify_hostname(ctx->cred_tls, ins->tls_verify_hostname); ctx->client_tls = flb_tls_create(FLB_TLS_CLIENT_MODE, FLB_TRUE, @@ -202,6 +203,7 @@ static int cb_kinesis_init(struct flb_output_instance *ins, flb_plg_error(ctx->ins, "Failed to create tls context"); goto error; } + flb_tls_set_verify_hostname(ctx->client_tls, ins->tls_verify_hostname); ctx->aws_provider = flb_standard_chain_provider_create(config, ctx->cred_tls, @@ -245,6 +247,7 @@ static int cb_kinesis_init(struct flb_output_instance *ins, flb_errno(); goto error; } + flb_tls_set_verify_hostname(ctx->sts_tls, ins->tls_verify_hostname); ctx->base_aws_provider = ctx->aws_provider; From 700940565f244628cafdcfe44ec74db0870323ee Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Thu, 22 Oct 2026 19:24:20 +0900 Subject: [PATCH 15/32] out_opensearch: honor TLS hostname verification for AWS credentials Signed-off-by: Hiroshi Hatake --- plugins/out_opensearch/os_conf.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/plugins/out_opensearch/os_conf.c b/plugins/out_opensearch/os_conf.c index ffce0c29b47..f407355ad23 100644 --- a/plugins/out_opensearch/os_conf.c +++ b/plugins/out_opensearch/os_conf.c @@ -263,6 +263,7 @@ struct flb_opensearch *flb_os_conf_create(struct flb_output_instance *ins, flb_os_conf_destroy(ctx); return NULL; } + flb_tls_set_verify_hostname(ctx->aws_tls, ins->tls_verify_hostname); tmp = flb_output_get_property("aws_region", ins); if (!tmp) { @@ -324,6 +325,7 @@ struct flb_opensearch *flb_os_conf_create(struct flb_output_instance *ins, flb_os_conf_destroy(ctx); return NULL; } + flb_tls_set_verify_hostname(ctx->aws_sts_tls, ins->tls_verify_hostname); ctx->aws_provider = flb_sts_provider_create(config, ctx->aws_sts_tls, From ab84b4eb4a46e5ee2e909d4898edb769eb1fb8f7 Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Thu, 22 Oct 2026 19:24:21 +0900 Subject: [PATCH 16/32] out_opentelemetry: honor TLS hostname verification for OAuth Signed-off-by: Hiroshi Hatake --- plugins/out_opentelemetry/opentelemetry_conf.c | 1 + 1 file changed, 1 insertion(+) diff --git a/plugins/out_opentelemetry/opentelemetry_conf.c b/plugins/out_opentelemetry/opentelemetry_conf.c index c09cbf9eb2a..19c717fd4b8 100644 --- a/plugins/out_opentelemetry/opentelemetry_conf.c +++ b/plugins/out_opentelemetry/opentelemetry_conf.c @@ -461,6 +461,7 @@ struct opentelemetry_context *flb_opentelemetry_context_create(struct flb_output flb_opentelemetry_context_destroy(ctx); return NULL; } + flb_tls_set_verify_hostname(ctx->oauth2_ctx->tls, ins->tls_verify_hostname); } ctx->logs_uri_sanitized = sanitize_uri(ctx->logs_uri); From 2c5b51c7147c498063fedce68d400b02adc3008e Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Thu, 22 Oct 2026 19:24:21 +0900 Subject: [PATCH 17/32] out_s3: honor TLS hostname verification for auxiliary connections Signed-off-by: Hiroshi Hatake --- plugins/out_s3/s3.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/plugins/out_s3/s3.c b/plugins/out_s3/s3.c index e2c730d20b5..895b4a40a59 100644 --- a/plugins/out_s3/s3.c +++ b/plugins/out_s3/s3.c @@ -1424,6 +1424,7 @@ static int cb_s3_init(struct flb_output_instance *ins, flb_plg_error(ctx->ins, "Failed to create tls context"); return -1; } + flb_tls_set_verify_hostname(ctx->client_tls, ins->tls_verify_hostname); } /* AWS provider needs a separate TLS instance */ @@ -1440,6 +1441,7 @@ static int cb_s3_init(struct flb_output_instance *ins, flb_errno(); return -1; } + flb_tls_set_verify_hostname(ctx->provider_tls, ins->tls_verify_hostname); ctx->provider = flb_standard_chain_provider_create(config, ctx->provider_tls, @@ -1475,6 +1477,7 @@ static int cb_s3_init(struct flb_output_instance *ins, flb_errno(); return -1; } + flb_tls_set_verify_hostname(ctx->sts_provider_tls, ins->tls_verify_hostname); session_name = flb_sts_session_name(); if (!session_name) { @@ -2897,6 +2900,7 @@ static int blob_initialize_authorization_endpoint_upstream(struct flb_s3 *contex char *port = NULL; char *uri = NULL; int upstream_flags; + int io_flags = FLB_IO_TCP; context->authorization_endpoint_upstream = NULL; context->authorization_endpoint_tls_context = NULL; @@ -2914,6 +2918,9 @@ static int blob_initialize_authorization_endpoint_upstream(struct flb_s3 *contex } if (scheme != NULL) { + if (strcasecmp(scheme, "https") == 0) { + io_flags = FLB_IO_TLS; + } flb_free(scheme); scheme = NULL; @@ -2942,11 +2949,11 @@ static int blob_initialize_authorization_endpoint_upstream(struct flb_s3 *contex } tls_context = flb_tls_create(FLB_TLS_CLIENT_MODE, - FLB_FALSE, + context->ins->tls_verify, FLB_FALSE, host, - NULL, - NULL, + context->ins->tls_ca_path, + context->ins->tls_ca_file, NULL, NULL, NULL); @@ -2960,10 +2967,11 @@ static int blob_initialize_authorization_endpoint_upstream(struct flb_s3 *contex return -2; } + flb_tls_set_verify_hostname(tls_context, context->ins->tls_verify_hostname); upstream = flb_upstream_create_url(context->ins->config, context->authorization_endpoint_url, - FLB_IO_TCP, + io_flags, tls_context); if (upstream == NULL) { From b8ab7b71657591dd016b95472bac04864578f837 Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Thu, 22 Oct 2026 19:24:22 +0900 Subject: [PATCH 18/32] out_stackdriver: honor TLS hostname verification for OAuth Signed-off-by: Hiroshi Hatake --- plugins/out_stackdriver/stackdriver.c | 1 + 1 file changed, 1 insertion(+) diff --git a/plugins/out_stackdriver/stackdriver.c b/plugins/out_stackdriver/stackdriver.c index 9c2e0a2a45e..7f29958ec2c 100644 --- a/plugins/out_stackdriver/stackdriver.c +++ b/plugins/out_stackdriver/stackdriver.c @@ -1411,6 +1411,7 @@ static int cb_stackdriver_init(struct flb_output_instance *ins, flb_plg_error(ctx->ins, "cannot create oauth2 context"); goto error; } + flb_tls_set_verify_hostname(ctx->o->tls, ins->tls_verify_hostname); flb_output_upstream_set(ctx->u, ins); /* From bdbdeaf7d64dc2e36d57d614da537ad19d02a6d5 Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Thu, 22 Oct 2026 19:24:22 +0900 Subject: [PATCH 19/32] aws: honor TLS hostname verification for managed credentials Signed-off-by: Hiroshi Hatake --- src/aws/flb_aws_credentials.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/aws/flb_aws_credentials.c b/src/aws/flb_aws_credentials.c index 37310676863..e989ab24372 100644 --- a/src/aws/flb_aws_credentials.c +++ b/src/aws/flb_aws_credentials.c @@ -389,6 +389,7 @@ struct flb_aws_provider *flb_managed_chain_provider_create(struct flb_output_ins flb_errno(); goto error; } + flb_tls_set_verify_hostname(cred_tls, ins->tls_verify_hostname); region = flb_output_get_property(config_key_region, ins); if (!region) { @@ -441,6 +442,7 @@ struct flb_aws_provider *flb_managed_chain_provider_create(struct flb_output_ins flb_errno(); goto error; } + flb_tls_set_verify_hostname(sts_tls, ins->tls_verify_hostname); aws_provider = flb_sts_provider_create(config, sts_tls, From 54e61953a8286019713797066df4323c458d2858 Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Thu, 22 Oct 2026 19:24:23 +0900 Subject: [PATCH 20/32] tests: runtime: cover S3 TLS hostname verification propagation Signed-off-by: Hiroshi Hatake --- tests/runtime/out_s3.c | 68 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 68 insertions(+) diff --git a/tests/runtime/out_s3.c b/tests/runtime/out_s3.c index be279b29ef3..2f885bbfea2 100644 --- a/tests/runtime/out_s3.c +++ b/tests/runtime/out_s3.c @@ -23,6 +23,7 @@ #define S3_TEST_WAIT_STEP_MS 10 #define S3_TEST_WAIT_TIMEOUT_MS 5000 #define S3_TEST_STARTUP_FILE_COUNT (CIO_MAX_CHUNKS_UP + 2) +#define S3_TEST_CA_FILE FLB_TESTS_DATA_PATH "/data/tls/ca_certificate.pem" /* not a real error code, but tests that the code can respond to any error */ #define ERROR_ACCESS_DENIED "\ @@ -46,6 +47,72 @@ static struct flb_s3 *get_s3_context(flb_ctx_t *ctx) return ins->context; } +static void flb_test_s3_hostname_verification_propagates(void) +{ + flb_ctx_t *ctx; + struct flb_s3 *s3; + int in_ffd; + int out_ffd; + int ret; + int verify_hostname; + + setenv("FLB_S3_PLUGIN_UNDER_TEST", "true", 1); + + for (verify_hostname = FLB_FALSE; verify_hostname <= FLB_TRUE; verify_hostname++) { + ctx = flb_create(); + TEST_CHECK(ctx != NULL); + if (ctx == NULL) { + break; + } + + in_ffd = flb_input(ctx, (char *) "lib", NULL); + TEST_CHECK(in_ffd >= 0); + flb_input_set(ctx, in_ffd, "tag", "test", NULL); + + out_ffd = flb_output(ctx, (char *) "s3", NULL); + TEST_CHECK(out_ffd >= 0); + flb_output_set(ctx, out_ffd, "match", "*", NULL); + flb_output_set(ctx, out_ffd, "region", "us-west-2", NULL); + flb_output_set(ctx, out_ffd, "bucket", "fluent", NULL); + flb_output_set(ctx, out_ffd, "authorization_endpoint_url", + "https://localhost:1443/authorize", NULL); + flb_output_set(ctx, out_ffd, "tls.ca_file", S3_TEST_CA_FILE, NULL); + if (verify_hostname == FLB_TRUE) { + flb_output_set(ctx, out_ffd, "tls.verify_hostname", "on", NULL); + } + + ret = flb_start(ctx); + TEST_CHECK(ret == 0); + if (ret == 0) { + s3 = get_s3_context(ctx); + TEST_CHECK(s3 != NULL); + if (s3 != NULL) { + TEST_CHECK(s3->client_tls != NULL); + TEST_CHECK(s3->provider_tls != NULL); + TEST_CHECK(s3->authorization_endpoint_tls_context != NULL); + if (s3->client_tls != NULL && s3->provider_tls != NULL) { + TEST_CHECK(s3->client_tls->verify_hostname == verify_hostname); + TEST_CHECK(s3->provider_tls->verify_hostname == verify_hostname); + } + if (s3->authorization_endpoint_tls_context != NULL) { + TEST_CHECK(s3->authorization_endpoint_tls_context->verify == FLB_TRUE); + TEST_CHECK(s3->authorization_endpoint_tls_context->verify_hostname == + verify_hostname); + TEST_CHECK(s3->authorization_endpoint_tls_context->ca_file != NULL); + if (s3->authorization_endpoint_tls_context->ca_file != NULL) { + TEST_CHECK(strcmp(s3->authorization_endpoint_tls_context->ca_file, + S3_TEST_CA_FILE) == 0); + } + } + } + flb_stop(ctx); + } + flb_destroy(ctx); + } + + unsetenv("FLB_S3_PLUGIN_UNDER_TEST"); +} + static int count_files_recursive(const char *path) { #ifdef FLB_SYSTEM_WINDOWS @@ -2483,6 +2550,7 @@ static void flb_test_s3_credentials_serialized(void) /* Test list */ TEST_LIST = { + {"hostname_verification_propagates", flb_test_s3_hostname_verification_propagates }, {"credentials_serialized", flb_test_s3_credentials_serialized }, {"multipart_success", flb_test_s3_multipart_success }, {"putobject_success", flb_test_s3_putobject_success }, From 6714c7b6712116d46973dde42390b9cad5b5ba6d Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Mon, 26 Oct 2026 14:54:44 +0900 Subject: [PATCH 21/32] oauth2: inherit hostname verification from output Signed-off-by: Hiroshi Hatake --- include/fluent-bit/flb_oauth2.h | 6 ++++-- src/flb_oauth2.c | 21 ++++++++++++++------- 2 files changed, 18 insertions(+), 9 deletions(-) diff --git a/include/fluent-bit/flb_oauth2.h b/include/fluent-bit/flb_oauth2.h index 62777abcfe5..ecfba30a3e0 100644 --- a/include/fluent-bit/flb_oauth2.h +++ b/include/fluent-bit/flb_oauth2.h @@ -93,10 +93,12 @@ struct flb_oauth2 { struct flb_upstream *u; }; -struct flb_oauth2 *flb_oauth2_create(struct flb_config *config, +struct flb_output_instance; + +struct flb_oauth2 *flb_oauth2_create(struct flb_output_instance *ins, const char *auth_url, int expire_sec); struct flb_oauth2 *flb_oauth2_create_from_config( - struct flb_config *config, + struct flb_output_instance *ins, const struct flb_oauth2_config *cfg); void flb_oauth2_destroy(struct flb_oauth2 *ctx); void flb_oauth2_config_destroy(struct flb_oauth2_config *cfg); diff --git a/src/flb_oauth2.c b/src/flb_oauth2.c index f0dda0e1cf0..b621c2698aa 100644 --- a/src/flb_oauth2.c +++ b/src/flb_oauth2.c @@ -24,6 +24,7 @@ #include #include #include +#include #include #include #include @@ -358,7 +359,7 @@ void flb_oauth2_config_destroy(struct flb_oauth2_config *cfg) } static int oauth2_setup_upstream(struct flb_oauth2 *ctx, - struct flb_config *config, + struct flb_output_instance *ins, const char *auth_url) { int ret; @@ -421,11 +422,17 @@ static int oauth2_setup_upstream(struct flb_oauth2 *ctx, goto error; } + ret = flb_tls_set_verify_hostname(ctx->tls, ins->tls_verify_hostname); + if (ret != 0) { + flb_error("[oauth2] error setting TLS hostname verification"); + goto error; + } + if (strcmp(prot, "https") == 0) { - ctx->u = flb_upstream_create_url(config, auth_url, FLB_IO_TLS, ctx->tls); + ctx->u = flb_upstream_create_url(ins->config, auth_url, FLB_IO_TLS, ctx->tls); } else { - ctx->u = flb_upstream_create_url(config, auth_url, FLB_IO_TCP, NULL); + ctx->u = flb_upstream_create_url(ins->config, auth_url, FLB_IO_TCP, NULL); } if (!ctx->u) { @@ -1178,7 +1185,7 @@ static int oauth2_token_needs_refresh(struct flb_oauth2 *ctx, int force_refresh) return FLB_FALSE; } -struct flb_oauth2 *flb_oauth2_create(struct flb_config *config, +struct flb_oauth2 *flb_oauth2_create(struct flb_output_instance *ins, const char *auth_url, int expire_sec) { struct flb_oauth2_config cfg; @@ -1191,14 +1198,14 @@ struct flb_oauth2 *flb_oauth2_create(struct flb_config *config, cfg.token_url = flb_sds_create(auth_url); cfg.refresh_skew = FLB_OAUTH2_DEFAULT_SKEW_SECS; - ctx = flb_oauth2_create_from_config(config, &cfg); + ctx = flb_oauth2_create_from_config(ins, &cfg); flb_oauth2_config_destroy(&cfg); return ctx; } -struct flb_oauth2 *flb_oauth2_create_from_config(struct flb_config *config, +struct flb_oauth2 *flb_oauth2_create_from_config(struct flb_output_instance *ins, const struct flb_oauth2_config *cfg) { int ret; @@ -1260,7 +1267,7 @@ struct flb_oauth2 *flb_oauth2_create_from_config(struct flb_config *config, return NULL; } - ret = oauth2_setup_upstream(ctx, config, ctx->auth_url); + ret = oauth2_setup_upstream(ctx, ins, ctx->auth_url); if (ret != 0) { flb_oauth2_destroy(ctx); return NULL; From 54a62e3fdf46dc05f19f869e56e1b84820dd3f51 Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Mon, 26 Oct 2026 14:55:16 +0900 Subject: [PATCH 22/32] out_azure_kusto: use output-owned OAuth2 TLS settings Signed-off-by: Hiroshi Hatake --- plugins/out_azure_kusto/azure_kusto.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/plugins/out_azure_kusto/azure_kusto.c b/plugins/out_azure_kusto/azure_kusto.c index 1045232af88..3e4ea0997fa 100644 --- a/plugins/out_azure_kusto/azure_kusto.c +++ b/plugins/out_azure_kusto/azure_kusto.c @@ -1003,7 +1003,7 @@ static int cb_azure_kusto_init(struct flb_output_instance *ins, struct flb_confi /* Create oauth2 context */ ctx->o = - flb_oauth2_create(ctx->config, ctx->oauth_url, FLB_AZURE_KUSTO_TOKEN_REFRESH); + flb_oauth2_create(ins, ctx->oauth_url, FLB_AZURE_KUSTO_TOKEN_REFRESH); if (!ctx->o) { flb_plg_error(ctx->ins, "cannot create oauth2 context"); if (ctx->buffering_enabled == FLB_TRUE) { @@ -1016,7 +1016,6 @@ static int cb_azure_kusto_init(struct flb_output_instance *ins, struct flb_confi flb_azure_kusto_conf_destroy(ctx); return -1; } - flb_tls_set_verify_hostname(ctx->o->tls, ins->tls_verify_hostname); flb_output_upstream_set(ctx->u, ins); flb_plg_debug(ctx->ins, "azure kusto init completed"); From 09533cdbfb3a0b347347024c1084a0ddb58c58c8 Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Mon, 26 Oct 2026 14:55:23 +0900 Subject: [PATCH 23/32] out_azure_logs_ingestion: use output-owned OAuth2 TLS settings Signed-off-by: Hiroshi Hatake --- plugins/out_azure_logs_ingestion/azure_logs_ingestion_conf.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/plugins/out_azure_logs_ingestion/azure_logs_ingestion_conf.c b/plugins/out_azure_logs_ingestion/azure_logs_ingestion_conf.c index 34f628ca0c5..1c7aa934665 100644 --- a/plugins/out_azure_logs_ingestion/azure_logs_ingestion_conf.c +++ b/plugins/out_azure_logs_ingestion/azure_logs_ingestion_conf.c @@ -190,14 +190,13 @@ struct flb_az_li* flb_az_li_ctx_create(struct flb_output_instance *ins, pthread_mutex_init(&ctx->token_mutex, NULL); /* Create oauth2 context */ - ctx->u_auth = flb_oauth2_create(config, ctx->auth_url, + ctx->u_auth = flb_oauth2_create(ins, ctx->auth_url, FLB_AZ_LI_TOKEN_TIMEOUT); if (!ctx->u_auth) { flb_plg_error(ins, "cannot create oauth2 context"); flb_az_li_ctx_destroy(ctx); return NULL; } - flb_tls_set_verify_hostname(ctx->u_auth->tls, ins->tls_verify_hostname); /* Create upstream context for Log Ingsetion endpoint */ ctx->u_dce = flb_upstream_create_url(config, ctx->dce_url, From a4b4717fc58a188fab38325e53e3dc7f27aa7ea5 Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Mon, 26 Oct 2026 14:55:32 +0900 Subject: [PATCH 24/32] out_bigquery: use output-owned OAuth2 TLS settings Signed-off-by: Hiroshi Hatake --- plugins/out_bigquery/bigquery.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/plugins/out_bigquery/bigquery.c b/plugins/out_bigquery/bigquery.c index 9f23e886be3..d48d8ab5512 100644 --- a/plugins/out_bigquery/bigquery.c +++ b/plugins/out_bigquery/bigquery.c @@ -858,12 +858,11 @@ static int cb_bigquery_init(struct flb_output_instance *ins, } /* Create oauth2 context */ - ctx->o = flb_oauth2_create(ctx->config, FLB_BIGQUERY_AUTH_URL, 3000); + ctx->o = flb_oauth2_create(ins, FLB_BIGQUERY_AUTH_URL, 3000); if (!ctx->o) { flb_plg_error(ctx->ins, "cannot create oauth2 context"); return -1; } - flb_tls_set_verify_hostname(ctx->o->tls, ins->tls_verify_hostname); flb_output_upstream_set(ctx->u, ins); /* Get or renew the OAuth2 token */ From 7adf05da0de7775a3662acc4ada479d74d6b7809 Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Mon, 26 Oct 2026 14:55:43 +0900 Subject: [PATCH 25/32] out_chronicle: use output-owned OAuth2 TLS settings Signed-off-by: Hiroshi Hatake --- plugins/out_chronicle/chronicle.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/plugins/out_chronicle/chronicle.c b/plugins/out_chronicle/chronicle.c index b912888efc9..1334b5293ed 100644 --- a/plugins/out_chronicle/chronicle.c +++ b/plugins/out_chronicle/chronicle.c @@ -493,12 +493,11 @@ static int cb_chronicle_init(struct flb_output_instance *ins, } /* Create oauth2 context */ - ctx->o = flb_oauth2_create(ctx->config, FLB_CHRONICLE_AUTH_URL, 3000); + ctx->o = flb_oauth2_create(ins, FLB_CHRONICLE_AUTH_URL, 3000); if (!ctx->o) { flb_plg_error(ctx->ins, "cannot create oauth2 context"); goto error; } - flb_tls_set_verify_hostname(ctx->o->tls, ins->tls_verify_hostname); flb_output_upstream_set(ctx->u, ins); if (ins->test_mode == FLB_FALSE) { From 43c7dc5f7963545e6fbca57580fd43edb3be8161 Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Mon, 26 Oct 2026 14:55:53 +0900 Subject: [PATCH 26/32] out_gcs: use output-owned OAuth2 TLS settings Signed-off-by: Hiroshi Hatake --- plugins/out_gcs/gcs.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/plugins/out_gcs/gcs.c b/plugins/out_gcs/gcs.c index df19dc46bdd..1cdf1761918 100644 --- a/plugins/out_gcs/gcs.c +++ b/plugins/out_gcs/gcs.c @@ -1967,11 +1967,10 @@ static int cb_gcs_init(struct flb_output_instance *ins, struct flb_config *confi flb_plg_info(ins, "using GCE/GKE metadata server authentication"); } - ctx->o = flb_oauth2_create(config, FLB_GCS_AUTH_URL, FLB_GCS_TOKEN_REFRESH); + ctx->o = flb_oauth2_create(ins, FLB_GCS_AUTH_URL, FLB_GCS_TOKEN_REFRESH); if (!ctx->o) { goto error; } - flb_tls_set_verify_hostname(ctx->o->tls, ins->tls_verify_hostname); } ctx->u = flb_upstream_create(config, FLB_GCS_DEFAULT_HOST, FLB_GCS_DEFAULT_PORT, From 6c0876094ccb458ebbb1765589baa11f8c28b3c7 Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Mon, 26 Oct 2026 14:56:01 +0900 Subject: [PATCH 27/32] out_http: use output-owned OAuth2 TLS settings Signed-off-by: Hiroshi Hatake --- plugins/out_http/http_conf.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/plugins/out_http/http_conf.c b/plugins/out_http/http_conf.c index acb0c914117..ec8ab3e8398 100644 --- a/plugins/out_http/http_conf.c +++ b/plugins/out_http/http_conf.c @@ -383,13 +383,12 @@ struct flb_out_http *flb_http_conf_create(struct flb_output_instance *ins, return NULL; } - ctx->oauth2_ctx = flb_oauth2_create_from_config(config, &ctx->oauth2_config); + ctx->oauth2_ctx = flb_oauth2_create_from_config(ins, &ctx->oauth2_config); if (!ctx->oauth2_ctx) { flb_plg_error(ctx->ins, "failed to initialize oauth2 context"); flb_http_conf_destroy(ctx); return NULL; } - flb_tls_set_verify_hostname(ctx->oauth2_ctx->tls, ins->tls_verify_hostname); } /* Set instance flags into upstream */ From d2ba1fb50ebf3e9436090352eeae89dfa8c52ec6 Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Mon, 26 Oct 2026 14:56:10 +0900 Subject: [PATCH 28/32] out_opentelemetry: use output-owned OAuth2 TLS settings Signed-off-by: Hiroshi Hatake --- plugins/out_opentelemetry/opentelemetry.c | 2 ++ plugins/out_opentelemetry/opentelemetry_conf.c | 3 +-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/plugins/out_opentelemetry/opentelemetry.c b/plugins/out_opentelemetry/opentelemetry.c index 4ca2d4eb382..62c324ed3e7 100644 --- a/plugins/out_opentelemetry/opentelemetry.c +++ b/plugins/out_opentelemetry/opentelemetry.c @@ -205,7 +205,9 @@ int opentelemetry_legacy_post(struct opentelemetry_context *ctx, struct flb_slist_entry *val; struct flb_config_map_val *mv; struct flb_http_client *c; +#if defined(FLB_HAVE_SIGNV4) && defined(FLB_HAVE_AWS) flb_sds_t signature = NULL; +#endif compressed = FLB_FALSE; diff --git a/plugins/out_opentelemetry/opentelemetry_conf.c b/plugins/out_opentelemetry/opentelemetry_conf.c index 19c717fd4b8..ab603e0a42f 100644 --- a/plugins/out_opentelemetry/opentelemetry_conf.c +++ b/plugins/out_opentelemetry/opentelemetry_conf.c @@ -455,13 +455,12 @@ struct opentelemetry_context *flb_opentelemetry_context_create(struct flb_output return NULL; } - ctx->oauth2_ctx = flb_oauth2_create_from_config(config, &ctx->oauth2_config); + ctx->oauth2_ctx = flb_oauth2_create_from_config(ins, &ctx->oauth2_config); if (!ctx->oauth2_ctx) { flb_plg_error(ctx->ins, "failed to initialize oauth2 context"); flb_opentelemetry_context_destroy(ctx); return NULL; } - flb_tls_set_verify_hostname(ctx->oauth2_ctx->tls, ins->tls_verify_hostname); } ctx->logs_uri_sanitized = sanitize_uri(ctx->logs_uri); From b3536af379576af7ac4c75044ac330e101120a6e Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Mon, 26 Oct 2026 14:56:18 +0900 Subject: [PATCH 29/32] out_stackdriver: use output-owned OAuth2 TLS settings Signed-off-by: Hiroshi Hatake --- plugins/out_stackdriver/stackdriver.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/plugins/out_stackdriver/stackdriver.c b/plugins/out_stackdriver/stackdriver.c index 7f29958ec2c..bd56f9fcc5d 100644 --- a/plugins/out_stackdriver/stackdriver.c +++ b/plugins/out_stackdriver/stackdriver.c @@ -1397,7 +1397,7 @@ static int cb_stackdriver_init(struct flb_output_instance *ins, FLB_IO_TCP, NULL); /* Create oauth2 context */ - ctx->o = flb_oauth2_create(ctx->config, FLB_STD_AUTH_URL, 3000); + ctx->o = flb_oauth2_create(ins, FLB_STD_AUTH_URL, 3000); if (!ctx->u) { flb_plg_error(ctx->ins, "upstream creation failed"); @@ -1411,7 +1411,6 @@ static int cb_stackdriver_init(struct flb_output_instance *ins, flb_plg_error(ctx->ins, "cannot create oauth2 context"); goto error; } - flb_tls_set_verify_hostname(ctx->o->tls, ins->tls_verify_hostname); flb_output_upstream_set(ctx->u, ins); /* From edc5fb36a9db3b921cd305e25a2c0c096bb7dd58 Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Mon, 26 Oct 2026 14:56:26 +0900 Subject: [PATCH 30/32] wasm: update OAuth2 browser stub signature Signed-off-by: Hiroshi Hatake --- src/wasm/http_client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/wasm/http_client.c b/src/wasm/http_client.c index 25e6db14561..f00309e9175 100644 --- a/src/wasm/http_client.c +++ b/src/wasm/http_client.c @@ -283,7 +283,7 @@ int flb_wasm_http_read_response(struct flb_http_client *c, int id) } /* Native plugins may link these paths even when OAuth2 is disabled. */ -struct flb_oauth2 *flb_oauth2_create_from_config(struct flb_config *config, +struct flb_oauth2 *flb_oauth2_create_from_config(struct flb_output_instance *ins, const struct flb_oauth2_config *cfg) { flb_error("[oauth2] browser token acquisition is not implemented"); From defc3c3348015dc022c15d1049fc12796bd4a1d5 Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Mon, 26 Oct 2026 14:56:34 +0900 Subject: [PATCH 31/32] tests: internal: cover OAuth2 hostname verification Signed-off-by: Hiroshi Hatake --- tests/internal/oauth2.c | 63 +++++++++++++++++++++++++++++++++++++++-- 1 file changed, 60 insertions(+), 3 deletions(-) diff --git a/tests/internal/oauth2.c b/tests/internal/oauth2.c index 05abfb3f5b7..c7a427b49ba 100644 --- a/tests/internal/oauth2.c +++ b/tests/internal/oauth2.c @@ -7,6 +7,7 @@ #include #include #include +#include #include #include #include @@ -519,6 +520,9 @@ static struct flb_oauth2 *create_oauth_ctx_with_user_agent(struct flb_config *co { struct flb_oauth2_config cfg; struct flb_oauth2 *ctx; + struct flb_output_instance ins = {0}; + + ins.config = config; memset(&cfg, 0, sizeof(cfg)); cfg.enabled = FLB_TRUE; @@ -533,7 +537,7 @@ static struct flb_oauth2 *create_oauth_ctx_with_user_agent(struct flb_config *co flb_sds_printf(&cfg.token_url, "http://127.0.0.1:%d/token", server->port); - ctx = flb_oauth2_create_from_config(config, &cfg); + ctx = flb_oauth2_create_from_config(&ins, &cfg); flb_oauth2_config_destroy(&cfg); @@ -603,6 +607,9 @@ static struct flb_oauth2 *create_legacy_oauth_ctx(struct flb_config *config, { flb_sds_t token_url; struct flb_oauth2 *ctx; + struct flb_output_instance ins = {0}; + + ins.config = config; token_url = flb_sds_create_size(64); TEST_CHECK(token_url != NULL); @@ -612,7 +619,7 @@ static struct flb_oauth2 *create_legacy_oauth_ctx(struct flb_config *config, flb_sds_printf(&token_url, "http://127.0.0.1:%d/token", server->port); - ctx = flb_oauth2_create(config, token_url, 300); + ctx = flb_oauth2_create(&ins, token_url, 300); flb_sds_destroy(token_url); return ctx; @@ -871,6 +878,9 @@ static struct flb_oauth2 *create_private_key_jwt_ctx(struct flb_config *config, { struct flb_oauth2 *ctx; struct flb_oauth2_config cfg; + struct flb_output_instance ins = {0}; + + ins.config = config; memset(&cfg, 0, sizeof(cfg)); @@ -887,7 +897,7 @@ static struct flb_oauth2 *create_private_key_jwt_ctx(struct flb_config *config, flb_sds_printf(&cfg.token_url, "http://127.0.0.1:%d/token", server->port); cfg.jwt_aud = flb_sds_create(cfg.token_url); - ctx = flb_oauth2_create_from_config(config, &cfg); + ctx = flb_oauth2_create_from_config(&ins, &cfg); flb_oauth2_config_destroy(&cfg); return ctx; @@ -1274,7 +1284,54 @@ void test_private_key_jwt_x5t_header(void) flb_config_exit(config); } +void test_hostname_verification_from_output_instance(void) +{ + int verify_hostname; + struct flb_config *config; + struct flb_oauth2 *ctx; + struct flb_output_instance ins = {0}; + struct flb_oauth2_config cfg = {0}; + + config = flb_config_init(); + TEST_CHECK(config != NULL); + if (!config) { + return; + } + + ins.config = config; + cfg.enabled = FLB_TRUE; + cfg.token_url = flb_sds_create("https://localhost/token"); + TEST_CHECK(cfg.token_url != NULL); + if (!cfg.token_url) { + flb_config_exit(config); + return; + } + + for (verify_hostname = FLB_FALSE; verify_hostname <= FLB_TRUE; verify_hostname++) { + ins.tls_verify_hostname = verify_hostname; + + ctx = flb_oauth2_create(&ins, cfg.token_url, 300); + TEST_CHECK(ctx != NULL); + if (ctx) { + TEST_CHECK(ctx->tls->verify_hostname == verify_hostname); + flb_oauth2_destroy(ctx); + } + + ctx = flb_oauth2_create_from_config(&ins, &cfg); + TEST_CHECK(ctx != NULL); + if (ctx) { + TEST_CHECK(ctx->tls->verify_hostname == verify_hostname); + flb_oauth2_destroy(ctx); + } + } + + flb_oauth2_config_destroy(&cfg); + flb_config_exit(config); +} + TEST_LIST = { + {"hostname_verification_from_output_instance", + test_hostname_verification_from_output_instance}, {"parse_refreshes_token_transactionally", test_parse_refreshes_token_transactionally}, {"parse_accepts_quoted_expires_in", test_parse_accepts_quoted_expires_in}, From bf9aef1e2c557039a4e3505458e2576bc4526a7f Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Mon, 26 Oct 2026 17:05:53 +0900 Subject: [PATCH 32/32] tests: remove resolver response dependency from DNS timeout test Signed-off-by: Hiroshi Hatake --- tests/internal/network_dns.c | 29 ++++++++++++++++++++--------- 1 file changed, 20 insertions(+), 9 deletions(-) diff --git a/tests/internal/network_dns.c b/tests/internal/network_dns.c index 659cf0a4482..c3253f6ce40 100644 --- a/tests/internal/network_dns.c +++ b/tests/internal/network_dns.c @@ -66,6 +66,7 @@ static void test_dns_timeout(char *mode, int upstream_first, int timeout) struct flb_sched_timer *timer; struct flb_sched_timer *deadline = NULL; struct mk_list *head; + struct mk_list *tmp; struct mk_event_loop *evl; #ifdef FLB_SYSTEM_WINDOWS WSADATA wsa_data; @@ -144,18 +145,14 @@ static void test_dns_timeout(char *mode, int upstream_first, int timeout) TEST_CHECK(mk_list_size(&context.upstream->queue.destroy_queue) == 1); } - /* With a deadline, withhold DNS events to simulate an unresponsive server. - * Without one, let the configured resolver complete the .invalid lookup so - * the coroutine and lookup context can be cleaned up normally. + /* Withhold DNS events to simulate an unresponsive server. A disabled + * deadline must leave the lookup pending regardless of resolver behavior. */ - limit = time(NULL) + 5; + limit = time(NULL) + (timeout > 0 ? 5 : 1); while (!context.done && time(NULL) < limit) { mk_event_wait_2(evl, 100); mk_event_foreach(event, evl) { - if (timeout <= 0 && event->type == FLB_ENGINE_EV_CUSTOM) { - event->handler(event); - } - else if (event->type & FLB_ENGINE_EV_SCHED) { + if (event->type & FLB_ENGINE_EV_SCHED) { flb_sched_event_handler(test_env_config, event); } } @@ -166,13 +163,27 @@ static void test_dns_timeout(char *mode, int upstream_first, int timeout) flb_net_dns_lookup_context_cleanup(&dns); flb_time_msleep(10); } + if (timeout <= 0) { + TEST_CHECK(context.done == FLB_FALSE); + TEST_CHECK(mk_list_size(&dns.lookups) == 1); + + /* Destroy the pending lookup through deferred cleanup. c-ares reports + * ARES_EDESTRUCTION before cleanup resumes the coroutine, so this does + * not need a response from the host's configured DNS server. + */ + mk_list_foreach_safe(head, tmp, &dns.lookups) { + mk_list_del(head); + mk_list_add(head, &dns.lookups_drop); + } + flb_net_dns_lookup_context_cleanup(&dns); + } TEST_ASSERT(context.done == FLB_TRUE); if (!upstream_first) { if (timeout > 0) { TEST_CHECK(context.result == ARES_ETIMEOUT); } else { - TEST_CHECK(context.result != ARES_ETIMEOUT); + TEST_CHECK(context.result == ARES_EDESTRUCTION); } } else {