tls: propagate verify_hostname settings on tls context

include/fluent-bit/flb_oauth2.h

@@ -93,10 +93,12 @@ struct flb_oauth2 {
     struct flb_upstream *u;
 };
 
-struct flb_oauth2 *flb_oauth2_create(struct flb_config *config,
+struct flb_output_instance;
+
+struct flb_oauth2 *flb_oauth2_create(struct flb_output_instance *ins,
                                      const char *auth_url, int expire_sec);
 struct flb_oauth2 *flb_oauth2_create_from_config(
-                                struct flb_config *config,
+                                struct flb_output_instance *ins,
                                 const struct flb_oauth2_config *cfg);
 void flb_oauth2_destroy(struct flb_oauth2 *ctx);
 void flb_oauth2_config_destroy(struct flb_oauth2_config *cfg);

plugins/filter_kubernetes/kube_meta.c

@@ -2284,6 +2284,7 @@ int flb_kube_pod_association_init(struct flb_kube *ctx, struct flb_config *confi
         flb_plg_error(ctx->ins, "[kube_meta] could not create TLS config for pod association host");
         return -1;
     }
+    flb_tls_set_verify_hostname(ctx->aws_pod_association_tls, ctx->tls_verify_hostname);
     ctx->aws_pod_association_upstream = flb_upstream_create(config,
                                                         ctx->aws_pod_association_host,
                                                         ctx->aws_pod_association_port,

plugins/filter_nightfall/nightfall.c

@@ -103,6 +103,7 @@ static int cb_nightfall_init(struct flb_filter_instance *f_ins,
         flb_free(ctx);
         return -1;
     }
+    flb_tls_set_verify_hostname(ctx->tls, ctx->tls_verify_hostname);
 
     ctx->upstream = flb_upstream_create_url(config,
                                             FLB_FILTER_NIGHTFALL_API_URL,
@@ -630,6 +631,11 @@ static struct flb_config_map config_map[] = {
      0, FLB_TRUE, offsetof(struct flb_filter_nightfall, tls_verify),
      "Enable or disable verification of TLS peer certificate"
     },
+    {
+     FLB_CONFIG_MAP_BOOL, "tls.verify_hostname", "off",
+     0, FLB_TRUE, offsetof(struct flb_filter_nightfall, tls_verify_hostname),
+     "Enable or disable TLS hostname verification"
+    },
     {
      FLB_CONFIG_MAP_STR, "tls.vhost", NULL,
      0, FLB_TRUE, offsetof(struct flb_filter_nightfall, tls_vhost),

plugins/filter_nightfall/nightfall.h

@@ -45,6 +45,7 @@ struct flb_filter_nightfall {
     double sampling_rate;
     int tls_debug;
     int tls_verify;
+    int tls_verify_hostname;
     char *tls_ca_path;
     flb_sds_t tls_vhost;
 

plugins/in_kubernetes_events/kubernetes_events_conf.c

@@ -121,6 +121,8 @@ static int network_init(struct k8s_events *ctx, struct flb_config *config)
             return -1;
         }
 
+        flb_tls_set_verify_hostname(ctx->tls, ctx->ins->tls_verify_hostname);
+
         io_type = FLB_IO_TLS;
     }
 

plugins/out_azure_blob/azure_blob_conf.c

@@ -316,6 +316,7 @@ static int flb_azure_blob_apply_remote_configuration(struct flb_azure_blob *cont
     char *port = NULL;
     char *uri = NULL;
     uint16_t port_as_short;
+    int io_flags = FLB_IO_TCP;
 
     /* Parse and split URL */
     ret = flb_utils_url_split(context->configuration_endpoint_url,
@@ -343,6 +344,9 @@ static int flb_azure_blob_apply_remote_configuration(struct flb_azure_blob *cont
     }
 
     if (scheme != NULL) {
+        if (strcasecmp(scheme, "https") == 0) {
+            io_flags = FLB_IO_TLS;
+        }
         flb_free(scheme);
         scheme = NULL;
     }
@@ -369,11 +373,11 @@ static int flb_azure_blob_apply_remote_configuration(struct flb_azure_blob *cont
     }
 
     tls_context = flb_tls_create(FLB_TLS_CLIENT_MODE,
-                                 FLB_FALSE,
+                                 context->ins->tls_verify,
                                  FLB_FALSE,
                                  host,
-                                 NULL,
-                                 NULL,
+                                 context->ins->tls_ca_path,
+                                 context->ins->tls_ca_file,
                                  NULL,
                                  NULL,
                                  NULL);
@@ -387,10 +391,11 @@ static int flb_azure_blob_apply_remote_configuration(struct flb_azure_blob *cont
 
         return -2;
     }
+    flb_tls_set_verify_hostname(tls_context, context->ins->tls_verify_hostname);
 
     upstream = flb_upstream_create_url(context->config,
                                        context->configuration_endpoint_url,
-                                       FLB_IO_TCP,
+                                       io_flags,
                                        tls_context);
 
     if (upstream == NULL) {

plugins/out_azure_kusto/azure_kusto.c

@@ -1003,7 +1003,7 @@ static int cb_azure_kusto_init(struct flb_output_instance *ins, struct flb_confi
 
     /* Create oauth2 context */
     ctx->o =
-        flb_oauth2_create(ctx->config, ctx->oauth_url, FLB_AZURE_KUSTO_TOKEN_REFRESH);
+        flb_oauth2_create(ins, ctx->oauth_url, FLB_AZURE_KUSTO_TOKEN_REFRESH);
     if (!ctx->o) {
         flb_plg_error(ctx->ins, "cannot create oauth2 context");
         if (ctx->buffering_enabled == FLB_TRUE) {

plugins/out_azure_logs_ingestion/azure_logs_ingestion_conf.c

@@ -190,7 +190,7 @@ struct flb_az_li* flb_az_li_ctx_create(struct flb_output_instance *ins,
     pthread_mutex_init(&ctx->token_mutex, NULL);
 
     /* Create oauth2 context */
-    ctx->u_auth = flb_oauth2_create(config, ctx->auth_url,
+    ctx->u_auth = flb_oauth2_create(ins, ctx->auth_url,
                                     FLB_AZ_LI_TOKEN_TIMEOUT);
     if (!ctx->u_auth) {
         flb_plg_error(ins, "cannot create oauth2 context");

plugins/out_bigquery/bigquery.c

@@ -737,6 +737,7 @@ static int cb_bigquery_init(struct flb_output_instance *ins,
             flb_bigquery_conf_destroy(ctx);
             return -1;
         }
+        flb_tls_set_verify_hostname(ctx->aws_tls, ins->tls_verify_hostname);
 
         ctx->aws_provider = flb_standard_chain_provider_create(config,
                                                                ctx->aws_tls,
@@ -776,6 +777,7 @@ static int cb_bigquery_init(struct flb_output_instance *ins,
             flb_bigquery_conf_destroy(ctx);
             return -1;
         }
+        flb_tls_set_verify_hostname(ctx->aws_sts_tls, ins->tls_verify_hostname);
 
         ctx->aws_sts_upstream = flb_upstream_create(config,
                                                     ctx->aws_sts_endpoint,
@@ -807,6 +809,7 @@ static int cb_bigquery_init(struct flb_output_instance *ins,
             flb_bigquery_conf_destroy(ctx);
             return -1;
         }
+        flb_tls_set_verify_hostname(ctx->google_sts_tls, ins->tls_verify_hostname);
 
         ctx->google_sts_upstream = flb_upstream_create_url(config,
                                                            FLB_BIGQUERY_GOOGLE_STS_URL,
@@ -835,6 +838,7 @@ static int cb_bigquery_init(struct flb_output_instance *ins,
             flb_bigquery_conf_destroy(ctx);
             return -1;
         }
+        flb_tls_set_verify_hostname(ctx->google_iam_tls, ins->tls_verify_hostname);
 
         ctx->google_iam_upstream = flb_upstream_create_url(config,
                                                            FLB_BIGQUERY_GOOGLE_IAM_URL,
@@ -854,7 +858,7 @@ static int cb_bigquery_init(struct flb_output_instance *ins,
     }
 
     /* Create oauth2 context */
-    ctx->o = flb_oauth2_create(ctx->config, FLB_BIGQUERY_AUTH_URL, 3000);
+    ctx->o = flb_oauth2_create(ins, FLB_BIGQUERY_AUTH_URL, 3000);
     if (!ctx->o) {
         flb_plg_error(ctx->ins, "cannot create oauth2 context");
         return -1;

plugins/out_chronicle/chronicle.c

@@ -489,14 +489,14 @@ static int cb_chronicle_init(struct flb_output_instance *ins,
                                      io_flags, ins->tls);
     if (!ctx->u) {
         flb_plg_error(ctx->ins, "upstream creation failed");
-        return -1;
+        goto error;
     }
 
     /* Create oauth2 context */
-    ctx->o = flb_oauth2_create(ctx->config, FLB_CHRONICLE_AUTH_URL, 3000);
+    ctx->o = flb_oauth2_create(ins, FLB_CHRONICLE_AUTH_URL, 3000);
     if (!ctx->o) {
         flb_plg_error(ctx->ins, "cannot create oauth2 context");
-        return -1;
+        goto error;
     }
     flb_output_upstream_set(ctx->u, ins);
 
@@ -520,12 +520,21 @@ static int cb_chronicle_init(struct flb_output_instance *ins,
             if (ret != 0) {
                 flb_plg_error(ctx->ins, "Validate log_type failed. '%s' is not supported. ret = %d",
                               ctx->log_type, ret);
-                return -1;
+                goto error;
             }
         }
     }
 
     return 0;
+
+error:
+    if (ctx->u) {
+        flb_upstream_destroy(ctx->u);
+    }
+    pthread_mutex_destroy(&ctx->token_mutex);
+    flb_chronicle_conf_destroy(ctx);
+    flb_output_set_context(ins, NULL);
+    return -1;
 }
 
 enum chronicle_log_key_result {

plugins/out_cloudwatch_logs/cloudwatch_logs.c

@@ -270,6 +270,7 @@ static int cb_cloudwatch_init(struct flb_output_instance *ins,
         flb_plg_error(ctx->ins, "Failed to create tls context");
         goto error;
     }
+    flb_tls_set_verify_hostname(ctx->cred_tls, ins->tls_verify_hostname);
 
     ctx->client_tls = flb_tls_create(FLB_TLS_CLIENT_MODE,
                                      ins->tls_verify,
@@ -284,6 +285,7 @@ static int cb_cloudwatch_init(struct flb_output_instance *ins,
         flb_plg_error(ctx->ins, "Failed to create tls context");
         goto error;
     }
+    flb_tls_set_verify_hostname(ctx->client_tls, ins->tls_verify_hostname);
 
     ctx->aws_provider = flb_standard_chain_provider_create(config,
                                                            ctx->cred_tls,
@@ -320,6 +322,7 @@ static int cb_cloudwatch_init(struct flb_output_instance *ins,
             flb_errno();
             goto error;
         }
+        flb_tls_set_verify_hostname(ctx->sts_tls, ins->tls_verify_hostname);
 
         ctx->base_aws_provider = ctx->aws_provider;
 

plugins/out_es/es_conf.c

@@ -163,6 +163,8 @@ static int flb_es_node_ctx_aws_init(struct flb_es_node_ctx *node_ctx,
         flb_errno();
         return -1;
     }
+    flb_tls_set_verify_hostname(node_ctx->aws_tls,
+                                ins->tls_verify_hostname || node->tls_verify_hostname);
 
     provider = flb_standard_chain_provider_create(config,
                                                   node_ctx->aws_tls,
@@ -205,6 +207,8 @@ static int flb_es_node_ctx_aws_init(struct flb_es_node_ctx *node_ctx,
             flb_errno();
             return -1;
         }
+        flb_tls_set_verify_hostname(node_ctx->aws_sts_tls,
+                                    ins->tls_verify_hostname || node->tls_verify_hostname);
 
         provider = flb_sts_provider_create(config,
                                            node_ctx->aws_sts_tls,
@@ -759,6 +763,7 @@ struct flb_elasticsearch *flb_es_conf_create(struct flb_output_instance *ins,
                 flb_es_conf_destroy(ctx);
                 return NULL;
             }
+            flb_tls_set_verify_hostname(ctx->aws_tls, ins->tls_verify_hostname);
 
             tmp = flb_output_get_property("aws_region", ins);
             if (!tmp) {
@@ -820,6 +825,7 @@ struct flb_elasticsearch *flb_es_conf_create(struct flb_output_instance *ins,
                     flb_es_conf_destroy(ctx);
                     return NULL;
                 }
+                flb_tls_set_verify_hostname(ctx->aws_sts_tls, ins->tls_verify_hostname);
 
                 ctx->aws_provider = flb_sts_provider_create(config,
                                                             ctx->aws_sts_tls,

plugins/out_gcs/gcs.c

@@ -1967,7 +1967,7 @@ static int cb_gcs_init(struct flb_output_instance *ins, struct flb_config *confi
             flb_plg_info(ins, "using GCE/GKE metadata server authentication");
         }
 
-        ctx->o = flb_oauth2_create(config, FLB_GCS_AUTH_URL, FLB_GCS_TOKEN_REFRESH);
+        ctx->o = flb_oauth2_create(ins, FLB_GCS_AUTH_URL, FLB_GCS_TOKEN_REFRESH);
         if (!ctx->o) {
             goto error;
         }

plugins/out_http/http_conf.c

@@ -383,7 +383,7 @@ struct flb_out_http *flb_http_conf_create(struct flb_output_instance *ins,
             return NULL;
         }
 
-        ctx->oauth2_ctx = flb_oauth2_create_from_config(config, &ctx->oauth2_config);
+        ctx->oauth2_ctx = flb_oauth2_create_from_config(ins, &ctx->oauth2_config);
         if (!ctx->oauth2_ctx) {
             flb_plg_error(ctx->ins, "failed to initialize oauth2 context");
             flb_http_conf_destroy(ctx);

plugins/out_kinesis_firehose/firehose.c

@@ -188,6 +188,7 @@ static int cb_firehose_init(struct flb_output_instance *ins,
         flb_plg_error(ctx->ins, "Failed to create tls context");
         goto error;
     }
+    flb_tls_set_verify_hostname(ctx->cred_tls, ins->tls_verify_hostname);
 
     ctx->client_tls = flb_tls_create(FLB_TLS_CLIENT_MODE,
                                      FLB_TRUE,
@@ -202,6 +203,7 @@ static int cb_firehose_init(struct flb_output_instance *ins,
         flb_plg_error(ctx->ins, "Failed to create tls context");
         goto error;
     }
+    flb_tls_set_verify_hostname(ctx->client_tls, ins->tls_verify_hostname);
 
     ctx->aws_provider = flb_standard_chain_provider_create(config,
                                                            ctx->cred_tls,
@@ -238,6 +240,7 @@ static int cb_firehose_init(struct flb_output_instance *ins,
             flb_errno();
             goto error;
         }
+        flb_tls_set_verify_hostname(ctx->sts_tls, ins->tls_verify_hostname);
 
         ctx->base_aws_provider = ctx->aws_provider;
 

plugins/out_kinesis_streams/kinesis.c

@@ -188,6 +188,7 @@ static int cb_kinesis_init(struct flb_output_instance *ins,
         flb_plg_error(ctx->ins, "Failed to create tls context");
         goto error;
     }
+    flb_tls_set_verify_hostname(ctx->cred_tls, ins->tls_verify_hostname);
 
     ctx->client_tls = flb_tls_create(FLB_TLS_CLIENT_MODE,
                                      FLB_TRUE,
@@ -202,6 +203,7 @@ static int cb_kinesis_init(struct flb_output_instance *ins,
         flb_plg_error(ctx->ins, "Failed to create tls context");
         goto error;
     }
+    flb_tls_set_verify_hostname(ctx->client_tls, ins->tls_verify_hostname);
 
     ctx->aws_provider = flb_standard_chain_provider_create(config,
                                                            ctx->cred_tls,
@@ -245,6 +247,7 @@ static int cb_kinesis_init(struct flb_output_instance *ins,
             flb_errno();
             goto error;
         }
+        flb_tls_set_verify_hostname(ctx->sts_tls, ins->tls_verify_hostname);
 
         ctx->base_aws_provider = ctx->aws_provider;
 

plugins/out_opensearch/os_conf.c

@@ -263,6 +263,7 @@ struct flb_opensearch *flb_os_conf_create(struct flb_output_instance *ins,
                 flb_os_conf_destroy(ctx);
                 return NULL;
             }
+            flb_tls_set_verify_hostname(ctx->aws_tls, ins->tls_verify_hostname);
 
             tmp = flb_output_get_property("aws_region", ins);
             if (!tmp) {
@@ -324,6 +325,7 @@ struct flb_opensearch *flb_os_conf_create(struct flb_output_instance *ins,
                     flb_os_conf_destroy(ctx);
                     return NULL;
                 }
+                flb_tls_set_verify_hostname(ctx->aws_sts_tls, ins->tls_verify_hostname);
 
                 ctx->aws_provider = flb_sts_provider_create(config,
                                                             ctx->aws_sts_tls,

plugins/out_opentelemetry/opentelemetry.c

@@ -205,7 +205,9 @@ int opentelemetry_legacy_post(struct opentelemetry_context *ctx,
     struct flb_slist_entry    *val;
     struct flb_config_map_val *mv;
     struct flb_http_client    *c;
+#if defined(FLB_HAVE_SIGNV4) && defined(FLB_HAVE_AWS)
     flb_sds_t                 signature = NULL;
+#endif
 
     compressed = FLB_FALSE;
 

plugins/out_opentelemetry/opentelemetry_conf.c

@@ -455,7 +455,7 @@ struct opentelemetry_context *flb_opentelemetry_context_create(struct flb_output
             return NULL;
         }
 
-        ctx->oauth2_ctx = flb_oauth2_create_from_config(config, &ctx->oauth2_config);
+        ctx->oauth2_ctx = flb_oauth2_create_from_config(ins, &ctx->oauth2_config);
         if (!ctx->oauth2_ctx) {
             flb_plg_error(ctx->ins, "failed to initialize oauth2 context");
             flb_opentelemetry_context_destroy(ctx);