Skip to content

Commit 82ed184

Browse files
edmocostaedmocosta
committed
Improving ssl_certificate/ssl_key validation and moving deprecated settings into a new section
1 parent e71f9a7 commit 82ed184

File tree

3 files changed

+98
-85
lines changed

3 files changed

+98
-85
lines changed

‎docs/index.asciidoc‎

Lines changed: 92 additions & 80 deletions
Original file line numberDiff line numberDiff line change
@@ -299,15 +299,14 @@ checks.
299299
==== Elasticsearch Output Configuration Options
300300

301301
This plugin supports the following configuration options plus the
302-
<<plugins-{type}s-{plugin}-common-options>> described later.
302+
<<plugins-{type}s-{plugin}-common-options>> and <<plugins-{type}s-{plugin}-deprecated-options>> described later.
303303

304304
[cols="<,<,<",options="header",]
305305
|=======================================================================
306306
|Setting |Input type|Required
307307
| <<plugins-{type}s-{plugin}-action>> |<<string,string>>|No
308308
| <<plugins-{type}s-{plugin}-api_key>> |<<password,password>>|No
309309
| <<plugins-{type}s-{plugin}-bulk_path>> |<<string,string>>|No
310-
| <<plugins-{type}s-{plugin}-cacert>> |a valid filesystem path|__Deprecated__
311310
| <<plugins-{type}s-{plugin}-ca_trusted_fingerprint>> |<<string,string>>|No
312311
| <<plugins-{type}s-{plugin}-cloud_auth>> |<<password,password>>|No
313312
| <<plugins-{type}s-{plugin}-cloud_id>> |<<string,string>>|No
@@ -333,8 +332,6 @@ This plugin supports the following configuration options plus the
333332
| <<plugins-{type}s-{plugin}-ilm_policy>> |<<string,string>>|No
334333
| <<plugins-{type}s-{plugin}-ilm_rollover_alias>> |<<string,string>>|No
335334
| <<plugins-{type}s-{plugin}-index>> |<<string,string>>|No
336-
| <<plugins-{type}s-{plugin}-keystore>> |a valid filesystem path|__Deprecated__
337-
| <<plugins-{type}s-{plugin}-keystore_password>> |<<password,password>>|__Deprecated__
338335
| <<plugins-{type}s-{plugin}-silence_errors_in_log>> |<<array,array>>|No
339336
| <<plugins-{type}s-{plugin}-manage_template>> |<<boolean,boolean>>|No
340337
| <<plugins-{type}s-{plugin}-parameters>> |<<hash,hash>>|No
@@ -358,10 +355,8 @@ This plugin supports the following configuration options plus the
358355
| <<plugins-{type}s-{plugin}-sniffing>> |<<boolean,boolean>>|No
359356
| <<plugins-{type}s-{plugin}-sniffing_delay>> |<<number,number>>|No
360357
| <<plugins-{type}s-{plugin}-sniffing_path>> |<<string,string>>|No
361-
| <<plugins-{type}s-{plugin}-ssl>> |<<boolean,boolean>>|__Deprecated__
362358
| <<plugins-{type}s-{plugin}-ssl_certificate>> |<<path,path>>|No
363359
| <<plugins-{type}s-{plugin}-ssl_certificate_authorities>> |list of <<path,path>>|No
364-
| <<plugins-{type}s-{plugin}-ssl_certificate_verification>> |<<boolean,boolean>>|__Deprecated__
365360
| <<plugins-{type}s-{plugin}-ssl_cipher_suites>> |list of <<string,string>>|No
366361
| <<plugins-{type}s-{plugin}-ssl_enabled>> |<<boolean,boolean>>|No
367362
| <<plugins-{type}s-{plugin}-ssl_key>> |<<path,path>>|No
@@ -378,8 +373,6 @@ This plugin supports the following configuration options plus the
378373
| <<plugins-{type}s-{plugin}-template_name>> |<<string,string>>|No
379374
| <<plugins-{type}s-{plugin}-template_overwrite>> |<<boolean,boolean>>|No
380375
| <<plugins-{type}s-{plugin}-timeout>> |<<number,number>>|No
381-
| <<plugins-{type}s-{plugin}-truststore>> |a valid filesystem path|__Deprecated__
382-
| <<plugins-{type}s-{plugin}-truststore_password>> |<<password,password>>|__Deprecated__
383376
| <<plugins-{type}s-{plugin}-upsert>> |<<string,string>>|No
384377
| <<plugins-{type}s-{plugin}-user>> |<<string,string>>|No
385378
| <<plugins-{type}s-{plugin}-validate_after_inactivity>> |<<number,number>>|No
@@ -434,15 +427,6 @@ Elasticsearch {ref}/security-api-create-api-key.html[Create API key API].
434427
HTTP Path to perform the _bulk requests to
435428
this defaults to a concatenation of the path parameter and "_bulk"
436429

437-
[id="plugins-{type}s-{plugin}-cacert"]
438-
===== `cacert`
439-
deprecated[11.14.0, Replaced by <<plugins-{type}s-{plugin}-ssl_certificate_authorities>>]
440-
441-
* Value type is a list of <<path,path>>
442-
* There is no default value for this setting.
443-
444-
The .cer or .pem file to validate the server's certificate.
445-
446430
[id="plugins-{type}s-{plugin}-ca_trusted_fingerprint"]
447431
===== `ca_trusted_fingerprint`
448432

@@ -782,27 +766,6 @@ Logstash uses
782766
http://www.joda.org/joda-time/apidocs/org/joda/time/format/DateTimeFormat.html[Joda
783767
formats] and the `@timestamp` field of each event is being used as source for the date.
784768

785-
[id="plugins-{type}s-{plugin}-keystore"]
786-
===== `keystore`
787-
deprecated[11.14.0, Replaced by <<plugins-{type}s-{plugin}-ssl_keystore_path>>]
788-
789-
* Value type is <<path,path>>
790-
* There is no default value for this setting.
791-
792-
The keystore used to present a certificate to the server.
793-
It can be either .jks or .p12
794-
795-
NOTE: You cannot use this setting and <<plugins-{type}s-{plugin}-ssl_certificate>> at the same time.
796-
797-
[id="plugins-{type}s-{plugin}-keystore_password"]
798-
===== `keystore_password`
799-
deprecated[11.14.0, Replaced by <<plugins-{type}s-{plugin}-ssl_keystore_password>>]
800-
801-
* Value type is <<password,password>>
802-
* There is no default value for this setting.
803-
804-
Set the keystore password
805-
806769
[id="plugins-{type}s-{plugin}-manage_template"]
807770
===== `manage_template`
808771

@@ -1051,17 +1014,6 @@ the default value is computed by concatenating the path value and "_nodes/http"
10511014
if sniffing_path is set it will be used as an absolute path
10521015
do not use full URL here, only paths, e.g. "/sniff/_nodes/http"
10531016

1054-
[id="plugins-{type}s-{plugin}-ssl"]
1055-
===== `ssl`
1056-
deprecated[11.14.0, Replaced by <<plugins-{type}s-{plugin}-ssl_enabled>>]
1057-
1058-
* Value type is <<boolean,boolean>>
1059-
* There is no default value for this setting.
1060-
1061-
Enable SSL/TLS secured communication to Elasticsearch cluster.
1062-
Leaving this unspecified will use whatever scheme is specified in the URLs listed in <<plugins-{type}s-{plugin}-hosts>> or extracted from the <<plugins-{type}s-{plugin}-cloud_id>>.
1063-
If no explicit protocol is specified plain HTTP will be used.
1064-
10651017
[id="plugins-{type}s-{plugin}-ssl_certificate"]
10661018
===== `ssl_certificate`
10671019
* Value type is <<path,path>>
@@ -1081,17 +1033,6 @@ The .cer or .pem files to validate the server's certificate.
10811033

10821034
NOTE: You cannot use this setting and <<plugins-{type}s-{plugin}-ssl_truststore_path>> at the same time.
10831035

1084-
[id="plugins-{type}s-{plugin}-ssl_certificate_verification"]
1085-
===== `ssl_certificate_verification`
1086-
deprecated[11.14.0, Replaced by <<plugins-{type}s-{plugin}-ssl_verification_mode>>]
1087-
1088-
* Value type is <<boolean,boolean>>
1089-
* Default value is `true`
1090-
1091-
Option to validate the server's certificate. Disabling this severely compromises security.
1092-
For more information on disabling certificate verification please read
1093-
https://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
1094-
10951036
[id="plugins-{type}s-{plugin}-ssl_cipher_suites"]
10961037
===== `ssl_cipher_suites`
10971038
* Value type is a list of <<string,string>>
@@ -1274,26 +1215,6 @@ the "logstash" template (i.e. removing all customized settings)
12741215
Set the timeout, in seconds, for network operations and requests sent Elasticsearch. If
12751216
a timeout occurs, the request will be retried.
12761217

1277-
[id="plugins-{type}s-{plugin}-truststore"]
1278-
===== `truststore`
1279-
deprecated[11.14.0, Replaced by <<plugins-{type}s-{plugin}-ssl_truststore_path>>]
1280-
1281-
* Value type is <<path,path>>
1282-
* There is no default value for this setting.
1283-
1284-
The truststore to validate the server's certificate.
1285-
It can be either .jks or .p12.
1286-
Use either `:truststore` or `:cacert`.
1287-
1288-
[id="plugins-{type}s-{plugin}-truststore_password"]
1289-
===== `truststore_password`
1290-
deprecated[11.14.0, Replaced by <<plugins-{type}s-{plugin}-ssl_truststore_password>>]
1291-
1292-
* Value type is <<password,password>>
1293-
* There is no default value for this setting.
1294-
1295-
Set the truststore password
1296-
12971218
[id="plugins-{type}s-{plugin}-upsert"]
12981219
===== `upsert`
12991220

@@ -1350,6 +1271,97 @@ https://www.elastic.co/blog/elasticsearch-versioning-support[versioning support
13501271
blog] and {ref}/docs-index_.html#_version_types[Version types] in the
13511272
Elasticsearch documentation.
13521273

1274+
[id="plugins-{type}s-{plugin}-deprecated-options"]
1275+
==== Elasticsearch Output Deprecated Configuration Options
1276+
1277+
This plugin supports the following deprecated configurations.
1278+
1279+
WARNING: Deprecated options are subject to removal in future releases.
1280+
1281+
[cols="<,<,<",options="header",]
1282+
|=======================================================================
1283+
|Setting|Input type|Replaced by
1284+
| <<plugins-{type}s-{plugin}-cacert>> |a valid filesystem path|<<plugins-{type}s-{plugin}-ssl_certificate_authorities>>
1285+
| <<plugins-{type}s-{plugin}-keystore>> |a valid filesystem path|<<plugins-{type}s-{plugin}-ssl_keystore_path>>
1286+
| <<plugins-{type}s-{plugin}-keystore_password>> |<<password,password>>|<<plugins-{type}s-{plugin}-ssl_keystore_password>>
1287+
| <<plugins-{type}s-{plugin}-ssl>> |<<boolean,boolean>>|<<plugins-{type}s-{plugin}-ssl_enabled>>
1288+
| <<plugins-{type}s-{plugin}-ssl_certificate_verification>> |<<boolean,boolean>>|<<plugins-{type}s-{plugin}-ssl_verification_mode>>
1289+
| <<plugins-{type}s-{plugin}-truststore>> |a valid filesystem path|<<plugins-{type}s-{plugin}-ssl_truststore_path>>
1290+
| <<plugins-{type}s-{plugin}-truststore_password>> |<<password,password>>|<<plugins-{type}s-{plugin}-ssl_truststore_password>>
1291+
|=======================================================================
1292+
1293+
1294+
[id="plugins-{type}s-{plugin}-cacert"]
1295+
===== `cacert`
1296+
deprecated[11.14.0, Replaced by <<plugins-{type}s-{plugin}-ssl_certificate_authorities>>]
1297+
1298+
* Value type is a list of <<path,path>>
1299+
* There is no default value for this setting.
1300+
1301+
The .cer or .pem file to validate the server's certificate.
1302+
1303+
[id="plugins-{type}s-{plugin}-keystore"]
1304+
===== `keystore`
1305+
deprecated[11.14.0, Replaced by <<plugins-{type}s-{plugin}-ssl_keystore_path>>]
1306+
1307+
* Value type is <<path,path>>
1308+
* There is no default value for this setting.
1309+
1310+
The keystore used to present a certificate to the server.
1311+
It can be either .jks or .p12
1312+
1313+
NOTE: You cannot use this setting and <<plugins-{type}s-{plugin}-ssl_certificate>> at the same time.
1314+
1315+
[id="plugins-{type}s-{plugin}-keystore_password"]
1316+
===== `keystore_password`
1317+
deprecated[11.14.0, Replaced by <<plugins-{type}s-{plugin}-ssl_keystore_password>>]
1318+
1319+
* Value type is <<password,password>>
1320+
* There is no default value for this setting.
1321+
1322+
Set the keystore password
1323+
1324+
[id="plugins-{type}s-{plugin}-ssl"]
1325+
===== `ssl`
1326+
deprecated[11.14.0, Replaced by <<plugins-{type}s-{plugin}-ssl_enabled>>]
1327+
1328+
* Value type is <<boolean,boolean>>
1329+
* There is no default value for this setting.
1330+
1331+
Enable SSL/TLS secured communication to Elasticsearch cluster.
1332+
Leaving this unspecified will use whatever scheme is specified in the URLs listed in <<plugins-{type}s-{plugin}-hosts>> or extracted from the <<plugins-{type}s-{plugin}-cloud_id>>.
1333+
If no explicit protocol is specified plain HTTP will be used.
1334+
1335+
[id="plugins-{type}s-{plugin}-ssl_certificate_verification"]
1336+
===== `ssl_certificate_verification`
1337+
deprecated[11.14.0, Replaced by <<plugins-{type}s-{plugin}-ssl_verification_mode>>]
1338+
1339+
* Value type is <<boolean,boolean>>
1340+
* Default value is `true`
1341+
1342+
Option to validate the server's certificate. Disabling this severely compromises security.
1343+
For more information on disabling certificate verification please read
1344+
https://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
1345+
1346+
[id="plugins-{type}s-{plugin}-truststore"]
1347+
===== `truststore`
1348+
deprecated[11.14.0, Replaced by <<plugins-{type}s-{plugin}-ssl_truststore_path>>]
1349+
1350+
* Value type is <<path,path>>
1351+
* There is no default value for this setting.
1352+
1353+
The truststore to validate the server's certificate.
1354+
It can be either `.jks` or `.p12`.
1355+
Use either `:truststore` or `:cacert`.
1356+
1357+
[id="plugins-{type}s-{plugin}-truststore_password"]
1358+
===== `truststore_password`
1359+
deprecated[11.14.0, Replaced by <<plugins-{type}s-{plugin}-ssl_truststore_password>>]
1360+
1361+
* Value type is <<password,password>>
1362+
* There is no default value for this setting.
1363+
1364+
Set the truststore password
13531365

13541366
[id="plugins-{type}s-{plugin}-common-options"]
13551367
include::{include_path}/{type}.asciidoc[]

‎lib/logstash/outputs/elasticsearch/http_client_builder.rb‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -133,11 +133,12 @@ def self.setup_ssl(logger, params)
133133
setup_ssl_store(ssl_options, 'keystore', params)
134134

135135
ssl_key = params["ssl_key"]
136-
if ssl_certificate && ssl_key
136+
if ssl_certificate
137+
raise LogStash::ConfigurationError, 'Using an "ssl_certificate" requires an "ssl_key"' unless ssl_key
137138
ssl_options[:client_cert] = ssl_certificate
138139
ssl_options[:client_key] = ssl_key
139-
elsif !!ssl_certificate || !!ssl_key
140-
raise LogStash::ConfigurationError, 'You must set both "ssl_certificate" and "ssl_key" for client authentication'
140+
elsif !ssl_key.nil?
141+
raise LogStash::ConfigurationError, 'An "ssl_certificate" is required when using an "ssl_key"'
141142
end
142143

143144
ssl_verification_mode = params["ssl_verification_mode"]

‎spec/unit/outputs/elasticsearch_ssl_spec.rb‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -181,15 +181,15 @@
181181
let(:settings) { super().reject { |k| "ssl_key".eql?(k) } }
182182

183183
it "should raise a configuration error" do
184-
expect { subject.register }.to raise_error(LogStash::ConfigurationError, /You must set both "ssl_certificate" and "ssl_key"/)
184+
expect { subject.register }.to raise_error(LogStash::ConfigurationError, /Using an "ssl_certificate" requires an "ssl_key"/)
185185
end
186186
end
187187

188188
context "and only the ssl_key is set" do
189189
let(:settings) { super().reject { |k| "ssl_certificate".eql?(k) } }
190190

191191
it "should raise a configuration error" do
192-
expect { subject.register }.to raise_error(LogStash::ConfigurationError, /You must set both "ssl_certificate" and "ssl_key"/)
192+
expect { subject.register }.to raise_error(LogStash::ConfigurationError, /An "ssl_certificate" is required when using an "ssl_key"/)
193193
end
194194
end
195195
end

0 commit comments

Comments
 (0)