elastic-transport 8.5.2 → 8.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ec964e43347f5b7ae8ab38e9f2403aa0f6bcd352c9169a2bcd4d54a1fa995957
-  data.tar.gz: cdbd0d5ce004ec76ba29af96ae02a0e084a926dd6bf3808d507b8a7f80764b5e
+  metadata.gz: 1d020bb42e417e2c6ac4a2f45502217df668c4d8d22d41ff2e420a3e4e816b95
+  data.tar.gz: 2944d994083d8d36b6b8f212c05516b34bf5bd6c985402496af9c2200a0f9f6f
 SHA512:
-  metadata.gz: 2809af5a1b46710a9b812aa11496266a83920e6efac87f1a30ed3e621963107b6bcc5d8362b297a07c9de4f3b030ecb0da34771ea27939513a5dc00b038503bd
-  data.tar.gz: 8b43dc2f6a63901eb5566b1eeb8a0a9a8ac4e189981cdab1afc9a24e4e6a3e8f7a7a325d137d6e218390c79c8532d0092a803e751fa078f170fe6506c5f31c77
+  metadata.gz: 166ba90d59e3239807a0f3ba9329ab1d0f844a59a17aac1607c5541789dbb9760367191f0c2ab0e716cb9abc9386284b32a713fd5255af847fb65e7653545368
+  data.tar.gz: 8fb41bdd95ca8163c0e6f736105b91d1f484706c19caa682b8caefdfa97ad37c7190e640907fca0a7eae9c4278450895d5c82d38154515167f3609f8ad75b51b

data/CHANGELOG.md

@@ -1,10 +1,10 @@
-## 8.5.2
+## 8.6.0
 
-- Minor refactor to `curb` implementation.
-- Updated `yard` development dependency to `> 0.9.42`.
-- Fix `multi_json` deprecation warnings. Some deprecations [were introduced in `multi_json` 1.21.0](https://github.com/sferik/multi_json/blob/main/CHANGELOG.md#1210). Pull Request: [#112](https://github.com/elastic/elastic-transport-ruby/pull/112).
-- Reduced gem size. Pull Request: [#114](https://github.com/elastic/elastic-transport-ruby/pull/114).
-- Addresses duplicate `content-type` header in Manticore. Pull Request: [#115](https://github.com/elastic/elastic-transport-ruby/pull/115).
+- **Breaking:** fixes `ca_fingerprint` so it secures the connections used for requests. The certificate matching the fingerprint is fetched from the server's chain and used as the only trusted certificate on every connection, with chain and expiry verification left on. Host names aren't checked (a pinned intermediate can't be used on JRuby, and the certificate is fetched without a proxy), so a cluster reached by a name or IP that isn't in its certificate works (Faraday 1 and Manticore still check them). Previously the fingerprint was checked on a separate socket and matched any certificate the server sent, without checking that the server's certificate was signed by it.
+  - `ca_fingerprint` raises an `ArgumentError` when combined with `verify: false` (or Manticore's `:none`/`:disable`), `ca_file`, `ca_path`, `cert_store` or `truststore`, in `transport_options[:ssl]` or `:ssl`. Remove `verify: false` if you followed the previous docs.
+  - The Curb transport now reads `ca_file` and `verify: false` from `transport_options[:ssl]`.
+  - `ca_fingerprint` raises an `ArgumentError` when combined with a custom `:transport` instance.
+  - Removes `Connection#verified`.
 
 ## 8.5.1
 

data/lib/elastic/transport/client.rb

@@ -117,7 +117,11 @@ module Elastic
       #
       # @option enable_meta_header [Boolean] :enable_meta_header Enable sending the meta data header to Cloud.
       #                                                          (Default: true)
-      # @option ca_fingerprint [String] :ca_fingerprint provide this value to only trust certificates that are signed by a specific CA certificate
+      # @option arguments [String] :ca_fingerprint SHA256 fingerprint of a certificate in the server's chain (usually
+      #   the CA). Before the first request, the matching certificate is fetched from the server and becomes the only
+      #   trusted certificate for every connection. Chain and expiry are verified, host names aren't (except on
+      #   Faraday 1 and Manticore). Requires https
+      #   hosts and the client-built transport (can't be combined with `:transport`).
       #
       # @yield [faraday] Access and configure the `Faraday::Connection` instance directly with a block
       #
@@ -136,13 +140,14 @@ module Elastic
 
         @hosts ||= extract_hosts
         @send_get_body_as = @arguments[:send_get_body_as] || 'GET'
-        @ca_fingerprint = @arguments.delete(:ca_fingerprint)
 
         if @arguments[:request_timeout]
           @arguments[:transport_options][:request] = { timeout: @arguments[:request_timeout] }
         end
 
         if @arguments[:transport]
+          raise ArgumentError, 'ca_fingerprint can\'t be used with a custom :transport instance' if @arguments[:ca_fingerprint]
+
           @transport = @arguments[:transport]
         else
           @transport_class = @arguments[:transport_class] || DEFAULT_TRANSPORT_CLASS
@@ -168,8 +173,7 @@ module Elastic
       #
       def perform_request(method, path, params = {}, body = nil, headers = nil, opts = {})
         method = @send_get_body_as if method == 'GET' && body
-        validate_ca_fingerprints if @ca_fingerprint
-        if @otel
+        if defined?(@otel) && !@otel.nil?
           # If no endpoint is specified in the opts, use the HTTP method name
           span_name = opts[:endpoint] || method
           @otel.tracer.in_span(span_name) do |span|
@@ -196,31 +200,6 @@ module Elastic
 
       private
 
-      def validate_ca_fingerprints
-        transport.connections.connections.each do |connection|
-          unless connection.host[:scheme] == 'https'
-            raise Elastic::Transport::Transport::Error, 'CA fingerprinting can\'t be configured over http'
-          end
-
-          next if connection.verified
-
-          ctx = OpenSSL::SSL::SSLContext.new
-          socket = TCPSocket.new(connection.host[:host], connection.host[:port])
-          ssl = OpenSSL::SSL::SSLSocket.new(socket, ctx)
-          ssl.connect
-          cert_store = ssl.peer_cert_chain
-          matching_certs = cert_store.select do |cert|
-            OpenSSL::Digest::SHA256.hexdigest(cert.to_der).upcase == @ca_fingerprint.gsub(':', '').upcase
-          end
-          if matching_certs.empty?
-            raise Elastic::Transport::Transport::Error,
-                  'Server certificate CA fingerprint does not match the value configured in ca_fingerprint'
-          end
-
-          connection.verified = true
-        end
-      end
-
       def add_header(header)
         headers = @arguments[:transport_options]&.[](:headers) || {}
         headers.merge!(header)

data/lib/elastic/transport/transport/base.rb

@@ -22,6 +22,7 @@ module Elastic
       #
       module Base
         include Loggable
+        include CaFingerprint
 
         DEFAULT_PORT             = 9200
         DEFAULT_PROTOCOL         = 'http'.freeze
@@ -48,6 +49,7 @@ module Elastic
         #
         def initialize(arguments = {}, &block)
           @state_mutex = Mutex.new
+          @ca_pin_mutex = Mutex.new
 
           @hosts       = arguments[:hosts]   || []
           @options     = arguments[:options] || {}
@@ -55,6 +57,7 @@ module Elastic
           @options[:retry_on_status] ||= []
           @options[:delay_on_retry]  ||= 0
 
+          validate_ca_fingerprint_options! if @options[:ca_fingerprint]
           @block       = block
           @compression = !!@options[:compression]
           @connections = __build_connections
@@ -166,6 +169,9 @@ module Elastic
               host[:password] ||= options[:password] || options[:http][:password]
             end
 
+            # Hosts added after the pin (reload, sniffing) would otherwise get no protection
+            raise Error, 'CA fingerprinting can\'t be configured over http' if @ca_file && host[:protocol] != 'https'
+
             __build_connection(host, (options[:transport_options] || {}), @block)
           end
         end
@@ -273,6 +279,7 @@ module Elastic
         def perform_request(method, path, params = {}, body = nil, headers = nil, opts = {}, &block)
           raise NoMethodError, 'Implement this method in your transport class' unless block_given?
 
+          pin_ca_certificate! if options[:ca_fingerprint]
           start = Time.now
           tries = 0
           reload_on_failure = opts.fetch(:reload_on_failure, @options[:reload_on_failure])
@@ -356,15 +363,10 @@ module Elastic
           end
 
           if response.body &&
-            !response.body.empty? &&
-            response.headers &&
-            response.headers["content-type"] =~ /json/
-
-            # Prevent Float value from automatically becoming BigDecimal when using Oj
-            load_options = {}
-            load_options[:mode] = :compat if ::MultiJson.adapter.to_s == "MultiJson::Adapters::Oj"
-
-            json = serializer.load(response.body, load_options)
+             !response.body.empty? &&
+             response.headers &&
+             response.headers['content-type'] =~ /json/
+            json = serializer.load(response.body)
           end
           took = (json['took'] ? sprintf('%.3fs', json['took'] / 1000.0) : 'n/a') rescue 'n/a'
           __log_response(method, path, params, body, url, response, json, took, duration) unless ignore.include?(response.status.to_i)

data/lib/elastic/transport/transport/ca_fingerprint.rb

@@ -0,0 +1,131 @@
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+require 'openssl'
+require 'socket'
+require 'tempfile'
+require 'timeout'
+
+module Elastic
+  module Transport
+    module Transport
+      # Makes the certificate matching the `ca_fingerprint` option the only trust anchor of every connection.
+      #
+      # Before the first request, the server's certificate chain is fetched once without verification. Only the
+      # certificate whose fingerprint matches is kept, so the fetch itself needs no trust. The connections are then
+      # rebuilt with that certificate as their only trusted certificate, and the HTTP library verifies the chain and
+      # expiry on every connection. Host names aren't checked where the adapter allows that.
+      #
+      module CaFingerprint
+        TRUST_SETTINGS = %i[ca_file ca_path cert_store truststore].freeze
+        VERIFY_OFF = [false, :none, :disable].freeze
+        FETCH_TIMEOUT = 10
+
+        private
+
+        # The pinned certificate must be the only trust anchor. Other trust settings would be trusted next to it,
+        # or silently replaced by it, and turning verification off would turn the pin off too.
+        def validate_ca_fingerprint_options!
+          [options[:ssl], options.dig(:transport_options, :ssl)].compact.each do |ssl|
+            ssl = ssl.to_h
+            if VERIFY_OFF.include?(ssl[:verify]) || TRUST_SETTINGS.any? { |key| ssl[key] }
+              raise ArgumentError,
+                    "ca_fingerprint can't be combined with :verify off or with #{TRUST_SETTINGS.join(', ')}"
+            end
+          end
+        end
+
+        def pin_ca_certificate!
+          return if @ca_file
+
+          @ca_pin_mutex.synchronize do
+            return if @ca_file
+
+            ca = fetch_pinned_certificate
+            store = OpenSSL::X509::Store.new
+            # Without PARTIAL_CHAIN, OpenSSL only trusts a chain that ends in a self-signed root in the store. With it,
+            # the pinned certificate is a trust anchor even when it is an intermediate. ponytail: jruby-openssl lacks
+            # the flag, so on JRuby the fingerprint has to be the root CA's.
+            store.flags = OpenSSL::X509::V_FLAG_PARTIAL_CHAIN if defined?(OpenSSL::X509::V_FLAG_PARTIAL_CHAIN)
+            store.add_cert(ca)
+            # The Tempfile is deleted when garbage collected, so @ca_file keeps a reference to it.
+            # Curb, Manticore and libcurl-based Faraday adapters only accept a CA file
+            ca_file = Tempfile.new(['ca_fingerprint', '.pem'])
+            ca_file.write(ca.to_pem)
+            ca_file.flush
+
+            pin = { cert_store: store, ca_file: ca_file.path }
+            # The pin is the trust decision, host names add nothing (elastic/security#6842), and clusters reached by
+            # a container service name or IP must work. ponytail: Faraday 1 and Manticore have no host-name-only
+            # switch, so they still check host names.
+            pin[:verify_hostname] = false if !is_a?(HTTP::Faraday) || ::Faraday::SSLOptions.members.include?(:verify_hostname)
+            # New hashes, so the caller's option hashes aren't changed
+            transport_options = options[:transport_options] || {}
+            options[:transport_options] = transport_options.merge(ssl: (transport_options[:ssl] || {}).merge(pin))
+            options[:ssl] = (options[:ssl] || {}).merge(ca_file: ca_file.path) # Manticore reads top-level :ssl
+            __rebuild_pinned_connections
+            @ca_file = ca_file
+          end
+        end
+
+        # Replaces every connection, so none built before the pin stays in use.
+        def __rebuild_pinned_connections
+          @state_mutex.synchronize do
+            __close_connections
+            @connections = __build_connections
+          end
+        end
+
+        def fetch_pinned_certificate
+          unless hosts.all? { |host| host[:protocol] == 'https' }
+            raise Error, 'CA fingerprinting can\'t be configured over http'
+          end
+
+          fingerprint = options[:ca_fingerprint].delete(':').upcase
+          chain = reachable_peer_cert_chain
+          ca = chain.find { |cert| OpenSSL::Digest::SHA256.hexdigest(cert.to_der).upcase == fingerprint }
+          ca or raise Error, 'Server certificate CA fingerprint does not match the value configured in ca_fingerprint'
+        end
+
+        # Takes the chain of the first host that answers. Every other host must chain to the same certificate, or
+        # its connections fail verification.
+        def reachable_peer_cert_chain
+          error = nil
+          hosts.each do |host|
+            return peer_cert_chain(host)
+          rescue SystemCallError, SocketError, IOError, OpenSSL::SSL::SSLError, Timeout::Error => e
+            error = e
+          end
+          raise Error, "Couldn't fetch the server certificate for ca_fingerprint: #{error.message}"
+        end
+
+        def peer_cert_chain(host)
+          context = OpenSSL::SSL::SSLContext.new
+          context.verify_mode = OpenSSL::SSL::VERIFY_NONE
+          socket = Socket.tcp(host[:host], host[:port], connect_timeout: FETCH_TIMEOUT)
+          ssl = OpenSSL::SSL::SSLSocket.new(socket, context)
+          ssl.hostname = host[:host]
+          Timeout.timeout(FETCH_TIMEOUT) { ssl.connect }
+          ssl.peer_cert_chain
+        ensure
+          ssl&.close
+          socket&.close
+        end
+      end
+    end
+  end
+end

data/lib/elastic/transport/transport/connections/connection.rb

@@ -33,7 +33,6 @@ module Elastic
           DEFAULT_RESURRECT_TIMEOUT = 60
 
           attr_reader :host, :connection, :options, :failures, :dead_since
-          attr_accessor :verified
 
           # @option arguments [Hash]   :host       Host information (example: `{host: 'localhost', port: 9200}`)
           # @option arguments [Object] :connection The transport-specific physical connection or "session"
@@ -43,7 +42,6 @@ module Elastic
             @host       = arguments[:host].is_a?(Hash) ? Redacted.new(arguments[:host]) : arguments[:host]
             @connection = arguments[:connection]
             @options    = arguments[:options] || {}
-            @verified   = false
             @state_mutex = Mutex.new
 
             @options[:resurrect_timeout] ||= DEFAULT_RESURRECT_TIMEOUT

data/lib/elastic/transport/transport/http/curb.rb

@@ -83,6 +83,9 @@ module Elastic
 
             apply_headers(client, options)
             client.url = __full_url(host)
+            client.cacert = options.dig(:ssl, :ca_file) if options.dig(:ssl, :ca_file)
+            client.ssl_verify_peer = false if options.dig(:ssl, :verify) == false
+            client.ssl_verify_host = 0 if options.dig(:ssl, :verify) == false || options.dig(:ssl, :verify_hostname) == false
 
             if host[:user]
               client.http_auth_types = host[:auth_type] || :basic

data/lib/elastic/transport/transport/http/manticore.rb

@@ -158,6 +158,14 @@ module Elastic
 
           private
 
+          # Faraday and Curb read the pinned CA when a connection is built, so rebuilding connections is enough.
+          # Manticore reads it once, when the Manticore::Client is built in initialize, so the client is built again.
+          def __rebuild_pinned_connections
+            @manticore.close
+            build_client(options)
+            super
+          end
+
           def parse_headers(headers)
             request_headers = @request_options.fetch(:headers, {})
             headers = request_headers.merge(headers || {})

data/lib/elastic/transport/version.rb

@@ -17,6 +17,6 @@
 
 module Elastic
   module Transport
-    VERSION = '8.5.2'.freeze
+    VERSION = '8.6.0'.freeze
   end
 end

data/lib/elastic/transport.rb

@@ -26,6 +26,7 @@ require 'elastic/transport/transport/serializer/multi_json'
 require 'elastic/transport/transport/sniffer'
 require 'elastic/transport/transport/response'
 require 'elastic/transport/transport/errors'
+require 'elastic/transport/transport/ca_fingerprint'
 require 'elastic/transport/transport/base'
 require 'elastic/transport/transport/connections/selector'
 require 'elastic/transport/transport/connections/connection'

metadata

@@ -1,13 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: elastic-transport
 version: !ruby/object:Gem::Version
-  version: 8.5.2
+  version: 8.6.0
 platform: ruby
 authors:
 - Elastic Client Library Maintainers
+autorequire:
 bindir: bin
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-11-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -242,8 +243,8 @@ email:
 executables: []
 extensions: []
 extra_rdoc_files:
-- LICENSE
 - README.md
+- LICENSE
 files:
 - CHANGELOG.md
 - CONTRIBUTING.md
@@ -256,6 +257,7 @@ files:
 - lib/elastic/transport/opentelemetry.rb
 - lib/elastic/transport/redacted.rb
 - lib/elastic/transport/transport/base.rb
+- lib/elastic/transport/transport/ca_fingerprint.rb
 - lib/elastic/transport/transport/connections/collection.rb
 - lib/elastic/transport/transport/connections/connection.rb
 - lib/elastic/transport/transport/connections/selector.rb
@@ -276,6 +278,7 @@ metadata:
   changelog_uri: https://github.com/elastic/elastic-transport-ruby/blob/master/CHANGELOG.md
   source_code_uri: https://github.com/elastic/elastic-transport-ruby
   bug_tracker_uri: https://github.com/elastic/elastic-transport-ruby/issues
+post_install_message:
 rdoc_options:
 - "--charset=UTF-8"
 require_paths:
@@ -291,7 +294,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.12
+rubygems_version: 3.5.22
+signing_key:
 specification_version: 4
 summary: Low level Ruby client for Elastic services.
 test_files: []