logstash-filter-dns 3.0.14 → 3.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 341ced782cd6b185f99d4f4bee0fd087730be5778d5047db4bdffe8b120078c5
-  data.tar.gz: 497917e8f50a780a61b8ce9d868ed160639373bc0ff2effee9d3d201a9d1cd67
+  metadata.gz: 72c7e403d0237346a3b975607b580a4becc8c8fb58307837787672aedd8c1e39
+  data.tar.gz: 362fda06ed74282ccb9601d8edd520de61feb04da36dd4faf37242ddabfe334e
 SHA512:
-  metadata.gz: 7551c9b77b2502b20054a84e9ea708d3fd2ff2b861058748e2f7b5f4b4036157cdf939cf37a92c967afd08a6b00ca437ebc28b44ea8a7bda914d2c164bb1176e
-  data.tar.gz: d94d30376359478c31b85a98a6b27facdcb21f295094a5e5dc10e3d59b075ba8c4800e50cebd4098c14964aae4746dfe41df17d6de2d15649b4a2ccaefe229a2
+  metadata.gz: 63b668e2338a8b0a7d2135bcc54fb6325cad0a1cce60a5a6aadd6a9328c14e8a187248d2211cff189c6bbddea185b1150fe46af2b816a29f735498fbf35d0033
+  data.tar.gz: 7ebd10080f2bd78bc325a566f5b31031d20bb8c3e35ee8481bb6943ab8bc07587883f61270b32116500455053a9641f8191cca13f85a25ee5101fab6c513b97c

data/CHANGELOG.md

@@ -1,3 +1,6 @@
+## 3.1.0
+  - Added search domains to the `nameserver` option [#56](https://github.com/logstash-plugins/logstash-filter-dns/pull/56)
+
 ## 3.0.14
   - Added documentation on the `nameserver` option for relying on `/etc/resolv.conf` to configure the resolver
 

data/docs/index.asciidoc

@@ -55,7 +55,7 @@ This plugin supports the following configuration options plus the <<plugins-{typ
 | <<plugins-{type}s-{plugin}-hit_cache_ttl>> |<<number,number>>|No
 | <<plugins-{type}s-{plugin}-hostsfile>> |<<array,array>>|No
 | <<plugins-{type}s-{plugin}-max_retries>> |<<number,number>>|No
-| <<plugins-{type}s-{plugin}-nameserver>> |<<array,array>>|No
+| <<plugins-{type}s-{plugin}-nameserver>> |<<hash,hash>>|No
 | <<plugins-{type}s-{plugin}-resolve>> |<<array,array>>|No
 | <<plugins-{type}s-{plugin}-reverse>> |<<array,array>>|No
 | <<plugins-{type}s-{plugin}-timeout>> |<<number,number>>|No
@@ -126,18 +126,29 @@ number of times to retry a failed resolve/reverse
 [id="plugins-{type}s-{plugin}-nameserver"]
 ===== `nameserver` 
 
-  * Value type is <<array,array>>
+  * Value type is <<hash,hash>>, and is composed of:
+    * a required `address` key, whose value is either a <<string,string>> or an <<array,array>>, representing one or more nameserver ip addresses
+    * an optional `search` key, whose value is either a <<string,string>> or an <<array,array>>, representing between one and six search domains (e.g., with search domain `com`, a query for `example` will match DNS entries for `example.com`)
+    * an optional `ndots` key, used in conjunction with `search`, whose value is a <<number,number>>, representing the minimum number of dots in a domain name being resolved that will _prevent_ the search domains from being used (default `1`; this option is rarely needed)
+  * For backward-compatibility, values of <<string,string>> and <<array,array>> are also accepted, representing one or more nameserver ip addresses _without_ search domains.
   * There is no default value for this setting.
 
-Use custom nameserver(s). For example: `["8.8.8.8", "8.8.4.4"]`.
+Use custom nameserver(s). For example:
+
+[source]
+    filter {
+      dns {
+        nameserver => {
+          address => ["8.8.8.8", "8.8.4.4"]
+          search  => ["internal.net"]
+        }
+      }
+    }
+
 If `nameserver` is not specified then `/etc/resolv.conf` will be read to
 configure the resolver using the `nameserver`, `domain`,
 `search` and `ndots` directives in `/etc/resolv.conf`.
 
-Note that nameservers normally resolve fully qualified domain names (FQDN)
-and relying on `/etc/resolv.conf` can be useful to provide a domains search
-list to resolve underqualified host names for example.
-
 [id="plugins-{type}s-{plugin}-resolve"]
 ===== `resolve` 
 

data/lib/logstash/filters/dns.rb

@@ -46,14 +46,25 @@ class LogStash::Filters::DNS < LogStash::Filters::Base
   # specified under `reverse` and `resolve`.
   config :action, :validate => [ "append", "replace" ], :default => "append"
 
-  # Use custom nameserver(s). For example: `["8.8.8.8", "8.8.4.4"]`.
+  # Use custom nameserver(s). For example:
+  #    filter {
+  #      dns {
+  #         nameserver => {
+  #          address => ["8.8.8.8", "8.8.4.4"]
+  #          search  => ["internal.net"]
+  #        }
+  #      }
+  #    }
+  #
+  # nameserver is a hash with the following key:
+  #   * a required `address` key, whose value is either a <<string,string>> or an <<array,array>>, representing one or more nameserver ip addresses
+  #   * an optional `search` key, whose value is either a <<string,string>> or an <<array,array>>, representing between one and six search domains (e.g., with search domain `com`, a query for `example` will match DNS entries for `example.com`)
+  #   * an optional `ndots` key, used in conjunction with `search`, whose value is a <<number,number>>, representing the minimum number of dots in a domain name being resolved that will _prevent_ the search domains from being used (default `1`; this option is rarely needed)
+  #   * For backward-compatibility, string ans arrays values are also accepted, representing one or more nameserver ip addresses _without_ search domains.
+  #
   # If `nameserver` is not specified then `/etc/resolv.conf` will be read to
   # configure the resolver using the `nameserver`, `domain`,
   # `search` and `ndots` directives in `/etc/resolv.conf`.
-  #
-  # Note that nameservers normally resolve fully qualified domain names (FQDN)
-  # and relying on `/etc/resolv.conf` can be useful to provide a domains search
-  # list to resolve underqualified host names for example.
   config :nameserver, :validate => :array
 
   # `resolv` calls will be wrapped in a timeout instance
@@ -125,7 +136,32 @@ class LogStash::Filters::DNS < LogStash::Filters::Base
 
   def build_user_dns_resolver
     return [] if @nameserver.nil? || @nameserver.empty?
-    [::Resolv::DNS.new(:nameserver => @nameserver, :search => [], :ndots => 1)]
+
+    [::Resolv::DNS.new(normalised_nameserver)]
+  end
+
+  def normalised_nameserver
+    nameserver_hash = @nameserver.kind_of?(Hash) ? @nameserver.dup : { 'address' => @nameserver }
+
+    nameserver = nameserver_hash.delete('address') || fail(LogStash::ConfigurationError, "DNS Filter: `nameserver` hash must include `address` (got `#{@nameserver}`)")
+    nameserver = Array(nameserver).map(&:to_s)
+    nameserver.empty? && fail(LogStash::ConfigurationError, "DNS Filter: `nameserver` addresses, when specified, cannot be empty (got `#{@nameserver}`)")
+
+    search     = nameserver_hash.delete('search') || []
+    search     = Array(search).map(&:to_s)
+    search.size > 6 && fail(LogStash::ConfigurationError, "DNS Filter: A maximum of 6 `search` domains are accepted (got `#{@nameserver}`)")
+
+    ndots      = nameserver_hash.delete('ndots') || 1
+    ndots      = Integer(ndots)
+    ndots <= 0 && fail(LogStash::ConfigurationError, "DNS Filter: `ndots` must be positive (got `#{@nameserver}`)")
+
+    fail(LogStash::ConfigurationError, "Unknown `nameserver` argument(s): #{nameserver_hash}") unless nameserver_hash.empty?
+
+    {
+      :nameserver => nameserver,
+      :search     => search,
+      :ndots      => ndots
+    }
   end
 
   def resolve(event)

data/logstash-filter-dns.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-filter-dns'
-  s.version         = '3.0.14'
+  s.version         = '3.1.0'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "Performs a standard or reverse DNS lookup"
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"

data/spec/filters/dns_spec.rb

@@ -418,7 +418,119 @@ describe LogStash::Filters::DNS do
     end
   end
 
-  describe "with nameserver integration" do
+  describe "with search configuration" do
+    subject(:dns_filter_plugin) { LogStash::Filters::DNS.new(config) }
+
+    before(:each) do
+      subject.register
+    end
+
+    context "search domain specified" do
+      let(:config) { { "resolve" => ["domain"], "action" => "replace", "nameserver" => { "address" => ["1.2.3.4"], "search" => "elastic.co" } } }
+      let(:event) { LogStash::Event.new("domain" => "training") }
+
+      it "will expand training to training.elastic.co" do
+        allow(Resolv::DNS::Name).to receive(:new).and_call_original
+
+        # This is implementation specific but the only way I found to verify that the "search" option was working.
+        expect(Resolv::DNS::Name).to receive(:new).with([Resolv::DNS::Label::Str.new("training"), Resolv::DNS::Label::Str.new("elastic"), Resolv::DNS::Label::Str.new("co")]).and_call_original
+
+        subject.filter(event)
+      end
+    end
+  end
+
+  describe "with nameserver configuration" do
+    subject(:dns_filter_plugin) { LogStash::Filters::DNS.new(config) }
+
+    before(:each) do
+      allow(Resolv::DNS).to receive(:new).and_call_original
+    end
+
+    context 'nameserver specified as a string' do
+      let(:config) { { "nameserver" => "8.8.8.8" } }
+
+      it 'sets up the expected Resolv::DNS' do
+        dns_filter_plugin.register
+
+        expect(Resolv::DNS).to have_received(:new).with(:nameserver => ["8.8.8.8"], :search => [], :ndots => 1)
+      end
+    end
+
+    context 'nameserver specified as an array of strings' do
+      let(:config) { { "nameserver" => ["8.8.8.8", "8.8.4.4"] } }
+
+      it 'sets up the expected Resolv::DNS' do
+        dns_filter_plugin.register
+
+        expect(Resolv::DNS).to have_received(:new).with(:nameserver => ["8.8.8.8", "8.8.4.4"], :search => [], :ndots => 1)
+      end
+    end
+
+    context 'nameserver specified as a hash' do
+      context 'with only string address' do
+        let(:config) { { "nameserver" => { "address" => "8.8.8.8" } } }
+
+        it 'sets up the expected Resolv::DNS' do
+          dns_filter_plugin.register
+
+          expect(Resolv::DNS).to have_received(:new).with(:nameserver => ["8.8.8.8"], :search => [], :ndots => 1)
+        end
+      end
+      context 'with only array address' do
+        let(:config) { { "nameserver" => { "address" => ["8.8.8.8", "8.8.4.4"] } } }
+
+        it 'sets up the expected Resolv::DNS' do
+          dns_filter_plugin.register
+
+          expect(Resolv::DNS).to have_received(:new).with(:nameserver => ["8.8.8.8", "8.8.4.4"], :search => [], :ndots => 1)
+        end
+      end
+      context 'with search domains' do
+        let(:config) do
+          {
+            "nameserver" => {
+              "address" => ["127.0.0.1"],
+              "search" => search_domains
+            }
+          }
+        end
+
+        {
+          "string" => "internal.net",
+          "array of strings" => ["internal.net", "internal1.com"]
+        }.each do |desc, search_domains_arg|
+          let(:search_domains) { search_domains_arg }
+          context "as #{desc}" do
+            it 'sets up the expected Resolv::DNS' do
+              dns_filter_plugin.register
+
+              expect(Resolv::DNS).to have_received(:new).with(:nameserver => ["127.0.0.1"], :search => Array(search_domains), :ndots => 1)
+            end
+          end
+        end
+      end
+    end
+  end
+
+  describe "without nameserver configuration" do
+    subject(:dns_filter_plugin) { LogStash::Filters::DNS.new(config) }
+
+    context 'nameserver not specified' do
+      let(:config) { { "resolve" => ["domain"], "action" => "replace" } }
+
+      it 'sets up the expected Resolv::DNS without arguments' do
+        # We expect that when no nameserver option is specified
+        # Resolv::DNS.new will be called without arguments thus reading /etc/resolv.conf
+        # for its configuration which is the desired behaviour for backward compatibility
+
+        expect(Resolv::DNS).to receive(:new).once.with(no_args)
+        dns_filter_plugin.register
+      end
+    end
+  end
+
+  describe "with hostsfile integration" do
     describe "lookup using fixture hosts file" do
       let(:subject) { LogStash::Filters::DNS.new(config) }
       let(:hostsfile) { File.join(File.dirname(__FILE__), "..", "fixtures", "hosts") }

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-filter-dns
 version: !ruby/object:Gem::Version
-  version: 3.0.14
+  version: 3.1.0
 platform: ruby
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2019-10-18 00:00:00.000000000 Z
+date: 2019-10-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement