logstash-filter-elasticsearch 4.3.1 → 4.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 57e0e5b17b9f3c454be9379c9dc617fdaad05f961600ec6d002eee6b2841a515
-  data.tar.gz: 5b484b241209b5bd9e067d798a6267ba9702734471b2ec99227238b5a2728fdb
+  metadata.gz: 460b1e72f53335af42fd95c998fb8fe158a705beeaf60e53d199aa8b9c64ab6f
+  data.tar.gz: 1d031b1b9783a30d7d849c320dc0ca7fec747192ee6e6a818b5873eb7a678875
 SHA512:
-  metadata.gz: ebb1434c624d486b3f07ccf786b9a277ecf46fe57860a0e665fb487f685045bd3f9e1097ab2fe6457f740f0387b3a987502b98b734508742811196825aad969b
-  data.tar.gz: 1bb0519e3894124b26a4c29ecae6683d8be668df51d40f20dd5cd1f231ba7666032bf353d685cd96ed63167e628998a2430e2f67b1594f3e0ae00be4760a9f9a
+  metadata.gz: 24c037f834fadb3d4c5f988d197f2bc3de60c657bc00be9d04ee97e979adcd18c8e99deefda37e836ab49976402b659e0cb6d71c4b2f1a0e01e0d7fc9703f0e3
+  data.tar.gz: 8bcf2cf0303eb4339b1ebdffeb01a2588c5826ec8178fdffd8d0fc755008f3fffbfa8edf31abc80c0e4078536f2c18d36e14919902ced4046d562f5ba9946b2d

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 4.4.1
+  - Support Elastic Cloud API keys in the `api_key` option, which now accepts an `id:api_key` pair, its base64-encoded form, or an `essu_` Cloud API key, and rejects an unrecognized format at startup [#215](https://github.com/logstash-plugins/logstash-filter-elasticsearch/pull/215)
+
+## 4.4.0
+  - Drop a support for Logstash 7.x by requiring `elasticsearch` gem >= 8. Logstash 8+ continues to work as before. [#213](https://github.com/logstash-plugins/logstash-filter-elasticsearch/pull/213)
+
 ## 4.3.1
   - Added support for encoded and non encoded api-key formats on plugin configuration [#203](https://github.com/logstash-plugins/logstash-filter-elasticsearch/pull/203)
 

data/docs/index.asciidoc

@@ -307,8 +307,11 @@ Example:
 Authenticate using Elasticsearch API key. Note that this option also requires
 enabling the <<plugins-{type}s-{plugin}-ssl_enabled>> option.
 
-Format is `id:api_key` where `id` and `api_key` are as returned by the
-Elasticsearch {ref}/security-api-create-api-key.html[Create API key API].
+The format is `id:api_key`, where `id` and `api_key` are as returned by the
+Elasticsearch {ref}/security-api-create-api-key.html[Create API key API]. The
+base64-encoded form of that pair is also accepted, as is an
+https://www.elastic.co/docs/deploy-manage/api-keys/elastic-cloud-api-keys[Elastic Cloud API key]
+(prefixed with `essu_`), which is used as-is.
 
 [id="plugins-{type}s-{plugin}-ca_trusted_fingerprint"]
 ===== `ca_trusted_fingerprint`

data/lib/logstash/filters/elasticsearch/client.rb

@@ -1,14 +1,13 @@
 # encoding: utf-8
-require "elasticsearch"
 require "base64"
-
+require "elasticsearch"
+require "elastic/transport/transport/http/manticore"
 
 module LogStash
   module Filters
     class ElasticsearchClient
 
       attr_reader :client
-      attr_reader :es_transport_client_type
 
       BUILD_FLAVOR_SERVERLESS = 'serverless'.freeze
       DEFAULT_EAV_HEADER = { "Elastic-Api-Version" => "2023-10-31" }.freeze
@@ -44,7 +43,7 @@ module LogStash
 
         client_options = {
                        hosts: hosts,
-             transport_class: get_transport_client_class,
+             transport_class: ::Elastic::Transport::Transport::HTTP::Manticore,
            transport_options: transport_options,
                          ssl: ssl_options,
             retry_on_failure: options[:retry_on_failure],
@@ -103,29 +102,37 @@ module LogStash
       def setup_api_key(api_key)
         return {} unless (api_key&.value)
 
-        token = base64?(api_key.value) ? api_key.value : Base64.strict_encode64(api_key.value)
+        token = resolve_api_key(api_key.value)
         { 'Authorization' => "ApiKey #{token}" }
       end
 
+      # Resolves the `api_key` value into the credential used in the
+      # `Authorization: ApiKey` header. An already base64-encoded key and an
+      # Elastic Cloud API key are used as-is; a raw `id:api_key` pair is
+      # base64-encoded. An unrecognized value is rejected so a malformed key
+      # surfaces at startup rather than as a later authentication failure.
+      def resolve_api_key(key_value)
+        if base64?(key_value) || cloud_api_key?(key_value)
+          key_value
+        elsif key_value.match?(/\A[^:]+:[^:]+\z/)
+          Base64.strict_encode64(key_value)
+        else
+          raise LogStash::ConfigurationError, "Invalid api_key format. Expected a base64-encoded key, an 'id:api_key' pair, or a Cloud API key (essu_ prefix)."
+        end
+      end
+
+      # Elastic Cloud API keys (such as the unified Serverless keys) are opaque
+      # tokens prefixed with `essu_` that Elasticsearch accepts verbatim in the
+      # `Authorization: ApiKey` header, with no base64 encoding.
+      def cloud_api_key?(string)
+        string.match?(/\Aessu_.+/)
+      end
+
       def base64?(string)
         string == Base64.strict_encode64(Base64.strict_decode64(string))
       rescue ArgumentError
         false
       end
-
-      def get_transport_client_class
-        # LS-core includes `elasticsearch` gem. The gem is composed of two separate gems: `elasticsearch-api` and `elasticsearch-transport`
-        # And now `elasticsearch-transport` is old, instead we have `elastic-transport`.
-        # LS-core updated `elasticsearch` > 8: https://github.com/elastic/logstash/pull/17161
-        # Following source bits are for the compatibility to support both `elasticsearch-transport` and `elastic-transport` gems
-        require "elasticsearch/transport/transport/http/manticore"
-        es_transport_client_type = "elasticsearch_transport"
-        ::Elasticsearch::Transport::Transport::HTTP::Manticore
-      rescue ::LoadError
-        require "elastic/transport/transport/http/manticore"
-        es_transport_client_type = "elastic_transport"
-        ::Elastic::Transport::Transport::HTTP::Manticore
-      end
     end
   end
 end

data/lib/logstash/filters/elasticsearch.rb

@@ -72,7 +72,8 @@ class LogStash::Filters::Elasticsearch < LogStash::Filters::Base
   config :cloud_auth, :validate => :password
 
   # Authenticate using Elasticsearch API key.
-  # format is id:api_key (as returned by https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-api-key.html[Create API key])
+  # Format is either the `id:api_key` pair (as returned by https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-api-key.html[Create API key]),
+  # its base64-encoded form, or an https://www.elastic.co/docs/deploy-manage/api-keys/elastic-cloud-api-keys[Elastic Cloud API key] (prefixed with `essu_`) can be used.
   config :api_key, :validate => :password
 
   # Set the address of a forward HTTP proxy.
@@ -209,9 +210,6 @@ class LogStash::Filters::Elasticsearch < LogStash::Filters::Base
     test_connection!
     validate_es_for_esql_support! if @query_type == "esql"
     setup_serverless
-    if get_client.es_transport_client_type == "elasticsearch_transport"
-      require_relative "elasticsearch/patches/_elasticsearch_transport_http_manticore"
-    end
   end # def register
 
   def filter(event)

data/logstash-filter-elasticsearch.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-filter-elasticsearch'
-  s.version         = '4.3.1'
+  s.version         = ::File.read('version').split("\n").first
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "Copies fields from previous log events in Elasticsearch to current events "
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
@@ -11,7 +11,7 @@ Gem::Specification.new do |s|
   s.require_paths = ["lib"]
 
   # Files
-  s.files = Dir["lib/**/*","spec/**/*","*.gemspec","*.md","CONTRIBUTORS","Gemfile","LICENSE","NOTICE.TXT", "vendor/jar-dependencies/**/*.jar", "vendor/jar-dependencies/**/*.rb", "VERSION", "docs/**/*"]
+  s.files = Dir["lib/**/*","spec/**/*","*.gemspec","*.md","CONTRIBUTORS","Gemfile","LICENSE","NOTICE.TXT", "vendor/jar-dependencies/**/*.jar", "vendor/jar-dependencies/**/*.rb", "VERSION", "version", "docs/**/*"]
 
   # Tests
   s.test_files = s.files.grep(%r{^(test|spec|features)/})
@@ -21,7 +21,7 @@ Gem::Specification.new do |s|
 
   # Gem dependencies
   s.add_runtime_dependency "logstash-core-plugin-api", ">= 1.60", "<= 2.99"
-  s.add_runtime_dependency 'elasticsearch', ">= 7.14.9", '< 9'
+  s.add_runtime_dependency 'elasticsearch', '>= 8', '< 10'
   s.add_runtime_dependency 'manticore', ">= 0.7.1"
   s.add_runtime_dependency 'logstash-mixin-ecs_compatibility_support', '~> 1.3'
   s.add_runtime_dependency 'logstash-mixin-ca_trusted_fingerprint_support', '~> 1.0'

data/spec/filters/elasticsearch_dsl_spec.rb

@@ -58,11 +58,6 @@ describe LogStash::Filters::Elasticsearch::DslExecutor do
 
     before(:each) do
       allow(LogStash::Filters::ElasticsearchClient).to receive(:new).and_return(client)
-      if defined?(Elastic::Transport)
-        allow(client).to receive(:es_transport_client_type).and_return('elastic_transport')
-      else
-        allow(client).to receive(:es_transport_client_type).and_return('elasticsearch_transport')
-      end
       allow(client).to receive(:search).and_return(response)
       allow(plugin).to receive(:test_connection!)
       allow(plugin).to receive(:setup_serverless)
@@ -123,26 +118,6 @@ describe LogStash::Filters::Elasticsearch::DslExecutor do
       end
     end
 
-    context 'when Elasticsearch 7.x gives us a totals object instead of an integer' do
-      let(:plugin_config) do
-        {
-          "hosts" => ["localhost:9200"],
-          "query" => "response: 404",
-          "fields" => { "response" => "code" },
-          "result_size" => 10
-        }
-      end
-
-      let(:response) do
-        LogStash::Json.load(File.read(File.join(File.dirname(__FILE__), "fixtures", "elasticsearch_7.x_hits_total_as_object.json")))
-      end
-
-      it "should enhance the current event with new data" do
-        plugin.filter(event)
-        expect(event.get("[@metadata][total_hits]")).to eq(13476)
-      end
-    end
-
     context "if something wrong happen during connection" do
 
       before(:each) do
@@ -307,11 +282,6 @@ describe LogStash::Filters::Elasticsearch::DslExecutor do
 
       before do
         allow(plugin).to receive(:get_client).and_return(client_double)
-        if defined?(Elastic::Transport)
-          allow(client_double).to receive(:es_transport_client_type).and_return('elastic_transport')
-        else
-          allow(client_double).to receive(:es_transport_client_type).and_return('elasticsearch_transport')
-        end
         allow(client_double).to receive(:client).and_return(transport_double)
       end
 

data/spec/filters/elasticsearch_spec.rb

@@ -4,6 +4,7 @@ require "logstash/plugin"
 require "logstash/filters/elasticsearch"
 require "logstash/json"
 require "cabin"
+require "manticore"
 require "webrick"
 require "uri"
 
@@ -61,17 +62,9 @@ describe LogStash::Filters::Elasticsearch do
         allow(filter_client).to receive(:serverless?).and_return(true)
         allow(filter_client).to receive(:client).and_return(es_client)
 
-        if defined?(Elastic::Transport)
-          allow(es_client).to receive(:info)
-                                .with(a_hash_including(
-                                        :headers => LogStash::Filters::ElasticsearchClient::DEFAULT_EAV_HEADER))
-                                .and_raise(Elastic::Transport::Transport::Errors::BadRequest.new)
-        else
-          allow(es_client).to receive(:info)
-                                .with(a_hash_including(
-                                        :headers => LogStash::Filters::ElasticsearchClient::DEFAULT_EAV_HEADER))
-                                .and_raise(Elasticsearch::Transport::Transport::Errors::BadRequest.new)
-        end
+        allow(es_client).to receive(:info)
+          .with(a_hash_including(:headers => LogStash::Filters::ElasticsearchClient::DEFAULT_EAV_HEADER))
+          .and_raise(Elastic::Transport::Transport::Errors::BadRequest.new)
       end
 
       it "raises an exception when Elastic Api Version is not supported" do
@@ -118,15 +111,15 @@ describe LogStash::Filters::Elasticsearch do
                   "cluster_name": "docker-cluster",
                   "cluster_uuid": "DyR1hN03QvuCWXRy3jtb0g",
                   "version": {
-                      "number": "7.13.1",
+                      "number": "8.0.0",
                       "build_flavor": "default",
                       "build_type": "docker",
                       "build_hash": "9a7758028e4ea59bcab41c12004603c5a7dd84a9",
                       "build_date": "2021-05-28T17:40:59.346932922Z",
                       "build_snapshot": false,
-                      "lucene_version": "8.8.2",
-                      "minimum_wire_compatibility_version": "6.8.0",
-                      "minimum_index_compatibility_version": "6.0.0-beta1"
+                      "lucene_version": "9.0.0",
+                      "minimum_wire_compatibility_version": "7.17.0",
+                      "minimum_index_compatibility_version": "7.0.0"
                   },
                   "tagline": "You Know, for Search"
               }
@@ -187,17 +180,6 @@ describe LogStash::Filters::Elasticsearch do
       end
       let(:plugin) { described_class.new(config) }
       let(:event)  { LogStash::Event.new({}) }
-
-      # elasticsearch-ruby 7.17.9 initialize two user agent headers, `user-agent` and `User-Agent`
-      # hence, fail this header size test case
-      xit "client should sent the expect user-agent" do
-        plugin.register
-
-        request = webserver.wait_receive_request
-
-        expect(request.header['user-agent'].size).to eq(1)
-        expect(request.header['user-agent'][0]).to match(/logstash\/\d*\.\d*\.\d* \(OS=.*; JVM=.*\) logstash-filter-elasticsearch\/\d*\.\d*\.\d*/)
-      end
     end
   end
 
@@ -225,12 +207,7 @@ describe LogStash::Filters::Elasticsearch do
       # this spec is a safeguard to trigger an assessment of thread-safety should
       # we choose a different transport adapter in the future.
       transport_class = extract_transport(client).options.fetch(:transport_class)
-      if defined?(Elastic::Transport)
-        allow(client).to receive(:es_transport_client_type).and_return("elastic_transport")
-        expect(transport_class).to equal ::Elastic::Transport::Transport::HTTP::Manticore
-      else
-        expect(transport_class).to equal ::Elasticsearch::Transport::Transport::HTTP::Manticore
-      end
+      expect(transport_class).to equal ::Elastic::Transport::Transport::HTTP::Manticore
     end
 
     it 'uses a client with sufficient connection pool size' do
@@ -348,6 +325,31 @@ describe LogStash::Filters::Elasticsearch do
           it_behaves_like "a plugin that sets the ApiKey authorization header"
         end
 
+        context "with an Elastic Cloud API key (essu_ prefix)" do
+          # The suffix is intentionally not canonical base64: a Cloud key is opaque
+          # and must be forwarded verbatim regardless of its payload encoding.
+          let(:api_key_value) { "essu_VFZGblZreFhTekJ4ZDB4M2NHUnZRMEU2YzNWd1pYSnpaV055WlhRPQ==AAAAAAAA" }
+
+          it "sets the Authorization header verbatim without re-encoding" do
+            plugin.register
+            client = plugin.send(:get_client).client
+            auth_header = extract_transport(client).options[:transport_options][:headers]['Authorization']
+
+            expect(auth_header).to eql("ApiKey #{api_key_value}")
+          end
+        end
+
+        context "with an unrecognized api_key format" do
+          let(:api_key_value) { "not-a-valid-key" }
+
+          # `test_connection!` and `setup_serverless` are stubbed here, so the
+          # client is built explicitly, as in the other api_key examples.
+          it "fails to build a client with a configuration error" do
+            plugin.register
+            expect { plugin.send(:get_client) }.to raise_error(LogStash::ConfigurationError, /Invalid api_key format/)
+          end
+        end
+
         context 'user also set' do
           let(:config) { super().merge({ 'api_key' => 'foo:bar', 'user' => 'another' }) }
 
@@ -559,11 +561,6 @@ describe LogStash::Filters::Elasticsearch do
 
     before(:each) do
       allow(LogStash::Filters::ElasticsearchClient).to receive(:new).and_return(client)
-      if defined?(Elastic::Transport)
-        allow(client).to receive(:es_transport_client_type).and_return('elastic_transport')
-      else
-        allow(client).to receive(:es_transport_client_type).and_return('elasticsearch_transport')
-      end
       allow(plugin).to receive(:test_connection!)
       allow(plugin).to receive(:setup_serverless)
       plugin.register

data/spec/filters/elasticsearch_ssl_spec.rb

@@ -15,7 +15,7 @@ describe "SSL options" do
   before do
     allow(es_client_double).to receive(:close)
     allow(es_client_double).to receive(:ping).with(any_args).and_return(double("pong").as_null_object)
-    allow(es_client_double).to receive(:info).with(any_args).and_return({"version" => {"number" => "7.5.0", "build_flavor" => "default"},
+    allow(es_client_double).to receive(:info).with(any_args).and_return({"version" => {"number" => "8.0.0", "build_flavor" => "default"},
                                                                          "tagline" => "You Know, for Search"})
     allow(Elasticsearch::Client).to receive(:new).and_return(es_client_double)
   end

data/spec/filters/fixtures/test_certs/ca.crt

@@ -1,32 +1,32 @@
 -----BEGIN CERTIFICATE-----
-MIIFiDCCA3CgAwIBAgIJAMPwu3Hm/yaUMA0GCSqGSIb3DQEBCwUAMFExCzAJBgNV
-BAYTAkxTMQswCQYDVQQIDAJOQTETMBEGA1UEBwwKSHR0cCBJbnB1dDERMA8GA1UE
-CgwITG9nc3Rhc2gxDTALBgNVBAMMBHJvb3QwHhcNMjIxMDE0MTkxOTM2WhcNMjcx
-MDE0MTkxOTM2WjBRMQswCQYDVQQGEwJMUzELMAkGA1UECAwCTkExEzARBgNVBAcM
-Ckh0dHAgSW5wdXQxETAPBgNVBAoMCExvZ3N0YXNoMQ0wCwYDVQQDDARyb290MIIC
-IjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsqSxx9bax+BGxDZ3qzkt0WAY
-6/UXqv8ay5q3ejrDsYqEopQzvpIfVqZvjAx4aGc+FsYs1ophg3RKBZz84+2DQIDD
-cwrP9/ggDs7C7c/9PEV77tLpkcvvhzW6JxsvY0BjGhPNNKl5KObxeVnLXyDjiYeC
-ON1U8ve4p0K6nczCbvPtyXgjYKLXGSOB6JRDDJa8exAPhO3HoSv0ZuVFLuSzle8z
-ZH1+P5wRGxGobi4NmhFTfYSSL5j21631P8n5N4xHVIhYr8vQNlWVGKkAIQeVneaD
-RsJ+NNRG+tP07X7sv5/QdgjEWXXF33sLeVusK+jWnGep//3Nr8d69ep230rnFQJv
-16HXkGhUUpCWyzE7n7sXS+Z7luOtQtPxHYAh40QKLUQMZVW7rS35KmeLOQMeIGEX
-xSZGRN7kYBqCV7FP8O7uvnBIXUcp66s9lSyaFJAZZgFb7VV2POZ0fBKRjvZVPjRa
-q0qwiSz2H/YbaszK8h22KYvYePzcBJ649w0G3siQ8pz5aFb1dT0H/CrKzdRTN3bE
-nuwk1HsiiM+9Jm0FSjQW5QMmwL+dWorVU1mTNB5wCO8fbmAoNZp3e5PkqkoOP/4q
-I+e0nKOHVqcmCw4WiLa2C05Le4VHlBdPzp2Zm/8b1VgDfIf+9LPcgwACzxkF5KTD
-cLvemYMVIJ+mveMitS8CAwEAAaNjMGEwHQYDVR0OBBYEFMMkkLxa8RHjAG+Pizya
-L/goJNw8MB8GA1UdIwQYMBaAFMMkkLxa8RHjAG+PizyaL/goJNw8MA8GA1UdEwEB
-/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4ICAQAUmBX5
-pUi4PJIB/Cld8T2Otgmywu4gSrTFWQpJuF++NxdryZRGg7twDxErlaH1YTuuvtwY
-X0LGF6b1XTNyRZn5o/gJJNxiYGucBxLc4Qx2qJje6CIg38fhfDTeyU8paiFnNxNj
-Fy+/5CgCrxEGd310XIU2gHJ8SWjhHNtJBeeDU6iXl6ITDTBI+Vf7gDyuR4fSi5rK
-Jl3oxxZLwk9u8qAQ/qzRadIQK1yRjUnZI6ClFLULXKGBu5DG9Uh9S3FGUPWCd4dl
-gU6dfhnxdy6PMUbkhdK426dm7U7W0NpbqxfCQWvnaiwihyfN2/gM0GfuNHkp8kA4
-W76xOC6aM6PjjyNWeIx7+Rm4/rCzWlL0aue9ZTWkxQlTbwms70KEGS12qriX6lPC
-mwIWvkN88JnbPlHvGCtxn+GBYb2qwtWmPdBl3t0EivpfJMG+gEuyoY7i/zf+2bvD
-h5A8r0PBhtliZDFX5ZY1UMvoh6Jag2QxzHCr+oDbjljMbR2M76ezfWOCntRGlkVa
-1Ah+vs7/kS2TwSL0X8EY2gXl7iGIhpJ7B6npz3KfvaRysHwP4xMxIUdy9Aj8niFf
-5OMCF2rYrXSu4tK7uvwp/V3Xuk3H4YM1wFXapE2o+DCuFhOwHbku1r/ALH//KgFb
-4O26CUzCDyhhBy+/wiuG6Fk37YskQBCgs37Mww==
+MIIFkzCCA3ugAwIBAgIUAjGJl4AQnrueLCvWZR5yN89tSHEwDQYJKoZIhvcNAQEL
+BQAwUTELMAkGA1UEBhMCTFMxCzAJBgNVBAgMAk5BMRMwEQYDVQQHDApIdHRwIElu
+cHV0MREwDwYDVQQKDAhMb2dzdGFzaDENMAsGA1UEAwwEcm9vdDAeFw0yNTEwMTcx
+NDU0NTRaFw0zMDEwMTcxNDU0NTRaMFExCzAJBgNVBAYTAkxTMQswCQYDVQQIDAJO
+QTETMBEGA1UEBwwKSHR0cCBJbnB1dDERMA8GA1UECgwITG9nc3Rhc2gxDTALBgNV
+BAMMBHJvb3QwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCm+zeOQcnl
+qhyTFjZ8CY9kJciUPHNBzWrBfcDfdGBZq+2/n95SySo5KgkfAnZW2Ma4NUHZozDJ
+V48NSVTDuXNwPO5MNh+pLS031W81t9t51muzk6lK6753j0Q2plwG0MhXav8A4Kv4
+1UgdsNErMFha1rd25ht73J09oWYn/TCJe2m5AGpviWzzDMYGhdzvb8vinoRCmfre
+h9X8U4DNJfgTBBaU/sKXdgbVMfUVUYv/+i6HIgxxBAsCzdX4tElRo4y9c1TK6ik1
+L7//lgK+r2zOWwpUw9yq6+Q4WO+zyZEQAJ1z0S+xzA8KDW50SP4hGUS36n3ywtsq
+22icDMcKtfcT5+aYSGT++vNCtENJKbEOAP4dokvPuwBzkoUrLFdWV6VA/7a47Udd
+IOXDY9U1tuYh82gLFuN69ykVoDFwH9U/Fw8bG5lOMEa3NqVCjEReUJpE3cjS4VB3
+QugaHSbVf0ITCCzJriq/qRi0coknQ05Q/Mt+bPDkboSSrmn5xc1sFVmtIy4w9GCD
+Sph2G5VQsauZh4x2qEQFHgo64b1Fexzn4I1b+fIx/iawIBkJ+ViHb0uv1G9P+YKq
+fL2J8fo0wFHGnxkA2sggb9naim8VGJqGDWodnlLqN4IWztD/x5PQLwx+A1KZmfy0
+VVHBmPITQJuyXJsYz/IgWyX500dZTB680QIDAQABo2MwYTAdBgNVHQ4EFgQUtyj4
+4lRYioSg/HodSvEl2ZqLvtkwHwYDVR0jBBgwFoAUtyj44lRYioSg/HodSvEl2ZqL
+vtkwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQEL
+BQADggIBADO458Qg9tA1JAZmKcM9T/IIwgjfZDRGg3H6TW7PIRBPvVkwfGpWOCKI
+rlcEPrzMatbGwUHdCtaDZ1TCFqp1h9v/vFc/Cvnygc/XCa7s8yCU0pN+U3XQRA8U
+AfTK11747mLNyX4xNZEFQaSFk71UzRcxkA2Mm9+zs4nddO1MOaLNh2MVLJ4qyg55
+0ypxXCWXjEols19dxwFiHbLGeW/+0jEPMby578voSg4xykYJMjjzH+yqkk+TJCcq
+n3SCgKpKpTQKBwSRwn3ztj2qK765v/P/xFYWBogzQIowfN5MN/C8moVg61YqcFHE
+kHwjRime2sj5DEsW7GyoZ19Q7xWoR15GxVnlL1PRBWcqWsVXLytspCgA1x8UNYBH
+isM05TlGZaMqNU7hX6Tv4bab4ieUNAAOcPvUhRg1Px3Bl2e9JhlN7oBwppj77eta
+GFT5+tq4s7d5IsOOMKj9YA0ea0hYqvxHf0G1Io4ebkAqECGaLQNNXjZ0M/Bf6K3A
+RaQupjNBrnIOZ6zOItKcaBwBWRudeVsVfJBaovw+5SjTJD9MqGCSyyJjg70KYGTc
++U/qOg+BRbKe8fwi3+1rb2OKPy8+0MLP4x9wrLuP7edTyE0UQxe2AXCp6Ysg7Yd3
+OBZlCXukkOaLrG7QbVS0iWsZQ61aeqcZs9rai5FydCpPgbjs1TJ8
 -----END CERTIFICATE-----

data/spec/filters/fixtures/test_certs/ca.der.sha256

@@ -1 +1 @@
-241943c7ea305d5489fce87550f53c0655b2419dcd0e8e4c7a164abc8e82808c
+f87c28293c97641f5d26976330f69af97be14900508bb66562696bdd15d19ec8

data/spec/filters/fixtures/test_certs/ca.key

@@ -1,51 +1,52 @@
------BEGIN RSA PRIVATE KEY-----
-MIIJKAIBAAKCAgEAsqSxx9bax+BGxDZ3qzkt0WAY6/UXqv8ay5q3ejrDsYqEopQz
-vpIfVqZvjAx4aGc+FsYs1ophg3RKBZz84+2DQIDDcwrP9/ggDs7C7c/9PEV77tLp
-kcvvhzW6JxsvY0BjGhPNNKl5KObxeVnLXyDjiYeCON1U8ve4p0K6nczCbvPtyXgj
-YKLXGSOB6JRDDJa8exAPhO3HoSv0ZuVFLuSzle8zZH1+P5wRGxGobi4NmhFTfYSS
-L5j21631P8n5N4xHVIhYr8vQNlWVGKkAIQeVneaDRsJ+NNRG+tP07X7sv5/QdgjE
-WXXF33sLeVusK+jWnGep//3Nr8d69ep230rnFQJv16HXkGhUUpCWyzE7n7sXS+Z7
-luOtQtPxHYAh40QKLUQMZVW7rS35KmeLOQMeIGEXxSZGRN7kYBqCV7FP8O7uvnBI
-XUcp66s9lSyaFJAZZgFb7VV2POZ0fBKRjvZVPjRaq0qwiSz2H/YbaszK8h22KYvY
-ePzcBJ649w0G3siQ8pz5aFb1dT0H/CrKzdRTN3bEnuwk1HsiiM+9Jm0FSjQW5QMm
-wL+dWorVU1mTNB5wCO8fbmAoNZp3e5PkqkoOP/4qI+e0nKOHVqcmCw4WiLa2C05L
-e4VHlBdPzp2Zm/8b1VgDfIf+9LPcgwACzxkF5KTDcLvemYMVIJ+mveMitS8CAwEA
-AQKCAgAf90Z0muaVI3WmQJTTR60CLS7ocfflOjbCPhIcxg0kZMPtD5XewOjoqWmG
-ZujYzbiXfKijTym5ywI/1OKPqn10+lV+7W1fUr/xxl+tDC2lLk3J42W2GAbpa9y+
-iKfHG8tf7DEo/jZW8lQ9QasZf5oXju7nW/uKandZPqCEAhK8pdtj1KKH9TuGHQtu
-4bDJvONHJg2Q3Ld/CI14KAhkJrpX1vCcR7Rij3ukG1nHNWhrrDQDXsiFydpJp7Ad
-1PdKUEinQKqV8mN0hYXjXsJOJrxH/+p3q+/HZkC5O1o1cSPN+jvkExeHZoKcxbi8
-44GAbe6RGB+cVf8LOCexf138ALwugmSI+b4DqWdB2AAn9/3LeUWxXm3JKhqn5y1o
-nVA1/+6fZtGKjQGRuYAkMxQfSUp+a8UXM72LmU0Vb32RYAJziU3EMslrQheMWCxN
-xH2x5ftdGnhH6biWOK8MG1JpktPSAQb05cdpaRlDiaj+3rg5WcfcWxCNLROLOXPn
-XZZY4wTjDv7R5T9PNGElUxW0Y8W4nc+R31fnLjHZO+6PjI19t+IrQaYXZk6DkoBm
-19P5nLc7ad3y3jqjuxC9yZaMXoSslWnztvF3UjC9twlJ+bnqf+/EHKyNPa9lWWE/
-zsxobGKTBxQp2mE002UUXMcwpfGge6yOSnVhjqMZEcOTrSaTeQKCAQEA6fJCiVKn
-7uuZCuYxu9OxBIP8bV9DTzY7MYlTDH5FOe1udM8qg7PMz+zhz4fT7kqyFPYZnxcj
-tkFJhGvEkZ1X5Dn2aH6Dg3NPHURMvVZcRaOq6uZ7JhdDTrX3VHmF3H5HV8wpydQT
-yYXbcS9pyy5kiH0sK5MsF+uiRvEwkBF5dB1FtVryrYky3ObrYTFbrgseLHbA1PYS
-PaiAYwIjjajm/wY2FubcNyTvmUawjH7KZuHCKYCcPA9o5vMhO2ke5UaixZWIYIkK
-P/4pg+lq8dkz54vbtgU6kFBqJjbdUUZhEzsgJY9SoejOX6uN40Te1JG7ejjnw+Pv
-uY8hdrRaqNoSxQKCAQEAw3vT9cQebcaFzSlBHAoNsD25FXQXgZuYSIvm8iXIV8UM
-Dl9oTVh6gdof9qOea24f0Bq09lkJIJa3ZSU0Jp8dEyXT6mnoLtZSKgWj11b3JXll
-eWfWbZ6AXXPMk7BS2/FynnOGkt037Qo4cuwfkxACnP1Nu9l0gIFk4A/iOSk1tfMN
-MwW3vVljaTl/8M4tPma9VLDwV6EuE/ov8RcOxHGUGSWoqWB2QuDa3Y+94xabsUtB
-cXrUO5i+9G3T3ajuEEv9I9SRB7N6u42LXFJ0g/paHfyrXHIiQkBhe2u9UeisWrr6
-A0DSMimjr2u1C2AESFVfCTS44pfLg5wNJ+201YLXYwKCAQAJXenMFcMjjctS5GSZ
-YKB1zdMNjgLj6Qf1s8nfdi7PYvJJOwI4w7ovmQxxgr65i8QVksTz2blUUsjexHHa
-YrJiMO/svyQE31kLkvB/pDWNlEADp7bGj6fiPuboOvVhHq08lrAVpKgmKXXf0kYq
-HHFqBZj/JaVeT9DvhjirjAeQ3psr57hPum6O6bAC9Db3gPp0TUzrOe8BCP4a+Lrz
-sQ+OpnED+bpXeuMc//eRqIHyHJfpkXyv6u4IUTPDbTIPfASIZLRRKSt/5G1FGtNt
-W4T4gGELqKnvnUiivw+dcXPxkSx4VIS6dtfMfNHxh5BkcnFPM3gUH8w5YcG1PwNi
-P1kBAoIBAQCZrUIvhjMpt5S+eb0ezuR99bgIHpDQKkLoXVt8Z6l9HoJg1i5IB9Of
-O5w/J9fFuvg1gJlcxRgAz5tzX3EFH7cas3VKZmHKWGCVeoOYKVz3z9yvOat/18gw
-L3XXcRlioQirekSENnbd2VgROIGF+mMjiZrPn58P2ykzYClHKJd5544r20XcDGaz
-dSmYZG17Dgevib4YFbUErX18+dR5KJT1w/440YWHA//riDIOUVqqYXAcRySLiYQs
-4h5ZtpEYrLRfs58kP7uvsBGrzYKdsnWf91+7uFooXTaFcWiO+OxuE2mynwXfu45b
-vL/CJoSXXM3ujcz/DbhHSamqBxxPcaHjAoIBAAVsTdPSz64Hr2xHyj4H5FqPDvY/
-lgD9GPZyXAIp4cBmguRiWJyq1oH39Sb2noueHZBmGke2wyA9IWYVAUx1FH5oNA0z
-I8lD1kO5Gl4QFQNfnW4NNOitp2smdsVEN7uvQIsli7A/UHZjTzpxwuRW8tLTu0WW
-UQs6zWUB55aYtjS01TpnLwiP83naC+jPbpS/5s0JsWf+Qb818EBUqrFSmm4D75/A
-C3C9vA3tHUltYNm8kg241iO3aGpjaI5T1gK6bMnMpxrpk3XTFJoDPw+XPySjE9aa
-nWn6eMAflovgvLpj+OYd3tf0iUO8GsfNf5JPqCrxXjbAhD+PYBsSSzv7PHs=
------END RSA PRIVATE KEY-----
+-----BEGIN PRIVATE KEY-----
+MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQCm+zeOQcnlqhyT
+FjZ8CY9kJciUPHNBzWrBfcDfdGBZq+2/n95SySo5KgkfAnZW2Ma4NUHZozDJV48N
+SVTDuXNwPO5MNh+pLS031W81t9t51muzk6lK6753j0Q2plwG0MhXav8A4Kv41Ugd
+sNErMFha1rd25ht73J09oWYn/TCJe2m5AGpviWzzDMYGhdzvb8vinoRCmfreh9X8
+U4DNJfgTBBaU/sKXdgbVMfUVUYv/+i6HIgxxBAsCzdX4tElRo4y9c1TK6ik1L7//
+lgK+r2zOWwpUw9yq6+Q4WO+zyZEQAJ1z0S+xzA8KDW50SP4hGUS36n3ywtsq22ic
+DMcKtfcT5+aYSGT++vNCtENJKbEOAP4dokvPuwBzkoUrLFdWV6VA/7a47UddIOXD
+Y9U1tuYh82gLFuN69ykVoDFwH9U/Fw8bG5lOMEa3NqVCjEReUJpE3cjS4VB3Quga
+HSbVf0ITCCzJriq/qRi0coknQ05Q/Mt+bPDkboSSrmn5xc1sFVmtIy4w9GCDSph2
+G5VQsauZh4x2qEQFHgo64b1Fexzn4I1b+fIx/iawIBkJ+ViHb0uv1G9P+YKqfL2J
+8fo0wFHGnxkA2sggb9naim8VGJqGDWodnlLqN4IWztD/x5PQLwx+A1KZmfy0VVHB
+mPITQJuyXJsYz/IgWyX500dZTB680QIDAQABAoIB/xgGYnfqqfc2rTsnIa+3Bb/j
+BSOkOZu+HR4PJIZXYtrZYduwT3dEek6/PZC4n0404mKenFren/utcrz2pWYuc0Ld
+gWvLCG3O54f2WDSNFNxIKDbY3VgU6H1LSlqSlQBmCcKKInvTLOsgb2qA25eF3TCK
+CYY8lWJnhjgtK1rq6DuKW4EYDjhTYtmVfOhzWivDv2dbvKvYe7/eIMECmAWW8O/L
+fB7z3guXb7mSS9uatV9Jymf8U3iZ8aZK91OmnOX3d3Mf+j3icwteqMFH/sfGIGGQ
+YmwlF3Aq1dXwSzdoSPbZynhfdf1JiYsTY6ZXhOOTlHo3GD1VdoiJXlkVfY3iSyor
+2BdrNEg97xS1cPK8S1vctUYRjR0NYkl1OyOMraRsuHnrmGcHNOGKdG4IPjCgo7mP
+EYjvmtp7tb+V4iJyFidkhpd1buts1hea0RZ/JpGwBP8H+64NHn/dHl1jttkHIhy8
+CN9UR1Byuo5FZaPMwOud/rBdS/pU+Ma66kQg5d7MGKzNdk0pa1YUrniMHnvmF/6x
+rsxnaWr+xnkvxsScFUCkfFVfcpuTUnY0IFL8ltFGZB9esQuKbyW1/wrcMOV7y5MH
+Y0dfxLDI6FRC1FF6CQQ3c4lg5ZXOeE1RXUDFZz1a2hTy1kr4+7vogMOPp9FNoHU+
+mao5VXUa8kL5LJgYhkkCggEBANU2KCtVv1aG6xcHNUMg/KQCdXU23uckN1Hu6iaP
+JapyX/FuWCHr51bi2CjiC8wtYNULq6z9NXZOYaa5cscbE/khVsRp8+Ca5qI+tY16
+PjVQh1IDQNgw7K+cTt1xdQiSJIWhDFfSEAbqFkDciNf9n4o0ZS4CXRLLIzjWtENc
+Cc2pDHvI+mpYLNTNAYhZi8mz4Cjd4bmWlUf2FhkllX1esF7dOC4gEIyQ9EeA9dnH
+n1RbACKxxIB0B3GT/xFt2Yri05mMXCPYbcrnNkv3/0HM0xns/8TtD0daQ6gXuFdZ
+YqV4SI808e9SvRdV7+N3H+klkoY4xg2FoYKpXnjHEliVDoUCggEBAMh99dDeW9FB
+jjl2EFsH4fDKD6o+iQNfFyAHGgFCzX/RGydE+f/idmLmKd9ldPQD6pltGLja/jrp
+T3WoRTIfadA6VBYknVKGoFZ7OJKPv+1+6A2nJOjtYP40MkmVnCyu9TiMJ7H3i057
+CxULEONeOLeF6ZJvC60pC5gnkaiv8bhIkSOL3/VitEmnL8yG2Hlh3+mcGYrBNWfZ
+SPUw6GJl+tyzyBwcZsjzTZ845ilvhEWCMe9Egb/crZ5vmcaZodB7SfbA8tJo4Jwo
+Swk8nY7YK/z6xv7toxTXJI3SRVbQ8PSr0Odbr/CQNDstl1g2SoGMongmt5njtI3c
+hL6RLxDUpN0CggEASBpXfUgzO7zGtfPvFDOMnJ5kQG589SfvOVsVflK8hybEwW3y
+ig4wHtb6COFg4fyamZGnzgmXUdnx9iMS6LiEiaS3pha6rcNUqZuRZDXp4bfI+3g0
+Lqhk8oJmvUaIMIzTowkylmRonR3+xpKOCJUxpdhQOz37Ycams6sQLRNsEUvQ9++g
+l+QXzSNDGGxH9L9K2CcpFc0R0NMs5/Yo1sv10y72t8qKLi87HQ9ElRCIFkvsAM+j
+R1l1xvgosyk1/1zz+CJaapjfkFWerBRDE2qEHWljmaIdn6Cr7qWO5qNI0/KYfy2F
+f8y4O7MJPCBl/z+AjLmYaKw/UWObmjagQqqtzQKCAQEApnrJalWpYloQEjCyJhSm
+jX4Lge8JcG4+Uo7zDgb9gtwMsw/4k3zllvvN2z1w3sp9vEa115GotxxSqb0/L/6b
+q5cziWt/4y3857LL6A9LbJcLc4LOCEhMWOjYtPdxRj1FTF48++80ksdjDWcx78qm
+R+X/bGOfC3tgsEhzD+KBUeeX9S9JmYYLdHlKHIgAKtKVznKbVvdWNFRd25Nv830A
+0NDMImOHCefWFZd2rwN1jw4sDqURJFLHLB85Tor1rZsicK4JM6R4ldJzdEkL/7gK
+1rcaFEcZOs3nAYiPoSZAXrpo7iPZNWVYqacS2+HA/k/b/O8RV8yXeZCZ/W+q6Eva
+VQKCAQEArJBEfTvVg4V3qp+2dcKZeBkWOeq53kA2Ey9Hn/FiNb/5jXzLjCkSF/jm
+XNSNQTzEFlm7vl7Ii8g3stPSOvBqnGqNkVmWSUuMmJKn9vxpn/adcyU1bCiu5dfT
+A+VOU6E7rMiQsODG3D8NrFGYthhaafoTVs6jI3eXMRjP1Z8Szw/WdE7uFbzYCVsP
+ERKJIykm9fspmlm/zsV+Ka2vSs+dPdUqNBO1sYRVgJObyvOSHwUorFJiKInrY+3z
+7l0X7AgLgT9U19W5WrP+e1nAWeXQrzvAyWHnzBf9y7TW9z/D5p3aivKM70qf1DVN
+hdh+Ptk6tdOWYuZaDnuuoeyq7+v6zw==
+-----END PRIVATE KEY-----