logstash-input-beats 6.0.11-java → 6.0.12-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3964ad3d90cff475af37cb0f6dcf53182fd9b81ae33079fff3bf8789fef9ddf1
-  data.tar.gz: 25bf12bef27170a2ab221d5003bc107492aae16e784995ebf44be9f0e51e479b
+  metadata.gz: fffd1d08907236b161c3b9df9bfd87ae1f90f0aa29450739410e7f2ec5d1a426
+  data.tar.gz: e48951c53cb2bc4ad6d4b48cb32dd7db0692b10d0182af7a21746cb703632f07
 SHA512:
-  metadata.gz: 9554a53784dbc2d06eb56e8710f5ddd2c49e1c7571fee3c1c7530e6118c76d60a82688c09dedfd373417f72a00eec1c09a2ac2851191b05f8fde347afa4761e6
-  data.tar.gz: 9b22eb9d8e5d60db6e6586eccb37bb518137b0458205d34f473dce178a088e3030095f1d6c0282ffa46574c26d2852feeea2b819788150f86a5ac30c38b27254
+  metadata.gz: f7f512920246aa50d6bd862844b133237f96fa75243a2fb13f255602881ab6ed9a7be1b3d7602db14ec7cfffbf795ef32fb3062425c0df5100159b2cee07acb9
+  data.tar.gz: 870eae665df61dc1aacc9ce0687e4042058e9c362301f93d255d318afc6045e92bda6f442f3fd7085db71fb532aa389052bf10f0a572761309bafe3229b596e2

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 6.0.12
+ - Fix: log error when SSL context building fails [#402](https://github.com/logstash-plugins/logstash-input-beats/pull/402).
+   We've also made sure to log messages on configuration errors as LS 7.8/7.9 only prints details when level set to debug.
+
 ## 6.0.11
  - Updated jackson databind and Netty dependencies. Additionally, this release removes the dependency on `tcnative` +
       `boringssl`, using JVM supplied ciphers instead. This may result in fewer ciphers being available if the JCE

data/VERSION

@@ -1 +1 @@
-6.0.11
+6.0.12

data/lib/logstash-input-beats_jars.rb

@@ -8,4 +8,4 @@ require_jar('com.fasterxml.jackson.core', 'jackson-annotations', '2.9.10')
 require_jar('com.fasterxml.jackson.core', 'jackson-databind', '2.9.10.4')
 require_jar('com.fasterxml.jackson.module', 'jackson-module-afterburner', '2.9.10')
 require_jar('org.apache.logging.log4j', 'log4j-api', '2.11.1')
-require_jar('org.logstash.beats', 'logstash-input-beats', '6.0.11')
+require_jar('org.logstash.beats', 'logstash-input-beats', '6.0.12')

data/lib/logstash/inputs/beats.rb

@@ -131,27 +131,32 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
       LogStash::Logger.setup_log4j(@logger)
     end
 
-    if !@ssl
-      @logger.warn("Beats input: SSL Certificate will not be used") unless @ssl_certificate.nil?
-      @logger.warn("Beats input: SSL Key will not be used") unless @ssl_key.nil?
-    elsif !ssl_configured?
-      raise LogStash::ConfigurationError, "Certificate or Certificate Key not configured"
-    end
+    if @ssl
+      if @ssl_key.nil? || @ssl_key.empty?
+        configuration_error "ssl_key => is a required setting when ssl => true is configured"
+      end
+      if @ssl_certificate.nil? || @ssl_certificate.empty?
+        configuration_error "ssl_certificate => is a required setting when ssl => true is configured"
+      end
 
-    if @ssl && require_certificate_authorities? && !client_authentification?
-      raise LogStash::ConfigurationError, "Using `verify_mode` set to PEER or FORCE_PEER, requires the configuration of `certificate_authorities`"
-    end
+      if require_certificate_authorities? && !client_authentification?
+        configuration_error "ssl_certificate_authorities => is a required setting when ssl_verify_mode => '#{@ssl_verify_mode}' is configured"
+      end
 
-    if client_authentication_metadata? && !require_certificate_authorities?
-      raise LogStash::ConfigurationError, "Enabling `peer_metadata` requires using `verify_mode` set to PEER or FORCE_PEER"
+      if client_authentication_metadata? && !require_certificate_authorities?
+        configuration_error "Configuring ssl_peer_metadata => true requires ssl_verify_mode => to be configured with 'peer' or 'force_peer'"
+      end
+    else
+      @logger.warn("configured ssl_certificate => #{@ssl_certificate.inspect} will not be used") if @ssl_certificate
+      @logger.warn("configured ssl_key => #{@ssl_key.inspect} will not be used") if @ssl_key
     end
 
     # Logstash 6.x breaking change (introduced with 4.0.0 of this gem)
     if @codec.kind_of? LogStash::Codecs::Multiline
-      raise LogStash::ConfigurationError, "Multiline codec with beats input is not supported. Please refer to the beats documentation for how to best manage multiline data. See https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html"
+      configuration_error "Multiline codec with beats input is not supported. Please refer to the beats documentation for how to best manage multiline data. See https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html"
     end
 
-    @logger.info("Beats inputs: Starting input listener", :address => "#{@host}:#{@port}")
+    @logger.info("Starting input listener", :address => "#{@host}:#{@port}")
 
     @server = create_server
   end # def register
@@ -159,37 +164,20 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
   def create_server
     server = org.logstash.beats.Server.new(@host, @port, @client_inactivity_timeout, @executor_threads)
     if @ssl
-
-      begin
-        ssl_context_builder = org.logstash.netty.SslContextBuilder.new(@ssl_certificate, @ssl_key, @ssl_key_passphrase.nil? ? nil : @ssl_key_passphrase.value)
-                          .setProtocols(convert_protocols)
-                          .setCipherSuites(normalized_ciphers)
-      rescue java.lang.IllegalArgumentException => e
-        raise LogStash::ConfigurationError, e
-      end
-
-
+      ssl_context_builder = new_ssl_context_builder
       if client_authentification?
-        if @ssl_verify_mode.upcase == "FORCE_PEER"
+        if @ssl_verify_mode == "force_peer"
           ssl_context_builder.setVerifyMode(org.logstash.netty.SslContextBuilder::SslClientVerifyMode::FORCE_PEER)
-        elsif @ssl_verify_mode.upcase == "PEER"
+        elsif @ssl_verify_mode == "peer"
           ssl_context_builder.setVerifyMode(org.logstash.netty.SslContextBuilder::SslClientVerifyMode::VERIFY_PEER)
         end
         ssl_context_builder.setCertificateAuthorities(@ssl_certificate_authorities)
       end
-      server.setSslHandlerProvider(org.logstash.netty.SslHandlerProvider.new(ssl_context_builder.build_context, @ssl_handshake_timeout))
+      server.setSslHandlerProvider(new_ssl_handshake_provider(ssl_context_builder))
     end
     server
   end
 
-  def ssl_configured?
-    !(@ssl_certificate.nil? || @ssl_key.nil?)
-  end
-
-  def target_codec_on_field?
-    !@target_codec_on_field.empty?
-  end
-
   def run(output_queue)
     message_listener = MessageListener.new(output_queue, self)
     @server.setMessageListener(message_listener)
@@ -200,6 +188,14 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
     @server.stop unless @server.nil?
   end
 
+  def ssl_configured?
+    !(@ssl_certificate.nil? || @ssl_key.nil?)
+  end
+
+  def target_codec_on_field?
+    !@target_codec_on_field.empty?
+  end
+
   def client_authentification?
     @ssl_certificate_authorities && @ssl_certificate_authorities.size > 0
   end
@@ -216,6 +212,32 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
     @ssl_verify_mode == "force_peer" || @ssl_verify_mode == "peer"
   end
 
+  private
+
+  def new_ssl_handshake_provider(ssl_context_builder)
+    begin
+      org.logstash.netty.SslHandlerProvider.new(ssl_context_builder.build_context, @ssl_handshake_timeout)
+    rescue java.lang.IllegalArgumentException => e
+      @logger.error("SSL configuration invalid", error_details(e))
+      raise LogStash::ConfigurationError, e
+    rescue java.security.GeneralSecurityException => e
+      @logger.error("SSL configuration failed", error_details(e, true))
+      raise e
+    end
+  end
+
+  def new_ssl_context_builder
+    passphrase = @ssl_key_passphrase.nil? ? nil : @ssl_key_passphrase.value
+    begin
+      org.logstash.netty.SslContextBuilder.new(@ssl_certificate, @ssl_key, passphrase)
+          .setProtocols(convert_protocols)
+          .setCipherSuites(normalized_ciphers)
+    rescue java.lang.IllegalArgumentException => e
+      @logger.error("SSL configuration invalid", error_details(e))
+      raise LogStash::ConfigurationError, e
+    end
+  end
+
   def normalized_ciphers
     @cipher_suites.map(&:upcase)
   end
@@ -223,4 +245,16 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
   def convert_protocols
     TLS.get_supported(@tls_min_version..@tls_max_version).map(&:name)
   end
+
+  def configuration_error(message)
+    @logger.error message
+    raise LogStash::ConfigurationError, message
+  end
+
+  def error_details(e, trace = false)
+    error_details = { :exception => e.class, :message => e.message }
+    error_details[:backtrace] = e.backtrace if trace || @logger.debug?
+    error_details
+  end
+
 end

data/spec/inputs/beats_spec.rb

@@ -13,11 +13,19 @@ describe LogStash::Inputs::Beats do
   let(:certificate) { BeatsInputTest.certificate }
   let(:port) { BeatsInputTest.random_port }
   let(:queue)  { Queue.new }
-  let(:config)   { { "port" => 0, "ssl_certificate" => certificate.ssl_cert, "ssl_key" => certificate.ssl_key, "type" => "example", "tags" => "beats"} }
+  let(:config)   do
+    {
+        "port" => 0,
+        "ssl_certificate" => certificate.ssl_cert,
+        "ssl_key" => certificate.ssl_key,
+        "type" => "example",
+        "tags" => "beats"
+    }
+  end
 
   context "#register" do
     context "host related configuration" do
-      let(:config) { super.merge!({ "host" => host, "port" => port, "client_inactivity_timeout" => client_inactivity_timeout, "executor_threads" => threads }) }
+      let(:config) { super.merge("host" => host, "port" => port, "client_inactivity_timeout" => client_inactivity_timeout, "executor_threads" => threads) }
       let(:host) { "192.168.1.20" }
       let(:port) { 9000 }
       let(:client_inactivity_timeout) { 400 }
@@ -38,38 +46,55 @@ describe LogStash::Inputs::Beats do
 
     context "with ssl enabled" do
       context "without certificate configuration" do
-        let(:config) {{ "port" => 0, "ssl" => true, "ssl_key" => certificate.ssl_key, "type" => "example", "tags" => "beats" }}
+        let(:config) { { "port" => 0, "ssl" => true, "ssl_key" => certificate.ssl_key, "type" => "example" } }
 
         it "should fail to register the plugin with ConfigurationError" do
           plugin = LogStash::Inputs::Beats.new(config)
-          expect {plugin.register}.to raise_error(LogStash::ConfigurationError)
+          expect { plugin.register }.to raise_error(LogStash::ConfigurationError)
         end
       end
 
       context "without key configuration" do
-        let(:config)   { { "port" => 0, "ssl" => true, "ssl_certificate" => certificate.ssl_cert, "type" => "example", "tags" => "Beats"} }
+        let(:config) { { "port" => 0, "ssl" => true, "ssl_certificate" => certificate.ssl_cert, "type" => "example" } }
         it "should fail to register the plugin with ConfigurationError" do
           plugin = LogStash::Inputs::Beats.new(config)
-          expect {plugin.register}.to raise_error(LogStash::ConfigurationError)
+          expect { plugin.register }.to raise_error(LogStash::ConfigurationError)
+        end
+      end
+
+      context "with invalid key configuration" do
+        let(:p12_key) { certificate.p12_key }
+        let(:config) { { "port" => 0, "ssl" => true, "ssl_certificate" => certificate.ssl_cert, "ssl_key" => p12_key } }
+        it "should fail to register the plugin" do
+          plugin = LogStash::Inputs::Beats.new(config)
+          expect( plugin.logger ).to receive(:error) do |msg, opts|
+            expect( msg ).to match /.*?configuration invalid/
+            expect( opts[:message] ).to match /does not contain valid private key/
+          end
+          expect { plugin.register }.to raise_error(LogStash::ConfigurationError)
         end
       end
 
       context "with invalid ciphers" do
-        let(:config)   { { "port" => 0, "ssl" => true, "ssl_certificate" => certificate.ssl_cert, "type" => "example", "tags" => "Beats", "cipher_suites" => "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA38"} }
+        let(:config) { super.merge("ssl" => true, "cipher_suites" => "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA38") }
 
         it "should raise a configuration error" do
           plugin = LogStash::Inputs::Beats.new(config)
+          expect( plugin.logger ).to receive(:error) do |msg, opts|
+            expect( msg ).to match /.*?configuration invalid/
+            expect( opts[:message] ).to match /TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA38.*? not available/
+          end
           expect { plugin.register }.to raise_error(LogStash::ConfigurationError)
         end
       end
 
       context "verify_mode" do
         context "verify_mode configured to PEER" do
-          let(:config)   { { "port" => 0, "ssl" => true, "ssl_verify_mode" => "peer", "ssl_certificate" => certificate.ssl_cert, "ssl_key" => certificate.ssl_key, "type" => "example", "tags" => "Beats"} }
+          let(:config) { super.merge("ssl" => true, "ssl_verify_mode" => "peer") }
 
           it "raise a ConfigurationError when certificate_authorities is not set" do
             plugin = LogStash::Inputs::Beats.new(config)
-            expect {plugin.register}.to raise_error(LogStash::ConfigurationError, "Using `verify_mode` set to PEER or FORCE_PEER, requires the configuration of `certificate_authorities`")
+            expect {plugin.register}.to raise_error(LogStash::ConfigurationError, "ssl_certificate_authorities => is a required setting when ssl_verify_mode => 'peer' is configured")
           end
 
           it "doesn't raise a configuration error when certificate_authorities is set" do
@@ -80,11 +105,11 @@ describe LogStash::Inputs::Beats do
         end
 
         context "verify_mode configured to FORCE_PEER" do
-          let(:config)   { { "port" => 0, "ssl" => true, "ssl_verify_mode" => "force_peer", "ssl_certificate" => certificate.ssl_cert, "ssl_key" => certificate.ssl_key, "type" => "example", "tags" => "Beats"} }
+          let(:config) { super.merge("ssl" => true, "ssl_verify_mode" => "force_peer") }
 
           it "raise a ConfigurationError when certificate_authorities is not set" do
             plugin = LogStash::Inputs::Beats.new(config)
-            expect {plugin.register}.to raise_error(LogStash::ConfigurationError, "Using `verify_mode` set to PEER or FORCE_PEER, requires the configuration of `certificate_authorities`")
+            expect {plugin.register}.to raise_error(LogStash::ConfigurationError, "ssl_certificate_authorities => is a required setting when ssl_verify_mode => 'force_peer' is configured")
           end
 
           it "doesn't raise a configuration error when certificate_authorities is set" do
@@ -98,7 +123,7 @@ describe LogStash::Inputs::Beats do
 
     context "with ssl disabled" do
       context "and certificate configuration" do
-        let(:config)   { { "port" => 0, "ssl" => false, "ssl_certificate" => certificate.ssl_cert, "type" => "example", "tags" => "Beats" } }
+        let(:config) { { "port" => 0, "ssl" => false, "ssl_certificate" => certificate.ssl_cert, "type" => "example", "tags" => "Beats" } }
 
         it "should not fail" do
           plugin = LogStash::Inputs::Beats.new(config)

data/spec/support/logstash_test.rb

@@ -13,6 +13,13 @@ module BeatsInputTest
 
       system("openssl req -x509  -batch -nodes -newkey rsa:2048 -keyout #{ssl_key} -out #{ssl_cert} -subj /CN=localhost > /dev/null 2>&1")
     end
+
+    def p12_key
+      p12_key = Stud::Temporary.pathname("p12_key")
+      system "openssl pkcs12 -export -passout pass:123 -inkey #{ssl_key} -in #{ssl_cert} -out #{p12_key}"
+      p12_key
+    end
+
   end
 
   class << self

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-input-beats
 version: !ruby/object:Gem::Version
-  version: 6.0.11
+  version: 6.0.12
 platform: java
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-06-03 00:00:00.000000000 Z
+date: 2020-12-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
@@ -271,7 +271,7 @@ files:
 - vendor/jar-dependencies/io/netty/netty-all/4.1.49.Final/netty-all-4.1.49.Final.jar
 - vendor/jar-dependencies/org/apache/logging/log4j/log4j-api/2.11.1/log4j-api-2.11.1.jar
 - vendor/jar-dependencies/org/javassist/javassist/3.24.0-GA/javassist-3.24.0-GA.jar
-- vendor/jar-dependencies/org/logstash/beats/logstash-input-beats/6.0.11/logstash-input-beats-6.0.11.jar
+- vendor/jar-dependencies/org/logstash/beats/logstash-input-beats/6.0.12/logstash-input-beats-6.0.12.jar
 homepage: http://www.elastic.co/guide/en/logstash/current/index.html
 licenses:
 - Apache License (2.0)