logstash-input-log4j 3.0.3-java → 3.0.4-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: a15d7c497e785b7e09b93e6f176bea3cf52a1936
-  data.tar.gz: 3daa1c9000748d6a21f91551ccb15866444c1efa
+  metadata.gz: 8332669c67e8a314ad2bdbeacb8d73ce517f6164
+  data.tar.gz: b08d5eecf241d5205f521ed95cd3aad87b96681d
 SHA512:
-  metadata.gz: 195c966ddab0dff4b8077a26496586584f8e333702247a38924e270213ae991243c56e77b53485409671c6af6b11d92f4a766f52583ad04360f8c23965746173
-  data.tar.gz: e06e17f5bb17535ea3870ab98dec0e0f0b25153a70f3ad0b29048f728c360dd4b709f6cc8c8c8ddbcd7eba4f1606dd95d699ec70d38868cb1ddd3da36c19aa53
+  metadata.gz: d1228c327c49ebc80c2d1a3551cff839750ec6ed6c1785f766fa36378fff8287eb4642e044cf51eebaf8a01d22a1c3d130815be7e4ec8b7202e5703f33d212ad
+  data.tar.gz: 481d227075c191bf9c4f0d05da2cf6f319c99338cab7251c846f6a3d28a325d90e0d8b729c7cdc5412e1f7dc1f5e4c1378b2c1ddd1e528ed530cddeb21c928e6

data/CHANGELOG.md

@@ -1,3 +1,6 @@
+## 3.0.4
+  - This input will now reject any non-log4j log objects sent as input.
+
 ## 3.0.3
   - `data_timeout` is now marked as obsolete, since this option is no longer necessary
 

data/lib/logstash/inputs/log4j.rb

@@ -41,6 +41,10 @@ class LogStash::Inputs::Log4j < LogStash::Inputs::Base
   # When mode is `client`, the port to connect to.
   config :port, :validate => :number, :default => 4560
 
+  # Proxy protocol support, only v1 is supported at this time
+  # http://www.haproxy.org/download/1.5/doc/proxy-protocol.txt
+  config :proxy_protocol, :validate => :boolean, :default => false
+
   # Read timeout in seconds. If a particular TCP connection is
   # idle for more than this timeout period, we will assume
   # it is dead and close it.
@@ -57,8 +61,6 @@ class LogStash::Inputs::Log4j < LogStash::Inputs::Base
 
   public
   def register
-    require "java"
-    require "jruby/serialization"
 
     begin
       Java::OrgApacheLog4jSpi.const_get("LoggingEvent")
@@ -100,10 +102,25 @@ class LogStash::Inputs::Log4j < LogStash::Inputs::Base
   private
   def handle_socket(socket, output_queue)
     begin
+      peer = socket.peer
+      if @proxy_protocol
+        pp_hdr = socket.readline
+        pp_info = pp_hdr.split(/\s/)
+
+        # PROXY proto clientip proxyip clientport proxyport
+        if pp_info[0] != "PROXY"
+          @logger.error("invalid proxy protocol header label", :hdr => pp_hdr)
+          return
+        else
+          # would be nice to log the proxy host and port data as well, but minimizing changes
+          peer = pp_info[2]
+        end
+      end
       ois = socket_to_inputstream(socket)
+
       while !stop?
         event = create_event(ois.readObject)
-        event.set("host", socket.peer)
+        event.set("host", peer)
         decorate(event)
         output_queue << event
       end # loop do
@@ -124,8 +141,7 @@ class LogStash::Inputs::Log4j < LogStash::Inputs::Base
 
   private
   def socket_to_inputstream(socket)
-    # JRubyObjectInputStream uses JRuby class path to find the class to de-serialize to
-    JRubyObjectInputStream.new(java.io.BufferedInputStream.new(socket.to_inputstream))
+     Log4jInputStream.new(java.io.BufferedInputStream.new(socket.to_inputstream))
   end
 
   private
@@ -178,4 +194,23 @@ class LogStash::Inputs::Log4j < LogStash::Inputs::Base
   def add_socket_mixin(socket)
     socket.instance_eval { class << self; include ::LogStash::Util::SocketPeer end }
   end
+
+  class Log4jInputStream < java.io.ObjectInputStream
+    ALLOWED_CLASSES = ["org.apache.log4j.spi.LoggingEvent"]
+
+    def initialize(*args)
+      super
+      @class_loader = org.jruby.Ruby.getGlobalRuntime.getJRubyClassLoader 
+    end
+
+    def safety_check(name)
+      raise java.io.InvalidObjectException.new("Object type #{name} is not allowed.") if !ALLOWED_CLASSES.include?(name)
+    end
+
+    def resolveClass(desc)
+      name = desc.getName
+      safety_check(name)
+      java.lang.Class.forName(name, false, @class_loader)
+    end
+  end
 end # class LogStash::Inputs::Log4j

data/logstash-input-log4j.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-input-log4j'
-  s.version         = '3.0.3'
+  s.version         = '3.0.4'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "Read events over a TCP socket from a Log4j SocketAppender"
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
@@ -26,5 +26,6 @@ Gem::Specification.new do |s|
   s.add_runtime_dependency "logstash-core-plugin-api", ">= 1.60", "<= 2.99"
 
   s.add_development_dependency 'logstash-devutils'
+  s.add_development_dependency 'flores'
 end
 

data/spec/inputs/log4j_spec.rb

@@ -1,16 +1,23 @@
 # encoding: utf-8
 require "logstash/devutils/rspec/spec_helper"
+require "socket"
 require "logstash/inputs/log4j"
 require "logstash/plugin"
+require "stud/try"
+require "stud/task"
+require 'timeout'
+require "flores/random"
+
+# Uncomment to enable higher level logging if needed during testing.
+#LogStash::Logging::Logger::configure_logging("DEBUG")
 
 describe LogStash::Inputs::Log4j do
 
   it "should register" do
-    input = LogStash::Plugin.lookup("input", "log4j").new("mode" => "client")
-
+    plugin = LogStash::Plugin.lookup("input", "log4j").new("mode" => "client")
 
     # register will try to load jars and raise if it cannot find jars or if org.apache.log4j.spi.LoggingEvent class is not present
-    expect {input.register}.to_not raise_error
+    expect {plugin.register}.to_not raise_error
   end
 
   context "when interrupting the plugin in server mode" do
@@ -35,7 +42,7 @@ describe LogStash::Inputs::Log4j do
   end
 
   context "reading general information from a org.apache.log4j.spi.LoggingEvent" do
-    let (:input) { LogStash::Plugin.lookup("input", "log4j").new("mode" => "client") }
+    let (:plugin) { LogStash::Plugin.lookup("input", "log4j").new("mode" => "client") }
     let (:log_obj) {
       org.apache.log4j.spi.LoggingEvent.new(
         "org.apache.log4j.Logger",
@@ -59,7 +66,7 @@ describe LogStash::Inputs::Log4j do
     }
 
     it "creates event with general information" do
-      subject = input.create_event(log_obj)
+      subject = plugin.create_event(log_obj)
       expect(subject.get("timestamp")).to eq(1426366971)
       expect(subject.get("path")).to eq("org.apache.log4j.LayoutTest")
       expect(subject.get("priority")).to eq("INFO")
@@ -74,14 +81,120 @@ describe LogStash::Inputs::Log4j do
     end
 
     it "creates event without stacktrace" do
-      subject = input.create_event(log_obj)
+      subject = plugin.create_event(log_obj)
       expect(subject.get("stack_trace")).to be_nil
     end
 
     it "creates event with stacktrace" do
-      subject = input.create_event(log_obj_with_stacktrace)
+      subject = plugin.create_event(log_obj_with_stacktrace)
       #checks stack_trace is collected, exact value is too monstruous
       expect(subject.get("stack_trace")).not_to be_empty
     end
   end
+
+  context "integration test" do
+    let(:host) { "127.0.0.1" }
+    let(:port) do
+      socket, address, port = Flores::Random.tcp_listener
+      socket.close
+      port
+    end
+
+    let(:config) do
+      {
+        "host" => host,
+        "port" => port
+      }
+    end
+
+    subject { LogStash::Inputs::Log4j.new(config) }
+
+    before do
+      subject.register
+    end
+
+    let(:thread) do
+      Thread.new { subject.run(queue) }
+    end
+
+    let(:queue) do
+      []
+    end
+
+    let(:client) do
+      Stud.try(5.times) { TCPSocket.new(host, port) }
+    end
+
+    after do
+      subject.do_stop
+
+      10.times do 
+        break unless thread.alive?
+        sleep(0.1)
+      end
+      expect(thread).not_to be_alive
+    end
+
+    shared_examples "accept events from the network" do |fixture|
+      before do
+        thread  # make the thread run
+        File.open(fixture, "rb") do |payload|
+          IO.copy_stream(payload, client)
+        end
+        client.close
+
+        Stud.try(5.times) do
+          throw StandardError.new("queue was empty, no data?") if queue.empty?
+        end
+        expect(queue.size).to be == 1
+      end
+
+      it "should accept an event from the network" do
+        event = queue.first
+        expect(event.get("message")).to be == "Hello world"
+      end
+    end
+
+    context "default behavior" do
+      include_examples "accept events from the network", "spec/fixtures/log4j.payload"
+    end
+
+    context "with proxy enabled" do
+      let(:config) do
+        {
+          "host" => host,
+          "port" => port,
+          "proxy_protocol" => true
+        }
+      end
+
+      before do
+        client.write("PROXY TCP4 1.2.3.4 5.6.7.8 1234 5678\r\n")
+      end
+
+      include_examples "accept events from the network", "spec/fixtures/log4j.payload" do
+        it "should set proxy_host and proxy_port" do
+          event = queue.first
+          expect(event.get("host")).to be == "1.2.3.4"
+        end
+      end
+    end
+  end
+
+  context "for safety" do
+    let(:input) { java.lang.Integer.new(Flores::Random.integer(0..1000)) }
+    let(:baos) { java.io.ByteArrayOutputStream.new }
+    let(:oos) { java.io.ObjectOutputStream.new(baos) }
+    let(:data) {
+      oos.writeObject(input)
+      baos.toByteArray()
+    }
+
+    let(:bais) { java.io.ByteArrayInputStream.new(data) }
+    let(:ois) { LogStash::Inputs::Log4j::Log4jInputStream.new(bais) }
+
+    it "should reject non-log4j objects" do
+      expect { ois.readObject }.to raise_error(java.io.InvalidObjectException)
+    end
+  end
 end

metadata

@@ -1,30 +1,39 @@
 --- !ruby/object:Gem::Specification
 name: logstash-input-log4j
 version: !ruby/object:Gem::Version
-  version: 3.0.3
+  version: 3.0.4
 platform: java
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2016-08-11 00:00:00.000000000 Z
+date: 2017-04-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
+  name: logstash-codec-plain
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-  name: logstash-codec-plain
   prerelease: false
   type: :runtime
+- !ruby/object:Gem::Dependency
+  name: logstash-core-plugin-api
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
+        version: '1.60'
+    - - "<="
+      - !ruby/object:Gem::Version
+        version: '2.99'
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -33,31 +42,36 @@ dependencies:
     - - "<="
       - !ruby/object:Gem::Version
         version: '2.99'
-  name: logstash-core-plugin-api
   prerelease: false
   type: :runtime
+- !ruby/object:Gem::Dependency
+  name: logstash-devutils
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.60'
-    - - "<="
-      - !ruby/object:Gem::Version
-        version: '2.99'
-- !ruby/object:Gem::Dependency
+        version: '0'
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-  name: logstash-devutils
   prerelease: false
   type: :development
+- !ruby/object:Gem::Dependency
+  name: flores
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  prerelease: false
+  type: :development
 description: This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program
 email: info@elastic.co
 executables: []
@@ -73,6 +87,7 @@ files:
 - lib/logstash-input-log4j_jars.rb
 - lib/logstash/inputs/log4j.rb
 - logstash-input-log4j.gemspec
+- spec/fixtures/log4j.payload
 - spec/inputs/log4j_spec.rb
 - vendor/jar-dependencies/runtime-jars/log4j-1.2.17.jar
 homepage: http://www.elastic.co/guide/en/logstash/current/index.html
@@ -102,4 +117,5 @@ signing_key:
 specification_version: 4
 summary: Read events over a TCP socket from a Log4j SocketAppender
 test_files:
+- spec/fixtures/log4j.payload
 - spec/inputs/log4j_spec.rb