sp-logstash-input-http 3.3.7-java

data/docs/index.asciidoc

@@ -0,0 +1,346 @@
+:plugin: http
+:type: input
+:default_codec: plain
+
+///////////////////////////////////////////
+START - GENERATED VARIABLES, DO NOT EDIT!
+///////////////////////////////////////////
+:version: %VERSION%
+:release_date: %RELEASE_DATE%
+:changelog_url: %CHANGELOG_URL%
+:include_path: ../../../../logstash/docs/include
+///////////////////////////////////////////
+END - GENERATED VARIABLES, DO NOT EDIT!
+///////////////////////////////////////////
+
+[id="plugins-{type}s-{plugin}"]
+
+=== Http input plugin
+
+include::{include_path}/plugin_header.asciidoc[]
+
+==== Description
+
+Using this input you can receive single or multiline events over http(s).
+Applications can send an HTTP request to the endpoint started by this input and
+Logstash will convert it into an event for subsequent processing. Users 
+can pass plain text, JSON, or any formatted data and use a corresponding codec with this
+input. For Content-Type `application/json` the `json` codec is used, but for all other
+data formats, `plain` codec is used.
+
+This input can also be used to receive webhook requests to integrate with other services
+and applications. By taking advantage of the vast plugin ecosystem available in Logstash
+you can trigger actionable events right from your application.
+
+==== Blocking Behavior
+
+The HTTP protocol doesn't deal well with long running requests. This plugin will either return 
+a 429 (busy) error when Logstash is backlogged, or it will time out the request. 
+
+If a 429 error is encountered clients should sleep, backing off exponentially with some random 
+jitter, then retry their request.
+
+This plugin will block if the Logstash queue is blocked and there are available HTTP input threads.
+This will cause most HTTP clients to time out. Sent events will still be processed in this case. This
+behavior is not optimal and will be changed in a future release. In the future, this plugin will always 
+return a 429 if the queue is busy, and will not time out in the event of a busy queue. 
+
+==== Security
+This plugin supports standard HTTP basic authentication headers to identify the requester.
+You can pass in a username, password combination while sending data to this input
+
+You can also setup SSL and send data securely over https, with multiple options such as
+validating the client's certificate.
+
+[id="plugins-{type}s-{plugin}-codec-settings"]
+==== Codec settings
+This plugin has two configuration options for codecs: `codec` and `additional_codecs`. 
+
+Values in `additional_codecs` are prioritized over those specified in the
+`codec` option. That is, the default `codec` is applied only if no codec
+for the request's content-type is found in the `additional_codecs` setting.
+
+[id="plugins-{type}s-{plugin}-options"]
+==== Http Input Configuration Options
+
+This plugin supports the following configuration options plus the <<plugins-{type}s-{plugin}-common-options>> described later.
+
+[cols="<,<,<",options="header",]
+|=======================================================================
+|Setting |Input type|Required
+| <<plugins-{type}s-{plugin}-additional_codecs>> |<<hash,hash>>|No
+| <<plugins-{type}s-{plugin}-cipher_suites>> |<<array,array>>|No
+| <<plugins-{type}s-{plugin}-host>> |<<string,string>>|No
+| <<plugins-{type}s-{plugin}-keystore>> |<<path,path>>|No
+| <<plugins-{type}s-{plugin}-keystore_password>> |<<password,password>>|No
+| <<plugins-{type}s-{plugin}-password>> |<<password,password>>|No
+| <<plugins-{type}s-{plugin}-port>> |<<number,number>>|No
+| <<plugins-{type}s-{plugin}-max_pending_requests>> |<<number,number>>|No
+| <<plugins-{type}s-{plugin}-response_headers>> |<<hash,hash>>|No
+| <<plugins-{type}s-{plugin}-response_code>> |<<number,number>>, one of `[200, 201, 202, 204]`|No
+| <<plugins-{type}s-{plugin}-ssl>> |<<boolean,boolean>>|No
+| <<plugins-{type}s-{plugin}-ssl_certificate>> |a valid filesystem path|No
+| <<plugins-{type}s-{plugin}-ssl_certificate_authorities>> |<<array,array>>|No
+| <<plugins-{type}s-{plugin}-ssl_handshake_timeout>> |<<number,number>>|No
+| <<plugins-{type}s-{plugin}-ssl_key>> |a valid filesystem path|No
+| <<plugins-{type}s-{plugin}-ssl_key_passphrase>> |<<password,password>>|No
+| <<plugins-{type}s-{plugin}-ssl_verify_mode>> |<<string,string>>, one of `["none", "peer", "force_peer"]`|No
+| <<plugins-{type}s-{plugin}-threads>> |<<number,number>>|No
+| <<plugins-{type}s-{plugin}-tls_max_version>> |<<number,number>>|No
+| <<plugins-{type}s-{plugin}-tls_min_version>> |<<number,number>>|No
+| <<plugins-{type}s-{plugin}-user>> |<<string,string>>|No
+| <<plugins-{type}s-{plugin}-verify_mode>> |<<string,string>>, one of `["none", "peer", "force_peer"]`|No
+|=======================================================================
+
+Also see <<plugins-{type}s-{plugin}-common-options>> for a list of options supported by all
+input plugins.
+
+&nbsp;
+
+[id="plugins-{type}s-{plugin}-additional_codecs"]
+===== `additional_codecs` 
+
+  * Value type is <<hash,hash>>
+  * Default value is `{"application/json"=>"json"}`
+
+Apply specific codecs for specific content types.
+The default codec will be applied only after this list is checked
+and no codec for the request's content-type is found
+
+[id="plugins-{type}s-{plugin}-cipher_suites"]
+===== `cipher_suites` 
+
+  * Value type is <<array,array>>
+  * Default value is `java.lang.String[TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256]@459cfcca`
+
+The list of ciphers suite to use, listed by priorities.
+
+[id="plugins-{type}s-{plugin}-host"]
+===== `host` 
+
+  * Value type is <<string,string>>
+  * Default value is `"0.0.0.0"`
+
+The host or ip to bind
+
+[id="plugins-{type}s-{plugin}-keystore"]
+===== `keystore`
+
+  * Value type is <<path,path>>
+  * There is no default value for this setting.
+  * This option is deprecated
+
+The JKS keystore to validate the client's certificates
+
+Note: This option is deprecated and it will be removed in the next major version of Logstash.
+Use `ssl_certificate` and `ssl_key` instead.
+
+[id="plugins-{type}s-{plugin}-keystore_password"]
+===== `keystore_password`
+
+  * Value type is <<password,password>>
+  * There is no default value for this setting.
+  * This option is deprecated
+
+Set the truststore password
+
+Note: This option is deprecated and it will be removed in the next major version of Logstash.
+Use `ssl_certificate` and `ssl_key` instead.
+
+[id="plugins-{type}s-{plugin}-password"]
+===== `password` 
+
+  * Value type is <<password,password>>
+  * There is no default value for this setting.
+
+Password for basic authorization
+
+[id="plugins-{type}s-{plugin}-port"]
+===== `port` 
+
+  * Value type is <<number,number>>
+  * Default value is `8080`
+
+The TCP port to bind to
+
+[id="plugins-{type}s-{plugin}-max_content_length"]
+===== `max_content_length`
+
+  * Value type is <<number,number>>
+  * Default value is 104857600
+
+The max content of an HTTP request in bytes. It defaults to 100mb.
+
+[id="plugins-{type}s-{plugin}-max_pending_requests"]
+===== `max_pending_requests`
+
+  * Value type is <<number,number>>
+  * Default value is 200
+
+Maximum number of incoming requests to store in a temporary queue before being processed by worker threads.
+If a request arrives and the queue is full a 429 response will be returned immediately.
+This queue exists to deal with micro bursts of events and to improve overall throughput,
+so it should be changed very carefully as it can lead to memory pressure and impact performance.
+If you need to deal both periodic or unforeseen spikes in incoming requests consider enabling the
+Persistent Queue for the logstash pipeline.
+
+[id="plugins-{type}s-{plugin}-response_code"]
+===== `response_code`
+
+  * Value can be any of: 200, 201, 202, 204
+  * Default value is `200`
+
+The HTTP return code if the request is processed successfully.
+
+Other return codes may happen in the case of an error condition, such as
+invalid credentials (401), internal errors (503) or backpressure (429).
+
+If 204 (No Content) is set, the response body will not be sent in the response.
+
+[id="plugins-{type}s-{plugin}-response_headers"]
+===== `response_headers` 
+
+  * Value type is <<hash,hash>>
+  * Default value is `{"Content-Type"=>"text/plain"}`
+
+specify a custom set of response headers
+
+[id="plugins-{type}s-{plugin}-remote_host_target_field"]
+===== `remote_host_target_field` 
+
+  * Value type is <<string,string>>
+  * Default value is `"host"`
+
+specify a target field for the client host of the http request
+
+[id="plugins-{type}s-{plugin}-request_headers_target_field"]
+===== `request_headers_target_field` 
+
+  * Value type is <<string,string>>
+  * Default value is `"headers"`
+
+specify target field for the client host of the http request
+
+[id="plugins-{type}s-{plugin}-ssl"]
+===== `ssl` 
+
+  * Value type is <<boolean,boolean>>
+  * Default value is `false`
+
+Events are by default sent in plain text. You can
+enable encryption by setting `ssl` to true and configuring
+the `ssl_certificate` and `ssl_key` options.
+
+[id="plugins-{type}s-{plugin}-ssl_certificate"]
+===== `ssl_certificate` 
+
+  * Value type is <<path,path>>
+  * There is no default value for this setting.
+
+SSL certificate to use.
+
+[id="plugins-{type}s-{plugin}-ssl_certificate_authorities"]
+===== `ssl_certificate_authorities` 
+
+  * Value type is <<array,array>>
+  * Default value is `[]`
+
+Validate client certificates against these authorities. 
+You can define multiple files or paths. All the certificates will
+be read and added to the trust store. You need to configure the `ssl_verify_mode`
+to `peer` or `force_peer` to enable the verification.
+
+
+[id="plugins-{type}s-{plugin}-ssl_handshake_timeout"]
+===== `ssl_handshake_timeout` 
+
+  * Value type is <<number,number>>
+  * Default value is `10000`
+
+Time in milliseconds for an incomplete ssl handshake to timeout
+
+[id="plugins-{type}s-{plugin}-ssl_key"]
+===== `ssl_key` 
+
+  * Value type is <<path,path>>
+  * There is no default value for this setting.
+
+SSL key to use.
+NOTE: This key need to be in the PKCS8 format, you can convert it with https://www.openssl.org/docs/man1.1.0/apps/pkcs8.html[OpenSSL]
+for more information.
+
+[id="plugins-{type}s-{plugin}-ssl_key_passphrase"]
+===== `ssl_key_passphrase` 
+
+  * Value type is <<password,password>>
+  * There is no default value for this setting.
+
+SSL key passphrase to use.
+
+[id="plugins-{type}s-{plugin}-ssl_verify_mode"]
+===== `ssl_verify_mode` 
+
+  * Value can be any of: `none`, `peer`, `force_peer`
+  * Default value is `"none"`
+
+By default the server doesn't do any client verification.
+
+`peer` will make the server ask the client to provide a certificate. 
+If the client provides a certificate, it will be validated.
+
+`force_peer` will make the server ask the client to provide a certificate.
+If the client doesn't provide a certificate, the connection will be closed.
+
+This option needs to be used with `ssl_certificate_authorities` and a defined list of CAs.
+
+[id="plugins-{type}s-{plugin}-threads"]
+===== `threads` 
+
+  * Value type is <<number,number>>
+  * Default value is number of processors
+
+Number of threads to use for both accepting connections and handling requests
+
+[id="plugins-{type}s-{plugin}-tls_max_version"]
+===== `tls_max_version` 
+
+  * Value type is <<number,number>>
+  * Default value is `1.2`
+
+The maximum TLS version allowed for the encrypted connections. The value must be the one of the following:
+1.0 for TLS 1.0, 1.1 for TLS 1.1, 1.2 for TLS 1.2
+
+[id="plugins-{type}s-{plugin}-tls_min_version"]
+===== `tls_min_version` 
+
+  * Value type is <<number,number>>
+  * Default value is `1`
+
+The minimum TLS version allowed for the encrypted connections. The value must be one of the following:
+1.0 for TLS 1.0, 1.1 for TLS 1.1, 1.2 for TLS 1.2
+
+[id="plugins-{type}s-{plugin}-user"]
+===== `user` 
+
+  * Value type is <<string,string>>
+  * There is no default value for this setting.
+
+Username for basic authorization
+
+[id="plugins-{type}s-{plugin}-verify_mode"]
+===== `verify_mode`
+
+  * Value can be any of: `none`, `peer`, `force_peer`
+  * Default value is `"none"`
+  * This option is deprecated
+
+Set the client certificate verification method. Valid methods: none, peer, force_peer
+
+Note: This option is deprecated and it will be removed in the next major version of Logstash.
+Use `ssl_verify_mode` instead.
+
+
+[id="plugins-{type}s-{plugin}-common-options"]
+include::{include_path}/{type}.asciidoc[]
+
+:default_codec!:

data/lib/logstash/inputs/http/message_handler.rb

@@ -0,0 +1,49 @@
+# encoding: utf-8
+require "logstash-input-http_jars"
+
+module LogStash module Inputs class Http
+  class MessageHandler
+    include org.logstash.plugins.inputs.http.IMessageHandler
+
+    attr_reader :input
+
+    def initialize(input, default_codec, additional_codecs, auth_token)
+      @input = input
+      @default_codec = default_codec
+      @additional_codecs = additional_codecs
+      @auth_token = auth_token
+    end
+
+    def validates_token(token)
+      if @auth_token
+        @auth_token == token
+      else
+        true
+      end
+    end
+
+    def requires_token
+      !!@auth_token
+    end
+
+    def onNewMessage(remote_address, headers, body)
+      @input.decode_body(headers, remote_address, body, @default_codec, @additional_codecs)
+    end
+
+    def copy
+      MessageHandler.new(@input, @default_codec.clone, clone_additional_codecs(), @auth_token)
+    end
+
+    def clone_additional_codecs
+      clone_additional_codecs = {}
+      @additional_codecs.each do |content_type, codec|
+        clone_additional_codecs[content_type] = codec.clone
+      end
+      clone_additional_codecs
+    end
+
+    def response_headers
+      @input.response_headers
+    end
+  end
+end; end; end

data/lib/logstash/inputs/http/tls.rb

@@ -0,0 +1,40 @@
+# encoding: utf-8
+module LogStash module Inputs class Http
+  class TLS
+    class TLSOption
+      include Comparable
+
+      attr_reader :name, :version
+      def initialize(name, version)
+        @name = name
+        @version = version
+      end
+
+      def <=>(other)
+        version <=> other.version
+      end
+    end
+
+    TLS_PROTOCOL_OPTIONS = [
+      TLSOption.new("TLSv1", 1),
+      TLSOption.new("TLSv1.1", 1.1),
+      TLSOption.new("TLSv1.2", 1.2)
+    ]
+
+    def self.min
+      TLS_PROTOCOL_OPTIONS.min
+    end
+
+    def self.max
+      TLS_PROTOCOL_OPTIONS.max
+    end
+
+    def self.get_supported(versions)
+      if versions.is_a?(Range)
+        TLS_PROTOCOL_OPTIONS.select { |tls| versions.cover?(tls.version) }
+      else 
+        TLS_PROTOCOL_OPTIONS.select { |tls| versions == tls.version }
+      end
+    end
+  end
+end; end; end