Skip to content

Allow cert chains#2700

Closed
mmussomele wants to merge 2 commits into
fluent:masterfrom
mmussomele:allow-cert-chains
Closed

Allow cert chains#2700
mmussomele wants to merge 2 commits into
fluent:masterfrom
mmussomele:allow-cert-chains

Conversation

@mmussomele

@mmussomele mmussomele commented Nov 14, 2019

Copy link
Copy Markdown
Contributor

Which issue(s) this PR fixes:
Fixes #2699

What this PR does / why we need it:

Adds support for certificate chains to Fluentd sockets. Needed for good practice around issuing certificates.

The added test fails if the new line:

context.extra_chain_cert = client_certs[1..-1]

is remove (effectively reverting to the old behavior of only loading the leaf certificate).

Docs Changes:

Unsure if needed.

Release Note:

Otherwise it seems to default to true, which results in logging of

    warning: verify_hostname requires hostname to be set

When running tests that use TLS without verifying the hostname.

Signed-off-by: Matthew Mussomele <matt@nefeli.io>
@mmussomele mmussomele force-pushed the allow-cert-chains branch 2 times, most recently from 84f605a to 4cd9d6b Compare November 14, 2019 21:57
@mmussomele

Copy link
Copy Markdown
Contributor Author

seems AppVeyor doesn't like ensure, will have to just let the temporary files be deleted by the GC or on exit

@mmussomele

Copy link
Copy Markdown
Contributor Author

unsure why the builds failed - the tests passed for me locally

@mtovino-nefeli

Copy link
Copy Markdown

👍 this would help me too

@repeatedly repeatedly self-assigned this Nov 18, 2019
@repeatedly repeatedly added the enhancement Feature request or improve operations label Nov 18, 2019
@repeatedly

Copy link
Copy Markdown
Member

I will check this patch in this week.

unsure why the builds failed - the tests passed for me locally

This is travis-ci environment issue. It sometimes slow down and it causes unexpected test failure.

if verify_fqdn && fqdn && context.respond_to?(:verify_hostname=)
context.verify_hostname = true
else
context.verify_hostname = false

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why change this line to set false explicitly?

@mmussomele mmussomele Nov 26, 2019

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

see commit body of the first commit:

Otherwise it seems to default to true, which results in logging of

warning: verify_hostname requires hostname to be set

When running tests that use TLS without verifying the hostname.

If you leave it unset like the code did prior, then warning logs are printed. Perhaps the right thing to do is something along the lines of

if hostname verification set to true:
    context.verify_hostname = true
else if hostname verification explicitly set to false:
    context.verify_hostname = false
else
    leave context.verify_hostname nil

?

Comment thread test/plugin/test_out_forward.rb Outdated
Comment thread test/plugin/test_out_forward.rb Outdated
@repeatedly repeatedly requested a review from ganmacs November 25, 2019 05:47
Comment thread lib/fluent/plugin_helper/socket.rb Outdated
Comment thread test/plugin/test_out_forward.rb Outdated
data('ack true' => true,
'ack false' => false)
test 'TLS transport client cert chain' do |ack|
omit "TLS and 'ack false' always fails. Need to debug" if !ack

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could you debug before merging this PR?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is an existing bug prior to my changes - see the test above.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

omit "TLS and 'ack false' always fails on AppVeyor. Need to debug" if Fluent.windows? && !ack
is for AppVeyor environment which the test run Windows. It runs on Linux environment. below is right.

Suggested change
omit "TLS and 'ack false' always fails. Need to debug" if !ack
omit "TLS and 'ack false' always fails. Need to debug" if Fluent.windows? && !ack

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

corrected omit check

Comment thread test/plugin/test_out_forward.rb Outdated
Comment thread test/plugin/test_out_forward.rb Outdated
Comment thread test/plugin/test_out_forward.rb Outdated
Comment thread test/plugin/test_out_forward.rb Outdated
Comment thread lib/fluent/plugin_helper/socket.rb Outdated
@mmussomele

Copy link
Copy Markdown
Contributor Author

@repeatedly @ganmacs changes made, except for the verify_hostname one - just want to verify with discussion first. Thanks for the comments!

@repeatedly

Copy link
Copy Markdown
Member

Re-run test to check random test failures.

Signed-off-by: Matthew Mussomele <matt@nefeli.io>
@mmussomele

Copy link
Copy Markdown
Contributor Author

sorry for the delay, have been very busy. Just updated the omit check to specify windows

@ganmacs

ganmacs commented Apr 6, 2020

Copy link
Copy Markdown
Member

This was done by #2930 .

@ganmacs ganmacs closed this Apr 6, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement Feature request or improve operations

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Fluentd does not support certificate chains

4 participants