Skip to content

Mark previously deprecated SSL settings as obsolete#183

Merged
robbavey merged 3 commits intologstash-plugins:mainfrom
robbavey:obsolete_ssl
Jan 10, 2025
Merged

Mark previously deprecated SSL settings as obsolete#183
robbavey merged 3 commits intologstash-plugins:mainfrom
robbavey:obsolete_ssl

Conversation

@robbavey
Copy link
Member

@robbavey robbavey commented Dec 2, 2024

  • SSL settings that were marked deprecated in version 3.15.0 are now marked obsolete, and will prevent the plugin from starting.
  • These settings are:
    • ca_file, which should be replaced by ssl_certificate_authorities
    • keystore, which should be replaced by ssl_keystore_path
    • keystore_password, which should be replaced by ssl_keystore_password
    • keystore_type, which should be replaced by ssl_keystore_password
    • ssl, which should be replaced by ssl_enabled

Relates: #179

- SSL settings that were marked deprecated in version `3.15.0` are now marked obsolete, and will prevent the plugin from starting.
- These settings are:
  - `ca_file`, which should be replaced by `ssl_certificate_authorities`
  - `keystore`, which should be replaced by `ssl_keystore_path`
  - `keystore_password`, which should be replaced by `ssl_keystore_password`
  - `keystore_type`, which should be replaced by `ssl_keystore_password`
  - `ssl`, which should be replaced by `ssl_enabled`
Copy link
Contributor

@donoghuc donoghuc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The setup of ssl parameters seems a bit complex now:

  def setup_ssl_params!
    # Infer the value if neither the deprecate `ssl` and `ssl_enabled` were set
    infer_ssl_enabled_from_hosts
  end

  def infer_ssl_enabled_from_hosts
    return if original_params.include?('ssl_enabled')

    @ssl_enabled = params['ssl_enabled'] = effectively_ssl?
  end

  def effectively_ssl?
    return true if @ssl_enabled

    hosts = Array(@hosts)
    return false if hosts.nil? || hosts.empty?

    hosts.all? { |host| host && host.to_s.start_with?("https") }
  end

I think that boils down to just:

def setup_ssl!
  return if original_params.include?('ssl_enabled')
  
  @ssl_enabled = if @ssl_enabled
    true
  else
    Array(@hosts).all? { |host| host && host.to_s.start_with?("https") }
  end
  
  params['ssl_enabled'] = @ssl_enabled
end

Though i'm not entirely sure what mutating params does in this. In general the params scope is kind of a mystery to me 😅

@robbavey
Copy link
Member Author

This was about as simple as I could get to:

  def setup_ssl_params!
    # Infer the value if neither `ssl_enabled` was not set
    return if original_params.include?('ssl_enabled')
    params['ssl_enabled'] = @ssl_enabled ||= Array(@hosts).all? { |host| host && host.to_s.start_with?("https") }
  end
Copy link
Contributor

@donoghuc donoghuc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great!

@robbavey
Copy link
Member Author

Over to @karenzone for doc review

Copy link
Contributor

@karenzone karenzone left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Line 113: Update links:

  • <<plugins-{type}s-{plugin}-ssl_keystore_path>> and/or <<plugins-{type}s-{plugin}-ssl_keystore_password>>
@robbavey
Copy link
Member Author

robbavey commented Jan 3, 2025

Ready for another round @karenzone

Copy link
Contributor

@karenzone karenzone left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@robbavey robbavey merged commit ad77062 into logstash-plugins:main Jan 10, 2025
1 check passed
flexitrev pushed a commit that referenced this pull request Jan 16, 2025
* Mark previously deprecated SSL settings as obsolete

- SSL settings that were marked deprecated in version `3.15.0` are now marked obsolete, and will prevent the plugin from starting.
- These settings are:
  - `ca_file`, which should be replaced by `ssl_certificate_authorities`
  - `keystore`, which should be replaced by `ssl_keystore_path`
  - `keystore_password`, which should be replaced by `ssl_keystore_password`
  - `keystore_type`, which should be replaced by `ssl_keystore_password`
  - `ssl`, which should be replaced by `ssl_enabled`
alexcams pushed a commit to alexcams/logstash-filter-elasticsearch that referenced this pull request Jan 22, 2026
* test setup: ensure presence of /etc/protocols

* test setup: actually run secure_integration tests

When SECURE_INTEGRATION is speicified, the (non-secure) `:integration` specs
are excluded, so we cannot have the `:secure_integration` specs wrapped in a
context flagged as `:integration`.

* test setup: regnerate test certs (and add regen script)

* test setup: give ES the full cert chain

In order for the `ca_trusted_fingerprint` specs to work with the CA's
fingerprint, ES needs to be configured to present a cert chain that
includes the CA.

* resilience: prevent failures from crashing plugin

When an Event cannot be created directly from the hit, or when the
docinfo cannot be merged into a non-hash field in the hit, emit an
Event tagged with `_elasticsearch_input_failure` that contains the
JSON-encoded hit in `[event][original]` instead of crashing.

* add link to changelog

* remove orphan method from refactor
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

3 participants