Skip to content

Commit 587efec

Browse files
robbaveyrobbavey
authored
Remove deprecated SSL settings (#182)
* Remove deprecated SSL settings This commit marks SSL settings `obsolete` that were previously marked as `deprecated` as part of the SSL Settings Standardization process implemented in `3.7.0` of this plugin. Marking these settings as `obsolete` is a *breaking change* that will stop the plugin from starting, and forces users to move to the new standard settings. SSL settings that were marked deprecated in version `3.7.0` are now marked obsolete, and will prevent the plugin from starting. - These settings are: - `tls_min_version`, which should be replaced by `ssl_supported_protocols` - `tls_max_version`, which should be replaced by `ssl_supported_protocols` - `cipher_suites`, which should bre replaced by `ssl_cipher_suites` - `ssl`, which should bre replaced by `ssl_enabled` - `keystore`, which should bre replaced by `ssl_keystore_path` - `keystore_password`, which should bre replaced by `ssl_keystore_password` - `ssl_verify_mode`, which should bre replaced by `ssl_client_authentication` - `verify_mode`, which should bre replaced by `ssl_client_authentication` - [#182](#182) This commit cleans up some code to handle duplicate settings, and removes tests that were put in place to support the co-existence of deprecated and non-deprecated settings, replacing them with tests that verify that obsolete settings are identified early, and information about the deprecation is related to the user.
1 parent 4d2aeeb commit 587efec

File tree

5 files changed

+62
-319
lines changed

5 files changed

+62
-319
lines changed

‎CHANGELOG.md

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,16 @@
1+
## 4.0.0
2+
- SSL settings that were marked deprecated in version `3.7.0` are now marked obsolete, and will prevent the plugin from starting.
3+
- These settings are:
4+
- `tls_min_version`, which should be replaced by `ssl_supported_protocols`
5+
- `tls_max_version`, which should be replaced by `ssl_supported_protocols`
6+
- `cipher_suites`, which should bre replaced by `ssl_cipher_suites`
7+
- `ssl`, which should bre replaced by `ssl_enabled`
8+
- `keystore`, which should bre replaced by `ssl_keystore_path`
9+
- `keystore_password`, which should bre replaced by `ssl_keystore_password`
10+
- `ssl_verify_mode`, which should bre replaced by `ssl_client_authentication`
11+
- `verify_mode`, which should bre replaced by `ssl_client_authentication`
12+
- [#182](https://github.com/logstash-plugins/logstash-input-http/pull/182)
13+
114
## 3.9.2
215
- Upgrade netty to 4.1.115 [#183](https://github.com/logstash-plugins/logstash-input-http/pull/183)
316

‎VERSION

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
3.9.2
1+
4.0.0

‎docs/index.asciidoc

Lines changed: 20 additions & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -87,21 +87,21 @@ for the request's content-type is found in the `additional_codecs` setting.
8787

8888
This plugin supports the following configuration options plus the <<plugins-{type}s-{plugin}-common-options>> described later.
8989

90+
NOTE: As of version `4.0.0` of this plugin, a number of previously deprecated settings related to SSL have been removed.
91+
Please check out <<plugins-{type}s-{plugin}-obsolete-options>> for details.
92+
93+
9094
[cols="<,<,<",options="header",]
9195
|=======================================================================
9296
|Setting |Input type|Required
9397
| <<plugins-{type}s-{plugin}-additional_codecs>> |<<hash,hash>>|No
94-
| <<plugins-{type}s-{plugin}-cipher_suites>> |<<array,array>>|__Deprecated__
9598
| <<plugins-{type}s-{plugin}-ecs_compatibility>> | <<string,string>>|No
9699
| <<plugins-{type}s-{plugin}-host>> |<<string,string>>|No
97-
| <<plugins-{type}s-{plugin}-keystore>> |<<path,path>>|__Deprecated__
98-
| <<plugins-{type}s-{plugin}-keystore_password>> |<<password,password>>|__Deprecated__
99100
| <<plugins-{type}s-{plugin}-password>> |<<password,password>>|No
100101
| <<plugins-{type}s-{plugin}-port>> |<<number,number>>|No
101102
| <<plugins-{type}s-{plugin}-max_pending_requests>> |<<number,number>>|No
102103
| <<plugins-{type}s-{plugin}-response_headers>> |<<hash,hash>>|No
103104
| <<plugins-{type}s-{plugin}-response_code>> |<<number,number>>, one of `[200, 201, 202, 204]`|No
104-
| <<plugins-{type}s-{plugin}-ssl>> |<<boolean,boolean>>|__Deprecated__
105105
| <<plugins-{type}s-{plugin}-ssl_certificate>> |a valid filesystem path|No
106106
| <<plugins-{type}s-{plugin}-ssl_certificate_authorities>> |<<array,array>>|No
107107
| <<plugins-{type}s-{plugin}-ssl_cipher_suites>> |<<array,array>>|No
@@ -117,12 +117,8 @@ This plugin supports the following configuration options plus the <<plugins-{typ
117117
| <<plugins-{type}s-{plugin}-ssl_truststore_password>> |<<password,password>>|No
118118
| <<plugins-{type}s-{plugin}-ssl_truststore_path>> |<<path,path>>|No
119119
| <<plugins-{type}s-{plugin}-ssl_truststore_type>> |<<string,string>>|No
120-
| <<plugins-{type}s-{plugin}-ssl_verify_mode>> |<<string,string>>, one of `["none", "peer", "force_peer"]`|__Deprecated__
121120
| <<plugins-{type}s-{plugin}-threads>> |<<number,number>>|No
122-
| <<plugins-{type}s-{plugin}-tls_max_version>> |<<number,number>>|__Deprecated__
123-
| <<plugins-{type}s-{plugin}-tls_min_version>> |<<number,number>>|__Deprecated__
124121
| <<plugins-{type}s-{plugin}-user>> |<<string,string>>|No
125-
| <<plugins-{type}s-{plugin}-verify_mode>> |<<string,string>>, one of `["none", "peer", "force_peer"]`|__Deprecated__
126122
|=======================================================================
127123

128124
Also see <<plugins-{type}s-{plugin}-common-options>> for a list of options supported by all
@@ -140,13 +136,6 @@ Apply specific codecs for specific content types.
140136
The default codec will be applied only after this list is checked
141137
and no codec for the request's content-type is found
142138

143-
[id="plugins-{type}s-{plugin}-cipher_suites"]
144-
===== `cipher_suites`
145-
deprecated[3.6.0, Replaced by <<plugins-{type}s-{plugin}-ssl_cipher_suites>>]
146-
147-
* Value type is <<array,array>>
148-
149-
The list of cipher suites to use, listed by priorities.
150139

151140
[id="plugins-{type}s-{plugin}-ecs_compatibility"]
152141
===== `ecs_compatibility`
@@ -220,23 +209,6 @@ See <<plugins-{type}s-{plugin}-ecs_metadata>> for detailed information.
220209

221210
The host or ip to bind
222211

223-
[id="plugins-{type}s-{plugin}-keystore"]
224-
===== `keystore`
225-
deprecated[3.7.0, Use <<plugins-{type}s-{plugin}-ssl_keystore_path>> instead]
226-
227-
* Value type is <<path,path>>
228-
* There is no default value for this setting.
229-
230-
The JKS keystore to validate the client's certificates
231-
232-
[id="plugins-{type}s-{plugin}-keystore_password"]
233-
===== `keystore_password`
234-
deprecated[3.7.0, Use <<plugins-{type}s-{plugin}-ssl_keystore_password>> instead]
235-
236-
* Value type is <<password,password>>
237-
* There is no default value for this setting.
238-
239-
Set the keystore password
240212

241213
[id="plugins-{type}s-{plugin}-password"]
242214
===== `password`
@@ -314,16 +286,6 @@ specify a target field for the client host of the http request
314286

315287
specify target field for the client host of the http request
316288

317-
[id="plugins-{type}s-{plugin}-ssl"]
318-
===== `ssl`
319-
deprecated[3.7.0, Replaced by <<plugins-{type}s-{plugin}-ssl_enabled>>]
320-
321-
* Value type is <<boolean,boolean>>
322-
* Default value is `false`
323-
324-
Events are, by default, sent in plain text. You can
325-
enable encryption by setting `ssl` to true and configuring
326-
the `ssl_certificate` and `ssl_key` options.
327289

328290
[id="plugins-{type}s-{plugin}-ssl_certificate"]
329291
===== `ssl_certificate`
@@ -473,22 +435,6 @@ NOTE: You cannot use this setting and <<plugins-{type}s-{plugin}-ssl_certificate
473435

474436
The format of the truststore file. It must be either `jks` or `pkcs12`.
475437

476-
[id="plugins-{type}s-{plugin}-ssl_verify_mode"]
477-
===== `ssl_verify_mode`
478-
deprecated[3.7.0, Replaced by <<plugins-{type}s-{plugin}-ssl_client_authentication>>]
479-
480-
* Value can be any of: `none`, `peer`, `force_peer`
481-
* Default value is `"none"`
482-
483-
By default the server doesn't do any client verification.
484-
485-
`peer` will make the server ask the client to provide a certificate.
486-
If the client provides a certificate, it will be validated.
487-
488-
`force_peer` will make the server ask the client to provide a certificate.
489-
If the client doesn't provide a certificate, the connection will be closed.
490-
491-
This option needs to be used with <<plugins-{type}s-{plugin}-ssl_certificate_authorities>> and a defined list of CAs.
492438

493439
[id="plugins-{type}s-{plugin}-threads"]
494440
===== `threads`
@@ -498,23 +444,6 @@ This option needs to be used with <<plugins-{type}s-{plugin}-ssl_certificate_aut
498444

499445
Number of threads to use for both accepting connections and handling requests
500446

501-
[id="plugins-{type}s-{plugin}-tls_max_version"]
502-
===== `tls_max_version`
503-
deprecated[3.6.0]
504-
505-
* Value type is <<number,number>>
506-
507-
The maximum TLS version allowed for the encrypted connections.
508-
The value must be the one of the following: 1.1 for TLS 1.1, 1.2 for TLS 1.2, 1.3 for TLSv1.3
509-
510-
[id="plugins-{type}s-{plugin}-tls_min_version"]
511-
===== `tls_min_version`
512-
deprecated[3.6.0]
513-
514-
* Value type is <<number,number>>
515-
516-
The minimum TLS version allowed for the encrypted connections.
517-
The value must be one of the following: 1.1 for TLS 1.1, 1.2 for TLS 1.2, 1.3 for TLSv1.3
518447

519448
[id="plugins-{type}s-{plugin}-user"]
520449
===== `user`
@@ -524,15 +453,24 @@ The value must be one of the following: 1.1 for TLS 1.1, 1.2 for TLS 1.2, 1.3 fo
524453

525454
Username for basic authorization
526455

527-
[id="plugins-{type}s-{plugin}-verify_mode"]
528-
===== `verify_mode`
529-
deprecated[3.6.0, Replaced by <<plugins-{type}s-{plugin}-ssl_verify_mode>>]
530-
531-
* Value can be any of: `none`, `peer`, `force_peer`
532-
* Default value is `"none"`
456+
[id="plugins-{type}s-{plugin}-obsolete-options"]
457+
==== HTTP Input Obsolete Configuration Options
533458

534-
Set the client certificate verification method. Valid methods: none, peer, force_peer
459+
WARNING: As of version `4.0.0` of this plugin, some configuration options have been replaced.
460+
The plugin will fail to start if it contains any of these obsolete options.
535461

462+
[cols="<,<",options="header",]
463+
|=======================================================================
464+
|Setting|Replaced by
465+
| cipher_suites |<<plugins-{type}s-{plugin}-ssl_cipher_suites>>
466+
| keystore |<<plugins-{type}s-{plugin}-ssl_keystore_path>>
467+
| keystore_password |<<plugins-{type}s-{plugin}-ssl_keystore_password>>
468+
| ssl |<<plugins-{type}s-{plugin}-ssl_enabled>>
469+
| ssl_verify_mode |<<plugins-{type}s-{plugin}-ssl_client_authentication>>
470+
| tls_max_version |<<plugins-{type}s-{plugin}-ssl_supported_protocols>>
471+
| tls_min_version |<<plugins-{type}s-{plugin}-ssl_supported_protocols>>
472+
| verify_mode |<<plugins-{type}s-{plugin}-ssl_client_authentication>>
473+
|=======================================================================
536474

537475
[id="plugins-{type}s-{plugin}-common-options"]
538476
include::{include_path}/{type}.asciidoc[]

‎lib/logstash/inputs/http.rb

Lines changed: 9 additions & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -55,11 +55,6 @@ class LogStash::Inputs::Http < LogStash::Inputs::Base
5555
# Password for basic authorization
5656
config :password, :validate => :password, :required => false
5757

58-
# Events are by default sent in plain text. You can
59-
# enable encryption by setting `ssl` to true and configuring
60-
# the `ssl_certificate` and `ssl_key` options.
61-
config :ssl, :validate => :boolean, :default => false, :deprecated => "Set 'ssl_enabled' instead."
62-
6358
# Events are by default sent in plain text. You can
6459
# enable encryption by setting `ssl` to true and configuring
6560
# the `ssl_certificate` and `ssl_key` options.
@@ -108,17 +103,6 @@ class LogStash::Inputs::Http < LogStash::Inputs::Base
108103
# This option needs to be used with `ssl_certificate_authorities` and a defined list of CAs.
109104
config :ssl_client_authentication, :validate => %w[none optional required], :default => 'none'
110105

111-
# By default the server doesn't do any client verification.
112-
#
113-
# `peer` will make the server ask the client to provide a certificate.
114-
# If the client provides a certificate, it will be validated.
115-
#
116-
# `force_peer` will make the server ask the client to provide a certificate.
117-
# If the client doesn't provide a certificate, the connection will be closed.
118-
#
119-
# This option needs to be used with `ssl_certificate_authorities` and a defined list of CAs.
120-
config :ssl_verify_mode, :validate => ["none", "peer", "force_peer"], :default => "none", :deprecated => "Set 'ssl_client_authentication' instead."
121-
122106
# Time in milliseconds for an incomplete ssl handshake to timeout
123107
config :ssl_handshake_timeout, :validate => :number, :default => 10000
124108

@@ -150,25 +134,15 @@ class LogStash::Inputs::Http < LogStash::Inputs::Base
150134

151135
config :response_code, :validate => [200, 201, 202, 204], :default => 200
152136

153-
# Deprecated options
154-
155-
# The JKS keystore to validate the client's certificates
156-
config :keystore, :validate => :path, :deprecated => "Set 'ssl_keystore_path' instead."
157-
158-
# The JKS keystore password
159-
config :keystore_password, :validate => :password, :deprecated => "Set 'ssl_keystore_password' instead."
160-
161-
config :verify_mode, :validate => ['none', 'peer', 'force_peer'], :default => 'none', :deprecated => "Set 'ssl_client_authentication' instead."
162-
163-
config :cipher_suites, :validate => :array, :default => [], :deprecated => "Set 'ssl_cipher_suites' instead."
164-
165-
# The minimum TLS version allowed for the encrypted connections. The value must be one of the following:
166-
# 1.0 for TLS 1.0, 1.1 for TLS 1.1, 1.2 for TLS 1.2, 1.3 for TLS 1.3
167-
config :tls_min_version, :validate => :number, :default => TLS.min.version, :deprecated => "Set 'ssl_supported_protocols' instead."
168-
169-
# The maximum TLS version allowed for the encrypted connections. The value must be the one of the following:
170-
# 1.0 for TLS 1.0, 1.1 for TLS 1.1, 1.2 for TLS 1.2, 1.3 for TLS 1.3
171-
config :tls_max_version, :validate => :number, :default => TLS.max.version, :deprecated => "Set 'ssl_supported_protocols' instead."
137+
# Obsolete Settings
138+
config :ssl, :obsolete => "Set 'ssl_enabled' instead."
139+
config :keystore, :obsolete => "Set 'ssl_keystore_path' instead."
140+
config :keystore_password, :validate => :password, :obsolete => "Set 'ssl_keystore_password' instead."
141+
config :verify_mode, :obsolete => "Set 'ssl_client_authentication' instead."
142+
config :cipher_suites, :obsolete => "Set 'ssl_cipher_suites' instead."
143+
config :tls_min_version, :obsolete => "Set 'ssl_supported_protocols' instead."
144+
config :tls_max_version, :obsolete => "Set 'ssl_supported_protocols' instead."
145+
config :ssl_verify_mode, :obsolete => "Set 'ssl_client_authentication' instead."
172146

173147
attr_reader :codecs
174148

@@ -200,8 +174,6 @@ class LogStash::Inputs::Http < LogStash::Inputs::Base
200174
public
201175
def register
202176

203-
setup_ssl_params!
204-
205177
validate_ssl_settings!
206178

207179
if @user && @password
@@ -342,34 +314,6 @@ def validate_ssl_settings!
342314
end
343315

344316
def setup_ssl_params!
345-
@ssl_enabled = normalize_config(:ssl_enabled) do |normalizer|
346-
normalizer.with_deprecated_alias(:ssl)
347-
end
348-
349-
@ssl_cipher_suites = normalize_config(:ssl_cipher_suites) do |normalizer|
350-
normalizer.with_deprecated_alias(:cipher_suites)
351-
end
352-
353-
@ssl_supported_protocols = normalize_config(:ssl_supported_protocols) do |normalizer|
354-
normalizer.with_deprecated_mapping(:tls_min_version, :tls_max_version) do |tls_min_version, tls_max_version|
355-
TLS.get_supported(tls_min_version..tls_max_version).map(&:name)
356-
end
357-
end
358-
359-
@ssl_client_authentication = normalize_config(:ssl_client_authentication) do |normalizer|
360-
normalizer.with_deprecated_mapping(:verify_mode, :ssl_verify_mode) do |verify_mode, ssl_verify_mode|
361-
normalize_ssl_client_authentication_value!(verify_mode, ssl_verify_mode)
362-
end
363-
end
364-
365-
@ssl_keystore_path = normalize_config(:ssl_keystore_path) do |normalizer|
366-
normalizer.with_deprecated_alias(:keystore)
367-
end
368-
369-
@ssl_keystore_password = normalize_config(:ssl_keystore_password) do |normalizer|
370-
normalizer.with_deprecated_alias(:keystore_password)
371-
end
372-
373317
params['ssl_enabled'] = @ssl_enabled unless @ssl_enabled.nil?
374318
params['ssl_cipher_suites'] = @ssl_cipher_suites unless @ssl_cipher_suites.nil?
375319
params['ssl_supported_protocols'] = @ssl_supported_protocols unless @ssl_supported_protocols.nil?
@@ -378,17 +322,6 @@ def setup_ssl_params!
378322
params['ssl_keystore_password'] = @ssl_keystore_password unless @ssl_keystore_password.nil?
379323
end
380324

381-
def normalize_ssl_client_authentication_value!(verify_mode, ssl_verify_mode)
382-
verify_mode_explicitly_set = original_params.key?("verify_mode")
383-
384-
if verify_mode_explicitly_set && original_params.key?("ssl_verify_mode")
385-
raise LogStash::ConfigurationError, "Both (deprecated) `ssl_verify_mode` and `verify_mode` were set. Use only `ssl_verify_mode`"
386-
end
387-
388-
deprecated_value = (verify_mode_explicitly_set ? verify_mode : ssl_verify_mode).downcase
389-
SSL_VERIFY_MODE_TO_CLIENT_AUTHENTICATION_MAP[deprecated_value]
390-
end
391-
392325
def create_http_server(message_handler)
393326
org.logstash.plugins.inputs.http.NettyHttpServer.new(
394327
@host, @port, message_handler, build_ssl_params, @threads, @max_pending_requests, @max_content_length, @response_code)
@@ -467,13 +400,7 @@ def ssl_client_authentication_optional?
467400
end
468401

469402
def provided_ssl_client_authentication_config(values = [@ssl_client_authentication])
470-
if original_params.include?('ssl_verify_mode')
471-
['ssl_verify_mode', *values.map { |v| SSL_VERIFY_MODE_TO_CLIENT_AUTHENTICATION_MAP.key(v) }]
472-
elsif original_params.include?('verify_mode')
473-
['verify_mode', *values.map { |v| SSL_VERIFY_MODE_TO_CLIENT_AUTHENTICATION_MAP.key(v) }]
474-
else
475403
['ssl_client_authentication', *values]
476-
end
477404
end
478405

479406
private

0 commit comments

Comments
 (0)