Skip to content

Feat: added ssl_supported_protocols option #38

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kares merged 2 commits into from
Mar 28, 2022
Merged

Feat: added ssl_supported_protocols option #38

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4cc4785
Feat: added ssl_supported_protocols option
kares Mar 28, 2022
51dd1ac
changelog
kares Mar 28, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
## 1.4.0
- Feat: added ssl_supported_protocols option [#38](https://github.com/logstash-plugins/logstash-filter-http/pull/38)

## 1.3.0
- Feat: support ssl_verification_mode option [#37](https://github.com/logstash-plugins/logstash-filter-http/pull/37)

Expand Down
24 changes: 21 additions & 3 deletions docs/index.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,7 @@ There are also multiple configuration options related to the HTTP connectivity:
| <<plugins-{type}s-{plugin}-request_timeout>> |<<number,number>>|No
| <<plugins-{type}s-{plugin}-retry_non_idempotent>> |<<boolean,boolean>>|No
| <<plugins-{type}s-{plugin}-socket_timeout>> |<<number,number>>|No
| <<plugins-{type}s-{plugin}-ssl_supported_protocols>> |<<string,string>>|No
| <<plugins-{type}s-{plugin}-ssl_verification_mode>> |<<string,string>>|No
| <<plugins-{type}s-{plugin}-truststore>> |a valid filesystem path|No
| <<plugins-{type}s-{plugin}-truststore_password>> |<<password,password>>|No
Expand Down Expand Up @@ -326,12 +327,29 @@ If `automatic_retries` is enabled this will cause non-idempotent HTTP verbs (suc

Timeout (in seconds) to wait for data on the socket. Default is `10s`

[id="plugins-{type}s-{plugin}-ssl_supported_protocols"]
===== `ssl_supported_protocols`

* Value type is <<string,string>>
* Allowed values are: `'TLSv1.1'`, `'TLSv1.2'`, `'TLSv1.3'`
* Default depends on the JDK being used. With up-to-date Logstash, the default is `['TLSv1.2', 'TLSv1.3']`.
`'TLSv1.1'` is not considered secure and is only provided for legacy applications.

List of allowed SSL/TLS versions to use when establishing a connection to the HTTP endpoint.

For Java 8 `'TLSv1.3'` is supported only since **8u262** (AdoptOpenJDK), but requires that you set the
`LS_JAVA_OPTS="-Djdk.tls.client.protocols=TLSv1.3"` system property in Logstash.

NOTE: If you configure the plugin to use `'TLSv1.1'` on any recent JVM, such as the one packaged with Logstash,
the protocol is disabled by default and needs to be enabled manually by changing `jdk.tls.disabledAlgorithms` in
the *$JDK_HOME/conf/security/java.security* configuration file. That is, `TLSv1.1` needs to be removed from the list.

[id="plugins-{type}s-{plugin}-ssl_verification_mode"]
===== `ssl_verification_mode`

* Value type is <<string,string>>
* Supported values are: `full`, `none`
* Default value is `full`
* Value type is <<string,string>>
* Supported values are: `full`, `none`
* Default value is `full`

Controls the verification of server certificates.
The `full` option verifies that the provided certificate is signed by a trusted authority (CA)
Expand Down
4 changes: 2 additions & 2 deletions logstash-filter-http.gemspec
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
Gem::Specification.new do |s|
s.name = 'logstash-filter-http'
s.version = '1.3.0'
s.version = '1.4.0'
s.licenses = ['Apache License (2.0)']
s.summary = 'This filter requests data from a RESTful Web Service.'
s.description = 'This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install logstash-filter-http. This gem is not a stand-alone program'
Expand Down Expand Up @@ -28,7 +28,7 @@ Gem::Specification.new do |s|
# Gem dependencies
s.add_runtime_dependency 'logstash-core-plugin-api', '>= 1.60', '<= 2.99'
s.add_runtime_dependency 'logstash-mixin-ecs_compatibility_support', '~>1.2'
s.add_runtime_dependency "logstash-mixin-http_client", ">= 7.1.0", '< 9.0.0'
s.add_runtime_dependency "logstash-mixin-http_client", ">= 7.2.0", '< 9.0.0'
Copy link

@andsel andsel Mar 28, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The http_poller plugin doens't have the < 9.0.0 to you think we could remove it?

Copy link
Author

@kares kares Mar 28, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is a common pattern ruby gems use to limit using a later version of the library,
you know there's a current 7.x versions that your code works with, 8.x will probably work as well but another major might be a bit too optimistic of an assumption - thus the upper bound limit.

s.add_runtime_dependency 'logstash-mixin-validator_support', '~> 1.0'

s.add_development_dependency 'logstash-devutils'
Expand Down