CL-Softwares
/
telegraf
8
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix x509_cert input plugin SNI support (#9289)

This commit is contained in:
Jarno Huuskonen 2021-06-22 19:41:45 +03:00 committed by GitHub
parent 81f882a271
commit ac9bf5a0ec
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 22 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
plugins/inputs/x509_cert/x509_cert.go
View File

@ -66,8 +66,7 @@ func (c *X509Cert) SampleConfig() string {
func (c *X509Cert) sourcesToURLs() error {
for _, source := range c.Sources {
if strings.HasPrefix(source, "file://") ||
strings.HasPrefix(source, "/") ||
strings.Index(source, ":\\") != 1 {
strings.HasPrefix(source, "/") {
source = filepath.ToSlash(strings.TrimPrefix(source, "file://"))
g, err := globpath.Compile(source)
if err != nil {
@ -82,7 +81,6 @@ func (c *X509Cert) sourcesToURLs() error {
if err != nil {
return fmt.Errorf("failed to parse cert location - %s", err.Error())
}
c.locations = append(c.locations, u)
}
}
@ -127,6 +125,9 @@ func (c *X509Cert) getCert(u *url.URL, timeout time.Duration) ([]*x509.Certifica
conn := tls.Client(ipConn, c.tlsCfg)
defer conn.Close()
// reset SNI between requests
defer func() { c.tlsCfg.ServerName = "" }()
hsErr := conn.Handshake()
if hsErr != nil {
return nil, hsErr
@ -313,6 +314,14 @@ func (c *X509Cert) Init() error {
tlsCfg = &tls.Config{}
}
if tlsCfg.ServerName != "" && c.ServerName == "" {
// Save SNI from tlsCfg.ServerName to c.ServerName and reset tlsCfg.ServerName.
// We need to reset c.tlsCfg.ServerName for each certificate when there's
// no explicit SNI (c.tlsCfg.ServerName or c.ServerName) otherwise we'll always (re)use
// first uri HostName for all certs (see issue 8914)
c.ServerName = tlsCfg.ServerName
tlsCfg.ServerName = ""
}
c.tlsCfg = tlsCfg
return nil

10
plugins/inputs/x509_cert/x509_cert_test.go
View File

@ -316,6 +316,16 @@ func TestGatherCertMustNotTimeout(t *testing.T) {
assert.True(t, acc.HasMeasurement("x509_cert"))
}
func TestSourcesToURLs(t *testing.T) {
m := &X509Cert{
Sources: []string{"https://www.influxdata.com:443", "tcp://influxdata.com:443", "file:///dummy_test_path_file.pem", "/tmp/dummy_test_path_glob*.pem"},
}
require.NoError(t, m.Init())
assert.Equal(t, len(m.globpaths), 2)
assert.Equal(t, len(m.locations), 2)
}
func TestServerName(t *testing.T) {
tests := []struct {
name string