upstream_node: Process tls.verify_hostname parameter

Signed-off-by: Hiroshi Hatake <[email protected]>
fluent · Aug 13, 2024 · 9c8e73a · 9c8e73a
1 parent e60c2f7
commit 9c8e73a
Show file tree

Hide file tree

Showing 3 changed files with 25 additions and 1 deletion.
diff --git a/include/fluent-bit/flb_upstream_node.h b/include/fluent-bit/flb_upstream_node.h
@@ -36,6 +36,7 @@ struct flb_upstream_node {
 #ifdef FLB_HAVE_TLS
     /* TLS: given configuration */
     int tls_verify;           /* Verify certs (default: true) */
+    int tls_verify_hostname;  /* Verify hostname (default: false) */
     int tls_debug;            /* mbedtls debug level          */
     char *tls_ca_path;        /* Path to certificates         */
     char *tls_ca_file;        /* CA root cert                 */
@@ -65,6 +66,7 @@ struct flb_upstream_node {
 struct flb_upstream_node *flb_upstream_node_create(flb_sds_t name, flb_sds_t host,
                                                    flb_sds_t port,
                                                    int tls, int tls_verify,
+                                                   int tls_verify_hostname,
                                                    int tls_debug,
                                                    const char *tls_vhost,
                                                    const char *tls_ca_path,

diff --git a/src/flb_upstream_ha.c b/src/flb_upstream_ha.c
@@ -120,6 +120,7 @@ static struct flb_upstream_node *create_node(int id,
     int vlen;
     int tls = FLB_FALSE;
     int tls_verify = FLB_TRUE;
+    int tls_verify_hostname = FLB_FALSE;
     int tls_debug = 1;
     char key[32];
     char *tmp;
@@ -138,7 +139,8 @@ static struct flb_upstream_node *create_node(int id,
     const char *known_keys[] = {"name", "host", "port",
                                 "tls", "tls.vhost", "tls.verify", "tls.debug",
                                 "tls.ca_path", "tls.ca_file", "tls.crt_file",
-                                "tls.key_file", "tls.key_passwd", NULL};
+                                "tls.key_file", "tls.key_passwd",
+                                "tls.verify_hostname", NULL};
 
     struct flb_upstream_node *node;
 
@@ -180,6 +182,13 @@ static struct flb_upstream_node *create_node(int id,
         flb_sds_destroy(tmp);
     }
 
+    /* tls.verify_hostname */
+    tmp = flb_cf_section_property_get_string(cf, s, "tls.verify_hostname");
+    if (tmp) {
+        tls_verify_hostname = flb_utils_bool(tmp);
+        flb_sds_destroy(tmp);
+    }
+
     /* tls.debug */
     tmp = flb_cf_section_property_get_string(cf, s, "tls.debug");
     if (tmp) {
@@ -252,6 +261,7 @@ static struct flb_upstream_node *create_node(int id,
     }
 
     node = flb_upstream_node_create(name, host, port, tls, tls_verify,
+                                    tls_verify_hostname,
                                     tls_debug, tls_vhost, tls_ca_path, tls_ca_file,
                                     tls_crt_file, tls_key_file,
                                     tls_key_passwd, ht, config);

diff --git a/src/flb_upstream_node.c b/src/flb_upstream_node.c
@@ -30,6 +30,7 @@
 struct flb_upstream_node *flb_upstream_node_create(flb_sds_t name, flb_sds_t host,
                                                    flb_sds_t port,
                                                    int tls, int tls_verify,
+                                                   int tls_verify_hostname,
                                                    int tls_debug,
                                                    const char *tls_vhost,
                                                    const char *tls_ca_path,
@@ -40,6 +41,7 @@ struct flb_upstream_node *flb_upstream_node_create(flb_sds_t name, flb_sds_t hos
                                                    struct flb_hash_table *ht,
                                                    struct flb_config *config)
 {
+    int ret;
     int i_port;
     int io_flags;
     char tmp[255];
@@ -143,6 +145,16 @@ struct flb_upstream_node *flb_upstream_node_create(flb_sds_t name, flb_sds_t hos
             return NULL;
         }
         node->tls_enabled = FLB_TRUE;
+        if (tls_verify_hostname == FLB_TRUE) {
+            ret = flb_tls_set_verify_hostname(node->tls, tls_verify_hostname);
+            if (ret == -1) {
+                flb_error("[upstream_node] error set up to verify hostname in TLS context "
+                          "on node '%s'", name);
+                flb_upstream_node_destroy(node);
+
+                return NULL;
+            }
+        }
     }
 #endif