Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

enhancement(core): Add CLI arg and env variable to control openssl probing #18229

Merged
merged 4 commits into from
Aug 15, 2023
Merged

enhancement(core): Add CLI arg and env variable to control openssl probing #18229

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5d8719c
enhancement(core): Add CLI arg and env variable to control openssl pr…
hhromic Aug 12, 2023
f2c8028
Document new option and env variable
hhromic Aug 15, 2023
86ae963
Remove copy/pasted block by mistake
hhromic Aug 15, 2023
8edb011
Align in-code comment with reference documentation
hhromic Aug 15, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 10 additions & 3 deletions src/app.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,7 +180,7 @@ impl Application {
}

pub fn prepare_from_opts(opts: Opts) -> Result<(Runtime, Self), ExitCode> {
init_global();
init_global(!opts.root.openssl_no_probe);

let color = opts.root.color.use_color();

Expand All @@ -191,6 +191,11 @@ impl Application {
opts.root.internal_log_rate_limit,
);

// Can only log this after initializing the logging subsystem
if opts.root.openssl_no_probe {
debug!(message = "Disabled probing and configuration of root certificate locations on the system for OpenSSL.");
}

let openssl_legacy_provider = opts
.root
.openssl_legacy_provider
Expand Down Expand Up @@ -420,8 +425,10 @@ impl FinishedApplication {
}
}

pub fn init_global() {
openssl_probe::init_ssl_cert_env_vars();
pub fn init_global(openssl_probe: bool) {
if openssl_probe {
openssl_probe::init_ssl_cert_env_vars();
}

#[cfg(not(feature = "enterprise-tests"))]
metrics::init_global().expect("metrics initialization failed");
Expand Down
8 changes: 8 additions & 0 deletions src/cli.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -198,6 +198,14 @@ pub struct RootOpts {
/// Load the OpenSSL legacy provider.
#[arg(long, env = "VECTOR_OPENSSL_LEGACY_PROVIDER", default_value = "true")]
pub openssl_legacy_provider: bool,

/// Disable probing and configuration of root certificate locations on the system for OpenSSL.
dsmith3197 marked this conversation as resolved.
Show resolved Hide resolved
///
/// The probe functionality manipulates the `SSL_CERT_FILE` and `SSL_CERT_DIR` environment variables
/// in the Vector process. This behavior can be problematic for users of the `exec` source, which by
/// default inherits the environment of the Vector process.
#[arg(long, env = "VECTOR_OPENSSL_NO_PROBE", default_value = "false")]
pub openssl_no_probe: bool,
}

impl RootOpts {
Expand Down
20 changes: 20 additions & 0 deletions website/cue/reference/cli.cue
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,6 +113,14 @@ cli: {
description: env_vars.VECTOR_NO_GRACEFUL_SHUTDOWN_LIMIT.description
env_var: "VECTOR_NO_GRACEFUL_SHUTDOWN_LIMIT"
}
"openssl-legacy-provider": {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for adding this one too :)

description: env_vars.VECTOR_OPENSSL_LEGACY_PROVIDER.description
env_var: "VECTOR_OPENSSL_LEGACY_PROVIDER"
}
"openssl-no-probe": {
description: env_vars.VECTOR_OPENSSL_NO_PROBE.description
env_var: "VECTOR_OPENSSL_NO_PROBE"
}
}

_core_config_options: {
Expand Down Expand Up @@ -624,6 +632,18 @@ cli: {
description: "Never time out while waiting for graceful shutdown after SIGINT or SIGTERM received. This is useful when you would like for Vector to attempt to send data until terminated by a SIGKILL. Overrides/cannot be set with `--graceful-shutdown-limit-secs`."
type: bool: default: false
}
VECTOR_OPENSSL_LEGACY_PROVIDER: {
description: "Load the OpenSSL legacy provider."
type: bool: default: true
}
VECTOR_OPENSSL_NO_PROBE: {
description: """
Disable probing and configuration of root certificate locations on the system for OpenSSL.

The probe functionality manipulates the `SSL_CERT_FILE` and `SSL_CERT_DIR` environment variables in the Vector process. This behavior can be problematic for users of the `exec` source, which by default inherits the environment of the Vector process.
"""
type: bool: default: false
}
}

// Helpers
Expand Down