search

logstash-plugins / logstash-input-tcp

Apache License 2.0
35 stars 75 forks source link

fix support for encrypted pkcs8 private keys #133

Closed jsvd closed 5 years ago

jsvd commented 5 years ago

Failure related to a bug in jruby-openssl which this logstash release uses

yaauie commented 5 years ago

🤔 Failing on 5.x.

logstash_1  | Failures:
logstash_1  | 
logstash_1  |   1) LogStash::Inputs::Tcp LogStash::Inputs::Tcp new specs style #receive when ssl_enable is true when using a certificate chain when using an encrypted private pkcs1 key should be able to connect and write data
logstash_1  |      Failure/Error: Unable to find java.lang.reflect.Method.invoke(java/lang/reflect/Method.java to read failed line
logstash_1  |      
logstash_1  |      Java::OrgBouncycastleOpenssl::PEMException:
logstash_1  |        problem creating RSA private key: java.lang.IllegalArgumentException: failed to construct sequence from byte[]: Extra data detected in stream
logstash_1  |      # java.lang.reflect.Method.invoke(java/lang/reflect/Method.java:498)
logstash_1  |      # RUBY.toSslContext(/usr/share/plugins/logstash-input-tcp/lib/logstash/inputs/tcp/compat_ssl_options.rb:93)
logstash_1  |      # RUBY.get_ssl_context(/usr/share/plugins/logstash-input-tcp/lib/logstash/inputs/tcp.rb:366)
logstash_1  |      # RUBY.register(/usr/share/plugins/logstash-input-tcp/lib/logstash/inputs/tcp.rb:150)
logstash_1  |      # RUBY.(root)(/usr/share/plugins/logstash-input-tcp/spec/inputs/tcp_spec.rb:396)
logstash_1  | 
logstash_1  | Finished in 1 minute 22.28 seconds (files took 6.32 seconds to load)
logstash_1  | 19 examples, 1 failure

-- https://travis-ci.org/logstash-plugins/logstash-input-tcp/jobs/463955391

jsvd commented 5 years ago

@yaauie reason for that is mentioned above ^ (a bug in the jruby-openssl) that ships with Logstash 5.6 (will be updated in the next patch release)

yaauie commented 5 years ago

derp. yeah that makes sense.

Since this feature did not work before this patch, I'm fine with either merging as-is now, as-is after the upstream patch release, or with a guard that prevents it from working at all in the 5.x series.