From 02772eb5f28b3c3a98f0d739b6210ca82d58f7ee Mon Sep 17 00:00:00 2001
From: Rich Megginson <rmeggins@redhat.com>
Date: Thu, 8 Feb 2018 18:13:13 -0700
Subject: [PATCH] omelasticsearch - add support for CA cert, client cert auth

This allows omelasticsearch to perform client cert based authentication
to Elasticsearch.
Add the following parameters:
`tls.cacert` - Full path and filename of the file containing the CA cert
               for the CA that issued the Elasticsearch server(s) cert(s)
`tls.mycert` - Full path and filename of the file containing the client
               cert used to authenticate to Elasticsearch
`tls.myprivkey` - Full path and filename of the file containing the client
                  key used to authenticate to Elasticsearch
---
 plugins/omelasticsearch/omelasticsearch.c | 79 ++++++++++++++++++++++++++++---
 1 file changed, 73 insertions(+), 6 deletions(-)

diff --git a/plugins/omelasticsearch/omelasticsearch.c b/plugins/omelasticsearch/omelasticsearch.c
index 97d8fb233..88bd5e16c 100644
--- a/plugins/omelasticsearch/omelasticsearch.c
+++ b/plugins/omelasticsearch/omelasticsearch.c
@@ -110,6 +110,9 @@ typedef struct _instanceData {
 	size_t maxbytes;
 	sbool useHttps;
 	sbool allowUnsignedCerts;
+	uchar *caCertFile;
+	uchar *myCertFile;
+	uchar *myPrivKeyFile;
 } instanceData;
 
 typedef struct wrkrInstanceData {
@@ -154,7 +157,10 @@ static struct cnfparamdescr actpdescr[] = {
 	{ "template", eCmdHdlrGetWord, 0 },
 	{ "dynbulkid", eCmdHdlrBinary, 0 },
 	{ "bulkid", eCmdHdlrGetWord, 0 },
-	{ "allowunsignedcerts", eCmdHdlrBinary, 0 }
+	{ "allowunsignedcerts", eCmdHdlrBinary, 0 },
+	{ "tls.cacert", eCmdHdlrString, 0 },
+	{ "tls.mycert", eCmdHdlrString, 0 },
+	{ "tls.myprivkey", eCmdHdlrString, 0 }
 };
 static struct cnfparamblk actpblk =
 	{ CNFPARAMBLK_VERSION,
@@ -168,6 +174,9 @@ BEGINcreateInstance
 CODESTARTcreateInstance
 	pData->fdErrFile = -1;
 	pthread_mutex_init(&pData->mutErrFile, NULL);
+	pData->caCertFile = NULL;
+	pData->myCertFile = NULL;
+	pData->myPrivKeyFile = NULL;
 ENDcreateInstance
 
 BEGINcreateWrkrInstance
@@ -216,6 +225,9 @@ CODESTARTfreeInstance
 	free(pData->timeout);
 	free(pData->errorFile);
 	free(pData->bulkId);
+	free(pData->caCertFile);
+	free(pData->myCertFile);
+	free(pData->myPrivKeyFile);
 ENDfreeInstance
 
 BEGINfreeWrkrInstance
@@ -270,6 +282,9 @@ CODESTARTdbgPrintInstInfo
 	dbgprintf("\tinterleaved=%d\n", pData->interleaved);
 	dbgprintf("\tdynbulkid=%d\n", pData->dynBulkId);
 	dbgprintf("\tbulkid='%s'\n", pData->bulkId);
+	dbgprintf("\ttls.cacert='%s'\n", pData->caCertFile);
+	dbgprintf("\ttls.mycert='%s'\n", pData->myCertFile);
+	dbgprintf("\ttls.myprivkey='%s'\n", pData->myPrivKeyFile);
 ENDdbgPrintInstInfo
 
 
@@ -311,7 +326,7 @@ computeBaseUrl(const char*const serverParam,
 		r = useHttps ? es_addBuf(&urlBuf, SCHEME_HTTPS, sizeof(SCHEME_HTTPS)-1) :
 			es_addBuf(&urlBuf, SCHEME_HTTP, sizeof(SCHEME_HTTP)-1);
 
-	if (r == 0) r = es_addBuf(&urlBuf, serverParam, strlen(serverParam));
+	if (r == 0) r = es_addBuf(&urlBuf, (char *)serverParam, strlen(serverParam));
 	if (r == 0 && !strchr(host, ':')) {
 		snprintf(portBuf, sizeof(portBuf), ":%d", defaultPort);
 		r = es_addBuf(&urlBuf, portBuf, strlen(portBuf));
@@ -1296,7 +1311,7 @@ finalize_it:
 }
 
 static void
-curlCheckConnSetup(CURL *handle, HEADER *header, long timeout, sbool allowUnsignedCerts)
+curlCheckConnSetup(CURL *handle, HEADER *header, long timeout, sbool allowUnsignedCerts, wrkrInstanceData_t *pWrkrData)
 {
 	curl_easy_setopt(handle, CURLOPT_HTTPHEADER, header);
 	curl_easy_setopt(handle, CURLOPT_NOBODY, TRUE);
@@ -1305,13 +1320,21 @@ curlCheckConnSetup(CURL *handle, HEADER *header, long timeout, sbool allowUnsign
 
 	if(allowUnsignedCerts)
 		curl_easy_setopt(handle, CURLOPT_SSL_VERIFYPEER, FALSE);
+	if(pWrkrData->pData->caCertFile)
+		curl_easy_setopt(handle, CURLOPT_CAINFO, pWrkrData->pData->caCertFile);
+	if(pWrkrData->pData->myCertFile)
+		curl_easy_setopt(handle, CURLOPT_SSLCERT, pWrkrData->pData->myCertFile);
+	if(pWrkrData->pData->myPrivKeyFile)
+		curl_easy_setopt(handle, CURLOPT_SSLKEY, pWrkrData->pData->myPrivKeyFile);
+	/* uncomment for in-dept debuggung:
+	curl_easy_setopt(handle, CURLOPT_VERBOSE, TRUE); */
 
 	/* Only enable for debugging
 	curl_easy_setopt(curl, CURLOPT_VERBOSE, TRUE); */
 }
 
 static void
-curlPostSetup(CURL *handle, HEADER *header, uchar* authBuf)
+curlPostSetup(CURL *handle, HEADER *header, uchar* authBuf, wrkrInstanceData_t *pWrkrData)
 {
 	curl_easy_setopt(handle, CURLOPT_HTTPHEADER, header);
 	curl_easy_setopt(handle, CURLOPT_WRITEFUNCTION, curlResult);
@@ -1322,6 +1345,12 @@ curlPostSetup(CURL *handle, HEADER *header, uchar* authBuf)
 		curl_easy_setopt(handle, CURLOPT_USERPWD, authBuf);
 		curl_easy_setopt(handle, CURLOPT_PROXYAUTH, CURLAUTH_ANY);
 	}
+	if(pWrkrData->pData->caCertFile)
+		curl_easy_setopt(handle, CURLOPT_CAINFO, pWrkrData->pData->caCertFile);
+	if(pWrkrData->pData->myCertFile)
+		curl_easy_setopt(handle, CURLOPT_SSLCERT, pWrkrData->pData->myCertFile);
+	if(pWrkrData->pData->myPrivKeyFile)
+		curl_easy_setopt(handle, CURLOPT_SSLKEY, pWrkrData->pData->myPrivKeyFile);
 }
 
 static rsRetVal
@@ -1332,7 +1361,7 @@ curlSetup(wrkrInstanceData_t *pWrkrData, instanceData *pData)
 	if (pWrkrData->curlPostHandle == NULL) {
 		return RS_RET_OBJ_CREATION_FAILED;
 	}
-	curlPostSetup(pWrkrData->curlPostHandle, pWrkrData->curlHeader, pData->authBuf);
+	curlPostSetup(pWrkrData->curlPostHandle, pWrkrData->curlHeader, pData->authBuf, pWrkrData);
 
 	pWrkrData->curlCheckConnHandle = curl_easy_init();
 	if (pWrkrData->curlCheckConnHandle == NULL) {
@@ -1341,7 +1370,7 @@ curlSetup(wrkrInstanceData_t *pWrkrData, instanceData *pData)
 		return RS_RET_OBJ_CREATION_FAILED;
 	}
 	curlCheckConnSetup(pWrkrData->curlCheckConnHandle, pWrkrData->curlHeader,
-		pData->healthCheckTimeout, pData->allowUnsignedCerts);
+		pData->healthCheckTimeout, pData->allowUnsignedCerts, pWrkrData);
 
 	return RS_RET_OK;
 }
@@ -1372,6 +1401,9 @@ setInstParamDefaults(instanceData *pData)
 	pData->interleaved=0;
 	pData->dynBulkId= 0;
 	pData->bulkId = NULL;
+	pData->caCertFile = NULL;
+	pData->myCertFile = NULL;
+	pData->myPrivKeyFile = NULL;
 }
 
 BEGINnewActInst
@@ -1380,6 +1412,8 @@ BEGINnewActInst
 	struct cnfarray* servers = NULL;
 	int i;
 	int iNumTpls;
+	FILE *fp;
+	char errStr[1024];
 CODESTARTnewActInst
 	if((pvals = nvlstGetParams(lst, &actpblk, NULL)) == NULL) {
 		ABORT_FINALIZE(RS_RET_MISSING_CNFPARAMS);
@@ -1435,6 +1469,39 @@ CODESTARTnewActInst
 			pData->dynBulkId = pvals[i].val.d.n;
 		} else if(!strcmp(actpblk.descr[i].name, "bulkid")) {
 			pData->bulkId = (uchar*)es_str2cstr(pvals[i].val.d.estr, NULL);
+		} else if(!strcmp(actpblk.descr[i].name, "tls.cacert")) {
+			pData->caCertFile = (uchar*)es_str2cstr(pvals[i].val.d.estr, NULL);
+			fp = fopen((const char*)pData->caCertFile, "r");
+			if(fp == NULL) {
+				rs_strerror_r(errno, errStr, sizeof(errStr));
+				errmsg.LogError(0, RS_RET_NO_FILE_ACCESS,
+						"error: 'tls.cacert' file %s couldn't be accessed: %s\n",
+						pData->caCertFile, errStr);
+			} else {
+				fclose(fp);
+			}
+		} else if(!strcmp(actpblk.descr[i].name, "tls.mycert")) {
+			pData->myCertFile = (uchar*)es_str2cstr(pvals[i].val.d.estr, NULL);
+			fp = fopen((const char*)pData->myCertFile, "r");
+			if(fp == NULL) {
+				rs_strerror_r(errno, errStr, sizeof(errStr));
+				errmsg.LogError(0, RS_RET_NO_FILE_ACCESS,
+						"error: 'tls.mycert' file %s couldn't be accessed: %s\n",
+						pData->myCertFile, errStr);
+			} else {
+				fclose(fp);
+			}
+		} else if(!strcmp(actpblk.descr[i].name, "tls.myprivkey")) {
+			pData->myPrivKeyFile = (uchar*)es_str2cstr(pvals[i].val.d.estr, NULL);
+			fp = fopen((const char*)pData->myPrivKeyFile, "r");
+			if(fp == NULL) {
+				rs_strerror_r(errno, errStr, sizeof(errStr));
+				errmsg.LogError(0, RS_RET_NO_FILE_ACCESS,
+						"error: 'tls.myprivkey' file %s couldn't be accessed: %s\n",
+						pData->myPrivKeyFile, errStr);
+			} else {
+				fclose(fp);
+			}
 		} else {
 			dbgprintf("omelasticsearch: program error, non-handled "
 			  "param '%s'\n", actpblk.descr[i].name);
-- 
2.14.3