out_syslog: tls: io: Handle dtls protocol on out syslog - #11728
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdded DTLS-over-UDP transport support across IO, upstream, TLS, and out_syslog: new I/O flags and TLS datagram modes, transport-aware connection/handshake logic, syslog plugin DTLS handling and config/validation, and integration tests for UDP/TCP/DTLS flows. Several related code paths were adjusted for UDP/DTLS. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant App as Fluent Bit Plugin (out_syslog)
participant Up as Upstream Manager
participant IO as flb_io / Socket Layer
participant TLS as OpenSSL TLS/DTLS
participant Receiver as Syslog Server
App->>Up: create upstream with flags (FLB_IO_UDP / FLB_IO_DTLS / FLB_IO_TLS / FLB_IO_TCP)
Up->>IO: flb_stream_setup(transport derived from flags)
App->>IO: connect() (UDP/TCP path selected)
alt transport == UDP/DTLS
IO->>IO: use UDP socket (non-blocking / recv timeout)
else
IO->>IO: use TCP connect (+proxy if TCP)
end
alt TLS or DTLS requested
IO->>TLS: establish TLS/DTLS session (client mode datagram/tcp as selected)
TLS-->>IO: handshake complete
end
IO->>Receiver: send datagram/stream (DTLS wraps datagram if used)
Receiver-->>App: response/ACK (captured by test receiver)
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
3e51274 to
4c265e7
Compare
Signed-off-by: Hiroshi Hatake <hiroshi@chronosphere.io>
Signed-off-by: Hiroshi Hatake <hiroshi@chronosphere.io>
Signed-off-by: Hiroshi Hatake <hiroshi@chronosphere.io>
Signed-off-by: Hiroshi Hatake <hiroshi@chronosphere.io>
Signed-off-by: Hiroshi Hatake <hiroshi@chronosphere.io>
Signed-off-by: Hiroshi Hatake <hiroshi@chronosphere.io>
Signed-off-by: Hiroshi Hatake <hiroshi@chronosphere.io>
4c265e7 to
719fef2
Compare
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 504b4b2c40
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Signed-off-by: Hiroshi Hatake <hiroshi@chronosphere.io>
Signed-off-by: Hiroshi Hatake <hiroshi@chronosphere.io>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
plugins/out_syslog/syslog.c (1)
863-870:⚠️ Potential issue | 🟠 MajorTreat DTLS as datagram mode when formatting syslog payloads.
FLB_SYSLOG_DTLSnow uses datagram transport, but Line 863 still appends a TCP/TLS newline for every non-UDP mode. That changes DTLS wire payloads and can exceedctx->maxsizeby one byte because truncation happens before the newline append.🐛 Proposed fix
- if (ctx->parsed_mode != FLB_SYSLOG_UDP) { + if (ctx->parsed_mode != FLB_SYSLOG_UDP && + ctx->parsed_mode != FLB_SYSLOG_DTLS) { tmp = flb_sds_cat(*s, "\n", 1); if (!tmp) { ret_sds = NULL;Also applies to: 1035-1036
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@plugins/out_syslog/syslog.c` around lines 863 - 870, The code unconditionally treats non-UDP modes as stream-based when appending a trailing newline to the syslog payload; update the conditional that checks ctx->parsed_mode (used where *s is appended with "\n") to treat FLB_SYSLOG_DTLS as a datagram mode (i.e., only append the newline when parsed_mode is neither FLB_SYSLOG_UDP nor FLB_SYSLOG_DTLS). Apply the same change at the other occurrence that appends a newline (the second block referencing ctx->parsed_mode and appending "\n") so DTLS payloads are not altered or over-sized.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@plugins/out_syslog/syslog.c`:
- Around line 863-870: The code unconditionally treats non-UDP modes as
stream-based when appending a trailing newline to the syslog payload; update the
conditional that checks ctx->parsed_mode (used where *s is appended with "\n")
to treat FLB_SYSLOG_DTLS as a datagram mode (i.e., only append the newline when
parsed_mode is neither FLB_SYSLOG_UDP nor FLB_SYSLOG_DTLS). Apply the same
change at the other occurrence that appends a newline (the second block
referencing ctx->parsed_mode and appending "\n") so DTLS payloads are not
altered or over-sized.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: ff0cf485-40f8-4709-9fd2-dff4d889c32d
📒 Files selected for processing (2)
plugins/out_syslog/syslog.csrc/flb_io.c
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 18dc607fed
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Signed-off-by: Hiroshi Hatake <hiroshi@chronosphere.io>
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/tls/openssl.c (1)
845-858:⚠️ Potential issue | 🟠 MajorMirror the
OPENSSL_NO_DTLSguard in the OpenSSL ≥ 1.1.0 branch.The legacy branch at lines 823–837 correctly guards DTLS method calls with
#ifndef OPENSSL_NO_DTLSand fails gracefully with an error message when unsupported. The#elsebranch for OpenSSL ≥ 1.1.0 (lines 845–858) lacks this guard and unconditionally referencesDTLS_server_method()andDTLS_client_method(). When OpenSSL ≥ 1.1.0 is built withOPENSSL_NO_DTLS, these function symbols are declared but not implemented, causing a linker failure. Apply the same guard here for consistency and build robustness.🔧 Proposed fix
`#else` if (mode == FLB_TLS_SERVER_MODE) { ssl_ctx = SSL_CTX_new(TLS_server_method()); } - else if (mode == FLB_TLS_SERVER_MODE_DGRAM) { - ssl_ctx = SSL_CTX_new(DTLS_server_method()); - } - else if (mode == FLB_TLS_CLIENT_MODE_DGRAM) { - ssl_ctx = SSL_CTX_new(DTLS_client_method()); - } + else if (mode == FLB_TLS_SERVER_MODE_DGRAM || + mode == FLB_TLS_CLIENT_MODE_DGRAM) { +#ifndef OPENSSL_NO_DTLS + if (mode == FLB_TLS_SERVER_MODE_DGRAM) { + ssl_ctx = SSL_CTX_new(DTLS_server_method()); + } + else { + ssl_ctx = SSL_CTX_new(DTLS_client_method()); + } +#else + flb_error("[openssl] DTLS mode requested but this OpenSSL build " + "does not provide DTLS support"); + return NULL; +#endif + } else { ssl_ctx = SSL_CTX_new(TLS_client_method()); } `#endif`🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/tls/openssl.c` around lines 845 - 858, The OpenSSL ≥1.1.0 branch unconditionally calls DTLS_server_method() and DTLS_client_method(), which can cause linker failures when built with OPENSSL_NO_DTLS; wrap the DTLS-specific branches (those comparing mode to FLB_TLS_SERVER_MODE_DGRAM and FLB_TLS_CLIENT_MODE_DGRAM) with the same `#ifndef` OPENSSL_NO_DTLS guard used in the legacy branch, and in the guarded-else provide the existing graceful fallback that logs an error and returns when DTLS is unavailable; keep TLS_server_method()/TLS_client_method() paths unchanged and ensure symbols SSL_CTX_new, DTLS_server_method, DTLS_client_method, TLS_server_method, TLS_client_method and the mode constants are referenced exactly as in the diff.
🧹 Nitpick comments (1)
src/tls/openssl.c (1)
823-843: Consider version-negotiating DTLS method for the pre-1.1.0 branch.
DTLSv1_server_method()/DTLSv1_client_method()pin the context to DTLS 1.0 only, while the >=1.1.0 branch uses the version-negotiatingDTLS_*_method(). SinceDTLS_*_method()is available starting in OpenSSL 1.0.2, you could use it here (with an additionalOPENSSL_VERSION_NUMBERcheck for 1.0.2+) to allow DTLS 1.2. This branch only targets very old OpenSSL releases, so this is optional.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/tls/openssl.c` around lines 823 - 843, The DTLS branch currently uses DTLSv1_server_method()/DTLSv1_client_method() which pins to DTLS 1.0; change it to prefer the version‑negotiating DTLS_server_method()/DTLS_client_method() when building against OpenSSL 1.0.2+ by checking OPENSSL_VERSION_NUMBER (>= 0x10002000L) and calling DTLS_server_method()/DTLS_client_method() to create ssl_ctx for FLB_TLS_SERVER_MODE_DGRAM/FLB_TLS_CLIENT_MODE_DGRAM, and fall back to DTLSv1_server_method()/DTLSv1_client_method() when the version check fails or the symbols are unavailable; keep existing error handling (flb_error and return NULL) when OPENSSL_NO_DTLS is defined.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@src/tls/openssl.c`:
- Around line 845-858: The OpenSSL ≥1.1.0 branch unconditionally calls
DTLS_server_method() and DTLS_client_method(), which can cause linker failures
when built with OPENSSL_NO_DTLS; wrap the DTLS-specific branches (those
comparing mode to FLB_TLS_SERVER_MODE_DGRAM and FLB_TLS_CLIENT_MODE_DGRAM) with
the same `#ifndef` OPENSSL_NO_DTLS guard used in the legacy branch, and in the
guarded-else provide the existing graceful fallback that logs an error and
returns when DTLS is unavailable; keep TLS_server_method()/TLS_client_method()
paths unchanged and ensure symbols SSL_CTX_new, DTLS_server_method,
DTLS_client_method, TLS_server_method, TLS_client_method and the mode constants
are referenced exactly as in the diff.
---
Nitpick comments:
In `@src/tls/openssl.c`:
- Around line 823-843: The DTLS branch currently uses
DTLSv1_server_method()/DTLSv1_client_method() which pins to DTLS 1.0; change it
to prefer the version‑negotiating DTLS_server_method()/DTLS_client_method() when
building against OpenSSL 1.0.2+ by checking OPENSSL_VERSION_NUMBER (>=
0x10002000L) and calling DTLS_server_method()/DTLS_client_method() to create
ssl_ctx for FLB_TLS_SERVER_MODE_DGRAM/FLB_TLS_CLIENT_MODE_DGRAM, and fall back
to DTLSv1_server_method()/DTLSv1_client_method() when the version check fails or
the symbols are unavailable; keep existing error handling (flb_error and return
NULL) when OPENSSL_NO_DTLS is defined.
2 participants
And implemented dtls transport protocol in core.
RSyslog has DTLS capability to handle DTLS transportation protocol which is described in RFC 6012.
DTLS is handled over UDP and transport layer security(TLS).
Currently, when selecting UDP as a transport protocol, there's no TLS support on out_syslog plugin. So, if users wanted to use this plugin with UDP and TLS combination, there's no luck.
We should add a capability to handle this.
Related to #11703.
Enter
[N/A]in the box, if an item is not applicable to your change.Testing
Before we can approve your change; please submit the following in a comment:
If this is a change to packaging of containers or native binaries then please confirm it works for all targets.
ok-package-testlabel to test for all targets (requires maintainer to do).Documentation
Backporting
Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.
Summary by CodeRabbit
New Features
Documentation
Behavior
Tests