tls: add support for setting min/max TLS version and cipher list

include/fluent-bit/flb_input.h

@@ -443,6 +443,9 @@ struct flb_input_instance {
     char *tls_crt_file;                  /* Certificate                  */
     char *tls_key_file;                  /* Cert Key                     */
     char *tls_key_passwd;                /* Cert Key Password            */
+    char *tls_min_version;               /* Minimum protocol version of TLS */
+    char *tls_max_version;               /* Maximum protocol version of TLS */
+    char *tls_ciphers;                   /* TLS ciphers */
 
     struct mk_list *tls_config_map;
 

include/fluent-bit/flb_output.h

@@ -366,6 +366,9 @@ struct flb_output_instance {
     char *tls_crt_file;                  /* Certificate                  */
     char *tls_key_file;                  /* Cert Key                     */
     char *tls_key_passwd;                /* Cert Key Password            */
+    char *tls_min_version;               /* Minimum protocol version of TLS */
+    char *tls_max_version;               /* Maximum protocol version of TLS */
+    char *tls_ciphers;                   /* TLS ciphers */
 #endif
 
     /*

include/fluent-bit/tls/flb_tls.h

@@ -77,6 +77,11 @@ struct flb_tls_backend {
     /* Additional settings */
     int (*context_alpn_set) (void *, const char *);
 
+    /* TLS Protocol version */
+    int (*set_minmax_proto) (struct flb_tls *tls, const char *, const char *);
+    /* TLS Ciphers */
+    int (*set_ciphers) (struct flb_tls *tls, const char *);
+
     /* Session management */
     void *(*session_create) (struct flb_tls *, int);
     int (*session_destroy) (void *);
@@ -119,6 +124,9 @@ int flb_tls_set_alpn(struct flb_tls *tls, const char *alpn);
 int flb_tls_set_verify_hostname(struct flb_tls *tls, int verify_hostname);
 
 int flb_tls_load_system_certificates(struct flb_tls *tls);
+int flb_tls_set_minmax_proto(struct flb_tls *tls,
+                             const char *min_version, const char *max_version);
+int flb_tls_set_ciphers(struct flb_tls *tls, const char *ciphers);
 
 struct mk_list *flb_tls_get_config_map(struct flb_config *config);
 

src/flb_input.c

@@ -595,6 +595,15 @@ int flb_input_set_property(struct flb_input_instance *ins,
     else if (prop_key_check("tls.key_passwd", k, len) == 0) {
         flb_utils_set_plugin_string_property("tls.key_passwd", &ins->tls_key_passwd, tmp);
     }
+    else if (prop_key_check("tls.min_version", k, len) == 0) {
+        flb_utils_set_plugin_string_property("tls.min_version", &ins->tls_min_version, tmp);
+    }
+    else if (prop_key_check("tls.max_version", k, len) == 0) {
+        flb_utils_set_plugin_string_property("tls.max_version", &ins->tls_max_version, tmp);
+    }
+    else if (prop_key_check("tls.ciphers", k, len) == 0) {
+        flb_utils_set_plugin_string_property("tls.ciphers", &ins->tls_ciphers, tmp);
+    }
 #endif
     else if (prop_key_check("storage.type", k, len) == 0 && tmp) {
         /* Set the storage type */
@@ -741,6 +750,18 @@ void flb_input_instance_destroy(struct flb_input_instance *ins)
         flb_sds_destroy(ins->tls_key_passwd);
     }
 
+    if (ins->tls_min_version) {
+        flb_sds_destroy(ins->tls_min_version);
+    }
+
+    if (ins->tls_max_version) {
+        flb_sds_destroy(ins->tls_max_version);
+    }
+
+    if (ins->tls_ciphers) {
+        flb_sds_destroy(ins->tls_ciphers);
+    }
+
     /* release the tag if any */
     flb_sds_destroy(ins->tag);
 
@@ -1311,6 +1332,26 @@ int flb_input_init_all(struct flb_config *config)
             flb_input_instance_destroy(ins);
             return -1;
         }
+
+        if (ins->tls_min_version != NULL || ins->tls_max_version != NULL) {
+            ret = flb_tls_set_minmax_proto(ins->tls, ins->tls_min_version, ins->tls_max_version);
+            if (ret != 0) {
+                flb_error("[input %s] error setting up minmax protocol version of TLS",
+                          ins->name);
+                flb_input_instance_destroy(ins);
+                return -1;
+            }
+        }
+
+        if (ins->tls_ciphers != NULL) {
+            ret = flb_tls_set_ciphers(ins->tls, ins->tls_ciphers);
+            if (ret != 0) {
+                flb_error("[input %s] error setting up TLS ciphers up to TLSv1.2",
+                          ins->name);
+                flb_input_instance_destroy(ins);
+                return -1;
+            }
+        }
     }
 
     return 0;

src/flb_output.c

@@ -115,6 +115,15 @@ static void flb_output_free_properties(struct flb_output_instance *ins)
     if (ins->tls_key_passwd) {
         flb_sds_destroy(ins->tls_key_passwd);
     }
+    if (ins->tls_min_version) {
+        flb_sds_destroy(ins->tls_min_version);
+    }
+    if (ins->tls_max_version) {
+        flb_sds_destroy(ins->tls_max_version);
+    }
+    if (ins->tls_ciphers) {
+        flb_sds_destroy(ins->tls_ciphers);
+    }
 #endif
 }
 
@@ -907,6 +916,15 @@ int flb_output_set_property(struct flb_output_instance *ins,
     else if (prop_key_check("tls.key_passwd", k, len) == 0) {
         flb_utils_set_plugin_string_property("tls.key_passwd", &ins->tls_key_passwd, tmp);
     }
+    else if (prop_key_check("tls.min_version", k, len) == 0) {
+        flb_utils_set_plugin_string_property("tls.min_version", &ins->tls_min_version, tmp);
+    }
+    else if (prop_key_check("tls.max_version", k, len) == 0) {
+        flb_utils_set_plugin_string_property("tls.max_version", &ins->tls_max_version, tmp);
+    }
+    else if (prop_key_check("tls.ciphers", k, len) == 0) {
+        flb_utils_set_plugin_string_property("tls.ciphers", &ins->tls_ciphers, tmp);
+    }
 #endif
     else if (prop_key_check("storage.total_limit_size", k, len) == 0 && tmp) {
         if (strcasecmp(tmp, "off") == 0 ||
@@ -1271,6 +1289,26 @@ int flb_output_init_all(struct flb_config *config)
                     return -1;
                 }
             }
+
+            if (ins->tls_min_version != NULL || ins->tls_max_version != NULL) {
+                ret = flb_tls_set_minmax_proto(ins->tls, ins->tls_min_version, ins->tls_max_version);
+                if (ret != 0) {
+                    flb_error("[output %s] error setting up minmax protocol version of TLS",
+                              ins->name);
+                    flb_output_instance_destroy(ins);
+                    return -1;
+                }
+            }
+
+            if (ins->tls_ciphers != NULL) {
+                ret = flb_tls_set_ciphers(ins->tls, ins->tls_ciphers);
+                if (ret != 0) {
+                    flb_error("[output %s] error setting up TLS ciphers up to TLSv1.2",
+                              ins->name);
+                    flb_output_instance_destroy(ins);
+                    return -1;
+                }
+            }
         }
 #endif
         /*

src/tls/flb_tls.c

@@ -80,6 +80,24 @@ struct flb_config_map tls_configmap[] = {
      "Enable or disable to verify hostname"
     },
 
+    {
+     FLB_CONFIG_MAP_STR, "tls.min_version", NULL,
+     0, FLB_FALSE, 0,
+     "Specify the minimum version of TLS"
+    },
+
+    {
+     FLB_CONFIG_MAP_STR, "tls.max_version", NULL,
+     0, FLB_FALSE, 0,
+     "Specify the maximum version of TLS"
+    },
+
+    {
+     FLB_CONFIG_MAP_STR, "tls.ciphers", NULL,
+     0, FLB_FALSE, 0,
+     "Specify TLS ciphers up to TLSv1.2"
+    },
+
     /* EOF */
     {0}
 };
@@ -209,6 +227,25 @@ struct flb_tls *flb_tls_create(int mode,
     return tls;
 }
 
+int flb_tls_set_minmax_proto(struct flb_tls *tls,
+                             const char *min_version, const char *max_version)
+{
+    if (tls->ctx) {
+        return tls->api->set_minmax_proto(tls, min_version, max_version);
+    }
+
+    return 0;
+}
+
+int flb_tls_set_ciphers(struct flb_tls *tls, const char *ciphers)
+{
+    if (tls->ctx) {
+        return tls->api->set_ciphers(tls, ciphers);
+    }
+
+    return 0;
+}
+
 int flb_tls_init()
 {
     return tls_init();

src/tls/openssl.c

@@ -651,6 +651,122 @@ static void *tls_context_create(int verify,
     return NULL;
 }
 
+#if !defined(TLS1_3_VERSION)
+#  define TLS1_3_VERSION 0x0304
+#endif
+
+struct tls_proto_def {
+    char *name;
+    int ver;
+};
+
+struct tls_proto_options {
+    int ver;
+    int no_opt;
+};
+
+static int parse_proto_version(const char *proto_ver)
+{
+    int i;
+    struct tls_proto_def defs[] = {
+        { "SSLv2", SSL2_VERSION },
+        { "SSLv3", SSL3_VERSION },
+        { "TLSv1", TLS1_VERSION },
+        { "TLSv1.1", TLS1_1_VERSION },
+        { "TLSv1.2", TLS1_2_VERSION },
+#if defined(TLS1_3_VERSION)
+        { "TLSv1.3", TLS1_3_VERSION },
+#endif
+        { NULL, 0 },
+    };
+
+    if (proto_ver == NULL) {
+        return 0;
+    }
+
+    for (i = 0; i < sizeof(defs) / sizeof(struct tls_proto_def); i++) {
+        if (strncasecmp(defs[i].name, proto_ver, strlen(proto_ver)) == 0) {
+            return defs[i].ver;
+        }
+    }
+
+    return -1;
+}
+
+#if defined(TLS1_3_VERSION)
+#define DEFAULT_MAX_VERSION TLS1_3_VERSION
+#else
+#define DEFAULT_MAX_VERSION TLS1_2_VERSION
+#endif
+
+static int tls_set_minmax_proto(struct flb_tls *tls,
+                                const char *min_version,
+                                const char *max_version)
+{
+    int i;
+    unsigned long sum = 0, opts = 0;
+    int min = TLS1_1_VERSION;
+    int max = DEFAULT_MAX_VERSION;
+    int val = -1;
+    struct tls_context *ctx = tls->ctx;
+
+    struct tls_proto_options tls_options[] = {
+        { SSL2_VERSION, SSL_OP_NO_SSLv2 },
+        { SSL3_VERSION, SSL_OP_NO_SSLv3 },
+        { TLS1_VERSION, SSL_OP_NO_TLSv1 },
+        { TLS1_1_VERSION, SSL_OP_NO_TLSv1_1 },
+        { TLS1_2_VERSION, SSL_OP_NO_TLSv1_2 },
+#if defined(TLS1_3_VERSION) && defined(SSL_OP_NO_TLSv1_3)
+        { TLS1_3_VERSION, SSL_OP_NO_TLSv1_3 },
+#endif
+    };
+
+    if (!ctx) {
+        return -1;
+    }
+
+    val = parse_proto_version(min_version);
+    if (val >= 0) {
+        min = val;
+    }
+
+    val = parse_proto_version(max_version);
+    if (val >= 0) {
+        max = val;
+    }
+
+    pthread_mutex_lock(&ctx->mutex);
+
+    for (i = 0; i < sizeof(tls_options) / sizeof(struct tls_proto_options); i++) {
+        sum |= tls_options[i].no_opt;
+        if ((min && min > tls_options[i].ver) ||
+            (max && max < tls_options[i].ver)) {
+            opts |= tls_options[i].no_opt;
+        }
+    }
+    SSL_CTX_clear_options(ctx->ctx, sum);
+    SSL_CTX_set_options(ctx->ctx, opts);
+
+    pthread_mutex_unlock(&ctx->mutex);
+
+    return 0;
+}
+
+static int tls_set_ciphers(struct flb_tls *tls, const char *ciphers)
+{
+    struct tls_context *ctx = tls->ctx;
+
+    pthread_mutex_lock(&ctx->mutex);
+
+    if (!SSL_CTX_set_cipher_list(ctx->ctx, ciphers)) {
+        return -1;
+    }
+
+    pthread_mutex_unlock(&ctx->mutex);
+
+    return 0;
+}
+
 static void *tls_session_create(struct flb_tls *tls,
                                 int fd)
 {
@@ -1043,6 +1159,8 @@ static struct flb_tls_backend tls_openssl = {
     .context_destroy      = tls_context_destroy,
     .context_alpn_set     = tls_context_alpn_set,
     .session_alpn_get     = tls_session_alpn_get,
+    .set_minmax_proto     = tls_set_minmax_proto,
+    .set_ciphers          = tls_set_ciphers,
     .session_create       = tls_session_create,
     .session_destroy      = tls_session_destroy,
     .net_read             = tls_net_read,