feat(inputs.x509_cert): Add support for JKS and PKCS#12 keystores #16508
Conversation
Signed-off-by: Paulo Dias <[email protected]>
Signed-off-by: Paulo Dias <[email protected]>
telegraf-tiger
bot
added
feat
|
@paulojmdias please check the linter issues. You can reproduce them locally using |
Signed-off-by: Paulo Dias <[email protected]>
Fixed 🙌 |
paulojmdias
changed the title
There was a problem hiding this comment.
Thanks for your contribution @paulojmdias! This is very much appreciated! I do have some comments in the code...
srebhan
changed the title
Signed-off-by: Paulo Dias <[email protected]>
Signed-off-by: Paulo Dias <[email protected]>
Signed-off-by: Paulo Dias <[email protected]>
Signed-off-by: Paulo Dias <[email protected]>
Signed-off-by: Paulo Dias <[email protected]>
|
|
||
| _, cert, caCerts, err := pkcs12.DecodeChain(data, passwordStr) | ||
| if err != nil { | ||
| _, cert, caCerts, err = pkcs12.DecodeChain(data, "") // Retry without password |
There was a problem hiding this comment.
Why is this required? The user can specify an empty password if he needs to, so don't try to be smart here as this usually calls for trouble. ;-)
There was a problem hiding this comment.
Make sense to set the default password as "" in Init() instead of the user explicitly adding it to the configuration? Or by default is "" if is not set?
| err = jks.Store(output, []byte("test-password")) | ||
| require.NoError(t, err) | ||
|
|
||
| return "jks://" + jksPath |
There was a problem hiding this comment.
This doesn't work on Windows, you should do
| return "jks://" + jksPath | |
| jksPath = filepath.ToSlash(jksPath) | |
| if !strings.HasPrefix(jksPath, "/") { | |
| jksPath = "/" + jksPath | |
| } | |
| return "jks://" + jksPath |
There was a problem hiding this comment.
Fixed also pkcs12Path
There was a problem hiding this comment.
This still seems to be not working on Windows. The code below will not make it work using absolute paths?
absPath, err := filepath.Abs(jksPath)
require.NoError(t, err)
return "jks://" + absPathSigned-off-by: Paulo Dias <[email protected]>
Signed-off-by: Paulo Dias <[email protected]>
Signed-off-by: Paulo Dias <[email protected]>
Signed-off-by: Paulo Dias <[email protected]>
Signed-off-by: Paulo Dias <[email protected]>
Signed-off-by: Paulo Dias <[email protected]>
Signed-off-by: Paulo Dias <[email protected]>
Signed-off-by: Paulo Dias <[email protected]>
Signed-off-by: Paulo Dias <[email protected]>
Signed-off-by: Paulo Dias <[email protected]>
Signed-off-by: Paulo Dias <[email protected]>
Signed-off-by: Paulo Dias <[email protected]>
Signed-off-by: Paulo Dias <[email protected]>
Signed-off-by: Paulo Dias <[email protected]>
Signed-off-by: Paulo Dias <[email protected]>
|
Download PR build artifacts for linux_amd64.tar.gz, darwin_arm64.tar.gz, and windows_amd64.zip. 📦 Click here to get additional PR build artifactsArtifact URLs |
Summary
I initially thought about creating a separate input plugin for JKS & PKCS12 key stores but decided to integrate it into x509_cert since the changes were minimal. This update allows x509_cert to automatically detect and parse JKS & PKCS12 files while maintaining the existing certificate validation and metric collection logic. I also added tests to ensure everything works smoothly without overcomplicating the code.
Please evaluate if make sense and let me know what changes you feel are needed to accommodate this feature.
Checklist
Related issues
resolves #7013