logstash logshipper TLS denial of service

[jmschmaus]

Logstash 5.3 uses jruby-openssl 0.9.16 for SSL/TLS. jruby-openssl SSLSocket.java does SSL handshake. SSLSocket will not return until the SSL handshake is complete. Logstash will not do another accept on the TLS socket until SSL handshake is complete. If a non-TLS client connects to logstash's TLS port, the port is hung and unusable for any other clients.

For all general issues, please provide the following details for fast resolution:

• Version: 5.3.0
• Operating System: CentOS 6
• Config File (if you have sensitive info, please remove it): Please see below for TLS configuration
• Sample Data:
• Steps to Reproduce:

1. Configure ssl for logshipper tcp input:

input {
...
tcp {
host => "0.0.0.0"
type => "tcp_json_event"
port => "10059"
ssl_enable => true # This needs to be true for the other ssl parameters to be considered
ssl_verify => false # Don't validate the cert against the CA. Useful for self signed certs
ssl_cert => "ssl cert" # SSL Cert
ssl_key => "ssl key"
ssl_extra_chain_certs => "trusted cert" # CA certs
codec => json_lines{
charset => "ISO-8859-1"
}
..

2. Verify TLS operation via openssl s_client -connect localhost:10059

3. Open non-TLS connection to port 10059, configured for TLS:
   nc localhost 10059

4. Verify SSL handshake no longer operational (step (2)).

[jakelandis]

@jmschmaus - Thanks for the issue report and steps to reproduce.

I agree this is an issue that should be addressed, and would fall under the TCP input plugin. Would you mind moving the issue over to https://github.com/logstash-plugins/logstash-input-tcp/issues ?

[jmschmaus]

Thanks Jake! I didn’t know how to move it so I created a new ticket: logstash-plugins/logstash-input-tcp#77 <logstash-plugins/logstash-input-tcp#77> and pasted description from the original. Hope that’s OK. John

…

On Jul 11, 2017, at 5:21 PM, Jake Landis ***@***.***> wrote: @jmschmaus <https://github.com/jmschmaus> - Thanks for the issue report and steps to reproduce. I agree this is an issue that should be addressed, and would fall under the TCP input plugin. Would you mind moving the issue over to https://github.com/logstash-plugins/logstash-input-tcp/issues <https://github.com/logstash-plugins/logstash-input-tcp/issues> ? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#7650 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AX0t6YwzNTWsMpnfDlp36qonCdQ36UVKks5sNAN1gaJpZM4OUg2P>.

[jakelandis]

@jmschmaus - Perfect thanks!

Closing in favor of logstash-plugins/logstash-input-tcp#77