Skip to content

Commit 875e225

Browse files
taylor-swansontaylor-swanson
authored
[checkpoint] Add TLS and custom options support to TCP input (#3317)
- Add TLS support to TCP input - Add TCP custom options to TCP input - Add system tests for TCP/TLS input
1 parent de7916e commit 875e225

7 files changed

Lines changed: 121 additions & 5 deletions

File tree

‎packages/checkpoint/_dev/deploy/docker/docker-compose.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,18 @@ services:
66
- ./sample_logs:/sample_logs:ro
77
- ${SERVICE_LOGS_DIR}:/var/log
88
command: /bin/sh -c "cp /sample_logs/* /var/log/"
9+
checkpoint-firewall-tls:
10+
image: docker.elastic.co/observability/stream:v0.6.2
11+
volumes:
12+
- ./sample_logs:/sample_logs:ro
13+
command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9515 -p=tls --insecure /sample_logs/test-checkpoint.log
914
checkpoint-firewall-tcp:
10-
image: akroh/stream:v0.0.1
15+
image: docker.elastic.co/observability/stream:v0.6.2
1116
volumes:
1217
- ./sample_logs:/sample_logs:ro
1318
command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9514 -p=tcp /sample_logs/test-checkpoint.log
1419
checkpoint-firewall-udp:
15-
image: akroh/stream:v0.0.1
20+
image: docker.elastic.co/observability/stream:v0.6.2
1621
volumes:
1722
- ./sample_logs:/sample_logs:ro
1823
command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9515 -p=udp /sample_logs/test-checkpoint.log

‎packages/checkpoint/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.5.0"
3+
changes:
4+
- description: Add TLS and custom options support to TCP input.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/3317
27
- version: "1.4.0"
38
changes:
49
- description: Update to ECS 8.2 to use new email field set.

‎packages/checkpoint/data_stream/firewall/_dev/test/system/test-tls-config.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
service: checkpoint-firewall-tls
2+
service_notify_signal: SIGHUP
3+
input: tcp
4+
vars:
5+
syslog_host: 0.0.0.0
6+
syslog_port: 9515
7+
data_stream:
8+
vars:
9+
ssl: |
10+
key: |
11+
-----BEGIN PRIVATE KEY-----
12+
MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDhCLvLsQAHufsN
13+
U+u1x/CequAUphfXZqLhDo2Eo/holfBS0+ey4bnzPL6lS9NFL5JkLQA2gYESqsXU
14+
/Ru8E76Az1egzMwT3TVAPLVU8NbrxBqeNiQa2m9wC37HQy4qC9OxL28LUoKtFjxS
15+
cD1sa0oikXCJN1a3BSoAf9iiZ/dxz4WVfrNhrzq2JFXjravY84n5ujkZOg45Pg70
16+
4vHOeg0rBbIoSNfjDUVZWjwC95K1BMN3msOTL9juv/EDa6BujqCxl+G1nY7JPFDL
17+
SHWis65p+1AAa5xieYDb47vyJ0SSR7lEURTXZOkkM6k5JWfgkATEmGzRxPkOloIT
18+
Xg9ag1OlAgMBAAECggEAEHfPJmzhj68wjB0kFr13AmWG2Hv/Kqg8KzQhbx+AwkaW
19+
u7j+L70NGpvLZ9VQtLNyhxoz9cksZO1SZO/Q48aeHlcOFppmJN3/U6AdtQWa9M35
20+
FLLpmX16wjxVHsfvzOvopgLOoYl8PqZt66qDFDgVyMnT7na6RdJ+7GJuvBPXq+Bc
21+
vgThvAZitHSAOhnBFYmTMlBi6AzOMMsaFlgE3Xf9v3M0pAKItPRKMhXlC3MyvA/v
22+
jgbra4Ib+0ryohggHheHB3bn3Jgv7iFKoW9OQSePVxacJ+kfr9H+No5g495URzqR
23+
mx/96WCiv3rAh3ct8Sk/C4/3zMC8fUueDJIVjhgw0QKBgQD8NufLINNkIpBrLoCS
24+
972oFEjZB2u6EusQ7X9raROqpaw26ZSu+zSHeIKCGQ93M3aRb3FpdGeOxgZ095MV
25+
8a+nlh4stOvHj2Mm5YhTBDUavTC7o9aVR3Od5eTXUpHnaJpNI/uyIcKupeK1UJnV
26+
UlBLeIwo/vJ1gsVrKMMAJkuKbwKBgQDkaWRRd0w2gUIbCTGf203BqXft0VdIiOW7
27+
+gnkeaNHAf09XljzxMcQzrB8kG63aKVGbJffphEfzxtiJ+HRQVH+7QpKRhU/GHmu
28+
+6OKkxTcxJm5zhoRFxcSi2wG4PWmUGJvc7ss1OJGcaOUxwocCepO7N/jfdDz9Uke
29+
KnA+YWOdKwKBgQDteZkYlojT0QOgF8HyH5gQyUCqMKWLJ0LzxltiPCbLV4Dml1pq
30+
w5Z7M8nWS1hXiTpLx93GSFc1hFkSCwYP9GfK6Lryp0sVtHnMZvTMDbseuSJImwRx
31+
vDwtYQfugg1lEQWwOoBEAiu3m/PxernNtNprpU57T0nlwUK3GkM5QdWAuwKBgQCZ
32+
ZF3GiANapzupxGbbH//8Cr9LqsafI7CEqMpz8WxBh4h16iJ6sq+tDeFgBe8UpOY5
33+
gTwNKg1d+0w8guQYD3HtbWr3rlEeamVtqfiOW3ArQqyqJ0tCJuuLvK3zgKf35Qv2
34+
JRaSaPT8sdxVUcXsRoxgLJu+vwPQke1koMN4YRbwuQKBgQDJiZ/WSeqa5oIqkXbn
35+
hjm7RXKaf2oE1U/bNjdSFtdEP7T4vUvvr7Hq2f/jiBLtCE7w16PJjKx9iIq2+jMl
36+
qIY43Sk9bdi5FxtYTHda0hwrbH274P+QVcVs5PXCT0TGktOleHGBlXaaPrxl9iCh
37+
8tmmxZZYa5aQxEO/lxB9xQKaiQ==
38+
-----END PRIVATE KEY-----
39+
certificate: |
40+
-----BEGIN CERTIFICATE-----
41+
MIIDazCCAlOgAwIBAgIUW5TDu1tJMY2Oa7PsL+BQSmeWqz0wDQYJKoZIhvcNAQEL
42+
BQAwRTELMAkGA1UEBhMCVVMxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
43+
GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yMTEwMDEwNTAwMjNaFw0yMTEw
44+
MDIwNTAwMjNaMEUxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
45+
HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB
46+
AQUAA4IBDwAwggEKAoIBAQDhCLvLsQAHufsNU+u1x/CequAUphfXZqLhDo2Eo/ho
47+
lfBS0+ey4bnzPL6lS9NFL5JkLQA2gYESqsXU/Ru8E76Az1egzMwT3TVAPLVU8Nbr
48+
xBqeNiQa2m9wC37HQy4qC9OxL28LUoKtFjxScD1sa0oikXCJN1a3BSoAf9iiZ/dx
49+
z4WVfrNhrzq2JFXjravY84n5ujkZOg45Pg704vHOeg0rBbIoSNfjDUVZWjwC95K1
50+
BMN3msOTL9juv/EDa6BujqCxl+G1nY7JPFDLSHWis65p+1AAa5xieYDb47vyJ0SS
51+
R7lEURTXZOkkM6k5JWfgkATEmGzRxPkOloITXg9ag1OlAgMBAAGjUzBRMB0GA1Ud
52+
DgQWBBRYUSKDHBBE9Q6fTeTqogicCxcXwDAfBgNVHSMEGDAWgBRYUSKDHBBE9Q6f
53+
TeTqogicCxcXwDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBc
54+
T8B+GpvPy9NQ700LsywRPY0L9IJCKiu6j3TP1tqqSPjAC/cg9ac+bFXuWOu7V+KJ
55+
s09Q/pItq9SLX6UvnfRzTxu5lCBwwGX9cL131mTIu5SmFo7Eks+sorbiIarWDMoC
56+
e+9An3GFpagW+YhOt4BdIM5lTqoeodzganDBsOUZI9aDAj2Yo5h2O7r6Wd12cb6T
57+
mz8vMfB2eG8BxU20ZMfkdERWjiyXHOSBQqeqfkV8d9370gMu5RcJNcIgnbmTRdho
58+
X3HJFiimZVaNjXATqmC/y2A1KXvJdamPLy3mGXkW2cFLoPCdK2OZFUHqiuc1bigA
59+
qEf55SihFqErRMeURPPF
60+
-----END CERTIFICATE-----

‎packages/checkpoint/data_stream/firewall/agent/stream/tcp.yml.hbs‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ tags:
99
{{#contains "forwarded" tags}}
1010
publisher_pipeline.disable_host: true
1111
{{/contains}}
12+
{{#if ssl}}
13+
ssl: {{ssl}}
14+
{{/if}}
1215
processors:
1316
- add_locale: ~
1417
{{#if processors}}
@@ -31,4 +34,7 @@ processors:
3134
{{#each external_zones as |zone i|}}
3235
- {{zone}}
3336
{{/each}}
34-
{{/if}}
37+
{{/if}}
38+
{{#if tcp_options.length}}
39+
{{tcp_options}}
40+
{{/if}}

‎packages/checkpoint/data_stream/firewall/agent/stream/udp.yml.hbs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,4 @@ processors:
3131
{{#each external_zones as |zone i|}}
3232
- {{zone}}
3333
{{/each}}
34-
{{/if}}
34+
{{/if}}

‎packages/checkpoint/data_stream/firewall/manifest.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,46 @@ streams:
5858
description: >
5959
Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.
6060
61+
- name: ssl
62+
type: yaml
63+
title: SSL Configuration
64+
description: i.e. certificate_authorities, supported_protocols, verification_mode etc.
65+
multi: false
66+
required: false
67+
show_user: false
68+
default: |
69+
#certificate_authorities:
70+
# - |
71+
# -----BEGIN CERTIFICATE-----
72+
# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF
73+
# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2
74+
# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB
75+
# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n
76+
# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl
77+
# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t
78+
# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP
79+
# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41
80+
# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O
81+
# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux
82+
# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D
83+
# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw
84+
# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA
85+
# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu
86+
# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0
87+
# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk
88+
# sxSmbIUfc2SGJGCJD4I=
89+
# -----END CERTIFICATE-----
90+
- name: tcp_options
91+
type: yaml
92+
title: Custom TCP Options
93+
multi: false
94+
required: false
95+
show_user: false
96+
default: |
97+
#max_connections: 1
98+
#framing: delimitier
99+
#line_delimiter: "\n"
100+
description: Specify custom configuration options for the TCP input.
61101
template_path: tcp.yml.hbs
62102
title: Check Point firewall logs (syslog over TCP)
63103
description: Collect Check Point firewall logs using tcp input

‎packages/checkpoint/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: checkpoint
22
title: Check Point
3-
version: 1.4.0
3+
version: 1.5.0
44
release: ga
55
description: Collect logs from Check Point with Elastic Agent.
66
type: integration

0 commit comments

Comments
 (0)