Opensearch output: Configuration setting `AWS_Auth true` fails silently
- Dominant language
- C
- Stars
- 8.1k
- Forks
- 2k
- Avg merge
- 4d 20h
- Merged PRs (30d)
- 71
Description
## Bug Report
Using `AWS_Auth` with the value `true` is silently ignored and treated as `false`.
Requests to Opensearch are not signed and fail with a 401 response code.
**To Reproduce**
- Set `AWS_Auth true` in the opensearch output configuration
**Expected behavior**
As the documentation states, `On` and `true` should behave identically i.e. as a boolean value.
This seems to be the case everywhere else; the expected behavior therefore is this setting working with `true` as well. Or, at the very least, it should log an error when the given value cannot be parsed.
**Additional context**
In addition to `true` failing silently, available debug output doesn't indicate that requests to Opensearch are unsigned, as far as I can tell.
It seems the config is parsed as a string using `strncasecmp(tmp, "On", 2)` here:
https://github.com/fluent/fluent-bit/blob/master/plugins/out_opensearch/os_conf.c#L247
This has already been reported, but apparently, it was auto-closed after a few weeks: #10228.
Contributor guide
Research direction
Start in plugins/out_opensearch/os_conf.c at the parsing code around line 247 and compare how AWS_Auth values are handled. Reproduce with AWS_Auth true, then verify that it behaves like On and that an unparseable value is not silently accepted; requests should be signed instead of returning 401.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, c
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 72/100