input: add option for verifying client certificates in TLS settings

Signed-off-by: Edward Lancaster <edward.lancaster@siemens.com>

Author: edbingo

include/fluent-bit/flb_input.h

@@ -446,6 +446,7 @@ struct flb_input_instance {
     /* TLS settings */
     int use_tls;                         /* bool, try to use TLS for I/O */
     int tls_verify;                      /* Verify certs (default: true) */
+    int tls_verify_client;               /* Verify client certs (default: false) */
     int tls_verify_hostname;             /* Verify hostname (default: false) */
     int tls_debug;                       /* mbedtls debug level          */
     char *tls_vhost;                     /* Virtual hostname for SNI     */

src/flb_input.c

@@ -400,6 +400,7 @@ struct flb_input_instance *flb_input_new(struct flb_config *config,
         instance->tls                   = NULL;
         instance->tls_debug             = -1;
         instance->tls_verify            = FLB_TRUE;
+        instance->tls_verify_client     = FLB_FALSE;
         instance->tls_verify_hostname   = FLB_FALSE;
         instance->tls_vhost             = NULL;
         instance->tls_ca_path           = NULL;
@@ -663,6 +664,14 @@ int flb_input_set_property(struct flb_input_instance *ins,
         ins->tls_verify = flb_utils_bool(tmp);
         flb_sds_destroy(tmp);
     }
+    else if (prop_key_check("tls.verify_client_cert", k, len) == 0 && tmp) {
+        ret = flb_utils_bool(tmp);
+        flb_sds_destroy(tmp);
+        if (ret == -1) {
+            return -1;
+        }
+        ins->tls_verify_client = ret;
+    }
     else if (prop_key_check("tls.verify_hostname", k, len) == 0 && tmp) {
         ins->tls_verify_hostname = flb_utils_bool(tmp);
         flb_sds_destroy(tmp);
@@ -1390,6 +1399,16 @@ int flb_input_instance_init(struct flb_input_instance *ins,
                 return -1;
             }
         }
+
+        if (ins->tls_verify_client == FLB_TRUE) {
+            ret = flb_tls_set_verify_client(ins->tls, ins->tls_verify_client);
+            if (ret == -1) {
+                flb_error("[input %s] error set up to verify client certificate in TLS context",
+                          ins->name);
+
+                return -1;
+            }
+        }
     }
 
     struct flb_config_map *m;