Logstash-output-syslog-3.0.5 not sending UDP over IPv6

Elastic Stack Logstash
1

I'm trying to use logstash-output-syslog-3.0.5 with protocol UDP and an IPv6 address.

It fails in connect, at line 209 of logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-syslog-3.0.5/lib/logstash/outputs/syslog.rb:

i.e.

208: socket = UDPSocket.new
209: socket.connect(@host, @port) <-- fails here, if @host is an IPv6 address.

If I change line 208 to explicitly use IPv6 it works.

i.e.

208: socket = UDPSocket.new(Socket::AF_INET6)
209: socket.connect(@host, @port) <-- this now works when @host is an IPv6 address.

Presumably, I've now broken it for IPv4, which isn't an issue for me, but a proper fix should handle both IPv4 and IPv6.

Absent my change, it works with IPv4, and it works with TCP, it's just the combination of UDP and IPv6 that fails.

2

It seems that the plugin only supports UDP with IPv4 and would need some changes to support both.

I do not know much about ruby, but looking at how other plugins deals with that, maybe it is a simple change.

For example, the logstash-input-syslog plugins use the following line to create a new UDP socket.

 @udp = UDPSocket.new (IPAddr.new(@host).ipv6? rescue nil) ? Socket::AF_INET6 : Socket::AF_INET

So, maybe if you change the logstash-output-syslog line 208 to:

socket =  UDPSocket.new (IPAddr.new(@host).ipv6? rescue nil) ? Socket::AF_INET6 : Socket::AF_INET

It would work with UDP for both IPv4 and IPv6.

Can you test that? If it work maybe you can submit a pull request to github.

The logstash-input-udp has a similar approach where it also tests if the IP address is a IPv6 or IPv4.

    if IPAddr.new(@host).ipv6?
      @udp = UDPSocket.new(Socket::AF_INET6)
    elsif IPAddr.new(@host).ipv4?
      @udp = UDPSocket.new(Socket::AF_INET)
    end
3

The logstash-input-udp approach looks cleaner.

Except that, and maybe I'm missing something, IPAddr.new only seems to work for numeric IP addresses - it fails if given a hostname.

I suppose it would be possible to try IPv4 and then if that fails, start over and try IPv6. Hardly elegant.

The other thing that module needs is error messages and maybe some extra info or debug messages.

4

Defect raised: logstash-output-syslog-3.0.5 with protocol UDP and an IPv6 address fails in connect · Issue #60 · logstash-plugins/logstash-output-syslog · GitHub

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.