From bc52dd84f3619ebf85f12c656f063b57b22a954f Mon Sep 17 00:00:00 2001 From: lecaros Date: Thu, 2 Jul 2026 12:09:04 -0400 Subject: [PATCH 1/2] in_splunk: fix 401/403 responses according to Splunk expected responses Signed-off-by: lecaros --- plugins/in_splunk/splunk_prot.c | 26 ++++++++++++++++++++++---- plugins/in_splunk/splunk_prot.h | 9 +++++---- 2 files changed, 27 insertions(+), 8 deletions(-) diff --git a/plugins/in_splunk/splunk_prot.c b/plugins/in_splunk/splunk_prot.c index 0d81ef26304..455548112fe 100644 --- a/plugins/in_splunk/splunk_prot.c +++ b/plugins/in_splunk/splunk_prot.c @@ -1203,6 +1203,12 @@ static int send_json_message_response_ng(struct flb_http_response *response, else if (http_status == 400) { flb_http_response_set_message(response, "Bad Request"); } + else if (http_status == 401) { + flb_http_response_set_message(response, "Unauthorized"); + } + else if (http_status == 403) { + flb_http_response_set_message(response, "Forbidden"); + } flb_http_response_set_header(response, "content-type", 0, @@ -1250,7 +1256,12 @@ static int validate_auth_header_ng(struct flb_splunk *ctx, struct flb_http_reque } } - return SPLUNK_AUTH_UNAUTHORIZED; + if (strncasecmp(auth_header, "Splunk ", 7) == 0 && + strlen(auth_header) > 7) { + return SPLUNK_AUTH_INVALID_TOKEN; + } + + return SPLUNK_AUTH_INVALID_AUTHORIZATION; } else { return SPLUNK_AUTH_MISSING_CRED; @@ -1388,12 +1399,19 @@ int splunk_prot_handle_ng(struct flb_http_request *request, ret = validate_auth_header_ng(context, request); if (ret < 0) { - send_response_ng(response, 401, "error: unauthorized\n"); - if (ret == SPLUNK_AUTH_MISSING_CRED) { + send_json_message_response_ng(response, 401, + "{\"text\":\"Token is required\",\"code\":2}"); flb_plg_warn(context->ins, "missing credentials in request headers"); } - else if (ret == SPLUNK_AUTH_UNAUTHORIZED) { + else if (ret == SPLUNK_AUTH_INVALID_AUTHORIZATION) { + send_json_message_response_ng(response, 401, + "{\"text\":\"Invalid authorization\",\"code\":3}"); + flb_plg_warn(context->ins, "invalid authorization in request headers"); + } + else if (ret == SPLUNK_AUTH_INVALID_TOKEN) { + send_json_message_response_ng(response, 403, + "{\"text\":\"Invalid token\",\"code\":4}"); flb_plg_warn(context->ins, "wrong credentials in request headers"); } diff --git a/plugins/in_splunk/splunk_prot.h b/plugins/in_splunk/splunk_prot.h index 5c965155686..bd5306c2dc8 100644 --- a/plugins/in_splunk/splunk_prot.h +++ b/plugins/in_splunk/splunk_prot.h @@ -20,10 +20,11 @@ #ifndef FLB_IN_SPLUNK_PROT #define FLB_IN_SPLUNK_PROT -#define SPLUNK_AUTH_UNAUTH 1 -#define SPLUNK_AUTH_SUCCESS 0 -#define SPLUNK_AUTH_MISSING_CRED -1 -#define SPLUNK_AUTH_UNAUTHORIZED -2 +#define SPLUNK_AUTH_UNAUTH 1 +#define SPLUNK_AUTH_SUCCESS 0 +#define SPLUNK_AUTH_MISSING_CRED -1 +#define SPLUNK_AUTH_INVALID_AUTHORIZATION -2 +#define SPLUNK_AUTH_INVALID_TOKEN -3 #define SPLUNK_XFF_HEADER "x-forwarded-for" From 946ecc885c1ce6fdbbee7c70eb279d4fe5f658e6 Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Wed, 8 Jul 2026 14:35:09 +0900 Subject: [PATCH 2/2] in_splunk: Follow the marco changes for invalid authorization circumstance Signed-off-by: Hiroshi Hatake --- plugins/in_splunk/splunk_prot.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/plugins/in_splunk/splunk_prot.c b/plugins/in_splunk/splunk_prot.c index 455548112fe..e0f055f90c1 100644 --- a/plugins/in_splunk/splunk_prot.c +++ b/plugins/in_splunk/splunk_prot.c @@ -656,7 +656,7 @@ static int validate_auth_header(struct flb_splunk *ctx, struct mk_http_request * mk_list_foreach(head, &ctx->auth_tokens) { splunk_token = mk_list_entry(head, struct flb_splunk_tokens, _head); if (flb_sds_len(authorization) != splunk_token->length) { - ret = SPLUNK_AUTH_UNAUTHORIZED; + ret = SPLUNK_AUTH_INVALID_AUTHORIZATION; continue; } @@ -669,7 +669,7 @@ static int validate_auth_header(struct flb_splunk *ctx, struct mk_http_request * } } - ret = SPLUNK_AUTH_UNAUTHORIZED; + ret = SPLUNK_AUTH_INVALID_AUTHORIZATION; flb_sds_destroy(authorization); return ret; } @@ -989,7 +989,7 @@ int splunk_prot_handle(struct flb_splunk *ctx, struct splunk_conn *conn, if (ret == SPLUNK_AUTH_MISSING_CRED) { flb_plg_warn(ctx->ins, "missing credentials in request headers"); } - else if (ret == SPLUNK_AUTH_UNAUTHORIZED) { + else if (ret == SPLUNK_AUTH_INVALID_AUTHORIZATION) { flb_plg_warn(ctx->ins, "wrong credentials in request headers"); }