Skip to content

in_splunk: return Splunk HEC auth status codes [Backport to 4.2] #12071

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cosmo0920 merged 2 commits into from
Jul 8, 2026
+30 −11
Merged

in_splunk: return Splunk HEC auth status codes [Backport to 4.2] #12071

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bc52dd8
in_splunk: fix 401/403 responses according to Splunk expected responses
lecaros Jul 2, 2026
946ecc8
in_splunk: Follow the marco changes for invalid authorization circums…
cosmo0920 Jul 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 25 additions & 7 deletions plugins/in_splunk/splunk_prot.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -656,7 +656,7 @@ static int validate_auth_header(struct flb_splunk *ctx, struct mk_http_request *
mk_list_foreach(head, &ctx->auth_tokens) {
splunk_token = mk_list_entry(head, struct flb_splunk_tokens, _head);
if (flb_sds_len(authorization) != splunk_token->length) {
ret = SPLUNK_AUTH_UNAUTHORIZED;
ret = SPLUNK_AUTH_INVALID_AUTHORIZATION;
continue;
}

Expand All @@ -669,7 +669,7 @@ static int validate_auth_header(struct flb_splunk *ctx, struct mk_http_request *
}
}

ret = SPLUNK_AUTH_UNAUTHORIZED;
ret = SPLUNK_AUTH_INVALID_AUTHORIZATION;
flb_sds_destroy(authorization);
return ret;
}
Expand Down Expand Up @@ -989,7 +989,7 @@ int splunk_prot_handle(struct flb_splunk *ctx, struct splunk_conn *conn,
if (ret == SPLUNK_AUTH_MISSING_CRED) {
flb_plg_warn(ctx->ins, "missing credentials in request headers");
}
else if (ret == SPLUNK_AUTH_UNAUTHORIZED) {
else if (ret == SPLUNK_AUTH_INVALID_AUTHORIZATION) {
flb_plg_warn(ctx->ins, "wrong credentials in request headers");
}

Expand Down Expand Up @@ -1203,6 +1203,12 @@ static int send_json_message_response_ng(struct flb_http_response *response,
else if (http_status == 400) {
flb_http_response_set_message(response, "Bad Request");
}
else if (http_status == 401) {
flb_http_response_set_message(response, "Unauthorized");
}
else if (http_status == 403) {
flb_http_response_set_message(response, "Forbidden");
}

flb_http_response_set_header(response,
"content-type", 0,
Expand Down Expand Up @@ -1250,7 +1256,12 @@ static int validate_auth_header_ng(struct flb_splunk *ctx, struct flb_http_reque
}
}

return SPLUNK_AUTH_UNAUTHORIZED;
if (strncasecmp(auth_header, "Splunk ", 7) == 0 &&
strlen(auth_header) > 7) {
return SPLUNK_AUTH_INVALID_TOKEN;
}

return SPLUNK_AUTH_INVALID_AUTHORIZATION;
}
else {
return SPLUNK_AUTH_MISSING_CRED;
Expand Down Expand Up @@ -1388,12 +1399,19 @@ int splunk_prot_handle_ng(struct flb_http_request *request,
ret = validate_auth_header_ng(context, request);

if (ret < 0) {
send_response_ng(response, 401, "error: unauthorized\n");

if (ret == SPLUNK_AUTH_MISSING_CRED) {
send_json_message_response_ng(response, 401,
"{\"text\":\"Token is required\",\"code\":2}");
flb_plg_warn(context->ins, "missing credentials in request headers");
}
else if (ret == SPLUNK_AUTH_UNAUTHORIZED) {
else if (ret == SPLUNK_AUTH_INVALID_AUTHORIZATION) {
send_json_message_response_ng(response, 401,
"{\"text\":\"Invalid authorization\",\"code\":3}");
flb_plg_warn(context->ins, "invalid authorization in request headers");
}
else if (ret == SPLUNK_AUTH_INVALID_TOKEN) {
send_json_message_response_ng(response, 403,
"{\"text\":\"Invalid token\",\"code\":4}");
flb_plg_warn(context->ins, "wrong credentials in request headers");
}

Expand Down
9 changes: 5 additions & 4 deletions plugins/in_splunk/splunk_prot.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,10 +20,11 @@
#ifndef FLB_IN_SPLUNK_PROT
#define FLB_IN_SPLUNK_PROT

#define SPLUNK_AUTH_UNAUTH 1
#define SPLUNK_AUTH_SUCCESS 0
#define SPLUNK_AUTH_MISSING_CRED -1
#define SPLUNK_AUTH_UNAUTHORIZED -2
#define SPLUNK_AUTH_UNAUTH 1
#define SPLUNK_AUTH_SUCCESS 0
#define SPLUNK_AUTH_MISSING_CRED -1
#define SPLUNK_AUTH_INVALID_AUTHORIZATION -2
Comment thread
cosmo0920 marked this conversation as resolved.
#define SPLUNK_AUTH_INVALID_TOKEN -3

#define SPLUNK_XFF_HEADER "x-forwarded-for"

Expand Down
Loading