openssl_verify_mode does not work in mail output with STARTTLS protocol

[IldarMinaev]

There is an issue in mail-2.5.3 lib (logstash used it), that cause error in mail delivery via STARTTLS protocol with disabled hostname verification.
This issue currently resolved in new version (2.6.3: https://rubygems.org/gems/mail/versions/2.6.3), see the code: https://github.com/mikel/mail/blob/master/lib/mail/network/delivery_methods/smtp.rb).
To add openssl_verify_mode to logstash see my updates in the file https://github.com/IldarMinaev/files/blob/master/logstash/lib/logstash/outputs/email.rb
So, config can be following:

email {
             from => "logstash@domain.com"
             to => "recepient@domain.com;"
             subject => "tmp"
             body => [ "tmp" ]
             via => "smtp"
             options => [ "smtpIporHost", "mailhost.domain.com",
                                  "port", "25",
                                  "domain", "domain.com",
                                  "starttls", "true",
                                  "debug", "true",
                                  "openssl_verify_mode", 'none']
}

I have mannually fixed this issue in mail-2.5.3 lib (see: https://github.com/IldarMinaev/files/blob/master/logstash/vendor/bundle/jruby/1.9/gems/mail-2.5.3/lib/mail/network/delivery_methods/smtp.rb)

My question:
If you planned to update gems libs in Logstash?
Could you add openssl_verify_mode propertie to 'mail' output Logstash plugin?

[ph]

Hello,
The latest version of logstash RC2, ship with mail 2.6.3,
Concerning the openssl_verify_mode would you mind creating an issue for it on the plugin repository? http://github.com/logstash-plugins/logstash-output-email, I understand the need for flexibility but I think there is some security implication in this change and we would benefit other people to comment on it.

[IldarMinaev]

Thanks for info about RC2. I'll try it.

I have submit pull-request for it:
logstash-plugins/logstash-output-email#14
The default value for this option is peer. So the security implication would be only in case when user change it to 'none'.
This option is very useful for test purpose and, as in my scenario, when DNS not reachable from Logstash and connection established by IP address.

[jordansissel]

For Logstash 1.5.0, we've moved all plugins to individual repositories, so I have moved this issue to logstash-plugins/logstash-output-email#23. Let's continue the discussion there! :)