From 153f1739897f03edff1f8432c23d629f6e5b0df4 Mon Sep 17 00:00:00 2001
From: Daniel Linsley <dlinsley@users.noreply.github.com>
Date: Tue, 21 Jul 2026 12:21:48 -0700
Subject: [PATCH] fail deploy when RELP transport is combined with TLS

RELP has no TLS support in this release: TLS directives only affect
the omfwd module (TCP/UDP), and RELP's legacy selector syntax has no
TLS parameters. Previously transport: relp + tls_enabled: true
rendered and deployed successfully while silently shipping logs in
cleartext. Raise a template error instead, mirroring the existing
UDP+TLS guard, for both the primary transport and RELP fallback
servers. Also fix relp-tls.yml, which omitted syslog.address/port and
so never actually exercised the relp transport.
---
 .../syslog-release-forwarding-rules.conf.erb      |  1 +
 .../syslog-release-forwarding-setup.conf.erb      |  5 ++++-
 tests/acceptance_test.go                          | 15 ++++++++++-----
 tests/manifests/relp-tls.yml                      |  2 ++
 4 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/jobs/syslog_forwarder/templates/syslog-release-forwarding-rules.conf.erb b/jobs/syslog_forwarder/templates/syslog-release-forwarding-rules.conf.erb
index 892ba42f8..6846133c0 100644
--- a/jobs/syslog_forwarder/templates/syslog-release-forwarding-rules.conf.erb
+++ b/jobs/syslog_forwarder/templates/syslog-release-forwarding-rules.conf.erb
@@ -38,6 +38,7 @@ $ActionExecOnlyWhenPreviousIsSuspended on
           syslog_fallback_transport = fallback_server.fetch('transport')
         %>
         <% if syslog_fallback_transport == 'relp' %>
+        <% raise "TLS is not supported for RELP fallback servers. Change fallback transport to TCP, or disable syslog.tls_enabled." if p('syslog.tls_enabled') %>
 $ModLoad omrelp
 :omrelp:<%= syslog_fallback_address %>:<%= syslog_fallback_port %>;SyslogForwarderTemplate
         <% elsif syslog_fallback_transport == 'tcp' %>
diff --git a/jobs/syslog_forwarder/templates/syslog-release-forwarding-setup.conf.erb b/jobs/syslog_forwarder/templates/syslog-release-forwarding-setup.conf.erb
index e02c0c989..dda7d9853 100644
--- a/jobs/syslog_forwarder/templates/syslog-release-forwarding-setup.conf.erb
+++ b/jobs/syslog_forwarder/templates/syslog-release-forwarding-setup.conf.erb
@@ -69,7 +69,10 @@ $ActionQueueType LinkedList            # Allocate on-demand
 <% if p('syslog.tls_enabled') %>
   <%
     if syslog_transport == 'udp'
-      raise "TLS is not supported with UDP. Change transport to TCP or RELP, or disable TLS."
+      raise "TLS is not supported with UDP. Change transport to TCP, or disable TLS."
+    end
+    if syslog_transport == 'relp'
+      raise "TLS is not supported with RELP in this release. Change transport to TCP, or disable TLS."
     end
     ca_cert_path = '/etc/ssl/certs/ca-certificates.crt'
 
diff --git a/tests/acceptance_test.go b/tests/acceptance_test.go
index 68345e823..511602c77 100644
--- a/tests/acceptance_test.go
+++ b/tests/acceptance_test.go
@@ -234,15 +234,20 @@ var _ = Describe("Forwarding loglines to a TCP syslog drain", func() {
 	})
 
 	Context("when TLS is configured over relp", func() {
-		BeforeEach(func() {
-			Cleanup()
-			DeployWithVarsStore("manifests/relp-tls.yml")
-		})
 		AfterEach(func() {
 			Cleanup()
 		})
 
-		TestSharedBehavior()
+		It("will fail the deploy, since RELP does not support TLS in this release", func() {
+			By("Deploying")
+
+			session := BoshCmd("deploy", "manifests/relp-tls.yml",
+				"-v", fmt.Sprintf("deployment=%s", DeploymentName()),
+				fmt.Sprintf("--vars-store=/tmp/%s-vars.yml", DeploymentName()),
+				"-v", fmt.Sprintf("stemcell-os=%s", StemcellOS()))
+			Eventually(session, 10*time.Minute).Should(gexec.Exit(1))
+			Eventually(BoshCmd("locks")).ShouldNot(gbytes.Say(DeploymentName()))
+		})
 	})
 
 	Context("when TLS is configured and mTLS is enforced", func() {
diff --git a/tests/manifests/relp-tls.yml b/tests/manifests/relp-tls.yml
index 9912c8888..d8f81f844 100644
--- a/tests/manifests/relp-tls.yml
+++ b/tests/manifests/relp-tls.yml
@@ -25,6 +25,8 @@ instance_groups:
         release: syslog
         properties:
           syslog:
+            address: "storer.default.((deployment)).bosh"
+            port: 514
             transport: "relp"
             tls_enabled: true
             permitted_peer: "*.storer.default.((deployment)).bosh"