Sanity/elasticsearch-TLS: add TLS parameter phases for PQC support

[prikryla]

Add test phases for the new omelasticsearch TLS parameters introduced in upstream PR #7278: tls.tlsversion, tls.ciphersuites, and tls.keyexchangegroups. Restructure the test to use the section-replace pattern for multi-phase reconfiguration.

Summary by Sourcery

Add phased TLS integration tests for omelasticsearch with new TLS configuration parameters and reusable helpers.

New Features:

• Introduce multi-phase test coverage for omelasticsearch TLS options including tls.tlsversion, tls.ciphersuites, and tls.keyexchangegroups.
• Add helper functions to reconfigure the omelasticsearch action dynamically and verify message delivery to Elasticsearch over HTTPS.

Tests:

• Restructure the Elasticsearch TLS sanity test to use a replaceable configuration section for omelasticsearch, enabling sequential reconfiguration across TLS parameter phases.
• Add negative test ensuring rsyslog fails to start with an invalid tls.tlsversion value.
• Add conditional PQC hybrid key exchange group test that runs only when the required OpenSSL algorithms are available.

[sourcery-ai]

Reviewer's Guide

Adds multi-phase TLS test coverage for omelasticsearch by restructuring rsyslog configuration to use a replaceable section and introducing helper functions to drive phased testing of new TLS parameters (tls.tlsversion, tls.ciphersuites, tls.keyexchangegroups) and PQC-related key exchange groups.

File-Level Changes

Change	Details	Files
Refactor rsyslog omelasticsearch TLS configuration to use a replaceable section and helper for dynamic reconfiguration across phases.	Introduce configure_omelasticsearch helper that replaces an OMELASTIC config section with a base omelasticsearch action plus optional extra TLS options. Switch from inlined OMES_ACTION to a static RULES block for module/template and a separate replaceable OMELASTIC section for the action. Ensure effective rsyslog config is printed after each configure_omelasticsearch invocation and adjust service management to stop/start rsyslog around section replacements.	Sanity/elasticsearch-TLS/runtest.sh
Add reusable send_and_verify helper to exercise rsyslog-to-Elasticsearch path with unique messages.	Add a function that logs a given message, waits briefly, queries Elasticsearch via curl, asserts presence of the message field and content, and cleans up the temporary rlRun log. Replace the previous single hard-coded message and assertions with calls to this helper so all phases share the same verification logic.	Sanity/elasticsearch-TLS/runtest.sh
Introduce phased tests to validate new omelasticsearch TLS parameters, including PQC-ready key exchange groups.	Add a basic TLS baseline phase that verifies message delivery over HTTPS using the default omelasticsearch TLS configuration. Add tls.tlsversion success and failure phases: one enforcing TLSv1.3 and verifying delivery, another setting an invalid value and asserting rsyslog startup failure before restoring valid config. Add a tls.ciphersuites phase that configures a specific TLS 1.3 cipher (TLS_AES_256_GCM_SHA384) and verifies delivery. Add a tls.keyexchangegroups phase that configures X25519MLKEM768:X25519 hybrid KEX when supported by OpenSSL, skipping the phase otherwise, and verifies message delivery. Minor whitespace and formatting cleanups in the script to normalize spacing and comments.	Sanity/elasticsearch-TLS/runtest.sh Sanity/elasticsearch-TLS/main.fmf

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

• The send_and_verify helper uses a fixed sleep 15, which may be either excessive or flaky depending on environment; consider a loop with shorter sleeps and a bounded retry window to make the check more robust and faster when ES responds quickly.
• In the PQC phase, the openssl list -kem-algorithms | grep X25519MLKEM768 check will treat any failure of the openssl list subcommand the same as “algorithm not found”; consider explicitly guarding for missing/unsupported list -kem-algorithms (e.g., checking OpenSSL version or return code) before deciding to skip or run the test.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The `send_and_verify` helper uses a fixed `sleep 15`, which may be either excessive or flaky depending on environment; consider a loop with shorter sleeps and a bounded retry window to make the check more robust and faster when ES responds quickly.
- In the PQC phase, the `openssl list -kem-algorithms | grep X25519MLKEM768` check will treat any failure of the `openssl list` subcommand the same as “algorithm not found”; consider explicitly guarding for missing/unsupported `list -kem-algorithms` (e.g., checking OpenSSL version or return code) before deciding to skip or run the test.

## Individual Comments

### Comment 1
<location path="Sanity/elasticsearch-TLS/runtest.sh" line_range="62-63" />
<code_context>
+    local msg="$1"
+    rlRun "logger '${msg}'"
+    rlRun "sleep 15"
+    rlRun -s "curl $CURL_TLS_OPTS -u elastic:$ELASTIC_PASSWORD -XGET 'https://127.0.0.1:9200/_all/_search?q=${msg}&pretty'"
+    rlAssertGrep "\"message\"" "$rlRun_LOG"
+    rlAssertGrep "${msg}" "$rlRun_LOG"
+    rm -f "$rlRun_LOG"
</code_context>
<issue_to_address>
**issue (bug_risk):** The `${msg}` placeholder in the curl URL is never expanded due to single quotes around the URL.

In `send_and_verify`, the URL is single-quoted (`'https://127.0.0.1:9200/_all/_search?q=${msg}&pretty'`), so `${msg}` is not expanded and every search uses the literal `${msg}` query. This makes the test assertions unreliable. Please allow variable expansion by dropping the single quotes or switching to double quotes, e.g.:

```sh
rlRun -s "curl $CURL_TLS_OPTS -u elastic:$ELASTIC_PASSWORD -XGET https://127.0.0.1:9200/_all/_search?q=${msg}&pretty"
# or
rlRun -s "curl $CURL_TLS_OPTS -u elastic:$ELASTIC_PASSWORD -XGET \"https://127.0.0.1:9200/_all/_search?q=${msg}&pretty\""
```
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[prikryla]

Local execution passed on both rhel-9 and rhel-10.
pqc_alg is still disabled because it's not available as for now. Will be enabled once all deps will be available.

              00:01:37 pass /Sanity/elasticsearch-TLS/rsa (on default-0) [1/1]
                    ..:..:.. pass /Setup (subresult)
                    ..:..:.. pass /Basic-TLS-message-delivery-over-HTTPS (subresult)
                    ..:..:.. pass /tls-tlsversion-TLSv1-3-message-delivered (subresult)
                    ..:..:.. pass /tls-tlsversion-invalid-value-message-not-delivered (subresult)
                    ..:..:.. pass /tls-ciphersuites-TLS-AES-256-GCM-SHA384 (subresult)
                    ..:..:.. pass /tls-keyexchangegroups-X25519MLKEM768-X25519-hybrid (subresult)
                    ..:..:.. pass /Cleanup (subresult)