fluent-plugin-devo-radiant 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 11587ede4fb7a85c2e3d9994d80514e429ff24785fdde2e61c0ce4fd7621883b
+  data.tar.gz: b20e719d8d884847df0aacb90fb6b93a0fabbbc04c3997e815b7ef06c6e9ceab
+SHA512:
+  metadata.gz: 4f1a8ff173b12a657be041f9969df4bc22f69cd33e21ccb0ec72ed27f4cfadab5b9c0c7340ef924d4a2f0fdb6848b923750d98ca71952fd3b57ef16526678769
+  data.tar.gz: 3b1f47135ecde3d48a20f335688c29c100fc39d58d290dbe39e50c1704dc48debc5d8bd85232cf8e4d9c3303e5f9d1d9e0d308c2e727853cc90bd12bd99675d7

data/LICENSE

@@ -0,0 +1,235 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+-------------------------------------------------------------------------------
+SOFTWARE DISTRIBUTED WITH SUMOLOGIC CLOUD SYSLOG (SyslogTLS's predecessor):
+
+The Sumologic Cloud Syslog software includes a number of subcomponents with
+separate copyright notices and license terms. Your use of the source
+code for the these subcomponents is subject to the terms and conditions
+of the following licenses.
+
+-------------------------------------------------------------------------------
+
+syslog_ruby (https://github.com/johnskopis/syslog_ruby)
+  Location: lib/sumologic_cloud_syslog
+  From: 'johnskopis' (https://github.com/johnskopis/syslog_ruby)
+  License:  MIT License
+
+Copyright 2009-2015 johnskopis. https://github.com/johnskopis/syslog_ruby
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/NOTICE

@@ -0,0 +1,19 @@
+fluent-plugin-devo-radiant
+Copyright 2026 Radiant Logic, Inc.
+
+This product is a derivative work of DevoInc/fluent-plugin-devo version 1.2.0,
+licensed under the Apache License, Version 2.0. The upstream source is available
+at https://github.com/DevoInc/fluent-plugin-devo.
+
+The derivative retains the upstream copyright and license notices. Its material
+changes are:
+
+- masks the Devo token and client private-key configuration values;
+- uses Fluentd buffering and propagates send failures for chunk retry;
+- supports Fluentd multi-worker operation with a worker-aware synchronized cache;
+- warns when TLS verification is disabled and configures a minimum TLS version;
+- moves the vendored syslog TLS client into a fork-specific Ruby namespace; and
+- registers both the `devo_radiant` and compatibility `devo` output names.
+
+The bundled syslog TLS implementation also contains portions attributed in the
+LICENSE file to Acquia, t.e.morgan, JMC, Devo Inc., and syslog_ruby contributors.

data/README.md

@@ -0,0 +1,77 @@
+# fluent-plugin-devo-radiant
+
+A hardened Fluentd output plugin for sending records to Devo over TLS. This is
+a derivative of [DevoInc/fluent-plugin-devo 1.2.0](https://github.com/DevoInc/fluent-plugin-devo)
+under the Apache License 2.0.
+
+## Changes from upstream
+
+- Fluentd buffering with retryable chunk failures instead of per-record error swallowing
+- Secret masking for `token` and `client_key`
+- Multi-worker support and synchronized, worker-aware logger caching
+- Peer verification with the system CA store by default
+- Explicit warnings if peer or hostname verification is disabled
+- Configurable minimum TLS version (`TLSv1_2` by default; `TLSv1_3` is supported)
+- Fork-specific namespace for the bundled syslog TLS implementation
+- Both `@type devo_radiant` and `@type devo` registrations
+
+Buffered delivery is at least once. If a chunk fails after some records were
+accepted by the remote endpoint, Fluentd retries the chunk and those earlier
+records can be delivered again.
+
+## Installation
+
+```bash
+fluent-gem install fluent-plugin-devo-radiant
+```
+
+## Configuration
+
+```conf
+<match devo.**>
+  @type devo_radiant
+  host logs.example.invalid
+  port 443
+
+  token YOUR_DEVO_TOKEN
+  ca_cert system
+  verify_cert_name true
+  tls_min_version TLSv1_2
+
+  # Optional mutual TLS credentials
+  client_cert /path/to/client.crt
+  client_key /path/to/client.key
+
+  <format>
+    @type json
+  </format>
+
+  <buffer tag>
+    @type file
+    path /var/log/fluent/devo-buffer
+    flush_interval 5s
+    retry_forever true
+  </buffer>
+</match>
+```
+
+The buffer chunk key defaults to `tag`, so the explicit `<buffer tag>` argument
+above is optional. A persistent file buffer and an intentional retry policy are
+recommended for production durability.
+
+Setting `ca_cert false` disables both certificate-chain and hostname
+verification and produces a warning. Setting `verify_cert_name false` disables
+hostname matching only and also produces a warning. Both weaken TLS security.
+
+## Development
+
+```bash
+bundle install
+bundle exec rake test
+```
+
+## Attribution and license
+
+Copyright notices from the upstream project are retained in derived source
+files. See [NOTICE](NOTICE) for the derivative-work statement and [LICENSE](LICENSE)
+for the Apache License 2.0 and bundled-component notices.

data/lib/fluent/plugin/devo_radiant_constants.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+# Copyright 2026 Radiant Logic, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+
+module Fluent
+  module Plugin
+    module DevoRadiantConstants
+      VERSION = '0.1.0'
+    end
+  end
+end

data/lib/fluent/plugin/out_devo.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+# Copyright 2016 Acquia, Inc.
+# Copyright 2016-2019 t.e.morgan.
+# Copyright 2021 JMC
+# Copyright 2026 Radiant Logic, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Fluentd resolves `@type devo` by requiring this path. The implementation
+# registers both `devo` and `devo_radiant`.
+require 'fluent/plugin/out_devo_radiant'

data/lib/fluent/plugin/out_devo_radiant.rb

@@ -0,0 +1,191 @@
+# frozen_string_literal: true
+
+# Copyright 2016 Acquia, Inc.
+# Copyright 2016-2019 t.e.morgan.
+# Copyright 2021 JMC
+# Copyright 2026 Radiant Logic, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'msgpack'
+require 'socket'
+require 'fluent/plugin/output'
+require 'fluent_plugin_devo_radiant/syslog_tls/logger'
+require_relative 'devo_radiant_constants'
+
+module Fluent
+  module Plugin
+    class DevoRadiantOutput < Output
+      Fluent::Plugin.register_output('devo_radiant', self)
+      Fluent::Plugin.register_output('devo', self)
+
+      helpers :inject, :formatter, :compat_parameters
+
+      DEFAULT_FORMAT_TYPE = 'json'
+      TLS_MIN_VERSIONS = FluentPluginDevoRadiant::SyslogTls::SSLTransport::TLS_MIN_VERSIONS.keys.freeze
+
+      config_param :host, :string
+      config_param :port, :integer
+      config_param :idle_timeout, :integer, default: nil
+      config_param :ca_cert, :string, default: 'system'
+      config_param :verify_cert_name, :bool, default: true
+      config_param :token, :string, default: nil, secret: true
+      config_param :client_cert, :string, default: nil
+      config_param :client_key, :string, default: nil, secret: true
+      config_param :hostname, :string, default: nil
+      config_param :facility, :string, default: 'LOCAL0'
+      config_param :tls_min_version, :enum, list: TLS_MIN_VERSIONS, default: :'TLSv1_2'
+
+      SYSLOG_HEADERS = %i[severity facility hostname app_name procid msgid].freeze
+
+      SYSLOG_HEADERS.each do |key_name|
+        config_param :"#{key_name}_key", :string, default: nil
+      end
+
+      config_section :buffer do
+        config_set_default :chunk_keys, ['tag']
+      end
+
+      config_section :format do
+        config_set_default :@type, DEFAULT_FORMAT_TYPE
+      end
+
+      attr_accessor :formatter
+
+      def initialize
+        super
+        @loggers = {}
+        @loggers_mutex = Mutex.new
+      end
+
+      def configure(conf)
+        conf['format'] = conf['output_type'] if conf['output_type'] && !conf['format']
+        compat_parameters_convert(conf, :inject, :formatter)
+
+        super
+
+        @hostname ||= Socket.gethostname.split('.').first
+        @mappings = {}
+        SYSLOG_HEADERS.each do |key_name|
+          conf_key = "#{key_name}_key"
+          @mappings[key_name] = conf[conf_key] if conf.key?(conf_key)
+        end
+
+        @formatter = formatter_create(conf: conf.elements('format').first, default_type: DEFAULT_FORMAT_TYPE)
+
+        if peer_verification_disabled?
+          log.warn 'TLS peer and hostname verification are disabled because ca_cert is false'
+        elsif !verify_cert_name
+          log.warn 'TLS hostname verification is disabled because verify_cert_name is false'
+        end
+      end
+
+      def shutdown
+        loggers = @loggers_mutex.synchronize do
+          current = @loggers.values
+          @loggers = {}
+          current
+        end
+        loggers.each { |cached_logger| cached_logger.close unless cached_logger.closed? }
+        super
+      end
+
+      def prefer_buffered_processing
+        true
+      end
+
+      def formatted_to_msgpack_binary?
+        true
+      end
+
+      def multi_workers_ready?
+        true
+      end
+
+      def format(tag, time, record)
+        record = inject_values_to_record(tag, time, record)
+        [time, record].to_msgpack
+      end
+
+      def write(chunk)
+        tag = chunk.metadata.tag
+        raise 'buffer chunk is missing tag metadata' unless tag
+
+        chunk.msgpack_each do |time, record|
+          send_record(tag, time, record)
+        end
+      end
+
+      # Compatibility path for explicitly non-buffered operation. Errors are
+      # intentionally allowed to escape so a failed send is never reported as
+      # successful.
+      def process(tag, event_stream)
+        event_stream.each do |time, record|
+          send_record(tag, time, inject_values_to_record(tag, time, record))
+        end
+      end
+
+      def logger(tag)
+        cache_key = [fluentd_worker_id, tag]
+        @loggers_mutex.synchronize do
+          cached_logger = @loggers[cache_key]
+          if cached_logger.nil? || cached_logger.closed?
+            cached_logger = new_logger(tag)
+            @loggers[cache_key] = cached_logger
+          end
+          cached_logger
+        end
+      end
+
+      def new_logger(tag)
+        transport = FluentPluginDevoRadiant::SyslogTls::SSLTransport.new(
+          host,
+          port,
+          idle_timeout: idle_timeout,
+          ca_cert: ca_cert,
+          client_cert: client_cert,
+          client_key: client_key,
+          verify_cert_name: verify_cert_name,
+          tls_min_version: tls_min_version,
+          max_retries: 3
+        )
+        syslog_logger = FluentPluginDevoRadiant::SyslogTls::Logger.new(transport, token)
+        syslog_logger.facility(facility)
+        syslog_logger.hostname(hostname)
+        syslog_logger.app_name(tag)
+        syslog_logger
+      end
+
+      private
+
+      def peer_verification_disabled?
+        ca_cert == false || ca_cert == 'false'
+      end
+
+      def send_record(tag, time, record)
+        severity = if @mappings.key?(:severity)
+                     record[@mappings[:severity]] || 'INFO'
+                   else
+                     'INFO'
+                   end
+
+        message = @formatter.format(tag, time, record)
+        logger(tag).log(severity, message, time: Time.at(time)) do |header|
+          @mappings.each do |name, record_key|
+            header.public_send(:"#{name}=", record[record_key]) unless record[record_key].nil?
+          end
+        end
+      end
+    end
+  end
+end

data/lib/fluent_plugin_devo_radiant/syslog_tls/facility.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+# Copyright 2016 Acquia, Inc.
+# Copyright 2021 Devo .Inc.
+# Copyright 2026 Radiant Logic, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require_relative 'lookup_from_const'
+
+module FluentPluginDevoRadiant
+  module SyslogTls
+    module Facility
+      extend LookupFromConst
+
+      KERN = 0
+      USER = 1
+      MAIL = 2
+      DAEMON = 3
+      AUTH = 4
+      SYSLOG = 5
+      LPR = 6
+      NEWS = 7
+      UUCP = 8
+      CRON = 9
+      AUTHPRIV = 10
+      FTP = 11
+      NTP = 12
+      SECURITY = 13
+      CONSOLE = 14
+      RAS = 15
+      LOCAL0 = 16
+      LOCAL1 = 17
+      LOCAL2 = 18
+      LOCAL3 = 19
+      LOCAL4 = 20
+      LOCAL5 = 21
+      LOCAL6 = 22
+      LOCAL7 = 23
+      NONE = SYSLOG
+    end
+  end
+end

data/lib/fluent_plugin_devo_radiant/syslog_tls/logger.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+# Copyright 2016 Acquia, Inc.
+# Copyright 2016 t.e.morgan.
+# Copyright 2021 Devo .Inc.
+# Copyright 2026 Radiant Logic, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require_relative 'protocol'
+require_relative 'ssl_transport'
+
+module FluentPluginDevoRadiant
+  module SyslogTls
+    class Logger
+      attr_reader :token
+      attr_accessor :transport
+
+      def initialize(transport, token = nil)
+        @transport = transport
+        @token = token
+        @default_header = Header.new
+        @default_structured_data = StructuredData.new(token)
+      end
+
+      def facility(value)
+        @default_header.facility = value
+      end
+
+      def hostname(value)
+        @default_header.hostname = value
+      end
+
+      def app_name(value)
+        @default_header.app_name = value
+      end
+
+      def procid(value)
+        @default_header.procid = value
+      end
+
+      def closed?
+        transport && transport.closed?
+      end
+
+      def close
+        transport.close
+      end
+
+      def log(severity, message, time: nil)
+        time ||= Time.now
+
+        syslog_message = Message.new
+        syslog_message.structured_data << @default_structured_data
+        syslog_message.header = @default_header.dup
+        syslog_message.header.severity = severity
+        syslog_message.header.timestamp = time
+
+        yield syslog_message.header if block_given?
+
+        syslog_message.msg = message
+        transport.write(syslog_message.to_s)
+      end
+    end
+  end
+end

data/lib/fluent_plugin_devo_radiant/syslog_tls/lookup_from_const.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+# Copyright 2016 Acquia, Inc.
+# Copyright 2021 Devo .Inc.
+# Copyright 2026 Radiant Logic, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module FluentPluginDevoRadiant
+  module SyslogTls
+    module LookupFromConst
+      def setup_constants(destination)
+        constants.each do |priority|
+          value = const_get(priority)
+
+          destination[priority] = value
+          destination[priority.downcase] = value
+
+          destination[:"LOG_#{priority}"] = value
+          destination[:"LOG_#{priority.to_s.downcase}"] = value
+          const_set(:"LOG_#{priority}", value)
+
+          destination[priority.to_s] = value
+          destination[priority.to_s.downcase] = value
+
+          destination[value] = value
+          destination[value.to_s] = value
+        end
+      end
+    end
+  end
+end

data/lib/fluent_plugin_devo_radiant/syslog_tls/protocol.rb

@@ -0,0 +1,133 @@
+# frozen_string_literal: true
+
+# Copyright 2016 Acquia, Inc.
+# Copyright 2016 t.e.morgan.
+# Copyright 2021 Devo .Inc.
+# Copyright 2026 Radiant Logic, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'date'
+
+require_relative 'facility'
+require_relative 'severity'
+
+module FluentPluginDevoRadiant
+  module SyslogTls
+    NIL_VALUE = ''
+
+    class Header
+      attr_accessor :version, :hostname, :app_name, :procid, :msgid
+      attr_reader :facility, :severity, :timestamp
+
+      FACILITIES = {}
+      SEVERITIES = {}
+
+      Facility.setup_constants(FACILITIES)
+      Severity.setup_constants(SEVERITIES)
+
+      def initialize
+        @timestamp = Time.now
+        @severity = 'INFO'
+        @facility = 'LOCAL0'
+        @version = 1
+        @hostname = NIL_VALUE
+        @app_name = NIL_VALUE
+        @procid = NIL_VALUE
+        @msgid = NIL_VALUE
+      end
+
+      def timestamp=(value)
+        raise ArgumentError, "Must provide Time object value instead: #{value.inspect}" unless value.is_a?(Time)
+
+        @timestamp = value
+      end
+
+      def facility=(value)
+        raise ArgumentError, "Invalid facility value: #{value.inspect}" unless FACILITIES.key?(value)
+
+        @facility = value
+      end
+
+      def severity=(value)
+        raise ArgumentError, "Invalid severity value: #{value.inspect}" unless SEVERITIES.key?(value)
+
+        @severity = value
+      end
+
+      def pri
+        FACILITIES[facility] * 8 + SEVERITIES[severity]
+      end
+
+      def assemble
+        [
+          "<#{pri}>#{timestamp.to_datetime.strftime('%b %d %H:%M:%S')}",
+          hostname,
+          app_name
+        ].join(' ')
+      end
+
+      def to_s
+        assemble
+      end
+    end
+
+    class StructuredData
+      attr_accessor :id, :data
+
+      def initialize(id)
+        @id = id
+        @data = {}
+      end
+
+      def assemble
+        return NIL_VALUE unless id
+
+        parts = [id]
+        data.each do |key, value|
+          value = value.gsub(/(\"|\]|\\)/) { |match| '\\' + match }
+          parts << "#{key}=\"#{value}\""
+        end
+        "[#{parts.join(' ')}]"
+      end
+
+      def to_s
+        assemble
+      end
+    end
+
+    class Message
+      attr_accessor :structured_data, :msg
+      attr_writer :header
+
+      def initialize
+        @msg = ''
+        @structured_data = []
+      end
+
+      def header
+        @header ||= Header.new
+      end
+
+      def assemble
+        output = [header.to_s]
+        output << msg if msg.length.positive?
+        output.join(' ') + "\n"
+      end
+
+      def to_s
+        assemble
+      end
+    end
+  end
+end

data/lib/fluent_plugin_devo_radiant/syslog_tls/severity.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+# Copyright 2016 Acquia, Inc.
+# Copyright 2021 Devo .Inc.
+# Copyright 2026 Radiant Logic, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require_relative 'lookup_from_const'
+
+module FluentPluginDevoRadiant
+  module SyslogTls
+    module Severity
+      extend LookupFromConst
+
+      EMERG = PANIC = 0
+      ALERT = 1
+      CRIT = 2
+      ERR = ERROR = 3
+      WARN = WARNING = 4
+      NOTICE = 5
+      INFO = 6
+      DEBUG = 7
+      NONE = 10
+    end
+  end
+end

data/lib/fluent_plugin_devo_radiant/syslog_tls/ssl_transport.rb

@@ -0,0 +1,222 @@
+# frozen_string_literal: true
+
+# Copyright 2016 Acquia, Inc.
+# Copyright 2016-2019 t.e.morgan.
+# Copyright 2021 Devo .Inc.
+# Copyright 2026 Radiant Logic, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'openssl'
+require 'rbconfig'
+require 'socket'
+
+module FluentPluginDevoRadiant
+  module SyslogTls
+    class SSLTransport
+      CONNECT_TIMEOUT = 10
+      WRITE_TIMEOUT = 5
+
+      TLS_MIN_VERSIONS = {
+        :'TLSv1_2' => OpenSSL::SSL::TLS1_2_VERSION
+      }.tap do |versions|
+        versions[:'TLSv1_3'] = OpenSSL::SSL::TLS1_3_VERSION if defined?(OpenSSL::SSL::TLS1_3_VERSION)
+      end.freeze
+
+      attr_accessor :socket
+      attr_reader :host, :port, :idle_timeout, :ca_cert, :client_cert, :client_key,
+                  :verify_cert_name, :tls_min_version
+      attr_writer :retries
+
+      def initialize(host, port, idle_timeout: nil, ca_cert: 'system', client_cert: nil,
+                     client_key: nil, verify_cert_name: true, tls_min_version: :'TLSv1_2',
+                     max_retries: 1)
+        @host = host
+        @port = port
+        @idle_timeout = idle_timeout
+        @ca_cert = ca_cert
+        @client_cert = client_cert
+        @client_key = client_key
+        @verify_cert_name = verify_cert_name
+        @tls_min_version = tls_min_version.to_sym
+        @retries = max_retries
+        @write_mutex = Mutex.new
+
+        raise ArgumentError, "Unsupported minimum TLS version: #{tls_min_version}" unless
+          TLS_MIN_VERSIONS.key?(@tls_min_version)
+
+        connect
+      end
+
+      def connect
+        @socket = get_ssl_connection
+        begin
+          begin
+            @socket.connect_nonblock
+          rescue Errno::EAGAIN, Errno::EWOULDBLOCK, IO::WaitReadable
+            select_with_timeout(@socket, :connect_read) && retry
+          rescue IO::WaitWritable
+            select_with_timeout(@socket, :connect_write) && retry
+          end
+        rescue Errno::ETIMEDOUT
+          raise 'Socket timeout during connect'
+        end
+        @last_write = Time.now if idle_timeout
+      end
+
+      def get_tcp_connection
+        tcp = nil
+        family = Socket::Constants::AF_UNSPEC
+        socket_type = Socket::Constants::SOCK_STREAM
+        address_info = Socket.getaddrinfo(host, port, family, socket_type, nil, nil, false).first
+        _, resolved_port, _, address, family, socket_type = address_info
+
+        begin
+          socket_address = Socket.sockaddr_in(resolved_port, address)
+          tcp = Socket.new(family, socket_type, 0)
+          tcp.setsockopt(Socket::SOL_SOCKET, Socket::Constants::SO_REUSEADDR, false)
+          unless RbConfig::CONFIG['host_os'].match?(/mswin|mingw|cygwin/)
+            tcp.setsockopt(Socket::SOL_SOCKET, Socket::Constants::SO_REUSEPORT, false)
+          end
+          tcp.connect_nonblock(socket_address)
+        rescue Errno::EINPROGRESS
+          select_with_timeout(tcp, :connect_write)
+          begin
+            tcp.connect_nonblock(socket_address)
+          rescue Errno::EISCONN
+            # Connected.
+          rescue SystemCallError
+            tcp.close rescue nil
+            raise
+          end
+        rescue SystemCallError
+          tcp.close rescue nil
+          raise
+        end
+
+        tcp.setsockopt(Socket::IPPROTO_TCP, Socket::TCP_NODELAY, true)
+        tcp
+      end
+
+      def get_ssl_connection
+        tcp = get_tcp_connection
+        context = build_ssl_context
+        ssl_socket = OpenSSL::SSL::SSLSocket.new(tcp, context)
+        ssl_socket.hostname = host
+        ssl_socket.sync_close = true
+        ssl_socket
+      end
+
+      def write(string)
+        @write_mutex.synchronize { write_with_retries(string) }
+      end
+
+      def do_write(data)
+        data = data.dup.force_encoding(Encoding::BINARY)
+        loop do
+          sent = 0
+          begin
+            sent = @socket.write_nonblock(data)
+          rescue OpenSSL::SSL::SSLError, Errno::EAGAIN, Errno::EWOULDBLOCK, IO::WaitWritable => error
+            if error.is_a?(OpenSSL::SSL::SSLError) && error.message !~ /write would block/
+              raise error
+            end
+
+            select_with_timeout(@socket, :write) && retry
+          end
+
+          break if sent >= data.bytesize
+
+          data = data.byteslice(sent, data.bytesize - sent)
+        end
+      end
+
+      def select_with_timeout(tcp, type)
+        arguments = case type
+                    when :connect_read
+                      [[tcp], nil, nil, CONNECT_TIMEOUT]
+                    when :connect_write
+                      [nil, [tcp], nil, CONNECT_TIMEOUT]
+                    when :write
+                      [nil, [tcp], nil, WRITE_TIMEOUT]
+                    else
+                      raise "Unknown select type #{type}"
+                    end
+        IO.select(*arguments) || raise("Socket timeout during #{type}")
+      end
+
+      def method_missing(method_name, *arguments, &block)
+        return super unless @socket.respond_to?(method_name)
+
+        @socket.public_send(method_name, *arguments, &block)
+      end
+
+      def respond_to_missing?(method_name, include_private = false)
+        @socket.respond_to?(method_name, include_private) || super
+      end
+
+      private
+
+      def build_ssl_context
+        context = OpenSSL::SSL::SSLContext.new
+        context.verify_mode = OpenSSL::SSL::VERIFY_PEER
+        context.verify_hostname = verify_cert_name != false
+        configure_tls_min_version(context)
+
+        case ca_cert
+        when true, 'true', 'system'
+          context.cert_store = OpenSSL::X509::Store.new
+          context.cert_store.set_default_paths
+        when false, 'false'
+          context.verify_hostname = false
+          context.verify_mode = OpenSSL::SSL::VERIFY_NONE
+        when %r{/$}
+          context.ca_path = ca_cert
+        when String
+          context.ca_file = ca_cert
+        end
+
+        context.cert = OpenSSL::X509::Certificate.new(File.read(client_cert)) if client_cert
+        context.key = OpenSSL::PKey.read(File.read(client_key)) if client_key
+        context
+      end
+
+      def configure_tls_min_version(context)
+        context.min_version = TLS_MIN_VERSIONS.fetch(tls_min_version)
+      end
+
+      def write_with_retries(string)
+        if idle_timeout
+          if (now = Time.now) > @last_write + idle_timeout
+            @socket.close rescue nil
+            connect
+          else
+            @last_write = now
+          end
+        end
+
+        begin
+          retry_id ||= 0
+          do_write(string)
+        rescue StandardError => error
+          if (retry_id += 1) < @retries
+            @socket.close rescue nil
+            connect
+            retry
+          end
+          raise error
+        end
+      end
+    end
+  end
+end

data/lib/fluent_plugin_devo_radiant/syslog_tls/version.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+# Copyright 2016 Acquia, Inc.
+# Copyright 2016-2019 t.e.morgan.
+# Copyright 2021 Devo .Inc.
+# Copyright 2026 Radiant Logic, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module FluentPluginDevoRadiant
+  module SyslogTls
+    VERSION = '1.2.0'
+  end
+end

metadata

@@ -0,0 +1,129 @@
+--- !ruby/object:Gem::Specification
+name: fluent-plugin-devo-radiant
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Radiant Logic, Inc.
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2026-09-03 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: fluentd
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.16'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.16'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2'
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+- !ruby/object:Gem::Dependency
+  name: test-unit
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.6'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.6'
+description: A production-hardened fork of fluent-plugin-devo 1.2.0 with buffered
+  retry semantics, credential masking, multi-worker support, configurable minimum
+  TLS versions, and a collision-free vendored syslog TLS namespace.
+email:
+- support@radiantlogic.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE
+- NOTICE
+- README.md
+- lib/fluent/plugin/devo_radiant_constants.rb
+- lib/fluent/plugin/out_devo.rb
+- lib/fluent/plugin/out_devo_radiant.rb
+- lib/fluent_plugin_devo_radiant/syslog_tls/facility.rb
+- lib/fluent_plugin_devo_radiant/syslog_tls/logger.rb
+- lib/fluent_plugin_devo_radiant/syslog_tls/lookup_from_const.rb
+- lib/fluent_plugin_devo_radiant/syslog_tls/protocol.rb
+- lib/fluent_plugin_devo_radiant/syslog_tls/severity.rb
+- lib/fluent_plugin_devo_radiant/syslog_tls/ssl_transport.rb
+- lib/fluent_plugin_devo_radiant/syslog_tls/version.rb
+homepage: https://github.com/gnanirahulnutakki/fluent-plugin-devo-radiant
+licenses:
+- Apache-2.0
+metadata:
+  bug_tracker_uri: https://github.com/gnanirahulnutakki/fluent-plugin-devo-radiant/issues
+  source_code_uri: https://github.com/gnanirahulnutakki/fluent-plugin-devo-radiant
+  rubygems_mfa_required: 'true'
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.1.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.5.3
+signing_key:
+specification_version: 4
+summary: Hardened Fluentd TLS output plugin for Devo
+test_files: []