fluent-plugin-logit 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 78c4c4ce59dc4b806f93e496225003e36edfda5bdea21eaf634390696653182d
-  data.tar.gz: e9a6cf80062c73fd922f7914227cb3bc45860c877f38ecb583c7a393083c54fd
+  metadata.gz: 3e711fd3713c8f48f841a2c921cf817a62fdfd280728442a060825d05880b80d
+  data.tar.gz: fb12650d8d450070d11f6b39e22c2e04b6a3a40485ed2c4a5cab4eda02ef76d1
 SHA512:
-  metadata.gz: 416faa7684b294652716eb0dca134186057c9e9351b0b3ac3a846ff2be3404a785c3c1a1288b3cc66c1e7d64b237cff84371a3025d81f191b3af4e4e6fbd346e
-  data.tar.gz: 43896716fcd6270faedd0ef68d722f90f9bb15631f768dd528939c1237c77c37be694038f8864890988764b38bb93973dfda61cbcce2bf09f715ba3a2fdc537b
+  metadata.gz: 2edb4fdaa7ce8c0cefafb7e65e164eb0768d7fc4598d82b6e6f70982b09f76608529fdf694e872345326ee9906ad8b0cc13eb7f1d18974c1882631441394a5ce
+  data.tar.gz: bc3f8809f72f531011f6922d21ba33bb13bbea9542d428f9cf142591fd915ddf6a00018a656c9f381c781e942e388e63697a66c5fb7fc7b6e24bf73c61a5478a

data/README.md

@@ -20,6 +20,26 @@ You need to configure the output with your stack_id and port number. See the sou
       buffer_path /var/log/fluent/logcentral
     </match>
 
+### Mutual TLS configuration
+
+If your stack is enabled for mutual TLS, make the client certificate, private
+key, and CA chain certificates available to Fluentd and specify their locations
+in the config:
+
+    <match **>
+      @type logit
+      stack_id <your-stack-id>
+      port <your-port>
+      buffer_type file
+      buffer_path /var/log/fluent/logcentral
+      tls_mode mutual
+      tls_ca_certificate "/etc/pki/tls/logit/ca-chain.pem"
+      tls_certificate "/etc/pki/tls/logit/client.pem"
+      tls_private_key "/etc/pki/tls/logit/key.pem"
+    </match>
+
+The private key file must be unencrypted before use.
+
 ## Support
 
 This plugin uses TCP with TLS to ship events.

data/VERSION

@@ -1 +1 @@
-0.2.0
+0.3.0

data/lib/fluent/plugin/out_logit.rb

@@ -21,6 +21,11 @@ module Fluent
     config_param :output_type, :string, :default => "json"
     config_param :output_append_newline, :bool, :default => true
 
+    config_param :tls_mode, :enum, list: [:simple, :mutual], default: :simple
+    config_param :tls_ca_certificate, :string, :default => nil
+    config_param :tls_certificate, :string, :default => nil
+    config_param :tls_private_key, :string, :default => nil
+
     def configure(conf)
       super
       if /[\w]{8}(-[\w]{4}){3}-[\w]{12}/.match(@stack_id) == nil
@@ -29,6 +34,23 @@ module Fluent
       if @port == 0
         raise "port is required. See the source wizard."
       end
+
+      if @tls_mode == :mutual
+        if ! @tls_ca_certificate || @tls_ca_certificate.empty?
+          raise Fluent::ConfigError, 
+            "tls_ca_certificate is required when tls_mode is set to mutual"
+        end
+
+        if ! @tls_certificate || @tls_certificate.empty?
+          raise Fluent::ConfigError,
+            "tls_certificate is required when tls_mode is set to mutual"
+        end
+
+        if ! @tls_private_key || @tls_private_key.empty?
+          raise Fluent::ConfigError,
+            "tls_private_key is required when tls_mode is set to mutual"
+        end
+      end
     end
 
     def start
@@ -84,17 +106,22 @@ module Fluent
       Timeout.timeout(@connect_timeout) do
         socket = TCPSocket.open("#{resolved_host()}", @port)
         ssl_context = OpenSSL::SSL::SSLContext.new()
-        # TODO implement mutual tls
-        #ssl_context.cert = OpenSSL::X509::Certificate.new(File.open("certificate.crt"))
-        #ssl_context.key = OpenSSL::PKey::RSA.new(File.open("certificate.key"))
         ssl_context.options |= OpenSSL::SSL::OP_NO_SSLv2
         ssl_context.options |= OpenSSL::SSL::OP_NO_SSLv3
         ssl_context.options |= OpenSSL::SSL::OP_NO_COMPRESSION
         ssl_context.ciphers = "TLSv1.2:!aNULL:!eNULL"
         ssl_context.ssl_version = :TLSv1_2
+
+        if @tls_mode == :mutual
+          ssl_context.cert = OpenSSL::X509::Certificate.new(File.open(@tls_certificate))
+          ssl_context.key = OpenSSL::PKey::RSA.new(File.open(@tls_private_key))
+          ssl_context.ca_file = @tls_ca_certificate
+        end
+
         ssl_socket = OpenSSL::SSL::SSLSocket.new(socket, ssl_context)
         ssl_socket.sync_close = true
         ssl_socket.connect
+
         return ssl_socket
       end
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-logit
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Logit
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-06-05 00:00:00.000000000 Z
+date: 2019-11-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: fluentd