fluent-plugin-secure-forward 0.0.2 → 0.0.3

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 616e3ee6ce26495d3cae028b95f875452e65b281
+  data.tar.gz: c2c1e3423af3a2659389b3ed3a534876b56ad9d3
+SHA512:
+  metadata.gz: d33ca023780967c1d5e543dd30da3beea56c9cddc53ad43b346f19513fa72a00fb35c48797336910b6455de39b14e3e32212f4250073c28ede2d1fddbbfcc077
+  data.tar.gz: 0353931f0f0308dc51719e24628cf96c9c01f53baba40ee087b5dd0f09f42c5bc7492475fe1434e15cc4706fbc0335f3728ca6f614b5a100fe98536bc332fb71

data/README.md

@@ -2,7 +2,7 @@
 
 Fluentd input/output plugin to forward fluentd messages over SSL with authentication.
 
-**THIS PLUGIN IS PoC, and now version is HIGHLY EXPERIMENTAL.**
+**CURRENT STATUS: HIGHLY EXPERIMENTAL**
 
 This plugin makes you to be able to:
 
@@ -12,10 +12,6 @@ This plugin makes you to be able to:
  * authenticate by shared\_key check from both of client(out\_secure\_forward) and server(in\_secure\_forward)
  * authenticate with username / password pairs
 
-**DON'T USE THIS PLUGIN OF THIS VERSION (v0.0.x) IN PRODUCTION ENVIRONMENT.**
-
-We need new developer/maintainer of this plugin, who wants to use this plugin in their systems.
-
 ## Configuration
 
 ### SecureForwardInput
@@ -123,6 +119,7 @@ Minimal configurations like this:
     <match secret.data.**>
       type secure_forward
       shared_key secret_string
+      self_hostname client.fqdn.local
       <server>
         host server.fqdn.local  # or IP
         # port 24284
@@ -136,6 +133,7 @@ If server requires username/password, set `username` and `password` in `<server>
     <match secret.data.**>
       type secure_forward
       shared_key secret_string
+      self_hostname client.fqdn.local
       <server>
         host server.fqdn.local
         username repeatedly

data/fluent-plugin-secure-forward.gemspec

@@ -1,11 +1,11 @@
 # -*- encoding: utf-8 -*-
 Gem::Specification.new do |gem|
   gem.name          = "fluent-plugin-secure-forward"
-  gem.version       = "0.0.2"
+  gem.version       = "0.0.3"
   gem.authors       = ["TAGOMORI Satoshi"]
   gem.email         = ["tagomoris@gmail.com"]
   gem.summary       = %q{Fluentd input/output plugin to forward over SSL with authentications}
-  gem.description   = %q{This version is HIGHLY EXPERIMENTAL. DON'T USE IN PRODUCTION}
+  gem.description   = %q{This version is HIGHLY EXPERIMENTAL.}
   gem.homepage      = "https://github.com/tagomoris/fluent-plugin-secure-forward"
 
   gem.files         = `git ls-files`.split($\)
@@ -15,4 +15,5 @@ Gem::Specification.new do |gem|
 
   gem.add_runtime_dependency "fluentd"
   gem.add_runtime_dependency "fluent-mixin-config-placeholders"
+  gem.add_runtime_dependency "resolve-hostname"
 end

data/lib/fluent/plugin/in_secure_forward.rb

@@ -65,7 +65,7 @@ module Fluent
 
     def configure(conf)
       super
-      
+
       unless @cert_auto_generate || @cert_file_path
         raise Fluent::ConfigError, "One of 'cert_auto_generate' or 'cert_file_path' must be specified"
       end
@@ -106,7 +106,7 @@ module Fluent
 
     def start
       super
-      OpenSSL::Random.seed(File.read("/dev/random", 16))
+      OpenSSL::Random.seed(File.read("/dev/urandom", 16))
       @sessions = []
       @sock = nil
       @listener = Thread.new(&method(:run))
@@ -118,7 +118,7 @@ module Fluent
       @sessions.each{ |s| s.shutdown }
       @sock.close
     end
-    
+
     def select_authenticate_users(node, username)
       if node.nil? || node[:users].nil?
         @users.select{|u| u[:username] == username}
@@ -159,17 +159,27 @@ module Fluent
     end
 
     def run # sslsocket server thread
+      $log.trace "setup for ssl sessions"
       cert, key = self.certificate
       ctx = OpenSSL::SSL::SSLContext.new
       ctx.cert = cert
       ctx.key = key
 
+      $log.trace "start to listen", :bind => @bind, :port => @port
       server = TCPServer.new(@bind, @port)
+      $log.trace "starting SSL server", :bind => @bind, :port => @port
       @sock = OpenSSL::SSL::SSLServer.new(server, ctx)
-      loop do
-        while socket = @sock.accept
-          @sessions.push Session.new(self, socket)
+      @sock.start_immediately = false
+      begin
+        $log.trace "accepting sessions"
+        loop do
+          while socket = @sock.accept
+            $log.trace "accept tcp connection (ssl session not established yet)"
+            @sessions.push Session.new(self, socket)
+          end
         end
+      rescue OpenSSL::SSL::SSLError => e
+        raise unless e.message.start_with?('SSL_accept SYSCALL') # signal trap on accept
       end
     end
 
@@ -179,12 +189,12 @@ module Fluent
       # TODO: format error
       tag = msg[0].to_s
       entries = msg[1]
-    
+
       if entries.class == String
         # PackedForward
         es = MessagePackEventStream.new(entries, @cached_unpacker)
         Fluent::Engine.emit_stream(tag, es)
-  
+
       elsif entries.class == Array
         # Forward
         es = Fluent::MultiEventStream.new
@@ -195,7 +205,7 @@ module Fluent
           es.add(time, record)
         }
         Fluent::Engine.emit_stream(tag, es)
-  
+
       else
         # Message
         time = msg[1]
@@ -328,7 +338,7 @@ module Fluent
             return
           end
           send_data generate_pong(true, reason_or_salt)
-          
+
           $log.debug "connection established"
           @state = :established
         end
@@ -342,11 +352,21 @@ module Fluent
       def start
         $log.debug "starting server"
 
+        $log.trace "accepting ssl session"
+        begin
+          @socket.accept
+        rescue OpenSSL::SSL::SSLError => e
+          $log.debug "failed to establish ssl session"
+          self.shutdown
+          return
+        end
+
         proto, port, host, ipaddr = @socket.io.addr
         @node = check_node(host, ipaddr, port, proto)
         if @node.nil? && (! @receiver.allow_anonymous_source)
           $log.warn "Connection required from unknown host '#{host}' (#{ipaddr}), disconnecting..."
           self.shutdown
+          return
         end
 
         @auth_key_salt = generate_salt
@@ -355,11 +375,11 @@ module Fluent
         read_length = @receiver.read_length
         read_interval = @receiver.read_interval
         socket_interval = @receiver.socket_interval
-        
+
         send_data generate_helo()
         @state = :pingpong
 
-        loop do 
+        loop do
           begin
             while @socket.read_nonblock(read_length, buf)
               if buf == ''
@@ -377,9 +397,10 @@ module Fluent
             break
           end
         end
-        self.shutdown
       rescue => e
         $log.warn e
+      ensure
+        self.shutdown
       end
 
       def shutdown

data/lib/fluent/plugin/out_secure_forward.rb

@@ -40,11 +40,14 @@ module Fluent
     #   password pass # if required
     # </server>
 
+    attr_reader :hostname_resolver
+
     def initialize
       super
       require 'socket'
       require 'openssl'
       require 'digest'
+      require 'resolve/hostname'
     end
 
     def configure(conf)
@@ -75,6 +78,8 @@ module Fluent
         raise Fluent::ConfigError, "Two or more servers are not supported yet."
       end
 
+      @hostname_resolver = Resolve::Hostname.new(:system_resolver => true)
+
       true
     end
 
@@ -86,8 +91,11 @@ module Fluent
     def start
       super
 
-      OpenSSL::Random.seed(File.read("/dev/random", 16))
+      $log.debug "starting secure-forward"
+      OpenSSL::Random.seed(File.read("/dev/urandom", 16))
+      $log.debug "start to connect target nodes"
       @nodes.each do |node|
+        $log.debug "connecting node", :host => node.host, :port => node.port
         node.start
       end
       @nodewatcher = Thread.new(&method(:node_watcher))
@@ -217,7 +225,7 @@ module Fluent
           @socket.close if @socket
         end
       rescue => e
-        $log.debug "#{e.class}:#{e.message}"
+        $log.debug "error on node shutdown #{e.class}:#{e.message}"
       end
 
       def verify_result_name(code)
@@ -349,8 +357,12 @@ module Fluent
 
       def connect
         $log.debug "starting client"
-        sock = TCPSocket.new(@host, @port)
 
+        addr = @sender.hostname_resolver.getaddress(@host)
+        $log.debug "create tcp socket to node", :host => @host, :address => addr, :port => @port
+        sock = TCPSocket.new(addr, @port)
+
+        $log.trace "changing socket options"
         opt = [1, @sender.send_timeout.to_i].pack('I!I!')  # { int l_onoff; int l_linger; }
         sock.setsockopt(Socket::SOL_SOCKET, Socket::SO_LINGER, opt)
 
@@ -358,16 +370,20 @@ module Fluent
         sock.setsockopt(Socket::SOL_SOCKET, Socket::SO_SNDTIMEO, opt)
 
         # TODO: SSLContext constructer parameter (SSL/TLS protocol version)
+        $log.trace "initializing SSL contexts"
         context = OpenSSL::SSL::SSLContext.new
-        context.ca_file = @cert_file_path
-        # TODO: context.ciphers= (SSL Shared key chiper protocols)
+        # TODO: context.ca_file = (ca_file_path)
+        # TODO: context.ciphers = (SSL Shared key chiper protocols)
 
+        $log.debug "trying to connect ssl session", :host => @host, :ipaddr => addr, :port => @port
         sslsession = OpenSSL::SSL::SSLSocket.new(sock, context)
+        # TODO: check connection failure
         sslsession.connect
-      
+        $log.debug "ssl session connected", :host => @host, :port => @port
+
         begin
           unless @sender.allow_self_signed_certificate
-            $log.debug sslsession.peer_cert.subject.to_s
+            $log.debug "checking peer's certificate", :subject => sslsession.peer_cert.subject
             sslsession.post_connection_check(@hostlabel)
             verify = sslsession.verify_result
             if verify != OpenSSL::X509::V_OK
@@ -378,12 +394,12 @@ module Fluent
             end
           end
         rescue OpenSSL::SSL::SSLError => e
-          $log.warn "failed to verify certification while connecting host #{@host} as #{@hostlabel}"
+          $log.warn "failed to verify certification while connecting ssl session", :host => @host, :hostlabel => @hostlabel
           self.shutdown
           raise
         end
 
-        $log.debug "ssl sessison connected"
+        $log.debug "ssl sessison connected", :host => @host, :port => @port
         @socket = sock
         @sslsession = sslsession
 

metadata

@@ -1,49 +1,58 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-secure-forward
 version: !ruby/object:Gem::Version
-  version: 0.0.2
-  prerelease: 
+  version: 0.0.3
 platform: ruby
 authors:
 - TAGOMORI Satoshi
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-04-08 00:00:00.000000000 Z
+date: 2013-07-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: fluentd
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: fluent-mixin-config-placeholders
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
-description: This version is HIGHLY EXPERIMENTAL. DON'T USE IN PRODUCTION
+- !ruby/object:Gem::Dependency
+  name: resolve-hostname
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+description: This version is HIGHLY EXPERIMENTAL.
 email:
 - tagomoris@gmail.com
 executables: []
@@ -70,28 +79,28 @@ files:
 - test/plugin/test_out_secure_forward.rb
 homepage: https://github.com/tagomoris/fluent-plugin-secure-forward
 licenses: []
+metadata: {}
 post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
-  none: false
   requirements:
-  - - ! '>='
+  - - '>='
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
-  none: false
   requirements:
-  - - ! '>='
+  - - '>='
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 1.8.23
+rubygems_version: 2.0.2
 signing_key: 
-specification_version: 3
+specification_version: 4
 summary: Fluentd input/output plugin to forward over SSL with authentications
 test_files:
 - test/plugin/test_in_secure_forward.rb
 - test/plugin/test_out_secure_forward.rb
+has_rdoc: