fluent-plugin-secure-forward 0.2.6 → 0.3.0

data/test/plugin/test_in_secure_forward.rb

@@ -17,19 +17,18 @@ class SecureForwardInputTest < Test::Unit::TestCase
     p1 = nil
     assert_nothing_raised { p1 = create_driver(<<CONFIG).instance }
   type secure_forward
+  secure false
   shared_key         secret_string
   self_hostname      server.fqdn.local  # This fqdn is used as CN (Common Name) of certificates
-  cert_auto_generate yes                # This parameter MUST be specified
 CONFIG
     assert_equal 'secret_string', p1.shared_key
     assert_equal 'server.fqdn.local', p1.self_hostname
-    assert p1.cert_auto_generate
 
     assert_raise(Fluent::ConfigError){ create_driver(<<CONFIG) }
   type secure_forward
+  secure no
   shared_key         secret_string
   self_hostname      server.fqdn.local
-  cert_auto_generate yes
   authentication     yes # Deny clients without valid username/password
   <user>
     username tagomoris
@@ -41,9 +40,9 @@ CONFIG
 CONFIG
     assert_raise(Fluent::ConfigError){ create_driver(<<CONFIG) }
   type secure_forward
+  secure no
   shared_key         secret_string
   self_hostname      server.fqdn.local
-  cert_auto_generate yes
   authentication     yes # Deny clients without valid username/password
   <user>
     username tagomoris
@@ -57,9 +56,9 @@ CONFIG
     p2 = nil
     assert_nothing_raised { p2 = create_driver(<<CONFIG).instance }
   type secure_forward
+  secure no
   shared_key         secret_string
   self_hostname      server.fqdn.local
-  cert_auto_generate yes
   authentication     yes # Deny clients without valid username/password
   <user>
     username tagomoris
@@ -76,9 +75,9 @@ CONFIG
 
     assert_raise(Fluent::ConfigError){ create_driver(<<CONFIG) }
   type secure_forward
+  secure no
   shared_key         secret_string
   self_hostname      server.fqdn.local
-  cert_auto_generate     yes
   allow_anonymous_source no  # Allow to accept from nodes of <client>
   <client>
     host 192.168.10.30
@@ -94,9 +93,9 @@ CONFIG
 CONFIG
     assert_raise(Fluent::ConfigError){ create_driver(<<CONFIG) }
   type secure_forward
+  secure no
   shared_key         secret_string
   self_hostname      server.fqdn.local
-  cert_auto_generate     yes
   allow_anonymous_source no  # Allow to accept from nodes of <client>
   <client>
     host 192.168.10.30
@@ -112,9 +111,9 @@ CONFIG
     p3 = nil
     assert_nothing_raised { p3 = create_driver(<<CONFIG).instance }
   type secure_forward
+  secure no
   shared_key         secret_string
   self_hostname      server.fqdn.local
-  cert_auto_generate     yes
   allow_anonymous_source no  # Allow to accept from nodes of <client>
   <client>
     host 192.168.10.30
@@ -137,6 +136,7 @@ CONFIG
 
     p4 = nil
     assert_nothing_raised { p4 = create_driver(<<CONFIG).instance }
+  secure no
   shared_key         secret_string
   self_hostname      server.fqdn.local
   cert_auto_generate     yes
@@ -169,4 +169,69 @@ CONFIG
 CONFIG
     assert_equal ['tagomoris','frsyuki'], p4.nodes[1][:users]
   end
+
+  def test_configure_secure
+    p = nil
+    assert_raise(Fluent::ConfigError) { p = create_driver(<<CONFIG).instance }
+  type secure_forward
+  shared_key         secret_string
+  self_hostname      server.fqdn.local  # This fqdn is used as CN (Common Name) of certificates
+CONFIG
+
+    assert_raise(Fluent::ConfigError) { p = create_driver(<<CONFIG).instance }
+  type secure_forward
+  secure true
+  shared_key         secret_string
+  self_hostname      server.fqdn.local  # This fqdn is used as CN (Common Name) of certificates
+CONFIG
+
+    assert_raise(Fluent::ConfigError) { p = create_driver(<<CONFIG).instance }
+  type secure_forward
+  secure true
+  shared_key         secret_string
+  self_hostname      server.fqdn.local  # This fqdn is used as CN (Common Name) of certificates
+  ca_cert_path       /anywhere/cert/file/does/not/exist
+CONFIG
+
+    passphrase = "testing secret phrase"
+    ca_dir = File.join(Dir.pwd, "test", "tmp", "cadir")
+    unless File.exist?(File.join(ca_dir, 'ca_cert.pem'))
+      FileUtils.mkdir_p(ca_dir)
+      opt = {
+        private_key_length: 2048,
+        cert_country:  'US',
+        cert_state:    'CA',
+        cert_locality: 'Mountain View',
+        cert_common_name: 'SecureForward CA',
+      }
+      cert, key = Fluent::SecureForward::CertUtil.generate_ca_pair(opt)
+      key_data = key.export(OpenSSL::Cipher::Cipher.new('aes256'), passphrase)
+      File.open(File.join(ca_dir, 'ca_key.pem'), 'w') do |file|
+        file.write key_data
+      end
+      File.open(File.join(ca_dir, 'ca_cert.pem'), 'w') do |file|
+        file.write cert.to_pem
+      end
+    end
+
+    assert_raise(OpenSSL::PKey::RSAError) { p = create_driver(<<CONFIG).instance }
+  type secure_forward
+  secure true
+  shared_key         secret_string
+  self_hostname      server.fqdn.local  # This fqdn is used as CN (Common Name) of certificates
+  ca_cert_path       #{ca_dir}/ca_cert.pem
+  ca_private_key_path #{ca_dir}/ca_key.pem
+  ca_private_key_passphrase wrong phrase
+CONFIG
+
+    assert_nothing_raised { p = create_driver(<<CONFIG).instance }
+  type secure_forward
+  secure true
+  shared_key         secret_string
+  self_hostname      server.fqdn.local  # This fqdn is used as CN (Common Name) of certificates
+  ca_cert_path       #{ca_dir}/ca_cert.pem
+  ca_private_key_path #{ca_dir}/ca_key.pem
+  ca_private_key_passphrase testing secret phrase
+CONFIG
+  end
 end

data/test/plugin/test_out_secure_forward.rb

@@ -16,6 +16,7 @@ class SecureForwardOutputTest < Test::Unit::TestCase
     p1 = nil
     assert_nothing_raised { p1 = create_driver(<<CONFIG).instance }
   type secure_forward
+  secure no
   shared_key secret_string
   self_hostname client.fqdn.local
   <server>
@@ -35,6 +36,7 @@ CONFIG
     p1 = nil
     assert_nothing_raised { p1 = create_driver(<<CONFIG).instance }
   type secure_forward
+  secure no
   shared_key secret_string
   self_hostname client.fqdn.local
   keepalive 1m
@@ -82,6 +84,7 @@ CONFIG
     p1 = nil
     assert_nothing_raised { p1 = create_driver(<<CONFIG).instance }
   type secure_forward
+  secure no
   shared_key secret_string
   self_hostname client.fqdn.local
   num_threads 3
@@ -99,4 +102,46 @@ CONFIG
     assert_equal 3, p1.num_threads
     assert_equal 1, p1.log.logs.select{|line| line =~ /\[warn\]: Too many num_threads for secure-forward:/}.size
   end
+
+  def test_configure_with_ca_cert
+    ca_dir = File.join(Dir.pwd, "test", "tmp", "cadir")
+    unless File.exist?(File.join(ca_dir, 'ca_cert.pem'))
+      FileUtils.mkdir_p(ca_dir)
+      opt = {
+        private_key_length: 2048,
+        cert_country:  'US',
+        cert_state:    'CA',
+        cert_locality: 'Mountain View',
+        cert_common_name: 'SecureForward CA',
+      }
+      cert, key = Fluent::SecureForward::CertUtil.generate_ca_pair(opt)
+      key_data = key.export(OpenSSL::Cipher::Cipher.new('aes256'), passphrase)
+      File.open(File.join(ca_dir, 'ca_key.pem'), 'w') do |file|
+        file.write key_data
+      end
+      File.open(File.join(ca_dir, 'ca_cert.pem'), 'w') do |file|
+        file.write cert.to_pem
+      end
+    end
+
+    p = nil
+    assert_nothing_raised { p = create_driver(<<CONFIG).instance }
+  type secure_forward
+  secure yes
+  ca_cert_path #{ca_dir}/ca_cert.pem
+  shared_key secret_string
+  self_hostname client.fqdn.local
+  num_threads 3
+  <server>
+    host server1.fqdn.local
+  </server>
+  <server>
+    host server2.fqdn.local
+  </server>
+  <server>
+    host server3.fqdn.local
+    standby
+  </server>
+CONFIG
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-secure-forward
 version: !ruby/object:Gem::Version
-  version: 0.2.6
+  version: 0.3.0
 platform: ruby
 authors:
 - TAGOMORI Satoshi
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-03-01 00:00:00.000000000 Z
+date: 2015-05-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: fluentd
@@ -83,7 +83,8 @@ dependencies:
 description: Message forwarding over SSL with authentication
 email:
 - tagomoris@gmail.com
-executables: []
+executables:
+- secure-forward-ca-generate
 extensions: []
 extra_rdoc_files: []
 files:
@@ -93,6 +94,7 @@ files:
 - LICENSE.txt
 - README.md
 - Rakefile
+- bin/secure-forward-ca-generate
 - example/auth_client.conf
 - example/auth_server.conf
 - example/cert_client.conf
@@ -100,6 +102,8 @@ files:
 - example/certs/cert.pem
 - example/certs/key.pem
 - example/client.conf
+- example/insecure_client.conf
+- example/insecure_server.conf
 - example/server.conf
 - fluent-plugin-secure-forward.gemspec
 - lib/fluent/plugin/in_secure_forward.rb
@@ -107,6 +111,7 @@ files:
 - lib/fluent/plugin/openssl_util.rb
 - lib/fluent/plugin/out_secure_forward.rb
 - lib/fluent/plugin/output_node.rb
+- lib/fluent/plugin/secure_forward/cert_util.rb
 - test/helper.rb
 - test/plugin/test_in_secure_forward.rb
 - test/plugin/test_input_session.rb
@@ -140,3 +145,4 @@ test_files:
 - test/plugin/test_in_secure_forward.rb
 - test/plugin/test_input_session.rb
 - test/plugin/test_out_secure_forward.rb
+has_rdoc: