fluent-plugin-secure-forward 0.3.1 → 0.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 5c76b6717bc34d045ab44d29ace650890d8b78da
-  data.tar.gz: 757fd393711ea77e11448491aee9ecd5358af942
+  metadata.gz: 55415b9e94812aef780d83eb0cbb597268440e49
+  data.tar.gz: 131d127a374a50390413313255c48ad9842d4174
 SHA512:
-  metadata.gz: 84e6610f4d7adf62b4918d03ed08fc60b9c374b007c32147039a3a02f3ddba16d6da3c62f5fd9c065d995a63be32f5592e21cabcd93d4d025dc40e83c62ddbfa
-  data.tar.gz: 236b1832abe620cc711ca748aeedd7b188457d5bc2925ca25be767d187e80d2faa1a109799af2d5cccb2d9e2fc32728f41a4721bd122fcec2e51d12065765441
+  metadata.gz: 77c5921e2bfa43fd48a0080de09ccebc28f2f76b218efa1f8b53e09b32b8d1aed9ce4dbbf77ebb713df7c8375a231ea0a426d77b5c4843ae8e954ba8b19abb90
+  data.tar.gz: d09d5754ed1dded8392ee0674249ea9c1d04fd5f49d66f823539fc3e1b974eb6b9e108439f1337431e51222477a8313eaa49d892ff89079398faa7a1f7fc2833

data/README.md

@@ -396,17 +396,18 @@ To specify keepalive timeouts, use `keepalive` configuration with seconds. SSL c
 3. (server) send HELO
   * ['HELO', options(hash)]
   * options:
+    * nonce: string as nonce: used for shared key digest (required, v0.3.2 or later)
     * auth: string or blank\_string (string: authentication required, and its salt is this value)
     * keepalive: bool (allowed or not)
 4. (client) send PING
-  * ['PING', selfhostname, sharedkey\_salt, sha512\_hex(sharedkey\_salt + selfhostname + sharedkey), username || '', sha512\_hex(auth\_salt + username + password) || '']
+  * ['PING', selfhostname, sharedkey\_salt, sha512\_hex(sharedkey\_salt + selfhostname + nonce + sharedkey), username || '', sha512\_hex(auth\_salt + username + password) || '']
 5. (server) check PING
   * check sharedkey
   * check username / password (if required)
   * send PONG FAILURE if failed
   * ['PONG', false, 'reason of authentication failure', '', '']
 6. (server) send PONG
-  * ['PONG', bool(authentication result), 'reason if authentication failed', selfhostname, sha512\_hex(salt + selfhostname + sharedkey)]
+  * ['PONG', bool(authentication result), 'reason if authentication failed', selfhostname, sha512\_hex(salt + selfhostname + nonce + sharedkey)]
 7. (client) check PONG
   * check sharedkey
   * disconnect when failed

data/fluent-plugin-secure-forward.gemspec

@@ -1,7 +1,7 @@
 # -*- encoding: utf-8 -*-
 Gem::Specification.new do |gem|
   gem.name          = "fluent-plugin-secure-forward"
-  gem.version       = "0.3.1"
+  gem.version       = "0.3.2"
   gem.authors       = ["TAGOMORI Satoshi"]
   gem.email         = ["tagomoris@gmail.com"]
   gem.summary       = %q{Fluentd input/output plugin to forward over SSL with authentications}

data/lib/fluent/plugin/input_session.rb

@@ -62,12 +62,12 @@ class Fluent::SecureForwardInput::Session
   def generate_helo
     log.debug "generating helo"
     # ['HELO', options(hash)]
-    [ 'HELO', {'auth' => (@receiver.authentication ? @auth_key_salt : ''), 'keepalive' => @receiver.allow_keepalive } ]
+    [ 'HELO', {'nonce' => @shared_key_nonce, 'auth' => (@receiver.authentication ? @auth_key_salt : ''), 'keepalive' => @receiver.allow_keepalive } ]
   end
 
   def check_ping(message)
     log.debug "checking ping"
-    # ['PING', self_hostname, shared_key\_salt, sha512\_hex(shared_key\_salt + self_hostname + shared_key),
+    # ['PING', self_hostname, shared_key\_salt, sha512\_hex(shared_key\_salt + self_hostname + nonce + shared_key),
     #  username || '', sha512\_hex(auth\_salt + username + password) || '']
     unless message.size == 6 && message[0] == 'PING'
       return false, 'invalid ping message'
@@ -79,7 +79,7 @@ class Fluent::SecureForwardInput::Session
                  else
                    @receiver.shared_key
                  end
-    serverside = Digest::SHA512.new.update(shared_key_salt).update(hostname).update(shared_key).hexdigest
+    serverside = Digest::SHA512.new.update(shared_key_salt).update(hostname).update(@shared_key_nonce).update(shared_key).hexdigest
     if shared_key_hexdigest != serverside
       log.warn "Shared key mismatch from '#{hostname}'"
       return false, 'shared_key mismatch'
@@ -104,7 +104,7 @@ class Fluent::SecureForwardInput::Session
   def generate_pong(auth_result, reason_or_salt)
     log.debug "generating pong"
     # ['PONG', bool(authentication result), 'reason if authentication failed',
-    #  self_hostname, sha512\_hex(salt + self_hostname + sharedkey)]
+    #  self_hostname, sha512\_hex(salt + self_hostname + nonce + sharedkey)]
     if not auth_result
       return ['PONG', false, reason_or_salt, '', '']
     end
@@ -114,7 +114,7 @@ class Fluent::SecureForwardInput::Session
                  else
                    @receiver.shared_key
                  end
-    shared_key_hex = Digest::SHA512.new.update(reason_or_salt).update(@receiver.self_hostname).update(shared_key).hexdigest
+    shared_key_hex = Digest::SHA512.new.update(reason_or_salt).update(@receiver.self_hostname).update(@shared_key_nonce).update(shared_key).hexdigest
     [ 'PONG', true, '', @receiver.self_hostname, shared_key_hex ]
   end
 
@@ -164,6 +164,7 @@ class Fluent::SecureForwardInput::Session
       return
     end
 
+    @shared_key_nonce = generate_salt
     @auth_key_salt = generate_salt
 
     buf = ''

data/lib/fluent/plugin/output_node.rb

@@ -130,6 +130,7 @@ class Fluent::SecureForwardOutput::Node
       return false
     end
     opts = message[1]
+    @shared_key_nonce = opts['nonce'] || '' # make shared_key_check failed (instead of error) if protocol version mismatch exist
     @authentication = opts['auth']
     @allow_keepalive = opts['keepalive']
     true
@@ -137,9 +138,9 @@ class Fluent::SecureForwardOutput::Node
 
   def generate_ping
     log.debug "generating ping"
-    # ['PING', self_hostname, sharedkey\_salt, sha512\_hex(sharedkey\_salt + self_hostname + shared_key),
+    # ['PING', self_hostname, sharedkey\_salt, sha512\_hex(sharedkey\_salt + self_hostname + nonce + shared_key),
     #  username || '', sha512\_hex(auth\_salt + username + password) || '']
-    shared_key_hexdigest = Digest::SHA512.new.update(@shared_key_salt).update(@sender.self_hostname).update(@shared_key).hexdigest
+    shared_key_hexdigest = Digest::SHA512.new.update(@shared_key_salt).update(@sender.self_hostname).update(@shared_key_nonce).update(@shared_key).hexdigest
     ping = ['PING', @sender.self_hostname, @shared_key_salt, shared_key_hexdigest]
     if @authentication != ''
       password_hexdigest = Digest::SHA512.new.update(@authentication).update(@username).update(@password).hexdigest
@@ -153,7 +154,7 @@ class Fluent::SecureForwardOutput::Node
   def check_pong(message)
     log.debug "checking pong"
     # ['PONG', bool(authentication result), 'reason if authentication failed',
-    #  self_hostname, sha512\_hex(salt + self_hostname + sharedkey)]
+    #  self_hostname, sha512\_hex(salt + self_hostname + nonce + sharedkey)]
     unless message.size == 5 && message[0] == 'PONG'
       return false, 'invalid format for PONG message'
     end
@@ -167,7 +168,7 @@ class Fluent::SecureForwardOutput::Node
       return false, 'same hostname between input and output: invalid configuration'
     end
 
-    clientside = Digest::SHA512.new.update(@shared_key_salt).update(hostname).update(@shared_key).hexdigest
+    clientside = Digest::SHA512.new.update(@shared_key_salt).update(hostname).update(@shared_key_nonce).update(@shared_key).hexdigest
     unless shared_key_hexdigest == clientside
       return false, 'shared key mismatch'
     end
@@ -253,9 +254,9 @@ class Fluent::SecureForwardOutput::Node
       log.trace "set verify_mode VERIFY_PEER"
       context.verify_mode = OpenSSL::SSL::VERIFY_PEER
       if @sender.enable_strict_verification
-        context.ca_store = OpenSSL::X509::Store.new
+        context.cert_store = OpenSSL::X509::Store.new
         begin
-          context.ca_store.set_default_paths
+          context.cert_store.set_default_paths
         rescue OpenSSL::X509::StoreError => e
           log.warn "faild to load system default certificates", error: e
         end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-secure-forward
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.3.2
 platform: ruby
 authors:
 - TAGOMORI Satoshi