fluent-plugin-ssl-check 2.0.1 → 2.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f02f38e91d229dc73544825292eac6c885e1720ce93cc9a5c121746204437442
-  data.tar.gz: 42f3a3d2369f699db149e92eeb93e0660bc95e4eb925fefdd6f7dc77e84e141b
+  metadata.gz: 6f57a4e0f824d263cc4cde461a9b4846695309b16e7211486ba6ccd2e41365c0
+  data.tar.gz: c93593774d277d9769bb953f0e7893bbaf7168adf514dadff415a2382b37e37b
 SHA512:
-  metadata.gz: 786757380f973b13d7f220a0c32759b57f28e2ae449ef55f51f639bf79c8a360b05afadf84521292c006a02ba408e8bb63cc50dd9e4a9a64a3436c95390a95ce
-  data.tar.gz: 027f9042684d4114b3a18a12af0a29b629a7b7954c7f8c8b61726c51ba70c620b13617828c32a0df8120dc0f9e6a99dedc3c186e9b1a324e894f2ee7779ea732
+  metadata.gz: 4e4cdfd93bd663bfb08e75fc60b9cd5ec34d58957001207569932cd6696e2e6c51e5ae3392fcbf76caa624af9a1d00684e56646f2690a8d96fbdd778b7fc653c
+  data.tar.gz: 3446b7d2cfb26a28754bafee5074725f8bff7a1381d1020128d61b01bb31ae7785b08762749c17fd83c378a78f8815e98c9809f5c5e5d9ccb874140114954be8

data/.rubocop.yml

@@ -26,10 +26,6 @@ Metrics/ClassLength:
 Metrics/MethodLength:
   Max: 20
 
-Metrics/ParameterLists:
-  Exclude:
-    - test/helper.rb
-
 # Naming/MethodParameterName:
 #   Exclude:
 #     - lib/fluent/plugin/in_ssl_check.rb

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    fluent-plugin-ssl-check (2.0.1)
+    fluent-plugin-ssl-check (2.2.0)
       fluentd (>= 0.14.10, < 2)
 
 GEM

data/README.md

@@ -30,6 +30,10 @@ Options are:
 * interval: check every X seconds
 * ca_path: directory that contains CA files
 * ca_file: specify a CA file directly
+* sni: want the sni support (true)
+* verify_mode: none or peer
+* cert: client cert for ssl connection
+* key: client key associated to client cert for ssl connection
 * timeout: timeout for ssl check execution (5sec)
 * log_events: emit log format (true)
 * metric_events: emit metric format (false)

data/fluent-plugin-ssl-check.gemspec

@@ -5,7 +5,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
 Gem::Specification.new do |spec|
   spec.name    = 'fluent-plugin-ssl-check'
-  spec.version = '2.0.1'
+  spec.version = '2.2.0'
   spec.authors = ['Thomas Tych']
   spec.email   = ['thomas.tych@gmail.com']
 

data/lib/fluent/plugin/in_ssl_check.rb

@@ -33,9 +33,10 @@ module Fluent
       Fluent::Plugin.register_input(NAME, self)
 
       DEFAULT_TAG = NAME
-      DEFAULT_HOST = 'localhost'
       DEFAULT_PORT = 443
-      DEFAULT_TIME = 600
+      DEFAULT_INTERVAL = 600
+      DEFAULT_SNI = true
+      DEFAULT_VERIFY_MODE = :peer
       DEFAULT_TIMEOUT = 5
       DEFAULT_LOG_EVENTS = true
       DEFAULT_METRIC_EVENTS = false
@@ -47,11 +48,19 @@ module Fluent
       desc 'Host of the service to check'
       config_param :hosts, :array, default: [], value_type: :string
       desc 'Interval for the check execution'
-      config_param :interval, :time, default: DEFAULT_TIME
+      config_param :interval, :time, default: DEFAULT_INTERVAL
       desc 'CA path to load'
       config_param :ca_path, :string, default: nil
       desc 'CA file to load'
       config_param :ca_file, :string, default: nil
+      desc 'SNI support'
+      config_param :sni, :bool, default: DEFAULT_SNI
+      desc 'Verify mode'
+      config_param :verify_mode, :enum, list: %i[none peer], default: DEFAULT_VERIFY_MODE
+      desc 'Client Cert'
+      config_param :cert, :string, default: nil
+      desc 'Client Key'
+      config_param :key, :string, default: nil
 
       desc 'Timeout for check'
       config_param :timeout, :integer, default: DEFAULT_TIMEOUT
@@ -67,17 +76,22 @@ module Fluent
 
       helpers :timer
 
-      # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+      # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/AbcSize, Style/DoubleNegation
       def configure(conf)
         super
 
         raise Fluent::ConfigError, 'tag can not be empty.' if !tag || tag.empty?
-        raise Fluent::ConfigError, 'hosts can not be empty.' if !hosts || hosts.empty?
+        raise Fluent::ConfigError, 'hosts can not be empty.' unless hosts
         raise Fluent::ConfigError, 'interval can not be < 1.' if !interval || interval < 1
         raise Fluent::ConfigError, 'ca_path should be a dir.' if ca_path && !File.directory?(ca_path)
         raise Fluent::ConfigError, 'ca_file should be a file.' if ca_file && !File.file?(ca_file)
+        raise Fluent::ConfigError, 'cert should be a file.' if cert && !File.file?(cert)
+        raise Fluent::ConfigError, 'key should be a file.' if key && !File.file?(key)
+        raise Fluent::ConfigError, 'cert and key should be specified.' if !!cert ^ !!key
+
+        log.warn("#{NAME}: hosts is empty, nothing to process") if hosts.empty?
       end
-      # rubocop:enable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+      # rubocop:enable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/AbcSize, Style/DoubleNegation
 
       def start
         super
@@ -104,6 +118,8 @@ module Fluent
         ssl_client = SslClient.new(
           host: host, port: port,
           ca_path: ca_path, ca_file: ca_file,
+          sni: sni, verify_mode: ssl_verify_mode,
+          cert: cert, key: key,
           timeout: timeout
         )
         ssl_client.ssl_info
@@ -157,6 +173,14 @@ module Fluent
         router.emit(tag, Fluent::EventTime.from_time(ssl_info.time), record)
       end
 
+      private
+
+      def ssl_verify_mode
+        return OpenSSL::SSL::VERIFY_PEER if verify_mode == :peer
+
+        OpenSSL::SSL::VERIFY_NONE
+      end
+
       # ssl info
       #  to encapsulate extracted ssl information
       class SslInfo
@@ -211,15 +235,23 @@ module Fluent
       # ssl client
       #  to check ssl status
       class SslClient
-        attr_reader :host, :port, :ca_path, :ca_file, :timeout
+        attr_reader :host, :port, :ca_path, :ca_file, :sni, :verify_mode, :cert, :key, :timeout
 
-        def initialize(host:, port:, ca_path: nil, ca_file: nil, timeout: 5)
+        # rubocop:disable Metrics/ParameterLists
+        def initialize(host:, port:, ca_path: nil, ca_file: nil, sni: true, verify_mode: OpenSSL::SSL::VERIFY_PEER,
+                       cert: nil, key: nil,
+                       timeout: 5)
           @host = host
           @port = port
           @ca_path = ca_path
           @ca_file = ca_file
+          @sni = sni
+          @verify_mode = verify_mode
+          @cert = cert
+          @key = key
           @timeout = timeout
         end
+        # rubocop:enable Metrics/ParameterLists
 
         def ssl_info
           info = SslInfo.new(host: host, port: port)
@@ -227,6 +259,7 @@ module Fluent
             Timeout.timeout(timeout) do
               tcp_socket = TCPSocket.open(host, port)
               ssl_socket = OpenSSL::SSL::SSLSocket.new(tcp_socket, ssl_context)
+              ssl_socket.hostname = host if sni
               ssl_socket.connect
               ssl_socket.sysclose
               tcp_socket.close
@@ -252,10 +285,12 @@ module Fluent
 
         def ssl_context
           OpenSSL::SSL::SSLContext.new.tap do |ssl_context|
-            ssl_context.verify_mode = OpenSSL::SSL::VERIFY_PEER
+            ssl_context.verify_mode = verify_mode
             ssl_context.cert_store = store
             ssl_context.min_version = nil
             ssl_context.max_version = OpenSSL::SSL::TLS1_2_VERSION
+            ssl_context.cert = OpenSSL::X509::Certificate.new(File.open(cert)) if cert
+            ssl_context.key = OpenSSL::PKey::RSA.new(File.open(key)) if key
           end
         end
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-ssl-check
 version: !ruby/object:Gem::Version
-  version: 2.0.1
+  version: 2.2.0
 platform: ruby
 authors:
 - Thomas Tych
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-08-24 00:00:00.000000000 Z
+date: 2023-09-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bump