fluentd-hubspot 0.14.14.1

data/lib/fluent/plugin_helper/socket.rb

@@ -0,0 +1,241 @@
+#
+# Fluentd
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+#
+
+require 'socket'
+require 'ipaddr'
+require 'openssl'
+
+require_relative 'socket_option'
+
+module Fluent
+  module PluginHelper
+    module Socket
+      # stop     : [-]
+      # shutdown : [-]
+      # close    : [-]
+      # terminate: [-]
+
+      include Fluent::PluginHelper::SocketOption
+
+      TLS_DEFAULT_VERSION = :'TLSv1_2'
+      TLS_SUPPORTED_VERSIONS = [:'TLSv1_1', :'TLSv1_2']
+      ### follow httpclient configuration by nahi
+      # OpenSSL 0.9.8 default: "ALL:!ADH:!LOW:!EXP:!MD5:+SSLv2:@STRENGTH"
+      CIPHERS_DEFAULT = "ALL:!aNULL:!eNULL:!SSLv2" # OpenSSL >1.0.0 default
+
+      attr_reader :_sockets # for tests
+
+      # TODO: implement connection pool for specified host
+
+      def socket_create(proto, host, port, **kwargs, &block)
+        case proto
+        when :tcp
+          socket_create_tcp(host, port, **kwargs, &block)
+        when :udp
+          socket_create_udp(host, port, **kwargs, &block)
+        when :tls
+          socket_create_tls(host, port, **kwargs, &block)
+        when :unix
+          raise "not implemented yet"
+        else
+          raise ArgumentError, "invalid protocol: #{proto}"
+        end
+      end
+
+      def socket_create_tcp(host, port, resolve_name: false, **kwargs, &block)
+        sock = WrappedSocket::TCP.new(host, port)
+        socket_option_set(sock, resolve_name: resolve_name, **kwargs)
+        if block
+          begin
+            block.call(sock)
+          ensure
+            sock.close_write rescue nil
+            sock.close rescue nil
+          end
+        else
+          sock
+        end
+      end
+
+      def socket_create_udp(host, port, resolve_name: false, connect: false, **kwargs, &block)
+        family = IPAddr.new(IPSocket.getaddress(host)).ipv4? ? ::Socket::AF_INET : ::Socket::AF_INET6
+        sock = WrappedSocket::UDP.new(family)
+        socket_option_set(sock, resolve_name: resolve_name, **kwargs)
+        sock.connect(host, port) if connect
+        if block
+          begin
+            block.call(sock)
+          ensure
+            sock.close rescue nil
+          end
+        else
+          sock
+        end
+      end
+
+      def socket_create_tls(
+          host, port,
+          version: TLS_DEFAULT_VERSION, ciphers: CIPHERS_DEFAULT, insecure: false, verify_fqdn: true, fqdn: nil,
+          enable_system_cert_store: true, allow_self_signed_cert: false, cert_paths: nil, **kwargs, &block)
+
+        host_is_ipaddress = IPAddr.new(host) rescue false
+        fqdn ||= host unless host_is_ipaddress
+
+        context = OpenSSL::SSL::SSLContext.new(version)
+
+        if insecure
+          log.trace "setting TLS verify_mode NONE"
+          context.verify_mode = OpenSSL::SSL::VERIFY_NONE
+        else
+          cert_store = OpenSSL::X509::Store.new
+          if allow_self_signed_cert && OpenSSL::X509.const_defined?('V_FLAG_CHECK_SS_SIGNATURE')
+            cert_store.flags = OpenSSL::X509::V_FLAG_CHECK_SS_SIGNATURE
+          end
+          begin
+            if enable_system_cert_store
+              log.trace "loading system default certificate store"
+              cert_store.set_default_paths
+            end
+          rescue OpenSSL::X509::StoreError
+            log.warn "failed to load system default certificate store", error: e
+          end
+          if cert_paths
+            if cert_paths.respond_to?(:each)
+              cert_paths.each do |cert_path|
+                log.trace "adding CA cert", path: cert_path
+                cert_store.add_file(cert_path)
+              end
+            else
+              cert_path = cert_paths
+              log.trace "adding CA cert", path: cert_path
+              cert_store.add_file(cert_path)
+            end
+          end
+
+          log.trace "setting TLS context", mode: "peer", ciphers: ciphers
+          context.set_params({})
+          context.ciphers = ciphers
+          context.verify_mode = OpenSSL::SSL::VERIFY_PEER
+          context.cert_store = cert_store
+          context.verify_hostname = true if verify_fqdn && fqdn && context.respond_to?(:verify_hostname=)
+        end
+
+        tcpsock = socket_create_tcp(host, port, **kwargs)
+        sock = WrappedSocket::TLS.new(tcpsock, context)
+        sock.sync_close = true
+        sock.hostname = fqdn if verify_fqdn && fqdn && sock.respond_to?(:hostname=)
+
+        log.trace "entering TLS handshake"
+        sock.connect
+
+        begin
+          if verify_fqdn
+            log.trace "checking peer's certificate", subject: sock.peer_cert.subject
+            sock.post_connection_check(fqdn)
+            verify = sock.verify_result
+            if verify != OpenSSL::X509::V_OK
+              err_name = Socket.tls_verify_result_name(verify)
+              log.warn "BUG: failed to verify certification while connecting (but not raised, why?)", host: host, fqdn: fqdn, error: err_name
+              raise RuntimeError, "BUG: failed to verify certification and to handle it correctly while connecting host #{host} as #{fqdn}"
+            end
+          end
+        rescue OpenSSL::SSL::SSLError => e
+          log.warn "failed to verify certification while connecting tls session", host: host, fqdn: fqdn, error: e
+          raise
+        end
+
+        if block
+          begin
+            block.call(sock)
+          ensure
+            sock.close rescue nil
+          end
+        else
+          sock
+        end
+      end
+
+      def self.tls_verify_result_name(code)
+        case code
+        when OpenSSL::X509::V_OK then 'V_OK'
+        when OpenSSL::X509::V_ERR_AKID_SKID_MISMATCH then 'V_ERR_AKID_SKID_MISMATCH'
+        when OpenSSL::X509::V_ERR_APPLICATION_VERIFICATION then 'V_ERR_APPLICATION_VERIFICATION'
+        when OpenSSL::X509::V_ERR_CERT_CHAIN_TOO_LONG then 'V_ERR_CERT_CHAIN_TOO_LONG'
+        when OpenSSL::X509::V_ERR_CERT_HAS_EXPIRED then 'V_ERR_CERT_HAS_EXPIRED'
+        when OpenSSL::X509::V_ERR_CERT_NOT_YET_VALID then 'V_ERR_CERT_NOT_YET_VALID'
+        when OpenSSL::X509::V_ERR_CERT_REJECTED then 'V_ERR_CERT_REJECTED'
+        when OpenSSL::X509::V_ERR_CERT_REVOKED then 'V_ERR_CERT_REVOKED'
+        when OpenSSL::X509::V_ERR_CERT_SIGNATURE_FAILURE then 'V_ERR_CERT_SIGNATURE_FAILURE'
+        when OpenSSL::X509::V_ERR_CERT_UNTRUSTED then 'V_ERR_CERT_UNTRUSTED'
+        when OpenSSL::X509::V_ERR_CRL_HAS_EXPIRED then 'V_ERR_CRL_HAS_EXPIRED'
+        when OpenSSL::X509::V_ERR_CRL_NOT_YET_VALID then 'V_ERR_CRL_NOT_YET_VALID'
+        when OpenSSL::X509::V_ERR_CRL_SIGNATURE_FAILURE then 'V_ERR_CRL_SIGNATURE_FAILURE'
+        when OpenSSL::X509::V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT then 'V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT'
+        when OpenSSL::X509::V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD then 'V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD'
+        when OpenSSL::X509::V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD then 'V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD'
+        when OpenSSL::X509::V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD then 'V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD'
+        when OpenSSL::X509::V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD then 'V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD'
+        when OpenSSL::X509::V_ERR_INVALID_CA then 'V_ERR_INVALID_CA'
+        when OpenSSL::X509::V_ERR_INVALID_PURPOSE then 'V_ERR_INVALID_PURPOSE'
+        when OpenSSL::X509::V_ERR_KEYUSAGE_NO_CERTSIGN then 'V_ERR_KEYUSAGE_NO_CERTSIGN'
+        when OpenSSL::X509::V_ERR_OUT_OF_MEM then 'V_ERR_OUT_OF_MEM'
+        when OpenSSL::X509::V_ERR_PATH_LENGTH_EXCEEDED then 'V_ERR_PATH_LENGTH_EXCEEDED'
+        when OpenSSL::X509::V_ERR_SELF_SIGNED_CERT_IN_CHAIN then 'V_ERR_SELF_SIGNED_CERT_IN_CHAIN'
+        when OpenSSL::X509::V_ERR_SUBJECT_ISSUER_MISMATCH then 'V_ERR_SUBJECT_ISSUER_MISMATCH'
+        when OpenSSL::X509::V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY then 'V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY'
+        when OpenSSL::X509::V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE then 'V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY'
+        when OpenSSL::X509::V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE then 'V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE'
+        when OpenSSL::X509::V_ERR_UNABLE_TO_GET_CRL then 'V_ERR_UNABLE_TO_GET_CRL'
+        when OpenSSL::X509::V_ERR_UNABLE_TO_GET_ISSUER_CERT then 'V_ERR_UNABLE_TO_GET_ISSUER_CERT'
+        when OpenSSL::X509::V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY then 'V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY'
+        when OpenSSL::X509::V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE then 'V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE'
+        end
+      end
+
+      # socket_create_socks ?
+
+      module WrappedSocket
+        class TCP < ::TCPSocket
+          def remote_addr; peeraddr[3]; end
+          def remote_host; peeraddr[2]; end
+          def remote_port; peeraddr[1]; end
+        end
+        class UDP < ::UDPSocket
+          def remote_addr; peeraddr[3]; end
+          def remote_host; peeraddr[2]; end
+          def remote_port; peeraddr[1]; end
+        end
+        class TLS < OpenSSL::SSL::SSLSocket
+          def remote_addr; peeraddr[3]; end
+          def remote_host; peeraddr[2]; end
+          def remote_port; peeraddr[1]; end
+        end
+      end
+
+      def initialize
+        super
+        # @_sockets = [] # for keepalived sockets / connection pool
+      end
+
+      # def close
+      #   @_sockets.each do |sock|
+      #     sock.close
+      #   end
+      #   super
+      # end
+    end
+  end
+end

data/lib/fluent/plugin_helper/socket_option.rb

@@ -0,0 +1,69 @@
+#
+# Fluentd
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+#
+
+require 'socket'
+require 'fcntl'
+
+# this module is only for Socket/Server plugin helpers
+module Fluent
+  module PluginHelper
+    module SocketOption
+      FORMAT_STRUCT_LINGER  = 'I!I!' # { int l_onoff; int l_linger; }
+      FORMAT_STRUCT_TIMEVAL = 'L!L!' # { time_t tv_sec; suseconds_t tv_usec; }
+
+      def socket_option_validate!(protocol, resolve_name: nil, linger_timeout: nil, recv_timeout: nil, send_timeout: nil)
+        unless resolve_name.nil?
+          if protocol != :tcp && protocol != :udp && protocol != :tls
+            raise ArgumentError, "BUG: resolve_name in available for tcp/udp/tls"
+          end
+        end
+        if linger_timeout
+          if protocol != :tcp && protocol != :tls
+            raise ArgumentError, "BUG: linger_timeout is available for tcp/tls"
+          end
+        end
+      end
+
+      def socket_option_set(sock, resolve_name: nil, nonblock: false, linger_timeout: nil, recv_timeout: nil, send_timeout: nil)
+        unless resolve_name.nil?
+          sock.do_not_reverse_lookup = !resolve_name
+        end
+        if nonblock
+          sock.fcntl(Fcntl::F_SETFL, Fcntl::O_NONBLOCK)
+        end
+        if linger_timeout
+          optval = [1, linger_timeout.to_i].pack(FORMAT_STRUCT_LINGER)
+          socket_option_set_one(sock, :SO_LINGER, optval)
+        end
+        if recv_timeout
+          optval = [recv_timeout.to_i, 0].pack(FORMAT_STRUCT_TIMEVAL)
+          socket_option_set_one(sock, :SO_RCVTIMEO, optval)
+        end
+        if send_timeout
+          optval = [send_timeout.to_i, 0].pack(FORMAT_STRUCT_TIMEVAL)
+          socket_option_set_one(sock, :SO_SNDTIMEO, optval)
+        end
+        sock
+      end
+
+      def socket_option_set_one(sock, option, value)
+        sock.setsockopt(::Socket::SOL_SOCKET, option, value)
+      rescue => e
+        log.warn "failed to set socket option", sock: sock.class, option: option, value: value, error: e
+      end
+    end
+  end
+end

data/lib/fluent/plugin_helper/storage.rb

@@ -0,0 +1,349 @@
+#
+# Fluentd
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+#
+
+require 'forwardable'
+
+require 'fluent/plugin'
+require 'fluent/plugin/storage'
+require 'fluent/plugin_helper/timer'
+require 'fluent/config/element'
+require 'fluent/configurable'
+
+module Fluent
+  module PluginHelper
+    module Storage
+      include Fluent::PluginHelper::Timer
+
+      StorageState = Struct.new(:storage, :running)
+
+      def storage_create(usage: '', type: nil, conf: nil, default_type: nil)
+        if conf && conf.respond_to?(:arg) && !conf.arg.empty?
+          usage = conf.arg
+        end
+        if !usage.empty? && usage !~ /^[a-zA-Z][-_.a-zA-Z0-9]*$/
+          raise Fluent::ConfigError, "Argument in <storage ARG> uses invalid characters: '#{usage}'"
+        end
+
+        s = @_storages[usage]
+        if s && s.running
+          return s.storage
+        elsif s
+          # storage is already created, but not loaded / started
+        else # !s
+          type = if type
+                   type
+                 elsif conf && conf.respond_to?(:[])
+                   raise Fluent::ConfigError, "@type is required in <storage>" unless conf['@type']
+                   conf['@type']
+                 elsif default_type
+                   default_type
+                 else
+                   raise ArgumentError, "BUG: both type and conf are not specified"
+                 end
+          storage = Plugin.new_storage(type, parent: self)
+          config = case conf
+                   when Fluent::Config::Element
+                     conf
+                   when Hash
+                     # in code, programmer may use symbols as keys, but Element needs strings
+                     conf = Hash[conf.map{|k,v| [k.to_s, v]}]
+                     Fluent::Config::Element.new('storage', usage, conf, [])
+                   when nil
+                     Fluent::Config::Element.new('storage', usage, {'@type' => type}, [])
+                   else
+                     raise ArgumentError, "BUG: conf must be a Element, Hash (or unspecified), but '#{conf.class}'"
+                   end
+          storage.configure(config)
+          if @_storages_started
+            storage.start
+          end
+          s = @_storages[usage] = StorageState.new(wrap_instance(storage), false)
+        end
+
+        s.storage
+      end
+
+      module StorageParams
+        include Fluent::Configurable
+        # minimum section definition to instantiate storage plugin instances
+        config_section :storage, required: false, multi: true, param_name: :storage_configs, init: true do
+          config_argument :usage, :string, default: ''
+          config_param    :@type, :string, default: Fluent::Plugin::Storage::DEFAULT_TYPE
+        end
+      end
+
+      def self.included(mod)
+        mod.include StorageParams
+      end
+
+      attr_reader :_storages # for tests
+
+      def initialize
+        super
+        @_storages_started = false
+        @_storages = {} # usage => storage_state
+      end
+
+      def configure(conf)
+        super
+
+        @storage_configs.each do |section|
+          if !section.usage.empty? && section.usage !~ /^[a-zA-Z][-_.a-zA-Z0-9]*$/
+            raise Fluent::ConfigError, "Argument in <storage ARG> uses invalid characters: '#{section.usage}'"
+          end
+          if @_storages[section.usage]
+            raise Fluent::ConfigError, "duplicated storages configured: #{section.usage}"
+          end
+          storage = Plugin.new_storage(section[:@type], parent: self)
+          storage.configure(section.corresponding_config_element)
+          @_storages[section.usage] = StorageState.new(wrap_instance(storage), false)
+        end
+      end
+
+      def start
+        super
+
+        @_storages_started = true
+        @_storages.each_pair do |usage, s|
+          s.storage.start
+          s.storage.load
+
+          if s.storage.autosave && !s.storage.persistent
+            timer_execute(:storage_autosave, s.storage.autosave_interval, repeat: true) do
+              begin
+                s.storage.save
+              rescue => e
+                log.error "plugin storage failed to save its data", usage: usage, type: type, error: e
+              end
+            end
+          end
+          s.running = true
+        end
+      end
+
+      def storage_operate(method_name, &block)
+        @_storages.each_pair do |usage, s|
+          begin
+            block.call(s) if block_given?
+            s.storage.send(method_name)
+          rescue => e
+            log.error "unexpected error while #{method_name}", usage: usage, storage: s.storage, error: e
+          end
+        end
+      end
+
+      def stop
+        super
+        # timer stops automatically in super
+        storage_operate(:stop)
+      end
+
+      def before_shutdown
+        storage_operate(:before_shutdown)
+        super
+      end
+
+      def shutdown
+        storage_operate(:shutdown) do |s|
+          s.storage.save if s.storage.save_at_shutdown
+        end
+        super
+      end
+
+      def after_shutdown
+        storage_operate(:after_shutdown)
+        super
+      end
+
+      def close
+        storage_operate(:close){|s| s.running = false }
+        super
+      end
+
+      def terminate
+        storage_operate(:terminate)
+        @_storages = {}
+        super
+      end
+
+      def wrap_instance(storage)
+        if storage.persistent && storage.persistent_always?
+          storage
+        elsif storage.persistent
+          PersistentWrapper.new(storage)
+        elsif !storage.synchronized?
+          SynchronizeWrapper.new(storage)
+        else
+          storage
+        end
+      end
+
+      class PersistentWrapper
+        # PersistentWrapper always provides synchronized operations
+        extend Forwardable
+
+        def initialize(storage)
+          @storage = storage
+          @monitor = Monitor.new
+        end
+
+        def_delegators :@storage, :autosave_interval, :save_at_shutdown
+        def_delegators :@storage, :start, :stop, :before_shutdown, :shutdown, :after_shutdown, :close, :terminate
+        def_delegators :@storage, :started?, :stopped?, :before_shutdown?, :shutdown?, :after_shutdown?, :closed?, :terminated?
+
+        def method_missing(name, *args)
+          @monitor.synchronize{ @storage.__send__(name, *args) }
+        end
+
+        def persistent_always?
+          true
+        end
+
+        def persistent
+          true
+        end
+
+        def autosave
+          false
+        end
+
+        def synchronized?
+          true
+        end
+
+        def implementation
+          @storage
+        end
+
+        def load
+          @monitor.synchronize do
+            @storage.load
+          end
+        end
+
+        def save
+          @monitor.synchronize do
+            @storage.save
+          end
+        end
+
+        def get(key)
+          @monitor.synchronize do
+            @storage.load
+            @storage.get(key)
+          end
+        end
+
+        def fetch(key, defval)
+          @monitor.synchronize do
+            @storage.load
+            @storage.fetch(key, defval)
+          end
+        end
+
+        def put(key, value)
+          @monitor.synchronize do
+            @storage.load
+            @storage.put(key, value)
+            @storage.save
+            value
+          end
+        end
+
+        def delete(key)
+          @monitor.synchronize do
+            @storage.load
+            val = @storage.delete(key)
+            @storage.save
+            val
+          end
+        end
+
+        def update(key, &block)
+          @monitor.synchronize do
+            @storage.load
+            v = block.call(@storage.get(key))
+            @storage.put(key, v)
+            @storage.save
+            v
+          end
+        end
+      end
+
+      class SynchronizeWrapper
+        extend Forwardable
+
+        def initialize(storage)
+          @storage = storage
+          @monitor = Monitor.new
+        end
+
+        def_delegators :@storage, :persistent, :autosave, :autosave_interval, :save_at_shutdown
+        def_delegators :@storage, :persistent_always?
+        def_delegators :@storage, :start, :stop, :before_shutdown, :shutdown, :after_shutdown, :close, :terminate
+        def_delegators :@storage, :started?, :stopped?, :before_shutdown?, :shutdown?, :after_shutdown?, :closed?, :terminated?
+
+        def method_missing(name, *args)
+          @monitor.synchronize{ @storage.__send__(name, *args) }
+        end
+
+        def synchronized?
+          true
+        end
+
+        def implementation
+          @storage
+        end
+
+        def load
+          @monitor.synchronize do
+            @storage.load
+          end
+        end
+
+        def save
+          @monitor.synchronize do
+            @storage.save
+          end
+        end
+
+        def get(key)
+          @monitor.synchronize{ @storage.get(key) }
+        end
+
+        def fetch(key, defval)
+          @monitor.synchronize{ @storage.fetch(key, defval) }
+        end
+
+        def put(key, value)
+          @monitor.synchronize{ @storage.put(key, value) }
+        end
+
+        def delete(key)
+          @monitor.synchronize{ @storage.delete(key) }
+        end
+
+        def update(key, &block)
+          @monitor.synchronize do
+            v = block.call(@storage.get(key))
+            @storage.put(key, v)
+            v
+          end
+        end
+      end
+    end
+  end
+end