fluentd 1.14.4-x64-mingw-ucrt

data/lib/fluent/plugin_helper/service_discovery/manager.rb

@@ -0,0 +1,146 @@
+#
+# Fluentd
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+#
+
+require 'fluent/plugin/service_discovery'
+require 'fluent/plugin_helper/service_discovery/round_robin_balancer'
+
+module Fluent
+  module PluginHelper
+    module ServiceDiscovery
+      class Manager
+        def initialize(log:, load_balancer: nil, custom_build_method: nil)
+          @log = log
+          @load_balancer = load_balancer || RoundRobinBalancer.new
+          @custom_build_method = custom_build_method
+
+          @discoveries = []
+          @services = {}
+          @queue = Queue.new
+          @static_config = true
+        end
+
+        def configure(configs, parent: nil)
+          configs.each do |config|
+            type, conf = if config.has_key?(:conf) # for compatibility with initial API
+                           [config[:type], config[:conf]]
+                         else
+                           [config['@type'], config]
+                         end
+
+            sd = Fluent::Plugin.new_sd(type, parent: parent)
+            sd.configure(conf)
+
+            sd.services.each do |s|
+              @services[s.discovery_id] = build_service(s)
+            end
+            @discoveries << sd
+
+            if @static_config && type.to_sym != :static
+              @static_config = false
+            end
+          end
+
+          rebalance
+        end
+
+        def static_config?
+          @static_config
+        end
+
+        def start
+          @discoveries.each do |d|
+            d.start(@queue)
+          end
+        end
+
+        %i[after_start stop before_shutdown shutdown after_shutdown close terminate].each do |mth|
+          define_method(mth) do
+            @discoveries.each do |d|
+              d.__send__(mth)
+            end
+          end
+        end
+
+        def run_once
+          # Don't care race in this loop intentionally
+          s = @queue.size
+
+          if s == 0
+            return
+          end
+
+          s.times do
+            msg = @queue.pop
+
+            unless msg.is_a?(Fluent::Plugin::ServiceDiscovery::DiscoveryMessage)
+              @log.warn("BUG: #{msg}")
+              next
+            end
+
+            begin
+              handle_message(msg)
+            rescue => e
+              @log.error(e)
+            end
+          end
+
+          rebalance
+        end
+
+        def rebalance
+          @load_balancer.rebalance(services)
+        end
+
+        def select_service(&block)
+          @load_balancer.select_service(&block)
+        end
+
+        def services
+          @services.values
+        end
+
+        private
+
+        def handle_message(msg)
+          service = msg.service
+
+          case msg.type
+          when Fluent::Plugin::ServiceDiscovery::SERVICE_IN
+            if (n = build_service(service))
+              @log.info("Service in: name=#{service.name} #{service.host}:#{service.port}")
+              @services[service.discovery_id] = n
+            else
+              raise "failed to build service in name=#{service.name} #{service.host}:#{service.port}"
+            end
+          when Fluent::Plugin::ServiceDiscovery::SERVICE_OUT
+            s = @services.delete(service.discovery_id)
+            if s
+              @log.info("Service out: name=#{service.name} #{service.host}:#{service.port}")
+            else
+              @log.warn("Not found service: name=#{service.name} #{service.host}:#{service.port}")
+            end
+          else
+            @log.error("BUG: unknow message type: #{msg.type}")
+          end
+        end
+
+        def build_service(n)
+          @custom_build_method ? @custom_build_method.call(n) : n
+        end
+      end
+    end
+  end
+end

data/lib/fluent/plugin_helper/service_discovery/round_robin_balancer.rb

@@ -0,0 +1,43 @@
+#
+# Fluentd
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+#
+
+module Fluent
+  module PluginHelper
+    module ServiceDiscovery
+      class RoundRobinBalancer
+        def initialize
+          @services = []
+          @mutex = Mutex.new
+        end
+
+        def rebalance(services)
+          @mutex.synchronize do
+            @services = services
+          end
+        end
+
+        def select_service
+          s = @mutex.synchronize do
+            s = @services.shift
+            @services.push(s)
+            s
+          end
+          yield(s)
+        end
+      end
+    end
+  end
+end

data/lib/fluent/plugin_helper/service_discovery.rb

@@ -0,0 +1,125 @@
+#
+# Fluentd
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+#
+
+require 'fluent/plugin_helper/timer'
+require 'fluent/plugin_helper/service_discovery/manager'
+
+module Fluent
+  module PluginHelper
+    module ServiceDiscovery
+      include Fluent::PluginHelper::Timer
+
+      # For the compatibility with older versions without `param_name: :service_discovery_configs`
+      attr_reader :service_discovery
+
+      def self.included(mod)
+        mod.include ServiceDiscoveryParams
+      end
+
+      def configure(conf)
+        super
+        # For the compatibility with older versions without `param_name: :service_discovery_configs`
+        @service_discovery = @service_discovery_configs
+      end
+
+      def start
+        unless @discovery_manager
+          log.warn('There is no discovery_manager. skip start them')
+          super
+          return
+        end
+
+        @discovery_manager.start
+        unless @discovery_manager.static_config?
+          timer_execute(@_plugin_helper_service_discovery_title, @_plugin_helper_service_discovery_iterval) do
+            @discovery_manager.run_once
+          end
+        end
+
+        super
+      end
+
+      %i[after_start stop before_shutdown shutdown after_shutdown close terminate].each do |mth|
+        define_method(mth) do
+          @discovery_manager&.__send__(mth)
+          super()
+        end
+      end
+
+      private
+
+      # @param title [Symbol] the thread name. this value should be unique.
+      # @param static_default_service_directive [String] the directive name of each service when "static" service discovery is enabled in default
+      # @param load_balancer [Object] object which has two methods #rebalance and #select_service
+      # @param custom_build_method [Proc]
+      def service_discovery_configure(title, static_default_service_directive: nil, load_balancer: nil, custom_build_method: nil, interval: 3)
+        configs = @service_discovery_configs.map(&:corresponding_config_element)
+        if static_default_service_directive
+          configs.prepend Fluent::Config::Element.new(
+            'service_discovery',
+            '',
+            {'@type' => 'static'},
+            @config.elements(name: static_default_service_directive.to_s).map{|e| Fluent::Config::Element.new('service', e.arg, e.dup, e.elements, e.unused) }
+          )
+        end
+        service_discovery_create_manager(title, configurations: configs, load_balancer: load_balancer, custom_build_method: custom_build_method, interval: interval)
+      end
+
+      def service_discovery_select_service(&block)
+        @discovery_manager.select_service(&block)
+      end
+
+      def service_discovery_services
+        @discovery_manager.services
+      end
+
+      def service_discovery_rebalance
+        @discovery_manager.rebalance
+      end
+
+      # @param title [Symbol] the thread name. this value should be unique.
+      # @param configurations [Hash] hash which must has discivery_service type and its configuration like `{ type: :static, conf: <Fluent::Config::Element> }`
+      # @param load_balancer [Object] object which has two methods #rebalance and #select_service
+      # @param custom_build_method [Proc]
+      def service_discovery_create_manager(title, configurations:, load_balancer: nil, custom_build_method: nil, interval: 3)
+        @_plugin_helper_service_discovery_title = title
+        @_plugin_helper_service_discovery_iterval = interval
+
+        @discovery_manager = Fluent::PluginHelper::ServiceDiscovery::Manager.new(
+          log: log,
+          load_balancer: load_balancer,
+          custom_build_method: custom_build_method,
+        )
+
+        @discovery_manager.configure(configurations, parent: self)
+
+        @discovery_manager
+      end
+
+      def discovery_manager
+        @discovery_manager
+      end
+
+      module ServiceDiscoveryParams
+        include Fluent::Configurable
+
+        config_section :service_discovery, multi: true, param_name: :service_discovery_configs do
+          config_param :@type, :string
+        end
+      end
+    end
+  end
+end

data/lib/fluent/plugin_helper/socket.rb

@@ -0,0 +1,277 @@
+#
+# Fluentd
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+#
+
+require 'socket'
+require 'ipaddr'
+require 'openssl'
+if Fluent.windows?
+  require 'certstore'
+end
+
+require 'fluent/tls'
+require_relative 'socket_option'
+
+module Fluent
+  module PluginHelper
+    module Socket
+      # stop     : [-]
+      # shutdown : [-]
+      # close    : [-]
+      # terminate: [-]
+
+      include Fluent::PluginHelper::SocketOption
+
+      attr_reader :_sockets # for tests
+
+      # TODO: implement connection pool for specified host
+
+      def socket_create(proto, host, port, **kwargs, &block)
+        case proto
+        when :tcp
+          socket_create_tcp(host, port, **kwargs, &block)
+        when :udp
+          socket_create_udp(host, port, **kwargs, &block)
+        when :tls
+          socket_create_tls(host, port, **kwargs, &block)
+        when :unix
+          raise "not implemented yet"
+        else
+          raise ArgumentError, "invalid protocol: #{proto}"
+        end
+      end
+
+      def socket_create_tcp(host, port, resolve_name: false, connect_timeout: nil, **kwargs, &block)
+        sock = if connect_timeout
+                 s = ::Socket.tcp(host, port, connect_timeout: connect_timeout)
+                 s.autoclose = false # avoid GC triggered close
+                 WrappedSocket::TCP.for_fd(s.fileno)
+               else
+                 WrappedSocket::TCP.new(host, port)
+               end
+        socket_option_set(sock, resolve_name: resolve_name, **kwargs)
+        if block
+          begin
+            block.call(sock)
+          ensure
+            sock.close_write rescue nil
+            sock.close rescue nil
+          end
+        else
+          sock
+        end
+      end
+
+      def socket_create_udp(host, port, resolve_name: false, connect: false, **kwargs, &block)
+        family = IPAddr.new(IPSocket.getaddress(host)).ipv4? ? ::Socket::AF_INET : ::Socket::AF_INET6
+        sock = WrappedSocket::UDP.new(family)
+        socket_option_set(sock, resolve_name: resolve_name, **kwargs)
+        sock.connect(host, port) if connect
+        if block
+          begin
+            block.call(sock)
+          ensure
+            sock.close rescue nil
+          end
+        else
+          sock
+        end
+      end
+
+      def socket_create_tls(
+          host, port,
+          version: Fluent::TLS::DEFAULT_VERSION, min_version: nil, max_version: nil, ciphers: Fluent::TLS::CIPHERS_DEFAULT, insecure: false, verify_fqdn: true, fqdn: nil,
+          enable_system_cert_store: true, allow_self_signed_cert: false, cert_paths: nil,
+          cert_path: nil, private_key_path: nil, private_key_passphrase: nil,
+          cert_thumbprint: nil, cert_logical_store_name: nil, cert_use_enterprise_store: true,
+          **kwargs, &block)
+
+        host_is_ipaddress = IPAddr.new(host) rescue false
+        fqdn ||= host unless host_is_ipaddress
+
+        context = OpenSSL::SSL::SSLContext.new
+
+        if insecure
+          log.trace "setting TLS verify_mode NONE"
+          context.verify_mode = OpenSSL::SSL::VERIFY_NONE
+        else
+          cert_store = OpenSSL::X509::Store.new
+          if allow_self_signed_cert && OpenSSL::X509.const_defined?('V_FLAG_CHECK_SS_SIGNATURE')
+            cert_store.flags = OpenSSL::X509::V_FLAG_CHECK_SS_SIGNATURE
+          end
+          begin
+            if enable_system_cert_store
+              if Fluent.windows? && cert_logical_store_name
+                log.trace "loading Windows system certificate store"
+                loader = Certstore::OpenSSL::Loader.new(log, cert_store, cert_logical_store_name,
+                                                        enterprise: cert_use_enterprise_store)
+                loader.load_cert_store
+                cert_store = loader.cert_store
+                context.cert = loader.get_certificate(cert_thumbprint) if cert_thumbprint
+              end
+              log.trace "loading system default certificate store"
+              cert_store.set_default_paths
+            end
+          rescue OpenSSL::X509::StoreError
+            log.warn "failed to load system default certificate store", error: e
+          end
+          if cert_paths
+            if cert_paths.respond_to?(:each)
+              cert_paths.each do |cert_path|
+                log.trace "adding CA cert", path: cert_path
+                cert_store.add_file(cert_path)
+              end
+            else
+              cert_path = cert_paths
+              log.trace "adding CA cert", path: cert_path
+              cert_store.add_file(cert_path)
+            end
+          end
+
+          log.trace "setting TLS context", mode: "peer", ciphers: ciphers
+          context.set_params({})
+          context.ciphers = ciphers
+          context.verify_mode = OpenSSL::SSL::VERIFY_PEER
+          context.cert_store = cert_store
+          context.verify_hostname = verify_fqdn && fqdn
+          context.key = OpenSSL::PKey::read(File.read(private_key_path), private_key_passphrase) if private_key_path
+
+          if cert_path
+            certs = socket_certificates_from_file(cert_path)
+            context.cert = certs.shift
+            unless certs.empty?
+              context.extra_chain_cert = certs
+            end
+          end
+        end
+        Fluent::TLS.set_version_to_context(context, version, min_version, max_version)
+
+        tcpsock = socket_create_tcp(host, port, **kwargs)
+        sock = WrappedSocket::TLS.new(tcpsock, context)
+        sock.sync_close = true
+        sock.hostname = fqdn if verify_fqdn && fqdn && sock.respond_to?(:hostname=)
+
+        log.trace "entering TLS handshake"
+        sock.connect
+
+        begin
+          if verify_fqdn
+            log.trace "checking peer's certificate", subject: sock.peer_cert.subject
+            sock.post_connection_check(fqdn)
+            verify = sock.verify_result
+            if verify != OpenSSL::X509::V_OK
+              err_name = Socket.tls_verify_result_name(verify)
+              log.warn "BUG: failed to verify certification while connecting (but not raised, why?)", host: host, fqdn: fqdn, error: err_name
+              raise RuntimeError, "BUG: failed to verify certification and to handle it correctly while connecting host #{host} as #{fqdn}"
+            end
+          end
+        rescue OpenSSL::SSL::SSLError => e
+          log.warn "failed to verify certification while connecting tls session", host: host, fqdn: fqdn, error: e
+          raise
+        end
+
+        if block
+          begin
+            block.call(sock)
+          ensure
+            sock.close rescue nil
+          end
+        else
+          sock
+        end
+      end
+
+      def socket_certificates_from_file(path)
+        data = File.read(path)
+        pattern = Regexp.compile('-+BEGIN CERTIFICATE-+\r?\n(?:[^-]*\r?\n)+-+END CERTIFICATE-+\r?\n?', Regexp::MULTILINE)
+        list = []
+        data.scan(pattern) { |match| list << OpenSSL::X509::Certificate.new(match) }
+        if list.length == 0
+          raise Fluent::ConfigError, "cert_path does not contain a valid certificate"
+        end
+        list
+      end
+
+      def self.tls_verify_result_name(code)
+        case code
+        when OpenSSL::X509::V_OK then 'V_OK'
+        when OpenSSL::X509::V_ERR_AKID_SKID_MISMATCH then 'V_ERR_AKID_SKID_MISMATCH'
+        when OpenSSL::X509::V_ERR_APPLICATION_VERIFICATION then 'V_ERR_APPLICATION_VERIFICATION'
+        when OpenSSL::X509::V_ERR_CERT_CHAIN_TOO_LONG then 'V_ERR_CERT_CHAIN_TOO_LONG'
+        when OpenSSL::X509::V_ERR_CERT_HAS_EXPIRED then 'V_ERR_CERT_HAS_EXPIRED'
+        when OpenSSL::X509::V_ERR_CERT_NOT_YET_VALID then 'V_ERR_CERT_NOT_YET_VALID'
+        when OpenSSL::X509::V_ERR_CERT_REJECTED then 'V_ERR_CERT_REJECTED'
+        when OpenSSL::X509::V_ERR_CERT_REVOKED then 'V_ERR_CERT_REVOKED'
+        when OpenSSL::X509::V_ERR_CERT_SIGNATURE_FAILURE then 'V_ERR_CERT_SIGNATURE_FAILURE'
+        when OpenSSL::X509::V_ERR_CERT_UNTRUSTED then 'V_ERR_CERT_UNTRUSTED'
+        when OpenSSL::X509::V_ERR_CRL_HAS_EXPIRED then 'V_ERR_CRL_HAS_EXPIRED'
+        when OpenSSL::X509::V_ERR_CRL_NOT_YET_VALID then 'V_ERR_CRL_NOT_YET_VALID'
+        when OpenSSL::X509::V_ERR_CRL_SIGNATURE_FAILURE then 'V_ERR_CRL_SIGNATURE_FAILURE'
+        when OpenSSL::X509::V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT then 'V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT'
+        when OpenSSL::X509::V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD then 'V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD'
+        when OpenSSL::X509::V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD then 'V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD'
+        when OpenSSL::X509::V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD then 'V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD'
+        when OpenSSL::X509::V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD then 'V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD'
+        when OpenSSL::X509::V_ERR_INVALID_CA then 'V_ERR_INVALID_CA'
+        when OpenSSL::X509::V_ERR_INVALID_PURPOSE then 'V_ERR_INVALID_PURPOSE'
+        when OpenSSL::X509::V_ERR_KEYUSAGE_NO_CERTSIGN then 'V_ERR_KEYUSAGE_NO_CERTSIGN'
+        when OpenSSL::X509::V_ERR_OUT_OF_MEM then 'V_ERR_OUT_OF_MEM'
+        when OpenSSL::X509::V_ERR_PATH_LENGTH_EXCEEDED then 'V_ERR_PATH_LENGTH_EXCEEDED'
+        when OpenSSL::X509::V_ERR_SELF_SIGNED_CERT_IN_CHAIN then 'V_ERR_SELF_SIGNED_CERT_IN_CHAIN'
+        when OpenSSL::X509::V_ERR_SUBJECT_ISSUER_MISMATCH then 'V_ERR_SUBJECT_ISSUER_MISMATCH'
+        when OpenSSL::X509::V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY then 'V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY'
+        when OpenSSL::X509::V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE then 'V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY'
+        when OpenSSL::X509::V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE then 'V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE'
+        when OpenSSL::X509::V_ERR_UNABLE_TO_GET_CRL then 'V_ERR_UNABLE_TO_GET_CRL'
+        when OpenSSL::X509::V_ERR_UNABLE_TO_GET_ISSUER_CERT then 'V_ERR_UNABLE_TO_GET_ISSUER_CERT'
+        when OpenSSL::X509::V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY then 'V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY'
+        when OpenSSL::X509::V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE then 'V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE'
+        end
+      end
+
+      # socket_create_socks ?
+
+      module WrappedSocket
+        class TCP < ::TCPSocket
+          def remote_addr; peeraddr[3]; end
+          def remote_host; peeraddr[2]; end
+          def remote_port; peeraddr[1]; end
+        end
+        class UDP < ::UDPSocket
+          def remote_addr; peeraddr[3]; end
+          def remote_host; peeraddr[2]; end
+          def remote_port; peeraddr[1]; end
+        end
+        class TLS < OpenSSL::SSL::SSLSocket
+          def remote_addr; peeraddr[3]; end
+          def remote_host; peeraddr[2]; end
+          def remote_port; peeraddr[1]; end
+        end
+      end
+
+      def initialize
+        super
+        # @_sockets = [] # for keepalived sockets / connection pool
+      end
+
+      # def close
+      #   @_sockets.each do |sock|
+      #     sock.close
+      #   end
+      #   super
+      # end
+    end
+  end
+end

data/lib/fluent/plugin_helper/socket_option.rb

@@ -0,0 +1,98 @@
+#
+# Fluentd
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+#
+
+require 'socket'
+require 'fcntl'
+
+# this module is only for Socket/Server plugin helpers
+module Fluent
+  module PluginHelper
+    module SocketOption
+      # ref: https://docs.microsoft.com/en-us/windows/win32/api/winsock/ns-winsock-linger
+      FORMAT_STRUCT_LINGER_WINDOWS  = 'S!S!' # { u_short l_onoff; u_short l_linger; }
+      FORMAT_STRUCT_LINGER  = 'I!I!' # { int l_onoff; int l_linger; }
+      FORMAT_STRUCT_TIMEVAL = 'L!L!' # { time_t tv_sec; suseconds_t tv_usec; }
+
+      def socket_option_validate!(protocol, resolve_name: nil, linger_timeout: nil, recv_timeout: nil, send_timeout: nil, receive_buffer_size: nil, send_keepalive_packet: nil)
+        unless resolve_name.nil?
+          if protocol != :tcp && protocol != :udp && protocol != :tls
+            raise ArgumentError, "BUG: resolve_name in available for tcp/udp/tls"
+          end
+        end
+        if linger_timeout
+          if protocol != :tcp && protocol != :tls
+            raise ArgumentError, "BUG: linger_timeout is available for tcp/tls"
+          end
+        end
+        if send_keepalive_packet
+          if protocol != :tcp && protocol != :tls
+            raise ArgumentError, "BUG: send_keepalive_packet is available for tcp/tls"
+          end
+        end
+      end
+
+      def socket_option_set(sock, resolve_name: nil, nonblock: false, linger_timeout: nil, recv_timeout: nil, send_timeout: nil, receive_buffer_size: nil, send_keepalive_packet: nil)
+        unless resolve_name.nil?
+          sock.do_not_reverse_lookup = !resolve_name
+        end
+        if nonblock
+          sock.fcntl(Fcntl::F_SETFL, Fcntl::O_NONBLOCK)
+        end
+        if Fluent.windows?
+          # To prevent closing socket forcibly on Windows,
+          # this options shouldn't be set up when linger_timeout equals to 0 (including nil).
+          # This unintended behavior always ocurrs on Windows when linger_timeout.to_i == 0.
+          # This unintented behavior causes "Errno::ECONNRESET: An existing connection was forcibly
+          # closed by the remote host." on Windows.
+          if linger_timeout.to_i > 0
+            if linger_timeout >= 2**16
+              log.warn "maximum linger_timeout is 65535(2^16 - 1). Set to 65535 forcibly."
+              linger_timeout = 2**16 - 1
+            end
+            optval = [1, linger_timeout.to_i].pack(FORMAT_STRUCT_LINGER_WINDOWS)
+            socket_option_set_one(sock, :SO_LINGER, optval)
+          end
+        else
+          if linger_timeout
+            optval = [1, linger_timeout.to_i].pack(FORMAT_STRUCT_LINGER)
+            socket_option_set_one(sock, :SO_LINGER, optval)
+          end
+        end
+        if recv_timeout
+          optval = [recv_timeout.to_i, 0].pack(FORMAT_STRUCT_TIMEVAL)
+          socket_option_set_one(sock, :SO_RCVTIMEO, optval)
+        end
+        if send_timeout
+          optval = [send_timeout.to_i, 0].pack(FORMAT_STRUCT_TIMEVAL)
+          socket_option_set_one(sock, :SO_SNDTIMEO, optval)
+        end
+        if receive_buffer_size
+          socket_option_set_one(sock, :SO_RCVBUF, receive_buffer_size.to_i)
+        end
+        if send_keepalive_packet
+          socket_option_set_one(sock, :SO_KEEPALIVE, true)
+        end
+        sock
+      end
+
+      def socket_option_set_one(sock, option, value)
+        sock.setsockopt(::Socket::SOL_SOCKET, option, value)
+      rescue => e
+        log.warn "failed to set socket option", sock: sock.class, option: option, value: value, error: e
+      end
+    end
+  end
+end