ruby-kafka-aws-iam 1.4.2 → 1.4.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 70f5cfc318547021d6d3acad6780dbd048c53da455ed71ce8b44661a24d5b884
-  data.tar.gz: 9623c5fe6a7301c4a8792ddf4d877025407d5bc791bd518258244c04315abfe2
+  metadata.gz: 410a10299e8244f0e25ca5d6cea717a54792caa24cf006674d2d2eb45124b646
+  data.tar.gz: 97492d2e16908532076a635049bddb7149ec374a282e6c3b13c20000fe0d523f
 SHA512:
-  metadata.gz: 5fda77a743ae3f98cce165b51f865788bba54327987bfa76fabbf0986788ed915e60b4304b17d78baa818a5be6799156168758b3f7304d0ff7344cd876e94f68
-  data.tar.gz: 9e20f068510c988138e5e799c75b4c558f6c93ea962e9e5ae27daeadef2e68dbdf175092723a94eae69bc943bfc9a463b2986c4594edb242435a66bab570bab6
+  metadata.gz: 95e075270ff241afba5b09f03ba18dddcf500022daa56077b2cfeb35a95ed66f69f3db356b7b4bb8a3f77a50bb4c44509d1197d4b936b8418723cce757259d76
+  data.tar.gz: 6f2a8046c8b4a77ea3980b5c6b3f88aa7df51a078451b97705defda0c4fcfcc8567407e39817542607ffcec3155c58009a56905550d72d8ec35ceb294b880010

data/lib/kafka/client.rb

@@ -86,7 +86,9 @@ module Kafka
                    sasl_gssapi_keytab: nil, sasl_plain_authzid: '', sasl_plain_username: nil, sasl_plain_password: nil,
                    sasl_scram_username: nil, sasl_scram_password: nil, sasl_scram_mechanism: nil,
                    sasl_aws_msk_iam_access_key_id: nil,
-                   sasl_aws_msk_iam_secret_key_id: nil, sasl_aws_msk_iam_aws_region: nil,
+                   sasl_aws_msk_iam_secret_key_id: nil,
+                   sasl_aws_msk_iam_aws_region: nil,
+                   sasl_aws_msk_iam_session_token: nil,
                    sasl_over_ssl: true, ssl_ca_certs_from_system: false, partitioner: nil, sasl_oauth_token_provider: nil, ssl_verify_hostname: true,
                    resolve_seed_brokers: false)
       @logger = TaggedLogger.new(logger)
@@ -117,6 +119,7 @@ module Kafka
         sasl_aws_msk_iam_access_key_id: sasl_aws_msk_iam_access_key_id,
         sasl_aws_msk_iam_secret_key_id: sasl_aws_msk_iam_secret_key_id,
         sasl_aws_msk_iam_aws_region: sasl_aws_msk_iam_aws_region,
+        sasl_aws_msk_iam_session_token: sasl_aws_msk_iam_session_token,
         sasl_oauth_token_provider: sasl_oauth_token_provider,
         logger: @logger
       )

data/lib/kafka/connection.rb

@@ -127,12 +127,7 @@ module Kafka
       @logger.debug "Opening connection to #{@host}:#{@port} with client id #{@client_id}..."
 
       if @ssl_context
-        @socket = SSLSocketWithTimeout.new(@host,
-                                           @port,
-                                           connect_timeout: @connect_timeout,
-                                           timeout: @socket_timeout,
-                                           ssl_context: @ssl_context,
-                                           logger: @logger)
+        @socket = SSLSocketWithTimeout.new(@host, @port, connect_timeout: @connect_timeout, timeout: @socket_timeout, ssl_context: @ssl_context)
       else
         @socket = SocketWithTimeout.new(@host, @port, connect_timeout: @connect_timeout, timeout: @socket_timeout)
       end

data/lib/kafka/sasl/awsmskiam.rb

@@ -9,12 +9,13 @@ module Kafka
     class AwsMskIam
       AWS_MSK_IAM = "AWS_MSK_IAM"
 
-      def initialize(aws_region:, access_key_id:, secret_key_id:, logger:)
+      def initialize(aws_region:, access_key_id:, secret_key_id:, session_token: nil,logger:)
         @semaphore = Mutex.new
 
         @aws_region = aws_region
         @access_key_id = access_key_id
         @secret_key_id = secret_key_id
+        @session_token = session_token
         @logger = TaggedLogger.new(logger)
       end
 
@@ -39,13 +40,11 @@ module Kafka
         encoder.write_bytes(msg)
 
         begin
-          @logger.debug "Decoding first server SASL AWS_MSK_IAM message"
           @server_first_message = decoder.bytes
           @logger.debug "Received first server SASL AWS_MSK_IAM message: #{@server_first_message}"
 
           raise Kafka::Error, "SASL AWS_MSK_IAM authentication failed: unknown error" unless @server_first_message
         rescue Errno::ETIMEDOUT, EOFError => e
-          @logger.error e.backtrace
           raise Kafka::Error, "SASL AWS_MSK_IAM authentication failed: #{e.message}"
         end
 
@@ -64,37 +63,41 @@ module Kafka
 
       def authentication_payload(host:, time_now:)
         {
-          'version': "2020_10_22",
-          'host': host,
-          'user-agent': "ruby-kafka",
-          'action': "kafka-cluster:Connect",
-          'x-amz-algorithm': "AWS4-HMAC-SHA256",
-          'x-amz-credential': @access_key_id + "/" + time_now.strftime("%Y%m%d") + "/" + @aws_region + "/kafka-cluster/aws4_request",
-          'x-amz-date': time_now.strftime("%Y%m%dT%H%M%SZ"),
-          'x-amz-signedheaders': "host",
-          'x-amz-expires': "900",
-          'x-amz-signature': signature(host: host, time_now: time_now)
-        }.to_json
+          'version' => "2020_10_22",
+          'host' => host,
+          'user-agent' => "ruby-kafka",
+          'action' => "kafka-cluster:Connect",
+          'x-amz-algorithm' => "AWS4-HMAC-SHA256",
+          'x-amz-credential' => @access_key_id + "/" + time_now.strftime("%Y%m%d") + "/" + @aws_region + "/kafka-cluster/aws4_request",
+          'x-amz-date' => time_now.strftime("%Y%m%dT%H%M%SZ"),
+          'x-amz-signedheaders' => "host",
+          'x-amz-expires' => "900",
+          'x-amz-security-token' => @session_token,
+          'x-amz-signature' => signature(host: host, time_now: time_now)
+        }.delete_if { |_, v| v.nil? }.to_json
       end
 
       def canonical_request(host:, time_now:)
         "GET\n" +
-        "/\n" +
-        canonical_query_string(time_now: time_now) + "\n" +
-        canonical_headers(host: host) + "\n" +
-        signed_headers + "\n" +
-        hashed_payload
+          "/\n" +
+          canonical_query_string(time_now: time_now) + "\n" +
+          canonical_headers(host: host) + "\n" +
+          signed_headers + "\n" +
+          hashed_payload
       end
 
       def canonical_query_string(time_now:)
-        URI.encode_www_form(
+        params = {
           "Action" => "kafka-cluster:Connect",
           "X-Amz-Algorithm" => "AWS4-HMAC-SHA256",
           "X-Amz-Credential" => @access_key_id + "/" + time_now.strftime("%Y%m%d") + "/" + @aws_region + "/kafka-cluster/aws4_request",
           "X-Amz-Date" => time_now.strftime("%Y%m%dT%H%M%SZ"),
           "X-Amz-Expires" => "900",
+          "X-Amz-Security-Token" => @session_token,
           "X-Amz-SignedHeaders" => "host"
-        )
+        }.delete_if { |_, v| v.nil? }
+
+        URI.encode_www_form(params)
       end
 
       def canonical_headers(host:)
@@ -111,9 +114,9 @@ module Kafka
 
       def string_to_sign(host:, time_now:)
         "AWS4-HMAC-SHA256" + "\n" +
-        time_now.strftime("%Y%m%dT%H%M%SZ") + "\n" +
-        time_now.strftime("%Y%m%d") + "/" + @aws_region + "/kafka-cluster/aws4_request" + "\n" +
-        bin_to_hex(digest.digest(canonical_request(host: host, time_now: time_now)))
+          time_now.strftime("%Y%m%dT%H%M%SZ") + "\n" +
+          time_now.strftime("%Y%m%d") + "/" + @aws_region + "/kafka-cluster/aws4_request" + "\n" +
+          bin_to_hex(digest.digest(canonical_request(host: host, time_now: time_now)))
       end
 
       def signature(host:, time_now:)

data/lib/kafka/sasl_authenticator.rb

@@ -14,8 +14,8 @@ module Kafka
                    sasl_oauth_token_provider:,
                    sasl_aws_msk_iam_access_key_id:,
                    sasl_aws_msk_iam_secret_key_id:,
-                   sasl_aws_msk_iam_aws_region:
-                  )
+                   sasl_aws_msk_iam_aws_region:,
+                   sasl_aws_msk_iam_session_token: nil)
       @logger = TaggedLogger.new(logger)
 
       @plain = Sasl::Plain.new(
@@ -42,6 +42,7 @@ module Kafka
         access_key_id: sasl_aws_msk_iam_access_key_id,
         secret_key_id: sasl_aws_msk_iam_secret_key_id,
         aws_region: sasl_aws_msk_iam_aws_region,
+        session_token: sasl_aws_msk_iam_session_token,
         logger: @logger,
       )
 

data/lib/kafka/ssl_socket_with_timeout.rb

@@ -21,13 +21,12 @@ module Kafka
     # @param timeout [Integer] the read and write timeout, in seconds.
     # @param ssl_context [OpenSSL::SSL::SSLContext] which SSLContext the ssl connection should use
     # @raise [Errno::ETIMEDOUT] if the timeout is exceeded.
-    def initialize(host, port, connect_timeout: nil, timeout: nil, ssl_context:, logger: nil)
+    def initialize(host, port, connect_timeout: nil, timeout: nil, ssl_context:)
       addr = Socket.getaddrinfo(host, nil)
       sockaddr = Socket.pack_sockaddr_in(port, addr[0][3])
 
       @connect_timeout = connect_timeout
       @timeout = timeout
-      @logger = logger
 
       @tcp_socket = Socket.new(Socket.const_get(addr[0][0]), Socket::SOCK_STREAM, 0)
       @tcp_socket.setsockopt(Socket::IPPROTO_TCP, Socket::TCP_NODELAY, 1)
@@ -94,7 +93,6 @@ module Kafka
     def read(num_bytes)
       buffer = String.new
 
-      @logger.debug "Reading #{num_bytes} bytes from #{@ssl_socket}"
       until buffer.length >= num_bytes
         begin
           # Unlike plain TCP sockets, SSL sockets don't support IO.select
@@ -103,8 +101,6 @@ module Kafka
           # catch exceptions from read_nonblock and gradually build up
           # our read buffer.
           buffer << @ssl_socket.read_nonblock(num_bytes - buffer.length)
-
-          @logger.debug "Bytes read: #{buffer.length}"
         rescue IO::WaitReadable
           if select_with_timeout(@ssl_socket, :read)
             retry

data/lib/kafka/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Kafka
-  VERSION = "1.4.2"
+  VERSION = "1.4.5"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ruby-kafka-aws-iam
 version: !ruby/object:Gem::Version
-  version: 1.4.2
+  version: 1.4.5
 platform: ruby
 authors:
 - Daniel Schierbeck
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2022-03-10 00:00:00.000000000 Z
+date: 2022-03-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: digest-crc