Skip to content

Add config_params in OutSyslogRFC5424 to support mutual_tls authentication #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Hisagar wants to merge 12 commits into
base: main
Choose a base branch
from
Open

Add config_params in OutSyslogRFC5424 to support mutual_tls authentication #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
15f23ee
private_key_path, private_key_passphrase, allow_self_signed_cert, fqd…
Hisagar Jan 31, 2022
0edc702
tls_version name updated to version
Hisagar Jan 31, 2022
6903f0b
allow_self_signed_cert type updated
Hisagar Jan 31, 2022
f5c972d
version string converted to symbol
Hisagar Feb 2, 2022
ef800ec
Update lib/fluent/plugin/out_syslog_rfc5424.rb
Hisagar Feb 3, 2022
f99d37f
Update lib/fluent/plugin/out_syslog_rfc5424.rb
Hisagar Feb 3, 2022
4186724
tls_socket.rb patch added to allow self_signed_certificate
Hisagar Feb 6, 2022
89b65e6
tls_socket.rb patch added to allow self_signed_certificate
Hisagar Feb 6, 2022
ba14fa2
require_relative added
Hisagar Feb 6, 2022
65f4aa2
require_relative added
Hisagar Feb 6, 2022
333679f
turnary operator added
Hisagar Feb 6, 2022
095de13
updated param for syslog plugin with mutual tls
Hisagar Feb 7, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 20 additions & 1 deletion lib/fluent/plugin/out_syslog_rfc5424.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,14 @@ class OutSyslogRFC5424 < Output
config_param :transport, :string, default: "tls"
config_param :insecure, :bool, default: false
config_param :trusted_ca_path, :string, default: nil
config_param :verify_fqdn, :bool, default: nil
config_param :client_cert_path, :string, default: nil
config_param :private_key_path, :string, default: nil
config_param :private_key_passphrase, :string, default: nil, secret: true
config_param :allow_self_signed_cert, :bool, default: false
config_param :enable_system_cert_store, :bool, default: true
config_param :fqdn, :string, default: nil
config_param :version, :string, default: "TLSv1_2"
config_section :format do
config_set_default :@type, DEFAULT_FORMATTER
end
Expand Down Expand Up @@ -62,7 +70,18 @@ def socket_options
{ connect: true }
elsif @transport == 'tls'
# TODO: make timeouts configurable
{ insecure: @insecure, verify_fqdn: !@insecure, cert_paths: @trusted_ca_path } #, connect_timeout: 1, send_timeout: 1, recv_timeout: 1, linger_timeout: 1 }
{
insecure: @insecure,
verify_fqdn: @verify_fqdn.nil? ? !@insecure : @verify_fqdn,
cert_paths: [@trusted_ca_path],
cert_path: @client_cert_path,
private_key_path: @private_key_path,
private_key_passphrase: @private_key_passphrase,
allow_self_signed_cert: @allow_self_signed_cert,
enable_system_cert_store: @enable_system_cert_store,
fqdn: @fqdn,
version: @version.to_sym
} #, connect_timeout: 1, send_timeout: 1, recv_timeout: 1, linger_timeout: 1 }
else
{}
end
Expand Down
48 changes: 40 additions & 8 deletions test/plugin/out_syslog_rfc5424_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,9 +35,9 @@ def test_sends_a_message
stub(socket).close

stub(IO).select(nil, [socket], nil, 1) { ["not an error"] }

any_instance_of(Fluent::Plugin::OutSyslogRFC5424) do |fluent_plugin|
mock(fluent_plugin).socket_create(:tls, "example.com", 123, {:insecure=>false, :verify_fqdn=>true, :cert_paths=>nil}).returns(socket)
mock(fluent_plugin).socket_create(:tls, "example.com", 123, {:insecure=>false, :verify_fqdn=>true, :cert_paths=>nil, :cert_path=>nil, :private_key_path=>nil, :private_key_passphrase=>nil, :allow_self_signed_cert=>false, :enable_system_cert_store=>true, :fqdn=>nil, :version=>"TLSv1_2"}).returns(socket)
end

output_driver.run do
Expand All @@ -55,7 +55,7 @@ def test_reconnects
bad_socket = Object.new
mock(bad_socket).write_nonblock(@formatted_log)
stub(bad_socket).close

good_socket = Object.new
mock(good_socket).write_nonblock(@formatted_log)
stub(good_socket).close
Expand All @@ -64,8 +64,8 @@ def test_reconnects
mock(IO).select(nil, [good_socket], nil, 1) { ["not an error"] }

any_instance_of(Fluent::Plugin::OutSyslogRFC5424) do |fluent_plugin|
mock(fluent_plugin).socket_create(:tls, "example.com", 123, {:insecure=>false, :verify_fqdn=>true, :cert_paths=>nil}).returns(bad_socket)
mock(fluent_plugin).socket_create(:tls, "example.com", 123, {:insecure=>false, :verify_fqdn=>true, :cert_paths=>nil}).returns(good_socket)
mock(fluent_plugin).socket_create(:tls, "example.com", 123, {:insecure=>false, :verify_fqdn=>true, :cert_paths=>nil, :cert_path=>nil, :private_key_path=>nil, :private_key_passphrase=>nil, :allow_self_signed_cert=>false, :enable_system_cert_store=>true, :fqdn=>nil, :version=>"TLSv1_2"}).returns(bad_socket)
mock(fluent_plugin).socket_create(:tls, "example.com", 123, {:insecure=>false, :verify_fqdn=>true, :cert_paths=>nil, :cert_path=>nil, :private_key_path=>nil, :private_key_passphrase=>nil, :allow_self_signed_cert=>false, :enable_system_cert_store=>true, :fqdn=>nil, :version=>"TLSv1_2"}).returns(good_socket)
end

output_driver.run(shutdown: false, force_flush_retry: true) do
Expand Down Expand Up @@ -112,7 +112,7 @@ def test_insecure_tls
stub(IO).select(nil, [socket], nil, 1) { ["not an error"] }

any_instance_of(Fluent::Plugin::OutSyslogRFC5424) do |fluent_plugin|
mock(fluent_plugin).socket_create(:tls, "example.com", 123, {:insecure=>true, :verify_fqdn=>false, :cert_paths=>nil}).returns(socket)
mock(fluent_plugin).socket_create(:tls, "example.com", 123, {:insecure=>true, :verify_fqdn=>false, :cert_paths=>nil, :cert_path=>nil, :private_key_path=>nil, :private_key_passphrase=>nil, :allow_self_signed_cert=>false, :enable_system_cert_store=>true, :fqdn=>nil, :version=>"TLSv1_2"}).returns(socket)
end

output_driver.run do
Expand All @@ -136,7 +136,39 @@ def test_secure_tls
stub(IO).select(nil, [socket], nil, 1) { ["not an error"] }

any_instance_of(Fluent::Plugin::OutSyslogRFC5424) do |fluent_plugin|
mock(fluent_plugin).socket_create(:tls, "example.com", 123, {:insecure=>false, :verify_fqdn=>true, :cert_paths=>"supertrustworthy"}).returns(socket)
mock(fluent_plugin).socket_create(:tls, "example.com", 123, {:insecure=>false, :verify_fqdn=>true, :cert_paths=>"supertrustworthy", :cert_path=>nil, :private_key_path=>nil, :private_key_passphrase=>nil, :allow_self_signed_cert=>false, :enable_system_cert_store=>true, :fqdn=>nil, :version=>"TLSv1_2"}).returns(socket)
end

output_driver.run do
output_driver.feed("tag", @time, {"log" => "hi"})
end
end

def test_secure_mutual_tls
output_driver = create_driver %(
@type syslog_rfc5424
host example.com
port 123
transport tls
verify_fqdn true
trusted_ca_path supertrustworthy
client_cert_path clientsupertrustworthykey
private_key_path clientsupertrustworthykey
private_key_passphrase clientsupertrustworthypassphrase
allow_self_signed_cert false
enable_system_cert_store true
fqdn supertrustworthyfqdn
version "TLSv1_2"
)

socket = Object.new
mock(socket).write_nonblock(@formatted_log)
stub(socket).close

stub(IO).select(nil, [socket], nil, 1) { ["not an error"] }

any_instance_of(Fluent::Plugin::OutSyslogRFC5424) do |fluent_plugin|
mock(fluent_plugin).socket_create(:tls, "example.com", 123, {:insecure=>false, :verify_fqdn=>true, :cert_paths=>"supertrustworthy", :cert_path=>"supertrustworthy", :private_key_path=>"clientsupertrustworthykey", :private_key_passphrase=>"clientsupertrustworthykey", :allow_self_signed_cert=>false, :enable_system_cert_store=>true, :fqdn=>"supertrustworthyfqdn", :version=>"TLSv1_2"}).returns(socket)
end

output_driver.run do
Expand All @@ -158,7 +190,7 @@ def test_close_is_called_on_sockets
stub(IO).select(nil, [socket], nil, 1) { ["not an error"] }

any_instance_of(Fluent::Plugin::OutSyslogRFC5424) do |fluent_plugin|
mock(fluent_plugin).socket_create(:tls, "example.com", 123, {:insecure=>false, :verify_fqdn=>true, :cert_paths=>nil}).returns(socket)
mock(fluent_plugin).socket_create(:tls, "example.com", 123, {:insecure=>false, :verify_fqdn=>true, :cert_paths=>nil, :cert_path=>nil, :private_key_path=>nil, :private_key_passphrase=>nil, :allow_self_signed_cert=>false, :enable_system_cert_store=>true, :fqdn=>nil, :version=>"TLSv1_2"}).returns(socket)
end

output_driver.run do
Expand Down