fluent/fluentd

#
# Fluentd
#
#    Licensed under the Apache License, Version 2.0 (the "License");
#    you may not use this file except in compliance with the License.
#    You may obtain a copy of the License at
#
#        http://www.apache.org/licenses/LICENSE-2.0
#
#    Unless required by applicable law or agreed to in writing, software
#    distributed under the License is distributed on an "AS IS" BASIS,
#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#    See the License for the specific language governing permissions and
#    limitations under the License.
#

require 'openssl'
require 'socket'

require 'fluent/tls'

# this module is only for Socket/Server/HttpServer plugin helpers
module Fluent
  module PluginHelper
    module CertOption
      def cert_option_create_context(version, insecure, ciphers, conf)
        cert, key, extra = cert_option_server_validate!(conf)

        ctx = OpenSSL::SSL::SSLContext.new
        # inject OpenSSL::SSL::SSLContext::DEFAULT_PARAMS
        # https://bugs.ruby-lang.org/issues/9424
        ctx.set_params({}) unless insecure

        if conf.client_cert_auth
          ctx.verify_mode = OpenSSL::SSL::VERIFY_PEER | OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT
        end

        ctx.ca_file = conf.ca_path
        ctx.cert = cert
        ctx.key = key
        if extra && !extra.empty?
          ctx.extra_chain_cert = extra
        end
        if conf.cert_verifier
          sandbox = Class.new
          ctx.verify_callback = if File.exist?(conf.cert_verifier)
                                  verifier = File.read(conf.cert_verifier)
                                  sandbox.instance_eval(verifier, File.basename(conf.cert_verifier))
                                else
                                  sandbox.instance_eval(conf.cert_verifier)
                                end
        end

        Fluent::TLS.set_version_to_context(ctx, version, conf.min_version, conf.max_version)
        ctx.ciphers = ciphers unless insecure

        ctx
      end

      def cert_option_server_validate!(conf)
        case
        when conf.cert_path
          raise Fluent::ConfigError, "private_key_path is required when cert_path is specified" unless conf.private_key_path
          log.warn "For security reason, setting private_key_passphrase is recommended when cert_path is specified" unless conf.private_key_passphrase
          cert_option_load(conf.cert_path, conf.private_key_path, conf.private_key_passphrase)

        when conf.ca_cert_path
          raise Fluent::ConfigError, "ca_private_key_path is required when ca_cert_path is specified" unless conf.ca_private_key_path
          log.warn "For security reason, setting ca_private_key_passphrase is recommended when ca_cert_path is specified" unless conf.ca_private_key_passphrase
          generate_opts = cert_option_cert_generation_opts_from_conf(conf)
          cert_option_generate_server_pair_by_ca(
            conf.ca_cert_path,
            conf.ca_private_key_path,
            conf.ca_private_key_passphrase,
            generate_opts
          )

        when conf.insecure
          log.warn "insecure TLS communication server is configured (using 'insecure' mode)"
          generate_opts = cert_option_cert_generation_opts_from_conf(conf)
          cert_option_generate_server_pair_self_signed(generate_opts)

        else
          raise Fluent::ConfigError, "no valid cert options configured. specify either 'cert_path', 'ca_cert_path' or 'insecure'"
        end
      end

      def cert_option_load(cert_path, private_key_path, private_key_passphrase)
        key = OpenSSL::PKey::read(File.read(private_key_path), private_key_passphrase)
        certs = cert_option_certificates_from_file(cert_path)
        cert = certs.shift
        return cert, key, certs
      end

      def cert_option_cert_generation_opts_from_conf(conf)
        {
          private_key_length: conf.generate_private_key_length,
          country: conf.generate_cert_country,
          state: conf.generate_cert_state,
          locality: conf.generate_cert_locality,
          common_name: conf.generate_cert_common_name || ::Socket.gethostname,
          expiration: conf.generate_cert_expiration,
          digest: conf.generate_cert_digest,
        }
      end

      def cert_option_generate_pair(opts, issuer = nil)
        key = OpenSSL::PKey::RSA.generate(opts[:private_key_length])

        subject = OpenSSL::X509::Name.new
        subject.add_entry('C', opts[:country])
        subject.add_entry('ST', opts[:state])
        subject.add_entry('L', opts[:locality])
        subject.add_entry('CN', opts[:common_name])

        issuer ||= subject

        cert = OpenSSL::X509::Certificate.new
        cert.not_before = Time.at(0)
        cert.not_after = Time.now + opts[:expiration]
        cert.public_key = key
        cert.version = 2
        cert.serial = rand(2**(8*10))
        cert.issuer = issuer
        cert.subject  = subject

        return cert, key
      end

      def cert_option_add_extensions(cert, extensions)
        ef = OpenSSL::X509::ExtensionFactory.new
        extensions.each do |ext|
          oid, value = ext
          cert.add_extension ef.create_extension(oid, value)
        end
      end

      def cert_option_generate_ca_pair_self_signed(generate_opts)
        cert, key = cert_option_generate_pair(generate_opts)

        cert_option_add_extensions(cert, [
          ['basicConstraints', 'CA:TRUE']
        ])

        cert.sign(key, generate_opts[:digest].to_s)
        return cert, key
      end

      def cert_option_generate_server_pair_by_ca(ca_cert_path, ca_key_path, ca_key_passphrase, generate_opts)
        ca_key = OpenSSL::PKey::read(File.read(ca_key_path), ca_key_passphrase)
        ca_cert = OpenSSL::X509::Certificate.new(File.read(ca_cert_path))
        cert, key = cert_option_generate_pair(generate_opts, ca_cert.subject)
        raise "BUG: certificate digest algorithm not set" unless generate_opts[:digest]

        cert_option_add_extensions(cert, [
          ['basicConstraints', 'CA:FALSE'],
          ['nsCertType', 'server'],
          ['keyUsage', 'digitalSignature,keyEncipherment'],
          ['extendedKeyUsage', 'serverAuth']
        ])

        cert.sign(ca_key, generate_opts[:digest].to_s)
        return cert, key, nil
      end

      def cert_option_generate_server_pair_self_signed(generate_opts)
        cert, key = cert_option_generate_pair(generate_opts)
        raise "BUG: certificate digest algorithm not set" unless generate_opts[:digest]

        cert_option_add_extensions(cert, [
          ['basicConstraints', 'CA:FALSE'],
          ['nsCertType', 'server']
        ])

        cert.sign(key, generate_opts[:digest].to_s)
        return cert, key, nil
      end

      def cert_option_certificates_from_file(path)
        data = File.read(path)
        pattern = Regexp.compile('-+BEGIN CERTIFICATE-+\r?\n(?:[^-]*\r?\n)+-+END CERTIFICATE-+\r?\n?', Regexp::MULTILINE)
        list = []
        data.scan(pattern){|match| list << OpenSSL::X509::Certificate.new(match) }
        if list.length == 0
          raise Fluent::ConfigError, "cert_path does not contain a valid certificate"
        end
        list
      end
    end
  end
end