Class: SyslogTls::SSLTransport

Inherits:
Object
  • Object
show all
Defined in:
lib/syslog_tls/ssl_transport.rb

Overview

Supports SSL connection to remote host

Constant Summary collapse

CONNECT_TIMEOUT = 
10
WRITE_TIMEOUT =

READ_TIMEOUT = 5

5

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(host, port, idle_timeout: nil, ca_cert: 'system', client_cert: nil, client_key: nil, verify_cert_name: true, ssl_version: :TLS1_2, max_retries: 1) ⇒ SSLTransport

Returns a new instance of SSLTransport.



33
34
35
36
37
38
39
40
41
42
43
44
45
 
# File 'lib/syslog_tls/ssl_transport.rb', line 33

def initialize(host, port, idle_timeout: nil, ca_cert: 'system', client_cert: nil, client_key: nil, verify_cert_name: true, ssl_version: :TLS1_2, max_retries: 1)
  pp "initialize SSLTransport"
  @host = host
  @port = port
  @idle_timeout = idle_timeout
  @ca_cert = ca_cert
  @client_cert = client_cert
  @client_key = client_key
  @verify_cert_name = verify_cert_name
  @ssl_version = ssl_version
  @retries = max_retries
  connect
end

Dynamic Method Handling

This class handles dynamic methods through the method_missing method

#method_missing(method_sym, *arguments, &block) ⇒ Object

Forward any methods directly to SSLSocket



214
215
216
 
# File 'lib/syslog_tls/ssl_transport.rb', line 214

def method_missing(method_sym, *arguments, &block)
  @socket.send(method_sym, *arguments, &block)
end

Instance Attribute Details

#ca_cert ⇒ Object (readonly)

Returns the value of attribute ca_cert.



29
30
31
 
# File 'lib/syslog_tls/ssl_transport.rb', line 29

def ca_cert
  @ca_cert
end

#client_cert ⇒ Object (readonly)

Returns the value of attribute client_cert.



29
30
31
 
# File 'lib/syslog_tls/ssl_transport.rb', line 29

def client_cert
  @client_cert
end

#client_key ⇒ Object (readonly)

Returns the value of attribute client_key.



29
30
31
 
# File 'lib/syslog_tls/ssl_transport.rb', line 29

def client_key
  @client_key
end

#host ⇒ Object (readonly)

Returns the value of attribute host.



29
30
31
 
# File 'lib/syslog_tls/ssl_transport.rb', line 29

def host
  @host
end

#idle_timeout ⇒ Object (readonly)

Returns the value of attribute idle_timeout.



29
30
31
 
# File 'lib/syslog_tls/ssl_transport.rb', line 29

def idle_timeout
  @idle_timeout
end

#port ⇒ Object (readonly)

Returns the value of attribute port.



29
30
31
 
# File 'lib/syslog_tls/ssl_transport.rb', line 29

def port
  @port
end

#retries=(value) ⇒ Object (writeonly)

Sets the attribute retries

Parameters:

  • value —

    the value to set the attribute retries to.



31
32
33
 
# File 'lib/syslog_tls/ssl_transport.rb', line 31

def retries=(value)
  @retries = value
end

#socket ⇒ Object

Returns the value of attribute socket.



27
28
29
 
# File 'lib/syslog_tls/ssl_transport.rb', line 27

def socket
  @socket
end

#ssl_version ⇒ Object (readonly)

Returns the value of attribute ssl_version.



29
30
31
 
# File 'lib/syslog_tls/ssl_transport.rb', line 29

def ssl_version
  @ssl_version
end

#verify_cert_name ⇒ Object (readonly)

Returns the value of attribute verify_cert_name.



29
30
31
 
# File 'lib/syslog_tls/ssl_transport.rb', line 29

def verify_cert_name
  @verify_cert_name
end

Instance Method Details

#connect ⇒ Object 



47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
 
# File 'lib/syslog_tls/ssl_transport.rb', line 47

def connect
  timwnow = Time.now
  pp "initialize SSLTransport.connect"+ timwnow.to_s
  @socket = get_ssl_connection
  begin
    begin
      @socket.connect_nonblock
    rescue Errno::EAGAIN, Errno::EWOULDBLOCK, IO::WaitReadable
      pp "initialize SSLTransport Errno::EAGAIN, Errno::EWOULDBLOCK, IO::WaitReadable"
      select_with_timeout(@socket, :connect_read) && retry
    rescue IO::WaitWritable
      pp "initialize SSLTransport IO::WaitWritable"
      select_with_timeout(@socket, :connect_write) && retry
    end
  rescue Errno::ETIMEDOUT
    pp "initialize SSLTransport Errno::ETIMEDOUT"
    raise 'Socket timeout during connect'
  end
  pp "initialize SSLTransport last_write"
  @last_write = Time.now if idle_timeout
end

#do_write(data) ⇒ Object 



160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
 
# File 'lib/syslog_tls/ssl_transport.rb', line 160

def do_write(data)
  data.force_encoding('BINARY') # so we can break in the middle of multi-byte characters
  loop do
    sent = 0
    begin
      sent = @socket.write_nonblock(data)
    rescue OpenSSL::SSL::SSLError, Errno::EAGAIN, Errno::EWOULDBLOCK, IO::WaitWritable => e
      if e.is_a?(OpenSSL::SSL::SSLError) && e.message !~ /write would block/
        raise e
      else
        select_with_timeout(@socket, :write) && retry
      end
    end

    break if sent >= data.size
    data = data[sent, data.size]
  end
end

#get_ssl_connection ⇒ Object 



102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
 
# File 'lib/syslog_tls/ssl_transport.rb', line 102

def get_ssl_connection
  tcp = get_tcp_connection

  ctx = OpenSSL::SSL::SSLContext.new
  ctx.verify_mode = OpenSSL::SSL::VERIFY_PEER
  ctx.min_version = ssl_version

  ctx.verify_hostname = verify_cert_name != false

  case ca_cert
  when true, 'true', 'system'
    # use system certs, same as openssl cli
    ctx.cert_store = OpenSSL::X509::Store.new
    ctx.cert_store.set_default_paths
  when false, 'false'
    ctx.verify_hostname = false
    ctx.verify_mode = OpenSSL::SSL::VERIFY_NONE
  when %r{/$} # ends in /
    ctx.ca_path = ca_cert
  when String
    ctx.ca_file = ca_cert
  end

  ctx.cert = OpenSSL::X509::Certificate.new(File.read(client_cert)) if client_cert
  ctx.key = OpenSSL::PKey::read(File.read(client_key)) if client_key
  socket = OpenSSL::SSL::SSLSocket.new(tcp, ctx)
  socket.hostname = host
  socket.sync_close = true
  socket
end

#get_tcp_connection ⇒ Object 



69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
 
# File 'lib/syslog_tls/ssl_transport.rb', line 69

def get_tcp_connection
  tcp = nil

  family = Socket::Constants::AF_UNSPEC
  sock_type = Socket::Constants::SOCK_STREAM
  addr_info = Socket.getaddrinfo(host, port, family, sock_type, nil, nil, false).first
  _, port, _, address, family, sock_type = addr_info

  begin
    sock_addr = Socket.sockaddr_in(port, address)
    tcp = Socket.new(family, sock_type, 0)
    tcp.setsockopt(Socket::SOL_SOCKET, Socket::Constants::SO_REUSEADDR, true)
    tcp.setsockopt(Socket::SOL_SOCKET, Socket::Constants::SO_REUSEPORT, true)
    tcp.connect_nonblock(sock_addr)
  rescue Errno::EINPROGRESS
    select_with_timeout(tcp, :connect_write)
    begin
      tcp.connect_nonblock(sock_addr)
    rescue Errno::EISCONN
      # all good
    rescue SystemCallError
      tcp.close rescue nil
      raise
    end
  rescue SystemCallError
    tcp.close rescue nil
    raise
  end

  tcp.setsockopt(Socket::IPPROTO_TCP, Socket::TCP_NODELAY, true)
  tcp
end

#select_with_timeout(tcp, type) ⇒ Object 



179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
 
# File 'lib/syslog_tls/ssl_transport.rb', line 179

def select_with_timeout(tcp, type)

  host_ip_port = host + ":" + port.to_s
  pp "1: initialize SSLTransport.select_with_timeout :: " + host_ip_port

  case type
  when :connect_read
    args = [[tcp], nil, nil, CONNECT_TIMEOUT]
  when :connect_write
    args = [nil, [tcp], nil, CONNECT_TIMEOUT]
  # when :read
  #   args = [[tcp], nil, nil, READ_TIMEOUT]
  when :write
    args = [nil, [tcp], nil, WRITE_TIMEOUT]
  else
    raise "Unknown select type #{type}"
  end
  pp "2: initialize SSLTransport.select_with_timeout :: " + host_ip_port
  if can_write(host_ip_port) == 1
    pp "3: initialize SSLTransport.select_with_timeout :: " + host_ip_port
    if IO.select(*args)
      pp "4: initialize SSLTransport.select_with_timeout :: " + host_ip_port
      reset_tries(host_ip_port)
    else
      increase_retry(host_ip_port)
      pp "initialize SSLTransport.select_with_timeout :: Socket timeout"
      raise("Socket timeout during #{type}")
    end
  else
    pp "initialize SSLTransport.select_with_timeout :: Failed to write"
    raise("Failed to write #{type}")
  end
end

#write(s) ⇒ Object

Allow to retry on failed writes



134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
 
# File 'lib/syslog_tls/ssl_transport.rb', line 134

def write(s)
  pp "initialize SSLTransport.write"
  if idle_timeout
    pp "initialize SSLTransport.write idle_timeout" + idle_timeout.to_s
    if (t=Time.now) > @last_write + idle_timeout
      @socket.close rescue nil
      connect
    else
      @last_write = t
    end
  end
  begin
    pp "initialize SSLTransport.write !idle_timeout"
    retry_id ||= 0
    do_write(s)
  rescue => e
    if (retry_id += 1) < @retries
      @socket.close rescue nil
      connect
      retry
    else
      raise e
    end
  end
end