From c30df8d1363b6bc9c32b932708ab90d6abdfb401 Mon Sep 17 00:00:00 2001 From: Mikhail Shustov Date: Fri, 9 Aug 2019 10:42:33 +0200 Subject: [PATCH] add socket.getPeerCertificate to KibanaRequest (#42929) * add socket.getPeerCertificate to KibanaRequest * update request mocks * update docs --- ...rver.ikibanasocket.getpeercertificate_1.md | 22 +++++++ ...rver.ikibanasocket.getpeercertificate_2.md | 22 +++++++ ...rver.ikibanasocket.getpeercertificate_3.md | 26 ++++++++ .../kibana-plugin-server.ikibanasocket.md | 22 +++++++ .../kibana-plugin-server.kibanarequest.md | 1 + ...bana-plugin-server.kibanarequest.socket.md | 11 ++++ .../core/server/kibana-plugin-server.md | 1 + src/core/server/http/index.ts | 1 + src/core/server/http/router/index.ts | 2 + src/core/server/http/router/request.ts | 4 ++ src/core/server/http/router/socket.test.ts | 59 +++++++++++++++++++ src/core/server/http/router/socket.ts | 59 +++++++++++++++++++ src/core/server/index.ts | 1 + src/core/server/server.api.md | 13 ++++ .../lib/__tests__/replace_injected_vars.js | 5 ++ 15 files changed, 249 insertions(+) create mode 100644 docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_1.md create mode 100644 docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_2.md create mode 100644 docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_3.md create mode 100644 docs/development/core/server/kibana-plugin-server.ikibanasocket.md create mode 100644 docs/development/core/server/kibana-plugin-server.kibanarequest.socket.md create mode 100644 src/core/server/http/router/socket.test.ts create mode 100644 src/core/server/http/router/socket.ts diff --git a/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_1.md b/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_1.md new file mode 100644 index 00000000000000..0c6cb0ce8bb0d2 --- /dev/null +++ b/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_1.md @@ -0,0 +1,22 @@ + + +[Home](./index.md) > [kibana-plugin-server](./kibana-plugin-server.md) > [IKibanaSocket](./kibana-plugin-server.ikibanasocket.md) > [getPeerCertificate](./kibana-plugin-server.ikibanasocket.getpeercertificate_1.md) + +## IKibanaSocket.getPeerCertificate() method + +Signature: + +```typescript +getPeerCertificate(detailed: true): DetailedPeerCertificate | null; +``` + +## Parameters + +| Parameter | Type | Description | +| --- | --- | --- | +| detailed | true | | + +Returns: + +`DetailedPeerCertificate | null` + diff --git a/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_2.md b/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_2.md new file mode 100644 index 00000000000000..a7c63b9d3047ae --- /dev/null +++ b/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_2.md @@ -0,0 +1,22 @@ + + +[Home](./index.md) > [kibana-plugin-server](./kibana-plugin-server.md) > [IKibanaSocket](./kibana-plugin-server.ikibanasocket.md) > [getPeerCertificate](./kibana-plugin-server.ikibanasocket.getpeercertificate_2.md) + +## IKibanaSocket.getPeerCertificate() method + +Signature: + +```typescript +getPeerCertificate(detailed: false): PeerCertificate | null; +``` + +## Parameters + +| Parameter | Type | Description | +| --- | --- | --- | +| detailed | false | | + +Returns: + +`PeerCertificate | null` + diff --git a/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_3.md b/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_3.md new file mode 100644 index 00000000000000..0c81a26cf15e65 --- /dev/null +++ b/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_3.md @@ -0,0 +1,26 @@ + + +[Home](./index.md) > [kibana-plugin-server](./kibana-plugin-server.md) > [IKibanaSocket](./kibana-plugin-server.ikibanasocket.md) > [getPeerCertificate](./kibana-plugin-server.ikibanasocket.getpeercertificate_3.md) + +## IKibanaSocket.getPeerCertificate() method + +Returns an object representing the peer's certificate. The returned object has some properties corresponding to the field of the certificate. If detailed argument is true the full chain with issuer property will be returned, if false only the top certificate without issuer property. If the peer does not provide a certificate, it returns null. + +Signature: + +```typescript +getPeerCertificate(detailed?: boolean): PeerCertificate | DetailedPeerCertificate | null; +``` + +## Parameters + +| Parameter | Type | Description | +| --- | --- | --- | +| detailed | boolean | If true; the full chain with issuer property will be returned. | + +Returns: + +`PeerCertificate | DetailedPeerCertificate | null` + +An object representing the peer's certificate. + diff --git a/docs/development/core/server/kibana-plugin-server.ikibanasocket.md b/docs/development/core/server/kibana-plugin-server.ikibanasocket.md new file mode 100644 index 00000000000000..129a3b1d2311ab --- /dev/null +++ b/docs/development/core/server/kibana-plugin-server.ikibanasocket.md @@ -0,0 +1,22 @@ + + +[Home](./index.md) > [kibana-plugin-server](./kibana-plugin-server.md) > [IKibanaSocket](./kibana-plugin-server.ikibanasocket.md) + +## IKibanaSocket interface + +A tiny abstraction for TCP socket. + +Signature: + +```typescript +export interface IKibanaSocket +``` + +## Methods + +| Method | Description | +| --- | --- | +| [getPeerCertificate(detailed)](./kibana-plugin-server.ikibanasocket.getpeercertificate_1.md) | | +| [getPeerCertificate(detailed)](./kibana-plugin-server.ikibanasocket.getpeercertificate_2.md) | | +| [getPeerCertificate(detailed)](./kibana-plugin-server.ikibanasocket.getpeercertificate_3.md) | Returns an object representing the peer's certificate. The returned object has some properties corresponding to the field of the certificate. If detailed argument is true the full chain with issuer property will be returned, if false only the top certificate without issuer property. If the peer does not provide a certificate, it returns null. | + diff --git a/docs/development/core/server/kibana-plugin-server.kibanarequest.md b/docs/development/core/server/kibana-plugin-server.kibanarequest.md index 19167f2f640418..6faa9606a84350 100644 --- a/docs/development/core/server/kibana-plugin-server.kibanarequest.md +++ b/docs/development/core/server/kibana-plugin-server.kibanarequest.md @@ -27,5 +27,6 @@ export declare class KibanaRequestParams | | | [query](./kibana-plugin-server.kibanarequest.query.md) | | Query | | | [route](./kibana-plugin-server.kibanarequest.route.md) | | RecursiveReadonly<KibanaRequestRoute> | matched route details | +| [socket](./kibana-plugin-server.kibanarequest.socket.md) | | IKibanaSocket | | | [url](./kibana-plugin-server.kibanarequest.url.md) | | Url | a WHATWG URL standard object. | diff --git a/docs/development/core/server/kibana-plugin-server.kibanarequest.socket.md b/docs/development/core/server/kibana-plugin-server.kibanarequest.socket.md new file mode 100644 index 00000000000000..3880428273ac9c --- /dev/null +++ b/docs/development/core/server/kibana-plugin-server.kibanarequest.socket.md @@ -0,0 +1,11 @@ + + +[Home](./index.md) > [kibana-plugin-server](./kibana-plugin-server.md) > [KibanaRequest](./kibana-plugin-server.kibanarequest.md) > [socket](./kibana-plugin-server.kibanarequest.socket.md) + +## KibanaRequest.socket property + +Signature: + +```typescript +readonly socket: IKibanaSocket; +``` diff --git a/docs/development/core/server/kibana-plugin-server.md b/docs/development/core/server/kibana-plugin-server.md index d5e8b899d26e85..558ff343b02de8 100644 --- a/docs/development/core/server/kibana-plugin-server.md +++ b/docs/development/core/server/kibana-plugin-server.md @@ -49,6 +49,7 @@ The plugin integrates with the core system via lifecycle events: `setup` | [HttpResponseOptions](./kibana-plugin-server.httpresponseoptions.md) | HTTP response parameters | | [HttpServerSetup](./kibana-plugin-server.httpserversetup.md) | Kibana HTTP Service provides own abstraction for work with HTTP stack. Plugins don't have direct access to hapi server and its primitives anymore. Moreover, plugins shouldn't rely on the fact that HTTP Service uses one or another library under the hood. This gives the platform flexibility to upgrade or changing our internal HTTP stack without breaking plugins. If the HTTP Service lacks functionality you need, we are happy to discuss and support your needs. | | [HttpServiceStart](./kibana-plugin-server.httpservicestart.md) | | +| [IKibanaSocket](./kibana-plugin-server.ikibanasocket.md) | A tiny abstraction for TCP socket. | | [InternalCoreStart](./kibana-plugin-server.internalcorestart.md) | | | [KibanaRequestRoute](./kibana-plugin-server.kibanarequestroute.md) | Request specific route information exposed to a handler. | | [LegacyRequest](./kibana-plugin-server.legacyrequest.md) | | diff --git a/src/core/server/http/index.ts b/src/core/server/http/index.ts index 4be92fe492b3e3..0fe827360ffdfa 100644 --- a/src/core/server/http/index.ts +++ b/src/core/server/http/index.ts @@ -24,6 +24,7 @@ export { GetAuthHeaders } from './auth_headers_storage'; export { AuthStatus, GetAuthState, IsAuthenticated } from './auth_state_storage'; export { CustomHttpResponseOptions, + IKibanaSocket, isRealRequest, HttpResponseOptions, HttpResponsePayload, diff --git a/src/core/server/http/router/index.ts b/src/core/server/http/router/index.ts index 5e2cbe5b7e1582..fa0dc55397647c 100644 --- a/src/core/server/http/router/index.ts +++ b/src/core/server/http/router/index.ts @@ -41,3 +41,5 @@ export { lifecycleResponseFactory, LifecycleResponseFactory, } from './response'; + +export { IKibanaSocket } from './socket'; diff --git a/src/core/server/http/router/request.ts b/src/core/server/http/router/request.ts index 4eac2e98317fcc..9e4d017f8db3ef 100644 --- a/src/core/server/http/router/request.ts +++ b/src/core/server/http/router/request.ts @@ -25,6 +25,7 @@ import { ObjectType, TypeOf } from '@kbn/config-schema'; import { deepFreeze, RecursiveReadonly } from '../../../utils'; import { Headers } from './headers'; import { RouteMethod, RouteSchemas, RouteConfigOptions } from './route'; +import { KibanaSocket, IKibanaSocket } from './socket'; const requestSymbol = Symbol('request'); @@ -120,6 +121,8 @@ export class KibanaRequest { */ public readonly headers: Headers; + public readonly socket: IKibanaSocket; + /** @internal */ protected readonly [requestSymbol]: Request; @@ -142,6 +145,7 @@ export class KibanaRequest { }); this.route = deepFreeze(this.getRouteInfo()); + this.socket = new KibanaSocket(request.raw.req.socket); } private getRouteInfo() { diff --git a/src/core/server/http/router/socket.test.ts b/src/core/server/http/router/socket.test.ts new file mode 100644 index 00000000000000..6bd903fd2f36ce --- /dev/null +++ b/src/core/server/http/router/socket.test.ts @@ -0,0 +1,59 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +import { Socket } from 'net'; +import { DetailedPeerCertificate, TLSSocket } from 'tls'; +import { KibanaSocket } from './socket'; + +describe('KibanaSocket', () => { + describe('getPeerCertificate', () => { + it('returns null for net.Socket instance', () => { + const socket = new KibanaSocket(new Socket()); + + expect(socket.getPeerCertificate()).toBe(null); + }); + + it('delegates a call to tls.Socket instance', () => { + const tlsSocket = new TLSSocket(new Socket()); + const cert = { issuerCertificate: {} } as DetailedPeerCertificate; + const spy = jest.spyOn(tlsSocket, 'getPeerCertificate').mockImplementation(() => cert); + const socket = new KibanaSocket(tlsSocket); + const result = socket.getPeerCertificate(true); + + expect(spy).toBeCalledTimes(1); + expect(spy).toBeCalledWith(true); + expect(result).toBe(cert); + }); + + it('returns null if tls.Socket getPeerCertificate returns null', () => { + const tlsSocket = new TLSSocket(new Socket()); + jest.spyOn(tlsSocket, 'getPeerCertificate').mockImplementation(() => null as any); + const socket = new KibanaSocket(tlsSocket); + + expect(socket.getPeerCertificate()).toBe(null); + }); + + it('returns null if tls.Socket getPeerCertificate returns empty object', () => { + const tlsSocket = new TLSSocket(new Socket()); + jest.spyOn(tlsSocket, 'getPeerCertificate').mockImplementation(() => ({} as any)); + const socket = new KibanaSocket(tlsSocket); + + expect(socket.getPeerCertificate()).toBe(null); + }); + }); +}); diff --git a/src/core/server/http/router/socket.ts b/src/core/server/http/router/socket.ts new file mode 100644 index 00000000000000..2cdcd8f6410015 --- /dev/null +++ b/src/core/server/http/router/socket.ts @@ -0,0 +1,59 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { Socket } from 'net'; +import { DetailedPeerCertificate, PeerCertificate, TLSSocket } from 'tls'; + +/** + * A tiny abstraction for TCP socket. + * @public + */ +export interface IKibanaSocket { + getPeerCertificate(detailed: true): DetailedPeerCertificate | null; + getPeerCertificate(detailed: false): PeerCertificate | null; + /** + * Returns an object representing the peer's certificate. + * The returned object has some properties corresponding to the field of the certificate. + * If detailed argument is true the full chain with issuer property will be returned, + * if false only the top certificate without issuer property. + * If the peer does not provide a certificate, it returns null. + * @param detailed - If true; the full chain with issuer property will be returned. + * @returns An object representing the peer's certificate. + */ + getPeerCertificate(detailed?: boolean): PeerCertificate | DetailedPeerCertificate | null; +} + +export class KibanaSocket implements IKibanaSocket { + constructor(private readonly socket: Socket) {} + + getPeerCertificate(detailed: true): DetailedPeerCertificate | null; + getPeerCertificate(detailed: false): PeerCertificate | null; + getPeerCertificate(detailed?: boolean): PeerCertificate | DetailedPeerCertificate | null; + + public getPeerCertificate(detailed?: boolean) { + if (this.socket instanceof TLSSocket) { + const peerCertificate = this.socket.getPeerCertificate(detailed); + + // If the peer does not provide a certificate, it returns null (if the socket has been destroyed) + // or an empty object, so we should check for both these cases. + if (peerCertificate && Object.keys(peerCertificate).length > 0) return peerCertificate; + } + return null; + } +} diff --git a/src/core/server/index.ts b/src/core/server/index.ts index 5a7882cb6bd9e0..fc9eef7823a471 100644 --- a/src/core/server/index.ts +++ b/src/core/server/index.ts @@ -75,6 +75,7 @@ export { HttpResponseOptions, HttpResponsePayload, HttpServerSetup, + IKibanaSocket, IsAuthenticated, KibanaRequest, KibanaRequestRoute, diff --git a/src/core/server/server.api.md b/src/core/server/server.api.md index a743bb7719b567..0cda3fd5d40330 100644 --- a/src/core/server/server.api.md +++ b/src/core/server/server.api.md @@ -7,10 +7,12 @@ import Boom from 'boom'; import { CallCluster } from 'src/legacy/core_plugins/elasticsearch'; import { ConfigOptions } from 'elasticsearch'; +import { DetailedPeerCertificate } from 'tls'; import { Duration } from 'moment'; import { IncomingHttpHeaders } from 'http'; import { ObjectType } from '@kbn/config-schema'; import { Observable } from 'rxjs'; +import { PeerCertificate } from 'tls'; import { Readable } from 'stream'; import { Request } from 'hapi'; import { ResponseObject } from 'hapi'; @@ -246,6 +248,15 @@ export interface HttpServiceStart { isListening: (port: number) => boolean; } +// @public +export interface IKibanaSocket { + // (undocumented) + getPeerCertificate(detailed: true): DetailedPeerCertificate | null; + // (undocumented) + getPeerCertificate(detailed: false): PeerCertificate | null; + getPeerCertificate(detailed?: boolean): PeerCertificate | DetailedPeerCertificate | null; +} + // @internal (undocumented) export interface InternalCoreSetup { // (undocumented) @@ -282,6 +293,8 @@ export class KibanaRequest { // (undocumented) readonly query: Query; readonly route: RecursiveReadonly; + // (undocumented) + readonly socket: IKibanaSocket; readonly url: Url; } diff --git a/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/replace_injected_vars.js b/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/replace_injected_vars.js index 71d6000329816b..c926170a2a4de6 100644 --- a/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/replace_injected_vars.js +++ b/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/replace_injected_vars.js @@ -21,6 +21,11 @@ const buildRequest = (telemetryOptedIn = null, path = '/app/kibana') => { return { path, route: { settings: {} }, + raw: { + req: { + socket: {} + } + }, getSavedObjectsClient: () => { return { get,