From c42280a8f71eb9231e5eb96bb14c3d7aaf0e0059 Mon Sep 17 00:00:00 2001 From: Mikhail Shustov Date: Fri, 9 Aug 2019 10:42:33 +0200 Subject: [PATCH] add socket.getPeerCertificate to KibanaRequest (#42929) * add socket.getPeerCertificate to KibanaRequest * update request mocks * update docs --- ...rver.ikibanasocket.getpeercertificate_1.md | 22 +++++++ ...rver.ikibanasocket.getpeercertificate_2.md | 22 +++++++ ...rver.ikibanasocket.getpeercertificate_3.md | 26 ++++++++ .../kibana-plugin-server.ikibanasocket.md | 22 +++++++ .../kibana-plugin-server.kibanarequest.md | 1 + ...bana-plugin-server.kibanarequest.socket.md | 11 ++++ .../core/server/kibana-plugin-server.md | 1 + src/core/server/http/index.ts | 1 + src/core/server/http/router/index.ts | 2 + src/core/server/http/router/request.ts | 4 ++ src/core/server/http/router/socket.test.ts | 59 +++++++++++++++++++ src/core/server/http/router/socket.ts | 59 +++++++++++++++++++ src/core/server/index.ts | 1 + src/core/server/server.api.md | 13 ++++ .../lib/__tests__/replace_injected_vars.js | 5 ++ 15 files changed, 249 insertions(+) create mode 100644 docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_1.md create mode 100644 docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_2.md create mode 100644 docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_3.md create mode 100644 docs/development/core/server/kibana-plugin-server.ikibanasocket.md create mode 100644 docs/development/core/server/kibana-plugin-server.kibanarequest.socket.md create mode 100644 src/core/server/http/router/socket.test.ts create mode 100644 src/core/server/http/router/socket.ts diff --git a/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_1.md b/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_1.md new file mode 100644 index 0000000000000..0c6cb0ce8bb0d --- /dev/null +++ b/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_1.md @@ -0,0 +1,22 @@ + + +[Home](./index.md) > [kibana-plugin-server](./kibana-plugin-server.md) > [IKibanaSocket](./kibana-plugin-server.ikibanasocket.md) > [getPeerCertificate](./kibana-plugin-server.ikibanasocket.getpeercertificate_1.md) + +## IKibanaSocket.getPeerCertificate() method + +Signature: + +```typescript +getPeerCertificate(detailed: true): DetailedPeerCertificate | null; +``` + +## Parameters + +| Parameter | Type | Description | +| --- | --- | --- | +| detailed | true | | + +Returns: + +`DetailedPeerCertificate | null` + diff --git a/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_2.md b/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_2.md new file mode 100644 index 0000000000000..a7c63b9d3047a --- /dev/null +++ b/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_2.md @@ -0,0 +1,22 @@ + + +[Home](./index.md) > [kibana-plugin-server](./kibana-plugin-server.md) > [IKibanaSocket](./kibana-plugin-server.ikibanasocket.md) > [getPeerCertificate](./kibana-plugin-server.ikibanasocket.getpeercertificate_2.md) + +## IKibanaSocket.getPeerCertificate() method + +Signature: + +```typescript +getPeerCertificate(detailed: false): PeerCertificate | null; +``` + +## Parameters + +| Parameter | Type | Description | +| --- | --- | --- | +| detailed | false | | + +Returns: + +`PeerCertificate | null` + diff --git a/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_3.md b/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_3.md new file mode 100644 index 0000000000000..0c81a26cf15e6 --- /dev/null +++ b/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_3.md @@ -0,0 +1,26 @@ + + +[Home](./index.md) > [kibana-plugin-server](./kibana-plugin-server.md) > [IKibanaSocket](./kibana-plugin-server.ikibanasocket.md) > [getPeerCertificate](./kibana-plugin-server.ikibanasocket.getpeercertificate_3.md) + +## IKibanaSocket.getPeerCertificate() method + +Returns an object representing the peer's certificate. The returned object has some properties corresponding to the field of the certificate. If detailed argument is true the full chain with issuer property will be returned, if false only the top certificate without issuer property. If the peer does not provide a certificate, it returns null. + +Signature: + +```typescript +getPeerCertificate(detailed?: boolean): PeerCertificate | DetailedPeerCertificate | null; +``` + +## Parameters + +| Parameter | Type | Description | +| --- | --- | --- | +| detailed | boolean | If true; the full chain with issuer property will be returned. | + +Returns: + +`PeerCertificate | DetailedPeerCertificate | null` + +An object representing the peer's certificate. + diff --git a/docs/development/core/server/kibana-plugin-server.ikibanasocket.md b/docs/development/core/server/kibana-plugin-server.ikibanasocket.md new file mode 100644 index 0000000000000..129a3b1d2311a --- /dev/null +++ b/docs/development/core/server/kibana-plugin-server.ikibanasocket.md @@ -0,0 +1,22 @@ + + +[Home](./index.md) > [kibana-plugin-server](./kibana-plugin-server.md) > [IKibanaSocket](./kibana-plugin-server.ikibanasocket.md) + +## IKibanaSocket interface + +A tiny abstraction for TCP socket. + +Signature: + +```typescript +export interface IKibanaSocket +``` + +## Methods + +| Method | Description | +| --- | --- | +| [getPeerCertificate(detailed)](./kibana-plugin-server.ikibanasocket.getpeercertificate_1.md) | | +| [getPeerCertificate(detailed)](./kibana-plugin-server.ikibanasocket.getpeercertificate_2.md) | | +| [getPeerCertificate(detailed)](./kibana-plugin-server.ikibanasocket.getpeercertificate_3.md) | Returns an object representing the peer's certificate. The returned object has some properties corresponding to the field of the certificate. If detailed argument is true the full chain with issuer property will be returned, if false only the top certificate without issuer property. If the peer does not provide a certificate, it returns null. | + diff --git a/docs/development/core/server/kibana-plugin-server.kibanarequest.md b/docs/development/core/server/kibana-plugin-server.kibanarequest.md index 19167f2f64041..6faa9606a8435 100644 --- a/docs/development/core/server/kibana-plugin-server.kibanarequest.md +++ b/docs/development/core/server/kibana-plugin-server.kibanarequest.md @@ -27,5 +27,6 @@ export declare class KibanaRequestParams | | | [query](./kibana-plugin-server.kibanarequest.query.md) | | Query | | | [route](./kibana-plugin-server.kibanarequest.route.md) | | RecursiveReadonly<KibanaRequestRoute> | matched route details | +| [socket](./kibana-plugin-server.kibanarequest.socket.md) | | IKibanaSocket | | | [url](./kibana-plugin-server.kibanarequest.url.md) | | Url | a WHATWG URL standard object. | diff --git a/docs/development/core/server/kibana-plugin-server.kibanarequest.socket.md b/docs/development/core/server/kibana-plugin-server.kibanarequest.socket.md new file mode 100644 index 0000000000000..3880428273ac9 --- /dev/null +++ b/docs/development/core/server/kibana-plugin-server.kibanarequest.socket.md @@ -0,0 +1,11 @@ + + +[Home](./index.md) > [kibana-plugin-server](./kibana-plugin-server.md) > [KibanaRequest](./kibana-plugin-server.kibanarequest.md) > [socket](./kibana-plugin-server.kibanarequest.socket.md) + +## KibanaRequest.socket property + +Signature: + +```typescript +readonly socket: IKibanaSocket; +``` diff --git a/docs/development/core/server/kibana-plugin-server.md b/docs/development/core/server/kibana-plugin-server.md index d5e8b899d26e8..558ff343b02de 100644 --- a/docs/development/core/server/kibana-plugin-server.md +++ b/docs/development/core/server/kibana-plugin-server.md @@ -49,6 +49,7 @@ The plugin integrates with the core system via lifecycle events: `setup` | [HttpResponseOptions](./kibana-plugin-server.httpresponseoptions.md) | HTTP response parameters | | [HttpServerSetup](./kibana-plugin-server.httpserversetup.md) | Kibana HTTP Service provides own abstraction for work with HTTP stack. Plugins don't have direct access to hapi server and its primitives anymore. Moreover, plugins shouldn't rely on the fact that HTTP Service uses one or another library under the hood. This gives the platform flexibility to upgrade or changing our internal HTTP stack without breaking plugins. If the HTTP Service lacks functionality you need, we are happy to discuss and support your needs. | | [HttpServiceStart](./kibana-plugin-server.httpservicestart.md) | | +| [IKibanaSocket](./kibana-plugin-server.ikibanasocket.md) | A tiny abstraction for TCP socket. | | [InternalCoreStart](./kibana-plugin-server.internalcorestart.md) | | | [KibanaRequestRoute](./kibana-plugin-server.kibanarequestroute.md) | Request specific route information exposed to a handler. | | [LegacyRequest](./kibana-plugin-server.legacyrequest.md) | | diff --git a/src/core/server/http/index.ts b/src/core/server/http/index.ts index 4be92fe492b3e..0fe827360ffdf 100644 --- a/src/core/server/http/index.ts +++ b/src/core/server/http/index.ts @@ -24,6 +24,7 @@ export { GetAuthHeaders } from './auth_headers_storage'; export { AuthStatus, GetAuthState, IsAuthenticated } from './auth_state_storage'; export { CustomHttpResponseOptions, + IKibanaSocket, isRealRequest, HttpResponseOptions, HttpResponsePayload, diff --git a/src/core/server/http/router/index.ts b/src/core/server/http/router/index.ts index 5e2cbe5b7e158..fa0dc55397647 100644 --- a/src/core/server/http/router/index.ts +++ b/src/core/server/http/router/index.ts @@ -41,3 +41,5 @@ export { lifecycleResponseFactory, LifecycleResponseFactory, } from './response'; + +export { IKibanaSocket } from './socket'; diff --git a/src/core/server/http/router/request.ts b/src/core/server/http/router/request.ts index 4eac2e98317fc..9e4d017f8db3e 100644 --- a/src/core/server/http/router/request.ts +++ b/src/core/server/http/router/request.ts @@ -25,6 +25,7 @@ import { ObjectType, TypeOf } from '@kbn/config-schema'; import { deepFreeze, RecursiveReadonly } from '../../../utils'; import { Headers } from './headers'; import { RouteMethod, RouteSchemas, RouteConfigOptions } from './route'; +import { KibanaSocket, IKibanaSocket } from './socket'; const requestSymbol = Symbol('request'); @@ -120,6 +121,8 @@ export class KibanaRequest { */ public readonly headers: Headers; + public readonly socket: IKibanaSocket; + /** @internal */ protected readonly [requestSymbol]: Request; @@ -142,6 +145,7 @@ export class KibanaRequest { }); this.route = deepFreeze(this.getRouteInfo()); + this.socket = new KibanaSocket(request.raw.req.socket); } private getRouteInfo() { diff --git a/src/core/server/http/router/socket.test.ts b/src/core/server/http/router/socket.test.ts new file mode 100644 index 0000000000000..6bd903fd2f36c --- /dev/null +++ b/src/core/server/http/router/socket.test.ts @@ -0,0 +1,59 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +import { Socket } from 'net'; +import { DetailedPeerCertificate, TLSSocket } from 'tls'; +import { KibanaSocket } from './socket'; + +describe('KibanaSocket', () => { + describe('getPeerCertificate', () => { + it('returns null for net.Socket instance', () => { + const socket = new KibanaSocket(new Socket()); + + expect(socket.getPeerCertificate()).toBe(null); + }); + + it('delegates a call to tls.Socket instance', () => { + const tlsSocket = new TLSSocket(new Socket()); + const cert = { issuerCertificate: {} } as DetailedPeerCertificate; + const spy = jest.spyOn(tlsSocket, 'getPeerCertificate').mockImplementation(() => cert); + const socket = new KibanaSocket(tlsSocket); + const result = socket.getPeerCertificate(true); + + expect(spy).toBeCalledTimes(1); + expect(spy).toBeCalledWith(true); + expect(result).toBe(cert); + }); + + it('returns null if tls.Socket getPeerCertificate returns null', () => { + const tlsSocket = new TLSSocket(new Socket()); + jest.spyOn(tlsSocket, 'getPeerCertificate').mockImplementation(() => null as any); + const socket = new KibanaSocket(tlsSocket); + + expect(socket.getPeerCertificate()).toBe(null); + }); + + it('returns null if tls.Socket getPeerCertificate returns empty object', () => { + const tlsSocket = new TLSSocket(new Socket()); + jest.spyOn(tlsSocket, 'getPeerCertificate').mockImplementation(() => ({} as any)); + const socket = new KibanaSocket(tlsSocket); + + expect(socket.getPeerCertificate()).toBe(null); + }); + }); +}); diff --git a/src/core/server/http/router/socket.ts b/src/core/server/http/router/socket.ts new file mode 100644 index 0000000000000..2cdcd8f641001 --- /dev/null +++ b/src/core/server/http/router/socket.ts @@ -0,0 +1,59 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { Socket } from 'net'; +import { DetailedPeerCertificate, PeerCertificate, TLSSocket } from 'tls'; + +/** + * A tiny abstraction for TCP socket. + * @public + */ +export interface IKibanaSocket { + getPeerCertificate(detailed: true): DetailedPeerCertificate | null; + getPeerCertificate(detailed: false): PeerCertificate | null; + /** + * Returns an object representing the peer's certificate. + * The returned object has some properties corresponding to the field of the certificate. + * If detailed argument is true the full chain with issuer property will be returned, + * if false only the top certificate without issuer property. + * If the peer does not provide a certificate, it returns null. + * @param detailed - If true; the full chain with issuer property will be returned. + * @returns An object representing the peer's certificate. + */ + getPeerCertificate(detailed?: boolean): PeerCertificate | DetailedPeerCertificate | null; +} + +export class KibanaSocket implements IKibanaSocket { + constructor(private readonly socket: Socket) {} + + getPeerCertificate(detailed: true): DetailedPeerCertificate | null; + getPeerCertificate(detailed: false): PeerCertificate | null; + getPeerCertificate(detailed?: boolean): PeerCertificate | DetailedPeerCertificate | null; + + public getPeerCertificate(detailed?: boolean) { + if (this.socket instanceof TLSSocket) { + const peerCertificate = this.socket.getPeerCertificate(detailed); + + // If the peer does not provide a certificate, it returns null (if the socket has been destroyed) + // or an empty object, so we should check for both these cases. + if (peerCertificate && Object.keys(peerCertificate).length > 0) return peerCertificate; + } + return null; + } +} diff --git a/src/core/server/index.ts b/src/core/server/index.ts index 5a7882cb6bd9e..fc9eef7823a47 100644 --- a/src/core/server/index.ts +++ b/src/core/server/index.ts @@ -75,6 +75,7 @@ export { HttpResponseOptions, HttpResponsePayload, HttpServerSetup, + IKibanaSocket, IsAuthenticated, KibanaRequest, KibanaRequestRoute, diff --git a/src/core/server/server.api.md b/src/core/server/server.api.md index a743bb7719b56..0cda3fd5d4033 100644 --- a/src/core/server/server.api.md +++ b/src/core/server/server.api.md @@ -7,10 +7,12 @@ import Boom from 'boom'; import { CallCluster } from 'src/legacy/core_plugins/elasticsearch'; import { ConfigOptions } from 'elasticsearch'; +import { DetailedPeerCertificate } from 'tls'; import { Duration } from 'moment'; import { IncomingHttpHeaders } from 'http'; import { ObjectType } from '@kbn/config-schema'; import { Observable } from 'rxjs'; +import { PeerCertificate } from 'tls'; import { Readable } from 'stream'; import { Request } from 'hapi'; import { ResponseObject } from 'hapi'; @@ -246,6 +248,15 @@ export interface HttpServiceStart { isListening: (port: number) => boolean; } +// @public +export interface IKibanaSocket { + // (undocumented) + getPeerCertificate(detailed: true): DetailedPeerCertificate | null; + // (undocumented) + getPeerCertificate(detailed: false): PeerCertificate | null; + getPeerCertificate(detailed?: boolean): PeerCertificate | DetailedPeerCertificate | null; +} + // @internal (undocumented) export interface InternalCoreSetup { // (undocumented) @@ -282,6 +293,8 @@ export class KibanaRequest { // (undocumented) readonly query: Query; readonly route: RecursiveReadonly; + // (undocumented) + readonly socket: IKibanaSocket; readonly url: Url; } diff --git a/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/replace_injected_vars.js b/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/replace_injected_vars.js index 71d6000329816..c926170a2a4de 100644 --- a/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/replace_injected_vars.js +++ b/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/replace_injected_vars.js @@ -21,6 +21,11 @@ const buildRequest = (telemetryOptedIn = null, path = '/app/kibana') => { return { path, route: { settings: {} }, + raw: { + req: { + socket: {} + } + }, getSavedObjectsClient: () => { return { get,