From 1ff59e6a0125da799a3ffe55e547759ab827d11e Mon Sep 17 00:00:00 2001 From: restrry Date: Thu, 8 Aug 2019 12:10:49 +0200 Subject: [PATCH 1/3] add socket.getPeerCertificate to KibanaRequest --- src/core/server/http/router/request.ts | 4 ++ src/core/server/http/router/socket.test.ts | 59 ++++++++++++++++++++++ src/core/server/http/router/socket.ts | 55 ++++++++++++++++++++ 3 files changed, 118 insertions(+) create mode 100644 src/core/server/http/router/socket.test.ts create mode 100644 src/core/server/http/router/socket.ts diff --git a/src/core/server/http/router/request.ts b/src/core/server/http/router/request.ts index 4eac2e98317fc..9e4d017f8db3e 100644 --- a/src/core/server/http/router/request.ts +++ b/src/core/server/http/router/request.ts @@ -25,6 +25,7 @@ import { ObjectType, TypeOf } from '@kbn/config-schema'; import { deepFreeze, RecursiveReadonly } from '../../../utils'; import { Headers } from './headers'; import { RouteMethod, RouteSchemas, RouteConfigOptions } from './route'; +import { KibanaSocket, IKibanaSocket } from './socket'; const requestSymbol = Symbol('request'); @@ -120,6 +121,8 @@ export class KibanaRequest { */ public readonly headers: Headers; + public readonly socket: IKibanaSocket; + /** @internal */ protected readonly [requestSymbol]: Request; @@ -142,6 +145,7 @@ export class KibanaRequest { }); this.route = deepFreeze(this.getRouteInfo()); + this.socket = new KibanaSocket(request.raw.req.socket); } private getRouteInfo() { diff --git a/src/core/server/http/router/socket.test.ts b/src/core/server/http/router/socket.test.ts new file mode 100644 index 0000000000000..6bd903fd2f36c --- /dev/null +++ b/src/core/server/http/router/socket.test.ts @@ -0,0 +1,59 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +import { Socket } from 'net'; +import { DetailedPeerCertificate, TLSSocket } from 'tls'; +import { KibanaSocket } from './socket'; + +describe('KibanaSocket', () => { + describe('getPeerCertificate', () => { + it('returns null for net.Socket instance', () => { + const socket = new KibanaSocket(new Socket()); + + expect(socket.getPeerCertificate()).toBe(null); + }); + + it('delegates a call to tls.Socket instance', () => { + const tlsSocket = new TLSSocket(new Socket()); + const cert = { issuerCertificate: {} } as DetailedPeerCertificate; + const spy = jest.spyOn(tlsSocket, 'getPeerCertificate').mockImplementation(() => cert); + const socket = new KibanaSocket(tlsSocket); + const result = socket.getPeerCertificate(true); + + expect(spy).toBeCalledTimes(1); + expect(spy).toBeCalledWith(true); + expect(result).toBe(cert); + }); + + it('returns null if tls.Socket getPeerCertificate returns null', () => { + const tlsSocket = new TLSSocket(new Socket()); + jest.spyOn(tlsSocket, 'getPeerCertificate').mockImplementation(() => null as any); + const socket = new KibanaSocket(tlsSocket); + + expect(socket.getPeerCertificate()).toBe(null); + }); + + it('returns null if tls.Socket getPeerCertificate returns empty object', () => { + const tlsSocket = new TLSSocket(new Socket()); + jest.spyOn(tlsSocket, 'getPeerCertificate').mockImplementation(() => ({} as any)); + const socket = new KibanaSocket(tlsSocket); + + expect(socket.getPeerCertificate()).toBe(null); + }); + }); +}); diff --git a/src/core/server/http/router/socket.ts b/src/core/server/http/router/socket.ts new file mode 100644 index 0000000000000..7c2f25e859ac1 --- /dev/null +++ b/src/core/server/http/router/socket.ts @@ -0,0 +1,55 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { Socket } from 'net'; +import { DetailedPeerCertificate, PeerCertificate, TLSSocket } from 'tls'; + +export interface IKibanaSocket { + /** + * Returns an object representing the peer's certificate. + * The returned object has some properties corresponding to the field of the certificate. + * If detailed argument is true the full chain with issuer property will be returned, + * if false only the top certificate without issuer property. + * If the peer does not provide a certificate, it returns null. + * @param detailed - If true; the full chain with issuer property will be returned. + * @returns An object representing the peer's certificate. + */ + getPeerCertificate(detailed: true): DetailedPeerCertificate | null; + getPeerCertificate(detailed: false): PeerCertificate | null; + getPeerCertificate(detailed?: boolean): PeerCertificate | DetailedPeerCertificate | null; +} + +export class KibanaSocket implements IKibanaSocket { + constructor(private readonly socket: Socket) {} + + getPeerCertificate(detailed: true): DetailedPeerCertificate | null; + getPeerCertificate(detailed: false): PeerCertificate | null; + getPeerCertificate(detailed?: boolean): PeerCertificate | DetailedPeerCertificate | null; + + public getPeerCertificate(detailed?: boolean) { + if (this.socket instanceof TLSSocket) { + const peerCertificate = this.socket.getPeerCertificate(detailed); + + // If the peer does not provide a certificate, it returns null (if the socket has been destroyed) + // or an empty object, so we should check for both these cases. + if (peerCertificate && Object.keys(peerCertificate).length > 0) return peerCertificate; + } + return null; + } +} From 051a4374d56ad86043791ed78366b8e8d438e6a3 Mon Sep 17 00:00:00 2001 From: restrry Date: Thu, 8 Aug 2019 16:04:33 +0200 Subject: [PATCH 2/3] update request mocks --- .../xpack_main/server/lib/__tests__/replace_injected_vars.js | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/replace_injected_vars.js b/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/replace_injected_vars.js index 71d6000329816..c926170a2a4de 100644 --- a/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/replace_injected_vars.js +++ b/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/replace_injected_vars.js @@ -21,6 +21,11 @@ const buildRequest = (telemetryOptedIn = null, path = '/app/kibana') => { return { path, route: { settings: {} }, + raw: { + req: { + socket: {} + } + }, getSavedObjectsClient: () => { return { get, From 8391cf093b53fc4b47a03b047d2861e1e466091d Mon Sep 17 00:00:00 2001 From: restrry Date: Thu, 8 Aug 2019 16:13:13 +0200 Subject: [PATCH 3/3] update docs --- ...rver.ikibanasocket.getpeercertificate_1.md | 22 ++++++++++++++++ ...rver.ikibanasocket.getpeercertificate_2.md | 22 ++++++++++++++++ ...rver.ikibanasocket.getpeercertificate_3.md | 26 +++++++++++++++++++ .../kibana-plugin-server.ikibanasocket.md | 22 ++++++++++++++++ .../kibana-plugin-server.kibanarequest.md | 1 + ...bana-plugin-server.kibanarequest.socket.md | 11 ++++++++ .../core/server/kibana-plugin-server.md | 1 + src/core/server/http/index.ts | 1 + src/core/server/http/router/index.ts | 2 ++ src/core/server/http/router/socket.ts | 8 ++++-- src/core/server/index.ts | 1 + src/core/server/server.api.md | 13 ++++++++++ 12 files changed, 128 insertions(+), 2 deletions(-) create mode 100644 docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_1.md create mode 100644 docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_2.md create mode 100644 docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_3.md create mode 100644 docs/development/core/server/kibana-plugin-server.ikibanasocket.md create mode 100644 docs/development/core/server/kibana-plugin-server.kibanarequest.socket.md diff --git a/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_1.md b/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_1.md new file mode 100644 index 0000000000000..0c6cb0ce8bb0d --- /dev/null +++ b/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_1.md @@ -0,0 +1,22 @@ + + +[Home](./index.md) > [kibana-plugin-server](./kibana-plugin-server.md) > [IKibanaSocket](./kibana-plugin-server.ikibanasocket.md) > [getPeerCertificate](./kibana-plugin-server.ikibanasocket.getpeercertificate_1.md) + +## IKibanaSocket.getPeerCertificate() method + +Signature: + +```typescript +getPeerCertificate(detailed: true): DetailedPeerCertificate | null; +``` + +## Parameters + +| Parameter | Type | Description | +| --- | --- | --- | +| detailed | true | | + +Returns: + +`DetailedPeerCertificate | null` + diff --git a/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_2.md b/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_2.md new file mode 100644 index 0000000000000..a7c63b9d3047a --- /dev/null +++ b/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_2.md @@ -0,0 +1,22 @@ + + +[Home](./index.md) > [kibana-plugin-server](./kibana-plugin-server.md) > [IKibanaSocket](./kibana-plugin-server.ikibanasocket.md) > [getPeerCertificate](./kibana-plugin-server.ikibanasocket.getpeercertificate_2.md) + +## IKibanaSocket.getPeerCertificate() method + +Signature: + +```typescript +getPeerCertificate(detailed: false): PeerCertificate | null; +``` + +## Parameters + +| Parameter | Type | Description | +| --- | --- | --- | +| detailed | false | | + +Returns: + +`PeerCertificate | null` + diff --git a/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_3.md b/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_3.md new file mode 100644 index 0000000000000..0c81a26cf15e6 --- /dev/null +++ b/docs/development/core/server/kibana-plugin-server.ikibanasocket.getpeercertificate_3.md @@ -0,0 +1,26 @@ + + +[Home](./index.md) > [kibana-plugin-server](./kibana-plugin-server.md) > [IKibanaSocket](./kibana-plugin-server.ikibanasocket.md) > [getPeerCertificate](./kibana-plugin-server.ikibanasocket.getpeercertificate_3.md) + +## IKibanaSocket.getPeerCertificate() method + +Returns an object representing the peer's certificate. The returned object has some properties corresponding to the field of the certificate. If detailed argument is true the full chain with issuer property will be returned, if false only the top certificate without issuer property. If the peer does not provide a certificate, it returns null. + +Signature: + +```typescript +getPeerCertificate(detailed?: boolean): PeerCertificate | DetailedPeerCertificate | null; +``` + +## Parameters + +| Parameter | Type | Description | +| --- | --- | --- | +| detailed | boolean | If true; the full chain with issuer property will be returned. | + +Returns: + +`PeerCertificate | DetailedPeerCertificate | null` + +An object representing the peer's certificate. + diff --git a/docs/development/core/server/kibana-plugin-server.ikibanasocket.md b/docs/development/core/server/kibana-plugin-server.ikibanasocket.md new file mode 100644 index 0000000000000..129a3b1d2311a --- /dev/null +++ b/docs/development/core/server/kibana-plugin-server.ikibanasocket.md @@ -0,0 +1,22 @@ + + +[Home](./index.md) > [kibana-plugin-server](./kibana-plugin-server.md) > [IKibanaSocket](./kibana-plugin-server.ikibanasocket.md) + +## IKibanaSocket interface + +A tiny abstraction for TCP socket. + +Signature: + +```typescript +export interface IKibanaSocket +``` + +## Methods + +| Method | Description | +| --- | --- | +| [getPeerCertificate(detailed)](./kibana-plugin-server.ikibanasocket.getpeercertificate_1.md) | | +| [getPeerCertificate(detailed)](./kibana-plugin-server.ikibanasocket.getpeercertificate_2.md) | | +| [getPeerCertificate(detailed)](./kibana-plugin-server.ikibanasocket.getpeercertificate_3.md) | Returns an object representing the peer's certificate. The returned object has some properties corresponding to the field of the certificate. If detailed argument is true the full chain with issuer property will be returned, if false only the top certificate without issuer property. If the peer does not provide a certificate, it returns null. | + diff --git a/docs/development/core/server/kibana-plugin-server.kibanarequest.md b/docs/development/core/server/kibana-plugin-server.kibanarequest.md index 19167f2f64041..6faa9606a8435 100644 --- a/docs/development/core/server/kibana-plugin-server.kibanarequest.md +++ b/docs/development/core/server/kibana-plugin-server.kibanarequest.md @@ -27,5 +27,6 @@ export declare class KibanaRequestParams | | | [query](./kibana-plugin-server.kibanarequest.query.md) | | Query | | | [route](./kibana-plugin-server.kibanarequest.route.md) | | RecursiveReadonly<KibanaRequestRoute> | matched route details | +| [socket](./kibana-plugin-server.kibanarequest.socket.md) | | IKibanaSocket | | | [url](./kibana-plugin-server.kibanarequest.url.md) | | Url | a WHATWG URL standard object. | diff --git a/docs/development/core/server/kibana-plugin-server.kibanarequest.socket.md b/docs/development/core/server/kibana-plugin-server.kibanarequest.socket.md new file mode 100644 index 0000000000000..3880428273ac9 --- /dev/null +++ b/docs/development/core/server/kibana-plugin-server.kibanarequest.socket.md @@ -0,0 +1,11 @@ + + +[Home](./index.md) > [kibana-plugin-server](./kibana-plugin-server.md) > [KibanaRequest](./kibana-plugin-server.kibanarequest.md) > [socket](./kibana-plugin-server.kibanarequest.socket.md) + +## KibanaRequest.socket property + +Signature: + +```typescript +readonly socket: IKibanaSocket; +``` diff --git a/docs/development/core/server/kibana-plugin-server.md b/docs/development/core/server/kibana-plugin-server.md index d5e8b899d26e8..558ff343b02de 100644 --- a/docs/development/core/server/kibana-plugin-server.md +++ b/docs/development/core/server/kibana-plugin-server.md @@ -49,6 +49,7 @@ The plugin integrates with the core system via lifecycle events: `setup` | [HttpResponseOptions](./kibana-plugin-server.httpresponseoptions.md) | HTTP response parameters | | [HttpServerSetup](./kibana-plugin-server.httpserversetup.md) | Kibana HTTP Service provides own abstraction for work with HTTP stack. Plugins don't have direct access to hapi server and its primitives anymore. Moreover, plugins shouldn't rely on the fact that HTTP Service uses one or another library under the hood. This gives the platform flexibility to upgrade or changing our internal HTTP stack without breaking plugins. If the HTTP Service lacks functionality you need, we are happy to discuss and support your needs. | | [HttpServiceStart](./kibana-plugin-server.httpservicestart.md) | | +| [IKibanaSocket](./kibana-plugin-server.ikibanasocket.md) | A tiny abstraction for TCP socket. | | [InternalCoreStart](./kibana-plugin-server.internalcorestart.md) | | | [KibanaRequestRoute](./kibana-plugin-server.kibanarequestroute.md) | Request specific route information exposed to a handler. | | [LegacyRequest](./kibana-plugin-server.legacyrequest.md) | | diff --git a/src/core/server/http/index.ts b/src/core/server/http/index.ts index 4be92fe492b3e..0fe827360ffdf 100644 --- a/src/core/server/http/index.ts +++ b/src/core/server/http/index.ts @@ -24,6 +24,7 @@ export { GetAuthHeaders } from './auth_headers_storage'; export { AuthStatus, GetAuthState, IsAuthenticated } from './auth_state_storage'; export { CustomHttpResponseOptions, + IKibanaSocket, isRealRequest, HttpResponseOptions, HttpResponsePayload, diff --git a/src/core/server/http/router/index.ts b/src/core/server/http/router/index.ts index 5e2cbe5b7e158..fa0dc55397647 100644 --- a/src/core/server/http/router/index.ts +++ b/src/core/server/http/router/index.ts @@ -41,3 +41,5 @@ export { lifecycleResponseFactory, LifecycleResponseFactory, } from './response'; + +export { IKibanaSocket } from './socket'; diff --git a/src/core/server/http/router/socket.ts b/src/core/server/http/router/socket.ts index 7c2f25e859ac1..2cdcd8f641001 100644 --- a/src/core/server/http/router/socket.ts +++ b/src/core/server/http/router/socket.ts @@ -20,7 +20,13 @@ import { Socket } from 'net'; import { DetailedPeerCertificate, PeerCertificate, TLSSocket } from 'tls'; +/** + * A tiny abstraction for TCP socket. + * @public + */ export interface IKibanaSocket { + getPeerCertificate(detailed: true): DetailedPeerCertificate | null; + getPeerCertificate(detailed: false): PeerCertificate | null; /** * Returns an object representing the peer's certificate. * The returned object has some properties corresponding to the field of the certificate. @@ -30,8 +36,6 @@ export interface IKibanaSocket { * @param detailed - If true; the full chain with issuer property will be returned. * @returns An object representing the peer's certificate. */ - getPeerCertificate(detailed: true): DetailedPeerCertificate | null; - getPeerCertificate(detailed: false): PeerCertificate | null; getPeerCertificate(detailed?: boolean): PeerCertificate | DetailedPeerCertificate | null; } diff --git a/src/core/server/index.ts b/src/core/server/index.ts index 5a7882cb6bd9e..fc9eef7823a47 100644 --- a/src/core/server/index.ts +++ b/src/core/server/index.ts @@ -75,6 +75,7 @@ export { HttpResponseOptions, HttpResponsePayload, HttpServerSetup, + IKibanaSocket, IsAuthenticated, KibanaRequest, KibanaRequestRoute, diff --git a/src/core/server/server.api.md b/src/core/server/server.api.md index a743bb7719b56..0cda3fd5d4033 100644 --- a/src/core/server/server.api.md +++ b/src/core/server/server.api.md @@ -7,10 +7,12 @@ import Boom from 'boom'; import { CallCluster } from 'src/legacy/core_plugins/elasticsearch'; import { ConfigOptions } from 'elasticsearch'; +import { DetailedPeerCertificate } from 'tls'; import { Duration } from 'moment'; import { IncomingHttpHeaders } from 'http'; import { ObjectType } from '@kbn/config-schema'; import { Observable } from 'rxjs'; +import { PeerCertificate } from 'tls'; import { Readable } from 'stream'; import { Request } from 'hapi'; import { ResponseObject } from 'hapi'; @@ -246,6 +248,15 @@ export interface HttpServiceStart { isListening: (port: number) => boolean; } +// @public +export interface IKibanaSocket { + // (undocumented) + getPeerCertificate(detailed: true): DetailedPeerCertificate | null; + // (undocumented) + getPeerCertificate(detailed: false): PeerCertificate | null; + getPeerCertificate(detailed?: boolean): PeerCertificate | DetailedPeerCertificate | null; +} + // @internal (undocumented) export interface InternalCoreSetup { // (undocumented) @@ -282,6 +293,8 @@ export class KibanaRequest { // (undocumented) readonly query: Query; readonly route: RecursiveReadonly; + // (undocumented) + readonly socket: IKibanaSocket; readonly url: Url; }