public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Secure socks proxy: use Grafana Plugin SDK (#71616)

Browse Source
This commit is contained in:
Stephanie Hingtgen
2023-07-18 15:23:02 -06:00
committed by GitHub
parent 600f623610
commit 4ece133fce
18 changed files with 101 additions and 226 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/infra/httpclient/httpclientprovider/http_client_provider.go
-8
View File
@@ -9,7 +9,6 @@ import (
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/infra/metrics/metricutil"
"github.com/grafana/grafana/pkg/infra/proxy"
"github.com/grafana/grafana/pkg/infra/tracing"
"github.com/grafana/grafana/pkg/services/validations"
"github.com/grafana/grafana/pkg/setting"
@@ -54,13 +53,6 @@ func New(cfg *setting.Cfg, validator validations.PluginRequestValidator, tracer
return
}
if cfg.SecureSocksDSProxy.Enabled && proxy.SecureSocksProxyEnabledOnDS(opts) {
err = proxy.NewSecureSocksHTTPProxy(&cfg.SecureSocksDSProxy, transport)
if err != nil {
logger.Error("Failed to enable secure socks proxy", "error", err.Error(), "datasource", datasourceName)
}
}
newConntrackRoundTripper(datasourceLabelName, transport)
},
})
pkg/infra/proxy/proxyutil/proxyutil.go
-108
View File
@@ -1,108 +0,0 @@
package proxyutil
import (
"crypto/rand"
"crypto/rsa"
"crypto/x509"
"crypto/x509/pkix"
"encoding/pem"
"math/big"
"os"
"path/filepath"
"testing"
"time"
"github.com/grafana/grafana/pkg/setting"
"github.com/stretchr/testify/require"
)
func SetupTestSecureSocksProxySettings(t *testing.T) *setting.SecureSocksDSProxySettings {
proxyAddress := "localhost:3000"
serverName := "localhost"
tempDir := t.TempDir()
// generate test rootCA
ca := &x509.Certificate{
SerialNumber: big.NewInt(2019),
Subject: pkix.Name{
Organization: []string{"Grafana Labs"},
CommonName: "Grafana",
},
NotBefore: time.Now(),
NotAfter: time.Now().AddDate(10, 0, 0),
IsCA: true,
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
BasicConstraintsValid: true,
}
caPrivKey, err := rsa.GenerateKey(rand.Reader, 4096)
require.NoError(t, err)
caBytes, err := x509.CreateCertificate(rand.Reader, ca, ca, &caPrivKey.PublicKey, caPrivKey)
require.NoError(t, err)
rootCACert := filepath.Join(tempDir, "ca.cert")
// nolint:gosec
// The gosec G304 warning can be ignored because all values come from the test
caCertFile, err := os.Create(rootCACert)
require.NoError(t, err)
err = pem.Encode(caCertFile, &pem.Block{
Type: "CERTIFICATE",
Bytes: caBytes,
})
require.NoError(t, err)
err = caCertFile.Close()
require.NoError(t, err)
// generate test client cert & key
cert := &x509.Certificate{
SerialNumber: big.NewInt(2019),
Subject: pkix.Name{
Organization: []string{"Grafana Labs"},
CommonName: "Grafana",
},
NotBefore: time.Now(),
NotAfter: time.Now().AddDate(10, 0, 0),
SubjectKeyId: []byte{1, 2, 3, 4, 6},
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
KeyUsage: x509.KeyUsageDigitalSignature,
}
certPrivKey, err := rsa.GenerateKey(rand.Reader, 4096)
require.NoError(t, err)
certBytes, err := x509.CreateCertificate(rand.Reader, cert, ca, &certPrivKey.PublicKey, caPrivKey)
require.NoError(t, err)
clientCert := filepath.Join(tempDir, "client.cert")
// nolint:gosec
// The gosec G304 warning can be ignored because all values come from the test
certFile, err := os.Create(clientCert)
require.NoError(t, err)
err = pem.Encode(certFile, &pem.Block{
Type: "CERTIFICATE",
Bytes: certBytes,
})
require.NoError(t, err)
err = certFile.Close()
require.NoError(t, err)
clientKey := filepath.Join(tempDir, "client.key")
// nolint:gosec
// The gosec G304 warning can be ignored because all values come from the test
keyFile, err := os.Create(clientKey)
require.NoError(t, err)
err = pem.Encode(keyFile, &pem.Block{
Type: "RSA PRIVATE KEY",
Bytes: x509.MarshalPKCS1PrivateKey(certPrivKey),
})
require.NoError(t, err)
err = keyFile.Close()
require.NoError(t, err)
return &setting.SecureSocksDSProxySettings{
ClientCert: clientCert,
ClientKey: clientKey,
RootCA: rootCACert,
ServerName: serverName,
ProxyAddress: proxyAddress,
}
}
pkg/infra/proxy/secure_socks_proxy.go
-81
View File
@@ -1,81 +0,0 @@
package proxy
import (
"crypto/tls"
"crypto/x509"
"errors"
"net/http"
"os"
"strings"
"github.com/grafana/grafana-plugin-sdk-go/backend"
sdkhttpclient "github.com/grafana/grafana-plugin-sdk-go/backend/httpclient"
"github.com/grafana/grafana/pkg/setting"
"golang.org/x/net/proxy"
)
// NewSecureSocksHTTPProxy takes a http.DefaultTransport and wraps it in a socks5 proxy with TLS
func NewSecureSocksHTTPProxy(cfg *setting.SecureSocksDSProxySettings, transport *http.Transport) error {
dialSocksProxy, err := NewSecureSocksProxyContextDialer(cfg)
if err != nil {
return err
}
contextDialer, ok := dialSocksProxy.(proxy.ContextDialer)
if !ok {
return errors.New("unable to cast socks proxy dialer to context proxy dialer")
}
transport.DialContext = contextDialer.DialContext
return nil
}
// NewSecureSocksProxyContextDialer returns a proxy context dialer that will wrap connections in a secure socks proxy
func NewSecureSocksProxyContextDialer(cfg *setting.SecureSocksDSProxySettings) (proxy.Dialer, error) {
certPool := x509.NewCertPool()
for _, rootCAFile := range strings.Split(cfg.RootCA, " ") {
// nolint:gosec
// The gosec G304 warning can be ignored because `rootCAFile` comes from config ini.
pem, err := os.ReadFile(rootCAFile)
if err != nil {
return nil, err
}
if !certPool.AppendCertsFromPEM(pem) {
return nil, errors.New("failed to append CA certificate " + rootCAFile)
}
}
cert, err := tls.LoadX509KeyPair(cfg.ClientCert, cfg.ClientKey)
if err != nil {
return nil, err
}
tlsDialer := &tls.Dialer{
Config: &tls.Config{
Certificates: []tls.Certificate{cert},
ServerName: cfg.ServerName,
RootCAs: certPool,
},
}
dialSocksProxy, err := proxy.SOCKS5("tcp", cfg.ProxyAddress, nil, tlsDialer)
if err != nil {
return nil, err
}
return dialSocksProxy, nil
}
// SecureSocksProxyEnabledOnDS checks the datasource json data to see if the secure socks proxy is enabled on it
func SecureSocksProxyEnabledOnDS(opts sdkhttpclient.Options) bool {
jsonData := backend.JSONDataFromHTTPClientOptions(opts)
res, enabled := jsonData["enableSecureSocksProxy"]
if !enabled {
return false
}
if val, ok := res.(bool); ok {
return val
}
return false
}
pkg/infra/proxy/secure_socks_proxy_test.go
-91
View File
@@ -1,91 +0,0 @@
package proxy
import (
"net/http"
"os"
"path/filepath"
"testing"
"github.com/grafana/grafana-plugin-sdk-go/backend"
"github.com/grafana/grafana/pkg/infra/proxy/proxyutil"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func TestNewSecureSocksProxy(t *testing.T) {
settings := proxyutil.SetupTestSecureSocksProxySettings(t)
// create empty file for testing invalid configs
tempDir := t.TempDir()
tempEmptyFile := filepath.Join(tempDir, "emptyfile.txt")
// nolint:gosec
// The gosec G304 warning can be ignored because all values come from the test
_, err := os.Create(tempEmptyFile)
require.NoError(t, err)
t.Run("New socks proxy should be properly configured when all settings are valid", func(t *testing.T) {
require.NoError(t, NewSecureSocksHTTPProxy(settings, &http.Transport{}))
})
t.Run("Client cert must be valid", func(t *testing.T) {
clientCertBefore := settings.ClientCert
settings.ClientCert = tempEmptyFile
t.Cleanup(func() {
settings.ClientCert = clientCertBefore
})
require.Error(t, NewSecureSocksHTTPProxy(settings, &http.Transport{}))
})
t.Run("Client key must be valid", func(t *testing.T) {
clientKeyBefore := settings.ClientKey
settings.ClientKey = tempEmptyFile
t.Cleanup(func() {
settings.ClientKey = clientKeyBefore
})
require.Error(t, NewSecureSocksHTTPProxy(settings, &http.Transport{}))
})
t.Run("Root CA must be valid", func(t *testing.T) {
rootCABefore := settings.RootCA
settings.RootCA = tempEmptyFile
t.Cleanup(func() {
settings.RootCA = rootCABefore
})
require.Error(t, NewSecureSocksHTTPProxy(settings, &http.Transport{}))
})
}
func TestSecureSocksProxyEnabledOnDS(t *testing.T) {
t.Run("Secure socks proxy should only be enabled when the json data contains enableSecureSocksProxy=true", func(t *testing.T) {
tests := []struct {
instanceSettings *backend.AppInstanceSettings
enabled bool
}{
{
instanceSettings: &backend.AppInstanceSettings{
JSONData: []byte("{}"),
},
enabled: false,
},
{
instanceSettings: &backend.AppInstanceSettings{
JSONData: []byte("{ \"enableSecureSocksProxy\": false }"),
},
enabled: false,
},
{
instanceSettings: &backend.AppInstanceSettings{
JSONData: []byte("{ \"enableSecureSocksProxy\": true }"),
},
enabled: true,
},
}
for _, tt := range tests {
opts, err := tt.instanceSettings.HTTPClientOptions()
assert.NoError(t, err)
assert.Equal(t, tt.enabled, SecureSocksProxyEnabledOnDS(opts))
}
})
}