Skip to content
This repository was archived by the owner on Dec 14, 2022. It is now read-only.

Commit 059bdb6

Browse files
author
Chris Wiechmann
committed
Adding support for field sslSubject
#104
1 parent b174e90 commit 059bdb6

File tree

8 files changed

+84
-4
lines changed

8 files changed

+84
-4
lines changed

‎UPDATE.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@ On the other hand, the API builder Docker image, as a central component of the s
4848
| 2.3.0 | [X](#api-builderlogstashmemcached) | - | - | - | - | - | - |- | 7.10.0 | |
4949
| 2.4.0 | [X](#api-builderlogstashmemcached) | [X](#api-builderlogstashmemcached) | - | - | - | - | [X](#parameters)|- | 7.10.0 | |
5050
| 2.4.1 | [X](#api-builderlogstashmemcached) | - | - | - | - | - | - |- | 7.10.0 | |
51+
| 2.4.2 | [X](#api-builderlogstashmemcached) | - | - | - | - | - | - |[X](#elastic-config)| 7.10.0 | |
5152

5253
### Update from Version 1.0.0
5354

‎apibuilder4elastic/custom_flow_nodes/api-builder-plugin-traffic-monitor-api-utils/src/actions.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ async function handleFilterFields(parameters, options) {
4242
{ fieldName: 'localAddr', queryType: 'match', queryLocation: 'http.localAddr' },
4343
{ fieldName: 'status', queryType: 'match', queryLocation: addStatusFilter },
4444
{ fieldName: 'subject', queryType: 'match', queryLocation: 'http.authSubjectId' },
45+
{ fieldName: 'sslsubject', queryType: 'match', queryLocation: 'http.sslSubject' },
4546
{ fieldName: 'operation', queryType: 'match', queryLocation: 'serviceContext.method' },
4647
{ fieldName: 'localPort', queryType: 'match', queryLocation: 'http.localPort' },
4748
{ fieldName: 'method', queryType: 'match', queryLocation: 'http.method' },

‎apibuilder4elastic/custom_flow_nodes/api-builder-plugin-traffic-monitor-api-utils/test/testHandleFilterQueries.js‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,19 @@ describe('flow-node traffic-monitor-api-utils', () => {
4949
]}});
5050
});
5151

52+
// Example .../search?format=json&field=sslsubject&value=/CN=*.ngrok.io
53+
it('should succeed with SSL-Subject field and proper value given', async () => {
54+
const { value, output } = await flowNode.handleFilterFields({ params: { field: "sslsubject", value: "/CN=*.ngrok.io" }, serviceID: "instance-1" });
55+
56+
expect(output).to.equal('next');
57+
expect(value).to.be.a('object');
58+
expect(value).to.deep.equal({ "bool": { "must": [
59+
{"match": {"http.sslSubject": { "query": "/CN=*.ngrok.io" }}},
60+
{"exists": {"field": "http"}},
61+
{"term": {"processInfo.serviceId": "instance-1"}}
62+
]}});
63+
});
64+
5265
// Example .../search?field=uri&value=/v2/pet/findByStatus&field=method&value=GET
5366
it('should succeed with valid argument', async () => {
5467
const { value, output } = await flowNode.handleFilterFields({ params: { field: ["uri","method"], value: ["/v2/pet/findByStatus","GET"] }, serviceID: "instance-1" });

‎apibuilder4elastic/elasticsearch_config/traffic-summary/index_template.json‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": 4,
2+
"version": 5,
33
"index_patterns": [
44
"apigw-traffic-summary-*"
55
],
@@ -121,6 +121,15 @@
121121
},
122122
"norms": false
123123
},
124+
"http.sslSubject": {
125+
"type": "text",
126+
"fields": {
127+
"keyword": {
128+
"type": "keyword"
129+
}
130+
},
131+
"norms": false
132+
},
124133
"protocol": {
125134
"type": "keyword"
126135
},

‎apibuilder4elastic/flows/trafficMonitorApi-search.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@
134134
{
135135
"name": "code",
136136
"type": "string",
137-
"value": "\"var result = {};\\n var hits = data.elasticsearch.result.body.hits.hits;\\n var protocol = data.params.protocol;\\n result.processId = \\\"\\\";\\n result.data = [];\\n hits.map(function(entry) {\\n var dataObject = {};\\n var _source = entry._source;\\n dataObject.correlationId = _source.correlationId;\\n dataObject.timestamp = Date.parse(_source['@timestamp']);\\n if(_source.serviceContext) {\\n dataObject.serviceName = _source.serviceContext.service;\\n dataObject.operation = _source.serviceContext.method;\\n }\\n dataObject.type = protocol;\\n switch (protocol) {\\n case \\\"http\\\":\\n formatHttpFields(dataObject, _source);\\n break;\\n case \\\"fileTransfer\\\":\\n formatFiletransferFields(dataObject, _source);\\n break;\\n }\\n result.data.push(dataObject);\\n });\\n \\n function formatHttpFields(dataObject, _source) { \\n dataObject.statustext = _source.http.statusText;\\n dataObject.method = _source.http.method;\\n dataObject.status = _source.http.status;\\n dataObject.wafStatus = _source.http.wafStatus;\\n dataObject.subject = _source.http.authSubjectId;\\n dataObject.localPort = _source.http.localPort;\\n dataObject.uri = _source.http.uri;\\n dataObject.vhost = _source.http.vhost;\\n dataObject.duration = _source.duration;\\n dataObject.finalStatus = _source.finalStatus;\\n dataObject.bytesReceived = _source.http.bytesReceived;\\n dataObject.bytesSent = _source.http.bytesSent;\\n dataObject.remoteName = _source.http.remoteName;\\n dataObject.remoteAddr = _source.http.remoteAddr;\\n dataObject.remotePort = _source.http.remotePort;\\n dataObject.localAddr = _source.http.localAddr;\\n dataObject.localPort = _source.http.localPort;\\n dataObject.leg = 0;\\n }\\n \\n function formatFiletransferFields(dataObject, _source) {\\n dataObject.remoteAddr = _source.fileTransfer.remoteAddr;\\n dataObject.uploadFile = _source.fileTransfer.uploadFile;\\n dataObject.direction = _source.fileTransfer.direction;\\n dataObject.servicetype = _source.fileTransfer.serviceType;\\n dataObject.size = _source.fileTransfer.size;\\n dataObject.duration = _source.duration;\\n dataObject.subject = _source.fileTransfer.authSubjectId;\\n dataObject.finalStatus = _source.finalStatus;\\n }\\n\\n \\n return result;\"",
137+
"value": "\"var result = {};\\n var hits = data.elasticsearch.result.body.hits.hits;\\n var protocol = data.params.protocol;\\n result.processId = \\\"\\\";\\n result.data = [];\\n hits.map(function(entry) {\\n var dataObject = {};\\n var _source = entry._source;\\n dataObject.correlationId = _source.correlationId;\\n dataObject.timestamp = Date.parse(_source['@timestamp']);\\n if(_source.serviceContext) {\\n dataObject.serviceName = _source.serviceContext.service;\\n dataObject.operation = _source.serviceContext.method;\\n }\\n if(!_source.http.sslSubject) {\\n _source.http.sslSubject = \\\"null\\\";\\n }\\n dataObject.type = protocol;\\n switch (protocol) {\\n case \\\"http\\\":\\n formatHttpFields(dataObject, _source);\\n break;\\n case \\\"fileTransfer\\\":\\n formatFiletransferFields(dataObject, _source);\\n break;\\n }\\n result.data.push(dataObject);\\n });\\n \\n function formatHttpFields(dataObject, _source) { \\n dataObject.statustext = _source.http.statusText;\\n dataObject.method = _source.http.method;\\n dataObject.status = _source.http.status;\\n dataObject.wafStatus = _source.http.wafStatus;\\n dataObject.subject = _source.http.authSubjectId;\\n dataObject.sslsubject = _source.http.sslSubject;\\n dataObject.localPort = _source.http.localPort;\\n dataObject.uri = _source.http.uri;\\n dataObject.vhost = _source.http.vhost;\\n dataObject.duration = _source.duration;\\n dataObject.finalStatus = _source.finalStatus;\\n dataObject.bytesReceived = _source.http.bytesReceived;\\n dataObject.bytesSent = _source.http.bytesSent;\\n dataObject.remoteName = _source.http.remoteName;\\n dataObject.remoteAddr = _source.http.remoteAddr;\\n dataObject.remotePort = _source.http.remotePort;\\n dataObject.localAddr = _source.http.localAddr;\\n dataObject.localPort = _source.http.localPort;\\n dataObject.leg = 0;\\n }\\n \\n function formatFiletransferFields(dataObject, _source) {\\n dataObject.remoteAddr = _source.fileTransfer.remoteAddr;\\n dataObject.uploadFile = _source.fileTransfer.uploadFile;\\n dataObject.direction = _source.fileTransfer.direction;\\n dataObject.servicetype = _source.fileTransfer.serviceType;\\n dataObject.size = _source.fileTransfer.size;\\n dataObject.duration = _source.duration;\\n dataObject.subject = _source.fileTransfer.authSubjectId;\\n dataObject.finalStatus = _source.finalStatus;\\n }\\n\\n \\n return result;\"",
138138
"metaName": "code",
139139
"metaDescription": "A JavaScript function body. Supports `await` and returning promises."
140140
}

‎apibuilder4elastic/test/documents/http/search_test_documents.js‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ module.exports = [
6969
"localAddr": "192.168.65.133",
7070
"remotePort": "60041",
7171
"localPort": "8065",
72-
"sslSubject": null,
72+
"sslSubject": "null",
7373
"authSubjectId": null
7474
}
7575
},
@@ -201,7 +201,8 @@ module.exports = [
201201
"localAddr" : "192.168.65.129",
202202
"remoteName" : "192.168.65.1",
203203
"remoteAddr": "192.168.65.1",
204-
"remotePort" : 50982
204+
"remotePort" : 50982,
205+
"sslSubject": "/CN=*.ngrok.io"
205206
}
206207
},
207208
// Slightly different API

‎apibuilder4elastic/test/trafficMonitorAPI/asAdmin/http/test_search_endpoint_AsAdmin.js‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -619,6 +619,26 @@ describe('Endpoints', function () {
619619
expect(body.data[0].subject).to.equals('Chris-Test');
620620
});
621621
});
622+
623+
it('[Endpoint-0030] Should return a single result based on the given sslSubject', async () => {
624+
return await requestAsync({
625+
method: 'GET',
626+
uri: `http://localhost:${server.apibuilder.port}/api/elk/v1/api/router/service/instance-1/ops/search?field=sslsubject&value=/CN=*.ngrok.io`,
627+
headers: {
628+
'cookie': 'VIDUSR=Search-0022-DAVID-1597468226-Z+qdRW4rGZnwzQ==',
629+
'csrf-token': '04F9F07E59F588CDE469FC367A12ED3A4B845FDA9A9AE2D9A77686823067CDDC'
630+
},
631+
json: true
632+
}).then(({ response, body }) => {
633+
expect(response.statusCode).to.equal(200);
634+
expect(body).to.be.an('Object');
635+
expect(body).to.have.property('data');
636+
expect(body.data).to.have.lengthOf(1); // We expect ONE API as a result
637+
expect(body.data[0].uri).to.equals('/petstore/v2/pet/findByStatus');
638+
expect(body.data[0].correlationId).to.equals('682c0f5fbe23dc8e1d80efe2');
639+
expect(body.data[0].sslsubject).to.equals('/CN=*.ngrok.io');
640+
});
641+
});
622642
});
623643
});
624644

@@ -640,6 +660,7 @@ function checkFields(data, hasServiceContext, hasVhost) {
640660
expect(entry).to.have.property('remoteAddr');
641661
expect(entry).to.have.property('remotePort');
642662
expect(entry).to.have.property('localAddr');
663+
expect(entry).to.have.property('sslsubject');
643664
if(hasVhost) {
644665
expect(entry).to.have.property('vhost');
645666
}

‎logstash/test/http/test-opentrafficlog.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -710,6 +710,40 @@
710710
"{\"timestamp\":1619688909827,\"correlationId\":\"cd7d8a6097b7669f3d48c5b6\",\"processInfo\":{\"hostname\":\"api-front-11\",\"domainId\":\"8591ad8b-c13d-492a-83cd-c3f937bb91bd\",\"groupId\":\"group-3\",\"groupName\":\"Front\",\"serviceId\":\"instance-3\",\"serviceName\":\"api-front-11.prd.schenkerag.de.axway.cloud\",\"version\":\"7.7.20201130\"},\"transactionElement\":{\"leg\":0,\"duration\":26,\"serviceName\":\"MapService\",\"operation\":null,\"finalStatus\":null,\"protocolInfo\":{\"http\":{\"uri\":\"/mapservice/v1/data/v3/1/1/1.pbf\",\"status\":200,\"statusText\":\"OK\",\"method\":\"OPTIONS\",\"vhost\":null,\"wafStatus\":0,\"bytesSent\":617,\"bytesReceived\":723,\"remoteName\":\"localhost\",\"remoteAddr\":\"127.0.0.1\",\"localAddr\":\"127.0.0.1\",\"remotePort\":\"8065\",\"localPort\":\"55640\",\"sslSubject\":\"/CN=Change this for production\",\"authSubjectId\":null},\"recvHeader\":\"Any received header\",\"sentHeader\":\"Any sent header\",\"recvPayload\":\"file:\/\/\/Cloud\/shared\/Openlogs\/2021-04-29\/11.35\/cd7d8a6097b7669f3d48c5b6-1-received\",\"sentPayload\":null}}}"
711711
],
712712
"expected": [
713+
{
714+
"@timestamp": "2020-09-15T15:37:36.487Z",
715+
"correlationId": "cd7d8a6097b7669f3d48c5b6",
716+
"type": "summaryIndex",
717+
"tags": [],
718+
"duration": 2,
719+
"finalStatus": "Pass",
720+
"processInfo": {
721+
"hostname": "api-env",
722+
"groupId": "group-2",
723+
"groupName": "QuickStart Group",
724+
"serviceId": "instance-1",
725+
"version": "7.7.20200730",
726+
"gatewayName": "API-Gateway 3",
727+
"gatewayRegion": "US"
728+
},
729+
"http": {
730+
"status": 200,
731+
"statusText": "OK",
732+
"method": "OPTIONS",
733+
"uri": "/WebShop.svc",
734+
"vhost": null,
735+
"wafStatus": 0,
736+
"bytesSent": 212,
737+
"bytesReceived": 477,
738+
"remoteName": "192.168.65.1",
739+
"remoteAddr": "192.168.65.1",
740+
"localAddr": "192.168.65.133",
741+
"remotePort": "60041",
742+
"localPort": "8065",
743+
"sslSubject": null,
744+
"authSubjectId": null
745+
}
746+
},
713747
{
714748
"@timestamp": "2021-03-17T11:10:26.799Z",
715749
"correlationId": "cd7d8a6097b7669f3d48c5b6",

0 commit comments

Comments
 (0)