[Multiple Datasources] Add TLS configuration for multiple data sources

CHANGELOG.md

@@ -54,6 +54,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 - [Chrome] Introduce registerCollapsibleNavHeader to allow plugins to customize the rendering of nav menu header ([#5244](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/5244))
 - [Dynamic Configurations] Pass request headers when making application config calls ([#6164](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/6164))
 - [Discover] Options button to configure legacy mode and remove the top navigation option ([#6170](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/6170))
+- [Multiple Datasource] Add TLS configuration for multiple data sources ([#6171](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/6171))
 
 
 ### 🐛 Bug Fixes

config/opensearch_dashboards.yml

@@ -281,6 +281,14 @@
 #    'ff00::/8',
 # ]
 
+# Optional setting that enables you to specify a path to PEM files for the certificate
+# authority for your connected datasources.
+#data_source.ssl.certificateAuthorities: [ "/path/to/your/CA.pem" ]
+
+# To disregard the validity of SSL certificates for connected data sources, change this setting's value to 'none'.
+# Possible values include full, certificate and none
+#data_source.ssl.verificationMode: full
+
 # Set enabled false to hide authentication method in OpenSearch Dashboards.
 # If this setting is commented then all 3 options will be available in OpenSearch Dashboards.
 # Default value will be considered to True.

src/plugins/data_source/config.ts

@@ -31,6 +31,15 @@ export const configSchema = schema.object({
       defaultValue: new Array(32).fill(0),
     }),
   }),
+  ssl: schema.object({
+    verificationMode: schema.oneOf(
+      [schema.literal('none'), schema.literal('certificate'), schema.literal('full')],
+      { defaultValue: 'full' }
+    ),
+    certificateAuthorities: schema.maybe(
+      schema.oneOf([schema.string(), schema.arrayOf(schema.string(), { minSize: 1 })])
+    ),
+  }),
   clientPool: schema.object({
     size: schema.number({ defaultValue: 5 }),
   }),

src/plugins/data_source/server/client/client_config.test.ts

@@ -5,17 +5,20 @@
 import { DataSourcePluginConfigType } from '../../config';
 import { parseClientOptions } from './client_config';
 
-const TEST_DATA_SOURCE_ENDPOINT = 'http://test.com/';
+jest.mock('fs');
+const mockReadFileSync: jest.Mock = jest.requireMock('fs').readFileSync;
 
-const config = {
-  enabled: true,
-  clientPool: {
-    size: 5,
-  },
-} as DataSourcePluginConfigType;
+const TEST_DATA_SOURCE_ENDPOINT = 'http://test.com/';
 
 describe('parseClientOptions', () => {
   test('include the ssl client configs as defaults', () => {
+    const config = {
+      enabled: true,
+      clientPool: {
+        size: 5,
+      },
+    } as DataSourcePluginConfigType;
+
     expect(parseClientOptions(config, TEST_DATA_SOURCE_ENDPOINT)).toEqual(
       expect.objectContaining({
         node: TEST_DATA_SOURCE_ENDPOINT,
@@ -26,4 +29,84 @@ describe('parseClientOptions', () => {
       })
     );
   });
+
+  test('test ssl config with verification mode set to none', () => {
+    const config = {
+      enabled: true,
+      ssl: {
+        verificationMode: 'none',
+      },
+      clientPool: {
+        size: 5,
+      },
+    } as DataSourcePluginConfigType;
+    expect(parseClientOptions(config, TEST_DATA_SOURCE_ENDPOINT)).toEqual(
+      expect.objectContaining({
+        node: TEST_DATA_SOURCE_ENDPOINT,
+        ssl: {
+          requestCert: true,
+          rejectUnauthorized: false,
+          ca: [],
+        },
+      })
+    );
+  });
+
+  test('test ssl config with verification mode set to certificate', () => {
+    const config = {
+      enabled: true,
+      ssl: {
+        verificationMode: 'certificate',
+        certificateAuthorities: ['some-path'],
+      },
+      clientPool: {
+        size: 5,
+      },
+    } as DataSourcePluginConfigType;
+    mockReadFileSync.mockReset();
+    mockReadFileSync.mockImplementation((path: string) => `content-of-${path}`);
+    const parsedConfig = parseClientOptions(config, TEST_DATA_SOURCE_ENDPOINT);
+    expect(mockReadFileSync).toHaveBeenCalledTimes(1);
+    mockReadFileSync.mockClear();
+    expect(parsedConfig).toEqual(
+      expect.objectContaining({
+        node: TEST_DATA_SOURCE_ENDPOINT,
+        ssl: {
+          requestCert: true,
+          rejectUnauthorized: true,
+          checkServerIdentity: expect.any(Function),
+          ca: ['content-of-some-path'],
+        },
+      })
+    );
+    expect(parsedConfig.ssl?.checkServerIdentity()).toBeUndefined();
+  });
+
+  test('test ssl config with verification mode set to full', () => {
+    const config = {
+      enabled: true,
+      ssl: {
+        verificationMode: 'full',
+        certificateAuthorities: ['some-path'],
+      },
+      clientPool: {
+        size: 5,
+      },
+    } as DataSourcePluginConfigType;
+    mockReadFileSync.mockReset();
+    mockReadFileSync.mockImplementation((path: string) => `content-of-${path}`);
+    const parsedConfig = parseClientOptions(config, TEST_DATA_SOURCE_ENDPOINT);
+    expect(mockReadFileSync).toHaveBeenCalledTimes(1);
+    mockReadFileSync.mockClear();
+    expect(parsedConfig).toEqual(
+      expect.objectContaining({
+        node: TEST_DATA_SOURCE_ENDPOINT,
+        ssl: {
+          requestCert: true,
+          rejectUnauthorized: true,
+          ca: ['content-of-some-path'],
+        },
+      })
+    );
+  });
 });

src/plugins/data_source/server/client/client_config.ts

@@ -4,8 +4,18 @@
  */
 
 import { ClientOptions } from '@opensearch-project/opensearch';
+import { readFileSync } from 'fs';
+import { checkServerIdentity } from 'tls';
 import { DataSourcePluginConfigType } from '../../config';
 
+/** @internal */
+type DataSourceSSLConfigOptions = Partial<{
+  requestCert: boolean;
+  rejectUnauthorized: boolean;
+  checkServerIdentity: typeof checkServerIdentity;
+  ca: string[];
+}>;
+
 /**
  * Parse the client options from given data source config and endpoint
  *
@@ -18,14 +28,70 @@
   endpoint: string,
   registeredSchema: any[]
 ): ClientOptions {
+  const sslConfig: DataSourceSSLConfigOptions = {
+    requestCert: true,
+    rejectUnauthorized: true,
+  };
+
+  if (config.ssl) {
+    const verificationMode = config.ssl.verificationMode;
+    switch (verificationMode) {
+      case 'none':
+        sslConfig.rejectUnauthorized = false;
+        break;
+      case 'certificate':
+        sslConfig.rejectUnauthorized = true;
+
+        // by default, NodeJS is checking the server identify
+        sslConfig.checkServerIdentity = () => undefined;
+        break;
+      case 'full':
+        sslConfig.rejectUnauthorized = true;
+        break;
+      default:
+        throw new Error(`Unknown ssl verificationMode: ${verificationMode}`);
+    }
+
+    const { certificateAuthorities } = readCertificateAuthorities(config);
+
+    sslConfig.ca = certificateAuthorities || [];
+  }
+
   const clientOptions: ClientOptions = {
     node: endpoint,
-    ssl: {
-      requestCert: true,
-      rejectUnauthorized: true,
-    },
+    ssl: sslConfig,
     plugins: registeredSchema,
   };
 
   return clientOptions;
 }
+
+export const readCertificateAuthorities = (rawConfig: any) => {
+  let certificateAuthorities: string[] | undefined;
+
+  const addCAs = (ca: string[] | undefined) => {
+    if (ca && ca.length) {
+      certificateAuthorities = [...(certificateAuthorities || []), ...ca];
+    }
+  };
+
+  const ca = rawConfig.ssl.certificateAuthorities;
+  if (ca) {
+    const parsed: string[] = [];
+    const paths = Array.isArray(ca) ? ca : [ca];
+    if (paths.length > 0) {
+      for (const path of paths) {
+        parsed.push(readFile(path));
+      }
+      addCAs(parsed);
+    }
+  }
+
+  return {
+    certificateAuthorities,
+  };
+};
+
+const readFile = (file: string) => {
+  return readFileSync(file, 'utf8');
+};

src/plugins/data_source/server/legacy/client_config.test.ts

@@ -5,17 +5,20 @@
 import { DataSourcePluginConfigType } from '../../config';
 import { parseClientOptions } from './client_config';
 
-const TEST_DATA_SOURCE_ENDPOINT = 'http://test.com/';
+jest.mock('fs');
+const mockReadFileSync: jest.Mock = jest.requireMock('fs').readFileSync;
 
-const config = {
-  enabled: true,
-  clientPool: {
-    size: 5,
-  },
-} as DataSourcePluginConfigType;
+const TEST_DATA_SOURCE_ENDPOINT = 'http://test.com/';
 
 describe('parseClientOptions', () => {
   test('include the ssl client configs as defaults', () => {
+    const config = {
+      enabled: true,
+      clientPool: {
+        size: 5,
+      },
+    } as DataSourcePluginConfigType;
+
     expect(parseClientOptions(config, TEST_DATA_SOURCE_ENDPOINT)).toEqual(
       expect.objectContaining({
         host: TEST_DATA_SOURCE_ENDPOINT,
@@ -25,4 +28,81 @@ describe('parseClientOptions', () => {
       })
     );
   });
+
+  test('test ssl config with verification mode set to none', () => {
+    const config = {
+      enabled: true,
+      ssl: {
+        verificationMode: 'none',
+      },
+      clientPool: {
+        size: 5,
+      },
+    } as DataSourcePluginConfigType;
+    expect(parseClientOptions(config, TEST_DATA_SOURCE_ENDPOINT)).toEqual(
+      expect.objectContaining({
+        host: TEST_DATA_SOURCE_ENDPOINT,
+        ssl: {
+          rejectUnauthorized: false,
+          ca: [],
+        },
+      })
+    );
+  });
+
+  test('test ssl config with verification mode set to certificate', () => {
+    const config = {
+      enabled: true,
+      ssl: {
+        verificationMode: 'certificate',
+        certificateAuthorities: ['some-path'],
+      },
+      clientPool: {
+        size: 5,
+      },
+    } as DataSourcePluginConfigType;
+    mockReadFileSync.mockReset();
+    mockReadFileSync.mockImplementation((path: string) => `content-of-${path}`);
+    const parsedConfig = parseClientOptions(config, TEST_DATA_SOURCE_ENDPOINT);
+    expect(mockReadFileSync).toHaveBeenCalledTimes(1);
+    mockReadFileSync.mockClear();
+    expect(parsedConfig).toEqual(
+      expect.objectContaining({
+        host: TEST_DATA_SOURCE_ENDPOINT,
+        ssl: {
+          rejectUnauthorized: true,
+          checkServerIdentity: expect.any(Function),
+          ca: ['content-of-some-path'],
+        },
+      })
+    );
+    expect(parsedConfig.ssl?.checkServerIdentity()).toBeUndefined();
+  });
+
+  test('test ssl config with verification mode set to full', () => {
+    const config = {
+      enabled: true,
+      ssl: {
+        verificationMode: 'full',
+        certificateAuthorities: ['some-path'],
+      },
+      clientPool: {
+        size: 5,
+      },
+    } as DataSourcePluginConfigType;
+    mockReadFileSync.mockReset();
+    mockReadFileSync.mockImplementation((path: string) => `content-of-${path}`);
+    const parsedConfig = parseClientOptions(config, TEST_DATA_SOURCE_ENDPOINT);
+    expect(mockReadFileSync).toHaveBeenCalledTimes(1);
+    mockReadFileSync.mockClear();
+    expect(parsedConfig).toEqual(
+      expect.objectContaining({
+        host: TEST_DATA_SOURCE_ENDPOINT,
+        ssl: {
+          rejectUnauthorized: true,
+          ca: ['content-of-some-path'],
+        },
+      })
+    );
+  });
 });