Skip to content

Commit 74e996f

Browse files
intxgomergify[bot]
intxgo
authored and
mergify[bot]
committed
resolve proxy to inject using http package (#6675)
* resolve proxy to inject using http package * unit tests * golint * golint * changelog fragment * changelog fragment * move environment manipulation, trying to fix test run in CI * fix unit test, localhost never goes through environment proxy * use internal function to be able to unit test the behavior * make lint happy * fix build * update NOTICE (cherry picked from commit be179d8)
1 parent 8bc7c7b commit 74e996f

File tree

5 files changed

+108
-98
lines changed

5 files changed

+108
-98
lines changed

‎NOTICE.txt

+37-37
Original file line numberDiff line numberDiff line change
@@ -18064,6 +18064,43 @@ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
1806418064
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1806518065

1806618066

18067+
--------------------------------------------------------------------------------
18068+
Dependency : golang.org/x/net
18069+
Version: v0.34.0
18070+
Licence type (autodetected): BSD-3-Clause
18071+
--------------------------------------------------------------------------------
18072+
18073+
Contents of probable licence file $GOMODCACHE/golang.org/x/net@v0.34.0/LICENSE:
18074+
18075+
Copyright 2009 The Go Authors.
18076+
18077+
Redistribution and use in source and binary forms, with or without
18078+
modification, are permitted provided that the following conditions are
18079+
met:
18080+
18081+
* Redistributions of source code must retain the above copyright
18082+
notice, this list of conditions and the following disclaimer.
18083+
* Redistributions in binary form must reproduce the above
18084+
copyright notice, this list of conditions and the following disclaimer
18085+
in the documentation and/or other materials provided with the
18086+
distribution.
18087+
* Neither the name of Google LLC nor the names of its
18088+
contributors may be used to endorse or promote products derived from
18089+
this software without specific prior written permission.
18090+
18091+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
18092+
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
18093+
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
18094+
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
18095+
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
18096+
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
18097+
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
18098+
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
18099+
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
18100+
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
18101+
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
18102+
18103+
1806718104
--------------------------------------------------------------------------------
1806818105
Dependency : golang.org/x/sync
1806918106
Version: v0.10.0
@@ -101533,43 +101570,6 @@ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
101533101570
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
101534101571

101535101572

101536-
--------------------------------------------------------------------------------
101537-
Dependency : golang.org/x/net
101538-
Version: v0.34.0
101539-
Licence type (autodetected): BSD-3-Clause
101540-
--------------------------------------------------------------------------------
101541-
101542-
Contents of probable licence file $GOMODCACHE/golang.org/x/net@v0.34.0/LICENSE:
101543-
101544-
Copyright 2009 The Go Authors.
101545-
101546-
Redistribution and use in source and binary forms, with or without
101547-
modification, are permitted provided that the following conditions are
101548-
met:
101549-
101550-
* Redistributions of source code must retain the above copyright
101551-
notice, this list of conditions and the following disclaimer.
101552-
* Redistributions in binary form must reproduce the above
101553-
copyright notice, this list of conditions and the following disclaimer
101554-
in the documentation and/or other materials provided with the
101555-
distribution.
101556-
* Neither the name of Google LLC nor the names of its
101557-
contributors may be used to endorse or promote products derived from
101558-
this software without specific prior written permission.
101559-
101560-
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
101561-
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
101562-
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
101563-
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
101564-
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
101565-
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
101566-
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
101567-
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
101568-
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
101569-
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
101570-
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
101571-
101572-
101573101573
--------------------------------------------------------------------------------
101574101574
Dependency : golang.org/x/oauth2
101575101575
Version: v0.24.0

‎changelog/fragments/1738329703-environment-proxy-injection-fix.yaml

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Kind can be one of:
2+
# - breaking-change: a change to previously-documented behavior
3+
# - deprecation: functionality that is being removed in a later release
4+
# - bug-fix: fixes a problem in a previous version
5+
# - enhancement: extends functionality but does not break or fix existing behavior
6+
# - feature: new functionality
7+
# - known-issue: problems that we are aware of in a given version
8+
# - security: impacts on the security of a product or a user’s deployment.
9+
# - upgrade: important information for someone upgrading from a prior version
10+
# - other: does not fit into any of the other categories
11+
kind: bug-fix
12+
13+
# Change summary; a 80ish characters long description of the change.
14+
summary: environment-proxy-injection-fix
15+
16+
# Long description; in case the summary is not enough to describe the change
17+
# this field accommodate a description without length limits.
18+
# NOTE: This field will be rendered only for breaking-change and known-issue kinds at the moment.
19+
description: When injecting environment proxy into Elastic Defend config the Agent should use http library to resolve the proxy settings to ensure consistency across all components.
20+
21+
# Affected component; usually one of "elastic-agent", "fleet-server", "filebeat", "metricbeat", "auditbeat", "all", etc.
22+
component: elastic-agent
23+
24+
# PR URL; optional; the PR number that added the changeset.
25+
# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added.
26+
# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number.
27+
# Please provide it if you are adding a fragment for a different PR.
28+
pr: https://github.com/elastic/elastic-agent/pull/6675
29+
30+
# Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of).
31+
# If not present is automatically filled by the tooling with the issue linked to the PR number.
32+
issue: https://github.com/elastic/elastic-agent/issues/6209

‎go.mod

+1-1
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@ require (
7878
go.uber.org/zap v1.27.0
7979
golang.org/x/crypto v0.32.0
8080
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
81+
golang.org/x/net v0.34.0
8182
golang.org/x/sync v0.10.0
8283
golang.org/x/sys v0.29.0
8384
golang.org/x/term v0.28.0
@@ -603,7 +604,6 @@ require (
603604
go.uber.org/atomic v1.11.0 // indirect
604605
go.uber.org/multierr v1.11.0 // indirect
605606
golang.org/x/mod v0.21.0 // indirect
606-
golang.org/x/net v0.34.0 // indirect
607607
golang.org/x/oauth2 v0.24.0 // indirect
608608
golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
609609
gonum.org/v1/gonum v0.15.1 // indirect

‎internal/pkg/agent/application/inject_proxy_component_modifier.go

+18-26
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,9 @@
55
package application
66

77
import (
8-
"os"
9-
"strings"
8+
"net/http"
9+
10+
"golang.org/x/net/http/httpproxy"
1011

1112
"github.com/elastic/elastic-agent-client/v7/pkg/client"
1213
"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator"
@@ -59,9 +60,8 @@ func InjectProxyEndpointModifier() coordinator.ComponentsModifier {
5960

6061
// injectProxyURL will inject the a proxy_url into the passed map if there is no existing key and there is an appropriate proxy through defined as an env var.
6162
//
62-
// The 1st item of the passed hosts list is checked to see if it starts with https or http and the corresponding proxy var is used.
63-
// Nothing is injected if the *_PROXY env var is empty, the map contains proxy_url: "", or the map has proxy_disable: true.
64-
// If no hosts are passed, then the HTTPS_PROXY value is used over the HTTP_PROXY value if it's defined.
63+
// Go http client is used to determine the proxy URL, to ensure consistent behavior across all components.
64+
// Traffic through proxy is preferred if the proxy is defined for any of the hosts.
6565
func injectProxyURL(m map[string]interface{}, hosts []string) {
6666
if m == nil {
6767
return
@@ -79,28 +79,20 @@ func injectProxyURL(m map[string]interface{}, hosts []string) {
7979
}
8080
}
8181

82-
var proxyURL string
83-
matched := false
84-
// If hosts are specified, check the 1st to see if HTTPS or HTTP is used to determine proxy
85-
if len(hosts) > 0 {
86-
if strings.HasPrefix(hosts[0], "https://") {
87-
matched = true
88-
proxyURL = os.Getenv("HTTPS_PROXY")
89-
} else if strings.HasPrefix(hosts[0], "http://") {
90-
matched = true
91-
proxyURL = os.Getenv("HTTP_PROXY")
82+
// Check if a proxy is defined for the hosts
83+
for _, host := range hosts {
84+
request, err := http.NewRequest("GET", host, nil)
85+
if err != nil {
86+
continue
9287
}
93-
}
94-
// if no hosts are specified, or it could not match a host prefix prefer HTTPS_PROXY over HTTP_PROXY
95-
if proxyURL == "" && !matched {
96-
proxyURL = os.Getenv("HTTPS_PROXY")
97-
if proxyURL == "" {
98-
proxyURL = os.Getenv("HTTP_PROXY")
88+
// not using http.ProxyFromEnvironment() to be able to change the environment in unit tests
89+
proxyURL, err := httpproxy.FromEnvironment().ProxyFunc()(request.URL)
90+
if err != nil {
91+
continue
92+
}
93+
if proxyURL != nil && proxyURL.String() != "" {
94+
m["proxy_url"] = proxyURL.String()
95+
return
9996
}
10097
}
101-
// No proxy defined
102-
if proxyURL == "" {
103-
return
104-
}
105-
m["proxy_url"] = proxyURL
10698
}

‎internal/pkg/agent/application/inject_proxy_component_modifier_test.go

+20-34
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ func TestInjectProxyEndpointModifier(t *testing.T) {
4343
Type: elasticsearch,
4444
Source: func() *structpb.Struct {
4545
var source structpb.Struct
46-
err := source.UnmarshalJSON([]byte(`{"type":"elasticsearch","hosts":["https://localhost:9200"]}`))
46+
err := source.UnmarshalJSON([]byte(`{"type":"elasticsearch","hosts":["https://example.output:9200"]}`))
4747
require.NoError(t, err)
4848
return &source
4949
}(),
@@ -64,7 +64,7 @@ func TestInjectProxyEndpointModifier(t *testing.T) {
6464
Type: elasticsearch,
6565
Source: func() *structpb.Struct {
6666
var source structpb.Struct
67-
err := source.UnmarshalJSON([]byte(`{"type":"elasticsearch","hosts":["https://localhost:9200"]}`))
67+
err := source.UnmarshalJSON([]byte(`{"type":"elasticsearch","hosts":["https://example.output:9200"]}`))
6868
require.NoError(t, err)
6969
return &source
7070
}(),
@@ -88,7 +88,7 @@ func TestInjectProxyEndpointModifier(t *testing.T) {
8888
Type: elasticsearch,
8989
Source: func() *structpb.Struct {
9090
var source structpb.Struct
91-
err := source.UnmarshalJSON([]byte(`{"type":"elasticsearch","hosts":["https://localhost:9200"],"proxy_url":"https://proxy:8080"}`))
91+
err := source.UnmarshalJSON([]byte(`{"type":"elasticsearch","hosts":["https://example.output:9200"],"proxy_url":"https://proxy:8080"}`))
9292
require.NoError(t, err)
9393
return &source
9494
}(),
@@ -109,7 +109,7 @@ func TestInjectProxyEndpointModifier(t *testing.T) {
109109
Type: elasticsearch,
110110
Source: func() *structpb.Struct {
111111
var source structpb.Struct
112-
err := source.UnmarshalJSON([]byte(`{"type":"elasticsearch","hosts":["https://localhost:9200"],"proxy_url":"https://proxy:8080"}`))
112+
err := source.UnmarshalJSON([]byte(`{"type":"elasticsearch","hosts":["https://example.output:9200"],"proxy_url":"https://proxy:8080"}`))
113113
require.NoError(t, err)
114114
return &source
115115
}(),
@@ -133,7 +133,7 @@ func TestInjectProxyEndpointModifier(t *testing.T) {
133133
Type: elasticsearch,
134134
Source: func() *structpb.Struct {
135135
var source structpb.Struct
136-
err := source.UnmarshalJSON([]byte(`{"type":"elasticsearch","hosts":["https://localhost:9200"],"proxy_url":""}`))
136+
err := source.UnmarshalJSON([]byte(`{"type":"elasticsearch","hosts":["https://example.output:9200"],"proxy_url":""}`))
137137
require.NoError(t, err)
138138
return &source
139139
}(),
@@ -154,7 +154,7 @@ func TestInjectProxyEndpointModifier(t *testing.T) {
154154
Type: elasticsearch,
155155
Source: func() *structpb.Struct {
156156
var source structpb.Struct
157-
err := source.UnmarshalJSON([]byte(`{"type":"elasticsearch","hosts":["https://localhost:9200"],"proxy_url":""}`))
157+
err := source.UnmarshalJSON([]byte(`{"type":"elasticsearch","hosts":["https://example.output:9200"],"proxy_url":""}`))
158158
require.NoError(t, err)
159159
return &source
160160
}(),
@@ -178,7 +178,7 @@ func TestInjectProxyEndpointModifier(t *testing.T) {
178178
Type: elasticsearch,
179179
Source: func() *structpb.Struct {
180180
var source structpb.Struct
181-
err := source.UnmarshalJSON([]byte(`{"type":"elasticsearch","hosts":["https://localhost:9200"],"proxy_disable":true}`))
181+
err := source.UnmarshalJSON([]byte(`{"type":"elasticsearch","hosts":["https://example.output:9200"],"proxy_disable":true}`))
182182
require.NoError(t, err)
183183
return &source
184184
}(),
@@ -199,7 +199,7 @@ func TestInjectProxyEndpointModifier(t *testing.T) {
199199
Type: elasticsearch,
200200
Source: func() *structpb.Struct {
201201
var source structpb.Struct
202-
err := source.UnmarshalJSON([]byte(`{"type":"elasticsearch","hosts":["https://localhost:9200"],"proxy_disable":true}`))
202+
err := source.UnmarshalJSON([]byte(`{"type":"elasticsearch","hosts":["https://example.output:9200"],"proxy_disable":true}`))
203203
require.NoError(t, err)
204204
return &source
205205
}(),
@@ -223,7 +223,7 @@ func TestInjectProxyEndpointModifier(t *testing.T) {
223223
Type: elasticsearch,
224224
Source: func() *structpb.Struct {
225225
var source structpb.Struct
226-
err := source.UnmarshalJSON([]byte(`{"type":"elasticsearch","hosts":["https://localhost:9200"]}`))
226+
err := source.UnmarshalJSON([]byte(`{"type":"elasticsearch","hosts":["https://example.output:9200"]}`))
227227
require.NoError(t, err)
228228
return &source
229229
}(),
@@ -244,7 +244,7 @@ func TestInjectProxyEndpointModifier(t *testing.T) {
244244
Type: elasticsearch,
245245
Source: func() *structpb.Struct {
246246
var source structpb.Struct
247-
err := source.UnmarshalJSON([]byte(`{"type":"elasticsearch","hosts":["https://localhost:9200"],"proxy_url":"https://localhost:8080"}`))
247+
err := source.UnmarshalJSON([]byte(`{"type":"elasticsearch","hosts":["https://example.output:9200"],"proxy_url":"https://localhost:8080"}`))
248248
require.NoError(t, err)
249249
return &source
250250
}(),
@@ -268,7 +268,7 @@ func TestInjectProxyEndpointModifier(t *testing.T) {
268268
Type: elasticsearch,
269269
Source: func() *structpb.Struct {
270270
var source structpb.Struct
271-
err := source.UnmarshalJSON([]byte(`{"type":"elasticsearch","hosts":["http://localhost:9200"]}`))
271+
err := source.UnmarshalJSON([]byte(`{"type":"elasticsearch","hosts":["http://example.output:9200"]}`))
272272
require.NoError(t, err)
273273
return &source
274274
}(),
@@ -289,7 +289,7 @@ func TestInjectProxyEndpointModifier(t *testing.T) {
289289
Type: elasticsearch,
290290
Source: func() *structpb.Struct {
291291
var source structpb.Struct
292-
err := source.UnmarshalJSON([]byte(`{"type":"elasticsearch","hosts":["http://localhost:9200"],"proxy_url":"http://localhost:8081"}`))
292+
err := source.UnmarshalJSON([]byte(`{"type":"elasticsearch","hosts":["http://example.output:9200"],"proxy_url":"http://localhost:8081"}`))
293293
require.NoError(t, err)
294294
return &source
295295
}(),
@@ -320,6 +320,7 @@ func TestInjectProxyEndpointModifier(t *testing.T) {
320320
func Test_injectProxyURL(t *testing.T) {
321321
t.Setenv("HTTPS_PROXY", "https://localhost:8080")
322322
t.Setenv("HTTP_PROXY", "http://localhost:8081")
323+
t.Setenv("NO_PROXY", "do.not.inject.proxy.for.me")
323324

324325
tests := []struct {
325326
name string
@@ -341,41 +342,26 @@ func Test_injectProxyURL(t *testing.T) {
341342
hosts: nil,
342343
expect: map[string]interface{}{"key": "value", "proxy_disable": true},
343344
}, {
344-
name: "no hosts uses HTTPS_PROXY",
345+
name: "http hosts uses HTTP_PROXY",
345346
m: map[string]interface{}{"key": "value"},
346-
hosts: nil,
347-
expect: map[string]interface{}{"key": "value", "proxy_url": "https://localhost:8080"},
347+
hosts: []string{"http://example:80"},
348+
expect: map[string]interface{}{"key": "value", "proxy_url": "http://localhost:8081"},
348349
}, {
349350
name: "https hosts uses HTTPS_PROXY",
350351
m: map[string]interface{}{"key": "value"},
351352
hosts: []string{"https://example:443"},
352353
expect: map[string]interface{}{"key": "value", "proxy_url": "https://localhost:8080"},
353354
}, {
354-
name: "http host uses HTTP_PROXY",
355+
name: "host skipped by NO_PROXY",
355356
m: map[string]interface{}{"key": "value"},
356-
hosts: []string{"http://example:80"},
357-
expect: map[string]interface{}{"key": "value", "proxy_url": "http://localhost:8081"},
357+
hosts: []string{"https://do.not.inject.proxy.for.me", "https://do.not.inject.proxy.for.me:8080", "really.do.not.inject.proxy.for.me"},
358+
expect: map[string]interface{}{"key": "value"},
358359
}}
360+
359361
for _, tc := range tests {
360362
t.Run(tc.name, func(t *testing.T) {
361363
injectProxyURL(tc.m, tc.hosts)
362364
require.Equal(t, tc.expect, tc.m)
363365
})
364366
}
365-
366-
t.Run("no hosts or HTTPS_PROXY uses HTTP_PROXY", func(t *testing.T) {
367-
t.Setenv("HTTPS_PROXY", "")
368-
t.Setenv("HTTP_PROXY", "http://localhost:8081")
369-
370-
m := map[string]interface{}{"key": "value"}
371-
injectProxyURL(m, nil)
372-
require.Equal(t, map[string]interface{}{"key": "value", "proxy_url": "http://localhost:8081"}, m)
373-
})
374-
t.Run("no env vars", func(t *testing.T) {
375-
t.Setenv("HTTPS_PROXY", "")
376-
t.Setenv("HTTP_PROXY", "")
377-
m := map[string]interface{}{"key": "value"}
378-
injectProxyURL(m, nil)
379-
require.Equal(t, map[string]interface{}{"key": "value"}, m)
380-
})
381367
}

0 commit comments

Comments
 (0)