Fix sslConfig for multiple datasource to handle when certificateAutho…

…rities is unset (#6282) (#6296) * Fix sslConfig for multiple datasource to handle when certificateAuthorities is unset Signed-off-by: Craig Perkins <cwperx@amazon.com> * Add to CHANGELOG Signed-off-by: Craig Perkins <cwperx@amazon.com> * Adjust test in tls_settings_provider.test.ts Signed-off-by: Craig Perkins <cwperx@amazon.com> --------- Signed-off-by: Craig Perkins <cwperx@amazon.com> (cherry picked from commit 40da92c) Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> # Conflicts: # CHANGELOG.md Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
opensearch-project · Apr 2, 2024 · e0c3664 · e0c3664
1 parent 1197a74
commit e0c3664
Show file tree

Hide file tree

Showing 6 changed files with 60 additions and 7 deletions.
diff --git a/src/plugins/data_source/server/client/client_config.test.ts b/src/plugins/data_source/server/client/client_config.test.ts
@@ -46,7 +46,7 @@ describe('parseClientOptions', () => {
         ssl: {
           requestCert: true,
           rejectUnauthorized: false,
-          ca: [],
+          ca: undefined,
         },
       })
     );
@@ -109,4 +109,31 @@ describe('parseClientOptions', () => {
       })
     );
   });
+
+  test('test ssl config with verification mode set to full with no ca list', () => {
+    const config = {
+      enabled: true,
+      ssl: {
+        verificationMode: 'full',
+      },
+      clientPool: {
+        size: 5,
+      },
+    } as DataSourcePluginConfigType;
+    mockReadFileSync.mockReset();
+    mockReadFileSync.mockImplementation((path: string) => `content-of-${path}`);
+    const parsedConfig = parseClientOptions(config, TEST_DATA_SOURCE_ENDPOINT);
+    expect(mockReadFileSync).toHaveBeenCalledTimes(0);
+    mockReadFileSync.mockClear();
+    expect(parsedConfig).toEqual(
+      expect.objectContaining({
+        node: TEST_DATA_SOURCE_ENDPOINT,
+        ssl: {
+          requestCert: true,
+          rejectUnauthorized: true,
+          ca: undefined,
+        },
+      })
+    );
+  });
 });
diff --git a/src/plugins/data_source/server/client/client_config.ts b/src/plugins/data_source/server/client/client_config.ts
@@ -56,7 +56,7 @@ export function parseClientOptions(
       config.ssl?.certificateAuthorities
     );
 
-    sslConfig.ca = certificateAuthorities || [];
+    sslConfig.ca = certificateAuthorities;
   }
 
   const clientOptions: ClientOptions = {

diff --git a/src/plugins/data_source/server/legacy/client_config.test.ts b/src/plugins/data_source/server/legacy/client_config.test.ts
@@ -44,7 +44,7 @@ describe('parseClientOptions', () => {
         host: TEST_DATA_SOURCE_ENDPOINT,
         ssl: {
           rejectUnauthorized: false,
-          ca: [],
+          ca: undefined,
         },
       })
     );
@@ -105,4 +105,30 @@ describe('parseClientOptions', () => {
       })
     );
   });
+
+  test('test ssl config with verification mode set to full with no ca list', () => {
+    const config = {
+      enabled: true,
+      ssl: {
+        verificationMode: 'full',
+      },
+      clientPool: {
+        size: 5,
+      },
+    } as DataSourcePluginConfigType;
+    mockReadFileSync.mockReset();
+    mockReadFileSync.mockImplementation((path: string) => `content-of-${path}`);
+    const parsedConfig = parseClientOptions(config, TEST_DATA_SOURCE_ENDPOINT);
+    expect(mockReadFileSync).toHaveBeenCalledTimes(0);
+    mockReadFileSync.mockClear();
+    expect(parsedConfig).toEqual(
+      expect.objectContaining({
+        host: TEST_DATA_SOURCE_ENDPOINT,
+        ssl: {
+          rejectUnauthorized: true,
+          ca: undefined,
+        },
+      })
+    );
+  });
 });
diff --git a/src/plugins/data_source/server/legacy/client_config.ts b/src/plugins/data_source/server/legacy/client_config.ts
@@ -55,7 +55,7 @@ export function parseClientOptions(
       config.ssl?.certificateAuthorities
     );
 
-    sslConfig.ca = certificateAuthorities || [];
+    sslConfig.ca = certificateAuthorities;
   }
 
   const configOptions: ConfigOptions = {

diff --git a/src/plugins/data_source/server/util/tls_settings_provider.test.ts b/src/plugins/data_source/server/util/tls_settings_provider.test.ts
@@ -40,7 +40,7 @@ describe('readCertificateAuthorities', () => {
     expect(mockReadFileSync).toHaveBeenCalledTimes(0);
     mockReadFileSync.mockClear();
     expect(certificateAuthorities).toEqual({
-      certificateAuthorities: [],
+      certificateAuthorities: undefined,
     });
   });
 
@@ -52,7 +52,7 @@ describe('readCertificateAuthorities', () => {
     expect(mockReadFileSync).toHaveBeenCalledTimes(0);
     mockReadFileSync.mockClear();
     expect(certificateAuthorities).toEqual({
-      certificateAuthorities: [],
+      certificateAuthorities: undefined,
     });
   });
 });
diff --git a/src/plugins/data_source/server/util/tls_settings_provider.ts b/src/plugins/data_source/server/util/tls_settings_provider.ts
@@ -8,7 +8,7 @@ import { readFileSync } from 'fs';
 export const readCertificateAuthorities = (
   listOfCertificateAuthorities: string | string[] | undefined
 ) => {
-  let certificateAuthorities: string[] | undefined = [];
+  let certificateAuthorities: string[] | undefined;
 
   const addCertificateAuthorities = (ca: string[]) => {
     if (ca && ca.length) {