From b7c34a3ff320524ec440a28f74c2b557043b0e61 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20de=20Metz?= Date: Mon, 17 Apr 2017 18:42:03 +0000 Subject: [PATCH] GitHub webhooks: check signature (#2493) --- CHANGELOG.md | 1 + etc/telegraf.conf | 1 + plugins/inputs/webhooks/github/README.md | 2 ++ .../inputs/webhooks/github/github_webhooks.go | 28 ++++++++++++++-- .../webhooks/github/github_webhooks_test.go | 33 +++++++++++++++++++ plugins/inputs/webhooks/webhooks.go | 1 + 6 files changed, 63 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 989e3f7a9..6715ef3bb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -70,6 +70,7 @@ be deprecated eventually. - [#2636](https://github.com/influxdata/telegraf/pull/2636): Add `message_len_max` option to `kafka_consumer` input - [#1100](https://github.com/influxdata/telegraf/issues/1100): Add collectd parser - [#1820](https://github.com/influxdata/telegraf/issues/1820): easier plugin testing without outputs +- [#2493](https://github.com/influxdata/telegraf/pull/2493): Check signature in the GitHub webhook plugin ### Bugfixes diff --git a/etc/telegraf.conf b/etc/telegraf.conf index 63e41d7bb..07ae5ac8f 100644 --- a/etc/telegraf.conf +++ b/etc/telegraf.conf @@ -2382,6 +2382,7 @@ # # [inputs.webhooks.github] # path = "/github" +# # secret = "" # # [inputs.webhooks.mandrill] # path = "/mandrill" diff --git a/plugins/inputs/webhooks/github/README.md b/plugins/inputs/webhooks/github/README.md index 68594cd78..908d92a63 100644 --- a/plugins/inputs/webhooks/github/README.md +++ b/plugins/inputs/webhooks/github/README.md @@ -2,6 +2,8 @@ You should configure your Organization's Webhooks to point at the `webhooks` service. To do this go to `github.com/{my_organization}` and click `Settings > Webhooks > Add webhook`. In the resulting menu set `Payload URL` to `http://:1619/github`, `Content type` to `application/json` and under the section `Which events would you like to trigger this webhook?` select 'Send me everything'. By default all of the events will write to the `github_webhooks` measurement, this is configurable by setting the `measurement_name` in the config file. +You can also add a secret that will be used by telegraf to verify the authenticity of the requests. + ## Events The titles of the following sections are links to the full payloads and details for each event. The body contains what information from the event is persisted. The format is as follows: diff --git a/plugins/inputs/webhooks/github/github_webhooks.go b/plugins/inputs/webhooks/github/github_webhooks.go index a31c6fdf2..0bb792bf5 100644 --- a/plugins/inputs/webhooks/github/github_webhooks.go +++ b/plugins/inputs/webhooks/github/github_webhooks.go @@ -1,6 +1,9 @@ package github import ( + "crypto/hmac" + "crypto/sha1" + "encoding/hex" "encoding/json" "io/ioutil" "log" @@ -11,8 +14,9 @@ import ( ) type GithubWebhook struct { - Path string - acc telegraf.Accumulator + Path string + Secret string + acc telegraf.Accumulator } func (gh *GithubWebhook) Register(router *mux.Router, acc telegraf.Accumulator) { @@ -23,12 +27,19 @@ func (gh *GithubWebhook) Register(router *mux.Router, acc telegraf.Accumulator) func (gh *GithubWebhook) eventHandler(w http.ResponseWriter, r *http.Request) { defer r.Body.Close() - eventType := r.Header["X-Github-Event"][0] + eventType := r.Header.Get("X-Github-Event") data, err := ioutil.ReadAll(r.Body) if err != nil { w.WriteHeader(http.StatusBadRequest) return } + + if gh.Secret != "" && !checkSignature(gh.Secret, data, r.Header.Get("X-Hub-Signature")) { + log.Printf("E! Fail to check the github webhook signature\n") + w.WriteHeader(http.StatusBadRequest) + return + } + e, err := NewEvent(data, eventType) if err != nil { w.WriteHeader(http.StatusBadRequest) @@ -108,3 +119,14 @@ func NewEvent(data []byte, name string) (Event, error) { } return nil, &newEventError{"Not a recognized event type"} } + +func checkSignature(secret string, data []byte, signature string) bool { + return hmac.Equal([]byte(signature), []byte(generateSignature(secret, data))) +} + +func generateSignature(secret string, data []byte) string { + mac := hmac.New(sha1.New, []byte(secret)) + mac.Write(data) + result := mac.Sum(nil) + return "sha1=" + hex.EncodeToString(result) +} diff --git a/plugins/inputs/webhooks/github/github_webhooks_test.go b/plugins/inputs/webhooks/github/github_webhooks_test.go index 0ec991726..65041e4a0 100644 --- a/plugins/inputs/webhooks/github/github_webhooks_test.go +++ b/plugins/inputs/webhooks/github/github_webhooks_test.go @@ -21,6 +21,19 @@ func GithubWebhookRequest(event string, jsonString string, t *testing.T) { } } +func GithubWebhookRequestWithSignature(event string, jsonString string, t *testing.T, signature string, expectedStatus int) { + var acc testutil.Accumulator + gh := &GithubWebhook{Path: "/github", Secret: "signature", acc: &acc} + req, _ := http.NewRequest("POST", "/github", strings.NewReader(jsonString)) + req.Header.Add("X-Github-Event", event) + req.Header.Add("X-Hub-Signature", signature) + w := httptest.NewRecorder() + gh.eventHandler(w, req) + if w.Code != expectedStatus { + t.Errorf("POST "+event+" returned HTTP status code %v.\nExpected %v", w.Code, expectedStatus) + } +} + func TestCommitCommentEvent(t *testing.T) { GithubWebhookRequest("commit_comment", CommitCommentEventJSON(), t) } @@ -100,3 +113,23 @@ func TestTeamAddEvent(t *testing.T) { func TestWatchEvent(t *testing.T) { GithubWebhookRequest("watch", WatchEventJSON(), t) } + +func TestEventWithSignatureFail(t *testing.T) { + GithubWebhookRequestWithSignature("watch", WatchEventJSON(), t, "signature", http.StatusBadRequest) +} + +func TestEventWithSignatureSuccess(t *testing.T) { + GithubWebhookRequestWithSignature("watch", WatchEventJSON(), t, generateSignature("signature", []byte(WatchEventJSON())), http.StatusOK) +} + +func TestCheckSignatureSuccess(t *testing.T) { + if !checkSignature("my_little_secret", []byte("random-signature-body"), "sha1=3dca279e731c97c38e3019a075dee9ebbd0a99f0") { + t.Errorf("check signature failed") + } +} + +func TestCheckSignatureFailed(t *testing.T) { + if checkSignature("m_little_secret", []byte("random-signature-body"), "sha1=3dca279e731c97c38e3019a075dee9ebbd0a99f0") { + t.Errorf("check signature failed") + } +} diff --git a/plugins/inputs/webhooks/webhooks.go b/plugins/inputs/webhooks/webhooks.go index fcddbebd7..bc8519d7a 100644 --- a/plugins/inputs/webhooks/webhooks.go +++ b/plugins/inputs/webhooks/webhooks.go @@ -47,6 +47,7 @@ func (wb *Webhooks) SampleConfig() string { [inputs.webhooks.github] path = "/github" + # secret = "" [inputs.webhooks.mandrill] path = "/mandrill"