GitHub webhooks: check signature (#2493)

This commit is contained in:
François de Metz 2017-04-17 18:42:03 +00:00 committed by Daniel Nelson
parent b92f6f5fb2
commit b7c34a3ff3
6 changed files with 63 additions and 3 deletions

View File

@ -70,6 +70,7 @@ be deprecated eventually.
- [#2636](https://github.com/influxdata/telegraf/pull/2636): Add `message_len_max` option to `kafka_consumer` input - [#2636](https://github.com/influxdata/telegraf/pull/2636): Add `message_len_max` option to `kafka_consumer` input
- [#1100](https://github.com/influxdata/telegraf/issues/1100): Add collectd parser - [#1100](https://github.com/influxdata/telegraf/issues/1100): Add collectd parser
- [#1820](https://github.com/influxdata/telegraf/issues/1820): easier plugin testing without outputs - [#1820](https://github.com/influxdata/telegraf/issues/1820): easier plugin testing without outputs
- [#2493](https://github.com/influxdata/telegraf/pull/2493): Check signature in the GitHub webhook plugin
### Bugfixes ### Bugfixes

View File

@ -2382,6 +2382,7 @@
# #
# [inputs.webhooks.github] # [inputs.webhooks.github]
# path = "/github" # path = "/github"
# # secret = ""
# #
# [inputs.webhooks.mandrill] # [inputs.webhooks.mandrill]
# path = "/mandrill" # path = "/mandrill"

View File

@ -2,6 +2,8 @@
You should configure your Organization's Webhooks to point at the `webhooks` service. To do this go to `github.com/{my_organization}` and click `Settings > Webhooks > Add webhook`. In the resulting menu set `Payload URL` to `http://<my_ip>:1619/github`, `Content type` to `application/json` and under the section `Which events would you like to trigger this webhook?` select 'Send me <b>everything</b>'. By default all of the events will write to the `github_webhooks` measurement, this is configurable by setting the `measurement_name` in the config file. You should configure your Organization's Webhooks to point at the `webhooks` service. To do this go to `github.com/{my_organization}` and click `Settings > Webhooks > Add webhook`. In the resulting menu set `Payload URL` to `http://<my_ip>:1619/github`, `Content type` to `application/json` and under the section `Which events would you like to trigger this webhook?` select 'Send me <b>everything</b>'. By default all of the events will write to the `github_webhooks` measurement, this is configurable by setting the `measurement_name` in the config file.
You can also add a secret that will be used by telegraf to verify the authenticity of the requests.
## Events ## Events
The titles of the following sections are links to the full payloads and details for each event. The body contains what information from the event is persisted. The format is as follows: The titles of the following sections are links to the full payloads and details for each event. The body contains what information from the event is persisted. The format is as follows:

View File

@ -1,6 +1,9 @@
package github package github
import ( import (
"crypto/hmac"
"crypto/sha1"
"encoding/hex"
"encoding/json" "encoding/json"
"io/ioutil" "io/ioutil"
"log" "log"
@ -11,8 +14,9 @@ import (
) )
type GithubWebhook struct { type GithubWebhook struct {
Path string Path string
acc telegraf.Accumulator Secret string
acc telegraf.Accumulator
} }
func (gh *GithubWebhook) Register(router *mux.Router, acc telegraf.Accumulator) { func (gh *GithubWebhook) Register(router *mux.Router, acc telegraf.Accumulator) {
@ -23,12 +27,19 @@ func (gh *GithubWebhook) Register(router *mux.Router, acc telegraf.Accumulator)
func (gh *GithubWebhook) eventHandler(w http.ResponseWriter, r *http.Request) { func (gh *GithubWebhook) eventHandler(w http.ResponseWriter, r *http.Request) {
defer r.Body.Close() defer r.Body.Close()
eventType := r.Header["X-Github-Event"][0] eventType := r.Header.Get("X-Github-Event")
data, err := ioutil.ReadAll(r.Body) data, err := ioutil.ReadAll(r.Body)
if err != nil { if err != nil {
w.WriteHeader(http.StatusBadRequest) w.WriteHeader(http.StatusBadRequest)
return return
} }
if gh.Secret != "" && !checkSignature(gh.Secret, data, r.Header.Get("X-Hub-Signature")) {
log.Printf("E! Fail to check the github webhook signature\n")
w.WriteHeader(http.StatusBadRequest)
return
}
e, err := NewEvent(data, eventType) e, err := NewEvent(data, eventType)
if err != nil { if err != nil {
w.WriteHeader(http.StatusBadRequest) w.WriteHeader(http.StatusBadRequest)
@ -108,3 +119,14 @@ func NewEvent(data []byte, name string) (Event, error) {
} }
return nil, &newEventError{"Not a recognized event type"} return nil, &newEventError{"Not a recognized event type"}
} }
func checkSignature(secret string, data []byte, signature string) bool {
return hmac.Equal([]byte(signature), []byte(generateSignature(secret, data)))
}
func generateSignature(secret string, data []byte) string {
mac := hmac.New(sha1.New, []byte(secret))
mac.Write(data)
result := mac.Sum(nil)
return "sha1=" + hex.EncodeToString(result)
}

View File

@ -21,6 +21,19 @@ func GithubWebhookRequest(event string, jsonString string, t *testing.T) {
} }
} }
func GithubWebhookRequestWithSignature(event string, jsonString string, t *testing.T, signature string, expectedStatus int) {
var acc testutil.Accumulator
gh := &GithubWebhook{Path: "/github", Secret: "signature", acc: &acc}
req, _ := http.NewRequest("POST", "/github", strings.NewReader(jsonString))
req.Header.Add("X-Github-Event", event)
req.Header.Add("X-Hub-Signature", signature)
w := httptest.NewRecorder()
gh.eventHandler(w, req)
if w.Code != expectedStatus {
t.Errorf("POST "+event+" returned HTTP status code %v.\nExpected %v", w.Code, expectedStatus)
}
}
func TestCommitCommentEvent(t *testing.T) { func TestCommitCommentEvent(t *testing.T) {
GithubWebhookRequest("commit_comment", CommitCommentEventJSON(), t) GithubWebhookRequest("commit_comment", CommitCommentEventJSON(), t)
} }
@ -100,3 +113,23 @@ func TestTeamAddEvent(t *testing.T) {
func TestWatchEvent(t *testing.T) { func TestWatchEvent(t *testing.T) {
GithubWebhookRequest("watch", WatchEventJSON(), t) GithubWebhookRequest("watch", WatchEventJSON(), t)
} }
func TestEventWithSignatureFail(t *testing.T) {
GithubWebhookRequestWithSignature("watch", WatchEventJSON(), t, "signature", http.StatusBadRequest)
}
func TestEventWithSignatureSuccess(t *testing.T) {
GithubWebhookRequestWithSignature("watch", WatchEventJSON(), t, generateSignature("signature", []byte(WatchEventJSON())), http.StatusOK)
}
func TestCheckSignatureSuccess(t *testing.T) {
if !checkSignature("my_little_secret", []byte("random-signature-body"), "sha1=3dca279e731c97c38e3019a075dee9ebbd0a99f0") {
t.Errorf("check signature failed")
}
}
func TestCheckSignatureFailed(t *testing.T) {
if checkSignature("m_little_secret", []byte("random-signature-body"), "sha1=3dca279e731c97c38e3019a075dee9ebbd0a99f0") {
t.Errorf("check signature failed")
}
}

View File

@ -47,6 +47,7 @@ func (wb *Webhooks) SampleConfig() string {
[inputs.webhooks.github] [inputs.webhooks.github]
path = "/github" path = "/github"
# secret = ""
[inputs.webhooks.mandrill] [inputs.webhooks.mandrill]
path = "/mandrill" path = "/mandrill"