Skip to content

[Actions] Fix HTTP connector TLS options through proxies#269898

Merged
shahargl merged 1 commit into
elastic:mainfrom
shahargl:fix/http-connector-proxy-tls
May 20, 2026
Merged

[Actions] Fix HTTP connector TLS options through proxies#269898
shahargl merged 1 commit into
elastic:mainfrom
shahargl:fix/http-connector-proxy-tls

Conversation

@shahargl
Copy link
Copy Markdown
Contributor

@shahargl shahargl commented May 19, 2026 •
edited by kibanamachine
Loading

Summary

  • For HTTPS requests through an HTTP proxy, forward target TLS options to the CONNECT-upgraded request created by HttpsProxyAgent.
  • Ensures connector verificationMode: none and per-request SSL overrides like fetcher.skip_ssl_verification are honored when the proxy performs TLS inspection.
  • Adds a regression test covering target SSL overrides through the proxy agent callback.

Test plan

  • node scripts/jest src/platform/packages/shared/kbn-actions-utils/utils/get_custom_agents.test.ts
  • node scripts/check_changes.ts
  • Manually reproduced with local mitmproxy before the fix and verified _execute succeeds after the fix.

References

Closes elastic/security-team#17454
Closes #196602

Made with Cursor

@shahargl @cursoragent
[Actions] Fix HTTP connector TLS options through proxies
aead095 
Forward target TLS settings to the CONNECT-upgraded proxy request so connector verificationMode and per-request SSL overrides are honored for HTTPS targets behind HTTP proxies.

Closes elastic/security-team#17454

Co-authored-by: Cursor <cursoragent@cursor.com>
@shahargl shahargl added release_note:fix backport:all-open Backport to all branches that could still receive a release Team:One Workflow Team label for One Workflow (Workflow automation) labels May 19, 2026
@shahargl shahargl marked this pull request as ready for review May 19, 2026 10:50
@shahargl shahargl requested a review from a team as a code owner May 19, 2026 10:50
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented May 19, 2026

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] FTR Configs #128 / Console App CCS Perform CCS Search in Console it should be able to access remote data
  • [job] [logs] Scout Lane #13 - stateful-classic / default / local-stateful-classic - APM integration not installed but setup completed - Admin user
  • [job] [logs] Scout Lane #12 - stateful-classic / default / local-stateful-classic - Saved Objects Tagging - get all tags - does not return tags from other spaces
  • [job] [logs] Scout Lane #12 - stateful-classic / default / local-stateful-classic - Saved Objects Tagging - get all tags - returns all default-space tags for user with SO tagging read access

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
stackConnectors 1.8MB 1.8MB +16.0B

@pmuellr
Copy link
Copy Markdown
Contributor

pmuellr commented May 19, 2026

This has been broken for a while I guess:

Note that in later versions of https-proxy-agent, the callback() method is renamed to connect(), so hopefully we'll get a type error when we upgrade ...

@heespi
Copy link
Copy Markdown

heespi commented May 20, 2026

@pmuellr.. thanks for the thoughts here. Are you the best person to drive sign off from the Response Ops side?

@darnautov darnautov self-requested a review May 20, 2026 07:37
darnautov
darnautov approved these changes May 20, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@darnautov darnautov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@shahargl shahargl merged commit 4783bfa into elastic:main May 20, 2026
73 checks passed
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented May 20, 2026

Starting backport for target branches: 8.19, 9.3, 9.4

https://github.com/elastic/kibana/actions/runs/26151923358

@kibanamachine kibanamachine mentioned this pull request May 20, 2026
Merged
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented May 20, 2026

💔 Some backports could not be created

Status Branch Result
❌ 8.19 Backport failed because of merge conflicts

You might need to backport the following PRs to 8.19:
- [scripts/check] exclude Scout tests from jest fast path (#270060)
- mise: add mise (#253596)
- fix stray .d.ts files from type_check in git worktrees (#269960)
❌ 9.3 Backport failed because of merge conflicts
✅ 9.4

Note: Successful backport PRs will be merged automatically after passing CI.

Manual backport

To create the backport manually run:

node scripts/backport --pr 269898

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request May 20, 2026
@kibanamachine @shahargl @cursoragent
[9.4] [Actions] Fix HTTP connector TLS options through proxies (#269898…
a52796f 
…) (#270104)

# Backport

This will backport the following commits from `main` to `9.4`:
- [[Actions] Fix HTTP connector TLS options through proxies
(#269898)](#269898)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Shahar
Glazner","email":"shaharglazner@gmail.com"},"sourceCommit":{"committedDate":"2026-05-20T08:50:22Z","message":"[Actions]
Fix HTTP connector TLS options through proxies (#269898)\n\n##
Summary\n- For HTTPS requests through an HTTP proxy, forward target TLS
options\nto the CONNECT-upgraded request created by
`HttpsProxyAgent`.\n- Ensures connector `verificationMode: none` and
per-request SSL\noverrides like `fetcher.skip_ssl_verification` are
honored when the\nproxy performs TLS inspection.\n- Adds a regression
test covering target SSL overrides through the proxy\nagent
callback.\n\n## Test plan\n- `node
scripts/jest\nsrc/platform/packages/shared/kbn-actions-utils/utils/get_custom_agents.test.ts`\n-
`node scripts/check_changes.ts`\n- Manually reproduced with local
mitmproxy before the fix and verified\n`_execute` succeeds after the
fix.\n\n## References\nCloses elastic/security-team#17454\nCloses
https://github.com/elastic/kibana/issues/196602\n\nMade with
[Cursor](https://cursor.com)\n\nCo-authored-by: Cursor
<cursoragent@cursor.com>","sha":"4783bfafd2d0e25d59d5f2a835ef5f84defd1333","branchLabelMapping":{"^v9.5.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","backport:all-open","Team:One
Workflow","v9.5.0"],"title":"[Actions] Fix HTTP connector TLS options
through
proxies","number":269898,"url":"https://github.com/elastic/kibana/pull/269898","mergeCommit":{"message":"[Actions]
Fix HTTP connector TLS options through proxies (#269898)\n\n##
Summary\n- For HTTPS requests through an HTTP proxy, forward target TLS
options\nto the CONNECT-upgraded request created by
`HttpsProxyAgent`.\n- Ensures connector `verificationMode: none` and
per-request SSL\noverrides like `fetcher.skip_ssl_verification` are
honored when the\nproxy performs TLS inspection.\n- Adds a regression
test covering target SSL overrides through the proxy\nagent
callback.\n\n## Test plan\n- `node
scripts/jest\nsrc/platform/packages/shared/kbn-actions-utils/utils/get_custom_agents.test.ts`\n-
`node scripts/check_changes.ts`\n- Manually reproduced with local
mitmproxy before the fix and verified\n`_execute` succeeds after the
fix.\n\n## References\nCloses elastic/security-team#17454\nCloses
https://github.com/elastic/kibana/issues/196602\n\nMade with
[Cursor](https://cursor.com)\n\nCo-authored-by: Cursor
<cursoragent@cursor.com>","sha":"4783bfafd2d0e25d59d5f2a835ef5f84defd1333"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.5.0","branchLabelMappingKey":"^v9.5.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/269898","number":269898,"mergeCommit":{"message":"[Actions]
Fix HTTP connector TLS options through proxies (#269898)\n\n##
Summary\n- For HTTPS requests through an HTTP proxy, forward target TLS
options\nto the CONNECT-upgraded request created by
`HttpsProxyAgent`.\n- Ensures connector `verificationMode: none` and
per-request SSL\noverrides like `fetcher.skip_ssl_verification` are
honored when the\nproxy performs TLS inspection.\n- Adds a regression
test covering target SSL overrides through the proxy\nagent
callback.\n\n## Test plan\n- `node
scripts/jest\nsrc/platform/packages/shared/kbn-actions-utils/utils/get_custom_agents.test.ts`\n-
`node scripts/check_changes.ts`\n- Manually reproduced with local
mitmproxy before the fix and verified\n`_execute` succeeds after the
fix.\n\n## References\nCloses elastic/security-team#17454\nCloses
https://github.com/elastic/kibana/issues/196602\n\nMade with
[Cursor](https://cursor.com)\n\nCo-authored-by: Cursor
<cursoragent@cursor.com>","sha":"4783bfafd2d0e25d59d5f2a835ef5f84defd1333"}}]}]
BACKPORT-->

Co-authored-by: Shahar Glazner <shaharglazner@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
dennis-tismenko pushed a commit to dennis-tismenko/kibana that referenced this pull request May 20, 2026
@shahargl @cursoragent @dennis-tismenko
[Actions] Fix HTTP connector TLS options through proxies (elastic#269898
51e124e 
)

## Summary
- For HTTPS requests through an HTTP proxy, forward target TLS options
to the CONNECT-upgraded request created by `HttpsProxyAgent`.
- Ensures connector `verificationMode: none` and per-request SSL
overrides like `fetcher.skip_ssl_verification` are honored when the
proxy performs TLS inspection.
- Adds a regression test covering target SSL overrides through the proxy
agent callback.

## Test plan
- `node scripts/jest
src/platform/packages/shared/kbn-actions-utils/utils/get_custom_agents.test.ts`
- `node scripts/check_changes.ts`
- Manually reproduced with local mitmproxy before the fix and verified
`_execute` succeeds after the fix.

## References
Closes elastic/security-team#17454
Closes elastic#196602

Made with [Cursor](https://cursor.com)

Co-authored-by: Cursor <cursoragent@cursor.com>
paulinashakirova pushed a commit to paulinashakirova/kibana that referenced this pull request May 22, 2026
@shahargl @cursoragent @paulinashakirova
[Actions] Fix HTTP connector TLS options through proxies (elastic#269898
9aca126 
)

## Summary
- For HTTPS requests through an HTTP proxy, forward target TLS options
to the CONNECT-upgraded request created by `HttpsProxyAgent`.
- Ensures connector `verificationMode: none` and per-request SSL
overrides like `fetcher.skip_ssl_verification` are honored when the
proxy performs TLS inspection.
- Adds a regression test covering target SSL overrides through the proxy
agent callback.

## Test plan
- `node scripts/jest
src/platform/packages/shared/kbn-actions-utils/utils/get_custom_agents.test.ts`
- `node scripts/check_changes.ts`
- Manually reproduced with local mitmproxy before the fix and verified
`_execute` succeeds after the fix.

## References
Closes elastic/security-team#17454
Closes elastic#196602

Made with [Cursor](https://cursor.com)

Co-authored-by: Cursor <cursoragent@cursor.com>
jcger pushed a commit that referenced this pull request May 26, 2026
@shahargl @cursoragent @jcger
[Actions] Fix HTTP connector TLS options through proxies (#269898)
ad63600 
## Summary
- For HTTPS requests through an HTTP proxy, forward target TLS options
to the CONNECT-upgraded request created by `HttpsProxyAgent`.
- Ensures connector `verificationMode: none` and per-request SSL
overrides like `fetcher.skip_ssl_verification` are honored when the
proxy performs TLS inspection.
- Adds a regression test covering target SSL overrides through the proxy
agent callback.

## Test plan
- `node scripts/jest
src/platform/packages/shared/kbn-actions-utils/utils/get_custom_agents.test.ts`
- `node scripts/check_changes.ts`
- Manually reproduced with local mitmproxy before the fix and verified
`_execute` succeeds after the fix.

## References
Closes elastic/security-team#17454
Closes #196602

Made with [Cursor](https://cursor.com)

Co-authored-by: Cursor <cursoragent@cursor.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@darnautov darnautov darnautov approved these changes

Assignees

No one assigned

Labels

backport:all-open Backport to all branches that could still receive a release release_note:fix Team:One Workflow Team label for One Workflow (Workflow automation) v9.4.2 v9.5.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[ResponseOps] https proxy agent options assignment is made in the wrong place

5 participants

@shahargl @kibanamachine @pmuellr @heespi @darnautov