|
| 1 | +package connectapi |
| 2 | + |
| 3 | +import ( |
| 4 | + "context" |
| 5 | + "crypto/tls" |
| 6 | + "crypto/x509" |
| 7 | + "encoding/json" |
| 8 | + "fmt" |
| 9 | + "io" |
| 10 | + "net" |
| 11 | + "net/http" |
| 12 | + "net/url" |
| 13 | + "os" |
| 14 | + "strings" |
| 15 | + "time" |
| 16 | +) |
| 17 | + |
| 18 | +// ConnectAuthOpts holds authentication options for the Kafka Connect REST API. |
| 19 | +type ConnectAuthOpts struct { |
| 20 | + BasicAuth string // "user:password" or empty |
| 21 | + BearerToken string // bearer token or empty |
| 22 | + CACertPath string // path to CA cert PEM file or empty |
| 23 | +} |
| 24 | + |
| 25 | +// ConnectClient is an HTTP client for the Kafka Connect REST API. |
| 26 | +type ConnectClient struct { |
| 27 | + baseURL string |
| 28 | + httpClient *http.Client |
| 29 | + auth ConnectAuthOpts |
| 30 | +} |
| 31 | + |
| 32 | +// NewConnectClient creates a new ConnectClient. |
| 33 | +func NewConnectClient(baseURL string, auth ConnectAuthOpts) (*ConnectClient, error) { |
| 34 | + // Validate URL scheme |
| 35 | + u, err := url.Parse(baseURL) |
| 36 | + if err != nil { |
| 37 | + return nil, fmt.Errorf("invalid Connect URL: %w", err) |
| 38 | + } |
| 39 | + if u.Scheme != "http" && u.Scheme != "https" { |
| 40 | + return nil, fmt.Errorf("Connect URL must use http or https scheme, got: %s", u.Scheme) |
| 41 | + } |
| 42 | + |
| 43 | + transport := http.DefaultTransport.(*http.Transport).Clone() |
| 44 | + |
| 45 | + if auth.CACertPath != "" { |
| 46 | + caPEM, err := os.ReadFile(auth.CACertPath) |
| 47 | + if err != nil { |
| 48 | + return nil, fmt.Errorf("failed to read Connect CA cert %s: %w", auth.CACertPath, err) |
| 49 | + } |
| 50 | + pool := x509.NewCertPool() |
| 51 | + if !pool.AppendCertsFromPEM(caPEM) { |
| 52 | + return nil, fmt.Errorf("failed to parse Connect CA cert from %s", auth.CACertPath) |
| 53 | + } |
| 54 | + transport.TLSClientConfig = &tls.Config{ |
| 55 | + RootCAs: pool, |
| 56 | + } |
| 57 | + } |
| 58 | + |
| 59 | + return &ConnectClient{ |
| 60 | + baseURL: strings.TrimRight(baseURL, "/"), |
| 61 | + httpClient: &http.Client{ |
| 62 | + Timeout: 15 * time.Second, |
| 63 | + Transport: transport, |
| 64 | + // Prevent redirect-based SSRF: do not follow redirects automatically. |
| 65 | + CheckRedirect: func(req *http.Request, via []*http.Request) error { |
| 66 | + return fmt.Errorf("Connect API redirect blocked (to %s): redirects are not followed for security", req.URL.Host) |
| 67 | + }, |
| 68 | + }, |
| 69 | + auth: auth, |
| 70 | + }, nil |
| 71 | +} |
| 72 | + |
| 73 | +// isLinkLocalIP checks if an IP is in the link-local range (169.254.0.0/16) |
| 74 | +// which includes the cloud metadata endpoint 169.254.169.254. |
| 75 | +func isLinkLocalIP(host string) bool { |
| 76 | + ips, err := net.LookupHost(host) |
| 77 | + if err != nil { |
| 78 | + return false |
| 79 | + } |
| 80 | + for _, ipStr := range ips { |
| 81 | + ip := net.ParseIP(ipStr) |
| 82 | + if ip == nil { |
| 83 | + continue |
| 84 | + } |
| 85 | + // Block link-local (169.254.0.0/16) — includes cloud metadata |
| 86 | + if ip4 := ip.To4(); ip4 != nil && ip4[0] == 169 && ip4[1] == 254 { |
| 87 | + return true |
| 88 | + } |
| 89 | + } |
| 90 | + return false |
| 91 | +} |
| 92 | + |
| 93 | +// GetConnectorConfig fetches the configuration for a named connector. |
| 94 | +func (c *ConnectClient) GetConnectorConfig(ctx context.Context, name string) (map[string]string, error) { |
| 95 | + // SSRF protection: block link-local addresses (cloud metadata) |
| 96 | + u, _ := url.Parse(c.baseURL) |
| 97 | + if u != nil && isLinkLocalIP(u.Hostname()) { |
| 98 | + return nil, fmt.Errorf("Connect URL resolves to link-local address (blocked for security)") |
| 99 | + } |
| 100 | + |
| 101 | + reqURL := fmt.Sprintf("%s/connectors/%s/config", c.baseURL, url.PathEscape(name)) |
| 102 | + req, err := http.NewRequestWithContext(ctx, http.MethodGet, reqURL, nil) |
| 103 | + if err != nil { |
| 104 | + return nil, fmt.Errorf("failed to create request: %w", err) |
| 105 | + } |
| 106 | + |
| 107 | + req.Header.Set("Accept", "application/json") |
| 108 | + c.applyAuth(req) |
| 109 | + |
| 110 | + resp, err := c.httpClient.Do(req) |
| 111 | + if err != nil { |
| 112 | + return nil, fmt.Errorf("Connect API unreachable: %w", err) |
| 113 | + } |
| 114 | + defer resp.Body.Close() |
| 115 | + |
| 116 | + body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20)) // limit to 1MB |
| 117 | + |
| 118 | + switch { |
| 119 | + case resp.StatusCode == http.StatusOK: |
| 120 | + var cfg map[string]string |
| 121 | + if err := json.Unmarshal(body, &cfg); err != nil { |
| 122 | + return nil, fmt.Errorf("failed to decode connector config: %w", err) |
| 123 | + } |
| 124 | + return cfg, nil |
| 125 | + |
| 126 | + case resp.StatusCode == http.StatusUnauthorized || resp.StatusCode == http.StatusForbidden: |
| 127 | + return nil, fmt.Errorf("Connect API auth failed (HTTP %d): check --connect-basic-auth or --connect-bearer-token", resp.StatusCode) |
| 128 | + |
| 129 | + case resp.StatusCode == http.StatusNotFound: |
| 130 | + return nil, fmt.Errorf("connector '%s' not found. Use GET /connectors to list available connectors", name) |
| 131 | + |
| 132 | + default: |
| 133 | + return nil, fmt.Errorf("Connect API returned HTTP %d: %s", resp.StatusCode, string(body)) |
| 134 | + } |
| 135 | +} |
| 136 | + |
| 137 | +// ListConnectors returns the names of all connectors. |
| 138 | +func (c *ConnectClient) ListConnectors(ctx context.Context) ([]string, error) { |
| 139 | + reqURL := fmt.Sprintf("%s/connectors", c.baseURL) |
| 140 | + req, err := http.NewRequestWithContext(ctx, http.MethodGet, reqURL, nil) |
| 141 | + if err != nil { |
| 142 | + return nil, err |
| 143 | + } |
| 144 | + |
| 145 | + req.Header.Set("Accept", "application/json") |
| 146 | + c.applyAuth(req) |
| 147 | + |
| 148 | + resp, err := c.httpClient.Do(req) |
| 149 | + if err != nil { |
| 150 | + return nil, fmt.Errorf("Connect API unreachable: %w", err) |
| 151 | + } |
| 152 | + defer resp.Body.Close() |
| 153 | + |
| 154 | + if resp.StatusCode != http.StatusOK { |
| 155 | + return nil, fmt.Errorf("Connect API returned HTTP %d", resp.StatusCode) |
| 156 | + } |
| 157 | + |
| 158 | + var names []string |
| 159 | + if err := json.NewDecoder(resp.Body).Decode(&names); err != nil { |
| 160 | + return nil, fmt.Errorf("failed to decode connector list: %w", err) |
| 161 | + } |
| 162 | + return names, nil |
| 163 | +} |
| 164 | + |
| 165 | +func (c *ConnectClient) applyAuth(req *http.Request) { |
| 166 | + if c.auth.BasicAuth != "" { |
| 167 | + parts := strings.SplitN(c.auth.BasicAuth, ":", 2) |
| 168 | + if len(parts) == 2 { |
| 169 | + req.SetBasicAuth(parts[0], parts[1]) |
| 170 | + } |
| 171 | + } |
| 172 | + if c.auth.BearerToken != "" { |
| 173 | + req.Header.Set("Authorization", "Bearer "+c.auth.BearerToken) |
| 174 | + } |
| 175 | +} |
0 commit comments