csp-report: ensure Sentry requests are made with SNI

test/nginx/mock-http-server/bad-cert.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDFzCCAf+gAwIBAgIUQX7dvQ1eABbaHSg6SNI8hLa3yQkwDQYJKoZIhvcNAQEL
+BQAwGzEZMBcGA1UEAwwQYmFkLmV4YW1wbGUudGVzdDAeFw0yNTEwMTYxMjMxNDha
+Fw0yNjEwMTYxMjMxNDhaMBsxGTAXBgNVBAMMEGJhZC5leGFtcGxlLnRlc3QwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDS0q55gE75/ntd0a5APTdhLbSt
+Ues0UcJiFeAvBFsZyHonmDGpt8jfsLQKd4Z0vE23Dg2cDt0DhhC13xukUhv2faiV
+G9S//UfQKcnFKfh9ZyJruazz2TFGWYEDUx1SqjxsXZaO1788AJb9JtwdjwiDhgmg
+gKFjuPR2rt6IJTjnTuGDv5ejRtjM0aCP2OZJGb6jpN8VI+N42KdTCr3smndbzUYd
+pA26Ter4MBpuWldYFFzNjzAliZ373cpF616ODfmKnGfeoR538jmu8qwszG1EDxfY
+NVfMZmRL5m/BqCMq7emwZoito59wykfgExZsRn4ZdrgsJObpWjCILiF+7R/dAgMB
+AAGjUzBRMB0GA1UdDgQWBBTSQ6/r2BkJfAP1R/zSF/eR1XsGWDAfBgNVHSMEGDAW
+gBTSQ6/r2BkJfAP1R/zSF/eR1XsGWDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3
+DQEBCwUAA4IBAQBwJWtAErfnJRpgKASTiUAksNe1x1STExsygBM92YZtvwhPZBtL
+PZ3FeLGaSyL0K+H1m+P0DF0Rbqigmdzr95NCBB7ZJNfRtzJoDf/2BkFNgr6uOtrc
+1JSw793Ql0o7RcjHWoN9PwotrKwOp6E8ywagvncx5+QOnQNwHSa0KCuoCZ4KIC6D
+Z33AKWX2/CnB+uhpL8JxdNYqcyomAnKUw3Xgqhb3HVfTO24axVH/lo3wGQkX0jS6
+S+qCs1ul0ALc/d2W3VQPTmcaGSHpTY/ab02Ww+ohQIV+k/JM4xRGEACHZEHsgrLD
+EDeD182brp031W6lxZ9nZuw/891PdQ9Hsrnc
+-----END CERTIFICATE-----

test/nginx/mock-http-server/bad-key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDS0q55gE75/ntd
+0a5APTdhLbStUes0UcJiFeAvBFsZyHonmDGpt8jfsLQKd4Z0vE23Dg2cDt0DhhC1
+3xukUhv2faiVG9S//UfQKcnFKfh9ZyJruazz2TFGWYEDUx1SqjxsXZaO1788AJb9
+JtwdjwiDhgmggKFjuPR2rt6IJTjnTuGDv5ejRtjM0aCP2OZJGb6jpN8VI+N42KdT
+Cr3smndbzUYdpA26Ter4MBpuWldYFFzNjzAliZ373cpF616ODfmKnGfeoR538jmu
+8qwszG1EDxfYNVfMZmRL5m/BqCMq7emwZoito59wykfgExZsRn4ZdrgsJObpWjCI
+LiF+7R/dAgMBAAECggEACV58i4DEwb5p/B7j6A3wZpyx4Vv5IG+bvGEtf9lpNQmg
+SB8u4dR9lFdVgPuT2Z8+supod21/q/bqyjJal6BghsFJ2yqL92ZJqToaMe1uEiCh
+unjbc1DNLEuw/JVWgcR3//beyIVVBdUe4Kw37wZawgGUbvIYegaPsrCNyi4hS8I0
+hEqtLq6pZvjWp5EahsUNdJ/4xCbhZDmmucDgW7/fiBOHCZja5oL/15xsMp2Y/Y0A
+ZSnQf4Y/vBUNe6XyerwFeUEkO9f+/V50k8YaSIh11u5SUWpAqOck3vEueRoJ+ATb
+ghMwb789YNZvrdMlxN4Oxt9OAYm7fRyk8IF0daB7gQKBgQDplVwkvaZnvPYR89va
+p4q7tplI+XTpE0NE3NVLg5njcrR8JkJg0xeHJB0oojZrtqlWazsZhBUS63Fy6eOs
+5IFFj0BOg9iYe8LbbHGqfFHSKnxZwT85FG1moJogpco1dcpwnTORSrVjJtfgNlz6
+gW2bq7kq+47jWZ2xpDcADe0snQKBgQDnDiVwlILx3PzyYXhmklhzmCSlhfAmYUXX
+l8bGVzoJpys8v7VPQrjXiPyXb5pO8OvuPeuyT3g2TWYBxiv79pddP0tEjqqQrSuj
+Jp/w+h19fPh2IA1zN8rG5tf8G/QpCG+tYTC5VjbIkM7koSgaa/ut1Bbdld3HiqBo
+dqy6mEA8QQKBgAkd+VC9zkbySzB8MjKgo3ucLvN4OSX3yIJhlDm0U0dbbMwDukeJ
+Nbvinvi9DB68LHPhD5d5XlE0u2Le2jIfYSRT6RCneMbK3douq2kaHR905RGjx1H1
+CCgfUKTBk9juVg57NE4Rem76TybDOHHWp26SD1IsK3GYR91tKXBpGr7JAoGAflFQ
+jKTUlc/gBc7d2Q3HB6M03b1E1ma1nTEf/c0wMJjQ3YxdXjC3BzagCVZ9QQ0bnwsB
+MWGa8e0MiInEACMHC3aP+rIYc7IIulBifobu2m0ZFNNfJw9ob6dCi1To/gnbrCkH
+TzvgBXSNd5bXauKAHL9npMrLDc0u9w1yTyzvaUECgYAzv8eME44+/Z66kYnzhPAu
+ZIU6TA0iNQGgnSUflh6RoZG+fol5TGrhwqF3eBWLfBuqCjKWzR+dk0UGsPzgWAbj
+PWEz6MJtmne6jW48PybGikhzqmmFKZueJNXJ1/bxa9gXE53JT5q0npjIR/aOLDS6
+IL/EeFzttWUHyslXOvaFoA==
+-----END PRIVATE KEY-----

test/nginx/mock-http-server/good-cert.pem

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDLTCCAhWgAwIBAgIUXDxRk8BeksLqR/9TPhl2VxdaSBQwDQYJKoZIhvcNAQEL
+BQAwJjEkMCIGA1UEAwwbby1mYWtlLWRzbi5pbmdlc3Quc2VudHJ5LmlvMB4XDTI1
+MTAxNjExNDg0N1oXDTI2MTAxNjExNDg0N1owJjEkMCIGA1UEAwwbby1mYWtlLWRz
+bi5pbmdlc3Quc2VudHJ5LmlvMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+AQEA1rL27rORMllMDc4/1ngoOjw/uZRvPZCGAXdKZKE+QT7q5+ZvfGS28KLdugxb
+0H2rbMBsSjxw5u5CCXTE3gGZ+T9d+9mL6OCisP+UIo0OtnZsqeQKmt93Ucf8Bnl9
+EfmYvPM/SaNt7tEVG0w4qYR0e4Bdk5AS+A4gj0dEZNrO052zlPkCLgPlCtCHjLqD
+57Tu/VOuMRbbGnoDKrzPZKKeRgngghNTq1JMYtSKt3Ji3m+w/V8yqSyuaPTJO2kW
+3nCHlEI+kBLDsQ5NRZxbvLltptaw2KEXA94WUSdlMDpq4tUuMKOlWp9E9GsMDQyL
+B5YKdDj49fgPbSZ+8OVH6Gcn8QIDAQABo1MwUTAdBgNVHQ4EFgQUUzNTJKVdOiwE
+b4jyPZvzjfq5PgwwHwYDVR0jBBgwFoAUUzNTJKVdOiwEb4jyPZvzjfq5PgwwDwYD
+VR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAKdUlX3/kIGV7JEaywOTA
+VxY+oEFgXWklEDdtoBE9X2SqrfypTuG3vk7tkmUIgY5MNEx3RKKhQanwtimwz+mJ
+dYqQAQ2OLaDV++m7tf6BK0ZVKQIN47pAzuCC9QO0Ep7fWpyWtxCb+RmjCgElfVmu
+7A9Gj7d9fzJlDbSHDXy15gWjDga3KjEIJ7erhxB/nKLzOykMEsBzDZC3gx6Y8RIx
+8yFUkXxftWECqj+cuSovbhEhy8O7LyHtnVOXd5ljhirBBM/VqS8CZPEjKXtsQbvI
+RvdRZgVAQKzvbsosqPTZV94l0h2opCS5aR/1V6AXKaKhtuDJ4W7hncjQpuRSm9E0
+cQ==
+-----END CERTIFICATE-----

test/nginx/mock-http-server/good-key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDWsvbus5EyWUwN
+zj/WeCg6PD+5lG89kIYBd0pkoT5BPurn5m98ZLbwot26DFvQfatswGxKPHDm7kIJ
+dMTeAZn5P1372Yvo4KKw/5QijQ62dmyp5Aqa33dRx/wGeX0R+Zi88z9Jo23u0RUb
+TDiphHR7gF2TkBL4DiCPR0Rk2s7TnbOU+QIuA+UK0IeMuoPntO79U64xFtsaegMq
+vM9kop5GCeCCE1OrUkxi1Iq3cmLeb7D9XzKpLK5o9Mk7aRbecIeUQj6QEsOxDk1F
+nFu8uW2m1rDYoRcD3hZRJ2UwOmri1S4wo6Van0T0awwNDIsHlgp0OPj1+A9tJn7w
+5UfoZyfxAgMBAAECggEABbOTNefQGmiPadrxLEx80f4VWaPo19dRjbKpp7Y1+WTW
+t2GR0pl4l7eVgIoxOn5J2f2aqpaED4fiek6O50/e00UE5YojimPDwkRJPmklS8Bl
+lpXjF7WJPUNcrJ3Xjc2Fajgh9T5JLjNAdpz9sLe/IaP5KDDmZg62++MSPITogutT
+1QvzHFq+XcaWviAu0w8Dx9zy3XaWwJXNAEIl0+sit/pwOeYpZpHMVpjDSM5Xz0kr
+tMM1JNL02x3v0tp0WWye5CnSHSEGc0WINGNT+ya23bb+pNejdUYXfjUWVUhIRYcN
+MG99zM5fxtL2WAtdL4vzd3t11ggSHHOfyqVuAN3R+QKBgQD7WMDfjTSvS6hi347F
+1H8GM70MXWtKtSXyBr2ZNrXh705M2WtlYgF4Cl5IaBAiUbYYyKjcFO+hmeZSfSws
+6NluUv1/OBPdU1jaO86Ohc1DzM4bAScxPG88HNZ/nES4+KPVZ3GWPxTa5LQXHCzd
+rIUfmzoBT9/dwdbDm6irWt9s6QKBgQDarIV742jazXMyFe6A1GgJf0pLDcw5Yc8G
+hc+5YM54G1tdenKs2bJd6bi1SpDrWDJXlgJ97BgtI/XtF+NXFa3/v1WV9lwJM8Vg
+ONBzQDKQbIYKh7pH53SflHLxeZzg69GE/WM6QScmYxUN6MV14Juk5UCZLaylk5g2
+tKZ6ttpdyQKBgAgM0KiYSi6vGqaICHeXlbXqJEzoFQ6gfKWix6HHmc2xr21QrVri
+568jjd99zb57pXxnuNjLpt0jI7hSn/6UOpqI9+uCLUiyaa8bqULxUCCyx4sf31R5
+Xgqr1cbih2TxObYVCRNJ0+4q0wXGdj1nUCAyBYqTN1VP5wP+0UkjsPI5AoGBAJ2O
+eI8PB1m/diS8UKBaaquNH4Z8Zo1hv7y/ZS/4ZEt9ypLLyxxnrnCkGgXluA0Z+wvI
+dfssxS6hHmy6LX9ti3Ud8xid7SpkNu5hgS/JLaWJy/qCWOG+DvV8DGWYbkRRJSFh
+QMGUeBTchysCcGPCdeKVm7nCgwa6FY41E06PuT6hAoGBAJnq0Lj0fhrfYjbaziC1
+NfYtffe6tMRD3E79KUk4/73Ria4m24VI3iIZKDgLL7CWZYJz3zyefL6NZ6zr56yl
+HoXVcfyg10IorEbzbc091NQx8409YxtONSzs+ddi2hh6Gjq+wRl0p3LpXm2AT6fc
+a7hoG1+xFK0JQw17i/vN4Qjr
+-----END PRIVATE KEY-----

test/nginx/mock-http-server/index.js

@@ -1,6 +1,7 @@
 const express = require('express');
 
 const port = process.env.PORT || 80;
+const mode = process.env.MODE || 'http';
 const log = (...args) => console.log('[mock-http-server]', ...args);
 
 const requests = [];
@@ -9,6 +10,33 @@
 
 app.use((req, res, next) => {
   console.log(new Date(), req.method, req.originalUrl);
+  if(req.socket.encrypted) {
+    // Get the local certificate (the server's certificate)
+    const certificate = req.socket.getCertificate();
+
+    if(certificate) {
+      console.log('--- Secure Context Details ---');
+      console.log('Subject:', certificate.subject.CN); // Common Name
+      console.log('Issuer:', certificate.issuer.CN);
+      console.log('Valid From:', certificate.valid_from);
+      console.log('Valid To:', certificate.valid_to);
+      console.log('Serial Number:', certificate.serialNumber);
+      // ... and more details
+      console.log('------------------------------');
+
+      if(certificate.subject.CN !== 'o-fake-dsn.ingest.sentry.io') {
+        // try to simulate an SNI / connection error
+        console.log('Destroying connection...');
+        return req.socket.destroy();
+      }
+    } else {
+      console.log('Secure connection, but no local certificate found (unexpected for server-side TLS)');
+    }
+  } else {
+    // This part runs if you are running an HTTP server or if a proxy 
+    // is terminating SSL before Express (see note below).
+    console.log('Insecure HTTP request.');
+  }
   next();
 });
 
@@ -47,6 +75,34 @@
   res.send('OK');
 }));
 
-app.listen(port, () => {
-  log(`Listening on port: ${port}`);
+const server = (() => {
+  if(mode === 'http') {
+    return app;
+  } else if(mode === 'https') {
+    const { readFileSync } = require('node:fs');
+    const { createServer } = require('node:https');
+    const { createSecureContext } = require('node:tls');
+
+    const pem = name => readFileSync(`${name}.pem`, 'utf8');
+    const creds = name => ({ key:pem(`${name}-key`), cert:pem(`${name}-cert`) });
+
+    const goodCreds = creds('good');
+
+    const opts = {
+      ...creds('bad'),
+      SNICallback: (servername, cb) => {
+        console.log('SNICallback:', servername);
+        cb(null, createSecureContext(goodCreds));
+      },
+    };
+
+    return createServer(opts, app);
+  } else {
+    console.error(`Unrecognised mode: '${mode}'; should be one of http, https.  Cannot start server.`);
+    process.exit(1);
+  }
+})();
+
+server.listen(port, () => {
+  log(`Listening with ${mode} on port: ${port}`, server === app);
 });

test/nginx/nginx.test.docker-compose.yml

@@ -13,6 +13,14 @@ services:
       - "8383:8383"
     environment:
       - PORT=8383
+  sentry-mock:
+    build:
+      dockerfile: mock-http-service.dockerfile
+    ports:
+      - "443:443"
+    environment:
+      - MODE=https
+      - PORT=443
   nginx:
     build:
       context: ../..
@@ -22,10 +30,13 @@ services:
     depends_on:
       - service
       - enketo
+      - sentry-mock
+    extra_hosts:
+      - o-fake-dsn.ingest.sentry.io:host-gateway
     environment:
       - DOMAIN=odk-nginx.example.test
       - SENTRY_KEY=example-sentry-key
-      - SENTRY_ORG_SUBDOMAIN=example-sentry-org-subdomain
+      - SENTRY_ORG_SUBDOMAIN=o-fake-dsn
       - SENTRY_PROJECT=example-sentry-project
       - SSL_TYPE=selfsign
       - OIDC_ENABLED=false

test/nginx/test-nginx.js

@@ -572,6 +572,44 @@ describe('nginx config', () => {
       });
     });
   });
+
+  describe('/csp-report', () => {
+    // This initial test is the control - Sentry will reject requests
+    // made directly to their IP address.
+    it('upstream should reject requests by IP address', async () => {
+      // given
+      let caught;
+
+      // when
+      try {
+        await fetch('https://127.0.0.1');
+      } catch(err) {
+        caught = err;
+      }
+
+      // then
+      assert.isOk(caught);
+      assert.instanceOf(caught, TypeError);
+      assert.equal(caught.message, 'fetch failed');
+      // and
+      assert.isOk(caught.cause);
+      assert.equal(caught.cause.name, 'SocketError');
+      assert.equal(caught.cause.message, 'other side closed');
+    });
+
+    it('should forward requests to Sentry, verbatim', async () => {
+      // when
+      const res = await fetchHttps('/csp-report', {
+        method: 'POST',
+        headers: { 'Content-Type':'application/json' },
+        body: JSON.stringify({ hiya:'sentry' }),
+      });
+
+      // then
+      assert.equal(res.status, 200);
+      assert.equal(await res.text(), 'OK');
+    });
+  });
 });
 
 function fetchHttp(path, options) {