Comments (10)
from ssl_exporter.
Hi @kirkeide - the ssl_exporter operates at TCP level, so HTTP_PROXY
and HTTPS_PROXY
(or http_proxy
and https_proxy
) won't work. If you were to run a TCP proxy then you could probably use ALL_PROXY
.
The switch from HTTP to TCP was a recent change in order to support non-http SSL endpoints (like ldaps://
). I could add a flag, or an argument to /probe
, to allow toggling between tcp and http but I'm kind of divided on whether that is a good idea or not. My initial preference is always to keep things as simple as possible.
That being said, http proxying is quite common and not always avoidable and it might be helpful to support it.
from ssl_exporter.
+1 for supporting it, but I do understand the desire to keep things simple.
from ssl_exporter.
Hi, @kirkeide. Sorry for the delay - life has been pretty hectic recently.
After some thought, I’ve decided to reinstate the http client, which will make proxying possible.
My favoured approach to this problem would be to use the target’s address to signal to the exporter what kind of connection to make to the target. I think this makes sense. If you’re using https://
in the URL, you would naturally expect that the connection is made over https.
What the exporter is doing now, converting that address to the format <target>:443
and making a tcp request, is actually somewhat dishonest and leads to exactly the kind of confusion in this ticket. If you’re using the format https://<domain>
you would probably expect https proxying with HTTPS_PROXY
to work, just like it would with curl.
In cases where a port and no scheme is given (localhost:443
), I think we should continue to operate as a TCP client. If neither is given, I think it’s safe to default to what I imagine is overwhelmingly the most common case (https on port 443).
I’ve made an initial stab at this on this branch. It seems to work for me but could you test it in your environment?
from ssl_exporter.
Very cool. I agree with your approach and will test it as quickly as I can (but this may still take a few days to get done). Thanks!
from ssl_exporter.
I finally had some time to test this, but behind my work firewall I cannot easily pull down a functional go environment and needed dependencies. Can you create an artifact for linux_amd64 that I can test? Thanks!
from ssl_exporter.
@kirkeide Here you go: ssl_exporter-https-proxy.tar.gz
from ssl_exporter.
from ssl_exporter.
After endless delays, I'm happy to say initial testing is working great! I will post any oddities or errors as we encounter them.
Thanks again!
Kirk
from ssl_exporter.
Great! I've released the changes as v0.6.0. Thanks for the issue and your help in testing.
from ssl_exporter.
Related Issues (20)
- OCSP server check? HOT 3
- Container has runAsNonRoot and image has non-numeric user (ssl), cannot verify user is non-root HOT 1
- go-restful lib in 2.4.1 having CRTICAL vulnerability HOT 1
- Consider defaulting to no modules
- Request for `dry-run` feature
- Consider allowing setting up custom headers on the HTTPS module HOT 3
- Crypto Go :we are a research group to help developers build secure applications.
- X-Prometheus-Scrape-Timeout-Seconds and network latency
- ssl_exporter dont export timestamp to prometheus HOT 2
- How can I custom the resolve IP for tls certificate check ? HOT 2
- The Certificate is revoked, but exporter ssl_ocsp_response_status is Good
- What format is the serial number in? HOT 1
- OCSP status HOT 2
- How can I monitor an IPv6 domain name? HOT 1
- Is it possible to use this exporter to monitor PEM files within each pod? HOT 1
- Allow to use remote http\https resources in PEM file module HOT 3
- Monitor expiring bundle certificate HOT 1
- List of all secrets does not work in restricted cluster - SSL Exporter needs to scope secret listing to a single namespace where possible
- Separate regex validation failures from `ssl_probe_success` metric HOT 7
- Add JKS (Java KeyStore) support? HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ssl_exporter.