Skip to content

Commit 980a974

Browse files
bjosvbjosv
authored
Add configuration to set minimum TLS version accepted by the metrics server port. (oliver006#666)
1 parent b5aa05e commit 980a974

File tree

5 files changed

+30
-9
lines changed

5 files changed

+30
-9
lines changed

‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,7 @@ Prometheus uses file watches and all changes to the json file are applied immedi
169169
| tls-server-key-file | REDIS_EXPORTER_TLS_SERVER_KEY_FILE | Name of the server key file (including full path) if the web interface and telemetry should use TLS |
170170
| tls-server-cert-file | REDIS_EXPORTER_TLS_SERVER_CERT_FILE | Name of the server certificate file (including full path) if the web interface and telemetry should use TLS |
171171
| tls-server-ca-cert-file | REDIS_EXPORTER_TLS_SERVER_CA_CERT_FILE | Name of the CA certificate file (including full path) if the web interface and telemetry should require TLS client authentication |
172+
| tls-server-min-version | REDIS_EXPORTER_TLS_SERVER_MIN_VERSION | Minimum TLS version that is acceptable by the web interface and telemetry when using TLS, defaults to `TLS1.2` (supports `TLS1.0`,`TLS1.1`,`TLS1.2`,`TLS1.3`). |
172173
| tls-ca-cert-file | REDIS_EXPORTER_TLS_CA_CERT_FILE | Name of the CA certificate file (including full path) if the server requires TLS client authentication |
173174
| set-client-name | REDIS_EXPORTER_SET_CLIENT_NAME | Whether to set client name to redis_exporter, defaults to true. |
174175
| check-key-groups | REDIS_EXPORTER_CHECK_KEY_GROUPS | Comma separated list of [LUA regexes](https://www.lua.org/pil/20.1.html) for classifying keys into groups. The regexes are applied in specified order to individual keys, and the group name is generated by concatenating all capture groups of the first regex that matches a key. A key will be tracked under the `unclassified` group if none of the specified regexes matches it. |

‎contrib/docker-compose-for-tests.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ services:
1515

1616
redis7:
1717
image: redis:7.0
18-
command: "redis-server --protected-mode no --dbfilename dump7.rdb"
18+
command: "redis-server --port 6384 --protected-mode no --dbfilename dump7.rdb"
1919
ports:
2020
- "16384:6384"
2121

‎exporter/tls.go

+17-2
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package exporter
33
import (
44
"crypto/tls"
55
"crypto/x509"
6+
"fmt"
67
"io/ioutil"
78

89
log "github.com/sirupsen/logrus"
@@ -33,15 +34,29 @@ func (e *Exporter) CreateClientTLSConfig() (*tls.Config, error) {
3334
return &tlsConfig, nil
3435
}
3536

36-
// CreateServerTLSConfig verifies configured files and return a prepared tls.Config
37-
func (e *Exporter) CreateServerTLSConfig(certFile, keyFile, caCertFile string) (*tls.Config, error) {
37+
var tlsVersions = map[string]uint16{
38+
"TLS1.3": tls.VersionTLS13,
39+
"TLS1.2": tls.VersionTLS12,
40+
"TLS1.1": tls.VersionTLS11,
41+
"TLS1.0": tls.VersionTLS10,
42+
}
43+
44+
// CreateServerTLSConfig verifies configuration and return a prepared tls.Config
45+
func (e *Exporter) CreateServerTLSConfig(certFile, keyFile, caCertFile, minVersionString string) (*tls.Config, error) {
3846
// Verify that the initial key pair is accepted
3947
_, err := LoadKeyPair(certFile, keyFile)
4048
if err != nil {
4149
return nil, err
4250
}
4351

52+
// Get minimum acceptable TLS version from the config string
53+
minVersion, ok := tlsVersions[minVersionString]
54+
if !ok {
55+
return nil, fmt.Errorf("configured minimum TLS version unknown: '%s'", minVersionString)
56+
}
57+
4458
tlsConfig := tls.Config{
59+
MinVersion: minVersion,
4560
GetCertificate: GetServerCertificateFunc(certFile, keyFile),
4661
}
4762

‎exporter/tls_test.go

+9-5
Original file line numberDiff line numberDiff line change
@@ -43,25 +43,29 @@ func TestCreateServerTLSConfig(t *testing.T) {
4343
e := getTestExporter()
4444

4545
// positive tests
46-
_, err := e.CreateServerTLSConfig("../contrib/tls/redis.crt", "../contrib/tls/redis.key", "")
46+
_, err := e.CreateServerTLSConfig("../contrib/tls/redis.crt", "../contrib/tls/redis.key", "", "TLS1.1")
4747
if err != nil {
4848
t.Errorf("CreateServerTLSConfig() err: %s", err)
4949
}
50-
_, err = e.CreateServerTLSConfig("../contrib/tls/redis.crt", "../contrib/tls/redis.key", "../contrib/tls/ca.crt")
50+
_, err = e.CreateServerTLSConfig("../contrib/tls/redis.crt", "../contrib/tls/redis.key", "../contrib/tls/ca.crt", "TLS1.0")
5151
if err != nil {
5252
t.Errorf("CreateServerTLSConfig() err: %s", err)
5353
}
5454

5555
// negative tests
56-
_, err = e.CreateServerTLSConfig("/nonexisting/file", "/nonexisting/file", "")
56+
_, err = e.CreateServerTLSConfig("/nonexisting/file", "/nonexisting/file", "", "TLS1.1")
5757
if err == nil {
5858
t.Errorf("Expected CreateServerTLSConfig() to fail")
5959
}
60-
_, err = e.CreateServerTLSConfig("/nonexisting/file", "/nonexisting/file", "/nonexisting/file")
60+
_, err = e.CreateServerTLSConfig("/nonexisting/file", "/nonexisting/file", "/nonexisting/file", "TLS1.2")
6161
if err == nil {
6262
t.Errorf("Expected CreateServerTLSConfig() to fail")
6363
}
64-
_, err = e.CreateServerTLSConfig("../contrib/tls/redis.crt", "../contrib/tls/redis.key", "/nonexisting/file")
64+
_, err = e.CreateServerTLSConfig("../contrib/tls/redis.crt", "../contrib/tls/redis.key", "/nonexisting/file", "TLS1.3")
65+
if err == nil {
66+
t.Errorf("Expected CreateServerTLSConfig() to fail")
67+
}
68+
_, err = e.CreateServerTLSConfig("../contrib/tls/redis.crt", "../contrib/tls/redis.key", "../contrib/tls/ca.crt", "TLSX")
6569
if err == nil {
6670
t.Errorf("Expected CreateServerTLSConfig() to fail")
6771
}

‎main.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,7 @@ func main() {
7777
tlsServerKeyFile = flag.String("tls-server-key-file", getEnv("REDIS_EXPORTER_TLS_SERVER_KEY_FILE", ""), "Name of the server key file (including full path) if the web interface and telemetry should use TLS")
7878
tlsServerCertFile = flag.String("tls-server-cert-file", getEnv("REDIS_EXPORTER_TLS_SERVER_CERT_FILE", ""), "Name of the server certificate file (including full path) if the web interface and telemetry should use TLS")
7979
tlsServerCaCertFile = flag.String("tls-server-ca-cert-file", getEnv("REDIS_EXPORTER_TLS_SERVER_CA_CERT_FILE", ""), "Name of the CA certificate file (including full path) if the web interface and telemetry should require TLS client authentication")
80+
tlsServerMinVersion = flag.String("tls-server-min-version", getEnv("REDIS_EXPORTER_TLS_SERVER_MIN_VERSION", "TLS1.2"), "Minimum TLS version that is acceptable by the web interface and telemetry when using TLS")
8081
maxDistinctKeyGroups = flag.Int64("max-distinct-key-groups", getEnvInt64("REDIS_EXPORTER_MAX_DISTINCT_KEY_GROUPS", 100), "The maximum number of distinct key groups with the most memory utilization to present as distinct metrics per database, the leftover key groups will be aggregated in the 'overflow' bucket")
8182
isDebug = flag.Bool("debug", getEnvBool("REDIS_EXPORTER_DEBUG", false), "Output verbose debug information")
8283
setClientName = flag.Bool("set-client-name", getEnvBool("REDIS_EXPORTER_SET_CLIENT_NAME", true), "Whether to set client name to redis_exporter")
@@ -203,7 +204,7 @@ func main() {
203204
if *tlsServerCertFile != "" && *tlsServerKeyFile != "" {
204205
log.Debugf("Bind as TLS using cert %s and key %s", *tlsServerCertFile, *tlsServerKeyFile)
205206

206-
tlsConfig, err := exp.CreateServerTLSConfig(*tlsServerCertFile, *tlsServerKeyFile, *tlsServerCaCertFile)
207+
tlsConfig, err := exp.CreateServerTLSConfig(*tlsServerCertFile, *tlsServerKeyFile, *tlsServerCaCertFile, *tlsServerMinVersion)
207208
if err != nil {
208209
log.Fatal(err)
209210
}

0 commit comments

Comments
 (0)