Add new SSL input plugin

plugins/inputs/all/all.go

@@ -88,6 +88,7 @@ import (
 	_ "github.com/influxdata/telegraf/plugins/inputs/socket_listener"
 	_ "github.com/influxdata/telegraf/plugins/inputs/solr"
 	_ "github.com/influxdata/telegraf/plugins/inputs/sqlserver"
+	_ "github.com/influxdata/telegraf/plugins/inputs/ssl"
 	_ "github.com/influxdata/telegraf/plugins/inputs/statsd"
 	_ "github.com/influxdata/telegraf/plugins/inputs/sysstat"
 	_ "github.com/influxdata/telegraf/plugins/inputs/system"

plugins/inputs/ssl/README.md

@@ -0,0 +1,50 @@
+# Telegraf Plugin: SSL
+
+### Configuration:
+
+```
+# Check expiration date and domains of ssl certificate
+[[inputs.ssl]]
+  ## Server to check
+  [[inputs.ssl.servers]]
+    host = "google.com:443"
+    timeout = 5
+  ## Server to check
+  [[inputs.ssl.servers]]
+    host = "github.com"
+    timeout = 5
+```
+
+### Tags:
+
+- domain
+- port
+
+### Fields:
+
+- time_to_expiration(int)
+
+### Example Output:
+
+If ssl certificate is valid:
+
+```
+* Plugin: inputs.ssl, Collection 1
+> ssl,domain=example.com,port=443,host=host time_to_expiration=3907728i 1517213967000000000
+```
+
+If ssl certificate and domain mismatch:
+
+```
+* Plugin: inputs.ssl, Collection 1
+2018-01-29T08:20:33Z E! Error in plugin [inputs.ssl]: [example.com:443] cert and domain mismatch
+> ssl,domain=example.com,port=443,host=host time_to_expiration=0i 1517214033000000000
+```
+
+If ssl certificate has expired:
+
+```
+* Plugin: inputs.ssl, Collection 1
+2018-01-29T08:20:33Z E! Error in plugin [inputs.ssl]: [example.com:443] cert has expired
+> ssl,domain=example.com,port=443,host=host time_to_expiration=0i 1517214033000000000
+```

plugins/inputs/ssl/ssl.go

@@ -0,0 +1,128 @@
+package ssl
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"github.com/influxdata/telegraf"
+	"github.com/influxdata/telegraf/plugins/inputs"
+	"github.com/pkg/errors"
+	"net"
+	"strings"
+	"time"
+)
+
+type Ssl struct {
+	Servers []Server
+}
+
+type Server struct {
+	Host    string
+	Timeout int
+}
+
+var sampleConfig = `
+  ## Server to check
+  [[inputs.ssl.servers]]
+    host = "google.com:443"
+    timeout = 5
+  ## Server to check
+  [[inputs.ssl.servers]]
+    host = "github.com"
+    timeout = 5
+`
+
+func (s *Ssl) SampleConfig() string {
+	return sampleConfig
+}
+
+func (s *Ssl) Description() string {
+	return "Check expiration date and domains of ssl certificate"
+}
+
+func (s *Ssl) Gather(acc telegraf.Accumulator) error {
+	for _, server := range s.Servers {
+		slice := strings.Split(server.Host, ":")
+		domain, port := slice[0], "443"
+		if len(slice) > 1 {
+			port = slice[1]
+		}
+		h := getServerAddress(domain, port)
+		timeNow := time.Now()
+		timeToExp := int64(0)
+		fields := make(map[string]interface{})
+		tags := make(map[string]string)
+		certs, err := getServerCertsChain(domain, port, server.Timeout)
+
+		if err != nil {
+			acc.AddError(err)
+		} else {
+			cert := certs[0]
+			if cert.NotAfter.UnixNano() < timeNow.UnixNano() {
+				acc.AddError(errors.New("[" + h + "] cert has expired"))
+			} else {
+				timeToExp = int64(cert.NotAfter.Sub(timeNow) / time.Second)
+			}
+			if !isDomainInCertDnsNames(domain, cert.DNSNames) {
+				acc.AddError(errors.New("[" + h + "] cert and domain mismatch"))
+				timeToExp = int64(0)
+			}
+		}
+		fields["time_to_expiration"] = timeToExp
+		tags["domain"] = domain
+		tags["port"] = port
+
+		acc.AddFields("ssl", fields, tags)
+	}
+	return nil
+}
+
+func getServerCertsChain(d string, p string, t int) ([]*x509.Certificate, error) {
+	h := getServerAddress(d, p)
+	ipConn, err := net.DialTimeout("tcp", h, time.Duration(t)*time.Second)
+	if err != nil {
+		return nil, errors.New("[" + h + "] " + err.Error())
+	}
+	defer ipConn.Close()
+
+	tlsConn := tls.Client(ipConn, &tls.Config{ServerName: d, InsecureSkipVerify: true})
+	defer tlsConn.Close()
+
+	err = tlsConn.Handshake()
+	if err != nil {
+		return nil, errors.New("[" + h + "] " + err.Error())
+	}
+	certs := tlsConn.ConnectionState().PeerCertificates
+	if certs == nil || len(certs) < 1 {
+		return nil, errors.New("[" + h + "] cert receive error")
+	}
+	return certs, nil
+}
+
+func getServerAddress(d string, p string) string {
+	return d + ":" + p
+}
+
+func isDomainInCertDnsNames(domain string, certDnsNames []string) bool {
+	for _, d := range certDnsNames {
+		if domain == d {
+			return true
+		}
+		if d[:1] == "*" && len(domain) >= len(d[2:]) {
+			d = d[2:]
+			if domain == d {
+				return true
+			}
+			start := len(domain) - len(d) - 1
+			if start >= 0 && domain[start:] == "."+d {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func init() {
+	inputs.Add("ssl", func() telegraf.Input {
+		return &Ssl{}
+	})
+}

plugins/inputs/ssl/ssl_test.go

@@ -0,0 +1,36 @@
+package ssl
+
+import (
+	"github.com/influxdata/telegraf/testutil"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"testing"
+)
+
+func TestGathering(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping network-dependent test in short mode.")
+	}
+	var servers = []Server{
+		{
+			Host:    "github.com:443",
+			Timeout: 5,
+		},
+		{
+			Host:    "github.com",
+			Timeout: 5,
+		},
+	}
+	var sslConfig = Ssl{
+		Servers: servers,
+	}
+	var acc testutil.Accumulator
+
+	err := acc.GatherError(sslConfig.Gather)
+	assert.NoError(t, err)
+	metric, ok := acc.Get("ssl")
+	require.True(t, ok)
+	timeToExp, _ := metric.Fields["time_to_expiration"].(float64)
+
+	assert.NotEqual(t, 0, timeToExp)
+}