Add listeners metrics

envoy/datadog_checks/envoy/metrics.py

@@ -1063,14 +1063,38 @@
         ),
         'method': 'monotonic_count',
     },
-    'listener.ssl.cipher': {
+    'listener.ssl.ciphers': {
         'tags': (
             ('address', ),
             (),
             ('cipher', ),
         ),
         'method': 'monotonic_count',
     },
+    'listener.ssl.versions': {
+        'tags': (
+            ('address', ),
+            (),
+            ('version', ),
+        ),
+        'method': 'monotonic_count',
+    },
+    'listener.ssl.curves': {
+        'tags': (
+            ('address', ),
+            (),
+            ('curve', ),
+        ),
+        'method': 'monotonic_count',
+    },
+    'listener.ssl.sigalgs': {
+        'tags': (
+            ('address', ),
+            (),
+            ('sigalg', ),
+        ),
+        'method': 'monotonic_count',
+    },
     'listener_manager.listener_added': {
         'tags': (
             (),

envoy/metadata.csv

@@ -109,7 +109,10 @@ envoy.listener.ssl.fail_verify_no_cert,count,,connection,,Total TLS connections
 envoy.listener.ssl.fail_verify_error,count,,connection,,Total TLS connections that failed CA verification,-1,envoy,
 envoy.listener.ssl.fail_verify_san,count,,connection,,Total TLS connections that failed SAN verification,-1,envoy,
 envoy.listener.ssl.fail_verify_cert_hash,count,,connection,,Total TLS connections that failed certificate pinning verification,-1,envoy,
-envoy.listener.ssl.cipher,count,,connection,,Total TLS connections that used cipher tag,0,envoy,
+envoy.listener.ssl.ciphers,count,,connection,,Total TLS connections that used cipher tag,0,envoy,
+envoy.listener.ssl.versions,count,,connection,,Total successful TLS connections that used protocol version tag,0,envoy,
+envoy.listener.ssl.curves,count,,connection,,Total successful TLS connections that used ECDHE curve tag,0,envoy,
+envoy.listener.ssl.sigalgs,count,,connection,,Total successful TLS connections that used signature algorithm sigalg tag,0,envoy,
 envoy.listener_manager.listener_added,count,,host,,Total listeners added (either via static config or LDS),0,envoy,
 envoy.listener_manager.listener_modified,count,,host,,Total listeners modified (via LDS),0,envoy,
 envoy.listener_manager.listener_removed,count,,host,,Total listeners removed (via LDS),0,envoy,

envoy/tests/fixtures/multiple_services

@@ -4273,6 +4273,11 @@ listener.00.00.00.00_0000.downstream_cx_total: 0
 listener.00.00.00.00_0000.downstream_cx_active: 0
 listener.00.00.00.00_0000.downstream_cx_destroy: 0
 listener.00.00.00.00_0000.downstream_cx_total: 0
+listener.00.00.00.00_0000.ssl.ciphers.AEAD-AES256-GCM-SHA384: 3
+listener.00.00.00.00_0000.ssl.versions.TLSv1.2: 13108
+listener.00.00.00.00_0000.ssl.versions.TLSv1.3: 7
+listener.00.00.00.00_0000.ssl.curves.P-256: 76
+listener.00.00.00.00_0000.ssl.sigalgs.rsa_pss_rsae_sha256: 0
 listener.admin.downstream_cx_active: 1
 listener.admin.downstream_cx_destroy: 3
 listener.admin.downstream_cx_total: 4

envoy/tests/test_envoy.py

@@ -36,7 +36,7 @@ def test_success_fixture(self, aggregator):
 
         num_metrics = len(response('multiple_services').content.decode().splitlines())
         num_metrics -= sum(c.unknown_metrics.values()) + sum(c.unknown_tags.values())
-        assert 4150 <= metrics_collected == num_metrics
+        assert 4155 <= metrics_collected == num_metrics
 
     def test_success_fixture_whitelist(self, aggregator):
         instance = INSTANCES['whitelist']

envoy/tests/test_parser.py

@@ -286,11 +286,11 @@ def test_mongo_collection(self):
         )
 
     def test_listener(self):
-        metric = 'listener{}.ssl.cipher{}'
+        metric = 'listener{}.ssl.ciphers{}'
         untagged_metric = metric.format('', '')
         tags = [tag for tags in METRICS[untagged_metric]['tags'] for tag in tags]
         tag0 = '0.0.0.0_80'
-        tag1 = 'some_cipher'
+        tag1 = 'some_ciphers'
         tagged_metric = metric.format('.{}'.format(tag0), '.{}'.format(tag1))
 
         assert parse_metric(tagged_metric) == (
@@ -305,6 +305,48 @@ def test_listener_manager(self):
 
         assert parse_metric(metric) == (METRIC_PREFIX + metric, list(tags), METRICS[metric]['method'])
 
+    def test_listener_tls(self):
+        metric = 'listener{}.ssl.versions{}'
+        untagged_metric = metric.format('', '')
+        tags = [tag for tags in METRICS[untagged_metric]['tags'] for tag in tags]
+        tag0 = '0.0.0.0'
+        tag1 = 'TLSv1.2'
+        tagged_metric = metric.format('.{}'.format(tag0), '.{}'.format(tag1))
+
+        assert parse_metric(tagged_metric) == (
+            METRIC_PREFIX + untagged_metric,
+            ['{}:{}'.format(tags[0], tag0), '{}:{}'.format(tags[1], tag1)],
+            METRICS[untagged_metric]['method'],
+        )
+
+    def test_listener_curves(self):
+        metric = 'listener{}.ssl.curves{}'
+        untagged_metric = metric.format('', '')
+        tags = [tag for tags in METRICS[untagged_metric]['tags'] for tag in tags]
+        tag0 = '0.0.0.0'
+        tag1 = 'P-256'
+        tagged_metric = metric.format('.{}'.format(tag0), '.{}'.format(tag1))
+
+        assert parse_metric(tagged_metric) == (
+            METRIC_PREFIX + untagged_metric,
+            ['{}:{}'.format(tags[0], tag0), '{}:{}'.format(tags[1], tag1)],
+            METRICS[untagged_metric]['method'],
+        )
+
+    def test_listener_sigalgs(self):
+        metric = 'listener{}.ssl.sigalgs{}'
+        untagged_metric = metric.format('', '')
+        tags = [tag for tags in METRICS[untagged_metric]['tags'] for tag in tags]
+        tag0 = '0.0.0.0'
+        tag1 = 'rsa_pss_rsae_sha256'
+        tagged_metric = metric.format('.{}'.format(tag0), '.{}'.format(tag1))
+
+        assert parse_metric(tagged_metric) == (
+            METRIC_PREFIX + untagged_metric,
+            ['{}:{}'.format(tags[0], tag0), '{}:{}'.format(tags[1], tag1)],
+            METRICS[untagged_metric]['method'],
+        )
+
     def test_http(self):
         metric = 'http{}.downstream_cx_total'
         untagged_metric = metric.format('')