Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding TLS mutual auth supoort to jti_openconfig_telemetry plugin #6027

Merged
merged 2 commits into from
Jun 21, 2019
Merged

Adding TLS mutual auth supoort to jti_openconfig_telemetry plugin #6027

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b41f696
Adding TLS mutual auth supoort to jti_openconfig_telemetry plugin
littlespace Jun 21, 2019
1184ee9
Adding TLS mutual auth supoort to jti_openconfig_telemetry plugin
littlespace Jun 21, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions etc/telegraf.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4772,9 +4772,13 @@
# "/interfaces",
# ]
#
# ## x509 Certificate to use with TLS connection. If it is not provided, an insecure
# ## channel will be opened with server
# ssl_cert = "/etc/telegraf/cert.pem"
# ## enable client-side TLS and define CA to authenticate the device
# enable_tls = true
# tls_ca = "/etc/telegraf/ca.pem"
# insecure_skip_verify = true
# ## define client-side TLS certificate & key to authenticate to the device
# tls_cert = "/etc/telegraf/cert.pem"
# tls_key = "/etc/telegraf/key.pem"
#
# ## Delay between retry attempts of failed RPC calls or streams. Defaults to 1000ms.
# ## Failed streams/calls will not be retried if 0 is provided
Expand Down
10 changes: 7 additions & 3 deletions plugins/inputs/jti_openconfig_telemetry/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,9 +41,13 @@ This plugin reads Juniper Networks implementation of OpenConfig telemetry data f
"/interfaces",
]

## x509 Certificate to use with TLS connection. If it is not provided, an insecure
## channel will be opened with server
ssl_cert = "/etc/telegraf/cert.pem"
## enable client-side TLS and define CA to authenticate the device
# enable_tls = true
# tls_ca = "/etc/telegraf/ca.pem"
# insecure_skip_verify = true
## define client-side TLS certificate & key to authenticate to the device
# tls_cert = "/etc/telegraf/cert.pem"
# tls_key = "/etc/telegraf/key.pem"

## Delay between retry attempts of failed RPC calls or streams. Defaults to 1000ms.
## Failed streams/calls will not be retried if 0 is provided
Expand Down
45 changes: 27 additions & 18 deletions plugins/inputs/jti_openconfig_telemetry/openconfig_telemetry.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package jti_openconfig_telemetry

import (
"crypto/tls"
"fmt"
"log"
"net"
Expand All @@ -11,6 +12,7 @@ import (

"github.com/influxdata/telegraf"
"github.com/influxdata/telegraf/internal"
internaltls "github.com/influxdata/telegraf/internal/tls"
"github.com/influxdata/telegraf/plugins/inputs"
"github.com/influxdata/telegraf/plugins/inputs/jti_openconfig_telemetry/auth"
"github.com/influxdata/telegraf/plugins/inputs/jti_openconfig_telemetry/oc"
Expand All @@ -28,13 +30,17 @@ type OpenConfigTelemetry struct {
Password string
ClientID string `toml:"client_id"`
SampleFrequency internal.Duration `toml:"sample_frequency"`
SSLCert string `toml:"ssl_cert"`
StrAsTags bool `toml:"str_as_tags"`
RetryDelay internal.Duration `toml:"retry_delay"`

sensorsConfig []sensorConfig
sensorsConfig []sensorConfig

// GRPC settings
grpcClientConns []*grpc.ClientConn
wg *sync.WaitGroup
EnableTLS bool `toml:"enable_tls"`
internaltls.ClientConfig

wg *sync.WaitGroup
}

var (
Expand Down Expand Up @@ -74,10 +80,14 @@ var (
"/interfaces",
]

## x509 Certificate to use with TLS connection. If it is not provided, an insecure
## channel will be opened with server
ssl_cert = "/etc/telegraf/cert.pem"

## enable client-side TLS and define CA to authenticate the device
# enable_tls = true
# tls_ca = "/etc/telegraf/ca.pem"
# insecure_skip_verify = true
## define client-side TLS certificate & key to authenticate to the device
# tls_cert = "/etc/telegraf/cert.pem"
# tls_key = "/etc/telegraf/key.pem"

littlespace marked this conversation as resolved.
Show resolved Hide resolved
## Delay between retry attempts of failed RPC calls or streams. Defaults to 1000ms.
## Failed streams/calls will not be retried if 0 is provided
retry_delay = "1000ms"
Expand Down Expand Up @@ -343,21 +353,20 @@ func (m *OpenConfigTelemetry) collectData(ctx context.Context,
}

func (m *OpenConfigTelemetry) Start(acc telegraf.Accumulator) error {

var tlscfg *tls.Config
var err error

// Build sensors config
if m.splitSensorConfig() == 0 {
return fmt.Errorf("E! No valid sensor configuration available")
}

// If SSL certificate is provided, use transport credentials
var err error
var transportCredentials credentials.TransportCredentials
if m.SSLCert != "" {
transportCredentials, err = credentials.NewClientTLSFromFile(m.SSLCert, "")
if err != nil {
return fmt.Errorf("E! Failed to read certificate: %v", err)
// Parse TLS config
if m.EnableTLS {
if tlscfg, err = m.ClientConfig.TLSConfig(); err != nil {
return err
}
} else {
transportCredentials = nil
}

// Connect to given list of servers and start collecting data
Expand All @@ -374,8 +383,8 @@ func (m *OpenConfigTelemetry) Start(acc telegraf.Accumulator) error {
}

// If a certificate is provided, open a secure channel. Else open insecure one
if transportCredentials != nil {
grpcClientConn, err = grpc.Dial(server, grpc.WithTransportCredentials(transportCredentials))
if tlscfg != nil {
grpcClientConn, err = grpc.Dial(server, grpc.WithTransportCredentials(credentials.NewTLS(tlscfg)))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All the code is right, but if you are interested in going further I can see a way we could have done this nicer originally. We should have created a grpc.DialOption above based on EnableTLS, and then here we don't need the if/else. Optional.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

} else {
grpcClientConn, err = grpc.Dial(server, grpc.WithInsecure())
}
Expand Down