Merge branch 'master' into issue-980

Signed-off-by: Daniel Teunis <[email protected]>

.circleci/config.yml

@@ -1,11 +1,11 @@
 version: 2.1
 orbs:
-  prometheus: prometheus/prometheus@0.16.0
+  prometheus: prometheus/prometheus@0.17.1
 executors:
   # Whenever the Go version is updated here, .promu.yml should also be updated.
   golang:
     docker:
-      - image: cimg/go:1.18
+      - image: cimg/go:1.20
 jobs:
   test:
     executor: golang
@@ -23,7 +23,7 @@ jobs:
     # Whenever the Go version is updated here, .travis.yml and .promu.yml
     # should also be updated.
     environment:
-      DOCKER_TEST_IMAGE_NAME: quay.io/prometheus/golang-builder:1.17-base
+      DOCKER_TEST_IMAGE_NAME: quay.io/prometheus/golang-builder:1.20-base
     steps:
       - checkout
       - run:

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "monthly"

.github/workflows/golangci-lint.yml

@@ -1,3 +1,5 @@
+---
+# This action is synced from https://github.com/prometheus/prometheus
 name: golangci-lint
 on:
   push:
@@ -16,15 +18,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
       - name: install Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
         with:
-          go-version: 1.18.x
+          go-version: 1.20.x
       - name: Install snmp_exporter/generator dependencies
         run: sudo apt-get update && sudo apt-get -y install libsnmp-dev
         if: github.repository == 'prometheus/snmp_exporter'
       - name: Lint
-        uses: golangci/golangci-lint-action@v3.2.0
+        uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
         with:
-          version: v1.45.2
+          version: v1.54.2

.promu.yml

@@ -1,7 +1,7 @@
 go:
     # Whenever the Go version is updated here, .travis.yml and
     # .circle/config.yml should also be updated.
-    version: 1.18
+    version: 1.20
 repository:
     path: github.com/prometheus/blackbox_exporter
 build:

.yamllint

@@ -20,9 +20,4 @@ rules:
       config/testdata/section_key_dup.bad.yml
   line-length: disable
   truthy:
-    ignore: |
-      .github/workflows/codeql-analysis.yml
-      .github/workflows/funcbench.yml
-      .github/workflows/fuzzing.yml
-      .github/workflows/prombench.yml
-      .github/workflows/golangci-lint.yml
+    check-keys: false

CHANGELOG.md

@@ -1,3 +1,16 @@
+## 0.24.0 / 2023-05-16
+
+* [CHANGE] Make Proxy Connect Headers consistent with Prometheus #1008
+* [FEATURE] Add hostname parameter for TCP probe #981
+* [FEATURE] Add support for HTTP request body as file #987
+
+## 0.23.0 / 2022-12-02
+
+* [SECURITY] Update Exporter Toolkit (CVE-2022-46146) #979
+* [FEATURE] Support multiple Listen Addresses and systemd socket activation #979
+* [FEATURE] Add leaf certificate details in a new `probe_ssl_last_chain_info` metric. #943
+* [FEATURE] DNS: Add `Add probe_dns_query_succeeded` metric. #990
+
 ## 0.22.0 / 2022-08-02
 
 * [FEATURE] HTTP: Add `skip_resolve_phase_with_proxy` option. #944

CONFIGURATION.md

@@ -16,7 +16,17 @@ Generic placeholders are defined as follows:
 
 The other placeholders are specified separately.
 
-### Module
+See [example.yml](example.yml) for configuration examples.
+
+```yml
+
+modules:
+     [ <string>: <module> ... ]
+
+```
+
+
+### `<module>`
 ```yml
 
   # The protocol over which the probe will take place (http, tcp, dns, icmp, grpc).
@@ -34,7 +44,7 @@ The other placeholders are specified separately.
 
 ```
 
-### <http_probe>
+### `<http_probe>`
 ```yml
 
   # Accepted status codes for this probe. Defaults to 2xx.
@@ -103,22 +113,37 @@ The other placeholders are specified separately.
   tls_config:
     [ <tls_config> ]
 
-  # The HTTP basic authentication credentials for the targets.
+  # The HTTP basic authentication credentials.
   basic_auth:
     [ username: <string> ]
     [ password: <secret> ]
     [ password_file: <filename> ]
 
-  # The bearer token for the targets.
-  [ bearer_token: <secret> ]
-
-  # The bearer token file for the targets.
-  [ bearer_token_file: <filename> ]
+  # Sets the `Authorization` header on every request with
+  # the configured credentials.
+  authorization:
+    # Sets the authentication type of the request.
+    [ type: <string> | default: Bearer ]
+    # Sets the credentials of the request. It is mutually exclusive with
+    # `credentials_file`.
+    [ credentials: <secret> ]
+    # Sets the credentials of the request with the credentials read from the
+    # configured file. It is mutually exclusive with `credentials`.
+    [ credentials_file: <filename> ]
 
   # HTTP proxy server to use to connect to the targets.
   [ proxy_url: <string> ]
-
-  # Skip DNS resolution and URL change when an HTTP proxy (proxy_url) is set.
+  # Comma-separated string that can contain IPs, CIDR notation, domain names
+  # that should be excluded from proxying. IP and domain names can
+  # contain port numbers.
+  [ no_proxy: <string> ]
+  # Use proxy URL indicated by environment variables (HTTP_PROXY, https_proxy, HTTPs_PROXY, https_proxy, and no_proxy)
+  [ proxy_from_environment: <bool> | default: false ]
+  # Specifies headers to send to proxies during CONNECT requests.
+  [ proxy_connect_headers:
+    [ <string>: [<secret>, ...] ] ]
+
+  # Skip DNS resolution and URL change when an HTTP proxy (proxy_url or proxy_from_environment) is set.
   [ skip_resolve_phase_with_proxy: <boolean> | default = false ]
 
   # OAuth 2.0 configuration to use to connect to the targets.
@@ -133,19 +158,23 @@ The other placeholders are specified separately.
   [ ip_protocol_fallback: <boolean> | default = true ]
 
   # The body of the HTTP request used in probe.
-  body: [ <string> ]
+  [ body: <string> ]
+
+  # Read the HTTP request body from from a file.
+  # It is mutually exclusive with `body`.
+  [ body_file: <filename> ]
 
 ```
 
-#### <http_header_match_spec>
+#### `<http_header_match_spec>`
 
 ```yml
 header: <string>,
 regexp: <regex>,
 [ allow_missing: <boolean> | default = false ]
 ```
 
-### <tcp_probe>
+### `<tcp_probe>`
 
 ```yml
 
@@ -174,7 +203,7 @@ tls_config:
 
 ```
 
-### <dns_probe>
+### `<dns_probe>`
 
 ```yml
 
@@ -250,7 +279,7 @@ validate_additional_rrs:
 
 ```
 
-### <icmp_probe>
+### `<icmp_probe>`
 
 ```yml
 
@@ -275,7 +304,7 @@ validate_additional_rrs:
 
 ```
 
-### <grpc_probe>
+### `<grpc_probe>`
 
 ```yml
 # The service name to query for health status.
@@ -293,7 +322,7 @@ tls_config:
   [ <tls_config> ]
 ```
 
-### <tls_config>
+### `<tls_config>`
 
 ```yml
 
@@ -317,9 +346,16 @@ tls_config:
 # If unset, Prometheus will use Go default minimum version, which is TLS 1.2.
 # See MinVersion in https://pkg.go.dev/crypto/tls#Config.
 [ min_version: <string> ]
+
+# Maximum acceptable TLS version. Accepted values: TLS10 (TLS 1.0), TLS11 (TLS
+# 1.1), TLS12 (TLS 1.2), TLS13 (TLS 1.3).
+# Can be used to test for the presence of insecure TLS versions.
+# If unset, Prometheus will use Go default maximum version, which is TLS 1.3.
+# See MaxVersion in https://pkg.go.dev/crypto/tls#Config.
+[ max_version: <string> ]
 ```
 
-#### <oauth2>
+#### `<oauth2>`
 
 OAuth 2.0 authentication using the client credentials grant type. Blackbox
 exporter fetches an access token from the specified endpoint with the given

Makefile.common

@@ -49,19 +49,19 @@ endif
 GOTEST := $(GO) test
 GOTEST_DIR :=
 ifneq ($(CIRCLE_JOB),)
-ifneq ($(shell which gotestsum),)
+ifneq ($(shell command -v gotestsum > /dev/null),)
 	GOTEST_DIR := test-results
 	GOTEST := gotestsum --junitfile $(GOTEST_DIR)/unit-tests.xml --
 endif
 endif
 
-PROMU_VERSION ?= 0.13.0
+PROMU_VERSION ?= 0.15.0
 PROMU_URL     := https://github.com/prometheus/promu/releases/download/v$(PROMU_VERSION)/promu-$(PROMU_VERSION).$(GO_BUILD_PLATFORM).tar.gz
 
 SKIP_GOLANGCI_LINT :=
 GOLANGCI_LINT :=
 GOLANGCI_LINT_OPTS ?=
-GOLANGCI_LINT_VERSION ?= v1.49.0
+GOLANGCI_LINT_VERSION ?= v1.54.2
 # golangci-lint only supports linux, darwin and windows platforms on i386/amd64.
 # windows isn't included here because of the path separator being different.
 ifeq ($(GOHOSTOS),$(filter $(GOHOSTOS),linux darwin))
@@ -91,6 +91,8 @@ BUILD_DOCKER_ARCHS = $(addprefix common-docker-,$(DOCKER_ARCHS))
 PUBLISH_DOCKER_ARCHS = $(addprefix common-docker-publish-,$(DOCKER_ARCHS))
 TAG_DOCKER_ARCHS = $(addprefix common-docker-tag-latest-,$(DOCKER_ARCHS))
 
+SANITIZED_DOCKER_IMAGE_TAG := $(subst +,-,$(DOCKER_IMAGE_TAG))
+
 ifeq ($(GOHOSTARCH),amd64)
         ifeq ($(GOHOSTOS),$(filter $(GOHOSTOS),linux freebsd darwin windows))
                 # Only supported on amd64
@@ -176,7 +178,7 @@ endif
 .PHONY: common-yamllint
 common-yamllint:
 	@echo ">> running yamllint on all YAML files in the repository"
-ifeq (, $(shell which yamllint))
+ifeq (, $(shell command -v yamllint > /dev/null))
 	@echo "yamllint not installed so skipping"
 else
 	yamllint .
@@ -205,7 +207,7 @@ common-tarball: promu
 .PHONY: common-docker $(BUILD_DOCKER_ARCHS)
 common-docker: $(BUILD_DOCKER_ARCHS)
 $(BUILD_DOCKER_ARCHS): common-docker-%:
-	docker build -t "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:$(DOCKER_IMAGE_TAG)" \
+	docker build -t "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:$(SANITIZED_DOCKER_IMAGE_TAG)" \
 		-f $(DOCKERFILE_PATH) \
 		--build-arg ARCH="$*" \
 		--build-arg OS="linux" \
@@ -214,19 +216,19 @@ $(BUILD_DOCKER_ARCHS): common-docker-%:
 .PHONY: common-docker-publish $(PUBLISH_DOCKER_ARCHS)
 common-docker-publish: $(PUBLISH_DOCKER_ARCHS)
 $(PUBLISH_DOCKER_ARCHS): common-docker-publish-%:
-	docker push "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:$(DOCKER_IMAGE_TAG)"
+	docker push "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:$(SANITIZED_DOCKER_IMAGE_TAG)"
 
 DOCKER_MAJOR_VERSION_TAG = $(firstword $(subst ., ,$(shell cat VERSION)))
 .PHONY: common-docker-tag-latest $(TAG_DOCKER_ARCHS)
 common-docker-tag-latest: $(TAG_DOCKER_ARCHS)
 $(TAG_DOCKER_ARCHS): common-docker-tag-latest-%:
-	docker tag "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:$(DOCKER_IMAGE_TAG)" "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:latest"
-	docker tag "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:$(DOCKER_IMAGE_TAG)" "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:v$(DOCKER_MAJOR_VERSION_TAG)"
+	docker tag "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:$(SANITIZED_DOCKER_IMAGE_TAG)" "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:latest"
+	docker tag "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:$(SANITIZED_DOCKER_IMAGE_TAG)" "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:v$(DOCKER_MAJOR_VERSION_TAG)"
 
 .PHONY: common-docker-manifest
 common-docker-manifest:
-	DOCKER_CLI_EXPERIMENTAL=enabled docker manifest create -a "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME):$(DOCKER_IMAGE_TAG)" $(foreach ARCH,$(DOCKER_ARCHS),$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$(ARCH):$(DOCKER_IMAGE_TAG))
-	DOCKER_CLI_EXPERIMENTAL=enabled docker manifest push "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME):$(DOCKER_IMAGE_TAG)"
+	DOCKER_CLI_EXPERIMENTAL=enabled docker manifest create -a "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME):$(SANITIZED_DOCKER_IMAGE_TAG)" $(foreach ARCH,$(DOCKER_ARCHS),$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$(ARCH):$(SANITIZED_DOCKER_IMAGE_TAG))
+	DOCKER_CLI_EXPERIMENTAL=enabled docker manifest push "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME):$(SANITIZED_DOCKER_IMAGE_TAG)"
 
 .PHONY: promu
 promu: $(PROMU)

README.md

@@ -22,7 +22,11 @@ Then:
 
 *Note: You may want to [enable ipv6 in your docker configuration](https://docs.docker.com/v17.09/engine/userguide/networking/default_network/ipv6/)*
 
-    docker run --rm -d -p 9115:9115 --name blackbox_exporter -v `pwd`:/config prom/blackbox-exporter:master --config.file=/config/blackbox.yml
+    docker run --rm \
+      -p 9115/tcp \
+      --name blackbox_exporter \
+      -v $(pwd):/config \
+      quay.io/prometheus/blackbox-exporter:latest --config.file=/config/blackbox.yml
 
 ### Checking the results
 
@@ -31,6 +35,9 @@ will return metrics for a HTTP probe against google.com. The `probe_success`
 metric indicates if the probe succeeded. Adding a `debug=true` parameter
 will return debug information for that probe.
 
+Metrics concerning the operation of the exporter itself are available at the
+endpoint <http://localhost:9115/metrics>.
+
 ### TLS and basic authentication
 
 The Blackbox Exporter supports TLS and basic authentication. This enables better
@@ -104,6 +111,9 @@ scrape_configs:
         target_label: instance
       - target_label: __address__
         replacement: 127.0.0.1:9115  # The blackbox exporter's real hostname:port.
+  - job_name: 'blackbox_exporter'  # collect blackbox exporter's operational metrics.
+    static_configs:
+      - targets: ['127.0.0.1:9115']
 ```
 
 HTTP probes can accept an additional `hostname` parameter that will set `Host` header and TLS SNI. This can be especially useful with `dns_sd_config`:

VERSION

@@ -1 +1 @@
-0.22.0
+0.24.0

blackbox.yml

@@ -1,6 +1,8 @@
 modules:
   http_2xx:
     prober: http
+    http:
+      preferred_ip_protocol: "ip4"
   http_post_2xx:
     prober: http
     http:
@@ -46,4 +48,4 @@ modules:
     prober: icmp
     timeout: 5s
     icmp:
-      ttl: 5
+      ttl: 5