Add regexp matching of HTTP response headers to the http probe

CONFIGURATION.md

@@ -58,14 +58,30 @@ The other placeholders are specified separately.
   # Probe fails if SSL is not present.
   [ fail_if_not_ssl: <boolean> | default = false ]
 
-  # Probe fails if response matches regex.
+  # Probe fails if response body matches regex.
   fail_if_matches_regexp:
     [ - <regex>, ... ]
 
-  # Probe fails if response does not match regex.
+  # Probe fails if response body does not match regex.
   fail_if_not_matches_regexp:
     [ - <regex>, ... ]
 
+  # Probe fails if response header matches regex.
+  fail_if_header_matches_regexp:
+    [ - [ header: <string>,
+          [ regex: <regex>, ]
+          [ allow_missing: <boolean> | default = false ]
+        ], ...
+    ]
+
+  # Probe fails if response header does not match regex.
+  fail_if_header_not_matches_regexp:
+    [ - [ header: <string>,
+          [ regex: <regex>, ]
+          [ allow_missing: <boolean> | default = false ]
+        ], ...
+    ]
+
   # Configuration for TLS protocol of HTTP probe.
   tls_config:
     [ <tls_config> ]

config/config.go

@@ -80,19 +80,27 @@ type Module struct {
 
 type HTTPProbe struct {
 	// Defaults to 2xx.
-	ValidStatusCodes       []int                   `yaml:"valid_status_codes,omitempty"`
-	ValidHTTPVersions      []string                `yaml:"valid_http_versions,omitempty"`
-	IPProtocol             string                  `yaml:"preferred_ip_protocol,omitempty"`
-	IPProtocolFallback     bool                    `yaml:"ip_protocol_fallback,omitempty"`
-	NoFollowRedirects      bool                    `yaml:"no_follow_redirects,omitempty"`
-	FailIfSSL              bool                    `yaml:"fail_if_ssl,omitempty"`
-	FailIfNotSSL           bool                    `yaml:"fail_if_not_ssl,omitempty"`
-	Method                 string                  `yaml:"method,omitempty"`
-	Headers                map[string]string       `yaml:"headers,omitempty"`
-	FailIfMatchesRegexp    []string                `yaml:"fail_if_matches_regexp,omitempty"`
-	FailIfNotMatchesRegexp []string                `yaml:"fail_if_not_matches_regexp,omitempty"`
-	Body                   string                  `yaml:"body,omitempty"`
-	HTTPClientConfig       config.HTTPClientConfig `yaml:"http_client_config,inline"`
+	ValidStatusCodes             []int                   `yaml:"valid_status_codes,omitempty"`
+	ValidHTTPVersions            []string                `yaml:"valid_http_versions,omitempty"`
+	IPProtocol                   string                  `yaml:"preferred_ip_protocol,omitempty"`
+	IPProtocolFallback           bool                    `yaml:"ip_protocol_fallback,omitempty"`
+	NoFollowRedirects            bool                    `yaml:"no_follow_redirects,omitempty"`
+	FailIfSSL                    bool                    `yaml:"fail_if_ssl,omitempty"`
+	FailIfNotSSL                 bool                    `yaml:"fail_if_not_ssl,omitempty"`
+	Method                       string                  `yaml:"method,omitempty"`
+	Headers                      map[string]string       `yaml:"headers,omitempty"`
+	FailIfMatchesRegexp          []string                `yaml:"fail_if_matches_regexp,omitempty"`
+	FailIfNotMatchesRegexp       []string                `yaml:"fail_if_not_matches_regexp,omitempty"`
+	FailIfHeaderMatchesRegexp    []HeaderMatch           `yaml:"fail_if_header_matches_regexp,omitempty"`
+	FailIfHeaderNotMatchesRegexp []HeaderMatch           `yaml:"fail_if_header_not_matches_regexp,omitempty"`
+	Body                         string                  `yaml:"body,omitempty"`
+	HTTPClientConfig             config.HTTPClientConfig `yaml:"http_client_config,inline"`
+}
+
+type HeaderMatch struct {
+	Header       string `yaml:"header,omitempty"`
+	Regexp       string `yaml:"regexp,omitempty"`
+	AllowMissing bool   `yaml:"allow_missing,omitempty"`
 }
 
 type QueryResponse struct {
@@ -217,3 +225,21 @@ func (s *QueryResponse) UnmarshalYAML(unmarshal func(interface{}) error) error {
 	}
 	return nil
 }
+
+// UnmarshalYAML implements the yaml.Unmarshaler interface.
+func (s *HeaderMatch) UnmarshalYAML(unmarshal func(interface{}) error) error {
+	type plain HeaderMatch
+	if err := unmarshal((*plain)(s)); err != nil {
+		return err
+	}
+
+	if s.Header == "" {
+		return errors.New("header name must be set for HTTP header matchers")
+	}
+
+	if !s.AllowMissing && s.Regexp == "" {
+		return errors.New("regexp must be set for required HTTP headers")
+	}
+
+	return nil
+}

config/config_test.go

@@ -38,6 +38,10 @@ func TestLoadBadConfigs(t *testing.T) {
 			ConfigFile:    "testdata/invalid-dns-module.yml",
 			ExpectedError: "error parsing config file: query name must be set for DNS module",
 		},
+		{
+			ConfigFile:    "testdata/invalid-http-header-match.yml",
+			ExpectedError: "error parsing config file: regexp must be set for required HTTP headers",
+		},
 	}
 	for i, test := range tests {
 		err := sc.ReloadConfig(test.ConfigFile)

config/testdata/blackbox-good.yml

@@ -66,3 +66,14 @@ modules:
       ip_protocol_fallback: false
       validate_answer_rrs:
         fail_if_matches_regexp: [test]
+  http_header_match_origin:
+    prober: http
+    timeout: 5s
+    http:
+      method: GET
+      headers:
+        Origin: example.com
+      fail_if_header_not_matches_regexp:
+        - header: Access-Control-Allow-Origin
+          regexp: '(\*|example\.com)'
+          allow_missing: false

config/testdata/invalid-http-header-match.yml

@@ -0,0 +1,8 @@
+modules:
+  http_headers:
+    prober: http
+    timeout: 5s
+    http:
+      fail_if_header_not_matches_regexp:
+        - header: Access-Control-Allow-Origin
+          allow_missing: false

prober/http.go

@@ -69,6 +69,55 @@ func matchRegularExpressions(reader io.Reader, httpConfig config.HTTPProbe, logg
 	return true
 }
 
+func matchRegularExpressionsOnHeaders(header http.Header, httpConfig config.HTTPProbe, logger log.Logger) bool {
+	for _, headerMatchSpec := range httpConfig.FailIfHeaderMatchesRegexp {
+		val := header.Get(headerMatchSpec.Header)
+		if val == "" {
+			if !headerMatchSpec.AllowMissing {
+				level.Error(logger).Log("msg", "Missing required header", "header", headerMatchSpec.Header)
+				return false
+			} else {
+				continue // no need to match any regex on missing headers
+			}
+		}
+
+		re, err := regexp.Compile(headerMatchSpec.Regexp)
+		if err != nil {
+			level.Error(logger).Log("msg", "Could not compile regular expression", "regexp", headerMatchSpec.Regexp, "err", err)
+			return false
+		}
+		if re.MatchString(val) {
+			level.Error(logger).Log("msg", "Header matched regular expression", "header", headerMatchSpec.Header,
+				"val", val, "regexp", headerMatchSpec.Regexp)
+			return false
+		}
+	}
+	for _, headerMatchSpec := range httpConfig.FailIfHeaderNotMatchesRegexp {
+		val := header.Get(headerMatchSpec.Header)
+		if val == "" {
+			if !headerMatchSpec.AllowMissing {
+				level.Error(logger).Log("msg", "Missing required header", "header", headerMatchSpec.Header)
+				return false
+			} else {
+				continue // no need to match any regex on missing headers
+			}
+		}
+
+		re, err := regexp.Compile(headerMatchSpec.Regexp)
+		if err != nil {
+			level.Error(logger).Log("msg", "Could not compile regular expression", "regexp", headerMatchSpec.Regexp, "err", err)
+			return false
+		}
+		if !re.MatchString(val) {
+			level.Error(logger).Log("msg", "Header did not match regular expression", "header", headerMatchSpec.Header,
+				"val", val, "regexp", headerMatchSpec.Regexp)
+			return false
+		}
+	}
+
+	return true
+}
+
 // roundTripTrace holds timings for a single HTTP roundtrip.
 type roundTripTrace struct {
 	tls           bool
@@ -173,6 +222,11 @@ func ProbeHTTP(ctx context.Context, target string, module config.Module, registr
 			Help: "Indicates if probe failed due to regex",
 		})
 
+		probeFailedDueToHeaders = prometheus.NewGauge(prometheus.GaugeOpts{
+			Name: "probe_failed_due_to_headers",
+			Help: "Indicates if probe failed due to headers",
+		})
+
 		probeHTTPLastModified = prometheus.NewGauge(prometheus.GaugeOpts{
 			Name: "probe_http_last_modified_timestamp_seconds",
 			Help: "Returns the Last-Modified HTTP response header in unixtime",
@@ -190,6 +244,7 @@ func ProbeHTTP(ctx context.Context, target string, module config.Module, registr
 	registry.MustRegister(statusCodeGauge)
 	registry.MustRegister(probeHTTPVersionGauge)
 	registry.MustRegister(probeFailedDueToRegex)
+	registry.MustRegister(probeFailedDueToHeaders)
 
 	httpConfig := module.HTTP
 
@@ -320,6 +375,15 @@ func ProbeHTTP(ctx context.Context, target string, module config.Module, registr
 			level.Info(logger).Log("msg", "Invalid HTTP response status code, wanted 2xx", "status_code", resp.StatusCode)
 		}
 
+		if success && (len(httpConfig.FailIfHeaderMatchesRegexp) > 0 || len(httpConfig.FailIfHeaderNotMatchesRegexp) > 0) {
+			success = matchRegularExpressionsOnHeaders(resp.Header, httpConfig, logger)
+			if success {
+				probeFailedDueToHeaders.Set(0)
+			} else {
+				probeFailedDueToHeaders.Set(1)
+			}
+		}
+
 		if success && (len(httpConfig.FailIfMatchesRegexp) > 0 || len(httpConfig.FailIfNotMatchesRegexp) > 0) {
 			success = matchRegularExpressions(resp.Body, httpConfig, logger)
 			if success {

prober/http_test.go

@@ -406,6 +406,49 @@ func TestHTTPHeaders(t *testing.T) {
 	}
 }
 
+func TestHTTPHeaderMatching(t *testing.T) {
+	tests := []struct {
+		FailIfMatches bool // true means should fail if matches, false means should fail if does not match
+		Rule          config.HeaderMatch
+		Value         string
+		ShouldSucceed bool
+	}{
+		{true, config.HeaderMatch{"Content-Type", "text/javascript", false}, "text/javascript", false},
+		{true, config.HeaderMatch{"Content-Type", "text/javascript", false}, "application/octet-stream", true},
+		{true, config.HeaderMatch{"Content-Type", "text/javascript", false}, "", false},
+		{true, config.HeaderMatch{"Content-Type", "", true}, "", true},
+
+		{false, config.HeaderMatch{"Content-Type", "application/octet-stream", false}, "text/javascript", false},
+		{false, config.HeaderMatch{"Content-Type", "application/octet-stream", false}, "application/octet-stream", true},
+		{false, config.HeaderMatch{"Content-Type", "application/octet-stream", false}, "", false},
+		{false, config.HeaderMatch{"Content-Type", "", true}, "", true},
+	}
+	for i, test := range tests {
+		ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if test.Value != "" {
+				w.Header().Add(test.Rule.Header, test.Value)
+			}
+		}))
+		defer ts.Close()
+		registry := prometheus.NewRegistry()
+		testCTX, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer cancel()
+
+		var httpProbe config.HTTPProbe
+
+		if test.FailIfMatches {
+			httpProbe = config.HTTPProbe{IPProtocolFallback: true, FailIfHeaderMatchesRegexp: []config.HeaderMatch{test.Rule}}
+		} else {
+			httpProbe = config.HTTPProbe{IPProtocolFallback: true, FailIfHeaderNotMatchesRegexp: []config.HeaderMatch{test.Rule}}
+		}
+
+		result := ProbeHTTP(testCTX, ts.URL, config.Module{Timeout: time.Second, HTTP: httpProbe}, registry, log.NewNopLogger())
+		if result != test.ShouldSucceed {
+			t.Fatalf("Test %d had unexpected result: succeeded: %t, expected: %+v", i, result, test)
+		}
+	}
+}
+
 func TestFailIfSelfSignedCA(t *testing.T) {
 	ts := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 	}))