Add option to allow custom CAs

closes #14

_meta/beat.yml

@@ -16,48 +16,58 @@ icingabeat:
   # Password of the user
   password: "icinga"
 
-  # Skip SSL verification
+  # Configure SSL verification. If `false` is configured, all server hosts
-  skip_ssl_verify: false
+  # and certificates will be accepted. In this mode, SSL based connections are
+  # susceptible to man-in-the-middle attacks. Use only for testing. Default is
+  # `true`.
+  ssl.verify: true
 
+  # List of root certificates for HTTPS server verifications
+  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
+
+  ########################### Icingabeat Eventstream ##########################
+  #
   # Icingabeat supports capturing of an evenstream and periodical polling of the
   # Icinga status data.
-  eventstream:
-    #
-    # Decide which events to receive from the event stream.
-    # The following event stream types are available:
-    #
-    # * CheckResult
-    # * StateChange
-    # * Notification
-    # * AcknowledgementSet
-    # * AcknowledgementCleared
-    # * CommentAdded
-    # * CommentRemoved
-    # * DowntimeAdded
-    # * DowntimeRemoved
-    # * DowntimeStarted
-    # * DowntimeTriggered
-    #
-    # To disable eventstream, leave the types empty or comment out the option
-    types:
-      - CheckResult
-      - StateChange
 
-    # Event streams can be filtered by attributes using the prefix 'event.'
+  # Decide which events to receive from the event stream.
-    #
+  # The following event stream types are available:
-    # Example for the CheckResult type with the exit_code set to 2:
+  #
-    # filter: "event.check_result.exit_status==2"
+  # * CheckResult
-    #
+  # * StateChange
-    # Example for the CheckResult type with the service matching the string
+  # * Notification
-    # pattern "mysql*":
+  # * AcknowledgementSet
-    # filter: 'match("mysql*", event.service)'
+  # * AcknowledgementCleared
-    #
+  # * CommentAdded
-    # To disable filtering set an empty string or comment out the filter option
+  # * CommentRemoved
-    filter: ""
+  # * DowntimeAdded
+  # * DowntimeRemoved
+  # * DowntimeStarted
+  # * DowntimeTriggered
+  #
+  # To disable eventstream, leave the types empty or comment out the option
+  eventstream.types:
+    - CheckResult
+    - StateChange
+
+  # Event streams can be filtered by attributes using the prefix 'event.'
+  #
+  # Example for the CheckResult type with the exit_code set to 2:
+  # filter: "event.check_result.exit_status==2"
+  #
+  # Example for the CheckResult type with the service matching the string
+  # pattern "mysql*":
+  # filter: 'match("mysql*", event.service)'
+  #
+  # To disable filtering set an empty string or comment out the filter option
+  eventstream.filter: ""
 
     # Defines how fast to reconnect to the API on connection loss
-    retry_interval: 10s
+  eventstream.retry_interval: 10s
 
-  statuspoller:
+  ########################### Icingabeat Statuspoller #########################
-    # Interval at which the status API is called. Set to 0 to disable polling.
+  #
-    interval: 60s
+  # Icingabeat can collect status information about Icinga 2 periodically. Set
+  # an interval at which the status API should be called. Set to 0 to disable
+  # polling.
+  statuspoller.interval: 60s

beater/eventstream.go

@@ -160,10 +160,9 @@ func (es *Eventstream) Run() error {
 			logp.Err("Error connecting to API: %v", responseErr)
 		}
 
-		defer response.Body.Close()
-
 		select {
 		case <-es.done:
+			defer response.Body.Close()
 			return nil
 		case <-ticker.C:
 		}

beater/http.go

@@ -2,7 +2,10 @@ package beater
 
 import (
 	"crypto/tls"
+	"crypto/x509"
 	"errors"
+	"fmt"
+	"io/ioutil"
 	"net/http"
 	"net/url"
 	"time"
@@ -11,8 +14,32 @@ import (
 )
 
 func requestURL(bt *Icingabeat, method string, URL *url.URL) (*http.Response, error) {
+
+	var skipSslVerify bool
+	certPool := x509.NewCertPool()
+
+	if bt.config.SSL.Verify {
+		skipSslVerify = false
+
+		for _, ca := range bt.config.SSL.CertificateAuthorities {
+			cert, err := ioutil.ReadFile(ca)
+			if err != nil {
+				logp.Warn("Could not load certificate: %v", err)
+			}
+			certPool.AppendCertsFromPEM(cert)
+		}
+	} else {
+		skipSslVerify = true
+	}
+
+	fmt.Print(bt.config.SSL.CertificateAuthorities)
+	tlsConfig := &tls.Config{
+		InsecureSkipVerify: skipSslVerify,
+		RootCAs:            certPool,
+	}
+
 	transport := &http.Transport{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: bt.config.SkipSSLVerify},
+		TLSClientConfig: tlsConfig,
 		MaxIdleConns:    10,
 		IdleConnTimeout: 30 * time.Second,
 	}

beater/icingabeat.go

@@ -47,6 +47,7 @@ func (bt *Icingabeat) Run(b *beat.Beat) error {
 		go eventstream.Run()
 	}
 
+	fmt.Print(bt.config.Statuspoller.Interval)
 	if bt.config.Statuspoller.Interval > 0 {
 		var statuspoller *Statuspoller
 		statuspoller = NewStatuspoller(bt, bt.config)

beater/statuspoller.go

@@ -128,13 +128,13 @@ func (sp *Statuspoller) Run() error {
 			logp.Err("Error connecting to API: %v", responseErr)
 		}
 
-		defer response.Body.Close()
-
 		select {
 		case <-sp.done:
+			defer response.Body.Close()
 			return nil
 		case <-ticker.C:
 		}
+
 	}
 }
 

config/config.go

@@ -3,17 +3,25 @@
 
 package config
 
-import "time"
+import (
+	"time"
+)
 
 // Config options
 type Config struct {
-	Host          string             `config:"host"`
+	Host         string             `config:"host"`
-	Port          int                `config:"port"`
+	Port         int                `config:"port"`
-	User          string             `config:"user"`
+	User         string             `config:"user"`
-	Password      string             `config:"password"`
+	Password     string             `config:"password"`
-	SkipSSLVerify bool               `config:"skip_ssl_verify"`
+	SSL          SSL                `config:"ssl"`
-	Eventstream   EventstreamConfig  `config:"eventstream"`
+	Eventstream  EventstreamConfig  `config:"eventstream"`
-	Statuspoller  StatuspollerConfig `config:"statuspoller"`
+	Statuspoller StatuspollerConfig `config:"statuspoller"`
+}
+
+// SSL options
+type SSL struct {
+	Verify                 bool     `config:"verify"`
+	CertificateAuthorities []string `config:"certificate_authorities"`
 }
 
 // EventstreamConfig optoins

icingabeat.reference.yml

@@ -16,51 +16,61 @@ icingabeat:
   # Password of the user
   password: "icinga"
 
-  # Skip SSL verification
+  # Configure SSL verification. If `false` is configured, all server hosts
-  skip_ssl_verify: false
+  # and certificates will be accepted. In this mode, SSL based connections are
+  # susceptible to man-in-the-middle attacks. Use only for testing. Default is
+  # `true`.
+  ssl.verify: true
 
+  # List of root certificates for HTTPS server verifications
+  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
+
+  ########################### Icingabeat Eventstream ##########################
+  #
   # Icingabeat supports capturing of an evenstream and periodical polling of the
   # Icinga status data.
-  eventstream:
-    #
-    # Decide which events to receive from the event stream.
-    # The following event stream types are available:
-    #
-    # * CheckResult
-    # * StateChange
-    # * Notification
-    # * AcknowledgementSet
-    # * AcknowledgementCleared
-    # * CommentAdded
-    # * CommentRemoved
-    # * DowntimeAdded
-    # * DowntimeRemoved
-    # * DowntimeStarted
-    # * DowntimeTriggered
-    #
-    # To disable eventstream, leave the types empty or comment out the option
-    types:
-      - CheckResult
-      - StateChange
 
-    # Event streams can be filtered by attributes using the prefix 'event.'
+  # Decide which events to receive from the event stream.
-    #
+  # The following event stream types are available:
-    # Example for the CheckResult type with the exit_code set to 2:
+  #
-    # filter: "event.check_result.exit_status==2"
+  # * CheckResult
-    #
+  # * StateChange
-    # Example for the CheckResult type with the service matching the string
+  # * Notification
-    # pattern "mysql*":
+  # * AcknowledgementSet
-    # filter: 'match("mysql*", event.service)'
+  # * AcknowledgementCleared
-    #
+  # * CommentAdded
-    # To disable filtering set an empty string or comment out the filter option
+  # * CommentRemoved
-    filter: ""
+  # * DowntimeAdded
+  # * DowntimeRemoved
+  # * DowntimeStarted
+  # * DowntimeTriggered
+  #
+  # To disable eventstream, leave the types empty or comment out the option
+  eventstream.types:
+    - CheckResult
+    - StateChange
+
+  # Event streams can be filtered by attributes using the prefix 'event.'
+  #
+  # Example for the CheckResult type with the exit_code set to 2:
+  # filter: "event.check_result.exit_status==2"
+  #
+  # Example for the CheckResult type with the service matching the string
+  # pattern "mysql*":
+  # filter: 'match("mysql*", event.service)'
+  #
+  # To disable filtering set an empty string or comment out the filter option
+  eventstream.filter: ""
 
     # Defines how fast to reconnect to the API on connection loss
-    retry_interval: 10s
+  eventstream.retry_interval: 10s
 
-  statuspoller:
+  ########################### Icingabeat Statuspoller #########################
-    # Interval at which the status API is called. Set to 0 to disable polling.
+  #
-    interval: 60s
+  # Icingabeat can collect status information about Icinga 2 periodically. Set
+  # an interval at which the status API should be called. Set to 0 to disable
+  # polling.
+  statuspoller.interval: 60s
 
 #================================ General ======================================
 

icingabeat.yml

@@ -16,51 +16,61 @@ icingabeat:
   # Password of the user
   password: "icinga"
 
-  # Skip SSL verification
+  # Configure SSL verification. If `false` is configured, all server hosts
-  skip_ssl_verify: false
+  # and certificates will be accepted. In this mode, SSL based connections are
+  # susceptible to man-in-the-middle attacks. Use only for testing. Default is
+  # `true`.
+  ssl.verify: true
 
+  # List of root certificates for HTTPS server verifications
+  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
+
+  ########################### Icingabeat Eventstream ##########################
+  #
   # Icingabeat supports capturing of an evenstream and periodical polling of the
   # Icinga status data.
-  eventstream:
-    #
-    # Decide which events to receive from the event stream.
-    # The following event stream types are available:
-    #
-    # * CheckResult
-    # * StateChange
-    # * Notification
-    # * AcknowledgementSet
-    # * AcknowledgementCleared
-    # * CommentAdded
-    # * CommentRemoved
-    # * DowntimeAdded
-    # * DowntimeRemoved
-    # * DowntimeStarted
-    # * DowntimeTriggered
-    #
-    # To disable eventstream, leave the types empty or comment out the option
-    types:
-      - CheckResult
-      - StateChange
 
-    # Event streams can be filtered by attributes using the prefix 'event.'
+  # Decide which events to receive from the event stream.
-    #
+  # The following event stream types are available:
-    # Example for the CheckResult type with the exit_code set to 2:
+  #
-    # filter: "event.check_result.exit_status==2"
+  # * CheckResult
-    #
+  # * StateChange
-    # Example for the CheckResult type with the service matching the string
+  # * Notification
-    # pattern "mysql*":
+  # * AcknowledgementSet
-    # filter: 'match("mysql*", event.service)'
+  # * AcknowledgementCleared
-    #
+  # * CommentAdded
-    # To disable filtering set an empty string or comment out the filter option
+  # * CommentRemoved
-    filter: ""
+  # * DowntimeAdded
+  # * DowntimeRemoved
+  # * DowntimeStarted
+  # * DowntimeTriggered
+  #
+  # To disable eventstream, leave the types empty or comment out the option
+  eventstream.types:
+    - CheckResult
+    - StateChange
+
+  # Event streams can be filtered by attributes using the prefix 'event.'
+  #
+  # Example for the CheckResult type with the exit_code set to 2:
+  # filter: "event.check_result.exit_status==2"
+  #
+  # Example for the CheckResult type with the service matching the string
+  # pattern "mysql*":
+  # filter: 'match("mysql*", event.service)'
+  #
+  # To disable filtering set an empty string or comment out the filter option
+  eventstream.filter: ""
 
     # Defines how fast to reconnect to the API on connection loss
-    retry_interval: 10s
+  eventstream.retry_interval: 10s
 
-  statuspoller:
+  ########################### Icingabeat Statuspoller #########################
-    # Interval at which the status API is called. Set to 0 to disable polling.
+  #
-    interval: 60s
+  # Icingabeat can collect status information about Icinga 2 periodically. Set
+  # an interval at which the status API should be called. Set to 0 to disable
+  # polling.
+  statuspoller.interval: 60s
 
 #================================ General =====================================