Add option to allow custom CAs

closes #14

_meta/beat.yml

@@ -16,13 +16,20 @@ icingabeat:
   # Password of the user
   password: "icinga"
 
-  # Skip SSL verification
-  skip_ssl_verify: false
+  # Configure SSL verification. If `false` is configured, all server hosts
+  # and certificates will be accepted. In this mode, SSL based connections are
+  # susceptible to man-in-the-middle attacks. Use only for testing. Default is
+  # `true`.
+  ssl.verify: true
 
+  # List of root certificates for HTTPS server verifications
+  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
+
+  ########################### Icingabeat Eventstream ##########################
+  #
   # Icingabeat supports capturing of an evenstream and periodical polling of the
   # Icinga status data.
-  eventstream:
-    #
+
   # Decide which events to receive from the event stream.
   # The following event stream types are available:
   #
@@ -39,7 +46,7 @@ icingabeat:
   # * DowntimeTriggered
   #
   # To disable eventstream, leave the types empty or comment out the option
-    types:
+  eventstream.types:
     - CheckResult
     - StateChange
 
@@ -53,11 +60,14 @@ icingabeat:
   # filter: 'match("mysql*", event.service)'
   #
   # To disable filtering set an empty string or comment out the filter option
-    filter: ""
+  eventstream.filter: ""
 
     # Defines how fast to reconnect to the API on connection loss
-    retry_interval: 10s
+  eventstream.retry_interval: 10s
 
-  statuspoller:
-    # Interval at which the status API is called. Set to 0 to disable polling.
-    interval: 60s
+  ########################### Icingabeat Statuspoller #########################
+  #
+  # Icingabeat can collect status information about Icinga 2 periodically. Set
+  # an interval at which the status API should be called. Set to 0 to disable
+  # polling.
+  statuspoller.interval: 60s

beater/eventstream.go

@@ -160,10 +160,9 @@ func (es *Eventstream) Run() error {
 			logp.Err("Error connecting to API: %v", responseErr)
 		}
 
-		defer response.Body.Close()
-
 		select {
 		case <-es.done:
+			defer response.Body.Close()
 			return nil
 		case <-ticker.C:
 		}

beater/http.go

@@ -2,7 +2,10 @@ package beater
 
 import (
 	"crypto/tls"
+	"crypto/x509"
 	"errors"
+	"fmt"
+	"io/ioutil"
 	"net/http"
 	"net/url"
 	"time"
@@ -11,8 +14,32 @@ import (
 )
 
 func requestURL(bt *Icingabeat, method string, URL *url.URL) (*http.Response, error) {
+
+	var skipSslVerify bool
+	certPool := x509.NewCertPool()
+
+	if bt.config.SSL.Verify {
+		skipSslVerify = false
+
+		for _, ca := range bt.config.SSL.CertificateAuthorities {
+			cert, err := ioutil.ReadFile(ca)
+			if err != nil {
+				logp.Warn("Could not load certificate: %v", err)
+			}
+			certPool.AppendCertsFromPEM(cert)
+		}
+	} else {
+		skipSslVerify = true
+	}
+
+	fmt.Print(bt.config.SSL.CertificateAuthorities)
+	tlsConfig := &tls.Config{
+		InsecureSkipVerify: skipSslVerify,
+		RootCAs:            certPool,
+	}
+
 	transport := &http.Transport{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: bt.config.SkipSSLVerify},
+		TLSClientConfig: tlsConfig,
 		MaxIdleConns:    10,
 		IdleConnTimeout: 30 * time.Second,
 	}

beater/icingabeat.go

@@ -47,6 +47,7 @@ func (bt *Icingabeat) Run(b *beat.Beat) error {
 		go eventstream.Run()
 	}
 
+	fmt.Print(bt.config.Statuspoller.Interval)
 	if bt.config.Statuspoller.Interval > 0 {
 		var statuspoller *Statuspoller
 		statuspoller = NewStatuspoller(bt, bt.config)

beater/statuspoller.go

@@ -128,13 +128,13 @@ func (sp *Statuspoller) Run() error {
 			logp.Err("Error connecting to API: %v", responseErr)
 		}
 
-		defer response.Body.Close()
-
 		select {
 		case <-sp.done:
+			defer response.Body.Close()
 			return nil
 		case <-ticker.C:
 		}
+
 	}
 }
 

config/config.go

@@ -3,7 +3,9 @@
 
 package config
 
-import "time"
+import (
+	"time"
+)
 
 // Config options
 type Config struct {
@@ -11,11 +13,17 @@ type Config struct {
 	Port         int                `config:"port"`
 	User         string             `config:"user"`
 	Password     string             `config:"password"`
-	SkipSSLVerify bool               `config:"skip_ssl_verify"`
+	SSL          SSL                `config:"ssl"`
 	Eventstream  EventstreamConfig  `config:"eventstream"`
 	Statuspoller StatuspollerConfig `config:"statuspoller"`
 }
 
+// SSL options
+type SSL struct {
+	Verify                 bool     `config:"verify"`
+	CertificateAuthorities []string `config:"certificate_authorities"`
+}
+
 // EventstreamConfig optoins
 type EventstreamConfig struct {
 	Types         []string      `config:"types"`

icingabeat.reference.yml

@@ -16,13 +16,20 @@ icingabeat:
   # Password of the user
   password: "icinga"
 
-  # Skip SSL verification
-  skip_ssl_verify: false
+  # Configure SSL verification. If `false` is configured, all server hosts
+  # and certificates will be accepted. In this mode, SSL based connections are
+  # susceptible to man-in-the-middle attacks. Use only for testing. Default is
+  # `true`.
+  ssl.verify: true
 
+  # List of root certificates for HTTPS server verifications
+  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
+
+  ########################### Icingabeat Eventstream ##########################
+  #
   # Icingabeat supports capturing of an evenstream and periodical polling of the
   # Icinga status data.
-  eventstream:
-    #
+
   # Decide which events to receive from the event stream.
   # The following event stream types are available:
   #
@@ -39,7 +46,7 @@ icingabeat:
   # * DowntimeTriggered
   #
   # To disable eventstream, leave the types empty or comment out the option
-    types:
+  eventstream.types:
     - CheckResult
     - StateChange
 
@@ -53,14 +60,17 @@ icingabeat:
   # filter: 'match("mysql*", event.service)'
   #
   # To disable filtering set an empty string or comment out the filter option
-    filter: ""
+  eventstream.filter: ""
 
     # Defines how fast to reconnect to the API on connection loss
-    retry_interval: 10s
+  eventstream.retry_interval: 10s
 
-  statuspoller:
-    # Interval at which the status API is called. Set to 0 to disable polling.
-    interval: 60s
+  ########################### Icingabeat Statuspoller #########################
+  #
+  # Icingabeat can collect status information about Icinga 2 periodically. Set
+  # an interval at which the status API should be called. Set to 0 to disable
+  # polling.
+  statuspoller.interval: 60s
 
 #================================ General ======================================
 

icingabeat.yml

@@ -16,13 +16,20 @@ icingabeat:
   # Password of the user
   password: "icinga"
 
-  # Skip SSL verification
-  skip_ssl_verify: false
+  # Configure SSL verification. If `false` is configured, all server hosts
+  # and certificates will be accepted. In this mode, SSL based connections are
+  # susceptible to man-in-the-middle attacks. Use only for testing. Default is
+  # `true`.
+  ssl.verify: true
 
+  # List of root certificates for HTTPS server verifications
+  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
+
+  ########################### Icingabeat Eventstream ##########################
+  #
   # Icingabeat supports capturing of an evenstream and periodical polling of the
   # Icinga status data.
-  eventstream:
-    #
+
   # Decide which events to receive from the event stream.
   # The following event stream types are available:
   #
@@ -39,7 +46,7 @@ icingabeat:
   # * DowntimeTriggered
   #
   # To disable eventstream, leave the types empty or comment out the option
-    types:
+  eventstream.types:
     - CheckResult
     - StateChange
 
@@ -53,14 +60,17 @@ icingabeat:
   # filter: 'match("mysql*", event.service)'
   #
   # To disable filtering set an empty string or comment out the filter option
-    filter: ""
+  eventstream.filter: ""
 
     # Defines how fast to reconnect to the API on connection loss
-    retry_interval: 10s
+  eventstream.retry_interval: 10s
 
-  statuspoller:
-    # Interval at which the status API is called. Set to 0 to disable polling.
-    interval: 60s
+  ########################### Icingabeat Statuspoller #########################
+  #
+  # Icingabeat can collect status information about Icinga 2 periodically. Set
+  # an interval at which the status API should be called. Set to 0 to disable
+  # polling.
+  statuspoller.interval: 60s
 
 #================================ General =====================================