Skip to content

Commit 4fc67c9

Browse files
author
Julien Pivotto
committed
Basic auth: add metrics
Signed-off-by: Julien Pivotto <[email protected]>
1 parent 4aee5b2 commit 4fc67c9

File tree

4 files changed

+31
-9
lines changed

4 files changed

+31
-9
lines changed

go.mod

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ go 1.14
55
require (
66
github.com/go-kit/kit v0.10.0
77
github.com/pkg/errors v0.9.1
8+
github.com/prometheus/client_golang v1.7.1
89
github.com/prometheus/common v0.15.0
910
golang.org/x/crypto v0.0.0-20201208171446-5f87f3452ae9
1011
gopkg.in/alecthomas/kingpin.v2 v2.2.6

https/tls_config.go

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ import (
2626
"github.com/go-kit/kit/log"
2727
"github.com/go-kit/kit/log/level"
2828
"github.com/pkg/errors"
29+
"github.com/prometheus/client_golang/prometheus"
2930
config_util "github.com/prometheus/common/config"
3031
"gopkg.in/yaml.v2"
3132
)
@@ -176,18 +177,18 @@ func ConfigToTLSConfig(c *TLSStruct) (*tls.Config, error) {
176177

177178
// Listen starts the server on the given address. Based on the file
178179
// tlsConfigPath, TLS or basic auth could be enabled.
179-
func Listen(server *http.Server, tlsConfigPath string, logger log.Logger) error {
180+
func Listen(server *http.Server, tlsConfigPath string, logger log.Logger, r prometheus.Registerer) error {
180181
listener, err := net.Listen("tcp", server.Addr)
181182
if err != nil {
182183
return err
183184
}
184185
defer listener.Close()
185-
return Serve(listener, server, tlsConfigPath, logger)
186+
return Serve(listener, server, tlsConfigPath, logger, r)
186187
}
187188

188189
// Server starts the server on the given listener. Based on the file
189190
// tlsConfigPath, TLS or basic auth could be enabled.
190-
func Serve(l net.Listener, server *http.Server, tlsConfigPath string, logger log.Logger) error {
191+
func Serve(l net.Listener, server *http.Server, tlsConfigPath string, logger log.Logger, r prometheus.Registerer) error {
191192
if tlsConfigPath == "" {
192193
level.Info(logger).Log("msg", "TLS is disabled.", "http2", false)
193194
return server.Serve(l)
@@ -202,11 +203,13 @@ func Serve(l net.Listener, server *http.Server, tlsConfigPath string, logger log
202203
if server.Handler != nil {
203204
handler = server.Handler
204205
}
205-
server.Handler = &userAuthRoundtrip{
206+
urt := &userAuthRoundtrip{
206207
tlsConfigPath: tlsConfigPath,
207208
logger: logger,
208209
handler: handler,
209210
}
211+
urt.instrument(r)
212+
server.Handler = urt
210213

211214
c, err := getConfig(tlsConfigPath)
212215
if err != nil {

https/tls_config_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -319,7 +319,7 @@ func TestConfigReloading(t *testing.T) {
319319
recordConnectionError(errors.New("Panic starting server"))
320320
}
321321
}()
322-
err := Listen(server, badYAMLPath, testlogger)
322+
err := Listen(server, badYAMLPath, testlogger, nil)
323323
recordConnectionError(err)
324324
}()
325325

@@ -391,7 +391,7 @@ func (test *TestInputs) Test(t *testing.T) {
391391
recordConnectionError(errors.New("Panic starting server"))
392392
}
393393
}()
394-
err := Listen(server, test.YAMLConfigPath, testlogger)
394+
err := Listen(server, test.YAMLConfigPath, testlogger, nil)
395395
recordConnectionError(err)
396396
}()
397397

https/users.go

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ import (
1717
"net/http"
1818

1919
"github.com/go-kit/kit/log"
20+
"github.com/prometheus/client_golang/prometheus"
2021
"golang.org/x/crypto/bcrypt"
2122
)
2223

@@ -37,14 +38,30 @@ func validateUsers(configPath string) error {
3738
}
3839

3940
type userAuthRoundtrip struct {
40-
tlsConfigPath string
41-
handler http.Handler
42-
logger log.Logger
41+
tlsConfigPath string
42+
handler http.Handler
43+
logger log.Logger
44+
failuresCounter prometheus.Counter
45+
}
46+
47+
func (u *userAuthRoundtrip) instrument(r prometheus.Registerer) {
48+
u.failuresCounter = prometheus.NewCounter(
49+
prometheus.CounterOpts{
50+
Namespace: "prometheus_toolkit",
51+
Subsystem: "https",
52+
Name: "request_basic_authentication_failures_total",
53+
Help: "Total number of requests rejected by basic authentication because of wrong username, password, or configuration.",
54+
},
55+
)
56+
if r != nil {
57+
r.MustRegister(u.failuresCounter)
58+
}
4359
}
4460

4561
func (u *userAuthRoundtrip) ServeHTTP(w http.ResponseWriter, r *http.Request) {
4662
c, err := getConfig(u.tlsConfigPath)
4763
if err != nil {
64+
u.failuresCounter.Inc()
4865
u.logger.Log("msg", "Unable to parse configuration", "err", err)
4966
http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
5067
return
@@ -65,6 +82,7 @@ func (u *userAuthRoundtrip) ServeHTTP(w http.ResponseWriter, r *http.Request) {
6582
}
6683
}
6784

85+
u.failuresCounter.Inc()
6886
w.Header().Set("WWW-Authenticate", "Basic")
6987
http.Error(w, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
7088
}

0 commit comments

Comments
 (0)