Skip to content

Commit 8ae7523

Browse files
LordHepipudLordHepipud
authored
Merge pull request #441 from Icinga:feature/adds_support_for_http_check_to_disable_tls_checks
Feature: Adds support for `Invoke-IcingaCheckHTTPStatus` to allow for ignoring SSL/TLS errors Adds support for `Invoke-IcingaCheckHTTPStatus` to allow for ignoring SSL/TLS errors
2 parents 5d3a24d + 39cf5aa commit 8ae7523

9 files changed

+45
-12
lines changed

‎config/director/Invoke-IcingaCheckHTTPStatus.json

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

‎config/director/Plugins_Bundle.json

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

‎config/icinga/Invoke-IcingaCheckHTTPStatus.conf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -178,6 +178,10 @@ object CheckCommand "Invoke-IcingaCheckHTTPStatus" {
178178
value = "$IcingaCheckHTTPStatus_Object_Critical$"
179179
order = 3
180180
}
181+
"-IgnoreSSL" = {
182+
set_if = "$IcingaCheckHTTPStatus_Switchparameter_IgnoreSSL$"
183+
order = 99
184+
}
181185
"-Headers" = {
182186
description = "Used to specify headers as Array. Like: -Headers 'Accept:application/json'"
183187
value = {{
@@ -266,6 +270,9 @@ object CheckCommand "Invoke-IcingaCheckHTTPStatus" {
266270
"AddOutputContent" = {
267271
set_if = "$IcingaCheckHTTPStatus_Switchparameter_AddOutputContent$"
268272
}
273+
"IgnoreSSL" = {
274+
set_if = "$IcingaCheckHTTPStatus_Switchparameter_IgnoreSSL$"
275+
}
269276
"ProxyUsername" = {
270277
value = "$IcingaCheckHTTPStatus_String_ProxyUsername$"
271278
}
@@ -299,6 +306,7 @@ object CheckCommand "Invoke-IcingaCheckHTTPStatus" {
299306
}
300307
vars.IcingaCheckHTTPStatus_Switchparameter_AddOutputContent = false
301308
vars.IcingaCheckHTTPStatus_Switchparameter_ConnectionErrAsCrit = false
309+
vars.IcingaCheckHTTPStatus_Switchparameter_IgnoreSSL = false
302310
vars.ifw_api_command = "invoke-icingacheckhttpstatus"
303311
vars.IcingaCheckHTTPStatus_Switchparameter_Negate = false
304312
}

‎config/icinga/Plugins_Bundle.conf

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -871,6 +871,10 @@ object CheckCommand "Invoke-IcingaCheckHTTPStatus" {
871871
value = "$IcingaCheckHTTPStatus_Object_Critical$"
872872
order = 3
873873
}
874+
"-IgnoreSSL" = {
875+
set_if = "$IcingaCheckHTTPStatus_Switchparameter_IgnoreSSL$"
876+
order = 99
877+
}
874878
"-Headers" = {
875879
description = "Used to specify headers as Array. Like: -Headers 'Accept:application/json'"
876880
value = {{
@@ -959,6 +963,9 @@ object CheckCommand "Invoke-IcingaCheckHTTPStatus" {
959963
"AddOutputContent" = {
960964
set_if = "$IcingaCheckHTTPStatus_Switchparameter_AddOutputContent$"
961965
}
966+
"IgnoreSSL" = {
967+
set_if = "$IcingaCheckHTTPStatus_Switchparameter_IgnoreSSL$"
968+
}
962969
"ProxyUsername" = {
963970
value = "$IcingaCheckHTTPStatus_String_ProxyUsername$"
964971
}
@@ -992,6 +999,7 @@ object CheckCommand "Invoke-IcingaCheckHTTPStatus" {
992999
}
9931000
vars.IcingaCheckHTTPStatus_Switchparameter_AddOutputContent = false
9941001
vars.IcingaCheckHTTPStatus_Switchparameter_ConnectionErrAsCrit = false
1002+
vars.IcingaCheckHTTPStatus_Switchparameter_IgnoreSSL = false
9951003
vars.ifw_api_command = "invoke-icingacheckhttpstatus"
9961004
vars.IcingaCheckHTTPStatus_Switchparameter_Negate = false
9971005
}
@@ -3648,7 +3656,7 @@ object CheckCommand "Invoke-IcingaCheckUNCPath" {
36483656

36493657
arguments += {
36503658
"-WarningTotal" = {
3651-
description = "A warning threshold for the shares total free space in byte units, like '50GB:' Please note that this value is decreasing over time, therefor you will have to use the plugin handler and add ':' at the end of your input to check for 'current value < threshold' like in the previous example Allowed units: B, KB, MB, GB, TB, PB, KiB, MiB, GiB, TiB, PiB"
3659+
description = "A warning threshold for the shares free space in either % or byte units, like '20%:' or '50GB:' Please note that this value is decreasing over time, therefor you will have to use the plugin handler and add ':' at the end of your input to check for 'current value < threshold' like in the previous example Allowed units: %, B, KB, MB, GB, TB, PB, KiB, MiB, GiB, TiB, PiB"
36523660
value = "$IcingaCheckUNCPath_Object_WarningTotal$"
36533661
order = 8
36543662
}
@@ -3955,7 +3963,7 @@ object CheckCommand "Invoke-IcingaCheckICMP" {
39553963

39563964
arguments += {
39573965
"-WarningPl" = {
3958-
description = "Threshold on which the plugin will return 'WARNING' for possible packet loss in %"
3966+
description = "Threshold on which the plugin will return 'WARNING' for the response time in ms"
39593967
value = "$IcingaCheckICMP_Object_WarningPl$"
39603968
order = 4
39613969
}
@@ -4969,7 +4977,7 @@ object CheckCommand "Invoke-IcingaCheckUpdates" {
49694977

49704978
arguments += {
49714979
"-WarningRollups" = {
4972-
description = "The warning threshold for the rollup update count on the Windows machine"
4980+
description = "The warning threshold for the total pending update count on the Windows machine"
49734981
value = "$IcingaCheckUpdates_Object_WarningRollups$"
49744982
order = 7
49754983
}
@@ -4992,7 +5000,7 @@ object CheckCommand "Invoke-IcingaCheckUpdates" {
49925000
order = 12
49935001
}
49945002
"-WarningDefender" = {
4995-
description = "The warning threshold for the Microsoft Defender update count on the Windows machine"
5003+
description = "The warning threshold for the total pending update count on the Windows machine"
49965004
value = "$IcingaCheckUpdates_Object_WarningDefender$"
49975005
order = 9
49985006
}
@@ -5015,7 +5023,7 @@ object CheckCommand "Invoke-IcingaCheckUpdates" {
50155023
order = 100
50165024
}
50175025
"-WarningOther" = {
5018-
description = "The warning threshold for all other updates on the Windows machine"
5026+
description = "The warning threshold for the total pending update count on the Windows machine"
50195027
value = "$IcingaCheckUpdates_Object_WarningOther$"
50205028
order = 11
50215029
}
@@ -5067,7 +5075,7 @@ object CheckCommand "Invoke-IcingaCheckUpdates" {
50675075
order = 2
50685076
}
50695077
"-WarningSecurity" = {
5070-
description = "The warning threshold for the security update count on the Windows machine"
5078+
description = "The warning threshold for the total pending update count on the Windows machine"
50715079
value = "$IcingaCheckUpdates_Object_WarningSecurity$"
50725080
order = 5
50735081
}

‎doc/31-Changelog.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ Released closed milestones can be found on [GitHub](https://github.com/Icinga/ic
2525
### Enhancements
2626

2727
* [#408](https://github.com/Icinga/icinga-powershell-plugins/issues/408) Adds support for `Invoke-IcingaCheckDiskHealth` to filter disks by their friendly name
28+
* [#430](https://github.com/Icinga/icinga-powershell-plugins/issues/430) Adds support for `Invoke-IcingaCheckHTTPStatus` to allow for ignoring SSL/TLS errors
2829

2930
## 1.13.0 (2025-01-30)
3031

‎doc/plugins/25-Invoke-IcingaCheckHTTPStatus.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ No special permissions required.
3232
| Negate | SwitchParameter | false | False | A switch used to invert check results. |
3333
| AddOutputContent | SwitchParameter | false | False | Adds the returned content of a website to the plugin output for debugging purpose |
3434
| ConnectionErrAsCrit | SwitchParameter | false | False | By default the plugin will return UNKNOWN in case a connection to a webserver is not possible. By using this<br /> flag, the result will be modified from UNKNOWN to CRITICAL |
35+
| IgnoreSSL | SwitchParameter | false | False | Use this flag to ignore SSL errors in case your endpoints are not trusted by the client or you are using self-signed certificates. |
3536
| NoPerfData | SwitchParameter | false | False | Used to disable PerfData. |
3637
| Verbosity | Int32 | false | 0 | Changes the behavior of the plugin output which check states are printed:<br /> 0 (default): Only service checks/packages with state not OK will be printed<br /> 1: Only services with not OK will be printed including OK checks of affected check packages including Package config<br /> 2: Everything will be printed regardless of the check state<br /> 3: Identical to Verbose 2, but prints in addition the check package configuration e.g (All must be [OK]) |
3738
| ThresholdInterval | String | | | Change the value your defined threshold checks against from the current value to a collected time threshold of the Icinga for Windows daemon, as described [here](https://icinga.com/docs/icinga-for-windows/latest/doc/110-Installation/06-Collect-Metrics-over-Time/). An example for this argument would be 1m or 15m which will use the average of 1m or 15m for monitoring. |

‎plugins/Invoke-IcingaCheckHTTPStatus.psm1

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,8 @@
6666
.PARAMETER ConnectionErrAsCrit
6767
By default the plugin will return UNKNOWN in case a connection to a webserver is not possible. By using this
6868
flag, the result will be modified from UNKNOWN to CRITICAL
69+
.PARAMETER IgnoreSSL
70+
Use this flag to ignore SSL errors in case your endpoints are not trusted by the client or you are using self-signed certificates.
6971
.PARAMETER NoPerfData
7072
Used to disable PerfData.
7173
.PARAMETER Verbosity
@@ -105,12 +107,13 @@ function Invoke-IcingaCheckHTTPStatus()
105107
[switch]$Negate = $FALSE,
106108
[switch]$AddOutputContent = $FALSE,
107109
[switch]$ConnectionErrAsCrit = $FALSE,
110+
[switch]$IgnoreSSL = $FALSE,
108111
[switch]$NoPerfData,
109112
[ValidateSet(0, 1, 2, 3)]
110113
[int]$Verbosity = 0
111114
)
112115

113-
$HTTPData = (Get-IcingaCheckHTTPQuery -Url $Url -VHost $VHost -Headers $Headers -Timeout $Timeout -Username $Username -Password $Password -ProxyUsername $ProxyUsername -ProxyPassword $ProxyPassword -ProxyServer $ProxyServer -Content $Content -StatusCode $StatusCode -ConnectionErrAsCrit:$ConnectionErrAsCrit);
116+
$HTTPData = (Get-IcingaCheckHTTPQuery -Url $Url -VHost $VHost -Headers $Headers -Timeout $Timeout -Username $Username -Password $Password -ProxyUsername $ProxyUsername -ProxyPassword $ProxyPassword -ProxyServer $ProxyServer -Content $Content -StatusCode $StatusCode -ConnectionErrAsCrit:$ConnectionErrAsCrit -IgnoreSSL:$IgnoreSSL -Verbose $Verbosity);
114117

115118
# In case -Minimum isn't set, implied -OperatorAnd
116119
if ($Minimum -eq -1) {

‎provider/http/Get-IcingaCheckHTTPQuery.psm1

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,8 @@ function Get-IcingaCheckHTTPQuery()
1212
[string]$ProxyServer = '',
1313
[array]$Content = @(),
1414
[array]$StatusCode = @(),
15-
[switch]$ConnectionErrAsCrit = $FALSE
15+
[switch]$ConnectionErrAsCrit = $FALSE,
16+
[switch]$IgnoreSSL = $FALSE
1617
);
1718

1819
if ($Url.count -eq 0) {
@@ -72,8 +73,11 @@ function Get-IcingaCheckHTTPQuery()
7273
) -Force;
7374
}
7475

75-
# Receive information
76+
if ($IgnoreSSL) {
77+
Enable-IcingaUntrustedCertificateValidation -SuppressMessages;
78+
}
7679

80+
# Receive information
7781
Start-IcingaTimer -Name 'HTTPRequest';
7882
try {
7983
$HTTPInformation = (Invoke-WebRequest @InvokeArguments);
@@ -90,6 +94,10 @@ function Get-IcingaCheckHTTPQuery()
9094
}
9195
Stop-IcingaTimer -Name 'HTTPRequest';
9296

97+
if ($IgnoreSSL) {
98+
Disable-IcingaUntrustedCertificateValidation -SuppressMessages;
99+
}
100+
93101
[hashtable]$HTTPData = @{ };
94102

95103
if (-Not [string]::IsNullOrEmpty($HTTPInformation.Content)) {

‎provider/httpJson/Get-IcingaHttpResponse.psm1

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,11 +35,15 @@ function Global:Get-IcingaHttpResponse()
3535
Set-IcingaTLSVersion;
3636

3737
if ($IgnoreSSL) {
38-
Enable-IcingaUntrustedCertificateValidation;
38+
Enable-IcingaUntrustedCertificateValidation -SuppressMessages;
3939
}
4040

4141
$response = Invoke-RestMethod -Uri $URI -Method Get -Headers $authHeader -TimeoutSec $Timeout;
4242

43+
if ($IgnoreSSL) {
44+
Disable-IcingaUntrustedCertificateValidation -SuppressMessages;
45+
}
46+
4347
Write-IcingaDebugMessage -Message 'Response: {0}' -Objects $response;
4448

4549
return $response;

0 commit comments

Comments
 (0)