Skip to content

feat(common.socket): Add option to specify source IP restrictions - #18044

Merged
mstrandboge merged 12 commits into
influxdata:masterfrom
allseas:allowed_sources
Dec 8, 2025
Merged

feat(common.socket): Add option to specify source IP restrictions#18044
mstrandboge merged 12 commits into
influxdata:masterfrom
allseas:allowed_sources

Conversation

@tgulden05

@tgulden05 tgulden05 commented Nov 20, 2025

Copy link
Copy Markdown
Contributor

Summary

The socket input plugin currently accepts data from all sources. This change adds an optional allowed_sources configuration option to the socket plugin that will allow to control which sources can send data to the input plugin. The key motivation is to make sure that only trusted sources contribute to collected data.

Checklist

Related issues

resolves #17995

@telegraf-tiger

Copy link
Copy Markdown
Contributor

Thanks so much for the pull request!
🤝 ✒️ Just a reminder that the CLA has not yet been signed, and we'll need it before merging. Please sign the CLA when you get a chance, then post a comment here saying !signed-cla

@telegraf-tiger telegraf-tiger Bot added the feat Improvement on an existing feature such as adding a new setting/mode to an existing plugin label Nov 20, 2025
@tgulden05

Copy link
Copy Markdown
Contributor Author

!signed-cla

@srebhan srebhan left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this nice feature @tgulden05! I have some suggestions in the code... Furthermore, I want to ask you to also add this feature to the streamListener as I think it also makes sense there...

Comment thread plugins/common/socket/datagram.go Outdated
Comment thread plugins/common/socket/datagram.go Outdated
@srebhan srebhan changed the title feat(common.socket): added allowed_sources configuration option to socket plugin Nov 28, 2025
@srebhan srebhan self-assigned this Nov 28, 2025
@srebhan srebhan added the plugin/input 1. Request for new input plugins 2. Issues/PRs that are related to input plugins label Nov 28, 2025
@tgulden05
tgulden05 requested a review from srebhan December 1, 2025 12:39

@srebhan srebhan left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @tgulden05! Please find some more comments in the code...

Comment thread plugins/common/socket/socket.conf Outdated
Comment thread plugins/common/socket/datagram.go Outdated
Comment thread plugins/common/socket/stream.go Outdated
@srebhan

srebhan commented Dec 4, 2025

Copy link
Copy Markdown
Member

Additionally, we maybe should print the "blocked" IP addresses in "debug" mode (use l.Log.Debugf) to empower users to find out why they miss data...

tgulden05 and others added 4 commits December 4, 2025 11:11
Co-authored-by: Sven Rebhan <36194019+srebhan@users.noreply.github.com>
Co-authored-by: Sven Rebhan <36194019+srebhan@users.noreply.github.com>

@srebhan srebhan left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @tgulden05! Please use onError to notify the socket user about the failing close call!

Comment thread plugins/common/socket/stream.go Outdated
Comment thread plugins/common/socket/stream.go Outdated
Comment thread plugins/common/socket/stream.go Outdated
@telegraf-tiger

telegraf-tiger Bot commented Dec 8, 2025

Copy link
Copy Markdown
Contributor

@srebhan srebhan left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome! Thanks @tgulden05!

@srebhan srebhan added the ready for final review This pull request has been reviewed and/or tested by multiple users and is ready for a final review. label Dec 8, 2025
@srebhan srebhan assigned mstrandboge and unassigned srebhan Dec 8, 2025
@mstrandboge
mstrandboge merged commit 2040e52 into influxdata:master Dec 8, 2025
24 of 27 checks passed
@github-actions github-actions Bot added this to the v1.37.0 milestone Dec 8, 2025
duchieu2k added a commit to svtechnmaa/telegraf that referenced this pull request Jan 22, 2026
* feat(inputs.s7comm): Add option idle_timeout (influxdata#18080)

Co-authored-by: 李金菱 <lijl@engipower.com>

* feat(outputs.nats): Add secret-support for credentials (influxdata#18048)

* feat(inputs.sqlserver): Add support for LPC and named-pipe protocols (influxdata#17924)

* chore(deps): Bump the aws-sdk-go-v2 group with 11 updates (influxdata#18052)

Co-authored-by: Maya Strandboge <mstrandboge@influxdata.com>

* feat(config): Allow specifying env-handling mode for config check (influxdata#18084)

* docs: Improve grammar in global configuration section (influxdata#18078)

Co-authored-by: Sven Rebhan <srebhan@influxdata.com>

* feat(common.socket): Add option to specify source IP restrictions (influxdata#18044)

Co-authored-by: Sven Rebhan <36194019+srebhan@users.noreply.github.com>

* docs(inputs.logql): Clarify sorting and limit example (influxdata#18087)

* docs(plugins): Replace Latin abbreviations with plain English (influxdata#18088)

* chore: Update Go to 1.25.5 (influxdata#18090)

* Update build version to 1.38.0

* Update changelog for v1.37.0

(cherry picked from commit efc64f3)

* chore(deps): Bump the aws-sdk-go-v2 group with 11 updates (influxdata#18091)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump go.step.sm/crypto from 0.74.0 to 0.75.0 (influxdata#18092)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump google.golang.org/api from 0.256.0 to 0.257.0 (influxdata#18104)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump github.com/tinylib/msgp from 1.5.0 to 1.6.1 (influxdata#18103)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump golang.org/x/sys from 0.38.0 to 0.39.0 (influxdata#18096)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump github.com/prometheus/prometheus from 0.307.3 to 0.308.0 (influxdata#18102)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump golang.org/x/mod from 0.30.0 to 0.31.0 (influxdata#18100)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump golang.org/x/term from 0.37.0 to 0.38.0 (influxdata#18099)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump golang.org/x/oauth2 from 0.33.0 to 0.34.0 (influxdata#18095)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump cloud.google.com/go/storage from 1.57.2 to 1.58.0 (influxdata#18094)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump github.com/SAP/go-hdb from 1.14.13 to 1.14.14 (influxdata#18101)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump golang.org/x/sync from 0.18.0 to 0.19.0 (influxdata#18093)

* chore(deps): Bump golang.org/x/text from 0.31.0 to 0.32.0 (influxdata#18097)

* fix(config): Make labels and selectors conform to specification (influxdata#18108)

* chore(deps): Bump golang.org/x/crypto from 0.45.0 to 0.46.0 (influxdata#18098)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* docs(specs): Changes to the labels and selector spec (influxdata#18109)

* docs(config): Fix documentation for labels and selectors (influxdata#18110)

* feat(inputs.mysql): Add replication latency fields (influxdata#18063)

Signed-off-by: Frederik Thuysbaert <frederik.thuysbaert@combell.group>

* chore(deps): Bump github.com/jedib0t/go-pretty/v6 from 6.7.5 to 6.7.7 (influxdata#18132)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump google.golang.org/protobuf from 1.36.10 to 1.36.11 (influxdata#18131)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump github.com/miekg/dns from 1.1.68 to 1.1.69 (influxdata#18130)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump github.com/snowflakedb/gosnowflake from 1.18.0 to 1.18.1 (influxdata#18129)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump k8s.io/api from 0.34.2 to 0.34.3 (influxdata#18128)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump golang.org/x/net from 0.47.0 to 0.48.0 (influxdata#18127)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump k8s.io/client-go from 0.34.2 to 0.34.3 (influxdata#18126)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump cloud.google.com/go/auth from 0.17.0 to 0.18.0 (influxdata#18125)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump tj-actions/changed-files from 47.0.0 to 47.0.1 (influxdata#18120)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump github.com/ClickHouse/clickhouse-go/v2 from 2.41.0 to 2.42.0 (influxdata#18124)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Update golangci-lint to 2.7.2 (influxdata#18115)

* fix(config): Add missing validation for labels in plugins (influxdata#18138)

* chore(deps): Bump the aws-sdk-go-v2 group with 8 updates (influxdata#18121)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump github.com/apache/arrow-go/v18 from 18.4.1 to 18.5.0 (influxdata#18123)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump super-linter/super-linter from 8.3.0 to 8.3.1 (influxdata#18158)

* chore(deps): Bump github.com/BurntSushi/toml from 1.5.0 to 1.6.0 (influxdata#18157)

* chore(deps): Bump k8s.io/apimachinery from 0.34.3 to 0.35.0 (influxdata#18148)

* chore(deps): Bump github.com/nats-io/nats-server/v2 from 2.12.2 to 2.12.3 (influxdata#18149)

* chore(deps): Bump modernc.org/sqlite from 1.40.1 to 1.41.0 (influxdata#18152)

* chore(deps): Bump k8s.io/client-go from 0.34.3 to 0.35.0 (influxdata#18154)

* chore(deps): Bump github.com/prometheus/prometheus from 0.308.0 to 0.308.1 (influxdata#18155)

* chore(deps): Bump the aws-sdk-go-v2 group with 3 updates (influxdata#18146)

* chore(deps): Bump github.com/nats-io/nats.go from 1.47.0 to 1.48.0 (influxdata#18147)

* chore(deps): Bump github.com/lxc/incus/v6 from 6.19.1 to 6.20.0 (influxdata#18150)

* chore(deps): Bump super-linter/super-linter from 8.3.1 to 8.3.2 (influxdata#18174)

* chore(deps): Bump google.golang.org/grpc from 1.77.0 to 1.78.0 (influxdata#18173)

* chore(deps): Bump modernc.org/sqlite from 1.41.0 to 1.42.2 (influxdata#18171)

* chore(deps): Bump github.com/jedib0t/go-pretty/v6 from 6.7.7 to 6.7.8 (influxdata#18169)

* feat(inputs.mysql): Add wsrep provider options fields (influxdata#18117)

* chore(deps): Bump github.com/SAP/go-hdb from 1.14.14 to 1.14.15 (influxdata#18153)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* test(inputs.syslog): Fix test failures with 2025 timestamps (influxdata#18182)

* chore(deps): Bump software.sslmate.com/src/go-pkcs12 from 0.6.0 to 0.7.0 (influxdata#18170)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump github.com/yuin/goldmark from 1.7.13 to 1.7.15 (influxdata#18186)

* chore(deps): Bump github.com/likexian/whois-parser from 1.24.20 to 1.24.21 (influxdata#18187)

* chore(deps): Bump github.com/tinylib/msgp from 1.6.1 to 1.6.3 (influxdata#18188)

* chore(deps): Bump github.com/prometheus/common from 0.67.4 to 0.67.5 (influxdata#18190)

* chore(deps): Bump github.com/likexian/whois from 1.15.6 to 1.15.7 (influxdata#18189)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump github.com/netsampler/goflow2/v2 from 2.2.3 to 2.2.6 (influxdata#18172)

Co-authored-by: Maya Strandboge <mstrandboge@influxdata.com>

* chore(deps): Bump github.com/yuin/goldmark from 1.7.15 to 1.7.16 (influxdata#18201)

* chore(deps): Bump github.com/SAP/go-hdb from 1.14.15 to 1.14.16 (influxdata#18199)

* chore(deps): Bump github.com/gophercloud/gophercloud/v2 from 2.9.0 to 2.10.0 (influxdata#18197)

* chore(deps): Bump github.com/gosnmp/gosnmp from 1.42.1 to 1.43.1 (influxdata#18198)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump github.com/apache/inlong/inlong-sdk/dataproxy-sdk-twins/dataproxy-sdk-golang from 1.0.6 to 1.0.7 (influxdata#18200)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix(outputs.sql): populate column cache for existing tables (influxdata#18191)

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: skartikey <s.kartikey@gmail.com>

* chore(deps): Bump cloud.google.com/go/auth from 0.17.0 to 0.18.0 (influxdata#18140)

* fix(inputs.procstat): Isolate process cache per filter to fix tag collision (influxdata#18144)

* docs(outputs.execd): Document error handling limitations (influxdata#18203)

* Update changelog for v1.37.1

(cherry picked from commit 21fbf76)

* chore(deps): Bump gonum.org/v1/gonum from 0.16.0 to 0.17.0 (influxdata#18217)

* chore(deps): Bump golang.org/x/crypto from 0.46.0 to 0.47.0 (influxdata#18215)

* chore(deps): Bump github.com/miekg/dns from 1.1.69 to 1.1.70 (influxdata#18210)

* chore(deps): Bump cloud.google.com/go/storage from 1.58.0 to 1.59.0 (influxdata#18212)

* chore(deps): Bump the aws-sdk-go-v2 group with 11 updates (influxdata#18204)

* chore(deps): Bump modernc.org/sqlite from 1.42.2 to 1.43.0 (influxdata#18213)

* chore(deps): Bump golang.org/x/mod from 0.31.0 to 0.32.0 (influxdata#18208)

* chore(deps): Bump github.com/gosnmp/gosnmp from 1.43.1 to 1.43.2 (influxdata#18206)

* chore(deps): Bump golang.org/x/net from 0.48.0 to 0.49.0 (influxdata#18207)

* feat(outputs.opentelemetry): Support http protocol (influxdata#17997)

Co-authored-by: Sven Rebhan <36194019+srebhan@users.noreply.github.com>
Co-authored-by: skartikey <s.kartikey@gmail.com>

* chore(deps): Bump github.com/SAP/go-hdb from 1.14.16 to 1.14.17 (influxdata#18216)

* chore(common.http): Embed TransportConfig in HTTPClientConfig (influxdata#18229)

* fix(inputs.statsd): Handle negative lengths (influxdata#18225)

* feat(inputs.nftables): Monitor set element counts (influxdata#18134)

* docs(outputs.sql): Add example configuration for mssql driver (influxdata#18231)

Co-authored-by: skartikey <s.kartikey@gmail.com>

* chore(deps): Bump github.com/sirupsen/logrus from 1.9.3 to 1.9.4 (influxdata#18244)

* chore(deps): Bump cloud.google.com/go/storage from 1.59.0 to 1.59.1 (influxdata#18243)

* chore(deps): Bump modernc.org/sqlite from 1.43.0 to 1.44.2 (influxdata#18241)

* chore(deps): Bump github.com/klauspost/compress from 1.18.2 to 1.18.3 (influxdata#18242)

* chore(deps): Bump github.com/SAP/go-hdb from 1.14.17 to 1.14.18 (influxdata#18236)

* chore(deps): Bump github.com/hashicorp/consul/api from 1.33.0 to 1.33.2 (influxdata#18240)

* chore(deps): Bump github.com/microsoft/go-mssqldb from 1.9.5 to 1.9.6 (influxdata#18239)

* chore(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.20.0 to 1.21.0 (influxdata#18237)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.279.1 to 1.279.2 (influxdata#18235)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix(inputs.nftables): Handle named counter references in JSON output (influxdata#18177)

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Frederik Thuysbaert <frederik.thuysbaert@combell.group>
Co-authored-by: 李金菱 <17816873960@163.com>
Co-authored-by: 李金菱 <lijl@engipower.com>
Co-authored-by: Will_i_code <42240136+w1ll-i-code@users.noreply.github.com>
Co-authored-by: Sven Rebhan <36194019+srebhan@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Maya Strandboge <mstrandboge@influxdata.com>
Co-authored-by: Jason Stirnaman <stirnamanj@gmail.com>
Co-authored-by: Sven Rebhan <srebhan@influxdata.com>
Co-authored-by: T.M.J. Guldenmundt <tim.guldenmundt@xs4all.nl>
Co-authored-by: Jason Stirnaman <jstirnaman@influxdata.com>
Co-authored-by: Maya Strandboge <136023093+mstrandboge@users.noreply.github.com>
Co-authored-by: Neelay Upadhyaya <neelay.upadhyaya@nutanix.com>
Co-authored-by: Frederik Thuysbaert <fretb@users.noreply.github.com>
Co-authored-by: Paweł Żak <pawel.zak.pawel@gmail.com>
Co-authored-by: Ishaan Kalra <108509616+ishaankalra@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: skartikey <s.kartikey@gmail.com>
Co-authored-by: Pascal Zimmermann <pascal.zimmermann01@sap.com>
Co-authored-by: Min Uk Lee <minuk.dev@gmail.com>
Co-authored-by: Thomas Casteleyn <thomas.casteleyn@super-visions.com>
Co-authored-by: ò_ó <donmahallem@users.noreply.github.com>
Co-authored-by: Niklas Fiekas <niklas.fiekas@backscattering.de>
Co-authored-by: OlisCode <oliver-ege@t-online.de>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

feat Improvement on an existing feature such as adding a new setting/mode to an existing plugin plugin/input 1. Request for new input plugins 2. Issues/PRs that are related to input plugins ready for final review This pull request has been reviewed and/or tested by multiple users and is ready for a final review.

3 participants