Cloud azure network virtualnetwork latency by rmorandell-pgum · Pull Request #6145 · centreon/centreon-plugins

rmorandell-pgum · 2026-04-24T16:34:32Z

Community contributors

Description

A latency mode has been added to the plugin.

PingMeshAverageRoundtripMs and PingMeshProbesFailedPercent are monitored as metrics.

I have implemented a process where the available metrics for the resource are first queried via the /providers/microsoft.insights/metricDefinitions endpoint.

for API
https://learn.microsoft.com/en-us/rest/api/monitor/metric-definitions/list?view=rest-monitor-2023-10-01&tabs=HTTP

for CLI
https://learn.microsoft.com/en-us/cli/azure/monitor/metrics?view=azure-cli-latest#az-monitor-metrics-list-definitions

This also allows you to determine the primaryAggregationType and use it if it has not been overridden with --aggregation.

Not all metrics are always available for all regions or features. That is why this is a good dynamic solution.

Type of change

Patch fixing an issue (non-breaking change)
New functionality (non-breaking change)
Functionality enhancement or optimization (non-breaking change)
Breaking change (patch or feature) that might cause side effects breaking part of the Software

How this pull request can be tested ?

use the anonymized debug output to test it

latency.debug.txt

Checklist

I have followed the coding style guidelines provided by Centreon
I have commented my code, especially hard-to-understand areas of the PR.
I have rebased my development branch on the base branch (develop).
I have provide data or shown output displaying the result of this code in the plugin area concerned.

Summary by Aikido

Security Issues: 0	🔍 Quality Issues: 4	Resolved Issues: 0

🚀 New Features

Added latency monitoring mode for virtual network metrics.

⚡ Enhancements

Introduced metrics mapping for PingMesh average and failed percent.
Queried resource metric definitions dynamically via metrics API.
Integrated latency mode into plugin and registered custom modes.
Built full resource path when resource and resource-group were provided.
Added options and aggregation handling with validation and defaults.

^{More info}

…om/i-Vertix/centreon-plugins into cloud-azure-network-virtualnetwork

aikido-pr-checks · 2026-04-29T13:28:58Z

+
+    return if (defined($self->{option_results}->{command_options}) && $self->{option_results}->{command_options} ne '');
+
+    my $cmd_options = "monitor metrics list-definitions --resource '$options{resource}' --only-show-errors --output json";


Command string built in azure_list_resource_metrics_set_cmd interpolates $options{resource} directly into cmd_options; this can lead to command injection when passed to execute. Use safer parameterization or escape/validate input before concatenation.

Details

✨ AI Reasoning
The new azure_list_resource_metrics_set_cmd builds a shell command string by concatenating user-provided options into cmd_options, then that string is passed to execute which runs the Azure CLI. Concatenating untrusted input into shell commands can lead to command injection if inputs (like resource) are attacker-controlled or not validated/escaped. The change introduces a new command construction site using $options{resource} directly. This harms code quality/security because it creates a new vector for injection; fixing would require parameterization or proper escaping of input before embedding in the command string.

🔧 How do I fix it?
Use parameterized queries with placeholders, array-based command execution (no shell interpretation), or properly escaped arguments using vetted libraries. Avoid dynamic queries/commands built with user input concatenation.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}
_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

aikido-pr-checks · 2026-05-04T15:08:23Z

+            $resource_group = $1;
+            $resource_name = $2;
+        } else {
+            $resource = "/subscriptions/" . $self->{az_subscription_id} . "/resourceGroups/" . $resource_group . "/providers/Microsoft.Network/virtualNetworks/" . $resource_name;


User-controlled values ($self->{az_subscription_id}, $resource_group, $resource_name) are concatenated into a resource path string. Avoid building API paths via raw string concatenation of untrusted input; validate or normalize components before use.

Details

✨ AI Reasoning
The code constructs an Azure resource path by concatenating subscription id, resource group, and resource name into a single string. This value originates from user-supplied options (resource and possibly resource_group). Concatenating untrusted inputs into an API resource path can allow crafted values to change the resource being queried or inject unexpected path segments. This is risky because the constructed string is subsequently passed to azure_list_resource_metrics for an API call, and there is no validation, normalization, or escaping of the components before concatenation. The finding focuses on the specific string construction operation introduced in this change.

🔧 How do I fix it?
Use parameterized queries with placeholders, array-based command execution (no shell interpretation), or properly escaped arguments using vetted libraries. Avoid dynamic queries/commands built with user input concatenation.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}
_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

aikido-pr-checks · 2026-05-13T09:06:10Z

+    my ($self, %options) = @_;
+    $self->SUPER::check_options(%options);
+
+    if (!defined($self->{option_results}->{resource}) || $self->{option_results}->{resource} eq '') {


Validation allows --resource without --resource-group, but name-based path construction always uses resource_group. This can build an invalid resource ID while passing check_options.

Show fix

Suggested change

if (!defined($self->{option_results}->{resource}) || $self->{option_results}->{resource} eq '') {

if (!defined($self->{option_results}->{resource}) || $self->{option_results}->{resource} eq '') {

my $resource_is_id = 0;

foreach my $resource (@{$self->{option_results}->{resource}}) {

if ($resource =~ /^\/subscriptions\//) {

$resource_is_id = 1;

last;

}

}

if (!$resource_is_id && (!defined($self->{option_results}->{resource_group}) || $self->{option_results}->{resource_group} eq '')) {

$self->{output}->add_option_msg(short_msg =>

'Need to specify either --resource <name> with --resource-group option or --resource <id>.');

$self->{output}->option_exit();

}

Details

✨ AI Reasoning
The code intends to accept either a full resource ID or a resource name paired with a group. However, the option check only verifies that a resource value exists. In the non-ID branch, it still constructs the resource path using the group value even when that value was never required. This creates an inconsistent control flow where an input explicitly described as invalid can pass validation and then produce an invalid request path.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}
_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

aikido-pr-checks · 2026-05-13T09:06:11Z

+    my ($self, %options) = @_;
+
+    my $url = $self->{management_endpoint};
+    $url .=  "/" . $options{resource} . "/providers/microsoft.insights/metricDefinitions";


Constructing URL with $options{resource} via string concatenation. Use proper encoding/validation for resource inputs before building the URL.

Details

✨ AI Reasoning
A new function constructs a management API URL by concatenating user-provided resource value directly into the path. User-supplied resource strings flow into an HTTP request URL without encoding or validation, allowing control characters or path manipulation. This can lead to unexpected requests or injection-like behaviour when upstream callers pass untrusted input. The problematic change was introduced in the new azure_list_resource_metrics_set_url implementation and is limited to the newly added code.

🔧 How do I fix it?
Use parameterized queries with placeholders, array-based command execution (no shell interpretation), or properly escaped arguments using vetted libraries. Avoid dynamic queries/commands built with user input concatenation.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}
_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

aikido-pr-checks · 2026-05-13T09:06:12Z

+
+            next unless exists $metric_values{$metric};
+
+            push @{$self->{az_metrics}}, $metric;


Appending to $self->{az_metrics} inside the per-resource loop causes the metric list to accumulate across resources; reset/initialize az_metrics per resource to avoid redundant, growing metric queries.

Details

✨ AI Reasoning
The code iterates over each provided resource and, for each resource, appends matching metric names into $self->{az_metrics} using 'push @{$self->{az_metrics}}, $metric'. There is no reset/initialization of $self->{az_metrics} inside the per-resource loop, so when multiple resources are processed the metrics list will accumulate values from prior resources. This makes subsequent calls (azure_get_metrics) request an ever-growing set of metrics for each resource, increasing network and processing cost as the number of resources increases. The issue is introduced by the added line that pushes into $self->{az_metrics} inside the resource loop.

🔧 How do I fix it?
Move constant work outside loops. Use StringBuilder instead of string concatenation in loops. Cache compiled regex patterns. Use hash-based lookups instead of nested loops. Batch database operations instead of N+1 queries.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}
_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

rmorandell-pgum and others added 5 commits April 24, 2026 18:19

cloud::azure::network::virtualnetwork

d13976b

Merge branch 'centreon:develop' into cloud-azure-network-virtualnetwork

b81e08e

remove custom status output

d03b42e

Merge branch 'cloud-azure-network-virtualnetwork' of https://github.c…

bd7b627

…om/i-Vertix/centreon-plugins into cloud-azure-network-virtualnetwork

custom API extension

898d0e2

rmorandell-pgum requested review from a team as code owners April 24, 2026 16:34

rmorandell-pgum requested review from Evan-Adam and bouda1 April 24, 2026 16:34

github-actions Bot added the external label Apr 24, 2026

lucie-tirand added enhancement Enhance existing in-backlog contribution labels Apr 27, 2026

azure_list_resource_metrics() in azcli

c9b589e

aikido-pr-checks Bot reviewed Apr 29, 2026

View reviewed changes

rmorandell-pgum added 2 commits April 30, 2026 16:58

display_ok

6784f5c

build resource path when --resource & --resourcegroup as options

5a3e6ff

aikido-pr-checks Bot reviewed May 4, 2026

View reviewed changes

fix: use metric_name not the label name

0356172

aikido-pr-checks Bot reviewed May 13, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Cloud azure network virtualnetwork latency#6145

Cloud azure network virtualnetwork latency#6145
rmorandell-pgum wants to merge 9 commits into
centreon:developfrom
i-Vertix:cloud-azure-network-virtualnetwork

rmorandell-pgum commented Apr 24, 2026 •

edited by aikido-pr-checks Bot

Loading

Uh oh!

aikido-pr-checks Bot Apr 29, 2026

Uh oh!

aikido-pr-checks Bot May 4, 2026

Uh oh!

aikido-pr-checks Bot May 13, 2026 •

edited

Loading

Uh oh!

aikido-pr-checks Bot May 13, 2026

Uh oh!

aikido-pr-checks Bot May 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		return if (defined($self->{option_results}->{command_options}) && $self->{option_results}->{command_options} ne '');

		my $cmd_options = "monitor metrics list-definitions --resource '$options{resource}' --only-show-errors --output json";

-    if (!defined($self->{option_results}->{resource}) || $self->{option_results}->{resource} eq '') {
+    if (!defined($self->{option_results}->{resource}) || $self->{option_results}->{resource} eq '') {
+    my $resource_is_id = 0;
+    foreach my $resource (@{$self->{option_results}->{resource}}) {
+        if ($resource =~ /^\/subscriptions\//) {
+            $resource_is_id = 1;
+            last;
+        }
+    }
+    if (!$resource_is_id && (!defined($self->{option_results}->{resource_group}) || $self->{option_results}->{resource_group} eq '')) {
+        $self->{output}->add_option_msg(short_msg =>
+            'Need to specify either --resource <name> with --resource-group option or --resource <id>.');
+        $self->{output}->option_exit();
+    }


		next unless exists $metric_values{$metric};

		push @{$self->{az_metrics}}, $metric;

Conversation

rmorandell-pgum commented Apr 24, 2026 • edited by aikido-pr-checks Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Community contributors

Description

Type of change

How this pull request can be tested ?

Checklist

Summary by Aikido

Uh oh!

aikido-pr-checks Bot Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot May 4, 2026

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot May 13, 2026

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot May 13, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

rmorandell-pgum commented Apr 24, 2026 •

edited by aikido-pr-checks Bot

Loading

aikido-pr-checks Bot May 13, 2026 •

edited

Loading