prober: Add SOCKS5 proxy support to TCP prober

[ivankatliarchuk]

What this PR does / Which issue(s) does the PR fix:

Fixes #1364

The TCP prober had no way to route connections through a proxy, blocking use cases where targets are only reachable via SOCKS5 (e.g. internal/zero-trust endpoints behind a corporate proxy).

• Add proxy_url, proxy_username, proxy_password fields to TCPProbe config
• When proxy is set, skip local DNS resolution and dial through the proxy via golang.org/x/net/proxy
• Support env var expansion in config file for credentials (${VAR})
• Add TestTCPConnectionWithSOCKS5Proxy test with a minimal in-process SOCKS5 server

Does this PR introduce a user-facing change?

No

Add proxy_url, proxy_username, proxy_password fields to TCPProbe config
Support env var expansion in config file for credentials (${VAR})

Checklist

• Tests updated
• Documentation added
• CHANGELOG added in release-notes section of PR Desc.

[ivankatliarchuk]

Tested with and without credentials

Results

Logs for the probe:



Metrics that would have been returned:
# HELP probe_duration_seconds Returns how long the probe took to complete in seconds
# TYPE probe_duration_seconds gauge
probe_duration_seconds 0.042730917
# HELP probe_failed_due_to_bytes Indicates if probe failed due to bytes
# TYPE probe_failed_due_to_bytes gauge
probe_failed_due_to_bytes 0
# HELP probe_failed_due_to_regex Indicates if probe failed due to regex
# TYPE probe_failed_due_to_regex gauge
probe_failed_due_to_regex 0
# HELP probe_ssl_earliest_cert_expiry Returns last SSL chain expiry in unixtime
# TYPE probe_ssl_earliest_cert_expiry gauge
probe_ssl_earliest_cert_expiry 1.77878507e+09
# HELP probe_ssl_last_chain_expiry_timestamp_seconds Returns last SSL chain expiry in timestamp
# TYPE probe_ssl_last_chain_expiry_timestamp_seconds gauge
probe_ssl_last_chain_expiry_timestamp_seconds -6.21355968e+10
# HELP probe_ssl_last_chain_info Contains SSL leaf certificate information
# TYPE probe_ssl_last_chain_info gauge
probe_ssl_last_chain_info{fingerprint_sha256="7a70788fe1f5a90e81f7acbdc16422cb6e5d764be8d0f4da9721ba9674aa8ba9",issuer="CN=Cloudflare TLS Issuing ECC CA 3,O=SSL Corporation,C=US",serialnumber="51ad987ea1246ff34244626a083d152f",subject="CN=example.com",subjectalternative="example.com,*.example.com"} 1
# HELP probe_success Displays whether or not the probe was a success
# TYPE probe_success gauge
probe_success 1
# HELP probe_tls_version_info Returns the TLS version used or NaN when unknown
# TYPE probe_tls_version_info gauge
probe_tls_version_info{version="TLS 1.3"} 1



Module configuration:
prober: tcp
http:
  ip_protocol_fallback: true
  follow_redirects: true
  enable_http2: true
tcp:
  preferred_ip_protocol: ip4
  ip_protocol_fallback: true
  tls: true
  tls_config:
    insecure_skip_verify: true
  proxy_url: socks5://proxy:1080
  proxy_username: user1
  proxy_password: <secret>
icmp:
  ip_protocol_fallback: true
  ttl: 64
dns:
  ip_protocol_fallback: true
  recursion_desired: true
websocket:
  ip_protocol_fallback: true

Configuration

blackblox.yml

modules:
  # TCP prober with TLS for hd-queue UAT endpoints (Queue-IT/Akamai-managed).
  # Uses a local SOCKS5 proxy — intended for use with the local fork of blackbox_exporter
  # which adds proxy_url support to the TCP prober.
  tcp_tls_with_proxy:
    prober: tcp
    tcp:
      preferred_ip_protocol: ip4
      tls: true
      tls_config:
        insecure_skip_verify: true
      proxy_url: socks5://proxy:1080
      proxy_username: ${TCP_TLS_PROXY_USER}
      proxy_password: ${TCP_TLS_PROXY_PASSWORD}

prometheus

global:
  scrape_interval: 30s
  evaluation_interval: 30s

rule_files:
  - /etc/prometheus/rules/*.yml

scrape_configs:

  - job_name: prometheus
    static_configs:
      - targets: ['localhost:9090']

  - job_name: blackbox-tls-probes
    file_sd_configs:
      - files:
          - '/etc/prometheus/targets/blackbox_ssl_targets.json'
        refresh_interval: 5m
    params:
      module:
        - tcp_tls_with_proxy
    scrape_interval: 30s
    scrape_timeout: 10s
    metrics_path: /probe
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target
      - source_labels: [__param_target]
        target_label: endpoint
      - target_label: __address__
        replacement: blackbox-local:9115

docker-compose.yaml

networks:
  monitoring:
    driver: bridge

services:

  # UI: http://localhost:9090
  # Cert expiry query: http://localhost:9090/graph?g0.expr=probe_ssl_earliest_cert_expiry+-+time()
  prometheus:
    image: prom/prometheus:v3.7.3
    volumes:
      - ./prometheus:/etc/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.external-url=http://localhost:9090'
    ports:
      - 9090:9090
    networks:
      - monitoring

  blackbox-local:
    image: blackbox-exporter:local
    volumes:
      - ./blackbox:/etc/blackbox
    command:
      - '--config.file=/etc/blackbox/blackbox-local.yml'
    environment:
      - TCP_TLS_PROXY_USER=user1
      - TCP_TLS_PROXY_PASSWORD=pass1
    ports:
      - 9116:9115
    depends_on:
      - proxy
    networks:
      - monitoring

  proxy:
    # https://hub.docker.com/r/serjs/go-socks5-proxy/
    image: serjs/go-socks5-proxy
    environment:
      - REQUIRE_AUTH=true
      - PROXY_USER=user1
      - PROXY_PASSWORD=pass1
    ports:
      - 11080:1080
    networks:
      - monitoring