logical_disk: add bitlocker status sub-collector (#2077)

internal/collector/container/container.go

@@ -29,7 +29,7 @@ import (
 	"unsafe"
 
 	"github.com/alecthomas/kingpin/v2"
-	"github.com/prometheus-community/windows_exporter/internal/headers/guid"
+	"github.com/go-ole/go-ole"
 	"github.com/prometheus-community/windows_exporter/internal/headers/hcn"
 	"github.com/prometheus-community/windows_exporter/internal/headers/hcs"
 	"github.com/prometheus-community/windows_exporter/internal/headers/iphlpapi"
@@ -536,7 +536,7 @@ func (c *Collector) collectNetworkMetrics(ch chan<- prometheus.Metric) error {
 			continue
 		}
 
-		var nicGUID *guid.GUID
+		var nicGUID *ole.GUID
 
 		for _, allocator := range properties.Resources.Allocators {
 			if allocator.AdapterNetCfgInstanceId != nil {

internal/collector/logical_disk/logical_disk.go

@@ -18,16 +18,22 @@
 package logical_disk
 
 import (
+	"context"
 	"encoding/binary"
 	"errors"
 	"fmt"
 	"log/slog"
 	"regexp"
+	"runtime"
+	"runtime/debug"
 	"slices"
 	"strconv"
 	"strings"
 
 	"github.com/alecthomas/kingpin/v2"
+	"github.com/go-ole/go-ole"
+	"github.com/prometheus-community/windows_exporter/internal/headers/propsys"
+	"github.com/prometheus-community/windows_exporter/internal/headers/shell32"
 	"github.com/prometheus-community/windows_exporter/internal/mi"
 	"github.com/prometheus-community/windows_exporter/internal/pdh"
 	"github.com/prometheus-community/windows_exporter/internal/types"
@@ -35,15 +41,23 @@ import (
 	"golang.org/x/sys/windows"
 )
 
-const Name = "logical_disk"
+const (
+	Name                  = "logical_disk"
+	subCollectorMetrics   = "metrics"
+	subCollectorBitlocker = "bitlocker_status"
+)
 
 type Config struct {
-	VolumeInclude *regexp.Regexp `yaml:"volume-include"`
-	VolumeExclude *regexp.Regexp `yaml:"volume-exclude"`
+	CollectorsEnabled []string       `yaml:"enabled"`
+	VolumeInclude     *regexp.Regexp `yaml:"volume-include"`
+	VolumeExclude     *regexp.Regexp `yaml:"volume-exclude"`
 }
 
 //nolint:gochecknoglobals
 var ConfigDefaults = Config{
+	CollectorsEnabled: []string{
+		subCollectorMetrics,
+	},
 	VolumeInclude: types.RegExpAny,
 	VolumeExclude: types.RegExpEmpty,
 }
@@ -56,6 +70,14 @@ type Collector struct {
 	perfDataCollector *pdh.Collector
 	perfDataObject    []perfDataCounterValues
 
+	bitlockerReqCh chan string
+	bitlockerResCh chan struct {
+		err    error
+		status int
+	}
+
+	ctxCancelFunc context.CancelFunc
+
 	avgReadQueue     *prometheus.Desc
 	avgWriteQueue    *prometheus.Desc
 	freeSpace        *prometheus.Desc
@@ -74,6 +96,8 @@ type Collector struct {
 	writeLatency     *prometheus.Desc
 	writesTotal      *prometheus.Desc
 	writeTime        *prometheus.Desc
+
+	bitlockerStatus *prometheus.Desc
 }
 
 type volumeInfo struct {
@@ -109,8 +133,9 @@ func NewWithFlags(app *kingpin.Application) *Collector {
 	c := &Collector{
 		config: ConfigDefaults,
 	}
+	c.config.CollectorsEnabled = make([]string, 0)
 
-	var volumeExclude, volumeInclude string
+	var collectorsEnabled, volumeExclude, volumeInclude string
 
 	app.Flag(
 		"collector.logical_disk.volume-exclude",
@@ -122,7 +147,17 @@ func NewWithFlags(app *kingpin.Application) *Collector {
 		"Regexp of volumes to include. Volume name must both match include and not match exclude to be included.",
 	).Default(".+").StringVar(&volumeInclude)
 
+	app.Flag(
+		"collector.logical_disk.enabled",
+		fmt.Sprintf("Comma-separated list of collectors to use. Available collectors: %s, %s. Defaults to metrics, if not specified.",
+			subCollectorMetrics,
+			subCollectorBitlocker,
+		),
+	).Default(strings.Join(ConfigDefaults.CollectorsEnabled, ",")).StringVar(&collectorsEnabled)
+
 	app.Action(func(*kingpin.ParseContext) error {
+		c.config.CollectorsEnabled = strings.Split(collectorsEnabled, ",")
+
 		var err error
 
 		c.config.VolumeExclude, err = regexp.Compile(fmt.Sprintf("^(?:%s)$", volumeExclude))
@@ -146,12 +181,24 @@ func (c *Collector) GetName() string {
 }
 
 func (c *Collector) Close() error {
+	if slices.Contains(c.config.CollectorsEnabled, subCollectorBitlocker) {
+		c.ctxCancelFunc()
+	}
+
 	return nil
 }
 
 func (c *Collector) Build(logger *slog.Logger, _ *mi.Session) error {
 	c.logger = logger.With(slog.String("collector", Name))
 
+	for _, collector := range c.config.CollectorsEnabled {
+		if !slices.Contains([]string{subCollectorMetrics, subCollectorBitlocker}, collector) {
+			return fmt.Errorf("unknown sub collector: %s. Possible values: %s", collector,
+				strings.Join([]string{subCollectorMetrics, subCollectorBitlocker}, ", "),
+			)
+		}
+	}
+
 	c.information = prometheus.NewDesc(
 		prometheus.BuildFQName(types.Namespace, Name, "info"),
 		"A metric with a constant '1' value labeled with logical disk information",
@@ -276,6 +323,13 @@ func (c *Collector) Build(logger *slog.Logger, _ *mi.Session) error {
 		nil,
 	)
 
+	c.bitlockerStatus = prometheus.NewDesc(
+		prometheus.BuildFQName(types.Namespace, Name, "bitlocker_status"),
+		"BitLocker status for the logical disk",
+		[]string{"volume", "status"},
+		nil,
+	)
+
 	var err error
 
 	c.perfDataCollector, err = pdh.NewCollector[perfDataCounterValues](pdh.CounterTypeRaw, "LogicalDisk", pdh.InstancesAll)
@@ -283,6 +337,25 @@ func (c *Collector) Build(logger *slog.Logger, _ *mi.Session) error {
 		return fmt.Errorf("failed to create LogicalDisk collector: %w", err)
 	}
 
+	if slices.Contains(c.config.CollectorsEnabled, subCollectorBitlocker) {
+		initErrCh := make(chan error)
+		c.bitlockerReqCh = make(chan string, 1)
+		c.bitlockerResCh = make(chan struct {
+			err    error
+			status int
+		}, 1)
+
+		ctx, cancel := context.WithCancel(context.Background())
+
+		c.ctxCancelFunc = cancel
+
+		go c.workerBitlocker(ctx, initErrCh)
+
+		if err = <-initErrCh; err != nil {
+			return fmt.Errorf("failed to initialize BitLocker worker: %w", err)
+		}
+	}
+
 	return nil
 }
 
@@ -325,117 +398,155 @@ func (c *Collector) Collect(ch chan<- prometheus.Metric) error {
 			info.serialNumber,
 		)
 
-		ch <- prometheus.MustNewConstMetric(
-			c.requestsQueued,
-			prometheus.GaugeValue,
-			data.CurrentDiskQueueLength,
-			data.Name,
-		)
+		if slices.Contains(c.config.CollectorsEnabled, subCollectorMetrics) {
+			ch <- prometheus.MustNewConstMetric(
+				c.requestsQueued,
+				prometheus.GaugeValue,
+				data.CurrentDiskQueueLength,
+				data.Name,
+			)
 
-		ch <- prometheus.MustNewConstMetric(
-			c.avgReadQueue,
-			prometheus.GaugeValue,
-			data.AvgDiskReadQueueLength*pdh.TicksToSecondScaleFactor,
-			data.Name,
-		)
+			ch <- prometheus.MustNewConstMetric(
+				c.avgReadQueue,
+				prometheus.GaugeValue,
+				data.AvgDiskReadQueueLength*pdh.TicksToSecondScaleFactor,
+				data.Name,
+			)
 
-		ch <- prometheus.MustNewConstMetric(
-			c.avgWriteQueue,
-			prometheus.GaugeValue,
-			data.AvgDiskWriteQueueLength*pdh.TicksToSecondScaleFactor,
-			data.Name,
-		)
+			ch <- prometheus.MustNewConstMetric(
+				c.avgWriteQueue,
+				prometheus.GaugeValue,
+				data.AvgDiskWriteQueueLength*pdh.TicksToSecondScaleFactor,
+				data.Name,
+			)
 
-		ch <- prometheus.MustNewConstMetric(
-			c.readBytesTotal,
-			prometheus.CounterValue,
-			data.DiskReadBytesPerSec,
-			data.Name,
-		)
+			ch <- prometheus.MustNewConstMetric(
+				c.readBytesTotal,
+				prometheus.CounterValue,
+				data.DiskReadBytesPerSec,
+				data.Name,
+			)
 
-		ch <- prometheus.MustNewConstMetric(
-			c.readsTotal,
-			prometheus.CounterValue,
-			data.DiskReadsPerSec,
-			data.Name,
-		)
+			ch <- prometheus.MustNewConstMetric(
+				c.readsTotal,
+				prometheus.CounterValue,
+				data.DiskReadsPerSec,
+				data.Name,
+			)
 
-		ch <- prometheus.MustNewConstMetric(
-			c.writeBytesTotal,
-			prometheus.CounterValue,
-			data.DiskWriteBytesPerSec,
-			data.Name,
-		)
+			ch <- prometheus.MustNewConstMetric(
+				c.writeBytesTotal,
+				prometheus.CounterValue,
+				data.DiskWriteBytesPerSec,
+				data.Name,
+			)
 
-		ch <- prometheus.MustNewConstMetric(
-			c.writesTotal,
-			prometheus.CounterValue,
-			data.DiskWritesPerSec,
-			data.Name,
-		)
+			ch <- prometheus.MustNewConstMetric(
+				c.writesTotal,
+				prometheus.CounterValue,
+				data.DiskWritesPerSec,
+				data.Name,
+			)
 
-		ch <- prometheus.MustNewConstMetric(
-			c.readTime,
-			prometheus.CounterValue,
-			data.PercentDiskReadTime,
-			data.Name,
-		)
+			ch <- prometheus.MustNewConstMetric(
+				c.readTime,
+				prometheus.CounterValue,
+				data.PercentDiskReadTime,
+				data.Name,
+			)
 
-		ch <- prometheus.MustNewConstMetric(
-			c.writeTime,
-			prometheus.CounterValue,
-			data.PercentDiskWriteTime,
-			data.Name,
-		)
+			ch <- prometheus.MustNewConstMetric(
+				c.writeTime,
+				prometheus.CounterValue,
+				data.PercentDiskWriteTime,
+				data.Name,
+			)
 
-		ch <- prometheus.MustNewConstMetric(
-			c.freeSpace,
-			prometheus.GaugeValue,
-			data.FreeSpace*1024*1024,
-			data.Name,
-		)
+			ch <- prometheus.MustNewConstMetric(
+				c.freeSpace,
+				prometheus.GaugeValue,
+				data.FreeSpace*1024*1024,
+				data.Name,
+			)
 
-		ch <- prometheus.MustNewConstMetric(
-			c.totalSpace,
-			prometheus.GaugeValue,
-			data.PercentFreeSpace*1024*1024,
-			data.Name,
-		)
+			ch <- prometheus.MustNewConstMetric(
+				c.totalSpace,
+				prometheus.GaugeValue,
+				data.PercentFreeSpace*1024*1024,
+				data.Name,
+			)
 
-		ch <- prometheus.MustNewConstMetric(
-			c.idleTime,
-			prometheus.CounterValue,
-			data.PercentIdleTime,
-			data.Name,
-		)
+			ch <- prometheus.MustNewConstMetric(
+				c.idleTime,
+				prometheus.CounterValue,
+				data.PercentIdleTime,
+				data.Name,
+			)
 
-		ch <- prometheus.MustNewConstMetric(
-			c.splitIOs,
-			prometheus.CounterValue,
-			data.SplitIOPerSec,
-			data.Name,
-		)
+			ch <- prometheus.MustNewConstMetric(
+				c.splitIOs,
+				prometheus.CounterValue,
+				data.SplitIOPerSec,
+				data.Name,
+			)
 
-		ch <- prometheus.MustNewConstMetric(
-			c.readLatency,
-			prometheus.CounterValue,
-			data.AvgDiskSecPerRead*pdh.TicksToSecondScaleFactor,
-			data.Name,
-		)
+			ch <- prometheus.MustNewConstMetric(
+				c.readLatency,
+				prometheus.CounterValue,
+				data.AvgDiskSecPerRead*pdh.TicksToSecondScaleFactor,
+				data.Name,
+			)
 
-		ch <- prometheus.MustNewConstMetric(
-			c.writeLatency,
-			prometheus.CounterValue,
-			data.AvgDiskSecPerWrite*pdh.TicksToSecondScaleFactor,
-			data.Name,
-		)
+			ch <- prometheus.MustNewConstMetric(
+				c.writeLatency,
+				prometheus.CounterValue,
+				data.AvgDiskSecPerWrite*pdh.TicksToSecondScaleFactor,
+				data.Name,
+			)
 
-		ch <- prometheus.MustNewConstMetric(
-			c.readWriteLatency,
-			prometheus.CounterValue,
-			data.AvgDiskSecPerTransfer*pdh.TicksToSecondScaleFactor,
-			data.Name,
-		)
+			ch <- prometheus.MustNewConstMetric(
+				c.readWriteLatency,
+				prometheus.CounterValue,
+				data.AvgDiskSecPerTransfer*pdh.TicksToSecondScaleFactor,
+				data.Name,
+			)
+		}
+
+		if slices.Contains(c.config.CollectorsEnabled, subCollectorBitlocker) {
+			c.bitlockerReqCh <- data.Name
+			bitlockerStatus := <-c.bitlockerResCh
+
+			if bitlockerStatus.err != nil {
+				c.logger.Warn("failed to get BitLocker status for "+data.Name,
+					slog.Any("err", bitlockerStatus.err),
+				)
+
+				continue
+			}
+
+			if bitlockerStatus.status == -1 {
+				c.logger.Debug("BitLocker status for "+data.Name+" is unknown",
+					slog.Int("status", bitlockerStatus.status),
+				)
+
+				continue
+			}
+
+			for i, status := range []string{"disabled", "on", "off", "encrypting", "decrypting", "suspended", "locked", "unknown", "waiting_for_activation"} {
+				val := 0.0
+				if bitlockerStatus.status == i {
+					val = 1.0
+				}
+
+				ch <- prometheus.MustNewConstMetric(
+					c.bitlockerStatus,
+					prometheus.GaugeValue,
+					val,
+					data.Name,
+					status,
+				)
+			}
+		}
 	}
 
 	return nil
@@ -609,3 +720,133 @@ func getAllMountedVolumes() (map[string]string, error) {
 		volumes[strings.TrimSuffix(mountPoint, `\`)] = strings.TrimSuffix(windows.UTF16ToString(guidBuf), `\`)
 	}
 }
+
+/*
+++ References
+
+| System.Volume.      | Control Panel                    | manage-bde conversion     | manage-bde     | Get-BitlockerVolume          | Get-BitlockerVolume |
+| BitLockerProtection |                                  |                           | protection     | VolumeStatus                 | ProtectionStatus    |
+| ------------------- | -------------------------------- | ------------------------- | -------------- | ---------------------------- | ------------------- |
+|                   1 | BitLocker on                     | Used Space Only Encrypted | Protection On  | FullyEncrypted               | On                  |
+|                   1 | BitLocker on                     | Fully Encrypted           | Protection On  | FullyEncrypted               | On                  |
+|                   1 | BitLocker on                     | Fully Encrypted           | Protection On  | FullyEncryptedWipeInProgress | On                  |
+|                   2 | BitLocker off                    | Fully Decrypted           | Protection Off | FullyDecrypted               | Off                 |
+|                   3 | BitLocker Encrypting             | Encryption In Progress    | Protection Off | EncryptionInProgress         | Off                 |
+|                   3 | BitLocker Encryption Paused      | Encryption Paused         | Protection Off | EncryptionSuspended          | Off                 |
+|                   4 | BitLocker Decrypting             | Decryption in progress    | Protection Off | DecyptionInProgress          | Off                 |
+|                   4 | BitLocker Decryption Paused      | Decryption Paused         | Protection Off | DecryptionSuspended          | Off                 |
+|                   5 | BitLocker suspended              | Used Space Only Encrypted | Protection Off | FullyEncrypted               | Off                 |
+|                   5 | BitLocker suspended              | Fully Encrypted           | Protection Off | FullyEncrypted               | Off                 |
+|                   6 | BitLocker on (Locked)            | Unknown                   | Unknown        | $null                        | Unknown             |
+|                   7 |                                  |                           |                |                              |                     |
+|                   8 | BitLocker waiting for activation | Used Space Only Encrypted | Protection Off | FullyEncrypted               | Off                 |
+
+--
+*/
+func (c *Collector) workerBitlocker(ctx context.Context, initErrCh chan<- error) {
+	defer func() {
+		if r := recover(); r != nil {
+			c.logger.Error("workerBitlocker panic",
+				slog.Any("panic", r),
+				slog.String("stack", string(debug.Stack())),
+			)
+
+			// Restart the workerBitlocker
+			initErrCh := make(chan error)
+
+			go c.workerBitlocker(ctx, initErrCh)
+
+			if err := <-initErrCh; err != nil {
+				c.logger.Error("workerBitlocker restart failed",
+					slog.Any("err", err),
+				)
+			}
+		}
+	}()
+
+	// The only way to run WMI queries in parallel while being thread-safe is to
+	// ensure the CoInitialize[Ex]() call is bound to its current OS thread.
+	// Otherwise, attempting to initialize and run parallel queries across
+	// goroutines will result in protected memory errors.
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+
+	if err := ole.CoInitializeEx(0, ole.COINIT_APARTMENTTHREADED|ole.COINIT_DISABLE_OLE1DDE); err != nil {
+		var oleCode *ole.OleError
+		if errors.As(err, &oleCode) && oleCode.Code() != ole.S_OK && oleCode.Code() != 0x00000001 {
+			initErrCh <- fmt.Errorf("CoInitializeEx: %w", err)
+
+			return
+		}
+	}
+
+	defer ole.CoUninitialize()
+
+	var pkey propsys.PROPERTYKEY
+
+	// The ideal solution to check the disk encryption (BitLocker) status is to
+	// use the WMI APIs (Win32_EncryptableVolume). However, only programs running
+	// with elevated priledges can access those APIs.
+	//
+	// Our alternative solution is based on the value of the undocumented (shell)
+	// property: "System.Volume.BitLockerProtection". That property is essentially
+	// an enum containing the current BitLocker status for a given volume. This
+	// approached was suggested here:
+	// https://stackoverflow.com/questions/41308245/detect-bitlocker-programmatically-from-c-sharp-without-admin/41310139
+	//
+	// Note that the link above doesn't give any explanation / meaning for the
+	// enum values, it simply says that 1, 3 or 5 means the disk is encrypted.
+	//
+	// I directly tested and validated this strategy on a Windows 10 machine.
+	// The values given in the BitLockerStatus enum contain the relevant values
+	// for the shell property. I also directly validated them.
+	if err := propsys.PSGetPropertyKeyFromName("System.Volume.BitLockerProtection", &pkey); err != nil {
+		initErrCh <- fmt.Errorf("PSGetPropertyKeyFromName failed: %w", err)
+
+		return
+	}
+
+	close(initErrCh)
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case path, ok := <-c.bitlockerReqCh:
+			if !ok {
+				return
+			}
+
+			if !strings.Contains(path, `:`) {
+				c.bitlockerResCh <- struct {
+					err    error
+					status int
+				}{err: nil, status: -1}
+
+				continue
+			}
+
+			status, err := func(path string) (int, error) {
+				item, err := shell32.SHCreateItemFromParsingName(path)
+				if err != nil {
+					return -1, fmt.Errorf("SHCreateItemFromParsingName failed: %w", err)
+				}
+
+				defer item.Release()
+
+				var v ole.VARIANT
+
+				if err := item.GetProperty(&pkey, &v); err != nil {
+					return -1, fmt.Errorf("GetProperty failed: %w", err)
+				}
+
+				return int(v.Val), v.Clear()
+			}(path)
+
+			c.bitlockerResCh <- struct {
+				err    error
+				status int
+			}{err: err, status: status}
+		}
+	}
+}