new plugin for Azure Network Virtual Hub

[rmorandell-pgum]

Community contributors

Description

Modes Available:

• discovery
• health
• hub-status
• hub-traffic

hub-status
Virtual Hubs

hub-traffic
Metric documentation

I have implemented a process where the available metrics for the resource are first queried via the /providers/microsoft.insights/metricDefinitions endpoint.

for API
https://learn.microsoft.com/en-us/rest/api/monitor/metric-definitions/list?view=rest-monitor-2023-10-01&tabs=HTTP

for CLI
https://learn.microsoft.com/en-us/cli/azure/monitor/metrics?view=azure-cli-latest#az-monitor-metrics-list-definitions

This also allows you to determine the primaryAggregationType and use it if it has not been overridden with --aggregation.

Not all metrics are always available for all regions or features. That is why this is a good dynamic solution.

Type of change

• Patch fixing an issue (non-breaking change)
• New functionality (non-breaking change)
• Functionality enhancement or optimization (non-breaking change)
• Breaking change (patch or feature) that might cause side effects breaking part of the Software

How this pull request can be tested ?

hub-status.debug.txt
hub-traffic.debug.txt

Checklist

• I have followed the coding style guidelines provided by Centreon
• I have commented my code, especially hard-to-understand areas of the PR.
• I have rebased my development branch on the base branch (develop).
• I have provide data or shown output displaying the result of this code in the plugin area concerned.

Summary by Aikido

Security Issues: 0	🔍 Quality Issues: 3	Resolved Issues: 0

🚀 New Features

• Added new Azure Virtual Hub monitoring plugin with multiple modes implemented

⚡ Enhancements

• Added discovery and health modes for Virtual Hub resource discovery
• Enhanced azcli and API custom modules to fetch and aggregate metrics dynamically

^{More info}

[aikido-pr-checks]

azure_list_resource_metrics_set_cmd places $options{resource} directly into a shell command string (--resource '$options{resource}'), enabling command/argument injection if resource is untrusted. Use argument arrays or sanitize/encode the value.

Details

✨ AI Reasoning
​A new function returns an Azure CLI command string with the --resource argument directly interpolated from $options{resource} into the command string. If $options{resource} can be controlled by an external user, this direct interpolation into a shell-executed command permits injection of additional CLI options or shell metacharacters. The risk arises where the assembled command is passed to the system execution routine without safe argument separation or sanitization.

🔧 How do I fix it?
Use parameterized queries with placeholders, array-based command execution (no shell interpretation), or properly escaped arguments using vetted libraries. Avoid dynamic queries/commands built with user input concatenation.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}

[aikido-pr-checks]

check_options iterates over $self->{az_resource} before assigning it from option_results, so validation can fail on uninitialized state before reaching the intended setup.

Details

✨ AI Reasoning
​The validation path checks whether a resource was provided, then immediately iterates over an internal collection that is only populated later in the same routine. This makes the loop depend on state that is not initialized yet, so the guard logic can fail before reaching the assignment step.

🔧 How do I fix it?
Trace execution paths carefully. Ensure precondition checks happen before using values, validate ranges before checking impossible conditions, and don't check for states that the code has already ruled out.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}

[aikido-pr-checks]

azure_list_virtualhubs_set_cmd concatenates $options{resource_group} and $self->{subscription} into a shell command string; avoid direct interpolation into commands (escape or use safe argument passing).

Details

✨ AI Reasoning
​The newly added function constructs a CLI command with the resource group and subscription values interpolated directly into the command string. If $options{resource_group} or $self->{subscription} are user-controlled, they could include shell metacharacters leading to command injection when executed. There is no escaping or use of safe argument passing in the constructed $cmd_options.

🔧 How do I fix it?
Use parameterized queries with placeholders, array-based command execution (no shell interpretation), or properly escaped arguments using vetted libraries. Avoid dynamic queries/commands built with user input concatenation.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}

[aikido-pr-checks]

manage_selection checks metric_results with $metric_name but reads the value with $metric_label_name, so it can miss existing data and report incorrect metric values.

Suggested change

	defined($metric_results{$resource_name}->{$metric_label_name}->{lc($aggregation)}) ?
	$metric_results{$resource_name}->{$metric_label_name}->{lc($aggregation)} :
	defined($metric_results{$resource_name}->{$metric_name}->{lc($aggregation)}) ?
	$metric_results{$resource_name}->{$metric_name}->{lc($aggregation)} :

Details

✨ AI Reasoning
​The selection logic normalizes metric names to one identifier for lookup, but later reads values from the results map using a different identifier format. This inconsistency means the retrieved metric value path does not match the stored path, leading to incorrect empty/default values.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}