summaryrefslogtreecommitdiff
path: root/lib/custodian
AgeCommit message (Collapse)Author
2016-11-03Send the server-name-indicator (SNI) when falling back to legacy.3-send-sni-when-falling-back-to-opensslSteve Kemp
If ruby-based SSL negotiation fails then we fallback to invoking (horridly!) openssl directly. Until now this didn't send the SNI hostname to connect to, so it could only test the first/default SSL site that was listening upon a given IP address. This commit updates things such that we send the correct hostname, from the URL under-test.
2016-07-18Fallback to using `openssl` if we can't get certificates.Steve Kemp
Since the ruby version available to wheezy doesn't support TLS 1.2 fetching the certificate from remote HTTPS servers will fail, if that is all that is available. If we hit that condition, and only that one, we'll fall back to invoking `openssl` natively. This will allow us to monitor expiration-time for remote SSL certificates, but the downside is that we no longr receive the bundle that the remote server might send - so we cannot validate the signature chain. This closes #2.
2016-07-13Update error message for validation-failuSteve Kemp
2016-07-13Retry SSL checks on negotiation failure.release-0.29Steve Kemp
This prevents an endless loop.
2016-04-22Updated to fix the last remaining rubocop warnings.Steve Kemp
This involved silencing a few issues that were judged to be minor, and changing various whitespaces and function-calls. The most obvious example was changing this: assert(ret.kind_of? Array) To this: assert(ret.kind_of?(Array))
2016-04-22More rubocop fixups.Steve Kemp
These are again mostly based around whitespace-changes.
2016-04-22More rubocop fixes.Steve Kemp
2016-04-22Fixed up more rubocop warnings.Steve Kemp
Again these were whitespace-related.
2016-04-22More updates to silence rubocop style-guides.Steve Kemp
These warnings were largely whitespace-based.
2016-04-22Readded file.Steve Kemp
It was required after all.
2016-04-22Removed obsolete file.Steve Kemp
2016-04-22Deleted trailing whitespace.Steve Kemp
Made minor formatting cleanups
2016-04-22Simplified the parsing of the TFTP URI.Steve Kemp
2016-04-21added tftp protocol testJames F. Carter
2016-04-21added a simple tftp utilityJames F. Carter
2016-02-10Don't allow limiting protocl on HTTP/HTTPS tests.root
We cannot allow HTTP/HTTPS to be limited by protocol, such as IPv4-only or IPv6-only. Raise an error in the parser if this is attempted. Added test-case to confirm, and this closes #12488.
2016-02-10Adjusted greediness of regex in http with contentPatrick J Cherry
It should match the next occurrence of the opening quote type, not the last.
2016-02-10Adjusted http with content string parsing.Patrick J Cherry
It now matches "can't match" and 'he said "ha!"'. Added tests.
2016-01-18Updated the queue-handling.Steve Kemp
We now use a zset to store our pending tests. This means that jobs are only in the queue once - no duplicates are allowed. This closes #12428.
2016-01-11Allow expected-test to be double-quoted.Steve Kemp
This changes the parser from only allowing this: http://example.com/ must run http with content 'reserved'. To allowing both of these: http://example.com/ must run http with content "reservered". http://example.com/ must run http with content 'reserved'.
2015-12-18Updated to use the right form of counting for the set.Steve Kemp
2015-12-18Fixed the name of the string.Steve Kemp
2015-12-18Updated to revert to a set with no ordering.Steve Kemp
This is more reliable, albeit potentially racy and with the failure case that a job might be readded twice.
2015-12-18Return values using a reverse-score-range.Steve Kemp
This prevents starvation, by ensuring that we pull tests out in a FIFO fashion - by virtue of the timestamp.
2015-12-18Removed references and support for beanstalkd.Steve Kemp
The beanstalkd queue used to be used in the past, and we later added support for Redis via a simple abstraction layer. But now we've no longer tested and used beanstalkd for over a year, and the client-libraries are no longer available as native Debian packages. With that in mind we've excised the code, although left the abstraction-class in-place.
2015-12-18Removed debugging print.Steve Kemp
2015-12-18Removed the diagnostic output of the test-scoresSteve Kemp
2015-12-18Use a sorted set for tests in our queue.Steve Kemp
This ensures that all tests always run, and we have an ordering.
2015-12-17Treat our Redis queue as a set.Steve Kemp
This means that tests will only ever be enqueued once, regardless of how many times they are parsed. In the past we could have a configuration file that read: test1 .. test2 .. test3 .. Parsing/adding this file would result in a queue looking like so: test1 .. test2 .. test3 .. test1 .. test2 .. test3 .. test1 .. test2 .. test3 .. Now the queue will *ALWAYS* look like this: test1 .. test2 .. test3 .. In the normal course of events this won't matter, as teh processing loop will look like so: * Add new jobs every minute. * Worker runs the jobs. In the case of a failing job though the test might take 2.5 minutes and that will cause the queue to backup. (2.5 minutes because a test is repeated 5 times before a fail is announced, and the timeout is 30 seconds. These values can and should be tweaked.) With the new method even if the queue is slowly draining the queue will never grow to containu hundreds of events it will just be "topped up" not "overflowing". Thanks to James Hannah for the suggestion, and James Lawrie for the patience.
2015-12-02Added swordfish range - 5.28.56.0/21Steve Kemp
2015-11-30Don't do SHA1 signature testing by default.Steve Kemp
2015-11-16Keep 8k history-transitions.Steve Kemp
2015-11-16Updated the redis-alerter to store more useful-state.Steve Kemp
This will make visualization more simple.
2015-11-16Ensure we strip leading/trailing space from alerts.Steve Kemp
This allows our configuration file `/etc/custodian/custodian.cfg` to contain something like this, without errors; alerter = file , redis
2015-10-29Allow testng for weak certificate signing algorithms.Steve Kemp
This is a good thing to do, as Chrome will apaprently be refusing to show sites with SHA-1 in use over SHA-256. This closes #12358.
2015-08-26Catch "RecvErr" exceptions from curb.Steve Kemp
This prevents a slightly ugly backtrace instead of a genuinely useful report.
2015-08-25Explicitly open our configuration file in UTF-8 mode.Steve Kemp
This avoids any errors of the form: invalid byte sequence in US-ASCII
2015-08-07Ensure that we correctly parse bogus macro-definitions.Steve Kemp
We've always had an implicit rule in macro-definitions, that they end with a period. This meant that the first line is valid: FOO is bar.vm.bytemark.co.uk. However we'd expect this to fail: FOO is bar.vm.bytemark.co.uk A similar issue would arise if a macro-definition involved more than one host, only the first would be valid. We've fixed this now, such that the trailing period is optional.
2015-08-04Override the alert-test-type for the SSL-expiry check.Steve Kemp
This allows better alerting.
2015-07-29Loosen teh grammar on tcp-tests.Steve Kemp
In the past we needed to write: must run tcp on 3306. Now we can add the "port" to match the rest of the tests: must run tcp on port 3306.
2015-07-29Ensure that protocol-handlers are lower-case.Steve Kemp
This allows you to write the following (identical) tests: foo must run FTP. foo must run ftp. foo must run FtP. This is mostly a neatness update.
2015-07-29Added handler for running RDP-tests.Steve Kemp
This just does a TCP-connection to port 3389.
2015-04-30If a test is skipped we don't need to sleep.Steve Kemp
If a test fails then we sleep for a small amount of time, two seconds by default, before repeating it. This delay is not required for tests that explicitly disable themselves.
2015-04-28Revert the last commit - syslog gives us timestampsSteve Kemp
2015-04-28Show the date/time as well as logged messages.Steve Kemp
2015-04-28Removed temporary debugging putsSteve Kemp
2015-04-24Use the expanded version of our return-codes.Steve Kemp
Rather than showing "2, 4, etc" we use the expansion routine to show TEST_FAILED, TEST_PASSED, etc. This reads more neatly.
2015-04-16Test our enum-like type works as expected.Steve Kemp
Specifically that we can get the value back as a string, and work with the ordinal too.
2015-04-16Removed reference to removed protocol tester.Steve Kemp
We no longer test for open-relays so we don't need to run the test.
2015-04-16Updated test-handler for new API.Steve Kemp
This update consists of two changes: * No longer return "true" or "false" instead return "TEST_FAILED", or "TEST_SUCCEEDED". * Removed the testing of test-inversion from the class, now it lives in the base-class where it should have done all along.