| Age | Commit message (Collapse) | Author |
|---|
|
If ruby-based SSL negotiation fails then we fallback to invoking
(horridly!) openssl directly. Until now this didn't send the SNI
hostname to connect to, so it could only test the first/default SSL site
that was listening upon a given IP address.
This commit updates things such that we send the correct hostname,
from the URL under-test.
|
|
Since the ruby version available to wheezy doesn't support TLS 1.2
fetching the certificate from remote HTTPS servers will fail, if
that is all that is available.
If we hit that condition, and only that one, we'll fall back to
invoking `openssl` natively. This will allow us to monitor
expiration-time for remote SSL certificates, but the downside is
that we no longr receive the bundle that the remote server might
send - so we cannot validate the signature chain.
This closes #2.
|
|
|
|
This prevents an endless loop.
|
|
This involved silencing a few issues that were judged to be minor,
and changing various whitespaces and function-calls. The most
obvious example was changing this:
assert(ret.kind_of? Array)
To this:
assert(ret.kind_of?(Array))
|
|
These are again mostly based around whitespace-changes.
|
|
|
|
Again these were whitespace-related.
|
|
These warnings were largely whitespace-based.
|
|
It was required after all.
|
|
|
|
Made minor formatting cleanups
|
|
|
|
|
|
|
|
We cannot allow HTTP/HTTPS to be limited by protocol,
such as IPv4-only or IPv6-only. Raise an error in the
parser if this is attempted.
Added test-case to confirm, and this closes #12488.
|
|
It should match the next occurrence of the opening quote type, not the
last.
|
|
It now matches "can't match" and 'he said "ha!"'.
Added tests.
|
|
We now use a zset to store our pending tests. This means that
jobs are only in the queue once - no duplicates are allowed.
This closes #12428.
|
|
This changes the parser from only allowing this:
http://example.com/ must run http with content 'reserved'.
To allowing both of these:
http://example.com/ must run http with content "reservered".
http://example.com/ must run http with content 'reserved'.
|
|
|
|
|
|
This is more reliable, albeit potentially racy and with the failure
case that a job might be readded twice.
|
|
This prevents starvation, by ensuring that we pull tests out in
a FIFO fashion - by virtue of the timestamp.
|
|
The beanstalkd queue used to be used in the past, and we later
added support for Redis via a simple abstraction layer. But now
we've no longer tested and used beanstalkd for over a year, and
the client-libraries are no longer available as native Debian
packages.
With that in mind we've excised the code, although left the
abstraction-class in-place.
|
|
|
|
|
|
This ensures that all tests always run, and we have an ordering.
|
|
This means that tests will only ever be enqueued once, regardless
of how many times they are parsed.
In the past we could have a configuration file that read:
test1 ..
test2 ..
test3 ..
Parsing/adding this file would result in a queue looking like so:
test1 ..
test2 ..
test3 ..
test1 ..
test2 ..
test3 ..
test1 ..
test2 ..
test3 ..
Now the queue will *ALWAYS* look like this:
test1 ..
test2 ..
test3 ..
In the normal course of events this won't matter, as teh processing
loop will look like so:
* Add new jobs every minute.
* Worker runs the jobs.
In the case of a failing job though the test might take 2.5 minutes
and that will cause the queue to backup. (2.5 minutes because a test
is repeated 5 times before a fail is announced, and the timeout is
30 seconds. These values can and should be tweaked.)
With the new method even if the queue is slowly draining the queue
will never grow to containu hundreds of events it will just be "topped
up" not "overflowing".
Thanks to James Hannah for the suggestion, and James Lawrie for
the patience.
|
|
|
|
|
|
|
|
This will make visualization more simple.
|
|
This allows our configuration file `/etc/custodian/custodian.cfg`
to contain something like this, without errors;
alerter = file , redis
|
|
This is a good thing to do, as Chrome will apaprently be
refusing to show sites with SHA-1 in use over SHA-256.
This closes #12358.
|
|
This prevents a slightly ugly backtrace instead of a genuinely
useful report.
|
|
This avoids any errors of the form:
invalid byte sequence in US-ASCII
|
|
We've always had an implicit rule in macro-definitions, that they
end with a period. This meant that the first line is valid:
FOO is bar.vm.bytemark.co.uk.
However we'd expect this to fail:
FOO is bar.vm.bytemark.co.uk
A similar issue would arise if a macro-definition involved more than
one host, only the first would be valid.
We've fixed this now, such that the trailing period is optional.
|
|
This allows better alerting.
|
|
In the past we needed to write:
must run tcp on 3306.
Now we can add the "port" to match the rest of the tests:
must run tcp on port 3306.
|
|
This allows you to write the following (identical) tests:
foo must run FTP.
foo must run ftp.
foo must run FtP.
This is mostly a neatness update.
|
|
This just does a TCP-connection to port 3389.
|
|
If a test fails then we sleep for a small amount of time, two seconds
by default, before repeating it.
This delay is not required for tests that explicitly disable themselves.
|
|
|
|
|
|
|
|
Rather than showing "2, 4, etc" we use the expansion routine
to show TEST_FAILED, TEST_PASSED, etc. This reads more neatly.
|
|
Specifically that we can get the value back as a string, and
work with the ordinal too.
|
|
We no longer test for open-relays so we don't need to run the test.
|
|
This update consists of two changes:
* No longer return "true" or "false" instead return "TEST_FAILED", or "TEST_SUCCEEDED".
* Removed the testing of test-inversion from the class, now it lives in the base-class where it should have done all along.
|
