diff options
| author | onefang | 2020-02-06 14:43:30 +1000 |
|---|---|---|
| committer | onefang | 2020-02-06 14:43:30 +1000 |
| commit | 8d6b01f086cda032f1b72620e84bf3e5b4d5be19 (patch) | |
| tree | 4f49f7b405ce1a3a33664556587b5317fa6bec88 | |
| parent | Rewrite some of the output. (diff) | |
| download | apt-panopticon-8d6b01f086cda032f1b72620e84bf3e5b4d5be19.zip apt-panopticon-8d6b01f086cda032f1b72620e84bf3e5b4d5be19.tar.gz apt-panopticon-8d6b01f086cda032f1b72620e84bf3e5b4d5be19.tar.bz2 apt-panopticon-8d6b01f086cda032f1b72620e84bf3e5b4d5be19.tar.xz | |
Clean up the README, add some more text, remove the theory part.
| -rw-r--r-- | README.md | 132 |
1 files changed, 26 insertions, 106 deletions
| @@ -23,7 +23,15 @@ badgered him about his Python scripts. It should also be much easier to | |||
| 23 | use, the previous scripts needed some work before you could run them, | 23 | use, the previous scripts needed some work before you could run them, |
| 24 | this one you just download and run. | 24 | this one you just download and run. |
| 25 | 25 | ||
| 26 | The source code is at [https://sledjhamr.org/cgit/apt-panopticon/](https://sledjhamr.org/cgit/apt-panopticon/) | 26 | After a discussion, it is likely that apt-panopticon will be used to |
| 27 | automatically decide which Devuan mirrors are in the DNS round robin. | ||
| 28 | The details of that are yet to be determined. | ||
| 29 | |||
| 30 | |||
| 31 | You can get the source code from [https://sledjhamr.org/cgit/apt-panopticon/](https://sledjhamr.org/cgit/apt-panopticon/) (main repo) | ||
| 32 | and [https://git.devuan.org/onefang/apt-panopticon](https://git.devuan.org/onefang/apt-panopticon) (Devuan repo). | ||
| 33 | You can get the cgp graphing source code from [https://sledjhamr.org/cgit/apt-panopticon_cgp/]() (main repo) | ||
| 34 | and [https://git.devuan.org/onefang/apt-panopticon_cgp](https://git.devuan.org/onefang/apt-panopticon_cgp) (Devuan repo). | ||
| 27 | 35 | ||
| 28 | The issue tracker is at [https://sledjhamr.org/mantisbt/project_page.php?project_id=13](https://sledjhamr.org/mantisbt/project_page.php?project_id=13) | 36 | The issue tracker is at [https://sledjhamr.org/mantisbt/project_page.php?project_id=13](https://sledjhamr.org/mantisbt/project_page.php?project_id=13) |
| 29 | 37 | ||
| @@ -56,13 +64,14 @@ If you want to have lots of graphs, also install | |||
| 56 | For the apt-panopticon_cgp package, which is used to show the detailed | 64 | For the apt-panopticon_cgp package, which is used to show the detailed |
| 57 | graphs, you'll need a web server that supports PHP. apt-panopticon_cgp | 65 | graphs, you'll need a web server that supports PHP. apt-panopticon_cgp |
| 58 | includes some support files for running PHP via CGI, which more web | 66 | includes some support files for running PHP via CGI, which more web |
| 59 | servers support. You'll need php-cgi for that. | 67 | servers support. You'll need php-cgi for that. It's been tested with |
| 68 | recent versions of Apache 2 and Lightttpd. | ||
| 60 | 69 | ||
| 61 | 70 | ||
| 62 | Web installation. | 71 | Web installation. |
| 63 | ----------------- | 72 | ----------------- |
| 64 | 73 | ||
| 65 | This is a suggestion for installation on a Devuan based web server. | 74 | This is a suggestion for installation on a Devuan based web server. |
| 66 | 75 | ||
| 67 | Create - | 76 | Create - |
| 68 | 77 | ||
| @@ -74,7 +83,7 @@ Install apt-panopticon and apt-panopticon_cgp there, so you end up with - | |||
| 74 | /var/www/html/apt-panopticon/apt-panopticon_cgp | 83 | /var/www/html/apt-panopticon/apt-panopticon_cgp |
| 75 | 84 | ||
| 76 | The script update_apt-panopticon is an example script for updating | 85 | The script update_apt-panopticon is an example script for updating |
| 77 | everything, including commented out commands to update the source code. | 86 | everything, including commented out commands to update the source code. |
| 78 | The file apt-panopticron is an example crontab file for updating | 87 | The file apt-panopticron is an example crontab file for updating |
| 79 | everything once every ten minutes. They assume your web server user is | 88 | everything once every ten minutes. They assume your web server user is |
| 80 | www-data with a group of www-data, and you have a mirror user called | 89 | www-data with a group of www-data, and you have a mirror user called |
| @@ -82,9 +91,8 @@ mirrors. For mirror operators, that mirrors user would be the owner of | |||
| 82 | the mirror files. You can change these to suite yourself. | 91 | the mirror files. You can change these to suite yourself. |
| 83 | 92 | ||
| 84 | Once everything is updated, | 93 | Once everything is updated, |
| 85 | /var/www/html/apt-panopticon/results/Report-web.html | 94 | /var/www/html/apt-panopticon/results/Report-web.html will point to the |
| 86 | will point to the main web page, and there will be a link at the bottom of | 95 | main web page, and there will be links that point to the detailed graphs. |
| 87 | that pointing to the detailed graphs. | ||
| 88 | 96 | ||
| 89 | Note that two runs of apt-panopticon have to happen ten minutes apart at | 97 | Note that two runs of apt-panopticon have to happen ten minutes apart at |
| 90 | least in order to see any data on the graphs. | 98 | least in order to see any data on the graphs. |
| @@ -98,9 +106,7 @@ Using it. | |||
| 98 | 106 | ||
| 99 | These examples assume you are running it from the source code directory. | 107 | These examples assume you are running it from the source code directory. |
| 100 | A directory will be created called `results`, it'll be full of log files | 108 | A directory will be created called `results`, it'll be full of log files |
| 101 | and any files that get downloaded. There will also be `results/email` | 109 | and any files that get downloaded. |
| 102 | and `results/web` directories, with the notification emails and web pages | ||
| 103 | (once I write that bit). | ||
| 104 | 110 | ||
| 105 | Note that unlike typical commands, you can't run single character options | 111 | Note that unlike typical commands, you can't run single character options |
| 106 | together, so this is wrong - | 112 | together, so this is wrong - |
| @@ -115,12 +121,12 @@ Just run the script to do all of the tests - | |||
| 115 | 121 | ||
| 116 | $ ./apt-panopticon.lua | 122 | $ ./apt-panopticon.lua |
| 117 | 123 | ||
| 118 | Which will print any errors. If you don't want to see errors - | 124 | Which will print any CRITICAL errors. If you don't want to see errors - |
| 119 | 125 | ||
| 120 | $ ./apt-panopticon.lua -q | 126 | $ ./apt-panopticon.lua -q |
| 121 | 127 | ||
| 122 | If you want to see warnings as well (as usual, the more `-v` options, the more | 128 | If you want to see other errors, warnings, and even more details as well |
| 123 | details) - | 129 | (as usual, the more `-v` options, the more details) - |
| 124 | 130 | ||
| 125 | $ ./apt-panopticon.lua -v | 131 | $ ./apt-panopticon.lua -v |
| 126 | 132 | ||
| @@ -184,7 +190,8 @@ and check all of it's IPs, which are the DNS RR mirrors anyway. | |||
| 184 | 190 | ||
| 185 | The mirror_list.txt file also used to select which protocols to test for | 191 | The mirror_list.txt file also used to select which protocols to test for |
| 186 | each mirror, it will only test those protocols the mirror lists as | 192 | each mirror, it will only test those protocols the mirror lists as |
| 187 | supporting. | 193 | supporting. Actually it'll test the ones not supported as well, but mark |
| 194 | them differently in the results. | ||
| 188 | 195 | ||
| 189 | 196 | ||
| 190 | Options. | 197 | Options. |
| @@ -200,13 +207,14 @@ Print the version. | |||
| 200 | 207 | ||
| 201 | -v | 208 | -v |
| 202 | 209 | ||
| 203 | Print more verbose output. Normally only CRITICAL and ERROR message sare | 210 | Print more verbose output. Normally only CRITICAL messages are printed. |
| 204 | printed. -v will print WARNING messages as well, -v -v INFO messages, | 211 | -v will print ERROR messages as well, -v -v WARNING messages, -v -v -v |
| 205 | and -v -v -v DEBUG messages. All messages are logged regardless. | 212 | INFO messages, and -v -v -v -v DEBUG messages. All messages are logged |
| 213 | regardless. | ||
| 206 | 214 | ||
| 207 | -q | 215 | -q |
| 208 | 216 | ||
| 209 | Only print CRITICAL messages. | 217 | Print no output messages. |
| 210 | 218 | ||
| 211 | -k | 219 | -k |
| 212 | 220 | ||
| @@ -257,91 +265,3 @@ negative argument deselects a report. | |||
| 257 | 265 | ||
| 258 | Select which tests to run. The arguments are comma separated. A | 266 | Select which tests to run. The arguments are comma separated. A |
| 259 | negative argument deselects a test. Examples are given above. | 267 | negative argument deselects a test. Examples are given above. |
| 260 | |||
| 261 | |||
| 262 | Theory of operation. | ||
| 263 | -------------------- | ||
| 264 | |||
| 265 | Typically you would call it without any specific mirror mentioned on the | ||
| 266 | command line. I'll start the discussion from there. | ||
| 267 | |||
| 268 | Create the results directory. | ||
| 269 | |||
| 270 | If -k is not given, delete results/*.log. | ||
| 271 | |||
| 272 | Delete results/*.check. | ||
| 273 | |||
| 274 | touch results/stamp | ||
| 275 | |||
| 276 | Open results/apt-panopticon.log for message logging. | ||
| 277 | |||
| 278 | Download mirror_list.txt from the reference site. Build a table of | ||
| 279 | Active mirrors keyed by the FDQN, include the listed Protocols as a sub | ||
| 280 | table. Add the round robin domain name. Resolve all the IPs and add | ||
| 281 | them to this table. Write this table to results/mirrors.lua so that the | ||
| 282 | forked tests can read it. | ||
| 283 | |||
| 284 | checkHost() the reference site first. | ||
| 285 | |||
| 286 | Loop through the mirrors table, and checkHost() each one, skipping the | ||
| 287 | reference site. | ||
| 288 | |||
| 289 | Wait for all forked tests to finish. | ||
| 290 | |||
| 291 | Delete results/*.check. | ||
| 292 | |||
| 293 | |||
| 294 | The checkHost() function does this - | ||
| 295 | |||
| 296 | If there is no second argument, then the host is set to the first | ||
| 297 | argument, otherwise the host is the second argument. | ||
| 298 | |||
| 299 | Gather the IPs for the host name with the following command - | ||
| 300 | |||
| 301 | dig +keepopen +noall +nottlid +answer example.com A example.com AAAA | ||
| 302 | example.com CNAME example.com SRV | sort -r | uniq | ||
| 303 | |||
| 304 | So it should end up with all the IPV4, IPV6, CNAME, and SRV records for | ||
| 305 | that host. | ||
| 306 | |||
| 307 | For each IPv4 and IPv6 address, fork a copy of the script something like | ||
| 308 | this (including any arguments originally provided to the script) - | ||
| 309 | |||
| 310 | ionice -c3 ./apt-panopticon.lua example.com/path x.x.x.x & | ||
| 311 | |||
| 312 | ionice -c3 ./apt-panopticon.lua example.com/path [x:x:x:x:x:x] & | ||
| 313 | |||
| 314 | For each CNAME, it checkHost() the host, but with the CNAME as a second | ||
| 315 | argument. | ||
| 316 | |||
| 317 | SRV reconds don't do anything yet, coz I have yet to see one from my test | ||
| 318 | environment, so can't test it. | ||
| 319 | |||
| 320 | |||
| 321 | Each forked call of the script from above does this - | ||
| 322 | |||
| 323 | Open results/example.com_x.x.x.x.log for message logging. | ||
| 324 | |||
| 325 | Loads the mirrors table from results/mirrors.lua. | ||
| 326 | |||
| 327 | If performing the Integrity or Updated testes, delete results/example.com | ||
| 328 | directory, downloads the reference files using wget. While it should | ||
| 329 | actually perform the Integrity and Updated tests now, those haven't been | ||
| 330 | written yet. Note that currently this downloads 4GB per mirror. | ||
| 331 | |||
| 332 | Calls checkHost() with the host as first and second arguments, and | ||
| 333 | includes the IP this time. The inclusion of the IP causes checkHost() to | ||
| 334 | call checkFiles(). | ||
| 335 | |||
| 336 | |||
| 337 | checkFiles() will call checkHEAD() for each of the reference files. | ||
| 338 | |||
| 339 | |||
| 340 | checkHEAD() uses LuaSocket (or LuaSec for HTTPS) to send a HEAD request | ||
| 341 | to the IP, with a Host header set to the original host name. Redirects | ||
| 342 | will not be followed by that request. If the request returns a redirect, | ||
| 343 | then checkHEAD() is called recursively. If the redirect is to some host | ||
| 344 | we are not already checking, we call checkHost() on it, with an IP of | ||
| 345 | "redir". This causes checkHost() to bypass the test that would otherwise | ||
| 346 | call checkFiles(), instead gathering the IPs and fork as usual. | ||
| 347 | |||
