Tables are now updated only if status of host changers

- Possibilité de régler le niveau de log (0,1,2) avec le flag -verbose (#2)

.gitlab-ci.yml

@@ -0,0 +1,28 @@
+# You can copy and paste this template into a new `.gitlab-ci.yml` file.
+# You should not add this template to an existing `.gitlab-ci.yml` file by using the `include:` keyword.
+#
+# To contribute improvements to CI/CD templates, please follow the Development guide at:
+# https://docs.gitlab.com/ee/development/cicd/templates.html
+# This specific template is located at:
+# https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/gitlab/ci/templates/Go.gitlab-ci.yml
+
+stages:
+  - test
+  - build
+
+format:
+  stage: test
+  script:
+    - go fmt $(go list ./... | grep -v /vendor/)
+    - go vet $(go list ./... | grep -v /vendor/)
+
+compile:
+  stage: build
+  script:
+    - mkdir -p mybinaries
+    - go build -o mybinaries ./...
+  artifacts:
+    paths:
+      - mybinaries
+
+

LICENSE

@@ -0,0 +1,177 @@
+Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+

README.md

@@ -0,0 +1,32 @@
+HostChecker
+===========
+
+HostChecker est un outil très simpliste, qui teste la disponibilité de services distants (tcp, http, smtp) pour établir la disponibilité d'un serveur (host).
+
+En fonction du résultat du test, il ajoute  ou supprime le serveur (désigné par son IP) d'une table PF.
+
+L'outil est écrit spécifiquement pour répondre à un besoin précis.
+Sur des pare-feux réseau FreeBSD ou OpenBSD, PF (packet filter) permet de distribuer un traffic entrant vers un ou plusieurs serveurs `backends` en round-robin.
+
+Si l'un de ces serveurs est indisponible, PF ne peut le détecter et continue de distribuer du traffic vers ce backend, générant donc des erreurs. Il existe plusieurs moyens pour pallier à ce problème, dont l'utilisation d'un proxy applicatif sur le pare-feu lui-même ou l'utilisation d'IP virtuelles redondées sur les serveurs backends.
+
+HostChecker permet d'avoir une troisième solution, celle de gérer dynamiquement la liste des serveurs backends référencés dans une table PF.
+
+Configuration
+--------------
+
+La configuration se fait dans un seul fichier YAML qui décrit un ou plusieurs groupes de serveurs, les méthodes de test et les tables PF a mettre à jour.
+
+```
+cluster-web:
+  tables:
+    - cluster-web-hosts
+  hosts:
+    - 10.10.1.10
+    - 10.10.1.11
+  check:
+    - type: http
+    - port: 80
+    - interval: 5
+    - timeout: 2
+```

go.sum

@@ -0,0 +1,3 @@
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

hostchecker.go

@@ -1,17 +1,17 @@
 /*
-   Copyright 2023 Laurent Ulrich (laurentu@gmail.com)
+Copyright 2023 Laurent Ulrich (laurentu@gmail.com)
 
-   Licensed under the Apache License, Version 2.0 (the "License");
+Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
+you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
+You may obtain a copy of the License at
 
-       http://www.apache.org/licenses/LICENSE-2.0
+	http://www.apache.org/licenses/LICENSE-2.0
 
-   Unless required by applicable law or agreed to in writing, software
+Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
+distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
+See the License for the specific language governing permissions and
-   limitations under the License. 
+limitations under the License.
 */
 package main
 
@@ -29,10 +29,11 @@ import "errors"
 import "net"
 import "os/exec"
 import "flag"
+import "log/syslog"
 
 type Check struct {
 	Type     string `yaml:"type"`
-  Host     string `yaml:"host"`
+	Host     string `yaml:"host"`
 	Port     int    `yaml:"port"`
 	Uri      string `yaml:"uri"`
 	Method   string `yaml:"method"`
@@ -47,13 +48,24 @@ type Group struct {
 	Check  Check    `yaml:"check"`
 }
 
+var verbose int
 
 func main() {
-	log.Println("Starting")
+	if verbose > 0 {
-
+		log.Println("Starting")
-  confFileName := flag.String("f", "/usr/local/etc/hostchecker.yaml", "YAML configuration file")
+	}
-  flag.Parse()
+	confFileName := flag.String("f", "/usr/local/etc/hostchecker.yaml", "YAML configuration file")
+	flag.IntVar(&verbose, "verbose", 0, "Set logs verbosity")
+	useSyslog := flag.Bool("syslog", false, "Send logs to syslog")
+	flag.Parse()
 
+	if *useSyslog == true {
+		syslogWriter, err := syslog.New(syslog.LOG_ERR, "hostchecker")
+		if err != nil {
+			log.Fatal("Error opening syslog #", err)
+		}
+		log.SetOutput(syslogWriter)
+	}
 	var waitGroup sync.WaitGroup
 
 	var conf map[string]Group
@@ -66,13 +78,15 @@ func main() {
 		log.Fatalf("Configuration read error #%v", err)
 	}
 
-  err = validateConfiguration(conf)
+	err = validateConfiguration(conf)
-  if err != nil {
+	if err != nil {
-    log.Fatal("Configuration error #", err)
+		log.Fatal("Configuration error #", err)
-  }
+	}
 	stopChannel := make(chan bool)
 	for name, group := range conf {
-		log.Println("Checking group", name, group)
+		if verbose > 0 {
+			log.Println("Checking group", name, group)
+		}
 		waitGroup.Add(1)
 		go checkGroup(name, group, &waitGroup, stopChannel)
 	}
@@ -82,17 +96,23 @@ func main() {
 	signal.Notify(exit, os.Interrupt)
 
 	s := <-exit
-	log.Println("Received signal", s)
+	if verbose > 1 {
-	log.Println("main closing stopChannel")
+		log.Println("Received signal", s)
+	}
+	if verbose > 0 {
+		log.Println("main closing stopChannel")
+	}
 	close(stopChannel)
 	waitGroup.Wait()
 }
 
 func checkGroup(name string, group Group, waitGroup *sync.WaitGroup, stopChannel chan bool) {
 	channels := make(map[string]chan int)
+  statusPerHost := make(map[string]int)
 	for _, host := range group.Hosts {
 		channel := make(chan int, 1)
 		channels[host] = channel
+    statusPerHost[host] = -1
 		waitGroup.Add(1)
 		go checkHost(channels[host], name, host, group.Check, waitGroup, stopChannel)
 	}
@@ -100,19 +120,28 @@ func checkGroup(name string, group Group, waitGroup *sync.WaitGroup, stopChannel
 	for {
 		select {
 		case <-stopChannel:
-			log.Println("checkGroup", name, "stopChannel")
+			if verbose > 0 {
+				log.Println("checkGroup", name, "stopChannel")
+			}
 			waitGroup.Done()
 			return
-			break
 		default:
 			for host, channel := range channels {
 				select {
 				case stop := <-stopChannel:
-					log.Println("checkGroup", name, "stopChannel", stop)
+					if verbose > 0 {
+						log.Println("checkGroup", name, "stopChannel", stop)
+					}
 					break
 				case status := <-channel:
-					log.Println("Status for ", host, "is", status, "in group", name)
+					if verbose > 1 {
-            updateTables( host, status, group.Tables )
+						log.Println("Status for ", host, "was", statusPerHost[host], "in group", name)
+						log.Println("Status for ", host, "is", status, "in group", name)
+					}
+          if statusPerHost[host] == -1 || statusPerHost[host] != status {
+            statusPerHost[host] = status
+					  updateTables(host, status, group.Tables)
+          }
 				default:
 					time.Sleep(100 * time.Millisecond)
 				}
@@ -121,84 +150,87 @@ func checkGroup(name string, group Group, waitGroup *sync.WaitGroup, stopChannel
 	}
 }
 
-func updateTables( host string, status int, tables []string ) {
+func updateTables(host string, status int, tables []string) {
-  for _, table := range tables {
+	for _, table := range tables {
-    op := "add"
+		op := "add"
-    if status != 0 {
+		if status != 0 {
-      op = "del"
+			op = "del"
-    }
+		}
-    cmd := exec.Command("pfctl", "-t", table, "-T", op, host)
+		cmd := exec.Command("pfctl", "-t", table, "-T", op, host)
-    err := cmd.Run()
+		err := cmd.Run()
-    if err != nil {
+		if err != nil {
-      log.Println("Unable to run command #", cmd)
+			log.Println("Unable to run command #", cmd)
-    }
+		}
-  }
+	}
 }
 
 func checkHost(status chan<- int, group string, host string, check Check, waitGroup *sync.WaitGroup, stopChannel chan bool) {
 
-  var lastCheck time.Time
+	var lastCheck time.Time
 
 	for {
 		select {
 		case <-stopChannel:
-			log.Println("checkHost", host, "group", group, "stopChannel")
+			if verbose > 0 {
+				log.Println("checkHost", host, "group", group, "stopChannel")
+			}
 			waitGroup.Done()
 			return
 		default:
 			var err error
-      if time.Since(lastCheck).Seconds() > float64(check.Interval) {
+			if time.Since(lastCheck).Seconds() > float64(check.Interval) {
-        lastCheck = time.Now()
+				lastCheck = time.Now()
-  			err = nil
+				err = nil
-  			switch check.Type {
+				switch check.Type {
-  			case "http":
+				case "http":
-  				err = CheckHTTP(host, check)
+					err = CheckHTTP(host, check)
-  			case "tcp":
+				case "tcp":
-  				err = CheckTCP(host, check)
+					err = CheckTCP(host, check)
-  			case "smtp":
+				case "smtp":
-  				err = CheckSMTP(host, check)
+					err = CheckSMTP(host, check)
-  			}
+				}
-  			if err != nil {
+				if err != nil {
-  				status <- 1
+					status <- 1
-  				log.Println("checkHost", host, "group", group, "error", err)
+					if verbose > 1 {
-  			} else {
+						log.Println("checkHost", host, "group", group, "error", err)
-  				status <- 0
+					}
-  			}
+				} else {
-      }
+					status <- 0
-			time.Sleep(300*time.Millisecond)
+				}
+			}
+			time.Sleep(300 * time.Millisecond)
 		}
 	}
 }
 
 func CheckHTTP(host string, check Check) error {
 
-
 	client := &http.Client{
 		Timeout: time.Duration(check.Timeout) * time.Second,
 	}
 	req, err := http.NewRequest(check.Method, fmt.Sprintf("http://%s%s", host, check.Uri), nil)
-  if err != nil {
+	if err != nil {
-    return err
+		return err
-  }
+	}
-  if len(check.Host) > 0 {
+	if len(check.Host) > 0 {
-    req.Header.Set("Host", check.Host)
+		req.Header.Set("Host", check.Host)
-  }
+	}
 	resp, err := client.Do(req)
 	if err != nil {
 		return err
 	}
-  defer resp.Body.Close()
+	defer resp.Body.Close()
 	_, _ = io.ReadAll(resp.Body)
 
 	return nil
 }
 
 func CheckTCP(host string, check Check) error {
-  cnx, err := net.DialTimeout("tcp", fmt.Sprintf("%s:%d", host, check.Port), time.Duration(check.Timeout) * time.Second)
+	cnx, err := net.DialTimeout("tcp", fmt.Sprintf("%s:%d", host, check.Port), time.Duration(check.Timeout)*time.Second)
-  if err != nil {
+	if err != nil {
-    return err
+		return err
-  }
+	}
-  cnx.Close()
+	cnx.Close()
 	return nil
 }
 
@@ -207,57 +239,61 @@ func CheckSMTP(host string, check Check) error {
 }
 
 func validateConfiguration(conf map[string]Group) error {
-  for name, group := range conf {
+	for name, group := range conf {
-    log.Println("Validating configuration", name)
+		if verbose > 1 {
-    if len(group.Tables) == 0 {
+			log.Println("Validating configuration", name)
-      return errors.New(fmt.Sprintf("No tables in group %s", name))
+		}
-    }
+		if len(group.Tables) == 0 {
-    log.Println("Hosts", group.Hosts)
+			return errors.New(fmt.Sprintf("No tables in group %s", name))
-    if len(group.Hosts) == 0 {
+		}
-      return errors.New(fmt.Sprintf("No hosts in group %s", name))
+		if verbose > 1 {
-    }
+			log.Println("Hosts", group.Hosts)
-    for _, host := range group.Hosts {
+		}
-      ip := net.ParseIP(host)
+		if len(group.Hosts) == 0 {
-      if ip == nil {
+			return errors.New(fmt.Sprintf("No hosts in group %s", name))
-        return errors.New(fmt.Sprintf("Host %v is not an IP in group %s", host, name))
+		}
-      }
+		for _, host := range group.Hosts {
-    }
+			ip := net.ParseIP(host)
-    switch group.Check.Type {
+			if ip == nil {
-    case "http":
+				return errors.New(fmt.Sprintf("Host %v is not an IP in group %s", host, name))
-      if len(group.Check.Method) == 0 {
+			}
-        group.Check.Method = "HEAD"
+		}
-      }
+		switch group.Check.Type {
-      switch group.Check.Method {
+		case "http":
-      case "HEAD":
+			if len(group.Check.Method) == 0 {
-      case "GET":
+				group.Check.Method = "HEAD"
-      default:
+			}
-        return errors.New(fmt.Sprintf("Check method shoud be HEAD or GET in group %s", name))
+			switch group.Check.Method {
-      }
+			case "HEAD":
-      if group.Check.Port == 0 {
+			case "GET":
-        group.Check.Port = 80
+			default:
-      }
+				return errors.New(fmt.Sprintf("Check method shoud be HEAD or GET in group %s", name))
-      if len(group.Check.Uri) == 0 {
+			}
-        group.Check.Uri = "/"
+			if group.Check.Port == 0 {
-      }
+				group.Check.Port = 80
-    case "tcp":
+			}
-      if group.Check.Port == 0 {
+			if len(group.Check.Uri) == 0 {
-        return errors.New(fmt.Sprintf("Check port is undefined or 0 in group %s", name))
+				group.Check.Uri = "/"
-      }
+			}
-    case "smtp":
+		case "tcp":
-      if group.Check.Port == 0 {
+			if group.Check.Port == 0 {
-        group.Check.Port = 25
+				return errors.New(fmt.Sprintf("Check port is undefined or 0 in group %s", name))
-      }
+			}
+		case "smtp":
+			if group.Check.Port == 0 {
+				group.Check.Port = 25
+			}
 
-    default:
+		default:
-      return errors.New(fmt.Sprintf("Check type should be http, smtp or tcp in group %s",name))
+			return errors.New(fmt.Sprintf("Check type should be http, smtp or tcp in group %s", name))
-    }
+		}
-    if group.Check.Interval == 0 {
+		if group.Check.Interval == 0 {
-      group.Check.Interval = 5
+			group.Check.Interval = 5
-    }
+		}
-    if group.Check.Timeout == 0 {
+		if group.Check.Timeout == 0 {
-      group.Check.Timeout = 2
+			group.Check.Timeout = 2
-    }
+		}
-    conf[name] = group
+		conf[name] = group
-  }
+	}
-  return nil
+	return nil
 }

hostchecker.rc

@@ -0,0 +1,12 @@
+#!/bin/sh
+
+. /etc/rc.subr
+
+name=hostchecker
+rcvar=hostchecker_enable
+
+command="/usr/local/bin/${name}" 
+command_args="&"
+
+load_rc_config $name
+run_rc_command "$1"