Package: conn-check
conn-check allows for checking connectivity with external services.You can write a config file that defines services that you need to
have access to, and conn-check will check connectivity with each.It supports various types of services, all of which allow for
basic network checks, but some allow for confirming credentials
work also.ConfigurationThe configuration is done via a yaml file. The file defines a list
of checks to do:-type:tcphost:localhostport:80-type:tlshost:localhostport:443disable_tls_verification:falseEach check defines a type, and then options as appropriate for that type.For a step by step guide on configuring conn-check for your applicationsee the tutorial.Check TypestcpA simple tcp connectivity check.hostThe host.portThe port.timeoutOptional connection timeout in seconds. default: 5 (or value from--connect-timeout).tlsA check that uses TLS (sslis a deprecated alias for this type).hostThe host.portThe port.disable_tls_verificationOptional flag to disable verification of TLS certs and handshake. Default:
false.timeoutOptional connection timeout in seconds. default: 5 (or value from--connect-timeout).udpCheck that sending a specific UDP packet gets a specific response.hostThe host.portThe port.sendThe string to send.expectThe string to expect in the response.timeoutOptional connection timeout in seconds. default: 5 (or value from--connect-timeout).httpCheck that a HTTP/HTTPS request succeeds (httpsalso works).urlThe URL to fetch.methodOptional HTTP method to use. Default: “GET”.expected_codeOptional status code that defines success. Default: 200.proxy_urlOptional HTTP/HTTPS proxy URL to connect via, including protocol,
if set proxy_{host,port} are ignored.proxy_hostOptional HTTP/HTTPS proxy to connect via.proxy_portOptional port to use withproxy_host. Default: 8000.headers:Optional headers to send, as a dict of key-values. Multiple values can be
given as a list/tuple of lists/tuples, e.g.:[('foo','bar'),('foo','baz')]body:Optional raw request body string to send.disable_tls_verification:Optional flag to disable verification of TLS certs and handshake. Default:
false.timeoutOptional connection timeout in seconds. default: 5 (or value from--connect-timeout).allow_redirectsOptional flag to Follow 30x redirects. Default: false.paramsOptional dict of params to URL encode and pass in the querystring.cookiesOptional dict of cookies to pass in the request headers.authOptionalbasic HTTP authcredentials, as a tuple/list:(username, password).digest_authOptionaldigest HTTP authcredentials, as a tuple/list:(username, password).amqpCheck that an AMQP server can be authenticated against.hostThe host.portThe port.usernameThe username to authenticate with.passwordThe password to authenticate with.use_tlsOptional flag whether to connect with TLS. Default: true.vhostOptional vhost name to connect to. Default ‘/’.timeoutOptional connection timeout in seconds. default: 5 (or value from--connect-timeout).postgresCheck that a PostgreSQL db can be authenticated against (postgresqlalso works).hostThe host.portThe port.usernameThe username to authenticate with.passwordThe password to authenticate with.databaseThe database to connect to.timeoutOptional connection timeout in seconds. default: 5 (or value from--connect-timeout).redisCheck that a redis server is present, optionally checking authentication.hostThe host.portThe port.passwordOptional password to authenticatie with.timeoutOptional connection timeout in seconds. default: 5 (or value from--connect-timeout).memcacheCheck that a memcached server is present (memcachedalso works).hostThe host.portThe port.timeoutOptional connection timeout in seconds. default: 5 (or value from--connect-timeout).mongodbCheck that a MongoDB server is present (mongoalso works).hostThe host.portOptional port. Default: 27017.usernameOptional username to authenticate with.passwordOptional password to authenticate with.databaseOptional database name to connect to, if not set thetestdatabase will be used,
if this database does not exist (or is not available to the user) you will need to
provide a database name.timeoutOptional connection timeout in seconds. default: 5 (or value from--connect-timeout).smtpCheck that we can reach, authenticate with and send an email using an SMTP server.Note 1: if this check succeeds an email is actually sent to the email
defined into_address, be careful how this is check is configured so it doesn’t
unintentionally spam anyone.Note 2: only EHLO/HELO over a TLS connection is supported with theuse_tlsflag, this check cannot currently create new TLS connection using theSTARTTLS Extension.hostThe host.portThe port, normally 465 for TLS and 25 for plaintext.usernameUsername to authenticate with.passwordPassword to authenticate with.from_address:Email address to sendfrom.to_address:Email address to sendto.message:Optional email body.subject:Optional email subject.helo_fallback:Optional flag that defines whether to fall back toHELOif theEHLOextended command set fails.use_tls:Optional flag to enable TLS security on connection. Default: true.timeoutOptional connection timeout in seconds. default: 5 (or value from--connect-timeout).TimeoutsBy default conn-check’s global timeout (max-timeout) is set to 9 seconds, this is because
when used with Nagios the maximum timeout for NRPE commands is 10 seconds, so we need to ensure
checks execute with enough time to output any errors (if you hit the NRPE timeout no output will
be returned, just a socket error from Nagios).If you need longer timeouts you can always setmax-timeoutyourself (it is settings, but
accepts floats for sub-second values).You can also set a different connect timeout, which is time taken to open an inidivual connection
(without doing anything else) per check, which is set globally with--connect-timeout, or per
check using thetimeoutargumnent that most check types accept.TagsEvery check type also supports atagsfield, which is a list of tags that
can be used with the--include-tagsand--exclude-tagsarguments to conn-check.Example YAML:-type:httpurl:http://google.com/tags:-externalTo run just “external” checks:conn-check --include-tags=external ...To run all the checksexceptexternal:conn-check --exclude-tags=externalBuffered/Ordered outputconn-check normally executes with output toSTDOUTbuffered so that the output can be ordered,
with failed checks being printed first, grouping by destination etc.If you’d rather see results as they available you can use the-U/--unbuffered-outputoption
to disable buffering.Generating firewall rulesconn-check includes theconn-check-export-fwutility which takes the same arguments asconn-checkbut runs using--dry-runmode and outputs a set ofegressfirewall
rules in an easy to parse YAML format, for example:# Generated from the conn-check demo.yaml fileegress:-from_host:mydevmachineports:[8080]protocol:udpto_host:localhost-from_host:mydevmachineports:[80,443]protocol:tcpto_host:login.ubuntu.com-from_host:mydevmachineports:[6379,11211]protocol:tcpto_host:127.0.0.1You can then use this output to generate your environments firewall rules (e.g. withEC2 security groups,OpenStack Neutron,iptablesetc.).conn-check-convert-fwis a utility that does just this, it accepts multiple firewall
rule YAML files, merges/de-dupes them, and outputs commands for AWS, Openstack Neutron,
OpenStack Nova (client), iptables, and ufw (mostly for testing purposes).It is designed for this workflow:On each host you run conn-check from, you runconn-check-export-fwto generate
a YAML file containing egress firewall rules.Each of these files is transfered to a host with the correct DNS entries for the
egress hosts.On this hostconn-check-convert-fwis run to generate a set of commands
for your firewall.These commands are audited by a human / possibly merged with other rules, such as
adding ingress rules, and then run to update your environment’s firewall.Building wheelsTo allow for easier/more portable distribution of this tool you can build
conn-check and all its dependencies asPython wheels:make clean-wheels
make build-wheels
make build-wheels-extra EXTRA=amqp
make build-wheels-extra EXTRA=redisThebuild-wheelsmake target will build conn-check and its base
dependencies, but to include the optional extra dependencies for other
checks such as amqp, redis or postgres you need to use thebuild-wheels-extratarget with theEXTRAenv value.By default all the wheels will be placed in./wheels.Automatically generating conn-check YAML configurationsTheconn-check-configspackage contains utilities/libraries
for generating checks from existing application configurations and environments, e.g. from Django settings modules
and Juju environments.