78 lines
2.5 KiB
Bash
Executable File
78 lines
2.5 KiB
Bash
Executable File
#!/bin/bash
|
|
# Quick check of the contest firewall, to run on a contest machine once the
|
|
# firewall is active: allowed sites must answer, every other site must fail,
|
|
# also when a program forces the address of the contest site for another name.
|
|
CONTEST_URL=${CONTEST_URL:-https://atlantic-canada26.kattis.com}
|
|
CONTEST_HOST=${CONTEST_URL#https://}
|
|
CONTEST_HOST=${CONTEST_HOST%%/*}
|
|
fail=0
|
|
|
|
report() {
|
|
if [ "$2" = "$3" ]; then
|
|
echo "OK $1 is $2"
|
|
else
|
|
echo "PROBLEM $1 is $2 (expected: $3)"
|
|
fail=1
|
|
fi
|
|
}
|
|
|
|
check() {
|
|
expected=$1
|
|
url=$2
|
|
if curl -s -o /dev/null --max-time 8 "$url"; then result=reachable; else result=blocked; fi
|
|
report "$url" $result "$expected"
|
|
}
|
|
|
|
# Another site reached through the address of the contest site (Cloudflare)
|
|
check_through_contest() {
|
|
host=$1
|
|
if curl -s -o /dev/null --max-time 8 --resolve "$host:443:$contest_ip" "https://$host/"; then
|
|
result=reachable
|
|
else
|
|
result=blocked
|
|
fi
|
|
report "https://$host/ through the address of $CONTEST_HOST" $result blocked
|
|
}
|
|
|
|
check reachable "$CONTEST_URL"
|
|
check reachable https://status.kattis.com
|
|
check reachable https://devdocs/
|
|
check blocked https://open.kattis.com
|
|
check blocked https://www.google.com
|
|
check blocked https://github.com
|
|
check blocked https://chatgpt.com
|
|
|
|
contest_ip=$(getent ahostsv4 "$CONTEST_HOST" | awk 'NR == 1 {print $1}')
|
|
if [ -n "$contest_ip" ]; then
|
|
check_through_contest open.kattis.com
|
|
check_through_contest pastebin.com
|
|
check_through_contest discord.com
|
|
else
|
|
echo "PROBLEM $CONTEST_HOST does not resolve"
|
|
fail=1
|
|
fi
|
|
|
|
# DNS: only the allowed names get an answer, and the DNS resolvers outside
|
|
# cannot be reached directly (no data exchanged through DNS)
|
|
if [ -n "$(dig +short +time=3 +tries=1 TXT example.com 2>/dev/null)" ]; then result=reachable; else result=blocked; fi
|
|
report "DNS for other names (TXT example.com)" $result blocked
|
|
if dig +time=3 +tries=1 example.com @1.1.1.1 >/dev/null 2>&1; then result=reachable; else result=blocked; fi
|
|
report "the DNS resolver 1.1.1.1 directly" $result blocked
|
|
|
|
echo
|
|
for unit in contest-proxy contest-dns; do
|
|
if systemctl is-active --quiet $unit.service; then
|
|
echo "OK $unit is running"
|
|
else
|
|
echo "PROBLEM $unit.service is not running"
|
|
fail=1
|
|
fi
|
|
done
|
|
if chronyc -n sources 2>/dev/null | grep -qE '^\^\*'; then
|
|
echo "OK the clock is synchronized (NTP)"
|
|
else
|
|
echo "PROBLEM the clock is not synchronized yet (check again in a minute)"
|
|
fail=1
|
|
fi
|
|
exit $fail
|