Add UDP listen integrity check for Monit

Author: szepeviktor

monitoring/monit/services/01-system

@@ -126,6 +126,18 @@
    group integrity
    if status != 0 then alert
 
+ # Open TCP listening sockets
+ check program network_tcp_listen
+    with path "/usr/local/sbin/server-integrity.sh -c TCPLISTEN -r '@@INTEGRITY_TCPLISTEN@@'" every 33 cycles
+   group integrity
+   if status != 0 then alert
+
+ # Open UDP listening sockets
+ check program network_udp_listen
+    with path "/usr/local/sbin/server-integrity.sh -c UDPLISTEN -r '@@INTEGRITY_UDPLISTEN@@'" every 33 cycles
+   group integrity
+   if status != 0 then alert
+
  # List of files in /
  check program fs_rootlist
     with path "/usr/local/sbin/server-integrity.sh -c ROOT -r '@@INTEGRITY_ROOTLIST@@'" every 33 cycles

monitoring/monit/services/01-system_preinst

@@ -32,4 +32,6 @@ INTEGRITY_HOP2_DEFAULT="$(/usr/local/sbin/server-integrity.sh -c HOP2 -h "$INTEG
 INTEGRITY_REVERSE_DEFAULT="$(/usr/local/sbin/server-integrity.sh -c PTR1)"
 INTEGRITY_FIRST_MX_DEFAULT="$(/usr/local/sbin/server-integrity.sh -c MX1 || true)"
 INTEGRITY_RESOLVERS_DEFAULT="$(/usr/local/sbin/server-integrity.sh -c RES)"
+INTEGRITY_TCPLISTEN_DEFAULT="$(/usr/local/sbin/server-integrity.sh -c TCPLISTEN)"
+INTEGRITY_UDPLISTEN_DEFAULT="$(/usr/local/sbin/server-integrity.sh -c UDPLISTEN)"
 INTEGRITY_ROOTLIST_DEFAULT="$(/usr/local/sbin/server-integrity.sh -c ROOT)"

monitoring/monit/services/01-system_script

@@ -243,6 +243,9 @@ case "$CHECK" in
     TCPLISTEN)
         RESULT="$(awk 'FNR > 1 && $4 == "0A" {print $2}' /proc/net/tcp /proc/net/tcp6 | sort | md5sum | cut -d " " -f 1)"
         ;;
+    UDPLISTEN)
+        RESULT="$(awk 'FNR > 1 && $3 == "00000000:0000" {print $2}' /proc/net/udp /proc/net/udp6 | sort | md5sum | cut -d " " -f 1)"
+        ;;
     *)
         # Missing check
         exit 11

webserver/HTTP-response-headers.md

@@ -4,28 +4,36 @@
 
 :memo: Section 7 of \[RFC9110]
 
-- `Connection`
 - `Upgrade`
+- `Connection`
 
 ## Caching & Freshness
 
 :memo: \[RFC9111]
 
+- `Age`
 - `Cache-Control`
+- `ETag`
 - `Expires`
 - `Last-Modified`
+- `Vary`
 
 ## Content & Representation Metadata
 
 :memo: Section 8 of \[RFC9110]
 
+- `Content-Encoding`
+- `Content-Language`
 - `Content-Length`
 - `Content-Type`
 
-## Request Context & Navigation
+## Request / Response Context
 
 :memo: Section 10 of \[RFC9110]
 
+MDN uses separate `Request context` and `Response context` group names.
+Fetch Metadata headers (`Sec-Fetch-*`) are request headers, so they are out of scope here.
+
 ## Authentication & Authorization
 
 :memo: Section 11 of \[RFC9110]
@@ -34,17 +42,22 @@
 
 :memo: \[RFC6265]
 
+- `Set-Cookie`
+
 ## Security & Privacy
 
 :memo: Section 12 of \[RFC9110], \[RFC6797], \[RFC8941]
 
+- `Content-Security-Policy`
 - `X-Content-Type-Options`
 - `Strict-Transport-Security`
 
 ## CORS (Cross-Origin Resource Sharing)
 
 :memo: [Fetch Living Standard – CORS](https://fetch.spec.whatwg.org/)
 
+- `Access-Control-Allow-Origin`
+
 ## Redirects & Location
 
 :memo: Section 15.5.2 of \[RFC9110]
@@ -53,29 +66,35 @@
 
 :memo: Section 7.6 of \[RFC9110]
 
+- `Via`
+
 ## Server & Response Info
 
 :memo: Sections 6 and 10 of \[RFC9110]
 
 - `Date`
 - `Server`
 
-## Streaming & Events (Range, SSE, WebSocket)
+## Streaming, Range & Protocol Upgrades
 
 :memo: Section 14 of \[RFC9110], \[RFC6455]
 
+This category combines MDN groups `Range requests`, `Server-sent events`, `Transfer coding`, and `WebSockets`.
+
 - `Accept-Ranges`
+- `Content-Range`
+- `Transfer-Encoding`
 
-## Miscellaneous / Non-standard
+## Other / Non-standard / Deprecated
 
 ## See also
 
 - https://www.iana.org/assignments/http-fields/http-fields.xhtml
 - https://www.geeksforgeeks.org/web-tech/http-headers/
 - https://github.com/mnot/redbot/blob/c47e907f0c76003fa6411e5a1ce0c9e35635d559/redbot/speak.py#L20-L27
-- [MDN HTTP headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers)
+- [MDN HTTP headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers)
 
 ```javascript
 Array.from(document.querySelectorAll("h2 > a")).map(function(anchor){return anchor.innerText}).join(",");
-// "Authentication,Caching,Conditionals,Connection management,Content negotiation,Controls,Cookies,CORS,Downloads,Integrity digests,Integrity policy,Message body information,Preferences,Proxies,Range requests,Redirects,Request context,Response context,Security,Server-sent events,Transfer coding,WebSockets,Other,Experimental headers,Non-standard headers,Deprecated headers,See also"
+// "Authentication,Caching,Conditionals,Connection management,Content negotiation,Controls,Cookies,CORS,Downloads,Integrity digests,Integrity policy,Message body information,Preferences,Proxies,Range requests,Redirects,Request context,Response context,Security,Fetch storage access headers,Server-sent events,Transfer coding,WebSockets,Other,Experimental headers,Non-standard headers,Deprecated headers,See also"
 ```