CRITICAL: Port and TLS checks for apex domains silently do nothing #19

Jauna problēma

clawbot · 2026-02-20T13:49:42+01:00

clawbot komentēja

2026-02-20 13:49:42 +01:00

Līdzstrādnieks

Bug

checkAllPorts() and runTLSChecks() both iterate over w.config.Domains and call collectIPs(domain). However, collectIPs reads from GetHostnameState(hostname), which only returns state set by checkHostname(). Domains go through checkDomain() which sets DomainState (nameservers only), never HostnameState.

func (w *Watcher) checkAllPorts(ctx context.Context) {
    // ...
    for _, domain := range w.config.Domains {
        w.checkPortsForHostname(ctx, domain)  // calls collectIPs
    }
}

func (w *Watcher) collectIPs(hostname string) []string {
    hs, ok := w.state.GetHostnameState(hostname)  // always false for domains!
    if !ok {
        return nil  // silently returns nothing
    }
    // ...
}

Impact

If a user configures example.com as a target (an apex domain), DNS NS monitoring works, but port monitoring and TLS certificate monitoring are silently skipped. No error is logged.

Fix

Either:

Resolve A/AAAA records for domains too (treating them also as hostnames for IP-level checks), or
Remove domains from the port/TLS check loops if they are intentionally NS-only, and document this behavior, or
Unify the domain/hostname distinction so all targets get full monitoring.

## Bug `checkAllPorts()` and `runTLSChecks()` both iterate over `w.config.Domains` and call `collectIPs(domain)`. However, `collectIPs` reads from `GetHostnameState(hostname)`, which only returns state set by `checkHostname()`. Domains go through `checkDomain()` which sets `DomainState` (nameservers only), never `HostnameState`. ```go func (w *Watcher) checkAllPorts(ctx context.Context) { // ... for _, domain := range w.config.Domains { w.checkPortsForHostname(ctx, domain) // calls collectIPs } } func (w *Watcher) collectIPs(hostname string) []string { hs, ok := w.state.GetHostnameState(hostname) // always false for domains! if !ok { return nil // silently returns nothing } // ... } ``` ## Impact If a user configures `example.com` as a target (an apex domain), DNS NS monitoring works, but port monitoring and TLS certificate monitoring are silently skipped. No error is logged. ## Fix Either: 1. Resolve A/AAAA records for domains too (treating them also as hostnames for IP-level checks), or 2. Remove domains from the port/TLS check loops if they are intentionally NS-only, and document this behavior, or 3. Unify the domain/hostname distinction so all targets get full monitoring.

clawbot pieminēja šo problēmu revīzijā

2026-02-21 09:53:44 +01:00

fix: look up A/AAAA records for apex domains to enable port/TLS checks (closes #19)

clawbot atsaucās uz izmaiņu pieprasījumu , kas atrisinās šo problēmu

2026-02-21 09:56:04 +01:00

fix: look up A/AAAA records for apex domains to enable port/TLS checks (closes #19) #21

sneak slēdza šo problēmu

2026-02-28 12:09:04 +01:00

sneak pieminēja šo problēmu revīzijā

2026-02-28 12:09:06 +01:00

Merge pull request 'fix: look up A/AAAA records for apex domains to enable port/TLS checks (closes #19)' (#21) from fix/domain-port-tls-state-lookup into main

Nepieciešams pieteikties, lai pievienotos šai sarunai.