The watcher joined an address and its port as address:port. For an IPv6 address that gave 2a01:4f8:2200:fd11::1:80, which is also an IPv6 address on its own. Port and certificate keys are now joined with net.JoinHostPort and port keys split with net.SplitHostPort, so an IPv6 address is in brackets ([2a01:4f8:2200:fd11::1]:80) and an IPv4 one is unchanged. The state file, /api/v1/status, the dashboard's Ports and Certificates tables and the Port Change notification all show these keys, so this one change reaches all of them.
A certificate key ([2001:db8::1]:443:www.example.com) is still split at its last colon, since a hostname has none, and the part before it is split as a port key. The certificate cleanup from #280 looks up port 443 by the same joined key.
The new test runs the port checks, the TLS checks and the port checks again for a hostname at an IPv6 address, then a last port check that finds port 443 closed and removes the certificate entry. Three existing tests built keys by hand for addresses that can be IPv6 (a saved AAAA record, and live answers for example.org); they now use the bracketed form. The README's State File Format section says how the keys are written.
Partly verified: the dashboard and /api/v1/status print the saved keys unchanged. I checked this by reading the handlers and the template; no test covers it.
Judgement call: the new test spells AAAA as a local constant, because a third literal in the package's tests trips the linter's repeated-string check.
Model: opus-5-5
Fixes https://git.eeqj.de/sneak/dnswatcher/issues/270.
The watcher joined an address and its port as `address:port`. For an IPv6 address that gave `2a01:4f8:2200:fd11::1:80`, which is also an IPv6 address on its own. Port and certificate keys are now joined with `net.JoinHostPort` and port keys split with `net.SplitHostPort`, so an IPv6 address is in brackets (`[2a01:4f8:2200:fd11::1]:80`) and an IPv4 one is unchanged. The state file, `/api/v1/status`, the dashboard's Ports and Certificates tables and the Port Change notification all show these keys, so this one change reaches all of them.
A certificate key (`[2001:db8::1]:443:www.example.com`) is still split at its last colon, since a hostname has none, and the part before it is split as a port key. The certificate cleanup from https://git.eeqj.de/sneak/dnswatcher/pulls/280 looks up port 443 by the same joined key.
The new test runs the port checks, the TLS checks and the port checks again for a hostname at an IPv6 address, then a last port check that finds port 443 closed and removes the certificate entry. Three existing tests built keys by hand for addresses that can be IPv6 (a saved AAAA record, and live answers for `example.org`); they now use the bracketed form. The README's State File Format section says how the keys are written.
Partly verified: the dashboard and `/api/v1/status` print the saved keys unchanged. I checked this by reading the handlers and the template; no test covers it.
Judgement call: the new test spells `AAAA` as a local constant, because a third literal in the package's tests trips the linter's repeated-string check.
Model: opus-5-5
internal/watcher/watcher.go, cleanupStaleCertificates: no test covers the port 443 lookup for an IPv6 address. It could go back to the unbracketed form unnoticed, and an IPv6 address's certificate entry would again stay ok after its port 443 closes (#265). Acceptable: a test in which a TLS check saves the certificate entry for an IPv6 address, a later port check finds its port 443 closed, and the entry is removed (for example, as a last step in TestIPv6AddressInBrackets).
Model: opus-5-5
Review: FAIL
- `internal/watcher/watcher.go`, `cleanupStaleCertificates`: no test covers the port 443 lookup for an IPv6 address. It could go back to the unbracketed form unnoticed, and an IPv6 address's certificate entry would again stay `ok` after its port 443 closes (https://git.eeqj.de/sneak/dnswatcher/issues/265). Acceptable: a test in which a TLS check saves the certificate entry for an IPv6 address, a later port check finds its port 443 closed, and the entry is removed (for example, as a last step in `TestIPv6AddressInBrackets`).
Model: opus-5-5
Port and certificate keys were joined as address:port, so an IPv6
address ran into its port: 2a01:4f8:2200:fd11::1:80 is also an address
on its own. Keys are now joined with net.JoinHostPort and split with
net.SplitHostPort, giving [2a01:4f8:2200:fd11::1]:80 in the state file,
/api/v1/status, the dashboard and Port Change notifications; an IPv4
address is unchanged. A certificate key still splits at its last colon,
since a hostname has none. Tests that built IPv6 keys by hand now use
the bracketed form, and a test checks that an IPv6 address's
certificate entry is removed when its port 443 closes.
Model: opus-5-5
cleanupStaleCertificates port 443 lookup for an IPv6 address: TestIPv6AddressInBrackets now ends with a port check that finds port 443 closed and requires the IPv6 address's certificate entry to be removed; with the lookup put back to the unbracketed form, the test fails.
Model: opus-5-5
Rework:
- `cleanupStaleCertificates` port 443 lookup for an IPv6 address: `TestIPv6AddressInBrackets` now ends with a port check that finds port 443 closed and requires the IPv6 address's certificate entry to be removed; with the lookup put back to the unbracketed form, the test fails.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes #270.
The watcher joined an address and its port as
address:port. For an IPv6 address that gave2a01:4f8:2200:fd11::1:80, which is also an IPv6 address on its own. Port and certificate keys are now joined withnet.JoinHostPortand port keys split withnet.SplitHostPort, so an IPv6 address is in brackets ([2a01:4f8:2200:fd11::1]:80) and an IPv4 one is unchanged. The state file,/api/v1/status, the dashboard's Ports and Certificates tables and the Port Change notification all show these keys, so this one change reaches all of them.A certificate key (
[2001:db8::1]:443:www.example.com) is still split at its last colon, since a hostname has none, and the part before it is split as a port key. The certificate cleanup from #280 looks up port 443 by the same joined key.The new test runs the port checks, the TLS checks and the port checks again for a hostname at an IPv6 address, then a last port check that finds port 443 closed and removes the certificate entry. Three existing tests built keys by hand for addresses that can be IPv6 (a saved AAAA record, and live answers for
example.org); they now use the bracketed form. The README's State File Format section says how the keys are written.Partly verified: the dashboard and
/api/v1/statusprint the saved keys unchanged. I checked this by reading the handlers and the template; no test covers it.Judgement call: the new test spells
AAAAas a local constant, because a third literal in the package's tests trips the linter's repeated-string check.Model: opus-5-5
Review: FAIL
internal/watcher/watcher.go,cleanupStaleCertificates: no test covers the port 443 lookup for an IPv6 address. It could go back to the unbracketed form unnoticed, and an IPv6 address's certificate entry would again stayokafter its port 443 closes (#265). Acceptable: a test in which a TLS check saves the certificate entry for an IPv6 address, a later port check finds its port 443 closed, and the entry is removed (for example, as a last step inTestIPv6AddressInBrackets).Model: opus-5-5
bd22c1ce97to2de3c4b820Rework:
cleanupStaleCertificatesport 443 lookup for an IPv6 address:TestIPv6AddressInBracketsnow ends with a port check that finds port 443 closed and requires the IPv6 address's certificate entry to be removed; with the lookup put back to the unbracketed form, the test fails.Model: opus-5-5
Review: PASS
Model: opus-5-5