sneak
87bce43f8d
All checks were successful
check / check (push) Successful in 1m23s
Rework of the unit at #93 (commit9cb2c2b), against the review at #136 (comment). Review of9cb2c2bfound the quorum assertions could not fail on a class of wrong answer. Each test banned exactly one bad status — _AllReturnOK banned only nxdomain, _NXDomainFromAllNS banned only ok — so resolver.StatusNoData passed both. nodata is a wrong answer, not silence, and answeredCount counted it as answered, so it did not even trigger a retry; with a quorum of 3 of 4 a single wrong nameserver slid through undetected. That is assertion-loosening beyond what the quorum change requires. Tolerance is now a closed allowlist rather than a blocklist of one status. unsanctionedStatuses() reports every per-nameserver result whose status the caller did not explicitly sanction: ok/timeout/error for the all-OK test, nxdomain/timeout/error for the NXDOMAIN test. Silence (timeout, error) is the only thing quorum exists to tolerate; any other status, including one added to the resolver later, fails by name. answeredCount is likewise an allowlist of ok/nxdomain/nodata, so an unknown status counts as silence and can only cause a retry and then a loud failure, never a quiet pass. Two harness tests cover the regression directly: three OK plus one nodata (quorum satisfied, no nxdomain present — the input that used to pass) is now reported as unsanctioned, and an unknown status is neither counted as answered nor tolerated. Verified by re-running the reviewer's probe: queryEachNS patched to force one of google.com's four nameservers to return StatusNoData turns both tests red, naming the offending nameserver and status — --- FAIL: TestQueryAllNameservers_AllReturnOK (1.12s) Should be empty, but was [ns1.google.com.=nodata] every nameserver must answer OK or not answer at all: ns1.google.com.=nodata ns2.google.com.=ok ns3.google.com.=ok ns4.google.com.=ok --- FAIL: TestQueryAllNameservers_NXDomainFromAllNS (1.34s) Should be empty, but was [ns1.google.com.=nodata] every nameserver must report NXDOMAIN or not answer at all: ns1.google.com.=nodata ns2.google.com.=nxdomain ns3.google.com.=nxdomain ns4.google.com.=nxdomain — and green with the probe reverted. Also fixes the review's nit: the per-attempt deadline assertion had no lower bound, so it passed for a deadline far shorter than intended. No production code changed; DNS is still never mocked.
179 lines
8.6 KiB
Markdown
179 lines
8.6 KiB
Markdown
# Workflow
|
|
|
|
* branch (from `main`)
|
|
* do the work in Next Step
|
|
* move Next Step to the top of Completed Steps
|
|
* move the top item of Future Steps into Next Step
|
|
* commit (`TODO.md` changes in the same commit as the work)
|
|
* merge to `main` if the branch is not protected, otherwise open a PR
|
|
* push
|
|
|
|
# Status
|
|
|
|
pre-1.0. No git tags. Core resolver work in flight on feature/resolver
|
|
(dirty: internal/resolver/resolver_test.go). Local checkout has diverged
|
|
from origin: origin/main is 8 commits ahead (watcher orchestrator,
|
|
unified TARGETS) and origin/feature/resolver already contains the full
|
|
iterative resolver implementation with hermetic mocked tests.
|
|
|
|
# Next Step
|
|
|
|
Policy scaffold commit: add LICENSE, REPO_POLICIES.md, .editorconfig,
|
|
.dockerignore, and .gitea/workflows/check.yml, and add the missing
|
|
fmt-check, docker, and hooks targets to the Makefile. One commit, then
|
|
confirm make check still passes.
|
|
|
|
# Completed Steps
|
|
|
|
- 2026-08-10: live-DNS test flakiness addressed by robustness rather
|
|
than gating, per the owner's ruling on #93: new
|
|
`internal/resolver/livedns_test.go` adds a package-wide concurrency
|
|
gate (so parallel tests stop bursting at the first root server),
|
|
retry with exponential backoff on transport failures only, and
|
|
quorum instead of unanimity for multi-nameserver assertions. Quorum
|
|
tolerates silence only: every per-nameserver status must be in a
|
|
closed allowlist (`ok`/`timeout`/`error`, or
|
|
`nxdomain`/`timeout`/`error`), so a wrong answer from a minority —
|
|
`nodata` today, any status added later — fails the test instead of
|
|
sliding through under the majority. The
|
|
`make test` cap moved to the new org-wide 60s hard cap / 20s target
|
|
with a 90s `-timeout` backstop; `REPO_POLICIES.md` re-vendored
|
|
byte-identical from `sneak/prompts`. No mocks, no `-short`, no build
|
|
tags, no skips, and no change to production resolver behaviour
|
|
- 2026-08-10: all linting moved into Docker: new root `Dockerfile.lint`
|
|
on the digest-pinned `golangci/golangci-lint:v2.12.2` image,
|
|
`script/lint` reduced to a thin wrapper that builds it with
|
|
`--no-cache-filter=lint` so the linter actually executes every run,
|
|
golangci-lint install dropped from `script/bootstrap` (goimports
|
|
stays, `script/fmt` needs it on the host), and the root `Dockerfile`
|
|
given its own lint stage so its build no longer recurses through
|
|
`make check` into `script/lint`. `golangci-lint config verify` is
|
|
deliberately omitted: it fetches its schema over an unpinned live
|
|
HTTPS call
|
|
- 2026-08-07: golangci-lint bumped to v2.12.2 (commit-pinned installs
|
|
in `Dockerfile` and `script/bootstrap`); `.golangci.yml` set to the
|
|
org-standard v2-schema config used across the org's repos
|
|
(owner-authorized; same file is being landed as canonical via prompts
|
|
PR #24), with settings under `linters.settings` so the
|
|
lll/funlen/cyclop/dupl thresholds apply; fixed the resulting
|
|
`goconst`, `dupl`, and `lll` findings; the informational `gomodguard`
|
|
deprecation warning under this config is accepted
|
|
- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
|
|
Makefile shims, README Entrypoints section
|
|
- 2026-02-20: iterative DNS resolver implemented; tests made hermetic
|
|
with mocked DNS (origin/feature/resolver, unmerged)
|
|
- 2026-02-20: CI actions and go install refs pinned to commit SHAs;
|
|
Gitea Actions workflow for make check (origin/ci/make-check, unmerged)
|
|
- 2026-02-20: watcher monitoring orchestrator merged to main (#8)
|
|
- 2026-02-20: DOMAINS/HOSTNAMES unified into single TARGETS config (#11)
|
|
- 2026-02-19: TCP port connectivity checker, made concurrent with port
|
|
validation; gosec G704 SSRF findings fixed without suppression
|
|
(feature branches, unmerged)
|
|
- 2026-02-19: TLS certificate inspector with no-peer-certificates error
|
|
path and IP SANs (feature branch, unmerged)
|
|
- 2026-02-19: gosec SSRF and formatting fixes on main
|
|
- 2026-02-19: initial scaffold with per-nameserver DNS monitoring model
|
|
|
|
# Future Steps
|
|
|
|
Compliance:
|
|
|
|
- Add README sections required by policy (Description, Getting Started,
|
|
Rationale, Design, TODO, License, Author) if any are missing
|
|
- Pin Dockerfile base images by sha256 and ensure the Docker build runs
|
|
make check
|
|
|
|
Branch reconciliation:
|
|
|
|
- Sync local checkout with origin: local main is 8 commits behind
|
|
origin/main; local feature/resolver has diverged from
|
|
origin/feature/resolver, which already implements the resolver
|
|
- Merge in-flight branches to main once green: feature/resolver,
|
|
ci/make-check, feature/portcheck-implementation,
|
|
feature/tlscheck-implementation
|
|
|
|
Resolver (plan from untracked TODO.md; largely implemented on
|
|
origin/feature/resolver, verify each item before closing):
|
|
|
|
- Add github.com/miekg/dns dependency
|
|
- roots.go: hardcoded IANA root server list (a through m, IPv4/IPv6),
|
|
rootServers() returning ip:53 strings
|
|
- query.go: low-level query(ctx, server, name, qtype): UDP with TCP
|
|
fallback on truncation, RD=0, context respected, 5s per-query timeout,
|
|
returns raw *dns.Msg
|
|
- trace.go: iterative delegation chasing from roots: referral detection
|
|
(NOERROR, empty answer, NS in authority), glue extraction with
|
|
bailiwick check, out-of-bailiwick NS resolved with recursion guard,
|
|
delegation depth limit (20), retry across nameservers on failure, do
|
|
not chase CNAMEs inside trace
|
|
- FindAuthoritativeNameservers: NS set via trace, sorted, FQDN
|
|
normalized, trailing dot handled; must pass its 9 tests
|
|
- QueryNameserver: resolve NS host to IPs, query A/AAAA/CNAME/MX/TXT/
|
|
SRV/CAA/NS, build NameserverResponse with status mapping (OK,
|
|
NXDomain, NoData, Error), documented record formatting, sorted values,
|
|
lame delegation detection; must pass its 16 tests
|
|
- QueryAllNameservers: find NS set for parent domain (public suffix
|
|
list), query all NS in parallel with bounded concurrency, return map
|
|
even when all fail, context cancellation; must pass its 4 tests
|
|
- LookupNS: thin wrapper over FindAuthoritativeNameservers, sorted,
|
|
identical results; must pass its 3 tests
|
|
- ResolveIPAddresses: collect A/AAAA from all NS, follow CNAME chains
|
|
with MaxCNAMEDepth, dedupe, sort, NXDOMAIN returns empty slice with
|
|
nil error; must pass its 9 tests
|
|
- All 39 resolver tests pass, make check green, merge to main
|
|
|
|
Watcher (internal/watcher/watcher.go):
|
|
|
|
- Scheduling loop in Run(ctx): initial check on startup, separate
|
|
tickers for DNS/port and TLS intervals, persist state via state.Save()
|
|
after each cycle, clean shutdown on context cancel
|
|
- Domain check: LookupNS, compare to stored state, store silently on
|
|
first run, notify with old/new NS lists on change
|
|
- Hostname check: QueryAllNameservers, compare per-NS records; notify on
|
|
record changes, NS failure, NS recovery, inconsistency detected,
|
|
inconsistency resolved, empty response; store silently on first run
|
|
- Port check: ResolveIPAddresses, check ports 80 and 443 per IP, notify
|
|
on open/closed transitions, handle new and disappeared IPs
|
|
- TLS check: for each open IP:443, CheckCertificate; notify on expiry
|
|
warning, certificate change (CN/issuer/SANs), TLS failure/recovery
|
|
|
|
Port checker (internal/portcheck/portcheck.go):
|
|
|
|
- Tests against known-open ports and RFC documentation IPs
|
|
- CheckPort: net.DialTimeout (5s), context respected; (true, nil) open,
|
|
(false, nil) closed/timeout/refused, error only for unexpected
|
|
failures
|
|
|
|
TLS checker (internal/tlscheck/tlscheck.go):
|
|
|
|
- Tests against known public HTTPS servers, verify fields populated
|
|
- CheckCertificate: tls.Dial to specific IP:443 with hostname as SNI;
|
|
extract subject CN, issuer CN and org, NotAfter, SANs; error on
|
|
handshake failure
|
|
|
|
Notification service (internal/notify/notify.go, Slack/Mattermost/ntfy
|
|
backends exist):
|
|
|
|
- Structured notification types: DNS change, port change, TLS expiry,
|
|
TLS change, NS failure, NS recovery, NS inconsistency
|
|
- Per-backend formatting: Slack/Mattermost attachment colors (red
|
|
failures/expiry, yellow warnings, green recoveries, blue info); ntfy
|
|
priorities (urgent failures, high warnings, default changes, low
|
|
recoveries); include hostname, nameserver, old/new values, timestamps
|
|
|
|
HTTP API handlers:
|
|
|
|
- Wire *state.State and *watcher.Watcher into handler params
|
|
- GET /api/v1/status: full state snapshot as JSON
|
|
- GET /api/v1/domains: domain states with NS records and last-checked
|
|
- GET /api/v1/hostnames: hostname states with per-NS record data
|
|
|
|
Infrastructure notes (from untracked TODO.md):
|
|
|
|
- Module path sneak.berlin/go/dnswatcher differs from the git.eeqj.de
|
|
remote intentionally; do not "fix" it
|
|
- Dependencies: github.com/miekg/dns, golang.org/x/net/publicsuffix
|
|
- Resolver tests originally used live DNS against *.dns.sneak.cloud
|
|
(required records documented in the test file header); origin now has
|
|
mocked hermetic tests, keep them hermetic
|