admin/hetzner-api-dyndns-records-webinterface
0
0 Fork 0
Code Issues Pull Requests Packages Projects Releases 11 Wiki Activity

fix: harden DynDNS recovery and publish v1.5.1

Browse Source
This commit is contained in:
admin committed 2026-10-10 02:26:47 +02:00
1 parent 3383b91e49
commit 81def77e3c
37 files changed
+2415 -250
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/ipresolve/resolver.go
+87 -39
View File
@@ -12,6 +12,9 @@ import (
"net/url"
"strings"
"time"
"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/diagnostics"
"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/netresolve"
)
type Result struct {
@@ -22,10 +25,15 @@ type Result struct {
}
type Resolver struct {
resolver *net.Resolver
resolver interface {
LookupNetIP(context.Context, string, string) ([]netip.Addr, error)
}
clientFor func(*url.URL, []netip.Addr) *http.Client
}
func New() *Resolver { return &Resolver{resolver: net.DefaultResolver} }
func New() *Resolver {
return &Resolver{resolver: netresolve.New(), clientFor: newEndpointClient}
}
func (r *Resolver) Resolve(ctx context.Context, ipv4Endpoints, ipv6Endpoints []string) Result {
return r.ResolveWithIPv6(ctx, ipv4Endpoints, ipv6Endpoints, true)
@@ -33,9 +41,19 @@ func (r *Resolver) Resolve(ctx context.Context, ipv4Endpoints, ipv6Endpoints []s
func (r *Resolver) ResolveWithIPv6(ctx context.Context, ipv4Endpoints, ipv6Endpoints []string, ipv6Enabled bool) Result {
result := Result{}
// Each family gets independent endpoint deadlines.
var ipv6Result chan Result
if ipv6Enabled {
ipv6Result = make(chan Result, 1)
go func() {
ip, err := r.resolveFamily(ctx, ipv6Endpoints, false)
ipv6Result <- Result{IPv6: ip, IPv6Err: err}
}()
}
result.IPv4, result.IPv4Err = r.resolveFamily(ctx, ipv4Endpoints, true)
if ipv6Enabled {
result.IPv6, result.IPv6Err = r.resolveFamily(ctx, ipv6Endpoints, false)
ipv6 := <-ipv6Result
result.IPv6, result.IPv6Err = ipv6.IPv6, ipv6.IPv6Err
}
return result
}
@@ -56,57 +74,59 @@ func (r *Resolver) resolveFamily(ctx context.Context, endpoints []string, ipv4 b
if len(endpoints) == 0 {
return "", errors.New("no endpoints configured")
}
var failures []string
var failures []error
for _, endpoint := range endpoints {
if err := ctx.Err(); err != nil {
return "", err
}
started := time.Now()
value, err := r.resolveOne(ctx, endpoint, ipv4)
family := "ip6"
if ipv4 {
family = "ip4"
}
code := "ip_fetch_ok"
if err != nil {
code = "ip_fetch_failed"
}
diagnostics.Record(diagnostics.Event{Code: code, Target: diagnostics.Target(safeEndpointName(endpoint)), Family: family, Failure: diagnostics.Failure(err), DurationMS: time.Since(started).Milliseconds(), Address: value, HTTPStatus: diagnostics.HTTPStatus(err)})
if err == nil {
return value, nil
}
failures = append(failures, safeEndpointName(endpoint)+": "+err.Error())
failures = append(failures, fmt.Errorf("%s: %w", safeEndpointName(endpoint), err))
}
family := "IPv6"
if ipv4 {
family = "IPv4"
}
return "", fmt.Errorf("all %s endpoints failed: %s", family, strings.Join(failures, "; "))
return "", &familyError{family: family, failures: failures}
}
type familyError struct {
family string
failures []error
}
func (e *familyError) Error() string {
messages := make([]string, len(e.failures))
for i, err := range e.failures {
messages[i] = err.Error()
}
return fmt.Sprintf("all %s endpoints failed: %s", e.family, strings.Join(messages, "; "))
}
func (e *familyError) Unwrap() []error { return e.failures }
func (r *Resolver) resolveOne(ctx context.Context, raw string, ipv4 bool) (string, error) {
// DNS, dialing, TLS and the response body share one deadline.
ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
defer cancel()
u, ips, err := r.parseAndResolve(ctx, raw, ipv4)
if err != nil {
return "", err
}
port := u.Port()
if port == "" {
port = "443"
}
dialer := &net.Dialer{Timeout: 5 * time.Second}
transport := &http.Transport{
Proxy: nil,
ForceAttemptHTTP2: true,
TLSHandshakeTimeout: 5 * time.Second,
ResponseHeaderTimeout: 5 * time.Second,
IdleConnTimeout: 10 * time.Second,
TLSClientConfig: &tls.Config{MinVersion: tls.VersionTLS12, ServerName: u.Hostname()},
DialContext: func(dialCtx context.Context, _, _ string) (net.Conn, error) {
var lastErr error
for _, ip := range ips {
conn, dialErr := dialer.DialContext(dialCtx, "tcp", net.JoinHostPort(ip.String(), port))
if dialErr == nil {
return conn, nil
}
lastErr = dialErr
}
return nil, lastErr
},
}
client := &http.Client{
Transport: transport,
Timeout: 10 * time.Second,
CheckRedirect: func(_ *http.Request, _ []*http.Request) error {
return http.ErrUseLastResponse
},
}
client := r.clientFor(u, ips)
defer client.CloseIdleConnections()
req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
if err != nil {
return "", err
@@ -118,7 +138,7 @@ func (r *Resolver) resolveOne(ctx context.Context, raw string, ipv4 bool) (strin
}
defer resp.Body.Close()
if resp.StatusCode != http.StatusOK {
return "", fmt.Errorf("returned HTTP %d", resp.StatusCode)
return "", responseError(resp.StatusCode)
}
body, err := io.ReadAll(io.LimitReader(resp.Body, 1025))
if err != nil {
@@ -140,6 +160,30 @@ func (r *Resolver) resolveOne(ctx context.Context, raw string, ipv4 bool) (strin
return address.String(), nil
}
type responseError int
func (e responseError) Error() string { return fmt.Sprintf("returned HTTP %d", e) }
func (e responseError) HTTPStatusCode() int { return int(e) }
func newEndpointClient(u *url.URL, ips []netip.Addr) *http.Client {
return &http.Client{
Transport: &http.Transport{
Proxy: nil,
ForceAttemptHTTP2: true,
TLSHandshakeTimeout: 5 * time.Second,
ResponseHeaderTimeout: 5 * time.Second,
TLSClientConfig: &tls.Config{MinVersion: tls.VersionTLS12, ServerName: u.Hostname()},
DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
return netresolve.DialAddresses(ctx, "tcp", ips, "443")
},
},
Timeout: 10 * time.Second,
CheckRedirect: func(_ *http.Request, _ []*http.Request) error {
return http.ErrUseLastResponse
},
}
}
func (r *Resolver) parseAndResolve(ctx context.Context, raw string, ipv4 bool) (*url.URL, []netip.Addr, error) {
u, err := url.Parse(strings.TrimSpace(raw))
if err != nil || u == nil {
@@ -161,7 +205,11 @@ func (r *Resolver) parseAndResolve(ctx context.Context, raw string, ipv4 bool) (
}
return u, []netip.Addr{literal}, nil
}
addresses, err := r.resolver.LookupNetIP(ctx, "ip", host)
family := "ip6"
if ipv4 {
family = "ip4"
}
addresses, err := r.resolver.LookupNetIP(ctx, family, host)
if err != nil {
return nil, nil, fmt.Errorf("resolve host: %w", err)
}
internal/ipresolve/resolver_test.go
+112
View File
@@ -2,8 +2,16 @@ package ipresolve
import (
"context"
"errors"
"io"
"net"
"net/http"
"net/http/httptest"
"net/netip"
"net/url"
"sync/atomic"
"testing"
"time"
)
func TestPublicAddress(t *testing.T) {
@@ -32,3 +40,107 @@ func TestDisabledIPv6IsNotResolvedOrReportedAsError(t *testing.T) {
t.Fatalf("disabled IPv6 must be skipped cleanly: %#v", result)
}
}
type lookupFunc func(context.Context, string, string) ([]netip.Addr, error)
func (f lookupFunc) LookupNetIP(ctx context.Context, network, host string) ([]netip.Addr, error) {
return f(ctx, network, host)
}
func TestResolverRecoversWithFreshIPAndFallbackEndpoint(t *testing.T) {
t.Parallel()
var current atomic.Value
current.Store("1.1.1.1")
api := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if r.URL.Path == "/unavailable" {
http.Error(w, "offline", http.StatusServiceUnavailable)
return
}
_, _ = io.WriteString(w, current.Load().(string))
}))
defer api.Close()
r := New()
var offline atomic.Bool
r.resolver = lookupFunc(func(ctx context.Context, network, host string) ([]netip.Addr, error) {
if network != "ip4" {
t.Errorf("unexpected family: %s", network)
}
if deadline, ok := ctx.Deadline(); !ok || time.Until(deadline) > 10*time.Second {
t.Error("DNS is outside the endpoint deadline")
}
if offline.Load() {
return nil, &net.DNSError{Err: "server misbehaving", IsTemporary: true}
}
return []netip.Addr{netip.MustParseAddr("1.1.1.1")}, nil
})
r.clientFor = func(u *url.URL, ips []netip.Addr) *http.Client {
client := newEndpointClient(u, ips)
transport := client.Transport.(*http.Transport)
transport.TLSClientConfig.RootCAs = api.Client().Transport.(*http.Transport).TLSClientConfig.RootCAs
transport.DialContext = func(ctx context.Context, _, _ string) (net.Conn, error) {
return (&net.Dialer{}).DialContext(ctx, "tcp", api.Listener.Addr().String())
}
return client
}
endpoints := []string{"https://example.com/unavailable", "https://example.com/ip"}
for _, step := range []struct {
offline bool
ip string
}{{false, "1.1.1.1"}, {true, ""}, {false, "9.9.9.9"}} {
offline.Store(step.offline)
if step.ip != "" {
current.Store(step.ip)
}
result := r.ResolveWithIPv6(context.Background(), endpoints, nil, false)
if result.IPv4 != step.ip || (result.IPv4Err != nil) != step.offline {
t.Fatalf("outage recovery: %#v", result)
}
}
}
func TestIPFamiliesResolveIndependently(t *testing.T) {
t.Parallel()
r := New()
started := make(chan string, 2)
proceed := make(chan struct{})
r.resolver = lookupFunc(func(ctx context.Context, network, _ string) ([]netip.Addr, error) {
started <- network
select {
case <-proceed:
return nil, errors.New("offline")
case <-ctx.Done():
return nil, ctx.Err()
}
})
ctx, cancel := context.WithTimeout(context.Background(), time.Second)
defer cancel()
done := make(chan Result, 1)
go func() { done <- r.Resolve(ctx, []string{"https://example.com"}, []string{"https://example.com"}) }()
families := map[string]bool{}
for range 2 {
select {
case family := <-started:
families[family] = true
case <-ctx.Done():
t.Fatal("family resolution blocked another family")
}
}
close(proceed)
result := <-done
if !families["ip4"] || !families["ip6"] || result.IPv4Err == nil || result.IPv6Err == nil {
t.Fatalf("unexpected family result: %#v", result)
}
}
func TestPrivateEndpointStillRejected(t *testing.T) {
t.Parallel()
r := New()
r.resolver = lookupFunc(func(context.Context, string, string) ([]netip.Addr, error) {
return []netip.Addr{netip.MustParseAddr("127.0.0.1"), netip.MustParseAddr("10.0.20.110")}, nil
})
for _, endpoint := range []string{"https://example.com/ip", "https://127.0.0.1/ip", "http://example.com", "https://user:secret@example.com", "https://example.com?token=secret", "https://example.com:8443"} {
if _, _, err := r.parseAndResolve(context.Background(), endpoint, true); err == nil {
t.Fatalf("unsafe endpoint accepted: %s", endpoint)
}
}
}