fix: harden DynDNS recovery and publish v1.5.1

internal/ipresolve/resolver.go

@@ -12,6 +12,9 @@ import (
 	"net/url"
 	"strings"
 	"time"
+
+	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/diagnostics"
+	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/netresolve"
 )
 
 type Result struct {
@@ -22,10 +25,15 @@ type Result struct {
 }
 
 type Resolver struct {
-	resolver *net.Resolver
+	resolver interface {
+		LookupNetIP(context.Context, string, string) ([]netip.Addr, error)
+	}
+	clientFor func(*url.URL, []netip.Addr) *http.Client
 }
 
-func New() *Resolver { return &Resolver{resolver: net.DefaultResolver} }
+func New() *Resolver {
+	return &Resolver{resolver: netresolve.New(), clientFor: newEndpointClient}
+}
 
 func (r *Resolver) Resolve(ctx context.Context, ipv4Endpoints, ipv6Endpoints []string) Result {
 	return r.ResolveWithIPv6(ctx, ipv4Endpoints, ipv6Endpoints, true)
@@ -33,9 +41,19 @@ func (r *Resolver) Resolve(ctx context.Context, ipv4Endpoints, ipv6Endpoints []s
 
 func (r *Resolver) ResolveWithIPv6(ctx context.Context, ipv4Endpoints, ipv6Endpoints []string, ipv6Enabled bool) Result {
 	result := Result{}
+	// Each family gets independent endpoint deadlines.
+	var ipv6Result chan Result
+	if ipv6Enabled {
+		ipv6Result = make(chan Result, 1)
+		go func() {
+			ip, err := r.resolveFamily(ctx, ipv6Endpoints, false)
+			ipv6Result <- Result{IPv6: ip, IPv6Err: err}
+		}()
+	}
 	result.IPv4, result.IPv4Err = r.resolveFamily(ctx, ipv4Endpoints, true)
 	if ipv6Enabled {
-		result.IPv6, result.IPv6Err = r.resolveFamily(ctx, ipv6Endpoints, false)
+		ipv6 := <-ipv6Result
+		result.IPv6, result.IPv6Err = ipv6.IPv6, ipv6.IPv6Err
 	}
 	return result
 }
@@ -56,57 +74,59 @@ func (r *Resolver) resolveFamily(ctx context.Context, endpoints []string, ipv4 b
 	if len(endpoints) == 0 {
 		return "", errors.New("no endpoints configured")
 	}
-	var failures []string
+	var failures []error
 	for _, endpoint := range endpoints {
+		if err := ctx.Err(); err != nil {
+			return "", err
+		}
+		started := time.Now()
 		value, err := r.resolveOne(ctx, endpoint, ipv4)
+		family := "ip6"
+		if ipv4 {
+			family = "ip4"
+		}
+		code := "ip_fetch_ok"
+		if err != nil {
+			code = "ip_fetch_failed"
+		}
+		diagnostics.Record(diagnostics.Event{Code: code, Target: diagnostics.Target(safeEndpointName(endpoint)), Family: family, Failure: diagnostics.Failure(err), DurationMS: time.Since(started).Milliseconds(), Address: value, HTTPStatus: diagnostics.HTTPStatus(err)})
 		if err == nil {
 			return value, nil
 		}
-		failures = append(failures, safeEndpointName(endpoint)+": "+err.Error())
+		failures = append(failures, fmt.Errorf("%s: %w", safeEndpointName(endpoint), err))
 	}
 	family := "IPv6"
 	if ipv4 {
 		family = "IPv4"
 	}
-	return "", fmt.Errorf("all %s endpoints failed: %s", family, strings.Join(failures, "; "))
+	return "", &familyError{family: family, failures: failures}
 }
 
+type familyError struct {
+	family   string
+	failures []error
+}
+
+func (e *familyError) Error() string {
+	messages := make([]string, len(e.failures))
+	for i, err := range e.failures {
+		messages[i] = err.Error()
+	}
+	return fmt.Sprintf("all %s endpoints failed: %s", e.family, strings.Join(messages, "; "))
+}
+func (e *familyError) Unwrap() []error { return e.failures }
+
 func (r *Resolver) resolveOne(ctx context.Context, raw string, ipv4 bool) (string, error) {
+	// DNS, dialing, TLS and the response body share one deadline.
+	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
 	u, ips, err := r.parseAndResolve(ctx, raw, ipv4)
 	if err != nil {
 		return "", err
 	}
-	port := u.Port()
-	if port == "" {
-		port = "443"
-	}
-	dialer := &net.Dialer{Timeout: 5 * time.Second}
-	transport := &http.Transport{
-		Proxy:                 nil,
-		ForceAttemptHTTP2:     true,
-		TLSHandshakeTimeout:   5 * time.Second,
-		ResponseHeaderTimeout: 5 * time.Second,
-		IdleConnTimeout:       10 * time.Second,
-		TLSClientConfig:       &tls.Config{MinVersion: tls.VersionTLS12, ServerName: u.Hostname()},
-		DialContext: func(dialCtx context.Context, _, _ string) (net.Conn, error) {
-			var lastErr error
-			for _, ip := range ips {
-				conn, dialErr := dialer.DialContext(dialCtx, "tcp", net.JoinHostPort(ip.String(), port))
-				if dialErr == nil {
-					return conn, nil
-				}
-				lastErr = dialErr
-			}
-			return nil, lastErr
-		},
-	}
-	client := &http.Client{
-		Transport: transport,
-		Timeout:   10 * time.Second,
-		CheckRedirect: func(_ *http.Request, _ []*http.Request) error {
-			return http.ErrUseLastResponse
-		},
-	}
+	client := r.clientFor(u, ips)
+	defer client.CloseIdleConnections()
+
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
 	if err != nil {
 		return "", err
@@ -118,7 +138,7 @@ func (r *Resolver) resolveOne(ctx context.Context, raw string, ipv4 bool) (strin
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode != http.StatusOK {
-		return "", fmt.Errorf("returned HTTP %d", resp.StatusCode)
+		return "", responseError(resp.StatusCode)
 	}
 	body, err := io.ReadAll(io.LimitReader(resp.Body, 1025))
 	if err != nil {
@@ -140,6 +160,30 @@ func (r *Resolver) resolveOne(ctx context.Context, raw string, ipv4 bool) (strin
 	return address.String(), nil
 }
 
+type responseError int
+
+func (e responseError) Error() string       { return fmt.Sprintf("returned HTTP %d", e) }
+func (e responseError) HTTPStatusCode() int { return int(e) }
+
+func newEndpointClient(u *url.URL, ips []netip.Addr) *http.Client {
+	return &http.Client{
+		Transport: &http.Transport{
+			Proxy:                 nil,
+			ForceAttemptHTTP2:     true,
+			TLSHandshakeTimeout:   5 * time.Second,
+			ResponseHeaderTimeout: 5 * time.Second,
+			TLSClientConfig:       &tls.Config{MinVersion: tls.VersionTLS12, ServerName: u.Hostname()},
+			DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
+				return netresolve.DialAddresses(ctx, "tcp", ips, "443")
+			},
+		},
+		Timeout: 10 * time.Second,
+		CheckRedirect: func(_ *http.Request, _ []*http.Request) error {
+			return http.ErrUseLastResponse
+		},
+	}
+}
+
 func (r *Resolver) parseAndResolve(ctx context.Context, raw string, ipv4 bool) (*url.URL, []netip.Addr, error) {
 	u, err := url.Parse(strings.TrimSpace(raw))
 	if err != nil || u == nil {
@@ -161,7 +205,11 @@ func (r *Resolver) parseAndResolve(ctx context.Context, raw string, ipv4 bool) (
 		}
 		return u, []netip.Addr{literal}, nil
 	}
-	addresses, err := r.resolver.LookupNetIP(ctx, "ip", host)
+	family := "ip6"
+	if ipv4 {
+		family = "ip4"
+	}
+	addresses, err := r.resolver.LookupNetIP(ctx, family, host)
 	if err != nil {
 		return nil, nil, fmt.Errorf("resolve host: %w", err)
 	}