fix: harden DynDNS recovery and publish v1.5.1

internal/ipresolve/resolver_test.go

@@ -2,8 +2,16 @@ package ipresolve
 
 import (
 	"context"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
 	"net/netip"
+	"net/url"
+	"sync/atomic"
 	"testing"
+	"time"
 )
 
 func TestPublicAddress(t *testing.T) {
@@ -32,3 +40,107 @@ func TestDisabledIPv6IsNotResolvedOrReportedAsError(t *testing.T) {
 		t.Fatalf("disabled IPv6 must be skipped cleanly: %#v", result)
 	}
 }
+
+type lookupFunc func(context.Context, string, string) ([]netip.Addr, error)
+
+func (f lookupFunc) LookupNetIP(ctx context.Context, network, host string) ([]netip.Addr, error) {
+	return f(ctx, network, host)
+}
+
+func TestResolverRecoversWithFreshIPAndFallbackEndpoint(t *testing.T) {
+	t.Parallel()
+	var current atomic.Value
+	current.Store("1.1.1.1")
+	api := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/unavailable" {
+			http.Error(w, "offline", http.StatusServiceUnavailable)
+			return
+		}
+		_, _ = io.WriteString(w, current.Load().(string))
+	}))
+	defer api.Close()
+	r := New()
+	var offline atomic.Bool
+	r.resolver = lookupFunc(func(ctx context.Context, network, host string) ([]netip.Addr, error) {
+		if network != "ip4" {
+			t.Errorf("unexpected family: %s", network)
+		}
+		if deadline, ok := ctx.Deadline(); !ok || time.Until(deadline) > 10*time.Second {
+			t.Error("DNS is outside the endpoint deadline")
+		}
+		if offline.Load() {
+			return nil, &net.DNSError{Err: "server misbehaving", IsTemporary: true}
+		}
+		return []netip.Addr{netip.MustParseAddr("1.1.1.1")}, nil
+	})
+	r.clientFor = func(u *url.URL, ips []netip.Addr) *http.Client {
+		client := newEndpointClient(u, ips)
+		transport := client.Transport.(*http.Transport)
+		transport.TLSClientConfig.RootCAs = api.Client().Transport.(*http.Transport).TLSClientConfig.RootCAs
+		transport.DialContext = func(ctx context.Context, _, _ string) (net.Conn, error) {
+			return (&net.Dialer{}).DialContext(ctx, "tcp", api.Listener.Addr().String())
+		}
+		return client
+	}
+	endpoints := []string{"https://example.com/unavailable", "https://example.com/ip"}
+	for _, step := range []struct {
+		offline bool
+		ip      string
+	}{{false, "1.1.1.1"}, {true, ""}, {false, "9.9.9.9"}} {
+		offline.Store(step.offline)
+		if step.ip != "" {
+			current.Store(step.ip)
+		}
+		result := r.ResolveWithIPv6(context.Background(), endpoints, nil, false)
+		if result.IPv4 != step.ip || (result.IPv4Err != nil) != step.offline {
+			t.Fatalf("outage recovery: %#v", result)
+		}
+	}
+}
+
+func TestIPFamiliesResolveIndependently(t *testing.T) {
+	t.Parallel()
+	r := New()
+	started := make(chan string, 2)
+	proceed := make(chan struct{})
+	r.resolver = lookupFunc(func(ctx context.Context, network, _ string) ([]netip.Addr, error) {
+		started <- network
+		select {
+		case <-proceed:
+			return nil, errors.New("offline")
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		}
+	})
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	done := make(chan Result, 1)
+	go func() { done <- r.Resolve(ctx, []string{"https://example.com"}, []string{"https://example.com"}) }()
+	families := map[string]bool{}
+	for range 2 {
+		select {
+		case family := <-started:
+			families[family] = true
+		case <-ctx.Done():
+			t.Fatal("family resolution blocked another family")
+		}
+	}
+	close(proceed)
+	result := <-done
+	if !families["ip4"] || !families["ip6"] || result.IPv4Err == nil || result.IPv6Err == nil {
+		t.Fatalf("unexpected family result: %#v", result)
+	}
+}
+
+func TestPrivateEndpointStillRejected(t *testing.T) {
+	t.Parallel()
+	r := New()
+	r.resolver = lookupFunc(func(context.Context, string, string) ([]netip.Addr, error) {
+		return []netip.Addr{netip.MustParseAddr("127.0.0.1"), netip.MustParseAddr("10.0.20.110")}, nil
+	})
+	for _, endpoint := range []string{"https://example.com/ip", "https://127.0.0.1/ip", "http://example.com", "https://user:secret@example.com", "https://example.com?token=secret", "https://example.com:8443"} {
+		if _, _, err := r.parseAndResolve(context.Background(), endpoint, true); err == nil {
+			t.Fatalf("unsafe endpoint accepted: %s", endpoint)
+		}
+	}
+}