239 lines
6.9 KiB
Go
239 lines
6.9 KiB
Go
package ipresolve
|
|
|
|
import (
|
|
"context"
|
|
"crypto/tls"
|
|
"errors"
|
|
"fmt"
|
|
"io"
|
|
"net"
|
|
"net/http"
|
|
"net/netip"
|
|
"net/url"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/diagnostics"
|
|
"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/netresolve"
|
|
)
|
|
|
|
type Result struct {
|
|
IPv4 string
|
|
IPv6 string
|
|
IPv4Err error
|
|
IPv6Err error
|
|
}
|
|
|
|
type Resolver struct {
|
|
resolver interface {
|
|
LookupNetIP(context.Context, string, string) ([]netip.Addr, error)
|
|
}
|
|
clientFor func(*url.URL, []netip.Addr) *http.Client
|
|
}
|
|
|
|
func New() *Resolver {
|
|
return &Resolver{resolver: netresolve.New(), clientFor: newEndpointClient}
|
|
}
|
|
|
|
func (r *Resolver) Resolve(ctx context.Context, ipv4Endpoints, ipv6Endpoints []string) Result {
|
|
return r.ResolveWithIPv6(ctx, ipv4Endpoints, ipv6Endpoints, true)
|
|
}
|
|
|
|
func (r *Resolver) ResolveWithIPv6(ctx context.Context, ipv4Endpoints, ipv6Endpoints []string, ipv6Enabled bool) Result {
|
|
result := Result{}
|
|
// Each family gets independent endpoint deadlines.
|
|
var ipv6Result chan Result
|
|
if ipv6Enabled {
|
|
ipv6Result = make(chan Result, 1)
|
|
go func() {
|
|
ip, err := r.resolveFamily(ctx, ipv6Endpoints, false)
|
|
ipv6Result <- Result{IPv6: ip, IPv6Err: err}
|
|
}()
|
|
}
|
|
result.IPv4, result.IPv4Err = r.resolveFamily(ctx, ipv4Endpoints, true)
|
|
if ipv6Enabled {
|
|
ipv6 := <-ipv6Result
|
|
result.IPv6, result.IPv6Err = ipv6.IPv6, ipv6.IPv6Err
|
|
}
|
|
return result
|
|
}
|
|
|
|
func (r *Resolver) ValidateEndpoint(ctx context.Context, raw string) error {
|
|
_, _, err := r.parseAndResolve(ctx, raw, true)
|
|
if err == nil {
|
|
return nil
|
|
}
|
|
_, _, err6 := r.parseAndResolve(ctx, raw, false)
|
|
if err6 == nil {
|
|
return nil
|
|
}
|
|
return fmt.Errorf("endpoint is not a reachable public HTTPS host: %w", err)
|
|
}
|
|
|
|
func (r *Resolver) resolveFamily(ctx context.Context, endpoints []string, ipv4 bool) (string, error) {
|
|
if len(endpoints) == 0 {
|
|
return "", errors.New("no endpoints configured")
|
|
}
|
|
var failures []error
|
|
for _, endpoint := range endpoints {
|
|
if err := ctx.Err(); err != nil {
|
|
return "", err
|
|
}
|
|
started := time.Now()
|
|
value, err := r.resolveOne(ctx, endpoint, ipv4)
|
|
family := "ip6"
|
|
if ipv4 {
|
|
family = "ip4"
|
|
}
|
|
code := "ip_fetch_ok"
|
|
if err != nil {
|
|
code = "ip_fetch_failed"
|
|
}
|
|
diagnostics.Record(diagnostics.Event{Code: code, Target: diagnostics.Target(safeEndpointName(endpoint)), Family: family, Failure: diagnostics.Failure(err), DurationMS: time.Since(started).Milliseconds(), Address: value, HTTPStatus: diagnostics.HTTPStatus(err)})
|
|
if err == nil {
|
|
return value, nil
|
|
}
|
|
failures = append(failures, fmt.Errorf("%s: %w", safeEndpointName(endpoint), err))
|
|
}
|
|
family := "IPv6"
|
|
if ipv4 {
|
|
family = "IPv4"
|
|
}
|
|
return "", &familyError{family: family, failures: failures}
|
|
}
|
|
|
|
type familyError struct {
|
|
family string
|
|
failures []error
|
|
}
|
|
|
|
func (e *familyError) Error() string {
|
|
messages := make([]string, len(e.failures))
|
|
for i, err := range e.failures {
|
|
messages[i] = err.Error()
|
|
}
|
|
return fmt.Sprintf("all %s endpoints failed: %s", e.family, strings.Join(messages, "; "))
|
|
}
|
|
func (e *familyError) Unwrap() []error { return e.failures }
|
|
|
|
func (r *Resolver) resolveOne(ctx context.Context, raw string, ipv4 bool) (string, error) {
|
|
// DNS, dialing, TLS and the response body share one deadline.
|
|
ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
|
|
defer cancel()
|
|
u, ips, err := r.parseAndResolve(ctx, raw, ipv4)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
client := r.clientFor(u, ips)
|
|
defer client.CloseIdleConnections()
|
|
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
req.Header.Set("Accept", "text/plain")
|
|
resp, err := client.Do(req)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
defer resp.Body.Close()
|
|
if resp.StatusCode != http.StatusOK {
|
|
return "", responseError(resp.StatusCode)
|
|
}
|
|
body, err := io.ReadAll(io.LimitReader(resp.Body, 1025))
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
if len(body) > 1024 {
|
|
return "", errors.New("response is larger than 1 KiB")
|
|
}
|
|
address, err := netip.ParseAddr(strings.TrimSpace(string(body)))
|
|
if err != nil {
|
|
return "", errors.New("response is not a plain IP address")
|
|
}
|
|
if ipv4 != address.Is4() {
|
|
return "", errors.New("response has the wrong IP family")
|
|
}
|
|
if !publicAddress(address) {
|
|
return "", errors.New("response is not a globally routable address")
|
|
}
|
|
return address.String(), nil
|
|
}
|
|
|
|
type responseError int
|
|
|
|
func (e responseError) Error() string { return fmt.Sprintf("returned HTTP %d", e) }
|
|
func (e responseError) HTTPStatusCode() int { return int(e) }
|
|
|
|
func newEndpointClient(u *url.URL, ips []netip.Addr) *http.Client {
|
|
return &http.Client{
|
|
Transport: &http.Transport{
|
|
Proxy: nil,
|
|
ForceAttemptHTTP2: true,
|
|
TLSHandshakeTimeout: 5 * time.Second,
|
|
ResponseHeaderTimeout: 5 * time.Second,
|
|
TLSClientConfig: &tls.Config{MinVersion: tls.VersionTLS12, ServerName: u.Hostname()},
|
|
DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
|
|
return netresolve.DialAddresses(ctx, "tcp", ips, "443")
|
|
},
|
|
},
|
|
Timeout: 10 * time.Second,
|
|
CheckRedirect: func(_ *http.Request, _ []*http.Request) error {
|
|
return http.ErrUseLastResponse
|
|
},
|
|
}
|
|
}
|
|
|
|
func (r *Resolver) parseAndResolve(ctx context.Context, raw string, ipv4 bool) (*url.URL, []netip.Addr, error) {
|
|
u, err := url.Parse(strings.TrimSpace(raw))
|
|
if err != nil || u == nil {
|
|
return nil, nil, errors.New("invalid URL")
|
|
}
|
|
if u.Scheme != "https" || u.Hostname() == "" || u.User != nil || u.Fragment != "" {
|
|
return nil, nil, errors.New("only credential-free HTTPS URLs are allowed")
|
|
}
|
|
if port := u.Port(); port != "" && port != "443" {
|
|
return nil, nil, errors.New("only HTTPS port 443 is allowed")
|
|
}
|
|
if u.RawQuery != "" {
|
|
return nil, nil, errors.New("query parameters are not allowed")
|
|
}
|
|
host := u.Hostname()
|
|
if literal, err := netip.ParseAddr(host); err == nil {
|
|
if literal.Is4() != ipv4 || !publicAddress(literal) {
|
|
return nil, nil, errors.New("host must resolve to a public address of the requested family")
|
|
}
|
|
return u, []netip.Addr{literal}, nil
|
|
}
|
|
family := "ip6"
|
|
if ipv4 {
|
|
family = "ip4"
|
|
}
|
|
addresses, err := r.resolver.LookupNetIP(ctx, family, host)
|
|
if err != nil {
|
|
return nil, nil, fmt.Errorf("resolve host: %w", err)
|
|
}
|
|
filtered := make([]netip.Addr, 0, len(addresses))
|
|
for _, address := range addresses {
|
|
if address.Is4() == ipv4 && publicAddress(address) {
|
|
filtered = append(filtered, address)
|
|
}
|
|
}
|
|
if len(filtered) == 0 {
|
|
return nil, nil, errors.New("host has no public address of the requested family")
|
|
}
|
|
return u, filtered, nil
|
|
}
|
|
|
|
func publicAddress(address netip.Addr) bool {
|
|
return address.IsValid() && address.IsGlobalUnicast() && !address.IsPrivate() && !address.IsLoopback() && !address.IsLinkLocalUnicast() && !address.IsLinkLocalMulticast() && !address.IsUnspecified() && !address.IsMulticast()
|
|
}
|
|
|
|
func safeEndpointName(raw string) string {
|
|
u, err := url.Parse(raw)
|
|
if err != nil || u.Hostname() == "" {
|
|
return "configured endpoint"
|
|
}
|
|
return u.Hostname()
|
|
}
|