hetzner-api-dyndns-records-webinterface/internal/ipresolve/resolver_test.go

package ipresolve

import (
	"context"
	"errors"
	"io"
	"net"
	"net/http"
	"net/http/httptest"
	"net/netip"
	"net/url"
	"sync/atomic"
	"testing"
	"time"
)

func TestPublicAddress(t *testing.T) {
	t.Parallel()
	for _, raw := range []string{"1.1.1.1", "2001:4860:4860::8888"} {
		address := netip.MustParseAddr(raw)
		if !publicAddress(address) {
			t.Fatalf("expected %s to be public", raw)
		}
	}
	for _, raw := range []string{"127.0.0.1", "192.168.1.1", "169.254.1.1", "::1", "fe80::1"} {
		address := netip.MustParseAddr(raw)
		if publicAddress(address) {
			t.Fatalf("expected %s to be rejected", raw)
		}
	}
}

func TestDisabledIPv6IsNotResolvedOrReportedAsError(t *testing.T) {
	t.Parallel()
	result := New().ResolveWithIPv6(context.Background(), nil, nil, false)
	if result.IPv4Err == nil {
		t.Fatal("missing IPv4 endpoints should still be reported")
	}
	if result.IPv6 != "" || result.IPv6Err != nil {
		t.Fatalf("disabled IPv6 must be skipped cleanly: %#v", result)
	}
}

type lookupFunc func(context.Context, string, string) ([]netip.Addr, error)

func (f lookupFunc) LookupNetIP(ctx context.Context, network, host string) ([]netip.Addr, error) {
	return f(ctx, network, host)
}

func TestResolverRecoversWithFreshIPAndFallbackEndpoint(t *testing.T) {
	t.Parallel()
	var current atomic.Value
	current.Store("1.1.1.1")
	api := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.URL.Path == "/unavailable" {
			http.Error(w, "offline", http.StatusServiceUnavailable)
			return
		}
		_, _ = io.WriteString(w, current.Load().(string))
	}))
	defer api.Close()
	r := New()
	var offline atomic.Bool
	r.resolver = lookupFunc(func(ctx context.Context, network, host string) ([]netip.Addr, error) {
		if network != "ip4" {
			t.Errorf("unexpected family: %s", network)
		}
		if deadline, ok := ctx.Deadline(); !ok || time.Until(deadline) > 10*time.Second {
			t.Error("DNS is outside the endpoint deadline")
		}
		if offline.Load() {
			return nil, &net.DNSError{Err: "server misbehaving", IsTemporary: true}
		}
		return []netip.Addr{netip.MustParseAddr("1.1.1.1")}, nil
	})
	r.clientFor = func(u *url.URL, ips []netip.Addr) *http.Client {
		client := newEndpointClient(u, ips)
		transport := client.Transport.(*http.Transport)
		transport.TLSClientConfig.RootCAs = api.Client().Transport.(*http.Transport).TLSClientConfig.RootCAs
		transport.DialContext = func(ctx context.Context, _, _ string) (net.Conn, error) {
			return (&net.Dialer{}).DialContext(ctx, "tcp", api.Listener.Addr().String())
		}
		return client
	}
	endpoints := []string{"https://example.com/unavailable", "https://example.com/ip"}
	for _, step := range []struct {
		offline bool
		ip      string
	}{{false, "1.1.1.1"}, {true, ""}, {false, "9.9.9.9"}} {
		offline.Store(step.offline)
		if step.ip != "" {
			current.Store(step.ip)
		}
		result := r.ResolveWithIPv6(context.Background(), endpoints, nil, false)
		if result.IPv4 != step.ip || (result.IPv4Err != nil) != step.offline {
			t.Fatalf("outage recovery: %#v", result)
		}
	}
}

func TestIPFamiliesResolveIndependently(t *testing.T) {
	t.Parallel()
	r := New()
	started := make(chan string, 2)
	proceed := make(chan struct{})
	r.resolver = lookupFunc(func(ctx context.Context, network, _ string) ([]netip.Addr, error) {
		started <- network
		select {
		case <-proceed:
			return nil, errors.New("offline")
		case <-ctx.Done():
			return nil, ctx.Err()
		}
	})
	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
	defer cancel()
	done := make(chan Result, 1)
	go func() { done <- r.Resolve(ctx, []string{"https://example.com"}, []string{"https://example.com"}) }()
	families := map[string]bool{}
	for range 2 {
		select {
		case family := <-started:
			families[family] = true
		case <-ctx.Done():
			t.Fatal("family resolution blocked another family")
		}
	}
	close(proceed)
	result := <-done
	if !families["ip4"] || !families["ip6"] || result.IPv4Err == nil || result.IPv6Err == nil {
		t.Fatalf("unexpected family result: %#v", result)
	}
}

func TestPrivateEndpointStillRejected(t *testing.T) {
	t.Parallel()
	r := New()
	r.resolver = lookupFunc(func(context.Context, string, string) ([]netip.Addr, error) {
		return []netip.Addr{netip.MustParseAddr("127.0.0.1"), netip.MustParseAddr("10.0.20.110")}, nil
	})
	for _, endpoint := range []string{"https://example.com/ip", "https://127.0.0.1/ip", "http://example.com", "https://user:secret@example.com", "https://example.com?token=secret", "https://example.com:8443"} {
		if _, _, err := r.parseAndResolve(context.Background(), endpoint, true); err == nil {
			t.Fatalf("unsafe endpoint accepted: %s", endpoint)
		}
	}
}