Documentation
¶
Overview ¶
Package cutoververify checks a domain that is being moved onto this server and answers with one verdict per aspect (DNS, proxy, redirect, certificate, HSTS, response, www/apex pair) plus the next step for each. It is read only: it looks names up and makes plain GET requests, nothing else.
Index ¶
Constants ¶
const ( ClassDNSFailed = "dns_failed" ClassConnectRefused = "connect_refused" ClassTimeout = "timeout" ClassTLSFailed = "tls_failed" ClassBlocked = "blocked_address" ClassConnectFailed = "connect_failed" ClassRequestFailed = "request_failed" )
Error classes shown in reports instead of raw Go error text, which can carry resolved addresses and internal detail.
const ( LineDNS = "dns" LineProxy = "proxy" LineRedirect = "redirect" LineCertificate = "certificate" LineHSTS = "hsts" LineResponse = "response" LinePair = "pair" )
Line ids, in report order.
Variables ¶
var ErrNonPublicAddress = errors.New("address is not public")
ErrNonPublicAddress is returned when a probe would connect to an address that is not on the public internet.
Functions ¶
func IsPublicAddr ¶
IsPublicAddr reports whether ip may be probed: not loopback, private (RFC1918 and ULA), link-local (which covers the 169.254.169.254 metadata address), unspecified, multicast or reserved. Documentation ranges count as public.
func IsPublicIP ¶
IsPublicIP is IsPublicAddr for a textual address; unparsable text is not public.
Types ¶
type Deps ¶
type Deps struct {
Resolver Resolver
Prober Prober
// IsProxyIP reports whether an address belongs to a known proxy network.
IsProxyIP func(ip string) bool
Now func() time.Time
}
Deps are the seams tests replace.
type HTTPResult ¶
type HTTPResult struct {
Status int
Location string
// Header holds the response headers with canonical keys.
Header map[string]string
TTFB time.Duration
}
HTTPResult is one plain GET, redirects not followed.
type Line ¶
type Line struct {
ID string `json:"id"`
Verdict Verdict `json:"verdict"`
Title string `json:"title"`
Detail string `json:"detail"`
Next string `json:"next"`
}
Line is one verified aspect.
type NetProber ¶
type NetProber struct {
// Timeout bounds each request; it must be set by the caller.
Timeout time.Duration
// HTTPSPort is the port the TLS probes use, 443 when zero.
HTTPSPort int
// contains filtered or unexported fields
}
NetProber probes over the public name with the standard library. Every connection goes to one of the addresses the caller passes in, so the address that was checked is the address that is dialed.
type Options ¶
type Options struct {
CertWarnDays int
CertFailDays int
// SlowTTFB is the time to first byte above which the response line warns.
SlowTTFB time.Duration
// HSTSMinAge is the smallest max-age (seconds) that counts as enabled.
HSTSMinAge int
}
Options are the thresholds, read from env by the caller.
type Prober ¶
type Prober interface {
HTTP(ctx context.Context, rawURL string, addrs []string) (HTTPResult, error)
Cert(ctx context.Context, host string, addrs []string) (CertInfo, error)
}
Prober makes the requests. Implementations must connect only to addrs, the set DNS answered once, while keeping the name for SNI and the Host header.
type Report ¶
type Report struct {
Domain string `json:"domain"`
Verdict Verdict `json:"verdict"`
Summary string `json:"summary"`
ServerIPs []string `json:"server_ips"`
Resolved []string `json:"resolved,omitempty"`
CNAME string `json:"cname,omitempty"`
Proxy string `json:"proxy,omitempty"`
Lines []Line `json:"lines"`
CheckedAt time.Time `json:"checked_at"`
}
Report is the whole answer for one domain.
Source Files