Initial commit

checker/interactive.go

@@ -0,0 +1,167 @@
+//go:build standalone
+
+package checker
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/miekg/dns"
+
+	sdk "git.happydns.org/checker-sdk-go/checker"
+	tls "git.happydns.org/checker-tls/checker"
+)
+
+// tlsaLookup fetches TLSA records for owner via the system resolver.
+// It is a package variable so tests can swap it for a fixture.
+var tlsaLookup = lookupTLSA
+
+// RenderForm lets a human run this checker standalone. The form only
+// collects the endpoint coordinates; the expected TLSA records are read
+// from DNS by ParseForm and the live certificate is fetched in-process by
+// the SDK running checker-tls as a sibling (see RelatedProviders).
+func (p *daneProvider) RenderForm() []sdk.CheckerOptionField {
+	return []sdk.CheckerOptionField{
+		{Id: OptionDomain, Type: "string", Label: "Domain", Placeholder: "example.com", Required: true},
+		{Id: "port", Type: "uint", Label: "Port", Default: float64(443), Required: true},
+		{Id: "proto", Type: "string", Label: "Protocol", Choices: []string{"tcp", "udp"}, Default: "tcp"},
+		{
+			Id:          "starttls",
+			Type:        "string",
+			Label:       "STARTTLS override",
+			Description: "Leave empty to auto-derive from port (25→smtp, 587→submission, 143→imap, …).",
+		},
+		{
+			Id:          OptionProbeTimeoutMs,
+			Type:        "uint",
+			Label:       "Probe timeout (ms)",
+			Default:     float64(tls.DefaultProbeTimeoutMs),
+			Description: "Forwarded to checker-tls for the live probe.",
+		},
+	}
+}
+
+// ParseForm turns the submitted endpoint into the same CheckerOptions
+// shape happyDomain would feed Collect. The TLSA RRset expected by
+// Collect is resolved live from DNS at _<port>._<proto>.<domain>; if
+// nothing is published there, no validation is possible and the form is
+// re-rendered with the error.
+func (p *daneProvider) ParseForm(r *http.Request) (sdk.CheckerOptions, error) {
+	domain := strings.TrimSuffix(strings.TrimSpace(r.FormValue(OptionDomain)), ".")
+	if domain == "" {
+		return nil, errors.New("domain is required")
+	}
+	portStr := strings.TrimSpace(r.FormValue("port"))
+	if portStr == "" {
+		return nil, errors.New("port is required")
+	}
+	port64, err := strconv.ParseUint(portStr, 10, 16)
+	if err != nil || port64 == 0 {
+		return nil, fmt.Errorf("invalid port %q: must be 1-65535", portStr)
+	}
+	port := uint16(port64)
+	proto := strings.TrimSpace(r.FormValue("proto"))
+	if proto == "" {
+		proto = "tcp"
+	}
+	if proto != "tcp" && proto != "udp" {
+		return nil, fmt.Errorf("invalid protocol %q: must be tcp or udp", proto)
+	}
+
+	owner := tlsaOwnerName(port, proto, domain)
+	records, err := tlsaLookup(owner)
+	if err != nil {
+		return nil, fmt.Errorf("TLSA lookup for %s: %w", owner, err)
+	}
+	if len(records) == 0 {
+		return nil, fmt.Errorf("no TLSA records found at %s", owner)
+	}
+
+	tlsaEntries := make([]map[string]any, 0, len(records))
+	for _, t := range records {
+		tlsaEntries = append(tlsaEntries, map[string]any{
+			"Hdr":          map[string]any{"Name": owner},
+			"Usage":        t.Usage,
+			"Selector":     t.Selector,
+			"MatchingType": t.MatchingType,
+			"Certificate":  strings.ToLower(t.Certificate),
+		})
+	}
+	body, err := json.Marshal(map[string]any{"tlsa": tlsaEntries})
+	if err != nil {
+		return nil, fmt.Errorf("marshal TLSAs service: %w", err)
+	}
+
+	opts := sdk.CheckerOptions{
+		OptionDomain: domain,
+		OptionService: serviceMessage{
+			Type:    serviceType,
+			Domain:  domain,
+			Service: body,
+		},
+	}
+
+	if s := strings.TrimSpace(r.FormValue("starttls")); s != "" {
+		opts[OptionSTARTTLS] = map[string]string{
+			starttlsKey(port, proto): s,
+		}
+	}
+	if v := strings.TrimSpace(r.FormValue(OptionProbeTimeoutMs)); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 {
+			opts[OptionProbeTimeoutMs] = float64(n)
+		}
+	}
+	return opts, nil
+}
+
+// RelatedProviders declares checker-tls as the sibling the SDK should run
+// in-process during the interactive flow. The SDK harvests the discovery
+// entries this checker publishes via DiscoverEntries and auto-fills
+// checker-tls's OptionEndpoints (the option tagged
+// sdk.AutoFillDiscoveryEntries in its definition), so the probe map the
+// rule reads via GetRelated is populated with live data.
+func (p *daneProvider) RelatedProviders() []sdk.ObservationProvider {
+	return []sdk.ObservationProvider{tls.Provider()}
+}
+
+// lookupTLSA queries the system resolver for TLSA records at owner.
+// Falls back to 1.1.1.1 when /etc/resolv.conf is unreadable.
+func lookupTLSA(owner string) ([]*dns.TLSA, error) {
+	resolver, err := interactiveResolver()
+	if err != nil {
+		return nil, err
+	}
+	msg := new(dns.Msg)
+	msg.SetQuestion(dns.Fqdn(owner), dns.TypeTLSA)
+	msg.RecursionDesired = true
+	msg.SetEdns0(4096, true)
+
+	c := new(dns.Client)
+	in, _, err := c.Exchange(msg, resolver)
+	if err != nil {
+		return nil, err
+	}
+	if in.Rcode != dns.RcodeSuccess && in.Rcode != dns.RcodeNameError {
+		return nil, fmt.Errorf("rcode %s", dns.RcodeToString[in.Rcode])
+	}
+	var out []*dns.TLSA
+	for _, rr := range in.Answer {
+		if t, ok := rr.(*dns.TLSA); ok {
+			out = append(out, t)
+		}
+	}
+	return out, nil
+}
+
+func interactiveResolver() (string, error) {
+	cfg, err := dns.ClientConfigFromFile("/etc/resolv.conf")
+	if err != nil || len(cfg.Servers) == 0 {
+		return net.JoinHostPort("1.1.1.1", "53"), nil
+	}
+	return net.JoinHostPort(cfg.Servers[0], cfg.Port), nil
+}