happyDomain/checker-dane
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compare commits

base: happyDomain:655ab5bb2630de12dcfdd797d454e967521244e9
Branches Tags
happyDomain:master
happyDomain:v0.2.0
happyDomain:v0.1.3
happyDomain:v0.1.2
happyDomain:v0.1.1
happyDomain:v0.1.0
..
compare: happyDomain:16aa0253a3f6e976b5f49c0d7c913325af36617f
Branches Tags
happyDomain:master
happyDomain:v0.2.0
happyDomain:v0.1.3
happyDomain:v0.1.2
happyDomain:v0.1.1
happyDomain:v0.1.0

No commits in common. "655ab5bb2630de12dcfdd797d454e967521244e9" and "16aa0253a3f6e976b5f49c0d7c913325af36617f" have entirely different histories.
655ab5bb26 ... 16aa0253a3

4 changed files with 22 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

6
checker/collect.go
View file

@ -8,6 +8,7 @@ import (
"sort" "sort"
"strconv" "strconv"
"strings" "strings"
"time"
sdk "git.happydns.org/checker-sdk-go/checker" sdk "git.happydns.org/checker-sdk-go/checker"
tlscontract "git.happydns.org/checker-tls/contract" tlscontract "git.happydns.org/checker-tls/contract"
@ -191,8 +192,9 @@ func (p *daneProvider) Collect(ctx context.Context, opts sdk.CheckerOptions) (an
} }
data := &DANEData{ data := &DANEData{
Targets: targets, Targets: targets,
Invalid: invalid, Invalid: invalid,
CollectedAt: time.Now().UTC(),
} }
if v, ok := opts[OptionDNSSECValidated]; ok { if v, ok := opts[OptionDNSSECValidated]; ok {
if b, ok := v.(bool); ok { if b, ok := v.(bool); ok {

15
checker/report.go
View file

@ -47,6 +47,7 @@ func (p *daneProvider) GetHTMLReport(ctx sdk.ReportContext) (string, error) {
} }
view := reportView{ view := reportView{
CollectedAt: data.CollectedAt.Format("2006-01-02 15:04 MST"),
TargetCount: len(data.Targets), TargetCount: len(data.Targets),
Diagnoses: diagnose(data, probes), Diagnoses: diagnose(data, probes),
Rows: rows, Rows: rows,
@ -64,6 +65,7 @@ func (p *daneProvider) GetHTMLReport(ctx sdk.ReportContext) (string, error) {
// the per-row status label/class and leaf string keeps the template free of // the per-row status label/class and leaf string keeps the template free of
// branching beyond simple range/if. // branching beyond simple range/if.
type reportView struct { type reportView struct {
CollectedAt string
TargetCount int TargetCount int
Diagnoses []diagnosis Diagnoses []diagnosis
Rows []reportRow Rows []reportRow
@ -164,6 +166,17 @@ func sevRank(s string) int {
} }
} }
// hasPKIXUsage reports whether any TLSA record at this target demands PKIX
// validation (usage 0 or 1).
func hasPKIXUsage(t TargetResult) bool {
for _, r := range t.Records {
if r.Usage == UsagePKIXTA || r.Usage == UsagePKIXEE {
return true
}
}
return false
}
// proposedTLSA renders a ready-to-paste replacement RR computed from the // proposedTLSA renders a ready-to-paste replacement RR computed from the
// live chain. The (usage, selector, matching) triplet is taken from the // live chain. The (usage, selector, matching) triplet is taken from the
// user's first existing record so the suggestion stays consistent with // user's first existing record so the suggestion stays consistent with
@ -233,7 +246,7 @@ var reportTemplate = template.Must(template.New("dane").Parse(`<!DOCTYPE html>
</head> </head>
<body><main> <body><main>
<h1>DANE / TLSA</h1> <h1>DANE / TLSA</h1>
<p class="meta">{{.TargetCount}} endpoint(s).</p> <p class="meta">Collected {{.CollectedAt}} · {{.TargetCount}} endpoint(s).</p>
{{with .Diagnoses}}<section class="diagnosis"> {{with .Diagnoses}}<section class="diagnosis">
<h2>Action required</h2> <h2>Action required</h2>
{{range .}}<article class="finding sev-{{.Severity}}"> {{range .}}<article class="finding sev-{{.Severity}}">

11
checker/rule.go
View file

@ -269,17 +269,6 @@ func indexProbes(related []sdk.RelatedObservation) map[string]*tls.TLSProbe {
return out return out
} }
// hasPKIXUsage reports whether any TLSA record at this target demands PKIX
// validation (usage 0 or 1).
func hasPKIXUsage(t TargetResult) bool {
for _, r := range t.Records {
if r.Usage == UsagePKIXTA || r.Usage == UsagePKIXEE {
return true
}
}
return false
}
func truncHex(s string) string { func truncHex(s string) string {
if len(s) > 12 { if len(s) > 12 {
return s[:12] + "…" return s[:12] + "…"

5
checker/types.go
View file

@ -18,6 +18,8 @@
// SHA-512) are matched against the chain slot implied by the usage. // SHA-512) are matched against the chain slot implied by the usage.
package checker package checker
import "time"
// ObservationKeyDANE is the observation key this checker writes. // ObservationKeyDANE is the observation key this checker writes.
const ObservationKeyDANE = "dane_checks" const ObservationKeyDANE = "dane_checks"
@ -87,7 +89,8 @@ type DANEData struct {
// records set the AD bit. Only populated by the standalone interactive // records set the AD bit. Only populated by the standalone interactive
// flow (lookupTLSA); nil in managed mode where records come from the // flow (lookupTLSA); nil in managed mode where records come from the
// user's zone config and DNSSEC posture is checked elsewhere. // user's zone config and DNSSEC posture is checked elsewhere.
DNSSECValidated *bool `json:"dnssec_validated,omitempty"` DNSSECValidated *bool `json:"dnssec_validated,omitempty"`
CollectedAt time.Time `json:"collected_at"`
} }
// InvalidRecord describes a TLSA record dropped during Collect. // InvalidRecord describes a TLSA record dropped during Collect.