From d4c1ac348a0c4c0e7c5225c69c6c1ce27f072f48 Mon Sep 17 00:00:00 2001 From: Pierre-Olivier Mercier Date: Fri, 24 Apr 2026 12:48:30 +0700 Subject: [PATCH] Migrate to checker-sdk-go v1.3.0 with standalone build tag The SDK split the HTTP server scaffolding into the new checker-sdk-go/checker/server subpackage and CheckRule.Evaluate now returns []CheckState. Update main.go to import server and call server.New, switch the rule and the package-level Evaluate helper to the new slice return type, and isolate the interactive form code behind the standalone build tag so plugin/builtin builds skip net/http and html/template entirely. --- Dockerfile | 2 +- Makefile | 7 ++- checker/collect.go | 2 +- checker/dns.go | 4 +- checker/evaluate.go | 6 +- checker/interactive.go | 136 +++++++++++++++++++++++++++++++++++++++++ checker/rule.go | 6 +- go.mod | 2 +- go.sum | 4 +- main.go | 6 +- 10 files changed, 157 insertions(+), 18 deletions(-) create mode 100644 checker/interactive.go diff --git a/Dockerfile b/Dockerfile index 64f0039..591dc3d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -6,7 +6,7 @@ WORKDIR /src COPY go.mod go.sum ./ RUN go mod download COPY . . -RUN CGO_ENABLED=0 go build -ldflags "-X main.Version=${CHECKER_VERSION}" -o /checker-delegation . +RUN CGO_ENABLED=0 go build -tags standalone -ldflags "-X main.Version=${CHECKER_VERSION}" -o /checker-delegation . FROM scratch COPY --from=builder /checker-delegation /checker-delegation diff --git a/Makefile b/Makefile index 3b94d28..a257412 100644 --- a/Makefile +++ b/Makefile @@ -6,12 +6,12 @@ CHECKER_SOURCES := main.go $(wildcard checker/*.go) GO_LDFLAGS := -X main.Version=$(CHECKER_VERSION) -.PHONY: all plugin docker clean +.PHONY: all plugin docker test clean all: $(CHECKER_NAME) $(CHECKER_NAME): $(CHECKER_SOURCES) - go build -ldflags "$(GO_LDFLAGS)" -o $@ . + go build -tags standalone -ldflags "$(GO_LDFLAGS)" -o $@ . plugin: $(CHECKER_NAME).so @@ -21,5 +21,8 @@ $(CHECKER_NAME).so: $(CHECKER_SOURCES) $(wildcard plugin/*.go) docker: docker build --build-arg CHECKER_VERSION=$(CHECKER_VERSION) -t $(CHECKER_IMAGE) . +test: + go test -tags standalone ./... + clean: rm -f $(CHECKER_NAME) $(CHECKER_NAME).so diff --git a/checker/collect.go b/checker/collect.go index 027dce0..925ecb2 100644 --- a/checker/collect.go +++ b/checker/collect.go @@ -164,7 +164,7 @@ func (p *delegationProvider) Collect(ctx context.Context, opts sdk.CheckerOption if len(dsMissing) > 0 || len(dsExtra) > 0 { sev := SeverityCrit if len(declaredDS) == 0 { - // Service does not declare any DS but parent has some — warn only. + // Service does not declare any DS but parent has some, warn only. sev = SeverityWarn } data.Findings = append(data.Findings, DelegationFinding{ diff --git a/checker/dns.go b/checker/dns.go index 3930e14..e810eed 100644 --- a/checker/dns.go +++ b/checker/dns.go @@ -19,7 +19,7 @@ const dnsTimeout = 5 * time.Second // dnsExchange sends a single query to the given server using the requested // transport ("" for UDP, "tcp"). The server address must already include a -// port. RecursionDesired is forced off — this checker only talks to +// port. RecursionDesired is forced off, this checker only talks to // authoritative servers. func dnsExchange(ctx context.Context, proto, server string, q dns.Question, edns bool) (*dns.Msg, error) { client := dns.Client{Net: proto, Timeout: dnsTimeout} @@ -77,7 +77,7 @@ func resolveHost(ctx context.Context, host string) ([]string, error) { // resolver returns NOERROR with an answer. // // If hintParent is non-empty, it is used as the assumed parent and we only -// resolve its NS — this matches happyDomain's data model where the parent +// resolve its NS, this matches happyDomain's data model where the parent // zone is known. func findParentZone(ctx context.Context, fqdn, hintParent string) (zone string, servers []string, err error) { zone = dns.Fqdn(hintParent) diff --git a/checker/evaluate.go b/checker/evaluate.go index b62675d..b8cf56d 100644 --- a/checker/evaluate.go +++ b/checker/evaluate.go @@ -9,7 +9,7 @@ import ( // Evaluate folds findings into a single CheckState. The status is the // highest severity observed: any Crit makes the whole result Crit, any Warn // makes it Warn, otherwise OK. -func Evaluate(data *DelegationData) sdk.CheckState { +func Evaluate(data *DelegationData) []sdk.CheckState { status := sdk.StatusOK var crit, warn, info int for _, f := range data.Findings { @@ -37,7 +37,7 @@ func Evaluate(data *DelegationData) sdk.CheckState { msg = fmt.Sprintf("Delegation of %s: %d critical, %d warning, %d info", data.DelegatedFQDN, crit, warn, info) } - return sdk.CheckState{ + return []sdk.CheckState{{ Status: status, Message: msg, Code: "delegation_result", @@ -49,5 +49,5 @@ func Evaluate(data *DelegationData) sdk.CheckState { "parent_ds": data.ParentDS, "child_serials": data.ChildSerials, }, - } + }} } diff --git a/checker/interactive.go b/checker/interactive.go new file mode 100644 index 0000000..a785e1f --- /dev/null +++ b/checker/interactive.go @@ -0,0 +1,136 @@ +//go:build standalone + +package checker + +import ( + "context" + "encoding/json" + "fmt" + "net" + "net/http" + "strings" + "sync" + + "github.com/miekg/dns" + + sdk "git.happydns.org/checker-sdk-go/checker" +) + +func (p *delegationProvider) RenderForm() []sdk.CheckerOptionField { + return []sdk.CheckerOptionField{ + { + Id: "domain", + Type: "string", + Label: "Delegated domain", + Placeholder: "sub.example.com", + Required: true, + Description: "Fully-qualified name of the delegated zone to check.", + }, + } +} + +func (p *delegationProvider) ParseForm(r *http.Request) (sdk.CheckerOptions, error) { + domain := strings.TrimSpace(r.FormValue("domain")) + if domain == "" { + return nil, fmt.Errorf("domain is required") + } + fqdn := dns.Fqdn(domain) + labels := dns.SplitDomainName(fqdn) + if len(labels) < 2 { + return nil, fmt.Errorf("%q has no parent zone", domain) + } + parentZone := strings.Join(labels[1:], ".") + subdomain := labels[0] + + resolver := interactiveResolver() + + ctx := r.Context() + var ( + wg sync.WaitGroup + nsRecords []*dns.NS + dsRecords []*dns.DS + nsErr error + dsErr error + ) + wg.Add(2) + go func() { + defer wg.Done() + nsRecords, nsErr = lookupRecords[*dns.NS](ctx, resolver, fqdn, dns.TypeNS, false) + }() + go func() { + defer wg.Done() + dsRecords, dsErr = lookupRecords[*dns.DS](ctx, resolver, fqdn, dns.TypeDS, true) + }() + wg.Wait() + + if nsErr != nil { + return nil, fmt.Errorf("NS lookup for %s: %w", domain, nsErr) + } + if len(nsRecords) == 0 { + return nil, fmt.Errorf("no NS records found for %s", domain) + } + if dsErr != nil { + return nil, fmt.Errorf("DS lookup for %s: %w", domain, dsErr) + } + + body, err := json.Marshal(delegationService{NameServers: nsRecords, DS: dsRecords}) + if err != nil { + return nil, fmt.Errorf("marshal delegation service: %w", err) + } + + svc := serviceMessage{ + Type: "abstract.Delegation", + Domain: parentZone, + Service: body, + } + + return sdk.CheckerOptions{ + "domain_name": parentZone, + "subdomain": subdomain, + "service": svc, + }, nil +} + +var ( + resolverOnce sync.Once + resolverAddr string + + interactiveClient = &dns.Client{Timeout: dnsTimeout} +) + +func interactiveResolver() string { + resolverOnce.Do(func() { + cfg, err := dns.ClientConfigFromFile("/etc/resolv.conf") + if err != nil || len(cfg.Servers) == 0 { + resolverAddr = net.JoinHostPort("1.1.1.1", "53") + return + } + resolverAddr = net.JoinHostPort(cfg.Servers[0], cfg.Port) + }) + return resolverAddr +} + +func lookupRecords[T dns.RR](ctx context.Context, resolver, fqdn string, qtype uint16, edns bool) ([]T, error) { + msg := new(dns.Msg) + msg.SetQuestion(fqdn, qtype) + msg.RecursionDesired = true + if edns { + msg.SetEdns0(4096, true) + } + + in, _, err := interactiveClient.ExchangeContext(ctx, msg, resolver) + if err != nil { + return nil, err + } + if in.Rcode != dns.RcodeSuccess && in.Rcode != dns.RcodeNameError { + return nil, fmt.Errorf("rcode %s", dns.RcodeToString[in.Rcode]) + } + + var out []T + for _, rr := range in.Answer { + if t, ok := rr.(T); ok { + out = append(out, t) + } + } + return out, nil +} diff --git a/checker/rule.go b/checker/rule.go index 753d7b7..444d421 100644 --- a/checker/rule.go +++ b/checker/rule.go @@ -33,14 +33,14 @@ func (r *delegationRule) ValidateOptions(opts sdk.CheckerOptions) error { return nil } -func (r *delegationRule) Evaluate(ctx context.Context, obs sdk.ObservationGetter, opts sdk.CheckerOptions) sdk.CheckState { +func (r *delegationRule) Evaluate(ctx context.Context, obs sdk.ObservationGetter, opts sdk.CheckerOptions) []sdk.CheckState { var data DelegationData if err := obs.Get(ctx, ObservationKeyDelegation, &data); err != nil { - return sdk.CheckState{ + return []sdk.CheckState{{ Status: sdk.StatusError, Message: fmt.Sprintf("Failed to get delegation data: %v", err), Code: "delegation_error", - } + }} } return Evaluate(&data) } diff --git a/go.mod b/go.mod index ebea955..3ec3aab 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module git.happydns.org/checker-delegation go 1.25.0 require ( - git.happydns.org/checker-sdk-go v0.0.1 + git.happydns.org/checker-sdk-go v1.3.0 github.com/miekg/dns v1.1.72 ) diff --git a/go.sum b/go.sum index eab57b3..092728a 100644 --- a/go.sum +++ b/go.sum @@ -1,5 +1,5 @@ -git.happydns.org/checker-sdk-go v0.0.1 h1:4RxCJr73HWKxjOyU/6NJMO8lXJmH0gMLA68EzTqLbQI= -git.happydns.org/checker-sdk-go v0.0.1/go.mod h1:aNAcfYFfbhvH9kJhE0Njp5GX0dQbxdRB0rJ0KvSC5nI= +git.happydns.org/checker-sdk-go v1.3.0 h1:FG2kIhlJCzI0m35EhxSgn4UWc9M4ha6aZTeoChu4l7A= +git.happydns.org/checker-sdk-go v1.3.0/go.mod h1:aNAcfYFfbhvH9kJhE0Njp5GX0dQbxdRB0rJ0KvSC5nI= github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI= github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= github.com/miekg/dns v1.1.72 h1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI= diff --git a/main.go b/main.go index 615fea3..465e3cf 100644 --- a/main.go +++ b/main.go @@ -5,7 +5,7 @@ import ( "log" delegation "git.happydns.org/checker-delegation/checker" - sdk "git.happydns.org/checker-sdk-go/checker" + "git.happydns.org/checker-sdk-go/checker/server" ) var listenAddr = flag.String("listen", ":8080", "HTTP listen address") @@ -21,8 +21,8 @@ func main() { delegation.Version = Version - server := sdk.NewServer(delegation.Provider()) - if err := server.ListenAndServe(*listenAddr); err != nil { + srv := server.New(delegation.Provider()) + if err := srv.ListenAndServe(*listenAddr); err != nil { log.Fatalf("server error: %v", err) } }