// SPDX-License-Identifier: MIT
package checker
import (
"bytes"
"encoding/json"
"fmt"
"html"
"html/template"
"sort"
"strings"
"time"
sdk "git.happydns.org/checker-sdk-go/checker"
)
// GetHTMLReport uses html/template for the skeleton (auto-escaping) and
// html.EscapeString for the hand-rendered zone tree; every user-controlled
// field must be escaped at the call site.
func (p *dnsvizProvider) GetHTMLReport(ctx sdk.ReportContext) (string, error) {
var data DNSVizData
if raw := ctx.Data(); len(raw) > 0 {
if err := json.Unmarshal(raw, &data); err != nil {
return "", fmt.Errorf("decoding DNSViz data: %w", err)
}
}
states := ctx.States()
view := buildReportView(&data, states)
var buf bytes.Buffer
if err := reportTmpl.Execute(&buf, view); err != nil {
return "", fmt.Errorf("rendering DNSViz report: %w", err)
}
return buf.String(), nil
}
// ExtractMetrics turns the rule output into time-series points so a
// happyDomain dashboard can show DNSSEC drift over time.
func (p *dnsvizProvider) ExtractMetrics(ctx sdk.ReportContext, collectedAt time.Time) ([]sdk.CheckMetric, error) {
var data DNSVizData
if raw := ctx.Data(); len(raw) > 0 {
if err := json.Unmarshal(raw, &data); err != nil {
return nil, err
}
}
metrics := []sdk.CheckMetric{
{
Name: "dnsviz.zones.count",
Value: float64(len(data.Zones)),
Timestamp: collectedAt,
},
}
var totalErrors, totalWarnings int
for _, z := range data.Zones {
totalErrors += len(z.Errors)
totalWarnings += len(z.Warnings)
}
metrics = append(metrics,
sdk.CheckMetric{Name: "dnsviz.errors.count", Value: float64(totalErrors), Timestamp: collectedAt},
sdk.CheckMetric{Name: "dnsviz.warnings.count", Value: float64(totalWarnings), Timestamp: collectedAt},
)
byStatus := map[sdk.Status]int{}
for _, s := range ctx.States() {
byStatus[s.Status]++
}
for status, n := range byStatus {
metrics = append(metrics, sdk.CheckMetric{
Name: "dnsviz.findings.count",
Value: float64(n),
Labels: map[string]string{"status": status.String()},
Timestamp: collectedAt,
})
}
return metrics, nil
}
// ── view assembly ────────────────────────────────────────────────────────
type reportView struct {
Domain string
DomainHdr string
Empty bool
Banner *bannerView
Fixes []fixView
Chain template.HTML
States []stateRow
HasRaw bool
Raw string
ProbeStderr string
GrokStderr string
}
type bannerView struct {
Status string
Leaf string
LeafSt string
}
type fixView struct {
Class string
Title string
Subject string
Code string
Hint string
}
type stateRow struct {
Status string
Subject string
Code string
Message string
}
func buildReportView(data *DNSVizData, states []sdk.CheckState) reportView {
v := reportView{
Domain: data.Domain,
DomainHdr: emptyAsUnknown(data.Domain),
}
if len(states) == 0 && len(data.Zones) == 0 {
v.Empty = true
return v
}
v.Banner = buildBanner(data, states)
v.Fixes = buildFixes(states)
v.Chain = template.HTML(renderChain(data))
v.States = buildStates(states)
if len(data.Raw) > 0 {
v.HasRaw = true
v.Raw = string(data.Raw)
v.ProbeStderr = data.ProbeStderr
v.GrokStderr = data.GrokStderr
}
return v
}
func buildBanner(data *DNSVizData, states []sdk.CheckState) *bannerView {
leaf := data.Domain + "."
z, ok := data.Zones[leaf]
if !ok {
zones := orderedZones(data)
if len(zones) > 0 {
leaf = zones[0]
z = data.Zones[leaf]
}
}
st := statusFromGrok(z.Status)
if w := worstStatus(states); w > st {
st = w
}
return &bannerView{
Status: st.String(),
Leaf: strings.TrimSuffix(leaf, "."),
LeafSt: emptyAsUnknown(z.Status),
}
}
func buildFixes(states []sdk.CheckState) []fixView {
var items []sdk.CheckState
for _, s := range states {
if s.Status < sdk.StatusWarn {
continue
}
items = append(items, s)
}
if len(items) == 0 {
return nil
}
sort.SliceStable(items, func(i, j int) bool {
if items[i].Status != items[j].Status {
return items[i].Status > items[j].Status
}
return items[i].Subject < items[j].Subject
})
out := make([]fixView, 0, len(items))
for _, s := range items {
title, hint := titleAndHint(s)
klass := "fix-card"
if s.Status == sdk.StatusWarn {
klass = "fix-card warn"
}
if hint == "" {
hint = s.Message
}
out = append(out, fixView{
Class: klass,
Title: title,
Subject: s.Subject,
Code: s.Code,
Hint: hint,
})
}
return out
}
func buildStates(states []sdk.CheckState) []stateRow {
if len(states) == 0 {
return nil
}
sorted := append([]sdk.CheckState(nil), states...)
sort.SliceStable(sorted, func(i, j int) bool {
if sorted[i].Status != sorted[j].Status {
return sorted[i].Status > sorted[j].Status
}
if sorted[i].Subject != sorted[j].Subject {
return sorted[i].Subject < sorted[j].Subject
}
return sorted[i].Code < sorted[j].Code
})
out := make([]stateRow, 0, len(sorted))
for _, s := range sorted {
out = append(out, stateRow{
Status: s.Status.String(),
Subject: s.Subject,
Code: s.Code,
Message: s.Message,
})
}
return out
}
func titleAndHint(s sdk.CheckState) (title, hint string) {
if s.Meta != nil {
if v, ok := s.Meta["title"].(string); ok {
title = v
}
if v, ok := s.Meta["hint"].(string); ok {
hint = v
}
}
if title == "" {
title = s.Message
}
return
}
// ── top-level template ───────────────────────────────────────────────────
var reportTmpl = template.Must(template.New("report").Parse(`
DNSSEC report: {{.Domain}}
DNSSEC analysis
{{.DomainHdr}}
{{- if .Empty}}
No DNSViz data and no rule states. The check probably failed before producing any output.
{{- else -}}
{{with .Banner}}Overall: {{.Status}}DNSViz status of {{.Leaf}}: {{.LeafSt}}
{{end}}
{{if .Fixes}}Fix these first
{{range .Fixes}}{{.Title}}
at {{.Subject}}, rule {{.Code}}
{{if .Hint}}
{{.Hint}}
{{end}}
All rule states
| Status | Subject | Code | Message |
|---|
{{range .States}}| {{.Status}} | {{.Subject}} | {{.Code}} | {{.Message}} |
{{end}}
{{end}}
{{if .HasRaw}}Raw dnsviz grok output
{{.Raw}}dnsviz probe stderr
{{.ProbeStderr}}dnsviz grok stderr
{{.GrokStderr}}DNS hierarchy (root → leaf)
`)
if rawDecodeErr != nil {
fmt.Fprintf(&b, `Raw dnsviz grok JSON could not be decoded (%s); rendering from typed data only.
`,
html.EscapeString(rawDecodeErr.Error()))
}
for i := len(zones) - 1; i >= 0; i-- {
name := zones[i]
z := data.Zones[name]
var raw map[string]any
if rb, ok := rawZones[name]; ok {
// Per-zone decode failures are expected for some dnsviz versions
// where a key holds a non-object value; fall back silently.
if err := json.Unmarshal(rb, &raw); err != nil {
raw = nil
}
}
writeZoneBlock(&b, name, i, len(zones), z, raw)
}
b.WriteString(``)
return b.String()
}
func writeZoneBlock(b *strings.Builder, name string, idx, total int, z ZoneAnalysis, raw map[string]any) {
st := statusFromGrok(z.Status)
level := zoneLevelLabel(idx, total)
// Default-open zones with problems so the user sees them without
// clicking; healthy/informational zones collapse to keep the chain
// overview tidy. Threshold is StatusWarn: INFO (e.g. INSECURE,
// NOERROR fallback) is not a problem worth surfacing automatically.
openAttr := ""
if st >= sdk.StatusWarn || len(z.Errors) > 0 || len(z.Warnings) > 0 {
openAttr = " open"
}
fmt.Fprintf(b, ``, st.String(), openAttr)
b.WriteString(``)
fmt.Fprintf(b, `%s
`, html.EscapeString(name))
if level != "" {
fmt.Fprintf(b, `%s`, html.EscapeString(level))
}
fmt.Fprintf(b, `%s`, st.String(), html.EscapeString(emptyAsUnknown(z.Status)))
if z.DNSStatus != "" && !strings.EqualFold(z.DNSStatus, z.Status) {
fmt.Fprintf(b, `DNS: %s`, html.EscapeString(z.DNSStatus))
}
if n := len(z.Errors); n > 0 {
fmt.Fprintf(b, `%d error%s`, n, pluralS(n))
}
if n := len(z.Warnings); n > 0 {
fmt.Fprintf(b, `%d warning%s`, n, pluralS(n))
}
b.WriteString(`
`)
b.WriteString(``)
if raw != nil {
writeDelegationSubsec(b, raw["delegation"])
writeDNSKEYSubsec(b, raw["dnskey"])
writeServersSubsec(b, raw["zone"])
writeQueriesSubsec(b, raw["queries"])
}
writeZoneFindings(b, z)
b.WriteString(`
`)
}
func zoneLevelLabel(idx, total int) string {
switch {
case total == 1:
return ""
case idx == 0:
return "(leaf)"
case idx == total-1:
return "(root / TLD)"
default:
return "(intermediate)"
}
}
// ── delegation (DS at parent) ────────────────────────────────────────────
func writeDelegationSubsec(b *strings.Builder, node any) {
m, ok := node.(map[string]any)
if !ok {
return
}
dsArr, _ := m["ds"].([]any)
delStatus, _ := m["status"].(string)
b.WriteString(`Delegation (DS at parent)`)
if delStatus != "" {
fmt.Fprintf(b, ` %s`, recordStatusClass(delStatus), html.EscapeString(delStatus))
}
fmt.Fprintf(b, ` %d DS
`, len(dsArr))
if len(dsArr) == 0 {
b.WriteString(`No DS record published at the parent: zone is unsigned (INSECURE).
`)
return
}
b.WriteString(``)
for _, item := range dsArr {
ds, _ := item.(map[string]any)
writeDSRecord(b, ds)
}
b.WriteString(`
`)
}
func writeDSRecord(b *strings.Builder, ds map[string]any) {
if ds == nil {
return
}
status, _ := ds["status"].(string)
alg := numAsInt(ds["algorithm"])
keyTag := numAsInt(ds["key_tag"])
digestType := numAsInt(ds["digest_type"])
digest, _ := ds["digest"].(string)
fmt.Fprintf(b, ``, recordStatusClass(status))
b.WriteString(`
`)
fmt.Fprintf(b, `%s`, html.EscapeString(dnssecAlgName(alg)))
fmt.Fprintf(b, `key tag %d`, keyTag)
fmt.Fprintf(b, `digest %s`, html.EscapeString(digestTypeName(digestType)))
b.WriteString(`
`)
b.WriteString(`
`)
b.WriteString(html.EscapeString(truncMid(digest, 40)))
b.WriteString(`
`)
b.WriteString(`
`)
if status != "" {
fmt.Fprintf(b, `%s`, recordStatusClass(status), html.EscapeString(status))
}
b.WriteString(`
DNSKEY set at apex`)
fmt.Fprintf(b, ` %d key%s
`, len(arr), pluralS(len(arr)))
if len(arr) == 0 {
b.WriteString(`No DNSKEY published at the apex.
`)
return
}
b.WriteString(``)
for _, item := range arr {
k, _ := item.(map[string]any)
writeDNSKEYRecord(b, k)
}
b.WriteString(`
`)
}
func writeDNSKEYRecord(b *strings.Builder, k map[string]any) {
if k == nil {
return
}
flags := numAsInt(k["flags"])
alg := numAsInt(k["algorithm"])
keyTag := numAsInt(k["key_tag"])
keyLen := numAsInt(k["key_length"])
status, _ := k["status"].(string)
fmt.Fprintf(b, ``, recordStatusClass(status))
b.WriteString(`
`)
fmt.Fprintf(b, `%s`, html.EscapeString(dnskeyFlagsLabel(flags)))
fmt.Fprintf(b, `%s`, html.EscapeString(dnssecAlgName(alg)))
fmt.Fprintf(b, `key tag %d`, keyTag)
if keyLen > 0 {
fmt.Fprintf(b, `%d bits`, keyLen)
}
b.WriteString(`
`)
b.WriteString(`
`)
b.WriteString(`
`)
if status != "" {
fmt.Fprintf(b, `%s`, recordStatusClass(status), html.EscapeString(status))
}
b.WriteString(`
Authoritative servers`)
fmt.Fprintf(b, ` %d
`, len(names))
b.WriteString(``)
for _, n := range names {
entry, _ := servers[n].(map[string]any)
b.WriteString(`
`)
fmt.Fprintf(b, `
%s
`, html.EscapeString(n))
writeIPList(b, "auth", entry["auth"])
writeIPList(b, "glue", entry["glue"])
b.WriteString(``)
}
b.WriteString(`
%s`, html.EscapeString(label))
for _, ip := range arr {
if s, ok := ip.(string); ok {
fmt.Fprintf(b, `- %s
`, html.EscapeString(s))
}
}
b.WriteString(`
`)
}
// ── queries (per RR-name/type) ───────────────────────────────────────────
func writeQueriesSubsec(b *strings.Builder, node any) {
q, ok := node.(map[string]any)
if !ok || len(q) == 0 {
return
}
keys := make([]string, 0, len(q))
for k := range q {
keys = append(keys, k)
}
sort.Strings(keys)
b.WriteString(`Queries`)
fmt.Fprintf(b, ` %d
`, len(keys))
for _, k := range keys {
entry, _ := q[k].(map[string]any)
writeQueryEntry(b, k, entry)
}
b.WriteString(``)
}
func writeQueryEntry(b *strings.Builder, key string, entry map[string]any) {
if entry == nil {
return
}
qname, qtype := splitQueryKey(key)
kind := queryKindLabel(entry)
worst := worstQueryStatus(entry)
fmt.Fprintf(b, `%s%s%s`,
html.EscapeString(qname), html.EscapeString(qtype), html.EscapeString(kind))
if worst != "" {
fmt.Fprintf(b, ` %s`, recordStatusClass(worst), html.EscapeString(worst))
}
b.WriteString(`
`)
if ans, ok := entry["answer"].([]any); ok {
for _, a := range ans {
writeAnswerRRset(b, a)
}
}
if nd, ok := entry["nodata"].([]any); ok {
for _, p := range nd {
writeNegativeProof(b, p, "NODATA")
}
}
if nx, ok := entry["nxdomain"].([]any); ok {
for _, p := range nx {
writeNegativeProof(b, p, "NXDOMAIN")
}
}
if er, ok := entry["error"].([]any); ok {
for _, e := range er {
writeQueryError(b, e)
}
}
b.WriteString(`
`)
b.WriteString(`
`)
b.WriteString(`RRset`)
if ttl > 0 {
fmt.Fprintf(b, `TTL %d`, ttl)
}
b.WriteString(`
`)
b.WriteString(`
`)
if desc != "" {
fmt.Fprintf(b, `
%s`, html.EscapeString(desc))
}
if len(rdata) > 0 {
b.WriteString(`
`)
for _, r := range rdata {
if s, ok := r.(string); ok {
fmt.Fprintf(b, `- %s
`, html.EscapeString(s))
}
}
b.WriteString(`
`)
}
b.WriteString(`
`, recordStatusClass(status))
b.WriteString(`
`)
b.WriteString(`RRSIG`)
fmt.Fprintf(b, `%s`, html.EscapeString(dnssecAlgName(alg)))
fmt.Fprintf(b, `key tag %d`, keyTag)
if signer != "" {
fmt.Fprintf(b, `signer %s`, html.EscapeString(signer))
}
b.WriteString(`
`)
b.WriteString(`
`)
if insep != "" || expir != "" {
fmt.Fprintf(b, `valid %s → %s`, html.EscapeString(insep), html.EscapeString(expir))
}
b.WriteString(`
`)
b.WriteString(`
`)
if status != "" {
fmt.Fprintf(b, `%s`, recordStatusClass(status), html.EscapeString(status))
}
b.WriteString(`
`)
b.WriteString(`
`)
fmt.Fprintf(b, `%s`, html.EscapeString(kind))
fmt.Fprintf(b, `%d NSEC proof%s`, len(proofs), pluralS(len(proofs)))
b.WriteString(`
`, recordStatusClass(status))
b.WriteString(`
NSEC
`)
b.WriteString(`
`)
b.WriteString(html.EscapeString(desc))
b.WriteString(`
`)
b.WriteString(`
`)
if status != "" {
fmt.Fprintf(b, `%s`, recordStatusClass(status), html.EscapeString(status))
}
b.WriteString(`
ERROR
`)
fmt.Fprintf(b, `
%s
DNSViz reported no problem at this level.
`)
return
}
b.WriteString(`Findings`)
fmt.Fprintf(b, ` %d error%s, %d warning%s
`,
len(z.Errors), pluralS(len(z.Errors)),
len(z.Warnings), pluralS(len(z.Warnings)))
if len(z.Errors) > 0 {
b.WriteString(``)
for _, f := range z.Errors {
writeFindingLI(b, f, "err")
}
b.WriteString(`
`)
}
if len(z.Warnings) > 0 {
b.WriteString(``)
for _, f := range z.Warnings {
writeFindingLI(b, f, "warn")
}
b.WriteString(`
`)
}
b.WriteString(``)
}
func writeFindingLI(b *strings.Builder, f Finding, klass string) {
fmt.Fprintf(b, ``, klass)
if f.Code != "" {
fmt.Fprintf(b, `%s `, html.EscapeString(f.Code))
}
b.WriteString(html.EscapeString(f.Description))
if len(f.Servers) > 0 {
fmt.Fprintf(b, ` (%s)`, html.EscapeString(strings.Join(f.Servers, ", ")))
}
if f.Path != "" {
fmt.Fprintf(b, `at %s`, html.EscapeString(f.Path))
}
b.WriteString(``)
}
// ── helpers ──────────────────────────────────────────────────────────────
func recordStatusClass(s string) string {
switch strings.ToUpper(strings.TrimSpace(s)) {
case "":
return "s-none"
case "VALID", "SECURE":
return "s-OK"
case "INSECURE", "NON_EXISTENT":
return "s-INFO"
case "INDETERMINATE", "INDETERMINATE_DS":
return "s-WARN"
case "BOGUS", "INVALID", "EXPIRED", "PREMATURE", "MISSING":
return "s-CRIT"
}
return "s-UNKNOWN"
}
func dnssecAlgName(n int) string {
switch n {
case 1:
return "RSAMD5"
case 3:
return "DSA"
case 5:
return "RSASHA1"
case 6:
return "DSA-NSEC3-SHA1"
case 7:
return "RSASHA1-NSEC3"
case 8:
return "RSASHA256"
case 10:
return "RSASHA512"
case 12:
return "ECC-GOST"
case 13:
return "ECDSAP256SHA256"
case 14:
return "ECDSAP384SHA384"
case 15:
return "ED25519"
case 16:
return "ED448"
case 0:
return "?"
}
return fmt.Sprintf("alg %d", n)
}
func digestTypeName(n int) string {
switch n {
case 1:
return "SHA-1"
case 2:
return "SHA-256"
case 3:
return "GOST R 34.11-94"
case 4:
return "SHA-384"
}
return fmt.Sprintf("type %d", n)
}
func dnskeyFlagsLabel(f int) string {
zone := f&0x100 != 0
sep := f&0x1 != 0
rev := f&0x80 != 0
switch {
case rev && zone && sep:
return "KSK (revoked)"
case zone && sep:
return "KSK"
case zone:
return "ZSK"
}
return fmt.Sprintf("flags %d", f)
}
func numAsInt(v any) int {
switch n := v.(type) {
case float64:
return int(n)
case int:
return n
case int64:
return int(n)
case json.Number:
i, _ := n.Int64()
return int(i)
}
return 0
}
func truncMid(s string, max int) string {
if max <= 0 || len(s) <= max {
return s
}
if max < 5 {
return s[:max]
}
half := (max - 1) / 2
return s[:half] + "…" + s[len(s)-half:]
}
func pluralS(n int) string {
if n == 1 {
return ""
}
return "s"
}
// worstStatus returns the highest-severity status in states, using the same
// ordering buildFixes relies on (Crit > Error > Warn > Info > OK > Unknown).
// Returns StatusOK when states is empty.
func worstStatus(states []sdk.CheckState) sdk.Status {
if len(states) == 0 {
return sdk.StatusOK
}
worst := states[0].Status
for _, s := range states[1:] {
if s.Status > worst {
worst = s.Status
}
}
return worst
}