StasonJatham
e8f7d6bfdf
Single stateless Go process that consumes CT logs via embedded (patched) CertSpotter internals, classifies cloud/database/storage DNS identifiers in-process with a zero-allocation classifier, enriches via round-robin DNS resolvers with CNAME following, and batch-writes useful findings to PostgreSQL. - third_party/certspotter: 2-hunk IdentifierSink patch, no stdout/JSON/files - internal/classify: AWS/Azure/GCP/Firebase/Cloudflare R2/DigitalOcean/Supabase/OCI - internal/dns: sharded bounded TTL cache, multi-resolver load balancing + failover - internal/pipeline: bounded queues, dedup, direct-priority load shedding - internal/store: pgx batch writer, Postgres CT checkpoints (no cert contents) - internal/probe: optional non-destructive reachability checks (off by default) - Docker: distroless non-root, read-only rootfs, no app volume, resource limits - tests enforce 0 allocs/op on the classifier and sink hot path
46 lines
1.2 KiB
Go
46 lines
1.2 KiB
Go
package probe
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"tea.karlcom.de/karl/bucketeer/internal/model"
|
|
)
|
|
|
|
func newProber(t *testing.T, status int) (*Prober, string) {
|
|
t.Helper()
|
|
srv := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(status)
|
|
}))
|
|
t.Cleanup(srv.Close)
|
|
p := New(Config{Workers: 1, Timeout: time.Second})
|
|
// httptest uses a self-signed cert; the prober already skips verification.
|
|
_ = tls.Config{}
|
|
host := strings.TrimPrefix(srv.URL, "https://")
|
|
return p, host
|
|
}
|
|
|
|
func TestProbeClassification(t *testing.T) {
|
|
cases := []struct {
|
|
status int
|
|
want model.ExposureState
|
|
}{
|
|
{http.StatusOK, model.ExposurePublicRead},
|
|
{http.StatusForbidden, model.ExposureAuthRequired},
|
|
{http.StatusUnauthorized, model.ExposureAuthRequired},
|
|
{http.StatusNotFound, model.ExposureNotFound},
|
|
{http.StatusInternalServerError, model.ExposureReachable},
|
|
}
|
|
for _, c := range cases {
|
|
p, host := newProber(t, c.status)
|
|
got := p.probe(t.Context(), model.Candidate{Hostname: host})
|
|
if got != c.want {
|
|
t.Errorf("status %d: got %s, want %s", c.status, got, c.want)
|
|
}
|
|
}
|
|
}
|