StasonJatham
e8f7d6bfdf
Single stateless Go process that consumes CT logs via embedded (patched) CertSpotter internals, classifies cloud/database/storage DNS identifiers in-process with a zero-allocation classifier, enriches via round-robin DNS resolvers with CNAME following, and batch-writes useful findings to PostgreSQL. - third_party/certspotter: 2-hunk IdentifierSink patch, no stdout/JSON/files - internal/classify: AWS/Azure/GCP/Firebase/Cloudflare R2/DigitalOcean/Supabase/OCI - internal/dns: sharded bounded TTL cache, multi-resolver load balancing + failover - internal/pipeline: bounded queues, dedup, direct-priority load shedding - internal/store: pgx batch writer, Postgres CT checkpoints (no cert contents) - internal/probe: optional non-destructive reachability checks (off by default) - Docker: distroless non-root, read-only rootfs, no app volume, resource limits - tests enforce 0 allocs/op on the classifier and sink hot path
67 lines
1.7 KiB
Go
67 lines
1.7 KiB
Go
package store
|
|
|
|
import (
|
|
"os"
|
|
"testing"
|
|
|
|
"software.sslmate.com/src/certspotter/cttypes"
|
|
|
|
"tea.karlcom.de/karl/bucketeer/internal/model"
|
|
"tea.karlcom.de/karl/bucketeer/internal/pipeline"
|
|
)
|
|
|
|
func TestSTHKeyStableAndUnique(t *testing.T) {
|
|
a := &cttypes.SignedTreeHead{TreeSize: 10, Timestamp: 100}
|
|
if sthKey(a) != sthKey(a) {
|
|
t.Fatal("sthKey is not deterministic")
|
|
}
|
|
b := &cttypes.SignedTreeHead{TreeSize: 11, Timestamp: 100}
|
|
if sthKey(a) == sthKey(b) {
|
|
t.Fatal("sthKey collides for different tree sizes")
|
|
}
|
|
}
|
|
|
|
func TestNonNil(t *testing.T) {
|
|
if got := nonNil(nil); got == nil || len(got) != 0 {
|
|
t.Fatalf("nonNil(nil) = %#v", got)
|
|
}
|
|
in := []string{"a"}
|
|
if got := nonNil(in); len(got) != 1 || got[0] != "a" {
|
|
t.Fatalf("nonNil changed slice: %#v", got)
|
|
}
|
|
}
|
|
|
|
// TestIntegration exercises the real schema when DATABASE_URL is set.
|
|
func TestIntegration(t *testing.T) {
|
|
url := os.Getenv("DATABASE_URL")
|
|
if url == "" {
|
|
t.Skip("DATABASE_URL not set; skipping integration test")
|
|
}
|
|
ctx := t.Context()
|
|
s, err := Open(ctx, url, 2)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer s.Close()
|
|
if err := s.Migrate(ctx); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
f := pipeline.Finding{
|
|
Candidate: model.Candidate{
|
|
Hostname: "it-bucket.s3.eu-central-1.amazonaws.com",
|
|
Original: "it-bucket.s3.eu-central-1.amazonaws.com",
|
|
Provider: model.ProviderAWS,
|
|
Service: model.ServiceS3,
|
|
Source: model.SourceDirectCT,
|
|
},
|
|
IPv4: []string{"1.2.3.4"},
|
|
}
|
|
if err := s.WriteFindings(ctx, []pipeline.Finding{f}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := s.UpdateExposure(ctx, model.ProviderAWS.String(), model.ServiceS3.String(), f.Hostname, model.ExposureReachable); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|