Files
blocky/cmd/stats_test.go
Dimitri Herzog 84353421d7 fix(stats): give DNS rebinding protection its own REBIND response type (#2166)
* fix(stats): give DNS rebinding protection its own REBIND response type

Rebinding protection returned ResponseTypeFILTERED, the same type used for
query-type filtering (filtering.queryTypes). Since #2161 excluded FILTERED
from the "blocked" stats, a rebinding hit — an actual attack being stopped —
was counted as a benign filter: absent from summary.blocked, topBlockedDomains
and the per-hour blocked series, and reported instead under "filtered", whose
API description explicitly claims it holds only query-type/NOTFQDN responses.

FILTERED was overloaded, so no stats-layer mapping could tell the two apart.
Split them at the source:

- add model.ResponseTypeREBIND (appended to the enum, so existing iota values
  are unchanged) and return it from RebindingProtectionResolver
- count REBIND as blocked in the stats (summary, Top Blocked, per-hour series)
- report REBIND to clients as EDE 15 (Blocked) rather than 17 (Filtered). Per
  RFC 8914, Blocked is blocking by operator security policy and Filtered is
  blocking requested by the client; rebinding protection is operator policy.
- FILTERED now means exactly what its enum comment says: filtered by query type

Also fixes gaps left by #2161:

- perHour gains a `filtered` series, so the volume the blocked series no longer
  carries stays observable instead of vanishing from the API
- docs/interfaces.md still documented blocked = BLOCKED + FILTERED + NOTFQDN
- cover the Filtered mapping in toAPIStats, the CLI summary row and the
  per-hour blocked series, none of which were tested

BREAKING CHANGE: rebinding-protection hits change response type FILTERED ->
REBIND and reason "FILTERED (rebinding protection)" -> "REBIND (rebinding
protection)" in query logs and Prometheus labels, and their EDE code changes
from 17 (Filtered) to 15 (Blocked).

* fix(stats): give DNSSEC validation failures their own BOGUS response type

DNSSEC-bogus SERVFAILs reused ResponseTypeBLOCKED, which had two effects.

In the statistics they were counted as blocks: they inflated summary.blocked
and perHour[].blocked, and a domain whose operator had merely misconfigured
DNSSEC showed up in topBlockedDomains. That contradicts the definition of
"blocked" as queries blocked to protect the client.

Worse, EdeResolver sits above the DNSSEC resolver and rewrites the EDE option
from the response type, and util.SetEdns0Option replaces an existing option of
the same code. So the ExtendedErrorCodeDNSBogus (6) that the DNSSEC resolver
sets on its SERVFAIL was overwritten with Blocked (15) before the answer
reached the client. The existing test missed this because it exercises the
resolver in isolation, with no EDE resolver above it.

Give validation failures their own response type, mirroring REBIND: BOGUS maps
to ExtendedErrorCodeDNSBogus, so EdeResolver now reproduces the correct code
instead of clobbering it, and it is categorized as an error rather than a
block. A SERVFAIL is a resolution error - blocky could not obtain a trustworthy
answer - so it joins the chain-level failures in summary.errors. The curated
categories now partition every response type, so they always add up to queries.

Also point the shipped Grafana dashboard's blocked panels (block rate,
blocked/sec, block ratio, top block reasons) at BLOCKED|REBIND. They hard-coded
response_type="BLOCKED", so they would have disagreed with /api/stats about
what "blocked" means, and they silently counted DNSSEC failures as blocks.

The query-log dashboards keep filtering on BLOCKED alone: that panel is
"Blocked by Denylist" and is correctly scoped to denylist groups.

* docs: fix stale FILTERED terminology and a wrong symbol reference

Addresses the two Copilot review comments on #2166.

The categorize comment referred to `model.ToExtendedErrorCode`, but there is no
package-level function of that name - it is a method on `model.ResponseType`,
which makes the behavior hard to trace from the comment.

The rebinding docs and the RebindingProtectionResolver.Resolve comment still
described the response as FILTERED, mixing the old terminology with the new
REBIND semantics introduced in 66784f6d.

* refactor(stats): derive the per-hour series from curatedSummary

perHour re-implemented curatedSummary's category-summing loop, so every new
category had to be taught to two places: adding "filtered" in 66784f6d needed
an edit in both, and a future one that updated only the summary would leave the
per-hour series silently disagreeing about what counts as a block. Derive the
point from curatedSummary instead, so categorize() stays the single switch.

Correct the isBlockedRType comment while here: since perHour no longer calls
it, its only caller is the Top Blocked table.

Also reset the shared mock in the EdeResolver suite. `m` is a closure variable
that nothing set back to nil, so a resolver installed by one spec's BeforeEach
survived into the next and was reused by the `if m == nil` guard, leaking both
its response type and its accumulated Calls. It passed only because Ginkgo runs
specs in declaration order and the specs relying on the default mock happen to
be declared first; under --randomize-all it fails on every seed tried.

Finally, cover REBIND and BOGUS in the CLI stats fixture, which exercised
neither of the response types split out of BLOCKED.
2026-07-13 22:31:49 +02:00

198 lines
7.0 KiB
Go

package cmd
import (
"bytes"
"encoding/json"
"net/http"
"net/http/httptest"
"strings"
"time"
"github.com/0xERR0R/blocky/api"
. "github.com/onsi/ginkgo/v2"
. "github.com/onsi/gomega"
)
func sampleStats() api.ApiStats {
start := time.Date(2026, 6, 23, 0, 0, 0, 0, time.UTC)
return api.ApiStats{
Start: start,
End: start.Add(12 * time.Hour),
Summary: api.ApiStatsSummary{
Queries: 12431, Cached: 5102, Forwarded: 4445, Blocked: 2884, Filtered: 1620,
Local: 12, Dropped: 3, Errors: 7, AvgResponseMs: 7, CacheHitRate: 0.41,
},
ByQueryType: map[string]int{"A": 9000, "AAAA": 3431},
ByResponseCode: map[string]int{"NOERROR": 11000, "NXDOMAIN": 1431},
// summary.blocked is BLOCKED + REBIND (2874 + 10) and summary.errors is BOGUS,
// so the curated rows above stay consistent with this raw breakdown
ByResponseType: map[string]int{
"CACHED": 5102, "BLOCKED": 2874, "REBIND": 10, "FILTERED": 1620, "BOGUS": 7,
},
TopDomains: []api.ApiNameCount{{Name: "github.com", Count: 1203}},
TopBlockedDomains: []api.ApiNameCount{{Name: "ads.example.com", Count: 402}},
TopClients: []api.ApiNameCount{{Name: "10.0.0.5", Count: 4310}},
Lists: api.ApiListCounts{
// "tracking" is denylist-only: it must still appear in the Lists table
// (with a 0 allowlist cell), exercising the group-key union in renderFooter.
Denylist: map[string]int{"ads": 142000, "tracking": 5000},
Allowlist: map[string]int{"ads": 30},
},
Cache: api.ApiCacheStats{Entries: 8123},
}
}
var _ = Describe("renderStats", func() {
It("renders a populated snapshot with formatted numbers and all sections", func() {
s := sampleStats()
var buf bytes.Buffer
renderStats(&buf, &s)
out := buf.String()
Expect(out).Should(ContainSubstring("Window:"))
Expect(out).Should(ContainSubstring("(UTC)"))
Expect(out).Should(ContainSubstring("Summary"))
Expect(out).Should(ContainSubstring("Queries"))
Expect(out).Should(ContainSubstring("12,431")) // thousands separator
Expect(out).Should(ContainSubstring("41.0%")) // cache hit rate 0.41 -> 41.0%
Expect(out).Should(ContainSubstring("Top Domains"))
Expect(out).Should(ContainSubstring("github.com"))
Expect(out).Should(ContainSubstring("Top Blocked"))
Expect(out).Should(ContainSubstring("ads.example.com"))
// blocked and filtered are separate rows, each with its own share of queries
Expect(out).Should(ContainSubstring("Blocked"))
Expect(out).Should(ContainSubstring("2,884 (23.2%)"))
Expect(out).Should(ContainSubstring("Filtered"))
Expect(out).Should(ContainSubstring("1,620 (13.0%)"))
Expect(out).Should(ContainSubstring("Top Clients"))
Expect(out).Should(ContainSubstring("By Query Type"))
Expect(out).Should(ContainSubstring("Cache: 8,123 entries"))
Expect(out).Should(ContainSubstring("Lists"))
Expect(out).Should(ContainSubstring("7 ms"))
Expect(out).Should(ContainSubstring("By Response Code"))
Expect(out).Should(ContainSubstring("By Response Type"))
// the response types split out of BLOCKED reach the breakdown under their own names
Expect(out).Should(ContainSubstring("REBIND"))
Expect(out).Should(ContainSubstring("BOGUS"))
Expect(out).Should(ContainSubstring("142,000"))
Expect(out).Should(ContainSubstring("tracking")) // denylist-only group surfaces via union
Expect(out).Should(ContainSubstring("5,000")) // its denylist count
Expect(strings.Index(out, "9,000")).Should(BeNumerically("<", strings.Index(out, "3,431")))
})
It("renders (none) for empty lists and avoids divide-by-zero when there are no queries", func() {
s := api.ApiStats{
Start: time.Date(2026, 6, 23, 0, 0, 0, 0, time.UTC),
End: time.Date(2026, 6, 23, 0, 0, 0, 0, time.UTC),
Summary: api.ApiStatsSummary{}, // all zero
ByQueryType: map[string]int{},
ByResponseCode: map[string]int{},
ByResponseType: map[string]int{},
TopDomains: []api.ApiNameCount{},
Lists: api.ApiListCounts{Denylist: map[string]int{}, Allowlist: map[string]int{}},
Cache: api.ApiCacheStats{Entries: 0},
}
var buf bytes.Buffer
renderStats(&buf, &s)
out := buf.String()
Expect(out).Should(ContainSubstring("Top Domains: (none)"))
Expect(out).Should(ContainSubstring("By Query Type: (none)"))
Expect(out).Should(ContainSubstring("Lists: (none)"))
Expect(out).Should(ContainSubstring("0.0%")) // no panic, graceful percentage
})
It("formats integers with thousands separators", func() {
Expect(formatInt(0)).Should(Equal("0"))
Expect(formatInt(999)).Should(Equal("999"))
Expect(formatInt(12431)).Should(Equal("12,431"))
Expect(formatInt(1000000)).Should(Equal("1,000,000"))
Expect(formatInt(-12431)).Should(Equal("-12,431"))
})
It("formats percentages and guards against zero totals", func() {
Expect(formatPercent(41, 100)).Should(Equal("41.0%"))
Expect(formatPercent(0, 0)).Should(Equal("0.0%"))
})
})
var _ = Describe("stats command", func() {
var (
ts *httptest.Server
mockFn func(w http.ResponseWriter, _ *http.Request)
)
JustBeforeEach(func() {
ts = testHTTPAPIServer(mockFn)
})
JustAfterEach(func() {
ts.Close()
})
BeforeEach(func() {
mockFn = func(w http.ResponseWriter, _ *http.Request) {}
})
When("stats are available", func() {
BeforeEach(func() {
mockFn = func(w http.ResponseWriter, _ *http.Request) {
w.Header().Add("Content-Type", "application/json")
s := sampleStats()
response, err := json.Marshal(s)
Expect(err).Should(Succeed())
_, err = w.Write(response)
Expect(err).Should(Succeed())
}
})
It("renders the dashboard to the command output", func() {
cmd := withContext(NewStatsCommand())
var buf bytes.Buffer
cmd.SetOut(&buf)
Expect(stats(cmd, []string{})).Should(Succeed())
Expect(buf.String()).Should(ContainSubstring("Queries"))
Expect(buf.String()).Should(ContainSubstring("github.com"))
Expect(buf.String()).Should(ContainSubstring("Cache:"))
})
})
When("statistics are disabled (503)", func() {
BeforeEach(func() {
mockFn = func(w http.ResponseWriter, _ *http.Request) {
w.WriteHeader(http.StatusServiceUnavailable)
_, _ = w.Write([]byte("statistics are disabled"))
}
})
It("returns a friendly error", func() {
err := stats(withContext(NewStatsCommand()), []string{})
Expect(err).Should(HaveOccurred())
Expect(err.Error()).Should(ContainSubstring("disabled"))
})
})
When("server returns 500", func() {
BeforeEach(func() {
mockFn = func(w http.ResponseWriter, _ *http.Request) {
w.WriteHeader(http.StatusInternalServerError)
}
})
It("returns an error", func() {
err := stats(withContext(NewStatsCommand()), []string{})
Expect(err).Should(HaveOccurred())
Expect(err.Error()).Should(ContainSubstring("500 Internal Server Error"))
})
})
When("the API URL is unreachable", func() {
It("returns a transport error", func() {
apiPort = 0
err := stats(withContext(NewStatsCommand()), []string{})
Expect(err).Should(HaveOccurred())
Expect(err.Error()).Should(ContainSubstring("connection refused"))
})
})
})