mirror of
https://github.com/0xERR0R/blocky.git
synced 2026-10-12 02:01:13 +00:00
* fix(stats): give DNS rebinding protection its own REBIND response type Rebinding protection returned ResponseTypeFILTERED, the same type used for query-type filtering (filtering.queryTypes). Since #2161 excluded FILTERED from the "blocked" stats, a rebinding hit — an actual attack being stopped — was counted as a benign filter: absent from summary.blocked, topBlockedDomains and the per-hour blocked series, and reported instead under "filtered", whose API description explicitly claims it holds only query-type/NOTFQDN responses. FILTERED was overloaded, so no stats-layer mapping could tell the two apart. Split them at the source: - add model.ResponseTypeREBIND (appended to the enum, so existing iota values are unchanged) and return it from RebindingProtectionResolver - count REBIND as blocked in the stats (summary, Top Blocked, per-hour series) - report REBIND to clients as EDE 15 (Blocked) rather than 17 (Filtered). Per RFC 8914, Blocked is blocking by operator security policy and Filtered is blocking requested by the client; rebinding protection is operator policy. - FILTERED now means exactly what its enum comment says: filtered by query type Also fixes gaps left by #2161: - perHour gains a `filtered` series, so the volume the blocked series no longer carries stays observable instead of vanishing from the API - docs/interfaces.md still documented blocked = BLOCKED + FILTERED + NOTFQDN - cover the Filtered mapping in toAPIStats, the CLI summary row and the per-hour blocked series, none of which were tested BREAKING CHANGE: rebinding-protection hits change response type FILTERED -> REBIND and reason "FILTERED (rebinding protection)" -> "REBIND (rebinding protection)" in query logs and Prometheus labels, and their EDE code changes from 17 (Filtered) to 15 (Blocked). * fix(stats): give DNSSEC validation failures their own BOGUS response type DNSSEC-bogus SERVFAILs reused ResponseTypeBLOCKED, which had two effects. In the statistics they were counted as blocks: they inflated summary.blocked and perHour[].blocked, and a domain whose operator had merely misconfigured DNSSEC showed up in topBlockedDomains. That contradicts the definition of "blocked" as queries blocked to protect the client. Worse, EdeResolver sits above the DNSSEC resolver and rewrites the EDE option from the response type, and util.SetEdns0Option replaces an existing option of the same code. So the ExtendedErrorCodeDNSBogus (6) that the DNSSEC resolver sets on its SERVFAIL was overwritten with Blocked (15) before the answer reached the client. The existing test missed this because it exercises the resolver in isolation, with no EDE resolver above it. Give validation failures their own response type, mirroring REBIND: BOGUS maps to ExtendedErrorCodeDNSBogus, so EdeResolver now reproduces the correct code instead of clobbering it, and it is categorized as an error rather than a block. A SERVFAIL is a resolution error - blocky could not obtain a trustworthy answer - so it joins the chain-level failures in summary.errors. The curated categories now partition every response type, so they always add up to queries. Also point the shipped Grafana dashboard's blocked panels (block rate, blocked/sec, block ratio, top block reasons) at BLOCKED|REBIND. They hard-coded response_type="BLOCKED", so they would have disagreed with /api/stats about what "blocked" means, and they silently counted DNSSEC failures as blocks. The query-log dashboards keep filtering on BLOCKED alone: that panel is "Blocked by Denylist" and is correctly scoped to denylist groups. * docs: fix stale FILTERED terminology and a wrong symbol reference Addresses the two Copilot review comments on #2166. The categorize comment referred to `model.ToExtendedErrorCode`, but there is no package-level function of that name - it is a method on `model.ResponseType`, which makes the behavior hard to trace from the comment. The rebinding docs and the RebindingProtectionResolver.Resolve comment still described the response as FILTERED, mixing the old terminology with the new REBIND semantics introduced in66784f6d. * refactor(stats): derive the per-hour series from curatedSummary perHour re-implemented curatedSummary's category-summing loop, so every new category had to be taught to two places: adding "filtered" in66784f6dneeded an edit in both, and a future one that updated only the summary would leave the per-hour series silently disagreeing about what counts as a block. Derive the point from curatedSummary instead, so categorize() stays the single switch. Correct the isBlockedRType comment while here: since perHour no longer calls it, its only caller is the Top Blocked table. Also reset the shared mock in the EdeResolver suite. `m` is a closure variable that nothing set back to nil, so a resolver installed by one spec's BeforeEach survived into the next and was reused by the `if m == nil` guard, leaking both its response type and its accumulated Calls. It passed only because Ginkgo runs specs in declaration order and the specs relying on the default mock happen to be declared first; under --randomize-all it fails on every seed tried. Finally, cover REBIND and BOGUS in the CLI stats fixture, which exercised neither of the response types split out of BLOCKED.
198 lines
7.0 KiB
Go
198 lines
7.0 KiB
Go
package cmd
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/0xERR0R/blocky/api"
|
|
|
|
. "github.com/onsi/ginkgo/v2"
|
|
. "github.com/onsi/gomega"
|
|
)
|
|
|
|
func sampleStats() api.ApiStats {
|
|
start := time.Date(2026, 6, 23, 0, 0, 0, 0, time.UTC)
|
|
|
|
return api.ApiStats{
|
|
Start: start,
|
|
End: start.Add(12 * time.Hour),
|
|
Summary: api.ApiStatsSummary{
|
|
Queries: 12431, Cached: 5102, Forwarded: 4445, Blocked: 2884, Filtered: 1620,
|
|
Local: 12, Dropped: 3, Errors: 7, AvgResponseMs: 7, CacheHitRate: 0.41,
|
|
},
|
|
ByQueryType: map[string]int{"A": 9000, "AAAA": 3431},
|
|
ByResponseCode: map[string]int{"NOERROR": 11000, "NXDOMAIN": 1431},
|
|
// summary.blocked is BLOCKED + REBIND (2874 + 10) and summary.errors is BOGUS,
|
|
// so the curated rows above stay consistent with this raw breakdown
|
|
ByResponseType: map[string]int{
|
|
"CACHED": 5102, "BLOCKED": 2874, "REBIND": 10, "FILTERED": 1620, "BOGUS": 7,
|
|
},
|
|
TopDomains: []api.ApiNameCount{{Name: "github.com", Count: 1203}},
|
|
TopBlockedDomains: []api.ApiNameCount{{Name: "ads.example.com", Count: 402}},
|
|
TopClients: []api.ApiNameCount{{Name: "10.0.0.5", Count: 4310}},
|
|
Lists: api.ApiListCounts{
|
|
// "tracking" is denylist-only: it must still appear in the Lists table
|
|
// (with a 0 allowlist cell), exercising the group-key union in renderFooter.
|
|
Denylist: map[string]int{"ads": 142000, "tracking": 5000},
|
|
Allowlist: map[string]int{"ads": 30},
|
|
},
|
|
Cache: api.ApiCacheStats{Entries: 8123},
|
|
}
|
|
}
|
|
|
|
var _ = Describe("renderStats", func() {
|
|
It("renders a populated snapshot with formatted numbers and all sections", func() {
|
|
s := sampleStats()
|
|
var buf bytes.Buffer
|
|
|
|
renderStats(&buf, &s)
|
|
out := buf.String()
|
|
|
|
Expect(out).Should(ContainSubstring("Window:"))
|
|
Expect(out).Should(ContainSubstring("(UTC)"))
|
|
Expect(out).Should(ContainSubstring("Summary"))
|
|
Expect(out).Should(ContainSubstring("Queries"))
|
|
Expect(out).Should(ContainSubstring("12,431")) // thousands separator
|
|
Expect(out).Should(ContainSubstring("41.0%")) // cache hit rate 0.41 -> 41.0%
|
|
Expect(out).Should(ContainSubstring("Top Domains"))
|
|
Expect(out).Should(ContainSubstring("github.com"))
|
|
Expect(out).Should(ContainSubstring("Top Blocked"))
|
|
Expect(out).Should(ContainSubstring("ads.example.com"))
|
|
// blocked and filtered are separate rows, each with its own share of queries
|
|
Expect(out).Should(ContainSubstring("Blocked"))
|
|
Expect(out).Should(ContainSubstring("2,884 (23.2%)"))
|
|
Expect(out).Should(ContainSubstring("Filtered"))
|
|
Expect(out).Should(ContainSubstring("1,620 (13.0%)"))
|
|
Expect(out).Should(ContainSubstring("Top Clients"))
|
|
Expect(out).Should(ContainSubstring("By Query Type"))
|
|
Expect(out).Should(ContainSubstring("Cache: 8,123 entries"))
|
|
Expect(out).Should(ContainSubstring("Lists"))
|
|
Expect(out).Should(ContainSubstring("7 ms"))
|
|
Expect(out).Should(ContainSubstring("By Response Code"))
|
|
Expect(out).Should(ContainSubstring("By Response Type"))
|
|
// the response types split out of BLOCKED reach the breakdown under their own names
|
|
Expect(out).Should(ContainSubstring("REBIND"))
|
|
Expect(out).Should(ContainSubstring("BOGUS"))
|
|
Expect(out).Should(ContainSubstring("142,000"))
|
|
Expect(out).Should(ContainSubstring("tracking")) // denylist-only group surfaces via union
|
|
Expect(out).Should(ContainSubstring("5,000")) // its denylist count
|
|
Expect(strings.Index(out, "9,000")).Should(BeNumerically("<", strings.Index(out, "3,431")))
|
|
})
|
|
|
|
It("renders (none) for empty lists and avoids divide-by-zero when there are no queries", func() {
|
|
s := api.ApiStats{
|
|
Start: time.Date(2026, 6, 23, 0, 0, 0, 0, time.UTC),
|
|
End: time.Date(2026, 6, 23, 0, 0, 0, 0, time.UTC),
|
|
Summary: api.ApiStatsSummary{}, // all zero
|
|
ByQueryType: map[string]int{},
|
|
ByResponseCode: map[string]int{},
|
|
ByResponseType: map[string]int{},
|
|
TopDomains: []api.ApiNameCount{},
|
|
Lists: api.ApiListCounts{Denylist: map[string]int{}, Allowlist: map[string]int{}},
|
|
Cache: api.ApiCacheStats{Entries: 0},
|
|
}
|
|
var buf bytes.Buffer
|
|
|
|
renderStats(&buf, &s)
|
|
out := buf.String()
|
|
|
|
Expect(out).Should(ContainSubstring("Top Domains: (none)"))
|
|
Expect(out).Should(ContainSubstring("By Query Type: (none)"))
|
|
Expect(out).Should(ContainSubstring("Lists: (none)"))
|
|
Expect(out).Should(ContainSubstring("0.0%")) // no panic, graceful percentage
|
|
})
|
|
|
|
It("formats integers with thousands separators", func() {
|
|
Expect(formatInt(0)).Should(Equal("0"))
|
|
Expect(formatInt(999)).Should(Equal("999"))
|
|
Expect(formatInt(12431)).Should(Equal("12,431"))
|
|
Expect(formatInt(1000000)).Should(Equal("1,000,000"))
|
|
Expect(formatInt(-12431)).Should(Equal("-12,431"))
|
|
})
|
|
|
|
It("formats percentages and guards against zero totals", func() {
|
|
Expect(formatPercent(41, 100)).Should(Equal("41.0%"))
|
|
Expect(formatPercent(0, 0)).Should(Equal("0.0%"))
|
|
})
|
|
})
|
|
|
|
var _ = Describe("stats command", func() {
|
|
var (
|
|
ts *httptest.Server
|
|
mockFn func(w http.ResponseWriter, _ *http.Request)
|
|
)
|
|
|
|
JustBeforeEach(func() {
|
|
ts = testHTTPAPIServer(mockFn)
|
|
})
|
|
JustAfterEach(func() {
|
|
ts.Close()
|
|
})
|
|
BeforeEach(func() {
|
|
mockFn = func(w http.ResponseWriter, _ *http.Request) {}
|
|
})
|
|
|
|
When("stats are available", func() {
|
|
BeforeEach(func() {
|
|
mockFn = func(w http.ResponseWriter, _ *http.Request) {
|
|
w.Header().Add("Content-Type", "application/json")
|
|
s := sampleStats()
|
|
response, err := json.Marshal(s)
|
|
Expect(err).Should(Succeed())
|
|
_, err = w.Write(response)
|
|
Expect(err).Should(Succeed())
|
|
}
|
|
})
|
|
It("renders the dashboard to the command output", func() {
|
|
cmd := withContext(NewStatsCommand())
|
|
var buf bytes.Buffer
|
|
cmd.SetOut(&buf)
|
|
|
|
Expect(stats(cmd, []string{})).Should(Succeed())
|
|
Expect(buf.String()).Should(ContainSubstring("Queries"))
|
|
Expect(buf.String()).Should(ContainSubstring("github.com"))
|
|
Expect(buf.String()).Should(ContainSubstring("Cache:"))
|
|
})
|
|
})
|
|
|
|
When("statistics are disabled (503)", func() {
|
|
BeforeEach(func() {
|
|
mockFn = func(w http.ResponseWriter, _ *http.Request) {
|
|
w.WriteHeader(http.StatusServiceUnavailable)
|
|
_, _ = w.Write([]byte("statistics are disabled"))
|
|
}
|
|
})
|
|
It("returns a friendly error", func() {
|
|
err := stats(withContext(NewStatsCommand()), []string{})
|
|
Expect(err).Should(HaveOccurred())
|
|
Expect(err.Error()).Should(ContainSubstring("disabled"))
|
|
})
|
|
})
|
|
|
|
When("server returns 500", func() {
|
|
BeforeEach(func() {
|
|
mockFn = func(w http.ResponseWriter, _ *http.Request) {
|
|
w.WriteHeader(http.StatusInternalServerError)
|
|
}
|
|
})
|
|
It("returns an error", func() {
|
|
err := stats(withContext(NewStatsCommand()), []string{})
|
|
Expect(err).Should(HaveOccurred())
|
|
Expect(err.Error()).Should(ContainSubstring("500 Internal Server Error"))
|
|
})
|
|
})
|
|
|
|
When("the API URL is unreachable", func() {
|
|
It("returns a transport error", func() {
|
|
apiPort = 0
|
|
err := stats(withContext(NewStatsCommand()), []string{})
|
|
Expect(err).Should(HaveOccurred())
|
|
Expect(err.Error()).Should(ContainSubstring("connection refused"))
|
|
})
|
|
})
|
|
})
|