|
| 1 | +// Copyright 2026 Google LLC |
| 2 | +// |
| 3 | +// Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | +// you may not use this file except in compliance with the License. |
| 5 | +// You may obtain a copy of the License at |
| 6 | +// |
| 7 | +// https://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +// |
| 9 | +// Unless required by applicable law or agreed to in writing, software |
| 10 | +// distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | +// See the License for the specific language governing permissions and |
| 13 | +// limitations under the License. |
| 14 | + |
| 15 | +package echtest |
| 16 | + |
| 17 | +import ( |
| 18 | + "bytes" |
| 19 | + "fmt" |
| 20 | + "os" |
| 21 | + "os/exec" |
| 22 | + "path/filepath" |
| 23 | + "strconv" |
| 24 | + "strings" |
| 25 | + "time" |
| 26 | +) |
| 27 | + |
| 28 | +type TestResult struct { |
| 29 | + Domain string |
| 30 | + ECHGrease bool |
| 31 | + Error string |
| 32 | + CurlExitCode int |
| 33 | + CurlErrorName string |
| 34 | + DNSLookup time.Duration |
| 35 | + TCPConnection time.Duration |
| 36 | + TLSHandshake time.Duration |
| 37 | + ServerTime time.Duration |
| 38 | + TotalTime time.Duration |
| 39 | + HTTPStatus int |
| 40 | + Stderr string |
| 41 | +} |
| 42 | + |
| 43 | +// curlExitCodeNames maps curl exit codes to their CURL_* string representations. |
| 44 | +var curlExitCodeNames = map[int]string{ |
| 45 | + 1: "CURLE_UNSUPPORTED_PROTOCOL", |
| 46 | + 2: "CURLE_FAILED_INIT", |
| 47 | + 3: "CURLE_URL_MALFORMAT", |
| 48 | + 4: "CURLE_NOT_BUILT_IN", |
| 49 | + 5: "CURLE_COULDNT_RESOLVE_PROXY", |
| 50 | + 6: "CURLE_COULDNT_RESOLVE_HOST", |
| 51 | + 7: "CURLE_COULDNT_CONNECT", |
| 52 | + 8: "CURLE_WEIRD_SERVER_REPLY", |
| 53 | + 9: "CURLE_REMOTE_ACCESS_DENIED", |
| 54 | + 11: "CURLE_FTP_WEIRD_PASV_REPLY", |
| 55 | + 13: "CURLE_FTP_WEIRD_227_FORMAT", |
| 56 | + 14: "CURLE_FTP_CANT_GET_HOST", |
| 57 | + 15: "CURLE_FTP_CANT_RECONNECT", |
| 58 | + 17: "CURLE_FTP_COULDNT_SET_TYPE", |
| 59 | + 18: "CURLE_PARTIAL_FILE", |
| 60 | + 19: "CURLE_FTP_COULDNT_RETR_FILE", |
| 61 | + 21: "CURLE_QUOTE_ERROR", |
| 62 | + 22: "CURLE_HTTP_RETURNED_ERROR", |
| 63 | + 23: "CURLE_WRITE_ERROR", |
| 64 | + 25: "CURLE_UPLOAD_FAILED", |
| 65 | + 26: "CURLE_READ_ERROR", |
| 66 | + 27: "CURLE_OUT_OF_MEMORY", |
| 67 | + 28: "CURLE_OPERATION_TIMEDOUT", |
| 68 | + 30: "CURLE_FTP_PORT_FAILED", |
| 69 | + 31: "CURLE_FTP_COULDNT_USE_REST", |
| 70 | + 33: "CURLE_RANGE_ERROR", |
| 71 | + 34: "CURLE_HTTP_POST_ERROR", |
| 72 | + 35: "CURLE_SSL_CONNECT_ERROR", |
| 73 | + 36: "CURLE_BAD_DOWNLOAD_RESUME", |
| 74 | + 37: "CURLE_FILE_COULDNT_READ_FILE", |
| 75 | + 38: "CURLE_LDAP_CANNOT_BIND", |
| 76 | + 39: "CURLE_LDAP_SEARCH_FAILED", |
| 77 | + 41: "CURLE_FUNCTION_NOT_FOUND", |
| 78 | + 42: "CURLE_ABORTED_BY_CALLBACK", |
| 79 | + 43: "CURLE_BAD_FUNCTION_ARGUMENT", |
| 80 | + 45: "CURLE_INTERFACE_FAILED", |
| 81 | + 47: "CURLE_TOO_MANY_REDIRECTS", |
| 82 | + 48: "CURLE_UNKNOWN_OPTION", |
| 83 | + 49: "CURLE_TELNET_OPTION_SYNTAX", |
| 84 | + 51: "CURLE_PEER_FAILED_VERIFICATION", |
| 85 | + 52: "CURLE_GOT_NOTHING", |
| 86 | + 53: "CURLE_SSL_ENGINE_NOTFOUND", |
| 87 | + 54: "CURLE_SSL_ENGINE_SETFAILED", |
| 88 | + 55: "CURLE_SEND_ERROR", |
| 89 | + 56: "CURLE_RECV_ERROR", |
| 90 | + 58: "CURLE_SSL_CERTPROBLEM", |
| 91 | + 59: "CURLE_SSL_CIPHER", |
| 92 | + 60: "CURLE_SSL_CACERT", |
| 93 | + 61: "CURLE_BAD_CONTENT_ENCODING", |
| 94 | + 62: "CURLE_LDAP_INVALID_URL", |
| 95 | + 63: "CURLE_FILESIZE_EXCEEDED", |
| 96 | + 64: "CURLE_USE_SSL_FAILED", |
| 97 | + 65: "CURLE_SEND_FAIL_REWIND", |
| 98 | + 66: "CURLE_SSL_ENGINE_INITFAILED", |
| 99 | + 67: "CURLE_LOGIN_DENIED", |
| 100 | + 68: "CURLE_TFTP_NOTFOUND", |
| 101 | + 69: "CURLE_TFTP_PERM", |
| 102 | + 70: "CURLE_REMOTE_DISK_FULL", |
| 103 | + 71: "CURLE_TFTP_ILLEGAL", |
| 104 | + 72: "CURLE_TFTP_UNKNOWNID", |
| 105 | + 73: "CURLE_REMOTE_FILE_EXISTS", |
| 106 | + 74: "CURLE_TFTP_NOSUCHUSER", |
| 107 | + 75: "CURLE_CONV_FAILED", |
| 108 | + 76: "CURLE_CONV_REQD", |
| 109 | + 77: "CURLE_SSL_CACERT_BADFILE", |
| 110 | + 78: "CURLE_REMOTE_FILE_NOT_FOUND", |
| 111 | + 79: "CURLE_SSH", |
| 112 | + 80: "CURLE_SSL_SHUTDOWN_FAILED", |
| 113 | + 81: "CURLE_AGAIN", |
| 114 | + 82: "CURLE_SSL_CRL_BADFILE", |
| 115 | + 83: "CURLE_SSL_ISSUER_ERROR", |
| 116 | + 84: "CURLE_FTP_PRET_FAILED", |
| 117 | + 85: "CURLE_RTSP_CSEQ_ERROR", |
| 118 | + 86: "CURLE_RTSP_SESSION_ERROR", |
| 119 | + 87: "CURLE_FTP_BAD_FILE_LIST", |
| 120 | + 88: "CURLE_CHUNK_FAILED", |
| 121 | + 89: "CURLE_NO_CONNECTION_AVAILABLE", |
| 122 | + 90: "CURLE_SSL_PINNEDPUBKEYNOTMATCH", |
| 123 | + 91: "CURLE_SSL_INVALIDCERTSTATUS", |
| 124 | + 92: "CURLE_HTTP2_STREAM", |
| 125 | + 93: "CURLE_RECURSIVE_API_CALL", |
| 126 | + 94: "CURLE_AUTH_ERROR", |
| 127 | + 95: "CURLE_HTTP3", |
| 128 | + 96: "CURLE_QUIC_CONNECT_ERROR", |
| 129 | +} |
| 130 | + |
| 131 | +// Run executes a curl command against the specified domain. |
| 132 | +func Run( |
| 133 | + curlPath string, |
| 134 | + domain string, |
| 135 | + echGrease bool, |
| 136 | + maxTime time.Duration, |
| 137 | + proxyURL string, |
| 138 | + proxyHeaders []string, |
| 139 | +) TestResult { |
| 140 | + result := TestResult{ |
| 141 | + Domain: domain, |
| 142 | + ECHGrease: echGrease, |
| 143 | + } |
| 144 | + |
| 145 | + targetURL := "https://" + domain |
| 146 | + |
| 147 | + args := []string{ |
| 148 | + "-w", |
| 149 | + "dnslookup:%{time_namelookup},tcpconnect:%{time_connect},tlsconnect:%{time_appconnect},servertime:%{time_starttransfer},total:%{time_total},httpstatus:%{http_code}", |
| 150 | + "--head", |
| 151 | + "--max-time", |
| 152 | + strconv.FormatFloat(maxTime.Seconds(), 'f', -1, 64), |
| 153 | + } |
| 154 | + |
| 155 | + // Handle proxy options |
| 156 | + if proxyURL != "" { |
| 157 | + args = append(args, "--proxy", proxyURL) |
| 158 | + for _, h := range proxyHeaders { |
| 159 | + args = append(args, "--proxy-header", h) |
| 160 | + } |
| 161 | + // If using a proxy with headers, we usually need verbose mode to see the proxy response. |
| 162 | + // If proxy headers are provided, we assume the caller wants to read them from stderr. |
| 163 | + if len(proxyHeaders) > 0 { |
| 164 | + args = append(args, "-v") |
| 165 | + } else { |
| 166 | + args = append(args, "-s") |
| 167 | + } |
| 168 | + } else { |
| 169 | + args = append(args, "-s") |
| 170 | + } |
| 171 | + |
| 172 | + if echGrease { |
| 173 | + args = append(args, "--ech", "grease") |
| 174 | + } else { |
| 175 | + args = append(args, "--ech", "false") |
| 176 | + } |
| 177 | + args = append(args, targetURL) |
| 178 | + |
| 179 | + cmd := exec.Command(curlPath, args...) |
| 180 | + |
| 181 | + // Setup environment for custom curl (matching internal/curl/runner.go) |
| 182 | + binDir := filepath.Dir(curlPath) |
| 183 | + libDir := filepath.Join(filepath.Dir(binDir), "lib") |
| 184 | + if libStat, err := os.Stat(libDir); err == nil && libStat.IsDir() { |
| 185 | + cmd.Env = append(os.Environ(), "LD_LIBRARY_PATH="+libDir) |
| 186 | + } |
| 187 | + |
| 188 | + var stdout bytes.Buffer |
| 189 | + var stderr bytes.Buffer |
| 190 | + cmd.Stdout = &stdout |
| 191 | + cmd.Stderr = &stderr |
| 192 | + |
| 193 | + err := cmd.Run() |
| 194 | + result.Stderr = stderr.String() // Always capture stderr for caller |
| 195 | + |
| 196 | + if err != nil { |
| 197 | + if exitError, ok := err.(*exec.ExitError); ok { |
| 198 | + result.CurlExitCode = exitError.ExitCode() |
| 199 | + result.CurlErrorName = curlExitCodeNames[result.CurlExitCode] |
| 200 | + } else { |
| 201 | + result.Error = fmt.Sprintf("failed to execute curl: %v", err) |
| 202 | + return result |
| 203 | + } |
| 204 | + } else { |
| 205 | + // Even if err is nil, there might be curl-level errors recorded in stderr |
| 206 | + // that the caller might be interested in, though standard execution succeeded. |
| 207 | + } |
| 208 | + |
| 209 | + // parse the stdout stats |
| 210 | + parts := strings.SplitSeq(stdout.String(), ",") |
| 211 | + for part := range parts { |
| 212 | + kv := strings.Split(part, ":") |
| 213 | + if len(kv) != 2 { |
| 214 | + continue |
| 215 | + } |
| 216 | + key := kv[0] |
| 217 | + value := kv[1] |
| 218 | + |
| 219 | + switch key { |
| 220 | + case "dnslookup": |
| 221 | + f, _ := strconv.ParseFloat(value, 64) |
| 222 | + result.DNSLookup = time.Duration(f * float64(time.Second)) |
| 223 | + case "tcpconnect": |
| 224 | + f, _ := strconv.ParseFloat(value, 64) |
| 225 | + result.TCPConnection = time.Duration(f * float64(time.Second)) |
| 226 | + case "tlsconnect": |
| 227 | + f, _ := strconv.ParseFloat(value, 64) |
| 228 | + result.TLSHandshake = time.Duration(f * float64(time.Second)) |
| 229 | + case "servertime": |
| 230 | + f, _ := strconv.ParseFloat(value, 64) |
| 231 | + result.ServerTime = time.Duration(f * float64(time.Second)) |
| 232 | + case "total": |
| 233 | + f, _ := strconv.ParseFloat(value, 64) |
| 234 | + result.TotalTime = time.Duration(f * float64(time.Second)) |
| 235 | + case "httpstatus": |
| 236 | + i, _ := strconv.Atoi(value) |
| 237 | + result.HTTPStatus = i |
| 238 | + } |
| 239 | + } |
| 240 | + |
| 241 | + return result |
| 242 | +} |
0 commit comments