novox/mesh-catalog
18
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

netcheck: ask one named resolver, and list what listens here (hq issue 348)

Browse Source 
During the 2026-10-09 outage the control node's resolver stayed active while it no longer listened on
its private address, and nothing on the mesh could ask that address a question or show which sockets
were bound. netcheck_dns takes server (and tcp) to ask one resolver alone and say its response code;
netcheck_listening reads the kernel's socket tables, as ss -lunt does, with the owning program where
the tool's account may see it and a sentence where it may not.
This commit is contained in:
jochen
2026-10-09 15:04:45 +02:00
parent 3d8b52c9f4
commit 0f6986aead
7 changed files with 712 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/netcheck/cmd/netcheck/main.go
+33 -3
View File
@@ -1,12 +1,14 @@
// netcheck's Go tools bundle (novox/hq ADR 0188, ADR 0193): a process the node's runtime launches
// and speaks MCP over stdio to, through the Go SDK. It serves the two checks that are the machine's
// own sockets and resolver — a TCP connect and a DNS lookup — and nothing that changes anything.
// own sockets and resolver — a TCP connect, a DNS lookup (of the machine's resolver, or of one named),
// and what listens here — and nothing that changes anything.
// The module's HTTP check is its TypeScript bundle; the runtime serves both under one module.
package main
import (
"fmt"
"os"
"strings"
stdio "git.novox.be/novox/mesh-sdk/go"
)
@@ -21,6 +23,29 @@ func main() {
func tools() []stdio.Tool {
return []stdio.Tool{
{
Name: "netcheck_listening",
Description: "What listens on this machine: every TCP socket in the listen state and every bound UDP socket, " +
"from the kernel's own tables (what ss -lunt reads), with the program holding it where this tool may see it. " +
"port narrows it to one port, e.g. 53 to see on which addresses the resolver answers.",
Input: map[string]any{
"port": map[string]any{"type": "integer", "description": "only this port (default every port)"},
},
Run: func(args map[string]any) (any, error) {
port := 0
if _, given := args["port"]; given {
p, err := whole(args, "port", 0)
if err != nil {
return nil, err
}
if p < 1 || p > 65535 {
return nil, fmt.Errorf("port %d is not a port (1-65535)", p)
}
port = p
}
return Listening("/proc", port), nil
},
},
{
Name: "netcheck_tcp",
Description: "Check whether a TCP port is reachable from this machine: opens one connection " +
@@ -48,11 +73,14 @@ func tools() []stdio.Tool {
},
{
Name: "netcheck_dns",
Description: "Look a name up with this machine's resolver (its /etc/resolv.conf and /etc/hosts). " +
Description: "Look a name up with this machine's resolver (its /etc/resolv.conf and /etc/hosts), or — with server — ask " +
"that one resolver alone over UDP (or TCP), answering its response code (NOERROR, NXDOMAIN, REFUSED…). " +
"type is A, AAAA, CNAME, TXT or MX; answers the records found, or the error.",
Input: map[string]any{
"name": map[string]any{"type": "string", "description": "the name to look up"},
"type": map[string]any{"type": "string", "enum": []string{"A", "AAAA", "CNAME", "TXT", "MX"}, "description": "record type (default A)"},
"server": map[string]any{"type": "string", "description": "ask this resolver alone: an address, with :port or without (53), e.g. 10.10.0.1"},
"tcp": map[string]any{"type": "boolean", "description": "ask the server over TCP rather than UDP (default false)"},
"timeout_ms": map[string]any{"type": "integer", "description": "give up after this long (default 3000, at most 30000)"},
},
Run: func(args map[string]any) (any, error) {
@@ -65,7 +93,9 @@ func tools() []stdio.Tool {
if err != nil {
return nil, err
}
return CheckDNS(name, kind, timeout)
server, _ := args["server"].(string)
overTCP, _ := args["tcp"].(bool)
return AskDNS(name, kind, strings.TrimSpace(server), overTCP, timeout)
},
},
}