name exceptions so we can ignore most of them

Now that we've had this in prod a while I've collected a few transient DNS
issues. Because webmentions are a nice-to-have, we can just drop the mention
if someone's DNS is flaking on us. We let BadIPsError hit logs because it
might be someone attempting to use this to enumerate our internal network
(tho it's most likely misconfiguration).
This commit is contained in:
Peter Bhat Harkins 2018-11-20 08:18:10 -06:00
parent 087df3bb6b
commit 0724c706fc
2 changed files with 17 additions and 8 deletions

View File

@ -3,6 +3,10 @@ require "net/https"
require "resolv"
require "ipaddr"
class BadIPsError < StandardError; end
class DNSError < StandardError; end
class NoIPsError < StandardError; end
module Net
class HTTP
attr_accessor :address, :custom_conn_address, :skip_close
@ -111,7 +115,7 @@ class Sponge
ips = Resolv.getaddresses(uri.host)
if !ips.any?
raise
raise NoIPsError
end
# reject ipv6 addresses
@ -123,21 +127,21 @@ class Sponge
end
rescue Timeout::Error => e
if retried
raise "couldn't resolve #{uri.host} (DNS timeout)"
raise DNSError.new("couldn't resolve #{uri.host} (DNS timeout)")
else
retried = true
retry
end
rescue => e
raise "couldn't resolve #{uri.host} (#{e.inspect})"
raise DNSError.new("couldn't resolve #{uri.host} (#{e.inspect})")
end
if !ip
raise "couldn't resolve #{uri.host}"
raise DNSError.new("couldn't resolve #{uri.host}")
end
if BAD_NETS.select {|n| IPAddr.new(n).include?(ip) }.any?
raise "refusing to talk to IP #{ip}"
raise BadIPsError.new("refusing to talk to IP #{ip}")
end
host = Net::HTTP.new(ip.to_s, uri.port)

View File

@ -78,9 +78,14 @@ if __FILE__ == $PROGRAM_NAME
sp = Sponge.new
sp.timeout = 10
response = sp.fetch(WEBrick::HTTPUtils.escape(s.url), :get, nil, nil, {
"User-agent" => "#{Rails.application.domain} webmention endpoint lookup",
}, 3)
begin
response = sp.fetch(WEBrick::HTTPUtils.escape(s.url), :get, nil, nil, {
"User-agent" => "#{Rails.application.domain} webmention endpoint lookup",
}, 3)
rescue NoIPsError, DNSError
# other people's DNS issues (usually transient); just skip the webmention
next
end
next unless response
wm_endpoint_raw = endpoint_from_headers(response['link']) ||