Class: GitHubPages::HealthCheck::Domain

Inherits:
Checkable
  • Object
show all
Defined in:
lib/github-pages-health-check/domain.rb

Constant Summary collapse

LEGACY_IP_ADDRESSES = 
[
  # Legacy GitHub Datacenter
  "207.97.227.245",
  "204.232.175.78",

  # Aug. 2016 Fastly datacenter deprecation
  "199.27.73.133",
  "199.27.76.133",

  # Feb. 2017 Fastly datacenter deprecation
  "103.245.222.133",
  "103.245.223.133",
  "103.245.224.133",
  "104.156.81.133",
  "104.156.82.133",
  "104.156.83.133",
  "104.156.85.133",
  "104.156.87.133",
  "104.156.88.133",
  "104.156.89.133",
  "104.156.90.133",
  "104.156.91.133",
  "104.156.92.133",
  "104.156.93.133",
  "104.156.94.133",
  "104.156.95.133",
  "104.37.95.133",
  "157.52.64.133",
  "157.52.66.133",
  "157.52.67.133",
  "157.52.68.133",
  "157.52.69.133",
  "157.52.96.133",
  "172.111.64.133",
  "172.111.96.133",
  "185.31.16.133",
  "185.31.17.133",
  "185.31.18.133",
  "185.31.19.133",
  "199.27.74.133",
  "199.27.75.133",
  "199.27.76.133",
  "199.27.78.133",
  "199.27.79.133",
  "23.235.33.133",
  "23.235.37.133",
  "23.235.39.133",
  "23.235.40.133",
  "23.235.41.133",
  "23.235.43.133",
  "23.235.44.133",
  "23.235.45.133",
  "23.235.46.133",
  "23.235.47.133",
  "23.235.47.133",
  "43.249.72.133",
  "43.249.73.133",
  "43.249.74.133",
  "43.249.75.133",

  # 2018 Move to GitHub assigned IP space
  "192.30.252.153",
  "192.30.252.154"
].freeze
CURRENT_IP_ADDRESSES = 
%w(
  185.199.108.153
  185.199.109.153
  185.199.110.153
  185.199.111.153
).freeze
CURRENT_IPV6_ADDRESSES = 
%w(
  2606:50c0:8000::153
  2606:50c0:8001::153
  2606:50c0:8002::153
  2606:50c0:8003::153
).freeze
CURRENT_IP_ADDRESSES_ALL = 
(CURRENT_IP_ADDRESSES + CURRENT_IPV6_ADDRESSES).freeze
HASH_METHODS = 
%i[
  host uri nameservers dns_resolves? proxied? cloudflare_ip?
  fastly_ip? old_ip_address? a_record? aaaa_record? a_record_present? aaaa_record_present?
  cname_record? mx_records_present? valid_domain? apex_domain?
  should_be_a_record? cname_to_github_user_domain? cname_to_domain_to_pages?
  cname_to_pages_dot_github_dot_com? cname_to_fastly?
  pointed_to_github_pages_ip? non_github_pages_ip_present? pages_domain?
  served_by_pages? valid? reason valid_domain? https?
  enforces_https? https_error https_eligible? caa_error dns_zone_soa? dns_zone_ns?
].freeze
REQUESTED_RECORD_TYPES = 
[
  Dnsruby::Types::A,
  Dnsruby::Types::AAAA,
  Dnsruby::Types::CNAME,
  Dnsruby::Types::MX,
  Dnsruby::Types::NS,
  Dnsruby::Types::SOA
].freeze

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Methods inherited from Checkable

#reason, #to_hash, #to_json, #to_s, #to_s_pretty, #valid?

Constructor Details

#initialize(host, nameservers: :default) ⇒ Domain

Returns a new instance of Domain.



107
108
109
110
111
112
113
114
115
116
 
# File 'lib/github-pages-health-check/domain.rb', line 107

def initialize(host, nameservers: :default)
  unless host.is_a? String
    raise ArgumentError, "Expected string, got #{host.class}"
  end

  @host = normalize_host(host)
  @nameservers = nameservers
  @resolver = GitHubPages::HealthCheck::Resolver.new(self.host,
                                                     :nameservers => nameservers)
end

Instance Attribute Details

#host ⇒ Object (readonly)

Returns the value of attribute host.



8
9
10
 
# File 'lib/github-pages-health-check/domain.rb', line 8

def host
  @host
end

#nameservers ⇒ Object (readonly)

Returns the value of attribute nameservers.



8
9
10
 
# File 'lib/github-pages-health-check/domain.rb', line 8

def nameservers
  @nameservers
end

#resolver ⇒ Object (readonly)

Returns the value of attribute resolver.



8
9
10
 
# File 'lib/github-pages-health-check/domain.rb', line 8

def resolver
  @resolver
end

Class Method Details

.redundant(host) ⇒ Object 



103
104
105
 
# File 'lib/github-pages-health-check/domain.rb', line 103

def self.redundant(host)
  GitHubPages::HealthCheck::RedundantCheck.new(host).check
end

Instance Method Details

#a_record? ⇒ Boolean

Is this domain’s first response an A record?

Returns:

  • (Boolean) 


373
374
375
376
377
378
 
# File 'lib/github-pages-health-check/domain.rb', line 373

def a_record?
  return @is_a_record if defined?(@is_a_record)
  return unless dns?

  @is_a_record = Dnsruby::Types::A == dns.first.type
end

#a_record_present? ⇒ Boolean

Does this domain has an A record setup (not necessarily as the first record)?

Returns:

  • (Boolean) 


389
390
391
392
393
 
# File 'lib/github-pages-health-check/domain.rb', line 389

def a_record_present?
  return unless dns?

  dns.any? { |answer| answer.type == Dnsruby::Types::A && answer.name.to_s == host }
end

#aaaa_record? ⇒ Boolean

Is this domain’s first response an AAAA record?

Returns:

  • (Boolean) 


381
382
383
384
385
386
 
# File 'lib/github-pages-health-check/domain.rb', line 381

def aaaa_record?
  return @is_aaaa_record if defined?(@is_aaaa_record)
  return unless dns?

  @is_aaaa_record = Dnsruby::Types::AAAA == dns.first.type
end

#aaaa_record_present? ⇒ Boolean

Does this domain has an AAAA record setup (not necessarily as the first record)?

Returns:

  • (Boolean) 


396
397
398
399
400
 
# File 'lib/github-pages-health-check/domain.rb', line 396

def aaaa_record_present?
  return unless dns?

  dns.any? { |answer| answer.type == Dnsruby::Types::AAAA && answer.name.to_s == host }
end

#apex_domain? ⇒ Boolean

Is this domain an apex domain, meaning a CNAME would be inappropriate

Returns:

  • (Boolean) 


176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
 
# File 'lib/github-pages-health-check/domain.rb', line 176

def apex_domain?
  return @apex_domain if defined?(@apex_domain)

  return false unless valid_domain?

  return true if dns_zone_soa? && dns_zone_ns?

  # PublicSuffix.domain pulls out the apex-level domain name.
  # E.g. PublicSuffix.domain("techblog.netflix.com") # => "netflix.com"
  # It's aware of multi-step top-level domain names:
  # E.g. PublicSuffix.domain("blog.digital.gov.uk") # => "digital.gov.uk"
  # For apex-level domain names, DNS providers do not support CNAME records.
  unicode_host = Addressable::IDNA.to_unicode(host)
  PublicSuffix.domain(unicode_host,
                      :default_rule => nil,
                      :ignore_private => true) == unicode_host
end

#caa_error ⇒ Object

Any errors querying CAA records



522
523
524
525
526
 
# File 'lib/github-pages-health-check/domain.rb', line 522

def caa_error
  return nil unless caa&.errored?

  caa.error.class.name
end

#check! ⇒ Object

Runs all checks, raises an error if invalid rubocop:disable Metrics/AbcSize



120
121
122
123
124
125
126
127
128
129
130
131
 
# File 'lib/github-pages-health-check/domain.rb', line 120

def check!
  raise Errors::InvalidDomainError.new :domain => self unless valid_domain?
  raise Errors::InvalidDNSError.new :domain => self    unless dns_resolves?
  raise Errors::DeprecatedIPError.new :domain => self  if deprecated_ip?
  return true if proxied?
  raise Errors::InvalidARecordError.new :domain => self    if invalid_a_record?
  raise Errors::InvalidCNAMEError.new :domain => self      if invalid_cname?
  raise Errors::InvalidAAAARecordError.new :domain => self if invalid_aaaa_record?
  raise Errors::NotServedByPagesError.new :domain => self  unless served_by_pages?

  true
end

#cloudflare_ip? ⇒ Boolean

Does the domain resolve to a CloudFlare-owned IP

Returns:

  • (Boolean) 


301
302
303
 
# File 'lib/github-pages-health-check/domain.rb', line 301

def cloudflare_ip?
  cdn_ip?(CloudFlare)
end

#cname ⇒ Object

The domain to which this domain’s CNAME resolves Returns nil if the domain is not a CNAME



413
414
415
416
417
418
419
420
421
 
# File 'lib/github-pages-health-check/domain.rb', line 413

def cname
  return unless dns?

  cnames = dns.take_while { |answer| answer.type == Dnsruby::Types::CNAME }
  return if cnames.empty?

  www_cname(cnames.last)
  @cname ||= Domain.new(cnames.last.cname.to_s)
end

#cname_record? ⇒ Boolean Also known as: cname?

Is this domain’s first response a CNAME record?

Returns:

  • (Boolean) 


403
404
405
406
407
408
 
# File 'lib/github-pages-health-check/domain.rb', line 403

def cname_record?
  return unless dns?
  return false unless cname

  cname.valid_domain?
end

#cname_to_domain_to_pages? ⇒ Boolean

Check if the CNAME points to a Domain that points to pages e.g. CNAME -> Domain -> Pages rubocop:disable Metrics/AbcSize

Returns:

  • (Boolean) 


251
252
253
254
255
256
257
258
259
 
# File 'lib/github-pages-health-check/domain.rb', line 251

def cname_to_domain_to_pages?
  return false unless dns?

  a_record_to_pages = dns.select { |d| d.type == Dnsruby::Types::A && d.name.to_s == host }.first

  return false unless a_record_to_pages && cname? && !cname_to_pages_dot_github_dot_com? && @www_cname

  CURRENT_IP_ADDRESSES.include?(a_record_to_pages.address.to_s.downcase)
end

#cname_to_fastly? ⇒ Boolean

Is the given domain CNAME’d directly to our Fastly account?

Returns:

  • (Boolean) 


271
272
273
 
# File 'lib/github-pages-health-check/domain.rb', line 271

def cname_to_fastly?
  cname? && !pages_domain? && cname.fastly?
end

#cname_to_github_user_domain? ⇒ Boolean

Is the domain’s first response a CNAME to a pages domain?

Returns:

  • (Boolean) 


244
245
246
 
# File 'lib/github-pages-health-check/domain.rb', line 244

def cname_to_github_user_domain?
  cname? && !cname_to_pages_dot_github_dot_com? && cname.pages_domain?
end

#cname_to_pages_dot_github_dot_com? ⇒ Boolean

Is the given domain a CNAME to pages.github.(io|com) instead of being CNAME’d to the user’s subdomain?

domain - the domain to check, generally the target of a cname

Returns:

  • (Boolean) 


266
267
268
 
# File 'lib/github-pages-health-check/domain.rb', line 266

def cname_to_pages_dot_github_dot_com?
  cname? && cname.pages_dot_github_dot_com?
end

#deprecated_ip? ⇒ Boolean

rubocop:enable Metrics/AbcSize

Returns:

  • (Boolean) 


134
135
136
137
138
 
# File 'lib/github-pages-health-check/domain.rb', line 134

def deprecated_ip?
  return @deprecated_ip if defined? @deprecated_ip

  @deprecated_ip = (valid_domain? && a_record? && old_ip_address?)
end

#dns ⇒ Object

Returns an array of DNS answers



340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
 
# File 'lib/github-pages-health-check/domain.rb', line 340

def dns
  return @dns if defined? @dns
  return unless valid_domain?

  @dns = Timeout.timeout(TIMEOUT) do
    GitHubPages::HealthCheck.without_warnings do
      next if host.nil?

      REQUESTED_RECORD_TYPES
        .map { |type| resolver.query(type) }
        .flatten.uniq
    end
  end
rescue StandardError
  @dns = nil
end

#dns? ⇒ Boolean Also known as: dns_resolves?

Are we even able to get the DNS record?

Returns:

  • (Boolean) 


358
359
360
 
# File 'lib/github-pages-health-check/domain.rb', line 358

def dns?
  !(dns.nil? || dns.empty?)
end

#dns_zone_ns? ⇒ Boolean

Does the domain have associated NS records?

Returns:

  • (Boolean) 


209
210
211
212
213
214
215
216
 
# File 'lib/github-pages-health-check/domain.rb', line 209

def dns_zone_ns?
  return @ns_records if defined?(@ns_records)
  return false unless dns?

  @ns_records = dns.any? do |answer|
    answer.type == Dnsruby::Types::NS && answer.name.to_s == host
  end
end

#dns_zone_soa? ⇒ Boolean

Does the domain have an associated SOA record?

Returns:

  • (Boolean) 


197
198
199
200
201
202
203
204
 
# File 'lib/github-pages-health-check/domain.rb', line 197

def dns_zone_soa?
  return @soa_records if defined?(@soa_records)
  return false unless dns?

  @soa_records = dns.any? do |answer|
    answer.type == Dnsruby::Types::SOA && answer.name.to_s == host
  end
end

#enforces_https? ⇒ Boolean

Does this domain redirect HTTP requests to HTTPS?

Returns:

  • (Boolean) 


499
500
501
502
503
504
 
# File 'lib/github-pages-health-check/domain.rb', line 499

def enforces_https?
  return false unless https? && http_response.headers["Location"]

  redirect = Addressable::URI.parse(http_response.headers["Location"])
  redirect.scheme == "https" && redirect.host == host
end

#fastly? ⇒ Boolean

Is the host our Fastly CNAME?

Returns:

  • (Boolean) 


296
297
298
 
# File 'lib/github-pages-health-check/domain.rb', line 296

def fastly?
  !!host.match(/\A#{Regexp.union(Fastly::HOSTNAMES)}\z/i)
end

#fastly_ip? ⇒ Boolean

Does the domain resolve to a Fastly-owned IP

Returns:

  • (Boolean) 


306
307
308
 
# File 'lib/github-pages-health-check/domain.rb', line 306

def fastly_ip?
  cdn_ip?(Fastly)
end

#github_domain? ⇒ Boolean

Is this domain owned by GitHub?

Returns:

  • (Boolean) 


291
292
293
 
# File 'lib/github-pages-health-check/domain.rb', line 291

def github_domain?
  host.downcase.eql?("github.com") || host.downcase.end_with?(".github.com")
end

#https? ⇒ Boolean

Does this domain respond to HTTPS requests with a valid cert?

Returns:

  • (Boolean) 


488
489
490
 
# File 'lib/github-pages-health-check/domain.rb', line 488

def https?
  https_response.return_code == :ok
end

#https_eligible? ⇒ Boolean

Can an HTTPS certificate be issued for this domain?

Returns:

  • (Boolean) 


507
508
509
510
511
512
513
514
515
516
517
518
519
 
# File 'lib/github-pages-health-check/domain.rb', line 507

def https_eligible?
  # Can't have any IP's which aren't GitHub's present.
  return false if non_github_pages_ip_present?

  # Can't have underscores in the domain name (Let's Encrypt does not allow it)
  return false if host.include?("_")

  # Must be a CNAME or point to our IPs.
  return true if cname_to_github_user_domain? || cname_to_domain_to_pages?

  # Check CAA records for the full domain and its parent domain.
  pointed_to_github_pages_ip? && caa.lets_encrypt_allowed?
end

#https_error ⇒ Object

The response code of the HTTPS request, if it failed. Useful for diagnosing cert errors



494
495
496
 
# File 'lib/github-pages-health-check/domain.rb', line 494

def https_error
  https_response.return_code unless https?
end

#invalid_a_record? ⇒ Boolean

Returns:

  • (Boolean) 


146
147
148
149
150
 
# File 'lib/github-pages-health-check/domain.rb', line 146

def invalid_a_record?
  return @invalid_a_record if defined? @invalid_a_record

  @invalid_a_record = (valid_domain? && a_record_present? && !should_be_a_record?)
end

#invalid_aaaa_record? ⇒ Boolean

Returns:

  • (Boolean) 


140
141
142
143
144
 
# File 'lib/github-pages-health-check/domain.rb', line 140

def invalid_aaaa_record?
  return @invalid_aaaa_record if defined? @invalid_aaaa_record

  @invalid_aaaa_record = (valid_domain? && aaaa_record_present? && !should_be_a_record?)
end

#invalid_cname? ⇒ Boolean

Returns:

  • (Boolean) 


152
153
154
155
156
157
158
159
160
161
162
 
# File 'lib/github-pages-health-check/domain.rb', line 152

def invalid_cname?
  return @invalid_cname if defined? @invalid_cname

  @invalid_cname = begin
    return false unless valid_domain?
    return false if github_domain? || apex_domain?
    return true  if cname_to_pages_dot_github_dot_com? || cname_to_fastly?

    !cname_to_github_user_domain? && should_be_cname_record?
  end
end

#maybe_wildcard? ⇒ Boolean

Returns:

  • (Boolean) 


459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
 
# File 'lib/github-pages-health-check/domain.rb', line 459

def maybe_wildcard?
  return @maybe_wildcard if defined? @maybe_wildcard
  return false unless dns_resolves?
  return false unless parent_domain

  sibling_domain = SecureRandom.alphanumeric(20) + "." + parent_domain

  @maybe_wildcard = begin
    wildcard_resolver = GitHubPages::HealthCheck::Resolver.new(sibling_domain, :nameservers => nameservers)

    [Dnsruby::Types::A, Dnsruby::Types::AAAA].any? do |record_type|
      wildcard_resolver.query(record_type).any? do |record|
        record.respond_to?(:address) && github_pages_ip?(record.address)
      end
    end
  end
end

#mx_records_present? ⇒ Boolean

Returns:

  • (Boolean) 


429
430
431
432
433
 
# File 'lib/github-pages-health-check/domain.rb', line 429

def mx_records_present?
  return unless dns?

  dns.any? { |answer| answer.type == Dnsruby::Types::MX }
end

#non_github_pages_ip_present? ⇒ Boolean

Are any of the domain’s A or AAAA records pointing elsewhere?

Returns:

  • (Boolean) 


235
236
237
238
239
240
241
 
# File 'lib/github-pages-health-check/domain.rb', line 235

def non_github_pages_ip_present?
  return unless dns?

  dns
    .select { |a| Dnsruby::Types::A == a.type || Dnsruby::Types::AAAA == a.type }
    .any? { |a| !github_pages_ip?(a.address.to_s) }
end

#old_ip_address? ⇒ Boolean

Does this domain have any A record that points to the legacy IPs?

Returns:

  • (Boolean) 


364
365
366
367
368
369
370
 
# File 'lib/github-pages-health-check/domain.rb', line 364

def old_ip_address?
  return unless dns?

  dns.any? do |answer|
    answer.type == Dnsruby::Types::A && legacy_ip?(answer.address.to_s)
  end
end

#pages_domain? ⇒ Boolean

Is the host a *.github.(io|com) domain?

Returns:

  • (Boolean) 


281
282
283
 
# File 'lib/github-pages-health-check/domain.rb', line 281

def pages_domain?
  !!host.match(/\A[\w-]+\.github\.(io|com)\.?\z/i)
end

#pages_dot_github_dot_com? ⇒ Boolean

Is the host pages.github.com or pages.github.io?

Returns:

  • (Boolean) 


286
287
288
 
# File 'lib/github-pages-health-check/domain.rb', line 286

def pages_dot_github_dot_com?
  !!host.match(/\Apages\.github\.(io|com)\.?\z/i)
end

#pages_io_domain? ⇒ Boolean

Is the host a *.github.io domain?

Returns:

  • (Boolean) 


276
277
278
 
# File 'lib/github-pages-health-check/domain.rb', line 276

def pages_io_domain?
  !!host.match(/\A[\w-]+\.github\.(io)\.?\z/i)
end

#parent_domain ⇒ Object 



447
448
449
450
451
452
453
454
455
456
457
 
# File 'lib/github-pages-health-check/domain.rb', line 447

def parent_domain
  parsed = PublicSuffix.parse(host)
  parent = host.split(".", 2).last
  if parent == parsed.tld
    return nil
  end

  parent
rescue PublicSuffix::DomainNotAllowed
  nil
end

#pointed_to_github_pages_ip? ⇒ Boolean

Is the domain’s first response an A or AAAA record to a valid GitHub Pages IP?

Returns:

  • (Boolean) 


228
229
230
231
232
 
# File 'lib/github-pages-health-check/domain.rb', line 228

def pointed_to_github_pages_ip?
  return false unless address_record?

  CURRENT_IP_ADDRESSES_ALL.include?(dns.first.address.to_s.downcase)
end

#proxied? ⇒ Boolean

Does this non-GitHub-pages domain proxy a GitHub Pages site?

This can be:

1. A Cloudflare-owned IP address
2. A site that returns GitHub.com server headers, but
   isn't CNAME'd to a GitHub domain
3. A site that returns GitHub.com server headers, but
   isn't CNAME'd to a GitHub IP

Returns:

  • (Boolean) 


318
319
320
321
322
323
324
325
326
327
328
 
# File 'lib/github-pages-health-check/domain.rb', line 318

def proxied?
  return unless dns?
  return true if cloudflare_ip?
  return false if pointed_to_github_pages_ip?
  return false if cname_to_github_user_domain?
  return false if cname_to_domain_to_pages?
  return false if cname_to_pages_dot_github_dot_com?
  return false if cname_to_fastly? || fastly_ip?

  served_by_pages?
end

#served_by_pages? ⇒ Boolean

Returns:

  • (Boolean) 


435
436
437
438
439
440
441
442
443
444
445
 
# File 'lib/github-pages-health-check/domain.rb', line 435

def served_by_pages?
  return @served_by_pages if defined? @served_by_pages
  return unless dns_resolves?

  @served_by_pages = begin
    return true if response.headers["Server"] == "GitHub.com"

    # Typhoeus mangles the case of the header, compare insensitively
    response.headers.any? { |k, _v| k.downcase == "x-github-request-id" }
  end
end

#should_be_a_record? ⇒ Boolean

Should the domain use an A record?

Returns:

  • (Boolean) 


219
220
221
 
# File 'lib/github-pages-health-check/domain.rb', line 219

def should_be_a_record?
  !pages_io_domain? && (apex_domain? || mx_records_present?)
end

#should_be_cname_record? ⇒ Boolean

Returns:

  • (Boolean) 


223
224
225
 
# File 'lib/github-pages-health-check/domain.rb', line 223

def should_be_cname_record?
  !should_be_a_record?
end

#uri(overrides = {}) ⇒ Object 



481
482
483
484
485
 
# File 'lib/github-pages-health-check/domain.rb', line 481

def uri(overrides = {})
  options = { :host => host, :scheme => scheme, :path => "/" }
  options = options.merge(overrides)
  Addressable::URI.new(options).normalize.to_s
end

#valid_domain? ⇒ Boolean

Is this a valid domain that PublicSuffix recognizes? Used as an escape hatch to prevent false positives on DNS checks

Returns:

  • (Boolean) 


166
167
168
169
170
171
172
173
 
# File 'lib/github-pages-health-check/domain.rb', line 166

def valid_domain?
  return @valid if defined? @valid

  unicode_host = Addressable::IDNA.to_unicode(host)
  @valid = PublicSuffix.valid?(unicode_host,
                               :default_rule => nil,
                               :ignore_private => true)
end

#wildcard_warning ⇒ Object 



477
478
479
 
# File 'lib/github-pages-health-check/domain.rb', line 477

def wildcard_warning
  Errors::WildcardRecordError.new :domain => self, :parent_domain => parent_domain if maybe_wildcard?
end

#www_cname(cname) ⇒ Object

Check if we have a ‘www.’ CNAME that matches the domain



424
425
426
427
 
# File 'lib/github-pages-health-check/domain.rb', line 424

def www_cname(cname)
  @www_cname ||= cname.name.to_s.start_with?("www.") &&
    cname.name.to_s.end_with?(cname.domainname.to_s)
end