mixandClaude Opus 5.5
f37424d9fc
The owner's decision of 2026-10-10, as the plan has it (Who sees what:
for the global administrator the filter's socket is one of the milter
sockets on Health and Overview). Written by Sonnet, reviewed by Opus.
- internal/health: CheckMilter probes an address in Postfix's two
forms. unix:/path is the existing stat; inet:host:port is a TCP
dial with a 1 s cap, closed at once, nothing written. An address in
neither form is reported as not checkable, never as fine. Details
are plain sentences ("No answer from antispam:11332 within 1 s.",
"Connection to ... refused.", "The name ... could not be
resolved.") and never the Go error text.
- Health: with the filter on, a third row "Spam filter - inbound"
with the configured address; it counts in the socket status and in
Overview's Milter sockets card. A filter that does not answer is an
error when INBOUND_ANTISPAM_MILTER_ACTION is tempfail (inbound mail
is deferred) and a warning otherwise (mail goes through
unfiltered), and the row says which. With the filter off nothing
changes.
- Both pages are global-only; a test checks a domain administrator
never receives the address.
The dial runs with the other checks on every request and poll of
Overview and Health (5 s active, 30 s idle, none while the tab is
hidden): a dead filter costs a poll at most 1 s, and a live one sees a
connect-and-close at that rhythm per open tab.
Not changed: fixtures and screenshots (the mockup draws two sockets),
help texts. The CHANGELOG line comes with the documentation step, which
is editing that file now.
go test -count=1 ./internal/health/... ./internal/web/... ./cmd/panel
ok (seven packages)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
109 lines
3.2 KiB
Go
109 lines
3.2 KiB
Go
package health
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"net"
|
|
"os"
|
|
"strconv"
|
|
"strings"
|
|
"syscall"
|
|
"time"
|
|
)
|
|
|
|
// milterDialTimeout caps the TCP probe. The Health page and Overview run every
|
|
// check on each poll, one after another, so this is the most a dead address can
|
|
// add to a poll.
|
|
const milterDialTimeout = time.Second
|
|
|
|
// CheckMilter probes a milter address in the two forms Postfix takes:
|
|
// unix:/path is stat-ed like any milter socket, and inet:host:port is dialled
|
|
// and the connection closed at once, with nothing written. required says what
|
|
// a failure costs, as for CheckSocket: an error when mail stops without the
|
|
// milter, a warning when it only goes through unscreened. An address in neither
|
|
// form is reported as not checkable (StatusUnknown), never as fine. Details say
|
|
// what failed in a sentence; they never carry the Go error.
|
|
func CheckMilter(name, addr string, required bool) Socket {
|
|
return checkMilter(name, addr, required, milterDialTimeout)
|
|
}
|
|
|
|
func checkMilter(name, addr string, required bool, timeout time.Duration) Socket {
|
|
s := Socket{Name: name, Path: addr}
|
|
addr = strings.TrimSpace(addr)
|
|
if addr == "" {
|
|
s.Status = StatusUnknown
|
|
s.Detail = "No address is configured."
|
|
return s
|
|
}
|
|
|
|
fail := func(detail string) Socket {
|
|
s.Status = missingStatus(required)
|
|
s.Detail = detail
|
|
return s
|
|
}
|
|
|
|
switch {
|
|
case strings.HasPrefix(addr, "unix:") && len(addr) > len("unix:"):
|
|
path := strings.TrimPrefix(addr, "unix:")
|
|
fi, err := os.Stat(path)
|
|
switch {
|
|
case err != nil:
|
|
return fail("The socket file does not exist.")
|
|
case fi.Mode()&os.ModeSocket == 0:
|
|
return fail("The path exists but is not a socket.")
|
|
}
|
|
case strings.HasPrefix(addr, "inet:"):
|
|
host, port, ok := splitInet(strings.TrimPrefix(addr, "inet:"))
|
|
if !ok {
|
|
return notCheckable(s)
|
|
}
|
|
conn, err := net.DialTimeout("tcp", net.JoinHostPort(host, port), timeout)
|
|
if err != nil {
|
|
return fail(milterDialDetail(err, host, port))
|
|
}
|
|
_ = conn.Close()
|
|
default:
|
|
return notCheckable(s)
|
|
}
|
|
|
|
s.Present = true
|
|
s.Status = StatusOK
|
|
s.Detail = "Listening"
|
|
return s
|
|
}
|
|
|
|
func notCheckable(s Socket) Socket {
|
|
s.Status = StatusUnknown
|
|
s.Detail = "The address is not unix:/path or inet:host:port, so it cannot be checked."
|
|
return s
|
|
}
|
|
|
|
// splitInet reads host:port (or [v6]:port) with a numeric port.
|
|
func splitInet(hp string) (host, port string, ok bool) {
|
|
host, port, err := net.SplitHostPort(hp)
|
|
if err != nil || host == "" {
|
|
return "", "", false
|
|
}
|
|
if n, err := strconv.Atoi(port); err != nil || n < 1 || n > 65535 {
|
|
return "", "", false
|
|
}
|
|
return host, port, true
|
|
}
|
|
|
|
// milterDialDetail turns a failed dial into a sentence that names only host and
|
|
// port.
|
|
func milterDialDetail(err error, host, port string) string {
|
|
hp := net.JoinHostPort(host, port)
|
|
var dns *net.DNSError
|
|
var nerr net.Error
|
|
switch {
|
|
case errors.As(err, &dns):
|
|
return fmt.Sprintf("The name %s could not be resolved.", host)
|
|
case errors.As(err, &nerr) && nerr.Timeout():
|
|
return fmt.Sprintf("No answer from %s within %d s.", hp, int(milterDialTimeout/time.Second))
|
|
case errors.Is(err, syscall.ECONNREFUSED) || strings.Contains(strings.ToLower(err.Error()), "refused"):
|
|
return fmt.Sprintf("Connection to %s refused.", hp)
|
|
}
|
|
return fmt.Sprintf("Could not connect to %s.", hp)
|
|
}
|