netprobe

Overview ¶

Command netprobe tries one network path from inside a guest and names how it ended: reached, resolve-refused, resolve-nxdomain, resolve-timeout, resolve-failed, connect-refused, timeout, no-route, client-missing, error, or error-after-connect.

The network conformance suite (#264) copies it into a sandbox and runs one case per call. A denied case passes only on the failure mode the policy causes. So the probe keeps a name the resolver refused apart from one it did not find or never answered for, a failed lookup apart from a connection that failed, and a refused port apart from a dropped one. It is built static and with the standard library alone, so it runs on any guest image whatever libc or tools it carries:

make netprobe

Usage:

netprobe tcp [-timeout d] HOST:PORT        a name, or an IPv4 or [IPv6] literal
netprobe dns [-timeout d] ADDR[:53] NAME   ask an alternate resolver over UDP
netprobe dot [-timeout d] HOST[:853] NAME  DNS over TLS
netprobe doh [-timeout d] [-client curl] URL NAME
                                          DNS over HTTPS, by the probe's own
                                          client or by the guest's curl

It prints one line, the outcome first, then the mode, the target and what happened. The exit status is 0 for reached, 1 for a path that was measured and not reached, 2 for a usage error, and 3 when nothing was measured: client-missing, or an error such as a certificate the guest does not trust. Only 0 means the target was reached. error-after-connect is an error once a connection was made, so the path was open that far, and error is any other.

DoT and DoH verify the server's certificate against the guest's CA bundle. An image with none, such as ubuntu:latest, gets error-after-connect on both. Point the probe at a bundle with SSL_CERT_FILE.