Reset

client/client.go

@@ -0,0 +1,375 @@
+package client
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/smtp"
+	"runtime"
+	"strings"
+	"time"
+
+	"github.com/TwiN/gocache/v2"
+	"github.com/TwiN/logr"
+	"github.com/TwiN/whois"
+	"github.com/ishidawataru/sctp"
+	"github.com/miekg/dns"
+	ping "github.com/prometheus-community/pro-bing"
+	"golang.org/x/crypto/ssh"
+	"golang.org/x/net/websocket"
+)
+
+const (
+	dnsPort = 53
+)
+
+var (
+	// injectedHTTPClient is used for testing purposes
+	injectedHTTPClient *http.Client
+
+	whoisClient              = whois.NewClient().WithReferralCache(true)
+	whoisExpirationDateCache = gocache.NewCache().WithMaxSize(10000).WithDefaultTTL(24 * time.Hour)
+)
+
+// GetHTTPClient returns the shared HTTP client, or the client from the configuration passed
+func GetHTTPClient(config *Config) *http.Client {
+	if injectedHTTPClient != nil {
+		return injectedHTTPClient
+	}
+	if config == nil {
+		return defaultConfig.getHTTPClient()
+	}
+	return config.getHTTPClient()
+}
+
+// GetDomainExpiration retrieves the duration until the domain provided expires
+func GetDomainExpiration(hostname string) (domainExpiration time.Duration, err error) {
+	var retrievedCachedValue bool
+	if v, exists := whoisExpirationDateCache.Get(hostname); exists {
+		domainExpiration = time.Until(v.(time.Time))
+		retrievedCachedValue = true
+		// If the domain OR the TTL is not going to expire in less than 24 hours
+		// we don't have to refresh the cache. Otherwise, we'll refresh it.
+		cacheEntryTTL, _ := whoisExpirationDateCache.TTL(hostname)
+		if cacheEntryTTL > 24*time.Hour && domainExpiration > 24*time.Hour {
+			// No need to refresh, so we'll just return the cached values
+			return domainExpiration, nil
+		}
+	}
+	if whoisResponse, err := whoisClient.QueryAndParse(hostname); err != nil {
+		if !retrievedCachedValue { // Add an error unless we already retrieved a cached value
+			return 0, fmt.Errorf("error querying and parsing hostname using whois client: %w", err)
+		}
+	} else {
+		domainExpiration = time.Until(whoisResponse.ExpirationDate)
+		if domainExpiration > 720*time.Hour {
+			whoisExpirationDateCache.SetWithTTL(hostname, whoisResponse.ExpirationDate, 240*time.Hour)
+		} else {
+			whoisExpirationDateCache.SetWithTTL(hostname, whoisResponse.ExpirationDate, 72*time.Hour)
+		}
+	}
+	return domainExpiration, nil
+}
+
+// CanCreateTCPConnection checks whether a connection can be established with a TCP endpoint
+func CanCreateTCPConnection(address string, config *Config) bool {
+	conn, err := net.DialTimeout("tcp", address, config.Timeout)
+	if err != nil {
+		return false
+	}
+	_ = conn.Close()
+	return true
+}
+
+// CanCreateUDPConnection checks whether a connection can be established with a UDP endpoint
+func CanCreateUDPConnection(address string, config *Config) bool {
+	conn, err := net.DialTimeout("udp", address, config.Timeout)
+	if err != nil {
+		return false
+	}
+	_ = conn.Close()
+	return true
+}
+
+// CanCreateSCTPConnection checks whether a connection can be established with a SCTP endpoint
+func CanCreateSCTPConnection(address string, config *Config) bool {
+	ch := make(chan bool, 1)
+	go (func(res chan bool) {
+		addr, err := sctp.ResolveSCTPAddr("sctp", address)
+		if err != nil {
+			res <- false
+			return
+		}
+
+		conn, err := sctp.DialSCTP("sctp", nil, addr)
+		if err != nil {
+			res <- false
+			return
+		}
+		_ = conn.Close()
+		res <- true
+	})(ch)
+	select {
+	case result := <-ch:
+		return result
+	case <-time.After(config.Timeout):
+		return false
+	}
+}
+
+// CanPerformStartTLS checks whether a connection can be established to an address using the STARTTLS protocol
+func CanPerformStartTLS(address string, config *Config) (connected bool, certificate *x509.Certificate, err error) {
+	hostAndPort := strings.Split(address, ":")
+	if len(hostAndPort) != 2 {
+		return false, nil, errors.New("invalid address for starttls, format must be host:port")
+	}
+	connection, err := net.DialTimeout("tcp", address, config.Timeout)
+	if err != nil {
+		return
+	}
+	smtpClient, err := smtp.NewClient(connection, hostAndPort[0])
+	if err != nil {
+		return
+	}
+	err = smtpClient.StartTLS(&tls.Config{
+		InsecureSkipVerify: config.Insecure,
+		ServerName:         hostAndPort[0],
+	})
+	if err != nil {
+		return
+	}
+	if state, ok := smtpClient.TLSConnectionState(); ok {
+		certificate = state.PeerCertificates[0]
+	} else {
+		return false, nil, errors.New("could not get TLS connection state")
+	}
+	return true, certificate, nil
+}
+
+// CanPerformTLS checks whether a connection can be established to an address using the TLS protocol
+func CanPerformTLS(address string, config *Config) (connected bool, certificate *x509.Certificate, err error) {
+	connection, err := tls.DialWithDialer(&net.Dialer{Timeout: config.Timeout}, "tcp", address, &tls.Config{
+		InsecureSkipVerify: config.Insecure,
+	})
+	if err != nil {
+		return
+	}
+	defer connection.Close()
+	verifiedChains := connection.ConnectionState().VerifiedChains
+	// If config.Insecure is set to true, verifiedChains will be an empty list []
+	// We should get the parsed certificates from PeerCertificates, it can't be empty on the client side
+	// Reference: https://pkg.go.dev/crypto/tls#PeerCertificates
+	if len(verifiedChains) == 0 || len(verifiedChains[0]) == 0 {
+		peerCertificates := connection.ConnectionState().PeerCertificates
+		return true, peerCertificates[0], nil
+	}
+	return true, verifiedChains[0][0], nil
+}
+
+// CanCreateSSHConnection checks whether a connection can be established and a command can be executed to an address
+// using the SSH protocol.
+func CanCreateSSHConnection(address, username, password string, config *Config) (bool, *ssh.Client, error) {
+	var port string
+	if strings.Contains(address, ":") {
+		addressAndPort := strings.Split(address, ":")
+		if len(addressAndPort) != 2 {
+			return false, nil, errors.New("invalid address for ssh, format must be host:port")
+		}
+		address = addressAndPort[0]
+		port = addressAndPort[1]
+	} else {
+		port = "22"
+	}
+	cli, err := ssh.Dial("tcp", strings.Join([]string{address, port}, ":"), &ssh.ClientConfig{
+		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
+		User:            username,
+		Auth: []ssh.AuthMethod{
+			ssh.Password(password),
+		},
+		Timeout: config.Timeout,
+	})
+	if err != nil {
+		return false, nil, err
+	}
+	return true, cli, nil
+}
+
+func CheckSSHBanner(address string, cfg *Config) (bool, int, error) {
+	var port string
+	if strings.Contains(address, ":") {
+		addressAndPort := strings.Split(address, ":")
+		if len(addressAndPort) != 2 {
+			return false, 1, errors.New("invalid address for ssh, format must be ssh://host:port")
+		}
+		address = addressAndPort[0]
+		port = addressAndPort[1]
+	} else {
+		port = "22"
+	}
+	dialer := net.Dialer{}
+	connStr := net.JoinHostPort(address, port)
+	conn, err := dialer.Dial("tcp", connStr)
+	if err != nil {
+		return false, 1, err
+	}
+	defer conn.Close()
+	conn.SetReadDeadline(time.Now().Add(time.Second))
+	buf := make([]byte, 256)
+	_, err = io.ReadAtLeast(conn, buf, 1)
+	if err != nil {
+		return false, 1, err
+	}
+	return true, 0, err
+}
+
+// ExecuteSSHCommand executes a command to an address using the SSH protocol.
+func ExecuteSSHCommand(sshClient *ssh.Client, body string, config *Config) (bool, int, error) {
+	type Body struct {
+		Command string `json:"command"`
+	}
+	defer sshClient.Close()
+	var b Body
+	if err := json.Unmarshal([]byte(body), &b); err != nil {
+		return false, 0, err
+	}
+	sess, err := sshClient.NewSession()
+	if err != nil {
+		return false, 0, err
+	}
+	err = sess.Start(b.Command)
+	if err != nil {
+		return false, 0, err
+	}
+	defer sess.Close()
+	err = sess.Wait()
+	if err == nil {
+		return true, 0, nil
+	}
+	var exitErr *ssh.ExitError
+	if ok := errors.As(err, &exitErr); !ok {
+		return false, 0, err
+	}
+	return true, exitErr.ExitStatus(), nil
+}
+
+// Ping checks if an address can be pinged and returns the round-trip time if the address can be pinged
+//
+// Note that this function takes at least 100ms, even if the address is 127.0.0.1
+func Ping(address string, config *Config) (bool, time.Duration) {
+	pinger := ping.New(address)
+	pinger.Count = 1
+	pinger.Timeout = config.Timeout
+	// Set the pinger's privileged mode to true for every GOOS except darwin
+	// See https://github.com/TwiN/gatus/issues/132
+	//
+	// Note that for this to work on Linux, Gatus must run with sudo privileges.
+	// See https://github.com/prometheus-community/pro-bing#linux
+	pinger.SetPrivileged(runtime.GOOS != "darwin")
+	pinger.SetNetwork(config.Network)
+	err := pinger.Run()
+	if err != nil {
+		return false, 0
+	}
+	if pinger.Statistics() != nil {
+		// If the packet loss is 100, it means that the packet didn't reach the host
+		if pinger.Statistics().PacketLoss == 100 {
+			return false, pinger.Timeout
+		}
+		return true, pinger.Statistics().MaxRtt
+	}
+	return true, 0
+}
+
+// QueryWebSocket opens a websocket connection, write `body` and return a message from the server
+func QueryWebSocket(address, body string, config *Config) (bool, []byte, error) {
+	const (
+		Origin             = "http://localhost/"
+		MaximumMessageSize = 1024 // in bytes
+	)
+	wsConfig, err := websocket.NewConfig(address, Origin)
+	if err != nil {
+		return false, nil, fmt.Errorf("error configuring websocket connection: %w", err)
+	}
+	if config != nil {
+		wsConfig.Dialer = &net.Dialer{Timeout: config.Timeout}
+	}
+	// Dial URL
+	ws, err := websocket.DialConfig(wsConfig)
+	if err != nil {
+		return false, nil, fmt.Errorf("error dialing websocket: %w", err)
+	}
+	defer ws.Close()
+	// Write message
+	if _, err := ws.Write([]byte(body)); err != nil {
+		return false, nil, fmt.Errorf("error writing websocket body: %w", err)
+	}
+	// Read message
+	var n int
+	msg := make([]byte, MaximumMessageSize)
+	if n, err = ws.Read(msg); err != nil {
+		return false, nil, fmt.Errorf("error reading websocket message: %w", err)
+	}
+	return true, msg[:n], nil
+}
+
+func QueryDNS(queryType, queryName, url string) (connected bool, dnsRcode string, body []byte, err error) {
+	if !strings.Contains(url, ":") {
+		url = fmt.Sprintf("%s:%d", url, dnsPort)
+	}
+	queryTypeAsUint16 := dns.StringToType[queryType]
+	c := new(dns.Client)
+	m := new(dns.Msg)
+	m.SetQuestion(queryName, queryTypeAsUint16)
+	r, _, err := c.Exchange(m, url)
+	if err != nil {
+		logr.Infof("[client.QueryDNS] Error exchanging DNS message: %v", err)
+		return false, "", nil, err
+	}
+	connected = true
+	dnsRcode = dns.RcodeToString[r.Rcode]
+	for _, rr := range r.Answer {
+		switch rr.Header().Rrtype {
+		case dns.TypeA:
+			if a, ok := rr.(*dns.A); ok {
+				body = []byte(a.A.String())
+			}
+		case dns.TypeAAAA:
+			if aaaa, ok := rr.(*dns.AAAA); ok {
+				body = []byte(aaaa.AAAA.String())
+			}
+		case dns.TypeCNAME:
+			if cname, ok := rr.(*dns.CNAME); ok {
+				body = []byte(cname.Target)
+			}
+		case dns.TypeMX:
+			if mx, ok := rr.(*dns.MX); ok {
+				body = []byte(mx.Mx)
+			}
+		case dns.TypeNS:
+			if ns, ok := rr.(*dns.NS); ok {
+				body = []byte(ns.Ns)
+			}
+		case dns.TypePTR:
+			if ptr, ok := rr.(*dns.PTR); ok {
+				body = []byte(ptr.Ptr)
+			}
+		case dns.TypeSRV:
+			if srv, ok := rr.(*dns.SRV); ok {
+				body = []byte(fmt.Sprintf("%s:%d", srv.Target, srv.Port))
+			}
+		default:
+			body = []byte("query type is not supported yet")
+		}
+	}
+	return connected, dnsRcode, body, nil
+}
+
+// InjectHTTPClient is used to inject a custom HTTP client for testing purposes
+func InjectHTTPClient(httpClient *http.Client) {
+	injectedHTTPClient = httpClient
+}

client/client_test.go

@@ -0,0 +1,511 @@
+package client
+
+import (
+	"bytes"
+	"crypto/tls"
+	"io"
+	"net/http"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/TwiN/gatus/v5/config/endpoint/dns"
+	"github.com/TwiN/gatus/v5/pattern"
+	"github.com/TwiN/gatus/v5/test"
+)
+
+func TestGetHTTPClient(t *testing.T) {
+	cfg := &Config{
+		Insecure:       false,
+		IgnoreRedirect: false,
+		Timeout:        0,
+		DNSResolver:    "tcp://1.1.1.1:53",
+		OAuth2Config: &OAuth2Config{
+			ClientID:     "00000000-0000-0000-0000-000000000000",
+			ClientSecret: "secretsauce",
+			TokenURL:     "https://token-server.local/token",
+			Scopes:       []string{"https://application.local/.default"},
+		},
+	}
+	err := cfg.ValidateAndSetDefaults()
+	if err != nil {
+		t.Errorf("expected error to be nil, but got: `%s`", err)
+	}
+	if GetHTTPClient(cfg) == nil {
+		t.Error("expected client to not be nil")
+	}
+	if GetHTTPClient(nil) == nil {
+		t.Error("expected client to not be nil")
+	}
+}
+
+func TestGetDomainExpiration(t *testing.T) {
+	t.Parallel()
+	if domainExpiration, err := GetDomainExpiration("example.com"); err != nil {
+		t.Fatalf("expected error to be nil, but got: `%s`", err)
+	} else if domainExpiration <= 0 {
+		t.Error("expected domain expiration to be higher than 0")
+	}
+	if domainExpiration, err := GetDomainExpiration("example.com"); err != nil {
+		t.Errorf("expected error to be nil, but got: `%s`", err)
+	} else if domainExpiration <= 0 {
+		t.Error("expected domain expiration to be higher than 0")
+	}
+	// Hack to pretend like the domain is expiring in 1 hour, which should trigger a refresh
+	whoisExpirationDateCache.SetWithTTL("example.com", time.Now().Add(time.Hour), 25*time.Hour)
+	if domainExpiration, err := GetDomainExpiration("example.com"); err != nil {
+		t.Errorf("expected error to be nil, but got: `%s`", err)
+	} else if domainExpiration <= 0 {
+		t.Error("expected domain expiration to be higher than 0")
+	}
+	// Make sure the refresh works when the ttl is <24 hours
+	whoisExpirationDateCache.SetWithTTL("example.com", time.Now().Add(35*time.Hour), 23*time.Hour)
+	if domainExpiration, err := GetDomainExpiration("example.com"); err != nil {
+		t.Errorf("expected error to be nil, but got: `%s`", err)
+	} else if domainExpiration <= 0 {
+		t.Error("expected domain expiration to be higher than 0")
+	}
+}
+
+func TestPing(t *testing.T) {
+	t.Parallel()
+	if success, rtt := Ping("127.0.0.1", &Config{Timeout: 500 * time.Millisecond}); !success {
+		t.Error("expected true")
+		if rtt == 0 {
+			t.Error("Round-trip time returned on success should've higher than 0")
+		}
+	}
+	if success, rtt := Ping("256.256.256.256", &Config{Timeout: 500 * time.Millisecond}); success {
+		t.Error("expected false, because the IP is invalid")
+		if rtt != 0 {
+			t.Error("Round-trip time returned on failure should've been 0")
+		}
+	}
+	if success, rtt := Ping("192.168.152.153", &Config{Timeout: 500 * time.Millisecond}); success {
+		t.Error("expected false, because the IP is valid but the host should be unreachable")
+		if rtt != 0 {
+			t.Error("Round-trip time returned on failure should've been 0")
+		}
+	}
+	// Can't perform integration tests (e.g. pinging public targets by single-stacked hostname) here,
+	// because ICMP is blocked in the network of GitHub-hosted runners.
+	if success, rtt := Ping("127.0.0.1", &Config{Timeout: 500 * time.Millisecond, Network: "ip"}); !success {
+		t.Error("expected true")
+		if rtt == 0 {
+			t.Error("Round-trip time returned on failure should've been 0")
+		}
+	}
+	if success, rtt := Ping("::1", &Config{Timeout: 500 * time.Millisecond, Network: "ip"}); !success {
+		t.Error("expected true")
+		if rtt == 0 {
+			t.Error("Round-trip time returned on failure should've been 0")
+		}
+	}
+	if success, rtt := Ping("::1", &Config{Timeout: 500 * time.Millisecond, Network: "ip4"}); success {
+		t.Error("expected false, because the IP isn't an IPv4 address")
+		if rtt != 0 {
+			t.Error("Round-trip time returned on failure should've been 0")
+		}
+	}
+	if success, rtt := Ping("127.0.0.1", &Config{Timeout: 500 * time.Millisecond, Network: "ip6"}); success {
+		t.Error("expected false, because the IP isn't an IPv6 address")
+		if rtt != 0 {
+			t.Error("Round-trip time returned on failure should've been 0")
+		}
+	}
+}
+
+func TestCanPerformStartTLS(t *testing.T) {
+	type args struct {
+		address  string
+		insecure bool
+	}
+	tests := []struct {
+		name          string
+		args          args
+		wantConnected bool
+		wantErr       bool
+	}{
+		{
+			name: "invalid address",
+			args: args{
+				address: "test",
+			},
+			wantConnected: false,
+			wantErr:       true,
+		},
+		{
+			name: "error dial",
+			args: args{
+				address: "test:1234",
+			},
+			wantConnected: false,
+			wantErr:       true,
+		},
+		{
+			name: "valid starttls",
+			args: args{
+				address: "smtp.gmail.com:587",
+			},
+			wantConnected: true,
+			wantErr:       false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			connected, _, err := CanPerformStartTLS(tt.args.address, &Config{Insecure: tt.args.insecure, Timeout: 5 * time.Second})
+			if (err != nil) != tt.wantErr {
+				t.Errorf("CanPerformStartTLS() err=%v, wantErr=%v", err, tt.wantErr)
+				return
+			}
+			if connected != tt.wantConnected {
+				t.Errorf("CanPerformStartTLS() connected=%v, wantConnected=%v", connected, tt.wantConnected)
+			}
+		})
+	}
+}
+
+func TestCanPerformTLS(t *testing.T) {
+	type args struct {
+		address  string
+		insecure bool
+	}
+	tests := []struct {
+		name          string
+		args          args
+		wantConnected bool
+		wantErr       bool
+	}{
+		{
+			name: "invalid address",
+			args: args{
+				address: "test",
+			},
+			wantConnected: false,
+			wantErr:       true,
+		},
+		{
+			name: "error dial",
+			args: args{
+				address: "test:1234",
+			},
+			wantConnected: false,
+			wantErr:       true,
+		},
+		{
+			name: "valid tls",
+			args: args{
+				address: "smtp.gmail.com:465",
+			},
+			wantConnected: true,
+			wantErr:       false,
+		},
+		{
+			name: "bad cert with insecure true",
+			args: args{
+				address:  "expired.badssl.com:443",
+				insecure: true,
+			},
+			wantConnected: true,
+			wantErr:       false,
+		},
+		{
+			name: "bad cert with insecure false",
+			args: args{
+				address:  "expired.badssl.com:443",
+				insecure: false,
+			},
+			wantConnected: false,
+			wantErr:       true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			connected, _, err := CanPerformTLS(tt.args.address, &Config{Insecure: tt.args.insecure, Timeout: 5 * time.Second})
+			if (err != nil) != tt.wantErr {
+				t.Errorf("CanPerformTLS() err=%v, wantErr=%v", err, tt.wantErr)
+				return
+			}
+			if connected != tt.wantConnected {
+				t.Errorf("CanPerformTLS() connected=%v, wantConnected=%v", connected, tt.wantConnected)
+			}
+		})
+	}
+}
+
+func TestCanCreateTCPConnection(t *testing.T) {
+	if CanCreateTCPConnection("127.0.0.1", &Config{Timeout: 5 * time.Second}) {
+		t.Error("should've failed, because there's no port in the address")
+	}
+	if !CanCreateTCPConnection("1.1.1.1:53", &Config{Timeout: 5 * time.Second}) {
+		t.Error("should've succeeded, because that IP should always™ be up")
+	}
+}
+
+// This test checks if a HTTP client configured with `configureOAuth2()` automatically
+// performs a Client Credentials OAuth2 flow and adds the obtained token as a `Authorization`
+// header to all outgoing HTTP calls.
+func TestHttpClientProvidesOAuth2BearerToken(t *testing.T) {
+	defer InjectHTTPClient(nil)
+	oAuth2Config := &OAuth2Config{
+		ClientID:     "00000000-0000-0000-0000-000000000000",
+		ClientSecret: "secretsauce",
+		TokenURL:     "https://token-server.local/token",
+		Scopes:       []string{"https://application.local/.default"},
+	}
+	mockHttpClient := &http.Client{
+		Transport: test.MockRoundTripper(func(r *http.Request) *http.Response {
+			// if the mock HTTP client tries to get a token from the `token-server`
+			// we provide the expected token response
+			if r.Host == "token-server.local" {
+				return &http.Response{
+					StatusCode: http.StatusOK,
+					Body: io.NopCloser(bytes.NewReader(
+						[]byte(
+							`{"token_type":"Bearer","expires_in":3599,"ext_expires_in":3599,"access_token":"secret-token"}`,
+						),
+					)),
+				}
+			}
+			// to verify the headers were sent as expected, we echo them back in the
+			// `X-Org-Authorization` header and check if the token value matches our
+			// mocked `token-server` response
+			return &http.Response{
+				StatusCode: http.StatusOK,
+				Header: map[string][]string{
+					"X-Org-Authorization": {r.Header.Get("Authorization")},
+				},
+				Body: http.NoBody,
+			}
+		}),
+	}
+	mockHttpClientWithOAuth := configureOAuth2(mockHttpClient, *oAuth2Config)
+	InjectHTTPClient(mockHttpClientWithOAuth)
+	request, err := http.NewRequest(http.MethodPost, "http://127.0.0.1:8282", http.NoBody)
+	if err != nil {
+		t.Error("expected no error, got", err.Error())
+	}
+	response, err := mockHttpClientWithOAuth.Do(request)
+	if err != nil {
+		t.Error("expected no error, got", err.Error())
+	}
+	if response.Header == nil {
+		t.Error("expected response headers, but got nil")
+	}
+	// the mock response echos the Authorization header used in the request back
+	// to us as `X-Org-Authorization` header, we check here if the value matches
+	// our expected token `secret-token`
+	if response.Header.Get("X-Org-Authorization") != "Bearer secret-token" {
+		t.Error("expected `secret-token` as Bearer token in the mocked response header `X-Org-Authorization`, but got", response.Header.Get("X-Org-Authorization"))
+	}
+}
+
+func TestQueryWebSocket(t *testing.T) {
+	_, _, err := QueryWebSocket("", "body", &Config{Timeout: 2 * time.Second})
+	if err == nil {
+		t.Error("expected an error due to the address being invalid")
+	}
+	_, _, err = QueryWebSocket("ws://example.org", "body", &Config{Timeout: 2 * time.Second})
+	if err == nil {
+		t.Error("expected an error due to the target not being websocket-friendly")
+	}
+}
+
+func TestTlsRenegotiation(t *testing.T) {
+	tests := []struct {
+		name           string
+		cfg            TLSConfig
+		expectedConfig tls.RenegotiationSupport
+	}{
+		{
+			name:           "default",
+			cfg:            TLSConfig{CertificateFile: "../testdata/cert.pem", PrivateKeyFile: "../testdata/cert.key"},
+			expectedConfig: tls.RenegotiateNever,
+		},
+		{
+			name:           "never",
+			cfg:            TLSConfig{RenegotiationSupport: "never", CertificateFile: "../testdata/cert.pem", PrivateKeyFile: "../testdata/cert.key"},
+			expectedConfig: tls.RenegotiateNever,
+		},
+		{
+			name:           "once",
+			cfg:            TLSConfig{RenegotiationSupport: "once", CertificateFile: "../testdata/cert.pem", PrivateKeyFile: "../testdata/cert.key"},
+			expectedConfig: tls.RenegotiateOnceAsClient,
+		},
+		{
+			name:           "freely",
+			cfg:            TLSConfig{RenegotiationSupport: "freely", CertificateFile: "../testdata/cert.pem", PrivateKeyFile: "../testdata/cert.key"},
+			expectedConfig: tls.RenegotiateFreelyAsClient,
+		},
+		{
+			name:           "not-valid-and-broken",
+			cfg:            TLSConfig{RenegotiationSupport: "invalid", CertificateFile: "../testdata/cert.pem", PrivateKeyFile: "../testdata/cert.key"},
+			expectedConfig: tls.RenegotiateNever,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			tls := &tls.Config{}
+			tlsConfig := configureTLS(tls, test.cfg)
+			if tlsConfig.Renegotiation != test.expectedConfig {
+				t.Errorf("expected tls renegotiation to be %v, but got %v", test.expectedConfig, tls.Renegotiation)
+			}
+		})
+	}
+}
+
+func TestQueryDNS(t *testing.T) {
+	scenarios := []struct {
+		name            string
+		inputDNS        dns.Config
+		inputURL        string
+		expectedDNSCode string
+		expectedBody    string
+		isErrExpected   bool
+	}{
+		{
+			name: "test Config with type A",
+			inputDNS: dns.Config{
+				QueryType: "A",
+				QueryName: "example.com.",
+			},
+			inputURL:        "8.8.8.8",
+			expectedDNSCode: "NOERROR",
+			expectedBody:    "__IPV4__",
+		},
+		{
+			name: "test Config with type AAAA",
+			inputDNS: dns.Config{
+				QueryType: "AAAA",
+				QueryName: "example.com.",
+			},
+			inputURL:        "8.8.8.8",
+			expectedDNSCode: "NOERROR",
+			expectedBody:    "__IPV6__",
+		},
+		{
+			name: "test Config with type CNAME",
+			inputDNS: dns.Config{
+				QueryType: "CNAME",
+				QueryName: "en.wikipedia.org.",
+			},
+			inputURL:        "8.8.8.8",
+			expectedDNSCode: "NOERROR",
+			expectedBody:    "dyna.wikimedia.org.",
+		},
+		{
+			name: "test Config with type MX",
+			inputDNS: dns.Config{
+				QueryType: "MX",
+				QueryName: "example.com.",
+			},
+			inputURL:        "8.8.8.8",
+			expectedDNSCode: "NOERROR",
+			expectedBody:    ".",
+		},
+		{
+			name: "test Config with type NS",
+			inputDNS: dns.Config{
+				QueryType: "NS",
+				QueryName: "example.com.",
+			},
+			inputURL:        "8.8.8.8",
+			expectedDNSCode: "NOERROR",
+			expectedBody:    "*.iana-servers.net.",
+		},
+		{
+			name: "test Config with type PTR",
+			inputDNS: dns.Config{
+				QueryType: "PTR",
+				QueryName: "8.8.8.8.in-addr.arpa.",
+			},
+			inputURL:        "8.8.8.8",
+			expectedDNSCode: "NOERROR",
+			expectedBody:    "dns.google.",
+		},
+		{
+			name: "test Config with fake type and retrieve error",
+			inputDNS: dns.Config{
+				QueryType: "B",
+				QueryName: "example",
+			},
+			inputURL:      "8.8.8.8",
+			isErrExpected: true,
+		},
+	}
+	for _, scenario := range scenarios {
+		t.Run(scenario.name, func(t *testing.T) {
+			_, dnsRCode, body, err := QueryDNS(scenario.inputDNS.QueryType, scenario.inputDNS.QueryName, scenario.inputURL)
+			if scenario.isErrExpected && err == nil {
+				t.Errorf("there should be an error")
+			}
+			if dnsRCode != scenario.expectedDNSCode {
+				t.Errorf("expected DNSRCode to be %s, got %s", scenario.expectedDNSCode, dnsRCode)
+			}
+			if scenario.inputDNS.QueryType == "NS" {
+				// Because there are often multiple nameservers backing a single domain, we'll only look at the suffix
+				if !pattern.Match(scenario.expectedBody, string(body)) {
+					t.Errorf("got %s, expected result %s,", string(body), scenario.expectedBody)
+				}
+			} else {
+				if string(body) != scenario.expectedBody {
+					// little hack to validate arbitrary ipv4/ipv6
+					switch scenario.expectedBody {
+					case "__IPV4__":
+						if addr, err := netip.ParseAddr(string(body)); err != nil {
+							t.Errorf("got %s, expected result %s", string(body), scenario.expectedBody)
+						} else if !addr.Is4() {
+							t.Errorf("got %s, expected valid IPv4", string(body))
+						}
+					case "__IPV6__":
+						if addr, err := netip.ParseAddr(string(body)); err != nil {
+							t.Errorf("got %s, expected result %s", string(body), scenario.expectedBody)
+						} else if !addr.Is6() {
+							t.Errorf("got %s, expected valid IPv6", string(body))
+						}
+					default:
+						t.Errorf("got %s, expected result %s", string(body), scenario.expectedBody)
+					}
+				}
+			}
+		})
+		time.Sleep(10 * time.Millisecond)
+	}
+}
+
+func TestCheckSSHBanner(t *testing.T) {
+	cfg := &Config{Timeout: 3}
+
+	t.Run("no-auth-ssh", func(t *testing.T) {
+		connected, status, err := CheckSSHBanner("tty.sdf.org", cfg)
+
+		if err != nil {
+			t.Errorf("Expected: error != nil, got: %v ", err)
+		}
+
+		if connected == false {
+			t.Errorf("Expected: connected == true, got: %v", connected)
+		}
+		if status != 0 {
+			t.Errorf("Expected: 0, got: %v", status)
+		}
+	})
+
+	t.Run("invalid-address", func(t *testing.T) {
+		connected, status, err := CheckSSHBanner("idontplaytheodds.com", cfg)
+
+		if err == nil {
+			t.Errorf("Expected: error, got: %v ", err)
+		}
+
+		if connected != false {
+			t.Errorf("Expected: connected == false, got: %v", connected)
+		}
+		if status != 1 {
+			t.Errorf("Expected: 1, got: %v", status)
+		}
+	})
+
+}

client/config.go

@@ -0,0 +1,343 @@
+package client
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"net"
+	"net/http"
+	"net/url"
+	"regexp"
+	"strconv"
+	"time"
+
+	"github.com/TwiN/logr"
+	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/clientcredentials"
+	"google.golang.org/api/idtoken"
+)
+
+const (
+	defaultTimeout = 10 * time.Second
+)
+
+var (
+	ErrInvalidDNSResolver        = errors.New("invalid DNS resolver specified. Required format is {proto}://{ip}:{port}")
+	ErrInvalidDNSResolverPort    = errors.New("invalid DNS resolver port")
+	ErrInvalidClientOAuth2Config = errors.New("invalid oauth2 configuration: must define all fields for client credentials flow (token-url, client-id, client-secret, scopes)")
+	ErrInvalidClientIAPConfig    = errors.New("invalid Identity-Aware-Proxy configuration: must define all fields for Google Identity-Aware-Proxy programmatic authentication (audience)")
+	ErrInvalidClientTLSConfig    = errors.New("invalid TLS configuration: certificate-file and private-key-file must be specified")
+
+	defaultConfig = Config{
+		Insecure:       false,
+		IgnoreRedirect: false,
+		Timeout:        defaultTimeout,
+		Network:        "ip",
+	}
+)
+
+// GetDefaultConfig returns a copy of the default configuration
+func GetDefaultConfig() *Config {
+	cfg := defaultConfig
+	return &cfg
+}
+
+// Config is the configuration for clients
+type Config struct {
+	// ProxyURL is the URL of the proxy to use for the client
+	ProxyURL string `yaml:"proxy-url,omitempty"`
+
+	// Insecure determines whether to skip verifying the server's certificate chain and host name
+	Insecure bool `yaml:"insecure,omitempty"`
+
+	// IgnoreRedirect determines whether to ignore redirects (true) or follow them (false, default)
+	IgnoreRedirect bool `yaml:"ignore-redirect,omitempty"`
+
+	// Timeout for the client
+	Timeout time.Duration `yaml:"timeout"`
+
+	// DNSResolver override for the HTTP client
+	// Expected format is {protocol}://{host}:{port}, e.g. tcp://8.8.8.8:53
+	DNSResolver string `yaml:"dns-resolver,omitempty"`
+
+	// OAuth2Config is the OAuth2 configuration used for the client.
+	//
+	// If non-nil, the http.Client returned by getHTTPClient will automatically retrieve a token if necessary.
+	// See configureOAuth2 for more details.
+	OAuth2Config *OAuth2Config `yaml:"oauth2,omitempty"`
+
+	// IAPConfig is the Google Cloud Identity-Aware-Proxy configuration used for the client. (e.g. audience)
+	IAPConfig *IAPConfig `yaml:"identity-aware-proxy,omitempty"`
+
+	httpClient *http.Client
+
+	// Network (ip, ip4 or ip6) for the ICMP client
+	Network string `yaml:"network"`
+
+	// TLS configuration (optional)
+	TLS *TLSConfig `yaml:"tls,omitempty"`
+}
+
+// DNSResolverConfig is the parsed configuration from the DNSResolver config string.
+type DNSResolverConfig struct {
+	Protocol string
+	Host     string
+	Port     string
+}
+
+// OAuth2Config is the configuration for the OAuth2 client credentials flow
+type OAuth2Config struct {
+	TokenURL     string   `yaml:"token-url"` // e.g. https://dev-12345678.okta.com/token
+	ClientID     string   `yaml:"client-id"`
+	ClientSecret string   `yaml:"client-secret"`
+	Scopes       []string `yaml:"scopes"` // e.g. ["openid"]
+}
+
+// IAPConfig is the configuration for the Google Cloud Identity-Aware-Proxy
+type IAPConfig struct {
+	Audience string `yaml:"audience"` // e.g. "toto.apps.googleusercontent.com"
+}
+
+// TLSConfig is the configuration for mTLS configurations
+type TLSConfig struct {
+	// CertificateFile is the public certificate for TLS in PEM format.
+	CertificateFile string `yaml:"certificate-file,omitempty"`
+
+	// PrivateKeyFile is the private key file for TLS in PEM format.
+	PrivateKeyFile string `yaml:"private-key-file,omitempty"`
+
+	RenegotiationSupport string `yaml:"renegotiation,omitempty"`
+}
+
+// ValidateAndSetDefaults validates the client configuration and sets the default values if necessary
+func (c *Config) ValidateAndSetDefaults() error {
+	if c.Timeout < time.Millisecond {
+		c.Timeout = 10 * time.Second
+	}
+	if c.HasCustomDNSResolver() {
+		// Validate the DNS resolver now to make sure it will not return an error later.
+		if _, err := c.parseDNSResolver(); err != nil {
+			return err
+		}
+	}
+	if c.HasOAuth2Config() && !c.OAuth2Config.isValid() {
+		return ErrInvalidClientOAuth2Config
+	}
+	if c.HasIAPConfig() && !c.IAPConfig.isValid() {
+		return ErrInvalidClientIAPConfig
+	}
+	if c.HasTLSConfig() {
+		if err := c.TLS.isValid(); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// HasCustomDNSResolver returns whether a custom DNSResolver is configured
+func (c *Config) HasCustomDNSResolver() bool {
+	return len(c.DNSResolver) > 0
+}
+
+// parseDNSResolver parses the DNS resolver into the DNSResolverConfig struct
+func (c *Config) parseDNSResolver() (*DNSResolverConfig, error) {
+	re := regexp.MustCompile(`^(?P<proto>(.*))://(?P<host>[A-Za-z0-9\-\.]+):(?P<port>[0-9]+)?(.*)$`)
+	matches := re.FindStringSubmatch(c.DNSResolver)
+	if len(matches) == 0 {
+		return nil, ErrInvalidDNSResolver
+	}
+	r := make(map[string]string)
+	for i, k := range re.SubexpNames() {
+		if i != 0 && k != "" {
+			r[k] = matches[i]
+		}
+	}
+	port, err := strconv.Atoi(r["port"])
+	if err != nil {
+		return nil, err
+	}
+	if port < 1 || port > 65535 {
+		return nil, ErrInvalidDNSResolverPort
+	}
+	return &DNSResolverConfig{
+		Protocol: r["proto"],
+		Host:     r["host"],
+		Port:     r["port"],
+	}, nil
+}
+
+// HasOAuth2Config returns true if the client has OAuth2 configuration parameters
+func (c *Config) HasOAuth2Config() bool {
+	return c.OAuth2Config != nil
+}
+
+// HasIAPConfig returns true if the client has IAP configuration parameters
+func (c *Config) HasIAPConfig() bool {
+	return c.IAPConfig != nil
+}
+
+// HasTLSConfig returns true if the client has client certificate parameters
+func (c *Config) HasTLSConfig() bool {
+	return c.TLS != nil && len(c.TLS.CertificateFile) > 0 && len(c.TLS.PrivateKeyFile) > 0
+}
+
+// isValid() returns true if the IAP configuration is valid
+func (c *IAPConfig) isValid() bool {
+	return len(c.Audience) > 0
+}
+
+// isValid() returns true if the OAuth2 configuration is valid
+func (c *OAuth2Config) isValid() bool {
+	return len(c.TokenURL) > 0 && len(c.ClientID) > 0 && len(c.ClientSecret) > 0 && len(c.Scopes) > 0
+}
+
+// isValid() returns nil if the client tls certificates are valid, otherwise returns an error
+func (t *TLSConfig) isValid() error {
+	if len(t.CertificateFile) > 0 && len(t.PrivateKeyFile) > 0 {
+		_, err := tls.LoadX509KeyPair(t.CertificateFile, t.PrivateKeyFile)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+	return ErrInvalidClientTLSConfig
+}
+
+// getHTTPClient return an HTTP client matching the Config's parameters.
+func (c *Config) getHTTPClient() *http.Client {
+	tlsConfig := &tls.Config{
+		InsecureSkipVerify: c.Insecure,
+	}
+	if c.HasTLSConfig() && c.TLS.isValid() == nil {
+		tlsConfig = configureTLS(tlsConfig, *c.TLS)
+	}
+	if c.httpClient == nil {
+		c.httpClient = &http.Client{
+			Timeout: c.Timeout,
+			Transport: &http.Transport{
+				MaxIdleConns:        100,
+				MaxIdleConnsPerHost: 20,
+				Proxy:               http.ProxyFromEnvironment,
+				TLSClientConfig:     tlsConfig,
+			},
+			CheckRedirect: func(req *http.Request, via []*http.Request) error {
+				if c.IgnoreRedirect {
+					// Don't follow redirects
+					return http.ErrUseLastResponse
+				}
+				// Follow redirects
+				return nil
+			},
+		}
+		if c.ProxyURL != "" {
+			proxyURL, err := url.Parse(c.ProxyURL)
+			if err != nil {
+				logr.Errorf("[client.getHTTPClient] THIS SHOULD NOT HAPPEN. Silently ignoring custom proxy due to error: %s", err.Error())
+			} else {
+				c.httpClient.Transport.(*http.Transport).Proxy = http.ProxyURL(proxyURL)
+			}
+		}
+		if c.HasCustomDNSResolver() {
+			dnsResolver, err := c.parseDNSResolver()
+			if err != nil {
+				// We're ignoring the error, because it should have been validated on startup ValidateAndSetDefaults.
+				// It shouldn't happen, but if it does, we'll log it... Better safe than sorry ;)
+				logr.Errorf("[client.getHTTPClient] THIS SHOULD NOT HAPPEN. Silently ignoring invalid DNS resolver due to error: %s", err.Error())
+			} else {
+				dialer := &net.Dialer{
+					Resolver: &net.Resolver{
+						PreferGo: true,
+						Dial: func(ctx context.Context, network, address string) (net.Conn, error) {
+							d := net.Dialer{}
+							return d.DialContext(ctx, dnsResolver.Protocol, dnsResolver.Host+":"+dnsResolver.Port)
+						},
+					},
+				}
+				c.httpClient.Transport.(*http.Transport).DialContext = func(ctx context.Context, network, addr string) (net.Conn, error) {
+					return dialer.DialContext(ctx, network, addr)
+				}
+			}
+		}
+		if c.HasOAuth2Config() && c.HasIAPConfig() {
+			logr.Errorf("[client.getHTTPClient] Error: Both Identity-Aware-Proxy and Oauth2 configuration are present.")
+		} else if c.HasOAuth2Config() {
+			c.httpClient = configureOAuth2(c.httpClient, *c.OAuth2Config)
+		} else if c.HasIAPConfig() {
+			c.httpClient = configureIAP(c.httpClient, *c.IAPConfig)
+		}
+	}
+	return c.httpClient
+}
+
+// validateIAPToken returns a boolean that will define if the Google identity-aware-proxy token can be fetched
+// and if is it valid.
+func validateIAPToken(ctx context.Context, c IAPConfig) bool {
+	ts, err := idtoken.NewTokenSource(ctx, c.Audience)
+	if err != nil {
+		logr.Errorf("[client.ValidateIAPToken] Claiming Identity token failed: %s", err.Error())
+		return false
+	}
+	tok, err := ts.Token()
+	if err != nil {
+		logr.Errorf("[client.ValidateIAPToken] Get Identity-Aware-Proxy token failed: %s", err.Error())
+		return false
+	}
+	_, err = idtoken.Validate(ctx, tok.AccessToken, c.Audience)
+	if err != nil {
+		logr.Errorf("[client.ValidateIAPToken] Token Validation failed: %s", err.Error())
+		return false
+	}
+	return true
+}
+
+// configureIAP returns an HTTP client that will obtain and refresh Identity-Aware-Proxy tokens as necessary.
+// The returned Client and its Transport should not be modified.
+func configureIAP(httpClient *http.Client, c IAPConfig) *http.Client {
+	ctx := context.WithValue(context.Background(), oauth2.HTTPClient, httpClient)
+	if validateIAPToken(ctx, c) {
+		ts, err := idtoken.NewTokenSource(ctx, c.Audience)
+		if err != nil {
+			logr.Errorf("[client.configureIAP] Claiming Token Source failed: %s", err.Error())
+			return httpClient
+		}
+		client := oauth2.NewClient(ctx, ts)
+		client.Timeout = httpClient.Timeout
+		return client
+	}
+	return httpClient
+}
+
+// configureOAuth2 returns an HTTP client that will obtain and refresh tokens as necessary.
+// The returned Client and its Transport should not be modified.
+func configureOAuth2(httpClient *http.Client, c OAuth2Config) *http.Client {
+	oauth2cfg := clientcredentials.Config{
+		ClientID:     c.ClientID,
+		ClientSecret: c.ClientSecret,
+		Scopes:       c.Scopes,
+		TokenURL:     c.TokenURL,
+	}
+	ctx := context.WithValue(context.Background(), oauth2.HTTPClient, httpClient)
+	client := oauth2cfg.Client(ctx)
+	client.Timeout = httpClient.Timeout
+	return client
+}
+
+// configureTLS returns a TLS Config that will enable mTLS
+func configureTLS(tlsConfig *tls.Config, c TLSConfig) *tls.Config {
+	clientTLSCert, err := tls.LoadX509KeyPair(c.CertificateFile, c.PrivateKeyFile)
+	if err != nil {
+		logr.Errorf("[client.configureTLS] Failed to load certificate: %s", err.Error())
+		return nil
+	}
+	tlsConfig.Certificates = []tls.Certificate{clientTLSCert}
+	tlsConfig.Renegotiation = tls.RenegotiateNever
+	renegotiationSupport := map[string]tls.RenegotiationSupport{
+		"once":   tls.RenegotiateOnceAsClient,
+		"freely": tls.RenegotiateFreelyAsClient,
+		"never":  tls.RenegotiateNever,
+	}
+	if val, ok := renegotiationSupport[c.RenegotiationSupport]; ok {
+		tlsConfig.Renegotiation = val
+	}
+	return tlsConfig
+}

client/config_test.go

@@ -0,0 +1,171 @@
+package client
+
+import (
+	"net/http"
+	"net/url"
+	"testing"
+	"time"
+)
+
+func TestConfig_getHTTPClient(t *testing.T) {
+	insecureConfig := &Config{Insecure: true}
+	insecureConfig.ValidateAndSetDefaults()
+	insecureClient := insecureConfig.getHTTPClient()
+	if !(insecureClient.Transport).(*http.Transport).TLSClientConfig.InsecureSkipVerify {
+		t.Error("expected Config.Insecure set to true to cause the HTTP client to skip certificate verification")
+	}
+	if insecureClient.Timeout != defaultTimeout {
+		t.Error("expected Config.Timeout to default the HTTP client to a timeout of 10s")
+	}
+	request, _ := http.NewRequest("GET", "", nil)
+	if err := insecureClient.CheckRedirect(request, nil); err != nil {
+		t.Error("expected Config.IgnoreRedirect set to false to cause the HTTP client's CheckRedirect to return nil")
+	}
+
+	secureConfig := &Config{IgnoreRedirect: true, Timeout: 5 * time.Second}
+	secureConfig.ValidateAndSetDefaults()
+	secureClient := secureConfig.getHTTPClient()
+	if (secureClient.Transport).(*http.Transport).TLSClientConfig.InsecureSkipVerify {
+		t.Error("expected Config.Insecure set to false to cause the HTTP client to not skip certificate verification")
+	}
+	if secureClient.Timeout != 5*time.Second {
+		t.Error("expected Config.Timeout to cause the HTTP client to have a timeout of 5s")
+	}
+	request, _ = http.NewRequest("GET", "", nil)
+	if err := secureClient.CheckRedirect(request, nil); err != http.ErrUseLastResponse {
+		t.Error("expected Config.IgnoreRedirect set to true to cause the HTTP client's CheckRedirect to return http.ErrUseLastResponse")
+	}
+}
+
+func TestConfig_ValidateAndSetDefaults_withCustomDNSResolver(t *testing.T) {
+	type args struct {
+		dnsResolver string
+	}
+	tests := []struct {
+		name    string
+		args    args
+		wantErr bool
+	}{
+		{
+			name: "with-valid-resolver",
+			args: args{
+				dnsResolver: "tcp://1.1.1.1:53",
+			},
+			wantErr: false,
+		},
+		{
+			name: "with-invalid-resolver-port",
+			args: args{
+				dnsResolver: "tcp://127.0.0.1:99999",
+			},
+			wantErr: true,
+		},
+		{
+			name: "with-invalid-resolver-format",
+			args: args{
+				dnsResolver: "foobar",
+			},
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := &Config{
+				DNSResolver: tt.args.dnsResolver,
+			}
+			err := cfg.ValidateAndSetDefaults()
+			if (err != nil) != tt.wantErr {
+				t.Errorf("ValidateAndSetDefaults() error=%v, wantErr=%v", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestConfig_getHTTPClient_withCustomProxyURL(t *testing.T) {
+	proxyURL := "http://proxy.example.com:8080"
+	cfg := &Config{
+		ProxyURL: proxyURL,
+	}
+	cfg.ValidateAndSetDefaults()
+	client := cfg.getHTTPClient()
+	transport := client.Transport.(*http.Transport)
+	if transport.Proxy == nil {
+		t.Errorf("expected Config.ProxyURL to set the HTTP client's proxy to %s", proxyURL)
+	}
+	req := &http.Request{
+		URL: &url.URL{
+			Scheme: "http",
+			Host:   "www.example.com",
+		},
+	}
+	expectProxyURL, err := transport.Proxy(req)
+	if err != nil {
+		t.Errorf("can't proxy the request %s", proxyURL)
+	}
+	if proxyURL != expectProxyURL.String() {
+		t.Errorf("expected Config.ProxyURL to set the HTTP client's proxy to %s", proxyURL)
+	}
+}
+
+func TestConfig_TlsIsValid(t *testing.T) {
+	tests := []struct {
+		name        string
+		cfg         *Config
+		expectedErr bool
+	}{
+		{
+			name:        "good-tls-config",
+			cfg:         &Config{TLS: &TLSConfig{CertificateFile: "../testdata/cert.pem", PrivateKeyFile: "../testdata/cert.key"}},
+			expectedErr: false,
+		},
+		{
+			name:        "missing-certificate-file",
+			cfg:         &Config{TLS: &TLSConfig{CertificateFile: "doesnotexist", PrivateKeyFile: "../testdata/cert.key"}},
+			expectedErr: true,
+		},
+		{
+			name:        "bad-certificate-file",
+			cfg:         &Config{TLS: &TLSConfig{CertificateFile: "../testdata/badcert.pem", PrivateKeyFile: "../testdata/cert.key"}},
+			expectedErr: true,
+		},
+		{
+			name:        "no-certificate-file",
+			cfg:         &Config{TLS: &TLSConfig{CertificateFile: "", PrivateKeyFile: "../testdata/cert.key"}},
+			expectedErr: true,
+		},
+		{
+			name:        "missing-private-key-file",
+			cfg:         &Config{TLS: &TLSConfig{CertificateFile: "../testdata/cert.pem", PrivateKeyFile: "doesnotexist"}},
+			expectedErr: true,
+		},
+		{
+			name:        "no-private-key-file",
+			cfg:         &Config{TLS: &TLSConfig{CertificateFile: "../testdata/cert.pem", PrivateKeyFile: ""}},
+			expectedErr: true,
+		},
+		{
+			name:        "bad-private-key-file",
+			cfg:         &Config{TLS: &TLSConfig{CertificateFile: "../testdata/cert.pem", PrivateKeyFile: "../testdata/badcert.key"}},
+			expectedErr: true,
+		},
+		{
+			name:        "bad-certificate-and-private-key-file",
+			cfg:         &Config{TLS: &TLSConfig{CertificateFile: "../testdata/badcert.pem", PrivateKeyFile: "../testdata/badcert.key"}},
+			expectedErr: true,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			err := test.cfg.TLS.isValid()
+			if (err != nil) != test.expectedErr {
+				t.Errorf("expected the existence of an error to be %v, got %v", test.expectedErr, err)
+				return
+			}
+			if !test.expectedErr {
+				if test.cfg.TLS.isValid() != nil {
+					t.Error("cfg.TLS.isValid() returned an error even though no error was expected")
+				}
+			}
+		})
+	}
+}