certstream

type CertStream struct {
	Config                      // copy of config
	C          <-chan *LogEntry // log entry channel
	HeadClient *http.Client     // main HTTP client, uses Config.HeadDialer
	TailClient *http.Client     // may be nil if not backfilling
	LogToggle  atomic.Bool      // if true, log stream activity
	// contains filtered or unexported fields
}

type Certificate struct {
	PreCert   bool
	Seen      time.Time
	Signature []byte
	*x509.Certificate
}

type Config struct {
	Logger       Logger              // if not nil Logger to use, no default
	HeadDialer   proxy.ContextDialer // dialer for following the head, defaults to &net.Dialer{}
	HeadLog      string              // log HTTP requests using the head dialer to this file
	TailDialer   proxy.ContextDialer // if not nil, backfill db using this dialer, no default
	PgUser       string              // PostgreSQL user, default "certstream"
	PgPass       string              // PostgreSQL password, default "certstream"
	PgName       string              // PostgreSQL db name, default "certstream"
	PgAddr       string              // PostgreSQL address, no default
	PgPrefix     string              // PostgreSQL naming prefix, default "certdb_"
	PgConns      int                 // max number of database connections, default 100
	PgWorkerBits int                 // number of prefix bits that determine DB workers, default 5 (32 workers)
	PgMaxAge     int                 // maximum age in days to backfill
	PgNoSSL      bool                // if true, do not use SSL
	PgSyncCommit bool                // if true, do not set synchronous_commit=off
	Concurrency  int                 // number of concurrent requests per stream, default is 4
	DataDir      string              // log and cache directory; leave empty to disable
	CacheMaxAge  time.Duration       // remove cached tile data older than this age; zero disables caching of tiles
	TailLog      string              // log HTTP requests using the tail dialer to this file
}

type JsonCertificate struct {
	PreCert        bool         `json:",omitempty"`
	Signature      hexEncoded   `json:",omitempty"` // SHA256 signature, searchable on crt.sh
	Issuer         JsonIdentity `json:",omitempty"`
	Subject        JsonIdentity `json:",omitempty"`
	CommonName     string       `json:",omitempty"` // Subject common name
	DNSNames       []string     `json:",omitempty"`
	EmailAddresses []string     `json:",omitempty"`
	IPAddresses    []string     `json:",omitempty"`
	URIs           []string     `json:",omitempty"`
	NotBefore      time.Time    `json:",omitempty"`
	NotAfter       time.Time    `json:",omitempty"`
	Since          time.Time    `json:",omitzero"`
}

type JsonIdentity struct {
	ID           int    `json:",omitempty"`
	Country      string `json:",omitempty"`
	Organization string `json:",omitempty"`
	Province     string `json:",omitempty"`
	CommonName   string `json:",omitempty"`
}

type LogEntry struct {
	*LogStream
	Err         error // error from RawLogEntryFromLeaf or ToLogEntry, or nil
	LogIndex    int64
	PreCert     bool
	Certificate *x509.Certificate
	Id          int64 // database id, if available
	Historical  bool  // true if the entry is from gap or backfilling
	Signature   []byte
	Seen        time.Time
}

type LogOperator struct {
	*CertStream
	Domain    string       // e.g. "letsencrypt.org" or "googleapis.com"
	Count     atomic.Int64 // atomic; sum of the stream's Count
	Status429 atomic.Int64 // atomic; number of 429 Too Many Requests
	Id        int32        // database ID, if available
	// contains filtered or unexported fields
}

type LogStream struct {
	*LogOperator
	Count     atomic.Int64 // number of certificates sent to the channel
	MinIndex  atomic.Int64 // atomic: lowest index seen so far, -1 if none seen yet
	MaxIndex  atomic.Int64 // atomic: highest index seen so far, -1 if none seen yet
	LastIndex atomic.Int64 // atomic: highest index that is available from stream source
	Backfill  atomic.Int64 // atomic: number of remaining entries to backfill until we reach head
	Logger    *slog.Logger // toggled by LogToggle
	Id        int32        // database ID, if available
	// contains filtered or unexported fields
}

type Logger interface {
	Info(msg string, args ...any)
	Error(msg string, args ...any)
}

type PgCertificate struct {
	Id         int64
	NotBefore  time.Time
	NotAfter   time.Time
	CommonName string
	SubjectID  int
	IssuerID   int
	Sha256     []byte
	PreCert    bool
	Since      time.Time
}

type PgDB struct {
	*CertStream
	*pgxpool.Pool
	Pfx     func(string) string // prefix replacer
	Workers atomic.Int32
	// contains filtered or unexported fields
}

type PgDnsname struct {
	Dnsname string
	CertID  int64
}

type PgDnsnamesView struct {
	CertID    int64
	FQDN      string
	NotBefore time.Time
	Idna      bool
	Valid     bool
	PreCert   bool
	Issuer    string
	Subject   string
	Crtsh     string
	Domain    string
	Tld       string
}

type PgIdent struct {
	Id           int
	Organization string
	Province     string
	Country      string
}

type PgLogEntry struct {
	Seen     time.Time // CT log entry timestamp
	LogIndex int64     // CT log index for the stream
	CertID   int64     // database ID of cert
	StreamID int32     // database ID of stream
}

type Scanner interface {
	Scan(dest ...any) error
}

type StreamError struct {
	*LogStream
	When time.Time
	Err  error
}