align dynet probe protocols with manifests

Author: PerishCode

crates/dynet-cli/src/cli/help.rs

@@ -18,6 +18,7 @@ Commands:
         [--log-level off|error|warn|info|debug|trace]
   probe [--root <path>] [--config <path>] [--format text|json]
         --url https://host/path | --host <host> [--port 443] [--path /]
+        [--protocol https-head|tls-handshake]
         [--inbound <tag>] [--quality-state <path>]
         [--log-level off|error|warn|info|debug|trace]
   repair [--format text|json]
@@ -47,8 +48,8 @@ Reports:
   install --check reports network ownership preflight, owned-resource scope,
   render-only desired state artifacts, and artifact validation status.
   plan compiles explicit routes into an explainable plan model.
-  probe runs an explicit dynet-observed HTTPS HEAD through route, plan,
-  outbound selection, and outbound stage tracing. probe is unprivileged by
+  probe runs an explicit dynet-observed HTTPS HEAD or TLS handshake through
+  route, plan, outbound selection, and outbound stage tracing. probe is unprivileged by
   default and does not apply the runtime socket mark. --quality-state loads an
   expiring observation snapshot for quality-aware diagnostic strategies.
   status, verify, repair, and uninstall report dynet-owned resource state.

crates/dynet-cli/src/cli/mod.rs

@@ -6,7 +6,10 @@ mod values;
 
 pub(crate) use help::help_text;
 pub(crate) use types::*;
-use values::{parse_format, parse_log_level, parse_u16, parse_u32, parse_u64, parse_usize};
+use values::{
+    parse_format, parse_log_level, parse_probe_protocol, parse_u16, parse_u32, parse_u64,
+    parse_usize,
+};
 
 #[derive(Debug, Clone, Copy, Eq, PartialEq)]
 enum CommandMode {
@@ -56,6 +59,7 @@ pub(crate) fn parse_args(args: Vec<String>) -> Result<CliCommand, String> {
     let mut probe_path = None;
     let mut probe_inbound = None;
     let mut probe_quality_state = None;
+    let mut probe_protocol = ProbeProtocol::HttpsHead;
     let mut run_max_dns_queries = None;
     let mut run_max_tun_packets = None;
     let mut run_max_tcp_sessions = None;
@@ -221,6 +225,12 @@ pub(crate) fn parse_args(args: Vec<String>) -> Result<CliCommand, String> {
                         "--quality-state requires a JSON path".to_string()
                     })?));
             }
+            "--protocol" if mode == CommandMode::Probe => {
+                let value = args
+                    .next()
+                    .ok_or_else(|| "--protocol requires https-head or tls-handshake".to_string())?;
+                probe_protocol = parse_probe_protocol(&value)?;
+            }
             "--max-dns-queries" if mode == CommandMode::Run => {
                 let value = args
                     .next()
@@ -314,6 +324,9 @@ pub(crate) fn parse_args(args: Vec<String>) -> Result<CliCommand, String> {
             other if mode == CommandMode::Probe && other.starts_with("--quality-state=") => {
                 probe_quality_state = Some(PathBuf::from(&other["--quality-state=".len()..]));
             }
+            other if mode == CommandMode::Probe && other.starts_with("--protocol=") => {
+                probe_protocol = parse_probe_protocol(&other["--protocol=".len()..])?;
+            }
             other if mode == CommandMode::Run && other.starts_with("--max-dns-queries=") => {
                 run_max_dns_queries = Some(parse_usize(
                     "--max-dns-queries",
@@ -387,6 +400,7 @@ pub(crate) fn parse_args(args: Vec<String>) -> Result<CliCommand, String> {
         }),
         CommandMode::Probe => CliCommand::Probe(ProbeOptions {
             command: options,
+            protocol: probe_protocol,
             url: probe_url,
             host: probe_host,
             port: probe_port,

crates/dynet-cli/src/cli/types.rs

@@ -67,6 +67,7 @@ pub(crate) struct RunOptions {
 #[derive(Debug, Clone, Eq, PartialEq)]
 pub(crate) struct ProbeOptions {
     pub(crate) command: CommandOptions,
+    pub(crate) protocol: ProbeProtocol,
     pub(crate) url: Option<String>,
     pub(crate) host: Option<String>,
     pub(crate) port: Option<u16>,
@@ -75,6 +76,12 @@ pub(crate) struct ProbeOptions {
     pub(crate) quality_state: Option<PathBuf>,
 }
 
+#[derive(Debug, Clone, Copy, Eq, PartialEq)]
+pub(crate) enum ProbeProtocol {
+    HttpsHead,
+    TlsHandshake,
+}
+
 #[derive(Debug, Clone, Eq, PartialEq)]
 pub(crate) struct InstallOptions {
     pub(crate) lifecycle: LifecycleOptions,

crates/dynet-cli/src/cli/values.rs

@@ -1,4 +1,4 @@
-use super::{LogLevel, OutputFormat};
+use super::{LogLevel, OutputFormat, ProbeProtocol};
 
 pub(super) fn parse_format(value: &str) -> Result<OutputFormat, String> {
     match value {
@@ -20,6 +20,14 @@ pub(super) fn parse_log_level(value: &str) -> Result<LogLevel, String> {
     }
 }
 
+pub(super) fn parse_probe_protocol(value: &str) -> Result<ProbeProtocol, String> {
+    match value {
+        "https-head" => Ok(ProbeProtocol::HttpsHead),
+        "tls-handshake" => Ok(ProbeProtocol::TlsHandshake),
+        other => Err(format!("unsupported probe protocol: {other}")),
+    }
+}
+
 pub(super) fn parse_u64(flag: &str, value: &str) -> Result<u64, String> {
     value
         .parse()

crates/dynet-cli/src/main.rs

@@ -195,12 +195,16 @@ fn run_probe_command(options: cli::ProbeOptions) -> Result<i32, String> {
     } else {
         dynet_runtime::RuntimePolicy::from_config(resolved.config)
     };
-    let report = dynet_runtime::probe_https_head(dynet_runtime::ProbeSettings {
+    let settings = dynet_runtime::ProbeSettings {
         target,
         inbound: options.inbound,
         bypass_mark,
         policy,
-    })?;
+    };
+    let report = match options.protocol {
+        cli::ProbeProtocol::HttpsHead => dynet_runtime::probe_https_head(settings),
+        cli::ProbeProtocol::TlsHandshake => dynet_runtime::probe_tls_handshake(settings),
+    }?;
     print_probe_report(&report, options.command.format)?;
     Ok(if report.status == dynet_runtime::RuntimeStatus::Pass {
         0

crates/dynet-cli/src/output/runtime.rs

@@ -62,6 +62,7 @@ pub(crate) fn text_probe_report(report: &dynet_runtime::ProbeReport) -> String {
     };
     writeln!(&mut text, "dynet probe {status}: {}", report.reason).expect("write string");
     writeln!(&mut text, "probe model: {}", report.schema).expect("write string");
+    writeln!(&mut text, "protocol: {}", report.protocol.as_str()).expect("write string");
     writeln!(
         &mut text,
         "target: https://{}:{}{}",

crates/dynet-cli/tests/unit/cli.rs

@@ -2,7 +2,7 @@ use std::path::PathBuf;
 
 use crate::cli::{
     help_text, parse_args, ApiCommand, ApiOptions, ApiServeOptions, CliCommand, InstallOptions,
-    LifecycleOptions, LogLevel, OutputFormat,
+    LifecycleOptions, LogLevel, OutputFormat, ProbeProtocol,
 };
 
 #[test]
@@ -126,6 +126,7 @@ fn parses_probe_options() {
         "--inbound=tun-in".into(),
         "--quality-state".into(),
         ".task/resources/quality.json".into(),
+        "--protocol=tls-handshake".into(),
         "--format=json".into(),
     ])
     .unwrap() else {
@@ -134,6 +135,7 @@ fn parses_probe_options() {
 
     assert_eq!(options.command.config, Some(PathBuf::from("proxy.json")));
     assert_eq!(options.command.format, OutputFormat::Json);
+    assert_eq!(options.protocol, ProbeProtocol::TlsHandshake);
     assert_eq!(options.url.as_deref(), Some("https://chatgpt.com/"));
     assert_eq!(options.inbound.as_deref(), Some("tun-in"));
     assert_eq!(

crates/dynet-cli/tests/unit/output.rs

@@ -355,6 +355,7 @@ fn probe_report_is_rendered() {
         schema: "dynet-probe/v1alpha1".to_string(),
         status: dynet_runtime::RuntimeStatus::Pass,
         reason: "HTTPS HEAD completed with HTTP 200".to_string(),
+        protocol: dynet_runtime::ProbeProtocol::HttpsHead,
         target: dynet_runtime::ProbeTarget {
             host: "example.com".to_string(),
             port: 443,
@@ -376,6 +377,7 @@ fn probe_report_is_rendered() {
 
     assert!(text.contains("dynet probe passed"));
     assert!(text.contains("probe model: dynet-probe/v1alpha1"));
+    assert!(text.contains("protocol: https-head"));
     assert!(text.contains("target: https://example.com:443/"));
     assert!(text.contains("runtime events:"));
     print_probe_report(&report, OutputFormat::Json).unwrap();

crates/dynet-runtime/src/lib.rs

@@ -141,7 +141,9 @@ use serde::Serialize;
 
 pub use dns::dns_reverse_from_wire;
 pub use event::{RuntimeEvent, RuntimeEventKind};
-pub use probe::{probe_https_head, ProbeReport, ProbeSettings, ProbeTarget};
+pub use probe::{
+    probe_https_head, probe_tls_handshake, ProbeProtocol, ProbeReport, ProbeSettings, ProbeTarget,
+};
 pub use settings::{
     DnsRuntimeChain, RunLimits, RuntimePolicy, RuntimeSettings, TakeoverSettings,
     TcpForwardingSettings, UdpForwardingSettings,

crates/dynet-runtime/src/probe/http.rs

@@ -11,30 +11,37 @@ use rustls::{ClientConfig, ClientConnection, RootCertStore, StreamOwned};
 use crate::{
     event::EventBus,
     outbound::ProxiedTcpStream,
-    probe::ProbeTarget,
+    probe::{ProbeProtocol, ProbeTarget},
     resolver::trace::{classify_runtime_error, elapsed_ms},
     RuntimeEvent, RuntimeEventKind,
 };
 
 const HTTP_HEAD_LIMIT: usize = 64 * 1024;
 
-pub(crate) struct HttpHeadResponse {
-    pub(crate) status_code: u16,
+pub(crate) struct ProbeResponse {
+    pub(crate) status_code: Option<u16>,
     pub(crate) bytes: usize,
 }
 
-pub(crate) fn execute(
+pub(crate) fn execute_with_protocol(
     ebus: &EventBus,
     outbound: &NetworkNode,
     target: &ProbeTarget,
     stream: ProxiedTcpStream,
-) -> Result<HttpHeadResponse, String> {
+    protocol: ProbeProtocol,
+) -> Result<ProbeResponse, String> {
     let mut tls = observe_stage(ebus, outbound, "tls-handshake", || {
         tls_handshake(
-            ObservedProbeStream::new(stream, ebus.clone(), outbound, "https-head"),
+            ObservedProbeStream::new(stream, ebus.clone(), outbound, protocol.as_str()),
             &target.host,
         )
     })?;
+    if protocol == ProbeProtocol::TlsHandshake {
+        return Ok(ProbeResponse {
+            status_code: None,
+            bytes: 0,
+        });
+    }
     observe_stage(ebus, outbound, "http-head-write", || {
         let request = http_head_request(target);
         tls.write_all(&request)
@@ -131,7 +138,7 @@ fn http_head_request(target: &ProbeTarget) -> Vec<u8> {
 
 fn read_http_head(
     tls: &mut StreamOwned<ClientConnection, ObservedProbeStream>,
-) -> Result<HttpHeadResponse, String> {
+) -> Result<ProbeResponse, String> {
     let mut response = Vec::new();
     let mut buffer = [0_u8; 4096];
     loop {
@@ -166,8 +173,8 @@ fn read_http_head(
         .ok_or_else(|| format!("HTTPS HEAD status line has no code: `{status_line}`"))?
         .parse::<u16>()
         .map_err(|error| format!("invalid HTTPS HEAD status line `{status_line}`: {error}"))?;
-    Ok(HttpHeadResponse {
-        status_code,
+    Ok(ProbeResponse {
+        status_code: Some(status_code),
         bytes: response.len(),
     })
 }