Function ProbeSNI

scanner/sni.go:112–156

ProbeSNI runs a single TLS handshake attempt against cfg.TargetIP using sni as the SNI. Returns a classified Result; Err is always non-empty for non-OK outcomes and always empty for OK.

(ctx context.Context, sni string, cfg ProbeConfig)

// sni as the SNI. Returns a classified Result; Err is always non-empty for
// non-OK outcomes and always empty for OK.
func ProbeSNI(ctx context.Context, sni string, cfg ProbeConfig) Result {
	cfg.defaults()

	host := sni
	if cfg.TargetIP.IsValid() {
		host = cfg.TargetIP.String()
	}
	addr := net.JoinHostPort(host, fmt.Sprintf("%d", cfg.TargetPort))

	r := Result{SNI: sni, TargetIP: cfg.TargetIP}

	// Stage 1: TCP connect.
	dialCtx, cancel := context.WithTimeout(ctx, cfg.ConnectTimeout)
	defer cancel()
	start := time.Now()
	conn, err := (&net.Dialer{}).DialContext(dialCtx, "tcp", addr)
	r.RTT = time.Since(start)
	if err != nil {
		r.Outcome, r.Err = classifyDialErr(err)
		return r
	}
	defer conn.Close()

	// Stage 2: TLS ClientHello. We deliberately use InsecureSkipVerify so
	// cert mismatches (e.g. TargetIP != sni host) don't count against the
	// SNI — we only care whether the handshake *reached* a server response.
	tlsConf := &tls.Config{
		ServerName:         sni,
		InsecureSkipVerify: true,
		NextProtos:         []string{"h2", "http/1.1"},
	}
	hsCtx, hsCancel := context.WithTimeout(ctx, cfg.HandshakeTimeout)
	defer hsCancel()

	tlsConn := tls.Client(conn, tlsConf)
	hsStart := time.Now()
	err = tlsConn.HandshakeContext(hsCtx)
	r.Handshake = time.Since(hsStart) + r.RTT
	if err != nil {
		r.Outcome, r.Err = classifyTLSErr(err)
		return r
	}
	r.Outcome = OutcomeOK
	return r
}

// ProbeSNIs runs ProbeSNI for every sni in the slice concurrently bounded
// by cfg.Concurrency. Results are returned in the same order as input.