Network + TLS diagnostics

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

sudo emisar pack install network-tls --hash sha256:987555fcc983a2627c2ade20a0dea9ff8db669e1d27e5928137a1cfc420a84ee

Setup

Probes the remote host, endpoint, or domain you pass as an action argument (host:port / name / URL) from the runner — no host-side credentials, but the runner needs outbound network reach to the target.

sudo install -d -m 0755 /etc/systemd/system/emisar.service.d
printf '%s\n' '[Service]' 'AmbientCapabilities=CAP_NET_RAW' | sudo tee /etc/systemd/system/emisar.service.d/10-network-tls-host-access.conf >/dev/null
sudo systemctl daemon-reload
sudo systemctl restart emisar

systemctl show emisar --property=AmbientCapabilities --value | grep -Fwi cap_net_raw

sudo emisar pack verify network-tls

Install and configure a pack walks through the whole sequence on a host.

• net.dig_dnssec exec low Low — read-only or trivially reversible

  dig +dnssec (DNSSEC validation)

  Issue a DNSSEC-validating query. Returns RRSIG records and the AD (authenticated-data) flag if validation succeeded.

  View source on GitHub
• net.dig_record exec low Low — read-only or trivially reversible

  dig (DNS lookup)

  `dig +short <type> <name> @<resolver>` — look up one DNS record. Type defaults to A; specify AAAA, MX, NS, TXT, CNAME, SRV. Resolver defaults to system default.

  View source on GitHub
• net.dig_reverse exec low Low — read-only or trivially reversible

  dig -x (reverse DNS)

  Look up the reverse PTR record for an IPv4 or IPv6 address (`dig -x <ip>`).

  View source on GitHub
• net.dig_trace exec low Low — read-only or trivially reversible

  dig +trace (full delegation chain)

  Trace the DNS delegation chain from the root to the authoritative server (`dig +trace`). Use to debug "the wrong nameservers are answering."

  View source on GitHub
• net.http_headers exec low Low — read-only or trivially reversible

  HTTP response headers (curl -I)

  Dump response headers from a URL, following redirects. Use to confirm cache-control / hsts / set-cookie / cors setup. Set insecure=true to skip TLS verification for an internal or self-signed certificate.

  View source on GitHub
• net.http_probe exec low Low — read-only or trivially reversible

  HTTP probe with timing

  Probe a URL with curl, returning HTTP status, DNS / TCP / TLS / total timings, and bytes transferred. Use as a synthetic check. Set insecure=true to skip TLS verification when the endpoint serves an internal or self-signed certificate (otherwise such a probe reports http_code=000). HTTP 4xx and 5xx responses are successful probe executions: the status is the evidence, not a reason to repeat the same request. A DNS, connection, or TLS failure exits unsuccessfully with curl's diagnostic; do not retry it unchanged unless the target may have recovered.

  View source on GitHub
• net.ipinfo_lookup exec low Low — read-only or trivially reversible

  ipinfo (geo + ASN for an IP)

  Look up an IP at ipinfo.io. Returns city/region/country/org/asn. Outbound HTTP to ipinfo.io required.

  View source on GitHub
• net.ping_extended exec low Low — read-only or trivially reversible

  ping (with count + timeout)

  Send N ICMP echo requests with explicit per-probe timeout. Needs CAP_NET_RAW on the runner identity where the host does not open `net.ipv4.ping_group_range`: ping ships setuid or file-capability elevation, and the runner's `no_new_privs` blocks both, so grant the capability from this pack's setup before enabling the action.

  View source on GitHub
• net.tcp_probe script low Low — read-only or trivially reversible

  Probe one TCP port

  Attempt one bounded TCP connection from the runner to a host and port. A successful handshake proves TCP reachability only; it does not validate an application protocol, TLS, authentication, or service health.

  View source on GitHub
• net.tls_cert_expiry script low Low — read-only or trivially reversible

  TLS cert expiry probe

  Connect to host:port with SNI and show certificate subject, issuer, notBefore, and notAfter. Connection, DNS, plaintext, and handshake failures retain the OpenSSL diagnostic instead of being reported as a certificate parse error. Use for "when does this cert expire?" alerts.

  View source on GitHub
• net.tls_chain_dump exec low Low — read-only or trivially reversible

  TLS chain dump

  Dump the full certificate chain a server returns. Use to debug "browsers see incomplete chain" errors.

  View source on GitHub
• net.tls_protocol_check script low Low — read-only or trivially reversible

  TLS protocol support check

  Probe TLS 1.0/1.1/1.2/1.3 support on host:port one at a time, reporting which versions the server accepts. Use for compliance audits ("is TLS 1.0 still on?"). Fails outright when the target cannot be reached, and reports a version this runner's OpenSSL cannot offer as UNSUPPORTED-BY-CLIENT rather than REFUSED. Runs with OPENSSL_CONF=/dev/null so the host's system MinProtocol floor (TLSv1.2 on Debian) doesn't pre-fail the 1.0/1.1 probes — each result reflects the server, not the client.

  View source on GitHub
• net.traceroute_mtr exec low Low — read-only or trivially reversible

  mtr report (route + loss statistics)

  Trace the network path to a host with per-hop packet loss and latency (`mtr --report`, 5 cycles) — the combined traceroute + ping report. Needs CAP_NET_RAW on the runner identity: mtr ships setuid or file-capability elevation, and the runner's `no_new_privs` blocks both, so grant the capability from this pack's setup before enabling the action.

  View source on GitHub
• net.whois_summary exec low Low — read-only or trivially reversible

  whois (registrar + expiry)

  Show filtered whois output — registrar, dates, name servers. Use to check "is this domain about to expire?"

  View source on GitHub