feat(netprobe): HTTP/DoH probes v2 — success criteria, TLS cert expiry, headers/proxy/mTLS - #793

Merged

leoparente merged 14 commits into

feat/netprobe-v2

Jul 20, 2026

Commits on Jul 19, 2026

feat(netprobe): content_failures, tls_cert_expiry_epoch_sec, response_size_bytes metrics
leoparente
committed
test(netprobe): v2 e2e — headers/auth, status sets, body checks, POST body, redaction; docs
leoparente
committed
fix(netprobe): redact tap-config secrets via an input-plugin hook (GET /api/v1/taps echoed raw headers/proxy/body)
leoparente
committed
fix(netprobe): don't classify content checks against a truncated body; configurable body_check_max_bytes
leoparente
committed
fix(http): reject oversized status-code entries before narrowing (stoul wrap could accept them as an in-range code)
leoparente
committed
fix(netprobe): keep newest window's tls_cert_expiry on merge, not max (max suppressed alerts after cert downgrade)
leoparente
committed
build: bump libcurl 8.20.0->8.21.0, libnghttp2 1.61.0->1.68.1
leoparente
committed
fix(http): redact proxy value + embedded credentials from curl error_msg (probes log it on transport failure)
leoparente
committed
fix(netprobe): don't follow redirects when a probe carries custom headers (libcurl re-sends them cross-host, leaking secret headers)
leoparente
committed
fix(netprobe): also disable redirects for body-bearing probes (307/308 resends the payload to the redirect target)
leoparente
committed