identify outbound clients with a contact User-Agent

c2sp.org/tlog-tiles: clients SHOULD include a way for the operator to
contact them in the User-Agent (an email and/or a +https:// URL), and
logs MAY rate-limit anonymous or unreachable clients. Skylight enforces
this — anonymous entry-bundle reads get HTTP 429.

Stamp a contact UA on everything in the repo that talks to a log or
mirror: the cactus server's mirror_push client and sign-subtree quorum
requests ("cactus (+https://github.com/mcpherrinm/cactus)") and
cactus-cli's reads. cactus-pollinate already ships with its own. The
integration stub witness now records the User-Agent it sees so the
header cannot silently regress.

Author: mcpherrinm

cert/cosigner_request.go

@@ -208,6 +208,9 @@ func requestOne(ctx context.Context, m MirrorEndpoint, body []byte, subtree *MTC
 		return MTCSignature{}, err
 	}
 	req.Header.Set("Content-Type", "text/plain; charset=utf-8")
+	// c2sp.org/tlog-tiles: clients SHOULD carry an operator contact in
+	// the User-Agent; mirrors MAY rate-limit anonymous clients.
+	req.Header.Set("User-Agent", "cactus (+https://github.com/mcpherrinm/cactus)")
 	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		return MTCSignature{}, err

cmd/cactus-cli/main.go

@@ -404,7 +404,14 @@ func certVerify(certPath, logURL string) {
 
 // httpGet fetches url and returns the body; treats 4xx/5xx as errors.
 func httpGet(url string) ([]byte, error) {
-	resp, err := http.Get(url)
+	req, err := http.NewRequest(http.MethodGet, url, nil)
+	if err != nil {
+		return nil, err
+	}
+	// c2sp.org/tlog-tiles: clients SHOULD carry a contact in the
+	// User-Agent; logs MAY rate-limit anonymous clients.
+	req.Header.Set("User-Agent", "cactus-cli (+https://github.com/mcpherrinm/cactus)")
+	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		return nil, err
 	}

cmd/cactus/main.go

@@ -51,6 +51,24 @@ import (
 	"github.com/letsencrypt/cactus/tlogx"
 )
 
+// serverUserAgent identifies the cactus server's outbound mirror
+// traffic. c2sp.org/tlog-tiles: clients SHOULD include a way for the
+// operator to contact them in the User-Agent, and logs MAY rate-limit
+// anonymous or unreachable clients.
+const serverUserAgent = "cactus (+https://github.com/mcpherrinm/cactus)"
+
+// uaTransport stamps serverUserAgent onto outgoing requests that don't
+// already carry a User-Agent.
+type uaTransport struct{ base http.RoundTripper }
+
+func (t uaTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	if req.Header.Get("User-Agent") == "" {
+		req = req.Clone(req.Context())
+		req.Header.Set("User-Agent", serverUserAgent)
+	}
+	return t.base.RoundTrip(req)
+}
+
 // caMirrorRequestsAdapter adapts a *prometheus.CounterVec to the
 // cert.CounterVec interface.
 type caMirrorRequestsAdapter struct {
@@ -120,7 +138,10 @@ func buildPushClients(
 	fsys storage.FS,
 	logger *slog.Logger,
 ) ([]*mirrorpush.Client, error) {
-	httpClient := &http.Client{Timeout: cfg.MirrorPush.RequestTimeout()}
+	httpClient := &http.Client{
+		Timeout:   cfg.MirrorPush.RequestTimeout(),
+		Transport: uaTransport{http.DefaultTransport},
+	}
 	out := make([]*mirrorpush.Client, 0, len(cfg.MirrorPush.Targets))
 	for i, t := range cfg.MirrorPush.Targets {
 		alg, err := signer.ParseAlgorithm(t.Algorithm)

integration/multi_mirror_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"net/http/httptest"
+	"strings"
 	"testing"
 	"time"
 
@@ -132,6 +133,13 @@ func TestMultiCosignerQuorum(t *testing.T) {
 			t.Errorf("witness %d served %d requests, want 1", i, n)
 		}
 	}
+	// tlog-tiles: the CA SHOULD identify itself with an operator
+	// contact in the User-Agent so mirrors can reach (and not
+	// rate-limit) it.
+	ua, _ := stubs[0].lastUA.Load().(string)
+	if !strings.Contains(ua, "+https://github.com/mcpherrinm/cactus") {
+		t.Errorf("witness saw User-Agent %q, want the cactus contact UA", ua)
+	}
 }
 
 // TestMultiCosignerQuorumNotMet: with a single witness but quorum=2,

integration/witness_helpers_test.go

@@ -62,6 +62,10 @@ type stubWitness struct {
 
 	// calls counts served requests.
 	calls atomic.Int64
+
+	// lastUA records the most recent request's User-Agent, so tests can
+	// assert the CA identifies itself per tlog-tiles.
+	lastUA atomic.Value // string
 }
 
 // newStubWitness builds a stub witness signing for logID under the
@@ -92,6 +96,7 @@ func (w *stubWitness) endpoint(url string) cert.MirrorEndpoint {
 // cert/cosigner_request.go looks for.
 func (w *stubWitness) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
 	w.calls.Add(1)
+	w.lastUA.Store(r.Header.Get("User-Agent"))
 	if w.delay > 0 {
 		time.Sleep(w.delay)
 	}