@blamejs/core 0.15.15 → 0.15.17

package/lib/middleware/api-encrypt.js

@@ -223,12 +223,39 @@ function _validSid(sid) {
          SID_RE.test(sid);
 }
 
-function _writeRejection(res, code, body) {
+// _writeRejection — emit a protocol-level rejection body.
+//
+// On an ESTABLISHED per-session encrypted channel the rejection MUST
+// travel inside the session envelope, exactly like a successful
+// response: a client on a keyed channel that sends a stale / replayed /
+// malformed request would otherwise learn, in cleartext, which check
+// failed over an otherwise-encrypted channel. The middleware stamps
+// `req.apiEncryptRejectEncode` the moment a session is resolved with a
+// valid session key; when present, the body is wrapped through the same
+// response-encryption path successful responses use. Absent it (a
+// pre-session handshake error, where no session context exists yet, or
+// per-request mode) the body falls back to plaintext.
+function _writeRejection(req, res, code, body, opts) {
   if (res.headersSent || res.writableEnded) return;
-  if (typeof res.writeHead === "function") {
-    res.writeHead(code, { "Content-Type": "application/json" });
-    res.end(JSON.stringify(body));
+  if (typeof res.writeHead !== "function") return;
+  var out = body;
+  // opts.plaintext forces a cleartext body even on an established channel.
+  // Used for the generic "encrypted-payload-rejected" refusals that DO NOT
+  // delete the session (the monotonic-counter replay and the atomic-claim
+  // loss): riding those on the session envelope would emit a response _ctr
+  // the client tracks as consumed, but those paths return before the
+  // server persists responsesEmitted — so the next genuine response reuses
+  // that _ctr and the client refuses it as a replay, bricking the session.
+  // The body is already generic (no session-lifecycle reason leaks the way
+  // session-expired / rotation-required would), so plaintext here costs no
+  // meaningful confidentiality.
+  var encode = (!opts || !opts.plaintext) && req && req.apiEncryptRejectEncode;
+  if (typeof encode === "function") {
+    try { out = encode(body); }
+    catch (_e) { out = body; }  // encryption failed → fall back to plaintext rather than hang
   }
+  res.writeHead(code, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(out));
 }
 
 // ---- Server-side middleware ----
@@ -458,6 +485,26 @@ function create(opts) {
     return encrypted;
   }
 
+  // _installRejectEncoder — stamp req with a function that wraps a
+  // protocol-level rejection body in the SAME session envelope a
+  // successful response uses, so an error emitted on an established
+  // per-session encrypted channel does not leak (in cleartext) which
+  // check the request tripped. Called the moment a session is resolved
+  // with a valid session key, BEFORE the expiry / rotation / replay
+  // gates that fire on a keyed channel. The rejection rides a fresh
+  // response counter (sid bound, strictly above the session's last
+  // emitted response) so the client's monotonic _ctr check still holds.
+  // The session-deleting rejections (expired / rotation) and the
+  // post-claim tag-mismatch ride this encoder; the two generic surviving
+  // rejections (monotonic-counter replay, atomic-claim loss) opt out via
+  // _writeRejection({ plaintext: true }) because they return before the
+  // consumed counter is persisted — see _writeRejection.
+  function _installRejectEncoder(req, sessionKey, sid, responseCtr) {
+    req.apiEncryptRejectEncode = function (body) {
+      return _encodeEnvelope(body, sessionKey, { sid: sid, responseCtr: responseCtr });
+    };
+  }
+
   // _wrapResJson — install res.json that encrypts the response with the
   // session key. In per-request mode the response is `{ _ct }`; in
   // per-session mode it carries `{ _ct, _sid, _ctr }` so the client can
@@ -507,18 +554,18 @@ function create(opts) {
     var body = req.body;
     if (!body || typeof body !== "object") {
       _emitFailure(req, "shape");
-      return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
+      return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
     }
 
     var now = Date.now();
     var ct = body._ct, ts = body._ts;
     if (typeof ct !== "string" || typeof ts !== "number") {
       _emitFailure(req, "shape");
-      return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
+      return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
     }
     if (Math.abs(now - ts) > replayWindowMs) {
       _emitFailure(req, "stale");
-      return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-rejected" });
+      return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-rejected" });
     }
 
     // Per-request OR per-session bootstrap path: shape includes _ek + _nonce.
@@ -540,25 +587,25 @@ function create(opts) {
       try { freshNonce = await store.checkAndInsert(nonceHash, expireAt); }
       catch (_e) {
         _emitFailure(req, "nonce-store-error");
-        return _writeRejection(res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: "nonce-store-unavailable" });
+        return _writeRejection(req, res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: "nonce-store-unavailable" });
       }
       if (!freshNonce) {
         _emitFailure(req, "replay");
-        return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-rejected" });
+        return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-rejected" });
       }
       sessionKey = _decryptEkToSessionKey(ek);
       if (!sessionKey) {
         _emitFailure(req, "tag");
-        return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-rejected" });
+        return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-rejected" });
       }
       if (keying === "per-session") {
         if (!_validSid(sid)) {
           _emitFailure(req, "shape");
-          return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
+          return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
         }
         if (!numericBounds.isNonNegativeFiniteInt(ctr)) {
           _emitFailure(req, "shape");
-          return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
+          return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
         }
         // Bootstrap a new session row keyed by sid. responsesEmitted is
         // set to 1 (this bootstrap emits one response) BEFORE the store
@@ -579,7 +626,7 @@ function create(opts) {
         try { await sessionStore.set(sid, session, { ttlMs: sessionTtlMs }); }
         catch (_e) {
           _emitFailure(req, "session-store-error");
-          return _writeRejection(res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: "session-store-unavailable" });
+          return _writeRejection(req, res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: "session-store-unavailable" });
         }
         _emitObs("apiEncrypt.session.created", 1, { mode: "per-session" });
         _emitSessionAudit("apiEncrypt.session.created", {
@@ -588,28 +635,56 @@ function create(opts) {
           requestId: req.requestId || null,
         });
         sessionCtx = { sid: sid, responseCtr: 1 };
+        // Session now established — a post-bootstrap rejection (e.g. the
+        // final decrypt below) rides the session envelope under the same
+        // counter the success response would have used.
+        _installRejectEncoder(req, sessionKey, sid, 1);
       }
     } else if (keying === "per-session" &&
                typeof sid === "string" && typeof ctr === "number") {
       // ---- Per-session subsequent-request path ----
       if (!_validSid(sid)) {
         _emitFailure(req, "shape");
-        return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
+        return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
       }
       if (!numericBounds.isNonNegativeFiniteInt(ctr)) {
         _emitFailure(req, "shape");
-        return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
+        return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
       }
       try { session = await sessionStore.get(sid); }
       catch (_e) {
         _emitFailure(req, "session-store-error");
-        return _writeRejection(res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: "session-store-unavailable" });
+        return _writeRejection(req, res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: "session-store-unavailable" });
       }
       if (!session) {
         _emitObs("apiEncrypt.session.unknown", 1, {});
         _emitFailure(req, "session-unknown");
-        return _writeRejection(res, HTTP_STATUS.UNAUTHORIZED, { error: "session-unknown" });
+        return _writeRejection(req, res, HTTP_STATUS.UNAUTHORIZED, { error: "session-unknown" });
+      }
+      // Recover + coerce the session key BEFORE the expiry / rotation /
+      // replay gates so a rejection on this established channel can ride
+      // the session envelope (the channel is keyed the moment the sid
+      // resolves to a stored session, even if THIS request is then
+      // refused). An operator store may have JSON-serialised the buffer.
+      sessionKey = session.sessionKey;
+      if (Buffer.isBuffer(sessionKey) === false) {
+        if (typeof sessionKey === "string") {
+          sessionKey = Buffer.from(sessionKey, "base64");
+        } else if (sessionKey && sessionKey.type === "Buffer" && Array.isArray(sessionKey.data)) {
+          sessionKey = Buffer.from(sessionKey.data);
+        } else if (sessionKey instanceof Uint8Array) {
+          sessionKey = Buffer.from(sessionKey);
+        }
+      }
+      if (!Buffer.isBuffer(sessionKey) || sessionKey.length !== SESSION_KEY_BYTES) {
+        sessionKey = null;
+        _emitFailure(req, "session-store-error");
+        return _writeRejection(req, res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: "session-store-unavailable" });
       }
+      // From here the channel is established: error bodies encrypt. The
+      // rejection counter sits one above the session's last emitted
+      // response so the client's strictly-increasing _ctr check holds.
+      _installRejectEncoder(req, sessionKey, sid, session.responsesEmitted + 1);
       if (now > session.expiresAt) {
         try { await sessionStore.delete(sid); } catch (_e) { /* best-effort */ }
         _emitObs("apiEncrypt.session.expired", 1, {});
@@ -620,7 +695,7 @@ function create(opts) {
           requestId: req.requestId || null,
         });
         _emitFailure(req, "session-expired");
-        return _writeRejection(res, HTTP_STATUS.UNAUTHORIZED, { error: "session-expired" });
+        return _writeRejection(req, res, HTTP_STATUS.UNAUTHORIZED, { error: "session-expired" });
       }
       if (session.responsesEmitted >= sessionMaxResponses) {
         try { await sessionStore.delete(sid); } catch (_e) { /* best-effort */ }
@@ -632,7 +707,7 @@ function create(opts) {
           requestId: req.requestId || null,
         });
         _emitFailure(req, "session-rotation-required");
-        return _writeRejection(res, HTTP_STATUS.UNAUTHORIZED, { error: "session-rotation-required" });
+        return _writeRejection(req, res, HTTP_STATUS.UNAUTHORIZED, { error: "session-rotation-required" });
       }
       // Replay defense: counter MUST strictly increase.
       if (ctr <= session.lastReqCtr) {
@@ -644,7 +719,10 @@ function create(opts) {
           requestId: req.requestId || null,
         });
         _emitFailure(req, "counter-replay");
-        return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-rejected" });
+        // Plaintext: this path does not persist a consumed response counter
+        // (see _writeRejection). Keeping it cleartext avoids desyncing the
+        // session's response-counter sequence.
+        return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-rejected" }, { plaintext: true });
       }
       // Atomic replay gate (CWE-367). The monotonic counter check above is
       // an ordering fast-path only: on a clustered session store, get(sid)
@@ -674,7 +752,7 @@ function create(opts) {
       try { ctrFresh = await store.checkAndInsert(ctrKey, session.expiresAt); }
       catch (_e) {
         _emitFailure(req, "nonce-store-error");
-        return _writeRejection(res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: "nonce-store-unavailable" });
+        return _writeRejection(req, res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: "nonce-store-unavailable" });
       }
       if (!ctrFresh) {
         _emitObs("apiEncrypt.session.replay_rejected", 1, { lane: "atomic" });
@@ -685,23 +763,10 @@ function create(opts) {
           requestId: req.requestId || null,
         });
         _emitFailure(req, "counter-replay");
-        return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-rejected" });
-      }
-      sessionKey = session.sessionKey;
-      if (Buffer.isBuffer(sessionKey) === false) {
-        // Operator-supplied store may have JSON-serialised the buffer.
-        // Accept hex / base64 / Uint8Array and coerce.
-        if (typeof sessionKey === "string") {
-          sessionKey = Buffer.from(sessionKey, "base64");
-        } else if (sessionKey && sessionKey.type === "Buffer" && Array.isArray(sessionKey.data)) {
-          sessionKey = Buffer.from(sessionKey.data);
-        } else if (sessionKey instanceof Uint8Array) {
-          sessionKey = Buffer.from(sessionKey);
-        }
-      }
-      if (!Buffer.isBuffer(sessionKey) || sessionKey.length !== SESSION_KEY_BYTES) {
-        _emitFailure(req, "session-store-error");
-        return _writeRejection(res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: "session-store-unavailable" });
+        // Plaintext for the same reason as the monotonic-replay path above:
+        // the atomic-claim loser returns before responsesEmitted is persisted,
+        // so encrypting it would consume a response _ctr the server never records.
+        return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-rejected" }, { plaintext: true });
       }
       session.lastReqCtr = ctr;
       session.lastUsedAt = now;
@@ -711,7 +776,7 @@ function create(opts) {
       sessionCtx = { sid: sid, responseCtr: session.responsesEmitted };
     } else {
       _emitFailure(req, "shape");
-      return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
+      return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
     }
 
     // Decrypt _ct → cleartext payload bytes → JSON object. The request
@@ -726,7 +791,7 @@ function create(opts) {
       clearObj = safeJson.parse(ptBuf.toString("utf8"), { maxBytes: maxDecryptedBytes });
     } catch (_e) {
       _emitFailure(req, "tag");
-      return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-rejected" });
+      return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-rejected" });
     }
 
     // Replace req.body with cleartext, stash session key for any
@@ -1086,8 +1151,12 @@ function httpClientEncrypted(opts) {
     headers["Content-Type"] = "application/json";
 
     var passThrough = {};
-    var passable = ["allowedProtocols", "allowInternal", "idleTimeoutMs", "maxResponseBytes",
-                    "agent", "errorClass"];
+    // timeoutMs (overall wall-clock cap) and signal (caller cancellation) are
+    // forwarded alongside idleTimeoutMs: without the wall-clock cap a peer that
+    // trickles bytes within the idle window holds the encrypted call open
+    // indefinitely (the plain request path already accepts both).
+    var passable = ["allowedProtocols", "allowInternal", "timeoutMs", "idleTimeoutMs",
+                    "maxResponseBytes", "signal", "agent", "errorClass"];
     for (var i = 0; i < passable.length; i++) {
       if (reqOpts[passable[i]] !== undefined) passThrough[passable[i]] = reqOpts[passable[i]];
     }

package/lib/network-dns-resolver.js

@@ -112,6 +112,7 @@ var networkDns         = require("./network-dns");
 var safeDns            = require("./safe-dns");
 var safeUrl            = require("./safe-url");
 var safeBuffer         = require("./safe-buffer");
+var safeAsync          = require("./safe-async");
 var lazyRequire        = require("./lazy-require");
 
 var audit              = lazyRequire(function () { return require("./audit"); });
@@ -126,6 +127,14 @@ var DEFAULT_MAX_TTL_MS    = C.TIME.hours(24);
 var DEFAULT_MIN_TTL_MS    = C.TIME.seconds(60);
 var DEFAULT_STALE_WINDOW  = C.TIME.hours(6);
 var DEFAULT_PROFILE       = "strict";
+// CWE-400. Per-query wall-clock deadline on the upstream transport
+// lookup. A non-responsive / slow / stalling DoH endpoint (or a
+// transport that sends headers then never ends the body) must not hold
+// the await pending forever — every query() and every followCnames hop
+// is bounded by this, and the default _wireLookup additionally tears
+// the socket down (req.setTimeout) so the fd is released, not just the
+// promise rejected. 10s matches a generous DoH round-trip ceiling.
+var DEFAULT_TIMEOUT_MS    = C.TIME.seconds(10);
 // CWE-400/770. Bound the cache so a hostile peer
 // that can drive query-name selection (e.g. inbound SMTP forwarding
 // DKIM `s=` / `d=` tag-controlled lookups) cannot inflate the Map to
@@ -168,6 +177,7 @@ var QTYPE_BY_NAME = Object.freeze({
  *   maxTtlMs:    number,           // cap any TTL from upstream; default 24h
  *   minTtlMs:    number,           // floor short-TTL records; default 60s
  *   serveStale:  number | false,   // ms to retain expired entries; default 6h
+ *   timeoutMs:   number,           // per-query upstream deadline; default 10s
  *   transport:   { lookup(name, qtype) → Promise<Buffer> },   // operator override
  *   audit:       b.audit namespace,
  *
@@ -187,7 +197,12 @@ function create(opts) {
   var minTtlMs    = typeof opts.minTtlMs === "number" ? opts.minTtlMs : DEFAULT_MIN_TTL_MS;
   var serveStale  = opts.serveStale === false ? 0 :
                     typeof opts.serveStale === "number" ? opts.serveStale : DEFAULT_STALE_WINDOW;
-  var transport   = opts.transport || _defaultTransport();
+  var timeoutMs   = typeof opts.timeoutMs === "number" ? opts.timeoutMs : DEFAULT_TIMEOUT_MS;
+  if (!isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new ResolverError("resolver/bad-input",
+      "create: timeoutMs must be a positive finite number");
+  }
+  var transport   = opts.transport || _defaultTransport(timeoutMs);
   // Audit goes to the operator-supplied sink (opts.audit) when present, else the
   // framework chain — b.audit.namespaced no-ops if the sink has no safeEmit.
   var _baseAudit  = audit().namespaced("network.dns.resolver", { sink: opts.audit });
@@ -276,10 +291,18 @@ function create(opts) {
       return _result(hit.parsed, hit.ttl, true, false, hit.validated);
     }
 
-    // Cache miss / expired — fetch from upstream.
+    // Cache miss / expired — fetch from upstream, bounded by the
+    // per-query wall-clock deadline. withTimeout rejects the await so a
+    // non-responsive / stalling endpoint can't hold the request pending
+    // forever; the default _wireLookup also tears the socket down on its
+    // own req.setTimeout so the underlying fd is released.
     var wireResponse;
     try {
-      wireResponse = await transport.lookup(name, qtype);
+      wireResponse = await safeAsync.withTimeout(
+        Promise.resolve(transport.lookup(name, qtype)),
+        timeoutMs,
+        { name: "dns-resolver:" + name + "/" + qtype }
+      );
     } catch (e) {
       // Upstream failure — serve stale if we have it within window.
       if (hit && serveStale > 0 && hit.staleUntil > now) {
@@ -425,13 +448,13 @@ function create(opts) {
   };
 }
 
-function _defaultTransport() {
+function _defaultTransport(timeoutMs) {
   // Default transport — compose b.network.dns.useDnsOverHttps()'s
   // existing DoH path. We use the wire-format DoH endpoint directly
   // so the response arrives as raw bytes for safeDns parsing.
   return {
     lookup: function (name, qtype) {
-      return _wireLookup(name, qtype);
+      return _wireLookup(name, qtype, timeoutMs);
     },
   };
 }
@@ -440,7 +463,9 @@ function _defaultTransport() {
 // existing DoH path. Returns the raw response bytes for safeDns to
 // parse. Distinct from the existing network-dns DoH path which returns
 // already-decoded address strings — we need the raw bytes here.
-async function _wireLookup(name, qtype) {
+async function _wireLookup(name, qtype, timeoutMs) {
+  var ms = typeof timeoutMs === "number" && isFinite(timeoutMs) && timeoutMs > 0
+    ? timeoutMs : DEFAULT_TIMEOUT_MS;
   var url = networkDns._getDohUrlForTest ? networkDns._getDohUrlForTest() : "https://cloudflare-dns.com/dns-query";
   // Encode a wire-format query for the target qtype.
   var qbuf = _encodeWireQuery(name, qtype);
@@ -448,6 +473,18 @@ async function _wireLookup(name, qtype) {
   var getUrl = url + (url.indexOf("?") === -1 ? "?" : "&") + "dns=" + b64;
   var u = safeUrl.parse(getUrl, { allowedProtocols: safeUrl.ALLOW_HTTP_TLS });
   return new Promise(function (resolve, reject) {
+    var settled = false;
+    function _fail(err) {
+      if (settled) return;
+      settled = true;
+      try { req.destroy(); } catch (_e) { /* best-effort socket teardown */ }
+      reject(err);
+    }
+    function _done(buf) {
+      if (settled) return;
+      settled = true;
+      resolve(buf);
+    }
     // Raw DoH wire-format request — bypasses b.httpClient envelope
     // because we need the raw binary response bytes for safeDns to
     // parse (httpClient assumes JSON/text shapes).
@@ -470,18 +507,31 @@ async function _wireLookup(name, qtype) {
       res.on("data", function (c) { if (!pushFailed) { try { collector.push(c); } catch (e) { pushFailed = e; } } });
       res.on("end", function () {
         try {
-          if (pushFailed) { reject(pushFailed); return; }
+          if (pushFailed) { _fail(pushFailed); return; }
           if (res.statusCode !== 200) {                                                                  // HTTP 200 OK
-            reject(new ResolverError("resolver/upstream-http",
+            _fail(new ResolverError("resolver/upstream-http",
               "DoH HTTP " + res.statusCode + " for " + name));
             return;
           }
-          resolve(collector.result());
-        } catch (e) { reject(e); }
+          _done(collector.result());
+        } catch (e) { _fail(e); }
       });
     });
+    // Wall-clock / idle deadline — a DoH endpoint that accepts the
+    // connection, sends 200 headers, then never ends the body would
+    // otherwise hold the socket (and its fd) open indefinitely. setTimeout
+    // arms on socket inactivity; on fire we tear the socket down AND reject
+    // so neither the promise nor the fd leaks (CWE-400 slowloris-style).
+    req.setTimeout(ms, function () {
+      _fail(new ResolverError("resolver/upstream-timeout",
+        "DoH request to " + u.hostname + " for " + name + " exceeded " + ms + "ms"));
+    });
+    req.on("timeout", function () {
+      _fail(new ResolverError("resolver/upstream-timeout",
+        "DoH request to " + u.hostname + " for " + name + " exceeded " + ms + "ms"));
+    });
     req.on("error", function (e) {
-      reject(new ResolverError("resolver/upstream-failed",
+      _fail(new ResolverError("resolver/upstream-failed",
         "DoH request failed: " + e.message));
     });
     req.end();

package/lib/network-dns.js

@@ -28,11 +28,18 @@ var HEX_RADIX        = C.BYTES.bytes(16);   // parseInt / toString radix-16
 var observability = lazyRequire(function () { return require("./observability"); });
 var safeEnv = require("./parsers/safe-env");
 
+// Default wall-clock deadline for every lookup (resolve / DoH / DoT /
+// system). Without a non-zero default a header-then-stall or
+// slow-trickle upstream hangs the request forever (CWE-400). 10s
+// matches the resolver's default. Operators override via
+// setLookupTimeoutMs(); 0 disables the deadline (operator opt-out).
+var DEFAULT_LOOKUP_TIMEOUT_MS = C.TIME.seconds(10);
+
 var STATE = {
   servers:        null,
   resultOrder:    null,
   family:         0,
-  lookupTimeoutMs: 0,
+  lookupTimeoutMs: DEFAULT_LOOKUP_TIMEOUT_MS,
   cacheTtlMs:     0,
   cacheNegativeTtlMs: 0,
   doh:            null,
@@ -285,6 +292,19 @@ function _withTimeout(promise, ms, host) {
   });
 }
 
+// Arm a wall-clock deadline on a raw https.request so a stalled upstream
+// (headers-then-stall, slow-trickle body) tears the socket down instead
+// of leaking the fd until the process exits. The promise-level
+// _withTimeout rejects the caller, but only this destroys the underlying
+// connection. No-op when the operator has disabled the deadline (ms<=0).
+function _armRequestTimeout(req, ms, host, reject) {
+  if (ms <= 0) return;
+  req.setTimeout(ms, function () {
+    try { req.destroy(); } catch (_e) { /* best-effort socket teardown */ }
+    reject(new DnsError("dns/lookup-timeout", "dns lookup of '" + host + "' exceeded " + ms + "ms"));
+  });
+}
+
 function _encodeDnsQuery(host, qtype) {
   var parts = host.split(".").filter(Boolean);
   var nameLen = 1;
@@ -450,6 +470,7 @@ async function _dohLookup(host, family) {
       });
     });
     req.on("error", function (e) { reject(new DnsError("dns/doh-failed", "DoH request failed: " + e.message)); });
+    _armRequestTimeout(req, STATE.lookupTimeoutMs, host, reject);
     if (usePost) req.write(enc.buf);
     req.end();
   });
@@ -511,6 +532,7 @@ async function _dohLookupSecure(host, family) {
       });
     });
     req.on("error", function (e) { reject(new DnsError("dns/doh-failed", "DoH request failed: " + e.message)); });
+    _armRequestTimeout(req, STATE.lookupTimeoutMs, host, reject);
     if (usePost) req.write(enc.buf);
     req.end();
   });
@@ -591,6 +613,17 @@ function _dotConnect() {
   // when idle — _dotLookup toggles this around its query. Calling
   // unref() unconditionally here let node exit during a normal lookup
   // when no other I/O kept the event loop alive.
+  //
+  // Wall-clock teardown: a stalled handshake or trickle-response upstream
+  // would otherwise leak the socket until the process exits (CWE-400).
+  // On inactivity past the deadline destroy the socket — the pool's
+  // error/close handlers evict it and the next lookup rebuilds. No-op
+  // when the operator has disabled the deadline (lookupTimeoutMs<=0).
+  if (STATE.lookupTimeoutMs > 0) {
+    sock.setTimeout(STATE.lookupTimeoutMs, function () {
+      try { sock.destroy(); } catch (_e) { /* best-effort socket teardown */ }
+    });
+  }
   return sock;
 }
 
@@ -865,6 +898,7 @@ async function _dohRawQuery(host, qtype) {
       });
     });
     req.on("error", function (e) { reject(new DnsError("dns/doh-failed", "DoH request failed: " + e.message)); });
+    _armRequestTimeout(req, STATE.lookupTimeoutMs, host, reject);
     if (usePost) req.write(enc.buf);
     req.end();
   });
@@ -979,6 +1013,17 @@ async function _systemRawQuery(host, qtype) {
       try { sock.destroy(); } catch (_e) { /* best-effort socket teardown */ }
       if (err) reject(err); else resolve(val);
     }
+    // Wall-clock teardown: a server that accepts the TCP connection but
+    // never replies (or trickles the length-prefix) would otherwise hang
+    // the query forever (CWE-400). On inactivity past the deadline
+    // settle()'s destroy() tears the socket down. No-op when the operator
+    // has disabled the deadline (lookupTimeoutMs<=0).
+    if (STATE.lookupTimeoutMs > 0) {
+      sock.setTimeout(STATE.lookupTimeoutMs, function () {
+        settle(new DnsError("dns/lookup-timeout",
+          "system DNS TCP query of '" + host + "' exceeded " + STATE.lookupTimeoutMs + "ms"));
+      });
+    }
     sock.on("connect", function () {
       var lenBuf = Buffer.alloc(2);
       lenBuf.writeUInt16BE(enc.buf.length, 0);
@@ -1684,7 +1729,7 @@ function nodeLookup(host, options, callback) {
 function _stateForTest() { return STATE; }
 function _resetForTest() {
   STATE.servers = null; STATE.resultOrder = null; STATE.family = 0;
-  STATE.lookupTimeoutMs = 0; STATE.cacheTtlMs = 0; STATE.cacheNegativeTtlMs = 0;
+  STATE.lookupTimeoutMs = DEFAULT_LOOKUP_TIMEOUT_MS; STATE.cacheTtlMs = 0; STATE.cacheNegativeTtlMs = 0;
   STATE.doh = null; STATE.dot = null; STATE.systemResolver = false;
   _designatedResolvers = null;
   _clearCache();

package/lib/network-nts.js

@@ -7,12 +7,20 @@ var nodeCrypto = require("node:crypto");
 var C = require("./constants");
 var { timingSafeEqual } = require("./crypto");
 var validateOpts = require("./validate-opts");
+var safeBuffer = require("./safe-buffer");
 var { defineClass } = require("./framework-error");
 
 var NtsError = defineClass("NtsError", { alwaysPermanent: false });
 
 var NTS_KE_DEFAULT_PORT = 4460;
 var NTPV4_DEFAULT_PORT  = 123;
+// Upper bound on accumulated NTS-KE handshake bytes before a REC_END
+// record terminates the exchange. A conformant NTS-KE response is a few
+// hundred bytes (RFC 8915 §4); 64 KiB is generous. Without this ceiling
+// a malicious or buggy server that streams non-END records fast enough
+// OOMs the process before the wall-clock timer fires (it bounds time,
+// not memory). Mirrors the ws-client handshake header cap.
+var NTS_KE_HANDSHAKE_MAX_BYTES = C.BYTES.kib(64);
 // RFC 5905 §6 — seconds between 1900-01-01T00:00Z (NTP epoch) and
 // 1970-01-01T00:00Z (Unix epoch). Protocol-fixed (not a tunable).
 var NTP_TO_UNIX_OFFSET_SECONDS = 2208988800;
@@ -284,6 +292,14 @@ function performKeHandshake(opts) {
     var warnings = [];
     sock.on("data", function (chunk) {
       got = Buffer.concat([got, chunk]);
+      if (safeBuffer.byteLengthOf(got) > NTS_KE_HANDSHAKE_MAX_BYTES) {
+        clearTimeout(timer);
+        try { sock.destroy(); } catch (_e) { /* best-effort socket teardown */ }
+        done(new NtsError("nts/ke-too-large",
+          "NTS-KE handshake exceeded " + NTS_KE_HANDSHAKE_MAX_BYTES +
+          " bytes before a REC_END record"));
+        return;
+      }
       try {
         var records = _decodeRecords(got);
         var endRec = records.find(function (r) { return r.type === REC_END; });