@blinklabs/dingo 0.85.0 → 0.88.0

package/README.md

@@ -8,7 +8,7 @@
   <a href="https://discord.gg/5fPRZnX4qW"><img src="https://img.shields.io/badge/Discord-7289DA?style=flat&logo=discord&logoColor=white" alt="Discord"></a>
 </div>
 
-> ⚠️ **WARNING: Dingo is under heavy active development and is not yet ready for mainnet block production use. It should only be used on testnets (preview, preprod, musashi) and devnets. Do not use Dingo on mainnet for block production with real funds.**
+> ⚠️ **WARNING: Dingo is under heavy active development and is not yet ready for mainnet block production use. It should only be used on testnets (preview, preprod, musashi, dijkstra) and devnets. Do not use Dingo on mainnet for block production with real funds.**
 
 Dingo is Blink Labs' Cardano node implementation in Go. It implements the
 Ouroboros networking and consensus protocols, validates ledger state, and

package/npm/checksums.json

@@ -1,8 +1,8 @@
 {
-  "dingo-v0.85.0-darwin-amd64.tar.gz": "270c3751a34f24e2a8cd5fb93112dce6af60ef02c12e4064f4f9c2cfa6151cfe",
-  "dingo-v0.85.0-darwin-arm64.tar.gz": "b77938960005799c108464e62a8384c99fc9d7df74f1ecf63a61660585759c1c",
-  "dingo-v0.85.0-freebsd-amd64.tar.gz": "1cafd0d142b0c95236814f57ecc58cfca75eac8242121ac55bc7288ec0390db3",
-  "dingo-v0.85.0-freebsd-arm64.tar.gz": "2ea82ef8ac5945417726d5c9c9e068dbafb7361444147bba327ceca455d54bd2",
-  "dingo-v0.85.0-linux-amd64.tar.gz": "e3b14ae3d05e4b8dd3eda1f869f8fabdf2214f61a1fc185df54f4e7272c7f34d",
-  "dingo-v0.85.0-linux-arm64.tar.gz": "b7d45e45b7a2809f2e4d671a978c1697b1c17e53e785166b6875867c81714657"
+  "dingo-v0.88.0-darwin-amd64.tar.gz": "79d7415714c60bbeef7d2c5fb7c97de9b7d99c97abad25298df7d2a3dde53aa8",
+  "dingo-v0.88.0-darwin-arm64.tar.gz": "11b33bd6ab0f67ef14f1a8c2856b57856561d0ca8d70bc9e3ee1130a2df32e6c",
+  "dingo-v0.88.0-freebsd-amd64.tar.gz": "b88d9fb5cdcdac7ae85c5486ab2260feec966235d6cd75e0ceb646e32c066d9e",
+  "dingo-v0.88.0-freebsd-arm64.tar.gz": "a5f44c93a95a8bcb244d3ca93211d19975dbf359c59c29fa05bebe9a1035418c",
+  "dingo-v0.88.0-linux-amd64.tar.gz": "06113229e0d2eb3c222dec1e4b2be07ab8313857cbbc7e1c568a19c001329cb1",
+  "dingo-v0.88.0-linux-arm64.tar.gz": "b8cfe72c8cf75173155e9975597800df6098fe1607e45578c52b641f69e04a81"
 }

package/npm/install.js

@@ -13,9 +13,11 @@
 'use strict';
 
 const crypto = require('node:crypto');
+const dns = require('node:dns');
 const fs = require('node:fs');
 const fsp = require('node:fs/promises');
 const https = require('node:https');
+const net = require('node:net');
 const os = require('node:os');
 const path = require('node:path');
 const { spawn } = require('node:child_process');
@@ -25,6 +27,97 @@ const { pipeline } = require('node:stream/promises');
 const MAX_ARCHIVE_BYTES = 256 * 1024 * 1024;
 const MAX_BINARY_BYTES = 512 * 1024 * 1024;
 const RETRY_DELAYS_MS = [100, 500];
+const RELEASE_HOSTS = new Set([
+  'github.com',
+  'github-releases.githubusercontent.com',
+  'objects.githubusercontent.com',
+  'release-assets.githubusercontent.com',
+]);
+
+// The two families are kept in separate lists because a Node BlockList matches
+// every IPv4 address against an IPv6 rule covering ::ffff:0:0/96, which would
+// reject all IPv4 answers. IPv4-mapped IPv6 answers are unmapped instead and
+// checked against the IPv4 rules.
+const blockedIPv4 = new net.BlockList();
+for (const [network, prefix] of [
+  ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8],
+  ['169.254.0.0', 16], ['172.16.0.0', 12], ['192.0.0.0', 24], ['192.0.2.0', 24],
+  ['192.88.99.0', 24], ['192.168.0.0', 16], ['198.18.0.0', 15],
+  ['198.51.100.0', 24], ['203.0.113.0', 24], ['224.0.0.0', 4], ['240.0.0.0', 4],
+]) blockedIPv4.addSubnet(network, prefix, 'ipv4');
+const blockedIPv6 = new net.BlockList();
+for (const [network, prefix] of [
+  ['::', 128], ['::1', 128], ['64:ff9b::', 96], ['64:ff9b:1::', 48],
+  ['100::', 64], ['2001:2::', 48], ['2001:db8::', 32], ['2001:10::', 28],
+  ['fc00::', 7], ['fe80::', 10], ['ff00::', 8],
+]) blockedIPv6.addSubnet(network, prefix, 'ipv6');
+
+function mappedIPv4(address) {
+  let host;
+  try {
+    // URL serialization canonicalizes every IPv6 spelling to compressed hex.
+    host = new URL(`http://[${address}]`).hostname;
+  } catch {
+    return null;
+  }
+  const match = /^\[::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})\]$/.exec(host);
+  if (!match) return null;
+  const high = parseInt(match[1], 16);
+  const low = parseInt(match[2], 16);
+  return `${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`;
+}
+
+function disallowedAddress(address) {
+  try {
+    if (net.isIPv4(address)) return blockedIPv4.check(address, 'ipv4');
+    if (!net.isIPv6(address)) return true;
+    const ipv4 = mappedIPv4(address);
+    if (ipv4) return blockedIPv4.check(ipv4, 'ipv4');
+    return blockedIPv6.check(address, 'ipv6');
+  } catch {
+    return true;
+  }
+}
+
+function validateReleaseURL(parsed) {
+  if (parsed.protocol !== 'https:') {
+    throw new Error('Dingo release downloads require HTTPS');
+  }
+  if (parsed.username || parsed.password || (parsed.port && parsed.port !== '443')) {
+    throw new Error('Dingo release download URL is not allowed');
+  }
+  if (!RELEASE_HOSTS.has(parsed.hostname.toLowerCase())) {
+    throw new Error('Dingo release download host is not allowed');
+  }
+}
+
+function publicLookup(hostname, options, callback) {
+  const lookupOptions = typeof options === 'object' ? options : {};
+  dns.lookup(hostname, {
+    family: lookupOptions.family,
+    hints: lookupOptions.hints,
+    all: true,
+    verbatim: true,
+  }, (error, addresses) => {
+    if (error) {
+      callback(error);
+      return;
+    }
+    if (addresses.length === 0 || addresses.some(({ address }) => disallowedAddress(address))) {
+      callback(new Error('Dingo release host resolved to a disallowed address'));
+      return;
+    }
+    if (lookupOptions.all) {
+      callback(null, addresses);
+      return;
+    }
+    callback(null, addresses[0].address, addresses[0].family);
+  });
+}
+
+function secureGet(url, callback) {
+  return https.get(url, { lookup: publicLookup }, callback);
+}
 
 function releaseTarget(version, platform = process.platform, arch = process.arch) {
   const targets = {
@@ -64,9 +157,12 @@ function byteLimit(maxBytes, description) {
 
 function downloadOnce(url, destination, get, redirects, maxBytes) {
   return new Promise((resolve, reject) => {
-    const parsed = new URL(url);
-    if (parsed.protocol !== 'https:') {
-      reject(new Error('Dingo release downloads require HTTPS'));
+    let parsed;
+    try {
+      parsed = new URL(url);
+      validateReleaseURL(parsed);
+    } catch (error) {
+      reject(error);
       return;
     }
     const request = get(parsed, (response) => {
@@ -109,7 +205,7 @@ function downloadOnce(url, destination, get, redirects, maxBytes) {
   });
 }
 
-async function download(url, destination, get = https.get, options = {}) {
+async function download(url, destination, get = secureGet, options = {}) {
   const delays = options.retryDelays ?? RETRY_DELAYS_MS;
   const wait = options.wait ?? ((milliseconds) => new Promise((resolve) => {
     setTimeout(resolve, milliseconds);
@@ -208,4 +304,4 @@ async function install(packageRoot, options = {}) {
   }
 }
 
-module.exports = { binaryPath, download, install, releaseURL };
+module.exports = { binaryPath, download, install, publicLookup, releaseURL };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blinklabs/dingo",
-  "version": "0.85.0",
+  "version": "0.88.0",
   "description": "Dingo is a Cardano blockchain data node",
   "bin": {
     "dingo": "npm/bin/dingo.js"