@celilo/cli 0.20.0 → 0.21.0

package/src/services/public-dns-probe.ts

@@ -0,0 +1,156 @@
+/**
+ * The off-fleet vantage point for the `public_dns` check.
+ *
+ * Two independent third parties, deliberately:
+ *
+ *  - a **resolver that is not the fleet's**, asked what the internet resolves
+ *    for each name. The fleet's own resolver runs split-horizon and answers
+ *    with an address that is reachable in-zone — correct for its purpose, and
+ *    not evidence about the public internet. A `public_dns` check that quietly
+ *    used it would pass forever, which is the original defect one layer up, so
+ *    `assertOffFleetResolver` refuses rather than trusting a code comment.
+ *  - an **echo service**, for what the fleet's public ingress address actually
+ *    is. Not the registrar's response: comparing what was published against
+ *    what we asked to publish is self-agreement, and Namecheap answers
+ *    `ErrCount 0` for updates it does not apply (design.md D2/D3).
+ *
+ * Both are configurable, and both are named in every finding they produce.
+ */
+
+import { Resolver } from 'node:dns/promises';
+import { eq } from 'drizzle-orm';
+import type { DbClient } from '../db/client';
+import { systemConfig } from '../db/schema';
+import type { IngressObservation, PublicDnsProbe, PublicResolution } from './audit/public-dns';
+
+/** Cloudflare. Overridable — the requirement is that it is not the fleet's. */
+export const DEFAULT_PUBLIC_RESOLVER = '1.1.1.1';
+export const DEFAULT_ECHO_URL = 'https://api.ipify.org';
+
+const PROBE_TIMEOUT_MS = 5_000;
+
+export class FleetResolverAsPublicVantageError extends Error {
+  constructor(resolver: string, role: string) {
+    super(
+      `Refusing to check public DNS through ${resolver}: it is the fleet's own resolver (${role}).\nThe fleet resolver runs split-horizon and answers with an in-zone address, so a\ncheck that used it would pass whatever the internet sees — which is exactly how\ncelilo#626 stayed invisible for nine days.\n\nSet an off-fleet resolver:\n  celilo system config set public_dns.resolver 1.1.1.1`,
+    );
+    this.name = 'FleetResolverAsPublicVantageError';
+  }
+}
+
+/**
+ * Reject a resolver the fleet itself uses. Pure so the gate is unit-testable
+ * without a database — it is the assertion §5.2 asks for.
+ */
+export function assertOffFleetResolver(
+  resolver: string,
+  fleetResolvers: { role: string; ip: string }[],
+): void {
+  const match = fleetResolvers.find((r) => r.ip === resolver);
+  if (match) throw new FleetResolverAsPublicVantageError(resolver, match.role);
+}
+
+function configValue(db: DbClient, key: string): string | undefined {
+  const row = db.select().from(systemConfig).where(eq(systemConfig.key, key)).get();
+  const value = row?.value?.trim();
+  return value && value.length > 0 ? value : undefined;
+}
+
+/**
+ * Every resolver address the fleet is configured to use for its own lookups.
+ *
+ * `dns.fallback` holds a COMMA-SEPARATED list (`1.0.0.1,8.8.8.8` is what
+ * `system init` writes), so it is split rather than compared whole. Treating it
+ * as one string made the guard below miss every fallback but a single-entry
+ * one — a fleet forwarding to 8.8.8.8 could have been handed 8.8.8.8 as its
+ * "off-fleet" vantage point and the check would have agreed with itself
+ * forever, which is precisely the failure this guard exists to prevent.
+ */
+export function fleetResolvers(db: DbClient): { role: string; ip: string }[] {
+  return parseFleetResolvers(
+    ['dns.primary', 'dns.fallback'].map((role) => ({ role, value: configValue(db, role) })),
+  );
+}
+
+/** The parse, split from the read so the comma handling is testable on its own. */
+export function parseFleetResolvers(
+  entries: { role: string; value: string | undefined }[],
+): { role: string; ip: string }[] {
+  const resolvers: { role: string; ip: string }[] = [];
+  for (const { role, value } of entries) {
+    for (const ip of (value ?? '').split(',')) {
+      const trimmed = ip.trim();
+      if (trimmed) resolvers.push({ role, ip: trimmed });
+    }
+  }
+  return resolvers;
+}
+
+export interface PublicDnsProbeSettings {
+  resolver: string;
+  echoUrl: string;
+}
+
+export function loadPublicDnsProbeSettings(db: DbClient): PublicDnsProbeSettings {
+  const resolver = configValue(db, 'public_dns.resolver') ?? DEFAULT_PUBLIC_RESOLVER;
+  assertOffFleetResolver(resolver, fleetResolvers(db));
+  return { resolver, echoUrl: configValue(db, 'public_dns.echo_url') ?? DEFAULT_ECHO_URL };
+}
+
+/**
+ * `fetch` with a bound, so an unanswered echo request cannot hang a scheduled
+ * check (the shape celilo#622 fixed for DDNS).
+ */
+async function fetchIngress(echoUrl: string): Promise<IngressObservation> {
+  try {
+    const response = await fetch(echoUrl, {
+      signal: AbortSignal.timeout(PROBE_TIMEOUT_MS),
+    });
+    if (!response.ok) {
+      return { kind: 'undetermined', reason: `HTTP ${response.status}` };
+    }
+    const ip = (await response.text()).trim();
+    if (!/^\d{1,3}(\.\d{1,3}){3}$/.test(ip)) {
+      return { kind: 'undetermined', reason: `unparseable answer: ${ip.slice(0, 40)}` };
+    }
+    return { kind: 'observed', ip };
+  } catch (error) {
+    return {
+      kind: 'undetermined',
+      reason: error instanceof Error ? error.message : String(error),
+    };
+  }
+}
+
+export function createPublicDnsProbe(settings: PublicDnsProbeSettings): PublicDnsProbe {
+  const resolver = new Resolver({ timeout: PROBE_TIMEOUT_MS, tries: 2 });
+  resolver.setServers([settings.resolver]);
+
+  return {
+    resolver: settings.resolver,
+    echoService: settings.echoUrl,
+
+    observeIngress: () => fetchIngress(settings.echoUrl),
+
+    async resolve(fqdn: string): Promise<PublicResolution> {
+      try {
+        // `ttl: true` is why this uses node:dns rather than shelling out to
+        // dig: the TTL is what the hysteresis window is measured in.
+        const answers = await resolver.resolve4(fqdn, { ttl: true });
+        const first = answers[0];
+        if (!first) return { kind: 'no_record' };
+        return { kind: 'answer', ip: first.address, ttlSeconds: first.ttl };
+      } catch (error) {
+        const code = (error as NodeJS.ErrnoException).code;
+        // NXDOMAIN / NODATA are authoritative answers: the name really has no
+        // A record. Everything else (timeout, SERVFAIL, refused) means the
+        // probe could not look, which is never a pass.
+        if (code === 'ENOTFOUND' || code === 'ENODATA') return { kind: 'no_record' };
+        return {
+          kind: 'undetermined',
+          reason: code ?? (error instanceof Error ? error.message : String(error)),
+        };
+      }
+    },
+  };
+}

package/src/services/update/orchestrator.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, test } from 'bun:test';
 import type { DbClient } from '../../db/client';
 import type { ModuleManifest } from '../../manifest/schema';
 import type { AuditDeps } from '../audit';
+import { unusedPublicDnsProbe } from '../audit/public-dns';
 import { buildModuleGraph } from './dep-graph';
 import {
   type ModuleSnapshot,
@@ -85,6 +86,7 @@ const cleanAudit: AuditDeps = {
   machinesReachable: { results: [] },
   transportReads: { statuses: [], now: new Date(), staleAfterMs: 30 * 60_000 },
   trustedSources: { firewalls: [] },
+  publicDns: { records: [], probe: unusedPublicDnsProbe },
 };
 
 describe('consumerSkipReason', () => {