@celilo/e2e 0.7.14 → 0.7.16

package/src/zone-classifier.ts

@@ -0,0 +1,92 @@
+/**
+ * Zone classification for e2e network assertions (ISS-0117, §D5).
+ *
+ * Pure functions: given a resolved IPv4, say which celilo zone it belongs to (by
+ * matching the topology's `ZONE_SUBNETS`), or whether it is a reserved/special-use
+ * range, or a globally-routable "public" address. The vantage-assertion verbs
+ * (`resolveFrom` / `assertResolvesInZone`, ISS-0117 §D3) build on this to enforce
+ * e.g. "www.<domain> resolved from internalDevice must NOT be a segmented-zone
+ * container IP" — the ISS-0101 / ISS-0111 bug class.
+ *
+ * Classification uses `ZONE_SUBNETS` (exact) + a reserved-range check — deliberately
+ * NOT a blanket RFC-1918/CGNAT ban: the sim's "public" IP is a CGNAT stand-in
+ * (100.100.0.100), so in this topology 10.x / 192.168.x are *zones* and 100.x is
+ * *public*. (A real deployment would additionally treat RFC-1918 + RFC-6598 as
+ * non-public; that's the caller's policy, layered on top of this primitive.)
+ */
+
+import { type Zone, ZONE_SUBNETS } from './types';
+
+export type ZoneClass =
+  | { kind: 'zone'; zone: Zone }
+  | { kind: 'reserved'; label: string }
+  | { kind: 'public' }
+  | { kind: 'invalid' };
+
+/**
+ * Segmented zones a device on the operator's LAN (`internal`) cannot route into —
+ * traffic to them must go via the firewall natIp. `internal` IS the LAN, so it is
+ * NOT segmented (a record at an internal-zone IP is reachable).
+ */
+export const SEGMENTED_ZONES: readonly Zone[] = ['dmz', 'app', 'secure'];
+
+/**
+ * Special-use IPv4 ranges that must never be a real service address (nor appear in
+ * any DNS answer). RFC-1918 and RFC-6598 (CGNAT) are intentionally absent — in this
+ * topology the former are the managed zones and the latter is the public stand-in.
+ */
+const RESERVED: ReadonlyArray<{ cidr: string; label: string }> = [
+  { cidr: '0.0.0.0/8', label: 'unspecified/this-host (incl. the 0.0.0.0 sentinel)' },
+  { cidr: '127.0.0.0/8', label: 'loopback' },
+  { cidr: '169.254.0.0/16', label: 'link-local (RFC 3927)' },
+  { cidr: '224.0.0.0/4', label: 'multicast' },
+  { cidr: '240.0.0.0/4', label: 'reserved (RFC 1112)' },
+];
+
+/** Parse a dotted-quad IPv4 to an unsigned 32-bit int, or null if malformed. */
+export function parseIpv4(ip: string): number | null {
+  const m = ip.trim().match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (!m) return null;
+  const octets = m.slice(1, 5).map(Number);
+  if (octets.some((o) => o > 255)) return null;
+  return ((octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]) >>> 0;
+}
+
+/** True if `ip` falls within `cidr` (e.g. "10.0.10.0/24"). */
+export function inCidr(ip: string, cidr: string): boolean {
+  const [base, bitsStr] = cidr.split('/');
+  const bits = Number(bitsStr);
+  const ipN = parseIpv4(ip);
+  const baseN = parseIpv4(base);
+  if (ipN === null || baseN === null || Number.isNaN(bits) || bits < 0 || bits > 32) return false;
+  if (bits === 0) return true;
+  const mask = (0xffffffff << (32 - bits)) >>> 0;
+  return (ipN & mask) >>> 0 === ((baseN & mask) >>> 0);
+}
+
+/** Classify a resolved IPv4 against the e2e topology. */
+export function classifyIp(ip: string): ZoneClass {
+  if (parseIpv4(ip) === null) return { kind: 'invalid' };
+  for (const r of RESERVED) {
+    if (inCidr(ip, r.cidr)) return { kind: 'reserved', label: r.label };
+  }
+  for (const zone of Object.keys(ZONE_SUBNETS) as Zone[]) {
+    if (inCidr(ip, ZONE_SUBNETS[zone])) return { kind: 'zone', zone };
+  }
+  return { kind: 'public' };
+}
+
+/** True if `ip` is inside a segmented zone (dmz/app/secure) — unroutable from the LAN. */
+export function isSegmentedZoneIp(ip: string): boolean {
+  const c = classifyIp(ip);
+  return c.kind === 'zone' && SEGMENTED_ZONES.includes(c.zone);
+}
+
+/**
+ * The "no leak past the public boundary" rule (ISS-0117 §D5; CLAUDE.md inviolable
+ * rule #1): a public DNS answer must be a routable public address — never a managed
+ * zone (incl. `internal`/RFC-1918) nor a reserved range.
+ */
+export function isPublicLeakSafe(ip: string): boolean {
+  return classifyIp(ip).kind === 'public';
+}

package/config/dns/iamtheinternet.org.zone

@@ -1,16 +0,0 @@
-$ORIGIN iamtheinternet.org.
-$TTL 300
-
-@ IN SOA ns1.iamtheinternet.org. admin.iamtheinternet.org. (
-    2024020247 300 60 604800 300
-)
-
-; Public DNS — RFC 1918 addresses NEVER appear here. The whole point of
-; the e2e simulation is to model real internet connectivity, where
-; private IPs are unreachable from outside. All public-facing names
-; resolve to the firewall's external IP (100.100.0.100), which DNATs
-; inbound to the right internal host.
-@       IN NS   ns1.iamtheinternet.org.
-ns1     IN A    100.64.0.55
-@       IN A    0.0.0.0
-www     IN A    100.100.0.100

package/config/dns/templates/lunacycle.net.zone

@@ -1,16 +0,0 @@
-$ORIGIN lunacycle.net.
-$TTL 300
-
-@ IN SOA ns1.lunacycle.net. admin.lunacycle.net. (
-    2024020108 300 60 604800 300
-)
-
-; Public DNS — RFC 1918 addresses NEVER appear here. The whole point of
-; the e2e simulation is to model real internet connectivity, where
-; private IPs are unreachable from outside. All public-facing names
-; resolve to the firewall's external IP (100.100.0.100), which DNATs
-; inbound to the right internal host.
-@       IN NS   ns1.lunacycle.net.
-ns1     IN A    100.64.0.55
-@       IN A    100.100.0.100
-www     IN A    100.100.0.100