@opensecurity/zonzon-core 0.1.1 → 0.1.3

package/dist/sni-proxy.js

@@ -0,0 +1,141 @@
+import * as net from "net";
+import * as dns from "dns/promises";
+import { firewallEngine } from "./firewall.js";
+import { audit } from "./audit.js";
+export class SniProxyService {
+    port;
+    config;
+    server = null;
+    activeConnections = new Set();
+    constructor(config, port = 443) {
+        this.config = config;
+        this.port = port;
+    }
+    extractSNI(data) {
+        try {
+            if (data.length < 5 || data[0] !== 0x16 || data[5] !== 0x01) {
+                return null;
+            }
+            let offset = 43;
+            if (offset >= data.length)
+                return null;
+            const sessionIdLength = data[offset];
+            offset += 1 + sessionIdLength;
+            if (offset >= data.length)
+                return null;
+            const cipherSuitesLength = data.readUInt16BE(offset);
+            offset += 2 + cipherSuitesLength;
+            if (offset >= data.length)
+                return null;
+            const compressionMethodsLength = data[offset];
+            offset += 1 + compressionMethodsLength;
+            if (offset >= data.length)
+                return null;
+            const extensionsLength = data.readUInt16BE(offset);
+            offset += 2;
+            const extensionsEnd = offset + extensionsLength;
+            while (offset < extensionsEnd && offset + 4 <= data.length) {
+                const extType = data.readUInt16BE(offset);
+                const extLength = data.readUInt16BE(offset + 2);
+                offset += 4;
+                if (extType === 0x0000) {
+                    let sniOffset = offset;
+                    sniOffset += 2;
+                    const nameType = data[sniOffset];
+                    if (nameType === 0) {
+                        sniOffset += 1;
+                        const nameLength = data.readUInt16BE(sniOffset);
+                        sniOffset += 2;
+                        return data.toString("utf8", sniOffset, sniOffset + nameLength);
+                    }
+                }
+                offset += extLength;
+            }
+        }
+        catch {
+            return null;
+        }
+        return null;
+    }
+    async handleConnection(clientSocket) {
+        const clientIp = clientSocket.remoteAddress || "unknown";
+        let buffer = Buffer.alloc(0);
+        let isHandled = false;
+        clientSocket.on("data", async (chunk) => {
+            if (isHandled)
+                return;
+            buffer = Buffer.concat([buffer, chunk]);
+            if (buffer.length < 5)
+                return;
+            const recordLength = buffer.readUInt16BE(3);
+            if (buffer.length < 5 + recordLength)
+                return;
+            isHandled = true;
+            const sni = this.extractSNI(buffer);
+            if (!sni) {
+                audit.http(clientIp, "TLS", "UNKNOWN", ":443", 400, "Dropped: No SNI detected");
+                clientSocket.destroy();
+                return;
+            }
+            try {
+                if (firewallEngine.evaluateDomain(sni, this.config.firewall) === "DENY") {
+                    throw new Error("Domain blocked by Firewall policy");
+                }
+                const records = await dns.resolve(sni);
+                const targetIps = records.filter(ip => typeof ip === "string");
+                if (targetIps.length === 0) {
+                    throw new Error("NXDOMAIN on upstream resolution");
+                }
+                const targetIp = targetIps[0];
+                if (firewallEngine.evaluateIp(targetIp, this.config.firewall) === "DENY") {
+                    throw new Error(`Target IP ${targetIp} blocked by Firewall policy`);
+                }
+                audit.http(clientIp, "TLS-SNI", sni, ":443", 200, `Tunneled to ${targetIp}`);
+                const srvSocket = net.connect(443, targetIp, () => {
+                    srvSocket.write(buffer);
+                    clientSocket.pipe(srvSocket);
+                    srvSocket.pipe(clientSocket);
+                });
+                this.activeConnections.add(srvSocket);
+                srvSocket.on("close", () => this.activeConnections.delete(srvSocket));
+                srvSocket.on("error", (err) => {
+                    audit.error(`Upstream tunnel fault on ${sni}:443 - ${err.message}`);
+                    if (!clientSocket.destroyed)
+                        clientSocket.destroy();
+                });
+            }
+            catch (err) {
+                audit.http(clientIp, "TLS-SNI", sni, ":443", 403, `Blocked: ${err.message}`);
+                clientSocket.destroy();
+            }
+        });
+        clientSocket.on("error", (err) => {
+            audit.error(`Client tunnel fault from ${clientIp} - ${err.message}`);
+        });
+    }
+    start() {
+        return new Promise((resolve, reject) => {
+            this.server = net.createServer((socket) => {
+                this.activeConnections.add(socket);
+                socket.on("close", () => this.activeConnections.delete(socket));
+                this.handleConnection(socket);
+            });
+            this.server.on("error", (err) => reject(err));
+            this.server.listen(this.port, "0.0.0.0", () => {
+                resolve();
+            });
+        });
+    }
+    async stop() {
+        if (this.server) {
+            for (const socket of this.activeConnections) {
+                socket.destroy();
+            }
+            this.activeConnections.clear();
+            await new Promise((resolve) => {
+                this.server.close(() => resolve());
+            });
+            this.server = null;
+        }
+    }
+}

package/dist/srv-record.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/srv-record.test.js

@@ -0,0 +1,186 @@
+import { describe, it } from "node:test";
+import assert from "assert";
+import { DevDnsServer } from "./dns-service.js";
+import { DNS_TYPES, DNS_RCODE } from "./types.js";
+function buildQuery(name, type) {
+    const encoder = new (class {
+        buf = Buffer.alloc(256);
+        offset = 0;
+        writeUint16(v) {
+            this.buf.writeUInt16BE(v, this.offset);
+            this.offset += 2;
+        }
+        writeUint8(v) {
+            this.buf.writeUInt8(v, this.offset);
+            this.offset += 1;
+        }
+        writeDomainName(nm) {
+            for (const label of nm.split(".")) {
+                if (label.length === 0)
+                    continue;
+                this.writeUint8(label.length);
+                Buffer.from(label).copy(this.buf, this.offset);
+                this.offset += label.length;
+            }
+            this.writeUint8(0);
+        }
+        finish() {
+            return this.buf.subarray(0, this.offset);
+        }
+    })();
+    encoder.writeUint16(0xabcd);
+    encoder.writeUint16(0x0100);
+    encoder.writeUint16(1);
+    encoder.writeUint16(0);
+    encoder.writeUint16(0);
+    encoder.writeUint16(0);
+    encoder.writeDomainName(name);
+    encoder.writeUint16(type);
+    encoder.writeUint16(1);
+    return encoder.finish();
+}
+function parseResponseFlags(buf) {
+    const flags = buf.readUInt16BE(2);
+    const qr = (flags >> 15) & 0x1;
+    const rcode = flags & 0xf;
+    return { qr, rcode };
+}
+function getAnswerCount(buf) {
+    return buf.readUInt16BE(6);
+}
+describe("DevDnsServer - SRV Wire Format Encoding", () => {
+    let server;
+    it("returns correctly encoded SRV record with priority=10 weight=5 port=8080", () => {
+        const config = {
+            port: 53,
+            hosts: {
+                "my.service.loop": {
+                    records: [
+                        { type: "SRV", priority: 10, weight: 5, port: 8080, target: "backend.my.service.loop" },
+                    ],
+                },
+            },
+        };
+        server = new DevDnsServer(config);
+        const queryBuffer = buildQuery("my.service.loop", DNS_TYPES.SRV);
+        const response = server.resolve(queryBuffer);
+        assert.ok(response.length > 0);
+        const { qr, rcode } = parseResponseFlags(response);
+        assert.strictEqual(qr, 1);
+        assert.strictEqual(rcode, DNS_RCODE.NOERROR);
+        const ancount = getAnswerCount(response);
+        assert.strictEqual(ancount, 1);
+        assert.ok(response.length > 40);
+        const rdlen = response.readUInt16BE(20);
+        assert.ok(rdlen >= 6);
+    });
+    it("returns correctly encoded SRV record with zero priority and weight", () => {
+        const config = {
+            port: 53,
+            hosts: {
+                "zero.srv.loop": {
+                    records: [
+                        { type: "SRV", priority: 0, weight: 0, port: 443, target: "primary.zero.srv.loop" },
+                    ],
+                },
+            },
+        };
+        server = new DevDnsServer(config);
+        const response = server.resolve(buildQuery("zero.srv.loop", DNS_TYPES.SRV));
+        assert.ok(response.length > 0);
+        const ancount = getAnswerCount(response);
+        assert.strictEqual(ancount, 1);
+    });
+    it("returns multiple SRV records for same host (weighted load balancing)", () => {
+        const config = {
+            port: 53,
+            hosts: {
+                "lb.srv.loop": {
+                    records: [
+                        { type: "SRV", priority: 10, weight: 7, port: 8080, target: "server1.lb.srv.loop" },
+                        { type: "SRV", priority: 20, weight: 3, port: 8080, target: "server2.lb.srv.loop" },
+                    ],
+                },
+            },
+        };
+        server = new DevDnsServer(config);
+        const response = server.resolve(buildQuery("lb.srv.loop", DNS_TYPES.SRV));
+        assert.ok(response.length > 0);
+        const ancount = getAnswerCount(response);
+        assert.strictEqual(ancount, 2);
+    });
+    it("does not respond with A record type when host only has SRV records", () => {
+        const config = {
+            port: 53,
+            hosts: {
+                "only-srv.loop": {
+                    records: [
+                        { type: "SRV", priority: 10, weight: 5, port: 8080, target: "target.only-srv.loop" },
+                    ],
+                },
+            },
+        };
+        server = new DevDnsServer(config);
+        const response = server.resolve(buildQuery("only-srv.loop", DNS_TYPES.A));
+        assert.ok(response.length > 0);
+        assert.strictEqual(getAnswerCount(response), 0);
+        const { rcode } = parseResponseFlags(response);
+        assert.strictEqual(rcode, DNS_RCODE.NOERROR);
+    });
+    it("handles SRV with maximum port value 65535", () => {
+        const config = {
+            port: 53,
+            hosts: {
+                "maxport.srv.loop": {
+                    records: [
+                        { type: "SRV", priority: 100, weight: 200, port: 65535, target: "max.maxport.srv.loop" },
+                    ],
+                },
+            },
+        };
+        server = new DevDnsServer(config);
+        const response = server.resolve(buildQuery("maxport.srv.loop", DNS_TYPES.SRV));
+        assert.ok(response.length > 0);
+        const ancount = getAnswerCount(response);
+        assert.strictEqual(ancount, 1);
+    });
+    it("preserves query ID in SRV response", () => {
+        const config = {
+            port: 53,
+            hosts: {
+                "id.srv.loop": {
+                    records: [
+                        { type: "SRV", priority: 10, weight: 5, port: 8080, target: "target.id.srv.loop" },
+                    ],
+                },
+            },
+        };
+        const testEncoder = new (class {
+            buf = Buffer.alloc(256);
+            offset = 0;
+            writeUint16(v) { this.buf.writeUInt16BE(v, this.offset); this.offset += 2; }
+            writeUint8(v) { this.buf.writeUInt8(v, this.offset); this.offset += 1; }
+            writeDomainName(nm) { for (const label of nm.split(".")) {
+                if (label.length === 0)
+                    continue;
+                this.writeUint8(label.length);
+                Buffer.from(label).copy(this.buf, this.offset);
+                this.offset += label.length;
+            } this.writeUint8(0); }
+            finish() { return this.buf.subarray(0, this.offset); }
+        })();
+        const testId = 0xDEAD;
+        testEncoder.writeUint16(testId);
+        testEncoder.writeUint16(0x0100);
+        testEncoder.writeUint16(1);
+        testEncoder.writeUint16(0);
+        testEncoder.writeUint16(0);
+        testEncoder.writeUint16(0);
+        testEncoder.writeDomainName("id.srv.loop");
+        testEncoder.writeUint16(DNS_TYPES.SRV);
+        testEncoder.writeUint16(1);
+        server = new DevDnsServer(config);
+        const response = server.resolve(testEncoder.finish());
+        assert.strictEqual(response.readUInt16BE(0), testId);
+    });
+});

package/dist/tcp-connection-limit.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tcp-connection-limit.test.js

@@ -0,0 +1,89 @@
+import { describe, it } from "node:test";
+import assert from "assert";
+import * as net from "net";
+let PORT_BASE = 61500;
+function nextPort() {
+    return PORT_BASE++;
+}
+describe("DnsHandler - TCP Connection Limiting", () => {
+    it("rejects new connections after max is reached", async () => {
+        const port = nextPort();
+        const { DnsHandler } = await import("./dns-handler.js");
+        const { DevDnsServer } = await import("./dns-service.js");
+        const config = { port, hosts: {}, maxTcpConnections: 2, tcpIdleTimeoutMs: 30000, rateLimitMaxRequests: 0 };
+        const dnsServer = new DevDnsServer(config);
+        const handler = new DnsHandler(dnsServer, config);
+        await handler.start();
+        try {
+            await new Promise((r) => setTimeout(r, 150));
+            const sockets = [];
+            for (let i = 0; i < 2; i++) {
+                const s = net.createConnection(port, "127.0.0.1", () => { });
+                sockets.push(s);
+            }
+            await new Promise((r) => setTimeout(r, 150));
+            const thirdPromise = new Promise((resolve) => {
+                const socket = net.createConnection(port, "127.0.0.1");
+                socket.on("connect", () => {
+                    setTimeout(() => resolve(socket.destroyed), 500);
+                });
+                socket.on("error", () => resolve(true));
+            });
+            const destroyed = await thirdPromise;
+            assert.strictEqual(destroyed, true);
+            for (const s of sockets)
+                s.destroy();
+        }
+        finally {
+            await handler.stop();
+        }
+    });
+    it("admits connections when one closes (below max)", async () => {
+        const port = nextPort();
+        const { DnsHandler } = await import("./dns-handler.js");
+        const { DevDnsServer } = await import("./dns-service.js");
+        const config = { port, hosts: {}, maxTcpConnections: 2, tcpIdleTimeoutMs: 1000, rateLimitMaxRequests: 0 };
+        const dnsServer = new DevDnsServer(config);
+        const handler = new DnsHandler(dnsServer, config);
+        await handler.start();
+        try {
+            await new Promise((r) => setTimeout(r, 150));
+            const socket1 = net.createConnection(port, "127.0.0.1");
+            const socket2 = net.createConnection(port, "127.0.0.1");
+            await new Promise((r) => setTimeout(r, 150));
+            socket1.end();
+            await new Promise((r) => { socket1.on("close", r); });
+            await new Promise((r) => setTimeout(r, 200));
+            const thirdPromise = new Promise((resolve) => {
+                const socket3 = net.createConnection(port, "127.0.0.1", () => resolve(true));
+                socket3.on("error", () => resolve(false));
+                socket3.setTimeout(500);
+                socket3.on("timeout", () => { socket3.destroy(); resolve(false); });
+            });
+            const admitted = await thirdPromise;
+            assert.strictEqual(admitted, true);
+        }
+        finally {
+            await handler.stop();
+        }
+    });
+    it("closes idle connections after timeout", async () => {
+        const port = nextPort();
+        const { DnsHandler } = await import("./dns-handler.js");
+        const { DevDnsServer } = await import("./dns-service.js");
+        const config = { port, hosts: {}, maxTcpConnections: 5, tcpIdleTimeoutMs: 300, rateLimitMaxRequests: 0 };
+        const dnsServer = new DevDnsServer(config);
+        const handler = new DnsHandler(dnsServer, config);
+        await handler.start();
+        try {
+            await new Promise((r) => setTimeout(r, 150));
+            const socket = net.createConnection(port, "127.0.0.1");
+            await new Promise((r) => socket.on("connect", () => r()));
+            await new Promise((r) => setTimeout(r, 800));
+            assert.strictEqual(socket.destroyed, true);
+        }
+        finally {
+            await handler.stop();
+        }
+    });
+});

package/dist/types.d.ts

@@ -0,0 +1,145 @@
+export interface ARecord {
+    type: "A";
+    address: string;
+}
+export interface AAAARecord {
+    type: "AAAA";
+    address: string;
+}
+export interface CNAME {
+    type: "CNAME";
+    target: string;
+}
+export interface TXT {
+    type: "TXT";
+    data: string[];
+}
+export interface MX {
+    type: "MX";
+    priority: number;
+    exchange: string;
+}
+export interface NS {
+    type: "NS";
+    target: string;
+}
+export interface SRV {
+    type: "SRV";
+    priority: number;
+    weight: number;
+    port: number;
+    target: string;
+}
+export interface PTR {
+    type: "PTR";
+    target: string;
+}
+export type DnsRecord = ARecord | AAAARecord | CNAME | TXT | MX | NS | SRV | PTR;
+export interface HttpProxyConfig {
+    enabled: boolean;
+    upstream?: string;
+    headers: Record<string, string>;
+    forwardRequestBody?: boolean;
+    maxRequestBodyBytes?: number;
+}
+export interface RedirectConfig {
+    enabled: boolean;
+    code: number;
+    target: string;
+}
+export interface HostConfig {
+    records: DnsRecord[];
+    http_proxy?: HttpProxyConfig;
+    redirect?: RedirectConfig;
+}
+export interface FirewallConfig {
+    defaultPolicy: "allow" | "deny";
+    allowlist_domains?: string[];
+    blocklist_domains?: string[];
+    allowlist_ranges?: string[];
+    blocklist_ranges?: string[];
+    allowlist_ips?: string[];
+    blocklist_ips?: string[];
+}
+export interface ControlPlaneConfig {
+    enabled?: boolean;
+    port?: number;
+    apiKey?: string;
+}
+export interface ServerConfig {
+    port: number;
+    fallbackDns?: string;
+    firewall?: FirewallConfig;
+    controlPlane?: ControlPlaneConfig;
+    dnsCacheMaxSize?: number;
+    dnsCacheTtlMs?: number;
+    maxTcpConnections?: number;
+    tcpIdleTimeoutMs?: number;
+    rateLimitMaxRequests?: number;
+    rateLimitWindowMs?: number;
+    hosts: Record<string, HostConfig>;
+}
+export interface DnsQuestion {
+    name: string;
+    type: number;
+    class: number;
+}
+export interface DnsResponseHeader {
+    id: number;
+    flags: number;
+    qdcount: number;
+    ancount: number;
+    nscount: number;
+    arcount: number;
+}
+export interface DnsQuestionSection {
+    questions: DnsQuestion[];
+    additional?: string;
+}
+export interface ProxiedRequest {
+    hostname: string;
+    originalUrl: string;
+    headers: Record<string, string>;
+    method: string;
+    body?: Buffer;
+}
+export interface ModifiedHeaders {
+    upstreamHeaders: Record<string, string>;
+    clientResponseHeaders: Record<string, string>;
+}
+export declare const DNS_CLASSES: {
+    IN: number;
+};
+export declare const DNS_TYPES: {
+    readonly A: 1;
+    readonly NS: 2;
+    readonly CNAME: 5;
+    readonly SOA: 6;
+    readonly MX: 15;
+    readonly TXT: 16;
+    readonly PTR: 12;
+    readonly AAAA: 28;
+    readonly SRV: 33;
+};
+export declare const DNS_OPCODE: {
+    QUERY: number;
+    IQUERY: number;
+    STATUS: number;
+};
+export declare const DNS_RCODE: {
+    NOERROR: number;
+    FORMERR: number;
+    SERVFAIL: number;
+    NXDOMAIN: number;
+    NOTIMP: number;
+    REFUSED: number;
+};
+export declare const RESPONSE_FLAGS: {
+    QR: number;
+    AA: number;
+    TC: number;
+    RD: number;
+    RA: number;
+};
+export declare const MAX_DNS_PACKET_SIZE = 512;
+export declare const MAX_TXT_RECORD_LENGTH = 255;

package/dist/types.js

@@ -0,0 +1,34 @@
+export const DNS_CLASSES = { IN: 1 };
+export const DNS_TYPES = {
+    A: 1,
+    NS: 2,
+    CNAME: 5,
+    SOA: 6,
+    MX: 15,
+    TXT: 16,
+    PTR: 12,
+    AAAA: 28,
+    SRV: 33,
+};
+export const DNS_OPCODE = {
+    QUERY: 0,
+    IQUERY: 1,
+    STATUS: 2,
+};
+export const DNS_RCODE = {
+    NOERROR: 0,
+    FORMERR: 1,
+    SERVFAIL: 2,
+    NXDOMAIN: 3,
+    NOTIMP: 4,
+    REFUSED: 5,
+};
+export const RESPONSE_FLAGS = {
+    QR: (1 << 15),
+    AA: (1 << 10),
+    TC: (1 << 9),
+    RD: (1 << 8),
+    RA: (1 << 7),
+};
+export const MAX_DNS_PACKET_SIZE = 512;
+export const MAX_TXT_RECORD_LENGTH = 255;

package/dist/wildcard-matching.test.d.ts

@@ -0,0 +1 @@
+export {};