@opensecurity/zonzon-core 0.1.1 → 0.1.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/audit.d.ts +10 -0
- package/dist/audit.js +39 -0
- package/dist/cache-layer.test.d.ts +1 -0
- package/dist/cache-layer.test.js +205 -0
- package/dist/cache-multi-question.test.d.ts +1 -0
- package/dist/cache-multi-question.test.js +187 -0
- package/dist/dns-handler.d.ts +27 -0
- package/dist/dns-handler.js +323 -0
- package/dist/dns-service.d.ts +45 -0
- package/dist/dns-service.js +546 -0
- package/dist/dns-service.test.d.ts +1 -0
- package/dist/dns-service.test.js +306 -0
- package/dist/dns-wireformat.test.d.ts +1 -0
- package/dist/dns-wireformat.test.js +669 -0
- package/dist/firewall.d.ts +9 -0
- package/dist/firewall.js +62 -0
- package/dist/http-body-forwarding-integration.test.d.ts +1 -0
- package/dist/http-body-forwarding-integration.test.js +318 -0
- package/dist/http-body-forwarding.test.d.ts +1 -0
- package/dist/http-body-forwarding.test.js +84 -0
- package/dist/http-handler.d.ts +21 -0
- package/dist/http-handler.js +429 -0
- package/dist/http-proxy.d.ts +14 -0
- package/dist/http-proxy.js +135 -0
- package/dist/http-proxy.test.d.ts +1 -0
- package/dist/http-proxy.test.js +375 -0
- package/{src/index.ts → dist/index.d.ts} +1 -1
- package/dist/index.js +10 -0
- package/dist/rate-limiter.d.ts +11 -0
- package/dist/rate-limiter.js +33 -0
- package/dist/rate-limiter.test.d.ts +1 -0
- package/dist/rate-limiter.test.js +149 -0
- package/dist/schema.d.ts +12 -0
- package/dist/schema.js +124 -0
- package/dist/schema.test.d.ts +1 -0
- package/dist/schema.test.js +586 -0
- package/dist/sni-proxy.d.ts +12 -0
- package/dist/sni-proxy.js +141 -0
- package/dist/srv-record.test.d.ts +1 -0
- package/dist/srv-record.test.js +186 -0
- package/dist/tcp-connection-limit.test.d.ts +1 -0
- package/dist/tcp-connection-limit.test.js +89 -0
- package/dist/types.d.ts +145 -0
- package/dist/types.js +34 -0
- package/dist/wildcard-matching.test.d.ts +1 -0
- package/dist/wildcard-matching.test.js +162 -0
- package/package.json +4 -1
- package/src/audit.ts +0 -43
- package/src/cache-layer.test.ts +0 -236
- package/src/cache-multi-question.test.ts +0 -263
- package/src/dns-handler.ts +0 -355
- package/src/dns-service.test.ts +0 -371
- package/src/dns-service.ts +0 -655
- package/src/dns-wireformat.test.ts +0 -771
- package/src/env.d.ts +0 -1
- package/src/firewall.ts +0 -66
- package/src/http-body-forwarding-integration.test.ts +0 -357
- package/src/http-body-forwarding.test.ts +0 -101
- package/src/http-handler.ts +0 -489
- package/src/http-proxy.test.ts +0 -440
- package/src/http-proxy.ts +0 -148
- package/src/rate-limiter.test.ts +0 -144
- package/src/rate-limiter.ts +0 -50
- package/src/schema.test.ts +0 -685
- package/src/schema.ts +0 -137
- package/src/sni-proxy.ts +0 -164
- package/src/srv-record.test.ts +0 -211
- package/src/tcp-connection-limit.test.ts +0 -110
- package/src/types.ts +0 -168
- package/src/wildcard-matching.test.ts +0 -196
- package/tsconfig.json +0 -9
package/src/dns-service.test.ts
DELETED
|
@@ -1,371 +0,0 @@
|
|
|
1
|
-
import { describe, it } from "node:test";
|
|
2
|
-
import assert from "assert";
|
|
3
|
-
import { DevDnsServer } from "./dns-service.js";
|
|
4
|
-
import { ServerConfig, DNS_TYPES, DNS_RCODE } from "./types.js";
|
|
5
|
-
|
|
6
|
-
function buildQuery(name: string, type: number): Buffer {
|
|
7
|
-
const encoder = new (class {
|
|
8
|
-
buf = Buffer.alloc(256);
|
|
9
|
-
offset = 0;
|
|
10
|
-
|
|
11
|
-
writeUint16(v: number) {
|
|
12
|
-
this.buf.writeUInt16BE(v, this.offset);
|
|
13
|
-
this.offset += 2;
|
|
14
|
-
}
|
|
15
|
-
|
|
16
|
-
writeUint8(v: number) {
|
|
17
|
-
this.buf.writeUInt8(v, this.offset);
|
|
18
|
-
this.offset += 1;
|
|
19
|
-
}
|
|
20
|
-
|
|
21
|
-
writeDomainName(name: string) {
|
|
22
|
-
for (const label of name.split(".")) {
|
|
23
|
-
if (label.length === 0) continue;
|
|
24
|
-
this.writeUint8(label.length);
|
|
25
|
-
Buffer.from(label).copy(this.buf, this.offset);
|
|
26
|
-
this.offset += label.length;
|
|
27
|
-
}
|
|
28
|
-
this.writeUint8(0);
|
|
29
|
-
}
|
|
30
|
-
|
|
31
|
-
finish(): Buffer {
|
|
32
|
-
return this.buf.subarray(0, this.offset);
|
|
33
|
-
}
|
|
34
|
-
})();
|
|
35
|
-
|
|
36
|
-
encoder.writeUint16(0x1234);
|
|
37
|
-
encoder.writeUint16(0x0100);
|
|
38
|
-
encoder.writeUint16(1);
|
|
39
|
-
encoder.writeUint16(0);
|
|
40
|
-
encoder.writeUint16(0);
|
|
41
|
-
encoder.writeUint16(0);
|
|
42
|
-
|
|
43
|
-
encoder.writeDomainName(name);
|
|
44
|
-
encoder.writeUint16(type);
|
|
45
|
-
encoder.writeUint16(1);
|
|
46
|
-
|
|
47
|
-
return encoder.finish();
|
|
48
|
-
}
|
|
49
|
-
|
|
50
|
-
function buildMalformedQuery(): Buffer {
|
|
51
|
-
return Buffer.from([0x12, 0x34]);
|
|
52
|
-
}
|
|
53
|
-
|
|
54
|
-
function parseResponseFlags(buf: Buffer): { qr: number; rcode: number; id: number } {
|
|
55
|
-
const id = buf.readUInt16BE(0);
|
|
56
|
-
const flags = buf.readUInt16BE(2);
|
|
57
|
-
const qr = (flags >> 15) & 0x1;
|
|
58
|
-
const rcode = flags & 0xf;
|
|
59
|
-
return { id, qr, rcode };
|
|
60
|
-
}
|
|
61
|
-
|
|
62
|
-
function getAnswerCount(buf: Buffer): number {
|
|
63
|
-
return buf.readUInt16BE(6);
|
|
64
|
-
}
|
|
65
|
-
|
|
66
|
-
describe("DevDnsServer - Baseline Tests", () => {
|
|
67
|
-
let server: DevDnsServer;
|
|
68
|
-
|
|
69
|
-
it("returns A record with matching ID and NOERROR for configured host", async () => {
|
|
70
|
-
const config: ServerConfig = {
|
|
71
|
-
port: 53,
|
|
72
|
-
hosts: {
|
|
73
|
-
"test.loop": {
|
|
74
|
-
records: [{ type: "A", address: "127.0.0.1" }],
|
|
75
|
-
},
|
|
76
|
-
},
|
|
77
|
-
};
|
|
78
|
-
|
|
79
|
-
server = new DevDnsServer(config);
|
|
80
|
-
const queryBuffer = buildQuery("test.loop", DNS_TYPES.A);
|
|
81
|
-
const response = server.resolve(queryBuffer)!;
|
|
82
|
-
|
|
83
|
-
assert.ok(response.length > 0);
|
|
84
|
-
|
|
85
|
-
const { id, qr, rcode } = parseResponseFlags(response);
|
|
86
|
-
assert.strictEqual(id, 0x1234);
|
|
87
|
-
assert.strictEqual(qr, 1);
|
|
88
|
-
assert.strictEqual(rcode, DNS_RCODE.NOERROR);
|
|
89
|
-
|
|
90
|
-
const ancount = getAnswerCount(response);
|
|
91
|
-
assert.ok(ancount >= 1);
|
|
92
|
-
});
|
|
93
|
-
|
|
94
|
-
it("returns NXDOMAIN for unconfigured host", async () => {
|
|
95
|
-
const config: ServerConfig = {
|
|
96
|
-
port: 53,
|
|
97
|
-
hosts: {},
|
|
98
|
-
};
|
|
99
|
-
|
|
100
|
-
server = new DevDnsServer(config);
|
|
101
|
-
const queryBuffer = buildQuery("notexist.loop", DNS_TYPES.A);
|
|
102
|
-
const response = server.resolve(queryBuffer)!;
|
|
103
|
-
|
|
104
|
-
assert.ok(response.length > 0);
|
|
105
|
-
|
|
106
|
-
const { id, qr, rcode } = parseResponseFlags(response);
|
|
107
|
-
assert.strictEqual(id, 0x1234);
|
|
108
|
-
assert.strictEqual(qr, 1);
|
|
109
|
-
assert.strictEqual(rcode, DNS_RCODE.NXDOMAIN);
|
|
110
|
-
});
|
|
111
|
-
|
|
112
|
-
it("returns CNAME record when configured", async () => {
|
|
113
|
-
const config: ServerConfig = {
|
|
114
|
-
port: 53,
|
|
115
|
-
hosts: {
|
|
116
|
-
"alias.loop": {
|
|
117
|
-
records: [{ type: "CNAME", target: "target.loop" }],
|
|
118
|
-
},
|
|
119
|
-
},
|
|
120
|
-
};
|
|
121
|
-
|
|
122
|
-
server = new DevDnsServer(config);
|
|
123
|
-
const queryBuffer = buildQuery("alias.loop", DNS_TYPES.CNAME);
|
|
124
|
-
const response = server.resolve(queryBuffer)!;
|
|
125
|
-
|
|
126
|
-
assert.ok(response.length > 0);
|
|
127
|
-
|
|
128
|
-
const { qr, rcode } = parseResponseFlags(response);
|
|
129
|
-
assert.strictEqual(qr, 1);
|
|
130
|
-
assert.strictEqual(rcode, DNS_RCODE.NOERROR);
|
|
131
|
-
|
|
132
|
-
const ancount = getAnswerCount(response);
|
|
133
|
-
assert.ok(ancount >= 1);
|
|
134
|
-
});
|
|
135
|
-
|
|
136
|
-
it("returns TXT record when configured", async () => {
|
|
137
|
-
const config: ServerConfig = {
|
|
138
|
-
port: 53,
|
|
139
|
-
hosts: {
|
|
140
|
-
"txt.loop": {
|
|
141
|
-
records: [{ type: "TXT", data: ["v=spf1 include:_example.com ~all"] }],
|
|
142
|
-
},
|
|
143
|
-
},
|
|
144
|
-
};
|
|
145
|
-
|
|
146
|
-
server = new DevDnsServer(config);
|
|
147
|
-
const queryBuffer = buildQuery("txt.loop", DNS_TYPES.TXT);
|
|
148
|
-
const response = server.resolve(queryBuffer)!;
|
|
149
|
-
|
|
150
|
-
assert.ok(response.length > 0);
|
|
151
|
-
|
|
152
|
-
const { qr } = parseResponseFlags(response);
|
|
153
|
-
assert.strictEqual(qr, 1);
|
|
154
|
-
|
|
155
|
-
const ancount = getAnswerCount(response);
|
|
156
|
-
assert.ok(ancount >= 1);
|
|
157
|
-
});
|
|
158
|
-
|
|
159
|
-
it("rejects malformed (too short) query packets", async () => {
|
|
160
|
-
const config: ServerConfig = {
|
|
161
|
-
port: 53,
|
|
162
|
-
hosts: {
|
|
163
|
-
"test.loop": {
|
|
164
|
-
records: [{ type: "A", address: "127.0.0.1" }],
|
|
165
|
-
},
|
|
166
|
-
},
|
|
167
|
-
};
|
|
168
|
-
|
|
169
|
-
server = new DevDnsServer(config);
|
|
170
|
-
const malformed = buildMalformedQuery();
|
|
171
|
-
const response = server.resolve(malformed)!;
|
|
172
|
-
|
|
173
|
-
assert.strictEqual(response.length, 0);
|
|
174
|
-
});
|
|
175
|
-
|
|
176
|
-
it("rejects packets that are DNS responses (QR=1)", async () => {
|
|
177
|
-
const config: ServerConfig = {
|
|
178
|
-
port: 53,
|
|
179
|
-
hosts: {
|
|
180
|
-
"test.loop": {
|
|
181
|
-
records: [{ type: "A", address: "127.0.0.1" }],
|
|
182
|
-
},
|
|
183
|
-
},
|
|
184
|
-
};
|
|
185
|
-
|
|
186
|
-
server = new DevDnsServer(config);
|
|
187
|
-
|
|
188
|
-
const encoder = new (class {
|
|
189
|
-
buf = Buffer.alloc(256);
|
|
190
|
-
offset = 0;
|
|
191
|
-
|
|
192
|
-
writeUint16(v: number) {
|
|
193
|
-
this.buf.writeUInt16BE(v, this.offset);
|
|
194
|
-
this.offset += 2;
|
|
195
|
-
}
|
|
196
|
-
|
|
197
|
-
writeDomainName(name: string) {
|
|
198
|
-
for (const label of name.split(".")) {
|
|
199
|
-
if (label.length === 0) continue;
|
|
200
|
-
this.writeUint8(label.length);
|
|
201
|
-
Buffer.from(label).copy(this.buf, this.offset);
|
|
202
|
-
this.offset += label.length;
|
|
203
|
-
}
|
|
204
|
-
this.writeUint8(0);
|
|
205
|
-
}
|
|
206
|
-
|
|
207
|
-
writeUint8(v: number) {
|
|
208
|
-
this.buf.writeUInt8(v, this.offset);
|
|
209
|
-
this.offset += 1;
|
|
210
|
-
}
|
|
211
|
-
|
|
212
|
-
finish(): Buffer {
|
|
213
|
-
return this.buf.subarray(0, this.offset);
|
|
214
|
-
}
|
|
215
|
-
})();
|
|
216
|
-
|
|
217
|
-
encoder.writeUint16(0xdead);
|
|
218
|
-
encoder.writeUint16(0x8100);
|
|
219
|
-
encoder.writeUint16(1);
|
|
220
|
-
encoder.writeUint16(0);
|
|
221
|
-
encoder.writeUint16(0);
|
|
222
|
-
encoder.writeUint16(0);
|
|
223
|
-
encoder.writeDomainName("test.loop");
|
|
224
|
-
encoder.writeUint16(DNS_TYPES.A);
|
|
225
|
-
encoder.writeUint16(1);
|
|
226
|
-
|
|
227
|
-
const response = server.resolve(encoder.finish())!;
|
|
228
|
-
assert.strictEqual(response.length, 0);
|
|
229
|
-
});
|
|
230
|
-
|
|
231
|
-
it("does not process queries with RD=0 (recursion not desired)", async () => {
|
|
232
|
-
const config: ServerConfig = {
|
|
233
|
-
port: 53,
|
|
234
|
-
hosts: {
|
|
235
|
-
"test.loop": {
|
|
236
|
-
records: [{ type: "A", address: "127.0.0.1" }],
|
|
237
|
-
},
|
|
238
|
-
},
|
|
239
|
-
};
|
|
240
|
-
|
|
241
|
-
server = new DevDnsServer(config);
|
|
242
|
-
|
|
243
|
-
const encoder = new (class {
|
|
244
|
-
buf = Buffer.alloc(256);
|
|
245
|
-
offset = 0;
|
|
246
|
-
|
|
247
|
-
writeUint16(v: number) {
|
|
248
|
-
this.buf.writeUInt16BE(v, this.offset);
|
|
249
|
-
this.offset += 2;
|
|
250
|
-
}
|
|
251
|
-
|
|
252
|
-
writeDomainName(name: string) {
|
|
253
|
-
for (const label of name.split(".")) {
|
|
254
|
-
if (label.length === 0) continue;
|
|
255
|
-
this.writeUint8(label.length);
|
|
256
|
-
Buffer.from(label).copy(this.buf, this.offset);
|
|
257
|
-
this.offset += label.length;
|
|
258
|
-
}
|
|
259
|
-
this.writeUint8(0);
|
|
260
|
-
}
|
|
261
|
-
|
|
262
|
-
writeUint8(v: number) {
|
|
263
|
-
this.buf.writeUInt8(v, this.offset);
|
|
264
|
-
this.offset += 1;
|
|
265
|
-
}
|
|
266
|
-
|
|
267
|
-
finish(): Buffer {
|
|
268
|
-
return this.buf.subarray(0, this.offset);
|
|
269
|
-
}
|
|
270
|
-
})();
|
|
271
|
-
|
|
272
|
-
encoder.writeUint16(0xbeef);
|
|
273
|
-
encoder.writeUint16(0x0000);
|
|
274
|
-
encoder.writeUint16(1);
|
|
275
|
-
encoder.writeUint16(0);
|
|
276
|
-
encoder.writeUint16(0);
|
|
277
|
-
encoder.writeUint16(0);
|
|
278
|
-
encoder.writeDomainName("test.loop");
|
|
279
|
-
encoder.writeUint16(DNS_TYPES.A);
|
|
280
|
-
encoder.writeUint16(1);
|
|
281
|
-
|
|
282
|
-
const response = server.resolve(encoder.finish())!;
|
|
283
|
-
assert.strictEqual(response.length, 0);
|
|
284
|
-
});
|
|
285
|
-
|
|
286
|
-
it("handles multiple host lookups correctly (isolated hosts)", async () => {
|
|
287
|
-
const config: ServerConfig = {
|
|
288
|
-
port: 53,
|
|
289
|
-
hosts: {
|
|
290
|
-
"alpha.loop": {
|
|
291
|
-
records: [{ type: "A", address: "10.0.0.1" }],
|
|
292
|
-
},
|
|
293
|
-
"beta.loop": {
|
|
294
|
-
records: [{ type: "A", address: "10.0.0.2" }],
|
|
295
|
-
},
|
|
296
|
-
},
|
|
297
|
-
};
|
|
298
|
-
|
|
299
|
-
server = new DevDnsServer(config);
|
|
300
|
-
|
|
301
|
-
const alphaResponse = server.resolve(buildQuery("alpha.loop", DNS_TYPES.A))!;
|
|
302
|
-
assert.ok(alphaResponse.length > 0);
|
|
303
|
-
const { qr: qrAlpha } = parseResponseFlags(alphaResponse);
|
|
304
|
-
assert.strictEqual(qrAlpha, 1);
|
|
305
|
-
|
|
306
|
-
const betaResponse = server.resolve(buildQuery("beta.loop", DNS_TYPES.A))!;
|
|
307
|
-
assert.ok(betaResponse.length > 0);
|
|
308
|
-
const { qr: qrBeta } = parseResponseFlags(betaResponse);
|
|
309
|
-
assert.strictEqual(qrBeta, 1);
|
|
310
|
-
});
|
|
311
|
-
|
|
312
|
-
it("supports AAAA records", async () => {
|
|
313
|
-
const config: ServerConfig = {
|
|
314
|
-
port: 53,
|
|
315
|
-
hosts: {
|
|
316
|
-
"ipv6.loop": {
|
|
317
|
-
records: [{ type: "AAAA", address: "::1" }],
|
|
318
|
-
},
|
|
319
|
-
},
|
|
320
|
-
};
|
|
321
|
-
|
|
322
|
-
server = new DevDnsServer(config);
|
|
323
|
-
const queryBuffer = buildQuery("ipv6.loop", DNS_TYPES.AAAA);
|
|
324
|
-
const response = server.resolve(queryBuffer)!;
|
|
325
|
-
|
|
326
|
-
assert.ok(response.length > 0);
|
|
327
|
-
|
|
328
|
-
const { qr } = parseResponseFlags(response);
|
|
329
|
-
assert.strictEqual(qr, 1);
|
|
330
|
-
});
|
|
331
|
-
|
|
332
|
-
it("supports MX records", async () => {
|
|
333
|
-
const config: ServerConfig = {
|
|
334
|
-
port: 53,
|
|
335
|
-
hosts: {
|
|
336
|
-
"mx.loop": {
|
|
337
|
-
records: [{ type: "MX", priority: 10, exchange: "mail.mx.loop" }],
|
|
338
|
-
},
|
|
339
|
-
},
|
|
340
|
-
};
|
|
341
|
-
|
|
342
|
-
server = new DevDnsServer(config);
|
|
343
|
-
const queryBuffer = buildQuery("mx.loop", DNS_TYPES.MX);
|
|
344
|
-
const response = server.resolve(queryBuffer)!;
|
|
345
|
-
|
|
346
|
-
assert.ok(response.length > 0);
|
|
347
|
-
|
|
348
|
-
const { qr } = parseResponseFlags(response);
|
|
349
|
-
assert.strictEqual(qr, 1);
|
|
350
|
-
});
|
|
351
|
-
|
|
352
|
-
it("supports SRV records", async () => {
|
|
353
|
-
const config: ServerConfig = {
|
|
354
|
-
port: 53,
|
|
355
|
-
hosts: {
|
|
356
|
-
"srv.loop": {
|
|
357
|
-
records: [{ type: "SRV", priority: 10, weight: 5, port: 8080, target: "app.srv.loop" }],
|
|
358
|
-
},
|
|
359
|
-
},
|
|
360
|
-
};
|
|
361
|
-
|
|
362
|
-
server = new DevDnsServer(config);
|
|
363
|
-
const queryBuffer = buildQuery("srv.loop", DNS_TYPES.SRV);
|
|
364
|
-
const response = server.resolve(queryBuffer)!;
|
|
365
|
-
|
|
366
|
-
assert.ok(response.length > 0);
|
|
367
|
-
|
|
368
|
-
const { qr } = parseResponseFlags(response);
|
|
369
|
-
assert.strictEqual(qr, 1);
|
|
370
|
-
});
|
|
371
|
-
});
|