@opensecurity/zonzon-core 0.1.4 → 0.1.5

package/dist/audit.d.ts

@@ -1,6 +1,10 @@
 export declare class AuditLogger {
     private isTestEnv;
+    private useJson;
+    private metrics;
     private sanitize;
+    setJsonMode(enable: boolean): void;
+    getMetricsPrometheus(): string;
     dns(ip: string, questions: any[], rcode: number, cached?: boolean): void;
     firewall(ip: string, target: string, action: "ALLOW" | "DENY", detail?: string): void;
     http(ip: string, method: string, host: string, path: string, status: number, target?: string): void;

package/dist/audit.js

@@ -2,38 +2,144 @@ import { DNS_TYPES } from "./types.js";
 const REVERSE_DNS_TYPES = Object.fromEntries(Object.entries(DNS_TYPES).map(([k, v]) => [v, k]));
 export class AuditLogger {
     isTestEnv = process.argv.includes("--test") || process.env.NODE_ENV === "test";
+    useJson = false;
+    metrics = {
+        dns_queries: 0,
+        dns_blocked: 0,
+        http_requests: 0,
+        http_blocked: 0,
+        firewall_drops: 0,
+        system_events: 0,
+        errors: 0
+    };
     sanitize(input) {
         return String(input || "").replace(/[\r\n\t]/g, " ").replace(/[^\x20-\x7E]/g, "?");
     }
+    setJsonMode(enable) {
+        this.useJson = enable;
+    }
+    getMetricsPrometheus() {
+        return [
+            `# HELP zonzon_dns_queries_total Total DNS queries processed`,
+            `# TYPE zonzon_dns_queries_total counter`,
+            `zonzon_dns_queries_total ${this.metrics.dns_queries}`,
+            `# HELP zonzon_dns_blocked_total Total DNS queries blocked by policy`,
+            `# TYPE zonzon_dns_blocked_total counter`,
+            `zonzon_dns_blocked_total ${this.metrics.dns_blocked}`,
+            `# HELP zonzon_http_requests_total Total HTTP requests routed`,
+            `# TYPE zonzon_http_requests_total counter`,
+            `zonzon_http_requests_total ${this.metrics.http_requests}`,
+            `# HELP zonzon_http_blocked_total Total HTTP requests blocked`,
+            `# TYPE zonzon_http_blocked_total counter`,
+            `zonzon_http_blocked_total ${this.metrics.http_blocked}`,
+            `# HELP zonzon_firewall_drops_total Total connection drops across L3/L4/L7`,
+            `# TYPE zonzon_firewall_drops_total counter`,
+            `zonzon_firewall_drops_total ${this.metrics.firewall_drops}`,
+            `# HELP zonzon_errors_total Total system errors encountered`,
+            `# TYPE zonzon_errors_total counter`,
+            `zonzon_errors_total ${this.metrics.errors}`
+        ].join("\n") + "\n";
+    }
     dns(ip, questions, rcode, cached = false) {
+        this.metrics.dns_queries += questions.length;
+        if (rcode === 5 || rcode === 3)
+            this.metrics.dns_blocked += questions.length;
         if (this.isTestEnv)
             return;
-        const codeMap = { 0: "Found (NOERROR)", 3: "Not Found (NXDOMAIN)", 5: "Blocked by Firewall (REFUSED)" };
-        const prefix = cached ? "[Cached] " : "";
-        questions.forEach(q => {
-            console.log(`[DNS] ${this.sanitize(ip)} | ${prefix}${REVERSE_DNS_TYPES[q.type] || q.type} ${this.sanitize(q.name)} -> ${codeMap[rcode] || rcode}`);
-        });
+        if (this.useJson) {
+            console.log(JSON.stringify({
+                timestamp: new Date().toISOString(),
+                level: "INFO",
+                component: "DNS",
+                ip,
+                questions: questions.map(q => ({ name: q.name, type: REVERSE_DNS_TYPES[q.type] || q.type })),
+                rcode,
+                cached
+            }));
+        }
+        else {
+            const codeMap = { 0: "Found (NOERROR)", 3: "Not Found (NXDOMAIN)", 5: "Blocked by Firewall (REFUSED)" };
+            const prefix = cached ? "[Cached] " : "";
+            questions.forEach(q => {
+                console.log(`[DNS] ${this.sanitize(ip)} | ${prefix}${REVERSE_DNS_TYPES[q.type] || q.type} ${this.sanitize(q.name)} -> ${codeMap[rcode] || rcode}`);
+            });
+        }
     }
     firewall(ip, target, action, detail = "") {
+        if (action === "DENY")
+            this.metrics.firewall_drops++;
         if (this.isTestEnv)
             return;
-        const color = action === "ALLOW" ? "\x1b[32mALLOW\x1b[0m" : "\x1b[31mDENY\x1b[0m";
-        console.log(`[FIREWALL] ${this.sanitize(ip)} | ${color} | ${this.sanitize(target)} ${detail ? `(${this.sanitize(detail)})` : ""}`);
+        if (this.useJson) {
+            console.log(JSON.stringify({
+                timestamp: new Date().toISOString(),
+                level: action === "DENY" ? "WARN" : "INFO",
+                component: "FIREWALL",
+                action,
+                ip,
+                target,
+                detail
+            }));
+        }
+        else {
+            const color = action === "ALLOW" ? "\x1b[32mALLOW\x1b[0m" : "\x1b[31mDENY\x1b[0m";
+            console.log(`[FIREWALL] ${this.sanitize(ip)} | ${color} | ${this.sanitize(target)} ${detail ? `(${this.sanitize(detail)})` : ""}`);
+        }
     }
     http(ip, method, host, path, status, target = "") {
+        this.metrics.http_requests++;
+        if (status === 403 || status === 413 || status === 429)
+            this.metrics.http_blocked++;
         if (this.isTestEnv)
             return;
-        console.log(`[HTTP] ${this.sanitize(ip)} | Returned Status ${status} | ${this.sanitize(method)} ${this.sanitize(host)}${this.sanitize(path)} ${target ? `-> ${this.sanitize(target)}` : ""}`);
+        if (this.useJson) {
+            console.log(JSON.stringify({
+                timestamp: new Date().toISOString(),
+                level: status >= 400 ? "WARN" : "INFO",
+                component: "HTTP",
+                ip,
+                method,
+                host,
+                path,
+                status,
+                target
+            }));
+        }
+        else {
+            console.log(`[HTTP] ${this.sanitize(ip)} | Returned Status ${status} | ${this.sanitize(method)} ${this.sanitize(host)}${this.sanitize(path)} ${target ? `-> ${this.sanitize(target)}` : ""}`);
+        }
     }
     system(msg) {
+        this.metrics.system_events++;
         if (this.isTestEnv)
             return;
-        console.log(`[SYSTEM] ${this.sanitize(msg)}`);
+        if (this.useJson) {
+            console.log(JSON.stringify({
+                timestamp: new Date().toISOString(),
+                level: "INFO",
+                component: "SYSTEM",
+                message: msg
+            }));
+        }
+        else {
+            console.log(`[SYSTEM] ${this.sanitize(msg)}`);
+        }
     }
     error(msg) {
+        this.metrics.errors++;
         if (this.isTestEnv)
             return;
-        console.error(`[ERROR] \x1b[31m${this.sanitize(msg)}\x1b[0m`);
+        if (this.useJson) {
+            console.error(JSON.stringify({
+                timestamp: new Date().toISOString(),
+                level: "ERROR",
+                component: "SYSTEM",
+                message: msg
+            }));
+        }
+        else {
+            console.error(`[ERROR] \x1b[31m${this.sanitize(msg)}\x1b[0m`);
+        }
     }
 }
 export const audit = new AuditLogger();

package/dist/dns-handler.d.ts

@@ -4,20 +4,29 @@ export declare class DnsHandler {
     private server;
     private udpServer;
     private tcpServer;
+    private dotServer;
+    private dohServer;
     private port;
     private fallbackDns;
     private config;
     private activeTcpConnections;
     private maxTcpConnections;
     private tcpIdleTimeoutMs;
+    private pendingUpstreamQueries;
+    private readonly maxConcurrentUdpForwards;
     private rateLimiter;
     constructor(server: DevDnsServer, config: ServerConfig);
     start(): Promise<void>;
     stop(): Promise<void>;
     private startUdp;
     private startTcp;
+    private startDoT;
+    private startDoH;
     private isRateLimited;
     private parseResolvedIpv4s;
+    private isPrivateIp;
+    private resolveQueryAsync;
+    private handleDohRequest;
     private forwardUdpQuery;
     private handleUdpMessage;
     private removeTcpConnection;

package/dist/dns-handler.js

@@ -1,20 +1,28 @@
 import dgram from "dgram";
 import * as net from "net";
-import { DnsWireFormat } from "./dns-service.js";
+import * as tls from "node:tls";
+import * as https from "node:https";
+import { randomBytes } from "node:crypto";
+import { DnsWireFormat, extractQuestions } from "./dns-service.js";
 import { DNS_RCODE } from "./types.js";
 import { RateLimiter } from "./rate-limiter.js";
+import { audit } from "./audit.js";
 import { firewallEngine } from "./firewall.js";
 const MAX_TCP_BUFFER_SIZE = 64 * 1024;
 export class DnsHandler {
     server;
     udpServer = null;
     tcpServer = null;
+    dotServer = null;
+    dohServer = null;
     port;
     fallbackDns;
     config;
     activeTcpConnections = new Map();
     maxTcpConnections;
     tcpIdleTimeoutMs;
+    pendingUpstreamQueries = new Map();
+    maxConcurrentUdpForwards = 2000;
     rateLimiter;
     constructor(server, config) {
         this.server = server;
@@ -36,6 +44,10 @@ export class DnsHandler {
     async start() {
         await this.startUdp();
         await this.startTcp();
+        if (this.config.tls) {
+            await this.startDoT();
+            await this.startDoH();
+        }
     }
     async stop() {
         if (this.udpServer) {
@@ -44,12 +56,32 @@ export class DnsHandler {
             });
             this.udpServer = null;
         }
+        for (const pending of this.pendingUpstreamQueries.values()) {
+            clearTimeout(pending.timeoutId);
+        }
+        this.pendingUpstreamQueries.clear();
         if (this.tcpServer) {
             await new Promise((resolve) => {
                 this.tcpServer?.close(() => resolve());
             });
             this.tcpServer = null;
         }
+        if (this.dotServer) {
+            await new Promise((resolve) => {
+                this.dotServer?.close(() => resolve());
+            });
+            this.dotServer = null;
+        }
+        if (this.dohServer) {
+            if ('closeIdleConnections' in this.dohServer) {
+                this.dohServer.closeIdleConnections();
+            }
+            await new Promise((resolve) => {
+                this.dohServer?.close(() => resolve());
+            });
+            this.dohServer = null;
+        }
+        this.activeTcpConnections.clear();
     }
     startUdp() {
         return new Promise((resolve, reject) => {
@@ -88,13 +120,6 @@ export class DnsHandler {
                 });
                 this.handleTcpConnection(socket);
             });
-            tcpServer.on("close", () => {
-                for (const [socket] of this.activeTcpConnections) {
-                    if (!socket.destroyed)
-                        socket.destroy();
-                }
-                this.activeTcpConnections.clear();
-            });
             tcpServer.on("listening", () => {
                 this.tcpServer = tcpServer;
                 resolve();
@@ -102,6 +127,63 @@ export class DnsHandler {
             tcpServer.listen(this.port, "0.0.0.0");
         });
     }
+    startDoT() {
+        return new Promise((resolve) => {
+            if (!this.config.tls) {
+                resolve();
+                return;
+            }
+            const dotServer = tls.createServer({
+                cert: this.config.tls.cert,
+                key: this.config.tls.key,
+                minVersion: "TLSv1.2"
+            }, (socket) => {
+                if (this.activeTcpConnections.size >= this.maxTcpConnections) {
+                    socket.destroy();
+                    return;
+                }
+                this.activeTcpConnections.set(socket, { timeoutId: undefined });
+                socket.setTimeout(this.tcpIdleTimeoutMs);
+                socket.on("timeout", () => {
+                    this.removeTcpConnection(socket);
+                    socket.destroy();
+                });
+                this.handleTcpConnection(socket);
+            });
+            dotServer.on("listening", () => {
+                this.dotServer = dotServer;
+                audit.system(`DoT (DNS over TLS) isolated boundary listening on port ${this.config.dotPort || 853}`);
+                resolve();
+            });
+            dotServer.listen(this.config.dotPort || 853, "0.0.0.0");
+        });
+    }
+    startDoH() {
+        return new Promise((resolve) => {
+            if (!this.config.tls) {
+                resolve();
+                return;
+            }
+            const dohServer = https.createServer({
+                cert: this.config.tls.cert,
+                key: this.config.tls.key,
+                minVersion: "TLSv1.2"
+            }, (req, res) => {
+                this.handleDohRequest(req, res).catch(() => {
+                    if (!res.headersSent) {
+                        res.writeHead(500);
+                        res.end();
+                    }
+                });
+            });
+            dohServer.on("listening", () => {
+                this.dohServer = dohServer;
+                audit.system(`DoH (DNS over HTTPS) isolated boundary listening on port ${this.config.dohPort || 8443}`);
+                resolve();
+            });
+            dohServer.listen(this.config.dohPort || 8443, "0.0.0.0");
+        });
+    }
     isRateLimited(ip) {
         if (!this.rateLimiter)
             return false;
@@ -133,24 +215,53 @@ export class DnsHandler {
         catch { }
         return ips;
     }
-    forwardUdpQuery(data, clientInfo) {
-        if (!this.fallbackDns || !this.udpServer)
-            return;
-        const fwdSocket = dgram.createSocket("udp4");
-        let handled = false;
-        const timeout = setTimeout(() => {
-            if (!handled) {
-                handled = true;
-                fwdSocket.close();
-                const ref = this.server.generateErrorResponse(data, DNS_RCODE.SERVFAIL);
-                this.udpServer?.send(ref, 0, ref.length, clientInfo.port, clientInfo.address);
+    isPrivateIp(ip) {
+        if (!net.isIPv4(ip) && !net.isIPv6(ip))
+            return false;
+        if (net.isIPv6(ip)) {
+            const normalized = ip.toLowerCase();
+            return normalized === "::1" || normalized.startsWith("fe80:") || normalized.startsWith("fc00:") || normalized.startsWith("fd");
+        }
+        const parts = ip.split('.').map(Number);
+        if (parts[0] === 10)
+            return true;
+        if (parts[0] === 127)
+            return true;
+        if (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31)
+            return true;
+        if (parts[0] === 192 && parts[1] === 168)
+            return true;
+        return false;
+    }
+    resolveQueryAsync(query, clientIp) {
+        return new Promise((resolve) => {
+            const response = this.server.resolve(query, clientIp);
+            if (response) {
+                if (response.length > 0)
+                    resolve(response);
+                else
+                    resolve(this.server.generateErrorResponse(query, DNS_RCODE.SERVFAIL));
+                return;
             }
-        }, 3000);
-        fwdSocket.on("message", (resp) => {
-            if (!handled) {
-                handled = true;
-                clearTimeout(timeout);
-                const ips = this.parseResolvedIpv4s(resp);
+            if (!this.fallbackDns) {
+                resolve(this.server.generateErrorResponse(query, DNS_RCODE.NXDOMAIN));
+                return;
+            }
+            const fwdSocket = dgram.createSocket("udp4");
+            const timeoutId = setTimeout(() => {
+                try {
+                    fwdSocket.close();
+                }
+                catch { }
+                resolve(this.server.generateErrorResponse(query, DNS_RCODE.SERVFAIL));
+            }, 3000);
+            fwdSocket.on("message", (msg) => {
+                clearTimeout(timeoutId);
+                try {
+                    fwdSocket.close();
+                }
+                catch { }
+                const ips = this.parseResolvedIpv4s(msg);
                 let blockedIp = null;
                 for (const ip of ips) {
                     if (firewallEngine.evaluateIp(ip, this.config.firewall) === "DENY") {
@@ -158,26 +269,178 @@ export class DnsHandler {
                         break;
                     }
                 }
+                const questions = extractQuestions(query);
                 if (blockedIp) {
-                    const ref = this.server.generateErrorResponse(data, DNS_RCODE.REFUSED);
-                    this.udpServer?.send(ref, 0, ref.length, clientInfo.port, clientInfo.address);
+                    audit.firewall(clientIp, blockedIp, "DENY", "Upstream target IP blocked");
+                    audit.dns(clientIp, questions, DNS_RCODE.REFUSED, false);
+                    resolve(this.server.generateErrorResponse(query, DNS_RCODE.REFUSED));
                 }
                 else {
-                    this.udpServer?.send(resp, 0, resp.length, clientInfo.port, clientInfo.address);
+                    const rcode = msg.length >= 4 ? msg.readUInt16BE(2) & 0xf : 0;
+                    audit.dns(clientIp, questions, rcode, false);
+                    resolve(msg);
                 }
+            });
+            fwdSocket.on("error", () => {
+                clearTimeout(timeoutId);
+                try {
+                    fwdSocket.close();
+                }
+                catch { }
+                resolve(this.server.generateErrorResponse(query, DNS_RCODE.SERVFAIL));
+            });
+            fwdSocket.send(query, 0, query.length, 53, this.fallbackDns);
+        });
+    }
+    async handleDohRequest(req, res) {
+        const clientIp = req.socket.remoteAddress || "unknown";
+        if (this.isRateLimited(clientIp)) {
+            res.writeHead(429);
+            res.end();
+            return;
+        }
+        const method = req.method || "GET";
+        const url = new URL(req.url || "/", `https://${req.headers.host || "localhost"}`);
+        if (url.pathname !== "/dns-query") {
+            res.writeHead(404);
+            res.end();
+            return;
+        }
+        let query = null;
+        if (method === "GET") {
+            const dnsParam = url.searchParams.get("dns");
+            if (!dnsParam) {
+                res.writeHead(400);
+                res.end();
+                return;
+            }
+            try {
+                query = Buffer.from(dnsParam, "base64url");
+            }
+            catch {
+                res.writeHead(400);
+                res.end();
+                return;
+            }
+        }
+        else if (method === "POST") {
+            if (req.headers["content-type"] !== "application/dns-message") {
+                res.writeHead(415);
+                res.end();
+                return;
+            }
+            const chunks = [];
+            let total = 0;
+            for await (const chunk of req) {
+                total += chunk.length;
+                if (total > MAX_TCP_BUFFER_SIZE) {
+                    res.writeHead(413);
+                    res.end();
+                    return;
+                }
+                chunks.push(chunk);
+            }
+            query = Buffer.concat(chunks);
+        }
+        else {
+            res.writeHead(405);
+            res.end();
+            return;
+        }
+        if (!query || query.length < 12) {
+            res.writeHead(400);
+            res.end();
+            return;
+        }
+        try {
+            const response = await this.resolveQueryAsync(query, clientIp);
+            res.writeHead(200, {
+                "Content-Type": "application/dns-message",
+                "Content-Length": response.length,
+                "Cache-Control": "max-age=0"
+            });
+            res.end(response);
+        }
+        catch {
+            res.writeHead(502);
+            res.end();
+        }
+    }
+    forwardUdpQuery(data, clientInfo) {
+        if (!this.fallbackDns)
+            return;
+        if (!this.isPrivateIp(clientInfo.address)) {
+            if (this.config.firewall && (!this.config.firewall.allowlist_ips || !this.config.firewall.allowlist_ips.includes(clientInfo.address))) {
+                audit.system(`Dropped UDP forward request from untrusted WAN IP: ${clientInfo.address} (Anti-Amplification)`);
+                return;
+            }
+        }
+        if (this.pendingUpstreamQueries.size >= this.maxConcurrentUdpForwards) {
+            audit.system("Dropped UDP forward request: Concurrent connection limit reached");
+            return;
+        }
+        if (data.length < 2)
+            return;
+        const originalId = data.readUInt16BE(0);
+        const ephemeralId = randomBytes(2).readUInt16BE(0);
+        const trackingId = randomBytes(4).readUInt32BE(0);
+        const fwdSocket = dgram.createSocket("udp4");
+        const timeoutId = setTimeout(() => {
+            this.pendingUpstreamQueries.delete(trackingId);
+            try {
                 fwdSocket.close();
             }
-        });
-        fwdSocket.on("error", (err) => {
-            if (!handled) {
-                handled = true;
-                clearTimeout(timeout);
+            catch { }
+            const ref = this.server.generateErrorResponse(data, DNS_RCODE.SERVFAIL);
+            this.udpServer?.send(ref, 0, ref.length, clientInfo.port, clientInfo.address);
+        }, 3000);
+        this.pendingUpstreamQueries.set(trackingId, { rinfo: clientInfo, originalId, timeoutId });
+        fwdSocket.on("message", (msg) => {
+            this.pendingUpstreamQueries.delete(trackingId);
+            clearTimeout(timeoutId);
+            try {
                 fwdSocket.close();
-                const ref = this.server.generateErrorResponse(data, DNS_RCODE.SERVFAIL);
+            }
+            catch { }
+            if (msg.length < 2)
+                return;
+            const responseId = msg.readUInt16BE(0);
+            if (responseId !== ephemeralId)
+                return;
+            const restoredMsg = Buffer.from(msg);
+            restoredMsg.writeUInt16BE(originalId, 0);
+            const ips = this.parseResolvedIpv4s(restoredMsg);
+            let blockedIp = null;
+            for (const ip of ips) {
+                if (firewallEngine.evaluateIp(ip, this.config.firewall) === "DENY") {
+                    blockedIp = ip;
+                    break;
+                }
+            }
+            const questions = extractQuestions(restoredMsg);
+            if (blockedIp) {
+                audit.firewall(clientInfo.address, blockedIp, "DENY", "Upstream target IP blocked");
+                audit.dns(clientInfo.address, questions, DNS_RCODE.REFUSED, false);
+                const ref = this.server.generateErrorResponse(restoredMsg, DNS_RCODE.REFUSED);
                 this.udpServer?.send(ref, 0, ref.length, clientInfo.port, clientInfo.address);
             }
+            else {
+                const rcode = restoredMsg.length >= 4 ? restoredMsg.readUInt16BE(2) & 0xf : 0;
+                audit.dns(clientInfo.address, questions, rcode, false);
+                this.udpServer?.send(restoredMsg, 0, restoredMsg.length, clientInfo.port, clientInfo.address);
+            }
         });
-        fwdSocket.send(data, 0, data.length, 53, this.fallbackDns);
+        fwdSocket.on("error", () => {
+            this.pendingUpstreamQueries.delete(trackingId);
+            clearTimeout(timeoutId);
+            try {
+                fwdSocket.close();
+            }
+            catch { }
+        });
+        const queryToForward = Buffer.from(data);
+        queryToForward.writeUInt16BE(ephemeralId, 0);
+        fwdSocket.send(queryToForward, 0, queryToForward.length, 53, this.fallbackDns);
     }
     handleUdpMessage(data, rinfo) {
         if (this.isRateLimited(rinfo.address)) {
@@ -218,6 +481,10 @@ export class DnsHandler {
             query.copy(prefixed, 2);
             fwd.write(prefixed);
         });
+        fwd.setTimeout(this.tcpIdleTimeoutMs);
+        fwd.on("timeout", () => {
+            fwd.destroy();
+        });
         fwd.on("data", (data) => {
             if (data.length < 2)
                 return;
@@ -230,7 +497,10 @@ export class DnsHandler {
                     break;
                 }
             }
+            const questions = extractQuestions(query);
             if (blockedIp) {
+                audit.firewall(peerAddr, blockedIp, "DENY", "Upstream target IP blocked");
+                audit.dns(peerAddr, questions, DNS_RCODE.REFUSED, false);
                 if (!clientSocket.destroyed) {
                     const ref = this.server.generateErrorResponse(query, DNS_RCODE.REFUSED);
                     const p = Buffer.alloc(2 + ref.length);
@@ -241,6 +511,8 @@ export class DnsHandler {
                 }
             }
             else {
+                const rcode = resp.length >= 4 ? resp.readUInt16BE(2) & 0xf : 0;
+                audit.dns(peerAddr, questions, rcode, false);
                 if (!clientSocket.destroyed)
                     clientSocket.write(data);
             }

package/dist/dns-service.d.ts

@@ -23,7 +23,6 @@ export declare function extractQuestions(query: Buffer): ParsedQuestion[];
 export declare class DevDnsServer {
     private config;
     private cacheMap;
-    private cacheOrder;
     private dnsCacheMaxSize;
     private dnsCacheTtlMs;
     constructor(config: ServerConfig);