@opensecurity/zonzon-core 0.1.4 → 0.1.6

package/dist/dns-service.js

@@ -245,7 +245,6 @@ function buildNoErrorResponse(id, flags, questions) {
 export class DevDnsServer {
     config;
     cacheMap = new Map();
-    cacheOrder = [];
     dnsCacheMaxSize;
     dnsCacheTtlMs;
     constructor(config) {
@@ -279,10 +278,10 @@ export class DevDnsServer {
         return questions.map((q) => `${q.name}:${q.type}`).join("|");
     }
     evictCacheEntry() {
-        if (this.cacheOrder.length === 0)
-            return;
-        const oldestKey = this.cacheOrder.shift();
-        this.cacheMap.delete(oldestKey);
+        const oldestKey = this.cacheMap.keys().next().value;
+        if (oldestKey !== undefined) {
+            this.cacheMap.delete(oldestKey);
+        }
     }
     getFromCache(key) {
         const entry = this.cacheMap.get(key);
@@ -290,15 +289,10 @@ export class DevDnsServer {
             return null;
         if (this.dnsCacheTtlMs > 0 && Date.now() - entry.insertedAt >= this.dnsCacheTtlMs) {
             this.cacheMap.delete(key);
-            const idx = this.cacheOrder.indexOf(key);
-            if (idx >= 0)
-                this.cacheOrder.splice(idx, 1);
             return null;
         }
-        const idx = this.cacheOrder.indexOf(key);
-        if (idx >= 0)
-            this.cacheOrder.splice(idx, 1);
-        this.cacheOrder.push(key);
+        this.cacheMap.delete(key);
+        this.cacheMap.set(key, entry);
         const remainingTtlMs = Math.max(0, this.dnsCacheTtlMs - (Date.now() - entry.insertedAt));
         entry.ttlMs = remainingTtlMs;
         return entry;
@@ -306,7 +300,7 @@ export class DevDnsServer {
     addToCache(key, response) {
         if (this.dnsCacheTtlMs <= 0)
             return;
-        while (this.cacheOrder.length >= this.dnsCacheMaxSize) {
+        while (this.cacheMap.size >= this.dnsCacheMaxSize) {
             this.evictCacheEntry();
         }
         const remainingSeconds = Math.max(1, Math.floor(this.dnsCacheTtlMs / 1000));
@@ -316,11 +310,8 @@ export class DevDnsServer {
             insertedAt: Date.now(),
             ttlMs: this.dnsCacheTtlMs,
         };
+        this.cacheMap.delete(key);
         this.cacheMap.set(key, entry);
-        const idx = this.cacheOrder.indexOf(key);
-        if (idx >= 0)
-            this.cacheOrder.splice(idx, 1);
-        this.cacheOrder.push(key);
     }
     skipQuestionSection(buffer, offset) {
         const savedOffset = offset;

package/dist/dns-service.test.js

@@ -1,5 +1,5 @@
 import { describe, it } from "node:test";
-import assert from "assert";
+import assert from "node:assert";
 import { DevDnsServer } from "./dns-service.js";
 import { DNS_TYPES, DNS_RCODE } from "./types.js";
 function buildQuery(name, type) {

package/dist/dns-wireformat.test.js

@@ -1,5 +1,5 @@
 import { describe, it } from "node:test";
-import assert from "assert";
+import assert from "node:assert";
 import { DevDnsServer } from "./dns-service.js";
 import { DNS_TYPES, DNS_RCODE } from "./types.js";
 function buildQuery(name, type) {

package/dist/doh-dot.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/doh-dot.test.js

@@ -0,0 +1,104 @@
+import { describe, it } from "node:test";
+import assert from "node:assert";
+import { DnsHandler } from "./dns-handler.js";
+import { DevDnsServer } from "./dns-service.js";
+function createMockReqRes(method, url, headers = {}) {
+    const req = {
+        method,
+        url,
+        headers,
+        socket: { remoteAddress: "127.0.0.1" },
+        destroy: () => { }
+    };
+    let statusCode = 0;
+    let endData = null;
+    const resHeaders = {};
+    const res = {
+        writeHead: (code, headers) => {
+            statusCode = code;
+            if (headers)
+                Object.assign(resHeaders, headers);
+        },
+        end: (data) => {
+            endData = data;
+        }
+    };
+    return { req, res, getStatus: () => statusCode, getEndData: () => endData, getHeaders: () => resHeaders };
+}
+describe("Modern DNS Protocols (DoH)", () => {
+    const config = {
+        port: 53,
+        hosts: {}
+    };
+    const server = new DevDnsServer(config);
+    const handler = new DnsHandler(server, config);
+    it("rejects DoH request on invalid path", async () => {
+        const { req, res, getStatus } = createMockReqRes("GET", "/invalid-path");
+        // @ts-ignore - Accessing private method for strict L7 unit testing
+        await handler.handleDohRequest(req, res);
+        assert.strictEqual(getStatus(), 404);
+    });
+    it("rejects DoH GET request missing dns query parameter", async () => {
+        const { req, res, getStatus } = createMockReqRes("GET", "/dns-query");
+        // @ts-ignore
+        await handler.handleDohRequest(req, res);
+        assert.strictEqual(getStatus(), 400);
+    });
+    it("rejects DoH GET request with invalid base64url payload", async () => {
+        const { req, res, getStatus } = createMockReqRes("GET", "/dns-query?dns=!!!invalid_base64!!!");
+        // @ts-ignore
+        await handler.handleDohRequest(req, res);
+        assert.strictEqual(getStatus(), 400);
+    });
+    it("rejects DoH POST request with invalid content-type", async () => {
+        const { req, res, getStatus } = createMockReqRes("POST", "/dns-query", {
+            "content-type": "application/json"
+        });
+        // @ts-ignore
+        await handler.handleDohRequest(req, res);
+        assert.strictEqual(getStatus(), 415);
+    });
+    it("rejects unsupported HTTP methods", async () => {
+        const { req, res, getStatus } = createMockReqRes("PUT", "/dns-query");
+        // @ts-ignore
+        await handler.handleDohRequest(req, res);
+        assert.strictEqual(getStatus(), 405);
+    });
+    it("rejects payloads that are too short to be valid DNS packets", async () => {
+        const { req, res, getStatus } = createMockReqRes("GET", "/dns-query?dns=abcd");
+        // @ts-ignore
+        await handler.handleDohRequest(req, res);
+        assert.strictEqual(getStatus(), 400);
+    });
+    it("enforces memory bounds on DoH POST payloads to prevent exhaustion", async () => {
+        const { req, res, getStatus } = createMockReqRes("POST", "/dns-query", {
+            "content-type": "application/dns-message"
+        });
+        const oversizedBuffer = Buffer.alloc(65 * 1024); // Exceeds MAX_TCP_BUFFER_SIZE (64KB)
+        req[Symbol.asyncIterator] = async function* () {
+            yield oversizedBuffer;
+        };
+        // @ts-ignore
+        await handler.handleDohRequest(req, res);
+        assert.strictEqual(getStatus(), 413);
+    });
+    it("processes a structurally valid DoH POST request", async () => {
+        const { req, res, getStatus, getHeaders } = createMockReqRes("POST", "/dns-query", {
+            "content-type": "application/dns-message"
+        });
+        // Create a minimal 12-byte valid DNS header
+        const validDnsHeader = Buffer.alloc(12);
+        validDnsHeader.writeUInt16BE(0x1234, 0); // ID
+        validDnsHeader.writeUInt16BE(0x0100, 2); // Flags (Standard Query)
+        validDnsHeader.writeUInt16BE(0x0000, 4); // QDCOUNT
+        req[Symbol.asyncIterator] = async function* () {
+            yield validDnsHeader;
+        };
+        // @ts-ignore
+        await handler.handleDohRequest(req, res);
+        assert.strictEqual(getStatus(), 200);
+        const headers = getHeaders();
+        assert.strictEqual(headers["Content-Type"], "application/dns-message");
+        assert.strictEqual(headers["Cache-Control"], "max-age=0");
+    });
+});

package/dist/firewall.d.ts

@@ -3,6 +3,8 @@ export declare class FirewallEngine {
     private ipToInt;
     private matchCidr;
     private matchDomain;
+    isRestrictedOutbound(ip: string): boolean;
+    evaluateOutbound(ip: string, fw?: FirewallConfig): "ALLOW" | "DENY";
     evaluateIp(ip: string, fw?: FirewallConfig): "ALLOW" | "DENY";
     evaluateDomain(domain: string, fw?: FirewallConfig): "ALLOW" | "DENY";
 }

package/dist/firewall.js

@@ -1,4 +1,4 @@
-import * as net from "net";
+import * as net from "node:net";
 export class FirewallEngine {
     ipToInt(ip) {
         return ip.split('.').reduce((int, octet) => (int << 8) + parseInt(octet, 10), 0) >>> 0;
@@ -22,26 +22,85 @@ export class FirewallEngine {
             return true;
         if (normPattern.startsWith("*.")) {
             const suffix = normPattern.slice(2);
-            return normDomain === suffix || normDomain.endsWith("." + suffix);
+            return normDomain.endsWith("." + suffix);
         }
         return false;
     }
+    isRestrictedOutbound(ip) {
+        if (net.isIPv6(ip)) {
+            const normalized = ip.toLowerCase();
+            if (normalized === "::1")
+                return true;
+            if (normalized === "::")
+                return true;
+            if (normalized.startsWith("fe80:"))
+                return true;
+            if (normalized.startsWith("fc00:") || normalized.startsWith("fd"))
+                return true;
+            if (normalized.includes("::ffff:127."))
+                return true;
+            if (normalized.includes("::ffff:169.254."))
+                return true;
+            return false;
+        }
+        if (!net.isIPv4(ip))
+            return true;
+        const parts = ip.split('.').map(Number);
+        if (parts[0] === 0)
+            return true;
+        if (parts[0] === 10)
+            return true;
+        if (parts[0] === 127)
+            return true;
+        if (parts[0] === 100 && parts[1] >= 64 && parts[1] <= 127)
+            return true;
+        if (parts[0] === 169 && parts[1] === 254)
+            return true;
+        if (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31)
+            return true;
+        if (parts[0] === 192 && parts[1] === 168)
+            return true;
+        if (parts[0] >= 224 && parts[0] <= 239)
+            return true;
+        if (parts[0] >= 240 && parts[0] <= 255)
+            return true;
+        return false;
+    }
+    evaluateOutbound(ip, fw) {
+        if (fw) {
+            if (fw.allowlist_ips && fw.allowlist_ips.includes(ip))
+                return "ALLOW";
+            if (net.isIPv4(ip)) {
+                for (const range of fw.allowlist_ranges || []) {
+                    if (this.matchCidr(ip, range))
+                        return "ALLOW";
+                }
+            }
+        }
+        if (this.isRestrictedOutbound(ip))
+            return "DENY";
+        return "ALLOW";
+    }
     evaluateIp(ip, fw) {
         if (!fw)
             return "ALLOW";
-        if (!net.isIPv4(ip))
+        if (!net.isIPv4(ip) && !net.isIPv6(ip))
             return "DENY";
         if (fw.blocklist_ips && fw.blocklist_ips.includes(ip))
             return "DENY";
-        for (const range of fw.blocklist_ranges || []) {
-            if (this.matchCidr(ip, range))
-                return "DENY";
+        if (net.isIPv4(ip)) {
+            for (const range of fw.blocklist_ranges || []) {
+                if (this.matchCidr(ip, range))
+                    return "DENY";
+            }
         }
         if (fw.allowlist_ips && fw.allowlist_ips.includes(ip))
             return "ALLOW";
-        for (const range of fw.allowlist_ranges || []) {
-            if (this.matchCidr(ip, range))
-                return "ALLOW";
+        if (net.isIPv4(ip)) {
+            for (const range of fw.allowlist_ranges || []) {
+                if (this.matchCidr(ip, range))
+                    return "ALLOW";
+            }
         }
         return fw.defaultPolicy === "allow" ? "ALLOW" : "DENY";
     }

package/dist/firewall.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/firewall.test.js

@@ -0,0 +1,165 @@
+import { describe, it } from "node:test";
+import assert from "node:assert";
+import { FirewallEngine } from "./firewall.js";
+describe("FirewallEngine - Domain Evaluation", () => {
+    const engine = new FirewallEngine();
+    it("returns ALLOW when firewall config is undefined", () => {
+        assert.strictEqual(engine.evaluateDomain("example.com"), "ALLOW");
+    });
+    it("respects default deny policy", () => {
+        const config = { defaultPolicy: "deny" };
+        assert.strictEqual(engine.evaluateDomain("example.com", config), "DENY");
+    });
+    it("respects default allow policy", () => {
+        const config = { defaultPolicy: "allow" };
+        assert.strictEqual(engine.evaluateDomain("example.com", config), "ALLOW");
+    });
+    it("blocks explicitly blocklisted domains", () => {
+        const config = {
+            defaultPolicy: "allow",
+            blocklist_domains: ["evil.com"],
+        };
+        assert.strictEqual(engine.evaluateDomain("evil.com", config), "DENY");
+    });
+    it("allows explicitly allowlisted domains overriding default deny", () => {
+        const config = {
+            defaultPolicy: "deny",
+            allowlist_domains: ["good.com"],
+        };
+        assert.strictEqual(engine.evaluateDomain("good.com", config), "ALLOW");
+    });
+    it("prioritizes blocklist over allowlist", () => {
+        const config = {
+            defaultPolicy: "allow",
+            allowlist_domains: ["conflict.com"],
+            blocklist_domains: ["conflict.com"],
+        };
+        assert.strictEqual(engine.evaluateDomain("conflict.com", config), "DENY");
+    });
+    it("supports exact domain matching case-insensitively", () => {
+        const config = {
+            defaultPolicy: "deny",
+            allowlist_domains: ["secure.loop"],
+        };
+        assert.strictEqual(engine.evaluateDomain("SECURE.LOOP", config), "ALLOW");
+    });
+    it("supports wildcard domain matching", () => {
+        const config = {
+            defaultPolicy: "deny",
+            allowlist_domains: ["*.internal.net"],
+        };
+        assert.strictEqual(engine.evaluateDomain("api.internal.net", config), "ALLOW");
+        assert.strictEqual(engine.evaluateDomain("db.internal.net", config), "ALLOW");
+        assert.strictEqual(engine.evaluateDomain("internal.net", config), "DENY");
+    });
+    it("handles trailing dots seamlessly", () => {
+        const config = {
+            defaultPolicy: "deny",
+            allowlist_domains: ["trailing.loop"],
+        };
+        assert.strictEqual(engine.evaluateDomain("trailing.loop.", config), "ALLOW");
+    });
+});
+describe("FirewallEngine - IP Evaluation", () => {
+    const engine = new FirewallEngine();
+    it("blocks malformed IPs universally", () => {
+        const config = { defaultPolicy: "allow" };
+        assert.strictEqual(engine.evaluateIp("not.an.ip", config), "DENY");
+        assert.strictEqual(engine.evaluateIp("999.999.999.999", config), "DENY");
+    });
+    it("blocks explicitly blocklisted IPs", () => {
+        const config = {
+            defaultPolicy: "allow",
+            blocklist_ips: ["192.168.1.100"],
+        };
+        assert.strictEqual(engine.evaluateIp("192.168.1.100", config), "DENY");
+    });
+    it("blocks IPs matching blocklist CIDR ranges", () => {
+        const config = {
+            defaultPolicy: "allow",
+            blocklist_ranges: ["10.0.0.0/8"],
+        };
+        assert.strictEqual(engine.evaluateIp("10.5.5.5", config), "DENY");
+        assert.strictEqual(engine.evaluateIp("11.0.0.1", config), "ALLOW");
+    });
+    it("allows IPs matching allowlist CIDR ranges overriding default deny", () => {
+        const config = {
+            defaultPolicy: "deny",
+            allowlist_ranges: ["172.16.0.0/12"],
+        };
+        assert.strictEqual(engine.evaluateIp("172.20.5.1", config), "ALLOW");
+        assert.strictEqual(engine.evaluateIp("192.168.1.1", config), "DENY");
+    });
+    it("prioritizes IP blocklist over IP allowlist", () => {
+        const config = {
+            defaultPolicy: "deny",
+            allowlist_ips: ["1.1.1.1"],
+            blocklist_ips: ["1.1.1.1"],
+        };
+        assert.strictEqual(engine.evaluateIp("1.1.1.1", config), "DENY");
+    });
+    it("safely ignores malformed CIDR ranges without crashing", () => {
+        const config = {
+            defaultPolicy: "deny",
+            allowlist_ranges: ["invalid/cidr/string"],
+            allowlist_ips: ["8.8.8.8"]
+        };
+        assert.strictEqual(engine.evaluateIp("8.8.8.8", config), "ALLOW");
+        assert.strictEqual(engine.evaluateIp("1.1.1.1", config), "DENY");
+    });
+});
+describe("FirewallEngine - Outbound SSRF Protection", () => {
+    const engine = new FirewallEngine();
+    it("blocks IPv4 loopback addresses natively", () => {
+        assert.strictEqual(engine.isRestrictedOutbound("127.0.0.1"), true);
+        assert.strictEqual(engine.isRestrictedOutbound("127.255.255.254"), true);
+    });
+    it("blocks IPv4 RFC1918 private network addresses natively", () => {
+        assert.strictEqual(engine.isRestrictedOutbound("10.0.0.1"), true);
+        assert.strictEqual(engine.isRestrictedOutbound("172.16.0.1"), true);
+        assert.strictEqual(engine.isRestrictedOutbound("172.31.255.255"), true);
+        assert.strictEqual(engine.isRestrictedOutbound("192.168.1.1"), true);
+    });
+    it("blocks IPv4 link-local and broadcast addresses natively", () => {
+        assert.strictEqual(engine.isRestrictedOutbound("169.254.169.254"), true);
+        assert.strictEqual(engine.isRestrictedOutbound("0.0.0.0"), true);
+        assert.strictEqual(engine.isRestrictedOutbound("224.0.0.1"), true);
+        assert.strictEqual(engine.isRestrictedOutbound("255.255.255.255"), true);
+    });
+    it("blocks IPv4 Carrier-Grade NAT addresses natively", () => {
+        assert.strictEqual(engine.isRestrictedOutbound("100.64.0.1"), true);
+        assert.strictEqual(engine.isRestrictedOutbound("100.127.255.254"), true);
+    });
+    it("allows standard public IPv4 addresses", () => {
+        assert.strictEqual(engine.isRestrictedOutbound("8.8.8.8"), false);
+        assert.strictEqual(engine.isRestrictedOutbound("1.1.1.1"), false);
+        assert.strictEqual(engine.isRestrictedOutbound("104.21.5.1"), false);
+    });
+    it("blocks IPv6 loopback and unspecified addresses natively", () => {
+        assert.strictEqual(engine.isRestrictedOutbound("::1"), true);
+        assert.strictEqual(engine.isRestrictedOutbound("::"), true);
+    });
+    it("blocks IPv6 link-local and unique local addresses natively", () => {
+        assert.strictEqual(engine.isRestrictedOutbound("fe80::1"), true);
+        assert.strictEqual(engine.isRestrictedOutbound("fc00::1"), true);
+        assert.strictEqual(engine.isRestrictedOutbound("fd00::1"), true);
+    });
+    it("blocks IPv4-mapped IPv6 addresses for restricted ranges", () => {
+        assert.strictEqual(engine.isRestrictedOutbound("::ffff:127.0.0.1"), true);
+        assert.strictEqual(engine.isRestrictedOutbound("::ffff:169.254.169.254"), true);
+    });
+    it("allows configured overrides for restricted IPs via allowlist", () => {
+        const config = {
+            defaultPolicy: "deny",
+            allowlist_ips: ["127.0.0.1"],
+        };
+        assert.strictEqual(engine.evaluateOutbound("127.0.0.1", config), "ALLOW");
+    });
+    it("allows configured overrides for restricted IPs via CIDR", () => {
+        const config = {
+            defaultPolicy: "deny",
+            allowlist_ranges: ["10.0.0.0/8"],
+        };
+        assert.strictEqual(engine.evaluateOutbound("10.5.0.1", config), "ALLOW");
+    });
+});

package/dist/http-body-forwarding-integration.test.js

@@ -1,5 +1,5 @@
 import { describe, it } from "node:test";
-import assert from "assert";
+import assert from "node:assert";
 import * as http from "http";
 describe("HTTP Body Forwarding Integration", () => {
     let upstreamServer;
@@ -131,6 +131,9 @@ describe("HTTP Body Forwarding Integration", () => {
         try {
             const config = {
                 port: 53,
+                firewall: {
+                    allowlist_ips: ["127.0.0.1"]
+                },
                 hosts: {
                     "app.loop": {
                         records: [{ type: "A", address: "127.0.0.1" }],
@@ -170,6 +173,9 @@ describe("HTTP Body Forwarding Integration", () => {
         try {
             const config = {
                 port: 53,
+                firewall: {
+                    allowlist_ips: ["127.0.0.1"]
+                },
                 hosts: {
                     "app.loop": {
                         records: [{ type: "A", address: "127.0.0.1" }],
@@ -209,6 +215,9 @@ describe("HTTP Body Forwarding Integration", () => {
         try {
             const config = {
                 port: 53,
+                firewall: {
+                    allowlist_ips: ["127.0.0.1"]
+                },
                 hosts: {
                     "app.loop": {
                         records: [{ type: "A", address: "127.0.0.1" }],
@@ -246,6 +255,9 @@ describe("HTTP Body Forwarding Integration", () => {
         try {
             const config = {
                 port: 53,
+                firewall: {
+                    allowlist_ips: ["127.0.0.1"]
+                },
                 hosts: {
                     "app.loop": {
                         records: [{ type: "A", address: "127.0.0.1" }],
@@ -285,6 +297,9 @@ describe("HTTP Body Forwarding Integration", () => {
         try {
             const config = {
                 port: 53,
+                firewall: {
+                    allowlist_ips: ["127.0.0.1"]
+                },
                 hosts: {
                     "app.loop": {
                         records: [{ type: "A", address: "127.0.0.1" }],

package/dist/http-body-forwarding.test.js

@@ -1,5 +1,5 @@
 import { describe, it } from "node:test";
-import assert from "assert";
+import assert from "node:assert";
 import { HttpProxyService } from "./http-proxy.js";
 function makeBodyForwardingConfig() {
     return {

package/dist/http-handler.d.ts

@@ -8,11 +8,13 @@ export declare class HttpHandler {
     private server;
     private circuitBreakers;
     private activeConnections;
+    private idleTimeoutMs;
     constructor(dnsServer: DevDnsServer, config: ServerConfig, port?: number);
     private getCircuitBreaker;
     private findWildcardHost;
-    private injectCustomHeaders;
     private handleConnect;
+    private doHttpProxy;
+    private readRequestBodySafe;
     private handleForwardProxy;
     private handleRequest;
     start(): Promise<void>;