@opensecurity/zonzon-core 0.1.5 → 0.1.6

package/dist/cache-layer.test.js

@@ -1,5 +1,5 @@
 import { describe, it } from "node:test";
-import assert from "assert";
+import assert from "node:assert";
 import { DevDnsServer } from "./dns-service.js";
 import { DNS_TYPES } from "./types.js";
 function buildQuery(name, type) {

package/dist/cache-multi-question.test.js

@@ -1,5 +1,5 @@
 import { describe, it } from "node:test";
-import assert from "assert";
+import assert from "node:assert";
 import { DevDnsServer } from "./dns-service.js";
 import { DNS_TYPES, DNS_CLASSES } from "./types.js";
 describe("Multi-Question TTL Cache Rewriting", () => {

package/dist/dns-handler.js

@@ -1,5 +1,5 @@
 import dgram from "dgram";
-import * as net from "net";
+import * as net from "node:net";
 import * as tls from "node:tls";
 import * as https from "node:https";
 import { randomBytes } from "node:crypto";

package/dist/dns-service.test.js

@@ -1,5 +1,5 @@
 import { describe, it } from "node:test";
-import assert from "assert";
+import assert from "node:assert";
 import { DevDnsServer } from "./dns-service.js";
 import { DNS_TYPES, DNS_RCODE } from "./types.js";
 function buildQuery(name, type) {

package/dist/dns-wireformat.test.js

@@ -1,5 +1,5 @@
 import { describe, it } from "node:test";
-import assert from "assert";
+import assert from "node:assert";
 import { DevDnsServer } from "./dns-service.js";
 import { DNS_TYPES, DNS_RCODE } from "./types.js";
 function buildQuery(name, type) {

package/dist/doh-dot.test.js

@@ -1,101 +1,104 @@
 import { describe, it } from "node:test";
 import assert from "node:assert";
-import { generateKeyPairSync } from "node:crypto";
 import { DnsHandler } from "./dns-handler.js";
 import { DevDnsServer } from "./dns-service.js";
-function buildDnsQuery(name, type) {
-    const encoder = new (class {
-        buf = Buffer.alloc(256);
-        offset = 0;
-        writeUint16(v) { this.buf.writeUInt16BE(v, this.offset); this.offset += 2; }
-        writeUint8(v) { this.buf.writeUInt8(v, this.offset); this.offset += 1; }
-        writeDomainName(nm) {
-            for (const label of nm.split(".")) {
-                if (!label.length)
-                    continue;
-                this.writeUint8(label.length);
-                Buffer.from(label).copy(this.buf, this.offset);
-                this.offset += label.length;
-            }
-            this.writeUint8(0);
+function createMockReqRes(method, url, headers = {}) {
+    const req = {
+        method,
+        url,
+        headers,
+        socket: { remoteAddress: "127.0.0.1" },
+        destroy: () => { }
+    };
+    let statusCode = 0;
+    let endData = null;
+    const resHeaders = {};
+    const res = {
+        writeHead: (code, headers) => {
+            statusCode = code;
+            if (headers)
+                Object.assign(resHeaders, headers);
+        },
+        end: (data) => {
+            endData = data;
         }
-        finish() { return this.buf.subarray(0, this.offset); }
-    })();
-    encoder.writeUint16(0xDEAD);
-    encoder.writeUint16(0x0100);
-    encoder.writeUint16(1);
-    encoder.writeUint16(0);
-    encoder.writeUint16(0);
-    encoder.writeUint16(0);
-    encoder.writeDomainName(name);
-    encoder.writeUint16(type);
-    encoder.writeUint16(1);
-    return encoder.finish();
-}
-function parseResponseFlags(buf) {
-    const flags = buf.readUInt16BE(2);
-    const qr = (flags >> 15) & 0x1;
-    const rcode = flags & 0xf;
-    return { qr, rcode };
+    };
+    return { req, res, getStatus: () => statusCode, getEndData: () => endData, getHeaders: () => resHeaders };
 }
-describe("Modern DNS Protocols (DoH and DoT)", () => {
-    let handler;
-    const dotPort = 64853;
-    const dohPort = 64443;
-    const dnsPort = 64053;
-    // Minimal self-signed cert generation for testing boundaries
-    const { privateKey, publicKey } = generateKeyPairSync('rsa', {
-        modulusLength: 2048,
-        publicKeyEncoding: { type: 'spki', format: 'pem' },
-        privateKeyEncoding: { type: 'pkcs8', format: 'pem' }
-    });
-    // Note: For a strictly functional test without full x509 cert generation logic, 
-    // we mock the TLS block to bypass strict validation in the Node runtime, 
-    // or use a pre-generated fixture. The handler binds TLS correctly, but 
-    // client verification needs to be disabled.
+describe("Modern DNS Protocols (DoH)", () => {
     const config = {
-        port: dnsPort,
-        dotPort: dotPort,
-        dohPort: dohPort,
-        tls: {
-            key: privateKey,
-            cert: privateKey // Will throw on deep verification, fine for structural boundary tests
-        },
-        hosts: {
-            "secure.loop": { records: [{ type: "A", address: "10.0.0.1" }] }
-        }
+        port: 53,
+        hosts: {}
     };
-    it("safely binds DoT and DoH boundaries without crashing", async () => {
-        const server = new DevDnsServer(config);
-        handler = new DnsHandler(server, config);
-        try {
-            // Due to the fake cert, start() might throw TLS errors if tightly coupled.
-            // We wrap to ensure the logic path executes safely.
-            await handler.start().catch(() => { });
-        }
-        finally {
-            await handler.stop();
-        }
-        assert.ok(true);
+    const server = new DevDnsServer(config);
+    const handler = new DnsHandler(server, config);
+    it("rejects DoH request on invalid path", async () => {
+        const { req, res, getStatus } = createMockReqRes("GET", "/invalid-path");
+        // @ts-ignore - Accessing private method for strict L7 unit testing
+        await handler.handleDohRequest(req, res);
+        assert.strictEqual(getStatus(), 404);
+    });
+    it("rejects DoH GET request missing dns query parameter", async () => {
+        const { req, res, getStatus } = createMockReqRes("GET", "/dns-query");
+        // @ts-ignore
+        await handler.handleDohRequest(req, res);
+        assert.strictEqual(getStatus(), 400);
+    });
+    it("rejects DoH GET request with invalid base64url payload", async () => {
+        const { req, res, getStatus } = createMockReqRes("GET", "/dns-query?dns=!!!invalid_base64!!!");
+        // @ts-ignore
+        await handler.handleDohRequest(req, res);
+        assert.strictEqual(getStatus(), 400);
+    });
+    it("rejects DoH POST request with invalid content-type", async () => {
+        const { req, res, getStatus } = createMockReqRes("POST", "/dns-query", {
+            "content-type": "application/json"
+        });
+        // @ts-ignore
+        await handler.handleDohRequest(req, res);
+        assert.strictEqual(getStatus(), 415);
     });
-    it("rejects malformed DoH requests", async () => {
-        // Validates the internal HTTP request parser for DoH
-        // This logic is tested directly on the handler object using mocks
-        const server = new DevDnsServer(config);
-        handler = new DnsHandler(server, config);
-        const mockReq = {
-            method: "POST",
-            url: "/dns-query",
-            headers: { "content-type": "text/plain" }, // Invalid content type
-            socket: { remoteAddress: "127.0.0.1" }
+    it("rejects unsupported HTTP methods", async () => {
+        const { req, res, getStatus } = createMockReqRes("PUT", "/dns-query");
+        // @ts-ignore
+        await handler.handleDohRequest(req, res);
+        assert.strictEqual(getStatus(), 405);
+    });
+    it("rejects payloads that are too short to be valid DNS packets", async () => {
+        const { req, res, getStatus } = createMockReqRes("GET", "/dns-query?dns=abcd");
+        // @ts-ignore
+        await handler.handleDohRequest(req, res);
+        assert.strictEqual(getStatus(), 400);
+    });
+    it("enforces memory bounds on DoH POST payloads to prevent exhaustion", async () => {
+        const { req, res, getStatus } = createMockReqRes("POST", "/dns-query", {
+            "content-type": "application/dns-message"
+        });
+        const oversizedBuffer = Buffer.alloc(65 * 1024); // Exceeds MAX_TCP_BUFFER_SIZE (64KB)
+        req[Symbol.asyncIterator] = async function* () {
+            yield oversizedBuffer;
         };
-        let statusCode = 0;
-        const mockRes = {
-            writeHead: (code) => { statusCode = code; },
-            end: () => { }
+        // @ts-ignore
+        await handler.handleDohRequest(req, res);
+        assert.strictEqual(getStatus(), 413);
+    });
+    it("processes a structurally valid DoH POST request", async () => {
+        const { req, res, getStatus, getHeaders } = createMockReqRes("POST", "/dns-query", {
+            "content-type": "application/dns-message"
+        });
+        // Create a minimal 12-byte valid DNS header
+        const validDnsHeader = Buffer.alloc(12);
+        validDnsHeader.writeUInt16BE(0x1234, 0); // ID
+        validDnsHeader.writeUInt16BE(0x0100, 2); // Flags (Standard Query)
+        validDnsHeader.writeUInt16BE(0x0000, 4); // QDCOUNT
+        req[Symbol.asyncIterator] = async function* () {
+            yield validDnsHeader;
         };
-        // @ts-ignore - access private method for deterministic testing
-        await handler.handleDohRequest(mockReq, mockRes);
-        assert.strictEqual(statusCode, 415); // Unsupported Media Type
+        // @ts-ignore
+        await handler.handleDohRequest(req, res);
+        assert.strictEqual(getStatus(), 200);
+        const headers = getHeaders();
+        assert.strictEqual(headers["Content-Type"], "application/dns-message");
+        assert.strictEqual(headers["Cache-Control"], "max-age=0");
     });
 });

package/dist/firewall.js

@@ -1,4 +1,4 @@
-import * as net from "net";
+import * as net from "node:net";
 export class FirewallEngine {
     ipToInt(ip) {
         return ip.split('.').reduce((int, octet) => (int << 8) + parseInt(octet, 10), 0) >>> 0;

package/dist/http-body-forwarding-integration.test.js

@@ -1,5 +1,5 @@
 import { describe, it } from "node:test";
-import assert from "assert";
+import assert from "node:assert";
 import * as http from "http";
 describe("HTTP Body Forwarding Integration", () => {
     let upstreamServer;

package/dist/http-body-forwarding.test.js

@@ -1,5 +1,5 @@
 import { describe, it } from "node:test";
-import assert from "assert";
+import assert from "node:assert";
 import { HttpProxyService } from "./http-proxy.js";
 function makeBodyForwardingConfig() {
     return {

package/dist/http-handler.js

@@ -1,7 +1,7 @@
-import * as http from "http";
-import * as https from "https";
-import * as net from "net";
-import * as dns from "dns/promises";
+import * as http from "node:http";
+import * as https from "node:https";
+import * as net from "node:net";
+import * as dns from "node:dns/promises";
 import { HttpProxyService } from "./http-proxy.js";
 import { audit } from "./audit.js";
 import { firewallEngine } from "./firewall.js";

package/dist/http-proxy.js

@@ -1,5 +1,5 @@
-import * as net from "net";
-import * as dns from "dns/promises";
+import * as net from "node:net";
+import * as dns from "node:dns/promises";
 import { firewallEngine } from "./firewall.js";
 export class HttpProxyService {
     async validateTargetFirewall(targetUrl, fw) {

package/dist/rate-limiter.test.js

@@ -1,6 +1,6 @@
 import { describe, it } from "node:test";
-import assert from "assert";
-import * as net from "net";
+import assert from "node:assert";
+import * as net from "node:net";
 let PORT_BASE = 65000;
 function nextPort() { return PORT_BASE++; }
 describe("TCP Rate Limiting", () => {

package/dist/schema.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import * as net from "net";
+import * as net from "node:net";
 const CrlfFreeString = z.string().max(8192).refine((val) => !/[\r\n]/.test(val), "Contains CR/LF");
 const Ipv4Schema = z.string().max(45).refine((ip) => net.isIPv4(ip), "Invalid IPv4");
 const Ipv6Schema = z.string().max(45).refine((ip) => net.isIPv6(ip), "Invalid IPv6");

package/dist/srv-record.test.js

@@ -1,5 +1,5 @@
 import { describe, it } from "node:test";
-import assert from "assert";
+import assert from "node:assert";
 import { DevDnsServer } from "./dns-service.js";
 import { DNS_TYPES, DNS_RCODE } from "./types.js";
 function buildQuery(name, type) {

package/dist/tcp-connection-limit.test.js

@@ -1,6 +1,6 @@
 import { describe, it } from "node:test";
-import assert from "assert";
-import * as net from "net";
+import assert from "node:assert";
+import * as net from "node:net";
 let PORT_BASE = 61500;
 function nextPort() {
     return PORT_BASE++;

package/dist/wildcard-matching.test.js

@@ -1,5 +1,5 @@
 import { describe, it } from "node:test";
-import assert from "assert";
+import assert from "node:assert";
 import { DevDnsServer } from "./dns-service.js";
 import { DNS_TYPES } from "./types.js";
 function buildQuery(name, type) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opensecurity/zonzon-core",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "core routing, dns, and firewall engine",
   "type": "module",
   "author": "Lucian BLETAN <neuraluc@gmail.com>",