@serve.zone/dcrouter 17.9.1 → 17.9.3

package/dist_ts_web/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/dcrouter',
-    version: '17.9.1',
+    version: '17.9.3',
     description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfd2ViLzAwX2NvbW1pdGluZm9fZGF0YS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7R0FFRztBQUNILE1BQU0sQ0FBQyxNQUFNLFVBQVUsR0FBRztJQUN4QixJQUFJLEVBQUUsc0JBQXNCO0lBQzVCLE9BQU8sRUFBRSxRQUFRO0lBQ2pCLFdBQVcsRUFBRSwwRUFBMEU7Q0FDeEYsQ0FBQSJ9

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@serve.zone/dcrouter",
   "private": false,
-  "version": "17.9.1",
+  "version": "17.9.3",
   "description": "A multifaceted routing service handling mail and SMS delivery functions.",
   "type": "module",
   "bin": {
@@ -41,7 +41,7 @@
     "@push.rocks/smartbucket": "^4.6.1",
     "@push.rocks/smartchallenge": "^1.1.0",
     "@push.rocks/smartdata": "^7.4.0",
-    "@push.rocks/smartdb": "^2.14.0",
+    "@push.rocks/smartdb": "^2.14.1",
     "@push.rocks/smartdns": "^7.12.1",
     "@push.rocks/smartfs": "^1.6.0",
     "@push.rocks/smartguard": "^3.1.2",

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '17.9.1',
+  version: '17.9.3',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }

package/ts/classes.dcrouter.ts

@@ -743,6 +743,9 @@ export class DcRouter {
                 } catch (err: unknown) {
                   logger.log('error', `Failed to sync Remote Ingress allowed edges: ${(err as Error).message}`);
                 }
+                this.dnsServerRuntime.syncPrivateRouteOverrides(
+                  routes as IDcRouterRouteConfig[],
+                );
               },
               (preparedRoutes) => buildHttpRedirectRuntimeRoutes(preparedRoutes || []),
               (storedRoute: IRoute) => this.emailRouteBuilder.hydrateStoredRouteForRuntime(storedRoute),
@@ -832,10 +835,14 @@ export class DcRouter {
 
     // DNS Server: optional, depends on SmartProxy
     if (this.options.dnsNsDomains && this.options.dnsNsDomains.length > 0 && this.options.dnsScopes && this.options.dnsScopes.length > 0) {
+      const dnsServerDeps = ['SmartProxy'];
+      if (this.options.dbConfig?.enabled !== false) {
+        dnsServerDeps.push('ConfigManagers', 'EmailServer');
+      }
       this.serviceManager.addService(
         new plugins.taskbuffer.Service('DnsServer')
           .optional()
-          .dependsOn('SmartProxy', ...((this.options.dbConfig?.enabled !== false) ? ['EmailServer'] : []))
+          .dependsOn(...dnsServerDeps)
           .withStart(async () => {
             await this.dnsServerRuntime.setup();
           })

package/ts/dns/classes.dns-server-runtime.ts

@@ -2,6 +2,7 @@ import * as plugins from '../plugins.js';
 import { logger } from '../logger.js';
 import { buildEmailDnsRecords } from '../email/index.js';
 import type { DcRouter } from '../classes.dcrouter.js';
+import type { IDcRouterRouteConfig } from '../../ts_interfaces/data/remoteingress.js';
 
 type TDnsRecordSeed = { name: string; type: string; value: string; ttl?: number; useIngressProxy?: boolean };
 
@@ -18,6 +19,8 @@ export class DnsServerRuntime {
   private batchCount = 0;
   private batchTimer: ReturnType<typeof setTimeout> | null = null;
 
+  private privateRouteHostnames = new Set<string>();
+  private privateRouteTargetIp?: string;
   constructor(private dcRouterRef: DcRouter) {}
 
   /**
@@ -58,6 +61,10 @@ export class DnsServerRuntime {
       }
     }
 
+    this.privateRouteTargetIp = plugins.net.isIP(vmIpAddress)
+      && vmIpAddress !== '0.0.0.0' && vmIpAddress !== '::'
+      ? vmIpAddress
+      : undefined;
     // Create DNS server instance with manual HTTPS mode
     const dnsServer = new plugins.smartdns.dnsServerMod.DnsServer({
       udpPort: 53,
@@ -72,6 +79,7 @@ export class DnsServerRuntime {
       httpsCert: ''
     });
     this.dcRouterRef.dnsServer = dnsServer;
+    this.registerPrivateRouteHandler(dnsServer);
 
     // Start the DNS server. smartdns owns UDP and DNS-over-TCP; dcrouter
     // keeps DNS-over-HTTPS routed through SmartProxy manual HTTPS mode.
@@ -172,6 +180,86 @@ export class DnsServerRuntime {
     this.dcRouterRef.mailDnsSync?.requestSync('DNS server attached');
   }
 
+  /**
+   * Keep an internal-only A-record overlay for exact route hostnames whose
+   * compiled source policy is private or whose only ingress is SmartVPN.
+   * Public routes compile without clientIp restrictions and are never added.
+   */
+  public syncPrivateRouteOverrides(routesArg: IDcRouterRouteConfig[]): void {
+    const nextHostnames = new Set<string>();
+    for (const route of routesArg) {
+      if (route.action?.type !== 'forward') continue;
+      const ingress = route.ingress;
+      if (!ingress?.directHub && !ingress?.smartVpn) continue;
+
+      const clientIp = route.match?.clientIp;
+      const clientIpEntries = Array.isArray(clientIp)
+        ? clientIp
+        : [];
+      const hasRestrictedSourceProfile = clientIpEntries
+        .map((entryArg) => entryArg.trim())
+        .filter(Boolean)
+        .some((entryArg) => entryArg !== '*');
+      const isSmartVpnOnly = ingress.smartVpn && !ingress.directHub;
+      if (!hasRestrictedSourceProfile && !isSmartVpnOnly) continue;
+
+      const domains = route.match?.domains;
+      const domainEntries = Array.isArray(domains)
+        ? domains
+        : typeof domains === 'string'
+          ? domains.split(',')
+          : [];
+      for (const domainArg of domainEntries) {
+        const hostname = this.normalizePrivateRouteHostname(domainArg);
+        if (hostname) nextHostnames.add(hostname);
+      }
+    }
+
+    const changed = nextHostnames.size !== this.privateRouteHostnames.size
+      || [...nextHostnames].some((hostnameArg) => !this.privateRouteHostnames.has(hostnameArg));
+    this.privateRouteHostnames = nextHostnames;
+    if (changed) {
+      logger.log(
+        'info',
+        `DNS private-route overlay now serves ${nextHostnames.size} exact hostname(s)`,
+        { zone: 'dns' },
+      );
+    }
+  }
+
+  private registerPrivateRouteHandler(
+    dnsServerArg: plugins.smartdns.dnsServerMod.DnsServer,
+  ): void {
+    dnsServerArg.registerHandler('*', ['A'], (questionArg) => {
+      const hostname = this.normalizePrivateRouteHostname(questionArg.name);
+      if (
+        !hostname
+        || questionArg.type.toUpperCase() !== 'A'
+        || !this.privateRouteTargetIp
+        || !this.privateRouteHostnames.has(hostname)
+      ) {
+        return null;
+      }
+      return {
+        name: hostname,
+        type: 'A',
+        class: 'IN',
+        ttl: 60,
+        data: this.privateRouteTargetIp,
+      };
+    });
+  }
+
+  private normalizePrivateRouteHostname(hostnameArg: string): string | undefined {
+    const hostname = hostnameArg.trim().toLowerCase().replace(/\.$/, '');
+    if (!hostname || hostname.includes('*') || hostname.includes(',')) return undefined;
+    if (hostname.length > 253) return undefined;
+    const labels = hostname.split('.');
+    if (labels.some((labelArg) => !labelArg || labelArg.length > 63
+      || !/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(labelArg))) return undefined;
+    return hostname;
+  }
+
   /**
    * Create the DoH socket handler SmartProxy routes hand TLS sockets to.
    */

package/ts/security/classes.security-policy-manager.ts

@@ -44,6 +44,7 @@ export class SecurityPolicyManager {
   private retentionSweepTimer?: ReturnType<typeof setInterval>;
   private retentionSweepPromise?: Promise<void>;
   private retentionMutationTail: Promise<void> = Promise.resolve();
+  private persistedIntelligenceCount?: number;
   private readonly inFlightObservations = new Map<string, Promise<void>>();
   private readonly queuedObservations = new Set<string>();
   private readonly observationQueue: string[] = [];
@@ -221,10 +222,11 @@ export class SecurityPolicyManager {
     return await this.withRetentionMutation(async () => {
       if (this.isStopping) return null;
       let doc = await IpIntelligenceDoc.findByIp(ip);
+      let isNewDocument = false;
+      let verifiedCount = this.persistedIntelligenceCount;
       if (!doc) {
-        let countAfterPrune: number;
         try {
-          countAfterPrune = await this.pruneIpIntelligence({ forCapacity: true });
+          verifiedCount ??= await this.pruneIpIntelligence({ forCapacity: true });
         } catch (error: unknown) {
           logger.log(
             'warn',
@@ -233,17 +235,18 @@ export class SecurityPolicyManager {
           );
           return null;
         }
-        if (countAfterPrune >= IP_INTELLIGENCE_RETENTION_HIGH_WATER) {
+        if (verifiedCount >= IP_INTELLIGENCE_RETENTION_HIGH_WATER) {
           logger.log(
             'warn',
             'Skipping persistence for new IP ' + ip
-              + ': cache remains at capacity (' + countAfterPrune + ')',
+              + ': cache remains at capacity (' + verifiedCount + ')',
           );
           return null;
         }
         doc = new IpIntelligenceDoc();
         doc.ipAddress = ip;
         doc.firstSeenAt = now;
+        isNewDocument = true;
       }
 
       Object.assign(doc, intelligence);
@@ -251,6 +254,9 @@ export class SecurityPolicyManager {
       doc.updatedAt = now;
       doc.seenCount = (doc.seenCount || 0) + 1;
       await doc.save();
+      if (isNewDocument) {
+        this.persistedIntelligenceCount = verifiedCount! + 1;
+      }
       return doc;
     });
   }
@@ -277,6 +283,7 @@ export class SecurityPolicyManager {
   }
 
   private async pruneIpIntelligence(options: { forCapacity: boolean }): Promise<number> {
+    this.persistedIntelligenceCount = undefined;
     let deletedCount = 0;
     const expiryCutoff = this.now() - IP_INTELLIGENCE_RETENTION_MAX_AGE_MS;
 
@@ -313,6 +320,7 @@ export class SecurityPolicyManager {
     if (deletedCount > 0) {
       logger.log('info', 'IP intelligence retention removed ' + deletedCount + ' cached record(s)');
     }
+    this.persistedIntelligenceCount = currentCount;
     return currentCount;
   }
 

package/ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '17.9.1',
+  version: '17.9.3',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }