@serve.zone/dcrouter 17.9.2 → 17.9.4

package/dist_ts_web/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/dcrouter',
-    version: '17.9.2',
+    version: '17.9.4',
     description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfd2ViLzAwX2NvbW1pdGluZm9fZGF0YS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7R0FFRztBQUNILE1BQU0sQ0FBQyxNQUFNLFVBQVUsR0FBRztJQUN4QixJQUFJLEVBQUUsc0JBQXNCO0lBQzVCLE9BQU8sRUFBRSxRQUFRO0lBQ2pCLFdBQVcsRUFBRSwwRUFBMEU7Q0FDeEYsQ0FBQSJ9

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@serve.zone/dcrouter",
   "private": false,
-  "version": "17.9.2",
+  "version": "17.9.4",
   "description": "A multifaceted routing service handling mail and SMS delivery functions.",
   "type": "module",
   "bin": {

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '17.9.2',
+  version: '17.9.4',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }

package/ts/classes.dcrouter.ts

@@ -743,6 +743,9 @@ export class DcRouter {
                 } catch (err: unknown) {
                   logger.log('error', `Failed to sync Remote Ingress allowed edges: ${(err as Error).message}`);
                 }
+                this.dnsServerRuntime.syncPrivateRouteOverrides(
+                  routes as IDcRouterRouteConfig[],
+                );
               },
               (preparedRoutes) => buildHttpRedirectRuntimeRoutes(preparedRoutes || []),
               (storedRoute: IRoute) => this.emailRouteBuilder.hydrateStoredRouteForRuntime(storedRoute),
@@ -832,10 +835,14 @@ export class DcRouter {
 
     // DNS Server: optional, depends on SmartProxy
     if (this.options.dnsNsDomains && this.options.dnsNsDomains.length > 0 && this.options.dnsScopes && this.options.dnsScopes.length > 0) {
+      const dnsServerDeps = ['SmartProxy'];
+      if (this.options.dbConfig?.enabled !== false) {
+        dnsServerDeps.push('ConfigManagers', 'EmailServer');
+      }
       this.serviceManager.addService(
         new plugins.taskbuffer.Service('DnsServer')
           .optional()
-          .dependsOn('SmartProxy', ...((this.options.dbConfig?.enabled !== false) ? ['EmailServer'] : []))
+          .dependsOn(...dnsServerDeps)
           .withStart(async () => {
             await this.dnsServerRuntime.setup();
           })

package/ts/dns/classes.dns-server-runtime.ts

@@ -2,6 +2,7 @@ import * as plugins from '../plugins.js';
 import { logger } from '../logger.js';
 import { buildEmailDnsRecords } from '../email/index.js';
 import type { DcRouter } from '../classes.dcrouter.js';
+import type { IDcRouterRouteConfig } from '../../ts_interfaces/data/remoteingress.js';
 
 type TDnsRecordSeed = { name: string; type: string; value: string; ttl?: number; useIngressProxy?: boolean };
 
@@ -18,6 +19,8 @@ export class DnsServerRuntime {
   private batchCount = 0;
   private batchTimer: ReturnType<typeof setTimeout> | null = null;
 
+  private privateRouteHostnames = new Set<string>();
+  private privateRouteTargetIp?: string;
   constructor(private dcRouterRef: DcRouter) {}
 
   /**
@@ -58,6 +61,10 @@ export class DnsServerRuntime {
       }
     }
 
+    this.privateRouteTargetIp = plugins.net.isIP(vmIpAddress)
+      && vmIpAddress !== '0.0.0.0' && vmIpAddress !== '::'
+      ? vmIpAddress
+      : undefined;
     // Create DNS server instance with manual HTTPS mode
     const dnsServer = new plugins.smartdns.dnsServerMod.DnsServer({
       udpPort: 53,
@@ -72,6 +79,7 @@ export class DnsServerRuntime {
       httpsCert: ''
     });
     this.dcRouterRef.dnsServer = dnsServer;
+    this.registerPrivateRouteHandler(dnsServer);
 
     // Start the DNS server. smartdns owns UDP and DNS-over-TCP; dcrouter
     // keeps DNS-over-HTTPS routed through SmartProxy manual HTTPS mode.
@@ -172,6 +180,86 @@ export class DnsServerRuntime {
     this.dcRouterRef.mailDnsSync?.requestSync('DNS server attached');
   }
 
+  /**
+   * Keep an internal-only A-record overlay for exact route hostnames whose
+   * compiled source policy is private or whose only ingress is SmartVPN.
+   * Public routes compile without clientIp restrictions and are never added.
+   */
+  public syncPrivateRouteOverrides(routesArg: IDcRouterRouteConfig[]): void {
+    const nextHostnames = new Set<string>();
+    for (const route of routesArg) {
+      if (route.action?.type !== 'forward') continue;
+      const ingress = route.ingress;
+      if (!ingress?.directHub && !ingress?.smartVpn) continue;
+
+      const clientIp = route.match?.clientIp;
+      const clientIpEntries = Array.isArray(clientIp)
+        ? clientIp
+        : [];
+      const hasRestrictedSourceProfile = clientIpEntries
+        .map((entryArg) => entryArg.trim())
+        .filter(Boolean)
+        .some((entryArg) => entryArg !== '*');
+      const isSmartVpnOnly = ingress.smartVpn && !ingress.directHub;
+      if (!hasRestrictedSourceProfile && !isSmartVpnOnly) continue;
+
+      const domains = route.match?.domains;
+      const domainEntries = Array.isArray(domains)
+        ? domains
+        : typeof domains === 'string'
+          ? domains.split(',')
+          : [];
+      for (const domainArg of domainEntries) {
+        const hostname = this.normalizePrivateRouteHostname(domainArg);
+        if (hostname) nextHostnames.add(hostname);
+      }
+    }
+
+    const changed = nextHostnames.size !== this.privateRouteHostnames.size
+      || [...nextHostnames].some((hostnameArg) => !this.privateRouteHostnames.has(hostnameArg));
+    this.privateRouteHostnames = nextHostnames;
+    if (changed) {
+      logger.log(
+        'info',
+        `DNS private-route overlay now serves ${nextHostnames.size} exact hostname(s)`,
+        { zone: 'dns' },
+      );
+    }
+  }
+
+  private registerPrivateRouteHandler(
+    dnsServerArg: plugins.smartdns.dnsServerMod.DnsServer,
+  ): void {
+    dnsServerArg.registerHandler('*', ['A'], (questionArg) => {
+      const hostname = this.normalizePrivateRouteHostname(questionArg.name);
+      if (
+        !hostname
+        || questionArg.type.toUpperCase() !== 'A'
+        || !this.privateRouteTargetIp
+        || !this.privateRouteHostnames.has(hostname)
+      ) {
+        return null;
+      }
+      return {
+        name: hostname,
+        type: 'A',
+        class: 'IN',
+        ttl: 60,
+        data: this.privateRouteTargetIp,
+      };
+    });
+  }
+
+  private normalizePrivateRouteHostname(hostnameArg: string): string | undefined {
+    const hostname = hostnameArg.trim().toLowerCase().replace(/\.$/, '');
+    if (!hostname || hostname.includes('*') || hostname.includes(',')) return undefined;
+    if (hostname.length > 253) return undefined;
+    const labels = hostname.split('.');
+    if (labels.some((labelArg) => !labelArg || labelArg.length > 63
+      || !/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(labelArg))) return undefined;
+    return hostname;
+  }
+
   /**
    * Create the DoH socket handler SmartProxy routes hand TLS sockets to.
    */

package/ts/dns/classes.gateway-route-dns-reconciler.ts

@@ -128,7 +128,9 @@ export class GatewayRouteDnsReconciler {
       return { success: true, retryable: false, mode, status: 'not-applicable', checkedAt };
     }
     const hostname = normalizeGatewayHostname(optionsArg.hostname);
-    const targetIp = optionsArg.delete ? undefined : this.getDesiredTargetIp();
+    const targetIp = optionsArg.delete
+      ? undefined
+      : this.getDesiredTargetIp(optionsArg.gatewayClientId, hostname);
     const workKey = this.buildWorkKey(optionsArg, hostname, mode, targetIp);
     const latestIntent = this.latestIntentByHostname.get(hostname);
     if (latestIntent?.workKey === workKey) return await latestIntent.promise;
@@ -217,7 +219,7 @@ export class GatewayRouteDnsReconciler {
         status: 'target-invalid',
         hostname,
         checkedAt,
-        message: 'Gateway DNS target requires a valid proxyIps[0], publicIp, or detectedPublicIp',
+        message: 'Gateway DNS target requires a valid hub DNS bind address or public ingress IP',
       };
     }
     const recordType = ipFamily === 6 ? 'AAAA' : 'A';
@@ -543,7 +545,33 @@ export class GatewayRouteDnsReconciler {
     return this.successForZone('managed-deleted', modeArg, checkedAtArg, hostnameArg, undefined, undefined, zone, []);
   }
 
-  private getDesiredTargetIp(): string | undefined {
+  private getDesiredTargetIp(
+    gatewayClientIdArg: string,
+    hostnameArg: string,
+  ): string | undefined {
+    const gatewayClientId = gatewayClientIdArg.trim().toLowerCase();
+    const claimRoutes = (this.dcRouterRef.routeConfigManager?.getMergedRoutes().routes || [])
+      .filter((routeArg) => {
+        if (!routeArg.enabled || routeArg.metadata?.ownerType !== 'gatewayClient'
+          || routeArg.metadata.gatewayDnsMode !== 'reconcile'
+          || routeArg.metadata.gatewayClientId?.trim().toLowerCase() !== gatewayClientId) {
+          return false;
+        }
+        return this.getRouteHostname(routeArg.route) === hostnameArg;
+      });
+    const hasPublicIngress = claimRoutes.some((routeArg) => routeArg.route.remoteIngress?.enabled);
+    const hasPrivateHubIngress = claimRoutes.length > 0 && claimRoutes.every((routeArg) => {
+      const ingress = routeArg.route.ingress;
+      return !routeArg.route.remoteIngress?.enabled
+        && Boolean(ingress?.directHub || ingress?.smartVpn);
+    });
+    if (!hasPublicIngress && hasPrivateHubIngress) {
+      const dnsBindInterface = this.dcRouterRef.options.dnsBindInterface?.trim();
+      if (dnsBindInterface && dnsBindInterface !== '0.0.0.0' && dnsBindInterface !== '::') {
+        return dnsBindInterface;
+      }
+      return undefined;
+    }
     return this.dcRouterRef.options.proxyIps?.[0]
       || this.dcRouterRef.options.publicIp
       || this.dcRouterRef.detectedPublicIp

package/ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '17.9.2',
+  version: '17.9.4',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }