@serve.zone/dcrouter 18.8.2 → 18.8.4

package/ts/classes.dcrouter.ts

@@ -29,7 +29,7 @@ import { MetricsManager, OpsEventManager } from './monitoring/index.js';
 import { RadiusServer, type IRadiusServerConfig } from './radius/index.js';
 import { RemoteIngressHubLifecycle, RemoteIngressManager, TunnelManager, buildEdgeOnlyDerivationRoutes } from './remoteingress/index.js';
 import { VpnAccessResolver, VpnManager, type IVpnManagerConfig } from './vpn/index.js';
-import { RouteConfigManager, ApiTokenManager, GatewayClientManager, ReferenceResolver, DbSeeder, TargetProfileManager, buildHttpRedirectRuntimeRoutes } from './config/index.js';
+import { RouteConfigManager, ApiTokenManager, GatewayClientManager, ReferenceResolver, DbSeeder, TargetProfileManager, buildHttpRedirectRuntimeRoutes, collectAutoCertificateHostnames } from './config/index.js';
 import type { TVpnClientAllowEntry } from './config/classes.route-config-manager.js';
 import { SecurityLogger, ContentScanner, IPReputationChecker, SecurityPolicyManager, RoutePolicyAugmenter, AuthenticationEventManager } from './security/index.js';
 import { type IHttp3Config, augmentRoutesWithHttp3 } from './http3/index.js';
@@ -731,9 +731,9 @@ export class DcRouter {
           .withStart(async () => {
             this.remoteIngressManager = new RemoteIngressManager();
             this.remoteIngressManager.setHubPublicIps([this.options.publicIp]);
-            this.remoteIngressManager.setOnEdgesChanged((reason) => (
-              this.mailDnsSync.requestEdgeEligibilityCheck(reason)
-            ));
+            this.remoteIngressManager.setOnEdgesChanged((reason) => {
+              this.handleRemoteIngressEdgesChanged(reason);
+            });
             await this.remoteIngressManager.initialize();
           })
           .withStop(async () => {
@@ -845,7 +845,17 @@ export class DcRouter {
                   );
                 }
               },
-              (preparedRoutes) => buildHttpRedirectRuntimeRoutes(preparedRoutes || []),
+              async (preparedRoutes) => {
+                const runtimeRoutes = [
+                  ...buildHttpRedirectRuntimeRoutes(preparedRoutes || []),
+                  ...this.emailRouteBuilder.getRuntimeSmtpsHostnameRoutes(preparedRoutes || []),
+                ];
+                await this.assertGeneratedRuntimeCertificateOwnership(
+                  runtimeRoutes,
+                  'Runtime route application',
+                );
+                return runtimeRoutes;
+              },
               (storedRoute: IRoute) => this.emailRouteBuilder.hydrateStoredRouteForRuntime(storedRoute),
               (routes) => this.routePolicyAugmenter.applyInboundProxyProtocolPolicies(routes),
             );
@@ -1360,10 +1370,18 @@ export class DcRouter {
       logger.log('debug', `DNS routes for nameservers ${this.options.dnsNsDomains.join(', ')}`, { routes: JSON.stringify(this.seedDnsRoutes) });
     }
 
+    const runtimeEmailRoutes = this.emailRouteBuilder.getRuntimeEmailRoutes(
+      this.seedEmailRoutes as IDcRouterRouteConfig[],
+    );
+    await this.assertGeneratedRuntimeCertificateOwnership(
+      runtimeEmailRoutes,
+      'SmartProxy bootstrap',
+    );
+
     // Combined routes for SmartProxy bootstrap (before DB routes are loaded)
     let routes: plugins.smartproxy.IRouteConfig[] = [
       ...this.seedConfigRoutes,
-      ...this.emailRouteBuilder.getRuntimeEmailRoutes(this.seedEmailRoutes as IDcRouterRouteConfig[]),
+      ...runtimeEmailRoutes,
       ...this.runtimeDnsRoutes,
     ];
 
@@ -1749,6 +1767,47 @@ export class DcRouter {
     }
   }
 
+  private async assertGeneratedRuntimeCertificateOwnership(
+    routes: plugins.smartproxy.IRouteConfig[],
+    operation: string,
+  ): Promise<void> {
+    const hostnames = new Set<string>();
+    for (const route of routes) {
+      for (const hostname of collectAutoCertificateHostnames(route as IDcRouterRouteConfig)) {
+        hostnames.add(hostname);
+      }
+    }
+    if (hostnames.size === 0) {
+      return;
+    }
+    if (!this.dnsManager) {
+      throw new Error(
+        `${operation} refused: DnsManager is unavailable, so generated certificate requirements cannot be verified`,
+      );
+    }
+    for (const hostname of hostnames) {
+      const ownership = await this.dnsManager.resolveDomainOwnership(hostname);
+      if (!ownership.verified) {
+        throw new DomainOwnershipError(
+          ownership,
+          operation,
+          'dcrouter-generated-route',
+          { data: { domain: hostname } },
+        );
+      }
+    }
+  }
+
+  private handleRemoteIngressEdgesChanged(reason: string): void {
+    this.mailDnsSync.requestEdgeEligibilityCheck(reason);
+    this.routeConfigManager?.applyRoutes().catch((err: unknown) => {
+      logger.log(
+        'error',
+        `Failed to re-apply routes after Remote Ingress edge change (${reason}): ${(err as Error).message}`,
+      );
+    });
+  }
+
   public async applySecurityPolicy(): Promise<void> {
     if (!this.securityPolicyManager) {
       return;

package/ts/config/classes.route-config-manager.ts

@@ -55,6 +55,26 @@ export interface IUnverifiedRouteDomain {
   ownership: IDomainOwnershipUnverified;
 }
 
+/** Hostnames for which a terminating route asks SmartProxy to obtain a certificate. */
+export function collectAutoCertificateHostnames(route: IDcRouterRouteConfig): string[] {
+  const tls = route.action?.tls;
+  if (!tls || tls.mode === 'passthrough' || tls.certificate !== 'auto') {
+    return [];
+  }
+  const domains = route.match?.domains;
+  const entries = Array.isArray(domains)
+    ? domains
+    : typeof domains === 'string'
+      ? domains.split(',')
+      : [];
+  const hostnames = new Set<string>();
+  for (const entry of entries) {
+    const trimmed = typeof entry === 'string' ? entry.trim() : '';
+    if (trimmed) hostnames.add(trimmed);
+  }
+  return [...hostnames];
+}
+
 interface IRouteMutationOptions {
   trustedManagedMutation?: boolean;
   replaceMetadata?: boolean;
@@ -103,7 +123,9 @@ export class RouteConfigManager {
     private getVpnClientAccessForRoute?: (route: IDcRouterRouteConfig, routeId?: string) => TVpnClientAllowEntry[],
     private referenceResolver?: ReferenceResolver,
     private onRoutesApplied?: (routes: plugins.smartproxy.IRouteConfig[]) => void | Promise<void>,
-    private getRuntimeRoutes?: (preparedRoutes?: plugins.smartproxy.IRouteConfig[]) => plugins.smartproxy.IRouteConfig[],
+    private getRuntimeRoutes?: (
+      preparedRoutes?: plugins.smartproxy.IRouteConfig[],
+    ) => plugins.smartproxy.IRouteConfig[] | Promise<plugins.smartproxy.IRouteConfig[]>,
     private hydrateStoredRoute?: (storedRoute: IRoute) => plugins.smartproxy.IRouteConfig | undefined,
     private applyInboundProxyPolicies?: (routes: plugins.smartproxy.IRouteConfig[]) => plugins.smartproxy.IRouteConfig[],
   ) {}
@@ -136,30 +158,6 @@ export class RouteConfigManager {
   // Certificate requirement / domain ownership gate
   // =========================================================================
 
-  /**
-   * Hostnames for which this route asks dcrouter to obtain a certificate.
-   * `tls.certificate === 'auto'` on a terminating route is exactly what makes
-   * SmartProxy call certProvisionFunction, i.e. what starts an ACME order.
-   */
-  private collectAutoCertificateHostnames(route: IDcRouterRouteConfig): string[] {
-    const tls = route.action?.tls;
-    if (!tls || tls.mode === 'passthrough' || tls.certificate !== 'auto') {
-      return [];
-    }
-    const domains = route.match?.domains;
-    const entries = Array.isArray(domains)
-      ? domains
-      : typeof domains === 'string'
-        ? domains.split(',')
-        : [];
-    const hostnames = new Set<string>();
-    for (const entry of entries) {
-      const trimmed = typeof entry === 'string' ? entry.trim() : '';
-      if (trimmed) hostnames.add(trimmed);
-    }
-    return [...hostnames];
-  }
-
   /**
    * Refuse a route whose certificate requirement covers a domain we cannot prove
    * we own. This is the point of attribution: the operator making the change gets
@@ -170,7 +168,7 @@ export class RouteConfigManager {
     route: IDcRouterRouteConfig,
     operation: string,
   ): Promise<void> {
-    const hostnames = this.collectAutoCertificateHostnames(route);
+    const hostnames = collectAutoCertificateHostnames(route);
     if (hostnames.length === 0) {
       return;
     }
@@ -209,7 +207,7 @@ export class RouteConfigManager {
     }
     const auditableRoutes = [...this.routes.values()].filter((storedRoute) => {
       return storedRoute.enabled
-        && this.collectAutoCertificateHostnames(storedRoute.route).length > 0;
+        && collectAutoCertificateHostnames(storedRoute.route).length > 0;
     });
     if (auditableRoutes.length === 0) {
       return [];
@@ -219,7 +217,7 @@ export class RouteConfigManager {
     const authorityZones = this.domainOwnershipSource.getAuthorityZones();
     const findings: IUnverifiedRouteDomain[] = [];
     for (const storedRoute of auditableRoutes) {
-      for (const hostname of this.collectAutoCertificateHostnames(storedRoute.route)) {
+      for (const hostname of collectAutoCertificateHostnames(storedRoute.route)) {
         const ownership = resolveDomainOwnership({ fqdn: hostname, zones, authorityZones });
         if (ownership.verified) continue;
         findings.push({
@@ -1209,7 +1207,7 @@ export class RouteConfigManager {
 
       let enabledRoutes = this.getPreparedEnabledRoutesForApply();
 
-      const runtimeRoutes = this.getRuntimeRoutes?.(enabledRoutes) || [];
+      const runtimeRoutes = await this.getRuntimeRoutes?.(enabledRoutes) || [];
       for (const route of runtimeRoutes) {
         enabledRoutes.push(this.prepareRouteForApply(route));
       }

package/ts/config/index.ts

@@ -1,6 +1,6 @@
 // Export validation tools only
 export * from './validator.js';
-export { RouteConfigManager } from './classes.route-config-manager.js';
+export { RouteConfigManager, collectAutoCertificateHostnames } from './classes.route-config-manager.js';
 export { ApiTokenManager } from './classes.api-token-manager.js';
 export { GatewayClientManager } from './classes.gateway-client-manager.js';
 export { ReferenceResolver } from './classes.reference-resolver.js';

package/ts/email/classes.email-route-builder.ts

@@ -5,6 +5,7 @@ import type { IRoute } from '../../ts_interfaces/data/route-management.js';
 import type { IDcRouterRouteConfig } from '../../ts_interfaces/data/remoteingress.js';
 import { REMOTE_INGRESS_MAIL_TAG } from '../../ts_interfaces/data/remoteingress.js';
 import type { DcRouter } from '../classes.dcrouter.js';
+import { normalizeOwnershipHostname } from '../dns/domain-ownership.js';
 
 type TInboundProxyProtocolPolicy = NonNullable<plugins.smartproxy.IRouteMatch['inboundProxyProtocol']>;
 
@@ -121,7 +122,56 @@ export class EmailRouteBuilder {
   }
 
   public getRuntimeEmailRoutes(emailRoutes: IDcRouterRouteConfig[]): plugins.smartproxy.IRouteConfig[] {
-    return emailRoutes.map((route) => this.createServerFirstEmailRuntimeRoute(route) || route);
+    const runtimeRoutes = emailRoutes.map(
+      (route) => this.createServerFirstEmailRuntimeRoute(route) || route,
+    );
+    return [...runtimeRoutes, ...this.getRuntimeSmtpsHostnameRoutes(runtimeRoutes)];
+  }
+
+  /**
+   * Add a hostname-restricted SMTPS route for SNI and certificate provisioning,
+   * while retaining the unrestricted generated route for clients without SNI.
+   */
+  public getRuntimeSmtpsHostnameRoutes(
+    runtimeRoutes: plugins.smartproxy.IRouteConfig[],
+  ): plugins.smartproxy.IRouteConfig[] {
+    const namedRoutes = runtimeRoutes.filter((route) => route.name === 'smtps-route');
+    if (namedRoutes.length === 0) {
+      return [];
+    }
+    if (namedRoutes.length !== 1) {
+      throw new Error(`Expected exactly one generated smtps-route, found ${namedRoutes.length}`);
+    }
+
+    const fallbackRoute = namedRoutes[0];
+    const ports = plugins.smartproxy.expandPortRange(fallbackRoute.match.ports as any) as number[];
+    const action = fallbackRoute.action;
+    if (
+      ports.length !== 1
+      || ports[0] !== 465
+      || fallbackRoute.match.domains !== undefined
+      || (fallbackRoute.priority ?? 0) !== 0
+      || action.type !== 'socket-handler'
+      || typeof action.socketHandler !== 'function'
+      || action.tls?.mode !== 'terminate'
+      || action.tls?.certificate !== 'auto'
+    ) {
+      throw new Error(
+        'Generated smtps-route no longer matches the guarded unrestricted TLS-terminating socket-handler shape',
+      );
+    }
+
+    return [{
+      ...fallbackRoute,
+      id: 'runtime-email-smtps-hostnames',
+      name: 'smtps-hostnames-route',
+      priority: 100,
+      match: {
+        ...fallbackRoute.match,
+        domains: this.getSmtpsCertificateHostnames(),
+      },
+      action: { ...fallbackRoute.action },
+    }];
   }
 
   /**
@@ -164,6 +214,30 @@ export class EmailRouteBuilder {
     return new Set(sourceRoutes.map((route) => route.name).filter(Boolean) as string[]);
   }
 
+  private getSmtpsCertificateHostnames(): string[] {
+    const configuredHostname = this.dcRouterRef.options.emailConfig?.hostname;
+    if (typeof configuredHostname !== 'string' || !configuredHostname.trim()) {
+      throw new Error('SMTPS port 465 requires a non-empty configured email hostname');
+    }
+
+    const candidates = [
+      configuredHostname,
+      ...(this.dcRouterRef.remoteIngressManager?.getMailEdges() || [])
+        .filter((edge) => edge.enabled && edge.tags?.includes(REMOTE_INGRESS_MAIL_TAG))
+        .map((edge) => edge.mailHostname)
+        .filter((hostname): hostname is string => typeof hostname === 'string' && Boolean(hostname.trim())),
+    ];
+    const hostnames = new Set<string>();
+    for (const candidate of candidates) {
+      const normalized = candidate.trim().toLowerCase().replace(/\.$/, '');
+      if (normalizeOwnershipHostname(normalized) !== normalized) {
+        throw new Error(`SMTPS certificate hostname '${candidate}' is not a valid fully qualified domain name`);
+      }
+      hostnames.add(normalized);
+    }
+    return [...hostnames].sort();
+  }
+
   private shouldHydrateGeneratedEmailRoute(storedRoute: IRoute): boolean {
     if (storedRoute.origin !== 'email') {
       return false;

package/ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '18.8.2',
+  version: '18.8.4',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }