@specific.dev/spectest 0.131.19 → 0.131.20

package/src/resolver.ts

@@ -1,35 +1,13 @@
-// spectest-resolver: a tiny DNS server that mirrors Docker's embedded
-// DNS, but from the VM host instead of from inside a container.
-//
-// Single-label lookups (no dots, e.g. `api`) hit the Docker socket by
-// container name. Multi-label lookups (e.g. `api.stripe.com`) scan
-// containers on `spectest-net` for one whose network aliases include the
-// queried name — set via service `hostnames` in env.ts. Anything we
-// can't resolve from Docker is forwarded to an upstream DNS server
-// (default 1.1.1.1). The daemon and any test code running on the VM
-// host can do `fetch("http://api:8000")` or `fetch("http://api.stripe.com")`
-// exactly like a container on the same bridge would.
-//
-// Designed to be tiny: one process, no caching beyond DNS TTL (5s), no
-// docker event subscription — every query asks Docker fresh. The latency
-// is ~1ms per query and the failure mode (Docker socket down) is rare
-// enough that simplicity wins.
-//
-// Listens on two *specific* addresses (never 0.0.0.0 — see the bind logic
-// at the bottom): 127.0.0.53, the nameserver the VM's /etc/resolv.conf
-// points at (daemon, host-side test code, and dockerd's embedded DNS as
-// its ExtServer all use it), and the spectest-net bridge gateway IP,
-// which is how an in-cluster k3s pod reaches us (k3s CoreDNS is pointed
-// there; see components/k3s.ts). Binding the specific gateway IP rather
-// than 0.0.0.0 matters: a 0.0.0.0 socket replies to a 127.0.0.53 query
-// from a kernel-chosen source (127.0.0.1), and glibc's resolver drops the
-// answer because its source doesn't match the queried server.
+// Platform-owned DNS server. SDK registry v1 queries are memory-only; Docker
+// discovery below serves only older pinned SDKs until the first full registry.
+// Bind specific loopback/bridge IPs so replies have the expected source address.
 
 import { createSocket, type RemoteInfo } from "node:dgram";
-import { isIPv4 } from "node:net";
+import { isIPv4, createServer as createTcpServer, createConnection } from "node:net";
 import { request as httpRequest } from "node:http";
 import { readFile, stat } from "node:fs/promises";
 import { lookup } from "./harness/names-registry.js";
+import { serveDnsRegistry, compileDnsRegistry } from "./harness/dns-registry.js";
 import * as dnsPacket from "dns-packet";
 
 const NETWORK_NAME = process.env.SPECTEST_NETWORK ?? "spectest-net";
@@ -45,6 +23,8 @@ const TTL_SECONDS = Number(process.env.SPECTEST_RESOLVER_TTL ?? "5");
 const FAKES_REGISTRY_PATH =
   process.env.SPECTEST_FAKES_REGISTRY ?? "/run/spectest-fakes.json";
 
+let registryLookup: ReturnType<typeof compileDnsRegistry> | undefined;
+
 function dockerGet(path: string): Promise<unknown | null> {
   return new Promise((resolve) => {
     const req = httpRequest(
@@ -67,6 +47,7 @@ function dockerGet(path: string): Promise<unknown | null> {
         res.on("error", () => resolve(null));
       },
     );
+    req.setTimeout(3_000, () => req.destroy());
     req.on("error", () => resolve(null));
     req.end();
   });
@@ -84,35 +65,49 @@ async function dockerLookupByName(name: string): Promise<string | null> {
   return ip && ip.length > 0 ? ip : null;
 }
 
-/**
- * Multi-label lookup: scan containers on spectest-net for one whose
- * Aliases include `name`. Aliases are set with `--network-alias` at
- * `docker run` time (see runContainer in daemon.ts).
- *
- * `/containers/json` returns `Aliases: null` in many Docker versions
- * even when --network-alias was set, so we use it only to enumerate
- * container IDs and then inspect each one — inspect reliably surfaces
- * the alias list. The fan-out is bounded by service count (~handful),
- * so the extra roundtrips are cheap.
- */
-async function dockerLookupByAlias(name: string): Promise<string | null> {
-  const filters = encodeURIComponent(JSON.stringify({ network: [NETWORK_NAME] }));
-  const list = (await dockerGet(`/containers/json?filters=${filters}`)) as
-    | Array<{ Id?: string }>
-    | null;
-  if (!Array.isArray(list)) return null;
-  for (const c of list) {
-    if (!c.Id) continue;
-    const info = (await dockerGet(`/containers/${c.Id}/json`)) as
-      | { NetworkSettings?: { Networks?: Record<string, { Aliases?: string[]; IPAddress?: string }> } }
-      | null;
-    const net = info?.NetworkSettings?.Networks?.[NETWORK_NAME];
-    if (!net) continue;
-    if ((net.Aliases ?? []).includes(name) && net.IPAddress) {
-      return net.IPAddress;
+// Alias discovery must not use /containers/json: Docker's containerd image
+// store refreshes image metadata for that endpoint, even for a names-only list.
+// Network inspection enumerates the same endpoints without walking images.
+// Share discovery across names and A/AAAA queries. Keep its lifetime shorter
+// than our DNS TTL so runtime container changes become visible promptly.
+let aliases: { expires: number; hosts: Map<string, string> } | undefined;
+let refreshingAliases: Promise<Map<string, string> | null> | undefined;
+
+async function readAliases(): Promise<{ hosts: Map<string, string>; complete: boolean } | null> {
+  const network = await dockerGet(`/networks/${encodeURIComponent(NETWORK_NAME)}`) as
+    { Containers?: Record<string, unknown> } | null;
+  if (!network?.Containers) return null;
+  const ids = Object.keys(network.Containers);
+  const hosts = new Map<string, string>();
+  let failed = false;
+  // Bound concurrent inspections even for large projects.
+  let next = 0;
+  await Promise.all(Array.from({ length: Math.min(8, ids.length) }, async () => {
+    while (next < ids.length) {
+      const id = ids[next++];
+      const info = await dockerGet(`/containers/${encodeURIComponent(id)}/json`) as
+        | { State?: { Running?: boolean }; NetworkSettings?: { Networks?: Record<string, { Aliases?: string[]; IPAddress?: string }> } }
+        | null;
+      if (!info) { failed = true; continue; }
+      if (!info.State?.Running) continue;
+      const net = info.NetworkSettings?.Networks?.[NETWORK_NAME];
+      if (!net?.IPAddress) continue;
+      for (const alias of net.Aliases ?? []) hosts.set(alias.toLowerCase(), net.IPAddress);
     }
+  }));
+  // A transient Docker failure must not become a cached negative answer.
+  return { hosts, complete: !failed };
+}
+
+async function dockerLookupByAlias(name: string): Promise<string | null> {
+  if (aliases && performance.now() < aliases.expires) return aliases.hosts.get(name) ?? null;
+  if (!refreshingAliases) {
+    refreshingAliases = readAliases().then(result => {
+      if (result?.complete) aliases = { hosts: result.hosts, expires: performance.now() + Math.min(1_000, TTL_SECONDS * 1_000) };
+      return result?.hosts ?? null;
+    }).finally(() => { refreshingAliases = undefined; });
   }
-  return null;
+  return (await refreshingAliases)?.get(name) ?? null;
 }
 
 // Cache the names registry file by mtime so we re-read only when the
@@ -168,26 +163,92 @@ async function lookupWildcard(name: string): Promise<string | null> {
   return lookup({ hosts: {}, wildcards: registryCache.wildcards }, name);
 }
 
-async function forwardUpstream(query: Buffer): Promise<Buffer | null> {
-  return new Promise((resolve) => {
-    const sock = createSocket("udp4");
+// One connected UDP socket validates the upstream source and multiplexes bounded
+// requests. Remap IDs so simultaneous clients cannot steal each other's replies.
+const upstreamSocket = createSocket("udp4");
+const upstreamPending = new Map<number, { query: dnsPacket.Packet; finish: (msg: Buffer | null) => void }>();
+let nextUpstreamId = 0;
+const upstreamReady = new Promise<void>(resolve => upstreamSocket.connect(UPSTREAM_PORT, UPSTREAM_DNS, resolve));
+upstreamSocket.on("error", () => {
+  for (const pending of upstreamPending.values()) pending.finish(null);
+});
+upstreamSocket.on("message", msg => {
+  if (msg.length < 12) return;
+  const pending = upstreamPending.get(msg.readUInt16BE(0));
+  if (!pending) return;
+  try {
+    const response = dnsPacket.decode(msg);
+    if (response.type !== "response" || JSON.stringify(response.questions) !== JSON.stringify(pending.query.questions)) return;
+    pending.finish(msg);
+  } catch { /* Discard malformed or unrelated responses. */ }
+});
+
+const upstreamFlights = new Map<string, Promise<Buffer | null>>();
+async function forwardUpstream(query: Buffer, tcp: boolean): Promise<Buffer | null> {
+  if (tcp) return forwardTcp(query);
+  const normalized = Buffer.from(query);
+  normalized.writeUInt16BE(0, 0);
+  const key = normalized.toString("base64");
+  let flight = upstreamFlights.get(key);
+  if (!flight) {
+    flight = exchangeUdp(normalized).finally(() => { upstreamFlights.delete(key); });
+    upstreamFlights.set(key, flight);
+  }
+  const response = await flight;
+  if (!response) return null;
+  const result = Buffer.from(response);
+  result.writeUInt16BE(query.readUInt16BE(0), 0);
+  return result;
+}
+
+async function exchangeUdp(query: Buffer): Promise<Buffer | null> {
+  if (upstreamPending.size >= 2048) return null;
+  let id: number;
+  do { id = nextUpstreamId++ & 0xffff; } while (upstreamPending.has(id));
+  return new Promise(resolve => {
+    const timer = setTimeout(() => finish(null), 3_000);
+    const finish = (msg: Buffer | null) => {
+      if (!upstreamPending.delete(id)) return;
+      clearTimeout(timer);
+      if (msg) { msg = Buffer.from(msg); msg.writeUInt16BE(query.readUInt16BE(0), 0); }
+      resolve(msg);
+    };
+    upstreamPending.set(id, { query: dnsPacket.decode(query), finish });
+    const forwarded = Buffer.from(query);
+    forwarded.writeUInt16BE(id, 0);
+    void upstreamReady.then(() => {
+      if (upstreamPending.has(id)) upstreamSocket.send(forwarded, error => { if (error) finish(null); });
+    });
+  });
+}
+
+function forwardTcp(query: Buffer): Promise<Buffer | null> {
+  return new Promise(resolve => {
+    const socket = createConnection({ host: UPSTREAM_DNS, port: UPSTREAM_PORT });
+    let data = Buffer.alloc(0);
     let done = false;
-    const finish = (b: Buffer | null) => {
+    const finish = (msg: Buffer | null) => {
       if (done) return;
       done = true;
-      try {
-        sock.close();
-      } catch {
-        // ignore
-      }
-      resolve(b);
+      clearTimeout(timer);
+      socket.destroy();
+      resolve(msg);
     };
-    sock.on("message", (msg) => finish(msg));
-    sock.on("error", () => finish(null));
-    sock.send(query, UPSTREAM_PORT, UPSTREAM_DNS, (err) => {
-      if (err) finish(null);
+    const timer = setTimeout(() => finish(null), 3_000);
+    socket.on("connect", () => { const size = Buffer.alloc(2); size.writeUInt16BE(query.length); socket.write(Buffer.concat([size, query])); });
+    socket.on("data", chunk => {
+      data = Buffer.concat([data, Buffer.from(chunk)]);
+      if (data.length >= 2 && data.length >= 2 + data.readUInt16BE(0)) {
+        const msg = data.subarray(2, 2 + data.readUInt16BE(0));
+        try {
+          const response = dnsPacket.decode(msg);
+          const request = dnsPacket.decode(query);
+          finish(response.type === "response" && response.id === request.id && JSON.stringify(response.questions) === JSON.stringify(request.questions) ? msg : null);
+        } catch { finish(null); }
+      }
     });
-    setTimeout(() => finish(null), 3_000);
+    socket.on("error", () => finish(null));
+    socket.on("close", () => finish(null));
   });
 }
 
@@ -195,7 +256,7 @@ function emptyAnswer(query: dnsPacket.Packet): Buffer {
   return dnsPacket.encode({
     type: "response",
     id: query.id,
-    flags: dnsPacket.AUTHORITATIVE_ANSWER | dnsPacket.RECURSION_DESIRED,
+    flags: dnsPacket.AUTHORITATIVE_ANSWER | dnsPacket.RECURSION_AVAILABLE | ((query.flags ?? 0) & dnsPacket.RECURSION_DESIRED),
     questions: query.questions,
     answers: [],
   });
@@ -205,7 +266,7 @@ function aAnswer(query: dnsPacket.Packet, name: string, ip: string): Buffer {
   return dnsPacket.encode({
     type: "response",
     id: query.id,
-    flags: dnsPacket.AUTHORITATIVE_ANSWER | dnsPacket.RECURSION_DESIRED,
+    flags: dnsPacket.AUTHORITATIVE_ANSWER | dnsPacket.RECURSION_AVAILABLE | ((query.flags ?? 0) & dnsPacket.RECURSION_DESIRED),
     questions: query.questions,
     answers: [{ type: "A", name, ttl: TTL_SECONDS, data: ip }],
   });
@@ -216,18 +277,25 @@ function aAnswer(query: dnsPacket.Packet, name: string, ip: string): Buffer {
 // the client sent to — which is why each listener is bound to a specific
 // IP rather than 0.0.0.0 (glibc drops answers whose source differs from
 // the queried server).
-async function handleQuery(
-  sock: ReturnType<typeof createSocket>,
-  msg: Buffer,
-  rinfo: RemoteInfo,
-): Promise<void> {
+async function handleQuery(msg: Buffer, tcp = false): Promise<Buffer | null> {
   let query: dnsPacket.Packet;
   try {
     query = dnsPacket.decode(msg);
   } catch {
-    return;
+    return null;
   }
+  if (query.type !== "query") return null;
   const q = query.questions?.[0];
+  if (query.questions?.length !== 1) return dnsPacket.encode({ type: "response", id: query.id, flags: 1, questions: query.questions });
+  if (registryLookup && q) {
+    const name = q.name.toLowerCase().replace(/\.$/, "");
+    const ip = registryLookup(name);
+    if (ip !== undefined || !name.includes(".") || name.endsWith(".internal")) {
+      return ip && q.type === "A" ? aAnswer(query, q.name, ip) : emptyAnswer(query);
+    }
+    const answer = await forwardUpstream(msg, tcp);
+    return answer ?? dnsPacket.encode({ type: "response", id: query.id, flags: dnsPacket.RECURSION_AVAILABLE | ((query.flags ?? 0) & dnsPacket.RECURSION_DESIRED) | 2, questions: query.questions });
+  }
   if (q && (q.type === "A" || q.type === "AAAA")) {
     const name = q.name.toLowerCase();
     const isSingleLabel = !name.includes(".");
@@ -246,16 +314,14 @@ async function handleQuery(
       // we own this name so libc should fall back to A instead of chasing
       // a stray upstream AAAA for the real public hostname.
       const resp = q.type === "A" ? aAnswer(query, q.name, ip) : emptyAnswer(query);
-      sock.send(resp, rinfo.port, rinfo.address);
-      return;
+      return resp;
     }
 
     if (isSingleLabel) {
       // Bare hostname we don't own — reply NOERROR with no answers so the
       // resolver moves on quickly. Forwarding bare hostnames upstream just
       // causes timeouts.
-      sock.send(emptyAnswer(query), rinfo.port, rinfo.address);
-      return;
+      return emptyAnswer(query);
     }
     // Multi-label exact miss: try wildcard suffixes (e.g. *.example.com
     // → the k3s cluster) before forwarding upstream. Exact lookups above
@@ -263,16 +329,14 @@ async function handleQuery(
     const wildIp = await lookupWildcard(name);
     if (wildIp) {
       const resp = q.type === "A" ? aAnswer(query, q.name, wildIp) : emptyAnswer(query);
-      sock.send(resp, rinfo.port, rinfo.address);
-      return;
+      return resp;
     }
     // Still nothing — fall through and forward to upstream below.
   }
   // Anything we don't own — forward.
-  const upstream = await forwardUpstream(msg);
+  const upstream = await forwardUpstream(msg, tcp);
   if (upstream) {
-    sock.send(upstream, rinfo.port, rinfo.address);
-    return;
+    return upstream;
   }
   // Upstream unreachable; return SERVFAIL (rcode 2 in low 4 bits of flags).
   const resp = dnsPacket.encode({
@@ -281,7 +345,7 @@ async function handleQuery(
     flags: dnsPacket.RECURSION_DESIRED | 0x2,
     questions: query.questions ?? [],
   });
-  sock.send(resp, rinfo.port, rinfo.address);
+  return resp;
 }
 
 /** Bind one UDP listener on `addr`, wired to the shared handler. A bind
@@ -291,7 +355,7 @@ function bindListener(addr: string, fatalOnError: boolean): Promise<boolean> {
   return new Promise((resolve) => {
     const sock = createSocket("udp4");
     sock.on("message", (msg: Buffer, rinfo: RemoteInfo) => {
-      void handleQuery(sock, msg, rinfo);
+      void handleQuery(msg).then(answer => { if (answer) sock.send(answer, rinfo.port, rinfo.address); }).catch(error => console.error("[spectest-resolver] query failed", error));
     });
     sock.on("error", (err) => {
       // eslint-disable-next-line no-console
@@ -314,6 +378,38 @@ function bindListener(addr: string, fatalOnError: boolean): Promise<boolean> {
   });
 }
 
+/** DNS over TCP uses the same registry and supports external truncated replies. */
+function bindTcpListener(addr: string, fatalOnError: boolean): void {
+  const server = createTcpServer(socket => {
+    let buffered = Buffer.alloc(0);
+    let inFlight = 0;
+    socket.setTimeout(10_000, () => socket.destroy());
+    socket.on("error", () => socket.destroy());
+    socket.on("data", chunk => {
+      buffered = Buffer.concat([buffered, Buffer.from(chunk)]);
+      while (buffered.length >= 2) {
+        const size = buffered.readUInt16BE(0);
+        if (buffered.length < size + 2) break;
+        const msg = Buffer.from(buffered.subarray(2, size + 2));
+        buffered = buffered.subarray(size + 2);
+        if (++inFlight > 128) { socket.destroy(); return; }
+        void handleQuery(msg, true).then(answer => {
+          if (answer && !socket.destroyed) {
+            const prefix = Buffer.alloc(2); prefix.writeUInt16BE(answer.length);
+            socket.write(Buffer.concat([prefix, answer]));
+          }
+        }).catch(() => socket.destroy()).finally(() => { inFlight--; });
+      }
+    });
+  });
+  server.on("error", error => {
+    console.error(`[spectest-resolver] TCP bind ${addr}:`, error);
+    if (fatalOnError) process.exit(1);
+    else setTimeout(() => bindTcpListener(addr, false), 2_000).unref();
+  });
+  server.listen(LISTEN_PORT, addr);
+}
+
 /** Read the spectest-net bridge gateway IP from Docker — the address an
  * in-cluster k3s pod (or any off-bridge client routed through the node)
  * uses to reach the VM host. Null until the network exists. */
@@ -325,8 +421,10 @@ async function bridgeGatewayIp(): Promise<string | null> {
   return gw && gw.length > 0 ? gw : null;
 }
 
-// Primary listener: the loopback nameserver. Fatal if it can't bind.
-void bindListener(LISTEN_ADDR, true);
+// Restore persisted state and open the control socket before advertising DNS.
+await serveDnsRegistry(doc => { registryLookup = compileDnsRegistry(doc); aliases = undefined; });
+await bindListener(LISTEN_ADDR, true);
+bindTcpListener(LISTEN_ADDR, true);
 
 // Secondary listener: the spectest-net bridge gateway, for k3s pods.
 // The network is created by the daemon at /load — after this process
@@ -343,6 +441,7 @@ if (process.env.SPECTEST_RESOLVER_NO_BRIDGE !== "1") {
     if (!gw) return;
     bound = true;
     if (!(await bindListener(gw, false))) bound = false; // retry on failure
+    else { bindTcpListener(gw, false); clearInterval(poll); }
   }, 2_000);
   // Don't keep the event loop alive solely for the poll timer.
   poll.unref?.();