tangerine 1.4.5 → 1.4.7

package/README.md

@@ -58,6 +58,7 @@
   * [`tangerine.setServers(servers)`](#tangerinesetserversservers)
 * [Options](#options)
 * [Cache](#cache)
+* [Compatibility](#compatibility)
 * [Debugging](#debugging)
 * [Benchmarks](#benchmarks)
   * [Tangerine Benchmarks](#tangerine-benchmarks)
@@ -430,6 +431,15 @@ await tangerine.resolve('forwardemail.net'); // uses cached value
 This purge cache feature is useful for DNS records that have recently changed and have had their caches purged at the relevant DNS provider (e.g. [Cloudflare's Purge Cache tool](https://1.1.1.1/purge-cache/)).
 
 
+## Compatibility
+
+The only known compatibility issue is for locally running DNS servers that have wildcard DNS matching.
+
+If you are using `dnsmasq` with a wildcard match on "localhost" to "127.0.0.1", then the results may vary.  For example, if your `dnsmasq` configuration has `address=/localhost/127.0.0.1`, then any match of `localhost` will resolve to `127.0.0.1`.  This means that `dns.promises.lookup('foo.localhost')` will return `127.0.0.1` – however with :tangerine: Tangerine it will not return a value.
+
+The reason is because :tangerine: Tangerine only looks at either `/etc/hosts` (macOS/Linux) and `C:/Windows/System32/drivers/etc/hosts` (Windows).  It does not lookup BIND, dnsmasq, or other configurations running locally.  We would welcome a PR to resolve this (see `isCI` usage in test folder) – however it is a non-issue, as the workaround is to simply append a new line to the hostfile of `127.0.0.1 foo.localhost`.
+
+
 ## Debugging
 
 If you run into issues while using :tangerine: Tangerine, then these recommendations may help:

package/index.js

@@ -7,8 +7,11 @@ const { debuglog } = require('node:util');
 const { getEventListeners, setMaxListeners } = require('node:events');
 const { isIP, isIPv4, isIPv6 } = require('node:net');
 
+const { toASCII } = require('punycode/');
+
 const autoBind = require('auto-bind');
 const getStream = require('get-stream');
+const hostile = require('hostile');
 const ipaddr = require('ipaddr.js');
 const mergeOptions = require('merge-options');
 const pMap = require('p-map');
@@ -18,8 +21,6 @@ const packet = require('dns-packet');
 const semver = require('semver');
 const structuredClone = require('@ungap/structured-clone').default;
 const { getService } = require('port-numbers');
-// eslint-disable-next-line import/order
-const { toASCII } = require('punycode/');
 
 const pkg = require('./package.json');
 
@@ -32,8 +33,32 @@ import('dohdec').then((obj) => {
   dohdec = obj;
 });
 
+// dynamically import private-ip
+let isPrivateIP;
+// eslint-disable-next-line unicorn/prefer-top-level-await
+import('private-ip').then((obj) => {
+  isPrivateIP = obj.default;
+});
+
+const HOSTFILE = hostile
+  .get(true)
+  .map((s) => (Array.isArray(s) ? s.join(' ') : s))
+  .join('\n');
+
+const HOSTS = [];
+const hosts = hostile.get();
+for (const line of hosts) {
+  const [ip, str] = line;
+  const hosts = str.split(' ');
+  HOSTS.push({ ip, hosts });
+}
+
 // <https://github.com/szmarczak/cacheable-lookup/pull/76>
 class Tangerine extends dns.promises.Resolver {
+  static HOSTFILE = HOSTFILE;
+
+  static HOSTS = HOSTS;
+
   static isValidPort(port) {
     return Number.isSafeInteger(port) && port >= 0 && port <= 65535;
   }
@@ -148,7 +173,8 @@ class Tangerine extends dns.promises.Resolver {
     dns.NOTINITIALIZED,
     dns.REFUSED,
     dns.SERVFAIL,
-    dns.TIMEOUT
+    dns.TIMEOUT,
+    'EINVAL'
   ]);
 
   static DNS_TYPES = new Set([
@@ -606,6 +632,16 @@ class Tangerine extends dns.promises.Resolver {
       throw err;
     }
 
+    if (name === '.') {
+      const err = this.constructor.createError(name, '', dns.NOTFOUND);
+      // remap and perform syscall
+      err.syscall = 'getaddrinfo';
+      err.message = err.message.replace('query', 'getaddrinfo');
+      err.errno = -3008; // <-- ?
+      // err.errno = -3007;
+      throw err;
+    }
+
     // purge cache support
     let purgeCache;
     if (options?.purgeCache) {
@@ -639,50 +675,102 @@ class Tangerine extends dns.promises.Resolver {
       }
     }
 
+    // <https://github.com/c-ares/c-ares/blob/38b30bc922c21faa156939bde15ea35332c30e08/src/lib/ares_getaddrinfo.c#L407>
+    // <https://www.rfc-editor.org/rfc/rfc6761.html#section-6.3>
+    //
+    // >  'localhost and any domains falling within .localhost'
+    //
+    // if no system loopback match, then revert to the default
+    // <https://github.com/c-ares/c-ares/blob/38b30bc922c21faa156939bde15ea35332c30e08/src/lib/ares__addrinfo_localhost.c#L224-L229>
+    // - IPv4 = '127.0.0.1"
+    // - IPv6 = "::1"
+    //
+    let resolve4;
+    let resolve6;
+
+    const lower = name.toLowerCase();
+
+    for (const rule of this.constructor.HOSTS) {
+      if (rule.hosts.every((h) => h.toLowerCase() !== lower)) continue;
+      const type = isIP(rule.ip);
+      if (!resolve4 && type === 4) {
+        if (!Array.isArray(resolve4)) resolve4 = [rule.ip];
+        else if (!resolve4.includes(rule.ip)) resolve4.push([rule.ip]);
+      } else if (!resolve6 && type === 6) {
+        if (!Array.isArray(resolve6)) resolve6 = [rule.ip];
+        else if (!resolve6.includes(rule.ip)) resolve6.push(rule.ip);
+      }
+    }
+
+    // safeguard (matches c-ares)
+    if (lower === 'localhost' || lower === 'localhost.') {
+      if (!resolve4) resolve4 = ['127.0.0.1'];
+      if (!resolve6) resolve6 = ['::1'];
+    }
+
+    if (isIPv4(name)) {
+      resolve4 = [name];
+      resolve6 = [];
+    } else if (isIPv6(name)) {
+      resolve6 = [name];
+      resolve4 = [];
+    }
+
     // resolve the first A or AAAA record (conditionally)
-    let answers = [];
+    const results = await Promise.all(
+      [
+        Array.isArray(resolve4)
+          ? Promise.resolve(resolve4)
+          : this.resolve4(name, { purgeCache, noThrowOnNODATA: true }),
+        Array.isArray(resolve6)
+          ? Promise.resolve(resolve6)
+          : this.resolve6(name, { purgeCache, noThrowOnNODATA: true })
+      ].map((p) => p.catch((err) => err))
+    );
 
-    try {
-      answers = await Promise.all([
-        this.resolve4(name, { purgeCache, noThrowOnNODATA: true }),
-        this.resolve6(name, { purgeCache, noThrowOnNODATA: true })
-      ]);
-      // default node behavior seems to return IPv4 by default always regardless
-      answers =
-        answers[0].length > 0 &&
-        (typeof options.family === 'undefined' || options.family === 0)
-          ? answers[0]
-          : answers.flat();
-    } catch (_err) {
-      debug(_err);
-
-      // this will most likely be instanceof AggregateError
-      if (_err instanceof AggregateError) {
-        const err = this.constructor.combineErrors(_err.errors);
-        err.hostname = name;
-        // remap and perform syscall
-        err.syscall = 'getaddrinfo';
-        if (!err.code)
-          err.code = _err.errors.find((e) => e.code)?.code || dns.BADRESP;
-        if (!err.errno)
-          err.errno = _err.errors.find((e) => e.errno)?.errno || undefined;
+    const errors = [];
+    let answers = [];
 
-        throw err;
+    for (const result of results) {
+      if (result instanceof Error) {
+        errors.push(result);
+      } else {
+        answers.push(result);
       }
+    }
 
-      const err = this.constructor.createError(name, '', _err.code, _err.errno);
+    if (
+      answers.length === 0 &&
+      errors.length > 0 &&
+      errors.every((e) => e.code === errors[0].code)
+    ) {
+      const err = this.constructor.createError(
+        name,
+        '',
+        errors[0].code === dns.BADNAME ? dns.NOTFOUND : errors[0].code
+      );
       // remap and perform syscall
       err.syscall = 'getaddrinfo';
-      err.error = _err;
+      err.message = err.message.replace('query', 'getaddrinfo');
+      err.errno = -3008;
       throw err;
     }
 
+    // default node behavior seems to return IPv4 by default always regardless
+    if (answers.length > 0)
+      answers =
+        answers[0].length > 0 &&
+        (typeof options.family === 'undefined' || options.family === 0)
+          ? answers[0]
+          : answers.flat();
+
     // if no results then throw ENODATA
     if (answers.length === 0) {
       const err = this.constructor.createError(name, '', dns.NODATA);
       // remap and perform syscall
       err.syscall = 'getaddrinfo';
-      // err.errno = -3008;
+      err.message = err.message.replace('query', 'getaddrinfo');
+      err.errno = -3008;
       throw err;
     }
 
@@ -835,15 +923,37 @@ class Tangerine extends dns.promises.Resolver {
     }
 
     if (!isIP(ip)) {
-      const err = this.constructor.createError(ip, '', dns.EINVAL);
+      const err = this.constructor.createError(ip, '', 'EINVAL');
+      err.message = `getHostByAddr EINVAL ${err.hostname}`;
       err.syscall = 'getHostByAddr';
-      // err.errno = -22;
+      err.errno = -22;
       if (!ip) delete err.hostname;
       throw err;
     }
 
+    // edge case where localhost IP returns matches
+    if (!isPrivateIP) await pWaitFor(() => Boolean(isPrivateIP));
+
+    const answers = new Set();
+    let match = false;
+
+    for (const rule of this.constructor.HOSTS) {
+      if (rule.ip === ip) {
+        match = true;
+        for (const host of rule.hosts.slice(1)) {
+          answers.add(host);
+        }
+      }
+    }
+
+    if (answers.size > 0 || match) return [...answers];
+
+    // NOTE: we can prob remove this (?)
+    // if (ip === '::1' || ip === '127.0.0.1') return [];
+
     // reverse the IP address
     if (!dohdec) await pWaitFor(() => Boolean(dohdec));
+
     const name = dohdec.DNSoverHTTPS.reverse(ip);
 
     // perform resolvePTR
@@ -1270,13 +1380,22 @@ class Tangerine extends dns.promises.Resolver {
       );
     }
 
-    const results = await pMap(
-      this.constructor.ANY_TYPES,
-      this.#resolveByType(name, options, abortController),
-      // <https://developers.cloudflare.com/fundamentals/api/reference/limits/>
-      { concurrency: this.options.concurrency, signal: abortController.signal }
-    );
-    return results.flat().filter(Boolean);
+    try {
+      const results = await pMap(
+        this.constructor.ANY_TYPES,
+        this.#resolveByType(name, options, abortController),
+        // <https://developers.cloudflare.com/fundamentals/api/reference/limits/>
+        {
+          concurrency: this.options.concurrency,
+          signal: abortController.signal
+        }
+      );
+      return results.flat().filter(Boolean);
+    } catch (err) {
+      err.syscall = 'queryAny';
+      err.message = `queryAny ${err.code} ${name}`;
+      throw err;
+    }
   }
 
   setDefaultResultOrder(dnsOrder) {
@@ -1330,6 +1449,11 @@ class Tangerine extends dns.promises.Resolver {
       throw err;
     }
 
+    // edge case where c-ares detects "." as start of string
+    // <https://github.com/c-ares/c-ares/blob/38b30bc922c21faa156939bde15ea35332c30e08/src/lib/ares_getaddrinfo.c#L829>
+    if (name !== '.' && (name.startsWith('.') || name.includes('..')))
+      throw this.constructor.createError(name, rrtype, dns.BADNAME);
+
     // purge cache support
     let purgeCache;
     if (options?.purgeCache) {
@@ -1712,7 +1836,7 @@ class Tangerine extends dns.promises.Resolver {
               : obj.certificate_type.toString();
             return obj;
           } catch (err) {
-            console.error(err);
+            this.options.logger.error(err, { name, rrtype, options, answer });
             throw err;
           }
         });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "tangerine",
   "description": "Tangerine is the best Node.js drop-in replacement for dns.promises.Resolver using DNS over HTTPS (\"DoH\") via undici with built-in retries, timeouts, smart server rotation, AbortControllers, and caching support for multiple backends (with TTL and purge support).",
-  "version": "1.4.5",
+  "version": "1.4.7",
   "author": "Forward Email (https://forwardemail.net)",
   "bugs": {
     "url": "https://github.com/forwardemail/tangerine/issues"
@@ -15,12 +15,14 @@
     "dns-packet": "^5.4.0",
     "dohdec": "^5.0.3",
     "get-stream": "6",
+    "hostile": "^1.3.3",
     "ipaddr.js": "^2.0.1",
     "merge-options": "3.0.4",
     "p-map": "4",
     "p-timeout": "4",
     "p-wait-for": "3",
     "port-numbers": "^6.0.1",
+    "private-ip": "^3.0.0",
     "punycode": "^2.3.0",
     "semver": "^7.3.8"
   },
@@ -39,6 +41,7 @@
     "husky": "^8.0.3",
     "ioredis": "^5.3.1",
     "ioredis-mock": "^8.2.6",
+    "is-ci": "^3.0.1",
     "lint-staged": "^13.1.2",
     "lodash": "^4.17.21",
     "nock": "^13.3.0",