Add DNS diagnostics across dataplane and client

2026-09-01 04:16:15 +03:00
parent e0bdafd25e
commit 76a99f098a
23 changed files with 1888 additions and 35 deletions
@@ -0,0 +1,208 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import test from 'node:test';
+
+import {
+  buildDnsQuery,
+  createDnsDiagnosticsService,
+  parseDnsResponse,
+} from '../../dist/server/services/dnsDiagnosticsService.js';
+
+function wireResponse(query, { rcode = 0, truncated = false, address = null } = {}) {
+  const header = Buffer.alloc(12);
+  query.copy(header, 0, 0, 2);
+  header.writeUInt16BE(0x8180 | rcode | (truncated ? 0x0200 : 0), 2);
+  header.writeUInt16BE(1, 4);
+  header.writeUInt16BE(address ? 1 : 0, 6);
+  const question = query.subarray(12);
+  if (!address) return Buffer.concat([header, question]);
+  const type = query.readUInt16BE(query.length - 4);
+  const data = type === 1
+    ? Buffer.from(address.split('.').map(Number))
+    : Buffer.from(address.split(':').flatMap((part) => {
+        const value = Number.parseInt(part || '0', 16);
+        return [value >> 8, value & 0xff];
+      }));
+  const answer = Buffer.alloc(12);
+  answer.writeUInt16BE(0xc00c, 0);
+  answer.writeUInt16BE(type, 2);
+  answer.writeUInt16BE(1, 4);
+  answer.writeUInt32BE(60, 6);
+  answer.writeUInt16BE(data.length, 10);
+  return Buffer.concat([header, question, answer, data]);
+}
+
+function addressFor(packet, path = 'direct') {
+  return packet.readUInt16BE(packet.length - 4) === 1
+    ? path === 'direct' ? '8.8.8.8' : '9.9.9.9'
+    : path === 'direct' ? '2001:db8:0:0:0:0:0:1' : '2001:db8:0:0:0:0:0:2';
+}
+
+test('DNS wire codec parses compressed A/AAAA and rejects malformed packets', () => {
+  const aQuery = buildDnsQuery('www.youtube.com', 'A', 17);
+  const aaaaQuery = buildDnsQuery('www.youtube.com', 'AAAA', 18);
+  assert.deepEqual(parseDnsResponse(wireResponse(aQuery, { address: '8.8.8.8' }), 17), {
+    rcode: 'NOERROR', truncated: false, ipv4: ['8.8.8.8'], ipv6: [],
+  });
+  assert.deepEqual(parseDnsResponse(wireResponse(aaaaQuery, {
+    address: '2001:db8:0:0:0:0:0:1',
+  }), 18).ipv6, ['2001:db8:0:0:0:0:0:1']);
+  assert.equal(parseDnsResponse(wireResponse(aQuery, { rcode: 3 }), 17).rcode, 'NXDOMAIN');
+  assert.equal(parseDnsResponse(wireResponse(aQuery, { rcode: 2 }), 17).rcode, 'SERVFAIL');
+  assert.throws(() => parseDnsResponse(Buffer.from([0, 1]), 1), /malformed/);
+  assert.throws(() => parseDnsResponse(wireResponse(aQuery), 99), /unexpected/);
+});
+
+test('DNS checker keeps Direct and VPN independent and never probes VPN when it is off', async () => {
+  const calls = [];
+  const classicExchange = async ({ path: route, resolver, packet }) => {
+    calls.push([route, resolver.endpoint, packet.readUInt16BE(packet.length - 4)]);
+    return {
+      response: wireResponse(packet, { address: addressFor(packet, route) }),
+      transport: 'udp',
+      latencyMs: route === 'direct' ? 10 : 20,
+    };
+  };
+  const service = createDnsDiagnosticsService({
+    proxyPort: 18080, getServers: () => [], classicExchange,
+    now: () => '2026-09-01T00:00:00.000Z',
+  });
+  const running = await service.run({ vpnAvailable: true, domainId: 'youtube', resolverId: 'google-dns' });
+  assert.deepEqual(calls.map(([route]) => route).sort(), ['direct', 'direct', 'vpn', 'vpn']);
+  assert.equal(running.results[0].comparison, 'different');
+  assert.deepEqual(running.results[0].direct.ipv4, ['8.8.8.8']);
+  assert.deepEqual(running.results[0].vpn.ipv6, ['2001:db8:0:0:0:0:0:2']);
+
+  calls.length = 0;
+  const stopped = await service.run({ vpnAvailable: false, domainId: 'youtube', resolverId: 'google-dns' });
+  assert.deepEqual(calls.map(([route]) => route), ['direct', 'direct']);
+  assert.equal(stopped.results[0].vpn.status, 'vpn-off');
+});
+
+test('DNS checker retries timeout once and uses TCP fallback on a truncated response', async () => {
+  let attempts = 0;
+  const timedOut = createDnsDiagnosticsService({
+    proxyPort: 18080,
+    getServers: () => [],
+    classicExchange: async () => {
+      attempts += 1;
+      const error = new Error('timeout');
+      error.code = 'ETIMEDOUT';
+      throw error;
+    },
+  });
+  const timeoutResult = await timedOut.run({
+    vpnAvailable: false, domainId: 'youtube', resolverId: 'google-dns',
+  });
+  assert.equal(attempts, 4);
+  assert.equal(timeoutResult.results[0].direct.status, 'timeout');
+
+  const fallbackCalls = [];
+  const fallback = createDnsDiagnosticsService({
+    proxyPort: 18080,
+    getServers: () => [],
+    classicExchange: async ({ packet }) => ({
+      response: wireResponse(packet, { truncated: true }), transport: 'udp', latencyMs: 2,
+    }),
+    tcpExchange: async ({ path: route, packet }) => {
+      fallbackCalls.push(route);
+      return {
+        response: wireResponse(packet, { address: addressFor(packet, route) }),
+        transport: 'tcp', latencyMs: 4,
+      };
+    },
+  });
+  const fallbackResult = await fallback.run({
+    vpnAvailable: true, domainId: 'youtube', resolverId: 'google-dns',
+  });
+  assert.deepEqual(fallbackCalls.sort(), ['direct', 'direct', 'vpn', 'vpn']);
+  assert.equal(fallbackResult.results[0].direct.transport, 'tcp');
+  assert.equal(fallbackResult.results[0].vpn.transport, 'tcp');
+});
+
+test('custom DoH is pinned only to public bootstrap addresses', async () => {
+  const resolver = {
+    id: 'custom-dns-office', label: 'Office DoH', kind: 'doh', endpoint: 'https://dns.example/dns-query',
+  };
+  const calls = [];
+  const service = createDnsDiagnosticsService({
+    proxyPort: 18080,
+    getServers: () => [],
+    lookup: async () => [{ address: '93.184.216.34', family: 4 }],
+    dohExchange: async ({ path: route, resolver: pinned, packet }) => {
+      calls.push([route, pinned.bootstrap]);
+      return {
+        response: wireResponse(packet, { address: addressFor(packet, route) }),
+        transport: 'doh', latencyMs: 7,
+      };
+    },
+  });
+  const result = await service.run({
+    vpnAvailable: true, customResolvers: [resolver], domainId: 'chatgpt', resolverId: resolver.id,
+  });
+  assert.deepEqual(calls, [
+    ['direct', '93.184.216.34'], ['direct', '93.184.216.34'],
+    ['vpn', '93.184.216.34'], ['vpn', '93.184.216.34'],
+  ]);
+  assert.equal(result.results[0].direct.transport, 'doh');
+
+  let requests = 0;
+  const blocked = createDnsDiagnosticsService({
+    proxyPort: 18080,
+    getServers: () => [],
+    lookup: async () => [{ address: '127.0.0.1', family: 4 }],
+    dohExchange: async () => { requests += 1; throw new Error('unexpected'); },
+  });
+  const blockedResult = await blocked.run({
+    vpnAvailable: true, customResolvers: [resolver], domainId: 'chatgpt', resolverId: resolver.id,
+  });
+  assert.equal(requests, 0);
+  assert.equal(blockedResult.results[0].direct.error, 'DoH endpoint is not public');
+});
+
+test('full DNS run includes system and built-in rows with at most three resolver workers', async () => {
+  const active = new Map();
+  let maximumResolvers = 0;
+  const exchange = async ({ path: route, resolver, packet }) => {
+    active.set(resolver.id, (active.get(resolver.id) || 0) + 1);
+    maximumResolvers = Math.max(maximumResolvers, active.size);
+    await new Promise((resolve) => setTimeout(resolve, 2));
+    const count = active.get(resolver.id) - 1;
+    if (count) active.set(resolver.id, count);
+    else active.delete(resolver.id);
+    return {
+      response: wireResponse(packet, { address: addressFor(packet, route) }),
+      transport: resolver.kind === 'doh' ? 'doh' : 'udp',
+      latencyMs: 2,
+    };
+  };
+  const service = createDnsDiagnosticsService({
+    proxyPort: 18080,
+    getServers: () => ['192.168.1.1'],
+    classicExchange: exchange,
+    dohExchange: exchange,
+  });
+  const catalog = await service.catalog();
+  assert.equal(catalog.resolvers[0].system, true);
+  assert.equal(catalog.resolvers.length, 7);
+  assert.deepEqual(catalog.domains.map(({ hostname }) => hostname), ['www.youtube.com', 'chatgpt.com']);
+
+  const result = await service.run({ vpnAvailable: false, domainId: 'youtube' });
+  assert.equal(result.results.length, 7);
+  assert.ok(maximumResolvers <= 3);
+});
+
+test('default transports enforce direct bypass, VPN proxy, binary DoH and no redirects', () => {
+  const source = fs.readFileSync(
+    path.resolve(import.meta.dirname, '../../src/server/services/dnsDiagnosticsService.ts'),
+    'utf8',
+  );
+  assert.match(source, /path === 'direct'[\s\S]*udpExchange\(address, port/);
+  assert.match(source, /socksHandshake\(3,[\s\S]*socksHandshake\(1,/);
+  assert.match(source, /'--noproxy', '\*'/);
+  assert.match(source, /'--proxy', `http:\/\/127\.0\.0\.1:\$\{proxyPort\}`/);
+  assert.match(source, /'--data-binary', '@-'/);
+  assert.match(source, /'--resolve'/);
+  assert.doesNotMatch(source, /--location/);
+});