permission,dns: add permission for dns

Author: theanarkh

doc/api/cli.md

@@ -357,6 +357,48 @@ Error: Access to this API has been restricted
 }
 ```
 
+### `--allow-net-dns`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1.1 - Active development
+
+When using the [Permission Model][], the process will not be able to make dns query
+by default.
+Attempts to do so will throw an `ERR_ACCESS_DENIED` unless the
+user explicitly passes the `--allow-net-dns` flag when starting Node.js.
+
+Example:
+
+```js
+const dns = require('node:dns');
+dns.lookup("localhost", () => {});
+```
+
+```console
+$ node --experimental-permission --allow-fs-read=\* index.js
+node:dns:235
+  const err = cares.getaddrinfo(
+                    ^
+
+Error: Access to this API has been restricted
+    at Object.lookup (node:dns:235:21)
+    at Object.<anonymous> (/home/index.js:2:5)
+    at Module._compile (node:internal/modules/cjs/loader:1460:14)
+    at Module._extensions..js (node:internal/modules/cjs/loader:1544:10)
+    at Module.load (node:internal/modules/cjs/loader:1275:32)
+    at Module._load (node:internal/modules/cjs/loader:1091:12)
+    at wrapModuleLoad (node:internal/modules/cjs/loader:212:19)
+    at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:158:5)
+    at node:internal/main/run_main_module:30:49 {
+  code: 'ERR_ACCESS_DENIED',
+  permission: 'NetDNS',
+  resource: 'lookup'
+}
+```
+
 ### `--build-snapshot`
 
 <!-- YAML

doc/api/permissions.md

@@ -575,6 +575,7 @@ There are constraints you need to know before using this system:
   * Inspector protocol
   * File system access
   * WASI
+  * DNS
 * The Permission Model is initialized after the Node.js environment is set up.
   However, certain flags such as `--env-file` or `--openssl-config` are designed
   to read files before environment initialization. As a result, such flags are

src/cares_wrap.cc

@@ -1400,9 +1400,11 @@ int ReverseTraits::Parse(
 }
 
 namespace {
-template <class Wrap>
+template <class Wrap, const char* name>
 static void Query(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
+  THROW_IF_INSUFFICIENT_PERMISSIONS(
+      env, permission::PermissionScope::kNetDNS, name);
   ChannelWrap* channel;
   ASSIGN_OR_RETURN_UNWRAP(&channel, args.Holder());
 
@@ -1568,7 +1570,8 @@ void CanonicalizeIP(const FunctionCallbackInfo<Value>& args) {
 
 void GetAddrInfo(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
-
+  THROW_IF_INSUFFICIENT_PERMISSIONS(
+      env, permission::PermissionScope::kNetDNS, "lookup");
   CHECK(args[0]->IsObject());
   CHECK(args[1]->IsString());
   CHECK(args[2]->IsInt32());
@@ -1631,7 +1634,8 @@ void GetAddrInfo(const FunctionCallbackInfo<Value>& args) {
 
 void GetNameInfo(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
-
+  THROW_IF_INSUFFICIENT_PERMISSIONS(
+      env, permission::PermissionScope::kNetDNS, "lookupService");
   CHECK(args[0]->IsObject());
   CHECK(args[1]->IsString());
   CHECK(args[2]->IsUint32());
@@ -1967,20 +1971,20 @@ void Initialize(Local<Object> target,
       ChannelWrap::kInternalFieldCount);
   channel_wrap->Inherit(AsyncWrap::GetConstructorTemplate(env));
 
-  SetProtoMethod(isolate, channel_wrap, "queryAny", Query<QueryAnyWrap>);
-  SetProtoMethod(isolate, channel_wrap, "queryA", Query<QueryAWrap>);
-  SetProtoMethod(isolate, channel_wrap, "queryAaaa", Query<QueryAaaaWrap>);
-  SetProtoMethod(isolate, channel_wrap, "queryCaa", Query<QueryCaaWrap>);
-  SetProtoMethod(isolate, channel_wrap, "queryCname", Query<QueryCnameWrap>);
-  SetProtoMethod(isolate, channel_wrap, "queryMx", Query<QueryMxWrap>);
-  SetProtoMethod(isolate, channel_wrap, "queryNs", Query<QueryNsWrap>);
-  SetProtoMethod(isolate, channel_wrap, "queryTxt", Query<QueryTxtWrap>);
-  SetProtoMethod(isolate, channel_wrap, "querySrv", Query<QuerySrvWrap>);
-  SetProtoMethod(isolate, channel_wrap, "queryPtr", Query<QueryPtrWrap>);
-  SetProtoMethod(isolate, channel_wrap, "queryNaptr", Query<QueryNaptrWrap>);
-  SetProtoMethod(isolate, channel_wrap, "querySoa", Query<QuerySoaWrap>);
+  SetProtoMethod(isolate, channel_wrap, "queryAny", Query<QueryAnyWrap, AnyTraits::name>);
+  SetProtoMethod(isolate, channel_wrap, "queryA", Query<QueryAWrap, ATraits::name>);
+  SetProtoMethod(isolate, channel_wrap, "queryAaaa", Query<QueryAaaaWrap, AaaaTraits::name>);
+  SetProtoMethod(isolate, channel_wrap, "queryCaa", Query<QueryCaaWrap, CaaTraits::name>);
+  SetProtoMethod(isolate, channel_wrap, "queryCname", Query<QueryCnameWrap, CnameTraits::name>);
+  SetProtoMethod(isolate, channel_wrap, "queryMx", Query<QueryMxWrap, MxTraits::name>);
+  SetProtoMethod(isolate, channel_wrap, "queryNs", Query<QueryNsWrap, NsTraits::name>);
+  SetProtoMethod(isolate, channel_wrap, "queryTxt", Query<QueryTxtWrap, TxtTraits::name>);
+  SetProtoMethod(isolate, channel_wrap, "querySrv", Query<QuerySrvWrap, SrvTraits::name>);
+  SetProtoMethod(isolate, channel_wrap, "queryPtr", Query<QueryPtrWrap, PtrTraits::name>);
+  SetProtoMethod(isolate, channel_wrap, "queryNaptr", Query<QueryNaptrWrap, NaptrTraits::name>);
+  SetProtoMethod(isolate, channel_wrap, "querySoa", Query<QuerySoaWrap, SoaTraits::name>);
   SetProtoMethod(
-      isolate, channel_wrap, "getHostByAddr", Query<GetHostByAddrWrap>);
+      isolate, channel_wrap, "getHostByAddr", Query<GetHostByAddrWrap, ReverseTraits::name>);
 
   SetProtoMethodNoSideEffect(isolate, channel_wrap, "getServers", GetServers);
   SetProtoMethod(isolate, channel_wrap, "setServers", SetServers);

src/cares_wrap.h

@@ -233,7 +233,6 @@ class QueryWrap final : public AsyncWrap {
       : AsyncWrap(channel->env(), req_wrap_obj, AsyncWrap::PROVIDER_QUERYWRAP),
         channel_(channel),
         trace_name_(Traits::name) {}
-
   ~QueryWrap() {
     CHECK_EQ(false, persistent().IsEmpty());
 

src/node_options.cc

@@ -464,6 +464,10 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             "allow worker threads when any permissions are set",
             &EnvironmentOptions::allow_worker_threads,
             kAllowedInEnvvar);
+  AddOption("--allow-net-dns",
+            "allow dns when any permissions are set",
+            &EnvironmentOptions::allow_net_dns,
+            kAllowedInEnvvar);
   AddOption("--experimental-repl-await",
             "experimental await keyword support in REPL",
             &EnvironmentOptions::experimental_repl_await,

src/node_options.h

@@ -132,6 +132,7 @@ class EnvironmentOptions : public Options {
   bool allow_child_process = false;
   bool allow_wasi = false;
   bool allow_worker_threads = false;
+  bool allow_net_dns = false;
   bool experimental_repl_await = true;
   bool experimental_vm_modules = false;
   bool expose_internals = false;

src/permission/net_dns_permission.cc

@@ -0,0 +1,22 @@
+#include "net_dns_permission.h"
+
+#include <string>
+
+namespace node {
+
+namespace permission {
+
+void NetDNSPermission::Apply(Environment* env,
+                                const std::vector<std::string>& allow,
+                                PermissionScope scope) {
+  deny_all_ = true;
+}
+
+bool NetDNSPermission::is_granted(Environment* env,
+                                     PermissionScope perm,
+                                     const std::string_view& param) const {
+  return deny_all_ == false;
+}
+
+}  // namespace permission
+}  // namespace node

src/permission/net_dns_permission.h

@@ -0,0 +1,31 @@
+#ifndef SRC_PERMISSION_NET_DNS_PERMISSION_H_
+#define SRC_PERMISSION_NET_DNS_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <string>
+#include "permission/permission_base.h"
+
+namespace node {
+
+namespace permission {
+
+class NetDNSPermission final : public PermissionBase {
+ public:
+  void Apply(Environment* env,
+             const std::vector<std::string>& allow,
+             PermissionScope scope) override;
+  bool is_granted(Environment* env,
+                  PermissionScope perm,
+                  const std::string_view& param = "") const override;
+
+ private:
+  bool deny_all_;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_NET_DNS_PERMISSION_H_

src/permission/permission_base.h

@@ -28,12 +28,15 @@ namespace permission {
 
 #define INSPECTOR_PERMISSIONS(V) V(Inspector, "inspector", PermissionsRoot)
 
+#define NET_DNS_PERMISSIONS(V) V(NetDNS, "net.dns", PermissionsRoot)
+
 #define PERMISSIONS(V)                                                         \
   FILESYSTEM_PERMISSIONS(V)                                                    \
   CHILD_PROCESS_PERMISSIONS(V)                                                 \
   WASI_PERMISSIONS(V)                                                          \
   WORKER_THREADS_PERMISSIONS(V)                                                \
-  INSPECTOR_PERMISSIONS(V)
+  INSPECTOR_PERMISSIONS(V)                                                     \
+  NET_DNS_PERMISSIONS(V)
 
 #define V(name, _, __) k##name,
 enum class PermissionScope {

test/parallel/test-permission-dns.js

@@ -0,0 +1,74 @@
+// Flags: --experimental-permission --allow-fs-read=*
+'use strict';
+require('../common');
+const assert = require('assert');
+const dns = require('dns');
+const common = require('../common');
+
+{
+  const functions = [
+    () => dns.lookup('example.com', () => {}),
+    () => dns.lookupService('127.0.0.1', 22, () => {}),
+    () => dns.reverse('8.8.8.8', () => {}),
+    () => dns.resolveAny('example.com', () => {}),
+    () => dns.resolve4('example.com', () => {}),
+    () => dns.resolve6('example.com', () => {}),
+    () => dns.resolveCaa('example.com', () => {}),
+    () => dns.resolveCname('example.com', () => {}),
+    () => dns.resolveMx('example.com', () => {}),
+    () => dns.resolveNs('example.com', () => {}),
+    () => dns.resolveTxt('example.com', () => {}),
+    () => dns.resolveSrv('example.com', () => {}),
+    () => dns.resolvePtr('example.com', () => {}),
+    () => dns.resolveNaptr('example.com', () => {}),
+    () => dns.resolveSoa('example.com', () => {}),
+  ];
+  for (let i = 0; i < functions.length; i++) {
+    assert.throws(functions[i], /Error: Access to this API has been restricted/);
+  }
+}
+
+{
+  const resolvers = new dns.Resolver();
+  const functions = [
+    () => resolvers.reverse('8.8.8.8', () => {}),
+    () => resolvers.resolveAny('example.com', () => {}),
+    () => resolvers.resolve4('example.com', () => {}),
+    () => resolvers.resolve6('example.com', () => {}),
+    () => resolvers.resolveCaa('example.com', () => {}),
+    () => resolvers.resolveCname('example.com', () => {}),
+    () => resolvers.resolveMx('example.com', () => {}),
+    () => resolvers.resolveNs('example.com', () => {}),
+    () => resolvers.resolveTxt('example.com', () => {}),
+    () => resolvers.resolveSrv('example.com', () => {}),
+    () => resolvers.resolvePtr('example.com', () => {}),
+    () => resolvers.resolveNaptr('example.com', () => {}),
+    () => resolvers.resolveSoa('example.com', () => {}),
+  ];
+  for (let i = 0; i < functions.length; i++) {
+    assert.throws(functions[i], /Error: Access to this API has been restricted/);
+  }
+}
+
+{
+  const functions = [
+    () => dns.promises.lookup('example.com'),
+    () => dns.promises.lookupService('127.0.0.1', 22),
+    () => dns.promises.reverse('8.8.8.8'),
+    () => dns.promises.resolveAny('example.com'),
+    () => dns.promises.resolve4('example.com'),
+    () => dns.promises.resolve6('example.com'),
+    () => dns.promises.resolveCaa('example.com'),
+    () => dns.promises.resolveCname('example.com'),
+    () => dns.promises.resolveMx('example.com'),
+    () => dns.promises.resolveNs('example.com'),
+    () => dns.promises.resolveTxt('example.com'),
+    () => dns.promises.resolveSrv('example.com'),
+    () => dns.promises.resolvePtr('example.com'),
+    () => dns.promises.resolveNaptr('example.com'),
+    () => dns.promises.resolveSoa('example.com'),
+  ];
+  for (let i = 0; i < functions.length; i++) {
+    assert.rejects(functions[i], /Error: Access to this API has been restricted/).then(common.mustCall());
+  }
+}