Release Network Tools 0.2.0

tests/network/http-mime.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { buildCsp, inspectHeaders } from "../../src/network/http";
+import { buildCsp, inspectCsp, inspectHeaders } from "../../src/network/http";
 import { lookupMime } from "../../src/network/mime";
 
 describe("HTTP helpers", () => {
@@ -29,6 +29,83 @@ describe("HTTP helpers", () => {
     expect(result.policy).toContain("object-src 'none'");
     expect(result.warnings.join(" ")).toMatch(/unsafe-eval/u);
   });
+
+  it("analyses deployed CSP, cookies, HSTS and framing defenses", () => {
+    const result = inspectHeaders(
+      "Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'\n" +
+        "Strict-Transport-Security: max-age=60\n" +
+        "Set-Cookie: session=abc; SameSite=None\n" +
+        "X-Content-Type-Options: nosniff\n" +
+        "Referrer-Policy: strict-origin",
+    );
+    expect(result.securityFindings.map((finding) => finding.code)).toEqual(
+      expect.arrayContaining([
+        "csp-unsafe-eval",
+        "hsts-short",
+        "cookie-secure",
+        "cookie-http-only",
+        "cookie-none-insecure",
+      ]),
+    );
+    expect(result.csp?.directives).toContainEqual({
+      name: "object-src",
+      values: ["'none'"],
+    });
+  });
+
+  it("identifies duplicate and dangerous CSP directives", () => {
+    const result = inspectCsp(
+      "default-src *; script-src data:; script-src 'self'",
+    );
+    expect(result.findings.map((finding) => finding.code)).toEqual(
+      expect.arrayContaining([
+        "csp-wildcard",
+        "csp-script-data",
+        "csp-duplicate-directive",
+      ]),
+    );
+  });
+
+  it("analyses every enforcing CSP field rather than silently dropping later fields", () => {
+    const result = inspectHeaders(
+      "Content-Security-Policy: default-src 'self'; object-src 'none'\n" +
+        "Content-Security-Policy: script-src 'unsafe-eval'; object-src 'none'",
+    );
+    expect(result.cspFields).toHaveLength(2);
+    expect(result.securityFindings).toContainEqual(
+      expect.objectContaining({
+        code: "csp-unsafe-eval",
+        message: expect.stringContaining("CSP field 2"),
+      }),
+    );
+  });
+
+  it("uses the first duplicate directive and validates X-Frame-Options", () => {
+    const csp = inspectCsp(
+      "default-src 'self'; object-src *; object-src 'none'",
+    );
+    expect(csp.findings.map((finding) => finding.code)).toContain(
+      "csp-object-src-open",
+    );
+    const headers = inspectHeaders(
+      "X-Frame-Options: ALLOW-FROM https://example.test",
+    );
+    expect(headers.securityFindings.map((finding) => finding.code)).toContain(
+      "x-frame-options-invalid",
+    );
+  });
+
+  it("does not apply sources from ignored duplicate CSP directives", () => {
+    const csp = inspectCsp(
+      "default-src 'self'; script-src 'self'; script-src 'unsafe-eval' data:",
+    );
+    expect(csp.findings.map((finding) => finding.code)).not.toContain(
+      "csp-unsafe-eval",
+    );
+    expect(csp.findings.map((finding) => finding.code)).toContain(
+      "csp-duplicate-directive",
+    );
+  });
 });
 
 describe("MIME lookup", () => {

tests/network/url-dns.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, it } from "vitest";
-import { buildDnsRecord } from "../../src/network/dns";
+import { buildDnsRecord, inspectDnsZone } from "../../src/network/dns";
+import { parseVlsmRequirements, planVlsm } from "../../src/network/vlsm";
 import { buildUrl, inspectUrl } from "../../src/network/url";
 
 describe("URL inspection", () => {
@@ -73,4 +74,91 @@ describe("DNS construction", () => {
       buildDnsRecord({ owner: "@", ttl: 60, type: "AAAA", value: "::::" }),
     ).toThrow(/IPv6/u);
   });
+
+  it("parses a bounded zone inertly and validates common record data", () => {
+    const result = inspectDnsZone(
+      "$ORIGIN example.test.\n$TTL 1h\n@ IN SOA ns hostmaster 1 1h 15m 1w 5m\n@ IN NS ns\nns IN A 192.0.2.1\n    IN AAAA 2001:db8::1\n_unknown IN SVCB 1 target.example.",
+    );
+    expect(result.origin).toBe("example.test.");
+    expect(result.records).toHaveLength(5);
+    expect(result.records[2]?.normalized).toContain(
+      "ns.example.test. 3600 IN A 192.0.2.1",
+    );
+    expect(result.records[3]?.owner).toBe("ns.example.test.");
+    expect(result.coverage).toMatchObject({
+      validatedRecords: 4,
+      syntaxOnlyRecords: 1,
+    });
+    expect(result.diagnostics[0]?.message).toMatch(/syntax-only/u);
+  });
+
+  it("rejects include directives without reading external files", () => {
+    const result = inspectDnsZone("$INCLUDE secrets.zone");
+    expect(result.records).toEqual([]);
+    expect(result.diagnostics[0]).toMatchObject({ severity: "error" });
+  });
+
+  it("accepts wildcard/root owners and keeps non-IN records syntax-only", () => {
+    const result = inspectDnsZone(
+      "$ORIGIN example.test.\n*.web IN A 192.0.2.9\n. IN NS a.root-servers.net.\nlegacy CH A not-an-ip",
+    );
+    expect(result.records.map((record) => record.owner)).toEqual([
+      "*.web.example.test.",
+      ".",
+      "legacy.example.test.",
+    ]);
+    expect(result.records[2]).toMatchObject({
+      dnsClass: "CH",
+      validation: "syntax-only",
+      data: ["not-an-ip"],
+    });
+    expect(result.diagnostics).toContainEqual(
+      expect.objectContaining({ message: expect.stringContaining("only IN") }),
+    );
+  });
+
+  it("joins names correctly beneath the DNS root origin", () => {
+    const result = inspectDnsZone("$ORIGIN .\nwww IN A 192.0.2.10");
+    expect(result.records[0]).toMatchObject({
+      owner: "www.",
+      normalized: "www. IN A 192.0.2.10",
+    });
+    expect(result.diagnostics).toEqual([]);
+  });
+});
+
+describe("VLSM planning", () => {
+  it("allocates largest requirements first on subnet boundaries", () => {
+    const plan = planVlsm(
+      "10.0.0.0/24",
+      parseVlsmRequirements("Printers,12\nOffice,100\nLab,50"),
+    );
+    expect(plan.allocations.map((item) => item.network)).toEqual([
+      "10.0.0.0/25",
+      "10.0.0.128/26",
+      "10.0.0.192/28",
+    ]);
+    expect(plan.allocations[0]?.name).toBe("Office");
+    expect(plan.freeAddresses).toBe(48);
+  });
+
+  it("fails atomically when requirements do not fit", () => {
+    expect(() =>
+      planVlsm("192.0.2.0/29", [
+        { name: "one", hosts: 4 },
+        { name: "two", hosts: 4 },
+      ]),
+    ).toThrow(/does not fit/u);
+  });
+
+  it("supports a conventional full IPv4 /0 capacity without unsafe numbers", () => {
+    const plan = planVlsm("0.0.0.0/0", [
+      { name: "whole range", hosts: 4_294_967_294 },
+    ]);
+    expect(plan.allocations[0]).toMatchObject({
+      network: "0.0.0.0/0",
+      broadcast: "255.255.255.255",
+      usableHosts: 4_294_967_294,
+    });
+  });
 });