@blamejs/blamejs-shop 0.4.55 → 0.4.57

package/lib/vendor/blamejs/lib/mail-server-managesieve.js

@@ -127,8 +127,9 @@
  */
 
 var net = require("node:net");
+var safeBuffer = require("./safe-buffer");
 var mailServerTls = require("./mail-server-tls");
-var lazyRequire = require("./lazy-require");
+var mailServerNet = require("./mail-server-net");
 var C = require("./constants");
 var bCrypto = require("./crypto");
 var numericBounds = require("./numeric-bounds");
@@ -139,7 +140,7 @@ var mailServerRateLimit = require("./mail-server-rate-limit");
 var mailServerRegistry = require("./mail-server-registry");
 var { defineClass } = require("./framework-error");
 
-var audit = lazyRequire(function () { return require("./audit"); });
+var auditEmit = require("./audit-emit");
 
 var MailServerManageSieveError = defineClass("MailServerManageSieveError",
   { alwaysPermanent: true });
@@ -226,40 +227,18 @@ function create(opts) {
   // the actual script bytes — same cap on both sides).
   var safeSieveProfile = profile;
 
-  var rateLimit;
-  if (opts.rateLimit === false) {
-    rateLimit = mailServerRateLimit.create({ disabled: true });
-  } else if (opts.rateLimit && typeof opts.rateLimit.admitConnection === "function") {
-    rateLimit = opts.rateLimit;
-  } else {
-    rateLimit = mailServerRateLimit.create(opts.rateLimit || {});
-  }
+  var rateLimit = mailServerRateLimit.resolve(opts.rateLimit);
 
-  var tcpServer   = null;
-  var listening   = false;
   var connections = new Set();
 
-  function _emit(action, metadata, outcome) {
-    try {
-      audit().safeEmit({
-        action:   action,
-        outcome:  outcome || "success",
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent — audit best-effort */ }
-  }
+  var _emit = auditEmit.emit;
 
   function _handleConnection(rawSocket) {
-    var remoteAddress = rawSocket.remoteAddress || "0.0.0.0";
-    var admit = rateLimit.admitConnection(remoteAddress);
-    if (!admit.ok) {
-      _emit("mail.server.managesieve.rate_limit_refused",
-        { remoteAddress: remoteAddress, reason: admit.reason }, "denied");
-      try { rawSocket.write('NO "Too many connections from your IP"\r\n'); }
-      catch (_e) { /* socket may be down */ }
-      try { rawSocket.destroy(); } catch (_e2) { /* idempotent */ }
-      return;
-    }
+    var remoteAddress = mailServerNet.admitConnection(rawSocket, rateLimit, _emit, {
+      refusedEvent: "mail.server.managesieve.rate_limit_refused",
+      refusalLine:  'NO "Too many connections from your IP"\r\n',
+    });
+    if (remoteAddress === null) return;
     var connectionId = "msvconn-" + bCrypto.generateToken(8);                                            // connection-id length
     var socket = rawSocket;
     connections.add(socket);
@@ -354,7 +333,7 @@ function create(opts) {
       }
       var crlf = state.lineBuffer.indexOf("\r\n");
       if (crlf === -1) {
-        if (state.lineBuffer.length > maxLineBytes) {
+        if (safeBuffer.byteLengthOf(state.lineBuffer) > maxLineBytes) {
           _writeNo(socket, "Line too long (cap " + maxLineBytes + ")");
           _close(socket);
         }
@@ -525,19 +504,18 @@ function create(opts) {
     }
     _writeOk(socket, "Begin TLS negotiation now");
     // RFC 5804 §2.2 — discard any bytes the client queued before the
-    // upgrade so pre-handshake injection can't survive into the post-
-    // TLS session. The shared upgradeSocket helper handles the
-    // CVE-2021-33515 / CVE-2021-38371 listener-strip + pause; the
-    // pending-protocol state still belongs to managesieve.
-    state.lineBuffer = Buffer.alloc(0);
-    state.pendingLiteral = null;
-    state.pendingAuth    = null;
-    mailServerTls.upgradeSocket({
-      plainSocket:   socket,
+    // upgrade (lineBuffer + pendingLiteral + pendingAuth) so pre-
+    // handshake injection can't survive into the post-TLS session.
+    // The shared upgradeLineProtocol helper owns that drain plus the
+    // CVE-2021-33515 / CVE-2021-38371 listener-strip + pause + read-pump.
+    mailServerTls.upgradeLineProtocol({
+      state:         state,
+      socket:        socket,
       secureContext: tlsContext,
       idleTimeoutMs: idleTimeoutMs,
+      clearFields:   ["pendingLiteral", "pendingAuth"],
+      drain:         _drainBuffer,
       onSecure: function (tlsSocket) {
-        state.tls = true;
         _emit("mail.server.managesieve.starttls_upgraded",
           { connectionId: state.id });
         // RFC 5804 §2.2 — server MUST re-emit capabilities on the
@@ -546,10 +524,6 @@ function create(opts) {
         _emitCapabilityBanner(state, tlsSocket);
         _writeOk(tlsSocket, "TLS negotiation successful");
       },
-      onData: function (tlsSocket, chunk) {
-        state.lineBuffer = Buffer.concat([state.lineBuffer, chunk]);
-        _drainBuffer(state, tlsSocket);
-      },
       onError: function (err) {
         _emit("mail.server.managesieve.starttls_handshake_failed",
           { connectionId: state.id, error: (err && err.message) || String(err) }, "failure");
@@ -863,43 +837,15 @@ function create(opts) {
   }
 
   // ---- Lifecycle ----------------------------------------------------------
-  async function listen(listenOpts) {
-    listenOpts = listenOpts || {};
-    if (listening) {
-      throw new MailServerManageSieveError("mail-server-managesieve/already-listening",
-        "listen: already listening");
-    }
-    var port    = listenOpts.port    === undefined ? DEFAULT_PORT : listenOpts.port;
-    var address = listenOpts.address || "0.0.0.0";
-    tcpServer = net.createServer(function (socket) { _handleConnection(socket); });
-    return new Promise(function (resolve, reject) {
-      tcpServer.once("error", reject);
-      tcpServer.listen(port, address, function () {
-        listening = true;
-        tcpServer.removeListener("error", reject);
-        _emit("mail.server.managesieve.listening", { port: port, address: address });
-        resolve({ port: tcpServer.address().port, address: address });
-      });
-    });
-  }
-
-  async function close() {
-    if (!listening) return;
-    listening = false;
-    for (var s of connections) { try { s.destroy(); } catch (_e) { /* idempotent */ } }
-    connections.clear();
-    return new Promise(function (resolve) {
-      tcpServer.close(function () {
-        _emit("mail.server.managesieve.closed", {});
-        resolve();
-      });
-    });
-  }
-
-  return {
-    listen: listen,
-    close:  close,
-  };
+  return mailServerNet.createStoreServer(net, {
+    defaultPort:      DEFAULT_PORT,
+    handleConnection: _handleConnection,
+    errorClass:       MailServerManageSieveError,
+    errorCodePrefix:  "mail-server-managesieve/",
+    emit:             _emit,
+    connections:      connections,
+    eventBase:        "mail.server.managesieve",
+  });
 }
 
 module.exports = {

package/lib/vendor/blamejs/lib/mail-server-mx.js

@@ -150,9 +150,10 @@ var guardSmtpCommand = require("./guard-smtp-command");
 var guardDomain = require("./guard-domain");
 var mailServerRateLimit = require("./mail-server-rate-limit");
 var mailServerTls = require("./mail-server-tls");
+var mailServerNet = require("./mail-server-net");
 var { defineClass } = require("./framework-error");
 
-var audit = lazyRequire(function () { return require("./audit"); });
+var auditEmit = require("./audit-emit");
 // Lazy like the sibling host primitives' guard loads — the inbound
 // authentication pipeline (and the DKIM verifier whose range
 // constants the boot validation mirrors) only loads when an operator
@@ -338,14 +339,7 @@ function create(opts) {
   // handle from b.mail.server.rateLimit.create({...}) to share one
   // budget across multiple listeners, or pass an opts object to
   // override defaults.
-  var rateLimit;
-  if (opts.rateLimit === false) {
-    rateLimit = mailServerRateLimit.create({ disabled: true });
-  } else if (opts.rateLimit && typeof opts.rateLimit.admitConnection === "function") {
-    rateLimit = opts.rateLimit;
-  } else {
-    rateLimit = mailServerRateLimit.create(opts.rateLimit || {});
-  }
+  var rateLimit = mailServerRateLimit.resolve(opts.rateLimit);
 
   // DATA-phase message-authentication gate. `guardEnvelope: true`
   // gates with defaults; an object tunes it. Like the sibling gates
@@ -451,16 +445,12 @@ function create(opts) {
     });
   }
   function _validateDomainHardened(d, label) {
-    if (!guardDomainProfile) return { ok: true };
-    var verdict = guardDomain.validate(d, guardDomainProfile);
-    if (!verdict.ok) {
-      _emit("mail.server.mx.domain_refused", {
-        reason: verdict.issues && verdict.issues[0] && verdict.issues[0].kind,
-        domain: d,
-        label:  label,
-      }, "denied");
-    }
-    return verdict;
+    return mailServerNet.validateDomainHardened(d, label, {
+      guardDomainProfile: guardDomainProfile,
+      guardDomain:        guardDomain,
+      emit:               _emit,
+      refusedEvent:       "mail.server.mx.domain_refused",
+    });
   }
 
   // Pre-validate operator-supplied localDomains at boot — the same
@@ -479,35 +469,19 @@ function create(opts) {
     }
   }
 
-  var tcpServer    = null;
-  var listening    = false;
   var connections  = new Set();
 
-  function _emit(action, metadata, outcome) {
-    try {
-      audit().safeEmit({
-        action:   action,
-        outcome:  outcome || "success",
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent — audit best-effort */ }
-  }
+  var _emit = auditEmit.emit;
 
   // ---- Per-connection state machine ---------------------------------------
   function _handleConnection(socket) {
-    var remoteAddress = socket.remoteAddress || "0.0.0.0";
-    var admit = rateLimit.admitConnection(remoteAddress);
-    if (!admit.ok) {
-      // 421 4.7.0 — transient refusal; sender retries elsewhere or later.
-      // RFC 5321 §3.8 + §4.5.4.2 (transient negative completion).
-      _emit("mail.server.mx.rate_limit_refused",
-        { remoteAddress: remoteAddress, reason: admit.reason }, "denied");
-      try {
-        socket.write("421 4.7.0 Too many connections from your IP\r\n");
-      } catch (_e) { /* socket may already be torn down */ }
-      try { socket.destroy(); } catch (_e2) { /* idempotent */ }
-      return;
-    }
+    // 421 4.7.0 — transient refusal; sender retries elsewhere or later.
+    // RFC 5321 §3.8 + §4.5.4.2 (transient negative completion).
+    var remoteAddress = mailServerNet.admitConnection(socket, rateLimit, _emit, {
+      refusedEvent: "mail.server.mx.rate_limit_refused",
+      refusalLine:  "421 4.7.0 Too many connections from your IP\r\n",
+    });
+    if (remoteAddress === null) return;
     socket.once("close", function () { rateLimit.releaseConnection(remoteAddress); });
 
     var connectionId = "mxconn-" + bCrypto.generateToken(8);                                          // connection-id length
@@ -653,7 +627,7 @@ function create(opts) {
 
       // Command phase — byte-buffered (8BITMIME-safe).
       lineBuffer = lineBuffer.length === 0 ? chunk : Buffer.concat([lineBuffer, chunk]);
-      if (lineBuffer.length > maxLineBytes * 4) {
+      if (safeBuffer.byteLengthOf(lineBuffer) > maxLineBytes * 4) {
         _writeReply(socket, REPLY_500_SYNTAX,
           "5.5.6 Line too long (>" + maxLineBytes + " bytes)");
         _closeConnection(socket);
@@ -1229,38 +1203,23 @@ function create(opts) {
   }
 
   // ---- Lifecycle ----------------------------------------------------------
-  async function listen(listenOpts) {
-    listenOpts = listenOpts || {};
-    if (listening) {
-      throw new MailServerMxError("mail-server-mx/already-listening",
-        "listen: already listening");
-    }
-    // Port 0 (ephemeral, test mode) must NOT fall back to 25 — the
-    // `|| 25` short-circuit was a footgun on the test path.
-    var port    = listenOpts.port    === undefined ? 25 : listenOpts.port;                           // SMTP MX port (IANA)
-    var address = listenOpts.address || "0.0.0.0";
-    tcpServer = net.createServer(function (socket) {
-      _handleConnection(socket);
-    });
-    return new Promise(function (resolve, reject) {
-      tcpServer.once("error", reject);
-      tcpServer.listen(port, address, function () {
-        listening = true;
-        tcpServer.removeListener("error", reject);
-        _emit("mail.server.mx.listening", {
-          port: port, address: address,
-        });
-        resolve({ port: tcpServer.address().port, address: address });
-      });
-    });
-  }
+  // Port 0 (ephemeral, test mode) must NOT fall back to 25 — the `|| 25`
+  // short-circuit was a footgun on the test path; createTcpListener honors an
+  // explicit 0 (only an OMITTED port falls back to the default).
+  var _tcpListener = mailServerNet.createTcpListener(net, {
+    defaultPort:      25,                                                                             // SMTP MX port (IANA)
+    handleConnection: _handleConnection,
+    errorFactory:     function (code, message) { return new MailServerMxError("mail-server-mx/" + code, message); },
+    emit:             _emit,
+    listeningEvent:   "mail.server.mx.listening",
+  });
 
   async function close(closeOpts) {
     closeOpts = closeOpts || {};
-    if (!listening) return;
+    if (!_tcpListener.isListening()) return;
     var timeoutMs = closeOpts.timeoutMs || C.TIME.seconds(30);
-    listening = false;
-    tcpServer.close();
+    _tcpListener.markClosed();
+    _tcpListener.getServer().close();
     connections.forEach(function (sock) {
       try { _writeReply(sock, REPLY_421_SERVICE_NOT_AVAIL, "4.3.0 Server shutting down"); }
       catch (_e) { /* socket already gone */ }
@@ -1279,10 +1238,10 @@ function create(opts) {
   function connectionCount() { return connections.size; }
 
   return {
-    listen:           listen,
+    listen:           _tcpListener.listen,
     close:            close,
     connectionCount:  connectionCount,
-    _portForTest:     function () { return tcpServer ? tcpServer.address().port : null; },
+    _portForTest:     function () { var s = _tcpListener.getServer(); return s ? s.address().port : null; },
   };
 }
 

package/lib/vendor/blamejs/lib/mail-server-net.js

@@ -0,0 +1,177 @@
+"use strict";
+
+// mail-server-net — the TCP-listener lifecycle shared by the mailbox / transfer
+// servers (b.mail.server.imap / pop3 / mx / managesieve / submission). Each of
+// those keeps its OWN connection set and close() drain because those diverge:
+// the store servers (IMAP/POP3/ManageSieve) await a Promise-wrapped
+// tcpServer.close(), while the transfer servers (MX/Submission) send an SMTP
+// 421 to every live socket and drain with a timeout. What every server shares
+// verbatim is the bind: refuse a double-listen, resolve the default port (never
+// falling back off an explicit port 0 — the ephemeral test-bind path), create
+// the listener, and arm a one-shot "error"→reject so a bind failure (EADDRINUSE,
+// EACCES) rejects the listen promise instead of crashing the process. That, plus
+// the listening/server state, is what createTcpListener owns.
+
+// createTcpListener(net, cfg) — build a listener lifecycle.
+//   cfg.defaultPort      port used when listenOpts.port is omitted (an explicit
+//                        0 is honored, for an ephemeral test bind).
+//   cfg.handleConnection (socket) => void — the server's per-connection handler.
+//   cfg.errorFactory     (code, message) => Error — builds the typed
+//                        "<prefix>/already-listening" double-listen error.
+//   cfg.emit             (action, metadata) => void — the server's audit emitter.
+//   cfg.listeningEvent   the "...listening" audit action.
+//   cfg.listeningExtra   optional () => object merged onto the listening event
+//                        payload (Submission reports implicitTls).
+// Returns { listen, getServer, isListening, markClosed } — the server wires its
+// own close() through getServer()/isListening()/markClosed().
+function createTcpListener(net, cfg) {
+  var server = null;
+  var listening = false;
+
+  function listen(listenOpts) {
+    listenOpts = listenOpts || {};
+    if (listening) {
+      throw cfg.errorFactory("already-listening", "listen: already listening");
+    }
+    var port = listenOpts.port === undefined ? cfg.defaultPort : listenOpts.port;
+    var address = listenOpts.address || "0.0.0.0";
+    server = net.createServer(function (socket) { cfg.handleConnection(socket); });
+    return new Promise(function (resolve, reject) {
+      server.once("error", reject);
+      server.listen(port, address, function () {
+        listening = true;
+        server.removeListener("error", reject);
+        var payload = { port: port, address: address };
+        if (cfg.listeningExtra) {
+          var extra = cfg.listeningExtra();
+          for (var k in extra) {
+            if (Object.prototype.hasOwnProperty.call(extra, k)) payload[k] = extra[k];
+          }
+        }
+        cfg.emit(cfg.listeningEvent, payload);
+        resolve({ port: server.address().port, address: address });
+      });
+    });
+  }
+
+  // closeSimple(closeCfg) — the store-server shutdown (IMAP / POP3 / ManageSieve):
+  // mark closed, destroy every live socket immediately, then await the listener's
+  // own close before emitting the "...closed" audit. The transfer servers
+  // (MX / Submission) do NOT use this — they run a graceful SMTP-421 drain with a
+  // timeout, so they own their close() and drive it through markClosed()/getServer().
+  //   closeCfg.connections  the server's live-socket Set (destroyed + cleared).
+  //   closeCfg.emit         the server's audit emitter.
+  //   closeCfg.closedEvent  the "...closed" audit action.
+  function closeSimple(closeCfg) {
+    if (!listening) return Promise.resolve();
+    listening = false;
+    for (var s of closeCfg.connections) { try { s.destroy(); } catch (_e) { /* idempotent */ } }
+    closeCfg.connections.clear();
+    return new Promise(function (resolve) {
+      server.close(function () {
+        closeCfg.emit(closeCfg.closedEvent, {});
+        resolve();
+      });
+    });
+  }
+
+  return {
+    listen:      listen,
+    closeSimple: closeSimple,
+    getServer:   function () { return server; },
+    isListening: function () { return listening; },
+    markClosed:  function () { listening = false; },
+  };
+}
+
+// createStoreServer(net, cfg) — the COMPLETE lifecycle of a mailbox store server
+// (b.mail.server.imap / pop3 / managesieve): compose createTcpListener with the
+// destroy-then-await closeSimple shutdown and return the { listen, close } a
+// store server exposes. The three store servers are byte-identical here, varying
+// only in port, error class, error-code prefix, and audit-event base — so the
+// wiring lives here once. The transfer servers (MX / Submission) do NOT use this:
+// they run a graceful SMTP-421 drain close + a richer return ({ connectionCount,
+// _portForTest, ... }), so they call createTcpListener directly.
+//   cfg.defaultPort      port used when listen() omits one (explicit 0 honored).
+//   cfg.handleConnection (socket) => void — the per-connection handler.
+//   cfg.errorClass       the server's typed error constructor (code, message).
+//   cfg.errorCodePrefix  prepended to the double-listen error code
+//                        (e.g. "mail-server-imap/").
+//   cfg.emit             (action, metadata) => void — the server's audit emitter.
+//   cfg.connections      the live-socket Set (destroyed + cleared on close).
+//   cfg.eventBase        the audit-action base; listeningEvent = eventBase +
+//                        ".listening", closedEvent = eventBase + ".closed".
+// Returns { listen, close }.
+function createStoreServer(net, cfg) {
+  var ErrorClass = cfg.errorClass;
+  var listener = createTcpListener(net, {
+    defaultPort:      cfg.defaultPort,
+    handleConnection: cfg.handleConnection,
+    errorFactory:     function (code, message) { return new ErrorClass(cfg.errorCodePrefix + code, message); },
+    emit:             cfg.emit,
+    listeningEvent:   cfg.eventBase + ".listening",
+  });
+  function close() {
+    return listener.closeSimple({
+      connections: cfg.connections,
+      emit:        cfg.emit,
+      closedEvent: cfg.eventBase + ".closed",
+    });
+  }
+  return { listen: listener.listen, close: close };
+}
+
+// admitConnection(socket, rateLimit, emit, cfg) — the per-connection rate-limit
+// gate every mail listener's _handleConnection opens with: resolve the remote
+// IP, admit it via the shared b.mail.server.rateLimit, or refuse it with a
+// protocol-specific line + a "<...>.rate_limit_refused" audit (outcome "denied")
+// and tear the socket down. Returns the remote address on admit, or null when
+// refused — the caller does `if (addr === null) return;` then runs its own
+// (protocol-specific) close handler, connection-id, tracking-set insert, and
+// state machine, none of which this touches.
+//   cfg.refusedEvent  the "<...>.rate_limit_refused" audit action.
+//   cfg.refusalLine   the wire bytes written before destroy (IMAP "* BAD …",
+//                     POP3 "-ERR …", SMTP "421 4.7.0 …", ManageSieve 'NO "…"').
+function admitConnection(socket, rateLimit, emit, cfg) {
+  var remoteAddress = socket.remoteAddress || "0.0.0.0";
+  var admit = rateLimit.admitConnection(remoteAddress);
+  if (!admit.ok) {
+    emit(cfg.refusedEvent, { remoteAddress: remoteAddress, reason: admit.reason }, "denied");
+    try { socket.write(cfg.refusalLine); } catch (_e) { /* socket may be down */ }
+    try { socket.destroy(); } catch (_e2) { /* idempotent */ }
+    return null;
+  }
+  return remoteAddress;
+}
+
+// validateDomainHardened(d, label, cfg) — the hardened-domain check the MX and
+// Submission transfer servers run on every HELO / MAIL FROM / RCPT TO domain.
+// When a guardDomain profile is configured it validates the domain and, on
+// refusal, emits a "<refusedEvent>" audit (the only per-server difference — MX
+// vs Submission) before returning the verdict; with no profile it passes
+// through { ok: true }. Sharing it keeps the two servers' domain-validation
+// posture identical (a divergence would be a silent spoofing / IDN-homograph
+// gap on one server).
+//   cfg.guardDomainProfile  the b.guardDomain profile (falsy = validation off).
+//   cfg.guardDomain         the b.guardDomain module (its validate(d, profile)).
+//   cfg.emit                (action, metadata, outcome) => void audit emitter.
+//   cfg.refusedEvent        the "<...>.domain_refused" audit action.
+function validateDomainHardened(d, label, cfg) {
+  if (!cfg.guardDomainProfile) return { ok: true };
+  var verdict = cfg.guardDomain.validate(d, cfg.guardDomainProfile);
+  if (!verdict.ok) {
+    cfg.emit(cfg.refusedEvent, {
+      reason: verdict.issues && verdict.issues[0] && verdict.issues[0].kind,
+      domain: d,
+      label:  label,
+    }, "denied");
+  }
+  return verdict;
+}
+
+module.exports = {
+  createTcpListener: createTcpListener,
+  createStoreServer: createStoreServer,
+  admitConnection:   admitConnection,
+  validateDomainHardened: validateDomainHardened,
+};