@blamejs/core 0.18.53 → 0.18.54

package/lib/mail-auth.js

@@ -1926,10 +1926,15 @@ function _arcInstanceOf(value) {
 }
 
 async function arcVerify(rfc822, opts) {
-  if (typeof rfc822 !== "string" || rfc822.length === 0) {
+  if ((!Buffer.isBuffer(rfc822) && typeof rfc822 !== "string") || rfc822.length === 0) {
     throw new MailAuthError("mail-auth/arc-bad-input",
-      "arc.verify: rfc822 must be a non-empty string");
+      "arc.verify: rfc822 must be a non-empty Buffer or string");
   }
+  // A seal covers the octets on the wire, so a caller holding them verifies
+  // against them. Same boundary as DKIM, and the SAME function, so a string
+  // cannot come to mean one thing here and another there: a Buffer is octets,
+  // a string is text and its octets are its UTF-8 encoding.
+  rfc822 = dkim._toWire(rfc822);
   opts = opts || {};
   // RFC 8617 §5.1.1 / RFC 6376 §3.4 — ARC-Message-Signature verification
   // reuses the DKIM verifier, whose header/body split REQUIRES CRLF CRLF and
@@ -2333,7 +2338,10 @@ async function _verifyAmsViaDkim(rfc822, hop, sigValue, tags, dkim, dnsLookup) {
   // unreachable from b.mail.dkim.verify.
   var verifyOpts = { dnsLookup: dnsLookup };
   verifyOpts[ARC_AMS_REUSE] = true;
-  var rv = await dkim.verify(synthetic, verifyOpts);
+  // As OCTETS. `synthetic` is already the wire form, one code unit per octet,
+  // and handing it over as a string would have the verifier read it as text and
+  // re-encode it as UTF-8 — hashing bytes this message does not contain.
+  var rv = await dkim.verify(dkim._wireBytes(synthetic), verifyOpts);
   if (!Array.isArray(rv) || rv.length === 0) {
     return { result: "permerror", errors: ["ams: dkim verifier returned no results"] };
   }
@@ -2401,7 +2409,11 @@ function _runVerify(signedString, sigB64, algorithm, keyB64, label) {
   var sigBuf = Buffer.from(sigB64, "base64");
   var verified;
   try {
-    verified = nodeCrypto.verify(nodeAlgo, Buffer.from(signedString, "utf8"), keyObj, sigBuf);
+    // latin1: the signer sealed the canonicalized OCTETS (lib/mail-arc-sign.js),
+    // and the message reaches here one code unit per octet. Re-encoding as UTF-8
+    // would verify against bytes the signer never saw, for any message carrying
+    // 8-bit content.
+    verified = nodeCrypto.verify(nodeAlgo, Buffer.from(signedString, "latin1"), keyObj, sigBuf);
   } catch (e) {
     return { result: "permerror",
              errors: [label + ": verify threw: " + ((e && e.message) || String(e))] };
@@ -2429,10 +2441,19 @@ void C; // C is imported for future TIME constants in policy fetchers.
 //   //    trustedDomain: "mailgun.net" }
 
 async function arcEvaluate(rfc822, opts) {
-  if (typeof rfc822 !== "string" || rfc822.length === 0) {
+  if ((!Buffer.isBuffer(rfc822) && typeof rfc822 !== "string") || rfc822.length === 0) {
     throw new MailAuthError("mail-auth/arc-bad-input",
-      "arc.evaluate: rfc822 must be a non-empty string");
-  }
+      "arc.evaluate: rfc822 must be a non-empty Buffer or string");
+  }
+  // Two views, and the distinction matters. The header re-scan below reads the
+  // message as a wire STRING; `arcVerify` resolves its own argument, and
+  // `_toWire` is idempotent on a Buffer but NOT on a string — applied twice it
+  // reads the latin1 wire form as text and re-encodes it as UTF-8, so the
+  // octets checked stop being the octets signed. Passing the wire string on
+  // made a Unicode message pass `arc.verify` and fail `arc.evaluate`, which are
+  // supposed to answer the same question.
+  rfc822 = dkim._toWire(rfc822);
+  var rfc822Octets = dkim._wireBytes(rfc822);
   opts = opts || {};
   if (!Array.isArray(opts.trustedSealers)) {
     throw new MailAuthError("mail-auth/arc-bad-trusted-sealers",
@@ -2448,7 +2469,7 @@ async function arcEvaluate(rfc822, opts) {
     trusted[d.toLowerCase()] = true;
   }
 
-  var verdict = await arcVerify(rfc822, opts);
+  var verdict = await arcVerify(rfc822Octets, opts);
   var out = {
     chainStatus:    verdict.chainStatus,
     hopCount:       verdict.hopCount,
@@ -2695,7 +2716,7 @@ function authResultsEmit(opts) {
 //     message:    rfc5322Bytes,                  // string or Buffer
 //     authservId: "mx.example.com",
 //   });
-//   // → { spf, dkim, from, dmarc, authResults }
+//   // → { spf, dkim, from, dmarc, arc, authResults }
 //   if (v.dmarc.recommendedAction === "reject") { /* refuse 550 5.7.1 */ }
 //
 // From-header discipline (RFC 9989 §5.3.1, RFC 7489 §6.6.1 before it):
@@ -2834,14 +2855,13 @@ async function inboundVerify(opts) {
   }
   var message = opts.message;
   if (Buffer.isBuffer(message)) {
-    // DKIM canonicalization re-encodes the string form as UTF-8
-    // (lib/mail-dkim.js hashes Buffer.from(canonicalized, "utf8")), so
-    // the byte→string decode must be utf8 for valid-UTF-8 content to
-    // round-trip exactly. Non-UTF-8 8-bit content cannot survive any
-    // decode + utf8 re-encode; such messages verify as DKIM fail and
-    // DMARC falls back to the SPF identity (RFC 9989 §4 — one
-    // aligned authenticator is sufficient to pass).
-    message = message.toString("utf8");
+    // One code unit per octet, which is what the DKIM verifier now hashes.
+    // This used to decode as UTF-8, on the reasoning that the verifier
+    // re-encoded as UTF-8 and so only valid-UTF-8 content could round-trip.
+    // That was accurate and it meant a message carrying ordinary 8-bit content
+    // verified as a DKIM fail, leaving DMARC to fall back to the SPF identity
+    // — and nothing to fall back to once the message had been forwarded.
+    message = message.toString("latin1");
   }
   if (typeof message !== "string" || message.length === 0) {
     throw new MailAuthError("mail-auth/inbound-bad-message",
@@ -2893,10 +2913,40 @@ async function inboundVerify(opts) {
   if (opts.clockSkewMs !== undefined) dkimVerifyOpts.clockSkewMs = opts.clockSkewMs;
   if (opts.maxSignatures !== undefined) dkimVerifyOpts.maxSignatures = opts.maxSignatures;
   if (opts.minRsaBits !== undefined) dkimVerifyOpts.minRsaBits = opts.minRsaBits;
-  var dkimResults = await dkim.verify(message, dkimVerifyOpts);
+  // As OCTETS. `message` is the wire form here, one code unit per octet, and
+  // both verifiers read a string as text — handing one over would re-encode it
+  // as UTF-8 and verify against bytes the sender never signed.
+  var messageOctets = dkim._wireBytes(message);
+  var dkimResults = await dkim.verify(messageOctets, dkimVerifyOpts);
+
+  // ARC (RFC 8617) — the chain a forwarder or list left behind, carrying the
+  // authentication verdict from before it rewrote the message. A receiver
+  // without it sees forwarded mail fail DMARC on the forwarder's identity with
+  // no way to recover the original result, which is the case ARC exists for.
+  //
+  // The chain is EVIDENCE, not a gate: a malformed one is reported as a fail
+  // verdict and the pipeline continues, because refusing mail over a defect in
+  // some intermediary's headers would be the receiver punishing the wrong
+  // party. Deciding what a passing chain buys a sender is local policy, which
+  // is what b.mail.arc.evaluate + trustedSealers is for.
+  var arcResult;
+  try {
+    arcResult = await arcVerify(messageOctets, { dnsLookup: opts.dnsLookup });
+  } catch (e) {
+    arcResult = { chainStatus: "fail", hopCount: 0, hops: [],
+                  reason: "arc-verify-error: " + ((e && e.message) || String(e)) };
+  }
 
   // From header + DMARC policy/alignment.
-  var from = _extractFromHeaders(_splitHeaderBlock(message).headers);
+  // The From header is read as TEXT, while DKIM and ARC above read the same
+  // message as OCTETS. Both are needed and they are not the same view: a
+  // signature covers the bytes on the wire, and an address is characters —
+  // an RFC 6531 local part written in UTF-8 aligns against a DMARC record
+  // only once it is decoded as UTF-8, and reading it octet-per-code-unit
+  // would compare mojibake. Only the header block is decoded, so the body's
+  // size does not pay for it.
+  var headerOctets = _splitHeaderBlock(message).headers;
+  var from = _extractFromHeaders(Buffer.from(headerOctets, "latin1").toString("utf8"));
   var dmarc;
   if (from.count === 1 && from.address && from.domain) {
     dmarc = await dmarcEvaluate({
@@ -2956,10 +3006,15 @@ async function inboundVerify(opts) {
     var dmarcEntry = { method: "dmarc", result: dmarc.result };
     if (from.address) dmarcEntry.from = from.address;
     arResults.push(dmarcEntry);
+    // RFC 8601 §2.7.6 — the arc method. "none" is reported like any other
+    // verdict: a receiver reading the header can tell a chain that was checked
+    // and found absent from a receiver that does not check.
+    arResults.push({ method: "arc", result: arcResult.chainStatus });
     authResults = authResultsEmit({ authservId: opts.authservId, results: arResults });
   }
 
-  return { spf: spf, dkim: dkimResults, from: from, dmarc: dmarc, authResults: authResults };
+  return { spf: spf, dkim: dkimResults, from: from, dmarc: dmarc,
+           arc: arcResult, authResults: authResults };
 }
 
 // ---- DMARC aggregate (RUA) report parser (RFC 9990 §3 / draft-ietf-dmarc-aggregate-reporting) ----

package/lib/mail-crypto-pgp.js

@@ -81,7 +81,7 @@
  *   Surface:
  *     var sigBundle = b.mail.crypto.pgp.sign({
  *       message:        "rfc822 body bytes",
- *       privateKeyPem:  "-----BEGIN PRIVATE KEY----- ...",
+ *       privateKeyPem:  "<PEM-encoded PKCS#8 private key>",
  *       passphrase:     undefined | "...",     // optional
  *       audit:          opts.audit,            // optional b.audit handle
  *     });

package/lib/mail-dkim.js

@@ -179,6 +179,51 @@ function _parseHeaders(rawHeaders) {
   return out;
 }
 
+// ---- The octet boundary ----
+//
+// RFC 6376 §3.4 signs a canonicalized OCTET stream, and a JavaScript string
+// cannot hold one: a message decoded as UTF-8 loses every sequence that is not
+// valid UTF-8 to U+FFFD, and no string re-encodes back to those bytes. Signing
+// hashed `utf8(decode_utf8(original))`, equal to the original only when the
+// original was already valid UTF-8 — 128 of the 256 single-octet values do not
+// survive it.
+//
+// So the message is carried as latin1 from here down. latin1 is a bijection
+// between bytes and code units 0x00-0xFF, which makes every string operation
+// below an operation on the octets themselves. That is not an approximation of a
+// byte implementation, it IS one: §3.4 canonicalization touches only SP, HTAB,
+// CR and LF, none of which can appear inside a multi-byte UTF-8 sequence, so a
+// byte scan and this character scan agree on every input.
+//
+// A string argument keeps its present meaning — the octets are that string's
+// UTF-8 encoding — so it is encoded once here and rejoins the same path. One
+// path, and the caller's existing signatures are unchanged.
+// NOT IDEMPOTENT ON A STRING. Applied twice to a string, the second pass reads
+// the latin1 wire form as text and re-encodes it as UTF-8, so the octets are no
+// longer the message's. It IS idempotent on a Buffer. So a function that
+// resolves a message and then hands it to another function that resolves it
+// again must pass OCTETS — `_wireBytes(_toWire(x))` — not the wire string.
+// `arc.evaluate` passed the string to `arc.verify` and the two then disagreed
+// about whether the same Unicode message's chain passed.
+//
+// Refuses anything else rather than coercing it. `String(x)` on an object
+// yields "[object Object]", which is a message this would go on to sign — and
+// the caller gets a valid signature over eleven characters instead of an error.
+function _toWire(rfc822) {
+  if (Buffer.isBuffer(rfc822)) return rfc822.toString("latin1");
+  if (typeof rfc822 !== "string") {
+    throw new DkimError("dkim/bad-input",
+      "message must be a Buffer or a string — got " +
+      (rfc822 === null ? "null" : typeof rfc822));
+  }
+  return Buffer.from(rfc822, "utf8").toString("latin1");
+}
+
+// The octets of a string that is already in the latin1 wire form above.
+function _wireBytes(wire) {
+  return Buffer.from(wire, "latin1");
+}
+
 // ---- Hashing + signing ----
 
 function _bodyHashB64(body, algorithm, canonBody, lcap) {
@@ -192,25 +237,29 @@ function _bodyHashB64(body, algorithm, canonBody, lcap) {
   // octet stream to lcap (slicing the raw body before canonicalizing diverges
   // whenever relaxed canon changes the byte count within the first lcap
   // octets — WSP-run collapse, trailing-WSP strip, CRLF normalization).
+  var buf = _wireBytes(canonicalized);
   if (typeof lcap === "number" && isFinite(lcap) && lcap >= 0) {
-    var buf = Buffer.from(canonicalized, "utf8");
     hash.update(lcap < buf.length ? buf.subarray(0, lcap) : buf);
   } else {
-    hash.update(canonicalized);
+    hash.update(buf);
   }
   return hash.digest("base64");
 }
 
 function _signString(strToSign, privateKey, algorithm) {
+  // §3.7's data hash is assembled from canonicalized header octets, so it takes
+  // the same treatment as the body: a header field carrying unencoded 8-bit
+  // content is signed as the octets it holds.
+  var toSign = _wireBytes(strToSign);
   if (algorithm === "rsa-sha256") {
     return nodeCrypto.createSign("RSA-SHA256")
-      .update(strToSign).sign(privateKey).toString("base64");
+      .update(toSign).sign(privateKey).toString("base64");
   }
   if (algorithm === "ed25519-sha256") {
     // Ed25519 in node:crypto signs the raw message (it hashes
     // internally as part of EdDSA). Per RFC 8463 the verifier still
     // sees `a=ed25519-sha256` because the body hash is sha256.
-    return nodeCrypto.sign(null, Buffer.from(strToSign, "utf8"), privateKey)
+    return nodeCrypto.sign(null, toSign, privateKey)
       .toString("base64");
   }
   throw new DkimError("dkim/bad-algorithm",
@@ -335,11 +384,15 @@ function create(opts) {
   }
 
   function sign(rfc822) {
-    if (typeof rfc822 !== "string" || rfc822.length === 0) {
+    var gaveBuffer = Buffer.isBuffer(rfc822);
+    if ((!gaveBuffer && typeof rfc822 !== "string") || rfc822.length === 0) {
       throw new DkimError("dkim/bad-input",
-        "sign() requires the rfc822 wire format as a non-empty string");
+        "sign() requires the rfc822 wire format as a non-empty Buffer or string");
     }
     var t0 = Date.now();
+    // A Buffer's own octets, or a string's UTF-8 encoding, one code unit per
+    // octet from here down.
+    rfc822 = _toWire(rfc822);
     var split = _splitHeadersBody(rfc822);
     var parsedHeaders = _parseHeaders(split.headers);
 
@@ -455,7 +508,17 @@ function create(opts) {
       durationMs: Date.now() - t0,
     });
 
-    return dkimHeaderLine + rfc822;
+    // Returned in the shape it arrived in. A caller who handed over octets is
+    // relaying what comes back, and handing them a string would put the
+    // corruption this signs around straight back into the message.
+    var out = dkimHeaderLine + rfc822;
+    // A string caller gets their own string back, not the latin1 wire form of
+    // it: the octets are that string's UTF-8 encoding, so decoding them as
+    // UTF-8 reproduces exactly what they passed, with the ASCII signature
+    // header in front. Returning the wire form instead handed back a mojibake
+    // string that no longer re-encoded to the bytes just signed, so the
+    // message failed its own verify.
+    return gaveBuffer ? _wireBytes(out) : _wireBytes(out).toString("utf8");
   }
 
   return {
@@ -808,7 +871,7 @@ function _verifySingleSignature(rfc822, parsedHeaders, sigHeader, keyTags, sigTa
   // accept legacy l= senders opts in via verify({ acceptBodyLengthLimit: true }).
   if (lcap !== undefined && !verifyOpts.acceptBodyLengthLimit) {
     var fullCanon = canonBody === "simple" ? _canonBodySimple(body) : _canonBodyRelaxed(body);
-    if (lcap < Buffer.byteLength(fullCanon, "utf8")) {
+    if (lcap < Buffer.byteLength(fullCanon, "latin1")) {
       return { result: "fail",
                errors: ["DKIM-Signature l= leaves appended body content unsigned " +
                         "(RFC 6376 §8.2 append-after-signature)"] };
@@ -924,7 +987,7 @@ function _verifySingleSignature(rfc822, parsedHeaders, sigHeader, keyTags, sigTa
   var verified;
   try {
     verified = nodeCrypto.verify(nodeAlgo,
-      Buffer.from(canonicalizedHeaders, "utf8"), keyObj, sigBuf);
+      _wireBytes(canonicalizedHeaders), keyObj, sigBuf);
   } catch (e) {
     return { result: "permerror",
              errors: ["DKIM verify threw: " + ((e && e.message) || String(e))] };
@@ -943,10 +1006,14 @@ var DKIM_CLOCK_SKEW_MS_MAX = C.TIME.hours(24);
 var DKIM_CLOCK_SKEW_MS_DEFAULT = C.TIME.minutes(5);
 
 async function verify(rfc822, opts) {
-  if (typeof rfc822 !== "string" || rfc822.length === 0) {
+  if ((!Buffer.isBuffer(rfc822) && typeof rfc822 !== "string") || rfc822.length === 0) {
     throw new DkimError("dkim/bad-input",
-      "verify(): rfc822 must be a non-empty string");
+      "verify(): rfc822 must be a non-empty Buffer or string");
   }
+  // The same octet boundary as sign(): a receiver holding wire bytes verifies
+  // against those bytes rather than against a UTF-8 decode of them, which is
+  // what a sender's signature actually covers.
+  rfc822 = _toWire(rfc822);
   opts = opts || {};
   validateOpts(opts, ["dnsLookup", "audit", "clockSkewMs", "maxSignatures",
                        "minRsaBits", "acceptBodyLengthLimit"], "mail.dkim.verify");
@@ -1392,6 +1459,8 @@ module.exports = {
   _canonBodyRelaxedForTest:   _canonBodyRelaxed,
   _canonBodySimpleForTest:    _canonBodySimple,
   _stripBTagValue:            _stripBTagValue,   // RFC 6376 §3.5 — tag-aware b= zeroing; shared by the ARC seal verifier (internal cross-module helper)
+  _toWire:                    _toWire,           // Buffer|string → the message one code unit per octet; shared with the ARC verifier so both modules answer "which bytes is this message" the same way (internal cross-module helper)
+  _wireBytes:                 _wireBytes,        // the octets of a string already in that wire form (internal cross-module helper)
   _stripBTagValueForTest:     _stripBTagValue,
   // The header-block parser that produces the { name, value } pairs fed to the
   // canonicalizers. Exposed so a golden-vector test can pin its byte-exact

package/lib/mail-helo.js

@@ -370,6 +370,16 @@ async function _runFcrdns(ip, resolver) {
   if (!rev) {
     return result;                                                                                      // unparseable IP — caller already rejected
   }
+  // The resolver must be able to answer the question before the answer means
+  // anything. A missing method is not a DNS condition, and letting it fall into
+  // the catch below turned a broken call into a clean "no reverse name" for
+  // every address the check ever ran on — `passed` stayed false, which looks
+  // exactly like an address with no PTR record.
+  if (typeof resolver.queryPtr !== "function") {
+    throw new MailHeloError("mail-helo/resolver-missing-queryptr",
+      "fcrdns requires resolver.queryPtr(name); the supplied resolver has none, " +
+      "so reverse DNS cannot be checked and a pass cannot be claimed");
+  }
   try {
     var ptr = await resolver.queryPtr(rev);
     if (ptr && ptr.rrs) {

package/lib/mail-rbl.js

@@ -253,9 +253,16 @@ function create(opts) {
     } catch (e) {
       // NXDOMAIN is the expected "not listed" response, not an error
       // condition. RFC 5782 §2.1.1 — absence of any A record means
-      // "not in list". Resolver surfaces this as resolver/nxdomain-or-
-      // error which we treat as the neutral verdict.
-      if (e && e.code === "resolver/nxdomain-or-error") {
+      // "not in list".
+      //
+      // ONLY NXDOMAIN. The resolver used to report every non-zero RCODE under
+      // one code, so this branch also caught SERVFAIL and REFUSED and returned
+      // the same clean verdict — a blocklist lookup that failed read exactly
+      // like a host that is not on the list. Anyone able to break the query
+      // could therefore clear themselves, which is the wrong direction for a
+      // blocklist to fail in. A failure now falls through to `rv.error` below,
+      // where the caller can see it.
+      if (e && e.code === "resolver/nxdomain") {
         // Neutral — not listed; not an error.
         return rv;
       }