@blamejs/core 0.18.53 → 0.18.54

package/lib/mail-server-managesieve.js

@@ -261,6 +261,8 @@ function create(opts) {
       actor:           null,
       pendingLiteral:  null,         // { verb, name, size, body, plus }
       pendingAuth:     null,         // { mech, irBytes, irPlus, irBody }
+      saslExchange:    null,         // { mech, step } while a multi-step SASL exchange is live
+      awaitingLiteralTerminator: false,  // a literal body was read; its line's CRLF has not arrived
       lineBuffer:      Buffer.alloc(0),
     };
 
@@ -327,7 +329,26 @@ function create(opts) {
         }
         pa.irBody = Buffer.concat([pa.irBody, state.lineBuffer.subarray(0, needA)]);
         state.lineBuffer = state.lineBuffer.subarray(needA);
-        // After literal-IR is gathered, expect CRLF terminator.
+        // The CRLF that ends the line the literal sat on. It was left in the
+        // buffer, so the next pass read it as an empty LINE — harmless while
+        // nothing was in flight, and not harmless during a multi-step SASL
+        // exchange, where an empty line is a second response and the pipelining
+        // guard fails the exchange for it. The bug only appeared when the two
+        // writes arrived as separate TCP segments, which is why the host run
+        // was green and the container run was not.
+        // The CRLF that ends the line the literal sat on. Consumed here when it
+        // is already buffered, and otherwise awaited: it may arrive in a later
+        // segment, and read as a line it is an EMPTY line. That was harmless
+        // while nothing was in flight, and during a multi-step SASL exchange it
+        // is a second response — the pipelining guard fails the exchange for
+        // it. A peek alone is not enough, because whether the terminator has
+        // arrived yet is a property of the network, not of the protocol.
+        if (state.lineBuffer.length >= 2 &&
+            state.lineBuffer[0] === 0x0d && state.lineBuffer[1] === 0x0a) {      // CR LF
+          state.lineBuffer = state.lineBuffer.subarray(2);
+        } else {
+          state.awaitingLiteralTerminator = true;
+        }
         pa.irBytes = null;
         _completeAuthenticate(state, socket);
         if (state.stage === "closed") return;
@@ -343,12 +364,27 @@ function create(opts) {
       }
       var rawLine = state.lineBuffer.subarray(0, crlf).toString("utf8");
       state.lineBuffer = state.lineBuffer.subarray(crlf + 2);
+      // The terminator a literal was still owed, arriving in its own segment.
+      // It closes the literal's line rather than opening a new one.
+      if (state.awaitingLiteralTerminator) {
+        state.awaitingLiteralTerminator = false;
+        if (rawLine.length === 0) continue;
+      }
       _handleLine(state, socket, rawLine);
       if (state.stage === "closed") return;
     }
   }
 
   function _handleLine(state, socket, line) {
+    // Mid-SASL: this line is the client's base64 response to the server's
+    // challenge, not a ManageSieve verb, so it goes to the exchange rather than
+    // the wire guard — which would refuse it as an unknown command. This
+    // ordering is why the `overrides` hook could never carry a multi-step
+    // mechanism on its own: the guard ran first and the reply never arrived.
+    if (state.saslExchange) {
+      _continueSaslExchange(state, socket, line);
+      return;
+    }
     var parsed;
     try {
       parsed = guardManageSieveCommand.validate(line, {
@@ -605,38 +641,145 @@ function create(opts) {
     // after.
   }
 
+  // `{N}` / `{N+}` on a line of its own, the RFC 5804 §1.2 literal form of a
+  // string. Returns null for anything else. Scanned rather than matched so the
+  // digit run is bounded by the line the caller already length-capped.
+  function _parseLiteralMarker(line) {
+    if (line.length < 3 || line.charAt(0) !== "{") return null;
+    var i = 1;
+    var digits = "";
+    while (i < line.length && line.charCodeAt(i) >= 0x30 && line.charCodeAt(i) <= 0x39) {
+      digits += line.charAt(i);
+      i += 1;
+      if (digits.length > 9) return null;                                                               // absurd count: not a literal we will honour
+    }
+    if (digits.length === 0) return null;
+    var plus = false;
+    if (line.charAt(i) === "+") { plus = true; i += 1; }
+    if (line.charAt(i) !== "}" || i !== line.length - 1) return null;
+    return { bytes: Number(digits), plus: plus };
+  }
+
   function _completeAuthenticate(state, socket) {
     var pa = state.pendingAuth;
     state.pendingAuth = null;
     if (!pa) return;
+    // Resuming a live exchange: the step counter and mechanism carry over, and
+    // no new auth_attempt is emitted — this is the same attempt, one round on.
+    if (pa.resume && state.saslExchange) {
+      _runAuthStep(state, socket, pa.irBody.toString("utf8"));
+      return;
+    }
     _emit("mail.server.managesieve.auth_attempt",
       { connectionId: state.id, mech: pa.mech, remoteAddress: state.remoteAddress });
-    Promise.resolve()
-      .then(function () {
-        return authConfig.verify(pa.mech, {
-          clientResponse: pa.irBody.length > 0 ? pa.irBody.toString("utf8") : null,
-          tls:            state.tls,
-          remoteAddress:  state.remoteAddress,
-        });
-      })
-      .then(function (result) {
-        if (result && result.ok && result.actor) {
-          state.actor = result.actor;
-          state.stage = "authenticated";
-          _emit("mail.server.managesieve.auth_success",
-            { connectionId: state.id, mech: pa.mech, tenantId: state.actor.tenantId || null });
-          _writeOk(socket, "Authenticated");
-          return;
-        }
+    state.saslExchange = { mech: pa.mech, step: 0 };
+    _runAuthStep(state, socket,
+      pa.irBody.length > 0 ? pa.irBody.toString("utf8") : null);
+  }
+
+  // One round of a SASL exchange (RFC 5804 §2.1). The verifier may answer with
+  // `{ pending: true, challenge }` to ask for another client response, as it
+  // may on the IMAP, POP3 and submission listeners. ManageSieve used to call
+  // verify once with no `step`, so a pending verdict landed in the failure
+  // branch — and spent the client's authentication-failure budget for what is a
+  // normal protocol round trip, weakening the very defence that budget exists
+  // to provide.
+  function _runAuthStep(state, socket, clientResponse) {
+    var ex = state.saslExchange;
+    function _fail(reason) {
+      state.saslExchange = null;
+      rateLimit.noteAuthFailure(state.remoteAddress);
+      _emit("mail.server.managesieve.auth_failed",
+        { connectionId: state.id, mech: ex.mech, reason: reason }, "denied");
+      _writeNo(socket, "Authentication failed");
+    }
+    mailServerNet.runSaslStep({
+      exchange:       ex,
+      verify:         authConfig.verify,
+      credentials:    { tls: state.tls, remoteAddress: state.remoteAddress },
+      clientResponse: clientResponse,
+      writeChallenge: function (ch) { return _writeChallenge(socket, ch); },
+      onChallengeUnsafe: function () { _fail("challenge-contains-line-terminator"); },
+      onSuccess: function (result) {
+        state.saslExchange = null;
+        state.actor = result.actor;
+        state.stage = "authenticated";
+        _emit("mail.server.managesieve.auth_success",
+          { connectionId: state.id, mech: ex.mech, tenantId: state.actor.tenantId || null });
+        _writeOk(socket, "Authenticated");
+      },
+      onFailure: function (result) { _fail((result && result.reason) || "verify-returned-fail"); },
+      onError:   function (err) { _fail((err && err.message) || String(err)); },
+    });
+  }
+
+  // RFC 5804 §2.1 — the server's SASL challenge is sent as a literal:
+  // `{N}\r\n<challenge>\r\n`. Returns false when the challenge carries bytes
+  // that would end the line, so the caller fails the exchange rather than
+  // emitting a second, smuggled protocol line.
+  function _writeChallenge(socket, challenge) {
+    var safe = mailServerNet.saslChallengeOrNull(challenge);
+    if (safe === null) return false;
+    try { socket.write("{" + Buffer.byteLength(safe, "utf8") + "}\r\n" + safe + "\r\n"); }
+    catch (_e) { /* socket down */ }
+    return true;
+  }
+
+  // The client's reply to a challenge, per RFC 5804 §1.2 "string": a quoted
+  // string, or (accepted defensively) a bare token. `"*"` cancels the exchange
+  // — a withdrawal rather than a failed credential, so it costs no budget.
+  function _continueSaslExchange(state, socket, line) {
+    // RFC 5804 §1.2 — a "string" is a quoted string OR a literal. A SASL
+    // response is base64 and can be long, which is exactly when a client
+    // reaches for the literal form, and reading `{N+}` as the response itself
+    // then reading its bytes as a second response cannot authenticate anyone.
+    // The bytes are collected by the same drain-loop branch the initial
+    // AUTHENTICATE response uses, and `resume` tells _completeAuthenticate to
+    // continue this exchange rather than start a new one at step 0.
+    var lit = _parseLiteralMarker(line);
+    if (lit) {
+      // The client declaring this size is unauthenticated, and the drain loop
+      // will collect toward it. Unbounded, `{999999999+}` both consumes memory
+      // and pins the connection open waiting for bytes that never arrive.
+      //
+      // The bound is the guard's own SASL-token cap, the same one it applies to
+      // the AUTHENTICATE initial response. One exchange, one bound, whichever
+      // round the token arrives on: two numbers for the same thing is how the
+      // two halves of a protocol drift apart.
+      if (lit.bytes > guardManageSieveCommand.MAX_SASL_TOKEN_BYTES) {
+        var oversizeMech = state.saslExchange.mech;
+        state.saslExchange = null;
         rateLimit.noteAuthFailure(state.remoteAddress);
         _emit("mail.server.managesieve.auth_failed",
-          { connectionId: state.id, mech: pa.mech, reason: "verify-returned-fail" }, "denied");
-        _writeNo(socket, "Authentication failed");
-      })
-      .catch(function () {
-        rateLimit.noteAuthFailure(state.remoteAddress);
-        _writeNo(socket, "Authentication failed");
-      });
+          { connectionId: state.id, mech: oversizeMech,
+            reason: "continuation-literal-too-large" }, "denied");
+        _writeNo(socket, "Authentication response too long (cap " +
+          guardManageSieveCommand.MAX_SASL_TOKEN_BYTES + ")");
+        return;
+      }
+      state.pendingAuth = {
+        mech:    state.saslExchange.mech,
+        irBytes: lit.bytes,
+        irPlus:  lit.plus,
+        irBody:  Buffer.alloc(0),
+        resume:  true,
+      };
+      // Synchronizing form: the server invites the bytes before the client
+      // sends them, exactly as it does for an initial-response literal.
+      if (!lit.plus) socket.write("OK\r\n");
+      return;
+    }
+    // The guard owns the quoted form of the same production — escapes
+    // included, and NUL / CR / LF refused inside the quotes. A bare token is
+    // accepted defensively for clients that omit the quoting.
+    var quoted = guardManageSieveCommand.parseQuotedString(line);
+    var body = quoted ? quoted.value : line;
+    if (body === "*") {
+      state.saslExchange = null;
+      _writeNo(socket, "Authentication cancelled");
+      return;
+    }
+    _runAuthStep(state, socket, body);
   }
 
   function _requireAuth(state, socket) {

package/lib/mail-server-mx.js

@@ -75,12 +75,14 @@
  *   - `mail.server.mx.rbl_refused`       — connecting IP on a DNS blocklist (zones)
  *   - `mail.server.mx.greylist_deferred` — (ip, from, rcpt) first-seen 450 deferral
  *   - `mail.server.mx.data_refused`      — refusal reason + SMTP code (5xx vs 4xx)
- *   - `mail.server.mx.envelope_verdict`  — DATA-phase SPF/DKIM/DMARC results + action (accept / quarantine / reject / defer) + gate mode
+ *   - `mail.server.mx.envelope_verdict`  — DATA-phase SPF/DKIM/DMARC/ARC results + action (accept / quarantine / reject / defer) + gate mode
  *   - `mail.server.mx.envelope_error`    — DATA-phase authentication pipeline failure or timeout (disposition follows onTemperror)
  *   - `mail.server.mx.delivered`         — agent.handoff ack
  *   - `mail.server.mx.tls_handshake_failed` — handshake error
  *   - `mail.server.mx.smtp_smuggling_detected` — CRLF.CRLF injection class
  *   - `mail.server.mx.relay_refused`     — open-relay attempt
+ *   - `mail.server.mx.recipient_refused` — recipientPolicy said the mailbox is unavailable (550 5.1.1)
+ *   - `mail.server.mx.recipient_policy_threw` — recipientPolicy failed; the recipient is deferred (451 4.7.1)
  *
  *   ## What v1 does NOT ship
  *
@@ -114,11 +116,25 @@
  *   `opts.helo` (HELO identity) evaluates at HELO/EHLO; `opts.rbl`
  *   (connecting-IP DNS blocklist, evaluated once per connection) and
  *   `opts.greylist` ((ip, from, rcpt) first-seen deferral) evaluate at
- *   RCPT TO and surface their verdicts on the `rcpt_to` event. The
+ *   RCPT TO and surface their verdicts on the `rcpt_to` event.
+ *
+ *   `opts.recipientPolicy` decides whether a mailbox on a local domain
+ *   exists, and is the only way to answer "no such user" the way RFC
+ *   5321 §3.3 asks. It runs at RCPT TO, so the refusal costs one command
+ *   rather than a whole message body: `{ ok: false, reason }` becomes
+ *   550 5.1.1 with the reason, and a throw becomes 451 4.7.1 (a
+ *   directory that cannot be reached is not a verdict about the
+ *   mailbox). Refusals charge the same per-IP recipient-failure budget
+ *   as a relay refusal, because the 250-vs-550 difference is a
+ *   mailbox-existence oracle. Unwired, every syntactically valid
+ *   recipient on a local domain is accepted and the agent handoff is
+ *   the operator's last chance to reject. The
+
  *   message-authentication gate (`opts.guardEnvelope`) runs at DATA
  *   completion through `b.mail.inbound.verify` — SPF (RFC 7208) on the
  *   envelope identity, DKIM (RFC 6376) on the message bytes, DMARC
- *   (RFC 9989) policy + alignment on the From-header domain — and in
+ *   (RFC 9989) policy + alignment on the From-header domain, ARC
+ *   (RFC 8617) on any chain a forwarder left behind — and in
  *   enforce mode refuses before the agent handoff: 550 5.7.26
  *   (RFC 7372) when the sender's published policy says reject, 550
  *   5.7.1 on the RFC 9989 §5.3.1 multi-From spoofing shape, 451 4.7.0
@@ -307,12 +323,13 @@ function _stripForgedAuthResults(messageBuf, authservId) {
  *   agent:             b.mail.agent,    // optional delivery handoff
  *   relayAllowedFor:   [{ cidr, scope }],  // operator-explicit relay allowlist; default [] = MX-only
  *   localDomains:      [string],        // RCPT TO local-domain allowlist (refuse non-local with 550 5.7.1)
+ *   recipientPolicy:   function (ctx) → { ok } | { ok: false, reason },  // optional RCPT-time mailbox check; refuses 550 5.1.1, defers 451 when it throws
  *   maxLineBytes:      number,          // default 1 KiB — per-command line cap
  *   maxMessageBytes:   number,          // default 50 MiB — DATA body cap
  *   maxRcptsPerMessage: number,         // default 100 — per RFC 5321 §4.5.3.1.8
  *   idleTimeoutMs:     number,          // default 5 minutes — RFC 5321 §4.5.3.2.7
  *   profile:           "strict" | "balanced" | "permissive",  // gate posture cascade
- *   guardEnvelope:     true | {        // optional gate — DATA-phase SPF/DKIM/DMARC via b.mail.inbound.verify
+ *   guardEnvelope:     true | {        // optional gate — DATA-phase SPF/DKIM/DMARC/ARC via b.mail.inbound.verify
  *     mode?:          "enforce" | "monitor",   // default: enforce (monitor when profile is permissive)
  *     onTemperror?:   "defer" | "accept",      // DNS temperror disposition; default "defer" (451 4.7.5)
  *     authservId?:    string,                  // RFC 8601 authserv-id; default localDomains[0]
@@ -1035,6 +1052,60 @@ function create(opts) {
           return;
         }
       }
+      // Operator-supplied recipient policy — the only place a listener can
+      // answer "no such mailbox" the way RFC 5321 §3.3 asks. Without it, a
+      // local domain accepted every local part and the application first met
+      // the recipient at agent.handoff, after 354 and after the whole message:
+      // from there the choices were 250 (tell the peer it arrived, then owe a
+      // DSN) or 451 (tell a peer holding a permanent condition to retry
+      // forever). Neither is a refusal. Same shape as the submission
+      // listener's hook: `{ ok: true }` accepts, `{ ok: false, reason }`
+      // refuses. Unwired, every syntactically valid recipient on a local
+      // domain is accepted, exactly as before.
+      if (typeof opts.recipientPolicy === "function") {
+        var rcptVerdictPolicy;
+        try {
+          rcptVerdictPolicy = await opts.recipientPolicy({
+            mailFrom:      state.mailFrom,
+            rcptTo:        rcpt,
+            connectionId:  state.id,
+            remoteAddress: state.remoteAddress,
+            tls:           state.tls,
+            heloName:      state.heloName || null,
+          });
+        } catch (policyErr) {
+          // The operator's directory being unreachable is not a verdict about
+          // this mailbox. A 550 here would permanently reject mail for a
+          // legitimate recipient because a lookup failed, so it defers.
+          _emit("mail.server.mx.recipient_policy_threw",
+            { connectionId: state.id, rcptTo: rcpt,
+              error: (policyErr && policyErr.message) || String(policyErr) }, "failure");
+          _writeReply(socket, REPLY_451_LOCAL_ERROR,
+            "4.7.1 Recipient policy temporarily unavailable");
+          return;
+        }
+        if (!rcptVerdictPolicy || rcptVerdictPolicy.ok !== true) {
+          // The 250-vs-550 difference is a mailbox-existence oracle, so a
+          // policy refusal charges the same per-IP recipient-failure budget
+          // the relay refusal does. Without that, wiring this hook would hand
+          // a scanner a free enumeration channel the listener did not have.
+          rateLimit.noteRcptFailure(state.remoteAddress);
+          _trackRefusedRcpt(state, rcpt, "recipient-policy");
+          _emit("mail.server.mx.recipient_refused",
+            { connectionId: state.id, mailFrom: state.mailFrom, rcptTo: rcpt,
+              reason: (rcptVerdictPolicy && rcptVerdictPolicy.reason) || "policy-refused",
+              remoteAddress: state.remoteAddress }, "denied");
+          // The reason goes onto a line-oriented reply, and a directory wrapper
+          // routinely quotes the address it looked up — which the peer chose.
+          // A CR or LF in it would end the 550 early and let the remainder be
+          // read as a second, forged reply. The refusal still happens; only the
+          // prose falls back.
+          _writeReply(socket, REPLY_550_MAILBOX_UNAVAIL,
+            "5.1.1 " + mailServerNet.replyTextOrFallback(
+              rcptVerdictPolicy && rcptVerdictPolicy.reason, "Mailbox unavailable"));
+          return;
+        }
+      }
       state.rcpts.push(rcpt);
       _emit("mail.server.mx.rcpt_to",
         { connectionId: state.id, rcptTo: rcpt, rcptCount: state.rcpts.length,
@@ -1143,6 +1214,7 @@ function create(opts) {
             spf:          inboundVerdict.spf.result,
             dkim:         dkimSummary,
             dmarc:        inboundVerdict.dmarc.result,
+            arc:          inboundVerdict.arc && inboundVerdict.arc.chainStatus,
             action:       envAction,
             mode:         envelopeGate.mode,
           }, (envAction === "reject" || envAction === "defer") ? "denied" : "success");

package/lib/mail-server-net.js

@@ -2,6 +2,8 @@
 // Copyright (c) blamejs contributors
 "use strict";
 
+var codepointClass = require("./codepoint-class");
+
 // mail-server-net — the TCP-listener lifecycle shared by the mailbox / transfer
 // servers (b.mail.server.imap / pop3 / mx / managesieve / submission). Each of
 // those keeps its OWN connection set and close() drain because those diverge:
@@ -171,9 +173,133 @@ function validateDomainHardened(d, label, cfg) {
   return verdict;
 }
 
+// saslChallengeOrNull(challenge) — the operator's SASL challenge, checked for
+// the bytes that would end the line it is written on.
+//
+// Every listener that supports a multi-step SASL exchange writes this value
+// straight to the wire, and it is not always the operator's own text: a SCRAM
+// or CRAM mechanism composes its challenge from the client's nonce, so client
+// bytes reach this line. A CR, LF or NUL in it terminates the server's reply
+// early and the remainder is read by the client as a second protocol line —
+// the same injection class the outbound SMTP transport refuses at config time
+// (GHSA-c7w3-x93f-qmm8). Returns null when the challenge cannot be written
+// safely; the caller fails the exchange rather than emitting a smuggled line.
+function saslChallengeOrNull(challenge) {
+  if (typeof challenge !== "string") return null;
+  return codepointClass.firstLineInjectionCharOffset(challenge) === -1 ? challenge : null;
+}
+
+// replyTextOrFallback(text, fallback) — operator-supplied prose, made safe to
+// write into a line-oriented protocol reply.
+//
+// A refusal reason is the common case, and it is rarely the operator's own
+// words: a directory wrapper answers "No such user: <address>", and the address
+// came from the peer. A CR or LF in it ends the reply line early and everything
+// after is read by the peer as a second server response, so a `550` refusal can
+// carry a forged `250` acceptance.
+//
+// Unlike a SASL challenge, a refusal must still happen: dropping the whole
+// reply would turn an injection attempt into a hang. So the unsafe text is
+// replaced by the caller's fallback and the refusal is delivered.
+function replyTextOrFallback(text, fallback) {
+  if (typeof text !== "string" || text.length === 0) return fallback;
+  return codepointClass.firstLineInjectionCharOffset(text) === -1 ? text : fallback;
+}
+
+// runSaslStep(cfg) — one round of a multi-step SASL exchange.
+//
+// IMAP, POP3, ManageSieve and submission all run the same loop: call the
+// operator's verifier with the current step and the client's latest response,
+// then either write a challenge and wait, complete the authentication, or fail
+// it. Only the wire syntax of each outcome differs, so the loop lives here once
+// and each listener supplies the four writers. Keeping it in one place is what
+// stops the listeners drifting apart again — the whole reason POP3 and
+// ManageSieve did not honour `pending` was that each had its own copy.
+//
+//   cfg.exchange       { mech, step } — mutated: step increments each round.
+//   cfg.verify         the operator's verify(mechanism, credentials).
+//   cfg.credentials    extra fields merged into the credentials object
+//                      (tls, remoteAddress).
+//   cfg.clientResponse this round's client response, or null.
+//   cfg.writeChallenge (challenge) => boolean — write it, false if unsafe.
+//   cfg.onChallengeUnsafe () => void — the challenge could not be written.
+//   cfg.onSuccess      (result) => void — verify returned { ok, actor }.
+//   cfg.onFailure      (result) => void — verify declined.
+//   cfg.onError        (err) => void — verify threw.
+//
+// A `pending` verdict is NOT a failure and none of the failure paths run for
+// it: it is a normal protocol round trip, and charging it against an
+// authentication-failure budget would spend the defence that budget exists to
+// provide.
+function runSaslStep(cfg) {
+  var ex = cfg.exchange;
+  // A client can put several lines in one TCP segment, and a listener's drain
+  // loop dispatches them without awaiting. Two SASL responses arriving together
+  // therefore each started a verifier call at the SAME `ex.step`: concurrent
+  // rounds, results landing out of order, and a later response able to complete
+  // authentication before the challenge for it had been issued.
+  //
+  // A client that answers before it has been asked is not following the
+  // protocol, so the second response fails the exchange rather than queueing:
+  // queueing would preserve the ordering but still credit a response the server
+  // never solicited.
+  // Once a pipelining violation has been reported the exchange is DEAD, and
+  // stays dead. A listener is expected to tear the connection down, but if it
+  // does not, a resumed exchange must not become authenticable just because the
+  // violation has scrolled past.
+  if (ex.abandoned) {
+    cfg.onFailure({ reason: "pipelined-sasl-response" });
+    return Promise.resolve();
+  }
+  if (ex.inFlight) {
+    // The round already in flight is ABANDONED, not merely reported. Its
+    // verifier has already been called and can still resolve `{ ok: true }`,
+    // and invoking onSuccess then authenticates the connection whose pipelined
+    // response was just refused — so reporting the refusal would have decided
+    // nothing. Every completion below checks this before calling back.
+    ex.abandoned = true;
+    cfg.onFailure({ reason: "pipelined-sasl-response" });
+    return Promise.resolve();
+  }
+  ex.inFlight = true;
+  return Promise.resolve()
+    .then(function () {
+      var creds = { step: ex.step, clientResponse: cfg.clientResponse };
+      if (cfg.credentials) {
+        Object.keys(cfg.credentials).forEach(function (k) { creds[k] = cfg.credentials[k]; });
+      }
+      return cfg.verify(ex.mech, creds);
+    })
+    .then(function (result) {
+      // Cleared before the callbacks run, so the next round — which a
+      // challenge invites — is free to start.
+      ex.inFlight = false;
+      // Abandoned while this was in flight: the listener has already answered
+      // the pipelining violation, and a second verdict on a dead exchange is
+      // the bypass this guard exists to close.
+      if (ex.abandoned) return;
+      ex.step += 1;
+      if (result && result.pending && typeof result.challenge === "string") {
+        if (cfg.writeChallenge(result.challenge)) return;
+        cfg.onChallengeUnsafe();
+        return;
+      }
+      if (result && result.ok === true && result.actor) { cfg.onSuccess(result); return; }
+      cfg.onFailure(result);
+    })
+    .catch(function (err) {
+      ex.inFlight = false;
+      if (ex.abandoned) return;                    // same reason as the resolve path
+      cfg.onError(err);
+    });
+}
+
 module.exports = {
   createTcpListener: createTcpListener,
+  runSaslStep:       runSaslStep,
   createStoreServer: createStoreServer,
   admitConnection:   admitConnection,
   validateDomainHardened: validateDomainHardened,
+  saslChallengeOrNull: saslChallengeOrNull,
+  replyTextOrFallback:  replyTextOrFallback,
 };

package/lib/mail-server-pop3.js

@@ -264,6 +264,7 @@ function create(opts) {
       stage:         "authorization",
       actor:         null,
       tentativeUser: null,           // USER name pending PASS
+      authPending:   null,           // in-flight multi-step SASL exchange (RFC 5034 §4)
       dropId:        null,           // mailStore-issued drop handle on TRANSACTION entry
       lineBuffer:    Buffer.alloc(0),
     };
@@ -307,6 +308,14 @@ function create(opts) {
   }
 
   function _handleLine(state, socket, line) {
+    // Mid-SASL: the client's next line is a base64 response to the server's
+    // challenge, not a POP3 verb, so it goes to the exchange rather than the
+    // wire guard — which would refuse it as an unknown command. Same ordering
+    // the submission listener uses for its own AUTH continuation.
+    if (state.authPending) {
+      _continueAuthExchange(state, socket, line);
+      return;
+    }
     var parsed;
     try {
       parsed = guardPop3Command.validate(line, {
@@ -596,28 +605,59 @@ function create(opts) {
     }
     var mech = args[0].toUpperCase();
     var initialResp = args.length > 1 ? args.slice(1).join(" ") : null;
-    Promise.resolve()
-      .then(function () {
-        return authConfig.verify(mech, {
-          clientResponse: initialResp,
-          tls:            state.tls,
-          remoteAddress:  state.remoteAddress,
-        });
-      })
-      .then(function (result) {
-        if (result && result.ok && result.actor) {
-          if (!_assertTenantOrRefuse(state, socket, result)) return;
-          state.actor = result.actor;
-          _enterTransaction(state, socket, "AUTH/" + mech);
-          return;
-        }
-        rateLimit.noteAuthFailure(state.remoteAddress);
-        _writeErr(socket, "Authentication failed");
-      })
-      .catch(function () {
-        rateLimit.noteAuthFailure(state.remoteAddress);
-        _writeErr(socket, "Authentication failed");
-      });
+    state.authPending = { mech: mech, step: 0 };
+    _runAuthStep(state, socket, initialResp);
+  }
+
+  // One round of a SASL exchange (RFC 5034 §4). The verifier may answer with
+  // `{ pending: true, challenge }` to ask for another client response, exactly
+  // as it may on the IMAP and submission listeners; POP3 used to call verify
+  // once with no `step`, so a pending verdict fell into the failure branch —
+  // and spent the client's authentication-failure budget for what is a normal
+  // protocol round trip, weakening the defence that budget exists to provide.
+  function _runAuthStep(state, socket, clientResponse) {
+    var pending = state.authPending;
+    function _fail(reason, outcome) {
+      state.authPending = null;
+      rateLimit.noteAuthFailure(state.remoteAddress);
+      _emit("mail.server.pop3.auth_failed",
+        { connectionId: state.id, verb: "AUTH", mech: pending.mech, reason: reason },
+        outcome);
+      _writeErr(socket, "Authentication failed");
+    }
+    mailServerNet.runSaslStep({
+      // `pending` IS the exchange: runSaslStep increments its `step`, and it
+      // stays on `state.authPending` across rounds.
+      exchange:       pending,
+      verify:         authConfig.verify,
+      credentials:    { tls: state.tls, remoteAddress: state.remoteAddress },
+      clientResponse: clientResponse,
+      // RFC 5034 §4 — the server's challenge is a `+ <base64>` line, and the
+      // connection stays mid-exchange until the client answers.
+      writeChallenge: function (ch) { return _writeContinuation(socket, ch); },
+      onChallengeUnsafe: function () { _fail("challenge-contains-line-terminator", "denied"); },
+      onSuccess: function (result) {
+        state.authPending = null;
+        if (!_assertTenantOrRefuse(state, socket, result)) return;
+        state.actor = result.actor;
+        _enterTransaction(state, socket, "AUTH/" + pending.mech);
+      },
+      onFailure: function (result) {
+        _fail((result && result.reason) || "verify-returned-fail", "denied");
+      },
+      onError: function (err) { _fail((err && err.message) || String(err), "failure"); },
+    });
+  }
+
+  function _continueAuthExchange(state, socket, line) {
+    // RFC 5034 §4 — a bare `*` cancels the exchange. Cancelling is the client
+    // withdrawing, not failing to authenticate, so it costs no budget either.
+    if (line === "*") {
+      state.authPending = null;
+      _writeErr(socket, "Authentication cancelled");
+      return;
+    }
+    _runAuthStep(state, socket, line);
   }
 
   function _enterTransaction(state, socket, verb) {
@@ -840,6 +880,17 @@ function create(opts) {
 
   function _writeOk(socket, msg)  { try { socket.write("+OK "  + msg + "\r\n"); } catch (_e) { /* socket down */ } }
   function _writeErr(socket, msg) { try { socket.write("-ERR " + msg + "\r\n"); } catch (_e) { /* socket down */ } }
+  // RFC 5034 §4 SASL continuation — `+ <base64>`, or a bare `+` for an empty
+  // challenge. Returns false when the challenge carries bytes that would end
+  // the line, so the caller fails the exchange instead of emitting a second,
+  // smuggled protocol line.
+  function _writeContinuation(socket, challenge) {
+    var b64 = mailServerNet.saslChallengeOrNull(challenge);
+    if (b64 === null) return false;
+    try { socket.write(b64.length > 0 ? "+ " + b64 + "\r\n" : "+\r\n"); }
+    catch (_e) { /* socket down */ }
+    return true;
+  }
   function _close(socket) {
     try { socket.end(); } catch (_e) { /* idempotent */ }
     try { socket.destroy(); } catch (_e2) { /* idempotent */ }