@blamejs/core 0.18.53 → 0.18.55

package/lib/mail-server-net.js

@@ -2,6 +2,9 @@
 // Copyright (c) blamejs contributors
 "use strict";
 
+var codepointClass = require("./codepoint-class");
+var bCrypto        = require("./crypto");
+
 // mail-server-net — the TCP-listener lifecycle shared by the mailbox / transfer
 // servers (b.mail.server.imap / pop3 / mx / managesieve / submission). Each of
 // those keeps its OWN connection set and close() drain because those diverge:
@@ -14,6 +17,14 @@
 // EACCES) rejects the listen promise instead of crashing the process. That, plus
 // the listening/server state, is what createTcpListener owns.
 
+// The listener's own ceiling when an operator names none. Every mail listener
+// shares it, so a deployment that raises or lowers it does so in one place and
+// the five listeners cannot drift apart on what "too many" means. Set well
+// above any single-host mail deployment's working set and far below what an
+// unbounded accept loop will take: the point is that a ceiling EXISTS, since
+// the per-address cap alone leaves the total at (cap x source addresses).
+var DEFAULT_MAX_CONNECTIONS = 1024;
+
 // createTcpListener(net, cfg) — build a listener lifecycle.
 //   cfg.defaultPort      port used when listenOpts.port is omitted (an explicit
 //                        0 is honored, for an ephemeral test bind).
@@ -24,6 +35,15 @@
 //   cfg.listeningEvent   the "...listening" audit action.
 //   cfg.listeningExtra   optional () => object merged onto the listening event
 //                        payload (Submission reports implicitTls).
+//   cfg.maxConnections   the listener's own ceiling on concurrently accepted
+//                        sockets. The per-address cap in b.mail.server.rateLimit
+//                        bounds ONE peer; it says nothing about how many peers
+//                        there are, so the process-wide total was the per-address
+//                        cap times however many source addresses the caller could
+//                        speak from — a number a botnet, a NAT pool or a single
+//                        v6 /64 makes large. Enforced by the runtime, which closes
+//                        the excess socket before handleConnection ever sees it,
+//                        so a refusal costs no descriptor and no state machine.
 // Returns { listen, getServer, isListening, markClosed } — the server wires its
 // own close() through getServer()/isListening()/markClosed().
 function createTcpListener(net, cfg) {
@@ -38,6 +58,7 @@ function createTcpListener(net, cfg) {
     var port = listenOpts.port === undefined ? cfg.defaultPort : listenOpts.port;
     var address = listenOpts.address || "0.0.0.0";
     server = net.createServer(function (socket) { cfg.handleConnection(socket); });
+    server.maxConnections = cfg.maxConnections || DEFAULT_MAX_CONNECTIONS;
     return new Promise(function (resolve, reject) {
       server.once("error", reject);
       server.listen(port, address, function () {
@@ -108,6 +129,7 @@ function createStoreServer(net, cfg) {
   var ErrorClass = cfg.errorClass;
   var listener = createTcpListener(net, {
     defaultPort:      cfg.defaultPort,
+    maxConnections:   cfg.maxConnections,
     handleConnection: cfg.handleConnection,
     errorFactory:     function (code, message) { return new ErrorClass(cfg.errorCodePrefix + code, message); },
     emit:             cfg.emit,
@@ -120,7 +142,137 @@ function createStoreServer(net, cfg) {
       closedEvent: cfg.eventBase + ".closed",
     });
   }
-  return { listen: listener.listen, close: close };
+  return {
+    listen:          listener.listen,
+    close:           close,
+    connectionCount: function () { return cfg.connections.size; },
+  };
+}
+
+// trackConnection(socket, cfg) — the other half of admitConnection, and the
+// reason it is here rather than written out per listener.
+//
+// A connection occupies two ledgers: the rate limiter's per-address count, and
+// the listener's live-socket set that shutdown drains. Both are released by the
+// SAME event — the socket closing — and it does not matter who closed it. Five
+// listeners each wrote that pairing by hand and one of them registered only the
+// release, so a peer that opened a connection, took the greeting and dropped TCP
+// freed its rate-limit slot (and could reconnect at once) while its set entry
+// stayed forever. Nothing authenticates before that point, so the growth was
+// unauthenticated and unbounded.
+//
+// Registering both in one handler is what makes the pair impossible to
+// half-write.
+//   cfg.connections    the listener's live-socket Set.
+//   cfg.rateLimit      the resolved b.mail.server.rateLimit.
+//   cfg.remoteAddress  the address admitConnection returned.
+//   cfg.closeSource    optional socket whose "close" drives teardown, when the
+//                      tracked socket is a wrapper (Submission's implicit-TLS
+//                      path tracks the TLSSocket but the raw socket is the one
+//                      that carries the FIN).
+function trackConnection(socket, cfg) {
+  cfg.connections.add(socket);
+  var source = cfg.closeSource || socket;
+  source.once("close", function () {
+    cfg.rateLimit.releaseConnection(cfg.remoteAddress);
+    cfg.connections.delete(socket);
+  });
+}
+
+// createBodyRateWindow(rateLimit) — the body-rate floor, measured over BOUNDED
+// windows instead of the whole transfer.
+//
+// A lifetime average lets an early burst pay for an arbitrarily slow tail: at
+// the default 100 B/s an 8 MiB burst buys about a day of credit and 50 MiB buys
+// six, which a peer spends holding a connection and its slot in the per-address
+// cap while sending a byte at a time. The floor was enforced and still
+// bypassable, which is the worse of the two states — it reads as covered.
+//
+// Each window has to meet the floor on its own, so nothing sent earlier pays
+// for what is sent now. A window only rolls forward once it has run long enough
+// to be a real judgement; inside that stretch no verdict is reached, so a
+// sender pausing to read from its own spool is not cut off for the pause, and a
+// fast chunk cannot keep resetting the clock to dodge the next measurement.
+//
+// `now` is a parameter rather than a call to the clock so the whole thing can
+// be driven across days of simulated time without waiting for them.
+//   rateLimit  the resolved b.mail.server.rateLimit (owns the floor + grace).
+function createBodyRateWindow(rateLimit) {
+  var windowStart = 0;
+  var windowBytes = 0;
+  return {
+    // Open the first window. `bytesSeen` is the caller's running total AT THIS
+    // MOMENT, which becomes the baseline every later reading is measured
+    // against — so the caller is free to keep one connection-lifetime counter
+    // incremented at the wire boundary rather than a per-transfer one. That
+    // matters where a listener re-feeds part of a chunk through its own parser:
+    // a counter maintained inside the parser credits those bytes twice, and a
+    // peer that pipelines a one-byte payload with the next command gets roughly
+    // double the rate it is actually sending.
+    start: function (now, bytesSeen) {
+      windowStart = now;
+      windowBytes = bytesSeen || 0;
+    },
+    // `bytesSeen` is the running total for the whole body; the window's own
+    // count is derived, so the caller keeps one counter rather than two.
+    starved: function (bytesSeen, now) {
+      var elapsed = now - windowStart;
+      if (rateLimit.bodyRateStarved(bytesSeen - windowBytes, elapsed)) return true;
+      // The limiter says how long a window must run before rolling, because the
+      // limiter is what decides when a measurement is old enough to mean
+      // something. Rolling on a number held HERE would ask a limiter that
+      // judges over a longer stretch only ever before it can answer: every call
+      // returning "too early", the window resetting underneath it, and its rate
+      // protection silently disabled while looking wired.
+      if (elapsed >= rateLimit.bodyRateWindowMs()) {
+        windowStart = now;
+        windowBytes = bytesSeen;
+      }
+      return false;
+    },
+  };
+}
+
+// acceptConnection(rawSocket, cfg) — everything a listener does between the TCP
+// accept and its own state machine: gate the address, mint the connection id,
+// wrap the socket if the protocol starts in TLS, and enter both ledgers.
+//
+// Every listener performed these four steps in the same order, and the parts
+// that differ between them are three strings and an optional wrap. Keeping the
+// order in one place is what stops a fifth listener from being written with one
+// of the steps missing, which is how the tracking-set entry and the rate-limit
+// slot came apart in the first place.
+//
+// Returns null when the address was refused — the caller returns immediately;
+// the refusal line and teardown are already done.
+//   cfg.rateLimit      the resolved b.mail.server.rateLimit.
+//   cfg.connections    the listener's live-socket Set.
+//   cfg.emit           the listener's audit emitter.
+//   cfg.refusedEvent   the "<...>.rate_limit_refused" audit action.
+//   cfg.refusalLine    the protocol's refusal bytes.
+//   cfg.idPrefix       "imapconn-" / "mxconn-" / … prefix for the connection id.
+//   cfg.wrap           optional (rawSocket) => socket, for a protocol that
+//                      starts inside TLS. The RAW socket still drives teardown:
+//                      a handshake that never completes closes it without the
+//                      wrapper ever being established.
+function acceptConnection(rawSocket, cfg) {
+  var remoteAddress = admitConnection(rawSocket, cfg.rateLimit, cfg.emit, {
+    refusedEvent: cfg.refusedEvent,
+    refusalLine:  cfg.refusalLine,
+  });
+  if (remoteAddress === null) return null;
+  var socket = cfg.wrap ? cfg.wrap(rawSocket) : rawSocket;
+  trackConnection(socket, {
+    connections:   cfg.connections,
+    rateLimit:     cfg.rateLimit,
+    remoteAddress: remoteAddress,
+    closeSource:   socket === rawSocket ? null : rawSocket,
+  });
+  return {
+    socket:        socket,
+    remoteAddress: remoteAddress,
+    connectionId:  cfg.idPrefix + bCrypto.generateToken(8),                                           // connection-id length
+  };
 }
 
 // admitConnection(socket, rateLimit, emit, cfg) — the per-connection rate-limit
@@ -171,9 +323,137 @@ function validateDomainHardened(d, label, cfg) {
   return verdict;
 }
 
+// saslChallengeOrNull(challenge) — the operator's SASL challenge, checked for
+// the bytes that would end the line it is written on.
+//
+// Every listener that supports a multi-step SASL exchange writes this value
+// straight to the wire, and it is not always the operator's own text: a SCRAM
+// or CRAM mechanism composes its challenge from the client's nonce, so client
+// bytes reach this line. A CR, LF or NUL in it terminates the server's reply
+// early and the remainder is read by the client as a second protocol line —
+// the same injection class the outbound SMTP transport refuses at config time
+// (GHSA-c7w3-x93f-qmm8). Returns null when the challenge cannot be written
+// safely; the caller fails the exchange rather than emitting a smuggled line.
+function saslChallengeOrNull(challenge) {
+  if (typeof challenge !== "string") return null;
+  return codepointClass.firstLineInjectionCharOffset(challenge) === -1 ? challenge : null;
+}
+
+// replyTextOrFallback(text, fallback) — operator-supplied prose, made safe to
+// write into a line-oriented protocol reply.
+//
+// A refusal reason is the common case, and it is rarely the operator's own
+// words: a directory wrapper answers "No such user: <address>", and the address
+// came from the peer. A CR or LF in it ends the reply line early and everything
+// after is read by the peer as a second server response, so a `550` refusal can
+// carry a forged `250` acceptance.
+//
+// Unlike a SASL challenge, a refusal must still happen: dropping the whole
+// reply would turn an injection attempt into a hang. So the unsafe text is
+// replaced by the caller's fallback and the refusal is delivered.
+function replyTextOrFallback(text, fallback) {
+  if (typeof text !== "string" || text.length === 0) return fallback;
+  return codepointClass.firstLineInjectionCharOffset(text) === -1 ? text : fallback;
+}
+
+// runSaslStep(cfg) — one round of a multi-step SASL exchange.
+//
+// IMAP, POP3, ManageSieve and submission all run the same loop: call the
+// operator's verifier with the current step and the client's latest response,
+// then either write a challenge and wait, complete the authentication, or fail
+// it. Only the wire syntax of each outcome differs, so the loop lives here once
+// and each listener supplies the four writers. Keeping it in one place is what
+// stops the listeners drifting apart again — the whole reason POP3 and
+// ManageSieve did not honour `pending` was that each had its own copy.
+//
+//   cfg.exchange       { mech, step } — mutated: step increments each round.
+//   cfg.verify         the operator's verify(mechanism, credentials).
+//   cfg.credentials    extra fields merged into the credentials object
+//                      (tls, remoteAddress).
+//   cfg.clientResponse this round's client response, or null.
+//   cfg.writeChallenge (challenge) => boolean — write it, false if unsafe.
+//   cfg.onChallengeUnsafe () => void — the challenge could not be written.
+//   cfg.onSuccess      (result) => void — verify returned { ok, actor }.
+//   cfg.onFailure      (result) => void — verify declined.
+//   cfg.onError        (err) => void — verify threw.
+//
+// A `pending` verdict is NOT a failure and none of the failure paths run for
+// it: it is a normal protocol round trip, and charging it against an
+// authentication-failure budget would spend the defence that budget exists to
+// provide.
+function runSaslStep(cfg) {
+  var ex = cfg.exchange;
+  // A client can put several lines in one TCP segment, and a listener's drain
+  // loop dispatches them without awaiting. Two SASL responses arriving together
+  // therefore each started a verifier call at the SAME `ex.step`: concurrent
+  // rounds, results landing out of order, and a later response able to complete
+  // authentication before the challenge for it had been issued.
+  //
+  // A client that answers before it has been asked is not following the
+  // protocol, so the second response fails the exchange rather than queueing:
+  // queueing would preserve the ordering but still credit a response the server
+  // never solicited.
+  // Once a pipelining violation has been reported the exchange is DEAD, and
+  // stays dead. A listener is expected to tear the connection down, but if it
+  // does not, a resumed exchange must not become authenticable just because the
+  // violation has scrolled past.
+  if (ex.abandoned) {
+    cfg.onFailure({ reason: "pipelined-sasl-response" });
+    return Promise.resolve();
+  }
+  if (ex.inFlight) {
+    // The round already in flight is ABANDONED, not merely reported. Its
+    // verifier has already been called and can still resolve `{ ok: true }`,
+    // and invoking onSuccess then authenticates the connection whose pipelined
+    // response was just refused — so reporting the refusal would have decided
+    // nothing. Every completion below checks this before calling back.
+    ex.abandoned = true;
+    cfg.onFailure({ reason: "pipelined-sasl-response" });
+    return Promise.resolve();
+  }
+  ex.inFlight = true;
+  return Promise.resolve()
+    .then(function () {
+      var creds = { step: ex.step, clientResponse: cfg.clientResponse };
+      if (cfg.credentials) {
+        Object.keys(cfg.credentials).forEach(function (k) { creds[k] = cfg.credentials[k]; });
+      }
+      return cfg.verify(ex.mech, creds);
+    })
+    .then(function (result) {
+      // Cleared before the callbacks run, so the next round — which a
+      // challenge invites — is free to start.
+      ex.inFlight = false;
+      // Abandoned while this was in flight: the listener has already answered
+      // the pipelining violation, and a second verdict on a dead exchange is
+      // the bypass this guard exists to close.
+      if (ex.abandoned) return;
+      ex.step += 1;
+      if (result && result.pending && typeof result.challenge === "string") {
+        if (cfg.writeChallenge(result.challenge)) return;
+        cfg.onChallengeUnsafe();
+        return;
+      }
+      if (result && result.ok === true && result.actor) { cfg.onSuccess(result); return; }
+      cfg.onFailure(result);
+    })
+    .catch(function (err) {
+      ex.inFlight = false;
+      if (ex.abandoned) return;                    // same reason as the resolve path
+      cfg.onError(err);
+    });
+}
+
 module.exports = {
   createTcpListener: createTcpListener,
+  runSaslStep:       runSaslStep,
   createStoreServer: createStoreServer,
   admitConnection:   admitConnection,
+  trackConnection:   trackConnection,
+  acceptConnection:  acceptConnection,
+  createBodyRateWindow: createBodyRateWindow,
+  DEFAULT_MAX_CONNECTIONS: DEFAULT_MAX_CONNECTIONS,
   validateDomainHardened: validateDomainHardened,
+  saslChallengeOrNull: saslChallengeOrNull,
+  replyTextOrFallback:  replyTextOrFallback,
 };

package/lib/mail-server-pop3.js

@@ -52,9 +52,10 @@
  *     `authFailuresPerIpPer15Min` cap applies to USER+PASS / APOP /
  *     AUTH refusals.
  *
- *   - **Slow-loris on RETR / TOP** — per-connection `idleTimeoutMs`
- *     bounds dead connections; `b.mail.server.rateLimit.minBytesPerSecond`
- *     bounds trickle-receive class.
+ *   - **Slow-loris** — per-connection `idleTimeoutMs` bounds a peer that
+ *     stops making progress, in either direction: a client that sends no
+ *     further command, and one that stops taking a RETR / TOP response.
+ *     `maxLineBytes` bounds a command line that never ends.
  *
  *   ## Audit lifecycle
  *
@@ -107,7 +108,6 @@
 var net = require("node:net");
 var safeBuffer = require("./safe-buffer");
 var C = require("./constants");
-var bCrypto = require("./crypto");
 var numericBounds = require("./numeric-bounds");
 var validateOpts = require("./validate-opts");
 var guardPop3Command = require("./guard-pop3-command");
@@ -152,6 +152,7 @@ var ERR_CLAMP = 200;
  *   greeting:          string,                   // default "blamejs POP3"
  *   maxLineBytes:      number,                   // default 1024
  *   idleTimeoutMs:     number,                   // default 10 min
+ *   maxConnections:    number,                   // default 1024 — listener-wide ceiling
  *   commitTimeoutMs:   number,                   // default 30 s (UPDATE-state mailStore.commitPop3Drop cap)
  *   profile:           "strict" | "balanced" | "permissive",
  *   auth: {
@@ -189,7 +190,7 @@ function create(opts) {
       "getMessage/listMessages/markDelete; compose b.mailStore.create or operator-supplied backend)");
   }
   numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxLineBytes", "idleTimeoutMs", "commitTimeoutMs"],
+    ["maxLineBytes", "idleTimeoutMs", "commitTimeoutMs", "maxConnections"],
     "mail.server.pop3.", MailServerPop3Error, "mail-server-pop3/bad-bound");
 
   var greeting        = opts.greeting        || DEFAULT_GREETING_VENDOR;
@@ -239,23 +240,18 @@ function create(opts) {
   var _emit = auditEmit.emit;
 
   function _handleConnection(rawSocket) {
-    var remoteAddress = mailServerNet.admitConnection(rawSocket, rateLimit, _emit, {
+    var accepted = mailServerNet.acceptConnection(rawSocket, {
+      rateLimit:    rateLimit,
+      connections:  connections,
+      emit:         _emit,
       refusedEvent: "mail.server.pop3.rate_limit_refused",
       refusalLine:  "-ERR Too many connections from your IP\r\n",
+      idPrefix:     "pop3conn-",
     });
-    if (remoteAddress === null) return;
-    var connectionId = "pop3conn-" + bCrypto.generateToken(8);                                       // connection-id length
-    var socket = rawSocket;
-    connections.add(socket);
-    // Single close handler covers BOTH operator-driven `_close(socket)`
-    // and client-initiated disconnects (TCP FIN / RST without a
-    // server-side close call) — releases the rate-limit slot AND
-    // removes the socket from the tracking set so it can't accumulate
-    // stale entries across long-lived deployments.
-    rawSocket.once("close", function () {
-      rateLimit.releaseConnection(remoteAddress);
-      connections.delete(socket);
-    });
+    if (accepted === null) return;
+    var remoteAddress = accepted.remoteAddress;
+    var connectionId  = accepted.connectionId;
+    var socket        = accepted.socket;
 
     var state = {
       id:            connectionId,
@@ -264,6 +260,7 @@ function create(opts) {
       stage:         "authorization",
       actor:         null,
       tentativeUser: null,           // USER name pending PASS
+      authPending:   null,           // in-flight multi-step SASL exchange (RFC 5034 §4)
       dropId:        null,           // mailStore-issued drop handle on TRANSACTION entry
       lineBuffer:    Buffer.alloc(0),
     };
@@ -307,6 +304,14 @@ function create(opts) {
   }
 
   function _handleLine(state, socket, line) {
+    // Mid-SASL: the client's next line is a base64 response to the server's
+    // challenge, not a POP3 verb, so it goes to the exchange rather than the
+    // wire guard — which would refuse it as an unknown command. Same ordering
+    // the submission listener uses for its own AUTH continuation.
+    if (state.authPending) {
+      _continueAuthExchange(state, socket, line);
+      return;
+    }
     var parsed;
     try {
       parsed = guardPop3Command.validate(line, {
@@ -596,28 +601,59 @@ function create(opts) {
     }
     var mech = args[0].toUpperCase();
     var initialResp = args.length > 1 ? args.slice(1).join(" ") : null;
-    Promise.resolve()
-      .then(function () {
-        return authConfig.verify(mech, {
-          clientResponse: initialResp,
-          tls:            state.tls,
-          remoteAddress:  state.remoteAddress,
-        });
-      })
-      .then(function (result) {
-        if (result && result.ok && result.actor) {
-          if (!_assertTenantOrRefuse(state, socket, result)) return;
-          state.actor = result.actor;
-          _enterTransaction(state, socket, "AUTH/" + mech);
-          return;
-        }
-        rateLimit.noteAuthFailure(state.remoteAddress);
-        _writeErr(socket, "Authentication failed");
-      })
-      .catch(function () {
-        rateLimit.noteAuthFailure(state.remoteAddress);
-        _writeErr(socket, "Authentication failed");
-      });
+    state.authPending = { mech: mech, step: 0 };
+    _runAuthStep(state, socket, initialResp);
+  }
+
+  // One round of a SASL exchange (RFC 5034 §4). The verifier may answer with
+  // `{ pending: true, challenge }` to ask for another client response, exactly
+  // as it may on the IMAP and submission listeners; POP3 used to call verify
+  // once with no `step`, so a pending verdict fell into the failure branch —
+  // and spent the client's authentication-failure budget for what is a normal
+  // protocol round trip, weakening the defence that budget exists to provide.
+  function _runAuthStep(state, socket, clientResponse) {
+    var pending = state.authPending;
+    function _fail(reason, outcome) {
+      state.authPending = null;
+      rateLimit.noteAuthFailure(state.remoteAddress);
+      _emit("mail.server.pop3.auth_failed",
+        { connectionId: state.id, verb: "AUTH", mech: pending.mech, reason: reason },
+        outcome);
+      _writeErr(socket, "Authentication failed");
+    }
+    mailServerNet.runSaslStep({
+      // `pending` IS the exchange: runSaslStep increments its `step`, and it
+      // stays on `state.authPending` across rounds.
+      exchange:       pending,
+      verify:         authConfig.verify,
+      credentials:    { tls: state.tls, remoteAddress: state.remoteAddress },
+      clientResponse: clientResponse,
+      // RFC 5034 §4 — the server's challenge is a `+ <base64>` line, and the
+      // connection stays mid-exchange until the client answers.
+      writeChallenge: function (ch) { return _writeContinuation(socket, ch); },
+      onChallengeUnsafe: function () { _fail("challenge-contains-line-terminator", "denied"); },
+      onSuccess: function (result) {
+        state.authPending = null;
+        if (!_assertTenantOrRefuse(state, socket, result)) return;
+        state.actor = result.actor;
+        _enterTransaction(state, socket, "AUTH/" + pending.mech);
+      },
+      onFailure: function (result) {
+        _fail((result && result.reason) || "verify-returned-fail", "denied");
+      },
+      onError: function (err) { _fail((err && err.message) || String(err), "failure"); },
+    });
+  }
+
+  function _continueAuthExchange(state, socket, line) {
+    // RFC 5034 §4 — a bare `*` cancels the exchange. Cancelling is the client
+    // withdrawing, not failing to authenticate, so it costs no budget either.
+    if (line === "*") {
+      state.authPending = null;
+      _writeErr(socket, "Authentication cancelled");
+      return;
+    }
+    _runAuthStep(state, socket, line);
   }
 
   function _enterTransaction(state, socket, verb) {
@@ -840,6 +876,17 @@ function create(opts) {
 
   function _writeOk(socket, msg)  { try { socket.write("+OK "  + msg + "\r\n"); } catch (_e) { /* socket down */ } }
   function _writeErr(socket, msg) { try { socket.write("-ERR " + msg + "\r\n"); } catch (_e) { /* socket down */ } }
+  // RFC 5034 §4 SASL continuation — `+ <base64>`, or a bare `+` for an empty
+  // challenge. Returns false when the challenge carries bytes that would end
+  // the line, so the caller fails the exchange instead of emitting a second,
+  // smuggled protocol line.
+  function _writeContinuation(socket, challenge) {
+    var b64 = mailServerNet.saslChallengeOrNull(challenge);
+    if (b64 === null) return false;
+    try { socket.write(b64.length > 0 ? "+ " + b64 + "\r\n" : "+\r\n"); }
+    catch (_e) { /* socket down */ }
+    return true;
+  }
   function _close(socket) {
     try { socket.end(); } catch (_e) { /* idempotent */ }
     try { socket.destroy(); } catch (_e2) { /* idempotent */ }
@@ -849,6 +896,7 @@ function create(opts) {
   // ---- Lifecycle ----------------------------------------------------------
   return mailServerNet.createStoreServer(net, {
     defaultPort:      110,                                                                            // RFC 1939 POP3 port (IANA)
+    maxConnections:   opts.maxConnections,
     handleConnection: _handleConnection,
     errorClass:       MailServerPop3Error,
     errorCodePrefix:  "mail-server-pop3/",