@blamejs/core 0.18.53 → 0.18.55

package/lib/mail-server-managesieve.js

@@ -133,7 +133,6 @@ var safeBuffer = require("./safe-buffer");
 var mailServerTls = require("./mail-server-tls");
 var mailServerNet = require("./mail-server-net");
 var C = require("./constants");
-var bCrypto = require("./crypto");
 var numericBounds = require("./numeric-bounds");
 var validateOpts = require("./validate-opts");
 var guardManageSieveCommand = require("./guard-managesieve-command");
@@ -172,6 +171,7 @@ var ERR_CLAMP                = 200;
  *   greeting:          string,                               // default "blamejs ManageSieve"
  *   maxLineBytes:      number,                               // default 8192
  *   idleTimeoutMs:     number,                               // default 5 min
+ *   maxConnections:    number,                               // default 1024 — listener-wide ceiling
  *   profile:           "strict" | "balanced" | "permissive", // default "strict"
  *   auth: {
  *     mechanisms:      ["SCRAM-SHA-256", "OAUTHBEARER", ...], // SASL mechs to advertise
@@ -212,7 +212,7 @@ function create(opts) {
       "operator-supplied backend)");
   }
   numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxLineBytes", "idleTimeoutMs"],
+    ["maxLineBytes", "idleTimeoutMs", "maxConnections"],
     "mail.server.managesieve.", MailServerManageSieveError, "mail-server-managesieve/bad-bound");
 
   var greeting       = opts.greeting       || DEFAULT_GREETING_VENDOR;
@@ -236,22 +236,18 @@ function create(opts) {
   var _emit = auditEmit.emit;
 
   function _handleConnection(rawSocket) {
-    var remoteAddress = mailServerNet.admitConnection(rawSocket, rateLimit, _emit, {
+    var accepted = mailServerNet.acceptConnection(rawSocket, {
+      rateLimit:    rateLimit,
+      connections:  connections,
+      emit:         _emit,
       refusedEvent: "mail.server.managesieve.rate_limit_refused",
       refusalLine:  'NO "Too many connections from your IP"\r\n',
+      idPrefix:     "msvconn-",
     });
-    if (remoteAddress === null) return;
-    var connectionId = "msvconn-" + bCrypto.generateToken(8);                                            // connection-id length
-    var socket = rawSocket;
-    connections.add(socket);
-    // Single close handler covers BOTH operator-driven `_close(socket)`
-    // and client-initiated disconnects (TCP FIN / RST). Releases the
-    // rate-limit slot AND removes the socket from the tracking set so
-    // long-lived deployments don't accumulate stale entries.
-    rawSocket.once("close", function () {
-      rateLimit.releaseConnection(remoteAddress);
-      connections.delete(socket);
-    });
+    if (accepted === null) return;
+    var remoteAddress = accepted.remoteAddress;
+    var connectionId  = accepted.connectionId;
+    var socket        = accepted.socket;
 
     var state = {
       id:              connectionId,
@@ -261,6 +257,8 @@ function create(opts) {
       actor:           null,
       pendingLiteral:  null,         // { verb, name, size, body, plus }
       pendingAuth:     null,         // { mech, irBytes, irPlus, irBody }
+      saslExchange:    null,         // { mech, step } while a multi-step SASL exchange is live
+      awaitingLiteralTerminator: false,  // a literal body was read; its line's CRLF has not arrived
       lineBuffer:      Buffer.alloc(0),
     };
 
@@ -300,6 +298,31 @@ function create(opts) {
   // AUTHENTICATE with a non-synchronizing initial-response), the next
   // N bytes are the literal-payload; accumulate them before resuming
   // line-mode dispatch.
+  // The CRLF that ends the LINE a literal sat on. RFC 5804 §4 puts it after
+  // the payload, outside the declared octet count, so every literal owes one
+  // and no literal's size includes it.
+  //
+  // Consumed here when it is already buffered, and otherwise awaited: it may
+  // arrive in a later segment, and read as a line it is an EMPTY line. On the
+  // SASL path an empty line is a second response and the pipelining guard
+  // fails the exchange for it; on the PUTSCRIPT path it draws a spurious
+  // "empty command line" refusal AFTER the script was accepted, so one command
+  // is answered twice and a client that reads one reply per command spends the
+  // rest of the session attributing each answer to the command before it.
+  //
+  // A peek alone is not enough, because whether the terminator has arrived yet
+  // is a property of the network rather than of the protocol. Shared by both
+  // literal paths: one of them used to do this and the other did not, which is
+  // the entire defect.
+  function _consumeLiteralTerminator(state) {
+    if (state.lineBuffer.length >= 2 &&
+        state.lineBuffer[0] === 0x0d && state.lineBuffer[1] === 0x0a) {          // CR LF
+      state.lineBuffer = state.lineBuffer.subarray(2);
+    } else {
+      state.awaitingLiteralTerminator = true;
+    }
+  }
+
   function _drainBuffer(state, socket) {
     while (true) {
       if (state.pendingLiteral) {
@@ -312,6 +335,7 @@ function create(opts) {
         }
         pl.body = Buffer.concat([pl.body, state.lineBuffer.subarray(0, need)]);
         state.lineBuffer = state.lineBuffer.subarray(need);
+        _consumeLiteralTerminator(state);
         state.pendingLiteral = null;
         _completePutscript(state, socket, pl);
         if (state.stage === "closed") return;
@@ -327,7 +351,7 @@ function create(opts) {
         }
         pa.irBody = Buffer.concat([pa.irBody, state.lineBuffer.subarray(0, needA)]);
         state.lineBuffer = state.lineBuffer.subarray(needA);
-        // After literal-IR is gathered, expect CRLF terminator.
+        _consumeLiteralTerminator(state);
         pa.irBytes = null;
         _completeAuthenticate(state, socket);
         if (state.stage === "closed") return;
@@ -343,12 +367,27 @@ function create(opts) {
       }
       var rawLine = state.lineBuffer.subarray(0, crlf).toString("utf8");
       state.lineBuffer = state.lineBuffer.subarray(crlf + 2);
+      // The terminator a literal was still owed, arriving in its own segment.
+      // It closes the literal's line rather than opening a new one.
+      if (state.awaitingLiteralTerminator) {
+        state.awaitingLiteralTerminator = false;
+        if (rawLine.length === 0) continue;
+      }
       _handleLine(state, socket, rawLine);
       if (state.stage === "closed") return;
     }
   }
 
   function _handleLine(state, socket, line) {
+    // Mid-SASL: this line is the client's base64 response to the server's
+    // challenge, not a ManageSieve verb, so it goes to the exchange rather than
+    // the wire guard — which would refuse it as an unknown command. This
+    // ordering is why the `overrides` hook could never carry a multi-step
+    // mechanism on its own: the guard ran first and the reply never arrived.
+    if (state.saslExchange) {
+      _continueSaslExchange(state, socket, line);
+      return;
+    }
     var parsed;
     try {
       parsed = guardManageSieveCommand.validate(line, {
@@ -589,10 +628,19 @@ function create(opts) {
       mech:    mech,
       irBytes: parsed.literalBytes,
       irPlus:  parsed.literalPlus,
-      irBody:  Buffer.alloc(0),
+      // RFC 5804 §2.1 lets the initial response come inline as a quoted string
+      // instead of a literal. It arrives complete on this line, so there is
+      // nothing to wait for — the exchange runs now, with the response the
+      // client actually sent. This used to fall through to the no-initial-
+      // response branch and answer a conforming client as though it had said
+      // nothing.
+      irBody:  parsed.initialResponse === null || parsed.initialResponse === undefined
+        ? Buffer.alloc(0)
+        : Buffer.from(parsed.initialResponse, "utf8"),
     };
     if (parsed.literalBytes === null) {
-      // No initial-response — call verify with empty client response.
+      // Either an inline initial response, complete above, or none at all —
+      // in which case verify is called with an empty client response.
       _completeAuthenticate(state, socket);
       return;
     }
@@ -605,38 +653,145 @@ function create(opts) {
     // after.
   }
 
+  // `{N}` / `{N+}` on a line of its own, the RFC 5804 §1.2 literal form of a
+  // string. Returns null for anything else. Scanned rather than matched so the
+  // digit run is bounded by the line the caller already length-capped.
+  function _parseLiteralMarker(line) {
+    if (line.length < 3 || line.charAt(0) !== "{") return null;
+    var i = 1;
+    var digits = "";
+    while (i < line.length && line.charCodeAt(i) >= 0x30 && line.charCodeAt(i) <= 0x39) {
+      digits += line.charAt(i);
+      i += 1;
+      if (digits.length > 9) return null;                                                               // absurd count: not a literal we will honour
+    }
+    if (digits.length === 0) return null;
+    var plus = false;
+    if (line.charAt(i) === "+") { plus = true; i += 1; }
+    if (line.charAt(i) !== "}" || i !== line.length - 1) return null;
+    return { bytes: Number(digits), plus: plus };
+  }
+
   function _completeAuthenticate(state, socket) {
     var pa = state.pendingAuth;
     state.pendingAuth = null;
     if (!pa) return;
+    // Resuming a live exchange: the step counter and mechanism carry over, and
+    // no new auth_attempt is emitted — this is the same attempt, one round on.
+    if (pa.resume && state.saslExchange) {
+      _runAuthStep(state, socket, pa.irBody.toString("utf8"));
+      return;
+    }
     _emit("mail.server.managesieve.auth_attempt",
       { connectionId: state.id, mech: pa.mech, remoteAddress: state.remoteAddress });
-    Promise.resolve()
-      .then(function () {
-        return authConfig.verify(pa.mech, {
-          clientResponse: pa.irBody.length > 0 ? pa.irBody.toString("utf8") : null,
-          tls:            state.tls,
-          remoteAddress:  state.remoteAddress,
-        });
-      })
-      .then(function (result) {
-        if (result && result.ok && result.actor) {
-          state.actor = result.actor;
-          state.stage = "authenticated";
-          _emit("mail.server.managesieve.auth_success",
-            { connectionId: state.id, mech: pa.mech, tenantId: state.actor.tenantId || null });
-          _writeOk(socket, "Authenticated");
-          return;
-        }
+    state.saslExchange = { mech: pa.mech, step: 0 };
+    _runAuthStep(state, socket,
+      pa.irBody.length > 0 ? pa.irBody.toString("utf8") : null);
+  }
+
+  // One round of a SASL exchange (RFC 5804 §2.1). The verifier may answer with
+  // `{ pending: true, challenge }` to ask for another client response, as it
+  // may on the IMAP, POP3 and submission listeners. ManageSieve used to call
+  // verify once with no `step`, so a pending verdict landed in the failure
+  // branch — and spent the client's authentication-failure budget for what is a
+  // normal protocol round trip, weakening the very defence that budget exists
+  // to provide.
+  function _runAuthStep(state, socket, clientResponse) {
+    var ex = state.saslExchange;
+    function _fail(reason) {
+      state.saslExchange = null;
+      rateLimit.noteAuthFailure(state.remoteAddress);
+      _emit("mail.server.managesieve.auth_failed",
+        { connectionId: state.id, mech: ex.mech, reason: reason }, "denied");
+      _writeNo(socket, "Authentication failed");
+    }
+    mailServerNet.runSaslStep({
+      exchange:       ex,
+      verify:         authConfig.verify,
+      credentials:    { tls: state.tls, remoteAddress: state.remoteAddress },
+      clientResponse: clientResponse,
+      writeChallenge: function (ch) { return _writeChallenge(socket, ch); },
+      onChallengeUnsafe: function () { _fail("challenge-contains-line-terminator"); },
+      onSuccess: function (result) {
+        state.saslExchange = null;
+        state.actor = result.actor;
+        state.stage = "authenticated";
+        _emit("mail.server.managesieve.auth_success",
+          { connectionId: state.id, mech: ex.mech, tenantId: state.actor.tenantId || null });
+        _writeOk(socket, "Authenticated");
+      },
+      onFailure: function (result) { _fail((result && result.reason) || "verify-returned-fail"); },
+      onError:   function (err) { _fail((err && err.message) || String(err)); },
+    });
+  }
+
+  // RFC 5804 §2.1 — the server's SASL challenge is sent as a literal:
+  // `{N}\r\n<challenge>\r\n`. Returns false when the challenge carries bytes
+  // that would end the line, so the caller fails the exchange rather than
+  // emitting a second, smuggled protocol line.
+  function _writeChallenge(socket, challenge) {
+    var safe = mailServerNet.saslChallengeOrNull(challenge);
+    if (safe === null) return false;
+    try { socket.write("{" + Buffer.byteLength(safe, "utf8") + "}\r\n" + safe + "\r\n"); }
+    catch (_e) { /* socket down */ }
+    return true;
+  }
+
+  // The client's reply to a challenge, per RFC 5804 §1.2 "string": a quoted
+  // string, or (accepted defensively) a bare token. `"*"` cancels the exchange
+  // — a withdrawal rather than a failed credential, so it costs no budget.
+  function _continueSaslExchange(state, socket, line) {
+    // RFC 5804 §1.2 — a "string" is a quoted string OR a literal. A SASL
+    // response is base64 and can be long, which is exactly when a client
+    // reaches for the literal form, and reading `{N+}` as the response itself
+    // then reading its bytes as a second response cannot authenticate anyone.
+    // The bytes are collected by the same drain-loop branch the initial
+    // AUTHENTICATE response uses, and `resume` tells _completeAuthenticate to
+    // continue this exchange rather than start a new one at step 0.
+    var lit = _parseLiteralMarker(line);
+    if (lit) {
+      // The client declaring this size is unauthenticated, and the drain loop
+      // will collect toward it. Unbounded, `{999999999+}` both consumes memory
+      // and pins the connection open waiting for bytes that never arrive.
+      //
+      // The bound is the guard's own SASL-token cap, the same one it applies to
+      // the AUTHENTICATE initial response. One exchange, one bound, whichever
+      // round the token arrives on: two numbers for the same thing is how the
+      // two halves of a protocol drift apart.
+      if (lit.bytes > guardManageSieveCommand.MAX_SASL_TOKEN_BYTES) {
+        var oversizeMech = state.saslExchange.mech;
+        state.saslExchange = null;
         rateLimit.noteAuthFailure(state.remoteAddress);
         _emit("mail.server.managesieve.auth_failed",
-          { connectionId: state.id, mech: pa.mech, reason: "verify-returned-fail" }, "denied");
-        _writeNo(socket, "Authentication failed");
-      })
-      .catch(function () {
-        rateLimit.noteAuthFailure(state.remoteAddress);
-        _writeNo(socket, "Authentication failed");
-      });
+          { connectionId: state.id, mech: oversizeMech,
+            reason: "continuation-literal-too-large" }, "denied");
+        _writeNo(socket, "Authentication response too long (cap " +
+          guardManageSieveCommand.MAX_SASL_TOKEN_BYTES + ")");
+        return;
+      }
+      state.pendingAuth = {
+        mech:    state.saslExchange.mech,
+        irBytes: lit.bytes,
+        irPlus:  lit.plus,
+        irBody:  Buffer.alloc(0),
+        resume:  true,
+      };
+      // Synchronizing form: the server invites the bytes before the client
+      // sends them, exactly as it does for an initial-response literal.
+      if (!lit.plus) socket.write("OK\r\n");
+      return;
+    }
+    // The guard owns the quoted form of the same production — escapes
+    // included, and NUL / CR / LF refused inside the quotes. A bare token is
+    // accepted defensively for clients that omit the quoting.
+    var quoted = guardManageSieveCommand.parseQuotedString(line);
+    var body = quoted ? quoted.value : line;
+    if (body === "*") {
+      state.saslExchange = null;
+      _writeNo(socket, "Authentication cancelled");
+      return;
+    }
+    _runAuthStep(state, socket, body);
   }
 
   function _requireAuth(state, socket) {
@@ -844,6 +999,7 @@ function create(opts) {
   // ---- Lifecycle ----------------------------------------------------------
   return mailServerNet.createStoreServer(net, {
     defaultPort:      DEFAULT_PORT,
+    maxConnections:   opts.maxConnections,
     handleConnection: _handleConnection,
     errorClass:       MailServerManageSieveError,
     errorCodePrefix:  "mail-server-managesieve/",