@blamejs/core 0.18.54 → 0.18.55

package/lib/mail-server-managesieve.js

@@ -133,7 +133,6 @@ var safeBuffer = require("./safe-buffer");
 var mailServerTls = require("./mail-server-tls");
 var mailServerNet = require("./mail-server-net");
 var C = require("./constants");
-var bCrypto = require("./crypto");
 var numericBounds = require("./numeric-bounds");
 var validateOpts = require("./validate-opts");
 var guardManageSieveCommand = require("./guard-managesieve-command");
@@ -172,6 +171,7 @@ var ERR_CLAMP                = 200;
  *   greeting:          string,                               // default "blamejs ManageSieve"
  *   maxLineBytes:      number,                               // default 8192
  *   idleTimeoutMs:     number,                               // default 5 min
+ *   maxConnections:    number,                               // default 1024 — listener-wide ceiling
  *   profile:           "strict" | "balanced" | "permissive", // default "strict"
  *   auth: {
  *     mechanisms:      ["SCRAM-SHA-256", "OAUTHBEARER", ...], // SASL mechs to advertise
@@ -212,7 +212,7 @@ function create(opts) {
       "operator-supplied backend)");
   }
   numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxLineBytes", "idleTimeoutMs"],
+    ["maxLineBytes", "idleTimeoutMs", "maxConnections"],
     "mail.server.managesieve.", MailServerManageSieveError, "mail-server-managesieve/bad-bound");
 
   var greeting       = opts.greeting       || DEFAULT_GREETING_VENDOR;
@@ -236,22 +236,18 @@ function create(opts) {
   var _emit = auditEmit.emit;
 
   function _handleConnection(rawSocket) {
-    var remoteAddress = mailServerNet.admitConnection(rawSocket, rateLimit, _emit, {
+    var accepted = mailServerNet.acceptConnection(rawSocket, {
+      rateLimit:    rateLimit,
+      connections:  connections,
+      emit:         _emit,
       refusedEvent: "mail.server.managesieve.rate_limit_refused",
       refusalLine:  'NO "Too many connections from your IP"\r\n',
+      idPrefix:     "msvconn-",
     });
-    if (remoteAddress === null) return;
-    var connectionId = "msvconn-" + bCrypto.generateToken(8);                                            // connection-id length
-    var socket = rawSocket;
-    connections.add(socket);
-    // Single close handler covers BOTH operator-driven `_close(socket)`
-    // and client-initiated disconnects (TCP FIN / RST). Releases the
-    // rate-limit slot AND removes the socket from the tracking set so
-    // long-lived deployments don't accumulate stale entries.
-    rawSocket.once("close", function () {
-      rateLimit.releaseConnection(remoteAddress);
-      connections.delete(socket);
-    });
+    if (accepted === null) return;
+    var remoteAddress = accepted.remoteAddress;
+    var connectionId  = accepted.connectionId;
+    var socket        = accepted.socket;
 
     var state = {
       id:              connectionId,
@@ -302,6 +298,31 @@ function create(opts) {
   // AUTHENTICATE with a non-synchronizing initial-response), the next
   // N bytes are the literal-payload; accumulate them before resuming
   // line-mode dispatch.
+  // The CRLF that ends the LINE a literal sat on. RFC 5804 §4 puts it after
+  // the payload, outside the declared octet count, so every literal owes one
+  // and no literal's size includes it.
+  //
+  // Consumed here when it is already buffered, and otherwise awaited: it may
+  // arrive in a later segment, and read as a line it is an EMPTY line. On the
+  // SASL path an empty line is a second response and the pipelining guard
+  // fails the exchange for it; on the PUTSCRIPT path it draws a spurious
+  // "empty command line" refusal AFTER the script was accepted, so one command
+  // is answered twice and a client that reads one reply per command spends the
+  // rest of the session attributing each answer to the command before it.
+  //
+  // A peek alone is not enough, because whether the terminator has arrived yet
+  // is a property of the network rather than of the protocol. Shared by both
+  // literal paths: one of them used to do this and the other did not, which is
+  // the entire defect.
+  function _consumeLiteralTerminator(state) {
+    if (state.lineBuffer.length >= 2 &&
+        state.lineBuffer[0] === 0x0d && state.lineBuffer[1] === 0x0a) {          // CR LF
+      state.lineBuffer = state.lineBuffer.subarray(2);
+    } else {
+      state.awaitingLiteralTerminator = true;
+    }
+  }
+
   function _drainBuffer(state, socket) {
     while (true) {
       if (state.pendingLiteral) {
@@ -314,6 +335,7 @@ function create(opts) {
         }
         pl.body = Buffer.concat([pl.body, state.lineBuffer.subarray(0, need)]);
         state.lineBuffer = state.lineBuffer.subarray(need);
+        _consumeLiteralTerminator(state);
         state.pendingLiteral = null;
         _completePutscript(state, socket, pl);
         if (state.stage === "closed") return;
@@ -329,26 +351,7 @@ function create(opts) {
         }
         pa.irBody = Buffer.concat([pa.irBody, state.lineBuffer.subarray(0, needA)]);
         state.lineBuffer = state.lineBuffer.subarray(needA);
-        // The CRLF that ends the line the literal sat on. It was left in the
-        // buffer, so the next pass read it as an empty LINE — harmless while
-        // nothing was in flight, and not harmless during a multi-step SASL
-        // exchange, where an empty line is a second response and the pipelining
-        // guard fails the exchange for it. The bug only appeared when the two
-        // writes arrived as separate TCP segments, which is why the host run
-        // was green and the container run was not.
-        // The CRLF that ends the line the literal sat on. Consumed here when it
-        // is already buffered, and otherwise awaited: it may arrive in a later
-        // segment, and read as a line it is an EMPTY line. That was harmless
-        // while nothing was in flight, and during a multi-step SASL exchange it
-        // is a second response — the pipelining guard fails the exchange for
-        // it. A peek alone is not enough, because whether the terminator has
-        // arrived yet is a property of the network, not of the protocol.
-        if (state.lineBuffer.length >= 2 &&
-            state.lineBuffer[0] === 0x0d && state.lineBuffer[1] === 0x0a) {      // CR LF
-          state.lineBuffer = state.lineBuffer.subarray(2);
-        } else {
-          state.awaitingLiteralTerminator = true;
-        }
+        _consumeLiteralTerminator(state);
         pa.irBytes = null;
         _completeAuthenticate(state, socket);
         if (state.stage === "closed") return;
@@ -625,10 +628,19 @@ function create(opts) {
       mech:    mech,
       irBytes: parsed.literalBytes,
       irPlus:  parsed.literalPlus,
-      irBody:  Buffer.alloc(0),
+      // RFC 5804 §2.1 lets the initial response come inline as a quoted string
+      // instead of a literal. It arrives complete on this line, so there is
+      // nothing to wait for — the exchange runs now, with the response the
+      // client actually sent. This used to fall through to the no-initial-
+      // response branch and answer a conforming client as though it had said
+      // nothing.
+      irBody:  parsed.initialResponse === null || parsed.initialResponse === undefined
+        ? Buffer.alloc(0)
+        : Buffer.from(parsed.initialResponse, "utf8"),
     };
     if (parsed.literalBytes === null) {
-      // No initial-response — call verify with empty client response.
+      // Either an inline initial response, complete above, or none at all —
+      // in which case verify is called with an empty client response.
       _completeAuthenticate(state, socket);
       return;
     }
@@ -987,6 +999,7 @@ function create(opts) {
   // ---- Lifecycle ----------------------------------------------------------
   return mailServerNet.createStoreServer(net, {
     defaultPort:      DEFAULT_PORT,
+    maxConnections:   opts.maxConnections,
     handleConnection: _handleConnection,
     errorClass:       MailServerManageSieveError,
     errorCodePrefix:  "mail-server-managesieve/",

package/lib/mail-server-mx.js

@@ -158,7 +158,6 @@
 var net   = require("node:net");
 var lazyRequire = require("./lazy-require");
 var C         = require("./constants");
-var bCrypto   = require("./crypto");
 var numericBounds = require("./numeric-bounds");
 var safeAsync = require("./safe-async");
 var safeBuffer = require("./safe-buffer");
@@ -328,6 +327,7 @@ function _stripForgedAuthResults(messageBuf, authservId) {
  *   maxMessageBytes:   number,          // default 50 MiB — DATA body cap
  *   maxRcptsPerMessage: number,         // default 100 — per RFC 5321 §4.5.3.1.8
  *   idleTimeoutMs:     number,          // default 5 minutes — RFC 5321 §4.5.3.2.7
+ *   maxConnections:    number,          // default 1024 — listener-wide ceiling
  *   profile:           "strict" | "balanced" | "permissive",  // gate posture cascade
  *   guardEnvelope:     true | {        // optional gate — DATA-phase SPF/DKIM/DMARC/ARC via b.mail.inbound.verify
  *     mode?:          "enforce" | "monitor",   // default: enforce (monitor when profile is permissive)
@@ -365,12 +365,20 @@ function create(opts) {
       "output directly. Cert provisioning lives in b.acme (RFC 8555 + RFC 9773 ARI).");
   }
   numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxLineBytes", "maxMessageBytes", "maxRcptsPerMessage", "idleTimeoutMs"],
+    ["maxLineBytes", "maxMessageBytes", "maxRcptsPerMessage", "idleTimeoutMs", "maxConnections"],
     "mail.server.mx.", MailServerMxError, "mail-server-mx/bad-bound");
-  if (opts.localDomains !== undefined &&
-      (!Array.isArray(opts.localDomains) || opts.localDomains.length === 0)) {
+  // An EMPTY array is accepted and means "this server hosts no domains", which
+  // is a real state — a first boot before the first domain is added — and the
+  // only honest thing to do with it is refuse every recipient. Refusing it at
+  // construction left the operator with one spelling that started a server
+  // (omitting the option), and that spelling used to skip the relay check
+  // entirely, so the only way to get a listener was to get one that accepted
+  // everything. An allowlist that disappears when it is empty is a firewall
+  // rule set that opens when the last rule is deleted.
+  if (opts.localDomains !== undefined && !Array.isArray(opts.localDomains)) {
     throw new MailServerMxError("mail-server-mx/bad-opts",
-      "mail.server.mx.create: localDomains must be a non-empty array if provided");
+      "mail.server.mx.create: localDomains must be an array of domain strings " +
+      "(an empty array means this server hosts no domains and refuses every recipient)");
   }
   if (opts.relayAllowedFor !== undefined && !Array.isArray(opts.relayAllowedFor)) {
     throw new MailServerMxError("mail-server-mx/bad-opts",
@@ -559,15 +567,17 @@ function create(opts) {
   function _handleConnection(socket) {
     // 421 4.7.0 — transient refusal; sender retries elsewhere or later.
     // RFC 5321 §3.8 + §4.5.4.2 (transient negative completion).
-    var remoteAddress = mailServerNet.admitConnection(socket, rateLimit, _emit, {
+    var accepted = mailServerNet.acceptConnection(socket, {
+      rateLimit:    rateLimit,
+      connections:  connections,
+      emit:         _emit,
       refusedEvent: "mail.server.mx.rate_limit_refused",
       refusalLine:  "421 4.7.0 Too many connections from your IP\r\n",
+      idPrefix:     "mxconn-",
     });
-    if (remoteAddress === null) return;
-    socket.once("close", function () { rateLimit.releaseConnection(remoteAddress); });
-
-    var connectionId = "mxconn-" + bCrypto.generateToken(8);                                          // connection-id length
-    connections.add(socket);
+    if (accepted === null) return;
+    var remoteAddress = accepted.remoteAddress;
+    var connectionId  = accepted.connectionId;
 
     // Backpressure observer — `_writeReply` flips `_bpEmitted` after
     // the first audit emission per socket to bound the audit volume.
@@ -597,6 +607,15 @@ function create(opts) {
     // message. Decode to string only for the per-command line parse.
     var lineBuffer = Buffer.alloc(0);
     var bodyCollector = null;
+    // Watches the DATA body for its terminator and the smuggling shape as bytes
+    // arrive, so neither screen re-reads what it has already seen. Lives exactly
+    // as long as bodyCollector.
+    var bodyScanner = null;
+    // The slow-loris byte-rate floor, measured over bounded windows so an early
+    // burst cannot buy credit for a slow tail.
+    var bodyRateWindow = mailServerNet.createBodyRateWindow(rateLimit);
+    // Every byte this connection has received, counted once at the wire funnel.
+    var wireBytes = 0;
     var inDataBody = false;
     // Async command pump: gates (HELO / RBL / greylist / envelope /
     // DMARC) may await DNS or a store, so command handling is async.
@@ -621,10 +640,9 @@ function create(opts) {
       _closeConnection(socket);
     });
 
-    socket.on("close", function () {
-      connClosed = true;
-      connections.delete(socket);
-    });
+    // The set entry and the rate-limit slot are released by trackConnection;
+    // this handler carries only the per-transaction flag the drain reads.
+    socket.on("close", function () { connClosed = true; });
 
     _emit("mail.server.mx.connect", {
       connectionId:  state.id,
@@ -647,6 +665,12 @@ function create(opts) {
     // 421 path. `activeSock` is whichever socket is current (plaintext or
     // TLS) so the 421/close lands on the right transport.
     function _feedChunk(activeSock, chunk) {
+      // Every wire byte, counted once, on the single funnel both the plaintext
+      // and the post-STARTTLS socket feed. The rate window takes its baseline
+      // from this, so the measurement is "bytes since the transfer opened"
+      // rather than "bytes the body parser happened to see" — the distinction
+      // that let the sibling listener's count go flat across a window roll.
+      wireBytes += chunk.length;
       pumpChain = pumpChain.then(function () {
         if (connClosed) return undefined;
         return _ingestBytes(state, activeSock, chunk);
@@ -665,6 +689,27 @@ function create(opts) {
 
     // ---- Byte-level ingestion --------------------------------------------
     async function _ingestBytes(state, socket, chunk) {
+      // The body-rate floor is enforced HERE, on every inbound byte, rather
+      // than inside the DATA handler below. A check reached only from a body
+      // handler is one the peer chooses whether to reach: on the sibling
+      // listener the same floor was skipped first by using BDAT, then by a
+      // zero-length chunk, then by interleaving NOOP, each of which resets the
+      // socket idle timer without passing through a body handler. What a peer
+      // cannot do is hold the connection without sending bytes, and every byte
+      // arrives here.
+      if (inDataBody && bodyRateWindow.starved(wireBytes, Date.now())) {
+        _emit("mail.server.mx.data_refused",
+          { connectionId: state.id, reason: "body-rate-below-floor",
+            minBytesPerSecond: rateLimit.minBytesPerSecond() }, "denied");
+        _writeReply(socket, REPLY_421_SERVICE_NOT_AVAIL,
+          "4.7.0 Message body arriving below the minimum rate; closing connection");
+        _resetTransaction(state);
+        inDataBody = false;
+        bodyCollector = null;
+        bodyScanner = null;
+        _closeConnection(socket);
+        return;
+      }
       if (inDataBody) {
         // DATA body — accumulate via boundedChunkCollector, watch for
         // canonical "\r\n.\r\n" terminator only. Bare-LF dot terminator
@@ -679,13 +724,25 @@ function create(opts) {
           _resetTransaction(state);
           inDataBody = false;
           bodyCollector = null;
+          bodyScanner = null;
           return;
         }
-        var collected = bodyCollector.result();
-        // Smuggling detector — bare LF dot-line in body before the
-        // CRLF dot terminator. Refuse the whole transaction; emit
-        // smuggling-detected audit.
-        if (guardSmtpCommand.detectBodySmuggling(collected)) {
+        // Scanned INCREMENTALLY — only this chunk plus a four-byte overlap.
+        // Re-deriving the whole accumulated body per chunk (`result()` is a
+        // fresh concat of everything received so far) and scanning it twice
+        // made acceptance quadratic in the message size. The byte cap bounds
+        // BYTES, not processor time, so a message well inside maxMessageBytes
+        // still cost 4949 ms at 8 MiB against 143 ms at 1 MiB — and on this
+        // listener that is reachable unauthenticated. `result()` is now called
+        // ONCE, when the terminator is found.
+        //
+        // The slow-loris floor is NOT applied here — it runs at the top of
+        // _ingestBytes, where every inbound byte passes whatever command it
+        // belongs to.
+        var seen = bodyScanner.push(chunk);
+        // Smuggling detector — bare LF dot-line in body before the CRLF dot
+        // terminator. Refuse the whole transaction; emit a smuggling audit.
+        if (seen.smuggling) {
           _emit("mail.server.mx.smtp_smuggling_detected",
             { connectionId: state.id, mailFrom: state.mailFrom, rcptCount: state.rcpts.length },
             "denied");
@@ -694,14 +751,15 @@ function create(opts) {
           _resetTransaction(state);
           inDataBody = false;
           bodyCollector = null;
+          bodyScanner = null;
           return;
         }
         // Canonical \r\n.\r\n terminator?
-        var endIdx = safeSmtp.findDotTerminator(collected);
-        if (endIdx !== -1) {
-          var body = collected.subarray(0, endIdx);
+        if (seen.terminatorAt !== -1) {
+          var body = bodyCollector.result().subarray(0, seen.terminatorAt);
           inDataBody = false;
           bodyCollector = null;
+          bodyScanner = null;
           await _finalizeDataBody(state, socket, body);
         }
         return;
@@ -868,6 +926,7 @@ function create(opts) {
       // shared upgradeSocket helper (b.mail.server.tls.upgradeSocket).
       lineBuffer    = Buffer.alloc(0);
       bodyCollector = null;
+      bodyScanner   = null;
       inDataBody    = false;
       mailServerTls.upgradeSocket({
         plainSocket:   socket,
@@ -1003,17 +1062,21 @@ function create(opts) {
       }
       // Local-domain check — refuse non-local recipients unless the
       // operator explicitly allowed relay for this scope.
-      if (localDomains.length > 0) {
-        if (localDomains.indexOf(rcptDomain) === -1 &&
-            !_isRelayAllowed(state.remoteAddress, rcpt)) {
-          rateLimit.noteRcptFailure(state.remoteAddress);
-          _trackRefusedRcpt(state, rcpt, "relay-denied");
-          _emit("mail.server.mx.relay_refused",
-            { connectionId: state.id, mailFrom: state.mailFrom, rcptTo: rcpt,
-              remoteAddress: state.remoteAddress }, "denied");
-          _writeReply(socket, REPLY_550_MAILBOX_UNAVAIL, "5.7.1 Relaying denied");
-          return;
-        }
+      //
+      // Run UNCONDITIONALLY. This used to sit inside `if (localDomains.length
+      // > 0)`, so a server hosting no domains ran no check at all and accepted
+      // every recipient. An empty hosted set now refuses everything naturally,
+      // which is what an empty allowlist has to mean; `relayAllowedFor` is
+      // still the way to permit a scope deliberately.
+      if (localDomains.indexOf(rcptDomain) === -1 &&
+          !_isRelayAllowed(state.remoteAddress, rcpt)) {
+        rateLimit.noteRcptFailure(state.remoteAddress);
+        _trackRefusedRcpt(state, rcpt, "relay-denied");
+        _emit("mail.server.mx.relay_refused",
+          { connectionId: state.id, mailFrom: state.mailFrom, rcptTo: rcpt,
+            remoteAddress: state.remoteAddress }, "denied");
+        _writeReply(socket, REPLY_550_MAILBOX_UNAVAIL, "5.7.1 Relaying denied");
+        return;
       }
       // RBL gate (b.mail.rbl) — DNS blocklist check on the connecting
       // IP. The verdict is per-connection, so it's evaluated once and
@@ -1131,6 +1194,8 @@ function create(opts) {
         sizeCode:    "mail-server-mx/body-too-large",
         sizeMessage: "DATA body exceeded maxMessageBytes (" + maxMessageBytes + ")",
       });
+      bodyScanner    = safeSmtp.createBodyScanner();
+      bodyRateWindow.start(Date.now(), wireBytes);
     }
 
     async function _finalizeDataBody(state, socket, body) {
@@ -1215,6 +1280,11 @@ function create(opts) {
             dkim:         dkimSummary,
             dmarc:        inboundVerdict.dmarc.result,
             arc:          inboundVerdict.arc && inboundVerdict.arc.chainStatus,
+            // The status alone cannot tell an operator reading the audit
+            // whether a chain failed because a seal was bad or because a
+            // resolver was down — the two want opposite responses.
+            arcReason:    inboundVerdict.arc && inboundVerdict.arc.reason,
+            arcTransient: !!(inboundVerdict.arc && inboundVerdict.arc.transient),
             action:       envAction,
             mode:         envelopeGate.mode,
           }, (envAction === "reject" || envAction === "defer") ? "denied" : "success");
@@ -1257,6 +1327,16 @@ function create(opts) {
             spf:        inboundVerdict.spf,
             dkim:       inboundVerdict.dkim,
             dmarc:      inboundVerdict.dmarc,
+            // The ARC chain sits beside the other three because it was
+            // computed with them. It used to reach the delivered message as an
+            // `arc=` token and the audit event as a status, and stop there —
+            // so a consumer wanting to act on it re-parsed a header the
+            // pipeline had just written. The header is also lossier than the
+            // verdict: RFC 8601 has one `arc=fail` token, while the verdict
+            // separates a chain that is structurally incomplete from one whose
+            // seal did not verify, and only the second says anything about the
+            // sender.
+            arc:        inboundVerdict.arc,
             from:       inboundVerdict.from,
             action:     envAction,
             mode:       envelopeGate.mode,
@@ -1370,6 +1450,7 @@ function create(opts) {
   // explicit 0 (only an OMITTED port falls back to the default).
   var _tcpListener = mailServerNet.createTcpListener(net, {
     defaultPort:      25,                                                                             // SMTP MX port (IANA)
+    maxConnections:   opts.maxConnections,
     handleConnection: _handleConnection,
     errorFactory:     function (code, message) { return new MailServerMxError("mail-server-mx/" + code, message); },
     emit:             _emit,

package/lib/mail-server-net.js

@@ -3,6 +3,7 @@
 "use strict";
 
 var codepointClass = require("./codepoint-class");
+var bCrypto        = require("./crypto");
 
 // mail-server-net — the TCP-listener lifecycle shared by the mailbox / transfer
 // servers (b.mail.server.imap / pop3 / mx / managesieve / submission). Each of
@@ -16,6 +17,14 @@ var codepointClass = require("./codepoint-class");
 // EACCES) rejects the listen promise instead of crashing the process. That, plus
 // the listening/server state, is what createTcpListener owns.
 
+// The listener's own ceiling when an operator names none. Every mail listener
+// shares it, so a deployment that raises or lowers it does so in one place and
+// the five listeners cannot drift apart on what "too many" means. Set well
+// above any single-host mail deployment's working set and far below what an
+// unbounded accept loop will take: the point is that a ceiling EXISTS, since
+// the per-address cap alone leaves the total at (cap x source addresses).
+var DEFAULT_MAX_CONNECTIONS = 1024;
+
 // createTcpListener(net, cfg) — build a listener lifecycle.
 //   cfg.defaultPort      port used when listenOpts.port is omitted (an explicit
 //                        0 is honored, for an ephemeral test bind).
@@ -26,6 +35,15 @@ var codepointClass = require("./codepoint-class");
 //   cfg.listeningEvent   the "...listening" audit action.
 //   cfg.listeningExtra   optional () => object merged onto the listening event
 //                        payload (Submission reports implicitTls).
+//   cfg.maxConnections   the listener's own ceiling on concurrently accepted
+//                        sockets. The per-address cap in b.mail.server.rateLimit
+//                        bounds ONE peer; it says nothing about how many peers
+//                        there are, so the process-wide total was the per-address
+//                        cap times however many source addresses the caller could
+//                        speak from — a number a botnet, a NAT pool or a single
+//                        v6 /64 makes large. Enforced by the runtime, which closes
+//                        the excess socket before handleConnection ever sees it,
+//                        so a refusal costs no descriptor and no state machine.
 // Returns { listen, getServer, isListening, markClosed } — the server wires its
 // own close() through getServer()/isListening()/markClosed().
 function createTcpListener(net, cfg) {
@@ -40,6 +58,7 @@ function createTcpListener(net, cfg) {
     var port = listenOpts.port === undefined ? cfg.defaultPort : listenOpts.port;
     var address = listenOpts.address || "0.0.0.0";
     server = net.createServer(function (socket) { cfg.handleConnection(socket); });
+    server.maxConnections = cfg.maxConnections || DEFAULT_MAX_CONNECTIONS;
     return new Promise(function (resolve, reject) {
       server.once("error", reject);
       server.listen(port, address, function () {
@@ -110,6 +129,7 @@ function createStoreServer(net, cfg) {
   var ErrorClass = cfg.errorClass;
   var listener = createTcpListener(net, {
     defaultPort:      cfg.defaultPort,
+    maxConnections:   cfg.maxConnections,
     handleConnection: cfg.handleConnection,
     errorFactory:     function (code, message) { return new ErrorClass(cfg.errorCodePrefix + code, message); },
     emit:             cfg.emit,
@@ -122,7 +142,137 @@ function createStoreServer(net, cfg) {
       closedEvent: cfg.eventBase + ".closed",
     });
   }
-  return { listen: listener.listen, close: close };
+  return {
+    listen:          listener.listen,
+    close:           close,
+    connectionCount: function () { return cfg.connections.size; },
+  };
+}
+
+// trackConnection(socket, cfg) — the other half of admitConnection, and the
+// reason it is here rather than written out per listener.
+//
+// A connection occupies two ledgers: the rate limiter's per-address count, and
+// the listener's live-socket set that shutdown drains. Both are released by the
+// SAME event — the socket closing — and it does not matter who closed it. Five
+// listeners each wrote that pairing by hand and one of them registered only the
+// release, so a peer that opened a connection, took the greeting and dropped TCP
+// freed its rate-limit slot (and could reconnect at once) while its set entry
+// stayed forever. Nothing authenticates before that point, so the growth was
+// unauthenticated and unbounded.
+//
+// Registering both in one handler is what makes the pair impossible to
+// half-write.
+//   cfg.connections    the listener's live-socket Set.
+//   cfg.rateLimit      the resolved b.mail.server.rateLimit.
+//   cfg.remoteAddress  the address admitConnection returned.
+//   cfg.closeSource    optional socket whose "close" drives teardown, when the
+//                      tracked socket is a wrapper (Submission's implicit-TLS
+//                      path tracks the TLSSocket but the raw socket is the one
+//                      that carries the FIN).
+function trackConnection(socket, cfg) {
+  cfg.connections.add(socket);
+  var source = cfg.closeSource || socket;
+  source.once("close", function () {
+    cfg.rateLimit.releaseConnection(cfg.remoteAddress);
+    cfg.connections.delete(socket);
+  });
+}
+
+// createBodyRateWindow(rateLimit) — the body-rate floor, measured over BOUNDED
+// windows instead of the whole transfer.
+//
+// A lifetime average lets an early burst pay for an arbitrarily slow tail: at
+// the default 100 B/s an 8 MiB burst buys about a day of credit and 50 MiB buys
+// six, which a peer spends holding a connection and its slot in the per-address
+// cap while sending a byte at a time. The floor was enforced and still
+// bypassable, which is the worse of the two states — it reads as covered.
+//
+// Each window has to meet the floor on its own, so nothing sent earlier pays
+// for what is sent now. A window only rolls forward once it has run long enough
+// to be a real judgement; inside that stretch no verdict is reached, so a
+// sender pausing to read from its own spool is not cut off for the pause, and a
+// fast chunk cannot keep resetting the clock to dodge the next measurement.
+//
+// `now` is a parameter rather than a call to the clock so the whole thing can
+// be driven across days of simulated time without waiting for them.
+//   rateLimit  the resolved b.mail.server.rateLimit (owns the floor + grace).
+function createBodyRateWindow(rateLimit) {
+  var windowStart = 0;
+  var windowBytes = 0;
+  return {
+    // Open the first window. `bytesSeen` is the caller's running total AT THIS
+    // MOMENT, which becomes the baseline every later reading is measured
+    // against — so the caller is free to keep one connection-lifetime counter
+    // incremented at the wire boundary rather than a per-transfer one. That
+    // matters where a listener re-feeds part of a chunk through its own parser:
+    // a counter maintained inside the parser credits those bytes twice, and a
+    // peer that pipelines a one-byte payload with the next command gets roughly
+    // double the rate it is actually sending.
+    start: function (now, bytesSeen) {
+      windowStart = now;
+      windowBytes = bytesSeen || 0;
+    },
+    // `bytesSeen` is the running total for the whole body; the window's own
+    // count is derived, so the caller keeps one counter rather than two.
+    starved: function (bytesSeen, now) {
+      var elapsed = now - windowStart;
+      if (rateLimit.bodyRateStarved(bytesSeen - windowBytes, elapsed)) return true;
+      // The limiter says how long a window must run before rolling, because the
+      // limiter is what decides when a measurement is old enough to mean
+      // something. Rolling on a number held HERE would ask a limiter that
+      // judges over a longer stretch only ever before it can answer: every call
+      // returning "too early", the window resetting underneath it, and its rate
+      // protection silently disabled while looking wired.
+      if (elapsed >= rateLimit.bodyRateWindowMs()) {
+        windowStart = now;
+        windowBytes = bytesSeen;
+      }
+      return false;
+    },
+  };
+}
+
+// acceptConnection(rawSocket, cfg) — everything a listener does between the TCP
+// accept and its own state machine: gate the address, mint the connection id,
+// wrap the socket if the protocol starts in TLS, and enter both ledgers.
+//
+// Every listener performed these four steps in the same order, and the parts
+// that differ between them are three strings and an optional wrap. Keeping the
+// order in one place is what stops a fifth listener from being written with one
+// of the steps missing, which is how the tracking-set entry and the rate-limit
+// slot came apart in the first place.
+//
+// Returns null when the address was refused — the caller returns immediately;
+// the refusal line and teardown are already done.
+//   cfg.rateLimit      the resolved b.mail.server.rateLimit.
+//   cfg.connections    the listener's live-socket Set.
+//   cfg.emit           the listener's audit emitter.
+//   cfg.refusedEvent   the "<...>.rate_limit_refused" audit action.
+//   cfg.refusalLine    the protocol's refusal bytes.
+//   cfg.idPrefix       "imapconn-" / "mxconn-" / … prefix for the connection id.
+//   cfg.wrap           optional (rawSocket) => socket, for a protocol that
+//                      starts inside TLS. The RAW socket still drives teardown:
+//                      a handshake that never completes closes it without the
+//                      wrapper ever being established.
+function acceptConnection(rawSocket, cfg) {
+  var remoteAddress = admitConnection(rawSocket, cfg.rateLimit, cfg.emit, {
+    refusedEvent: cfg.refusedEvent,
+    refusalLine:  cfg.refusalLine,
+  });
+  if (remoteAddress === null) return null;
+  var socket = cfg.wrap ? cfg.wrap(rawSocket) : rawSocket;
+  trackConnection(socket, {
+    connections:   cfg.connections,
+    rateLimit:     cfg.rateLimit,
+    remoteAddress: remoteAddress,
+    closeSource:   socket === rawSocket ? null : rawSocket,
+  });
+  return {
+    socket:        socket,
+    remoteAddress: remoteAddress,
+    connectionId:  cfg.idPrefix + bCrypto.generateToken(8),                                           // connection-id length
+  };
 }
 
 // admitConnection(socket, rateLimit, emit, cfg) — the per-connection rate-limit
@@ -299,6 +449,10 @@ module.exports = {
   runSaslStep:       runSaslStep,
   createStoreServer: createStoreServer,
   admitConnection:   admitConnection,
+  trackConnection:   trackConnection,
+  acceptConnection:  acceptConnection,
+  createBodyRateWindow: createBodyRateWindow,
+  DEFAULT_MAX_CONNECTIONS: DEFAULT_MAX_CONNECTIONS,
   validateDomainHardened: validateDomainHardened,
   saslChallengeOrNull: saslChallengeOrNull,
   replyTextOrFallback:  replyTextOrFallback,