@blamejs/core 0.18.54 → 0.18.56

package/lib/mail-server-managesieve.js

@@ -133,7 +133,6 @@ var safeBuffer = require("./safe-buffer");
 var mailServerTls = require("./mail-server-tls");
 var mailServerNet = require("./mail-server-net");
 var C = require("./constants");
-var bCrypto = require("./crypto");
 var numericBounds = require("./numeric-bounds");
 var validateOpts = require("./validate-opts");
 var guardManageSieveCommand = require("./guard-managesieve-command");
@@ -172,6 +171,7 @@ var ERR_CLAMP                = 200;
  *   greeting:          string,                               // default "blamejs ManageSieve"
  *   maxLineBytes:      number,                               // default 8192
  *   idleTimeoutMs:     number,                               // default 5 min
+ *   maxConnections:    number,                               // default 1024 — listener-wide ceiling
  *   profile:           "strict" | "balanced" | "permissive", // default "strict"
  *   auth: {
  *     mechanisms:      ["SCRAM-SHA-256", "OAUTHBEARER", ...], // SASL mechs to advertise
@@ -212,7 +212,7 @@ function create(opts) {
       "operator-supplied backend)");
   }
   numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxLineBytes", "idleTimeoutMs"],
+    ["maxLineBytes", "idleTimeoutMs", "maxConnections"],
     "mail.server.managesieve.", MailServerManageSieveError, "mail-server-managesieve/bad-bound");
 
   var greeting       = opts.greeting       || DEFAULT_GREETING_VENDOR;
@@ -222,7 +222,16 @@ function create(opts) {
   var authConfig     = opts.auth           || null;
   var mailStore      = opts.mailStore;
   var allowPlaintext = opts.allowPlaintext === true;
-  var tlsContext     = opts.tlsContext     || null;
+
+  // Read at the point of use, never captured. A consumer wiring the watching
+  // loader from mail.server.tls.context installs an accessor on this option, and
+  // capturing it here would call that accessor exactly once and freeze whatever
+  // certificate was current at boot — for a listener whose siblings all rotate.
+  // Certificates renew every 60 to 90 days on any automated CA, so the frozen
+  // one expires while the operator's evidence says rotation is working: the
+  // watcher fired, the context rebuilt, and it simply never reached here. The
+  // four sibling listeners already read the option per connection.
+  function _tlsContext() { return opts.tlsContext || null; }
 
   // safeSieve cap matches the guard's per-profile script cap (the
   // guard caps the literal-byte announcement; safeSieve.parse caps
@@ -236,22 +245,18 @@ function create(opts) {
   var _emit = auditEmit.emit;
 
   function _handleConnection(rawSocket) {
-    var remoteAddress = mailServerNet.admitConnection(rawSocket, rateLimit, _emit, {
+    var accepted = mailServerNet.acceptConnection(rawSocket, {
+      rateLimit:    rateLimit,
+      connections:  connections,
+      emit:         _emit,
       refusedEvent: "mail.server.managesieve.rate_limit_refused",
       refusalLine:  'NO "Too many connections from your IP"\r\n',
+      idPrefix:     "msvconn-",
     });
-    if (remoteAddress === null) return;
-    var connectionId = "msvconn-" + bCrypto.generateToken(8);                                            // connection-id length
-    var socket = rawSocket;
-    connections.add(socket);
-    // Single close handler covers BOTH operator-driven `_close(socket)`
-    // and client-initiated disconnects (TCP FIN / RST). Releases the
-    // rate-limit slot AND removes the socket from the tracking set so
-    // long-lived deployments don't accumulate stale entries.
-    rawSocket.once("close", function () {
-      rateLimit.releaseConnection(remoteAddress);
-      connections.delete(socket);
-    });
+    if (accepted === null) return;
+    var remoteAddress = accepted.remoteAddress;
+    var connectionId  = accepted.connectionId;
+    var socket        = accepted.socket;
 
     var state = {
       id:              connectionId,
@@ -284,7 +289,7 @@ function create(opts) {
     _emitCapabilityBanner(state, socket);
     _writeOk(socket, greeting + " ready");
 
-    if (allowPlaintext && !tlsContext) {
+    if (allowPlaintext && !_tlsContext()) {
       _emit("mail.server.managesieve.plaintext_warning",
         { connectionId: connectionId,
           remark: "allowPlaintext=true; no STARTTLS available — operators MUST gate at network layer" },
@@ -302,6 +307,31 @@ function create(opts) {
   // AUTHENTICATE with a non-synchronizing initial-response), the next
   // N bytes are the literal-payload; accumulate them before resuming
   // line-mode dispatch.
+  // The CRLF that ends the LINE a literal sat on. RFC 5804 §4 puts it after
+  // the payload, outside the declared octet count, so every literal owes one
+  // and no literal's size includes it.
+  //
+  // Consumed here when it is already buffered, and otherwise awaited: it may
+  // arrive in a later segment, and read as a line it is an EMPTY line. On the
+  // SASL path an empty line is a second response and the pipelining guard
+  // fails the exchange for it; on the PUTSCRIPT path it draws a spurious
+  // "empty command line" refusal AFTER the script was accepted, so one command
+  // is answered twice and a client that reads one reply per command spends the
+  // rest of the session attributing each answer to the command before it.
+  //
+  // A peek alone is not enough, because whether the terminator has arrived yet
+  // is a property of the network rather than of the protocol. Shared by both
+  // literal paths: one of them used to do this and the other did not, which is
+  // the entire defect.
+  function _consumeLiteralTerminator(state) {
+    if (state.lineBuffer.length >= 2 &&
+        state.lineBuffer[0] === 0x0d && state.lineBuffer[1] === 0x0a) {          // CR LF
+      state.lineBuffer = state.lineBuffer.subarray(2);
+    } else {
+      state.awaitingLiteralTerminator = true;
+    }
+  }
+
   function _drainBuffer(state, socket) {
     while (true) {
       if (state.pendingLiteral) {
@@ -314,6 +344,7 @@ function create(opts) {
         }
         pl.body = Buffer.concat([pl.body, state.lineBuffer.subarray(0, need)]);
         state.lineBuffer = state.lineBuffer.subarray(need);
+        _consumeLiteralTerminator(state);
         state.pendingLiteral = null;
         _completePutscript(state, socket, pl);
         if (state.stage === "closed") return;
@@ -329,26 +360,7 @@ function create(opts) {
         }
         pa.irBody = Buffer.concat([pa.irBody, state.lineBuffer.subarray(0, needA)]);
         state.lineBuffer = state.lineBuffer.subarray(needA);
-        // The CRLF that ends the line the literal sat on. It was left in the
-        // buffer, so the next pass read it as an empty LINE — harmless while
-        // nothing was in flight, and not harmless during a multi-step SASL
-        // exchange, where an empty line is a second response and the pipelining
-        // guard fails the exchange for it. The bug only appeared when the two
-        // writes arrived as separate TCP segments, which is why the host run
-        // was green and the container run was not.
-        // The CRLF that ends the line the literal sat on. Consumed here when it
-        // is already buffered, and otherwise awaited: it may arrive in a later
-        // segment, and read as a line it is an EMPTY line. That was harmless
-        // while nothing was in flight, and during a multi-step SASL exchange it
-        // is a second response — the pipelining guard fails the exchange for
-        // it. A peek alone is not enough, because whether the terminator has
-        // arrived yet is a property of the network, not of the protocol.
-        if (state.lineBuffer.length >= 2 &&
-            state.lineBuffer[0] === 0x0d && state.lineBuffer[1] === 0x0a) {      // CR LF
-          state.lineBuffer = state.lineBuffer.subarray(2);
-        } else {
-          state.awaitingLiteralTerminator = true;
-        }
+        _consumeLiteralTerminator(state);
         pa.irBytes = null;
         _completeAuthenticate(state, socket);
         if (state.stage === "closed") return;
@@ -508,7 +520,7 @@ function create(opts) {
     } else {
       socket.write('"SASL" ""\r\n');
     }
-    if (!state.tls && tlsContext) {
+    if (!state.tls && _tlsContext()) {
       socket.write('"STARTTLS"\r\n');
     }
   }
@@ -536,7 +548,8 @@ function create(opts) {
       _writeNo(socket, "STARTTLS only valid pre-AUTH (RFC 5804 §2.2)");
       return;
     }
-    if (!tlsContext) {
+    var startTlsContext = _tlsContext();
+    if (!startTlsContext) {
       _writeNo(socket, "STARTTLS unavailable (listener configured with allowPlaintext=true and no tlsContext)");
       return;
     }
@@ -549,7 +562,7 @@ function create(opts) {
     mailServerTls.upgradeLineProtocol({
       state:         state,
       socket:        socket,
-      secureContext: tlsContext,
+      secureContext: startTlsContext,
       idleTimeoutMs: idleTimeoutMs,
       clearFields:   ["pendingLiteral", "pendingAuth"],
       drain:         _drainBuffer,
@@ -625,10 +638,19 @@ function create(opts) {
       mech:    mech,
       irBytes: parsed.literalBytes,
       irPlus:  parsed.literalPlus,
-      irBody:  Buffer.alloc(0),
+      // RFC 5804 §2.1 lets the initial response come inline as a quoted string
+      // instead of a literal. It arrives complete on this line, so there is
+      // nothing to wait for — the exchange runs now, with the response the
+      // client actually sent. This used to fall through to the no-initial-
+      // response branch and answer a conforming client as though it had said
+      // nothing.
+      irBody:  parsed.initialResponse === null || parsed.initialResponse === undefined
+        ? Buffer.alloc(0)
+        : Buffer.from(parsed.initialResponse, "utf8"),
     };
     if (parsed.literalBytes === null) {
-      // No initial-response — call verify with empty client response.
+      // Either an inline initial response, complete above, or none at all —
+      // in which case verify is called with an empty client response.
       _completeAuthenticate(state, socket);
       return;
     }
@@ -987,6 +1009,7 @@ function create(opts) {
   // ---- Lifecycle ----------------------------------------------------------
   return mailServerNet.createStoreServer(net, {
     defaultPort:      DEFAULT_PORT,
+    maxConnections:   opts.maxConnections,
     handleConnection: _handleConnection,
     errorClass:       MailServerManageSieveError,
     errorCodePrefix:  "mail-server-managesieve/",