@blamejs/core 0.7.39 → 0.7.40

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.7.x
 
+- **0.7.40** (2026-05-05) — RFC 8617 ARC chain-validity hardening: duplicate-instance refusal, gap detection, hop ceiling, per-hop `cv=` rule enforcement. Closes a class of chain-injection holes the prior `arcVerify` would silently accept. **Duplicate instance** — two `ARC-Seal` (or AMS / AAR) headers at the same `i=N` now fail with `reason: "duplicate-instance"` instead of silently letting the second header overwrite the first signer's record (the latter is a known forwarder-injection attack). **Non-contiguous chain** — gap detection (`i=1, i=3` with no `i=2`) now correctly fails with `reason: "incomplete-or-non-contiguous"`. The prior `.some()` check skipped sparse-array empty slots and let the gap through. **Hop ceiling** — RFC 8617 §5.1.2 caps the chain at 50 sets; verifier now refuses with `reason: "too-many-hops"`. **Per-hop `cv=` rules** — i=1 MUST be `cv=none` (no upstream chain to validate); i≥2 MUST be `cv=pass` or `cv=fail` (cv=none invalid past hop 1); a downstream `cv=pass` after an upstream `cv=fail` is invalid (a hop can't claim chain-pass when an earlier hop saw it fail). Each violation surfaces with a structured `reason` field. **Result shape gains** `perHopCv: [string|null,...]` (one entry per hop) and `reason: string` when `chainStatus === "fail"` so operators can distinguish "signature failed" from "chain rules violated" without parsing free-text errors. Smoke 8642 → 8648 / wiki e2e 178 / Linux container smoke 8648 / Linux container wiki e2e 178 / eslint clean / api-snapshot baseline refreshed.
+
 - **0.7.39** (2026-05-05) — RFC 8954 OCSP nonce extension default-on, plus persistent-log reliability fix in the smoke runner. **`b.network.tls.ocsp.buildRequest(opts)`** (NEW) — constructs a DER-encoded OCSPRequest for a single (`leafCertDer`, `issuerCertDer`) pair. The RFC 8954 nonce extension is **on by default** (security-defaults-on rule); operators talking to responders that ignore nonces opt out via `nonce: false`. Default nonce length is 16 bytes (RFC 8954 §2.1 floor 1, ceiling 32 — `nonceLen` overrides). CertID hashes are SHA-1 per RFC 6960 §4.1.1 (the universally-supported algorithm; SHA-256 in OCSP requests is §4.3 optional and many responders reject). Returns `{ requestDer, nonce }`. Operators send `requestDer` to the OCSP responder URL via `b.httpClient` (Content-Type: `application/ocsp-request`) and pass the returned `nonce` Buffer to `evaluate(responseDer, { issuerPem, expectedNonce })` — defends against replay attacks where an attacker captures a "good" OCSP response and replays it after the cert is revoked. **DER writer surface added to `lib/asn1-der.js`** — `writeNode` / `writeSequence` / `writeOctetString` / `writeInteger` / `writeNull` / `writeOid` / `writeContextExplicit` (minimal, ~80 lines, X.690 short + long-form length encoding). **`evaluate(der, opts)` accepts `expectedNonce`** — when supplied, the response's nonce extension MUST match (else `tls/ocsp-nonce-mismatch`). Result shape gains a `nonce` field: `"matched"` / `"present-not-checked"` / `"n/a"`. **Smoke-runner persistent log reliability fix** — the `.test-output/smoke.log` tee was using `fs.createWriteStream` (async); when the runner threw on a test failure the buffer didn't flush before `process.exit`, so the failure detail never reached the log. Replaced with synchronous `fs.writeSync` against an open fd — every byte hits disk before exit. Surface change for diagnosing future failures: the log now ALWAYS captures the failure stack instead of truncating mid-run. Smoke 8635 → 8642 / wiki e2e 178 / Linux container smoke 8642 / Linux container wiki e2e 178 / eslint clean / api-snapshot baseline refreshed.
 
 - **0.7.38** (2026-05-05) — RFC 6698 + RFC 7672 DANE certificate-chain verification, plus smoke-runner LPT scheduling and a wiki failure-detail bugfix. **`b.network.smtp.dane.verifyChain(certChain, tlsaRecords, opts?)`** (NEW) — walks the peer cert chain (leaf-first DER buffers — typically `sock.getPeerCertificate(true).raw`) and confirms at least one TLSA record matches per the record's usage / selector / mtype. SMTP outbound (RFC 7672) only honors `DANE-TA` (2) and `DANE-EE` (3); `PKIX-TA` (0) and `PKIX-EE` (1) require a full PKIX path validator + CA-bundle and are refused unless the operator opts in via `allowPkixModes`. Selector `Cert` (0) compares the full DER; selector `SPKI` (1) compares the SubjectPublicKeyInfo bytes (extracted via the framework ASN.1 walker). Matching types: `Full`, sha-two-family at the short-digest length, sha-two-family at the long-digest length. Returns `{ ok, matches: [{ tlsaIndex, certIndex, usage, mtype }], errors }`. **ASN.1 walker** — `lib/asn1-der.js` `readNode` now surfaces a `.raw` field on each node (header + value bytes from the source buffer) so SPKI extraction can return the exact wire bytes for byte-identical TLSA matching. **Smoke-runner LPT scheduling** — `test/smoke.js` parallel mode now uses Longest-Processing-Time-first scheduling with a continuous worker queue. Per-test durations persist under `.test-output/smoke-timings.json` keyed by `process.platform` (so host win32/darwin and Linux container don't pollute each other's medians) with a 5-run history per test. Replaces the prior batched `Promise.all(slice(i, i + PARALLEL))` scheduling that left workers idle when one batch contained the long-tail test. **Wiki failure-detail bugfix** — `examples/wiki/test/e2e.js` was printing the per-example failure list AFTER the assert that throws on failure → operators only saw "1 of 178 failed" without WHICH example. Reordered so failure detail prints first. Smoke 8627 → 8635 / wiki e2e 178 / Linux container smoke 8635 / Linux container wiki e2e 178 / eslint clean / api-snapshot baseline refreshed.

package/lib/mail-auth.js

@@ -376,6 +376,10 @@ function _parseHeaderLines(headerSection) {
   return unfolded;
 }
 
+// RFC 8617 §5.1.2 caps the chain at 50 sets to bound verifier work and
+// limit how far an attacker can push junk headers.
+var ARC_MAX_HOPS = 50;                                                           // allow:raw-byte-literal — RFC 8617 §5.1.2 chain ceiling
+
 async function arcVerify(rfc822, opts) {
   if (typeof rfc822 !== "string" || rfc822.length === 0) {
     throw new MailAuthError("mail-auth/arc-bad-input",
@@ -384,8 +388,16 @@ async function arcVerify(rfc822, opts) {
   opts = opts || {};
   var headers = _parseHeaderLines(_splitHeaders(rfc822));
   var hops = [];
-
-  // 1. Index ARC headers by instance number.
+  var seenSlot = {};                                                             // {`<instance>:<name>`: true} — duplicate detection
+
+  // 1. Index ARC headers by instance number. Refuse duplicates: a single
+  //    hop has exactly one ARC-Seal / ARC-Message-Signature /
+  //    ARC-Authentication-Results. A second copy at the same instance is
+  //    a malformed chain (per RFC 8617 §5.1 implicit, and a known
+  //    injection vector — a forwarder that re-signs with a duplicate
+  //    instance would silently overwrite the original signer).
+  var duplicate = false;
+  var maxInstanceSeen = 0;
   for (var i = 0; i < headers.length; i += 1) {
     var line = headers[i];
     var colonAt = line.indexOf(":");
@@ -396,7 +408,11 @@ async function arcVerify(rfc822, opts) {
         name !== "arc-authentication-results") continue;
     var iMatch = value.match(/(?:^|[;,\s])i=(\d+)/);                             // allow:regex-no-length-cap — header bounded by RFC 5322 998
     var inst = iMatch ? parseInt(iMatch[1], 10) : null;
-    if (inst === null) continue;
+    if (inst === null || !isFinite(inst) || inst < 1) continue;
+    if (inst > maxInstanceSeen) maxInstanceSeen = inst;
+    var slotKey = inst + ":" + name;
+    if (seenSlot[slotKey]) { duplicate = true; continue; }
+    seenSlot[slotKey] = true;
     if (!hops[inst - 1]) hops[inst - 1] = { instance: inst };
     hops[inst - 1][name] = value;
   }
@@ -405,14 +421,48 @@ async function arcVerify(rfc822, opts) {
     return { chainStatus: "none", hopCount: 0, hops: [] };
   }
 
-  // 2. Structural check — every hop must carry all three headers.
-  var structuralFail = hops.some(function (h) {
-    return !h || !h["arc-seal"] || !h["arc-message-signature"] ||
-           !h["arc-authentication-results"];
-  });
+  if (duplicate) {
+    return {
+      chainStatus: "fail",
+      reason:      "duplicate-instance",
+      hopCount:    hops.filter(Boolean).length,
+      hops: hops.filter(Boolean).map(function (h) {
+        return { instance: h.instance,
+                 hasSeal: !!h["arc-seal"],
+                 hasMessageSignature: !!h["arc-message-signature"],
+                 hasAuthenticationResults: !!h["arc-authentication-results"],
+                 amsResult: "skipped", asResult: "skipped" };
+      }),
+    };
+  }
+
+  if (maxInstanceSeen > ARC_MAX_HOPS) {
+    return {
+      chainStatus: "fail",
+      reason:      "too-many-hops",
+      hopCount:    maxInstanceSeen,
+      hops:        [],
+    };
+  }
+
+  // 2. Structural check — every hop must carry all three headers AND
+  //    the chain must start at i=1 with no gaps. RFC 8617 §5.1 requires
+  //    instances to form a contiguous 1..N sequence. Indexed loop (not
+  //    .some) because sparse arrays skip empty slots in callbacks —
+  //    a non-contiguous chain ([hop1, , hop3]) would silently pass.
+  var structuralFail = false;
+  for (var sci = 0; sci < hops.length; sci += 1) {
+    var sch = hops[sci];
+    if (!sch || !sch["arc-seal"] || !sch["arc-message-signature"] ||
+        !sch["arc-authentication-results"]) {
+      structuralFail = true;
+      break;
+    }
+  }
   if (structuralFail) {
     return {
       chainStatus: "fail",
+      reason:      "incomplete-or-non-contiguous",
       hopCount:    hops.filter(Boolean).length,
       hops: hops.filter(Boolean).map(function (h) {
         return { instance: h.instance,
@@ -454,23 +504,73 @@ async function arcVerify(rfc822, opts) {
     if (amsResult.result !== "pass" || asResult.result !== "pass") anyFail = true;
   }
 
-  // 4. Chain Validation per §5.2: the most recent AS's cv= must
-  //    reflect the validity of every prior hop.
-  var lastAs = hops[hops.length - 1]["arc-seal"];
-  var cvMatch = lastAs.match(/(?:^|[;,\s])cv=(none|pass|fail)/);
-  var cv = cvMatch ? cvMatch[1] : null;
+  // 4. Chain Validation per RFC 8617 §5.2.
+  //
+  //    Per-hop cv= self-attestation rules:
+  //      i=1   — cv=none REQUIRED (no upstream chain to validate)
+  //      i>=2  — cv=pass or cv=fail; cv=none is invalid at i>=2
+  //
+  //    Once any hop's AS reports cv=fail, the chain is permanently
+  //    broken — downstream cv=pass claims after an upstream cv=fail
+  //    are malformed (a hop can't claim the chain validates when it
+  //    knows an earlier hop saw it fail).
+  var perHopCv = [];
+  var hopRuleViolation = null;
+  var sawFail = false;
+  for (var hi = 0; hi < hops.length; hi += 1) {
+    var as = hops[hi]["arc-seal"];
+    var hopCvMatch = as.match(/(?:^|[;,\s])cv=(none|pass|fail)/);
+    var hopCv = hopCvMatch ? hopCvMatch[1] : null;
+    perHopCv.push(hopCv);
+    if (hopCv === null) {
+      hopRuleViolation = "missing-cv-at-i=" + (hi + 1);
+      break;
+    }
+    if (hi === 0 && hopCv !== "none") {
+      hopRuleViolation = "i=1-cv-must-be-none-got-" + hopCv;
+      break;
+    }
+    if (hi >= 1 && hopCv === "none") {
+      hopRuleViolation = "i=" + (hi + 1) + "-cv=none-invalid-after-hop-1";
+      break;
+    }
+    if (hopCv === "fail") sawFail = true;
+    if (hopCv === "pass" && sawFail) {
+      hopRuleViolation = "i=" + (hi + 1) + "-cv=pass-after-upstream-fail";
+      break;
+    }
+  }
 
-  var chainStatus = anyFail ? "fail" :
-                    (hops.length === 1 && cv === "none") ? "pass" :
-                    (hops.length > 1 && cv === "pass")   ? "pass" :
-                    "fail";
+  var lastCv = perHopCv[perHopCv.length - 1];
+  var chainStatus;
+  var reasonOut = null;
+  if (hopRuleViolation) {
+    chainStatus = "fail";
+    reasonOut = hopRuleViolation;
+  } else if (anyFail) {
+    chainStatus = "fail";
+    reasonOut = "signature-verification-failed";
+  } else if (lastCv === "fail") {
+    chainStatus = "fail";
+    reasonOut = "last-as-cv=fail";
+  } else if (hops.length === 1 && lastCv === "none") {
+    chainStatus = "pass";
+  } else if (hops.length > 1 && lastCv === "pass") {
+    chainStatus = "pass";
+  } else {
+    chainStatus = "fail";
+    reasonOut = "unexpected-cv-state";
+  }
 
-  return {
+  var out = {
     chainStatus: chainStatus,
     hopCount:    hops.length,
-    cv:          cv,
+    cv:          lastCv,
+    perHopCv:    perHopCv,
     hops:        perHop,
   };
+  if (reasonOut) out.reason = reasonOut;
+  return out;
 }
 
 // Verify a single AMS or AS within the chain by reconstructing the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.7.39",
+  "version": "0.7.40",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cyclonedx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3c8db39e-745e-4810-ae2a-7b527c808492",
+  "serialNumber": "urn:uuid:bd5fd6e1-f474-44da-9714-adb6fbf43b34",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-05T19:17:04.824Z",
+    "timestamp": "2026-05-05T19:17:14.991Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.7.39",
+      "bom-ref": "@blamejs/core@0.7.40",
       "type": "library",
       "name": "blamejs",
-      "version": "0.7.39",
+      "version": "0.7.40",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.7.39",
+      "purl": "pkg:npm/%40blamejs/core@0.7.40",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.7.39",
+      "ref": "@blamejs/core@0.7.40",
       "dependsOn": []
     }
   ]