@blamejs/core 0.9.49 → 0.10.2

package/lib/mail-server-mx.js

@@ -116,7 +116,6 @@
  */
 
 var net   = require("node:net");
-var nodeTls   = require("node:tls");
 var lazyRequire = require("./lazy-require");
 var C         = require("./constants");
 var bCrypto   = require("./crypto");
@@ -128,6 +127,7 @@ var validateOpts = require("./validate-opts");
 var guardSmtpCommand = require("./guard-smtp-command");
 var guardDomain = require("./guard-domain");
 var mailServerRateLimit = require("./mail-server-rate-limit");
+var mailServerTls = require("./mail-server-tls");
 var { defineClass } = require("./framework-error");
 
 var audit = lazyRequire(function () { return require("./audit"); });
@@ -210,7 +210,10 @@ function create(opts) {
     MailServerMxError, "mail-server-mx/bad-opts");
   if (!opts.tlsContext) {
     throw new MailServerMxError("mail-server-mx/no-tls-context",
-      "mail.server.mx.create: tlsContext is required (no implicit plaintext mode)");
+      "mail.server.mx.create: tlsContext is required (no implicit plaintext mode). " +
+      "Use b.mail.server.tls.context({ certFile, keyFile, watch: true }) to load + " +
+      "auto-reload a cert/key pair from disk, or pass a node:tls.createSecureContext " +
+      "output directly. Cert provisioning lives in b.acme (RFC 8555 + RFC 9773 ARI).");
   }
   numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
     ["maxLineBytes", "maxMessageBytes", "maxRcptsPerMessage", "idleTimeoutMs"],
@@ -554,39 +557,46 @@ function create(opts) {
         return;
       }
       _writeReply(socket, REPLY_220_READY, "2.0.0 Ready to start TLS");
-      // STARTTLS-injection defense (CVE-2021-38371 Exim,
-      // CVE-2021-33515 Dovecot): clear the command buffer + body
-      // collector at upgrade time. Any commands pipelined (RFC 2920)
-      // BEFORE the TLS handshake are discarded — only commands sent
-      // on the post-handshake TLS socket are honored.
+      // CVE-2021-38371 (Exim) / CVE-2021-33515 (Dovecot) STARTTLS-
+      // injection defense: clear the pre-handshake command buffer +
+      // body collector AND strip the plain-socket "data" listener
+      // before wrapping in TLSSocket so bytes the peer pipelined
+      // (RFC 2920) pre-handshake cannot reach the post-TLS state
+      // machine. Listener-removal + idle-timeout re-arm live in the
+      // shared upgradeSocket helper (b.mail.server.tls.upgradeSocket).
       lineBuffer    = "";
       bodyCollector = null;
       inDataBody    = false;
-      var tlsSocket = new nodeTls.TLSSocket(socket, {
-        isServer:      true,
+      mailServerTls.upgradeSocket({
+        plainSocket:   socket,
         secureContext: opts.tlsContext,
-      });
-      tlsSocket.on("secure", function () {
-        state.tls   = true;
-        // After the handshake, the state machine restarts at EHLO
-        // (per RFC 3207 §4.2 — client MUST re-issue EHLO).
-        state.stage = "ehlo";
-        state.helo  = null;
-      });
-      tlsSocket.on("error", function (err) {
-        _emit("mail.server.mx.tls_handshake_failed",
-          { connectionId: state.id, code: (err && err.code) || "unknown",
-            message: err && err.message }, "failure");
-        _closeConnection(socket);
-      });
-      tlsSocket.on("data", function (chunk) {
-        try { _ingestBytes(state, tlsSocket, chunk); }
-        catch (err) {
-          _emit("mail.server.mx.handler_threw",
-            { connectionId: state.id, error: (err && err.message) || String(err) },
-            "failure");
+        idleTimeoutMs: idleTimeoutMs,
+        onSecure: function (_tlsSocket) {
+          state.tls   = true;
+          // After the handshake, the state machine restarts at EHLO
+          // (per RFC 3207 §4.2 — client MUST re-issue EHLO).
+          state.stage = "ehlo";
+          state.helo  = null;
+        },
+        onData: function (tlsSocket, chunk) {
+          try { _ingestBytes(state, tlsSocket, chunk); }
+          catch (err) {
+            _emit("mail.server.mx.handler_threw",
+              { connectionId: state.id, error: (err && err.message) || String(err) },
+              "failure");
+            _closeConnection(tlsSocket);
+          }
+        },
+        onError: function (err) {
+          _emit("mail.server.mx.tls_handshake_failed",
+            { connectionId: state.id, code: (err && err.code) || "unknown",
+              message: err && err.message }, "failure");
+          _closeConnection(socket);
+        },
+        onTimeout: function (tlsSocket) {
+          _writeReply(tlsSocket, REPLY_421_SERVICE_NOT_AVAIL, "4.4.2 Idle timeout");
           _closeConnection(tlsSocket);
-        }
+        },
       });
     }