@serve.zone/dcrouter 2.12.4

package/dist_ts/ts/mail/delivery/smtpserver/starttls-handler.d.ts

@@ -0,0 +1,21 @@
+/**
+ * STARTTLS Implementation
+ * Provides an improved implementation for STARTTLS upgrades
+ */
+import * as plugins from '../../../plugins.js';
+import type { ISmtpSession, ISessionManager, IConnectionManager } from './interfaces.js';
+import { SmtpState } from '../interfaces.js';
+/**
+ * Enhanced STARTTLS handler for more reliable TLS upgrades
+ */
+export declare function performStartTLS(socket: plugins.net.Socket, options: {
+    key: string;
+    cert: string;
+    ca?: string;
+    session?: ISmtpSession;
+    sessionManager?: ISessionManager;
+    connectionManager?: IConnectionManager;
+    onSuccess?: (tlsSocket: plugins.tls.TLSSocket) => void;
+    onFailure?: (error: Error) => void;
+    updateSessionState?: (session: ISmtpSession, state: SmtpState) => void;
+}): Promise<plugins.tls.TLSSocket | undefined>;

package/dist_ts/ts/mail/delivery/smtpserver/starttls-handler.js

@@ -0,0 +1,207 @@
+/**
+ * STARTTLS Implementation
+ * Provides an improved implementation for STARTTLS upgrades
+ */
+import * as plugins from '../../../plugins.js';
+import { SmtpLogger } from './utils/logging.js';
+import { loadCertificatesFromString, createTlsOptions } from './certificate-utils.js';
+import { getSocketDetails } from './utils/helpers.js';
+import { SmtpState } from '../interfaces.js';
+/**
+ * Enhanced STARTTLS handler for more reliable TLS upgrades
+ */
+export async function performStartTLS(socket, options) {
+    return new Promise((resolve) => {
+        try {
+            const socketDetails = getSocketDetails(socket);
+            SmtpLogger.info('Starting enhanced STARTTLS upgrade process', {
+                remoteAddress: socketDetails.remoteAddress,
+                remotePort: socketDetails.remotePort
+            });
+            // Create a proper socket cleanup function
+            const cleanupSocket = () => {
+                // Remove all listeners to prevent memory leaks
+                socket.removeAllListeners('data');
+                socket.removeAllListeners('error');
+                socket.removeAllListeners('close');
+                socket.removeAllListeners('end');
+                socket.removeAllListeners('drain');
+            };
+            // Prepare the socket for TLS upgrade
+            socket.setNoDelay(true);
+            // Critical: make sure there's no pending data before TLS handshake
+            socket.pause();
+            // Add error handling for the base socket
+            const handleSocketError = (err) => {
+                SmtpLogger.error(`Socket error during STARTTLS preparation: ${err.message}`, {
+                    remoteAddress: socketDetails.remoteAddress,
+                    remotePort: socketDetails.remotePort,
+                    error: err,
+                    stack: err.stack
+                });
+                if (options.onFailure) {
+                    options.onFailure(err);
+                }
+                // Resolve with undefined to indicate failure
+                resolve(undefined);
+            };
+            socket.once('error', handleSocketError);
+            // Load certificates
+            let certificates;
+            try {
+                certificates = loadCertificatesFromString({
+                    key: options.key,
+                    cert: options.cert,
+                    ca: options.ca
+                });
+            }
+            catch (certError) {
+                SmtpLogger.error(`Certificate error during STARTTLS: ${certError instanceof Error ? certError.message : String(certError)}`);
+                if (options.onFailure) {
+                    options.onFailure(certError instanceof Error ? certError : new Error(String(certError)));
+                }
+                resolve(undefined);
+                return;
+            }
+            // Create TLS options optimized for STARTTLS
+            const tlsOptions = createTlsOptions(certificates, true);
+            // Create secure context
+            let secureContext;
+            try {
+                secureContext = plugins.tls.createSecureContext(tlsOptions);
+            }
+            catch (contextError) {
+                SmtpLogger.error(`Failed to create secure context: ${contextError instanceof Error ? contextError.message : String(contextError)}`);
+                if (options.onFailure) {
+                    options.onFailure(contextError instanceof Error ? contextError : new Error(String(contextError)));
+                }
+                resolve(undefined);
+                return;
+            }
+            // Log STARTTLS upgrade attempt
+            SmtpLogger.debug('Attempting TLS socket upgrade with options', {
+                minVersion: tlsOptions.minVersion,
+                maxVersion: tlsOptions.maxVersion,
+                handshakeTimeout: tlsOptions.handshakeTimeout
+            });
+            // Use a safer approach to create the TLS socket
+            const handshakeTimeout = 30000; // 30 seconds timeout for TLS handshake
+            let handshakeTimeoutId;
+            // Create the TLS socket using a conservative approach for STARTTLS
+            const tlsSocket = new plugins.tls.TLSSocket(socket, {
+                isServer: true,
+                secureContext,
+                // Server-side options (simpler is more reliable for STARTTLS)
+                requestCert: false,
+                rejectUnauthorized: false
+            });
+            // Set up error handling for the TLS socket
+            tlsSocket.once('error', (err) => {
+                if (handshakeTimeoutId) {
+                    clearTimeout(handshakeTimeoutId);
+                }
+                SmtpLogger.error(`TLS error during STARTTLS: ${err.message}`, {
+                    remoteAddress: socketDetails.remoteAddress,
+                    remotePort: socketDetails.remotePort,
+                    error: err,
+                    stack: err.stack
+                });
+                // Clean up socket listeners
+                cleanupSocket();
+                if (options.onFailure) {
+                    options.onFailure(err);
+                }
+                // Destroy the socket to ensure we don't have hanging connections
+                tlsSocket.destroy();
+                resolve(undefined);
+            });
+            // Set up handshake timeout manually for extra safety
+            handshakeTimeoutId = setTimeout(() => {
+                SmtpLogger.error('TLS handshake timed out', {
+                    remoteAddress: socketDetails.remoteAddress,
+                    remotePort: socketDetails.remotePort
+                });
+                // Clean up socket listeners
+                cleanupSocket();
+                if (options.onFailure) {
+                    options.onFailure(new Error('TLS handshake timed out'));
+                }
+                // Destroy the socket to ensure we don't have hanging connections
+                tlsSocket.destroy();
+                resolve(undefined);
+            }, handshakeTimeout);
+            // Set up handler for successful TLS negotiation
+            tlsSocket.once('secure', () => {
+                if (handshakeTimeoutId) {
+                    clearTimeout(handshakeTimeoutId);
+                }
+                const protocol = tlsSocket.getProtocol();
+                const cipher = tlsSocket.getCipher();
+                SmtpLogger.info('TLS upgrade successful via STARTTLS', {
+                    remoteAddress: socketDetails.remoteAddress,
+                    remotePort: socketDetails.remotePort,
+                    protocol: protocol || 'unknown',
+                    cipher: cipher?.name || 'unknown'
+                });
+                // Update socket mapping in session manager
+                if (options.sessionManager) {
+                    const socketReplaced = options.sessionManager.replaceSocket(socket, tlsSocket);
+                    if (!socketReplaced) {
+                        SmtpLogger.error('Failed to replace socket in session manager after STARTTLS', {
+                            remoteAddress: socketDetails.remoteAddress,
+                            remotePort: socketDetails.remotePort
+                        });
+                    }
+                }
+                // Re-attach event handlers from connection manager
+                if (options.connectionManager) {
+                    try {
+                        options.connectionManager.setupSocketEventHandlers(tlsSocket);
+                        SmtpLogger.debug('Successfully re-attached connection manager event handlers to TLS socket', {
+                            remoteAddress: socketDetails.remoteAddress,
+                            remotePort: socketDetails.remotePort
+                        });
+                    }
+                    catch (handlerError) {
+                        SmtpLogger.error('Failed to re-attach event handlers to TLS socket after STARTTLS', {
+                            remoteAddress: socketDetails.remoteAddress,
+                            remotePort: socketDetails.remotePort,
+                            error: handlerError instanceof Error ? handlerError : new Error(String(handlerError))
+                        });
+                    }
+                }
+                // Update session if provided
+                if (options.session) {
+                    // Update session properties to indicate TLS is active
+                    options.session.useTLS = true;
+                    options.session.secure = true;
+                    // Reset session state as required by RFC 3207
+                    // After STARTTLS, client must issue a new EHLO
+                    if (options.updateSessionState) {
+                        options.updateSessionState(options.session, SmtpState.GREETING);
+                    }
+                }
+                // Call success callback if provided
+                if (options.onSuccess) {
+                    options.onSuccess(tlsSocket);
+                }
+                // Success - return the TLS socket
+                resolve(tlsSocket);
+            });
+            // Resume the socket after we've set up all handlers
+            // This allows the TLS handshake to proceed
+            socket.resume();
+        }
+        catch (error) {
+            SmtpLogger.error(`Unexpected error in STARTTLS: ${error instanceof Error ? error.message : String(error)}`, {
+                error: error instanceof Error ? error : new Error(String(error)),
+                stack: error instanceof Error ? error.stack : 'No stack trace available'
+            });
+            if (options.onFailure) {
+                options.onFailure(error instanceof Error ? error : new Error(String(error)));
+            }
+            resolve(undefined);
+        }
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3RhcnR0bHMtaGFuZGxlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uL3RzL21haWwvZGVsaXZlcnkvc210cHNlcnZlci9zdGFydHRscy1oYW5kbGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7R0FHRztBQUVILE9BQU8sS0FBSyxPQUFPLE1BQU0scUJBQXFCLENBQUM7QUFDL0MsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBQ2hELE9BQU8sRUFDTCwwQkFBMEIsRUFDMUIsZ0JBQWdCLEVBRWpCLE1BQU0sd0JBQXdCLENBQUM7QUFDaEMsT0FBTyxFQUFFLGdCQUFnQixFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFFdEQsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBRTdDOztHQUVHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxlQUFlLENBQ25DLE1BQTBCLEVBQzFCLE9BVUM7SUFFRCxPQUFPLElBQUksT0FBTyxDQUFvQyxDQUFDLE9BQU8sRUFBRSxFQUFFO1FBQ2hFLElBQUksQ0FBQztZQUNILE1BQU0sYUFBYSxHQUFHLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBRS9DLFVBQVUsQ0FBQyxJQUFJLENBQUMsNENBQTRDLEVBQUU7Z0JBQzVELGFBQWEsRUFBRSxhQUFhLENBQUMsYUFBYTtnQkFDMUMsVUFBVSxFQUFFLGFBQWEsQ0FBQyxVQUFVO2FBQ3JDLENBQUMsQ0FBQztZQUVILDBDQUEwQztZQUMxQyxNQUFNLGFBQWEsR0FBRyxHQUFHLEVBQUU7Z0JBQ3pCLCtDQUErQztnQkFDL0MsTUFBTSxDQUFDLGtCQUFrQixDQUFDLE1BQU0sQ0FBQyxDQUFDO2dCQUNsQyxNQUFNLENBQUMsa0JBQWtCLENBQUMsT0FBTyxDQUFDLENBQUM7Z0JBQ25DLE1BQU0sQ0FBQyxrQkFBa0IsQ0FBQyxPQUFPLENBQUMsQ0FBQztnQkFDbkMsTUFBTSxDQUFDLGtCQUFrQixDQUFDLEtBQUssQ0FBQyxDQUFDO2dCQUNqQyxNQUFNLENBQUMsa0JBQWtCLENBQUMsT0FBTyxDQUFDLENBQUM7WUFDckMsQ0FBQyxDQUFDO1lBRUYscUNBQXFDO1lBQ3JDLE1BQU0sQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLENBQUM7WUFFeEIsbUVBQW1FO1lBQ25FLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUVmLHlDQUF5QztZQUN6QyxNQUFNLGlCQUFpQixHQUFHLENBQUMsR0FBVSxFQUFFLEVBQUU7Z0JBQ3ZDLFVBQVUsQ0FBQyxLQUFLLENBQUMsNkNBQTZDLEdBQUcsQ0FBQyxPQUFPLEVBQUUsRUFBRTtvQkFDM0UsYUFBYSxFQUFFLGFBQWEsQ0FBQyxhQUFhO29CQUMxQyxVQUFVLEVBQUUsYUFBYSxDQUFDLFVBQVU7b0JBQ3BDLEtBQUssRUFBRSxHQUFHO29CQUNWLEtBQUssRUFBRSxHQUFHLENBQUMsS0FBSztpQkFDakIsQ0FBQyxDQUFDO2dCQUVILElBQUksT0FBTyxDQUFDLFNBQVMsRUFBRSxDQUFDO29CQUN0QixPQUFPLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxDQUFDO2dCQUN6QixDQUFDO2dCQUVELDZDQUE2QztnQkFDN0MsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQ3JCLENBQUMsQ0FBQztZQUVGLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLGlCQUFpQixDQUFDLENBQUM7WUFFeEMsb0JBQW9CO1lBQ3BCLElBQUksWUFBOEIsQ0FBQztZQUNuQyxJQUFJLENBQUM7Z0JBQ0gsWUFBWSxHQUFHLDBCQUEwQixDQUFDO29CQUN4QyxHQUFHLEVBQUUsT0FBTyxDQUFDLEdBQUc7b0JBQ2hCLElBQUksRUFBRSxPQUFPLENBQUMsSUFBSTtvQkFDbEIsRUFBRSxFQUFFLE9BQU8sQ0FBQyxFQUFFO2lCQUNmLENBQUMsQ0FBQztZQUNMLENBQUM7WUFBQyxPQUFPLFNBQVMsRUFBRSxDQUFDO2dCQUNuQixVQUFVLENBQUMsS0FBSyxDQUFDLHNDQUFzQyxTQUFTLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQyxDQUFDO2dCQUU3SCxJQUFJLE9BQU8sQ0FBQyxTQUFTLEVBQUUsQ0FBQztvQkFDdEIsT0FBTyxDQUFDLFNBQVMsQ0FBQyxTQUFTLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUM7Z0JBQzNGLENBQUM7Z0JBRUQsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDO2dCQUNuQixPQUFPO1lBQ1QsQ0FBQztZQUVELDRDQUE0QztZQUM1QyxNQUFNLFVBQVUsR0FBRyxnQkFBZ0IsQ0FBQyxZQUFZLEVBQUUsSUFBSSxDQUFDLENBQUM7WUFFeEQsd0JBQXdCO1lBQ3hCLElBQUksYUFBYSxDQUFDO1lBQ2xCLElBQUksQ0FBQztnQkFDSCxhQUFhLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxtQkFBbUIsQ0FBQyxVQUFVLENBQUMsQ0FBQztZQUM5RCxDQUFDO1lBQUMsT0FBTyxZQUFZLEVBQUUsQ0FBQztnQkFDdEIsVUFBVSxDQUFDLEtBQUssQ0FBQyxvQ0FBb0MsWUFBWSxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUMsQ0FBQztnQkFFcEksSUFBSSxPQUFPLENBQUMsU0FBUyxFQUFFLENBQUM7b0JBQ3RCLE9BQU8sQ0FBQyxTQUFTLENBQUMsWUFBWSxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxJQUFJLEtBQUssQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxDQUFDO2dCQUNwRyxDQUFDO2dCQUVELE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQztnQkFDbkIsT0FBTztZQUNULENBQUM7WUFFRCwrQkFBK0I7WUFDL0IsVUFBVSxDQUFDLEtBQUssQ0FBQyw0Q0FBNEMsRUFBRTtnQkFDN0QsVUFBVSxFQUFFLFVBQVUsQ0FBQyxVQUFVO2dCQUNqQyxVQUFVLEVBQUUsVUFBVSxDQUFDLFVBQVU7Z0JBQ2pDLGdCQUFnQixFQUFFLFVBQVUsQ0FBQyxnQkFBZ0I7YUFDOUMsQ0FBQyxDQUFDO1lBRUgsZ0RBQWdEO1lBQ2hELE1BQU0sZ0JBQWdCLEdBQUcsS0FBSyxDQUFDLENBQUMsdUNBQXVDO1lBQ3ZFLElBQUksa0JBQThDLENBQUM7WUFFbkQsbUVBQW1FO1lBQ25FLE1BQU0sU0FBUyxHQUFHLElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUMsTUFBTSxFQUFFO2dCQUNsRCxRQUFRLEVBQUUsSUFBSTtnQkFDZCxhQUFhO2dCQUNiLDhEQUE4RDtnQkFDOUQsV0FBVyxFQUFFLEtBQUs7Z0JBQ2xCLGtCQUFrQixFQUFFLEtBQUs7YUFDMUIsQ0FBQyxDQUFDO1lBRUgsMkNBQTJDO1lBQzNDLFNBQVMsQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUMsR0FBRyxFQUFFLEVBQUU7Z0JBQzlCLElBQUksa0JBQWtCLEVBQUUsQ0FBQztvQkFDdkIsWUFBWSxDQUFDLGtCQUFrQixDQUFDLENBQUM7Z0JBQ25DLENBQUM7Z0JBRUQsVUFBVSxDQUFDLEtBQUssQ0FBQyw4QkFBOEIsR0FBRyxDQUFDLE9BQU8sRUFBRSxFQUFFO29CQUM1RCxhQUFhLEVBQUUsYUFBYSxDQUFDLGFBQWE7b0JBQzFDLFVBQVUsRUFBRSxhQUFhLENBQUMsVUFBVTtvQkFDcEMsS0FBSyxFQUFFLEdBQUc7b0JBQ1YsS0FBSyxFQUFFLEdBQUcsQ0FBQyxLQUFLO2lCQUNqQixDQUFDLENBQUM7Z0JBRUgsNEJBQTRCO2dCQUM1QixhQUFhLEVBQUUsQ0FBQztnQkFFaEIsSUFBSSxPQUFPLENBQUMsU0FBUyxFQUFFLENBQUM7b0JBQ3RCLE9BQU8sQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLENBQUM7Z0JBQ3pCLENBQUM7Z0JBRUQsaUVBQWlFO2dCQUNqRSxTQUFTLENBQUMsT0FBTyxFQUFFLENBQUM7Z0JBQ3BCLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUNyQixDQUFDLENBQUMsQ0FBQztZQUVILHFEQUFxRDtZQUNyRCxrQkFBa0IsR0FBRyxVQUFVLENBQUMsR0FBRyxFQUFFO2dCQUNuQyxVQUFVLENBQUMsS0FBSyxDQUFDLHlCQUF5QixFQUFFO29CQUMxQyxhQUFhLEVBQUUsYUFBYSxDQUFDLGFBQWE7b0JBQzFDLFVBQVUsRUFBRSxhQUFhLENBQUMsVUFBVTtpQkFDckMsQ0FBQyxDQUFDO2dCQUVILDRCQUE0QjtnQkFDNUIsYUFBYSxFQUFFLENBQUM7Z0JBRWhCLElBQUksT0FBTyxDQUFDLFNBQVMsRUFBRSxDQUFDO29CQUN0QixPQUFPLENBQUMsU0FBUyxDQUFDLElBQUksS0FBSyxDQUFDLHlCQUF5QixDQUFDLENBQUMsQ0FBQztnQkFDMUQsQ0FBQztnQkFFRCxpRUFBaUU7Z0JBQ2pFLFNBQVMsQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDcEIsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQ3JCLENBQUMsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDO1lBRXJCLGdEQUFnRDtZQUNoRCxTQUFTLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxHQUFHLEVBQUU7Z0JBQzVCLElBQUksa0JBQWtCLEVBQUUsQ0FBQztvQkFDdkIsWUFBWSxDQUFDLGtCQUFrQixDQUFDLENBQUM7Z0JBQ25DLENBQUM7Z0JBRUQsTUFBTSxRQUFRLEdBQUcsU0FBUyxDQUFDLFdBQVcsRUFBRSxDQUFDO2dCQUN6QyxNQUFNLE1BQU0sR0FBRyxTQUFTLENBQUMsU0FBUyxFQUFFLENBQUM7Z0JBRXJDLFVBQVUsQ0FBQyxJQUFJLENBQUMscUNBQXFDLEVBQUU7b0JBQ3JELGFBQWEsRUFBRSxhQUFhLENBQUMsYUFBYTtvQkFDMUMsVUFBVSxFQUFFLGFBQWEsQ0FBQyxVQUFVO29CQUNwQyxRQUFRLEVBQUUsUUFBUSxJQUFJLFNBQVM7b0JBQy9CLE1BQU0sRUFBRSxNQUFNLEVBQUUsSUFBSSxJQUFJLFNBQVM7aUJBQ2xDLENBQUMsQ0FBQztnQkFFSCwyQ0FBMkM7Z0JBQzNDLElBQUksT0FBTyxDQUFDLGNBQWMsRUFBRSxDQUFDO29CQUMzQixNQUFNLGNBQWMsR0FBRyxPQUFPLENBQUMsY0FBYyxDQUFDLGFBQWEsQ0FBQyxNQUFNLEVBQUUsU0FBUyxDQUFDLENBQUM7b0JBQy9FLElBQUksQ0FBQyxjQUFjLEVBQUUsQ0FBQzt3QkFDcEIsVUFBVSxDQUFDLEtBQUssQ0FBQyw0REFBNEQsRUFBRTs0QkFDN0UsYUFBYSxFQUFFLGFBQWEsQ0FBQyxhQUFhOzRCQUMxQyxVQUFVLEVBQUUsYUFBYSxDQUFDLFVBQVU7eUJBQ3JDLENBQUMsQ0FBQztvQkFDTCxDQUFDO2dCQUNILENBQUM7Z0JBRUQsbURBQW1EO2dCQUNuRCxJQUFJLE9BQU8sQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO29CQUM5QixJQUFJLENBQUM7d0JBQ0gsT0FBTyxDQUFDLGlCQUFpQixDQUFDLHdCQUF3QixDQUFDLFNBQVMsQ0FBQyxDQUFDO3dCQUM5RCxVQUFVLENBQUMsS0FBSyxDQUFDLDBFQUEwRSxFQUFFOzRCQUMzRixhQUFhLEVBQUUsYUFBYSxDQUFDLGFBQWE7NEJBQzFDLFVBQVUsRUFBRSxhQUFhLENBQUMsVUFBVTt5QkFDckMsQ0FBQyxDQUFDO29CQUNMLENBQUM7b0JBQUMsT0FBTyxZQUFZLEVBQUUsQ0FBQzt3QkFDdEIsVUFBVSxDQUFDLEtBQUssQ0FBQyxpRUFBaUUsRUFBRTs0QkFDbEYsYUFBYSxFQUFFLGFBQWEsQ0FBQyxhQUFhOzRCQUMxQyxVQUFVLEVBQUUsYUFBYSxDQUFDLFVBQVU7NEJBQ3BDLEtBQUssRUFBRSxZQUFZLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQyxZQUFZLENBQUMsQ0FBQzt5QkFDdEYsQ0FBQyxDQUFDO29CQUNMLENBQUM7Z0JBQ0gsQ0FBQztnQkFFRCw2QkFBNkI7Z0JBQzdCLElBQUksT0FBTyxDQUFDLE9BQU8sRUFBRSxDQUFDO29CQUNwQixzREFBc0Q7b0JBQ3RELE9BQU8sQ0FBQyxPQUFPLENBQUMsTUFBTSxHQUFHLElBQUksQ0FBQztvQkFDOUIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxNQUFNLEdBQUcsSUFBSSxDQUFDO29CQUU5Qiw4Q0FBOEM7b0JBQzlDLCtDQUErQztvQkFDL0MsSUFBSSxPQUFPLENBQUMsa0JBQWtCLEVBQUUsQ0FBQzt3QkFDL0IsT0FBTyxDQUFDLGtCQUFrQixDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDO29CQUNsRSxDQUFDO2dCQUNILENBQUM7Z0JBRUQsb0NBQW9DO2dCQUNwQyxJQUFJLE9BQU8sQ0FBQyxTQUFTLEVBQUUsQ0FBQztvQkFDdEIsT0FBTyxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUMsQ0FBQztnQkFDL0IsQ0FBQztnQkFFRCxrQ0FBa0M7Z0JBQ2xDLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUNyQixDQUFDLENBQUMsQ0FBQztZQUVILG9EQUFvRDtZQUNwRCwyQ0FBMkM7WUFDM0MsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBRWxCLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsVUFBVSxDQUFDLEtBQUssQ0FBQyxpQ0FBaUMsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLEVBQUU7Z0JBQzFHLEtBQUssRUFBRSxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztnQkFDaEUsS0FBSyxFQUFFLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLDBCQUEwQjthQUN6RSxDQUFDLENBQUM7WUFFSCxJQUFJLE9BQU8sQ0FBQyxTQUFTLEVBQUUsQ0FBQztnQkFDdEIsT0FBTyxDQUFDLFNBQVMsQ0FBQyxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDL0UsQ0FBQztZQUVELE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNyQixDQUFDO0lBQ0gsQ0FBQyxDQUFDLENBQUM7QUFDTCxDQUFDIn0=

package/dist_ts/ts/mail/delivery/smtpserver/tls-handler.d.ts

@@ -0,0 +1,66 @@
+/**
+ * SMTP TLS Handler
+ * Responsible for handling TLS-related SMTP functionality
+ */
+import * as plugins from '../../../plugins.js';
+import type { ITlsHandler, ISmtpServer, ISmtpSession } from './interfaces.js';
+/**
+ * Handles TLS functionality for SMTP server
+ */
+export declare class TlsHandler implements ITlsHandler {
+    /**
+     * Reference to the SMTP server instance
+     */
+    private smtpServer;
+    /**
+     * Certificate data
+     */
+    private certificates;
+    /**
+     * TLS options
+     */
+    private options;
+    /**
+     * Creates a new TLS handler
+     * @param smtpServer - SMTP server instance
+     */
+    constructor(smtpServer: ISmtpServer);
+    /**
+     * Handle STARTTLS command
+     * @param socket - Client socket
+     */
+    handleStartTls(socket: plugins.net.Socket, session: ISmtpSession): Promise<plugins.tls.TLSSocket | null>;
+    /**
+     * Upgrade a connection to TLS
+     * @param socket - Client socket
+     */
+    startTLS(socket: plugins.net.Socket): Promise<plugins.tls.TLSSocket>;
+    /**
+     * Create a secure server
+     * @returns TLS server instance or undefined if TLS is not enabled
+     */
+    createSecureServer(): plugins.tls.Server | undefined;
+    /**
+     * Check if TLS is enabled
+     * @returns Whether TLS is enabled
+     */
+    isTlsEnabled(): boolean;
+    /**
+     * Send a response to the client
+     * @param socket - Client socket
+     * @param response - Response message
+     */
+    private sendResponse;
+    /**
+     * Check if TLS is available (interface requirement)
+     */
+    isTlsAvailable(): boolean;
+    /**
+     * Get TLS options (interface requirement)
+     */
+    getTlsOptions(): plugins.tls.TlsOptions;
+    /**
+     * Clean up resources
+     */
+    destroy(): void;
+}

package/dist_ts/ts/mail/delivery/smtpserver/tls-handler.js

@@ -0,0 +1,261 @@
+/**
+ * SMTP TLS Handler
+ * Responsible for handling TLS-related SMTP functionality
+ */
+import * as plugins from '../../../plugins.js';
+import { SmtpResponseCode, SecurityEventType, SecurityLogLevel } from './constants.js';
+import { SmtpLogger } from './utils/logging.js';
+import { getSocketDetails, getTlsDetails } from './utils/helpers.js';
+import { loadCertificatesFromString, generateSelfSignedCertificates, createTlsOptions } from './certificate-utils.js';
+import { SmtpState } from '../interfaces.js';
+/**
+ * Handles TLS functionality for SMTP server
+ */
+export class TlsHandler {
+    /**
+     * Creates a new TLS handler
+     * @param smtpServer - SMTP server instance
+     */
+    constructor(smtpServer) {
+        this.smtpServer = smtpServer;
+        // Initialize certificates
+        const serverOptions = this.smtpServer.getOptions();
+        try {
+            // Try to load certificates from provided options
+            this.certificates = loadCertificatesFromString({
+                key: serverOptions.key,
+                cert: serverOptions.cert,
+                ca: serverOptions.ca
+            });
+            SmtpLogger.info('Successfully loaded TLS certificates');
+        }
+        catch (error) {
+            SmtpLogger.warn(`Failed to load certificates from options, using self-signed: ${error instanceof Error ? error.message : String(error)}`);
+            // Fall back to self-signed certificates for testing
+            this.certificates = generateSelfSignedCertificates();
+        }
+        // Initialize TLS options
+        this.options = createTlsOptions(this.certificates);
+    }
+    /**
+     * Handle STARTTLS command
+     * @param socket - Client socket
+     */
+    async handleStartTls(socket, session) {
+        // Check if already using TLS
+        if (session.useTLS) {
+            this.sendResponse(socket, `${SmtpResponseCode.BAD_SEQUENCE} TLS already active`);
+            return null;
+        }
+        // Check if we have the necessary TLS certificates
+        if (!this.isTlsEnabled()) {
+            this.sendResponse(socket, `${SmtpResponseCode.TLS_UNAVAILABLE_TEMP} TLS not available`);
+            return null;
+        }
+        // Send ready for TLS response
+        this.sendResponse(socket, `${SmtpResponseCode.SERVICE_READY} Ready to start TLS`);
+        // Upgrade the connection to TLS
+        try {
+            const tlsSocket = await this.startTLS(socket);
+            return tlsSocket;
+        }
+        catch (error) {
+            SmtpLogger.error(`STARTTLS negotiation failed: ${error instanceof Error ? error.message : String(error)}`, {
+                sessionId: session.id,
+                remoteAddress: session.remoteAddress,
+                error: error instanceof Error ? error : new Error(String(error))
+            });
+            // Log security event
+            SmtpLogger.logSecurityEvent(SecurityLogLevel.ERROR, SecurityEventType.TLS_NEGOTIATION, 'STARTTLS negotiation failed', { error: error instanceof Error ? error.message : String(error) }, session.remoteAddress);
+            return null;
+        }
+    }
+    /**
+     * Upgrade a connection to TLS
+     * @param socket - Client socket
+     */
+    async startTLS(socket) {
+        // Get the session for this socket
+        const session = this.smtpServer.getSessionManager().getSession(socket);
+        try {
+            // Import the enhanced STARTTLS handler
+            // This uses a more robust approach to TLS upgrades
+            const { performStartTLS } = await import('./starttls-handler.js');
+            SmtpLogger.info('Using enhanced STARTTLS implementation');
+            // Use the enhanced STARTTLS handler with better error handling and socket management
+            const serverOptions = this.smtpServer.getOptions();
+            const tlsSocket = await performStartTLS(socket, {
+                key: serverOptions.key,
+                cert: serverOptions.cert,
+                ca: serverOptions.ca,
+                session: session,
+                sessionManager: this.smtpServer.getSessionManager(),
+                connectionManager: this.smtpServer.getConnectionManager(),
+                // Callback for successful upgrade
+                onSuccess: (secureSocket) => {
+                    SmtpLogger.info('TLS connection successfully established via enhanced STARTTLS', {
+                        remoteAddress: secureSocket.remoteAddress,
+                        remotePort: secureSocket.remotePort,
+                        protocol: secureSocket.getProtocol() || 'unknown',
+                        cipher: secureSocket.getCipher()?.name || 'unknown'
+                    });
+                    // Log security event
+                    SmtpLogger.logSecurityEvent(SecurityLogLevel.INFO, SecurityEventType.TLS_NEGOTIATION, 'STARTTLS successful with enhanced implementation', {
+                        protocol: secureSocket.getProtocol(),
+                        cipher: secureSocket.getCipher()?.name
+                    }, secureSocket.remoteAddress, undefined, true);
+                },
+                // Callback for failed upgrade
+                onFailure: (error) => {
+                    SmtpLogger.error(`Enhanced STARTTLS failed: ${error.message}`, {
+                        sessionId: session?.id,
+                        remoteAddress: socket.remoteAddress,
+                        error
+                    });
+                    // Log security event
+                    SmtpLogger.logSecurityEvent(SecurityLogLevel.ERROR, SecurityEventType.TLS_NEGOTIATION, 'Enhanced STARTTLS failed', { error: error.message }, socket.remoteAddress, undefined, false);
+                },
+                // Function to update session state
+                updateSessionState: this.smtpServer.getSessionManager().updateSessionState?.bind(this.smtpServer.getSessionManager())
+            });
+            // If STARTTLS failed with the enhanced implementation, log the error
+            if (!tlsSocket) {
+                SmtpLogger.warn('Enhanced STARTTLS implementation failed to create TLS socket', {
+                    sessionId: session?.id,
+                    remoteAddress: socket.remoteAddress
+                });
+                throw new Error('Failed to create TLS socket');
+            }
+            return tlsSocket;
+        }
+        catch (error) {
+            // Log STARTTLS failure
+            SmtpLogger.error(`Failed to upgrade connection to TLS: ${error instanceof Error ? error.message : String(error)}`, {
+                remoteAddress: socket.remoteAddress,
+                remotePort: socket.remotePort,
+                error: error instanceof Error ? error : new Error(String(error)),
+                stack: error instanceof Error ? error.stack : 'No stack trace available'
+            });
+            // Log security event
+            SmtpLogger.logSecurityEvent(SecurityLogLevel.ERROR, SecurityEventType.TLS_NEGOTIATION, 'Failed to upgrade connection to TLS', {
+                error: error instanceof Error ? error.message : String(error),
+                stack: error instanceof Error ? error.stack : 'No stack trace available'
+            }, socket.remoteAddress, undefined, false);
+            // Destroy the socket on error
+            socket.destroy();
+            throw error;
+        }
+    }
+    /**
+     * Create a secure server
+     * @returns TLS server instance or undefined if TLS is not enabled
+     */
+    createSecureServer() {
+        if (!this.isTlsEnabled()) {
+            return undefined;
+        }
+        try {
+            SmtpLogger.info('Creating secure TLS server');
+            // Log certificate info
+            SmtpLogger.debug('Using certificates for secure server', {
+                keyLength: this.certificates.key.length,
+                certLength: this.certificates.cert.length,
+                caLength: this.certificates.ca ? this.certificates.ca.length : 0
+            });
+            // Create TLS options using our certificate utilities
+            // This ensures proper PEM format handling and protocol negotiation
+            const tlsOptions = createTlsOptions(this.certificates, true); // Use server options
+            SmtpLogger.info('Creating TLS server with options', {
+                minVersion: tlsOptions.minVersion,
+                maxVersion: tlsOptions.maxVersion,
+                handshakeTimeout: tlsOptions.handshakeTimeout
+            });
+            // Create a server with wider TLS compatibility
+            const server = new plugins.tls.Server(tlsOptions);
+            // Add error handling
+            server.on('error', (err) => {
+                SmtpLogger.error(`TLS server error: ${err.message}`, {
+                    error: err,
+                    stack: err.stack
+                });
+            });
+            // Log TLS details for each connection
+            server.on('secureConnection', (socket) => {
+                SmtpLogger.info('New secure connection established', {
+                    protocol: socket.getProtocol(),
+                    cipher: socket.getCipher()?.name,
+                    remoteAddress: socket.remoteAddress,
+                    remotePort: socket.remotePort
+                });
+            });
+            return server;
+        }
+        catch (error) {
+            SmtpLogger.error(`Failed to create secure server: ${error instanceof Error ? error.message : String(error)}`, {
+                error: error instanceof Error ? error : new Error(String(error)),
+                stack: error instanceof Error ? error.stack : 'No stack trace available'
+            });
+            return undefined;
+        }
+    }
+    /**
+     * Check if TLS is enabled
+     * @returns Whether TLS is enabled
+     */
+    isTlsEnabled() {
+        const options = this.smtpServer.getOptions();
+        return !!(options.key && options.cert);
+    }
+    /**
+     * Send a response to the client
+     * @param socket - Client socket
+     * @param response - Response message
+     */
+    sendResponse(socket, response) {
+        // Check if socket is still writable before attempting to write
+        if (socket.destroyed || socket.readyState !== 'open' || !socket.writable) {
+            SmtpLogger.debug(`Skipping response to closed/destroyed socket: ${response}`, {
+                remoteAddress: socket.remoteAddress,
+                remotePort: socket.remotePort,
+                destroyed: socket.destroyed,
+                readyState: socket.readyState,
+                writable: socket.writable
+            });
+            return;
+        }
+        try {
+            socket.write(`${response}\r\n`);
+            SmtpLogger.logResponse(response, socket);
+        }
+        catch (error) {
+            SmtpLogger.error(`Error sending response: ${error instanceof Error ? error.message : String(error)}`, {
+                response,
+                remoteAddress: socket.remoteAddress,
+                remotePort: socket.remotePort,
+                error: error instanceof Error ? error : new Error(String(error))
+            });
+            socket.destroy();
+        }
+    }
+    /**
+     * Check if TLS is available (interface requirement)
+     */
+    isTlsAvailable() {
+        return this.isTlsEnabled();
+    }
+    /**
+     * Get TLS options (interface requirement)
+     */
+    getTlsOptions() {
+        return this.options;
+    }
+    /**
+     * Clean up resources
+     */
+    destroy() {
+        // Clear any cached certificates or TLS contexts
+        // TlsHandler doesn't have timers but may have cached resources
+        SmtpLogger.debug('TlsHandler destroyed');
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidGxzLWhhbmRsZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi90cy9tYWlsL2RlbGl2ZXJ5L3NtdHBzZXJ2ZXIvdGxzLWhhbmRsZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7OztHQUdHO0FBRUgsT0FBTyxLQUFLLE9BQU8sTUFBTSxxQkFBcUIsQ0FBQztBQUUvQyxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsaUJBQWlCLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxnQkFBZ0IsQ0FBQztBQUN2RixPQUFPLEVBQUUsVUFBVSxFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFDaEQsT0FBTyxFQUFFLGdCQUFnQixFQUFFLGFBQWEsRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBQ3JFLE9BQU8sRUFDTCwwQkFBMEIsRUFDMUIsOEJBQThCLEVBQzlCLGdCQUFnQixFQUVqQixNQUFNLHdCQUF3QixDQUFDO0FBQ2hDLE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUU3Qzs7R0FFRztBQUNILE1BQU0sT0FBTyxVQUFVO0lBZ0JyQjs7O09BR0c7SUFDSCxZQUFZLFVBQXVCO1FBQ2pDLElBQUksQ0FBQyxVQUFVLEdBQUcsVUFBVSxDQUFDO1FBRTdCLDBCQUEwQjtRQUMxQixNQUFNLGFBQWEsR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQ25ELElBQUksQ0FBQztZQUNILGlEQUFpRDtZQUNqRCxJQUFJLENBQUMsWUFBWSxHQUFHLDBCQUEwQixDQUFDO2dCQUM3QyxHQUFHLEVBQUUsYUFBYSxDQUFDLEdBQUc7Z0JBQ3RCLElBQUksRUFBRSxhQUFhLENBQUMsSUFBSTtnQkFDeEIsRUFBRSxFQUFFLGFBQWEsQ0FBQyxFQUFFO2FBQ3JCLENBQUMsQ0FBQztZQUVILFVBQVUsQ0FBQyxJQUFJLENBQUMsc0NBQXNDLENBQUMsQ0FBQztRQUMxRCxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLFVBQVUsQ0FBQyxJQUFJLENBQUMsZ0VBQWdFLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUM7WUFFMUksb0RBQW9EO1lBQ3BELElBQUksQ0FBQyxZQUFZLEdBQUcsOEJBQThCLEVBQUUsQ0FBQztRQUN2RCxDQUFDO1FBRUQseUJBQXlCO1FBQ3pCLElBQUksQ0FBQyxPQUFPLEdBQUcsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxDQUFDO0lBQ3JELENBQUM7SUFFRDs7O09BR0c7SUFDSSxLQUFLLENBQUMsY0FBYyxDQUFDLE1BQTBCLEVBQUUsT0FBcUI7UUFFM0UsNkJBQTZCO1FBQzdCLElBQUksT0FBTyxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ25CLElBQUksQ0FBQyxZQUFZLENBQUMsTUFBTSxFQUFFLEdBQUcsZ0JBQWdCLENBQUMsWUFBWSxxQkFBcUIsQ0FBQyxDQUFDO1lBQ2pGLE9BQU8sSUFBSSxDQUFDO1FBQ2QsQ0FBQztRQUVELGtEQUFrRDtRQUNsRCxJQUFJLENBQUMsSUFBSSxDQUFDLFlBQVksRUFBRSxFQUFFLENBQUM7WUFDekIsSUFBSSxDQUFDLFlBQVksQ0FBQyxNQUFNLEVBQUUsR0FBRyxnQkFBZ0IsQ0FBQyxvQkFBb0Isb0JBQW9CLENBQUMsQ0FBQztZQUN4RixPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFFRCw4QkFBOEI7UUFDOUIsSUFBSSxDQUFDLFlBQVksQ0FBQyxNQUFNLEVBQUUsR0FBRyxnQkFBZ0IsQ0FBQyxhQUFhLHFCQUFxQixDQUFDLENBQUM7UUFFbEYsZ0NBQWdDO1FBQ2hDLElBQUksQ0FBQztZQUNILE1BQU0sU0FBUyxHQUFHLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUM5QyxPQUFPLFNBQVMsQ0FBQztRQUNuQixDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLFVBQVUsQ0FBQyxLQUFLLENBQUMsZ0NBQWdDLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsRUFBRSxFQUFFO2dCQUN6RyxTQUFTLEVBQUUsT0FBTyxDQUFDLEVBQUU7Z0JBQ3JCLGFBQWEsRUFBRSxPQUFPLENBQUMsYUFBYTtnQkFDcEMsS0FBSyxFQUFFLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsSUFBSSxLQUFLLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO2FBQ2pFLENBQUMsQ0FBQztZQUVILHFCQUFxQjtZQUNyQixVQUFVLENBQUMsZ0JBQWdCLENBQ3pCLGdCQUFnQixDQUFDLEtBQUssRUFDdEIsaUJBQWlCLENBQUMsZUFBZSxFQUNqQyw2QkFBNkIsRUFDN0IsRUFBRSxLQUFLLEVBQUUsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLEVBQ2pFLE9BQU8sQ0FBQyxhQUFhLENBQ3RCLENBQUM7WUFFRixPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7SUFDSCxDQUFDO0lBRUQ7OztPQUdHO0lBQ0ksS0FBSyxDQUFDLFFBQVEsQ0FBQyxNQUEwQjtRQUM5QyxrQ0FBa0M7UUFDbEMsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxpQkFBaUIsRUFBRSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUV2RSxJQUFJLENBQUM7WUFDSCx1Q0FBdUM7WUFDdkMsbURBQW1EO1lBQ25ELE1BQU0sRUFBRSxlQUFlLEVBQUUsR0FBRyxNQUFNLE1BQU0sQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDO1lBRWxFLFVBQVUsQ0FBQyxJQUFJLENBQUMsd0NBQXdDLENBQUMsQ0FBQztZQUUxRCxxRkFBcUY7WUFDckYsTUFBTSxhQUFhLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxVQUFVLEVBQUUsQ0FBQztZQUNuRCxNQUFNLFNBQVMsR0FBRyxNQUFNLGVBQWUsQ0FBQyxNQUFNLEVBQUU7Z0JBQzlDLEdBQUcsRUFBRSxhQUFhLENBQUMsR0FBRztnQkFDdEIsSUFBSSxFQUFFLGFBQWEsQ0FBQyxJQUFJO2dCQUN4QixFQUFFLEVBQUUsYUFBYSxDQUFDLEVBQUU7Z0JBQ3BCLE9BQU8sRUFBRSxPQUFPO2dCQUNoQixjQUFjLEVBQUUsSUFBSSxDQUFDLFVBQVUsQ0FBQyxpQkFBaUIsRUFBRTtnQkFDbkQsaUJBQWlCLEVBQUUsSUFBSSxDQUFDLFVBQVUsQ0FBQyxvQkFBb0IsRUFBRTtnQkFDekQsa0NBQWtDO2dCQUNsQyxTQUFTLEVBQUUsQ0FBQyxZQUFZLEVBQUUsRUFBRTtvQkFDMUIsVUFBVSxDQUFDLElBQUksQ0FBQywrREFBK0QsRUFBRTt3QkFDL0UsYUFBYSxFQUFFLFlBQVksQ0FBQyxhQUFhO3dCQUN6QyxVQUFVLEVBQUUsWUFBWSxDQUFDLFVBQVU7d0JBQ25DLFFBQVEsRUFBRSxZQUFZLENBQUMsV0FBVyxFQUFFLElBQUksU0FBUzt3QkFDakQsTUFBTSxFQUFFLFlBQVksQ0FBQyxTQUFTLEVBQUUsRUFBRSxJQUFJLElBQUksU0FBUztxQkFDcEQsQ0FBQyxDQUFDO29CQUVILHFCQUFxQjtvQkFDckIsVUFBVSxDQUFDLGdCQUFnQixDQUN6QixnQkFBZ0IsQ0FBQyxJQUFJLEVBQ3JCLGlCQUFpQixDQUFDLGVBQWUsRUFDakMsa0RBQWtELEVBQ2xEO3dCQUNFLFFBQVEsRUFBRSxZQUFZLENBQUMsV0FBVyxFQUFFO3dCQUNwQyxNQUFNLEVBQUUsWUFBWSxDQUFDLFNBQVMsRUFBRSxFQUFFLElBQUk7cUJBQ3ZDLEVBQ0QsWUFBWSxDQUFDLGFBQWEsRUFDMUIsU0FBUyxFQUNULElBQUksQ0FDTCxDQUFDO2dCQUNKLENBQUM7Z0JBQ0QsOEJBQThCO2dCQUM5QixTQUFTLEVBQUUsQ0FBQyxLQUFLLEVBQUUsRUFBRTtvQkFDbkIsVUFBVSxDQUFDLEtBQUssQ0FBQyw2QkFBNkIsS0FBSyxDQUFDLE9BQU8sRUFBRSxFQUFFO3dCQUM3RCxTQUFTLEVBQUUsT0FBTyxFQUFFLEVBQUU7d0JBQ3RCLGFBQWEsRUFBRSxNQUFNLENBQUMsYUFBYTt3QkFDbkMsS0FBSztxQkFDTixDQUFDLENBQUM7b0JBRUgscUJBQXFCO29CQUNyQixVQUFVLENBQUMsZ0JBQWdCLENBQ3pCLGdCQUFnQixDQUFDLEtBQUssRUFDdEIsaUJBQWlCLENBQUMsZUFBZSxFQUNqQywwQkFBMEIsRUFDMUIsRUFBRSxLQUFLLEVBQUUsS0FBSyxDQUFDLE9BQU8sRUFBRSxFQUN4QixNQUFNLENBQUMsYUFBYSxFQUNwQixTQUFTLEVBQ1QsS0FBSyxDQUNOLENBQUM7Z0JBQ0osQ0FBQztnQkFDRCxtQ0FBbUM7Z0JBQ25DLGtCQUFrQixFQUFFLElBQUksQ0FBQyxVQUFVLENBQUMsaUJBQWlCLEVBQUUsQ0FBQyxrQkFBa0IsRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO2FBQ3RILENBQUMsQ0FBQztZQUVILHFFQUFxRTtZQUNyRSxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7Z0JBQ2YsVUFBVSxDQUFDLElBQUksQ0FBQyw4REFBOEQsRUFBRTtvQkFDOUUsU0FBUyxFQUFFLE9BQU8sRUFBRSxFQUFFO29CQUN0QixhQUFhLEVBQUUsTUFBTSxDQUFDLGFBQWE7aUJBQ3BDLENBQUMsQ0FBQztnQkFDSCxNQUFNLElBQUksS0FBSyxDQUFDLDZCQUE2QixDQUFDLENBQUM7WUFDakQsQ0FBQztZQUVELE9BQU8sU0FBUyxDQUFDO1FBQ25CLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsdUJBQXVCO1lBQ3ZCLFVBQVUsQ0FBQyxLQUFLLENBQUMsd0NBQXdDLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsRUFBRSxFQUFFO2dCQUNqSCxhQUFhLEVBQUUsTUFBTSxDQUFDLGFBQWE7Z0JBQ25DLFVBQVUsRUFBRSxNQUFNLENBQUMsVUFBVTtnQkFDN0IsS0FBSyxFQUFFLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsSUFBSSxLQUFLLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO2dCQUNoRSxLQUFLLEVBQUUsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsMEJBQTBCO2FBQ3pFLENBQUMsQ0FBQztZQUVILHFCQUFxQjtZQUNyQixVQUFVLENBQUMsZ0JBQWdCLENBQ3pCLGdCQUFnQixDQUFDLEtBQUssRUFDdEIsaUJBQWlCLENBQUMsZUFBZSxFQUNqQyxxQ0FBcUMsRUFDckM7Z0JBQ0UsS0FBSyxFQUFFLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUM7Z0JBQzdELEtBQUssRUFBRSxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQywwQkFBMEI7YUFDekUsRUFDRCxNQUFNLENBQUMsYUFBYSxFQUNwQixTQUFTLEVBQ1QsS0FBSyxDQUNOLENBQUM7WUFFRiw4QkFBOEI7WUFDOUIsTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ2pCLE1BQU0sS0FBSyxDQUFDO1FBQ2QsQ0FBQztJQUNILENBQUM7SUFFRDs7O09BR0c7SUFDSSxrQkFBa0I7UUFDdkIsSUFBSSxDQUFDLElBQUksQ0FBQyxZQUFZLEVBQUUsRUFBRSxDQUFDO1lBQ3pCLE9BQU8sU0FBUyxDQUFDO1FBQ25CLENBQUM7UUFFRCxJQUFJLENBQUM7WUFDSCxVQUFVLENBQUMsSUFBSSxDQUFDLDRCQUE0QixDQUFDLENBQUM7WUFFOUMsdUJBQXVCO1lBQ3ZCLFVBQVUsQ0FBQyxLQUFLLENBQUMsc0NBQXNDLEVBQUU7Z0JBQ3ZELFNBQVMsRUFBRSxJQUFJLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxNQUFNO2dCQUN2QyxVQUFVLEVBQUUsSUFBSSxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsTUFBTTtnQkFDekMsUUFBUSxFQUFFLElBQUksQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUM7YUFDakUsQ0FBQyxDQUFDO1lBRUgscURBQXFEO1lBQ3JELG1FQUFtRTtZQUNuRSxNQUFNLFVBQVUsR0FBRyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsWUFBWSxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMscUJBQXFCO1lBRW5GLFVBQVUsQ0FBQyxJQUFJLENBQUMsa0NBQWtDLEVBQUU7Z0JBQ2xELFVBQVUsRUFBRSxVQUFVLENBQUMsVUFBVTtnQkFDakMsVUFBVSxFQUFFLFVBQVUsQ0FBQyxVQUFVO2dCQUNqQyxnQkFBZ0IsRUFBRSxVQUFVLENBQUMsZ0JBQWdCO2FBQzlDLENBQUMsQ0FBQztZQUVILCtDQUErQztZQUMvQyxNQUFNLE1BQU0sR0FBRyxJQUFJLE9BQU8sQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBRWxELHFCQUFxQjtZQUNyQixNQUFNLENBQUMsRUFBRSxDQUFDLE9BQU8sRUFBRSxDQUFDLEdBQUcsRUFBRSxFQUFFO2dCQUN6QixVQUFVLENBQUMsS0FBSyxDQUFDLHFCQUFxQixHQUFHLENBQUMsT0FBTyxFQUFFLEVBQUU7b0JBQ25ELEtBQUssRUFBRSxHQUFHO29CQUNWLEtBQUssRUFBRSxHQUFHLENBQUMsS0FBSztpQkFDakIsQ0FBQyxDQUFDO1lBQ0wsQ0FBQyxDQUFDLENBQUM7WUFFSCxzQ0FBc0M7WUFDdEMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxrQkFBa0IsRUFBRSxDQUFDLE1BQU0sRUFBRSxFQUFFO2dCQUN2QyxVQUFVLENBQUMsSUFBSSxDQUFDLG1DQUFtQyxFQUFFO29CQUNuRCxRQUFRLEVBQUUsTUFBTSxDQUFDLFdBQVcsRUFBRTtvQkFDOUIsTUFBTSxFQUFFLE1BQU0sQ0FBQyxTQUFTLEVBQUUsRUFBRSxJQUFJO29CQUNoQyxhQUFhLEVBQUUsTUFBTSxDQUFDLGFBQWE7b0JBQ25DLFVBQVUsRUFBRSxNQUFNLENBQUMsVUFBVTtpQkFDOUIsQ0FBQyxDQUFDO1lBQ0wsQ0FBQyxDQUFDLENBQUM7WUFFSCxPQUFPLE1BQU0sQ0FBQztRQUNoQixDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLFVBQVUsQ0FBQyxLQUFLLENBQUMsbUNBQW1DLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsRUFBRSxFQUFFO2dCQUM1RyxLQUFLLEVBQUUsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxJQUFJLEtBQUssQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7Z0JBQ2hFLEtBQUssRUFBRSxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQywwQkFBMEI7YUFDekUsQ0FBQyxDQUFDO1lBRUgsT0FBTyxTQUFTLENBQUM7UUFDbkIsQ0FBQztJQUNILENBQUM7SUFFRDs7O09BR0c7SUFDSSxZQUFZO1FBQ2pCLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxVQUFVLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDN0MsT0FBTyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsR0FBRyxJQUFJLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUN6QyxDQUFDO0lBRUQ7Ozs7T0FJRztJQUNLLFlBQVksQ0FBQyxNQUFrRCxFQUFFLFFBQWdCO1FBQ3ZGLCtEQUErRDtRQUMvRCxJQUFJLE1BQU0sQ0FBQyxTQUFTLElBQUksTUFBTSxDQUFDLFVBQVUsS0FBSyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDekUsVUFBVSxDQUFDLEtBQUssQ0FBQyxpREFBaUQsUUFBUSxFQUFFLEVBQUU7Z0JBQzVFLGFBQWEsRUFBRSxNQUFNLENBQUMsYUFBYTtnQkFDbkMsVUFBVSxFQUFFLE1BQU0sQ0FBQyxVQUFVO2dCQUM3QixTQUFTLEVBQUUsTUFBTSxDQUFDLFNBQVM7Z0JBQzNCLFVBQVUsRUFBRSxNQUFNLENBQUMsVUFBVTtnQkFDN0IsUUFBUSxFQUFFLE1BQU0sQ0FBQyxRQUFRO2FBQzFCLENBQUMsQ0FBQztZQUNILE9BQU87UUFDVCxDQUFDO1FBRUQsSUFBSSxDQUFDO1lBQ0gsTUFBTSxDQUFDLEtBQUssQ0FBQyxHQUFHLFFBQVEsTUFBTSxDQUFDLENBQUM7WUFDaEMsVUFBVSxDQUFDLFdBQVcsQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDM0MsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixVQUFVLENBQUMsS0FBSyxDQUFDLDJCQUEyQixLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLEVBQUUsRUFBRTtnQkFDcEcsUUFBUTtnQkFDUixhQUFhLEVBQUUsTUFBTSxDQUFDLGFBQWE7Z0JBQ25DLFVBQVUsRUFBRSxNQUFNLENBQUMsVUFBVTtnQkFDN0IsS0FBSyxFQUFFLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsSUFBSSxLQUFLLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO2FBQ2pFLENBQUMsQ0FBQztZQUVILE1BQU0sQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUNuQixDQUFDO0lBQ0gsQ0FBQztJQUVEOztPQUVHO0lBQ0ksY0FBYztRQUNuQixPQUFPLElBQUksQ0FBQyxZQUFZLEVBQUUsQ0FBQztJQUM3QixDQUFDO0lBRUQ7O09BRUc7SUFDSSxhQUFhO1FBQ2xCLE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQztJQUN0QixDQUFDO0lBRUQ7O09BRUc7SUFDSSxPQUFPO1FBQ1osZ0RBQWdEO1FBQ2hELCtEQUErRDtRQUMvRCxVQUFVLENBQUMsS0FBSyxDQUFDLHNCQUFzQixDQUFDLENBQUM7SUFDM0MsQ0FBQztDQUNGIn0=