@serve.zone/dcrouter 2.12.4

package/test/suite/smtpclient_security/test.csec-05.dmarc-policy.ts

@@ -0,0 +1,200 @@
+import { tap, expect } from '@git.zone/tstest/tapbundle';
+import { startTestServer, stopTestServer, type ITestServer } from '../../helpers/server.loader.js';
+import { createTestSmtpClient } from '../../helpers/smtp.client.js';
+import { Email } from '../../../ts/mail/core/classes.email.js';
+import * as dns from 'dns';
+import { promisify } from 'util';
+
+const resolveTxt = promisify(dns.resolveTxt);
+
+let testServer: ITestServer;
+
+tap.test('setup test SMTP server', async () => {
+  testServer = await startTestServer({
+    port: 2565,
+    tlsEnabled: false,
+    authRequired: false
+  });
+  expect(testServer).toBeTruthy();
+  expect(testServer.port).toBeGreaterThan(0);
+});
+
+tap.test('CSEC-05: DMARC record parsing', async () => {
+  // Test DMARC record parsing
+  const testDmarcRecords = [
+    {
+      domain: 'example.com',
+      record: 'v=DMARC1; p=reject; rua=mailto:dmarc@example.com; ruf=mailto:forensics@example.com; adkim=s; aspf=s; pct=100',
+      description: 'Strict DMARC with reporting'
+    },
+    {
+      domain: 'relaxed.com',
+      record: 'v=DMARC1; p=quarantine; adkim=r; aspf=r; pct=50',
+      description: 'Relaxed alignment, 50% quarantine'
+    },
+    {
+      domain: 'monitoring.com',
+      record: 'v=DMARC1; p=none; rua=mailto:reports@monitoring.com',
+      description: 'Monitor only mode'
+    }
+  ];
+
+  console.log('DMARC Record Analysis:\n');
+  
+  for (const test of testDmarcRecords) {
+    console.log(`Domain: _dmarc.${test.domain}`);
+    console.log(`Record: ${test.record}`);
+    console.log(`Description: ${test.description}`);
+    
+    // Parse DMARC tags
+    const tags = test.record.match(/(\w+)=([^;]+)/g);
+    if (tags) {
+      console.log(`Tags found: ${tags.length}`);
+    }
+    console.log('');
+  }
+});
+
+tap.test('CSEC-05: DMARC alignment testing', async () => {
+  const smtpClient = createTestSmtpClient({
+    host: testServer.hostname,
+    port: testServer.port,
+    secure: false,
+    connectionTimeout: 5000,
+    debug: true
+  });
+
+  // Test DMARC alignment scenarios
+  const alignmentTests = [
+    {
+      name: 'Fully aligned',
+      fromHeader: 'sender@example.com',
+      expectedResult: 'pass'
+    },
+    {
+      name: 'Different domain',
+      fromHeader: 'sender@otherdomain.com',
+      expectedResult: 'fail'
+    }
+  ];
+
+  for (const test of alignmentTests) {
+    console.log(`\nTesting DMARC alignment: ${test.name}`);
+    console.log(`  From header: ${test.fromHeader}`);
+    
+    const email = new Email({
+      from: test.fromHeader,
+      to: ['recipient@example.com'],
+      subject: `DMARC Test: ${test.name}`,
+      text: 'Testing DMARC alignment'
+    });
+
+    const result = await smtpClient.sendMail(email);
+    expect(result.success).toBeTruthy();
+    
+    console.log(`  Email sent successfully`);
+    console.log(`  Expected result: ${test.expectedResult}`);
+  }
+
+  await smtpClient.close();
+});
+
+tap.test('CSEC-05: DMARC policy enforcement', async () => {
+  // Test different DMARC policies
+  const policies = [
+    {
+      policy: 'none',
+      description: 'Monitor only - no action taken',
+      action: 'Deliver normally, send reports'
+    },
+    {
+      policy: 'quarantine',
+      description: 'Quarantine failing messages',
+      action: 'Move to spam/junk folder'
+    },
+    {
+      policy: 'reject',
+      description: 'Reject failing messages',
+      action: 'Bounce the message'
+    }
+  ];
+
+  console.log('\nDMARC Policy Actions:\n');
+  
+  for (const p of policies) {
+    console.log(`Policy: p=${p.policy}`);
+    console.log(`  Description: ${p.description}`);
+    console.log(`  Action: ${p.action}`);
+    console.log('');
+  }
+});
+
+tap.test('CSEC-05: DMARC deployment best practices', async () => {
+  // DMARC deployment phases
+  const deploymentPhases = [
+    {
+      phase: 1,
+      policy: 'p=none; rua=mailto:dmarc@example.com',
+      description: 'Monitor only - collect data'
+    },
+    {
+      phase: 2,
+      policy: 'p=quarantine; pct=10; rua=mailto:dmarc@example.com',
+      description: 'Quarantine 10% of failing messages'
+    },
+    {
+      phase: 3,
+      policy: 'p=reject; rua=mailto:dmarc@example.com',
+      description: 'Reject all failing messages'
+    }
+  ];
+
+  console.log('\nDMARC Deployment Best Practices:\n');
+  
+  for (const phase of deploymentPhases) {
+    console.log(`Phase ${phase.phase}: ${phase.description}`);
+    console.log(`  Record: v=DMARC1; ${phase.policy}`);
+    console.log('');
+  }
+});
+
+tap.test('CSEC-05: DMARC record lookup', async () => {
+  // Test real DMARC record lookups
+  const testDomains = ['paypal.com'];
+  
+  console.log('\nReal DMARC Record Lookups:\n');
+  
+  for (const domain of testDomains) {
+    const dmarcDomain = `_dmarc.${domain}`;
+    console.log(`Domain: ${domain}`);
+    
+    try {
+      const txtRecords = await resolveTxt(dmarcDomain);
+      const dmarcRecords = txtRecords
+        .map(record => record.join(''))
+        .filter(record => record.startsWith('v=DMARC1'));
+      
+      if (dmarcRecords.length > 0) {
+        const record = dmarcRecords[0];
+        console.log(`  Record found: ${record.substring(0, 50)}...`);
+        
+        // Parse key elements
+        const policyMatch = record.match(/p=(\w+)/);
+        if (policyMatch) console.log(`  Policy: ${policyMatch[1]}`);
+      } else {
+        console.log('  No DMARC record found');
+      }
+    } catch (error) {
+      console.log(`  Lookup failed: ${error.message}`);
+    }
+    console.log('');
+  }
+});
+
+tap.test('cleanup test SMTP server', async () => {
+  if (testServer) {
+    await stopTestServer(testServer);
+  }
+});
+
+tap.start();

package/test/suite/smtpclient_security/test.csec-06.certificate-validation.ts

@@ -0,0 +1,145 @@
+import { tap, expect } from '@git.zone/tstest/tapbundle';
+import { startTestServer, stopTestServer, type ITestServer, createTestServer as createSimpleTestServer } from '../../helpers/server.loader.js';
+import { createTestSmtpClient } from '../../helpers/smtp.client.js';
+import { Email } from '../../../ts/mail/core/classes.email.js';
+
+let testServer: ITestServer;
+
+tap.test('setup test SMTP server', async () => {
+  testServer = await startTestServer({
+    port: 2566,
+    tlsEnabled: true,
+    authRequired: false
+  });
+  expect(testServer).toBeTruthy();
+  expect(testServer.port).toBeGreaterThan(0);
+});
+
+tap.test('CSEC-06: Valid certificate acceptance', async () => {
+  const smtpClient = createTestSmtpClient({
+    host: testServer.hostname,
+    port: testServer.port,
+    secure: true,
+    tls: {
+      rejectUnauthorized: false  // Accept self-signed for test
+    }
+  });
+
+  const email = new Email({
+    from: 'sender@example.com',
+    to: ['recipient@example.com'],
+    subject: 'Valid certificate test',
+    text: 'Testing with valid TLS connection'
+  });
+
+  const result = await smtpClient.sendMail(email);
+  console.log(`Result: ${result.success ? 'Success' : 'Failed'}`);
+  console.log('Certificate accepted for secure connection');
+  expect(result.success).toBeTruthy();
+
+  await smtpClient.close();
+});
+
+tap.test('CSEC-06: Self-signed certificate handling', async () => {
+  // Test with strict validation (should fail)
+  const strictClient = createTestSmtpClient({
+    host: testServer.hostname,
+    port: testServer.port,
+    secure: true,
+    tls: {
+      rejectUnauthorized: true  // Reject self-signed
+    }
+  });
+
+  const email = new Email({
+    from: 'sender@example.com',
+    to: ['recipient@example.com'],
+    subject: 'Self-signed cert test',
+    text: 'Testing self-signed certificate rejection'
+  });
+
+  try {
+    await strictClient.sendMail(email);
+    console.log('Unexpected: Self-signed cert was accepted');
+  } catch (error) {
+    console.log(`Expected error: ${error.message}`);
+    expect(error.message).toInclude('self');
+  }
+
+  await strictClient.close();
+
+  // Test with relaxed validation (should succeed)
+  const relaxedClient = createTestSmtpClient({
+    host: testServer.hostname,
+    port: testServer.port,
+    secure: true,
+    tls: {
+      rejectUnauthorized: false  // Accept self-signed
+    }
+  });
+
+  const result = await relaxedClient.sendMail(email);
+  console.log('Self-signed cert accepted with relaxed validation');
+  expect(result.success).toBeTruthy();
+
+  await relaxedClient.close();
+});
+
+tap.test('CSEC-06: Certificate hostname verification', async () => {
+  const smtpClient = createTestSmtpClient({
+    host: testServer.hostname,
+    port: testServer.port,
+    secure: true,
+    tls: {
+      rejectUnauthorized: false,  // For self-signed
+      servername: testServer.hostname  // Verify hostname
+    }
+  });
+
+  const email = new Email({
+    from: 'sender@example.com',
+    to: ['recipient@example.com'],
+    subject: 'Hostname verification test',
+    text: 'Testing certificate hostname matching'
+  });
+
+  const result = await smtpClient.sendMail(email);
+  console.log('Hostname verification completed');
+  expect(result.success).toBeTruthy();
+
+  await smtpClient.close();
+});
+
+tap.test('CSEC-06: Certificate validation with custom CA', async () => {
+  const smtpClient = createTestSmtpClient({
+    host: testServer.hostname,
+    port: testServer.port,
+    secure: true,
+    tls: {
+      rejectUnauthorized: false,
+      // In production, would specify CA certificates
+      ca: undefined
+    }
+  });
+
+  const email = new Email({
+    from: 'sender@example.com',
+    to: ['recipient@example.com'],
+    subject: 'Certificate chain test',
+    text: 'Testing certificate chain validation'
+  });
+
+  const result = await smtpClient.sendMail(email);
+  console.log('Certificate chain validation completed');
+  expect(result.success).toBeTruthy();
+
+  await smtpClient.close();
+});
+
+tap.test('cleanup test SMTP server', async () => {
+  if (testServer) {
+    await stopTestServer(testServer);
+  }
+});
+
+tap.start();

package/test/suite/smtpclient_security/test.csec-07.cipher-suites.ts

@@ -0,0 +1,153 @@
+import { tap, expect } from '@git.zone/tstest/tapbundle';
+import { startTestServer, stopTestServer, type ITestServer } from '../../helpers/server.loader.js';
+import { createTestSmtpClient } from '../../helpers/smtp.client.js';
+import { Email } from '../../../ts/mail/core/classes.email.js';
+
+let testServer: ITestServer;
+
+tap.test('setup test SMTP server', async () => {
+  testServer = await startTestServer({
+    port: 2567,
+    tlsEnabled: true,
+    authRequired: false
+  });
+  expect(testServer).toBeTruthy();
+  expect(testServer.port).toBeGreaterThan(0);
+});
+
+tap.test('CSEC-07: Strong cipher suite negotiation', async () => {
+  const smtpClient = createTestSmtpClient({
+    host: testServer.hostname,
+    port: testServer.port,
+    secure: true,
+    tls: {
+      rejectUnauthorized: false,
+      // Prefer strong ciphers
+      ciphers: 'HIGH:!aNULL:!MD5:!3DES',
+      minVersion: 'TLSv1.2'
+    }
+  });
+
+  const email = new Email({
+    from: 'sender@example.com',
+    to: ['recipient@example.com'],
+    subject: 'Strong cipher test',
+    text: 'Testing with strong cipher suites'
+  });
+
+  const result = await smtpClient.sendMail(email);
+  console.log('Successfully negotiated strong cipher');
+  expect(result.success).toBeTruthy();
+
+  await smtpClient.close();
+});
+
+tap.test('CSEC-07: Cipher suite configuration', async () => {
+  // Test with specific cipher configuration
+  const smtpClient = createTestSmtpClient({
+    host: testServer.hostname,
+    port: testServer.port,
+    secure: true,
+    tls: {
+      rejectUnauthorized: false,
+      // Specify allowed ciphers
+      ciphers: 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256',
+      honorCipherOrder: true
+    }
+  });
+
+  const email = new Email({
+    from: 'sender@example.com',
+    to: ['recipient@example.com'],
+    subject: 'Cipher configuration test',
+    text: 'Testing specific cipher suite configuration'
+  });
+
+  const result = await smtpClient.sendMail(email);
+  console.log('Cipher configuration test completed');
+  expect(result.success).toBeTruthy();
+
+  await smtpClient.close();
+});
+
+tap.test('CSEC-07: Perfect Forward Secrecy ciphers', async () => {
+  const smtpClient = createTestSmtpClient({
+    host: testServer.hostname,
+    port: testServer.port,
+    secure: true,
+    tls: {
+      rejectUnauthorized: false,
+      // Prefer PFS ciphers
+      ciphers: 'ECDHE:DHE:!aNULL:!MD5',
+      ecdhCurve: 'auto'
+    }
+  });
+
+  const email = new Email({
+    from: 'sender@example.com',
+    to: ['recipient@example.com'],
+    subject: 'PFS cipher test',
+    text: 'Testing Perfect Forward Secrecy'
+  });
+
+  const result = await smtpClient.sendMail(email);
+  console.log('Successfully used PFS cipher');
+  expect(result.success).toBeTruthy();
+
+  await smtpClient.close();
+});
+
+tap.test('CSEC-07: Cipher compatibility testing', async () => {
+  const cipherConfigs = [
+    {
+      name: 'TLS 1.2 compatible',
+      ciphers: 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256',
+      minVersion: 'TLSv1.2'
+    },
+    {
+      name: 'Broad compatibility',
+      ciphers: 'HIGH:MEDIUM:!aNULL:!MD5:!3DES',
+      minVersion: 'TLSv1.2'
+    }
+  ];
+  
+  for (const config of cipherConfigs) {
+    console.log(`\nTesting ${config.name}...`);
+    
+    const smtpClient = createTestSmtpClient({
+      host: testServer.hostname,
+      port: testServer.port,
+      secure: true,
+      tls: {
+        rejectUnauthorized: false,
+        ciphers: config.ciphers,
+        minVersion: config.minVersion as any
+      }
+    });
+
+    const email = new Email({
+      from: 'sender@example.com',
+      to: ['recipient@example.com'],
+      subject: `${config.name} test`,
+      text: `Testing ${config.name} cipher configuration`
+    });
+
+    try {
+      const result = await smtpClient.sendMail(email);
+      console.log(`  Success with ${config.name}`);
+      expect(result.success).toBeTruthy();
+    } catch (error) {
+      console.log(`  ${config.name} not supported in this environment`);
+    }
+
+    await smtpClient.close();
+  }
+});
+
+tap.test('cleanup test SMTP server', async () => {
+  if (testServer) {
+    await stopTestServer(testServer);
+  }
+});
+
+tap.start();

package/test/suite/smtpclient_security/test.csec-08.authentication-fallback.ts

@@ -0,0 +1,154 @@
+import { tap, expect } from '@git.zone/tstest/tapbundle';
+import { startTestServer, stopTestServer, type ITestServer } from '../../helpers/server.loader.js';
+import { createTestSmtpClient } from '../../helpers/smtp.client.js';
+import { Email } from '../../../ts/mail/core/classes.email.js';
+
+let testServer: ITestServer;
+
+tap.test('setup test SMTP server', async () => {
+  testServer = await startTestServer({
+    port: 2568,
+    tlsEnabled: false,
+    authRequired: true
+  });
+  expect(testServer).toBeTruthy();
+  expect(testServer.port).toBeGreaterThan(0);
+});
+
+tap.test('CSEC-08: Multiple authentication methods', async () => {
+  const smtpClient = createTestSmtpClient({
+    host: testServer.hostname,
+    port: testServer.port,
+    secure: false,
+    auth: {
+      user: 'testuser',
+      pass: 'testpass'
+    }
+  });
+
+  const email = new Email({
+    from: 'sender@example.com',
+    to: ['recipient@example.com'],
+    subject: 'Multi-auth test',
+    text: 'Testing multiple authentication methods'
+  });
+
+  const result = await smtpClient.sendMail(email);
+  console.log('Authentication successful');
+  expect(result.success).toBeTruthy();
+
+  await smtpClient.close();
+});
+
+tap.test('CSEC-08: OAuth2 fallback to password auth', async () => {
+  // Test with OAuth2 token (will fail and fallback)
+  const oauthClient = createTestSmtpClient({
+    host: testServer.hostname,
+    port: testServer.port,
+    secure: false,
+    auth: {
+      oauth2: {
+        user: 'user@example.com',
+        clientId: 'test-client',
+        clientSecret: 'test-secret',
+        refreshToken: 'refresh-token',
+        accessToken: 'invalid-token'
+      }
+    }
+  });
+
+  const email = new Email({
+    from: 'sender@example.com',
+    to: ['recipient@example.com'],
+    subject: 'OAuth2 fallback test',
+    text: 'Testing OAuth2 authentication fallback'
+  });
+
+  try {
+    await oauthClient.sendMail(email);
+    console.log('OAuth2 authentication attempted');
+  } catch (error) {
+    console.log(`OAuth2 failed as expected: ${error.message}`);
+  }
+
+  await oauthClient.close();
+
+  // Test fallback to password auth
+  const fallbackClient = createTestSmtpClient({
+    host: testServer.hostname,
+    port: testServer.port,
+    secure: false,
+    auth: {
+      user: 'testuser',
+      pass: 'testpass'
+    }
+  });
+  
+  const result = await fallbackClient.sendMail(email);
+  console.log('Fallback authentication successful');
+  expect(result.success).toBeTruthy();
+
+  await fallbackClient.close();
+});
+
+tap.test('CSEC-08: Auth method preference', async () => {
+  // Test with specific auth method preference
+  const smtpClient = createTestSmtpClient({
+    host: testServer.hostname,
+    port: testServer.port,
+    secure: false,
+    auth: {
+      user: 'testuser',
+      pass: 'testpass',
+      method: 'PLAIN'  // Prefer PLAIN auth
+    }
+  });
+
+  const email = new Email({
+    from: 'sender@example.com',
+    to: ['recipient@example.com'],
+    subject: 'Auth preference test',
+    text: 'Testing authentication method preference'
+  });
+
+  const result = await smtpClient.sendMail(email);
+  console.log('Authentication with preferred method successful');
+  expect(result.success).toBeTruthy();
+
+  await smtpClient.close();
+});
+
+tap.test('CSEC-08: Secure auth requirements', async () => {
+  // Test authentication behavior with security requirements
+  const smtpClient = createTestSmtpClient({
+    host: testServer.hostname,
+    port: testServer.port,
+    secure: false,
+    auth: {
+      user: 'testuser',
+      pass: 'testpass'
+    },
+    requireTLS: false  // Allow auth over plain connection for test
+  });
+
+  const email = new Email({
+    from: 'sender@example.com',
+    to: ['recipient@example.com'],
+    subject: 'Secure auth test',
+    text: 'Testing secure authentication requirements'
+  });
+
+  const result = await smtpClient.sendMail(email);
+  console.log('Authentication completed');
+  expect(result.success).toBeTruthy();
+
+  await smtpClient.close();
+});
+
+tap.test('cleanup test SMTP server', async () => {
+  if (testServer) {
+    await stopTestServer(testServer);
+  }
+});
+
+tap.start();