@serve.zone/dcrouter 2.12.4

package/test/suite/smtpclient_security/test.csec-09.relay-restrictions.ts

@@ -0,0 +1,166 @@
+import { tap, expect } from '@git.zone/tstest/tapbundle';
+import { startTestServer, stopTestServer, type ITestServer } from '../../helpers/server.loader.js';
+import { createTestSmtpClient } from '../../helpers/smtp.client.js';
+import { Email } from '../../../ts/mail/core/classes.email.js';
+
+let testServer: ITestServer;
+
+tap.test('setup test SMTP server', async () => {
+  testServer = await startTestServer({
+    port: 2569,
+    tlsEnabled: false,
+    authRequired: false
+  });
+  expect(testServer).toBeTruthy();
+  expect(testServer.port).toBeGreaterThan(0);
+});
+
+tap.test('CSEC-09: Open relay prevention', async () => {
+  // Test unauthenticated relay attempt (should succeed for test server)
+  const unauthClient = createTestSmtpClient({
+    host: testServer.hostname,
+    port: testServer.port,
+    secure: false
+  });
+
+  const relayEmail = new Email({
+    from: 'external@untrusted.com',
+    to: ['recipient@another-external.com'],
+    subject: 'Relay test',
+    text: 'Testing open relay prevention'
+  });
+
+  const result = await unauthClient.sendMail(relayEmail);
+  console.log('Test server allows relay for testing purposes');
+  expect(result.success).toBeTruthy();
+
+  await unauthClient.close();
+});
+
+tap.test('CSEC-09: Authenticated relay', async () => {
+  // Test authenticated relay (should succeed)
+  const authClient = createTestSmtpClient({
+    host: testServer.hostname,
+    port: testServer.port,
+    secure: false,
+    auth: {
+      user: 'testuser',
+      pass: 'testpass'
+    }
+  });
+
+  const relayEmail = new Email({
+    from: 'sender@example.com',
+    to: ['recipient@external.com'],
+    subject: 'Authenticated relay test',
+    text: 'Testing authenticated relay'
+  });
+
+  const result = await authClient.sendMail(relayEmail);
+  console.log('Authenticated relay allowed');
+  expect(result.success).toBeTruthy();
+
+  await authClient.close();
+});
+
+tap.test('CSEC-09: Recipient count limits', async () => {
+  const smtpClient = createTestSmtpClient({
+    host: testServer.hostname,
+    port: testServer.port,
+    secure: false
+  });
+
+  // Test with multiple recipients
+  const manyRecipients = Array(10).fill(null).map((_, i) => `recipient${i + 1}@example.com`);
+  
+  const bulkEmail = new Email({
+    from: 'sender@example.com',
+    to: manyRecipients,
+    subject: 'Recipient limit test',
+    text: 'Testing recipient count limits'
+  });
+
+  const result = await smtpClient.sendMail(bulkEmail);
+  console.log(`Sent to ${result.acceptedRecipients.length} recipients`);
+  expect(result.success).toBeTruthy();
+  
+  // Check if any recipients were rejected
+  if (result.rejectedRecipients.length > 0) {
+    console.log(`${result.rejectedRecipients.length} recipients rejected`);
+  }
+
+  await smtpClient.close();
+});
+
+tap.test('CSEC-09: Sender domain verification', async () => {
+  const smtpClient = createTestSmtpClient({
+    host: testServer.hostname,
+    port: testServer.port,
+    secure: false
+  });
+
+  // Test with various sender domains
+  const senderTests = [
+    { from: 'sender@example.com', expected: true },
+    { from: 'sender@trusted.com', expected: true },
+    { from: 'sender@untrusted.com', expected: true } // Test server accepts all
+  ];
+
+  for (const test of senderTests) {
+    const email = new Email({
+      from: test.from,
+      to: ['recipient@example.com'],
+      subject: `Sender test from ${test.from}`,
+      text: 'Testing sender domain restrictions'
+    });
+
+    const result = await smtpClient.sendMail(email);
+    console.log(`Sender ${test.from}: ${result.success ? 'accepted' : 'rejected'}`);
+    expect(result.success).toEqual(test.expected);
+  }
+
+  await smtpClient.close();
+});
+
+tap.test('CSEC-09: Rate limiting simulation', async () => {
+  // Send multiple messages to test rate limiting
+  const results: boolean[] = [];
+  
+  for (let i = 0; i < 5; i++) {
+    const client = createTestSmtpClient({
+      host: testServer.hostname,
+      port: testServer.port,
+      secure: false
+    });
+    
+    const email = new Email({
+      from: 'sender@example.com',
+      to: ['recipient@example.com'],
+      subject: `Rate test ${i + 1}`,
+      text: `Testing rate limits - message ${i + 1}`
+    });
+    
+    try {
+      const result = await client.sendMail(email);
+      console.log(`Message ${i + 1}: Sent successfully`);
+      results.push(result.success);
+    } catch (error) {
+      console.log(`Message ${i + 1}: Failed`);
+      results.push(false);
+    }
+    
+    await client.close();
+  }
+  
+  const successCount = results.filter(r => r).length;
+  console.log(`Sent ${successCount}/${results.length} messages`);
+  expect(successCount).toBeGreaterThan(0);
+});
+
+tap.test('cleanup test SMTP server', async () => {
+  if (testServer) {
+    await stopTestServer(testServer);
+  }
+});
+
+tap.start();

package/test/suite/smtpclient_security/test.csec-10.anti-spam-measures.ts

@@ -0,0 +1,196 @@
+import { tap, expect } from '@git.zone/tstest/tapbundle';
+import { startTestServer, stopTestServer, type ITestServer } from '../../helpers/server.loader.js';
+import { createTestSmtpClient } from '../../helpers/smtp.client.js';
+import { Email } from '../../../ts/mail/core/classes.email.js';
+
+let testServer: ITestServer;
+
+tap.test('setup test SMTP server', async () => {
+  testServer = await startTestServer({
+    port: 2570,
+    tlsEnabled: false,
+    authRequired: false
+  });
+  expect(testServer).toBeTruthy();
+  expect(testServer.port).toBeGreaterThan(0);
+});
+
+tap.test('CSEC-10: Reputation-based filtering', async () => {
+  const smtpClient = createTestSmtpClient({
+    host: testServer.hostname,
+    port: testServer.port,
+    secure: false
+  });
+
+  const email = new Email({
+    from: 'sender@example.com',
+    to: ['recipient@example.com'],
+    subject: 'Reputation test',
+    text: 'Testing reputation-based filtering'
+  });
+
+  const result = await smtpClient.sendMail(email);
+  console.log('Good reputation: Message accepted');
+  expect(result.success).toBeTruthy();
+
+  await smtpClient.close();
+});
+
+tap.test('CSEC-10: Content filtering and spam scoring', async () => {
+  const smtpClient = createTestSmtpClient({
+    host: testServer.hostname,
+    port: testServer.port,
+    secure: false
+  });
+
+  // Test 1: Clean email
+  const cleanEmail = new Email({
+    from: 'sender@example.com',
+    to: ['recipient@example.com'],
+    subject: 'Business proposal',
+    text: 'I would like to discuss our upcoming project. Please let me know your availability.'
+  });
+
+  const cleanResult = await smtpClient.sendMail(cleanEmail);
+  console.log('Clean email: Accepted');
+  expect(cleanResult.success).toBeTruthy();
+
+  // Test 2: Email with spam-like content
+  const spamEmail = new Email({
+    from: 'sender@example.com',
+    to: ['recipient@example.com'],
+    subject: 'You are a WINNER!',
+    text: 'Click here to claim your lottery prize! Act now! 100% guarantee!'
+  });
+
+  const spamResult = await smtpClient.sendMail(spamEmail);
+  console.log('Spam-like email: Processed by server');
+  expect(spamResult.success).toBeTruthy();
+
+  await smtpClient.close();
+});
+
+tap.test('CSEC-10: Greylisting simulation', async () => {
+  const smtpClient = createTestSmtpClient({
+    host: testServer.hostname,
+    port: testServer.port,
+    secure: false
+  });
+
+  const email = new Email({
+    from: 'sender@example.com',
+    to: ['recipient@example.com'],
+    subject: 'Greylist test',
+    text: 'Testing greylisting mechanism'
+  });
+
+  // Test server doesn't implement greylisting, so this should succeed
+  const result = await smtpClient.sendMail(email);
+  console.log('Email sent (greylisting not active on test server)');
+  expect(result.success).toBeTruthy();
+
+  await smtpClient.close();
+});
+
+tap.test('CSEC-10: DNS blacklist checking', async () => {
+  const smtpClient = createTestSmtpClient({
+    host: testServer.hostname,
+    port: testServer.port,
+    secure: false
+  });
+
+  // Test with various domains
+  const testDomains = [
+    { from: 'sender@clean-domain.com', expected: true },
+    { from: 'sender@spam-domain.com', expected: true } // Test server accepts all
+  ];
+
+  for (const test of testDomains) {
+    const email = new Email({
+      from: test.from,
+      to: ['recipient@example.com'],
+      subject: 'DNSBL test',
+      text: 'Testing DNSBL checking'
+    });
+
+    const result = await smtpClient.sendMail(email);
+    console.log(`Sender ${test.from}: ${result.success ? 'accepted' : 'rejected'}`);
+    expect(result.success).toBeTruthy();
+  }
+
+  await smtpClient.close();
+});
+
+tap.test('CSEC-10: Connection behavior analysis', async () => {
+  // Test normal behavior
+  const smtpClient = createTestSmtpClient({
+    host: testServer.hostname,
+    port: testServer.port,
+    secure: false
+  });
+
+  const email = new Email({
+    from: 'sender@example.com',
+    to: ['recipient@example.com'],
+    subject: 'Behavior test',
+    text: 'Testing normal email sending behavior'
+  });
+
+  const result = await smtpClient.sendMail(email);
+  console.log('Normal behavior: Accepted');
+  expect(result.success).toBeTruthy();
+
+  await smtpClient.close();
+});
+
+tap.test('CSEC-10: Attachment scanning', async () => {
+  const smtpClient = createTestSmtpClient({
+    host: testServer.hostname,
+    port: testServer.port,
+    secure: false
+  });
+
+  // Test 1: Safe attachment
+  const safeEmail = new Email({
+    from: 'sender@example.com',
+    to: ['recipient@example.com'],
+    subject: 'Document for review',
+    text: 'Please find the attached document.',
+    attachments: [{
+      filename: 'report.pdf',
+      content: Buffer.from('PDF content here'),
+      contentType: 'application/pdf'
+    }]
+  });
+
+  const safeResult = await smtpClient.sendMail(safeEmail);
+  console.log('Safe attachment: Accepted');
+  expect(safeResult.success).toBeTruthy();
+
+  // Test 2: Potentially dangerous attachment (test server accepts all)
+  const exeEmail = new Email({
+    from: 'sender@example.com',
+    to: ['recipient@example.com'],
+    subject: 'Important update',
+    text: 'Please run the attached file',
+    attachments: [{
+      filename: 'update.exe',
+      content: Buffer.from('MZ\x90\x00\x03'),  // Fake executable header
+      contentType: 'application/octet-stream'
+    }]
+  });
+
+  const exeResult = await smtpClient.sendMail(exeEmail);
+  console.log('Executable attachment: Processed by server');
+  expect(exeResult.success).toBeTruthy();
+
+  await smtpClient.close();
+});
+
+tap.test('cleanup test SMTP server', async () => {
+  if (testServer) {
+    await stopTestServer(testServer);
+  }
+});
+
+tap.start();

package/test/suite/smtpserver_commands/test.cmd-01.ehlo-command.ts

@@ -0,0 +1,193 @@
+import { tap, expect } from '@git.zone/tstest/tapbundle';
+import * as net from 'net';
+import { startTestServer, stopTestServer } from '../../helpers/server.loader.js';
+
+const TEST_PORT = 2525;
+
+let testServer;
+const TEST_TIMEOUT = 10000;
+
+tap.test('prepare server', async () => {
+  testServer = await startTestServer({ port: TEST_PORT });
+  await new Promise(resolve => setTimeout(resolve, 100));
+});
+
+tap.test('CMD-01: EHLO Command - server responds with proper capabilities', async (tools) => {
+  const done = tools.defer();
+  
+  const socket = net.createConnection({
+    host: 'localhost',
+    port: TEST_PORT,
+    timeout: TEST_TIMEOUT
+  });
+  
+  let receivedData = '';
+  let currentStep = 'connecting';
+  
+  socket.on('data', (data) => {
+    receivedData += data.toString();
+    
+    if (currentStep === 'connecting' && receivedData.includes('220')) {
+      currentStep = 'ehlo';
+      receivedData = ''; // Clear buffer
+      socket.write('EHLO test.example.com\r\n');
+    } else if (currentStep === 'ehlo' && receivedData.includes('250 ')) {
+      // Parse response - only lines that start with 250
+      const lines = receivedData.split('\r\n')
+        .filter(line => line.startsWith('250'))
+        .filter(line => line.length > 0);
+      
+      // Check for required ESMTP extensions
+      const capabilities = lines.map(line => line.substring(4).trim());
+      console.log('📋 Server capabilities:', capabilities);
+      
+      // Verify essential capabilities
+      expect(capabilities.some(cap => cap.includes('SIZE'))).toBeTruthy();
+      expect(capabilities.some(cap => cap.includes('8BITMIME'))).toBeTruthy();
+      
+      // The last line should be "250 " (without hyphen)
+      const lastLine = lines[lines.length - 1];
+      expect(lastLine.startsWith('250 ')).toBeTruthy();
+      
+      currentStep = 'quit';
+      receivedData = ''; // Clear buffer
+      socket.write('QUIT\r\n');
+    } else if (currentStep === 'quit' && receivedData.includes('221')) {
+      socket.destroy();
+      done.resolve();
+    }
+  });
+  
+  socket.on('error', (error) => {
+    done.reject(error);
+  });
+  
+  socket.on('timeout', () => {
+    socket.destroy();
+    done.reject(new Error(`Connection timeout at step: ${currentStep}`));
+  });
+  
+  await done.promise;
+});
+
+tap.test('CMD-01: EHLO with invalid hostname - server handles gracefully', async (tools) => {
+  const done = tools.defer();
+  
+  const socket = net.createConnection({
+    host: 'localhost',
+    port: TEST_PORT,
+    timeout: TEST_TIMEOUT
+  });
+  
+  let receivedData = '';
+  let currentStep = 'connecting';
+  let testIndex = 0;
+  
+  const invalidHostnames = [
+    '',                    // Empty hostname
+    ' ',                  // Whitespace only
+    'invalid..hostname',  // Double dots
+    '.invalid',          // Leading dot
+    'invalid.',          // Trailing dot
+    'very-long-hostname-that-exceeds-reasonable-limits-' + 'x'.repeat(200)
+  ];
+  
+  socket.on('data', (data) => {
+    receivedData += data.toString();
+    
+    if (currentStep === 'connecting' && receivedData.includes('220')) {
+      currentStep = 'testing';
+      receivedData = ''; // Clear buffer
+      console.log(`Testing invalid hostname: "${invalidHostnames[testIndex]}"`);
+      socket.write(`EHLO ${invalidHostnames[testIndex]}\r\n`);
+    } else if (currentStep === 'testing' && (receivedData.includes('250') || receivedData.includes('5'))) {
+      // Server should either accept with warning or reject with 5xx
+      expect(receivedData).toMatch(/^(250|5\d\d)/);
+      
+      testIndex++;
+      if (testIndex < invalidHostnames.length) {
+        currentStep = 'reset';
+        receivedData = ''; // Clear buffer
+        socket.write('RSET\r\n');
+      } else {
+        socket.write('QUIT\r\n');
+        setTimeout(() => {
+          socket.destroy();
+          done.resolve();
+        }, 100);
+      }
+    } else if (currentStep === 'reset' && receivedData.includes('250')) {
+      currentStep = 'testing';
+      receivedData = ''; // Clear buffer
+      console.log(`Testing invalid hostname: "${invalidHostnames[testIndex]}"`);
+      socket.write(`EHLO ${invalidHostnames[testIndex]}\r\n`);
+    }
+  });
+  
+  socket.on('error', (error) => {
+    done.reject(error);
+  });
+  
+  socket.on('timeout', () => {
+    socket.destroy();
+    done.reject(new Error(`Connection timeout at step: ${currentStep}`));
+  });
+  
+  await done.promise;
+});
+
+tap.test('CMD-01: EHLO command pipelining - multiple EHLO commands', async (tools) => {
+  const done = tools.defer();
+  
+  const socket = net.createConnection({
+    host: 'localhost',
+    port: TEST_PORT,
+    timeout: TEST_TIMEOUT
+  });
+  
+  let receivedData = '';
+  let currentStep = 'connecting';
+  
+  socket.on('data', (data) => {
+    receivedData += data.toString();
+    
+    if (currentStep === 'connecting' && receivedData.includes('220')) {
+      currentStep = 'first_ehlo';
+      receivedData = ''; // Clear buffer
+      socket.write('EHLO first.example.com\r\n');
+    } else if (currentStep === 'first_ehlo' && receivedData.includes('250 ')) {
+      currentStep = 'second_ehlo';
+      receivedData = ''; // Clear buffer
+      // Second EHLO (should reset session)
+      socket.write('EHLO second.example.com\r\n');
+    } else if (currentStep === 'second_ehlo' && receivedData.includes('250 ')) {
+      currentStep = 'mail_from';
+      receivedData = ''; // Clear buffer
+      // Verify session was reset by trying MAIL FROM
+      socket.write('MAIL FROM:<test@example.com>\r\n');
+    } else if (currentStep === 'mail_from' && receivedData.includes('250')) {
+      socket.write('QUIT\r\n');
+      setTimeout(() => {
+        socket.destroy();
+        done.resolve();
+      }, 100);
+    }
+  });
+  
+  socket.on('error', (error) => {
+    done.reject(error);
+  });
+  
+  socket.on('timeout', () => {
+    socket.destroy();
+    done.reject(new Error(`Connection timeout at step: ${currentStep}`));
+  });
+  
+  await done.promise;
+});
+
+tap.test('cleanup server', async () => {
+  await stopTestServer(testServer);
+});
+
+export default tap.start();