@serve.zone/dcrouter 2.12.4

package/test/suite/smtpserver_rfc-compliance/test.rfc-07.rfc3461-dsn-compliance.ts

@@ -0,0 +1,399 @@
+import { tap, expect } from '@git.zone/tstest/tapbundle';
+import * as plugins from '../../../ts/plugins.js';
+import * as net from 'net';
+import { startTestServer, stopTestServer } from '../../helpers/server.loader.js'
+import type { ITestServer } from '../../helpers/server.loader.js';
+
+const TEST_PORT = 2525;
+let testServer: ITestServer;
+
+// Helper function to wait for SMTP response
+const waitForResponse = (socket: net.Socket, expectedCode?: string, timeout = 5000): Promise<string> => {
+  return new Promise((resolve, reject) => {
+    let buffer = '';
+    const timer = setTimeout(() => {
+      socket.removeListener('data', handler);
+      reject(new Error(`Timeout waiting for ${expectedCode || 'any'} response`));
+    }, timeout);
+    
+    const handler = (data: Buffer) => {
+      buffer += data.toString();
+      const lines = buffer.split('\r\n');
+      
+      // Check if we have a complete response
+      for (const line of lines) {
+        if (expectedCode) {
+          if (line.startsWith(expectedCode + ' ')) {
+            clearTimeout(timer);
+            socket.removeListener('data', handler);
+            resolve(buffer);
+            return;
+          }
+        } else {
+          // Any complete response line
+          if (line.match(/^\d{3} /)) {
+            clearTimeout(timer);
+            socket.removeListener('data', handler);
+            resolve(buffer);
+            return;
+          }
+        }
+      }
+    };
+    
+    socket.on('data', handler);
+  });
+};
+
+tap.test('setup - start test server', async (toolsArg) => {
+  testServer = await startTestServer({ port: TEST_PORT });
+  await toolsArg.delayFor(1000);
+});
+
+tap.test('RFC 3461 DSN - DSN extension advertised', async (tools) => {
+  const done = tools.defer();
+  
+  try {
+    const socket = net.createConnection({
+      host: 'localhost',
+      port: TEST_PORT,
+      timeout: 30000
+    });
+    
+    await new Promise<void>((resolve, reject) => {
+      socket.once('connect', resolve);
+      socket.once('error', reject);
+    });
+    
+    // Read greeting
+    const greeting = await waitForResponse(socket, '220');
+    console.log('Server response:', greeting);
+    
+    // Send EHLO
+    socket.write('EHLO testclient\r\n');
+    const ehloResponse = await waitForResponse(socket, '250');
+    console.log('Server response:', ehloResponse);
+    
+    // Check if DSN extension is advertised
+    const advertisesDsn = ehloResponse.toLowerCase().includes('dsn');
+    console.log('DSN extension advertised:', advertisesDsn);
+    
+    // Parse extensions
+    const lines = ehloResponse.split('\r\n');
+    const extensions = lines
+      .filter(line => line.startsWith('250-') || (line.startsWith('250 ') && lines.indexOf(line) > 0))
+      .map(line => line.substring(4).split(' ')[0].toUpperCase());
+    
+    console.log('Server extensions:', extensions);
+    
+    socket.write('QUIT\r\n');
+    await waitForResponse(socket, '221');
+    socket.end();
+    done.resolve();
+  } catch (error) {
+    console.error('Socket error:', error);
+    done.reject(error);
+  }
+});
+
+tap.test('RFC 3461 DSN - MAIL FROM with DSN parameters', async (tools) => {
+  const done = tools.defer();
+  
+  try {
+    const socket = net.createConnection({
+      host: 'localhost',
+      port: TEST_PORT,
+      timeout: 30000
+    });
+    
+    await new Promise<void>((resolve, reject) => {
+      socket.once('connect', resolve);
+      socket.once('error', reject);
+    });
+    
+    // Read greeting
+    const greeting = await waitForResponse(socket, '220');
+    console.log('Server response:', greeting);
+    
+    // Send EHLO
+    socket.write('EHLO testclient\r\n');
+    const ehloResponse = await waitForResponse(socket, '250');
+    console.log('Server response:', ehloResponse);
+    
+    // Test MAIL FROM with DSN parameters (RFC 3461)
+    socket.write('MAIL FROM:<sender@example.com> RET=FULL ENVID=test-envelope-123\r\n');
+    const mailResponse = await waitForResponse(socket);
+    console.log('Server response:', mailResponse);
+    
+    // Server should either accept (250) or reject with proper error
+    const accepted = mailResponse.includes('250');
+    const properlyRejected = mailResponse.includes('501') || mailResponse.includes('555');
+    
+    expect(accepted || properlyRejected).toEqual(true);
+    console.log(`DSN parameters in MAIL FROM ${accepted ? 'accepted' : 'rejected'}`);
+    
+    if (accepted) {
+      // Reset to test other parameters
+      socket.write('RSET\r\n');
+      const resetResponse = await waitForResponse(socket, '250');
+      console.log('Server response:', resetResponse);
+      
+      // Test with RET=HDRS
+      socket.write('MAIL FROM:<sender@example.com> RET=HDRS\r\n');
+      const mailHdrsResponse = await waitForResponse(socket);
+      console.log('Server response:', mailHdrsResponse);
+      
+      const hdrsAccepted = mailHdrsResponse.includes('250');
+      console.log(`RET=HDRS parameter ${hdrsAccepted ? 'accepted' : 'rejected'}`);
+    }
+    
+    socket.write('QUIT\r\n');
+    await waitForResponse(socket, '221');
+    socket.end();
+    done.resolve();
+  } catch (error) {
+    console.error('Socket error:', error);
+    done.reject(error);
+  }
+});
+
+tap.test('RFC 3461 DSN - RCPT TO with DSN parameters', async (tools) => {
+  const done = tools.defer();
+  
+  try {
+    const socket = net.createConnection({
+      host: 'localhost',
+      port: TEST_PORT,
+      timeout: 30000
+    });
+    
+    await new Promise<void>((resolve, reject) => {
+      socket.once('connect', resolve);
+      socket.once('error', reject);
+    });
+    
+    // Read greeting
+    const greeting = await waitForResponse(socket, '220');
+    console.log('Server response:', greeting);
+    
+    // Send EHLO
+    socket.write('EHLO testclient\r\n');
+    const ehloResponse = await waitForResponse(socket, '250');
+    console.log('Server response:', ehloResponse);
+    
+    // Send MAIL FROM
+    socket.write('MAIL FROM:<sender@example.com>\r\n');
+    const mailResponse = await waitForResponse(socket, '250');
+    console.log('Server response:', mailResponse);
+    
+    // Test RCPT TO with DSN parameters
+    socket.write('RCPT TO:<recipient@example.com> NOTIFY=SUCCESS,FAILURE ORCPT=rfc822;recipient@example.com\r\n');
+    const rcptResponse = await waitForResponse(socket);
+    console.log('Server response:', rcptResponse);
+    
+    // Server should either accept (250) or reject with proper error
+    const accepted = rcptResponse.includes('250');
+    const properlyRejected = rcptResponse.includes('501') || rcptResponse.includes('555');
+    
+    expect(accepted || properlyRejected).toEqual(true);
+    console.log(`DSN parameters in RCPT TO ${accepted ? 'accepted' : 'rejected'}`);
+    
+    if (accepted) {
+      // Reset to test other notify values
+      socket.write('RSET\r\n');
+      const resetResponse = await waitForResponse(socket, '250');
+      console.log('Server response:', resetResponse);
+      
+      // Send MAIL FROM again
+      socket.write('MAIL FROM:<sender@example.com>\r\n');
+      const mail2Response = await waitForResponse(socket, '250');
+      console.log('Server response:', mail2Response);
+      
+      // Test NOTIFY=NEVER
+      socket.write('RCPT TO:<recipient@example.com> NOTIFY=NEVER\r\n');
+      const rcptNeverResponse = await waitForResponse(socket);
+      console.log('Server response:', rcptNeverResponse);
+      
+      const neverAccepted = rcptNeverResponse.includes('250');
+      console.log(`NOTIFY=NEVER parameter ${neverAccepted ? 'accepted' : 'rejected'}`);
+    }
+    
+    socket.write('QUIT\r\n');
+    await waitForResponse(socket, '221');
+    socket.end();
+    done.resolve();
+  } catch (error) {
+    console.error('Socket error:', error);
+    done.reject(error);
+  }
+});
+
+tap.test('RFC 3461 DSN - Complete DSN-enabled email', async (tools) => {
+  const done = tools.defer();
+  
+  const socket = net.createConnection({
+    host: 'localhost',
+    port: TEST_PORT,
+    timeout: 30000
+  });
+  
+  socket.on('error', (err) => {
+    console.error('Socket error:', err);
+    done.reject(err);
+  });
+  
+  socket.on('connect', async () => {
+    try {
+      // Wait for greeting
+      await waitForResponse(socket, '220');
+      
+      // Send EHLO
+      socket.write('EHLO testclient\r\n');
+      await waitForResponse(socket, '250');
+      
+      // Try with DSN parameters
+      socket.write('MAIL FROM:<sender@example.com> RET=FULL ENVID=test123\r\n');
+      const mailResponse = await waitForResponse(socket);
+      
+      if (mailResponse.includes('250')) {
+        // DSN parameters accepted, continue with DSN RCPT
+        socket.write('RCPT TO:<recipient@example.com> NOTIFY=SUCCESS,FAILURE,DELAY\r\n');
+        const rcptResponse = await waitForResponse(socket);
+        
+        if (!rcptResponse.includes('250')) {
+          // Fallback to plain RCPT if DSN parameters not supported
+          console.log('DSN RCPT parameters not supported, using plain RCPT TO');
+          socket.write('RCPT TO:<recipient@example.com>\r\n');
+          await waitForResponse(socket, '250');
+        }
+      } else if (mailResponse.includes('501') || mailResponse.includes('555')) {
+        // DSN not supported, use plain MAIL FROM
+        console.log('DSN parameters not supported, using plain MAIL FROM');
+        socket.write('MAIL FROM:<sender@example.com>\r\n');
+        await waitForResponse(socket, '250');
+        
+        socket.write('RCPT TO:<recipient@example.com>\r\n');
+        await waitForResponse(socket, '250');
+      }
+      
+      // Send DATA
+      socket.write('DATA\r\n');
+      await waitForResponse(socket, '354');
+      
+      // Send email content
+      const email = [
+        `From: sender@example.com`,
+        `To: recipient@example.com`,
+        `Subject: RFC 3461 DSN Compliance Test`,
+        `Date: ${new Date().toUTCString()}`,
+        `Message-ID: <dsn-test-${Date.now()}@example.com>`,
+        '',
+        'This email tests RFC 3461 DSN (Delivery Status Notification) compliance.',
+        'The server should handle DSN parameters according to RFC 3461.',
+        '.',
+        ''
+      ].join('\r\n');
+      
+      socket.write(email);
+      await waitForResponse(socket, '250');
+      
+      console.log('DSN-enabled email accepted');
+      
+      // Quit
+      socket.write('QUIT\r\n');
+      await waitForResponse(socket, '221');
+      
+      socket.end();
+      done.resolve();
+    } catch (err) {
+      console.error('Test error:', err);
+      socket.end();
+      done.reject(err);
+    }
+  });
+  
+  await done.promise;
+});
+
+tap.test('RFC 3461 DSN - Invalid DSN parameter handling', async (tools) => {
+  const done = tools.defer();
+  
+  const socket = net.createConnection({
+    host: 'localhost',
+    port: TEST_PORT,
+    timeout: 30000
+  });
+  
+  socket.on('error', (err) => {
+    console.error('Socket error:', err);
+    done.reject(err);
+  });
+  
+  socket.on('connect', async () => {
+    try {
+      // Wait for greeting
+      await waitForResponse(socket, '220');
+      
+      // Send EHLO
+      socket.write('EHLO testclient\r\n');
+      await waitForResponse(socket, '250');
+      
+      // Test with invalid RET value
+      socket.write('MAIL FROM:<sender@example.com> RET=INVALID\r\n');
+      const mailResponse = await waitForResponse(socket);
+      
+      // Should reject with 501 or similar
+      const properlyRejected = mailResponse.includes('501') || 
+                              mailResponse.includes('555') ||
+                              mailResponse.includes('500');
+      
+      if (properlyRejected) {
+        console.log('Invalid RET parameter properly rejected');
+        expect(true).toEqual(true);
+      } else if (mailResponse.includes('250')) {
+        // Server ignores unknown parameters (also acceptable)
+        console.log('Server ignores invalid DSN parameters');
+      }
+      
+      // Reset and test invalid NOTIFY
+      socket.write('RSET\r\n');
+      await waitForResponse(socket, '250');
+      
+      socket.write('MAIL FROM:<sender@example.com>\r\n');
+      await waitForResponse(socket, '250');
+      
+      // Test with invalid NOTIFY value
+      socket.write('RCPT TO:<recipient@example.com> NOTIFY=INVALID\r\n');
+      const rcptResponse = await waitForResponse(socket);
+      
+      const rcptRejected = rcptResponse.includes('501') || 
+                          rcptResponse.includes('555') ||
+                          rcptResponse.includes('500');
+      
+      if (rcptRejected) {
+        console.log('Invalid NOTIFY parameter properly rejected');
+      } else if (rcptResponse.includes('250')) {
+        console.log('Server ignores invalid NOTIFY parameter');
+      }
+      
+      // Quit
+      socket.write('QUIT\r\n');
+      await waitForResponse(socket, '221');
+      
+      socket.end();
+      done.resolve();
+    } catch (err) {
+      console.error('Test error:', err);
+      socket.end();
+      done.reject(err);
+    }
+  });
+  
+  await done.promise;
+});
+
+tap.test('cleanup - stop test server', async () => {
+  await stopTestServer(testServer);
+});
+
+export default tap.start();

package/test/suite/smtpserver_security/test.sec-01.authentication.ts

@@ -0,0 +1,218 @@
+import { tap, expect } from '@git.zone/tstest/tapbundle';
+import { startTestServer, stopTestServer, type ITestServer } from '../../helpers/server.loader.js';
+import { connectToSmtp, waitForGreeting, sendSmtpCommand, closeSmtpConnection } from '../../helpers/utils.js';
+
+let testServer: ITestServer;
+
+tap.test('setup - start SMTP server with authentication', async () => {
+  testServer = await startTestServer({
+    port: 2530,
+    hostname: 'localhost',
+    authRequired: true
+  });
+  expect(testServer).toBeInstanceOf(Object);
+});
+
+tap.test('SEC-01: Authentication - server advertises AUTH capability', async () => {
+  const socket = await connectToSmtp(testServer.hostname, testServer.port);
+  
+  try {
+    await waitForGreeting(socket);
+    
+    // Send EHLO to get capabilities
+    const ehloResponse = await sendSmtpCommand(socket, 'EHLO test.example.com', '250');
+    
+    // Parse capabilities
+    const lines = ehloResponse.split('\r\n').filter(line => line.length > 0);
+    const capabilities = lines.map(line => line.substring(4).trim());
+    
+    // Check for AUTH capability
+    const authCapability = capabilities.find(cap => cap.startsWith('AUTH'));
+    expect(authCapability).toBeDefined();
+    
+    // Extract supported mechanisms
+    const supportedMechanisms = authCapability?.substring(5).split(' ') || [];
+    console.log('📋 Supported AUTH mechanisms:', supportedMechanisms);
+    
+    // Common mechanisms should be supported
+    expect(supportedMechanisms).toContain('PLAIN');
+    expect(supportedMechanisms).toContain('LOGIN');
+    
+    console.log('✅ AUTH capability test passed');
+    
+  } finally {
+    await closeSmtpConnection(socket);
+  }
+});
+
+tap.test('SEC-01: AUTH PLAIN mechanism - correct credentials', async () => {
+  const socket = await connectToSmtp(testServer.hostname, testServer.port);
+  
+  try {
+    await waitForGreeting(socket);
+    await sendSmtpCommand(socket, 'EHLO test.example.com', '250');
+    
+    // Create AUTH PLAIN credentials
+    // Format: base64(NULL + username + NULL + password)
+    const username = 'testuser';
+    const password = 'testpass';
+    const authString = Buffer.from(`\0${username}\0${password}`).toString('base64');
+    
+    // Send AUTH PLAIN command
+    try {
+      const authResponse = await sendSmtpCommand(socket, `AUTH PLAIN ${authString}`);
+      // Server might accept (235) or reject (535) based on configuration
+      expect(authResponse).toMatch(/^(235|535)/);
+      
+      if (authResponse.startsWith('235')) {
+        console.log('✅ AUTH PLAIN accepted (test mode)');
+      } else {
+        console.log('✅ AUTH PLAIN properly rejected (production mode)');
+      }
+    } catch (error) {
+      // Auth failure is expected in test environment
+      console.log('✅ AUTH PLAIN handled:', error.message);
+    }
+    
+  } finally {
+    await closeSmtpConnection(socket);
+  }
+});
+
+tap.test('SEC-01: AUTH LOGIN mechanism - interactive authentication', async () => {
+  const socket = await connectToSmtp(testServer.hostname, testServer.port);
+  
+  try {
+    await waitForGreeting(socket);
+    await sendSmtpCommand(socket, 'EHLO test.example.com', '250');
+    
+    // Start AUTH LOGIN
+    try {
+      const authStartResponse = await sendSmtpCommand(socket, 'AUTH LOGIN', '334');
+      expect(authStartResponse).toInclude('334');
+      
+      // Server should prompt for username (base64 "Username:")
+      const usernamePrompt = Buffer.from(
+        authStartResponse.substring(4).trim(), 
+        'base64'
+      ).toString();
+      console.log('Server prompt:', usernamePrompt);
+      
+      // Send username
+      const username = Buffer.from('testuser').toString('base64');
+      const passwordPromptResponse = await sendSmtpCommand(socket, username, '334');
+      
+      // Send password
+      const password = Buffer.from('testpass').toString('base64');
+      const authResult = await sendSmtpCommand(socket, password);
+      
+      // Check result (235 = success, 535 = failure)
+      expect(authResult).toMatch(/^(235|535)/);
+      
+    } catch (error) {
+      // Auth failure is expected in test environment
+      console.log('✅ AUTH LOGIN handled:', error.message);
+    }
+    
+  } finally {
+    await closeSmtpConnection(socket);
+  }
+});
+
+tap.test('SEC-01: Authentication required - reject commands without auth', async () => {
+  const socket = await connectToSmtp(testServer.hostname, testServer.port);
+  
+  try {
+    await waitForGreeting(socket);
+    await sendSmtpCommand(socket, 'EHLO test.example.com', '250');
+    
+    // Try to send email without authentication
+    try {
+      const mailResponse = await sendSmtpCommand(socket, 'MAIL FROM:<test@example.com>');
+      
+      // Server should reject with 530 (authentication required) or similar
+      if (mailResponse.startsWith('530') || mailResponse.startsWith('503')) {
+        console.log('✅ Server properly requires authentication');
+      } else if (mailResponse.startsWith('250')) {
+        console.log('⚠️ Server accepted mail without auth (test mode)');
+      }
+      
+    } catch (error) {
+      // Command rejection is expected
+      console.log('✅ Server rejected unauthenticated command:', error.message);
+    }
+    
+  } finally {
+    await closeSmtpConnection(socket);
+  }
+});
+
+tap.test('SEC-01: Invalid authentication attempts - rate limiting', async () => {
+  const socket = await connectToSmtp(testServer.hostname, testServer.port);
+  
+  try {
+    await waitForGreeting(socket);
+    await sendSmtpCommand(socket, 'EHLO test.example.com', '250');
+    
+    // Try multiple failed authentication attempts
+    const maxAttempts = 5;
+    let failedAttempts = 0;
+    let requiresTLS = false;
+    
+    for (let i = 0; i < maxAttempts; i++) {
+      try {
+        // Send invalid credentials
+        const invalidAuth = Buffer.from('\0invalid\0wrong').toString('base64');
+        const response = await sendSmtpCommand(socket, `AUTH PLAIN ${invalidAuth}`);
+        
+        // Check if authentication failed
+        if (response.startsWith('535')) {
+          failedAttempts++;
+          console.log(`Failed attempt ${i + 1}: ${response.trim()}`);
+          
+          // Check if server requires TLS (common security practice)
+          if (response.includes('TLS')) {
+            requiresTLS = true;
+            console.log('✅ Server enforces TLS requirement for authentication');
+            break;
+          }
+        } else if (response.startsWith('503')) {
+          // Too many failed attempts
+          failedAttempts++;
+          console.log('✅ Server enforces auth attempt limits');
+          break;
+        }
+      } catch (error) {
+        // Handle connection errors
+        failedAttempts++;
+        console.log(`Failed attempt ${i + 1}: ${error.message}`);
+        
+        // Check if server closed connection or rate limited
+        if (error.message.includes('closed') || error.message.includes('timeout')) {
+          console.log('✅ Server enforces auth attempt limits by closing connection');
+          break;
+        }
+      }
+    }
+    
+    // Either TLS is required or we had failed attempts
+    expect(failedAttempts).toBeGreaterThan(0);
+    if (requiresTLS) {
+      console.log('✅ Authentication properly protected by TLS requirement');
+    } else {
+      console.log(`✅ Handled ${failedAttempts} failed auth attempts`);
+    }
+    
+  } finally {
+    if (!socket.destroyed) {
+      socket.destroy();
+    }
+  }
+});
+
+tap.test('cleanup - stop SMTP server', async () => {
+  await stopTestServer(testServer);
+  console.log('✅ Test server stopped');
+});
+
+export default tap.start();