@serve.zone/dcrouter 2.12.4

package/test/suite/smtpserver_security/test.sec-06.ip-reputation.ts

@@ -0,0 +1,303 @@
+import { tap, expect } from '@git.zone/tstest/tapbundle';
+import * as plugins from '../../../ts/plugins.js';
+import * as net from 'net';
+import { startTestServer, stopTestServer } from '../../helpers/server.loader.js'
+import type { ITestServer } from '../../helpers/server.loader.js';
+
+const TEST_PORT = 2525;
+let testServer: ITestServer;
+
+// Helper to wait for SMTP response
+const waitForResponse = (socket: net.Socket, expectedCode?: string, timeout = 5000): Promise<string> => {
+  return new Promise((resolve, reject) => {
+    let buffer = '';
+    const timer = setTimeout(() => {
+      socket.removeListener('data', handler);
+      reject(new Error(`Timeout waiting for ${expectedCode || 'any'} response`));
+    }, timeout);
+    
+    const handler = (data: Buffer) => {
+      buffer += data.toString();
+      const lines = buffer.split('\r\n');
+      
+      for (const line of lines) {
+        if (expectedCode) {
+          if (line.startsWith(expectedCode + ' ')) {
+            clearTimeout(timer);
+            socket.removeListener('data', handler);
+            resolve(buffer);
+            return;
+          }
+        } else {
+          // Look for any complete response
+          if (line.match(/^\d{3} /)) {
+            clearTimeout(timer);
+            socket.removeListener('data', handler);
+            resolve(buffer);
+            return;
+          }
+        }
+      }
+    };
+    
+    socket.on('data', handler);
+  });
+};
+
+tap.test('setup - start test server', async (toolsArg) => {
+  testServer = await startTestServer({ port: TEST_PORT });
+  await toolsArg.delayFor(1000);
+});
+
+tap.test('IP Reputation - Suspicious hostname in EHLO', async (tools) => {
+  const socket = net.createConnection({
+    host: 'localhost',
+    port: TEST_PORT,
+    timeout: 30000
+  });
+  
+  try {
+    // Wait for greeting
+    const greeting = await waitForResponse(socket, '220');
+    console.log('Server response:', greeting);
+    
+    // Use suspicious hostname
+    socket.write('EHLO suspicious-host.badreputation.com\r\n');
+    const ehloResponse = await waitForResponse(socket);
+    console.log('Server response:', ehloResponse);
+    
+    const accepted = ehloResponse.includes('250');
+    const rejected = ehloResponse.includes('550') || ehloResponse.includes('521');
+    
+    console.log(`Suspicious hostname: accepted=${accepted}, rejected=${rejected}`);
+    expect(accepted || rejected).toEqual(true);
+    
+    if (rejected) {
+      console.log('IP reputation check working - suspicious host rejected at EHLO');
+    }
+    
+    socket.write('QUIT\r\n');
+    await waitForResponse(socket, '221');
+  } finally {
+    socket.destroy();
+  }
+});
+
+tap.test('IP Reputation - Blacklisted sender domain', async (tools) => {
+  const socket = net.createConnection({
+    host: 'localhost',
+    port: TEST_PORT,
+    timeout: 30000
+  });
+  
+  try {
+    // Wait for greeting
+    const greeting = await waitForResponse(socket, '220');
+    console.log('Server response:', greeting);
+    
+    // Send EHLO
+    socket.write('EHLO testclient\r\n');
+    const ehloResponse = await waitForResponse(socket, '250');
+    console.log('Server response:', ehloResponse);
+    
+    // Use known spam/blacklisted domain
+    socket.write('MAIL FROM:<spam@blacklisted.com>\r\n');
+    const mailResponse = await waitForResponse(socket);
+    console.log('Server response:', mailResponse);
+    
+    if (mailResponse.includes('250')) {
+      console.log('Blacklisted sender accepted at MAIL FROM');
+      
+      // Try RCPT TO
+      socket.write('RCPT TO:<recipient@example.com>\r\n');
+      const rcptResponse = await waitForResponse(socket);
+      console.log('Server response:', rcptResponse);
+      
+      const accepted = rcptResponse.includes('250');
+      const rejected = rcptResponse.includes('550') || rcptResponse.includes('553');
+      
+      console.log(`Blacklisted domain at RCPT: accepted=${accepted}, rejected=${rejected}`);
+      expect(accepted || rejected).toEqual(true);
+    } else if (mailResponse.includes('550') || mailResponse.includes('553')) {
+      console.log('Blacklisted sender rejected - IP reputation check working');
+      expect(true).toEqual(true);
+    }
+    
+    socket.write('QUIT\r\n');
+    await waitForResponse(socket, '221');
+  } finally {
+    socket.destroy();
+  }
+});
+
+tap.test('IP Reputation - Known good sender', async (tools) => {
+  const socket = net.createConnection({
+    host: 'localhost',
+    port: TEST_PORT,
+    timeout: 30000
+  });
+  
+  try {
+    // Wait for greeting
+    const greeting = await waitForResponse(socket, '220');
+    console.log('Server response:', greeting);
+    
+    // Send EHLO
+    socket.write('EHLO localhost\r\n');
+    const ehloResponse = await waitForResponse(socket, '250');
+    console.log('Server response:', ehloResponse);
+    
+    // Use legitimate sender
+    socket.write('MAIL FROM:<test@example.com>\r\n');
+    const mailResponse = await waitForResponse(socket, '250');
+    console.log('Server response:', mailResponse);
+    
+    // Send RCPT TO
+    socket.write('RCPT TO:<recipient@example.com>\r\n');
+    const rcptResponse = await waitForResponse(socket, '250');
+    console.log('Server response:', rcptResponse);
+    
+    console.log('Good sender accepted - IP reputation allows legitimate senders');
+    expect(true).toEqual(true);
+    
+    socket.write('QUIT\r\n');
+    await waitForResponse(socket, '221');
+  } finally {
+    socket.destroy();
+  }
+});
+
+tap.test('IP Reputation - Multiple connections from same IP', async (tools) => {
+  const connections: net.Socket[] = [];
+  const totalConnections = 3;
+  const connectionResults: Promise<void>[] = [];
+  
+  // Create multiple connections rapidly
+  for (let i = 0; i < totalConnections; i++) {
+    const connectionPromise = (async () => {
+      const socket = net.createConnection({
+        host: 'localhost',
+        port: TEST_PORT,
+        timeout: 30000
+      });
+      
+      connections.push(socket);
+      
+      try {
+        // Wait for greeting
+        const greeting = await waitForResponse(socket, '220');
+        console.log(`Connection ${i + 1} response:`, greeting);
+        
+        // Send EHLO
+        socket.write('EHLO testclient\r\n');
+        const ehloResponse = await waitForResponse(socket);
+        console.log(`Connection ${i + 1} response:`, ehloResponse);
+        
+        if (ehloResponse.includes('250')) {
+          socket.write('QUIT\r\n');
+          await waitForResponse(socket, '221');
+        } else if (ehloResponse.includes('421') || ehloResponse.includes('550')) {
+          // Connection rejected due to rate limiting or reputation
+          console.log(`Connection ${i + 1} rejected - IP reputation/rate limiting active`);
+        }
+      } catch (err: any) {
+        console.error(`Connection ${i + 1} error:`, err.message);
+      } finally {
+        socket.destroy();
+      }
+    })();
+    
+    connectionResults.push(connectionPromise);
+    
+    // Small delay between connections
+    if (i < totalConnections - 1) {
+      await tools.delayFor(100);
+    }
+  }
+  
+  // Wait for all connections to complete
+  await Promise.all(connectionResults);
+  console.log('All connections completed');
+  expect(true).toEqual(true);
+});
+
+tap.test('IP Reputation - Suspicious patterns in email', async (tools) => {
+  const socket = net.createConnection({
+    host: 'localhost',
+    port: TEST_PORT,
+    timeout: 30000
+  });
+  
+  try {
+    // Wait for greeting
+    const greeting = await waitForResponse(socket, '220');
+    console.log('Server response:', greeting);
+    
+    // Send EHLO
+    socket.write('EHLO testclient\r\n');
+    const ehloResponse = await waitForResponse(socket, '250');
+    console.log('Server response:', ehloResponse);
+    
+    // Send MAIL FROM
+    socket.write('MAIL FROM:<sender@example.com>\r\n');
+    const mailResponse = await waitForResponse(socket, '250');
+    console.log('Server response:', mailResponse);
+    
+    // Multiple recipients (spam pattern)
+    socket.write('RCPT TO:<recipient1@example.com>\r\n');
+    const rcpt1Response = await waitForResponse(socket, '250');
+    console.log('Server response:', rcpt1Response);
+    
+    socket.write('RCPT TO:<recipient2@example.com>\r\n');
+    const rcpt2Response = await waitForResponse(socket, '250');
+    console.log('Server response:', rcpt2Response);
+    
+    socket.write('RCPT TO:<recipient3@example.com>\r\n');
+    const rcpt3Response = await waitForResponse(socket);
+    console.log('Server response:', rcpt3Response);
+    
+    if (rcpt3Response.includes('250')) {
+      // Send DATA
+      socket.write('DATA\r\n');
+      const dataResponse = await waitForResponse(socket, '354');
+      console.log('Server response:', dataResponse);
+      
+      // Email with spam-like content
+      const email = [
+        `From: sender@example.com`,
+        `To: recipient1@example.com, recipient2@example.com, recipient3@example.com`,
+        `Subject: URGENT!!! You've won $1,000,000!!!`,
+        `Date: ${new Date().toUTCString()}`,
+        `Message-ID: <spam-pattern-${Date.now()}@example.com>`,
+        '',
+        'CLICK HERE NOW!!! Limited time offer!!!',
+        'Visit http://suspicious-link.com/win-money',
+        'Act NOW before it\'s too late!!!',
+        '.',
+        ''
+      ].join('\r\n');
+      
+      socket.write(email);
+      const emailResponse = await waitForResponse(socket);
+      console.log('Server response:', emailResponse);
+      
+      const result = emailResponse.includes('250') ? 'accepted' : 'rejected';
+      console.log(`Suspicious content email ${result}`);
+      expect(true).toEqual(true);
+    } else if (rcpt3Response.includes('452') || rcpt3Response.includes('550')) {
+      console.log('Multiple recipients limited - reputation control active');
+      expect(true).toEqual(true);
+    }
+    
+    socket.write('QUIT\r\n');
+    await waitForResponse(socket, '221');
+  } finally {
+    socket.destroy();
+  }
+});
+
+tap.test('cleanup - stop test server', async () => {
+  await stopTestServer(testServer);
+});
+
+export default tap.start();

package/test/suite/smtpserver_security/test.sec-07.content-scanning.ts

@@ -0,0 +1,409 @@
+import { tap, expect } from '@git.zone/tstest/tapbundle';
+import * as plugins from '../../../ts/plugins.js';
+import * as net from 'net';
+import { startTestServer, stopTestServer } from '../../helpers/server.loader.js'
+import type { ITestServer } from '../../helpers/server.loader.js';
+
+const TEST_PORT = 2525;
+let testServer: ITestServer;
+
+// Helper to wait for SMTP response
+const waitForResponse = (socket: net.Socket, expectedCode?: string, timeout = 5000): Promise<string> => {
+  return new Promise((resolve, reject) => {
+    let buffer = '';
+    const timer = setTimeout(() => {
+      socket.removeListener('data', handler);
+      reject(new Error(`Timeout waiting for ${expectedCode || 'any'} response`));
+    }, timeout);
+    
+    const handler = (data: Buffer) => {
+      buffer += data.toString();
+      const lines = buffer.split('\r\n');
+      
+      for (const line of lines) {
+        if (expectedCode) {
+          if (line.startsWith(expectedCode + ' ')) {
+            clearTimeout(timer);
+            socket.removeListener('data', handler);
+            resolve(buffer);
+            return;
+          }
+        } else {
+          // Look for any complete response
+          if (line.match(/^\d{3} /)) {
+            clearTimeout(timer);
+            socket.removeListener('data', handler);
+            resolve(buffer);
+            return;
+          }
+        }
+      }
+    };
+    
+    socket.on('data', handler);
+  });
+};
+
+tap.test('setup - start test server', async (toolsArg) => {
+  testServer = await startTestServer({ port: TEST_PORT });
+  await toolsArg.delayFor(1000);
+});
+
+tap.test('Content Scanning - Suspicious content patterns', async (tools) => {
+  const socket = net.createConnection({
+    host: 'localhost',
+    port: TEST_PORT,
+    timeout: 30000
+  });
+  
+  try {
+    // Wait for greeting
+    await waitForResponse(socket, '220');
+    
+    // Send EHLO
+    socket.write('EHLO testclient\r\n');
+    await waitForResponse(socket, '250');
+    
+    // Send MAIL FROM
+    socket.write('MAIL FROM:<sender@example.com>\r\n');
+    await waitForResponse(socket, '250');
+    
+    // Send RCPT TO
+    socket.write('RCPT TO:<recipient@example.com>\r\n');
+    await waitForResponse(socket, '250');
+    
+    // Send DATA
+    socket.write('DATA\r\n');
+    await waitForResponse(socket, '354');
+    
+    // Email with suspicious content
+    const email = [
+      `From: sender@example.com`,
+      `To: recipient@example.com`,
+      `Subject: Content Scanning Test`,
+      `Date: ${new Date().toUTCString()}`,
+      `Message-ID: <content-scan-${Date.now()}@example.com>`,
+      '',
+      'This email contains suspicious content that should trigger content scanning:',
+      'VIRUS_TEST_STRING',
+      'SUSPICIOUS_ATTACHMENT_PATTERN',
+      'MALWARE_SIGNATURE_TEST',
+      'Click here for FREE MONEY!!!',
+      'Visit http://phishing-site.com/steal-data',
+      '.',
+      ''
+    ].join('\r\n');
+    
+    socket.write(email);
+    const dataResponse = await waitForResponse(socket);
+    
+    const accepted = dataResponse.startsWith('250');
+    const rejected = dataResponse.startsWith('550');
+    
+    console.log(`Suspicious content: accepted=${accepted}, rejected=${rejected}`);
+    
+    if (rejected) {
+      console.log('Content scanning active - suspicious content detected');
+    } else {
+      console.log('Content scanning operational - email processed');
+    }
+    
+    expect(accepted || rejected).toEqual(true);
+    
+    socket.write('QUIT\r\n');
+    await waitForResponse(socket, '221').catch(() => {});
+  } finally {
+    socket.destroy();
+  }
+});
+
+tap.test('Content Scanning - Malware patterns', async (tools) => {
+  const socket = net.createConnection({
+    host: 'localhost',
+    port: TEST_PORT,
+    timeout: 30000
+  });
+  
+  try {
+    // Wait for greeting
+    await waitForResponse(socket, '220');
+    
+    // Send EHLO
+    socket.write('EHLO testclient\r\n');
+    await waitForResponse(socket, '250');
+    
+    // Send MAIL FROM
+    socket.write('MAIL FROM:<sender@example.com>\r\n');
+    await waitForResponse(socket, '250');
+    
+    // Send RCPT TO
+    socket.write('RCPT TO:<recipient@example.com>\r\n');
+    await waitForResponse(socket, '250');
+    
+    // Send DATA
+    socket.write('DATA\r\n');
+    await waitForResponse(socket, '354');
+    
+    // Email with malware-like patterns
+    const email = [
+      `From: sender@example.com`,
+      `To: recipient@example.com`,
+      `Subject: Important Security Update`,
+      `Date: ${new Date().toUTCString()}`,
+      `Message-ID: <malware-test-${Date.now()}@example.com>`,
+      'Content-Type: multipart/mixed; boundary="malware-boundary"',
+      '',
+      '--malware-boundary',
+      'Content-Type: text/plain',
+      '',
+      'Please run the attached file to update your security software.',
+      '',
+      '--malware-boundary',
+      'Content-Type: application/x-msdownload; name="update.exe"',
+      'Content-Transfer-Encoding: base64',
+      'Content-Disposition: attachment; filename="update.exe"',
+      '',
+      'TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',
+      'AAAA4AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1v',
+      '',
+      '--malware-boundary--',
+      '.',
+      ''
+    ].join('\r\n');
+    
+    socket.write(email);
+    const dataResponse = await waitForResponse(socket);
+    
+    const accepted = dataResponse.startsWith('250');
+    const rejected = dataResponse.startsWith('550');
+    
+    console.log(`Malware pattern email: ${accepted ? 'accepted' : 'rejected'}`);
+    
+    if (rejected) {
+      console.log('Content scanning active - malware patterns detected');
+    } else {
+      console.log('Content scanning operational - email processed');
+    }
+    
+    expect(accepted || rejected).toEqual(true);
+    
+    socket.write('QUIT\r\n');
+    await waitForResponse(socket, '221').catch(() => {});
+  } finally {
+    socket.destroy();
+  }
+});
+
+tap.test('Content Scanning - Spam keywords', async (tools) => {
+  const socket = net.createConnection({
+    host: 'localhost',
+    port: TEST_PORT,
+    timeout: 30000
+  });
+  
+  try {
+    // Wait for greeting
+    await waitForResponse(socket, '220');
+    
+    // Send EHLO
+    socket.write('EHLO testclient\r\n');
+    await waitForResponse(socket, '250');
+    
+    // Send MAIL FROM
+    socket.write('MAIL FROM:<sender@example.com>\r\n');
+    await waitForResponse(socket, '250');
+    
+    // Send RCPT TO
+    socket.write('RCPT TO:<recipient@example.com>\r\n');
+    await waitForResponse(socket, '250');
+    
+    // Send DATA
+    socket.write('DATA\r\n');
+    await waitForResponse(socket, '354');
+    
+    // Email with spam keywords
+    const email = [
+      `From: sender@example.com`,
+      `To: recipient@example.com`,
+      `Subject: URGENT!!! Act NOW!!! Limited Time OFFER!!!`,
+      `Date: ${new Date().toUTCString()}`,
+      `Message-ID: <spam-test-${Date.now()}@example.com>`,
+      '',
+      'CONGRATULATIONS!!! You have WON!!!',
+      'FREE FREE FREE!!!',
+      'VIAGRA CIALIS CHEAP MEDS!!!',
+      'MAKE $$$ FAST!!!',
+      'WORK FROM HOME!!!',
+      'NO CREDIT CHECK!!!',
+      'GUARANTEED WINNER!!!',
+      'CLICK HERE NOW!!!',
+      'This is NOT SPAM!!!',
+      '.',
+      ''
+    ].join('\r\n');
+    
+    socket.write(email);
+    const dataResponse = await waitForResponse(socket);
+    
+    const accepted = dataResponse.startsWith('250');
+    const rejected = dataResponse.startsWith('550');
+    
+    console.log(`Spam keyword email: ${accepted ? 'accepted' : 'rejected (spam detected)'}`);
+    
+    if (rejected) {
+      console.log('Content scanning active - spam keywords detected');
+    } else {
+      console.log('Content scanning operational - email processed');
+    }
+    
+    expect(accepted || rejected).toEqual(true);
+    
+    socket.write('QUIT\r\n');
+    await waitForResponse(socket, '221').catch(() => {});
+  } finally {
+    socket.destroy();
+  }
+});
+
+tap.test('Content Scanning - Clean legitimate email', async (tools) => {
+  const socket = net.createConnection({
+    host: 'localhost',
+    port: TEST_PORT,
+    timeout: 30000
+  });
+  
+  try {
+    // Wait for greeting
+    await waitForResponse(socket, '220');
+    
+    // Send EHLO
+    socket.write('EHLO testclient\r\n');
+    await waitForResponse(socket, '250');
+    
+    // Send MAIL FROM
+    socket.write('MAIL FROM:<sender@example.com>\r\n');
+    await waitForResponse(socket, '250');
+    
+    // Send RCPT TO
+    socket.write('RCPT TO:<recipient@example.com>\r\n');
+    await waitForResponse(socket, '250');
+    
+    // Send DATA
+    socket.write('DATA\r\n');
+    await waitForResponse(socket, '354');
+    
+    // Clean legitimate email
+    const email = [
+      `From: sender@example.com`,
+      `To: recipient@example.com`,
+      `Subject: Meeting Tomorrow`,
+      `Date: ${new Date().toUTCString()}`,
+      `Message-ID: <clean-email-${Date.now()}@example.com>`,
+      '',
+      'Hi,',
+      '',
+      'Just wanted to confirm our meeting for tomorrow at 2 PM.',
+      'Please let me know if you need to reschedule.',
+      '',
+      'Best regards,',
+      'John',
+      '.',
+      ''
+    ].join('\r\n');
+    
+    socket.write(email);
+    const dataResponse = await waitForResponse(socket, '250');
+    
+    console.log('Clean email accepted - content scanning allows legitimate emails');
+    expect(dataResponse.startsWith('250')).toEqual(true);
+    
+    socket.write('QUIT\r\n');
+    await waitForResponse(socket, '221').catch(() => {});
+  } finally {
+    socket.destroy();
+  }
+});
+
+tap.test('Content Scanning - Large attachment', async (tools) => {
+  const socket = net.createConnection({
+    host: 'localhost',
+    port: TEST_PORT,
+    timeout: 30000
+  });
+  
+  try {
+    // Wait for greeting
+    await waitForResponse(socket, '220');
+    
+    // Send EHLO
+    socket.write('EHLO testclient\r\n');
+    await waitForResponse(socket, '250');
+    
+    // Send MAIL FROM
+    socket.write('MAIL FROM:<sender@example.com>\r\n');
+    await waitForResponse(socket, '250');
+    
+    // Send RCPT TO
+    socket.write('RCPT TO:<recipient@example.com>\r\n');
+    await waitForResponse(socket, '250');
+    
+    // Send DATA
+    socket.write('DATA\r\n');
+    await waitForResponse(socket, '354');
+    
+    // Email with large attachment pattern
+    const largeData = 'A'.repeat(10000); // 10KB of data
+    
+    const email = [
+      `From: sender@example.com`,
+      `To: recipient@example.com`,
+      `Subject: Large Attachment Test`,
+      `Date: ${new Date().toUTCString()}`,
+      `Message-ID: <large-attach-${Date.now()}@example.com>`,
+      'Content-Type: multipart/mixed; boundary="boundary123"',
+      '',
+      '--boundary123',
+      'Content-Type: text/plain',
+      '',
+      'Please find the attached file.',
+      '',
+      '--boundary123',
+      'Content-Type: application/octet-stream; name="largefile.dat"',
+      'Content-Transfer-Encoding: base64',
+      'Content-Disposition: attachment; filename="largefile.dat"',
+      '',
+      Buffer.from(largeData).toString('base64'),
+      '',
+      '--boundary123--',
+      '.',
+      ''
+    ].join('\r\n');
+    
+    socket.write(email);
+    const dataResponse = await waitForResponse(socket);
+    
+    const accepted = dataResponse.startsWith('250');
+    const rejected = dataResponse.startsWith('550') || dataResponse.startsWith('552');
+    
+    console.log(`Large attachment: ${accepted ? 'accepted' : 'rejected (size or content issue)'}`);
+    
+    if (rejected) {
+      console.log('Content scanning active - large attachment blocked');
+    } else {
+      console.log('Content scanning operational - email processed');
+    }
+    
+    expect(accepted || rejected).toEqual(true);
+    
+    socket.write('QUIT\r\n');
+    await waitForResponse(socket, '221').catch(() => {});
+  } finally {
+    socket.destroy();
+  }
+});
+
+tap.test('cleanup - stop test server', async () => {
+  await stopTestServer(testServer);
+});
+
+export default tap.start();