Haraka 3.1.6 → 3.1.7

package/test/plugins/prevent_credential_leaks.js

@@ -0,0 +1,178 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+const { describe, it, beforeEach } = require('node:test')
+
+const fixtures = require('haraka-test-fixtures')
+require('haraka-constants').import(global)
+
+function makeConnection({ authUser, authPasswd, bodytext = '', children = [] } = {}) {
+    const conn = fixtures.connection.createConnection()
+    conn.init_transaction()
+    if (authUser) conn.notes.auth_user = authUser
+    if (authPasswd) conn.notes.auth_passwd = authPasswd
+    conn.transaction.body = { bodytext, children }
+    return conn
+}
+
+describe('prevent_credential_leaks', () => {
+    let plugin
+
+    beforeEach(() => {
+        plugin = new fixtures.plugin('prevent_credential_leaks')
+    })
+
+    describe('hook_data', () => {
+        it('does not enable parse_body when no auth credentials', (t, done) => {
+            const conn = makeConnection()
+            conn.transaction.parse_body = false
+            plugin.hook_data((rc) => {
+                assert.equal(rc, undefined)
+                assert.equal(conn.transaction.parse_body, false)
+                done()
+            }, conn)
+        })
+
+        it('enables parse_body when both auth_user and auth_passwd are present', (t, done) => {
+            const conn = makeConnection({ authUser: 'user@example.com', authPasswd: 'secret' })
+            conn.transaction.parse_body = false
+            plugin.hook_data((rc) => {
+                assert.equal(rc, undefined)
+                assert.equal(conn.transaction.parse_body, true)
+                done()
+            }, conn)
+        })
+
+        it('does not enable parse_body when only auth_user is set', (t, done) => {
+            const conn = makeConnection({ authUser: 'user@example.com' })
+            conn.transaction.parse_body = false
+            plugin.hook_data((rc) => {
+                assert.equal(rc, undefined)
+                assert.equal(conn.transaction.parse_body, false)
+                done()
+            }, conn)
+        })
+
+        it('handles missing connection gracefully', (t, done) => {
+            // Simulate a null-ish connection by calling with empty notes
+            const conn = fixtures.connection.createConnection()
+            conn.init_transaction()
+            conn.notes = {}
+            plugin.hook_data((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+    })
+
+    describe('hook_data_post', () => {
+        it('calls next when no auth credentials are set', (t, done) => {
+            const conn = makeConnection({ bodytext: 'user@example.com secret123' })
+            plugin.hook_data_post((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+
+        it('calls next when only auth_user is set (no password)', (t, done) => {
+            const conn = makeConnection({ authUser: 'user@example.com', bodytext: 'user@example.com' })
+            plugin.hook_data_post((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+
+        it('calls next when body contains neither username nor password', (t, done) => {
+            const conn = makeConnection({
+                authUser: 'alice@example.com',
+                authPasswd: 'mypassword',
+                bodytext: 'Hello, this is a clean email with no credentials.',
+            })
+            plugin.hook_data_post((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+
+        it('calls next when body contains username but not password', (t, done) => {
+            const conn = makeConnection({
+                authUser: 'alice@example.com',
+                authPasswd: 'mypassword',
+                bodytext: 'Contact alice@example.com for more info.',
+            })
+            plugin.hook_data_post((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+
+        it('denies when body contains both username and password', (t, done) => {
+            const conn = makeConnection({
+                authUser: 'alice@example.com',
+                authPasswd: 'mypassword',
+                bodytext: 'Please send your login: alice and password: mypassword to activate.',
+            })
+            plugin.hook_data_post((rc, msg) => {
+                assert.equal(rc, DENY)
+                assert.ok(msg.includes('Credential leak'))
+                done()
+            }, conn)
+        })
+
+        it('denies when credentials appear in a child body part', (t, done) => {
+            const conn = fixtures.connection.createConnection()
+            conn.init_transaction()
+            conn.notes.auth_user = 'bob@example.com'
+            conn.notes.auth_passwd = 's3cr3t'
+            conn.transaction.body = {
+                bodytext: 'clean parent text',
+                children: [{ bodytext: 'bob login with s3cr3t password', children: [] }],
+            }
+            plugin.hook_data_post((rc) => {
+                assert.equal(rc, DENY)
+                done()
+            }, conn)
+        })
+
+        it('handles qualified username (user@domain) by making domain optional', (t, done) => {
+            const conn = makeConnection({
+                authUser: 'carol@corp.example.com',
+                authPasswd: 'pass123',
+                bodytext: 'carol pass123 credentials',
+            })
+            plugin.hook_data_post((rc) => {
+                assert.equal(rc, DENY)
+                done()
+            }, conn)
+        })
+
+        it('unqualified username (no @) is not split into a partial match', (t, done) => {
+            // Bug: `if (idx)` with idx === -1 treated 'admin' as qualified,
+            // splitting it to user='admi' which then matches 'admiral'.
+            const conn = makeConnection({
+                authUser: 'admin',
+                authPasswd: 'pw',
+                bodytext: 'the admiral said pw today',
+            })
+            plugin.hook_data_post((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+
+        it('calls next when credentials appear in neither top nor child', (t, done) => {
+            const conn = fixtures.connection.createConnection()
+            conn.init_transaction()
+            conn.notes.auth_user = 'dave@example.com'
+            conn.notes.auth_passwd = 'xyzzy'
+            conn.transaction.body = {
+                bodytext: 'Hello world',
+                children: [{ bodytext: 'No credentials here at all', children: [] }],
+            }
+            plugin.hook_data_post((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+    })
+})

package/test/plugins/process_title.js

@@ -0,0 +1,135 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+const { describe, it, beforeEach } = require('node:test')
+
+const fixtures = require('haraka-test-fixtures')
+const Notes = require('haraka-notes')
+
+function makeServer(extra = {}) {
+    return {
+        notes: new Notes({
+            pt_connections: 0,
+            pt_concurrent: 0,
+            pt_cps_diff: 0,
+            pt_cps_max: 0,
+            pt_recipients: 0,
+            pt_rps_diff: 0,
+            pt_rps_max: 0,
+            pt_messages: 0,
+            pt_mps_diff: 0,
+            pt_mps_max: 0,
+            ...extra,
+        }),
+        cluster: null,
+        address: () => ({ address: '127.0.0.1', port: 25 }),
+    }
+}
+
+describe('process_title', () => {
+    let plugin
+
+    beforeEach(() => {
+        plugin = new fixtures.plugin('process_title')
+    })
+
+    describe('hook_connect_init', () => {
+        it('increments connection and concurrent counts', (t, done) => {
+            const server = makeServer()
+            const conn = fixtures.connection.createConnection({}, server)
+            plugin.hook_connect_init((rc) => {
+                assert.equal(rc, undefined)
+                assert.equal(server.notes.pt_connections, 1)
+                assert.equal(server.notes.pt_concurrent, 1)
+                assert.equal(conn.notes.pt_connect_run, true)
+                done()
+            }, conn)
+        })
+    })
+
+    describe('hook_disconnect', () => {
+        it('decrements concurrent count when connect_init ran', (t, done) => {
+            const server = makeServer({ pt_connections: 1, pt_concurrent: 1 })
+            const conn = fixtures.connection.createConnection({}, server)
+            conn.notes.pt_connect_run = true
+            plugin.hook_disconnect((rc) => {
+                assert.equal(rc, undefined)
+                assert.equal(server.notes.pt_concurrent, 0)
+                assert.equal(server.notes.pt_connections, 1) // not re-incremented
+                done()
+            }, conn)
+        })
+
+        it('increments connection count when connect_init did not run', (t, done) => {
+            const server = makeServer({ pt_connections: 0, pt_concurrent: 0 })
+            const conn = fixtures.connection.createConnection({}, server)
+            // pt_connect_run is NOT set: disconnect does connect bookkeeping then decrements
+            plugin.hook_disconnect((rc) => {
+                assert.equal(rc, undefined)
+                assert.equal(server.notes.pt_connections, 1) // incremented by disconnect
+                assert.equal(server.notes.pt_concurrent, 0) // +1 then -1
+                done()
+            }, conn)
+        })
+    })
+
+    describe('hook_rcpt', () => {
+        it('increments recipient count', (t, done) => {
+            const server = makeServer()
+            const conn = fixtures.connection.createConnection({}, server)
+            plugin.hook_rcpt((rc) => {
+                assert.equal(rc, undefined)
+                assert.equal(server.notes.pt_recipients, 1)
+                done()
+            }, conn)
+        })
+    })
+
+    describe('hook_data', () => {
+        it('increments message count', (t, done) => {
+            const server = makeServer()
+            const conn = fixtures.connection.createConnection({}, server)
+            plugin.hook_data((rc) => {
+                assert.equal(rc, undefined)
+                assert.equal(server.notes.pt_messages, 1)
+                done()
+            }, conn)
+        })
+    })
+
+    describe('hook_init_child', () => {
+        it('initializes server notes and calls next', (t, done) => {
+            const server = { notes: new Notes(), cluster: null }
+            plugin.hook_init_child((rc) => {
+                clearInterval(plugin._interval)
+                assert.equal(rc, undefined)
+                assert.equal(server.notes.pt_connections, 0)
+                assert.equal(server.notes.pt_messages, 0)
+                assert.equal(server.notes.pt_recipients, 0)
+                done()
+            }, server)
+        })
+    })
+
+    describe('hook_init_master', () => {
+        it('initializes server notes and calls next (no cluster)', (t, done) => {
+            const server = { notes: new Notes(), cluster: null }
+            plugin.hook_init_master((rc) => {
+                clearInterval(plugin._interval)
+                assert.equal(rc, undefined)
+                assert.equal(server.notes.pt_connections, 0)
+                assert.equal(server.notes.pt_child_exits, 0)
+                done()
+            }, server)
+        })
+    })
+
+    describe('shutdown', () => {
+        it('clears the interval', () => {
+            plugin._interval = setInterval(() => {}, 9999)
+            plugin.shutdown()
+            // If the interval was cleared, no error thrown
+            assert.ok(true)
+        })
+    })
+})

package/test/plugins/queue/deliver.js

@@ -0,0 +1,99 @@
+'use strict'
+
+const assert = require('node:assert')
+const path = require('node:path')
+const Module = require('node:module')
+const { describe, it, beforeEach, before, after } = require('node:test')
+
+const fixtures = require('haraka-test-fixtures')
+
+// deliver.js does `require('./outbound')` at the top level. In a running
+// Haraka that resolves to the core outbound module (Haraka/outbound/index.js),
+// which we don't want to load here: it would pull in the real delivery
+// machinery. So we intercept Module._resolveFilename to map './outbound' to a
+// stable path and pre-populate the require cache with a mock at that path
+// before loading the plugin.
+const outboundPath = path.resolve('outbound/index.js')
+let mockOutbound
+let origResolve
+
+before(() => {
+    require('haraka-constants').import(global)
+
+    mockOutbound = { send_trans_email: () => {} }
+    require.cache[outboundPath] = {
+        id: outboundPath,
+        filename: outboundPath,
+        loaded: true,
+        exports: mockOutbound,
+    }
+
+    origResolve = Module._resolveFilename
+    Module._resolveFilename = function (request, parent, isMain, options) {
+        if (request === './outbound') return outboundPath
+        return origResolve.call(this, request, parent, isMain, options)
+    }
+})
+
+after(() => {
+    Module._resolveFilename = origResolve
+    delete require.cache[outboundPath]
+})
+
+function makeConnection(opts = {}) {
+    const conn = fixtures.connection.createConnection()
+    conn.init_transaction()
+    if (opts.relaying !== undefined) conn.relaying = opts.relaying
+    return conn
+}
+
+describe('queue/deliver', () => {
+    describe('hook_queue_outbound', () => {
+        let plugin, conn
+
+        beforeEach(() => {
+            plugin = new fixtures.plugin('queue/deliver')
+            mockOutbound.send_trans_email = () => {}
+        })
+
+        it('calls next() when connection is not relaying', (t, done) => {
+            conn = makeConnection({ relaying: false })
+            plugin.hook_queue_outbound((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+
+        it('calls next() when connection is undefined', (t, done) => {
+            plugin.hook_queue_outbound((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, undefined)
+        })
+
+        it('calls outbound.send_trans_email when relaying is true', (t, done) => {
+            conn = makeConnection({ relaying: true })
+            mockOutbound.send_trans_email = (txn, next) => {
+                assert.equal(txn, conn.transaction)
+                next(OK)
+            }
+            plugin.hook_queue_outbound((rc) => {
+                assert.equal(rc, OK)
+                done()
+            }, conn)
+        })
+
+        it('passes transaction to outbound.send_trans_email', (t, done) => {
+            conn = makeConnection({ relaying: true })
+            let capturedTxn
+            mockOutbound.send_trans_email = (txn, next) => {
+                capturedTxn = txn
+                next(OK)
+            }
+            plugin.hook_queue_outbound(() => {
+                assert.equal(capturedTxn, conn.transaction)
+                done()
+            }, conn)
+        })
+    })
+})

package/test/plugins/queue/discard.js

@@ -0,0 +1,79 @@
+'use strict'
+
+const assert = require('node:assert')
+const { describe, it, beforeEach, before } = require('node:test')
+
+const fixtures = require('haraka-test-fixtures')
+
+before(() => {
+    require('haraka-constants').import(global)
+})
+
+describe('queue/discard', () => {
+    describe('discard hook', () => {
+        let plugin, conn
+
+        beforeEach(() => {
+            plugin = new fixtures.plugin('queue/discard')
+            conn = fixtures.connection.createConnection()
+            conn.init_transaction()
+            delete process.env.YES_REALLY_DO_DISCARD
+        })
+
+        it('calls next() when queue.wants is set to another plugin', (t, done) => {
+            conn.transaction.notes.set('queue.wants', 'smtp_forward')
+            plugin.discard((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+
+        it('calls next(OK) when connection.notes.discard is set', (t, done) => {
+            conn.notes.discard = true
+            plugin.discard((rc) => {
+                assert.equal(rc, OK)
+                done()
+            }, conn)
+        })
+
+        it('calls next(OK) when txn.notes.discard is set', (t, done) => {
+            conn.transaction.notes.discard = true
+            plugin.discard((rc) => {
+                assert.equal(rc, OK)
+                done()
+            }, conn)
+        })
+
+        it('calls next(OK) when queue.wants is discard', (t, done) => {
+            conn.transaction.notes.set('queue.wants', 'discard')
+            plugin.discard((rc) => {
+                assert.equal(rc, OK)
+                done()
+            }, conn)
+        })
+
+        it('calls next(OK) when YES_REALLY_DO_DISCARD env var is set', (t, done) => {
+            process.env.YES_REALLY_DO_DISCARD = '1'
+            plugin.discard((rc) => {
+                assert.equal(rc, OK)
+                done()
+            }, conn)
+        })
+
+        it('calls next() (pass-through) when no discard conditions are met', (t, done) => {
+            plugin.discard((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+
+        it('queue.wants=discard takes priority over other queue wants', (t, done) => {
+            // Once queue.wants is set, it's compared against 'discard'; since it equals 'discard', discard runs
+            conn.transaction.notes.set('queue.wants', 'discard')
+            plugin.discard((rc) => {
+                assert.equal(rc, OK)
+                done()
+            }, conn)
+        })
+    })
+})

package/test/plugins/queue/lmtp.js

@@ -0,0 +1,138 @@
+'use strict'
+
+const assert = require('node:assert')
+const { describe, it, beforeEach, before } = require('node:test')
+
+const fixtures = require('haraka-test-fixtures')
+
+before(() => {
+    require('haraka-constants').import(global)
+})
+
+describe('queue/lmtp', () => {
+    describe('hook_get_mx', () => {
+        let plugin
+
+        beforeEach(() => {
+            plugin = new fixtures.plugin('queue/lmtp')
+            plugin.load_lmtp_ini()
+        })
+
+        it('calls next() when hmail does not have using_lmtp note', (t, done) => {
+            const hmail = { todo: { notes: {} } }
+            plugin.hook_get_mx(
+                (rc, mx) => {
+                    assert.equal(rc, undefined)
+                    assert.equal(mx, undefined)
+                    done()
+                },
+                hmail,
+                'example.com',
+            )
+        })
+
+        it('returns OK with default host and port when using_lmtp is set', (t, done) => {
+            const hmail = { todo: { notes: { using_lmtp: true } } }
+            plugin.cfg = { main: {} }
+            plugin.hook_get_mx(
+                (rc, mx) => {
+                    assert.equal(rc, OK)
+                    assert.equal(mx.using_lmtp, true)
+                    assert.equal(mx.exchange, '127.0.0.1')
+                    assert.equal(mx.port, 24)
+                    assert.equal(mx.priority, 0)
+                    done()
+                },
+                hmail,
+                'example.com',
+            )
+        })
+
+        it('uses domain-specific section when available', (t, done) => {
+            const hmail = { todo: { notes: { using_lmtp: true } } }
+            plugin.cfg = {
+                main: { host: '127.0.0.1' },
+                'example.com': { host: 'lmtp.example.com', port: 2400 },
+            }
+            plugin.hook_get_mx(
+                (rc, mx) => {
+                    assert.equal(rc, OK)
+                    assert.equal(mx.exchange, 'lmtp.example.com')
+                    assert.equal(mx.port, 2400)
+                    done()
+                },
+                hmail,
+                'example.com',
+            )
+        })
+
+        it('falls back to main section when no domain-specific section', (t, done) => {
+            const hmail = { todo: { notes: { using_lmtp: true } } }
+            plugin.cfg = { main: { host: 'lmtp.default.com', port: 24 } }
+            plugin.hook_get_mx(
+                (rc, mx) => {
+                    assert.equal(rc, OK)
+                    assert.equal(mx.exchange, 'lmtp.default.com')
+                    done()
+                },
+                hmail,
+                'other.com',
+            )
+        })
+
+        it('includes path in mx when configured', (t, done) => {
+            const hmail = { todo: { notes: { using_lmtp: true } } }
+            plugin.cfg = { main: { host: '127.0.0.1', path: '/var/run/lmtp.sock' } }
+            plugin.hook_get_mx(
+                (rc, mx) => {
+                    assert.equal(rc, OK)
+                    assert.equal(mx.path, '/var/run/lmtp.sock')
+                    done()
+                },
+                hmail,
+                'example.com',
+            )
+        })
+
+        it('does not include path in mx when not configured', (t, done) => {
+            const hmail = { todo: { notes: { using_lmtp: true } } }
+            plugin.cfg = { main: {} }
+            plugin.hook_get_mx(
+                (rc, mx) => {
+                    assert.equal(rc, OK)
+                    assert.equal(mx.path, undefined)
+                    done()
+                },
+                hmail,
+                'example.com',
+            )
+        })
+    })
+
+    describe('hook_queue', () => {
+        let plugin, conn
+
+        beforeEach(() => {
+            plugin = new fixtures.plugin('queue/lmtp')
+            plugin.load_lmtp_ini()
+            conn = fixtures.connection.createConnection()
+            conn.init_transaction()
+        })
+
+        it('calls next() when there is no transaction', (t, done) => {
+            const connNoTxn = fixtures.connection.createConnection()
+            plugin.hook_queue((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, connNoTxn)
+        })
+
+        it('calls next() when queue.wants is set to another plugin', (t, done) => {
+            conn.transaction.notes.set('queue.wants', 'smtp_forward')
+            plugin.hook_queue((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+    })
+})