Haraka 3.2.1 → 3.3.1

package/server.js

@@ -4,15 +4,17 @@
 const cluster = require('node:cluster')
 const { spawn } = require('node:child_process')
 const fs = require('node:fs')
+const net = require('node:net')
 const os = require('node:os')
 const path = require('node:path')
 const tls = require('node:tls')
 const constants = require('haraka-constants')
+const net_utils = require('haraka-net-utils')
 
+const { endpoint } = require('haraka-net-utils')
 const tls_socket = require('./tls_socket')
 const conn = require('./connection')
 const outbound = require('./outbound')
-const endpoint = require('./endpoint')
 
 const Server = exports
 Server.logger = require('./logger')
@@ -64,8 +66,16 @@ Server.load_http_ini = () => {
     }).main
 }
 
+Server.load_connection_ini = () => {
+    Server.connection = {}
+    Server.connection.cfg = Server.config.get('connection.ini', {
+        booleans: ['+haproxy.enabled'],
+    })
+}
+
 Server.load_smtp_ini()
 Server.load_http_ini()
+Server.load_connection_ini()
 
 Server.daemonize = function () {
     const c = this.cfg.main
@@ -262,14 +272,7 @@ Server.receiveAsMaster = (command, params) => {
     Server[command].apply(Server, params)
 }
 
-function messageHandler(worker, msg, handle) {
-    // sunset Haraka v3 (Node < 6)
-    if (arguments.length === 2) {
-        handle = msg
-        msg = worker
-        worker = undefined
-    }
-    // console.log("received cmd: ", msg);
+function messageHandler(worker, msg) {
     if (msg?.cmd) {
         Server.receiveAsMaster(msg.cmd, msg.params)
     }
@@ -351,6 +354,142 @@ Server.load_default_tls_config = (done) => {
     })
 }
 
+Server.create_smtps_server = (opts, onConnect) => {
+    let server
+    const socket_tls_state = new Map()
+    const proxyPrefix = Buffer.from('PROXY ')
+    // Defensive cap while waiting for a PROXY v1 line before TLS starts.
+    const proxyLineReadLimit = 512
+
+    const tlsServer = tls.createServer(opts, (cleartext) => {
+        const state_key = socket_tls_state_key(cleartext)
+        const smtps_state = socket_tls_state.get(state_key)
+        if (smtps_state) cleartext.haraka_smtps = smtps_state
+        socket_tls_state.delete(state_key)
+
+        onConnect(cleartext)
+    })
+
+    function close_with_proxy_error(socket, timer, msg) {
+        clearTimeout(timer)
+        socket.removeAllListeners('data')
+        socket.end(`421 ${msg}\r\n`, () => {
+            socket.destroy()
+        })
+    }
+
+    function socket_tls_state_key(socket) {
+        return JSON.stringify([socket.remoteAddress, socket.remotePort, socket.localAddress, socket.localPort])
+    }
+
+    function start_tls(socket, proxy, peer_allowed) {
+        if (proxy || peer_allowed) {
+            const smtps_state = { peer_allowed }
+            if (proxy) {
+                smtps_state.proxy = {
+                    ...proxy,
+                    proxy_ip: net_utils.normalize_ip(socket.remoteAddress) || socket.remoteAddress,
+                }
+            }
+            socket_tls_state.set(socket_tls_state_key(socket), smtps_state)
+        }
+
+        tlsServer.emit('connection', socket)
+    }
+
+    tlsServer.on('tlsClientError', (err, cleartext) => {
+        if (cleartext) socket_tls_state.delete(socket_tls_state_key(cleartext))
+        server.emit('tlsClientError', err, cleartext)
+    })
+
+    tlsServer.on('secureConnection', (cleartext) => {
+        server.emit('secureConnection', cleartext)
+    })
+
+    function starts_with_proxy_prefix(data) {
+        if (!data.length) return true
+        if (data.length > proxyPrefix.length) return data.subarray(0, proxyPrefix.length).equals(proxyPrefix)
+
+        return proxyPrefix.subarray(0, data.length).equals(data)
+    }
+
+    function start_tls_with_buffer(socket, data, proxy, peer_allowed) {
+        // Preserve bytes already read by the PROXY pre-parser, then hand the
+        // paused socket to TLS before letting it read again.
+        socket.pause()
+        if (data?.length) socket.unshift(data)
+        setImmediate(() => {
+            start_tls(socket, proxy, peer_allowed)
+            socket.resume()
+        })
+    }
+
+    server = net.createServer((socket) => {
+        const remote_ip = net_utils.normalize_ip(socket.remoteAddress) || socket.remoteAddress
+
+        if (!net_utils.is_haproxy_allowed(remote_ip)) {
+            start_tls(socket)
+            return
+        }
+
+        let current_data = null
+        const proxy_timer = setTimeout(() => {
+            close_with_proxy_error(socket, proxy_timer, 'PROXY timeout')
+        }, 30 * 1000)
+
+        function cleanup() {
+            clearTimeout(proxy_timer)
+            // Stop flowing before removing the pre-parser listener so TLS bytes
+            // cannot arrive between listener removal and TLS attachment.
+            socket.pause()
+            socket.removeListener('data', on_data)
+            socket.removeListener('close', cleanup)
+            socket.removeListener('error', cleanup)
+        }
+
+        function on_data(data) {
+            current_data = current_data ? Buffer.concat([current_data, data]) : data
+
+            if (!starts_with_proxy_prefix(current_data)) {
+                cleanup()
+                start_tls_with_buffer(socket, current_data, null, true)
+                return
+            }
+
+            const offset = current_data.indexOf(0x0a)
+            if (offset === -1) {
+                if (current_data.length > proxyLineReadLimit) {
+                    close_with_proxy_error(socket, proxy_timer, 'Invalid PROXY format')
+                }
+                return
+            }
+            if (offset > proxyLineReadLimit) {
+                close_with_proxy_error(socket, proxy_timer, 'Invalid PROXY format')
+                return
+            }
+
+            cleanup()
+
+            const proxy = net_utils.parse_proxy_line(current_data.slice(0, offset + 1))
+            if (!proxy) {
+                close_with_proxy_error(socket, proxy_timer, 'Invalid PROXY format')
+                return
+            }
+
+            const rest = current_data.slice(offset + 1)
+            start_tls_with_buffer(socket, rest, proxy, true)
+        }
+
+        socket.once('close', cleanup)
+        socket.once('error', cleanup)
+        socket.on('data', on_data)
+    })
+
+    server.tlsServer = tlsServer
+
+    return server
+}
+
 Server.get_smtp_server = async (ep, inactivity_timeout) => {
     let server
 
@@ -358,17 +497,19 @@ Server.get_smtp_server = async (ep, inactivity_timeout) => {
         client.setTimeout(inactivity_timeout)
         const connection = conn.createConnection(client, server, Server.cfg)
 
-        if (!server.has_tls) return
+        if (server.has_tls) {
+            const cipher = client.getCipher()
+            cipher.version = client.getProtocol() // replace min with actual
 
-        const cipher = client.getCipher()
-        cipher.version = client.getProtocol() // replace min with actual
+            connection.setTLS({
+                cipher,
+                verified: client.authorized,
+                verifyError: client.authorizationError,
+                peerCertificate: client.getPeerCertificate(),
+            })
+        }
 
-        connection.setTLS({
-            cipher,
-            verified: client.authorized,
-            verifyError: client.authorizationError,
-            peerCertificate: client.getPeerCertificate(),
-        })
+        if (client.haraka_smtps?.proxy) connection.apply_proxy(client.haraka_smtps.proxy)
     }
 
     if (ep.port === parseInt(Server.cfg.main.smtps_port, 10)) {
@@ -382,10 +523,13 @@ Server.get_smtp_server = async (ep, inactivity_timeout) => {
             tls_socket.cfg.main.requireAuthorized,
         )
 
-        server = tls.createServer(opts, onConnect)
-        tls_socket.addOCSP(server)
+        server = Server.connection.cfg.haproxy.enabled
+            ? Server.create_smtps_server(opts, onConnect)
+            : tls.createServer(opts, onConnect)
+        const tls_event_server = server.tlsServer || server
+        tls_socket.addOCSP(tls_event_server)
         server.has_tls = true
-        server.on('resumeSession', (id, rsDone) => {
+        tls_event_server.on('resumeSession', (id, rsDone) => {
             Server.loginfo('client requested TLS resumeSession')
             rsDone(null, null)
         })
@@ -394,7 +538,7 @@ Server.get_smtp_server = async (ep, inactivity_timeout) => {
     } else {
         server = tls_socket.createServer(onConnect)
         server.has_tls = false
-        const opts = await tls_socket.getSocketOpts('*')
+        await tls_socket.getSocketOpts('*')
         Server.listeners.push(server)
         return server
     }
@@ -403,7 +547,7 @@ Server.get_smtp_server = async (ep, inactivity_timeout) => {
 Server.setup_smtp_listeners = async (plugins2, type, inactivity_timeout) => {
     const errors = []
 
-    for (const [ifName, ifObj] of Object.entries(os.networkInterfaces())) {
+    for (const [, ifObj] of Object.entries(os.networkInterfaces())) {
         for (const addr of ifObj) {
             if (addr.family === 'IPv6') {
                 if (!Server.notes.IPv6) Server.notes.IPv6 = true
@@ -476,7 +620,7 @@ Server.setup_http_listeners = async () => {
     try {
         Server.http.express = require('express')
         Server.loginfo('express loaded at Server.http.express')
-    } catch (err) {
+    } catch {
         Server.logerror('express failed to load. No http server. Install express with: npm install -g express')
         return
     }
@@ -531,7 +675,7 @@ Server.init_master_respond = async (retval, msg) => {
     if (!(cluster && c.nodes)) {
         try {
             await outbound.init_queue()
-        } catch (err) {
+        } catch {
             Server.logcrit('Loading queue failed. Shutting down.')
             return logger.dump_and_exit(1)
         }
@@ -566,7 +710,7 @@ Server.init_master_respond = async (retval, msg) => {
             Server.lognotice(`worker ${worker.id} listening on ${endpoint(address)}`)
         })
         cluster.on('exit', cluster_exit_listener)
-    } catch (err) {
+    } catch {
         Server.logcrit('Scanning queue failed. Shutting down.')
         logger.dump_and_exit(1)
     }
@@ -605,7 +749,7 @@ Server.init_child_respond = (retval, msg) => {
             process.kill(pid)
             Server.logerror(`Killing master (pid=${pid})`)
         }
-    } catch (err) {
+    } catch {
         Server.logerror('Terminating child')
     }
     logger.dump_and_exit(1)
@@ -635,7 +779,7 @@ Server.init_http_respond = () => {
     let WebSocketServer
     try {
         WebSocketServer = require('ws').Server
-    } catch (e) {
+    } catch {
         Server.logerror(`unable to load ws.\n  did you: npm install -g ws?`)
         return
     }

package/smtp_client.js

@@ -15,7 +15,7 @@ const utils = require('haraka-utils')
 
 const tls_socket = require('./tls_socket')
 const logger = require('./logger')
-const HostPool = require('./host_pool')
+const HostPool = net_utils.HostPool
 
 const smtp_regexp = /^(\d{3})([ -])(.*)/
 const STATE = {
@@ -486,6 +486,7 @@ function get_hostport(connection, cfg) {
             server.notes.host_pool = new HostPool(
                 cfg.forwarding_host_pool, // 1.2.3.4:420, 5.6.7.8:420
                 cfg.dead_forwarding_host_retry_secs,
+                { logger },
             )
         }
 

package/test/connection.js

@@ -5,7 +5,7 @@ const assert = require('node:assert/strict')
 
 const constants = require('haraka-constants')
 const DSN = require('haraka-dsn')
-const { Address } = require('../address')
+const { Address } = require('@haraka/email-address')
 
 const connection = require('../connection')
 const Server = require('../server')
@@ -508,7 +508,10 @@ describe('connection', () => {
                 assert.equal(this.connection.msg_count.tempfail, 1)
                 assert.equal(this.connection.transaction.msg_status, 'deferred')
                 assert.equal(harness.calls.reset, 1)
-                assert.deepEqual(harness.calls.results[0], { fail: 'Message denied temporarily' })
+                assert.deepEqual(harness.calls.results[0], {
+                    fail: 'Message denied temporarily',
+                    soft: true,
+                })
             } finally {
                 harness.restore()
             }
@@ -654,6 +657,120 @@ describe('connection', () => {
             assert.equal(responses[2][0], 503)
         })
 
+        it('cmd_mail strips control chars from invalid address logs', () => {
+            const notices = []
+            const responses = []
+            this.connection.hello.host = 'example.test'
+            this.connection.lognotice = (msg) => notices.push(msg)
+            this.connection.respond = (code, msg) => {
+                responses.push({ code, msg })
+            }
+
+            this.connection.cmd_mail('FROM:<mail\x00@example.com>')
+
+            assert.equal(responses[0].code, 501)
+            assert.match(responses[0].msg, /^Invalid MAIL FROM address /)
+            assert.equal(responses[0].msg.includes('\r'), false)
+            assert.equal(responses[0].msg.includes('\n'), false)
+            assert.equal(responses[0].msg.includes('\\u0000'), false)
+            assert.equal(notices[0], responses[0].msg)
+        })
+
+        it('cmd_rcpt strips control chars from invalid address logs', () => {
+            const notices = []
+            const responses = []
+            this.connection.transaction = { mail_from: new Address('<from@example.com>'), rcpt_to: [] }
+            this.connection.lognotice = (msg) => notices.push(msg)
+            this.connection.respond = (code, msg) => {
+                responses.push({ code, msg })
+            }
+
+            this.connection.cmd_rcpt('TO:<rcpt\x00@example.com>')
+
+            assert.equal(responses[0].code, 501)
+            assert.match(responses[0].msg, /^Invalid RCPT TO address /)
+            assert.equal(responses[0].msg.includes('\r'), false)
+            assert.equal(responses[0].msg.includes('\n'), false)
+            assert.equal(responses[0].msg.includes('\\u0000'), false)
+            assert.equal(notices[0], responses[0].msg)
+        })
+
+        it('cmd_mail rejects a postel-only address when main.postel is false', () => {
+            const responses = []
+            this.connection.hello.host = 'example.test'
+            this.connection.lognotice = () => {}
+            this.connection.respond = (code, msg) => responses.push({ code, msg })
+
+            this.connection.cmd_mail('FROM:<foo@[IPv6:bogus::xyz]>')
+
+            assert.equal(responses[0].code, 501)
+            assert.match(responses[0].msg, /^Invalid MAIL FROM address /)
+        })
+
+        it('cmd_mail accepts a postel-only address when main.postel is true', () => {
+            const responses = []
+            let started = false
+            this.connection.hello.host = 'example.test'
+            this.connection.respond = (code, msg) => responses.push({ code, msg })
+            this.connection.init_transaction = () => {
+                started = true
+            }
+
+            connection.cfg.main.postel = true
+            try {
+                this.connection.cmd_mail('FROM:<foo@[IPv6:bogus::xyz]>')
+            } finally {
+                connection.cfg.main.postel = false
+            }
+
+            assert.equal(started, true)
+            assert.equal(
+                responses.some((r) => r.code === 501),
+                false,
+            )
+        })
+
+        it('cmd_rcpt rejects a postel-only address when main.postel is false', () => {
+            const responses = []
+            this.connection.transaction = {
+                mail_from: new Address('<from@example.com>'),
+                rcpt_to: [],
+            }
+            this.connection.lognotice = () => {}
+            this.connection.respond = (code, msg) => responses.push({ code, msg })
+
+            this.connection.cmd_rcpt('TO:<foo@[IPv6:bogus::xyz]>')
+
+            assert.equal(responses[0].code, 501)
+            assert.match(responses[0].msg, /^Invalid RCPT TO address /)
+        })
+
+        it('cmd_rcpt accepts a postel-only address when main.postel is true', () => {
+            const plugins = require('../plugins')
+            const originalRunHooks = plugins.run_hooks
+            const responses = []
+            this.connection.transaction = {
+                mail_from: new Address('<from@example.com>'),
+                rcpt_to: [],
+            }
+            this.connection.respond = (code, msg) => responses.push({ code, msg })
+            plugins.run_hooks = () => {}
+
+            connection.cfg.main.postel = true
+            try {
+                this.connection.cmd_rcpt('TO:<foo@[IPv6:bogus::xyz]>')
+            } finally {
+                connection.cfg.main.postel = false
+                plugins.run_hooks = originalRunHooks
+            }
+
+            assert.equal(this.connection.transaction.rcpt_to.length, 1)
+            assert.equal(
+                responses.some((r) => r.code === 501),
+                false,
+            )
+        })
+
         it('data_respond denysoftdisconnect disconnects and default enters DATA', () => {
             const responses = []
             let disconnected = 0

package/test/fixtures/haproxy_allowed/config/connection.ini

@@ -0,0 +1,3 @@
+[haproxy]
+enabled=true
+hosts[] = 127.0.0.1

package/test/fixtures/haproxy_disabled/config/connection.ini

@@ -0,0 +1,3 @@
+[haproxy]
+enabled=false
+hosts[] = 127.0.0.1

package/test/fixtures/haproxy_untrusted/config/connection.ini

@@ -0,0 +1,3 @@
+[haproxy]
+enabled=true
+hosts[] = 192.0.2.1

package/test/fixtures/line_socket.js

@@ -18,4 +18,4 @@ class Socket extends events.EventEmitter {
 
 exports.Socket = Socket
 
-exports.connect = (port, host, cb) => new Socket(port, host)
+exports.connect = (port, host) => new Socket(port, host)

package/test/fixtures/util_hmailitem.js

@@ -2,7 +2,7 @@
 
 const assert = require('node:assert')
 
-const { Address } = require('../../address')
+const { Address } = require('@haraka/email-address')
 const fixtures = require('haraka-test-fixtures')
 
 /**
@@ -44,8 +44,7 @@ exports.createHMailItem = (outbound_context, options, callback) => {
     const delivery_domain = options.delivery_domain || 'domain'
     const mail_recipients = options.mail_recipients || [new Address('recipient@domain')]
 
-    const conn = fixtures.connection.createConnection()
-    conn.init_transaction()
+    const conn = fixtures.makeConnection({ withTxn: true })
     conn.transaction.mail_from = new Address(mail_from)
 
     const todo = new outbound_context.TODOItem(delivery_domain, mail_recipients, conn.transaction)

package/test/outbound/index.js

@@ -6,7 +6,6 @@ const fs = require('node:fs')
 const path = require('node:path')
 
 const constants = require('haraka-constants')
-const logger = require('../../logger')
 
 const lines = [
     'From: John Johnson <john@example.com>',
@@ -211,7 +210,7 @@ describe('outbound', () => {
         it('yields to setImmediate before opening process_delivery pipes', async () => {
             const stream = require('node:stream')
             const Transaction = require('../../transaction')
-            const Address = require('../../address').Address
+            const Address = require('@haraka/email-address').Address
             const outbound = require('../../outbound')
             const plugins = require('../../plugins')
 
@@ -271,7 +270,7 @@ describe('outbound', () => {
 
         it('adds missing Message-Id/Date and prepends Received before queueing', async () => {
             process.env.HARAKA_TEST_DIR = path.resolve('test')
-            const Address = require('../../address').Address
+            const Address = require('@haraka/email-address').Address
             const outbound = require('../../outbound')
             const plugins = require('../../plugins')
 
@@ -281,7 +280,7 @@ describe('outbound', () => {
             const transaction = {
                 uuid: 'txn-add-headers',
                 header: {
-                    get_all(_name) {
+                    get_all() {
                         return []
                     },
                     get() {
@@ -344,12 +343,12 @@ describe('outbound', () => {
     })
 
     describe('timer_queue', () => {
-        let outbound, ob_timer_queue
+        let ob_timer_queue
 
         beforeEach(() => {
             process.env.HARAKA_TEST_DIR = path.resolve('test')
-            outbound = require('../../outbound')
-            const TimerQueue = require('../../outbound/timer_queue')
+            require('../../outbound')
+            const { TimerQueue } = require('haraka-utils')
             ob_timer_queue = new TimerQueue(500)
         })
 

package/test/outbound/qfile.js

@@ -1,6 +1,6 @@
 'use strict'
 
-const { describe, it, beforeEach } = require('node:test')
+const { describe, it } = require('node:test')
 const assert = require('node:assert')
 const os = require('node:os')
 

package/test/outbound/queue.js

@@ -96,7 +96,7 @@ describe('outbound/queue', () => {
             let renameAttempts = 0
 
             const originalRename = queue.rename_to_actual_pid
-            queue.rename_to_actual_pid = (_file, _parts) => {
+            queue.rename_to_actual_pid = () => {
                 renameAttempts++
                 throw new Error('test skip')
             }
@@ -107,7 +107,7 @@ describe('outbound/queue', () => {
                     '1507509981169_1507509981169_0_61403_e0Y0Ym_1_haraka',
                     '1508455115683_1508455115683_0_90253_9Q4o4V_1_haraka',
                 ],
-                (_file) => {},
+                () => {},
             )
             queue.rename_to_actual_pid = originalRename
             assert.equal(renameAttempts, 1)