domma-cms 1.8.15 → 1.8.17

package/server/services/mailHost.js

@@ -0,0 +1,100 @@
+/**
+ * Where this server may open a mail connection (SMTP or IMAP) to a host a site
+ * user typed - and the address it then connects to.
+ *
+ * A mail host is a TCP target the admin chooses, and a failed connection says
+ * what is listening there, so an unchecked host is a scanner of the server's
+ * own network. The address rules are services/outbound.js's (`resolvePublic`,
+ * `isBlockedAddress`): every address the name resolves to must be public,
+ * IPv4-mapped / NAT64 / decimal and octal spellings included. This module adds
+ * what is particular to mail:
+ *
+ *  - Signed-only sites (codePolicy.signedOnly() - every site a Manager hosts)
+ *    may name `localhost`, `127.0.0.1` or `::1` (hosted sites send through the
+ *    box's own port 25) or a public mail server, on the mail ports only
+ *    (SMTP 25/465/587/2525, IMAP 143/993). Nothing the site's admin sets lifts
+ *    that - not `outboundAllowPrivate`, not a mail plugin's
+ *    `allowPrivateMailHosts`, not the site's own SMTP host.
+ *  - This server's own PUBLIC address is not refused here (outbound.js refuses
+ *    it for web requests): a hosted mailbox at mail.<domain> on the same box is
+ *    normal, and on a signed-only site the port list keeps it to mail.
+ *  - The connection goes to the address that was checked (`address`), with the
+ *    name kept for TLS (`servername`), so a second DNS answer cannot swap in an
+ *    internal one (DNS rebinding).
+ *
+ * Self-hosted sites keep their freedom: core's site SMTP is not checked at all
+ * there (an internal relay is normal), and the mail plugins' own rules apply
+ * (plugins/_lib/mail/hostGuard.js).
+ *
+ * @module services/mailHost
+ */
+import dns from 'node:dns';
+import net from 'node:net';
+import {FetchRefused, resolvePublic} from './outbound.js';
+import {signedOnly} from './codePolicy.js';
+
+export const SMTP_PORTS = Object.freeze([25, 465, 587, 2525]);
+export const IMAP_PORTS = Object.freeze([143, 993]);
+
+/** The loopback names a signed-only site may use, and the address each one is. */
+const LOOPBACK = Object.freeze({localhost: '127.0.0.1', '127.0.0.1': '127.0.0.1', '::1': '::1'});
+
+export const REFUSED_PRIVATE = 'That mail server is on a private network, so this site will not connect to it. '
+    + 'Use the mail server\'s public name.';
+
+export class MailHostRefused extends Error {
+    constructor(message) { super(message); this.code = 'EMAILHOST_REFUSED'; this.mailHostRefused = true; }
+}
+
+/**
+ * Normalise a typed host for comparison: case, spaces, trailing dot, IPv6 brackets.
+ *
+ * @param {string} host
+ * @returns {string}
+ */
+export function normaliseMailHost(host) {
+    return String(host ?? '').trim().toLowerCase().replace(/\.$/, '').replace(/^\[(.*)\]$/, '$1');
+}
+
+/**
+ * Check a mail host and port, and say which address to connect to.
+ *
+ * @param {string} host
+ * @param {number} port
+ * @param {object} [opts]
+ * @param {'smtp'|'imap'} [opts.kind='smtp']
+ * @param {boolean} [opts.signed] - codePolicy.signedOnly() when omitted
+ * @param {boolean} [opts.checkAddresses] - refuse private addresses (default: on when signed)
+ * @param {boolean} [opts.anyPort] - skip the port rule (a save route that has no port to hand; the connection checks it)
+ * @param {Function} [opts.lookup] - dns.promises.lookup, swappable in tests
+ * @returns {Promise<{address: string, family: number, servername: string|undefined}>}
+ * @throws {MailHostRefused} the host or port is not allowed
+ * @throws {Error} code ENOTFOUND - the name did not resolve (never connect by name instead)
+ */
+export async function resolveMailHost(host, port, {kind = 'smtp', signed, checkAddresses, anyPort = false, lookup = dns.promises.lookup} = {}) {
+    const isSigned = signed ?? signedOnly();
+    const check = checkAddresses ?? isSigned;
+    const name = normaliseMailHost(host);
+    if (!name) throw new MailHostRefused('A mail server is required.');
+    if (isSigned && !anyPort) {
+        const ports = kind === 'imap' ? IMAP_PORTS : SMTP_PORTS;
+        const n = Number(port);
+        if (!ports.includes(n)) throw new MailHostRefused(`Port ${Number.isFinite(n) ? n : port} is not used for mail here - use ${ports.join(', ')}.`);
+    }
+    const servername = net.isIP(name) ? undefined : name;
+    if (isSigned && Object.hasOwn(LOOPBACK, name)) {
+        const address = LOOPBACK[name];
+        return {address, family: net.isIP(address), servername};
+    }
+    try {
+        // own: an empty set - see the module note on this server's public address.
+        const r = await resolvePublic(name, {allowPrivate: !check, lookup, own: new Set()});
+        return {address: r.address, family: r.family, servername};
+    } catch (err) {
+        if (!(err instanceof FetchRefused)) throw err;
+        if (/could not be found/.test(err.message)) {
+            throw Object.assign(new Error(`getaddrinfo ENOTFOUND ${name}`), {code: 'ENOTFOUND'});
+        }
+        throw new MailHostRefused(REFUSED_PRIVATE);
+    }
+}

package/server/services/notification-sources.js

@@ -317,7 +317,8 @@ export async function registerCoreSources() {
 export function emailFailed(message) {
     return notify({source: 'core:email', severity: 'warning', dedupeKey: `email-failed:${day()}`, link: '#/settings',
         title: 'An email could not be sent',
-        body: `The mail server refused or could not be reached: ${String(message || '').slice(0, 300)}\n\nPassword resets and form emails may not be arriving. Check Settings > Email.`});
+        // `message` is email.js's plain text, never the mail server's own words (those are in the server log).
+        body: `${String(message || 'The mail server refused the message or could not be reached.').slice(0, 300)}\n\nPassword resets and form emails may not be arriving. Check Settings > Email; the server log has the mail server's reply.`});
 }
 
 /** email.js: no SMTP host, so mail goes to a test inbox. */