imapflow 1.3.6 → 1.4.0

package/test/imap-flow-proxy-paths-test.js

@@ -0,0 +1,215 @@
+'use strict';
+
+// Exercises connect()'s proxy code path by injecting a mocked proxyConnection
+// (via proxyquire) that returns a cleartext socket connected to an in-process
+// mock IMAP server. Also covers the proxy-setup failure path.
+
+const net = require('net');
+const tls = require('tls');
+const proxyquire = require('proxyquire');
+const { cert, key } = require('./fixtures/test-tls');
+
+const CAPS = 'IMAP4rev1 ID ENABLE NAMESPACE';
+
+// Minimal mock IMAP server (plaintext) sufficient for a full session.
+const createServer = () =>
+    net.createServer(socket => {
+        socket.on('error', () => {});
+        let buf = '';
+        socket.on('data', data => {
+            buf += data.toString('binary');
+            let idx;
+            while ((idx = buf.indexOf('\r\n')) >= 0) {
+                let line = buf.slice(0, idx);
+                buf = buf.slice(idx + 2);
+                let parts = line.split(' ');
+                let tag = parts[0];
+                let cmd = (parts[1] || '').toUpperCase();
+                switch (cmd) {
+                    case 'CAPABILITY':
+                        socket.write(`* CAPABILITY ${CAPS}\r\n${tag} OK done\r\n`);
+                        break;
+                    case 'ID':
+                        socket.write(`* ID ("name" "mock" "version" "1")\r\n${tag} OK done\r\n`);
+                        break;
+                    case 'LOGIN':
+                        socket.write(`${tag} OK LOGIN done\r\n`);
+                        break;
+                    case 'NAMESPACE':
+                        socket.write(`* NAMESPACE (("" "/")) NIL NIL\r\n${tag} OK done\r\n`);
+                        break;
+                    case 'ENABLE':
+                        socket.write(`${tag} OK done\r\n`);
+                        break;
+                    case 'LOGOUT':
+                        socket.write(`* BYE bye\r\n${tag} OK done\r\n`);
+                        break;
+                    default:
+                        socket.write(`${tag} OK ok\r\n`);
+                }
+            }
+        });
+        socket.write(`* OK [CAPABILITY ${CAPS}] ready\r\n`);
+    });
+
+const listen = server => new Promise(resolve => server.listen(0, '127.0.0.1', () => resolve(server.address().port)));
+
+module.exports['Proxy: cleartext connection established through a proxy socket'] = async test => {
+    let server = createServer();
+    let port = await listen(server);
+
+    // Mock proxyConnection to hand back a real cleartext socket to our server.
+    const { ImapFlow } = proxyquire('../lib/imap-flow', {
+        './proxy-connection': {
+            proxyConnection: async () => net.connect(port, '127.0.0.1'),
+            detachEarlyErrorHandler: () => {}
+        }
+    });
+
+    let client = new ImapFlow({
+        host: '127.0.0.1',
+        port,
+        secure: false,
+        proxy: 'socks://127.0.0.1:1080',
+        disableAutoIdle: true,
+        disableCompression: true,
+        logger: false,
+        auth: { user: 'test', pass: 'secret' }
+    });
+    client.on('error', () => {});
+
+    await client.connect();
+    test.ok(client.usable, 'session established over the proxied socket');
+    test.ok(client.authenticated);
+
+    await client.logout();
+    client.close();
+    server.close();
+    test.done();
+};
+
+module.exports['Proxy: TLS connection established through a proxy socket'] = async test => {
+    let server = tls.createServer({ cert, key }, socket => {
+        socket.on('error', () => {});
+        let buf = '';
+        socket.on('data', data => {
+            buf += data.toString('binary');
+            let idx;
+            while ((idx = buf.indexOf('\r\n')) >= 0) {
+                let line = buf.slice(0, idx);
+                buf = buf.slice(idx + 2);
+                let parts = line.split(' ');
+                let tag = parts[0];
+                let cmd = (parts[1] || '').toUpperCase();
+                if (cmd === 'CAPABILITY') socket.write(`* CAPABILITY ${CAPS}\r\n${tag} OK done\r\n`);
+                else if (cmd === 'ID') socket.write(`* ID ("name" "m")\r\n${tag} OK done\r\n`);
+                else if (cmd === 'NAMESPACE') socket.write(`* NAMESPACE (("" "/")) NIL NIL\r\n${tag} OK done\r\n`);
+                else if (cmd === 'LOGOUT') socket.write(`* BYE bye\r\n${tag} OK done\r\n`);
+                else socket.write(`${tag} OK ok\r\n`);
+            }
+        });
+        socket.write(`* OK [CAPABILITY ${CAPS}] ready\r\n`);
+    });
+    let port = await listen(server);
+
+    // proxyConnection returns a plaintext TCP socket; the client then wraps it in TLS.
+    const { ImapFlow } = proxyquire('../lib/imap-flow', {
+        './proxy-connection': {
+            proxyConnection: async () => net.connect(port, '127.0.0.1'),
+            detachEarlyErrorHandler: () => {}
+        }
+    });
+
+    let client = new ImapFlow({
+        host: '127.0.0.1',
+        port,
+        secure: true,
+        servername: 'localhost',
+        tls: { rejectUnauthorized: false },
+        proxy: 'socks://127.0.0.1:1080',
+        disableAutoIdle: true,
+        disableCompression: true,
+        logger: false,
+        auth: { user: 'test', pass: 'secret' }
+    });
+    client.on('error', () => {});
+
+    await client.connect();
+    test.ok(client.secureConnection, 'TLS handshake over the proxy socket');
+    test.ok(client.usable);
+
+    await client.logout();
+    client.close();
+    server.close();
+    test.done();
+};
+
+module.exports['Proxy: a null proxy socket rejects connect'] = async test => {
+    const { ImapFlow } = proxyquire('../lib/imap-flow', {
+        './proxy-connection': {
+            proxyConnection: async () => null, // proxy setup yields no socket
+            detachEarlyErrorHandler: () => {}
+        }
+    });
+
+    let client = new ImapFlow({
+        host: '127.0.0.1',
+        port: 1,
+        secure: false,
+        proxy: 'socks://127.0.0.1:1080',
+        disableAutoIdle: true,
+        disableCompression: true,
+        logger: false,
+        auth: { user: 'test', pass: 'secret' }
+    });
+    client.on('error', () => {});
+
+    let err = null;
+    try {
+        await client.connect();
+    } catch (e) {
+        err = e;
+    }
+    test.ok(err, 'connect rejected when proxy returns no socket');
+    test.equal(err.code, 'ProxyError');
+
+    client.close();
+    test.done();
+};
+
+module.exports['Proxy: proxyConnection throwing rejects connect'] = async test => {
+    const { ImapFlow } = proxyquire('../lib/imap-flow', {
+        './proxy-connection': {
+            proxyConnection: async () => {
+                let e = new Error('SOCKS handshake failed');
+                e.code = 'ESOCKS';
+                throw e;
+            },
+            detachEarlyErrorHandler: () => {}
+        }
+    });
+
+    let client = new ImapFlow({
+        host: '127.0.0.1',
+        port: 1,
+        secure: false,
+        proxy: 'socks://127.0.0.1:1080',
+        disableAutoIdle: true,
+        disableCompression: true,
+        logger: false,
+        auth: { user: 'test', pass: 'secret' }
+    });
+    client.on('error', () => {});
+
+    let err = null;
+    try {
+        await client.connect();
+    } catch (e) {
+        err = e;
+    }
+    test.ok(err);
+    test.equal(err.code, 'ESOCKS');
+
+    client.close();
+    test.done();
+};

package/test/imap-flow-secure-test.js

@@ -0,0 +1,327 @@
+'use strict';
+
+// End-to-end secure-transport tests: a successful STARTTLS upgrade and a direct
+// TLS connection, both against in-process mock servers using a self-signed cert.
+// These cover upgradeToSTARTTLS()'s success path and the TLS branches of connect().
+
+const net = require('net');
+const tls = require('tls');
+const { ImapFlow } = require('../lib/imap-flow');
+const { cert, key } = require('./fixtures/test-tls');
+
+const CAPS = 'IMAP4rev1 ID ENABLE NAMESPACE';
+
+// Shared per-connection IMAP line handler used by both the plaintext and the
+// upgraded TLS phases. Returns responses for the minimal session commands.
+const handleLine = (sock, line, onStartTls) => {
+    let parts = line.split(' ');
+    let tag = parts[0];
+    let cmd = (parts[1] || '').toUpperCase();
+    switch (cmd) {
+        case 'CAPABILITY':
+            sock.write(`* CAPABILITY ${CAPS} STARTTLS\r\n${tag} OK CAPABILITY done\r\n`);
+            break;
+        case 'STARTTLS':
+            sock.write(`${tag} OK Begin TLS\r\n`);
+            if (onStartTls) {
+                onStartTls();
+            }
+            break;
+        case 'ID':
+            sock.write(`* ID ("name" "mock" "version" "1")\r\n${tag} OK ID done\r\n`);
+            break;
+        case 'LOGIN':
+            sock.write(`${tag} OK LOGIN done\r\n`);
+            break;
+        case 'NAMESPACE':
+            sock.write(`* NAMESPACE (("" "/")) NIL NIL\r\n${tag} OK NAMESPACE done\r\n`);
+            break;
+        case 'ENABLE':
+            sock.write(`${tag} OK ENABLE done\r\n`);
+            break;
+        case 'COMPRESS':
+            sock.write(`${tag} NO not now\r\n`);
+            break;
+        case 'NOOP':
+            sock.write(`${tag} OK NOOP done\r\n`);
+            break;
+        case 'LOGOUT':
+            sock.write(`* BYE bye\r\n${tag} OK LOGOUT done\r\n`);
+            break;
+        default:
+            sock.write(`${tag} BAD unknown ${cmd}\r\n`);
+    }
+};
+
+const lineReader = (sock, onLine) => {
+    let buf = '';
+    let handler = data => {
+        buf += data.toString('binary');
+        let idx;
+        while ((idx = buf.indexOf('\r\n')) >= 0) {
+            let line = buf.slice(0, idx);
+            buf = buf.slice(idx + 2);
+            onLine(line);
+        }
+    };
+    sock.on('data', handler);
+    sock.on('error', () => {});
+    return () => sock.removeListener('data', handler);
+};
+
+const listen = server => new Promise(resolve => server.listen(0, '127.0.0.1', () => resolve(server.address().port)));
+
+// ---------------------------------------------------------------------------
+// STARTTLS happy path
+// ---------------------------------------------------------------------------
+
+module.exports['Secure: STARTTLS upgrade completes a session'] = async test => {
+    let server = net.createServer(rawSocket => {
+        rawSocket.on('error', () => {});
+
+        let detachPlain;
+        detachPlain = lineReader(rawSocket, line => {
+            handleLine(rawSocket, line, () => {
+                // Upgrade: stop reading plaintext, wrap the socket in TLS
+                detachPlain();
+                let tlsSocket = new tls.TLSSocket(rawSocket, { isServer: true, key, cert });
+                tlsSocket.on('error', () => {});
+                tlsSocket.on('secure', () => {});
+                lineReader(tlsSocket, l => handleLine(tlsSocket, l));
+            });
+        });
+
+        rawSocket.write(`* OK [CAPABILITY ${CAPS} STARTTLS] ready\r\n`);
+    });
+
+    let port = await listen(server);
+    let client = new ImapFlow({
+        host: '127.0.0.1',
+        port,
+        secure: false,
+        doSTARTTLS: true,
+        servername: 'localhost',
+        tls: { rejectUnauthorized: false },
+        disableAutoIdle: true,
+        disableCompression: true,
+        logger: false,
+        auth: { user: 'test', pass: 'secret' }
+    });
+    client.on('error', () => {});
+
+    await client.connect();
+    test.ok(client.secureConnection, 'connection upgraded to TLS');
+    test.ok(client.authenticated, 'authenticated over TLS');
+    test.ok(client.usable);
+
+    await client.noop();
+    await client.logout();
+    client.close();
+    server.close();
+    test.done();
+};
+
+// ---------------------------------------------------------------------------
+// Direct TLS connection
+// ---------------------------------------------------------------------------
+
+module.exports['Secure: direct TLS connection completes a session'] = async test => {
+    let server = tls.createServer({ key, cert }, sock => {
+        sock.on('error', () => {});
+        lineReader(sock, line => handleLine(sock, line));
+        sock.write(`* OK [CAPABILITY ${CAPS}] ready\r\n`);
+    });
+
+    let port = await listen(server);
+    let client = new ImapFlow({
+        host: '127.0.0.1',
+        port,
+        secure: true,
+        servername: 'localhost',
+        tls: { rejectUnauthorized: false },
+        disableAutoIdle: true,
+        disableCompression: true,
+        logger: false,
+        auth: { user: 'test', pass: 'secret' }
+    });
+    client.on('error', () => {});
+
+    await client.connect();
+    test.ok(client.secureConnection);
+    test.ok(client.authenticated);
+    test.ok(client.tls, 'cipher info recorded');
+
+    await client.noop();
+    await client.logout();
+    client.close();
+    server.close();
+    test.done();
+};
+
+// ---------------------------------------------------------------------------
+// STARTTLS required but unsupported -> fail closed
+// ---------------------------------------------------------------------------
+
+module.exports['Secure: doSTARTTLS=false skips an advertised upgrade'] = async test => {
+    let server = net.createServer(sock => {
+        sock.on('error', () => {});
+        lineReader(sock, line => handleLine(sock, line)); // advertises STARTTLS in CAPABILITY
+        sock.write(`* OK [CAPABILITY ${CAPS} STARTTLS] ready\r\n`);
+    });
+    let port = await listen(server);
+    let client = new ImapFlow({
+        host: '127.0.0.1',
+        port,
+        secure: false,
+        doSTARTTLS: false, // explicitly disabled -> stay plaintext
+        tls: { rejectUnauthorized: false },
+        disableAutoIdle: true,
+        disableCompression: true,
+        logger: false,
+        auth: { user: 'test', pass: 'secret' }
+    });
+    client.on('error', () => {});
+
+    await client.connect();
+    test.ok(!client.secureConnection, 'stayed on plaintext');
+    test.ok(client.authenticated);
+
+    await client.logout();
+    client.close();
+    server.close();
+    test.done();
+};
+
+module.exports['Secure: STARTTLS command rejected by server fails closed'] = async test => {
+    let server = net.createServer(sock => {
+        sock.on('error', () => {});
+        lineReader(sock, line => {
+            let parts = line.split(' ');
+            let tag = parts[0];
+            let cmd = (parts[1] || '').toUpperCase();
+            if (cmd === 'CAPABILITY') {
+                sock.write(`* CAPABILITY ${CAPS} STARTTLS\r\n${tag} OK done\r\n`);
+            } else if (cmd === 'STARTTLS') {
+                sock.write(`${tag} NO STARTTLS not available right now\r\n`);
+            } else {
+                sock.write(`${tag} OK ok\r\n`);
+            }
+        });
+        sock.write(`* OK [CAPABILITY ${CAPS} STARTTLS] ready\r\n`);
+    });
+    let port = await listen(server);
+    let client = new ImapFlow({
+        host: '127.0.0.1',
+        port,
+        secure: false,
+        doSTARTTLS: true,
+        tls: { rejectUnauthorized: false },
+        disableAutoIdle: true,
+        disableCompression: true,
+        logger: false,
+        auth: { user: 'test', pass: 'secret' }
+    });
+    client.on('error', () => {});
+
+    let err = null;
+    try {
+        await client.connect();
+    } catch (e) {
+        err = e;
+    }
+    test.ok(err, 'connect rejected when STARTTLS refused');
+    test.ok(err.tlsFailed);
+
+    client.close();
+    server.close();
+    test.done();
+};
+
+module.exports['Secure: STARTTLS handshake error rejects connect'] = async test => {
+    // Server acknowledges STARTTLS then sends non-TLS garbage so the client's TLS
+    // handshake fails, exercising the dedicated TLS-socket error handler.
+    let server = net.createServer(rawSocket => {
+        rawSocket.on('error', () => {});
+        let detach = lineReader(rawSocket, line => {
+            handleLine(rawSocket, line, () => {
+                detach();
+                // garbage instead of a TLS ServerHello
+                rawSocket.write(Buffer.from('this is definitely not a TLS handshake\r\n'.repeat(8)));
+            });
+        });
+        rawSocket.write(`* OK [CAPABILITY ${CAPS} STARTTLS] ready\r\n`);
+    });
+    let port = await listen(server);
+    let client = new ImapFlow({
+        host: '127.0.0.1',
+        port,
+        secure: false,
+        doSTARTTLS: true,
+        servername: 'localhost',
+        tls: { rejectUnauthorized: false },
+        disableAutoIdle: true,
+        disableCompression: true,
+        logger: false,
+        auth: { user: 'test', pass: 'secret' }
+    });
+    client.on('error', () => {});
+
+    let err = null;
+    try {
+        await client.connect();
+    } catch (e) {
+        err = e;
+    }
+    test.ok(err, 'connect rejected on TLS handshake failure');
+    test.ok(err.tlsFailed, 'flagged as a TLS failure');
+
+    client.close();
+    server.close();
+    test.done();
+};
+
+module.exports['Secure: STARTTLS required but not advertised throws'] = async test => {
+    let server = net.createServer(sock => {
+        sock.on('error', () => {});
+        lineReader(sock, line => {
+            let parts = line.split(' ');
+            let tag = parts[0];
+            let cmd = (parts[1] || '').toUpperCase();
+            if (cmd === 'CAPABILITY') {
+                // no STARTTLS advertised
+                sock.write(`* CAPABILITY ${CAPS}\r\n${tag} OK done\r\n`);
+            } else {
+                sock.write(`${tag} OK ok\r\n`);
+            }
+        });
+        sock.write(`* OK [CAPABILITY ${CAPS}] ready\r\n`);
+    });
+
+    let port = await listen(server);
+    let client = new ImapFlow({
+        host: '127.0.0.1',
+        port,
+        secure: false,
+        doSTARTTLS: true,
+        servername: 'localhost',
+        tls: { rejectUnauthorized: false },
+        disableAutoIdle: true,
+        disableCompression: true,
+        logger: false,
+        auth: { user: 'test', pass: 'secret' }
+    });
+    client.on('error', () => {});
+
+    let err = null;
+    try {
+        await client.connect();
+    } catch (e) {
+        err = e;
+    }
+    test.ok(err, 'connect rejected');
+    test.ok(err.tlsFailed, 'flagged as TLS failure');
+
+    client.close();
+    server.close();
+    test.done();
+};