mailauth 3.0.3 → 4.0.0

package/README.md

@@ -48,7 +48,8 @@ Where
         -   **selector** (_string_) ARC key selector
         -   **privateKey** (_string_ or _buffer_) Private key for signing. Either an RSA or an Ed25519 key
     -   **resolver** (_async function_) is an optional async function for DNS requests. Defaults to [dns.promises.resolve](https://nodejs.org/api/dns.html#dns_dnspromises_resolve_hostname_rrtype)
-    -   **maxResolveCount** (_number_ defaults to _50_) is the DNS lookup limit for SPF. [RFC7208](https://datatracker.ietf.org/doc/html/rfc7208#section-4.6.4) requires this limit to be 10. Mailauth is less strict and defaults to 50.
+    -   **maxResolveCount** (_number_ defaults to _10_) is the DNS lookup limit for SPF. [RFC7208](https://datatracker.ietf.org/doc/html/rfc7208#section-4.6.4) requires this limit to be 10.
+    -   **maxVoidCount** (_number_ defaults to _2_) is the DNS lookup limit for SPF that produce an empty result. [RFC7208](https://datatracker.ietf.org/doc/html/rfc7208#section-4.6.4) requires this limit to be 2.
 
 **Example**
 
@@ -403,7 +404,6 @@ The function returns a boolean. If it is `true`, then MX hostname is allowed to
 
 [OpenSPF test suite](http://www.openspf.org/Test_Suite) ([archive.org mirror](https://web.archive.org/web/20190130131432/http://www.openspf.org/Test_Suite)) with the following differences:
 
--   No PTR support in `mailauth`. All PTR related tests are ignored
 -   Less strict whitespace checks (`mailauth` accepts multiple spaces between tags etc.)
 -   Some macro tests are skipped (macro expansion is supported _in most parts_)
 -   Some tests where the invalid component is listed after a matching part (mailauth processes from left to right and returns on the first match found)

package/bin/mailauth.js

@@ -52,7 +52,13 @@ const argv = yargs(hideBin(process.argv))
                     alias: 'x',
                     type: 'number',
                     description: 'Maximum allowed DNS lookups',
-                    default: 50
+                    default: 10
+                })
+                .option('max-void-lookups', {
+                    alias: 'z',
+                    type: 'number',
+                    description: 'Maximum allowed empty DNS lookups',
+                    default: 2
                 });
             yargs.positional('email', {
                 describe: 'Path to the email message file in EML format. If not specified then content is read from stdin'
@@ -275,7 +281,13 @@ const argv = yargs(hideBin(process.argv))
                     alias: 'x',
                     type: 'number',
                     description: 'Maximum allowed DNS lookups',
-                    default: 50
+                    default: 10
+                })
+                .option('max-void-lookups', {
+                    alias: 'z',
+                    type: 'number',
+                    description: 'Maximum allowed empty DNS lookups',
+                    default: 2
                 });
         },
         argv => {

package/cli.md

@@ -59,7 +59,8 @@ Where
 -   `--mta hostname` or `-m hostname` is the server hostname doing the validation checks. Defaults to `os.hostname()`
 -   `--dns-cache /path/to/dns.json` or `-n path` is the path to a file with cached DNS query responses. If this file is provided then no actual DNS requests are performed, only cached values from this file are used.
 -   `--verbose` or `-v` if this flag is set then mailauth writes some debugging info to standard error
--   `--max-lookups nr` or `-x nr` defines the allowed DNS lookup limit for SPF checks. Defaults to 50.
+-   `--max-lookups nr` or `-x nr` defines the allowed DNS lookup limit for SPF checks. Defaults to 10.
+-   `--max-void-lookups nr` or `-z nr` defines the allowed DNS lookup limit for SPF checks. Defaults to 2.
 
 **Example**
 
@@ -187,14 +188,15 @@ Where
 -   `--dns-cache /path/to/dns.json` or `-n path` is the path to a file with cached DNS query responses. If this file is provided then no actual DNS requests are performed, only cached values from this file are used.
 -   `--verbose` or `-v` if this flag is set then mailauth writes some debugging info to standard error
 -   `--headers-only` or `-o` If set return SPF authentication header only. Default is to return a JSON structure.
--   `--max-lookups nr` or `-x nr` defines the allowed DNS lookup limit for SPF checks. Defaults to 50.
+-   `--max-lookups nr` or `-x nr` defines the allowed DNS lookup limit for SPF checks. Defaults to 10.
+-   `--max-void-lookups nr` or `-z nr` defines the allowed DNS lookup limit for SPF checks. Defaults to 2.
 
 **Example**
 
 ```
 $ mailauth spf --verbose -f andris@wildduck.email -i 217.146.76.20
 Checking SPF for andris@wildduck.email
-Maximum DNS lookups: 50
+Maximum DNS lookups: 10
 --------
 DNS query for TXT wildduck.email: [["v=spf1 mx a -all"]]
 DNS query for MX wildduck.email: [{"exchange":"mail.wildduck.email","priority":1}]

package/lib/commands/report.js

@@ -35,6 +35,10 @@ const cmd = async argv => {
         opts.maxResolveCount = argv.maxLookups;
     }
 
+    if (argv.maxVoidLookups) {
+        opts.maxVoidCount = argv.maxVoidLookups;
+    }
+
     for (let key of ['mta', 'helo', 'sender']) {
         if (argv[key]) {
             opts[key] = argv[key];

package/lib/commands/spf.js

@@ -28,6 +28,10 @@ const cmd = async argv => {
         opts.maxResolveCount = argv.maxLookups;
     }
 
+    if (argv.maxVoidLookups) {
+        opts.maxVoidCount = argv.maxVoidLookups;
+    }
+
     for (let key of ['sender', 'helo', 'mta']) {
         if (argv[key]) {
             opts[key] = argv[key];

package/lib/dkim/body/relaxed.js

@@ -266,27 +266,3 @@ class RelaxedHash {
 }
 
 module.exports = { RelaxedHash };
-
-/*
-let fs = require('fs');
-
-const getBody = message => {
-    message = message.toString('binary');
-    let match = message.match(/\r?\n\r?\n/);
-    if (match) {
-        message = message.substr(match.index + match[0].length);
-    }
-    return Buffer.from(message, 'binary');
-};
-
-let s = fs.readFileSync(process.argv[2]);
-
-let k = new RelaxedHash('rsa-sha256', -1);
-
-for (let byte of getBody(s)) {
-    k.update(Buffer.from([byte]));
-}
-
-console.error(k.digest('base64'));
-console.error(k.byteLength, k.bodyHashedBytes);
-*/

package/lib/spf/index.js

@@ -8,7 +8,8 @@ const Joi = require('joi');
 const domainSchema = Joi.string().domain({ allowUnicode: false, tlds: false });
 const { formatAuthHeaderRow, escapeCommentValue } = require('../tools');
 
-const MAX_RESOLVE_COUNT = 50;
+const MAX_RESOLVE_COUNT = 10;
+const MAX_VOID_COUNT = 2;
 
 const formatHeaders = result => {
     let header = `Received-SPF: ${result.status.result}${result.status.comment ? ` (${escapeCommentValue(result.status.comment)})` : ''} client-ip=${
@@ -19,23 +20,24 @@ const formatHeaders = result => {
 };
 
 // DNS resolver method
-let limitedResolver = (resolver, maxResolveCount) => {
+let limitedResolver = (resolver, maxResolveCount, maxVoidCount, ignoreFirst) => {
     let resolveCount = 0;
-    maxResolveCount = maxResolveCount || MAX_RESOLVE_COUNT;
+    let voidCount = 0;
 
-    return async (domain, type) => {
-        if (!domain && type === 'resolveCount') {
-            // special condition to get the counter
-            return resolveCount;
-        }
+    let subResolveCounts = {};
+    let firstCounted = !ignoreFirst;
 
-        if (!domain && type === 'resolveLimit') {
-            // special condition to get the limit
-            return maxResolveCount;
-        }
+    maxResolveCount = maxResolveCount || MAX_RESOLVE_COUNT;
+    maxVoidCount = maxVoidCount || MAX_VOID_COUNT;
 
+    let resolverFunc = async (domain, type) => {
         // do not allow to make more that MAX_RESOLVE_COUNT DNS requests per SPF check
-        resolveCount++;
+
+        if (firstCounted) {
+            resolveCount++;
+        } else {
+            firstCounted = true;
+        }
 
         if (resolveCount > maxResolveCount) {
             let error = new Error('Too many DNS requests');
@@ -65,8 +67,17 @@ let limitedResolver = (resolver, maxResolveCount) => {
         } catch (err) {
             switch (err.code) {
                 case 'ENOTFOUND':
-                case 'ENODATA':
+                case 'ENODATA': {
+                    voidCount++;
+                    if (voidCount > maxVoidCount) {
+                        err.spfResult = {
+                            error: 'permerror',
+                            text: 'Too many void DNS results'
+                        };
+                        throw err;
+                    }
                     return [];
+                }
 
                 case 'ETIMEOUT':
                     err.spfResult = {
@@ -80,6 +91,21 @@ let limitedResolver = (resolver, maxResolveCount) => {
             }
         }
     };
+
+    resolverFunc.updateSubQueries = (type, count) => {
+        if (!subResolveCounts[type]) {
+            subResolveCounts[type] = count;
+        } else {
+            subResolveCounts[type] += count;
+        }
+    };
+
+    resolverFunc.getResolveCount = () => resolveCount;
+    resolverFunc.getResolveLimit = () => maxResolveCount;
+    resolverFunc.getSubResolveCounts = () => subResolveCounts;
+    resolverFunc.getVoidCount = () => voidCount;
+
+    return resolverFunc;
 };
 
 /**
@@ -89,10 +115,11 @@ let limitedResolver = (resolver, maxResolveCount) => {
  * @param {String} opts.ip Client IP address
  * @param {String} opts.helo Client EHLO/HELO hostname
  * @param {String} [opts.mta] Hostname of the MTA or MX server that processes the message
- * @param {String} [opts.maxResolveCount=50] Maximum DNS lookups allowed
+ * @param {String} [opts.maxResolveCount=10] Maximum DNS lookups allowed
+ * @param {String} [opts.maxVoidCount=2] Maximum empty DNS lookups allowed
  */
 const verify = async opts => {
-    let { sender, ip, helo, mta, maxResolveCount, resolver } = opts || {};
+    let { sender, ip, helo, mta, maxResolveCount, maxVoidCount, resolver } = opts || {};
 
     mta = mta || os.hostname();
 
@@ -125,7 +152,7 @@ const verify = async opts => {
         }
     };
 
-    let verifyResolver = limitedResolver(resolver, maxResolveCount);
+    let verifyResolver = limitedResolver(resolver, maxResolveCount, maxVoidCount, true);
 
     let result;
     try {
@@ -146,7 +173,10 @@ const verify = async opts => {
             helo,
 
             // generate DNS handler
-            resolver: verifyResolver
+            resolver: verifyResolver,
+
+            // allow to create sub resolvers
+            createSubResolver: () => limitedResolver(resolver, maxResolveCount, maxVoidCount)
         });
     } catch (err) {
         if (err.spfResult) {
@@ -161,8 +191,10 @@ const verify = async opts => {
 
     if (result && typeof result === 'object') {
         result.lookups = {
-            limit: await verifyResolver(false, 'resolveLimit'),
-            count: await verifyResolver(false, 'resolveCount')
+            limit: verifyResolver.getResolveLimit(),
+            count: verifyResolver.getResolveCount(),
+            void: verifyResolver.getVoidCount(),
+            subqueries: verifyResolver.getSubResolveCounts()
         };
     }
 

package/lib/spf/spf-verify.js

@@ -5,6 +5,9 @@ const net = require('net');
 const macro = require('./macro');
 const dns = require('dns').promises;
 const ipaddr = require('ipaddr.js');
+const { getPtrHostname, formatDomain } = require('../tools');
+
+const LIMIT_PTR_RESOLVE_RECORDS = 10;
 
 const matchIp = (addr, range) => {
     if (/\/\d+$/.test(range)) {
@@ -357,18 +360,27 @@ const spfVerify = async (domain, opts) => {
 
                         let mxList = await resolver(mxDomain, 'MX');
                         if (mxList) {
-                            mxList = mxList.sort((a, b) => a.priority - b.priority);
-                            for (let mx of mxList) {
-                                if (mx.exchange) {
-                                    let responses = await resolver(mx.exchange, net.isIPv6(opts.ip) ? 'AAAA' : 'A');
-                                    if (responses) {
-                                        for (let a of responses) {
-                                            if (matchIp(addr, a + cidr)) {
-                                                return { type, val: mx.exchange, qualifier };
+                            // MX resolver has separate counter
+                            let subResolver = typeof opts.createSubResolver === 'function' ? opts.createSubResolver() : resolver;
+                            try {
+                                mxList = mxList.sort((a, b) => a.priority - b.priority);
+                                for (let mx of mxList) {
+                                    if (mx.exchange) {
+                                        let responses = await subResolver(mx.exchange, net.isIPv6(opts.ip) ? 'AAAA' : 'A');
+                                        if (responses) {
+                                            for (let a of responses) {
+                                                if (matchIp(addr, a + cidr)) {
+                                                    return { type, val: mx.exchange, qualifier };
+                                                }
                                             }
                                         }
                                     }
                                 }
+                            } finally {
+                                if (typeof resolver.updateSubQueries === 'function') {
+                                    resolver.updateSubQueries('mx', subResolver.getResolveCount());
+                                    resolver.updateSubQueries('mx:void', subResolver.getVoidCount());
+                                }
                             }
                         }
                     }
@@ -391,7 +403,73 @@ const spfVerify = async (domain, opts) => {
                     break;
 
                 case 'ptr':
-                    // ignore, not supported
+                    {
+                        let { cidr4, cidr6 } = parseCidrValue(val, false, type);
+                        if (cidr4 || cidr6) {
+                            let err = new Error('SPF failure');
+                            err.spfResult = { error: 'permerror', text: `invalid domain-spec definition: ${val}` };
+                            throw err;
+                        }
+
+                        let ptrDomain;
+                        if (val) {
+                            ptrDomain = macro(val, opts);
+                        } else {
+                            ptrDomain = macro('%{d}', opts);
+                        }
+                        ptrDomain = formatDomain(ptrDomain);
+
+                        // Step 1. Resolve PTR hostnames
+                        let ptrValues;
+                        if (opts._resolvedPtr) {
+                            ptrValues = opts._resolvedPtr;
+                        } else {
+                            let responses = await resolver(getPtrHostname(addr), 'PTR');
+                            opts._resolvedPtr = ptrValues = responses && responses.length ? responses : [];
+                        }
+
+                        // PTR resolver has separate counter
+                        let subResolver = typeof opts.createSubResolver === 'function' ? opts.createSubResolver() : resolver;
+
+                        let resolvers = [];
+                        for (let ptrValue of ptrValues) {
+                            if (resolvers.length < LIMIT_PTR_RESOLVE_RECORDS) {
+                                // resolve up to 10 PTR A/AAAA records
+                                // https://datatracker.ietf.org/doc/html/rfc7208#section-4.6.4
+                                resolvers.push(subResolver(ptrValue, net.isIPv6(opts.ip) ? 'AAAA' : 'A'));
+                            }
+                        }
+
+                        // Step 2. Validate PTR hostnames by reverse resolving these
+                        let validatedPtrRecords = [];
+                        let results = await Promise.allSettled(resolvers);
+
+                        if (typeof resolver.updateSubQueries === 'function') {
+                            resolver.updateSubQueries('ptr', subResolver.getResolveCount());
+                            resolver.updateSubQueries('ptr:void', subResolver.getVoidCount());
+                        }
+
+                        for (let i = 0; i < results.length; i++) {
+                            let result = results[i];
+                            let ptrHostname = ptrValues[i];
+                            if (
+                                result.status === 'fulfilled' &&
+                                Array.isArray(result.value) &&
+                                result.value.map(val => ipaddr.parse(val).toNormalizedString()).includes(addr.toNormalizedString())
+                            ) {
+                                validatedPtrRecords.push(ptrHostname);
+                            }
+                        }
+
+                        // Step 3. Check subdomain alignment
+                        for (let ptrRecord of validatedPtrRecords) {
+                            let formattedPtrRecord = formatDomain(ptrRecord);
+
+                            if (formattedPtrRecord === ptrDomain || formattedPtrRecord.substr(-(ptrDomain.length + 1)) === `.${ptrDomain}`) {
+                                return { type, val: ptrRecord, qualifier };
+                            }
+                        }
+                    }
                     break;
             }
         }

package/lib/tools.js

@@ -470,6 +470,21 @@ const validateAlgorithm = (algorithm, strict) => {
     }
 };
 
+const getPtrHostname = parsedAddr => {
+    let bytes = parsedAddr.toByteArray();
+    if (bytes.length === 4) {
+        return `${bytes
+            .map(a => a.toString(10))
+            .reverse()
+            .join('.')}.in-addr.arpa`;
+    } else {
+        return `${bytes
+            .flatMap(a => a.toString(16).padStart(2, '0').split(''))
+            .reverse()
+            .join('.')}.ip6.arpa`;
+    }
+};
+
 module.exports = {
     writeToStream,
     parseHeaders,
@@ -491,5 +506,7 @@ module.exports = {
     getAlignment,
 
     formatRelaxedLine,
-    formatDomain
+    formatDomain,
+
+    getPtrHostname
 };

package/licenses.txt

@@ -1,12 +1,12 @@
 name             license type               link                                                            installed version  author
 ----             ------------               ----                                                            -----------------  ------
-@postalsys/vmc   MIT                        https://registry.npmjs.org/@postalsys/vmc/-/vmc-1.0.4.tgz       1.0.4              Postal Systems OÜ
-fast-xml-parser  MIT                        git+https://github.com/NaturalIntelligence/fast-xml-parser.git  4.0.9              Amit Gupta https://amitkumargupta.work/
-ipaddr.js        MIT                        git://github.com/whitequark/ipaddr.js.git                       2.0.1              whitequark whitequark@whitequark.org
-joi              BSD-3-Clause               git://github.com/sideway/joi.git                                17.6.0
-libmime          MIT                        git://github.com/andris9/libmime.git                            5.1.0              Andris Reinman andris@kreata.ee
+@postalsys/vmc   MIT                        https://registry.npmjs.org/@postalsys/vmc/-/vmc-1.0.5.tgz       1.0.5              Postal Systems OÜ
+fast-xml-parser  MIT                        git+https://github.com/NaturalIntelligence/fast-xml-parser.git  4.0.9              Amit Gupta (https://amitkumargupta.work/)
+ipaddr.js        MIT                        git://github.com/whitequark/ipaddr.js.git                       2.0.1              whitequark <whitequark@whitequark.org>
+joi              BSD-3-Clause               git://github.com/sideway/joi.git                                17.6.0             n/a
+libmime          MIT                        git://github.com/andris9/libmime.git                            5.1.0              Andris Reinman <andris@kreata.ee>
 node-forge       (BSD-3-Clause OR GPL-2.0)  git+https://github.com/digitalbazaar/forge.git                  1.3.1              Digital Bazaar, Inc. support@digitalbazaar.com http://digitalbazaar.com/
 nodemailer       MIT                        git+https://github.com/nodemailer/nodemailer.git                6.7.7              Andris Reinman
-psl              MIT                        git+ssh://git@github.com/lupomontero/psl.git                    1.9.0              Lupo Montero lupomontero@gmail.com https://lupomontero.com/
+psl              MIT                        git+ssh://git@github.com/lupomontero/psl.git                    1.9.0              Lupo Montero <lupomontero@gmail.com> (https://lupomontero.com/)
 punycode         MIT                        git+https://github.com/bestiejs/punycode.js.git                 2.1.1              Mathias Bynens https://mathiasbynens.be/
-yargs            MIT                        git+https://github.com/yargs/yargs.git                          17.5.1
+yargs            MIT                        git+https://github.com/yargs/yargs.git                          17.5.1             n/a

package/man/mailauth.1

@@ -1,4 +1,4 @@
-.TH "MAILAUTH" "1" "July 2022" "v3.0.2" "Mailauth Help"
+.TH "MAILAUTH" "1" "July 2022" "v3.0.3" "Mailauth Help"
 .SH "NAME"
 \fBmailauth\fR
 .QP

package/man/man.md

@@ -103,7 +103,10 @@ content is read from standard input.
     Return signing headers only. By default, the entire message is printed to the console. (`sign`, `seal`, `spf`)
 
 -   `--max-lookups`, `-x`
-    How many DNS lookups allowed for SPF validation. Defaults to 50. (`report`, `spf`)
+    How many DNS lookups allowed for SPF validation. Defaults to 10. (`report`, `spf`)
+
+-   `--max-void-lookups`, `-z`
+    How many empty DNS lookups allowed for SPF validation. Defaults to 2. (`report`, `spf`)
 
 ## DNS CACHE
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mailauth",
-    "version": "3.0.3",
+    "version": "4.0.0",
     "description": "Email authentication library for Node.js",
     "main": "lib/mailauth.js",
     "scripts": {
@@ -37,7 +37,7 @@
         "eslint-config-nodemailer": "1.2.0",
         "eslint-config-prettier": "8.5.0",
         "js-yaml": "4.1.0",
-        "license-report": "5.0.2",
+        "license-report": "6.0.0",
         "marked": "0.7.0",
         "marked-man": "0.7.0",
         "mbox-reader": "1.1.5",