mailauth 5.0.3 → 7.0.0

package/lib/parse-received.js

@@ -1,6 +1,9 @@
 'use strict';
 
 const { DANGEROUS_KEYS } = require('./safe-keys');
+const { isIP } = require('node:net');
+
+const TLS_COMMENT = /tls|cipher=|Google Transport Security/i;
 
 const parseReceived = buf => {
     let header = (buf || '').toString();
@@ -31,6 +34,29 @@ const parseReceived = buf => {
 
     let curValue = nextValue();
 
+    // adds a character of a key or a value, starting the next one where needed
+    let appendChar = c => {
+        if (state === 'none') {
+            state = 'val';
+            switch (curKey) {
+                case '':
+                    curKey = 'key';
+                    break;
+                case 'key':
+                    curKey = 'value';
+                    break;
+                case 'value':
+                case 'comment':
+                    curValue = nextValue();
+                    curKey = 'key';
+                    break;
+            }
+        } else if (curKey === 'comment' && c === '(') {
+            commentLevel++;
+        }
+        curValue[curKey] += c;
+    };
+
     for (let i = 0; i < headerValue.length; i++) {
         let c = headerValue.charAt(i);
 
@@ -46,12 +72,16 @@ const parseReceived = buf => {
         }
 
         if (quoted) {
-            if (c === quoted) {
-                quoted = false;
-                state = 'none';
+            // RFC 5322 quoted-string, kept as it is, quotes included, so that an address
+            // such as <"x;y"@example.com> keeps its local-part
+            if (c === '\\' && i < headerValue.length - 1) {
+                curValue[curKey] += c + headerValue.charAt(++i);
                 continue;
             }
             curValue[curKey] += c;
+            if (c === '"') {
+                quoted = false;
+            }
             continue;
         }
 
@@ -85,8 +115,9 @@ const parseReceived = buf => {
                 state = 'none';
                 break;
             case '"':
-            case "'":
-                // start quoting
+                // start quoting. Only the double quote quotes (RFC 5322 section 3.2.4), an
+                // apostrophe is an ordinary character, as in <o'brien@example.com>
+                appendChar(c);
                 quoted = c;
                 break;
             case '(':
@@ -102,30 +133,7 @@ const parseReceived = buf => {
                 escaped = true;
                 break;
             default:
-                if (state === 'none') {
-                    state = 'val';
-                    switch (curKey) {
-                        case '':
-                            curKey = 'key';
-                            curValue[curKey] += c;
-                            break;
-                        case 'key':
-                            curKey = 'value';
-                            curValue[curKey] += c;
-                            break;
-                        case 'value':
-                        case 'comment':
-                            curValue = nextValue();
-                            curKey = 'key';
-                            curValue[curKey] += c;
-                            break;
-                    }
-                } else {
-                    if (curKey === 'comment' && c === '(') {
-                        commentLevel++;
-                    }
-                    curValue[curKey] += c;
-                }
+                appendChar(c);
         }
     }
 
@@ -148,13 +156,27 @@ const parseReceived = buf => {
         }
     }
 
+    // A from clause can have more than one comment after it. Postfix writes the TCP-info
+    // comment after the HELO name, and a HELO name with parentheses in it looks like a
+    // comment of its own, as in "from x([192.0.2.1]) (unknown [198.51.100.7])". The comments
+    // are kept together, in order, so that the TCP-info comment is always the last part
+    for (let i = 1; i < values.length; i++) {
+        let val = values[i];
+        let prev = values[i - 1];
+        if (!val.key && !val.value && val.comment && (prev.key || '').toLowerCase() === 'from' && !TLS_COMMENT.test(val.comment)) {
+            prev.comment = [prev.comment || []].concat(val.comment).join(' ');
+            values.splice(i, 1);
+            i--;
+        }
+    }
+
     for (let val of values) {
         if (val.comment) {
             val.comment = val.comment.replace(/\s+/g, ' ').trim();
         }
         if (val.key) {
             let key = val.key.toLowerCase();
-            if (key !== 'from' && !result.tls && /tls|cipher=|Google Transport Security/i.test(val.comment)) {
+            if (key !== 'from' && !result.tls && TLS_COMMENT.test(val.comment)) {
                 result.tls = { value: '', ...(val.comment && { comment: val.comment }) };
                 val.comment = '';
             }
@@ -163,7 +185,7 @@ const parseReceived = buf => {
                 continue;
             }
             result[key] = { value: val.value, ...(val.comment && { comment: val.comment }) };
-        } else if (!result.tls && /tls|cipher=|Google Transport Security/i.test(val.comment)) {
+        } else if (!result.tls && TLS_COMMENT.test(val.comment)) {
             result.tls = { value: val.value, ...(val.comment && { comment: val.comment }) };
         }
     }
@@ -181,4 +203,54 @@ const parseReceived = buf => {
     return result;
 };
 
-module.exports = { parseReceived };
+// An address literal (RFC 5321 section 4.1.3), with an optional port after it as Exim writes
+// it. The content is checked with isIP separately
+const ADDRESS_LITERAL = /\[(?:IPv6:)?([^\]\s]+)\](?::\d+)?/gi;
+// "helo=" or "ehlo=" right before a literal, the client's own claim, not its address
+const HELO_PREFIX = /(?:^|[\s(;,])(?:helo|ehlo)=\s*$/i;
+
+/**
+ * Finds the IP address of the client in the from clause of a parsed Received header.
+ *
+ * RFC 5321 section 4.4 puts the address the connection came from into the TCP-info comment
+ * of the from clause, "from helo.name (rdns.name [192.0.2.1])", so it is the last address
+ * literal of that comment. The rest of the clause is the client's own claim: the HELO name,
+ * which can itself be an address literal, and in Exim's format a "helo=" value inside the
+ * comment. Those are never used. Exim writes "from [192.0.2.1] (helo=...)" for a client
+ * without reverse DNS, where the literal in front of the comment is the address of the
+ * connection, which is only used when the comment has no address literal of its own.
+ *
+ * @param {Object} from The "from" entry of parseReceived(), { value, comment }
+ * @returns {String|false} IP address, without an "IPv6:" prefix, or false if none was found
+ */
+const getClientAddress = from => {
+    if (!from || typeof from !== 'object') {
+        return false;
+    }
+
+    let comment = typeof from.comment === 'string' ? from.comment : '';
+    let value = typeof from.value === 'string' ? from.value.trim() : '';
+
+    let address = false;
+    for (let match of comment.matchAll(ADDRESS_LITERAL)) {
+        if (HELO_PREFIX.test(comment.substring(0, match.index))) {
+            continue;
+        }
+        if (isIP(match[1])) {
+            address = match[1];
+        }
+    }
+
+    if (address) {
+        return address;
+    }
+
+    let valueMatch = value.match(/^\[(?:IPv6:)?([^\]\s]+)\](?::\d+)?$/i);
+    if (valueMatch && comment && isIP(valueMatch[1])) {
+        return valueMatch[1];
+    }
+
+    return false;
+};
+
+module.exports = { parseReceived, getClientAddress };

package/lib/spf/index.d.ts

@@ -1,6 +1,42 @@
 // Type definitions for mailauth/lib/spf
 
-import { SPFOptions, SPFResult } from '../../index';
+import { SPFOptions as BaseSPFOptions, SPFResult as BaseSPFResult } from '../../index';
+
+/**
+ * SPF verification options
+ */
+export interface SPFOptions extends BaseSPFOptions {
+    /**
+     * Follow RFC 7208 exactly instead of the lenient default (default: false). Strict mode
+     * validates the whole record before evaluation, rejects the c, r and t macros outside of
+     * explanation text, counts void lookups per RFC 7208 section 4.6.4, discards records with
+     * leading whitespace, and reports only the checked identity in Authentication-Results
+     */
+    strict?: boolean;
+
+    /**
+     * Maximum time in milliseconds for the whole evaluation. If exceeded, the result is
+     * temperror (RFC 7208 section 4.6.4). No limit by default
+     */
+    maxElapsedTime?: number;
+}
+
+/**
+ * SPF verification result
+ */
+export interface SPFResult extends BaseSPFResult {
+    /**
+     * Explanation string published by the domain owner with the "exp" modifier
+     * (RFC 7208 section 6.2). Only set for a "fail" result. This is third party text
+     */
+    explanation?: string;
+
+    /**
+     * Set in the default mode when something was accepted that strict mode would have
+     * rejected: "syntax-error", "void-lookup-limit" or "non-ascii-local-part"
+     */
+    warnings?: string[];
+}
 
 /**
  * Verifies SPF for a sender