mailauth 7.1.1 → 7.3.0

package/lib/parse-received.js

@@ -208,49 +208,238 @@ const parseReceived = buf => {
 const ADDRESS_LITERAL = /\[(?:IPv6:)?([^\]\s]+)\](?::\d+)?/gi;
 // "helo=" or "ehlo=" right before a literal, the client's own claim, not its address
 const HELO_PREFIX = /(?:^|[\s(;,])(?:helo|ehlo)=\s*$/i;
+// a "helo=" or "ehlo=" anywhere in a comment, the HELO name as Exim writes it
+const HELO_KEYWORD = /(?:^|[\s(;,])(?:helo|ehlo)=/i;
+// a word of the Received header, anything up to whitespace or a special character
+const WORD = /[^\s()";\\]+/y;
+
+/**
+ * Splits the from clause of a Received header into its words and comments, up to the "by"
+ * keyword that ends it. The receiving server writes the TCP-info comment after the HELO name,
+ * and some servers (Postfix) copy the HELO argument as it was given, spaces, parentheses and
+ * quotes included. Such a HELO can look like a TCP-info comment and a "by" keyword of its own,
+ * so a header that can not be split without guessing returns false: a comment or a quoted
+ * string that is not closed, a stray ")" or a backslash, a quoted string in the from clause,
+ * more than one top level "by" or ";", or a "by" that is not followed by a host name.
+ *
+ * @param {String} header Received header
+ * @returns {Object|false} { words, comments } of the from clause, or false
+ */
+const splitFromClause = header => {
+    let value = header.substring(header.indexOf(':') + 1);
+
+    let tokens = [];
+    // where the date-time part starts in `tokens`
+    let dateTimeStart = -1;
+    let i = 0;
+    while (i < value.length) {
+        let c = value.charAt(i);
+
+        if (/\s/.test(c)) {
+            i++;
+            continue;
+        }
+
+        if (c === ';') {
+            // the date-time part. RFC 5322 section 3.6.7 has a single ";", in front of the
+            // date-time, so another one came from the HELO argument, and so may the first
+            // one. The rest of the header is still read to find such a ";"
+            if (dateTimeStart >= 0) {
+                return false;
+            }
+            dateTimeStart = tokens.length;
+            i++;
+            continue;
+        }
+
+        if (c === ')' || c === '\\') {
+            return false;
+        }
+
+        if (c === '(') {
+            // RFC 5322 comment, nested comments are part of it
+            let start = i;
+            let level = 0;
+            for (; i < value.length; i++) {
+                let cc = value.charAt(i);
+                if (cc === '\\') {
+                    return false;
+                }
+                if (cc === '(') {
+                    level++;
+                } else if (cc === ')' && --level === 0) {
+                    break;
+                }
+            }
+            if (level) {
+                return false;
+            }
+            tokens.push({ type: 'comment', value: value.substring(start + 1, i) });
+            i++;
+            continue;
+        }
+
+        if (c === '"') {
+            let end = i + 1;
+            while (end < value.length && value.charAt(end) !== '"') {
+                // a quoted-pair keeps the next character
+                end += value.charAt(end) === '\\' ? 2 : 1;
+            }
+            if (end >= value.length) {
+                return false;
+            }
+            tokens.push({ type: 'quoted', value: value.substring(i, end + 1) });
+            i = end + 1;
+            continue;
+        }
+
+        WORD.lastIndex = i;
+        let word = WORD.exec(value)[0];
+        tokens.push({ type: 'word', value: word });
+        i += word.length;
+    }
+
+    if (dateTimeStart >= 0) {
+        tokens = tokens.slice(0, dateTimeStart);
+    }
+
+    if (tokens[0]?.type !== 'word' || tokens[0].value.toLowerCase() !== 'from') {
+        return false;
+    }
+
+    let byPositions = [];
+    tokens.forEach((token, pos) => {
+        if (token.type === 'word' && token.value.toLowerCase() === 'by') {
+            byPositions.push(pos);
+        }
+    });
+
+    if (byPositions.length !== 1 || tokens[byPositions[0] + 1]?.type !== 'word') {
+        return false;
+    }
+
+    let clause = tokens.slice(1, byPositions[0]);
+    if (clause.some(token => token.type === 'quoted')) {
+        return false;
+    }
+
+    return {
+        words: clause.filter(token => token.type === 'word').map(token => token.value),
+        comments: clause.filter(token => token.type === 'comment').map(token => token.value)
+    };
+};
+
+// splitFromClause results of parsed Received headers, so that getClientAddress and getClientHelo
+// split each header once. Kept aside, the parsed header object is not modified
+const fromClauseCache = new WeakMap();
+
+// The split from clause of a parsed Received header (see splitFromClause), or false
+const getFromClause = received => {
+    if (!received || typeof received !== 'object' || typeof received.full !== 'string') {
+        return false;
+    }
+    let cached = fromClauseCache.get(received);
+    if (cached?.full !== received.full) {
+        cached = { full: received.full, clause: splitFromClause(received.full) };
+        fromClauseCache.set(received, cached);
+    }
+    return cached.clause;
+};
 
 /**
  * Finds the IP address of the client in the from clause of a parsed Received header.
  *
  * RFC 5321 section 4.4 puts the address the connection came from into the TCP-info comment
- * of the from clause, "from helo.name (rdns.name [192.0.2.1])", so it is the last address
- * literal of that comment. The rest of the clause is the client's own claim: the HELO name,
- * which can itself be an address literal, and in Exim's format a "helo=" value inside the
- * comment. Those are never used. Exim writes "from [192.0.2.1] (helo=...)" for a client
- * without reverse DNS, where the literal in front of the comment is the address of the
- * connection, which is only used when the comment has no address literal of its own.
+ * of the from clause, "from helo.name (rdns.name [192.0.2.1])". The rest of the clause is the
+ * client's own claim: the HELO name, which can itself be an address literal or hold
+ * parentheses, and in Exim's format a "helo=" value inside the comment. Those are never used.
+ * Exim writes "from [192.0.2.1] (helo=...)" for a client without reverse DNS, where the literal
+ * in front of the comment is the address of the connection. With a "helo=" comment it is used
+ * unless a comment has a different address literal, otherwise only when no comment has an
+ * address literal of its own.
  *
- * @param {Object} from The "from" entry of parseReceived(), { value, comment }
+ * Only an unambiguous address is returned. A header that can not be split into a from clause
+ * and a single "by" (see splitFromClause), a from clause with more than one address in its
+ * comments, or Exim's layout with a different address in a comment, returns false instead of
+ * a guess.
+ *
+ * @param {Object} received Parsed Received header, the result of parseReceived()
  * @returns {String|false} IP address, without an "IPv6:" prefix, or false if none was found
  */
-const getClientAddress = from => {
-    if (!from || typeof from !== 'object') {
+const getClientAddress = received => {
+    let clause = getFromClause(received);
+    if (!clause) {
         return false;
     }
 
-    let comment = typeof from.comment === 'string' ? from.comment : '';
-    let value = typeof from.value === 'string' ? from.value.trim() : '';
-
-    let address = false;
-    for (let match of comment.matchAll(ADDRESS_LITERAL)) {
-        if (HELO_PREFIX.test(comment.substring(0, match.index))) {
-            continue;
+    let addresses = new Set();
+    for (let comment of clause.comments) {
+        for (let match of comment.matchAll(ADDRESS_LITERAL)) {
+            if (!HELO_PREFIX.test(comment.substring(0, match.index)) && isIP(match[1])) {
+                addresses.add(match[1]);
+            }
         }
-        if (isIP(match[1])) {
-            address = match[1];
+    }
+
+    let valueMatch = clause.comments.length && clause.words.length && clause.words[0].match(/^\[(?:IPv6:)?([^\]\s]+)\](?::\d+)?$/i);
+    let valueAddress = valueMatch && isIP(valueMatch[1]) ? valueMatch[1] : false;
+
+    if (valueAddress && clause.comments.some(comment => HELO_KEYWORD.test(comment))) {
+        // Exim's layout for a client without reverse DNS, "from [192.0.2.1] (helo=name)". The
+        // literal in front of the comment is the address of the connection, and everything
+        // after "helo=" is the client's own text, which can add words, comments and address
+        // literals of its own. The same header can also come from Postfix, with
+        // "[192.0.2.1] (helo=name)" as the HELO argument and the TCP-info comment after it. So
+        // a different address in the comments may be the real one or a forged one, and the
+        // header is ambiguous
+        if (clause.words.length === 1 && (!addresses.size || (addresses.size === 1 && addresses.has(valueAddress)))) {
+            return valueAddress;
         }
+        return false;
     }
 
-    if (address) {
-        return address;
+    if (addresses.size === 1) {
+        return addresses.values().next().value;
     }
 
-    let valueMatch = value.match(/^\[(?:IPv6:)?([^\]\s]+)\](?::\d+)?$/i);
-    if (valueMatch && comment && isIP(valueMatch[1])) {
-        return valueMatch[1];
+    if (addresses.size > 1) {
+        // the HELO name holds an address literal of its own, can not tell which one is real
+        return false;
+    }
+
+    return clause.words.length === 1 && valueAddress;
+};
+
+// the HELO name in the TCP-info comment, "helo=name" as Exim writes it or "HELO name" as qmail does
+const HELO_COMMENT = /(?:^|[\s(;,])(?:helo|ehlo)=([^\s()]+)|^(?:helo|ehlo)\s+([^\s()]+)$/i;
+
+/**
+ * Finds the HELO name of the client in the from clause of a parsed Received header. Most servers
+ * write the HELO name as the from value, "from helo.name (rdns.name [192.0.2.1])", but Exim and
+ * qmail write the reverse DNS name there and the HELO name into a comment when the two differ,
+ * "from rdns.name ([192.0.2.1] helo=helo.name)" and "from rdns.name (HELO helo.name) (192.0.2.1)".
+ *
+ * A header that can not be split into a from clause and a single "by" (see splitFromClause)
+ * returns false, as the HELO name in it can not be told apart from the rest.
+ *
+ * @param {Object} received Parsed Received header, the result of parseReceived()
+ * @returns {String|false} HELO name or false if none was found
+ */
+const getClientHelo = received => {
+    let clause = getFromClause(received);
+    if (!clause) {
+        return false;
+    }
+
+    for (let comment of clause.comments) {
+        let match = comment.trim().match(HELO_COMMENT);
+        if (match) {
+            return match[1] || match[2];
+        }
     }
 
-    return false;
+    let value = received.from?.value;
+    return (typeof value === 'string' && value.trim()) || false;
 };
 
-module.exports = { parseReceived, getClientAddress };
+module.exports = { parseReceived, getClientAddress, getClientHelo };

package/lib/spf/index.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const { spfVerify } = require('./spf-verify');
-const { parseIp, isValidTargetName } = require('./syntax');
+const { parseIp, isValidTargetName, stripRootDot } = require('./syntax');
 const os = require('node:os');
 const dns = require('node:dns');
 const libmime = require('libmime');
@@ -135,7 +135,8 @@ let dualStackResolver = async (resolver, domain, opts, state) => {
  * @param {Boolean} [options.strict] - If true, follow RFC 7208 exactly (no dual-stack void optimization)
  * @param {Object} [options.ctx] - Shared evaluation state, lax acceptances are added to ctx.warnings
  * @param {Number} [options.deadline] - Timestamp after which no more queries are made
- * @returns {Function} - Rate-limited resolver function with signature: (domain, type, opts) => Promise<Array>
+ * @returns {Function} - Rate-limited resolver function with signature: (domain, type, opts) => Promise<Array>.
+ *   If `opts.ignoreVoid` is set, the query counts toward the lookup limit but an empty answer is not a void lookup
  */
 let limitedResolver = (resolver, maxResolveCount, maxVoidCount, ignoreFirst, options) => {
     options = options || {};
@@ -148,8 +149,9 @@ let limitedResolver = (resolver, maxResolveCount, maxVoidCount, ignoreFirst, opt
     let subResolveCounts = {};
     let firstCounted = !ignoreFirst;
 
-    maxResolveCount = maxResolveCount || MAX_RESOLVE_COUNT;
-    maxVoidCount = maxVoidCount || MAX_VOID_COUNT;
+    // 0 is a valid limit, the default is used only if the value is not a non-negative number
+    maxResolveCount = typeof maxResolveCount === 'number' && maxResolveCount >= 0 ? maxResolveCount : MAX_RESOLVE_COUNT;
+    maxVoidCount = typeof maxVoidCount === 'number' && maxVoidCount >= 0 ? maxVoidCount : MAX_VOID_COUNT;
 
     let checkRfcVoidCount = () => {
         if (rfcVoidCount > maxVoidCount && options.ctx && options.ctx.warnings) {
@@ -233,6 +235,10 @@ let limitedResolver = (resolver, maxResolveCount, maxVoidCount, ignoreFirst, opt
                 case 'ENOTFOUND': // Domain does not exist
                 case 'ENODATA': {
                     // Domain exists but has no records of this type
+                    if (opts?.ignoreVoid) {
+                        // the void limit counts terms, and the term decides with its own query
+                        return [];
+                    }
                     // Increment void lookup counter
                     voidCount++;
                     rfcVoidCount++;
@@ -369,6 +375,11 @@ const verify = async opts => {
 
     mta = mta || os.hostname();
 
+    // the root dot is removed from the identities used for evaluation, macros and reporting
+    if (typeof helo === 'string') {
+        helo = stripRootDot(helo);
+    }
+
     // a null reverse-path means that the HELO identity is checked (RFC 7208 section 2.4)
     let nullSender = !sender;
 
@@ -394,6 +405,12 @@ const verify = async opts => {
     }
     atPos = sender.lastIndexOf('@');
 
+    let senderDomain = sender.substr(atPos + 1).trim();
+    let relativeDomain = stripRootDot(senderDomain);
+    if (relativeDomain !== senderDomain) {
+        sender = `${sender.substr(0, atPos + 1)}${relativeDomain}`;
+    }
+
     let domain =
         sender
             .substr(atPos + 1)

package/lib/spf/macro.js

@@ -54,7 +54,7 @@ const macro = (input, values) => {
         if (m === '%') {
             // Lone % found
             let err = new Error('Syntax error on parsing macro');
-            err.spfResult = { error: 'permerror', message: `Unexpected % in macro` };
+            err.spfResult = { error: 'permerror', text: `Unexpected % in macro` };
             throw err;
         }
 
@@ -143,7 +143,7 @@ const macro = (input, values) => {
 
             default: {
                 let err = new Error('Syntax error on parsing macro');
-                err.spfResult = { error: 'permerror', message: `Unknown macro letter "${macroChar}"` };
+                err.spfResult = { error: 'permerror', text: `Unknown macro letter "${macroChar}"` };
                 throw err;
             }
         }
@@ -184,7 +184,9 @@ const macro = (input, values) => {
         delimiters = delimiters || '.';
 
         if (reversed || nr || delimiters !== '.') {
-            curval = curval.split(new RegExp(`[${delimiters.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}]`));
+            // every delimiter is escaped, an unescaped "-" between two others would make a range
+            // in the character class, such as "+-." that also matches ","
+            curval = curval.split(new RegExp(`[${delimiters.replace(/./g, '\\$&')}]`));
 
             if (reversed) {
                 curval = curval.reverse();

package/lib/spf/spf-verify.js

@@ -94,12 +94,13 @@ const parseCidrValue = (val, defaultValue, type) => {
  * goes through the given resolver, so with the limited resolver every "ptr" term and every
  * %{p} expansion counts toward the DNS lookup limit (RFC 7208 section 4.6.4).
  *
+ * @param {Object} [ptrOpts] Options for the PTR query, `{ ignoreVoid: true }` if an empty answer is not a void lookup
  * @returns {Array} Validated names, empty if there are none or the PTR lookup failed
  */
-const getValidatedNames = async (addr, resolver, subResolver) => {
+const getValidatedNames = async (addr, resolver, subResolver, ptrOpts) => {
     let ptrValues;
     try {
-        ptrValues = await resolver(getPtrHostname(addr), 'PTR');
+        ptrValues = await resolver(getPtrHostname(addr), 'PTR', ptrOpts);
     } catch (err) {
         if (isFatalError(err)) {
             throw err;
@@ -195,9 +196,11 @@ const spfVerify = async (domain, opts) => {
     let senderStr = (opts.sender || '').toString();
     let nonAsciiLocalPart = /[^\x00-\x7F]/.test(senderStr.substr(0, Math.max(senderStr.lastIndexOf('@'), 0)));
 
-    // The macro values with %{p}, the validated domain name of the client IP (RFC 7208 section 7.3)
+    // The macro values with %{p}, the validated domain name of the client IP (RFC 7208 section 7.3).
+    // The PTR query counts toward the lookup limit but not as a void lookup, the void limit counts
+    // terms (RFC 7208 section 4.6.4) and the query of the term itself decides if the term was void
     let withPtr = async (ptrResolver, subResolver) =>
-        Object.assign({}, macroValues, { p: selectPtrName(await getValidatedNames(addr, ptrResolver, subResolver), domain) });
+        Object.assign({}, macroValues, { p: selectPtrName(await getValidatedNames(addr, ptrResolver, subResolver, { ignoreVoid: true }), domain) });
 
     /**
      * Expands a domain-spec into a target name
@@ -643,7 +646,13 @@ const spfVerify = async (domain, opts) => {
                 return false;
             }
 
-            return macro(text, usesMacro(text, 'p') ? await withPtr(expResolver, expResolver) : macroValues);
+            let explanation = macro(text, usesMacro(text, 'p') ? await withPtr(expResolver, expResolver) : macroValues);
+            // the limit applies to the final, macro-expanded string, %{s}, %{l} and %{h} copy the identities as they are
+            if (/[^\x20-\x7E]/.test(explanation)) {
+                return false;
+            }
+
+            return explanation;
         } catch (err) {
             return false;
         }

package/lib/spf/syntax.js

@@ -356,8 +356,13 @@ const validateTerms = terms => {
     return false;
 };
 
+// A single trailing dot makes a name fully qualified, it is the same DNS name without it (RFC 7208
+// section 4.3). Only a single one is removed, a zero-length label anywhere else is still malformed
+const stripRootDot = name => (/[^.]\.$/.test(name) ? name.slice(0, -1) : name);
+
 module.exports = {
     parseIp,
+    stripRootDot,
     ipInNetwork,
     normalizeTargetName,
     isValidTargetName,