mailauth 7.2.0 → 7.3.1

package/lib/mailauth.js

@@ -2,6 +2,9 @@
 
 const { dkimSign, DkimSignStream } = require('./dkim/sign');
 const { dkimVerify } = require('./dkim/verify');
+const { dkim2Sign, Dkim2SignStream } = require('./dkim2/sign');
+const { dkim2Verify } = require('./dkim2/verify');
+const { dkim2Hash } = require('./dkim2/hash');
 const { spf } = require('./spf');
 const { dmarc, evaluateDmarc } = require('./dmarc');
 const { arc, createSeal, sealMessage, getARChain, verifyASChain } = require('./arc');
@@ -9,6 +12,7 @@ const { bimi, validateVMC: validateBimiVmc } = require('./bimi');
 const { validateSvg: validateBimiSvg } = require('./bimi/validate-svg');
 const { parseReceived, getClientAddress, getClientHelo } = require('./parse-received');
 const { formatDomain, getAlignment, formatAuthservId } = require('./tools');
+const { buffer: readStream } = require('node:stream/consumers');
 const libmime = require('libmime');
 const os = require('node:os');
 const { isIP } = require('net');
@@ -33,6 +37,9 @@ const { isIP } = require('net');
  * @param {Boolean} [opts.disableDmarc=false] If true then do not perform DMARC check
  * @param {Boolean} [opts.disableBimi=false] If true then do not perform BIMI check
  * @param {Boolean} [opts.strict=false] If true then every check follows its RFC exactly instead of the lenient defaults
+ * @param {Boolean} [opts.dkim2=false] If true then DKIM2 header fields are verified as well (draft-ietf-dkim-dkim2-spec-06)
+ * @param {String|String[]} [opts.rcptTo] RCPT TO addresses of the delivery, checked against the DKIM2 chain of custody
+ * @param {Object} [opts.dkim2Options] Extra options for the DKIM2 verifier (maxSignatureAge, maxFutureTime, maxInstances, checkReplay, curTime)
  * @returns Authentication result
  */
 const authenticate = async (input, opts) => {
@@ -45,6 +52,11 @@ const authenticate = async (input, opts) => {
     // quoted, or throws under strict, before any work is done
     const authservId = formatAuthservId(opts.mta, opts.strict);
 
+    if (opts.dkim2 && typeof input?.on === 'function') {
+        // DKIM2 reads the message a second time, so a stream is read into memory first
+        input = await readStream(input);
+    }
+
     const dkimResult = await dkimVerify(input, {
         resolver: opts.resolver,
         sender: opts.sender, // defaults to Return-Path header
@@ -97,7 +109,24 @@ const authenticate = async (input, opts) => {
         opts.helo = `[${opts.helo}]`;
     }
 
+    // DKIM2 runs alongside SPF. The delivery is compared with the highest DKIM2-Signature only
+    // when it is known
+    const dkim2Verification =
+        opts.dkim2 &&
+        dkim2Verify(
+            input,
+            Object.assign({}, opts.dkim2Options, {
+                resolver: opts.resolver,
+                mailFrom: typeof opts.sender === 'string' ? opts.sender : undefined,
+                rcptTo: opts.rcptTo
+            })
+        );
+    // a rejection is handled by the await below, this keeps it from being reported as unhandled
+    // while SPF runs
+    dkim2Verification?.catch?.(() => false);
+
     const spfResult = await spf(opts);
+    const dkim2Result = await dkim2Verification;
 
     let arcResult;
     if (!opts.disableArc) {
@@ -118,6 +147,12 @@ const authenticate = async (input, opts) => {
         arHeader.push(`${libmime.foldLines(row.info, 160)}`);
     });
 
+    if (dkim2Result?.info) {
+        // draft-gondwana-dkim2-authres-00: the method is not registered yet. DKIM2 results do not
+        // take part in DMARC, that is an open question (draft-ietf-dkim-dkim2-bcp-01 section 7.2)
+        arHeader.push(libmime.foldLines(dkim2Result.info, 160));
+    }
+
     if (spfResult) {
         arHeader.push(libmime.foldLines(spfResult.info, 160));
         receivedSpfHeader = spfResult.header;
@@ -237,6 +272,7 @@ const authenticate = async (input, opts) => {
 
     const result = {
         dkim: dkimResult,
+        dkim2: dkim2Result || false,
         spf: spfResult,
         dmarc: dmarcResult || false,
         arc: arcResult || false,
@@ -260,6 +296,10 @@ module.exports = {
     dkimSign,
     DkimSignStream,
     dkimVerify,
+    dkim2Sign,
+    Dkim2SignStream,
+    dkim2Verify,
+    dkim2Hash,
     spf,
     dmarc,
     arc,

package/lib/mta-sts.js

@@ -6,6 +6,7 @@ const https = require('node:https');
 const tls = require('node:tls');
 const { X509Certificate } = require('node:crypto');
 const { toALabel, createError } = require('./tools');
+const { trimChars, trimEndChars } = require('./trim');
 
 // socket idle timeout for the policy request
 const HTTP_IDLE_TIMEOUT = 15 * 1000;
@@ -65,7 +66,7 @@ const parseTxtRecordStrict = record => {
         // WSP around a delimiter belongs to the delimiter
         let field = parts[i].replace(/^[ \t]+/, '');
         if (!isLast) {
-            field = field.replace(/[ \t]+$/, '');
+            field = trimEndChars(field, ' \t');
         } else if (!field) {
             // optional trailing delimiter
             continue;
@@ -217,7 +218,7 @@ const parsePolicyFile = (file, strict, warnings) => {
             if (!EXT_NAME.test(key)) {
                 continue;
             }
-            value = line.substr(colonPos + 1).replace(/^[ \t]+|[ \t]+$/g, '');
+            value = trimChars(line.substr(colonPos + 1), ' \t');
         } else {
             key = line.substr(0, colonPos).toLowerCase().trim();
             value = line.substr(colonPos + 1).trim();

package/lib/parse-dkim-headers.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const { DANGEROUS_KEYS } = require('./safe-keys');
+const { trimChars } = require('./trim');
 
 // Keys the headerParser result pre-seeds: "header" holds the header name and "value" the
 // authserv-id picked from the first key-only part. A crafted part must not overwrite them,
@@ -24,7 +25,7 @@ const NUMERIC_TAGS = new Set(['l', 'v', 't', 'x']);
 // RFC 6376 section 3.2: tag-name = ALPHA *ALNUMPUNC
 const TAG_NAME = /^[A-Za-z][A-Za-z0-9_]*$/;
 // FWS around a tag-spec, only SP, HTAB and the CRLF of a fold
-const FWS_EDGES = /^[ \t\r\n]+|[ \t\r\n]+$/g;
+const FWS_CHARS = ' \t\r\n';
 
 const normalizeString = value => value.replace(/\s+/g, ' ').trim();
 
@@ -104,7 +105,7 @@ const tagListParser = (line, headerKey, strict) => {
 
     for (let i = 0; i < segments.length; i++) {
         let segment = segments[i];
-        let trimmed = segment.replace(FWS_EDGES, '');
+        let trimmed = trimChars(segment, FWS_CHARS);
 
         if (!trimmed) {
             // one trailing semicolon is allowed, an empty tag-spec anywhere else is not
@@ -127,7 +128,7 @@ const tagListParser = (line, headerKey, strict) => {
             continue;
         }
 
-        let name = segment.substring(0, eqPos).replace(FWS_EDGES, '');
+        let name = trimChars(segment.substring(0, eqPos), FWS_CHARS);
         let value = normalizeString(segment.substring(eqPos + 1));
 
         if (!TAG_NAME.test(name)) {

package/lib/tools.js

@@ -10,6 +10,7 @@ const crypto = require('node:crypto');
 const https = require('node:https');
 const packageData = require('../package');
 const parseDkimHeaders = require('./parse-dkim-headers');
+const { trimChars, trimEndChars } = require('./trim');
 const { parseTagList } = parseDkimHeaders;
 const tldts = require('tldts');
 const Joi = require('joi');
@@ -152,27 +153,27 @@ const FIELD_START = /^[\x21-\x39\x3b-\x7e]+[ \t\r\n]*:/;
 // only add bytes to a signed value, so it can only ever turn a pass into a fail; reading
 // the line the other way round is what cannot be undone. formatRelaxedLine is not lenient
 // in the same way, what a signature covers is RFC 6376 section 3.4.2 alone
-const startsField = row =>
-    // only the start of the row decides this, and a fold can push the colon no further
+const startsField = (line, next) =>
+    // only the start of a line decides this, and a fold can push the colon no further
     // than onto the line after the name
-    FIELD_START.test(row.length > 1 ? `${row[0]}\r\n${row[1]}` : row[0]);
+    FIELD_START.test(line) || (next !== undefined && FIELD_START.test(`${line}\r\n${next}`));
 
 const parseHeaders = buf => {
-    let rows = buf
-        .toString('binary')
-        .replace(/[\r\n]+$/, '')
-        .split(/\r?\n/)
-        .map(row => [row]);
+    let lines = trimEndChars(buf.toString('binary'), '\r\n').split(/\r?\n/);
 
-    if (rows.length === 1 && !rows[0][0]) {
+    if (lines.length === 1 && !lines[0]) {
         // nothing to parse, rather than one row that is not a header
         return { parsed: [], original: buf };
     }
 
-    for (let i = rows.length - 1; i > 0; i--) {
-        if (!startsField(rows[i])) {
-            rows[i - 1] = rows[i - 1].concat(rows[i]);
-            rows.splice(i, 1);
+    // the first line always opens a row, every later line either opens one or continues
+    // the row before it
+    let rows = [[lines[0]]];
+    for (let i = 1; i < lines.length; i++) {
+        if (startsField(lines[i], lines[i + 1])) {
+            rows.push([lines[i]]);
+        } else {
+            rows[rows.length - 1].push(lines[i]);
         }
     }
 
@@ -188,7 +189,7 @@ const parseHeaders = buf => {
             if (casedKey.indexOf('\n') >= 0) {
                 casedKey = casedKey.replace(/\r?\n/g, '');
             }
-            casedKey = casedKey.replace(/^[ \t]+|[ \t]+$/g, '');
+            casedKey = trimChars(casedKey, ' \t');
             key = lowerCaseASCII(casedKey);
         }
 
@@ -203,7 +204,7 @@ const parseHeaders = buf => {
 const normalizeFieldNames = fieldNames =>
     fieldNames
         .split(':')
-        .map(key => lowerCaseASCII(key.replace(/^[ \t]+|[ \t]+$/g, '')))
+        .map(key => lowerCaseASCII(trimChars(key, ' \t')))
         .filter(key => key);
 
 const defaultDKIMFieldNamesNormalized = normalizeFieldNames(defaultDKIMFieldNames);
@@ -219,7 +220,7 @@ const OVERSIGN_FIELD_NAME = /^[\x21-\x39\x3c-\x7e]+$/;
 const getOversignedNames = (fieldNames, signingList) => {
     let listed = new Map();
     for (let casedKey of fieldNames.split(':')) {
-        casedKey = casedKey.replace(/^[ \t]+|[ \t]+$/g, '');
+        casedKey = trimChars(casedKey, ' \t');
         let key = lowerCaseASCII(casedKey);
         if (!key) {
             continue;
@@ -987,7 +988,7 @@ const formatRelaxedLine = (line, suffix) => {
             // unfold
             .replace(/\r?\n/g, '')
             // key to lowercase, trim around :
-            .replace(/^([^:]*):[ \t]*/, (m, k) => lowerCaseASCII(k).replace(/^[ \t]+|[ \t]+$/g, '') + ':')
+            .replace(/^([^:]*):[ \t]*/, (m, k) => trimChars(lowerCaseASCII(k), ' \t') + ':')
             // single WSP
             .replace(/[ \t]+/g, ' ')
             // no WSP around the value
@@ -1034,7 +1035,7 @@ const formatDomain = domain => {
     // signer writes and the verifier reports for the same name
     domain = toALabel(domain.toLowerCase().trim()).toLowerCase().trim();
     // the root label is not part of the name, so "example.com." and "example.com" are the same domain
-    return domain.replace(/\.+$/, '');
+    return trimEndChars(domain, '.');
 };
 
 // A domain as getAlignment() compares it, after formatDomain(): labels of letters, digits, "-"
@@ -1357,6 +1358,7 @@ module.exports = {
     addWarning,
     KEY_ERROR_COMMENTS,
     isValidDnsName,
+    isBareRsaPublicKey,
 
     defaultDKIMFieldNames,
     defaultARCFieldNames,

package/lib/trim.js

@@ -0,0 +1,27 @@
+'use strict';
+
+// Trims the characters of `chars` off the end of a string with an index scan. A regex such
+// as /[ \t]+$/ retries the trailing run from every position inside it whenever the run is
+// not at the end of the string, quadratic in the length of a run of those characters
+const trimEndChars = (str, chars) => {
+    let end = str.length;
+    while (end > 0 && chars.includes(str[end - 1])) {
+        end--;
+    }
+    return str.slice(0, end);
+};
+
+// Trims the characters of `chars` off both ends of a string, see trimEndChars
+const trimChars = (str, chars) => {
+    let start = 0;
+    let end = str.length;
+    while (start < end && chars.includes(str[start])) {
+        start++;
+    }
+    while (end > start && chars.includes(str[end - 1])) {
+        end--;
+    }
+    return str.slice(start, end);
+};
+
+module.exports = { trimChars, trimEndChars };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mailauth",
-    "version": "7.2.0",
+    "version": "7.3.1",
     "description": "Email authentication library for Node.js",
     "main": "lib/mailauth.js",
     "types": "index.d.ts",
@@ -48,7 +48,7 @@
         "license-report": "6.8.6",
         "mbox-reader": "1.2.0",
         "mocha": "12.0.3",
-        "prettier": "3.9.9",
+        "prettier": "3.9.10",
         "resedit": "3.1.0"
     },
     "dependencies": {
@@ -58,7 +58,7 @@
         "ipaddr.js": "2.5.0",
         "joi": "18.2.9",
         "libmime": "5.4.7",
-        "nodemailer": "10.0.16",
+        "nodemailer": "10.1.0",
         "punycode.js": "2.3.1",
         "tldts": "7.4.18",
         "undici": "8.11.2"

package/stryker.config.json

@@ -3,10 +3,10 @@
     "_comment": "Opt-in mutation testing, run with `npm run mutation`. The mocha runner plugin does not support mocha 12, so every mutant runs the tests of the mutated modules through the command runner. The long mocha timeout keeps the slower instrumented code from failing tests by timeout, which would count as a killed mutant",
     "testRunner": "command",
     "commandRunner": {
-        "command": "npx mocha --bail --timeout 60000 --reporter dot \"test/dkim/**/*-test.js\" \"test/spf/**/*-test.js\" \"test/dmarc/**/*-test.js\" \"test/property/*-test.js\" test/mailauth-test.js"
+        "command": "npx mocha --bail --timeout 60000 --reporter dot \"test/dkim/**/*-test.js\" \"test/spf/**/*-test.js\" \"test/dmarc/**/*-test.js\" \"test/dkim2/**/*-test.js\" \"test/property/*-test.js\" test/mailauth-test.js"
     },
     "coverageAnalysis": "off",
-    "mutate": ["lib/dkim/body/*.js", "lib/spf/macro.js", "lib/dmarc/author-domain.js"],
+    "mutate": ["lib/dkim/body/*.js", "lib/spf/macro.js", "lib/dmarc/author-domain.js", "lib/dkim2/*.js"],
     "reporters": ["clear-text", "progress", "html", "json"],
     "htmlReporter": { "fileName": "reports/mutation/mutation.html" },
     "jsonReporter": { "fileName": "reports/mutation/mutation.json" },