w-email 1.1.2 → 1.1.4

package/test/tools/fakeSmtp.mjs

@@ -0,0 +1,310 @@
+import net from 'net'
+import tls from 'tls'
+
+
+/**
+ * 啟動本機假SMTP伺服器，記錄客戶端送出之指令、AUTH、信封與信件原文，供測試斷言
+ *
+ * 連接埠自portStart起循序嘗試，遇占用則試下一號至portEnd為止(自動配發，不隨機)，僅綁定127.0.0.1
+ *
+ * @param {Object} [opt={}] 輸入設定物件，預設{}
+ * @param {Number} [opt.portStart=8025] 輸入起始連接埠，預設8025
+ * @param {Number} [opt.portEnd=8999] 輸入結束連接埠，預設8999
+ * @param {String} [opt.auth='accept'] 輸入AUTH行為，'accept'為接受，'reject'為回覆535，'none'為不宣告AUTH，'xoauth2only'為僅宣告XOAUTH2，未宣告之機制一律回覆504，預設'accept'
+ * @param {Object} [opt.tls=null] 輸入STARTTLS用之憑證物件{key, cert}，給予時宣告STARTTLS且於升級TLS前不宣告AUTH(同Gmail)，預設null
+ * @param {Array} [opt.rcptReject=[]] 輸入以550拒收之收件地址(小寫)陣列，預設[]
+ * @param {Boolean} [opt.dataReject=false] 輸入DATA結束後是否回覆554，預設false
+ * @param {String} [opt.dropAt=''] 輸入伺服器端強制斷線時機，''為不斷線，'connect'為連線即斷，'mailfrom'為收到MAIL FROM即斷，'middata'為收到部分信件內容即斷，預設''
+ * @returns {Promise} 回傳Promise，resolve回傳物件，含port(實際連接埠)、sessions(各連線紀錄陣列)、close(關閉函數)
+ */
+async function startFakeSmtp(opt = {}) {
+    let portStart = opt.portStart || 8025
+    let portEnd = opt.portEnd || 8999
+    let auth = opt.auth || 'accept'
+    let optTls = opt.tls || null
+    let rcptReject = opt.rcptReject || []
+    let dataReject = opt.dataReject === true
+    let dropAt = opt.dropAt || ''
+
+    let sessions = []
+    let sockets = new Set()
+
+    let onConnection = (socket) => {
+        sockets.add(socket)
+        socket.on('close', () => {
+            sockets.delete(socket)
+        })
+        socket.on('error', () => {})
+
+        //sess, tls為是否已升級TLS, cmds為指令(AUTH之初始回應已遮蔽), auth為解出之帳密, mailFrom與rcptTo為信封地址, data為信件原文Buffer
+        let sess = {
+            tls: false,
+            cmds: [],
+            auth: null,
+            mailFrom: null,
+            rcptTo: [],
+            data: null,
+        }
+        sessions.push(sess)
+
+        if (dropAt === 'connect') {
+            socket.destroy()
+            return
+        }
+
+        let sock = socket //升級TLS後改為TLSSocket
+        let buf = '' //以latin1保留原始位元組
+        let inData = false
+        let dataLines = []
+        let authStep = ''
+        let loginUser = ''
+
+        let send = (s) => {
+            if (!sock.destroyed) {
+                sock.write(s + '\r\n')
+            }
+        }
+
+        let b64 = (s) => {
+            return Buffer.from(s, 'base64').toString('utf8')
+        }
+
+        let addrOf = (s) => {
+            let m = s.match(/<([^>]*)>/)
+            return m ? m[1] : s
+        }
+
+        //advertised, 目前宣告之AUTH機制, 有STARTTLS時須升級TLS後才宣告
+        let advertised = () => {
+            if (optTls && !sess.tls) {
+                return []
+            }
+            if (auth === 'accept' || auth === 'reject') {
+                return ['PLAIN', 'LOGIN']
+            }
+            if (auth === 'xoauth2only') {
+                return ['XOAUTH2']
+            }
+            return []
+        }
+
+        let setAuth = (mech, user, pass) => {
+            sess.auth = { mech, user, pass }
+            if (auth === 'reject') {
+                send('535 5.7.8 Username and Password not accepted')
+            }
+            else {
+                send('235 2.7.0 Accepted')
+            }
+        }
+
+        let onLine = (line) => {
+
+            //信件內容
+            if (inData) {
+                if (line === '.') {
+                    inData = false
+                    sess.data = Buffer.from(dataLines.join('\r\n'), 'latin1')
+                    if (dataReject) {
+                        send('554 5.6.0 Message rejected')
+                    }
+                    else {
+                        send('250 2.0.0 OK queued')
+                    }
+                    return
+                }
+                dataLines.push(line.startsWith('.') ? line.slice(1) : line)
+                if (dropAt === 'middata' && dataLines.length >= 3) {
+                    sock.destroy()
+                }
+                return
+            }
+
+            //AUTH後續回應
+            if (authStep !== '') {
+                let step = authStep
+                authStep = ''
+                if (step === 'login-user') {
+                    loginUser = b64(line)
+                    authStep = 'login-pass'
+                    send('334 UGFzc3dvcmQ6')
+                }
+                else if (step === 'login-pass') {
+                    setAuth('LOGIN', loginUser, b64(line))
+                }
+                else if (step === 'plain') {
+                    let p = b64(line).split('\0')
+                    setAuth('PLAIN', p[1], p[2])
+                }
+                return
+            }
+
+            let text = Buffer.from(line, 'latin1').toString('utf8')
+            sess.cmds.push(text.replace(/^(AUTH\s+\S+)\s+.*$/i, '$1 <initial-response>'))
+            let cmd = text.split(' ')[0].toUpperCase()
+            let arg = text.slice(cmd.length).trim()
+
+            if (cmd === 'EHLO') {
+                let ext = ['8BITMIME', 'SMTPUTF8']
+                if (optTls && !sess.tls) {
+                    ext.push('STARTTLS')
+                }
+                let mechs = advertised()
+                if (mechs.length > 0) {
+                    ext.push(`AUTH ${mechs.join(' ')}`)
+                }
+                let lines = ['localhost', ...ext]
+                lines.forEach((l, i) => {
+                    send(`250${i === lines.length - 1 ? ' ' : '-'}${l}`)
+                })
+            }
+            else if (cmd === 'HELO') {
+                send('250 localhost')
+            }
+            else if (cmd === 'STARTTLS') {
+                if (!optTls || sess.tls) {
+                    send('503 5.5.1 STARTTLS not available')
+                    return
+                }
+                send('220 2.0.0 Ready to start TLS')
+                socket.removeAllListeners('data')
+                let ts = new tls.TLSSocket(socket, { isServer: true, key: optTls.key, cert: optTls.cert })
+                ts.on('error', () => {})
+                ts.on('secure', () => {
+                    sess.tls = true
+                })
+                ts.on('data', onData)
+                sock = ts
+                buf = ''
+            }
+            else if (cmd === 'AUTH') {
+                let [mech, init] = arg.split(/\s+/)
+                mech = (mech || '').toUpperCase()
+                if (!advertised().includes(mech)) {
+                    //未宣告之機制, 同真實伺服器回覆504
+                    sess.auth = { mech }
+                    send('504 5.5.4 Unrecognized authentication type')
+                }
+                else if (mech === 'PLAIN') {
+                    if (init) {
+                        let p = b64(init).split('\0')
+                        setAuth('PLAIN', p[1], p[2])
+                    }
+                    else {
+                        authStep = 'plain'
+                        send('334 ')
+                    }
+                }
+                else if (mech === 'LOGIN') {
+                    if (init) {
+                        loginUser = b64(init)
+                        authStep = 'login-pass'
+                        send('334 UGFzc3dvcmQ6')
+                    }
+                    else {
+                        authStep = 'login-user'
+                        send('334 VXNlcm5hbWU6')
+                    }
+                }
+                else {
+                    sess.auth = { mech }
+                    send('535 5.7.8 Authentication failed')
+                }
+            }
+            else if (cmd === 'MAIL') {
+                if (dropAt === 'mailfrom') {
+                    sock.destroy()
+                    return
+                }
+                sess.mailFrom = addrOf(arg)
+                send('250 2.1.0 OK')
+            }
+            else if (cmd === 'RCPT') {
+                let a = addrOf(arg)
+                sess.rcptTo.push(a)
+                if (rcptReject.includes(a.toLowerCase())) {
+                    send('550 5.1.1 User unknown')
+                }
+                else {
+                    send('250 2.1.5 OK')
+                }
+            }
+            else if (cmd === 'DATA') {
+                inData = true
+                dataLines = []
+                send('354 Go ahead')
+            }
+            else if (cmd === 'RSET' || cmd === 'NOOP') {
+                send('250 2.0.0 OK')
+            }
+            else if (cmd === 'QUIT') {
+                send('221 2.0.0 Bye')
+                sock.end()
+            }
+            else {
+                send('502 5.5.2 Command not recognized')
+            }
+        }
+
+        let onData = (chunk) => {
+            buf += chunk.toString('latin1')
+            let i = buf.indexOf('\r\n')
+            while (i >= 0) {
+                let line = buf.slice(0, i)
+                buf = buf.slice(i + 2)
+                onLine(line)
+                if (sock.destroyed) {
+                    return
+                }
+                i = buf.indexOf('\r\n')
+            }
+        }
+
+        socket.on('data', onData)
+        send('220 localhost ESMTP fakeSmtp')
+    }
+
+    for (let port = portStart; port <= portEnd; port++) {
+        let server = net.createServer(onConnection)
+        let r = await new Promise((resolve) => {
+            server.once('error', (err) => {
+                resolve(err)
+            })
+            server.listen(port, '127.0.0.1', () => {
+                resolve(null)
+            })
+        })
+        if (r === null) {
+            let close = () => {
+                return new Promise((resolve) => {
+                    for (let s of sockets) {
+                        s.destroy()
+                    }
+                    server.close(() => {
+                        resolve()
+                    })
+                })
+            }
+            return { port, sessions, close }
+        }
+        if (r.code !== 'EADDRINUSE' && r.code !== 'EACCES') {
+            throw r
+        }
+    }
+    throw new Error(`no free port in ${portStart}-${portEnd}`)
+}
+
+
+/**
+ * 取得一個當下無服務監聽之連接埠(自8025起循序配發後立即關閉)，供測試連線被拒之情境
+ *
+ * @returns {Promise} 回傳Promise，resolve回傳連接埠數字
+ */
+async function getClosedPort() {
+    let srv = await startFakeSmtp()
+    await srv.close()
+    return srv.port
+}
+
+
+export { startFakeSmtp, getClosedPort }

package/test/tools/genCert.mjs

@@ -0,0 +1,101 @@
+import crypto from 'crypto'
+
+
+//DER編碼之最小輔助, 僅涵蓋產生自簽憑證所需之型別
+function derLen(n) {
+    if (n < 0x80) {
+        return Buffer.from([n])
+    }
+    if (n < 0x100) {
+        return Buffer.from([0x81, n])
+    }
+    return Buffer.from([0x82, n >> 8, n & 0xff])
+}
+
+
+function tlv(tag, buf) {
+    return Buffer.concat([Buffer.from([tag]), derLen(buf.length), buf])
+}
+
+
+function seq(...items) {
+    return tlv(0x30, Buffer.concat(items))
+}
+
+
+function oid(s) {
+    let ns = s.split('.').map(Number)
+    let bytes = [ns[0] * 40 + ns[1]]
+    for (let n of ns.slice(2)) {
+        let enc = [n & 0x7f]
+        n = Math.floor(n / 128)
+        while (n > 0) {
+            enc.unshift((n & 0x7f) | 0x80)
+            n = Math.floor(n / 128)
+        }
+        bytes.push(...enc)
+    }
+    return tlv(0x06, Buffer.from(bytes))
+}
+
+
+function int(buf) {
+    //正整數, 最高位元為1時補0
+    if (buf[0] & 0x80) {
+        buf = Buffer.concat([Buffer.from([0]), buf])
+    }
+    return tlv(0x02, buf)
+}
+
+
+function time(d) {
+    //2050年(含)以後須用GeneralizedTime
+    let p = (v) => String(v).padStart(2, '0')
+    let s = `${p(d.getUTCMonth() + 1)}${p(d.getUTCDate())}${p(d.getUTCHours())}${p(d.getUTCMinutes())}${p(d.getUTCSeconds())}Z`
+    if (d.getUTCFullYear() >= 2050) {
+        return tlv(0x18, Buffer.from(`${d.getUTCFullYear()}${s}`, 'ascii'))
+    }
+    return tlv(0x17, Buffer.from(`${p(d.getUTCFullYear() % 100)}${s}`, 'ascii'))
+}
+
+
+/**
+ * 以Node內建crypto產生localhost自簽憑證(EC P-256, SAN含localhost與127.0.0.1), 供測試之TLS伺服器使用
+ *
+ * 於測試執行時產生, 不需openssl與第三方套件, 亦不必將私鑰納入版控或發布之套件
+ *
+ * @returns {Object} 回傳物件，含key(私鑰PEM)與cert(憑證PEM)
+ */
+function genCert() {
+    let { privateKey, publicKey } = crypto.generateKeyPairSync('ec', { namedCurve: 'prime256v1' })
+    let spki = publicKey.export({ type: 'spki', format: 'der' })
+    let sigAlg = seq(oid('1.2.840.10045.4.3.2')) //ecdsa-with-SHA256
+    let name = seq(tlv(0x31, seq(oid('2.5.4.3'), tlv(0x0c, Buffer.from('localhost', 'utf8'))))) //CN=localhost
+    let now = Date.now()
+    let validity = seq(time(new Date(now - 60 * 60 * 1000)), time(new Date(now + 24 * 60 * 60 * 1000)))
+    let san = seq(tlv(0x82, Buffer.from('localhost', 'ascii')), tlv(0x87, Buffer.from([127, 0, 0, 1]))) //dNSName, iPAddress
+    let extensions = tlv(0xa3, seq(
+        seq(oid('2.5.29.19'), tlv(0x01, Buffer.from([0xff])), tlv(0x04, seq(tlv(0x01, Buffer.from([0xff]))))), //basicConstraints critical CA:TRUE
+        seq(oid('2.5.29.17'), tlv(0x04, san)), //subjectAltName
+    ))
+    let tbs = seq(
+        tlv(0xa0, int(Buffer.from([2]))), //v3
+        int(Buffer.from([1])), //序號固定為1, 每次執行皆為新金鑰對故無衝突
+        sigAlg,
+        name,
+        validity,
+        name,
+        spki,
+        extensions,
+    )
+    let sig = crypto.sign('sha256', tbs, { key: privateKey, dsaEncoding: 'der' })
+    let certDer = seq(tbs, sigAlg, tlv(0x03, Buffer.concat([Buffer.from([0]), sig])))
+    let b64 = certDer.toString('base64').match(/.{1,64}/g).join('\n')
+    return {
+        key: privateKey.export({ type: 'pkcs8', format: 'pem' }),
+        cert: `-----BEGIN CERTIFICATE-----\n${b64}\n-----END CERTIFICATE-----\n`,
+    }
+}
+
+
+export default genCert