serve.zone/dcrouter
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update

Browse Source
This commit is contained in:
Philipp Kunz
2025-05-23 19:03:44 +00:00
parent 7d28d23bbd
commit 1b141ec8f3
101 changed files with 30736 additions and 374 deletions
Download Patch File Download Diff File Expand all files Collapse all files

297
test/suite/security/test.spf-checking.ts Normal file
View File

@ -0,0 +1,297 @@
import { tap, expect } from '@push.rocks/tapbundle';
import * as plugins from '../plugins.js';
import * as net from 'net';
import { startTestServer, stopTestServer, TEST_PORT, sendEmailWithRawSocket } from '../server.loader.js';
let testServer: any;
tap.test('setup - start test server', async () => {
testServer = await startTestServer();
await plugins.smartdelay.delayFor(1000);
});
tap.test('SPF Checking - Authorized IP from local domain', async (tools) => {
const done = tools.defer();
const socket = net.createConnection({
host: 'localhost',
port: TEST_PORT,
timeout: 30000
});
let dataBuffer = '';
let step = 'greeting';
socket.on('data', (data) => {
dataBuffer += data.toString();
console.log('Server response:', data.toString());
if (step === 'greeting' && dataBuffer.includes('220 ')) {
step = 'ehlo';
socket.write('EHLO localhost\r\n');
dataBuffer = '';
} else if (step === 'ehlo' && dataBuffer.includes('250')) {
step = 'mail';
// Use local hostname - should pass SPF
socket.write('MAIL FROM:<test@localhost>\r\n');
dataBuffer = '';
} else if (step === 'mail') {
if (dataBuffer.includes('250')) {
console.log('Local domain sender accepted (SPF pass or neutral)');
step = 'rcpt';
socket.write('RCPT TO:<recipient@example.com>\r\n');
dataBuffer = '';
} else if (dataBuffer.includes('550') || dataBuffer.includes('553')) {
console.log('Local domain sender rejected (SPF fail)');
expect(true).toBeTrue(); // Either result shows SPF processing
socket.write('QUIT\r\n');
socket.end();
done.resolve();
}
} else if (step === 'rcpt' && dataBuffer.includes('250')) {
console.log('Email accepted - SPF likely passed or neutral');
expect(true).toBeTrue();
socket.write('QUIT\r\n');
socket.end();
done.resolve();
}
});
socket.on('error', (err) => {
console.error('Socket error:', err);
done.reject(err);
});
await done.promise;
});
tap.test('SPF Checking - External domain sender', async (tools) => {
const done = tools.defer();
const socket = net.createConnection({
host: 'localhost',
port: TEST_PORT,
timeout: 30000
});
let dataBuffer = '';
let step = 'greeting';
socket.on('data', (data) => {
dataBuffer += data.toString();
console.log('Server response:', data.toString());
if (step === 'greeting' && dataBuffer.includes('220 ')) {
step = 'ehlo';
socket.write('EHLO testclient\r\n');
dataBuffer = '';
} else if (step === 'ehlo' && dataBuffer.includes('250')) {
step = 'mail';
// Use well-known external domain
socket.write('MAIL FROM:<test@google.com>\r\n');
dataBuffer = '';
} else if (step === 'mail') {
if (dataBuffer.includes('250')) {
console.log('External domain sender accepted');
step = 'rcpt';
socket.write('RCPT TO:<recipient@example.com>\r\n');
dataBuffer = '';
} else if (dataBuffer.includes('550') || dataBuffer.includes('553')) {
console.log('External domain sender rejected (SPF fail)');
expect(true).toBeTrue(); // Shows SPF is working
socket.write('QUIT\r\n');
socket.end();
done.resolve();
}
} else if (step === 'rcpt') {
const accepted = dataBuffer.includes('250');
const rejected = dataBuffer.includes('550') || dataBuffer.includes('553');
console.log(`External domain: accepted=${accepted}, rejected=${rejected}`);
expect(accepted || rejected).toBeTrue();
socket.write('QUIT\r\n');
socket.end();
done.resolve();
}
});
socket.on('error', (err) => {
console.error('Socket error:', err);
done.reject(err);
});
await done.promise;
});
tap.test('SPF Checking - Known SPF fail domain', async (tools) => {
const done = tools.defer();
const socket = net.createConnection({
host: 'localhost',
port: TEST_PORT,
timeout: 30000
});
let dataBuffer = '';
let step = 'greeting';
socket.on('data', (data) => {
dataBuffer += data.toString();
console.log('Server response:', data.toString());
if (step === 'greeting' && dataBuffer.includes('220 ')) {
step = 'ehlo';
socket.write('EHLO testclient\r\n');
dataBuffer = '';
} else if (step === 'ehlo' && dataBuffer.includes('250')) {
step = 'mail';
// Use domain that should fail SPF
socket.write('MAIL FROM:<test@spf-fail-test.example>\r\n');
dataBuffer = '';
} else if (step === 'mail') {
if (dataBuffer.includes('250')) {
console.log('SPF fail domain accepted (server may not enforce SPF)');
step = 'rcpt';
socket.write('RCPT TO:<recipient@example.com>\r\n');
dataBuffer = '';
} else if (dataBuffer.includes('550') || dataBuffer.includes('553')) {
console.log('SPF fail domain properly rejected');
expect(true).toBeTrue();
socket.write('QUIT\r\n');
socket.end();
done.resolve();
}
} else if (step === 'rcpt') {
// Either accepted or rejected is valid
const response = dataBuffer.includes('250') || dataBuffer.includes('550') || dataBuffer.includes('553');
expect(response).toBeTrue();
socket.write('QUIT\r\n');
socket.end();
done.resolve();
}
});
socket.on('error', (err) => {
console.error('Socket error:', err);
done.reject(err);
});
await done.promise;
});
tap.test('SPF Checking - IPv4 literal in HELO', async (tools) => {
const done = tools.defer();
const socket = net.createConnection({
host: 'localhost',
port: TEST_PORT,
timeout: 30000
});
let dataBuffer = '';
let step = 'greeting';
socket.on('data', (data) => {
dataBuffer += data.toString();
console.log('Server response:', data.toString());
if (step === 'greeting' && dataBuffer.includes('220 ')) {
step = 'ehlo';
// Use IP literal in EHLO
socket.write('EHLO [127.0.0.1]\r\n');
dataBuffer = '';
} else if (step === 'ehlo' && dataBuffer.includes('250')) {
step = 'mail';
socket.write('MAIL FROM:<test@[127.0.0.1]>\r\n');
dataBuffer = '';
} else if (step === 'mail') {
// Server should handle IP literals appropriately
const accepted = dataBuffer.includes('250');
const rejected = dataBuffer.includes('550') || dataBuffer.includes('553');
console.log(`IP literal sender: accepted=${accepted}, rejected=${rejected}`);
expect(accepted || rejected).toBeTrue();
socket.write('QUIT\r\n');
socket.end();
done.resolve();
}
});
socket.on('error', (err) => {
console.error('Socket error:', err);
done.reject(err);
});
await done.promise;
});
tap.test('SPF Checking - Subdomain sender', async (tools) => {
const done = tools.defer();
const socket = net.createConnection({
host: 'localhost',
port: TEST_PORT,
timeout: 30000
});
let dataBuffer = '';
let step = 'greeting';
socket.on('data', (data) => {
dataBuffer += data.toString();
console.log('Server response:', data.toString());
if (step === 'greeting' && dataBuffer.includes('220 ')) {
step = 'ehlo';
socket.write('EHLO subdomain.localhost\r\n');
dataBuffer = '';
} else if (step === 'ehlo' && dataBuffer.includes('250')) {
step = 'mail';
// Test subdomain SPF handling
socket.write('MAIL FROM:<test@subdomain.localhost>\r\n');
dataBuffer = '';
} else if (step === 'mail') {
if (dataBuffer.includes('250')) {
console.log('Subdomain sender accepted');
step = 'rcpt';
socket.write('RCPT TO:<recipient@example.com>\r\n');
dataBuffer = '';
} else if (dataBuffer.includes('550') || dataBuffer.includes('553')) {
console.log('Subdomain sender rejected');
expect(true).toBeTrue();
socket.write('QUIT\r\n');
socket.end();
done.resolve();
}
} else if (step === 'rcpt') {
const accepted = dataBuffer.includes('250');
console.log(`Subdomain SPF test: ${accepted ? 'passed' : 'failed'}`);
expect(true).toBeTrue();
socket.write('QUIT\r\n');
socket.end();
done.resolve();
}
});
socket.on('error', (err) => {
console.error('Socket error:', err);
done.reject(err);
});
await done.promise;
});
tap.test('cleanup - stop test server', async () => {
await stopTestServer(testServer);
});
tap.start();