feat: bump mx-connect to 1.7.0, add new blockReservedNetworks option - #503
Open
dragoangel wants to merge 1 commit into
Open
feat: bump mx-connect to 1.7.0, add new blockReservedNetworks option#503dragoangel wants to merge 1 commit into
dragoangel wants to merge 1 commit into
Conversation
…tion 1.7.0 hardens MX IP validation, rejects null MX (RFC 7505), skips TLSA lookups for non-DNSSEC zones (RFC 7672) and fixes DANE SPKI extraction. It splits invalid MX targets into three tiers: unspecified, broadcast and multicast are now rejected unconditionally; local/private ranges stay behind blockLocalAddresses; and a new blockReservedNetworks covers the future-use and documentation ranges. Expose the new switch exactly like blockLocalAddresses — global default, zone override, per-delivery override. Defaults to false, as in mx-connect. Signed-off-by: Dmytro Alieksieiev <1865999+dragoangel@users.noreply.github.com>
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps
mx-connectto 1.7.0 and exposes theblockReservedNetworksswitch it introduces.What 1.7.0 brings
Hardened MX IP validation, null MX rejection (RFC 7505), TLSA lookups skipped for non-DNSSEC zones (RFC 7672), and a fix for
extractSPKI()returning the raw public key instead of SPKI DER.MX destinations are now classified in three tiers:
unspecified(0.0.0.0),broadcast,multicastblockLocalAddressesblockReservedNetworks(new)What this PR adds
Only the second tier was reachable from zone-mta.
blockReservedNetworksis now wired identically:config/default.js— globaldns.blockReservedNetworks: falselib/sending-zone.js— copied onto the zone like the other delivery optionslib/sender.js— folded intodelivery.dnsOptionsPrecedence matches
blockLocalAddresses: per-deliverydnsOptions→ zone →config.dns. Defaults tofalse, same as mx-connect.Behaviour change
The first tier arrives with the bump and has no opt-out: an MX resolving to
0.0.0.0,255.255.255.255or a multicast address is now rejected regardless of configuration. Nothing else changes for existing deployments.About the lockfile
package-lock.jsonloses 221 lines — 16 entries removed, none added. That is the effect of the bump, not collateral damage:node_modules/mx-connect/node_modules/*subtree. 1.6.0 pinnedmailauth@4.13.0while zone-mta pins4.13.3, so npm kept a private copy along with its full transitive tree. 1.7.0 pins4.13.3, so it dedupes into the hoisted one.node_modules/mailauth/node_modules/ipaddr.js— the hoistedipaddr.jswas 2.3.0 (1.6.0's pin), so mailauth carried its own 2.4.0. The hoisted one is now 2.4.0 itself.node_modules/joi— hoisted only for the nestedmailauth@4.13.0. Thejoithatmailauth@4.13.3needs lives atnode_modules/mailauth/node_modules/joiand is untouched in both locks.Checked by walking every remaining package's declared dependencies in npm's resolution order: no unresolved dependency in the resulting tree, and nothing added.
The node floor is unaffected: the strictest requirement in the tree is
mailauth'snode >=20.18.1, which zone-mta already depends on directly and which is unchanged here. The bump only drops the two nested copies (mx-connect/mailauth,mx-connect/undici) that carried the same requirement.Verification
Run in a clean
node:20container (node 20.20.2, npm 10.8.2):npm ci— installs cleanly, 651 packages, so the lockfile is consistent withpackage.json.npm test(grunt: eslint + nodeunit) — lint clean, 227 assertions passed.npm install --package-lock-onlyreproduces the committed lockfile byte for byte. The committed file was generated by npm 9 on node 18, so both toolchains resolve the tree identically — the dedupe above is npm's own resolution, not an artifact of the environment it was generated in.