472// todo: the parameters and usage are too much now. change to scheme similar to smtpserver, with params in a struct, and a separate method for init and making a connection.

473func startArgsMore(t *testing.T, uidonly, first, immediateTLS bool, serverConfig, clientConfig *tls.Config, allowLoginWithoutTLS, setPassword bool, accname string, afterInit func() error) *testconn {

474 limitersInit() // Reset rate limiters.

475

476 switchStop := func() {}

477 if first {

478 mox.ConfigStaticPath = filepath.FromSlash("../testdata/imap/mox.conf")

479 mox.MustLoadConfig(true, false)

480 store.Close() // May not be open, we ignore error.

481 os.RemoveAll("../testdata/imap/data")

482 err := store.Init(ctxbg)

483 tcheck(t, err, "store init")

484 switchStop = store.Switchboard()

485 }

486

487 acc, err := store.OpenAccount(pkglog, accname, false)

488 tcheck(t, err, "open account")

489 if setPassword {

490 err = acc.SetPassword(pkglog, password0)

491 tcheck(t, err, "set password")

492 }

493 if first {

494 // Add a deleted mailbox, may excercise some code paths.

495 err = acc.DB.Write(ctxbg, func(tx *bstore.Tx) error {

496 // todo: add a message to inbox and remove it again. need to change all uids in the tests.

497 // todo: add tests for operating on an expunged mailbox. it should say it doesn't exist.

498

499 mb, _, _, _, err := acc.MailboxCreate(tx, "expungebox", store.SpecialUse{})

500 if err != nil {

501 return fmt.Errorf("create mailbox: %v", err)

502 }

503 if _, _, err := acc.MailboxDelete(ctxbg, pkglog, tx, &mb); err != nil {

504 return fmt.Errorf("delete mailbox: %v", err)

505 }

506 return nil

507 })

508 tcheck(t, err, "add expunged mailbox")

509 }

510

511 if afterInit != nil {

512 err := afterInit()

513 tcheck(t, err, "after init")

514 }

515

516 // We get actual sockets for their buffering behaviour. net.Pipe is synchronous,

517 // and the implementation of the compress extension can write a sync message to an

518 // imap client when that client isn't reading but is trying to write. In the real

519 // world, network buffer will take up those few bytes, so assume the buffer in the

520 // test too.

521 fds, err := unix.Socketpair(unix.AF_UNIX, unix.SOCK_STREAM, 0)

522 tcheck(t, err, "socketpair")

523 xfdconn := func(fd int, name string) net.Conn {

524 f := os.NewFile(uintptr(fd), name)

525 fc, err := net.FileConn(f)

526 tcheck(t, err, "fileconn")

527 err = f.Close()

528 tcheck(t, err, "close file for conn")

529

530 // Small read/write buffers, for detecting closed/broken connections quickly.

531 uc := fc.(*net.UnixConn)

532 err = uc.SetReadBuffer(512)

533 tcheck(t, err, "set read buffer")

534 uc.SetWriteBuffer(512)

535 tcheck(t, err, "set write buffer")

536

537 return namedConn{uc}

538 }

539 serverConn := xfdconn(fds[0], "server")

540 clientConn := xfdconn(fds[1], "client")

541

542 if serverConfig == nil {

543 serverConfig = &tls.Config{

544 Certificates: []tls.Certificate{fakeCert(t, false)},

545 }

546 }

547 if immediateTLS {

548 if clientConfig == nil {

549 clientConfig = &tls.Config{InsecureSkipVerify: true}

550 }

551 clientConn = tls.Client(clientConn, clientConfig)

552 }

553

554 done := make(chan struct{})

555 connCounter += 2

556 cid := connCounter - 1

557 go func() {

558 const viaHTTPS = false

559 serve("test", cid, serverConfig, serverConn, immediateTLS, allowLoginWithoutTLS, viaHTTPS, "")

560 close(done)

561 }()

562 var tc *testconn

563 var opts imapclient.Opts

564 opts = imapclient.Opts{

565 Logger: slog.Default().With("cid", connCounter),

566 Error: func(err error) {

567 if tc.clientPanic {

568 panic(err)

569 } else {

570 opts.Logger.Error("imapclient error", "err", err)

571 }

572 },

573 }

574 client, _ := imapclient.New(clientConn, &opts)

575 tc = &testconn{t: t, conn: clientConn, client: client, uidonly: uidonly, done: done, serverConn: serverConn, account: acc, clientPanic: true}

576 if first {

577 tc.switchStop = switchStop

578 }

579 return tc

580}

581

582func fakeCert(t *testing.T, randomkey bool) tls.Certificate {

583 seed := make([]byte, ed25519.SeedSize)

584 if randomkey {

585 cryptorand.Read(seed)

586 }

587 privKey := ed25519.NewKeyFromSeed(seed) // Fake key, don't use this for real!

588 template := &x509.Certificate{

589 SerialNumber: big.NewInt(1), // Required field...

590 // Valid period is needed to get session resumption enabled.

591 NotBefore: time.Now().Add(-time.Minute),

592 NotAfter: time.Now().Add(time.Hour),

593 }

594 localCertBuf, err := x509.CreateCertificate(cryptorand.Reader, template, template, privKey.Public(), privKey)

595 if err != nil {

596 t.Fatalf("making certificate: %s", err)

597 }

598 cert, err := x509.ParseCertificate(localCertBuf)

599 if err != nil {

600 t.Fatalf("parsing generated certificate: %s", err)

601 }

602 c := tls.Certificate{

603 Certificate: [][]byte{localCertBuf},

604 PrivateKey: privKey,

605 Leaf: cert,

606 }

607 return c

608}

609

610func TestLogin(t *testing.T) {

611 tc := start(t, false)

612 defer tc.close()

613

614 tc.transactf("bad", "login too many args")

615 tc.transactf("bad", "login") // no args

616 tc.transactf("no", "login mjl@mox.example badpass")

617 tc.transactf("no", `login mjl "%s"`, password0) // must use email, not account

618 tc.transactf("no", "login mjl@mox.example test")

619 tc.transactf("no", "login mjl@mox.example testtesttest")

620 tc.transactf("no", `login "mjl@mox.example" "testtesttest"`)

621 tc.transactf("no", "login \"m\xf8x@mox.example\" \"testtesttest\"")

622 tc.transactf("ok", `login mjl@mox.example "%s"`, password0)

623 tc.close()

624

625 tc = start(t, false)

626 tc.transactf("ok", `login "mjl@mox.example" "%s"`, password0)

627 tc.close()

628

629 tc = start(t, false)

630 tc.transactf("ok", `login "\"\"@mox.example" "%s"`, password0)

631 defer tc.close()

632

633 tc.transactf("bad", "logout badarg")

634 tc.transactf("ok", "logout")

635}

636

637// Test that commands don't work in the states they are not supposed to.

638func TestState(t *testing.T) {

639 tc := start(t, false)

640

641 notAuthenticated := []string{"starttls", "authenticate", "login"}

642 authenticatedOrSelected := []string{"enable", "select", "examine", "create", "delete", "rename", "subscribe", "unsubscribe", "list", "namespace", "status", "append", "idle", "lsub"}

643 selected := []string{"close", "unselect", "expunge", "search", "fetch", "store", "copy", "move", "uid expunge"}

644

645 // Always allowed.

646 tc.transactf("ok", "capability")

647 tc.transactf("ok", "noop")

648 tc.transactf("ok", "logout")

649 tc.close()

650 tc = start(t, false)

651 defer tc.close()

652

653 // Not authenticated, lots of commands not allowed.

654 for _, cmd := range slices.Concat(authenticatedOrSelected, selected) {