1// Package smtpserver implements an SMTP server for submission and incoming delivery of mail messages.

2package smtpserver

3

4import (

5 "bufio"

6 "bytes"

7 "context"

8 "crypto/ed25519"

9 "crypto/md5"

10 cryptorand "crypto/rand"

11 "crypto/rsa"

12 "crypto/sha1"

13 "crypto/sha256"

14 "crypto/tls"

15 "crypto/x509"

16 "encoding/base64"

17 "errors"

18 "fmt"

19 "hash"

20 "io"

21 "log/slog"

22 "maps"

23 "math"

24 "net"

25 "net/textproto"

26 "os"

27 "runtime/debug"

28 "slices"

29 "sort"

30 "strings"

31 "sync"

32 "time"

33 "unicode"

34

35 "golang.org/x/text/unicode/norm"

36

37 "github.com/prometheus/client_golang/prometheus"

38 "github.com/prometheus/client_golang/prometheus/promauto"

39

40 "github.com/mjl-/bstore"

41

42 "github.com/mjl-/mox/config"

43 "github.com/mjl-/mox/dkim"

44 "github.com/mjl-/mox/dmarc"

45 "github.com/mjl-/mox/dmarcdb"

46 "github.com/mjl-/mox/dmarcrpt"

47 "github.com/mjl-/mox/dns"

48 "github.com/mjl-/mox/dsn"

49 "github.com/mjl-/mox/iprev"

50 "github.com/mjl-/mox/message"

51 "github.com/mjl-/mox/metrics"

52 "github.com/mjl-/mox/mlog"

53 "github.com/mjl-/mox/mox-"

54 "github.com/mjl-/mox/moxio"

55 "github.com/mjl-/mox/publicsuffix"

56 "github.com/mjl-/mox/queue"

57 "github.com/mjl-/mox/ratelimit"

58 "github.com/mjl-/mox/scram"

59 "github.com/mjl-/mox/smtp"

60 "github.com/mjl-/mox/spf"

61 "github.com/mjl-/mox/store"

62 "github.com/mjl-/mox/tlsrpt"

63 "github.com/mjl-/mox/tlsrptdb"

64)

65

66// We use panic and recover for error handling while executing commands.

67// These errors signal the connection must be closed.

68var errIO = errors.New("io error")

69

70// If set, regular delivery/submit is sidestepped, email is accepted and

71// delivered to the account named mox.

72var Localserve bool

73

74var limiterConnectionRate, limiterConnections *ratelimit.Limiter

75

76// For delivery rate limiting. Variable because changed during tests.

77var limitIPMasked1MessagesPerMinute int = 500

78var limitIPMasked1SizePerMinute int64 = 1000 * 1024 * 1024

79

80// Maximum number of RCPT TO commands (i.e. recipients) for a single message

81// delivery. Must be at least 100. Announced in LIMIT extension.

82const rcptToLimit = 1000

83

84func init() {

85 // Also called by tests, so they don't trigger the rate limiter.

86 limitersInit()

87}

88

89func limitersInit() {

90 mox.LimitersInit()

91 // todo future: make these configurable

92 limiterConnectionRate = &ratelimit.Limiter{

93 WindowLimits: []ratelimit.WindowLimit{

94 {

95 Window: time.Minute,

96 Limits: [...]int64{300, 900, 2700},

97 },

98 },

99 }

100 limiterConnections = &ratelimit.Limiter{

101 WindowLimits: []ratelimit.WindowLimit{

102 {

103 Window: time.Duration(math.MaxInt64), // All of time.

104 Limits: [...]int64{30, 90, 270},

105 },

106 },

107 }

108}

109

110var (

111 // Delays for bad/suspicious behaviour. Zero during tests.

112 badClientDelay = time.Second // Before reads and after 1-byte writes for probably spammers.

113 authFailDelay = time.Second // Response to authentication failure.

114 unknownRecipientsDelay = 5 * time.Second // Response when all recipients are unknown.

115 firstTimeSenderDelayDefault = 15 * time.Second // Before accepting message from first-time sender.

116)

117

118type codes struct {

119 code int

120 secode string // Enhanced code, but without the leading major int from code.

121}

122

123var (

124 metricConnection = promauto.NewCounterVec(

125 prometheus.CounterOpts{

126 Name: "mox_smtpserver_connection_total",

127 Help: "Incoming SMTP connections.",

128 },

129 []string{

130 "kind", // "deliver" or "submit"

131 },

132 )

133 metricCommands = promauto.NewHistogramVec(

134 prometheus.HistogramOpts{

135 Name: "mox_smtpserver_command_duration_seconds",

136 Help: "SMTP server command duration and result codes in seconds.",

137 Buckets: []float64{0.001, 0.005, 0.01, 0.05, 0.100, 0.5, 1, 5, 10, 20, 30, 60, 120},

138 },

139 []string{

140 "kind", // "deliver" or "submit"

141 "cmd",

142 "code",

143 "ecode",

144 },

145 )

146 metricDelivery = promauto.NewCounterVec(

147 prometheus.CounterOpts{

148 Name: "mox_smtpserver_delivery_total",

149 Help: "SMTP incoming message delivery from external source, not submission. Result values: delivered, reject, unknownuser, accounterror, delivererror. Reason indicates why a message was rejected/accepted.",

150 },

151 []string{

152 "result",

153 "reason",

154 },

155 )

156 // Similar between ../webmail/webmail.go:/metricSubmission and ../smtpserver/server.go:/metricSubmission and ../webapisrv/server.go:/metricSubmission

157 metricSubmission = promauto.NewCounterVec(

158 prometheus.CounterOpts{

159 Name: "mox_smtpserver_submission_total",

160 Help: "SMTP server incoming submission results, known values (those ending with error are server errors): ok, badmessage, badfrom, badheader, messagelimiterror, recipientlimiterror, localserveerror, queueerror.",

161 },

162 []string{

163 "result",

164 },

165 )

166 metricServerErrors = promauto.NewCounterVec(

167 prometheus.CounterOpts{

168 Name: "mox_smtpserver_errors_total",

169 Help: "SMTP server errors, known values: dkimsign, queuedsn.",

170 },

171 []string{

172 "error",

173 },

174 )

175 metricDeliveryStarttls = promauto.NewCounter(

176 prometheus.CounterOpts{

177 Name: "mox_smtpserver_delivery_starttls_total",

178 Help: "Total number of STARTTLS handshakes for incoming deliveries.",

179 },

180 )

181 metricDeliveryStarttlsErrors = promauto.NewCounterVec(

182 prometheus.CounterOpts{

183 Name: "mox_smtpserver_delivery_starttls_errors_total",

184 Help: "Errors with TLS handshake during STARTTLS for incoming deliveries.",

185 },

186 []string{

187 "reason", // "eof", "sslv2", "unsupportedversions", "nottls", "alert-<num>-<msg>", "other"

188 },

189 )

190)

191

192var jitterRand = mox.NewPseudoRand()

193

194func durationDefault(delay *time.Duration, def time.Duration) time.Duration {

195 if delay == nil {

196 return def

197 }

198 return *delay

199}

200

201// Listen initializes network listeners for incoming SMTP connection.

202// The listeners are stored for a later call to Serve.

203func Listen() {

204 names := slices.Sorted(maps.Keys(mox.Conf.Static.Listeners))

205 for _, name := range names {

206 listener := mox.Conf.Static.Listeners[name]

207

208 var tlsConfig, tlsConfigDelivery *tls.Config

209 var noTLSClientAuth bool

210 if listener.TLS != nil {

211 tlsConfig = listener.TLS.Config

212 // For SMTP delivery, if we get a TLS handshake for an SNI hostname that we don't

213 // allow, we'll fallback to a certificate for the listener hostname instead of

214 // causing the connection to fail. May improve interoperability.

215 tlsConfigDelivery = listener.TLS.ConfigFallback

216 noTLSClientAuth = listener.TLS.ClientAuthDisabled

217 }

218

219 maxMsgSize := listener.SMTPMaxMessageSize

220 if maxMsgSize == 0 {

221 maxMsgSize = config.DefaultMaxMsgSize

222 }

223

224 if listener.SMTP.Enabled {

225 hostname := mox.Conf.Static.HostnameDomain

226 if listener.Hostname != "" {

227 hostname = listener.HostnameDomain

228 }

229 port := config.Port(listener.SMTP.Port, 25)

230 for _, ip := range listener.IPs {

231 firstTimeSenderDelay := durationDefault(listener.SMTP.FirstTimeSenderDelay, firstTimeSenderDelayDefault)

232 if tlsConfigDelivery != nil {

233 tlsConfigDelivery = tlsConfigDelivery.Clone()

234 // Default setting is currently to have session tickets disabled, to work around

235 // TLS interoperability issues with incoming deliveries from Microsoft. See

236 // https://github.com/golang/go/issues/70232.

237 tlsConfigDelivery.SessionTicketsDisabled = listener.SMTP.TLSSessionTicketsDisabled == nil || *listener.SMTP.TLSSessionTicketsDisabled

238 }

239 listen1("smtp", name, ip, port, hostname, tlsConfigDelivery, false, false, noTLSClientAuth, maxMsgSize, false, listener.SMTP.RequireSTARTTLS, !listener.SMTP.NoRequireTLS, listener.SMTP.DNSBLZones, firstTimeSenderDelay)

240 }

241 }

242 if listener.Submission.Enabled {

243 hostname := mox.Conf.Static.HostnameDomain

244 if listener.Hostname != "" {

245 hostname = listener.HostnameDomain

246 }

247 port := config.Port(listener.Submission.Port, 587)

248 for _, ip := range listener.IPs {

249 listen1("submission", name, ip, port, hostname, tlsConfig, true, false, noTLSClientAuth, maxMsgSize, !listener.Submission.NoRequireSTARTTLS, !listener.Submission.NoRequireSTARTTLS, true, nil, 0)

250 }

251 }

252

253 if listener.Submissions.Enabled {

254 hostname := mox.Conf.Static.HostnameDomain

255 if listener.Hostname != "" {

256 hostname = listener.HostnameDomain

257 }

258 port := config.Port(listener.Submissions.Port, 465)

259 for _, ip := range listener.IPs {

260 listen1("submissions", name, ip, port, hostname, tlsConfig, true, true, noTLSClientAuth, maxMsgSize, true, true, true, nil, 0)

261 }

262 }

263 }

264}

265

266var servers []func()

267

268func listen1(protocol, name, ip string, port int, hostname dns.Domain, tlsConfig *tls.Config, submission, xtls, noTLSClientAuth bool, maxMessageSize int64, requireTLSForAuth, requireTLSForDelivery, requireTLS bool, dnsBLs []dns.Domain, firstTimeSenderDelay time.Duration) {

269 log := mlog.New("smtpserver", nil)

270 addr := net.JoinHostPort(ip, fmt.Sprintf("%d", port))

271 if os.Getuid() == 0 {

272 log.Print("listening for smtp",

273 slog.String("listener", name),

274 slog.String("address", addr),

275 slog.String("protocol", protocol))

276 }

277 network := mox.Network(ip)

278 ln, err := mox.Listen(network, addr)

279 if err != nil {

280 log.Fatalx("smtp: listen for smtp", err, slog.String("protocol", protocol), slog.String("listener", name))

281 }

282

283 // Each listener gets its own copy of the config, so session keys between different

284 // ports on same listener aren't shared. We rotate session keys explicitly in this

285 // base TLS config because each connection clones the TLS config before using. The

286 // base TLS config would never get automatically managed/rotated session keys.

287 if tlsConfig != nil {

288 tlsConfig = tlsConfig.Clone()

289 mox.StartTLSSessionTicketKeyRefresher(mox.Shutdown, log, tlsConfig)

290 }

291

292 serve := func() {

293 for {

294 conn, err := ln.Accept()

295 if err != nil {

296 log.Infox("smtp: accept", err, slog.String("protocol", protocol), slog.String("listener", name))

297 continue

298 }

299

300 // Package is set on the resolver by the dkim/spf/dmarc/etc packages.

301 resolver := dns.StrictResolver{Log: log.Logger}

302 go serve(name, mox.Cid(), hostname, tlsConfig, conn, resolver, submission, xtls, false, noTLSClientAuth, maxMessageSize, requireTLSForAuth, requireTLSForDelivery, requireTLS, dnsBLs, firstTimeSenderDelay)

303 }

304 }

305

306 servers = append(servers, serve)

307}

308

309// Serve starts serving on all listeners, launching a goroutine per listener.

310func Serve() {

311 for _, serve := range servers {

312 go serve()

313 }

314}

315

316type conn struct {

317 cid int64

318

319 // OrigConn is the original (TCP) connection. We'll read from/write to conn, which

320 // can be wrapped in a tls.Server. We close origConn instead of conn because

321 // closing the TLS connection would send a TLS close notification, which may block

322 // for 5s if the server isn't reading it (because it is also sending it).

323 origConn net.Conn

324 conn net.Conn

325

326 tls bool

327 extRequireTLS bool // Whether to announce and allow the REQUIRETLS extension.

328 viaHTTPS bool // Whether the connection came in via the HTTPS port (using TLS ALPN).

329 noTLSClientAuth bool

330 resolver dns.Resolver

331 // The "x" in the readers and writes indicate Read and Write errors use panic to

332 // propagate the error.

333 xbr *bufio.Reader

334 xbw *bufio.Writer

335 xtr *moxio.TraceReader // Kept for changing trace level during cmd/auth/data.

336 xtw *moxio.TraceWriter

337 slow bool // If set, reads are done with a 1 second sleep, and writes are done 1 byte at a time, to keep spammers busy.

338 lastlog time.Time // Used for printing the delta time since the previous logging for this connection.

339 submission bool // ../rfc/6409:19 applies

340 baseTLSConfig *tls.Config

341 localIP net.IP

342 remoteIP net.IP

343 hostname dns.Domain

344 log mlog.Log // Used for all synchronous logging on this connection, see logbg for logging in a separate goroutine.

345 maxMessageSize int64

346 requireTLSForAuth bool

347 requireTLSForDelivery bool // If set, delivery is only allowed with TLS (STARTTLS), except if delivery is to a TLS reporting address.

348 cmd string // Current command.

349 cmdStart time.Time // Start of current command.

350 ncmds int // Number of commands processed. Used to abort connection when first incoming command is unknown/invalid.

351 dnsBLs []dns.Domain

352 firstTimeSenderDelay time.Duration

353

354 // If non-zero, taken into account during Read and Write. Set while processing DATA

355 // command, we don't want the entire delivery to take too long.

356 deadline time.Time

357

358 hello dns.IPDomain // Claimed remote name. Can be ip address for ehlo.

359 ehlo bool // If set, we had EHLO instead of HELO.

360

361 authFailed int // Number of failed auth attempts. For slowing down remote with many failures.

362 authSASL bool // Whether SASL authentication was done.

363 authTLS bool // Whether we did TLS client cert authentication.

364 username string // Only when authenticated.

365 account *store.Account // Only when authenticated.

366

367 // We track good/bad message transactions to disconnect spammers trying to guess addresses.

368 transactionGood int

369 transactionBad int

370

371 // Message transaction.

372 mailFrom *smtp.Path

373 requireTLS *bool // MAIL FROM with REQUIRETLS set.

374 futureRelease time.Time // MAIL FROM with HOLDFOR or HOLDUNTIL.

375 futureReleaseRequest string // For use in DSNs, either "for;" or "until;" plus original value. ../rfc/4865:305

376 has8bitmime bool // If MAIL FROM parameter BODY=8BITMIME was sent. Required for SMTPUTF8.

377 smtputf8 bool // todo future: we should keep track of this per recipient. perhaps only a specific recipient requires smtputf8, e.g. due to a utf8 localpart.

378 msgsmtputf8 bool // Is SMTPUTF8 required for the received message. Default to the same value as `smtputf8`, but is re-evaluated after the whole message (envelope and data) is received.

379 recipients []recipient

380}

381

382type rcptAccount struct {

383 AccountName string

384 Destination config.Destination

385 CanonicalAddress string // Optional catchall part stripped and/or lowercased.

386}

387

388type rcptAlias struct {

389 Alias config.Alias

390 CanonicalAddress string // Optional catchall part stripped and/or lowercased.

391}

392

393type recipient struct {

394 Addr smtp.Path

395

396 // If account and alias are both not set, this is not for a local address. This is

397 // normal for submission, where messages are added to the queue. For incoming

398 // deliveries, this will result in an error.

399 Account *rcptAccount // If set, recipient address is for this local account.

400 Alias *rcptAlias // If set, for a local alias.

401}

402

403func isClosed(err error) bool {

404 return errors.Is(err, errIO) || mlog.IsClosed(err)

405}

406

407// Logbg returns a logger for logging in the background (in a goroutine), eg for

408// logging LoginAttempts. The regular c.log has a handler that evaluates fields on

409// the connection at time of logging, which may happen at the same time as

410// modifications to those fields.

411func (c *conn) logbg() mlog.Log {

412 log := mlog.New("smtpserver", nil).WithCid(c.cid)

413 if c.username != "" {

414 log = log.With(slog.String("username", c.username))

415 }

416 return log

417}

418

419// loginAttempt initializes a store.LoginAttempt, for adding to the store after

420// filling in the results and other details.

421func (c *conn) loginAttempt(useTLS bool, authMech string) store.LoginAttempt {

422 var state *tls.ConnectionState

423 if tc, ok := c.conn.(*tls.Conn); ok && useTLS {

424 v := tc.ConnectionState()

425 state = &v

426 }

427

428 return store.LoginAttempt{

429 RemoteIP: c.remoteIP.String(),

430 LocalIP: c.localIP.String(),

431 TLS: store.LoginAttemptTLS(state),

432 Protocol: "submission",

433 AuthMech: authMech,

434 Result: store.AuthError, // Replaced by caller.

435 }

436}

437

438// makeTLSConfig makes a new tls config that is bound to the connection for

439// possible client certificate authentication in case of submission.

440func (c *conn) makeTLSConfig() *tls.Config {

441 if !c.submission || c.noTLSClientAuth {

442 return c.baseTLSConfig

443 }

444

445 // We clone the config so we can set VerifyPeerCertificate below to a method bound

446 // to this connection. Earlier, we set session keys explicitly on the base TLS

447 // config, so they can be used for this connection too.

448 tlsConf := c.baseTLSConfig.Clone()

449

450 // Allow client certificate authentication, for use with the sasl "external"

451 // authentication mechanism.

452 tlsConf.ClientAuth = tls.RequestClientCert

453

454 // We verify the client certificate during the handshake. The TLS handshake is

455 // initiated explicitly for incoming connections and during starttls, so we can

456 // immediately extract the account name and address used for authentication.

457 tlsConf.VerifyPeerCertificate = c.tlsClientAuthVerifyPeerCert

458

459 return tlsConf

460}

461

462// tlsClientAuthVerifyPeerCert can be used as tls.Config.VerifyPeerCertificate, and

463// sets authentication-related fields on conn. This is not called on resumed TLS

464// connections.

465func (c *conn) tlsClientAuthVerifyPeerCert(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {

466 if len(rawCerts) == 0 {

467 return nil

468 }

469

470 // If we had too many authentication failures from this IP, don't attempt

471 // authentication. If this is a new incoming connetion, it is closed after the TLS

472 // handshake.

473 if !mox.LimiterFailedAuth.CanAdd(c.remoteIP, time.Now(), 1) {

474 return nil

475 }

476

477 cert, err := x509.ParseCertificate(rawCerts[0])

478 if err != nil {

479 c.log.Debugx("parsing tls client certificate", err)

480 return err

481 }

482 if err := c.tlsClientAuthVerifyPeerCertParsed(cert); err != nil {

483 c.log.Debugx("verifying tls client certificate", err)

484 return fmt.Errorf("verifying client certificate: %w", err)

485 }

486 return nil

487}

488

489// tlsClientAuthVerifyPeerCertParsed verifies a client certificate. Called both for

490// fresh and resumed TLS connections.

491func (c *conn) tlsClientAuthVerifyPeerCertParsed(cert *x509.Certificate) error {

492 if c.account != nil {

493 return fmt.Errorf("cannot authenticate with tls client certificate after previous authentication")

494 }

495

496 la := c.loginAttempt(false, "tlsclientauth")

497 defer func() {

498 // Get TLS connection state in goroutine because we are called while performing the

499 // TLS handshake, which already has the tls connection locked.

500 conn := c.conn.(*tls.Conn)

501 logbg := c.logbg() // Evaluate attributes now, can't do it in goroutine.

502 go func() {

503 defer func() {

504 // In case of panic don't take the whole program down.

505 x := recover()

506 if x != nil {

507 c.log.Error("recover from panic", slog.Any("panic", x))

508 debug.PrintStack()

509 metrics.PanicInc(metrics.Smtpserver)

510 }

511 }()

512

513 state := conn.ConnectionState()

514 la.TLS = store.LoginAttemptTLS(&state)

515 store.LoginAttemptAdd(context.Background(), logbg, la)

516 }()

517

518 if la.Result == store.AuthSuccess {

519 mox.LimiterFailedAuth.Reset(c.remoteIP, time.Now())

520 } else {

521 mox.LimiterFailedAuth.Add(c.remoteIP, time.Now(), 1)

522 }

523 }()

524

525 // For many failed auth attempts, slow down verification attempts.

526 if c.authFailed > 3 && authFailDelay > 0 {

527 mox.Sleep(mox.Context, time.Duration(c.authFailed-3)*authFailDelay)

528 }

529 c.authFailed++ // Compensated on success.

530 defer func() {

531 // On the 3rd failed authentication, start responding slowly. Successful auth will

532 // cause fast responses again.

533 if c.authFailed >= 3 {

534 c.setSlow(true)

535 }

536 }()

537

538 shabuf := sha256.Sum256(cert.RawSubjectPublicKeyInfo)

539 fp := base64.RawURLEncoding.EncodeToString(shabuf[:])

540 la.TLSPubKeyFingerprint = fp

541 pubKey, err := store.TLSPublicKeyGet(context.TODO(), fp)

542 if err != nil {

543 if err == bstore.ErrAbsent {

544 la.Result = store.AuthBadCredentials

545 }

546 return fmt.Errorf("looking up tls public key with fingerprint %s, subject %q, issuer %q: %v", fp, cert.Subject, cert.Issuer, err)

547 }

548 la.LoginAddress = pubKey.LoginAddress

549

550 // Verify account exists and still matches address. We don't check for account

551 // login being disabled if preauth is disabled. In that case, sasl external auth

552 // will be done before credentials can be used, and login disabled will be checked

553 // then, where it will result in a more helpful error message.

554 checkLoginDisabled := !pubKey.NoIMAPPreauth

555 acc, accName, _, err := store.OpenEmail(c.log, pubKey.LoginAddress, checkLoginDisabled)

556 la.AccountName = accName

557 if err != nil {

558 if errors.Is(err, store.ErrLoginDisabled) {

559 la.Result = store.AuthLoginDisabled

560 }

561 return fmt.Errorf("opening account for address %s for public key %s: %w", pubKey.LoginAddress, fp, err)

562 }

563 defer func() {

564 if acc != nil {

565 err := acc.Close()

566 c.log.Check(err, "close account")

567 }

568 }()

569 la.AccountName = acc.Name

570 if acc.Name != pubKey.Account {

571 return fmt.Errorf("tls client public key %s is for account %s, but email address %s is for account %s", fp, pubKey.Account, pubKey.LoginAddress, acc.Name)

572 }

573

574 c.authFailed = 0

575 c.account = acc

576 acc = nil // Prevent cleanup by defer.

577 c.username = pubKey.LoginAddress

578 c.authTLS = true

579 la.Result = store.AuthSuccess

580 c.log.Debug("tls client authenticated with client certificate",

581 slog.String("fingerprint", fp),

582 slog.String("username", c.username),

583 slog.String("account", c.account.Name),

584 slog.Any("remote", c.remoteIP))

585 return nil

586}

587

588// xtlsHandshakeAndAuthenticate performs the TLS handshake, and verifies a client

589// certificate if present.

590func (c *conn) xtlsHandshakeAndAuthenticate(conn net.Conn) {

591 tlsConn := tls.Server(conn, c.makeTLSConfig())

592 c.conn = tlsConn

593

594 cidctx := context.WithValue(mox.Context, mlog.CidKey, c.cid)

595 ctx, cancel := context.WithTimeout(cidctx, time.Minute)

596 defer cancel()

597 c.log.Debug("starting tls server handshake")

598 if !c.submission {

599 metricDeliveryStarttls.Inc()

600 }

601 if err := tlsConn.HandshakeContext(ctx); err != nil {

602 if !c.submission {

603 // Errors from crypto/tls mostly aren't typed. We'll have to look for strings...

604 reason := "other"

605 if errors.Is(err, io.EOF) {

606 reason = "eof"

607 } else if alert, ok := mox.AsTLSAlert(err); ok {

608 reason = tlsrpt.FormatAlert(alert)

609 } else {

610 s := err.Error()

611 if strings.Contains(s, "tls: client offered only unsupported versions") {

612 reason = "unsupportedversions"

613 } else if strings.Contains(s, "tls: first record does not look like a TLS handshake") {

614 reason = "nottls"

615 } else if strings.Contains(s, "tls: unsupported SSLv2 handshake received") {

616 reason = "sslv2"

617 }

618 }

619 metricDeliveryStarttlsErrors.WithLabelValues(reason).Inc()

620 }

621 panic(fmt.Errorf("tls handshake: %s (%w)", err, errIO))

622 }

623 cancel()

624

625 cs := tlsConn.ConnectionState()

626 if cs.DidResume && len(cs.PeerCertificates) > 0 && !c.noTLSClientAuth {

627 // Verify client after session resumption.

628 err := c.tlsClientAuthVerifyPeerCertParsed(cs.PeerCertificates[0])

629 if err != nil {

630 panic(fmt.Errorf("tls verify client certificate after resumption: %s (%w)", err, errIO))

631 }

632 }

633

634 version, ciphersuite := moxio.TLSInfo(cs)

635 attrs := []slog.Attr{

636 slog.String("version", version),

637 slog.String("ciphersuite", ciphersuite),

638 slog.String("sni", cs.ServerName),

639 slog.Bool("resumed", cs.DidResume),

640 slog.Bool("notlsclientauth", c.noTLSClientAuth),

641 slog.Int("clientcerts", len(cs.PeerCertificates)),

642 }

643 if c.account != nil {

644 attrs = append(attrs,

645 slog.String("account", c.account.Name),

646 slog.String("username", c.username),

647 )

648 }

649 c.log.Debug("tls handshake completed", attrs...)

650}

651

652// completely reset connection state as if greeting has just been sent.

653// ../rfc/3207:210

654func (c *conn) reset() {

655 c.ehlo = false

656 c.hello = dns.IPDomain{}

657 if !c.authTLS {

658 c.username = ""

659 if c.account != nil {

660 err := c.account.Close()

661 c.log.Check(err, "closing account")

662 }

663 c.account = nil

664 }

665 c.authSASL = false

666 c.rset()

667}

668

669// for rset command, and a few more cases that reset the mail transaction state.

670// ../rfc/5321:2502

671func (c *conn) rset() {

672 c.mailFrom = nil

673 c.requireTLS = nil

674 c.futureRelease = time.Time{}

675 c.futureReleaseRequest = ""

676 c.has8bitmime = false

677 c.smtputf8 = false

678 c.msgsmtputf8 = false

679 c.recipients = nil

680}

681

682func (c *conn) earliestDeadline(d time.Duration) time.Time {

683 e := time.Now().Add(d)

684 if !c.deadline.IsZero() && c.deadline.Before(e) {

685 return c.deadline

686 }

687 return e

688}

689

690func (c *conn) xcheckAuth() {

691 if c.submission && c.account == nil {

692 // ../rfc/4954:623

693 xsmtpUserErrorf(smtp.C530SecurityRequired, smtp.SePol7Other0, "authentication required")

694 }

695}

696

697func (c *conn) xtrace(level slog.Level) func() {

698 c.xflush()

699 c.xtr.SetTrace(level)

700 c.xtw.SetTrace(level)

701 return func() {

702 c.xflush()

703 c.xtr.SetTrace(mlog.LevelTrace)

704 c.xtw.SetTrace(mlog.LevelTrace)

705 }

706}

707

708// setSlow marks the connection slow (or now), so reads are done with 3 second

709// delay for each read, and writes are done at 1 byte per second, to try to slow

710// down spammers.

711func (c *conn) setSlow(on bool) {

712 if on && !c.slow {

713 c.log.Debug("connection changed to slow")

714 } else if !on && c.slow {

715 c.log.Debug("connection restored to regular pace")

716 }

717 c.slow = on

718}

719

720// Write writes to the connection. It panics on i/o errors, which is handled by the

721// connection command loop.

722func (c *conn) Write(buf []byte) (int, error) {

723 chunk := len(buf)

724 if c.slow {

725 chunk = 1

726 }

727

728 // We set a single deadline for Write and Read. This may be a TLS connection.

729 // SetDeadline works on the underlying connection. If we wouldn't touch the read

730 // deadline, and only set the write deadline and do a bunch of writes, the TLS

731 // library would still have to do reads on the underlying connection, and may reach

732 // a read deadline that was set for some earlier read.

733 // We have one deadline for the whole write. In case of slow writing, we'll write

734 // the last chunk in one go, so remote smtp clients don't abort the connection for

735 // being slow.

736 deadline := c.earliestDeadline(30 * time.Second)

737 if err := c.conn.SetDeadline(deadline); err != nil {

738 c.log.Errorx("setting deadline for write", err)

739 }

740

741 var n int

742 for len(buf) > 0 {

743 nn, err := c.conn.Write(buf[:chunk])

744 if err != nil {

745 panic(fmt.Errorf("write: %s (%w)", err, errIO))

746 }

747 n += nn

748 buf = buf[chunk:]

749 if len(buf) > 0 && badClientDelay > 0 {

750 mox.Sleep(mox.Context, badClientDelay)

751

752 // Make sure we don't take too long, otherwise the remote SMTP client may close the

753 // connection.

754 if time.Until(deadline) < 5*badClientDelay {

755 chunk = len(buf)

756 }

757 }

758 }

759 return n, nil

760}

761

762// Read reads from the connection. It panics on i/o errors, which is handled by the

763// connection command loop.

764func (c *conn) Read(buf []byte) (int, error) {

765 if c.slow && badClientDelay > 0 {

766 mox.Sleep(mox.Context, badClientDelay)

767 }

768

769 // todo future: make deadline configurable for callers, and through config file? ../rfc/5321:3610 ../rfc/6409:492

770 // See comment about Deadline instead of individual read/write deadlines at Write.

771 if err := c.conn.SetDeadline(c.earliestDeadline(30 * time.Second)); err != nil {

772 c.log.Errorx("setting deadline for read", err)

773 }

774

775 n, err := c.conn.Read(buf)

776 if err != nil {

777 panic(fmt.Errorf("read: %s (%w)", err, errIO))

778 }

779 return n, err

780}

781

782// Cache of line buffers for reading commands.

783// Filled on demand.

784var bufpool = moxio.NewBufpool(8, 2*1024)

785

786func (c *conn) xreadline() string {

787 line, err := bufpool.Readline(c.log, c.xbr)

788 if err != nil && errors.Is(err, moxio.ErrLineTooLong) {

789 c.xwritecodeline(smtp.C500BadSyntax, smtp.SeProto5Other0, "line too long, smtp max is 512, we reached 2048", nil)

790 panic(fmt.Errorf("%s (%w)", err, errIO))

791 } else if err != nil {

792 panic(fmt.Errorf("%s (%w)", err, errIO))

793 }

794 return line

795}

796

797// Buffered-write command response line to connection with codes and msg.

798// Err is not sent to remote but is used for logging and can be empty.

799func (c *conn) xbwritecodeline(code int, secode string, msg string, err error) {

800 var ecode string

801 if secode != "" {

802 ecode = fmt.Sprintf("%d.%s", code/100, secode)

803 }

804 metricCommands.WithLabelValues(c.kind(), c.cmd, fmt.Sprintf("%d", code), ecode).Observe(float64(time.Since(c.cmdStart)) / float64(time.Second))

805 c.log.Debugx("smtp command result", err,

806 slog.String("kind", c.kind()),

807 slog.String("cmd", c.cmd),

808 slog.Int("code", code),

809 slog.String("ecode", ecode),

810 slog.Duration("duration", time.Since(c.cmdStart)))

811

812 var sep string

813 if ecode != "" {

814 sep = " "

815 }

816

817 // Separate by newline and wrap long lines.

818 lines := strings.Split(msg, "\n")

819 for i, line := range lines {

820 // ../rfc/5321:3506 ../rfc/5321:2583 ../rfc/5321:2756

821 var prelen = 3 + 1 + len(ecode) + len(sep)

822 for prelen+len(line) > 510 {

823 e := 510 - prelen

824 for ; e > 400 && line[e] != ' '; e-- {

825 }

826 // todo future: understand if ecode should be on each line. won't hurt. at least as long as we don't do expn or vrfy.

827 c.xbwritelinef("%d-%s%s%s", code, ecode, sep, line[:e])

828 line = line[e:]

829 }

830 spdash := " "

831 if i < len(lines)-1 {

832 spdash = "-"

833 }

834 c.xbwritelinef("%d%s%s%s%s", code, spdash, ecode, sep, line)

835 }

836}

837

838// Buffered-write a formatted response line to connection.

839func (c *conn) xbwritelinef(format string, args ...any) {

840 msg := fmt.Sprintf(format, args...)

841 fmt.Fprint(c.xbw, msg+"\r\n")

842}

843

844// Flush pending buffered writes to connection.

845func (c *conn) xflush() {

846 c.xbw.Flush() // Errors will have caused a panic in Write.

847}

848

849// Write (with flush) a response line with codes and message. err is not written, used for logging and can be nil.

850func (c *conn) xwritecodeline(code int, secode string, msg string, err error) {

851 c.xbwritecodeline(code, secode, msg, err)

852 c.xflush()

853}

854

855// Write (with flush) a formatted response line to connection.

856func (c *conn) xwritelinef(format string, args ...any) {

857 c.xbwritelinef(format, args...)

858 c.xflush()

859}

860

861var cleanClose struct{} // Sentinel value for panic/recover indicating clean close of connection.

862

863// ServeTLSConn serves a TLS connection.

864func ServeTLSConn(listenerName string, hostname dns.Domain, conn *tls.Conn, tlsConfig *tls.Config, submission, viaHTTPS bool, maxMsgSize int64, requireTLS bool) {

865 log := mlog.New("smtpserver", nil)

866 resolver := dns.StrictResolver{Log: log.Logger}

867 serve(listenerName, mox.Cid(), hostname, tlsConfig, conn, resolver, submission, true, viaHTTPS, true, maxMsgSize, true, true, requireTLS, nil, 0)

868}

869

870func serve(listenerName string, cid int64, hostname dns.Domain, tlsConfig *tls.Config, nc net.Conn, resolver dns.Resolver, submission, xtls, viaHTTPS, noTLSClientAuth bool, maxMessageSize int64, requireTLSForAuth, requireTLSForDelivery, requireTLS bool, dnsBLs []dns.Domain, firstTimeSenderDelay time.Duration) {

871 var localIP, remoteIP net.IP

872 if a, ok := nc.LocalAddr().(*net.TCPAddr); ok {

873 localIP = a.IP

874 } else {

875 // For net.Pipe, during tests.

876 localIP = net.ParseIP("127.0.0.10")

877 }

878 if a, ok := nc.RemoteAddr().(*net.TCPAddr); ok {

879 remoteIP = a.IP

880 } else {

881 // For net.Pipe, during tests.

882 remoteIP = net.ParseIP("127.0.0.10")

883 }

884

885 origConn := nc

886 if viaHTTPS {

887 origConn = nc.(*tls.Conn).NetConn()

888 }

889

890 c := &conn{

891 cid: cid,

892 origConn: origConn,

893 conn: nc,

894 submission: submission,

895 tls: xtls,

896 viaHTTPS: viaHTTPS,

897 noTLSClientAuth: noTLSClientAuth,

898 extRequireTLS: requireTLS,

899 resolver: resolver,

900 lastlog: time.Now(),

901 baseTLSConfig: tlsConfig,

902 localIP: localIP,

903 remoteIP: remoteIP,

904 hostname: hostname,

905 maxMessageSize: maxMessageSize,

906 requireTLSForAuth: requireTLSForAuth,

907 requireTLSForDelivery: requireTLSForDelivery,

908 dnsBLs: dnsBLs,

909 firstTimeSenderDelay: firstTimeSenderDelay,

910 }

911 var logmutex sync.Mutex

912 // Also see (and possibly update) c.logbg, for logging in a goroutine.

913 c.log = mlog.New("smtpserver", nil).WithFunc(func() []slog.Attr {

914 logmutex.Lock()

915 defer logmutex.Unlock()

916 now := time.Now()

917 l := []slog.Attr{

918 slog.Int64("cid", c.cid),

919 slog.Duration("delta", now.Sub(c.lastlog)),

920 }

921 c.lastlog = now

922 if c.username != "" {

923 l = append(l, slog.String("username", c.username))

924 }

925 return l

926 })

927 c.xtr = moxio.NewTraceReader(c.log, "RC: ", c)

928 c.xbr = bufio.NewReader(c.xtr)

929 c.xtw = moxio.NewTraceWriter(c.log, "LS: ", c)

930 c.xbw = bufio.NewWriter(c.xtw)

931

932 metricConnection.WithLabelValues(c.kind()).Inc()

933 c.log.Info("new connection",

934 slog.Any("remote", c.conn.RemoteAddr()),

935 slog.Any("local", c.conn.LocalAddr()),

936 slog.Bool("submission", submission),

937 slog.Bool("tls", xtls),

938 slog.Bool("viahttps", viaHTTPS),

939 slog.String("listener", listenerName))

940

941 defer func() {

942 err := c.origConn.Close() // Close actual TCP socket, regardless of TLS on top.

943 c.log.Check(err, "closing tcp connection")

944 c.conn.Close() // If TLS, will try to write alert notification to already closed socket, returning error quickly.

945

946 if c.account != nil {

947 err := c.account.Close()

948 c.log.Check(err, "closing account")

949 c.account = nil

950 }

951

952 x := recover()

953 if x == nil || x == cleanClose {

954 c.log.Info("connection closed")

955 } else if err, ok := x.(error); ok && isClosed(err) {

956 c.log.Infox("connection closed", err)

957 } else {

958 c.log.Error("unhandled panic", slog.Any("err", x))

959 debug.PrintStack()

960 metrics.PanicInc(metrics.Smtpserver)

961 }

962 }()

963

964 if xtls && !viaHTTPS {

965 // Start TLS on connection. We perform the handshake explicitly, so we can set a

966 // timeout, do client certificate authentication, log TLS details afterwards.

967 c.xtlsHandshakeAndAuthenticate(c.conn)

968 }

969

970 select {

971 case <-mox.Shutdown.Done():

972 // ../rfc/5321:2811 ../rfc/5321:1666 ../rfc/3463:420

973 c.xwritecodeline(smtp.C421ServiceUnavail, smtp.SeSys3NotAccepting2, "shutting down", nil)

974 return

975 default:

976 }

977

978 if !limiterConnectionRate.Add(c.remoteIP, time.Now(), 1) {

979 c.xwritecodeline(smtp.C421ServiceUnavail, smtp.SePol7Other0, "connection rate from your ip or network too high, slow down please", nil)

980 return

981 }

982

983 // If remote IP/network resulted in too many authentication failures, refuse to serve.

984 if submission && !mox.LimiterFailedAuth.CanAdd(c.remoteIP, time.Now(), 1) {

985 metrics.AuthenticationRatelimitedInc("submission")

986 c.log.Debug("refusing connection due to many auth failures", slog.Any("remoteip", c.remoteIP))

987 c.xwritecodeline(smtp.C421ServiceUnavail, smtp.SePol7Other0, "too many auth failures", nil)

988 return

989 }

990

991 if !limiterConnections.Add(c.remoteIP, time.Now(), 1) {

992 c.log.Debug("refusing connection due to many open connections", slog.Any("remoteip", c.remoteIP))

993 c.xwritecodeline(smtp.C421ServiceUnavail, smtp.SePol7Other0, "too many open connections from your ip or network", nil)

994 return

995 }

996 defer limiterConnections.Add(c.remoteIP, time.Now(), -1)

997

998 // We register and unregister the original connection, in case c.conn is replaced

999 // with a TLS connection later on.

1000 mox.Connections.Register(nc, "smtp", listenerName)

1001 defer mox.Connections.Unregister(nc)

1002

1003 // ../rfc/5321:964 ../rfc/5321:4294 about announcing software and version

1004 // Syntax: ../rfc/5321:2586

1005 // We include the string ESMTP. https://cr.yp.to/smtp/greeting.html recommends it.

1006 // Should not be too relevant nowadays, but does not hurt and default blackbox

1007 // exporter SMTP health check expects it.

1008 c.xwritelinef("%d %s ESMTP mox", smtp.C220ServiceReady, c.hostname.ASCII)

1009

1010 for {

1011 command(c)

1012

1013 // If another command is present, don't flush our buffered response yet. Holding

1014 // off will cause us to respond with a single packet.

1015 n := c.xbr.Buffered()

1016 if n > 0 {

1017 buf, err := c.xbr.Peek(n)

1018 if err == nil && bytes.IndexByte(buf, '\n') >= 0 {

1019 continue

1020 }

1021 }

1022 c.xflush()

1023 }

1024}

1025

1026var commands = map[string]func(c *conn, p *parser){

1027 "helo": (*conn).cmdHelo,

1028 "ehlo": (*conn).cmdEhlo,

1029 "starttls": (*conn).cmdStarttls,

1030 "auth": (*conn).cmdAuth,

1031 "mail": (*conn).cmdMail,

1032 "rcpt": (*conn).cmdRcpt,

1033 "data": (*conn).cmdData,

1034 "rset": (*conn).cmdRset,

1035 "vrfy": (*conn).cmdVrfy,

1036 "expn": (*conn).cmdExpn,

1037 "help": (*conn).cmdHelp,

1038 "noop": (*conn).cmdNoop,

1039 "quit": (*conn).cmdQuit,

1040}

1041

1042func command(c *conn) {

1043 defer func() {

1044 x := recover()

1045 if x == nil {

1046 return

1047 }

1048 err, ok := x.(error)

1049 if !ok {

1050 panic(x)

1051 }

1052

1053 if isClosed(err) {

1054 panic(err)

1055 }

1056

1057 var serr smtpError

1058 if errors.As(err, &serr) {

1059 c.xwritecodeline(serr.code, serr.secode, fmt.Sprintf("%s (%s)", serr.errmsg, mox.ReceivedID(c.cid)), serr.err)

1060 if serr.printStack {

1061 c.log.Errorx("smtp error", serr.err, slog.Int("code", serr.code), slog.String("secode", serr.secode))

1062 debug.PrintStack()

1063 }

1064 } else {

1065 // Other type of panic, we pass it on, aborting the connection.

1066 c.log.Errorx("command panic", err)

1067 panic(err)

1068 }

1069 }()

1070

1071 // todo future: we could wait for either a line or shutdown, and just close the connection on shutdown.

1072

1073 line := c.xreadline()

1074 t := strings.SplitN(line, " ", 2)

1075 var args string

1076 if len(t) == 2 {

1077 args = " " + t[1]

1078 }

1079 cmd := t[0]

1080 cmdl := strings.ToLower(cmd)

1081

1082 // todo future: should we return an error for lines that are too long? perhaps for submission or in a pedantic mode. we would have to take extensions for MAIL into account. ../rfc/5321:3500 ../rfc/5321:3552

1083

1084 select {

1085 case <-mox.Shutdown.Done():

1086 // ../rfc/5321:2811 ../rfc/5321:1666 ../rfc/3463:420

1087 c.xwritecodeline(smtp.C421ServiceUnavail, smtp.SeSys3NotAccepting2, "shutting down", nil)

1088 panic(errIO)

1089 default:

1090 }

1091

1092 c.cmd = cmdl

1093 c.cmdStart = time.Now()

1094

1095 p := newParser(args, c.smtputf8, c)

1096 fn, ok := commands[cmdl]

1097 if !ok {

1098 c.cmd = "(unknown)"

1099 if c.ncmds == 0 {

1100 // Other side is likely speaking something else than SMTP, send error message and

1101 // stop processing because there is a good chance whatever they sent has multiple

1102 // lines.

1103 c.xwritecodeline(smtp.C500BadSyntax, smtp.SeProto5Syntax2, "please try again speaking smtp", nil)

1104 panic(errIO)

1105 }

1106 // note: not "command not implemented", see ../rfc/5321:2934 ../rfc/5321:2539

1107 xsmtpUserErrorf(smtp.C500BadSyntax, smtp.SeProto5BadCmdOrSeq1, "unknown command")

1108 }

1109 c.ncmds++

1110 fn(c, p)

1111}

1112

1113// For use in metric labels.

1114func (c *conn) kind() string {

1115 if c.submission {

1116 return "submission"

1117 }

1118 return "smtp"

1119}

1120

1121func (c *conn) xneedHello() {

1122 if c.hello.IsZero() {

1123 xsmtpUserErrorf(smtp.C503BadCmdSeq, smtp.SeProto5BadCmdOrSeq1, "no ehlo/helo yet")

1124 }

1125}

1126

1127// If smtp server is configured to require TLS for all mail delivery (except to TLS

1128// reporting address), abort command.

1129func (c *conn) xneedTLSForDelivery(rcpt smtp.Path) {

1130 // For TLS reports, we allow the message in even without TLS, because there may be

1131 // TLS interopability problems. ../rfc/8460:316

1132 if c.requireTLSForDelivery && !c.tls && !isTLSReportRecipient(rcpt) {

1133 // ../rfc/3207:148

1134 xsmtpUserErrorf(smtp.C530SecurityRequired, smtp.SePol7Other0, "STARTTLS required for mail delivery")

1135 }

1136}

1137

1138func isTLSReportRecipient(rcpt smtp.Path) bool {

1139 _, _, _, dest, err := mox.LookupAddress(rcpt.Localpart, rcpt.IPDomain.Domain, false, false, false)

1140 return err == nil && (dest.HostTLSReports || dest.DomainTLSReports)

1141}

1142

1143func (c *conn) cmdHelo(p *parser) {

1144 c.cmdHello(p, false)

1145}

1146

1147func (c *conn) cmdEhlo(p *parser) {

1148 c.cmdHello(p, true)

1149}

1150

1151// ../rfc/5321:1783

1152func (c *conn) cmdHello(p *parser, ehlo bool) {

1153 var remote dns.IPDomain

1154 if c.submission && !mox.Pedantic {

1155 // Mail clients regularly put bogus information in the hostname/ip. For submission,

1156 // the value is of no use, so there is not much point in annoying the user with

1157 // errors they cannot fix themselves. Except when in pedantic mode.

1158 remote = dns.IPDomain{IP: c.remoteIP}

1159 } else {

1160 p.xspace()

1161 if ehlo {

1162 remote = p.xipdomain(true)

1163 } else {

1164 remote = dns.IPDomain{Domain: p.xdomain()}

1165

1166 // Verify a remote domain name has an A or AAAA record, CNAME not allowed. ../rfc/5321:722

1167 cidctx := context.WithValue(mox.Context, mlog.CidKey, c.cid)

1168 ctx, cancel := context.WithTimeout(cidctx, time.Minute)

1169 _, _, err := c.resolver.LookupIPAddr(ctx, remote.Domain.ASCII+".")

1170 cancel()

1171 if dns.IsNotFound(err) {

1172 xsmtpUserErrorf(smtp.C550MailboxUnavail, smtp.SeProto5Other0, "your ehlo domain does not resolve to an IP address")

1173 }

1174 // For success or temporary resolve errors, we'll just continue.

1175 }

1176 // ../rfc/5321:1827

1177 // Though a few paragraphs earlier is a claim additional data can occur for address

1178 // literals (IP addresses), although the ABNF in that document does not allow it.

1179 // We allow additional text, but only if space-separated.

1180 if len(remote.IP) > 0 && p.space() {

1181 p.remainder() // ../rfc/5321:1802 ../rfc/2821:1632

1182 }

1183 p.xend()

1184 }

1185

1186 // Reset state as if RSET command has been issued. ../rfc/5321:2093 ../rfc/5321:2453

1187 c.rset()

1188

1189 c.ehlo = ehlo

1190 c.hello = remote

1191

1192 // https://www.iana.org/assignments/mail-parameters/mail-parameters.xhtml

1193

1194 c.xbwritelinef("250-%s", c.hostname.ASCII)

1195 c.xbwritelinef("250-PIPELINING") // ../rfc/2920:108

1196 c.xbwritelinef("250-SIZE %d", c.maxMessageSize) // ../rfc/1870:70

1197 // ../rfc/3207:237

1198 if !c.tls && c.baseTLSConfig != nil {

1199 // ../rfc/3207:90

1200 c.xbwritelinef("250-STARTTLS")

1201 } else if c.extRequireTLS {

1202 // ../rfc/8689:202

1203 // ../rfc/8689:143

1204 c.xbwritelinef("250-REQUIRETLS")

1205 }

1206 if c.submission {

1207 var mechs string

1208 // ../rfc/4954:123

1209 if c.tls || !c.requireTLSForAuth {

1210 // We always mention the SCRAM PLUS variants, even if TLS is not active: It is a

1211 // hint to the client that a TLS connection can use TLS channel binding during

1212 // authentication. The client should select the bare variant when TLS isn't

1213 // present, and also not indicate the server supports the PLUS variant in that

1214 // case, or it would trigger the mechanism downgrade detection.

1215 mechs = "SCRAM-SHA-256-PLUS SCRAM-SHA-256 SCRAM-SHA-1-PLUS SCRAM-SHA-1 CRAM-MD5 PLAIN LOGIN"

1216 }

1217 if c.tls && len(c.conn.(*tls.Conn).ConnectionState().PeerCertificates) > 0 && !c.viaHTTPS && !c.noTLSClientAuth {

1218 mechs = "EXTERNAL " + mechs

1219 }

1220 c.xbwritelinef("250-AUTH %s", mechs)

1221 // ../rfc/4865:127

1222 t := time.Now().Add(queue.FutureReleaseIntervalMax).UTC() // ../rfc/4865:98

1223 c.xbwritelinef("250-FUTURERELEASE %d %s", queue.FutureReleaseIntervalMax/time.Second, t.Format(time.RFC3339))

1224 }

1225 c.xbwritelinef("250-ENHANCEDSTATUSCODES") // ../rfc/2034:71

1226 // todo future? c.writelinef("250-DSN")

1227 c.xbwritelinef("250-8BITMIME") // ../rfc/6152:86

1228 c.xbwritelinef("250-LIMITS RCPTMAX=%d", rcptToLimit) // ../rfc/9422:301

1229 c.xbwritecodeline(250, "", "SMTPUTF8", nil) // ../rfc/6531:201

1230 c.xflush()

1231}

1232

1233// ../rfc/3207:96

1234func (c *conn) cmdStarttls(p *parser) {

1235 c.xneedHello()

1236 p.xend()

1237

1238 if c.tls {

1239 // ../rfc/3207:235

1240 xsmtpUserErrorf(smtp.C503BadCmdSeq, smtp.SeProto5BadCmdOrSeq1, "already speaking tls")

1241 }

1242 if c.account != nil {

1243 xsmtpUserErrorf(smtp.C503BadCmdSeq, smtp.SeProto5BadCmdOrSeq1, "cannot starttls after authentication")

1244 }

1245 if c.baseTLSConfig == nil {

1246 xsmtpUserErrorf(smtp.C503BadCmdSeq, smtp.SeProto5BadCmdOrSeq1, "starttls not offered")

1247 }

1248

1249 // We don't want to do TLS on top of c.r because it also prints protocol traces: We

1250 // don't want to log the TLS stream. So we'll do TLS on the underlying connection,

1251 // but make sure any bytes already read and in the buffer are used for the TLS

1252 // handshake.

1253 conn := c.conn

1254 if n := c.xbr.Buffered(); n > 0 {

1255 conn = &moxio.PrefixConn{

1256 PrefixReader: io.LimitReader(c.xbr, int64(n)),

1257 Conn: conn,

1258 }

1259 }

1260

1261 // We add the cid to the output, to help debugging in case of a failing TLS connection.

1262 c.xwritecodeline(smtp.C220ServiceReady, smtp.SeOther00, "go! ("+mox.ReceivedID(c.cid)+")", nil)

1263

1264 c.xtlsHandshakeAndAuthenticate(conn)

1265

1266 c.reset() // ../rfc/3207:210

1267 c.tls = true

1268}

1269

1270// ../rfc/4954:139

1271func (c *conn) cmdAuth(p *parser) {

1272 c.xneedHello()

1273

1274 if !c.submission {

1275 xsmtpUserErrorf(smtp.C503BadCmdSeq, smtp.SeProto5BadCmdOrSeq1, "authentication only allowed on submission ports")

1276 }

1277 if c.authSASL {

1278 // ../rfc/4954:152

1279 xsmtpUserErrorf(smtp.C503BadCmdSeq, smtp.SeProto5BadCmdOrSeq1, "already authenticated")

1280 }

1281 if c.mailFrom != nil {

1282 // ../rfc/4954:157

1283 xsmtpUserErrorf(smtp.C503BadCmdSeq, smtp.SeProto5BadCmdOrSeq1, "authentication not allowed during mail transaction")

1284 }

1285

1286 // If authentication fails due to missing derived secrets, we don't hold it against

1287 // the connection. There is no way to indicate server support for an authentication

1288 // mechanism, but that a mechanism won't work for an account.

1289 var missingDerivedSecrets bool

1290

1291 // For many failed auth attempts, slow down verification attempts.

1292 // Dropping the connection could also work, but more so when we have a connection rate limiter.

1293 // ../rfc/4954:770

1294 if c.authFailed > 3 && authFailDelay > 0 {

1295 // ../rfc/4954:770

1296 mox.Sleep(mox.Context, time.Duration(c.authFailed-3)*authFailDelay)

1297 }

1298 c.authFailed++ // Compensated on success.

1299 defer func() {

1300 if missingDerivedSecrets {

1301 c.authFailed--

1302 }

1303 // On the 3rd failed authentication, start responding slowly. Successful auth will

1304 // cause fast responses again.

1305 if c.authFailed >= 3 {

1306 c.setSlow(true)

1307 }

1308 }()

1309

1310 la := c.loginAttempt(true, "")

1311 defer func() {

1312 store.LoginAttemptAdd(context.Background(), c.logbg(), la)

1313 if la.Result == store.AuthSuccess {

1314 mox.LimiterFailedAuth.Reset(c.remoteIP, time.Now())

1315 } else if !missingDerivedSecrets {

1316 mox.LimiterFailedAuth.Add(c.remoteIP, time.Now(), 1)

1317 }

1318 }()

1319

1320 // ../rfc/4954:699

1321 p.xspace()

1322 mech := p.xsaslMech()

1323

1324 // Read the first parameter, either as initial parameter or by sending a

1325 // continuation with the optional encChal (must already be base64-encoded).

1326 xreadInitial := func(encChal string) []byte {

1327 var auth string

1328 if p.empty() {

1329 c.xwritelinef("%d %s", smtp.C334ContinueAuth, encChal) // ../rfc/4954:205

1330 // todo future: handle max length of 12288 octets and return proper responde codes otherwise ../rfc/4954:253

1331 auth = c.xreadline()

1332 if auth == "*" {

1333 // ../rfc/4954:193

1334 la.Result = store.AuthAborted

1335 xsmtpUserErrorf(smtp.C501BadParamSyntax, smtp.SeProto5Other0, "authentication aborted")

1336 }

1337 } else {

1338 p.xspace()

1339 if !mox.Pedantic {

1340 // Windows Mail 16005.14326.21606.0 sends two spaces between "AUTH PLAIN" and the

1341 // base64 data.

1342 for p.space() {

1343 }

1344 }

1345 auth = p.remainder()

1346 if auth == "" {

1347 // ../rfc/4954:235

1348 xsmtpUserErrorf(smtp.C501BadParamSyntax, smtp.SeProto5Syntax2, "missing initial auth base64 parameter after space")

1349 } else if auth == "=" {

1350 // ../rfc/4954:214

1351 auth = "" // Base64 decode below will result in empty buffer.

1352 }

1353 }

1354 buf, err := base64.StdEncoding.DecodeString(auth)

1355 if err != nil {

1356 // ../rfc/4954:235

1357 xsmtpUserErrorf(smtp.C501BadParamSyntax, smtp.SeProto5Syntax2, "invalid base64: %s", err)

1358 }

1359 return buf

1360 }

1361

1362 xreadContinuation := func() []byte {

1363 line := c.xreadline()

1364 if line == "*" {

1365 la.Result = store.AuthAborted

1366 xsmtpUserErrorf(smtp.C501BadParamSyntax, smtp.SeProto5Other0, "authentication aborted")

1367 }

1368 buf, err := base64.StdEncoding.DecodeString(line)

1369 if err != nil {

1370 // ../rfc/4954:235

1371 xsmtpUserErrorf(smtp.C501BadParamSyntax, smtp.SeProto5Syntax2, "invalid base64: %s", err)

1372 }

1373 return buf

1374 }

1375

1376 // The various authentication mechanisms set account and username. We may already

1377 // have an account and username from TLS client authentication. Afterwards, we

1378 // check that the account is the same.

1379 var account *store.Account

1380 var username string

1381 defer func() {

1382 if account != nil {

1383 err := account.Close()

1384 c.log.Check(err, "close account")

1385 }

1386 }()

1387

1388 switch mech {

1389 case "PLAIN":

1390 la.AuthMech = "plain"

1391

1392 // ../rfc/4954:343

1393 // ../rfc/4954:326

1394 if !c.tls && c.requireTLSForAuth {

1395 xsmtpUserErrorf(smtp.C538EncReqForAuth, smtp.SePol7EncReqForAuth11, "authentication requires tls")

1396 }

1397

1398 // Password is in line in plain text, so hide it.

1399 defer c.xtrace(mlog.LevelTraceauth)()

1400 buf := xreadInitial("")

1401 c.xtrace(mlog.LevelTrace) // Restore.

1402 plain := bytes.Split(buf, []byte{0})

1403 if len(plain) != 3 {

1404 xsmtpUserErrorf(smtp.C501BadParamSyntax, smtp.SeProto5BadParams4, "auth data should have 3 nul-separated tokens, got %d", len(plain))

1405 }

1406 authz := norm.NFC.String(string(plain[0]))

1407 username = norm.NFC.String(string(plain[1]))

1408 la.LoginAddress = username

1409 password := string(plain[2])

1410

1411 if authz != "" && authz != username {

1412 la.Result = store.AuthBadCredentials

1413 xsmtpUserErrorf(smtp.C535AuthBadCreds, smtp.SePol7AuthBadCreds8, "cannot assume other role")

1414 }

1415

1416 var err error

1417 account, la.AccountName, err = store.OpenEmailAuth(c.log, username, password, false)

1418 if err != nil && errors.Is(err, store.ErrUnknownCredentials) {

1419 // ../rfc/4954:274

1420 la.Result = store.AuthBadCredentials

1421 c.log.Info("failed authentication attempt", slog.String("username", username), slog.Any("remote", c.remoteIP))

1422 xsmtpUserErrorf(smtp.C535AuthBadCreds, smtp.SePol7AuthBadCreds8, "bad user/pass")

1423 }

1424 xcheckf(err, "verifying credentials")

1425

1426 case "LOGIN":

1427 // LOGIN is obsoleted in favor of PLAIN, only implemented to support legacy

1428 // clients, see Internet-Draft (I-D):

1429 // https://datatracker.ietf.org/doc/html/draft-murchison-sasl-login-00

1430

1431 la.LoginAddress = "login"

1432

1433 // ../rfc/4954:343

1434 // ../rfc/4954:326

1435 if !c.tls && c.requireTLSForAuth {

1436 xsmtpUserErrorf(smtp.C538EncReqForAuth, smtp.SePol7EncReqForAuth11, "authentication requires tls")

1437 }

1438

1439 // Read user name. The I-D says the client should ignore the server challenge, but

1440 // also that some clients may require challenge "Username:" instead of "User

1441 // Name". We can't sent both... Servers most commonly return "Username:" and

1442 // "Password:", so we do the same.

1443 // I-D says maximum length must be 64 bytes. We allow more, for long user names

1444 // (domains).

1445 encChal := base64.StdEncoding.EncodeToString([]byte("Username:"))

1446 username = string(xreadInitial(encChal))

1447 username = norm.NFC.String(username)

1448 la.LoginAddress = username

1449

1450 // Again, client should ignore the challenge, we send the same as the example in

1451 // the I-D.

1452 c.xwritelinef("%d %s", smtp.C334ContinueAuth, base64.StdEncoding.EncodeToString([]byte("Password:")))

1453

1454 // Password is in line in plain text, so hide it.

1455 defer c.xtrace(mlog.LevelTraceauth)()

1456 password := string(xreadContinuation())

1457 c.xtrace(mlog.LevelTrace) // Restore.

1458

1459 var err error

1460 account, la.AccountName, err = store.OpenEmailAuth(c.log, username, password, false)

1461 if err != nil && errors.Is(err, store.ErrUnknownCredentials) {

1462 // ../rfc/4954:274

1463 la.Result = store.AuthBadCredentials

1464 c.log.Info("failed authentication attempt", slog.String("username", username), slog.Any("remote", c.remoteIP))

1465 xsmtpUserErrorf(smtp.C535AuthBadCreds, smtp.SePol7AuthBadCreds8, "bad user/pass")

1466 }

1467 xcheckf(err, "verifying credentials")

1468

1469 case "CRAM-MD5":

1470 la.AuthMech = strings.ToLower(mech)

1471

1472 p.xempty()

1473

1474 // ../rfc/2195:82

1475 chal := fmt.Sprintf("<%d.%d@%s>", uint64(mox.CryptoRandInt()), time.Now().UnixNano(), mox.Conf.Static.HostnameDomain.ASCII)

1476 c.xwritelinef("%d %s", smtp.C334ContinueAuth, base64.StdEncoding.EncodeToString([]byte(chal)))

1477

1478 resp := xreadContinuation()

1479 t := strings.Split(string(resp), " ")

1480 if len(t) != 2 || len(t[1]) != 2*md5.Size {

1481 xsmtpUserErrorf(smtp.C501BadParamSyntax, smtp.SeProto5BadParams4, "malformed cram-md5 response")

1482 }

1483 username = norm.NFC.String(t[0])

1484 la.LoginAddress = username

1485 c.log.Debug("cram-md5 auth", slog.String("username", username))

1486 var err error

1487 account, la.AccountName, _, err = store.OpenEmail(c.log, username, false)

1488 if err != nil && errors.Is(err, store.ErrUnknownCredentials) {

1489 la.Result = store.AuthBadCredentials

1490 c.log.Info("failed authentication attempt", slog.String("username", username), slog.Any("remote", c.remoteIP))

1491 xsmtpUserErrorf(smtp.C535AuthBadCreds, smtp.SePol7AuthBadCreds8, "bad user/pass")

1492 }

1493 xcheckf(err, "looking up address")

1494 la.AccountName = account.Name

1495 var ipadhash, opadhash hash.Hash

1496 account.WithRLock(func() {

1497 err := account.DB.Read(context.TODO(), func(tx *bstore.Tx) error {

1498 password, err := bstore.QueryTx[store.Password](tx).Get()

1499 if err == bstore.ErrAbsent {

1500 c.log.Info("failed authentication attempt", slog.String("username", username), slog.Any("remote", c.remoteIP))

1501 xsmtpUserErrorf(smtp.C535AuthBadCreds, smtp.SePol7AuthBadCreds8, "bad user/pass")

1502 }

1503 if err != nil {

1504 return err

1505 }

1506

1507 ipadhash = password.CRAMMD5.Ipad

1508 opadhash = password.CRAMMD5.Opad

1509 return nil

1510 })

1511 xcheckf(err, "tx read")

1512 })

1513 if ipadhash == nil || opadhash == nil {

1514 missingDerivedSecrets = true

1515 c.log.Info("cram-md5 auth attempt without derived secrets set, save password again to store secrets", slog.String("username", username))

1516 c.log.Info("failed authentication attempt", slog.String("username", username), slog.Any("remote", c.remoteIP))

1517 xsmtpUserErrorf(smtp.C535AuthBadCreds, smtp.SePol7AuthBadCreds8, "bad user/pass")

1518 }

1519

1520 // ../rfc/2195:138 ../rfc/2104:142

1521 ipadhash.Write([]byte(chal))

1522 opadhash.Write(ipadhash.Sum(nil))

1523 digest := fmt.Sprintf("%x", opadhash.Sum(nil))

1524 if digest != t[1] {

1525 c.log.Info("failed authentication attempt", slog.String("username", username), slog.Any("remote", c.remoteIP))

1526 xsmtpUserErrorf(smtp.C535AuthBadCreds, smtp.SePol7AuthBadCreds8, "bad user/pass")

1527 }

1528

1529 case "SCRAM-SHA-256-PLUS", "SCRAM-SHA-256", "SCRAM-SHA-1-PLUS", "SCRAM-SHA-1":

1530 // todo: improve handling of errors during scram. e.g. invalid parameters. should we abort the imap command, or continue until the end and respond with a scram-level error?

1531 // todo: use single implementation between ../imapserver/server.go and ../smtpserver/server.go

1532

1533 // Passwords cannot be retrieved or replayed from the trace.

1534

1535 la.AuthMech = strings.ToLower(mech)

1536 var h func() hash.Hash

1537 switch la.AuthMech {

1538 case "scram-sha-1", "scram-sha-1-plus":

1539 h = sha1.New

1540 case "scram-sha-256", "scram-sha-256-plus":

1541 h = sha256.New

1542 default:

1543 xsmtpServerErrorf(codes{smtp.C554TransactionFailed, smtp.SeSys3Other0}, "missing scram auth method case")

1544 }

1545

1546 var cs *tls.ConnectionState

1547 channelBindingRequired := strings.HasSuffix(la.AuthMech, "-plus")

1548 if channelBindingRequired && !c.tls {

1549 // ../rfc/4954:630

1550 xsmtpUserErrorf(smtp.C538EncReqForAuth, smtp.SePol7EncReqForAuth11, "scram plus mechanism requires tls connection")

1551 }

1552 if c.tls {

1553 xcs := c.conn.(*tls.Conn).ConnectionState()

1554 cs = &xcs

1555 }

1556 c0 := xreadInitial("")

1557 ss, err := scram.NewServer(h, c0, cs, channelBindingRequired)

1558 if err != nil {

1559 c.log.Infox("scram protocol error", err, slog.Any("remote", c.remoteIP))

1560 xsmtpUserErrorf(smtp.C455BadParams, smtp.SePol7Other0, "scram protocol error: %s", err)

1561 }

1562 username = ss.Authentication

1563 la.LoginAddress = username

1564 c.log.Debug("scram auth", slog.String("authentication", username))

1565 account, la.AccountName, _, err = store.OpenEmail(c.log, username, false)

1566 if err != nil {

1567 // todo: we could continue scram with a generated salt, deterministically generated

1568 // from the username. that way we don't have to store anything but attackers cannot

1569 // learn if an account exists. same for absent scram saltedpassword below.

1570 c.log.Info("failed authentication attempt", slog.String("username", username), slog.Any("remote", c.remoteIP))

1571 xsmtpUserErrorf(smtp.C454TempAuthFail, smtp.SeSys3Other0, "scram not possible")

1572 }

1573 if ss.Authorization != "" && ss.Authorization != username {

1574 xsmtpUserErrorf(smtp.C535AuthBadCreds, smtp.SePol7AuthBadCreds8, "authentication with authorization for different user not supported")

1575 }

1576 var xscram store.SCRAM

1577 account.WithRLock(func() {

1578 err := account.DB.Read(context.TODO(), func(tx *bstore.Tx) error {

1579 password, err := bstore.QueryTx[store.Password](tx).Get()

1580 if err == bstore.ErrAbsent {

1581 c.log.Info("failed authentication attempt", slog.String("username", username), slog.Any("remote", c.remoteIP))

1582 xsmtpUserErrorf(smtp.C535AuthBadCreds, smtp.SePol7AuthBadCreds8, "bad user/pass")

1583 }

1584 xcheckf(err, "fetching credentials")

1585 switch la.AuthMech {

1586 case "scram-sha-1", "scram-sha-1-plus":

1587 xscram = password.SCRAMSHA1

1588 case "scram-sha-256", "scram-sha-256-plus":

1589 xscram = password.SCRAMSHA256

1590 default:

1591 xsmtpServerErrorf(codes{smtp.C554TransactionFailed, smtp.SeSys3Other0}, "missing scram auth credentials case")

1592 }

1593 if len(xscram.Salt) == 0 || xscram.Iterations == 0 || len(xscram.SaltedPassword) == 0 {

1594 missingDerivedSecrets = true

1595 c.log.Info("scram auth attempt without derived secrets set, save password again to store secrets", slog.String("address", username))

1596 c.log.Info("failed authentication attempt", slog.String("username", username), slog.Any("remote", c.remoteIP))

1597 xsmtpUserErrorf(smtp.C454TempAuthFail, smtp.SeSys3Other0, "scram not possible")

1598 }

1599 return nil

1600 })

1601 xcheckf(err, "read tx")

1602 })

1603 s1, err := ss.ServerFirst(xscram.Iterations, xscram.Salt)

1604 xcheckf(err, "scram first server step")

1605 c.xwritelinef("%d %s", smtp.C334ContinueAuth, base64.StdEncoding.EncodeToString([]byte(s1))) // ../rfc/4954:187

1606 c2 := xreadContinuation()

1607 s3, err := ss.Finish(c2, xscram.SaltedPassword)

1608 if len(s3) > 0 {

1609 c.xwritelinef("%d %s", smtp.C334ContinueAuth, base64.StdEncoding.EncodeToString([]byte(s3))) // ../rfc/4954:187

1610 }

1611 if err != nil {

1612 c.xreadline() // Should be "*" for cancellation.

1613 if errors.Is(err, scram.ErrInvalidProof) {

1614 la.Result = store.AuthBadCredentials

1615 c.log.Info("failed authentication attempt", slog.String("username", username), slog.Any("remote", c.remoteIP))

1616 xsmtpUserErrorf(smtp.C535AuthBadCreds, smtp.SePol7AuthBadCreds8, "bad credentials")

1617 } else if errors.Is(err, scram.ErrChannelBindingsDontMatch) {

1618 la.Result = store.AuthBadChannelBinding

1619 c.log.Warn("bad channel binding during authentication, potential mitm", slog.String("username", username), slog.Any("remote", c.remoteIP))

1620 xsmtpUserErrorf(smtp.C535AuthBadCreds, smtp.SePol7MsgIntegrity7, "channel bindings do not match, potential mitm")

1621 } else if errors.Is(err, scram.ErrInvalidEncoding) {

1622 la.Result = store.AuthBadProtocol

1623 c.log.Infox("bad scram protocol message", err, slog.String("username", username), slog.Any("remote", c.remoteIP))

1624 xsmtpUserErrorf(smtp.C535AuthBadCreds, smtp.SePol7Other0, "bad scram protocol message")

1625 }

1626 xcheckf(err, "server final")

1627 }

1628

1629 // Client must still respond, but there is nothing to say. See ../rfc/9051:6221

1630 // The message should be empty. todo: should we require it is empty?

1631 xreadContinuation()

1632

1633 case "EXTERNAL":

1634 la.AuthMech = "external"

1635

1636 // ../rfc/4422:1618

1637 buf := xreadInitial("")

1638 username = norm.NFC.String(string(buf))

1639 la.LoginAddress = username

1640

1641 if !c.tls {

1642 // ../rfc/4954:630

1643 xsmtpUserErrorf(smtp.C538EncReqForAuth, smtp.SePol7EncReqForAuth11, "tls required for tls client certificate authentication")

1644 }

1645 if c.account == nil {

1646 xsmtpUserErrorf(smtp.C535AuthBadCreds, smtp.SePol7AuthBadCreds8, "missing client certificate, required for tls client certificate authentication")

1647 }

1648

1649 if username == "" {

1650 username = c.username

1651 la.LoginAddress = username

1652 }

1653 var err error

1654 account, la.AccountName, _, err = store.OpenEmail(c.log, username, false)

1655 xcheckf(err, "looking up username from tls client authentication")

1656

1657 default:

1658 la.AuthMech = "(unrecognized)"

1659 // ../rfc/4954:176

1660 xsmtpUserErrorf(smtp.C504ParamNotImpl, smtp.SeProto5BadParams4, "mechanism %s not supported", mech)

1661 }

1662

1663 if accConf, ok := account.Conf(); !ok {

1664 xcheckf(errors.New("cannot find account"), "get account config")

1665 } else if accConf.LoginDisabled != "" {

1666 la.Result = store.AuthLoginDisabled

1667 c.log.Info("account login disabled", slog.String("username", username))

1668 xsmtpUserErrorf(smtp.C525AccountDisabled, smtp.SePol7AccountDisabled13, "%w: %s", store.ErrLoginDisabled, accConf.LoginDisabled)

1669 }

1670

1671 // We may already have TLS credentials. We allow an additional SASL authentication,

1672 // possibly with different username, but the account must be the same.

1673 if c.account != nil {

1674 if account != c.account {

1675 c.log.Debug("sasl authentication for different account than tls client authentication, aborting connection",

1676 slog.String("saslmechanism", la.AuthMech),

1677 slog.String("saslaccount", account.Name),

1678 slog.String("tlsaccount", c.account.Name),

1679 slog.String("saslusername", username),

1680 slog.String("tlsusername", c.username),

1681 )

1682 xsmtpUserErrorf(smtp.C535AuthBadCreds, smtp.SePol7AuthBadCreds8, "authentication failed, tls client certificate public key belongs to another account")

1683 } else if username != c.username {

1684 c.log.Debug("sasl authentication for different username than tls client certificate authentication, switching to sasl username",

1685 slog.String("saslmechanism", la.AuthMech),

1686 slog.String("saslusername", username),

1687 slog.String("tlsusername", c.username),

1688 slog.String("account", c.account.Name),

1689 )

1690 }

1691 } else {

1692 c.account = account

1693 account = nil // Prevent cleanup.

1694 }

1695 c.username = username

1696

1697 la.LoginAddress = c.username

1698 la.AccountName = c.account.Name

1699 la.Result = store.AuthSuccess

1700 c.authSASL = true

1701 c.authFailed = 0

1702 c.setSlow(false)

1703 // ../rfc/4954:276

1704 c.xwritecodeline(smtp.C235AuthSuccess, smtp.SePol7Other0, "nice", nil)

1705}

1706

1707// ../rfc/5321:1879 ../rfc/5321:1025

1708func (c *conn) cmdMail(p *parser) {

1709 // requirements for maximum line length:

1710 // ../rfc/5321:3500 (base max of 512 including crlf) ../rfc/4954:134 (+500) ../rfc/1870:92 (+26) ../rfc/6152:90 (none specified) ../rfc/6531:231 (+10)

1711 // todo future: enforce? doesn't really seem worth it...

1712

1713 if c.transactionBad > 10 && c.transactionGood == 0 {

1714 // If we get many bad transactions, it's probably a spammer that is guessing user names.

1715 // Useful in combination with rate limiting.

1716 // ../rfc/5321:4349

1717 c.xwritecodeline(smtp.C550MailboxUnavail, smtp.SeAddr1Other0, "too many failures", nil)

1718 panic(errIO)

1719 }

1720

1721 c.xneedHello()

1722 c.xcheckAuth()

1723 if c.mailFrom != nil {

1724 // ../rfc/5321:2507, though ../rfc/5321:1029 contradicts, implying a MAIL would also reset, but ../rfc/5321:1160 decides.

1725 xsmtpUserErrorf(smtp.C503BadCmdSeq, smtp.SeProto5BadCmdOrSeq1, "already have MAIL")

1726 }

1727 // Ensure clear transaction state on failure.

1728 defer func() {

1729 x := recover()

1730 if x != nil {

1731 // ../rfc/5321:2514

1732 c.rset()

1733 panic(x)

1734 }

1735 }()

1736 p.xtake(" FROM:")

1737 // note: no space allowed after colon. ../rfc/5321:1093

1738 // Microsoft Outlook 365 Apps for Enterprise sends it with submission. For delivery

1739 // it is mostly used by spammers, but has been seen with legitimate senders too.

1740 if !mox.Pedantic {

1741 p.space()

1742 }

1743 rawRevPath := p.xrawReversePath()

1744 paramSeen := map[string]bool{}

1745 for p.space() {

1746 // ../rfc/5321:2273

1747 key := p.xparamKeyword()

1748

1749 K := strings.ToUpper(key)

1750 if paramSeen[K] {

1751 // e.g. ../rfc/6152:128

1752 xsmtpUserErrorf(smtp.C501BadParamSyntax, smtp.SeProto5BadParams4, "duplicate param %q", key)

1753 }

1754 paramSeen[K] = true

1755

1756 switch K {

1757 case "SIZE":

1758 p.xtake("=")

1759 size := p.xnumber(20, true) // ../rfc/1870:90

1760 if size > c.maxMessageSize {

1761 // ../rfc/1870:136 ../rfc/3463:382

1762 ecode := smtp.SeSys3MsgLimitExceeded4

1763 if size < config.DefaultMaxMsgSize {

1764 ecode = smtp.SeMailbox2MsgLimitExceeded3

1765 }

1766 xsmtpUserErrorf(smtp.C552MailboxFull, ecode, "message too large")

1767 }

1768 // We won't verify the message is exactly the size the remote claims. Buf if it is

1769 // larger, we'll abort the transaction when remote crosses the boundary.

1770 case "BODY":

1771 p.xtake("=")

1772 // ../rfc/6152:90

1773 v := p.xparamValue()

1774 switch strings.ToUpper(v) {

1775 case "7BIT":

1776 c.has8bitmime = false

1777 case "8BITMIME":

1778 c.has8bitmime = true

1779 default:

1780 xsmtpUserErrorf(smtp.C555UnrecognizedAddrParams, smtp.SeProto5BadParams4, "unrecognized parameter %q", key)

1781 }

1782 case "AUTH":

1783 // ../rfc/4954:455

1784

1785 // We act as if we don't trust the client to specify a mailbox. Instead, we always

1786 // check the rfc5321.mailfrom and rfc5322.from before accepting the submission.

1787 // ../rfc/4954:538

1788

1789 // ../rfc/4954:704

1790 // todo future: should we accept utf-8-addr-xtext if there is no smtputf8, and utf-8 if there is? need to find a spec ../rfc/6533:259

1791 p.xtake("=")

1792 p.xtake("<")

1793 p.xtext()

1794 p.xtake(">")

1795 case "SMTPUTF8":

1796 // ../rfc/6531:213

1797 c.smtputf8 = true

1798 c.msgsmtputf8 = true

1799 case "REQUIRETLS":

1800 // ../rfc/8689:155

1801 if !c.tls {

1802 xsmtpUserErrorf(smtp.C523EncryptionNeeded, smtp.SePol7EncNeeded10, "requiretls only allowed on tls-encrypted connections")

1803 } else if !c.extRequireTLS {

1804 xsmtpUserErrorf(smtp.C555UnrecognizedAddrParams, smtp.SeSys3NotSupported3, "REQUIRETLS not allowed for this connection")

1805 }

1806 v := true

1807 c.requireTLS = &v

1808 case "HOLDFOR", "HOLDUNTIL":

1809 // Only for submission ../rfc/4865:163

1810 if !c.submission {

1811 xsmtpUserErrorf(smtp.C555UnrecognizedAddrParams, smtp.SeSys3NotSupported3, "unrecognized parameter %q", key)

1812 }

1813 if K == "HOLDFOR" && paramSeen["HOLDUNTIL"] || K == "HOLDUNTIL" && paramSeen["HOLDFOR"] {

1814 // ../rfc/4865:260

1815 xsmtpUserErrorf(smtp.C501BadParamSyntax, smtp.SeProto5BadParams4, "cannot use both HOLDUNTIL and HOLFOR")

1816 }

1817 p.xtake("=")

1818 // ../rfc/4865:263 ../rfc/4865:267 We are not following the advice of treating

1819 // semantic errors as syntax errors

1820 if K == "HOLDFOR" {

1821 n := p.xnumber(9, false) // ../rfc/4865:92

1822 if n > int64(queue.FutureReleaseIntervalMax/time.Second) {

1823 // ../rfc/4865:250

1824 xsmtpUserErrorf(smtp.C554TransactionFailed, smtp.SeProto5BadParams4, "future release interval too far in the future")

1825 }

1826 c.futureRelease = time.Now().Add(time.Duration(n) * time.Second)

1827 c.futureReleaseRequest = fmt.Sprintf("for;%d", n)

1828 } else {

1829 t, s := p.xdatetimeutc()

1830 ival := time.Until(t)

1831 if ival <= 0 {

1832 // Likely a mistake by the user.

1833 xsmtpUserErrorf(smtp.C554TransactionFailed, smtp.SeProto5BadParams4, "requested future release time is in the past")

1834 } else if ival > queue.FutureReleaseIntervalMax {

1835 // ../rfc/4865:255

1836 xsmtpUserErrorf(smtp.C554TransactionFailed, smtp.SeProto5BadParams4, "requested future release time is too far in the future")

1837 }

1838 c.futureRelease = t

1839 c.futureReleaseRequest = "until;" + s

1840 }

1841 default:

1842 // ../rfc/5321:2230

1843 xsmtpUserErrorf(smtp.C555UnrecognizedAddrParams, smtp.SeSys3NotSupported3, "unrecognized parameter %q", key)

1844 }

1845 }

1846

1847 // We now know if we have to parse the address with support for utf8.

1848 pp := newParser(rawRevPath, c.smtputf8, c)

1849 rpath := pp.xbareReversePath()

1850 pp.xempty()

1851 pp = nil

1852 p.xend()

1853

1854 // For submission, check if reverse path is allowed. I.e. authenticated account

1855 // must have the rpath configured. We do a check again on rfc5322.from during DATA.

1856 // Mail clients may use the alias address as smtp mail from address, so we allow it

1857 // for such aliases.

1858 rpathAllowed := func(disabled *bool) bool {

1859 // ../rfc/6409:349

1860 if rpath.IsZero() {

1861 return true

1862 }

1863

1864 from := smtp.NewAddress(rpath.Localpart, rpath.IPDomain.Domain)

1865 ok, dis := mox.AllowMsgFrom(c.account.Name, from)

1866 *disabled = dis

1867 return ok

1868 }

1869

1870 if !c.submission && !rpath.IPDomain.Domain.IsZero() {

1871 // If rpath domain has null MX record or is otherwise not accepting email, reject.

1872 // ../rfc/7505:181

1873 // ../rfc/5321:4045

1874 cidctx := context.WithValue(mox.Context, mlog.CidKey, c.cid)

1875 ctx, cancel := context.WithTimeout(cidctx, time.Minute)

1876 valid, err := checkMXRecords(ctx, c.resolver, rpath.IPDomain.Domain)

1877 cancel()

1878 if err != nil {

1879 c.log.Infox("temporary reject for temporary mx lookup error", err)

1880 xsmtpServerErrorf(codes{smtp.C451LocalErr, smtp.SeNet4Other0}, "cannot verify mx records for mailfrom domain")

1881 } else if !valid && !(Localserve && rpath.IPDomain.Domain.ASCII == "localhost") {

1882 // We don't reject for "localhost" in Localserve mode because we only resolve

1883 // through DNS, not an /etc/hosts file, and localhost may not resolve through DNS,

1884 // depending on network environment.

1885

1886 c.log.Info("permanent reject because mailfrom domain does not accept mail")

1887 xsmtpUserErrorf(smtp.C550MailboxUnavail, smtp.SePol7SenderHasNullMX27, "mailfrom domain not configured for mail")

1888 }

1889 }

1890

1891 var disabled bool

1892 if c.submission && (len(rpath.IPDomain.IP) > 0 || !rpathAllowed(&disabled)) {

1893 if disabled {

1894 c.log.Info("submission with smtp mail from of disabled domain", slog.Any("domain", rpath.IPDomain.Domain))

1895 xsmtpServerErrorf(codes{smtp.C451LocalErr, smtp.SeSys3Other0}, "domain of smtp mail from is temporarily disabled")

1896 }

1897

1898 // ../rfc/6409:522

1899 c.log.Info("submission with unconfigured mailfrom", slog.String("user", c.username), slog.String("mailfrom", rpath.String()))

1900 xsmtpUserErrorf(smtp.C550MailboxUnavail, smtp.SePol7DeliveryUnauth1, "must match authenticated user")

1901 } else if !c.submission && len(rpath.IPDomain.IP) > 0 {

1902 // todo future: allow if the IP is the same as this connection is coming from? does later code allow this?

1903 c.log.Info("delivery from address without domain", slog.String("mailfrom", rpath.String()))

1904 xsmtpUserErrorf(smtp.C550MailboxUnavail, smtp.SePol7Other0, "domain name required")

1905 }

1906

1907 if Localserve && strings.HasPrefix(string(rpath.Localpart), "mailfrom") {

1908 c.xlocalserveError(rpath.Localpart)

1909 }

1910

1911 c.mailFrom = &rpath

1912

1913 c.xbwritecodeline(smtp.C250Completed, smtp.SeAddr1Other0, "looking good", nil)

1914}

1915

1916// ../rfc/5321:1916 ../rfc/5321:1054

1917func (c *conn) cmdRcpt(p *parser) {

1918 c.xneedHello()

1919 c.xcheckAuth()

1920 if c.mailFrom == nil {

1921 // ../rfc/5321:1088

1922 xsmtpUserErrorf(smtp.C503BadCmdSeq, smtp.SeProto5BadCmdOrSeq1, "missing MAIL FROM")

1923 }

1924

1925 // ../rfc/5321:1985

1926 p.xtake(" TO:")

1927 // note: no space allowed after colon. ../rfc/5321:1093

1928 // Microsoft Outlook 365 Apps for Enterprise sends it with submission. For delivery

1929 // it is mostly used by spammers, but has been seen with legitimate senders too.

1930 if !mox.Pedantic {

1931 p.space()

1932 }

1933 var fpath smtp.Path

1934 if p.take("<POSTMASTER>") {

1935 fpath = smtp.Path{Localpart: "postmaster"}

1936 } else {

1937 fpath = p.xforwardPath()

1938 }

1939 for p.space() {

1940 // ../rfc/5321:2275

1941 key := p.xparamKeyword()

1942 // K := strings.ToUpper(key)

1943 // todo future: DSN, ../rfc/3461, with "NOTIFY"

1944 // ../rfc/5321:2230

1945 xsmtpUserErrorf(smtp.C555UnrecognizedAddrParams, smtp.SeSys3NotSupported3, "unrecognized parameter %q", key)

1946 }

1947 p.xend()

1948

1949 // Check if TLS is enabled if required. It's not great that sender/recipient

1950 // addresses may have been exposed in plaintext before we can reject delivery. The

1951 // recipient could be the tls reporting addresses, which must always be able to

1952 // receive in plain text.

1953 c.xneedTLSForDelivery(fpath)

1954

1955 // todo future: for submission, should we do explicit verification that domains are fully qualified? also for mail from. ../rfc/6409:420

1956

1957 if len(c.recipients) >= rcptToLimit {

1958 // ../rfc/5321:3535 ../rfc/5321:3571

1959 xsmtpUserErrorf(smtp.C452StorageFull, smtp.SeProto5TooManyRcpts3, "max of %d recipients reached", rcptToLimit)

1960 }

1961

1962 // We don't want to allow delivery to multiple recipients with a null reverse path.

1963 // Why would anyone send like that? Null reverse path is intended for delivery

1964 // notifications, they should go to a single recipient.

1965 if !c.submission && len(c.recipients) > 0 && c.mailFrom.IsZero() {

1966 xsmtpUserErrorf(smtp.C452StorageFull, smtp.SeProto5TooManyRcpts3, "only one recipient allowed with null reverse address")

1967 }

1968

1969 // Do not accept multiple recipients if remote does not pass SPF. Because we don't

1970 // want to generate DSNs to unverified domains. This is the moment we

1971 // can refuse individual recipients, DATA will be too late. Because mail

1972 // servers must handle a max recipient limit gracefully and still send to the

1973 // recipients that are accepted, this should not cause problems. Though we are in

1974 // violation because the limit must be >= 100.

1975 // ../rfc/5321:3598

1976 // ../rfc/5321:4045

1977 // Also see ../rfc/7489:2214

1978 if !c.submission && len(c.recipients) == 1 && !Localserve {

1979 // note: because of check above, mailFrom cannot be the null address.

1980 var pass bool

1981 d := c.mailFrom.IPDomain.Domain

1982 if !d.IsZero() {

1983 // todo: use this spf result for DATA.

1984 spfArgs := spf.Args{

1985 RemoteIP: c.remoteIP,

1986 MailFromLocalpart: c.mailFrom.Localpart,

1987 MailFromDomain: d,

1988 HelloDomain: c.hello,

1989 LocalIP: c.localIP,

1990 LocalHostname: c.hostname,

1991 }

1992 cidctx := context.WithValue(mox.Context, mlog.CidKey, c.cid)

1993 spfctx, spfcancel := context.WithTimeout(cidctx, time.Minute)

1994 defer spfcancel()

1995 receivedSPF, _, _, _, err := spf.Verify(spfctx, c.log.Logger, c.resolver, spfArgs)

1996 spfcancel()

1997 if err != nil {

1998 c.log.Errorx("spf verify for multiple recipients", err)

1999 }

2000 pass = receivedSPF.Identity == spf.ReceivedMailFrom && receivedSPF.Result == spf.StatusPass

2001 }

2002 if !pass {

2003 xsmtpUserErrorf(smtp.C452StorageFull, smtp.SeProto5TooManyRcpts3, "only one recipient allowed without spf pass")

2004 }

2005 }

2006

2007 if Localserve && strings.HasPrefix(string(fpath.Localpart), "rcptto") {

2008 c.xlocalserveError(fpath.Localpart)

2009 }

2010

2011 if len(fpath.IPDomain.IP) > 0 {

2012 if !c.submission {

2013 xsmtpUserErrorf(smtp.C550MailboxUnavail, smtp.SeAddr1UnknownDestMailbox1, "not accepting email for ip")

2014 }

2015 c.recipients = append(c.recipients, recipient{fpath, nil, nil})

2016 } else if accountName, alias, canonical, dest, err := mox.LookupAddress(fpath.Localpart, fpath.IPDomain.Domain, true, true, true); err == nil {

2017 // note: a bare postmaster, without domain, is handled by LookupAddress. ../rfc/5321:735

2018 if alias != nil {

2019 c.recipients = append(c.recipients, recipient{fpath, nil, &rcptAlias{*alias, canonical}})

2020 } else if dest.SMTPError != "" {

2021 xsmtpServerErrorf(codes{dest.SMTPErrorCode, dest.SMTPErrorSecode}, "%s", dest.SMTPErrorMsg)

2022 } else {

2023 c.recipients = append(c.recipients, recipient{fpath, &rcptAccount{accountName, dest, canonical}, nil})

2024 }

2025

2026 } else if Localserve {

2027 // If the address isn't known, and we are in localserve, deliver to the mox user.

2028 // If account or destination doesn't exist, it will be handled during delivery. For

2029 // submissions, which is the common case, we'll deliver to the logged in user,

2030 // which is typically the mox user.

2031 acc, _ := mox.Conf.Account("mox")

2032 dest := acc.Destinations["mox@localhost"]

2033 c.recipients = append(c.recipients, recipient{fpath, &rcptAccount{"mox", dest, "mox@localhost"}, nil})

2034 } else if errors.Is(err, mox.ErrDomainDisabled) {

2035 c.log.Info("smtp recipient for temporarily disabled domain", slog.Any("domain", fpath.IPDomain.Domain))

2036 xsmtpUserErrorf(smtp.C450MailboxUnavail, smtp.SeMailbox2Disabled1, "recipient domain temporarily disabled")

2037 } else if errors.Is(err, mox.ErrDomainNotFound) {

2038 if !c.submission {

2039 xsmtpUserErrorf(smtp.C550MailboxUnavail, smtp.SeAddr1UnknownDestMailbox1, "not accepting email for domain")

2040 }

2041 // We'll be delivering this email.

2042 c.recipients = append(c.recipients, recipient{fpath, nil, nil})

2043 } else if errors.Is(err, mox.ErrAddressNotFound) {

2044 if c.submission {

2045 // For submission, we're transparent about which user exists. Should be fine for the typical small-scale deploy.

2046 // ../rfc/5321:1071

2047 xsmtpUserErrorf(smtp.C550MailboxUnavail, smtp.SeAddr1UnknownDestMailbox1, "no such user")

2048 }

2049 // We pretend to accept. We don't want to let remote know the user does not exist

2050 // until after DATA. Because then remote has committed to sending a message.

2051 // note: not local for !c.submission is the signal this address is in error.

2052 c.recipients = append(c.recipients, recipient{fpath, nil, nil})

2053 } else {

2054 c.log.Errorx("looking up account for delivery", err, slog.Any("rcptto", fpath))

2055 xsmtpServerErrorf(codes{smtp.C451LocalErr, smtp.SeSys3Other0}, "error processing")

2056 }

2057 c.xbwritecodeline(smtp.C250Completed, smtp.SeAddr1Other0, "now on the list", nil)

2058}

2059

2060func hasNonASCII(s string) bool {

2061 for _, c := range []byte(s) {

2062 if c > unicode.MaxASCII {

2063 return true

2064 }

2065 }

2066 return false

2067}

2068

2069// ../rfc/6531:497

2070func (c *conn) isSMTPUTF8Required(part *message.Part) bool {

2071 // Check "MAIL FROM".

2072 if hasNonASCII(string(c.mailFrom.Localpart)) {

2073 return true

2074 }

2075 // Check all "RCPT TO".

2076 for _, rcpt := range c.recipients {

2077 if hasNonASCII(string(rcpt.Addr.Localpart)) {

2078 return true

2079 }

2080 }

2081

2082 // Check header in all message parts.

2083 smtputf8, err := part.NeedsSMTPUTF8()

2084 xcheckf(err, "checking if smtputf8 is required")

2085 return smtputf8

2086}

2087

2088// ../rfc/5321:1992 ../rfc/5321:1098

2089func (c *conn) cmdData(p *parser) {

2090 c.xneedHello()

2091 c.xcheckAuth()

2092 if c.mailFrom == nil {

2093 // ../rfc/5321:1130

2094 xsmtpUserErrorf(smtp.C503BadCmdSeq, smtp.SeProto5BadCmdOrSeq1, "missing MAIL FROM")

2095 }

2096 if len(c.recipients) == 0 {

2097 // ../rfc/5321:1130

2098 xsmtpUserErrorf(smtp.C503BadCmdSeq, smtp.SeProto5BadCmdOrSeq1, "missing RCPT TO")

2099 }

2100

2101 // ../rfc/5321:2066

2102 p.xend()

2103

2104 // todo future: we could start a reader for a single line. we would then create a context that would be canceled on i/o errors.

2105

2106 // Entire delivery should be done within 30 minutes, or we abort.

2107 cidctx := context.WithValue(mox.Context, mlog.CidKey, c.cid)

2108 cmdctx, cmdcancel := context.WithTimeout(cidctx, 30*time.Minute)

2109 defer cmdcancel()

2110 // Deadline is taken into account by Read and Write.

2111 c.deadline, _ = cmdctx.Deadline()

2112 defer func() {

2113 c.deadline = time.Time{}

2114 }()

2115

2116 // ../rfc/5321:1994

2117 c.xwritelinef("354 see you at the bare dot")

2118

2119 // Mark as tracedata.

2120 defer c.xtrace(mlog.LevelTracedata)()

2121

2122 // We read the data into a temporary file. We limit the size and do basic analysis while reading.

2123 dataFile, err := store.CreateMessageTemp(c.log, "smtp-deliver")

2124 if err != nil {

2125 xsmtpServerErrorf(errCodes(smtp.C451LocalErr, smtp.SeSys3Other0, err), "creating temporary file for message: %s", err)

2126 }

2127 defer store.CloseRemoveTempFile(c.log, dataFile, "smtpserver delivered message")

2128 msgWriter := message.NewWriter(dataFile)

2129 dr := smtp.NewDataReader(c.xbr)

2130 n, err := io.Copy(&limitWriter{maxSize: c.maxMessageSize, w: msgWriter}, dr)

2131 c.xtrace(mlog.LevelTrace) // Restore.

2132 if err != nil {

2133 if errors.Is(err, errMessageTooLarge) {

2134 // ../rfc/1870:136 and ../rfc/3463:382

2135 ecode := smtp.SeSys3MsgLimitExceeded4

2136 if n < config.DefaultMaxMsgSize {

2137 ecode = smtp.SeMailbox2MsgLimitExceeded3

2138 }

2139 c.xwritecodeline(smtp.C451LocalErr, ecode, fmt.Sprintf("error copying data to file (%s)", mox.ReceivedID(c.cid)), err)

2140 panic(fmt.Errorf("remote sent too much DATA: %w", errIO))

2141 }

2142

2143 if errors.Is(err, smtp.ErrCRLF) {

2144 c.xwritecodeline(smtp.C500BadSyntax, smtp.SeProto5Syntax2, fmt.Sprintf("invalid bare \\r or \\n, may be smtp smuggling (%s)", mox.ReceivedID(c.cid)), err)

2145 return

2146 }

2147

2148 // Something is failing on our side. We want to let remote know. So write an error response,

2149 // then discard the remaining data so the remote client is more likely to see our

2150 // response. Our write is synchronous, there is a risk no window/buffer space is

2151 // available and our write blocks us from reading remaining data, leading to

2152 // deadlock. We have a timeout on our connection writes though, so worst case we'll

2153 // abort the connection due to expiration.

2154 c.xwritecodeline(smtp.C451LocalErr, smtp.SeSys3Other0, fmt.Sprintf("error copying data to file (%s)", mox.ReceivedID(c.cid)), err)

2155 io.Copy(io.Discard, dr)

2156 return

2157 }

2158

2159 // Basic sanity checks on messages before we send them out to the world. Just

2160 // trying to be strict in what we do to others and liberal in what we accept.

2161 if c.submission {

2162 if !msgWriter.HaveBody {

2163 // ../rfc/6409:541

2164 xsmtpUserErrorf(smtp.C554TransactionFailed, smtp.SeMsg6Other0, "message requires both header and body section")

2165 }

2166 // Check only for pedantic mode because ios mail will attempt to send smtputf8 with

2167 // non-ascii in message from localpart without using 8bitmime.

2168 if mox.Pedantic && msgWriter.Has8bit && !c.has8bitmime {

2169 // ../rfc/5321:906

2170 xsmtpUserErrorf(smtp.C500BadSyntax, smtp.SeMsg6Other0, "message with non-us-ascii requires 8bitmime extension")

2171 }

2172 }

2173

2174 if Localserve && mox.Pedantic {

2175 // Require that message can be parsed fully.

2176 p, err := message.Parse(c.log.Logger, false, dataFile)

2177 if err == nil {

2178 err = p.Walk(c.log.Logger, nil)

2179 }

2180 if err != nil {

2181 // ../rfc/6409:541

2182 xsmtpUserErrorf(smtp.C554TransactionFailed, smtp.SeMsg6Other0, "malformed message: %v", err)

2183 }

2184 }

2185

2186 // Now that we have all the whole message (envelope + data), we can check if the SMTPUTF8 extension is required.

2187 var part *message.Part

2188 if c.smtputf8 || c.submission || mox.Pedantic {

2189 // Try to parse the message.

2190 // Do nothing if something bad happen during Parse and Walk, just keep the current value for c.msgsmtputf8.

2191 p, err := message.Parse(c.log.Logger, true, dataFile)

2192 if err == nil {

2193 // Message parsed without error. Keep the result to avoid parsing the message again.

2194 part = &p

2195 err = part.Walk(c.log.Logger, nil)

2196 if err == nil {

2197 c.msgsmtputf8 = c.isSMTPUTF8Required(part)

2198 }

2199 }

2200 if err != nil {

2201 c.log.Debugx("parsing message for smtputf8 check", err)

2202 }

2203 if c.smtputf8 != c.msgsmtputf8 {

2204 c.log.Debug("smtputf8 flag changed", slog.Bool("smtputf8", c.smtputf8), slog.Bool("msgsmtputf8", c.msgsmtputf8))

2205 }

2206 }

2207 if !c.smtputf8 && c.msgsmtputf8 && mox.Pedantic {

2208 metricSubmission.WithLabelValues("missingsmtputf8").Inc()

2209 xsmtpUserErrorf(smtp.C550MailboxUnavail, smtp.SeMsg6Other0, "smtputf8 extension is required but was not added to the MAIL command")

2210 }

2211

2212 // Prepare "Received" header.

2213 // ../rfc/5321:2051 ../rfc/5321:3302

2214 // ../rfc/5321:3311 ../rfc/6531:578

2215 var recvFrom string

2216 var iprevStatus iprev.Status // Only for delivery, not submission.

2217 var iprevAuthentic bool

2218 if c.submission {

2219 // Hide internal hosts.

2220 // todo future: make this a config option, where admins specify ip ranges that they don't want exposed. also see ../rfc/5321:4321

2221 recvFrom = message.HeaderCommentDomain(mox.Conf.Static.HostnameDomain, c.msgsmtputf8)

2222 } else {

2223 if len(c.hello.IP) > 0 {

2224 recvFrom = smtp.AddressLiteral(c.hello.IP)

2225 } else {

2226 // ASCII-only version added after the extended-domain syntax below, because the

2227 // comment belongs to "BY" which comes immediately after "FROM".

2228 recvFrom = c.hello.Domain.XName(c.msgsmtputf8)

2229 }

2230 iprevctx, iprevcancel := context.WithTimeout(cmdctx, time.Minute)

2231 var revName string

2232 var revNames []string

2233 iprevStatus, revName, revNames, iprevAuthentic, err = iprev.Lookup(iprevctx, c.resolver, c.remoteIP)

2234 iprevcancel()

2235 if err != nil {

2236 c.log.Infox("reverse-forward lookup", err, slog.Any("remoteip", c.remoteIP))

2237 }

2238 c.log.Debug("dns iprev check", slog.Any("addr", c.remoteIP), slog.Any("status", iprevStatus))

2239 var name string

2240 if revName != "" {

2241 name = revName

2242 } else if len(revNames) > 0 {

2243 name = revNames[0]

2244 }

2245 name = strings.TrimSuffix(name, ".")

2246 recvFrom += " ("

2247 if name != "" && name != c.hello.Domain.XName(c.msgsmtputf8) {

2248 recvFrom += name + " "

2249 }

2250 recvFrom += smtp.AddressLiteral(c.remoteIP) + ")"

2251 if c.msgsmtputf8 && c.hello.Domain.Unicode != "" {

2252 recvFrom += " (" + c.hello.Domain.ASCII + ")"

2253 }

2254 }

2255 recvBy := mox.Conf.Static.HostnameDomain.XName(c.msgsmtputf8)

2256 recvBy += " (" + smtp.AddressLiteral(c.localIP) + ")" // todo: hide ip if internal?

2257 if c.msgsmtputf8 && mox.Conf.Static.HostnameDomain.Unicode != "" {

2258 // This syntax is part of "VIA".

2259 recvBy += " (" + mox.Conf.Static.HostnameDomain.ASCII + ")"

2260 }

2261

2262 // ../rfc/3848:34 ../rfc/6531:791

2263 with := "SMTP"

2264 if c.msgsmtputf8 {

2265 with = "UTF8SMTP"

2266 } else if c.ehlo {

2267 with = "ESMTP"

2268 }

2269 if c.tls {

2270 with += "S"

2271 }

2272 if c.account != nil {

2273 // ../rfc/4954:660

2274 with += "A"

2275 }

2276

2277 // Assume transaction does not succeed. If it does, we'll compensate.

2278 c.transactionBad++

2279

2280 recvHdrFor := func(rcptTo string) string {

2281 recvHdr := &message.HeaderWriter{}

2282 // For additional Received-header clauses, see:

2283 // https://www.iana.org/assignments/mail-parameters/mail-parameters.xhtml#table-mail-parameters-8

2284 withComment := ""

2285 if c.requireTLS != nil && *c.requireTLS {

2286 // Comment is actually part of ID ABNF rule. ../rfc/5321:3336

2287 withComment = " (requiretls)"

2288 }

2289 recvHdr.Add(" ", "Received:", "from", recvFrom, "by", recvBy, "via", "tcp", "with", with+withComment, "id", mox.ReceivedID(c.cid)) // ../rfc/5321:3158

2290 if c.tls {

2291 tlsConn := c.conn.(*tls.Conn)

2292 tlsComment := mox.TLSReceivedComment(c.log, tlsConn.ConnectionState())

2293 recvHdr.Add(" ", tlsComment...)

2294 }

2295 // We leave out an empty "for" clause. This is empty for messages submitted to

2296 // multiple recipients, so the message stays identical and a single smtp

2297 // transaction can deliver, only transferring the data once.

2298 if rcptTo != "" {

2299 recvHdr.Add(" ", "for", "<"+rcptTo+">;")

2300 }

2301 recvHdr.Add(" ", time.Now().Format(message.RFC5322Z))

2302 return recvHdr.String()

2303 }

2304

2305 // Submission is easiest because user is trusted. Far fewer checks to make. So

2306 // handle it first, and leave the rest of the function for handling wild west

2307 // internet traffic.

2308 if c.submission {

2309 c.submit(cmdctx, recvHdrFor, msgWriter, dataFile, part)

2310 } else {

2311 c.deliver(cmdctx, recvHdrFor, msgWriter, iprevStatus, iprevAuthentic, dataFile)

2312 }

2313}

2314

2315// Check if a message has unambiguous "TLS-Required: No" header. Messages must not

2316// contain multiple TLS-Required headers. The only valid value is "no". But we'll

2317// accept multiple headers as long as all they are all "no".

2318// ../rfc/8689:223

2319func hasTLSRequiredNo(h textproto.MIMEHeader) bool {

2320 l := h.Values("Tls-Required")

2321 if len(l) == 0 {

2322 return false

2323 }

2324 for _, v := range l {

2325 if !strings.EqualFold(v, "no") {

2326 return false

2327 }

2328 }

2329 return true

2330}

2331

2332// submit is used for mail from authenticated users that we will try to deliver.

2333func (c *conn) submit(ctx context.Context, recvHdrFor func(string) string, msgWriter *message.Writer, dataFile *os.File, part *message.Part) {

2334 // Similar between ../smtpserver/server.go:/submit\( and ../webmail/api.go:/MessageSubmit\( and ../webapisrv/server.go:/Send\(

2335

2336 var msgPrefix []byte

2337

2338 // Check that user is only sending email as one of its configured identities. Not

2339 // for other users.

2340 // We don't check the Sender field, there is no expectation of verification, ../rfc/7489:2948

2341 // and with Resent headers it seems valid to have someone else as Sender. ../rfc/5322:1578

2342 msgFrom, _, header, err := message.From(c.log.Logger, true, dataFile, part)

2343 if err != nil {

2344 metricSubmission.WithLabelValues("badmessage").Inc()

2345 c.log.Infox("parsing message From address", err, slog.String("user", c.username))

2346 xsmtpUserErrorf(smtp.C550MailboxUnavail, smtp.SeMsg6Other0, "cannot parse header or From address: %v", err)

2347 }

2348 if ok, disabled := mox.AllowMsgFrom(c.account.Name, msgFrom); disabled {

2349 c.log.Info("submission with message from address of disabled domain", slog.Any("domain", msgFrom.Domain))

2350 xsmtpServerErrorf(codes{smtp.C451LocalErr, smtp.SeSys3Other0}, "domain of message from header is temporarily disabled")

2351 } else if !ok {

2352 // ../rfc/6409:522

2353 metricSubmission.WithLabelValues("badfrom").Inc()

2354 c.log.Infox("verifying message from address", mox.ErrAddressNotFound, slog.String("user", c.username), slog.Any("msgfrom", msgFrom))

2355 xsmtpUserErrorf(smtp.C550MailboxUnavail, smtp.SePol7DeliveryUnauth1, "message from address must belong to authenticated user")

2356 }

2357

2358 // TLS-Required: No header makes us not enforce recipient domain's TLS policy.

2359 // ../rfc/8689:206

2360 // Only when requiretls smtp extension wasn't used. ../rfc/8689:246

2361 if c.requireTLS == nil && hasTLSRequiredNo(header) {

2362 v := false

2363 c.requireTLS = &v

2364 }

2365

2366 // Outgoing messages should not have a Return-Path header. The final receiving mail

2367 // server will add it.

2368 // ../rfc/5321:3233

2369 if mox.Pedantic && header.Values("Return-Path") != nil {

2370 metricSubmission.WithLabelValues("badheader").Inc()

2371 xsmtpUserErrorf(smtp.C550MailboxUnavail, smtp.SeMsg6Other0, "message should not have Return-Path header")

2372 }

2373

2374 // Add Message-Id header if missing.

2375 // ../rfc/5321:4131 ../rfc/6409:751

2376 messageID := header.Get("Message-Id")

2377 if messageID == "" {

2378 messageID = mox.MessageIDGen(c.msgsmtputf8)

2379 msgPrefix = append(msgPrefix, fmt.Sprintf("Message-Id: <%s>\r\n", messageID)...)

2380 }

2381

2382 // ../rfc/6409:745

2383 if header.Get("Date") == "" {

2384 msgPrefix = append(msgPrefix, "Date: "+time.Now().Format(message.RFC5322Z)+"\r\n"...)

2385 }

2386

2387 // Check outgoing message rate limit.

2388 err = c.account.DB.Read(ctx, func(tx *bstore.Tx) error {

2389 rcpts := make([]smtp.Path, len(c.recipients))

2390 for i, r := range c.recipients {

2391 rcpts[i] = r.Addr

2392 }

2393 msglimit, rcptlimit, err := c.account.SendLimitReached(tx, rcpts)

2394 xcheckf(err, "checking sender limit")

2395 if msglimit >= 0 {

2396 metricSubmission.WithLabelValues("messagelimiterror").Inc()

2397 xsmtpUserErrorf(smtp.C451LocalErr, smtp.SePol7DeliveryUnauth1, "max number of messages (%d) over past 24h reached, try increasing per-account setting MaxOutgoingMessagesPerDay", msglimit)

2398 } else if rcptlimit >= 0 {

2399 metricSubmission.WithLabelValues("recipientlimiterror").Inc()

2400 xsmtpUserErrorf(smtp.C451LocalErr, smtp.SePol7DeliveryUnauth1, "max number of new/first-time recipients (%d) over past 24h reached, try increasing per-account setting MaxFirstTimeRecipientsPerDay", rcptlimit)

2401 }

2402 return nil

2403 })

2404 xcheckf(err, "read-only transaction")

2405

2406 // We gather any X-Mox-Extra-* headers into the "extra" data during queueing, which

2407 // will make it into any webhook we deliver.

2408 // todo: remove the X-Mox-Extra-* headers from the message. we don't currently rewrite the message...

2409 // todo: should we not canonicalize keys?

2410 var extra map[string]string

2411 for k, vl := range header {

2412 if !strings.HasPrefix(k, "X-Mox-Extra-") {

2413 continue

2414 }

2415 if extra == nil {

2416 extra = map[string]string{}

2417 }

2418 xk := k[len("X-Mox-Extra-"):]

2419 // We don't allow duplicate keys.

2420 if _, ok := extra[xk]; ok || len(vl) > 1 {

2421 xsmtpUserErrorf(smtp.C554TransactionFailed, smtp.SeMsg6Other0, "duplicate x-mox-extra- key %q", xk)

2422 }

2423 extra[xk] = vl[len(vl)-1]

2424 }

2425

2426 // todo future: in a pedantic mode, we can parse the headers, and return an error if rcpt is only in To or Cc header, and not in the non-empty Bcc header. indicates a client that doesn't blind those bcc's.

2427

2428 // Add DKIM signatures.

2429 confDom, ok := mox.Conf.Domain(msgFrom.Domain)

2430 if !ok {

2431 c.log.Error("domain disappeared", slog.Any("domain", msgFrom.Domain))

2432 xsmtpServerErrorf(codes{smtp.C451LocalErr, smtp.SeSys3Other0}, "internal error")

2433 } else if confDom.Disabled {

2434 c.log.Info("submission with message from address of disabled domain", slog.Any("domain", msgFrom.Domain))

2435 xsmtpServerErrorf(codes{smtp.C451LocalErr, smtp.SeSys3Other0}, "domain of message from header is temporarily disabled")

2436 }

2437

2438 selectors := mox.DKIMSelectors(confDom.DKIM)

2439 if len(selectors) > 0 {

2440 canonical := mox.CanonicalLocalpart(msgFrom.Localpart, confDom)

2441 if dkimHeaders, err := dkim.Sign(ctx, c.log.Logger, canonical, msgFrom.Domain, selectors, c.msgsmtputf8, store.FileMsgReader(msgPrefix, dataFile)); err != nil {

2442 c.log.Errorx("dkim sign for domain", err, slog.Any("domain", msgFrom.Domain))

2443 metricServerErrors.WithLabelValues("dkimsign").Inc()

2444 } else {

2445 msgPrefix = append(msgPrefix, []byte(dkimHeaders)...)

2446 }

2447 }

2448

2449 authResults := message.AuthResults{

2450 Hostname: mox.Conf.Static.HostnameDomain.XName(c.msgsmtputf8),

2451 Comment: mox.Conf.Static.HostnameDomain.ASCIIExtra(c.msgsmtputf8),

2452 Methods: []message.AuthMethod{

2453 {

2454 Method: "auth",

2455 Result: "pass",

2456 Props: []message.AuthProp{

2457 message.MakeAuthProp("smtp", "mailfrom", c.mailFrom.XString(c.msgsmtputf8), true, c.mailFrom.ASCIIExtra(c.msgsmtputf8)),

2458 },

2459 },

2460 },

2461 }

2462 msgPrefix = append(msgPrefix, []byte(authResults.Header())...)

2463

2464 // We always deliver through the queue. It would be more efficient to deliver

2465 // directly for local accounts, but we don't want to circumvent all the anti-spam

2466 // measures. Accounts on a single mox instance should be allowed to block each

2467 // other.

2468

2469 accConf, _ := c.account.Conf()

2470 loginAddr, err := smtp.ParseAddress(c.username)

2471 xcheckf(err, "parsing login address")

2472 useFromID := slices.Contains(accConf.ParsedFromIDLoginAddresses, loginAddr)

2473 var localpartBase string

2474 var fromID string

2475 var genFromID bool

2476 if useFromID {

2477 // With submission, user can bring their own fromid.

2478 t := strings.SplitN(string(c.mailFrom.Localpart), confDom.LocalpartCatchallSeparatorsEffective[0], 2)

2479 localpartBase = t[0]

2480 if len(t) == 2 {

2481 fromID = t[1]

2482 if fromID != "" && len(c.recipients) > 1 {

2483 xsmtpServerErrorf(codes{smtp.C554TransactionFailed, smtp.SeProto5TooManyRcpts3}, "cannot send to multiple recipients with chosen fromid")

2484 }

2485 } else {

2486 genFromID = true

2487 }

2488 }

2489 now := time.Now()

2490 qml := make([]queue.Msg, len(c.recipients))

2491 for i, rcpt := range c.recipients {

2492 if Localserve {

2493 code, timeout := mox.LocalserveNeedsError(rcpt.Addr.Localpart)

2494 if timeout {

2495 c.log.Info("timing out submission due to special localpart")

2496 mox.Sleep(mox.Context, time.Hour)

2497 xsmtpServerErrorf(codes{smtp.C451LocalErr, smtp.SeSys3Other0}, "timing out submission due to special localpart")

2498 } else if code != 0 {

2499 c.log.Info("failure due to special localpart", slog.Int("code", code))

2500 xsmtpServerErrorf(codes{code, smtp.SeOther00}, "failure with code %d due to special localpart", code)

2501 }

2502 }

2503

2504 fp := *c.mailFrom

2505 if useFromID {

2506 if genFromID {

2507 fromID = xrandomID(16)

2508 }

2509 fp.Localpart = smtp.Localpart(localpartBase + confDom.LocalpartCatchallSeparatorsEffective[0] + fromID)

2510 }

2511

2512 // For multiple recipients, we don't make each message prefix unique, leaving out

2513 // the "for" clause in the Received header. This allows the queue to deliver the

2514 // messages in a single smtp transaction.

2515 var rcptTo string

2516 if len(c.recipients) == 1 {

2517 rcptTo = rcpt.Addr.String()

2518 }

2519 xmsgPrefix := append([]byte(recvHdrFor(rcptTo)), msgPrefix...)

2520 msgSize := int64(len(xmsgPrefix)) + msgWriter.Size

2521 qm := queue.MakeMsg(fp, rcpt.Addr, msgWriter.Has8bit, c.msgsmtputf8, msgSize, messageID, xmsgPrefix, c.requireTLS, now, header.Get("Subject"))

2522 if !c.futureRelease.IsZero() {

2523 qm.NextAttempt = c.futureRelease

2524 qm.FutureReleaseRequest = c.futureReleaseRequest

2525 }

2526 qm.FromID = fromID

2527 qm.Extra = extra

2528 qml[i] = qm

2529 }

2530

2531 // todo: it would be good to have a limit on messages (count and total size) a user has in the queue. also/especially with futurerelease. ../rfc/4865:387

2532 if err := queue.Add(ctx, c.log, c.account.Name, dataFile, qml...); err != nil && errors.Is(err, queue.ErrFromID) && !genFromID {

2533 // todo: should we return this error during the "rcpt to" command?

2534 // secode is not an exact match, but seems closest.

2535 xsmtpServerErrorf(errCodes(smtp.C554TransactionFailed, smtp.SeAddr1SenderSyntax7, err), "bad fromid in smtp mail from address: %s", err)

2536 } else if err != nil {

2537 // Aborting the transaction is not great. But continuing and generating DSNs will

2538 // probably result in errors as well...

2539 metricSubmission.WithLabelValues("queueerror").Inc()

2540 c.log.Errorx("queuing message", err)

2541 xsmtpServerErrorf(errCodes(smtp.C451LocalErr, smtp.SeSys3Other0, err), "error delivering message: %v", err)

2542 }

2543 metricSubmission.WithLabelValues("ok").Inc()

2544 for i, rcpt := range c.recipients {

2545 c.log.Info("messages queued for delivery",

2546 slog.Any("mailfrom", *c.mailFrom),

2547 slog.Any("rcptto", rcpt.Addr),

2548 slog.Bool("smtputf8", c.smtputf8),

2549 slog.Bool("msgsmtputf8", c.msgsmtputf8),

2550 slog.Int64("msgsize", qml[i].Size))

2551 }

2552

2553 err = c.account.DB.Write(ctx, func(tx *bstore.Tx) error {

2554 for _, rcpt := range c.recipients {

2555 outgoing := store.Outgoing{Recipient: rcpt.Addr.XString(true)}

2556 if err := tx.Insert(&outgoing); err != nil {

2557 return fmt.Errorf("adding outgoing message: %v", err)

2558 }

2559 }

2560 return nil

2561 })

2562 xcheckf(err, "adding outgoing messages")

2563

2564 c.transactionGood++

2565 c.transactionBad-- // Compensate for early earlier pessimistic increase.

2566

2567 c.rset()

2568 c.xwritecodeline(smtp.C250Completed, smtp.SeMailbox2Other0, "it is done", nil)

2569}

2570

2571func xrandomID(n int) string {

2572 return base64.RawURLEncoding.EncodeToString(xrandom(n))

2573}

2574

2575func xrandom(n int) []byte {

2576 buf := make([]byte, n)

2577 x, err := cryptorand.Read(buf)

2578 xcheckf(err, "read random")

2579 if x != n {

2580 xcheckf(errors.New("short random read"), "read random")

2581 }

2582 return buf

2583}

2584

2585func ipmasked(ip net.IP) (string, string, string) {

2586 if ip.To4() != nil {

2587 m1 := ip.String()

2588 m2 := ip.Mask(net.CIDRMask(26, 32)).String()

2589 m3 := ip.Mask(net.CIDRMask(21, 32)).String()

2590 return m1, m2, m3

2591 }

2592 m1 := ip.Mask(net.CIDRMask(64, 128)).String()

2593 m2 := ip.Mask(net.CIDRMask(48, 128)).String()

2594 m3 := ip.Mask(net.CIDRMask(32, 128)).String()

2595 return m1, m2, m3

2596}

2597

2598func (c *conn) xlocalserveError(lp smtp.Localpart) {

2599 code, timeout := mox.LocalserveNeedsError(lp)

2600 if timeout {

2601 c.log.Info("timing out due to special localpart")

2602 mox.Sleep(mox.Context, time.Hour)

2603 xsmtpServerErrorf(codes{smtp.C451LocalErr, smtp.SeSys3Other0}, "timing out command due to special localpart")

2604 } else if code != 0 {

2605 c.log.Info("failure due to special localpart", slog.Int("code", code))

2606 metricDelivery.WithLabelValues("delivererror", "localserve").Inc()

2607 xsmtpServerErrorf(codes{code, smtp.SeOther00}, "failure with code %d due to special localpart", code)

2608 }

2609}

2610

2611// deliver is called for incoming messages from external, typically untrusted

2612// sources. i.e. not submitted by authenticated users.

2613func (c *conn) deliver(ctx context.Context, recvHdrFor func(string) string, msgWriter *message.Writer, iprevStatus iprev.Status, iprevAuthentic bool, dataFile *os.File) {

2614 // todo: in decision making process, if we run into (some) temporary errors, attempt to continue. if we decide to accept, all good. if we decide to reject, we'll make it a temporary reject.

2615

2616 var msgFrom smtp.Address

2617 var envelope *message.Envelope

2618 var headers textproto.MIMEHeader

2619 var isDSN bool

2620 part, err := message.Parse(c.log.Logger, false, dataFile)

2621 if err == nil {

2622 // todo: is it enough to check only the the content-type header? in other places we look at the content-types of the parts before considering a message a dsn. should we change other places to this simpler check?

2623 isDSN = part.MediaType == "MULTIPART" && part.MediaSubType == "REPORT" && strings.EqualFold(part.ContentTypeParams["report-type"], "delivery-status")

2624 msgFrom, envelope, headers, err = message.From(c.log.Logger, false, dataFile, &part)

2625 }

2626 if err != nil {

2627 c.log.Infox("parsing message for From address", err)

2628 }

2629

2630 // Basic loop detection. ../rfc/5321:4065 ../rfc/5321:1526

2631 if len(headers.Values("Received")) > 100 {

2632 xsmtpUserErrorf(smtp.C550MailboxUnavail, smtp.SeNet4Loop6, "loop detected, more than 100 Received headers")

2633 }

2634

2635 // TLS-Required: No header makes us not enforce recipient domain's TLS policy.

2636 // Since we only deliver locally at the moment, this won't influence our behaviour.

2637 // Once we forward, it would our delivery attempts.

2638 // ../rfc/8689:206

2639 // Only when requiretls smtp extension wasn't used. ../rfc/8689:246

2640 if c.requireTLS == nil && hasTLSRequiredNo(headers) {

2641 v := false

2642 c.requireTLS = &v

2643 }

2644

2645 // We'll be building up an Authentication-Results header.

2646 authResults := message.AuthResults{

2647 Hostname: mox.Conf.Static.HostnameDomain.XName(c.msgsmtputf8),

2648 }

2649

2650 commentAuthentic := func(v bool) string {

2651 if v {

2652 return "with dnssec"

2653 }

2654 return "without dnssec"

2655 }

2656

2657 // Reverse IP lookup results.

2658 // todo future: how useful is this?

2659 // ../rfc/5321:2481

2660 authResults.Methods = append(authResults.Methods, message.AuthMethod{

2661 Method: "iprev",

2662 Result: string(iprevStatus),

2663 Comment: commentAuthentic(iprevAuthentic),

2664 Props: []message.AuthProp{

2665 message.MakeAuthProp("policy", "iprev", c.remoteIP.String(), false, ""),

2666 },

2667 })

2668

2669 // SPF and DKIM verification in parallel.

2670 var wg sync.WaitGroup

2671

2672 // DKIM

2673 wg.Add(1)

2674 var dkimResults []dkim.Result

2675 var dkimErr error

2676 go func() {

2677 defer func() {

2678 x := recover() // Should not happen, but don't take program down if it does.

2679 if x != nil {

2680 c.log.Error("dkim verify panic", slog.Any("err", x))

2681 debug.PrintStack()

2682 metrics.PanicInc(metrics.Dkimverify)

2683 }

2684 }()

2685 defer wg.Done()

2686 // We always evaluate all signatures. We want to build up reputation for each

2687 // domain in the signature.

2688 const ignoreTestMode = false

2689 // todo future: longer timeout? we have to read through the entire email, which can be large, possibly multiple times.

2690 dkimctx, dkimcancel := context.WithTimeout(ctx, time.Minute)

2691 defer dkimcancel()

2692 // todo future: we could let user configure which dkim headers they require

2693

2694 // For localserve, fake dkim selector DNS records for hosted domains to give

2695 // dkim-signatures a chance to pass for deliveries from queue.

2696 resolver := c.resolver

2697 if Localserve {

2698 // Lookup based on message From address is an approximation.

2699 if dc, ok := mox.Conf.Domain(msgFrom.Domain); ok && len(dc.DKIM.Selectors) > 0 {

2700 txts := map[string][]string{}

2701 for name, sel := range dc.DKIM.Selectors {

2702 dkimr := dkim.Record{

2703 Version: "DKIM1",

2704 Hashes: []string{sel.HashEffective},

2705 PublicKey: sel.Key.Public(),

2706 }

2707 if _, ok := sel.Key.(ed25519.PrivateKey); ok {

2708 dkimr.Key = "ed25519"

2709 } else if _, ok := sel.Key.(*rsa.PrivateKey); !ok {

2710 err := fmt.Errorf("unrecognized private key for DKIM selector %q: %T", name, sel.Key)

2711 xcheckf(err, "making dkim record")

2712 }

2713 txt, err := dkimr.Record()

2714 xcheckf(err, "making DKIM DNS TXT record")

2715 txts[name+"._domainkey."+msgFrom.Domain.ASCII+"."] = []string{txt}

2716 }

2717 resolver = dns.MockResolver{TXT: txts}

2718 }

2719 }

2720 dkimResults, dkimErr = dkim.Verify(dkimctx, c.log.Logger, resolver, c.msgsmtputf8, dkim.DefaultPolicy, dataFile, ignoreTestMode)

2721 dkimcancel()

2722 }()

2723

2724 // SPF.

2725 // ../rfc/7208:472

2726 var receivedSPF spf.Received

2727 var spfDomain dns.Domain

2728 var spfExpl string

2729 var spfAuthentic bool

2730 var spfErr error

2731 spfArgs := spf.Args{

2732 RemoteIP: c.remoteIP,

2733 MailFromLocalpart: c.mailFrom.Localpart,

2734 MailFromDomain: c.mailFrom.IPDomain.Domain, // Can be empty.

2735 HelloDomain: c.hello,

2736 LocalIP: c.localIP,

2737 LocalHostname: c.hostname,

2738 }

2739 wg.Add(1)

2740 go func() {

2741 defer func() {

2742 x := recover() // Should not happen, but don't take program down if it does.

2743 if x != nil {

2744 c.log.Error("spf verify panic", slog.Any("err", x))

2745 debug.PrintStack()

2746 metrics.PanicInc(metrics.Spfverify)

2747 }

2748 }()

2749 defer wg.Done()

2750 spfctx, spfcancel := context.WithTimeout(ctx, time.Minute)

2751 defer spfcancel()

2752 resolver := c.resolver

2753 // For localserve, give hosted domains a chance to pass for deliveries from queue.

2754 if Localserve && c.remoteIP.IsLoopback() {

2755 // Lookup based on message From address is an approximation.

2756 if _, ok := mox.Conf.Domain(msgFrom.Domain); ok {

2757 resolver = dns.MockResolver{

2758 TXT: map[string][]string{msgFrom.Domain.ASCII + ".": {"v=spf1 ip4:127.0.0.1/8 ip6:::1 ~all"}},

2759 }

2760 }

2761 }

2762 receivedSPF, spfDomain, spfExpl, spfAuthentic, spfErr = spf.Verify(spfctx, c.log.Logger, resolver, spfArgs)

2763 spfcancel()

2764 if spfErr != nil {

2765 c.log.Infox("spf verify", spfErr)

2766 }

2767 }()

2768

2769 // Wait for DKIM and SPF validation to finish.

2770 wg.Wait()

2771

2772 // Give immediate response if all recipients are unknown.

2773 nunknown := 0

2774 for _, r := range c.recipients {

2775 if r.Account == nil && r.Alias == nil {

2776 nunknown++

2777 }

2778 }

2779 if nunknown == len(c.recipients) {

2780 // During RCPT TO we found that the address does not exist.

2781 c.log.Info("deliver attempt to unknown user(s)", slog.Any("recipients", c.recipients))

2782

2783 // Crude attempt to slow down someone trying to guess names. Would work better

2784 // with connection rate limiter.

2785 if unknownRecipientsDelay > 0 {

2786 mox.Sleep(ctx, unknownRecipientsDelay)

2787 }

2788

2789 // todo future: if remote does not look like a properly configured mail system, respond with generic 451 error? to prevent any random internet system from discovering accounts. we could give proper response if spf for ehlo or mailfrom passes.

2790 xsmtpUserErrorf(smtp.C550MailboxUnavail, smtp.SeAddr1UnknownDestMailbox1, "no such user(s)")

2791 }

2792

2793 // Add DKIM results to Authentication-Results header.

2794 authResAddDKIM := func(result, comment, reason string, props []message.AuthProp) {

2795 dm := message.AuthMethod{

2796 Method: "dkim",

2797 Result: result,

2798 Comment: comment,

2799 Reason: reason,

2800 Props: props,

2801 }

2802 authResults.Methods = append(authResults.Methods, dm)

2803 }

2804 if dkimErr != nil {

2805 c.log.Errorx("dkim verify", dkimErr)

2806 authResAddDKIM("none", "", dkimErr.Error(), nil)

2807 } else if len(dkimResults) == 0 {

2808 c.log.Info("no dkim-signature header", slog.Any("mailfrom", c.mailFrom))

2809 authResAddDKIM("none", "", "no dkim signatures", nil)

2810 }

2811 for i, r := range dkimResults {

2812 var domain, selector dns.Domain

2813 var identity *dkim.Identity

2814 var comment string

2815 var props []message.AuthProp

2816 if r.Sig != nil {

2817 if r.Record != nil && r.Record.PublicKey != nil {

2818 if pubkey, ok := r.Record.PublicKey.(*rsa.PublicKey); ok {

2819 comment = fmt.Sprintf("%d bit rsa, ", pubkey.N.BitLen())

2820 }

2821 }

2822

2823 sig := base64.StdEncoding.EncodeToString(r.Sig.Signature)

2824 sig = sig[:12] // Must be at least 8 characters and unique among the signatures.

2825 props = []message.AuthProp{

2826 message.MakeAuthProp("header", "d", r.Sig.Domain.XName(c.msgsmtputf8), true, r.Sig.Domain.ASCIIExtra(c.msgsmtputf8)),

2827 message.MakeAuthProp("header", "s", r.Sig.Selector.XName(c.msgsmtputf8), true, r.Sig.Selector.ASCIIExtra(c.msgsmtputf8)),

2828 message.MakeAuthProp("header", "a", r.Sig.Algorithm(), false, ""),

2829 message.MakeAuthProp("header", "b", sig, false, ""), // ../rfc/6008:147

2830 }

2831 domain = r.Sig.Domain

2832 selector = r.Sig.Selector

2833 if r.Sig.Identity != nil {

2834 props = append(props, message.MakeAuthProp("header", "i", r.Sig.Identity.String(), true, ""))

2835 identity = r.Sig.Identity

2836 }

2837 if r.RecordAuthentic {

2838 comment += "with dnssec"

2839 } else {

2840 comment += "without dnssec"

2841 }

2842 }

2843 var errmsg string

2844 if r.Err != nil {

2845 errmsg = r.Err.Error()

2846 }

2847 authResAddDKIM(string(r.Status), comment, errmsg, props)

2848 c.log.Debugx("dkim verification result", r.Err,

2849 slog.Int("index", i),

2850 slog.Any("mailfrom", c.mailFrom),

2851 slog.Any("status", r.Status),

2852 slog.Any("domain", domain),

2853 slog.Any("selector", selector),

2854 slog.Any("identity", identity))

2855 }

2856

2857 // Add SPF results to Authentication-Results header. ../rfc/7208:2141

2858 var spfIdentity *dns.Domain

2859 var mailFromValidation = store.ValidationUnknown

2860 var ehloValidation = store.ValidationUnknown

2861 switch receivedSPF.Identity {

2862 case spf.ReceivedHELO:

2863 if len(spfArgs.HelloDomain.IP) == 0 {

2864 spfIdentity = &spfArgs.HelloDomain.Domain

2865 }

2866 ehloValidation = store.SPFValidation(receivedSPF.Result)

2867 case spf.ReceivedMailFrom:

2868 spfIdentity = &spfArgs.MailFromDomain

2869 mailFromValidation = store.SPFValidation(receivedSPF.Result)

2870 }

2871 var props []message.AuthProp

2872 if spfIdentity != nil {

2873 props = []message.AuthProp{message.MakeAuthProp("smtp", string(receivedSPF.Identity), spfIdentity.XName(c.msgsmtputf8), true, spfIdentity.ASCIIExtra(c.msgsmtputf8))}

2874 }

2875 var spfComment string

2876 if spfAuthentic {

2877 spfComment = "with dnssec"

2878 } else {

2879 spfComment = "without dnssec"

2880 }

2881 authResults.Methods = append(authResults.Methods, message.AuthMethod{

2882 Method: "spf",

2883 Result: string(receivedSPF.Result),

2884 Comment: spfComment,

2885 Props: props,

2886 })

2887 switch receivedSPF.Result {

2888 case spf.StatusPass:

2889 c.log.Debug("spf pass", slog.Any("ip", spfArgs.RemoteIP), slog.String("mailfromdomain", spfArgs.MailFromDomain.ASCII)) // todo: log the domain that was actually verified.

2890 case spf.StatusFail:

2891 if spfExpl != "" {

2892 // Filter out potentially hostile text. ../rfc/7208:2529

2893 for _, b := range []byte(spfExpl) {

2894 if b < ' ' || b >= 0x7f {

2895 spfExpl = ""

2896 break

2897 }

2898 }

2899 if spfExpl != "" {

2900 if len(spfExpl) > 800 {

2901 spfExpl = spfExpl[:797] + "..."

2902 }

2903 spfExpl = "remote claims: " + spfExpl

2904 }

2905 }

2906 if spfExpl == "" {

2907 spfExpl = fmt.Sprintf("your ip %s is not on the SPF allowlist for domain %s", spfArgs.RemoteIP, spfDomain.ASCII)

2908 }

2909 c.log.Info("spf fail", slog.String("explanation", spfExpl)) // todo future: get this to the client. how? in smtp session in case of a reject due to dmarc fail?

2910 case spf.StatusTemperror:

2911 c.log.Infox("spf temperror", spfErr)

2912 case spf.StatusPermerror:

2913 c.log.Infox("spf permerror", spfErr)

2914 case spf.StatusNone, spf.StatusNeutral, spf.StatusSoftfail:

2915 default:

2916 c.log.Error("unknown spf status, treating as None/Neutral", slog.Any("status", receivedSPF.Result))

2917 receivedSPF.Result = spf.StatusNone

2918 }

2919

2920 // DMARC

2921 var dmarcUse bool

2922 var dmarcResult dmarc.Result

2923 const applyRandomPercentage = true

2924 // dmarcMethod is added to authResults when delivering to recipients: accounts can

2925 // have different policy override rules.

2926 var dmarcMethod message.AuthMethod

2927 var msgFromValidation = store.ValidationNone

2928 if msgFrom.IsZero() {

2929 dmarcResult.Status = dmarc.StatusNone

2930 dmarcMethod = message.AuthMethod{

2931 Method: "dmarc",

2932 Result: string(dmarcResult.Status),

2933 }

2934 } else {

2935 msgFromValidation = alignment(ctx, c.log, msgFrom.Domain, dkimResults, receivedSPF.Result, spfIdentity)

2936

2937 // We are doing the DMARC evaluation now. But we only store it for inclusion in an

2938 // aggregate report when we actually use it. We use an evaluation for each

2939 // recipient, with each a potentially different result due to mailing

2940 // list/forwarding configuration. If we reject a message due to being spam, we

2941 // don't want to spend any resources for the sender domain, and we don't want to

2942 // give the sender any more information about us, so we won't record the

2943 // evaluation.

2944 // todo future: also not send for first-time senders? they could be spammers getting through our filter, don't want to give them insights either. though we currently would have no reasonable way to decide if they are still reputationless at the time we are composing/sending aggregate reports.

2945

2946 dmarcctx, dmarccancel := context.WithTimeout(ctx, time.Minute)

2947 defer dmarccancel()

2948 dmarcUse, dmarcResult = dmarc.Verify(dmarcctx, c.log.Logger, c.resolver, msgFrom.Domain, dkimResults, receivedSPF.Result, spfIdentity, applyRandomPercentage)

2949 dmarccancel()

2950 var comment string

2951 if dmarcResult.RecordAuthentic {

2952 comment = "with dnssec"

2953 } else {

2954 comment = "without dnssec"

2955 }

2956 dmarcMethod = message.AuthMethod{

2957 Method: "dmarc",

2958 Result: string(dmarcResult.Status),

2959 Comment: comment,

2960 Props: []message.AuthProp{

2961 // ../rfc/7489:1489

2962 message.MakeAuthProp("header", "from", msgFrom.Domain.ASCII, true, msgFrom.Domain.ASCIIExtra(c.msgsmtputf8)),

2963 },

2964 }

2965

2966 if dmarcResult.Status == dmarc.StatusPass && msgFromValidation == store.ValidationRelaxed {

2967 msgFromValidation = store.ValidationDMARC

2968 }

2969

2970 // todo future: consider enforcing an spf (soft)fail if there is no dmarc policy or the dmarc policy is none. ../rfc/7489:1507

2971 }

2972 c.log.Debug("dmarc verification", slog.Any("result", dmarcResult.Status), slog.Any("domain", msgFrom.Domain))

2973

2974 // Prepare for analyzing content, calculating reputation.

2975 ipmasked1, ipmasked2, ipmasked3 := ipmasked(c.remoteIP)

2976 var verifiedDKIMDomains []string

2977 dkimSeen := map[string]bool{}

2978 for _, r := range dkimResults {

2979 // A message can have multiple signatures for the same identity. For example when

2980 // signing the message multiple times with different algorithms (rsa and ed25519).

2981 if r.Status != dkim.StatusPass {

2982 continue

2983 }

2984 d := r.Sig.Domain.Name()

2985 if !dkimSeen[d] {

2986 dkimSeen[d] = true

2987 verifiedDKIMDomains = append(verifiedDKIMDomains, d)

2988 }

2989 }

2990

2991 // When we deliver, we try to remove from rejects mailbox based on message-id.

2992 // We'll parse it when we need it, but it is the same for each recipient.

2993 var messageID string

2994 var parsedMessageID bool

2995

2996 // We build up a DSN for each failed recipient. If we have recipients in dsnMsg

2997 // after processing, we queue the DSN. Unless all recipients failed, in which case

2998 // we may just fail the mail transaction instead (could be common for failure to

2999 // deliver to a single recipient, e.g. for junk mail).

3000 // ../rfc/3464:436

3001 type deliverError struct {

3002 rcptTo smtp.Path

3003 code int

3004 secode string

3005 userError bool

3006 errmsg string

3007 }

3008 var deliverErrors []deliverError

3009 addError := func(rcpt recipient, code int, secode string, userError bool, errmsg string) {

3010 e := deliverError{rcpt.Addr, code, secode, userError, errmsg}

3011 c.log.Info("deliver error",

3012 slog.Any("rcptto", e.rcptTo),

3013 slog.Int("code", code),

3014 slog.String("secode", "secode"),

3015 slog.Bool("usererror", userError),

3016 slog.String("errmsg", errmsg))

3017 deliverErrors = append(deliverErrors, e)

3018 }

3019

3020 // Sort recipients: local accounts, aliases, unknown. For ensuring we don't deliver

3021 // to an alias destination that was also explicitly sent to.

3022 rcptScore := func(r recipient) int {

3023 if r.Account != nil {

3024 return 0

3025 } else if r.Alias != nil {

3026 return 1

3027 }

3028 return 2

3029 }

3030 sort.SliceStable(c.recipients, func(i, j int) bool {

3031 return rcptScore(c.recipients[i]) < rcptScore(c.recipients[j])

3032 })

3033

3034 // Return whether address is a regular explicit recipient in this transaction. Used

3035 // to prevent delivering a message to an address both for alias and explicit

3036 // addressee. Relies on c.recipients being sorted as above.

3037 regularRecipient := func(addr smtp.Path) bool {

3038 for _, rcpt := range c.recipients {

3039 if rcpt.Account == nil {

3040 break

3041 } else if rcpt.Addr.Equal(addr) {

3042 return true

3043 }

3044 }

3045 return false

3046 }

3047

3048 // Prepare a message, analyze it against account's junk filter.

3049 // The returned analysis has an open account that must be closed by the caller.

3050 // We call this for all alias destinations, also when we already delivered to that

3051 // recipient: It may be the only recipient that would allow the message.

3052 messageAnalyze := func(log mlog.Log, smtpRcptTo, deliverTo smtp.Path, accountName string, destination config.Destination, canonicalAddr string) (a *analysis, rerr error) {

3053 acc, err := store.OpenAccount(log, accountName, false)

3054 if err != nil {

3055 log.Errorx("open account", err, slog.Any("account", accountName))

3056 metricDelivery.WithLabelValues("accounterror", "").Inc()

3057 return nil, err

3058 }

3059 defer func() {

3060 if a == nil {

3061 err := acc.Close()

3062 log.Check(err, "closing account during analysis")

3063 }

3064 }()

3065

3066 m := store.Message{

3067 Received: time.Now(),

3068 RemoteIP: c.remoteIP.String(),

3069 RemoteIPMasked1: ipmasked1,

3070 RemoteIPMasked2: ipmasked2,

3071 RemoteIPMasked3: ipmasked3,

3072 EHLODomain: c.hello.Domain.Name(),

3073 MailFrom: c.mailFrom.String(),

3074 MailFromLocalpart: c.mailFrom.Localpart,

3075 MailFromDomain: c.mailFrom.IPDomain.Domain.Name(),

3076 RcptToLocalpart: smtpRcptTo.Localpart,

3077 RcptToDomain: smtpRcptTo.IPDomain.Domain.Name(),

3078 MsgFromLocalpart: msgFrom.Localpart,

3079 MsgFromDomain: msgFrom.Domain.Name(),

3080 MsgFromOrgDomain: publicsuffix.Lookup(ctx, log.Logger, msgFrom.Domain).Name(),

3081 EHLOValidated: ehloValidation == store.ValidationPass,

3082 MailFromValidated: mailFromValidation == store.ValidationPass,

3083 MsgFromValidated: msgFromValidation == store.ValidationStrict || msgFromValidation == store.ValidationDMARC || msgFromValidation == store.ValidationRelaxed,

3084 EHLOValidation: ehloValidation,

3085 MailFromValidation: mailFromValidation,

3086 MsgFromValidation: msgFromValidation,

3087 DKIMDomains: verifiedDKIMDomains,

3088 DSN: isDSN,

3089 Size: msgWriter.Size,

3090 }

3091 if c.tls {

3092 tlsState := c.conn.(*tls.Conn).ConnectionState()

3093 m.ReceivedTLSVersion = tlsState.Version

3094 m.ReceivedTLSCipherSuite = tlsState.CipherSuite

3095 if c.requireTLS != nil {

3096 m.ReceivedRequireTLS = *c.requireTLS

3097 }

3098 } else {

3099 m.ReceivedTLSVersion = 1 // Signals plain text delivery.

3100 }

3101

3102 var msgTo, msgCc []message.Address

3103 if envelope != nil {

3104 msgTo = envelope.To

3105 msgCc = envelope.CC

3106 }

3107 d := delivery{c.tls, &m, dataFile, smtpRcptTo, deliverTo, destination, canonicalAddr, acc, msgTo, msgCc, msgFrom, c.dnsBLs, dmarcUse, dmarcResult, dkimResults, iprevStatus, c.smtputf8}

3108

3109 r := analyze(ctx, log, c.resolver, d)

3110 return &r, nil

3111 }

3112

3113 // Either deliver the message, or call addError to register the recipient as failed.

3114 // If recipient is an alias, we may be delivering to multiple address/accounts and

3115 // we will consider a message delivered if we delivered it to at least one account

3116 // (others may be over quota).

3117 processRecipient := func(rcpt recipient) {

3118 log := c.log.With(slog.Any("mailfrom", c.mailFrom), slog.Any("rcptto", rcpt.Addr))

3119

3120 // If this is not a valid local user, we send back a DSN. This can only happen when

3121 // there are also valid recipients, and only when remote is SPF-verified, so the DSN

3122 // should not cause backscatter.

3123 // In case of serious errors, we abort the transaction. We may have already

3124 // delivered some messages. Perhaps it would be better to continue with other

3125 // deliveries, and return an error at the end? Though the failure conditions will

3126 // probably prevent any other successful deliveries too...

3127 // We'll continue delivering to other recipients. ../rfc/5321:3275

3128 if rcpt.Account == nil && rcpt.Alias == nil {

3129 metricDelivery.WithLabelValues("unknownuser", "").Inc()

3130 addError(rcpt, smtp.C550MailboxUnavail, smtp.SeAddr1UnknownDestMailbox1, true, "no such user")

3131 return

3132 }

3133

3134 // la holds all analysis, and message preparation, for all accounts (multiple for

3135 // aliases). Each has an open account that we we close on return.

3136 var la []analysis

3137 defer func() {

3138 for _, a := range la {

3139 err := a.d.acc.Close()

3140 log.Check(err, "close account")

3141 }

3142 }()

3143

3144 // For aliases, we prepare & analyze for each recipient. We accept the message if

3145 // any recipient accepts it. Regular destination have just a single account to

3146 // check. We check all alias destinations, even if we already explicitly delivered

3147 // to them: they may be the only destination that would accept the message.

3148 var a0 *analysis // Analysis we've used for accept/reject decision.

3149 if rcpt.Alias != nil {

3150 // Check if msgFrom address is acceptable. This doesn't take validation into

3151 // consideration. If the header was forged, the message may be rejected later on.

3152 if !aliasAllowedMsgFrom(rcpt.Alias.Alias, msgFrom) {

3153 addError(rcpt, smtp.C550MailboxUnavail, smtp.SePol7ExpnProhibited2, true, "not allowed to send to destination")

3154 return

3155 }

3156

3157 la = make([]analysis, 0, len(rcpt.Alias.Alias.ParsedAddresses))

3158 for _, aa := range rcpt.Alias.Alias.ParsedAddresses {

3159 a, err := messageAnalyze(log, rcpt.Addr, aa.Address.Path(), aa.AccountName, aa.Destination, rcpt.Alias.CanonicalAddress)

3160 if err != nil {

3161 addError(rcpt, smtp.C451LocalErr, smtp.SeSys3Other0, false, "error processing")

3162 return

3163 }

3164 la = append(la, *a)

3165 if a.accept && a0 == nil {

3166 // Address that caused us to accept.

3167 a0 = &la[len(la)-1]

3168 }

3169 }

3170 if a0 == nil {

3171 // First address, for rejecting.

3172 a0 = &la[0]

3173 }

3174 } else {

3175 a, err := messageAnalyze(log, rcpt.Addr, rcpt.Addr, rcpt.Account.AccountName, rcpt.Account.Destination, rcpt.Account.CanonicalAddress)

3176 if err != nil {

3177 addError(rcpt, smtp.C451LocalErr, smtp.SeSys3Other0, false, "error processing")

3178 return

3179 }

3180 la = []analysis{*a}

3181 a0 = &la[0]

3182 }

3183

3184 if !a0.accept && a0.reason == reasonHighRate {

3185 log.Info("incoming message rejected for high rate, not storing in rejects mailbox", slog.String("reason", a0.reason), slog.Any("msgfrom", msgFrom))

3186 metricDelivery.WithLabelValues("reject", a0.reason).Inc()

3187 c.setSlow(true)

3188 addError(rcpt, a0.code, a0.secode, a0.userError, a0.errmsg)

3189 return

3190 }

3191

3192 // Any DMARC result override is stored in the evaluation for outgoing DMARC

3193 // aggregate reports, and added to the Authentication-Results message header.

3194 // We want to tell the sender that we have an override, e.g. for mailing lists, so

3195 // they don't overestimate the potential damage of switching from p=none to

3196 // p=reject.

3197 var dmarcOverrides []string

3198 if a0.dmarcOverrideReason != "" {

3199 dmarcOverrides = []string{a0.dmarcOverrideReason}

3200 }

3201 if dmarcResult.Record != nil && !dmarcUse {

3202 dmarcOverrides = append(dmarcOverrides, string(dmarcrpt.PolicyOverrideSampledOut))

3203 }

3204

3205 // Add per-recipient DMARC method to Authentication-Results. Each account can have

3206 // their own override rules, e.g. based on configured mailing lists/forwards.

3207 // ../rfc/7489:1486

3208 rcptDMARCMethod := dmarcMethod

3209 if len(dmarcOverrides) > 0 {

3210 if rcptDMARCMethod.Comment != "" {

3211 rcptDMARCMethod.Comment += ", "

3212 }

3213 rcptDMARCMethod.Comment += "override " + strings.Join(dmarcOverrides, ",")

3214 }

3215 rcptAuthResults := authResults

3216 rcptAuthResults.Methods = slices.Clone(authResults.Methods)

3217 rcptAuthResults.Methods = append(rcptAuthResults.Methods, rcptDMARCMethod)

3218

3219 // Prepend reason as message header, for easy viewing in mail clients.

3220 var xmox string

3221 if a0.reason != "" {

3222 hw := &message.HeaderWriter{}

3223 hw.Add(" ", "X-Mox-Reason:")

3224 hw.Add(" ", a0.reason)

3225 for i, s := range a0.reasonText {

3226 if i == 0 {

3227 s = "; " + s

3228 } else {

3229 hw.Newline()

3230 }

3231 // Just in case any of the strings has a newline, replace it with space to not break the message.

3232 s = strings.ReplaceAll(s, "\n", " ")

3233 s = strings.ReplaceAll(s, "\r", " ")

3234 s += ";"

3235 hw.AddWrap([]byte(s), true)

3236 }

3237 xmox = hw.String()

3238 }

3239 xmox += a0.headers

3240

3241 for i := range la {

3242 // ../rfc/5321:3204

3243 // Received-SPF header goes before Received. ../rfc/7208:2038

3244 la[i].d.m.MsgPrefix = []byte(

3245 xmox +

3246 "Delivered-To: " + la[i].d.deliverTo.XString(c.msgsmtputf8) + "\r\n" + // ../rfc/9228:274

3247 "Return-Path: <" + c.mailFrom.String() + ">\r\n" + // ../rfc/5321:3300

3248 rcptAuthResults.Header() +

3249 receivedSPF.Header() +

3250 recvHdrFor(rcpt.Addr.String()),

3251 )

3252 la[i].d.m.Size += int64(len(la[i].d.m.MsgPrefix))

3253 }

3254

3255 // Store DMARC evaluation for inclusion in an aggregate report. Only if there is at

3256 // least one reporting address: We don't want to needlessly store a row in a

3257 // database for each delivery attempt. If we reject a message for being junk, we

3258 // are also not going to send it a DMARC report. The DMARC check is done early in

3259 // the analysis, we will report on rejects because of DMARC, because it could be

3260 // valuable feedback about forwarded or mailing list messages.

3261 // ../rfc/7489:1492

3262 if !mox.Conf.Static.NoOutgoingDMARCReports && dmarcResult.Record != nil && len(dmarcResult.Record.AggregateReportAddresses) > 0 && (a0.accept && !a0.d.m.IsReject || a0.reason == reasonDMARCPolicy) {

3263 // Disposition holds our decision on whether to accept the message. Not what the

3264 // DMARC evaluation resulted in. We can override, e.g. because of mailing lists,

3265 // forwarding, or local policy.

3266 // We treat quarantine as reject, so never claim to quarantine.

3267 // ../rfc/7489:1691

3268 disposition := dmarcrpt.DispositionNone

3269 if !a0.accept {

3270 disposition = dmarcrpt.DispositionReject

3271 }

3272

3273 // unknownDomain returns whether the sender is domain with which this account has

3274 // not had positive interaction.

3275 unknownDomain := func() (unknown bool) {

3276 err := a0.d.acc.DB.Read(ctx, func(tx *bstore.Tx) (err error) {

3277 // See if we received a non-junk message from this organizational domain.

3278 q := bstore.QueryTx[store.Message](tx)

3279 q.FilterNonzero(store.Message{MsgFromOrgDomain: a0.d.m.MsgFromOrgDomain})

3280 q.FilterEqual("Expunged", false)

3281 q.FilterEqual("Notjunk", true)

3282 q.FilterEqual("IsReject", false)

3283 exists, err := q.Exists()

3284 if err != nil {

3285 return fmt.Errorf("querying for non-junk message from organizational domain: %v", err)

3286 }

3287 if exists {

3288 return nil

3289 }

3290

3291 // See if we sent a message to this organizational domain.

3292 qr := bstore.QueryTx[store.Recipient](tx)

3293 qr.FilterNonzero(store.Recipient{OrgDomain: a0.d.m.MsgFromOrgDomain})

3294 exists, err = qr.Exists()

3295 if err != nil {

3296 return fmt.Errorf("querying for message sent to organizational domain: %v", err)

3297 }

3298 if !exists {

3299 unknown = true

3300 }

3301 return nil

3302 })

3303 if err != nil {

3304 log.Errorx("checking if sender is unknown domain, for dmarc aggregate report evaluation", err)

3305 }

3306 return

3307 }

3308

3309 r := dmarcResult.Record

3310 addresses := make([]string, len(r.AggregateReportAddresses))

3311 for i, a := range r.AggregateReportAddresses {

3312 addresses[i] = a.String()

3313 }

3314 sp := dmarcrpt.Disposition(r.SubdomainPolicy)

3315 if r.SubdomainPolicy == dmarc.PolicyEmpty {

3316 sp = dmarcrpt.Disposition(r.Policy)

3317 }

3318 eval := dmarcdb.Evaluation{

3319 // Evaluated and IntervalHours set by AddEvaluation.

3320 PolicyDomain: dmarcResult.Domain.Name(),

3321

3322 // Optional evaluations don't cause a report to be sent, but will be included.

3323 // Useful for automated inter-mailer messages, we don't want to get in a reporting

3324 // loop. We also don't want to be used for sending reports to unsuspecting domains

3325 // we have no relation with.

3326 // todo: would it make sense to also mark some percentage of mailing-list-policy-overrides optional? to lower the load on mail servers of folks sending to large mailing lists.

3327 Optional: a0.d.destination.DMARCReports || a0.d.destination.HostTLSReports || a0.d.destination.DomainTLSReports || a0.reason == reasonDMARCPolicy && unknownDomain(),

3328

3329 Addresses: addresses,

3330

3331 PolicyPublished: dmarcrpt.PolicyPublished{

3332 Domain: dmarcResult.Domain.Name(),

3333 ADKIM: dmarcrpt.Alignment(r.ADKIM),

3334 ASPF: dmarcrpt.Alignment(r.ASPF),

3335 Policy: dmarcrpt.Disposition(r.Policy),

3336 SubdomainPolicy: sp,

3337 Percentage: r.Percentage,

3338 // We don't save ReportingOptions, we don't do per-message failure reporting.

3339 },

3340 SourceIP: c.remoteIP.String(),

3341 Disposition: disposition,

3342 AlignedDKIMPass: dmarcResult.AlignedDKIMPass,

3343 AlignedSPFPass: dmarcResult.AlignedSPFPass,

3344 EnvelopeTo: rcpt.Addr.IPDomain.String(),

3345 EnvelopeFrom: c.mailFrom.IPDomain.String(),

3346 HeaderFrom: msgFrom.Domain.Name(),

3347 }

3348

3349 for _, s := range dmarcOverrides {

3350 reason := dmarcrpt.PolicyOverrideReason{Type: dmarcrpt.PolicyOverride(s)}

3351 eval.OverrideReasons = append(eval.OverrideReasons, reason)

3352 }

3353

3354 // We'll include all signatures for the organizational domain, even if they weren't

3355 // relevant due to strict alignment requirement.

3356 for _, dkimResult := range dkimResults {

3357 if dkimResult.Sig == nil || publicsuffix.Lookup(ctx, log.Logger, msgFrom.Domain) != publicsuffix.Lookup(ctx, log.Logger, dkimResult.Sig.Domain) {

3358 continue

3359 }

3360 r := dmarcrpt.DKIMAuthResult{

3361 Domain: dkimResult.Sig.Domain.Name(),

3362 Selector: dkimResult.Sig.Selector.ASCII,

3363 Result: dmarcrpt.DKIMResult(dkimResult.Status),

3364 }

3365 eval.DKIMResults = append(eval.DKIMResults, r)

3366 }

3367

3368 switch receivedSPF.Identity {

3369 case spf.ReceivedHELO:

3370 spfAuthResult := dmarcrpt.SPFAuthResult{

3371 Domain: spfArgs.HelloDomain.String(), // Can be unicode and also IP.

3372 Scope: dmarcrpt.SPFDomainScopeHelo,

3373 Result: dmarcrpt.SPFResult(receivedSPF.Result),

3374 }

3375 eval.SPFResults = []dmarcrpt.SPFAuthResult{spfAuthResult}

3376 case spf.ReceivedMailFrom:

3377 spfAuthResult := dmarcrpt.SPFAuthResult{

3378 Domain: spfArgs.MailFromDomain.Name(), // Can be unicode.

3379 Scope: dmarcrpt.SPFDomainScopeMailFrom,

3380 Result: dmarcrpt.SPFResult(receivedSPF.Result),

3381 }

3382 eval.SPFResults = []dmarcrpt.SPFAuthResult{spfAuthResult}

3383 }

3384

3385 err := dmarcdb.AddEvaluation(ctx, dmarcResult.Record.AggregateReportingInterval, &eval)

3386 log.Check(err, "adding dmarc evaluation to database for aggregate report")

3387 }

3388

3389 if !a0.accept {

3390 for _, a := range la {

3391 // Don't add message if address was also explicitly present in a RCPT TO command.

3392 if rcpt.Alias != nil && regularRecipient(a.d.deliverTo) {

3393 continue

3394 }

3395

3396 conf, _ := a.d.acc.Conf()

3397 if conf.RejectsMailbox == "" {

3398 continue

3399 }

3400 present, _, messagehash, err := rejectPresent(log, a.d.acc, conf.RejectsMailbox, a.d.m, dataFile)

3401 if err != nil {

3402 log.Errorx("checking whether reject is already present", err)

3403 continue

3404 } else if present {

3405 log.Info("reject message is already present, ignoring")

3406 continue

3407 }

3408 a.d.m.IsReject = true

3409 a.d.m.Seen = true // We don't want to draw attention.

3410 // Regular automatic junk flags configuration applies to these messages. The

3411 // default is to treat these as neutral, so they won't cause outright rejections

3412 // due to reputation for later delivery attempts.

3413 a.d.m.MessageHash = messagehash

3414 a.d.acc.WithWLock(func() {

3415 var changes []store.Change

3416 var stored bool

3417

3418 var newID int64

3419 defer func() {

3420 if newID != 0 {

3421 p := a.d.acc.MessagePath(newID)

3422 err := os.Remove(p)

3423 c.log.Check(err, "remove message after error delivering to rejects", slog.String("path", p))

3424 }

3425 }()

3426

3427 err := a.d.acc.DB.Write(context.TODO(), func(tx *bstore.Tx) error {

3428 mbrej, err := a.d.acc.MailboxFind(tx, conf.RejectsMailbox)

3429 if err != nil {

3430 return fmt.Errorf("finding rejects mailbox: %v", err)

3431 }

3432

3433 if !conf.KeepRejects && mbrej != nil {

3434 chl, hasSpace, err := a.d.acc.TidyRejectsMailbox(c.log, tx, mbrej)

3435 if err != nil {

3436 return fmt.Errorf("tidying rejects mailbox: %v", err)

3437 }

3438 changes = append(changes, chl...)

3439 if !hasSpace {

3440 log.Info("not storing spammy mail to full rejects mailbox")

3441 return nil

3442 }

3443 }

3444 if mbrej == nil {

3445 nmb, chl, _, _, err := a.d.acc.MailboxCreate(tx, conf.RejectsMailbox, store.SpecialUse{})

3446 if err != nil {

3447 return fmt.Errorf("creating rejects mailbox: %v", err)

3448 }

3449 changes = append(changes, chl...)

3450

3451 mbrej = &nmb

3452 }

3453 a.d.m.MailboxID = mbrej.ID

3454 if err := a.d.acc.MessageAdd(log, tx, mbrej, a.d.m, dataFile, store.AddOpts{}); err != nil {

3455 return fmt.Errorf("delivering spammy mail to rejects mailbox: %v", err)

3456 }

3457 newID = a.d.m.ID

3458

3459 if err := tx.Update(mbrej); err != nil {

3460 return fmt.Errorf("updating rejects mailbox: %v", err)

3461 }

3462 changes = append(changes, a.d.m.ChangeAddUID(*mbrej), mbrej.ChangeCounts())

3463 stored = true

3464 return nil

3465 })

3466 if err != nil {

3467 log.Errorx("delivering to rejects mailbox", err)

3468 return

3469 } else if stored {

3470 log.Info("stored spammy mail in rejects mailbox")

3471 }

3472 newID = 0

3473

3474 store.BroadcastChanges(a.d.acc, changes)

3475 })

3476 }

3477

3478 log.Info("incoming message rejected", slog.String("reason", a0.reason), slog.Any("msgfrom", msgFrom))

3479 metricDelivery.WithLabelValues("reject", a0.reason).Inc()

3480 c.setSlow(true)

3481 addError(rcpt, a0.code, a0.secode, a0.userError, a0.errmsg)

3482 return

3483 }

3484

3485 delayFirstTime := true

3486 if rcpt.Account != nil && a0.dmarcReport != nil {

3487 // todo future: add rate limiting to prevent DoS attacks. ../rfc/7489:2570

3488 if err := dmarcdb.AddReport(ctx, a0.dmarcReport, msgFrom.Domain); err != nil {

3489 log.Errorx("saving dmarc aggregate report in database", err)

3490 } else {

3491 log.Info("dmarc aggregate report processed")

3492 a0.d.m.Flags.Seen = true

3493 delayFirstTime = false

3494 }

3495 }

3496 if rcpt.Account != nil && a0.tlsReport != nil {

3497 // todo future: add rate limiting to prevent DoS attacks.

3498 if err := tlsrptdb.AddReport(ctx, c.log, msgFrom.Domain, c.mailFrom.String(), a0.d.destination.HostTLSReports, a0.tlsReport); err != nil {

3499 log.Errorx("saving TLSRPT report in database", err)

3500 } else {

3501 log.Info("tlsrpt report processed")

3502 a0.d.m.Flags.Seen = true

3503 delayFirstTime = false

3504 }

3505 }

3506

3507 // If this is a first-time sender and not a forwarded/mailing list message, wait

3508 // before actually delivering. If this turns out to be a spammer, we've kept one of

3509 // their connections busy.

3510 a0conf, _ := a0.d.acc.Conf()

3511 if delayFirstTime && !a0.d.m.IsForward && !a0.d.m.IsMailingList && a0.reason == reasonNoBadSignals && !a0conf.NoFirstTimeSenderDelay && c.firstTimeSenderDelay > 0 {

3512 log.Debug("delaying before delivering from sender without reputation", slog.Duration("delay", c.firstTimeSenderDelay))

3513 mox.Sleep(mox.Context, c.firstTimeSenderDelay)

3514 }

3515

3516 if Localserve {

3517 code, timeout := mox.LocalserveNeedsError(rcpt.Addr.Localpart)

3518 if timeout {

3519 log.Info("timing out due to special localpart")

3520 mox.Sleep(mox.Context, time.Hour)

3521 xsmtpServerErrorf(codes{smtp.C451LocalErr, smtp.SeOther00}, "timing out delivery due to special localpart")

3522 } else if code != 0 {

3523 log.Info("failure due to special localpart", slog.Int("code", code))

3524 metricDelivery.WithLabelValues("delivererror", "localserve").Inc()

3525 addError(rcpt, code, smtp.SeOther00, false, fmt.Sprintf("failure with code %d due to special localpart", code))

3526 return

3527 }

3528 }

3529

3530 // Gather the message-id before we deliver and the file may be consumed.

3531 if !parsedMessageID {

3532 if p, err := message.Parse(c.log.Logger, false, store.FileMsgReader(a0.d.m.MsgPrefix, dataFile)); err != nil {

3533 log.Infox("parsing message for message-id", err)

3534 } else if header, err := p.Header(); err != nil {

3535 log.Infox("parsing message header for message-id", err)

3536 } else {

3537 messageID = header.Get("Message-Id")

3538 }

3539 parsedMessageID = true

3540 }

3541

3542 // Finally deliver the message to the account(s).

3543 var nerr int // Number of non-quota errors.

3544 var nfull int // Number of failed deliveries due to over quota.

3545 var ndelivered int // Number delivered to account.

3546 for _, a := range la {

3547 // Don't deliver to recipient that was explicitly present in SMTP transaction, or

3548 // is sending the message to an alias they are member of.

3549 if rcpt.Alias != nil && (regularRecipient(a.d.deliverTo) || a.d.deliverTo.Equal(msgFrom.Path())) {

3550 continue

3551 }

3552

3553 var delivered bool

3554 a.d.acc.WithWLock(func() {

3555 if err := a.d.acc.DeliverMailbox(log, a.mailbox, a.d.m, dataFile); err != nil {

3556 log.Errorx("delivering", err)

3557 metricDelivery.WithLabelValues("delivererror", a0.reason).Inc()

3558 if errors.Is(err, store.ErrOverQuota) {

3559 nfull++

3560 } else {

3561 addError(rcpt, smtp.C451LocalErr, smtp.SeSys3Other0, false, "error processing")

3562 nerr++

3563 }

3564 return

3565 }

3566 delivered = true

3567 ndelivered++

3568 metricDelivery.WithLabelValues("delivered", a0.reason).Inc()

3569 log.Info("incoming message delivered", slog.String("reason", a0.reason), slog.Any("msgfrom", msgFrom))

3570

3571 conf, _ := a.d.acc.Conf()

3572 if conf.RejectsMailbox != "" && a.d.m.MessageID != "" {

3573 if err := a.d.acc.RejectsRemove(log, conf.RejectsMailbox, a.d.m.MessageID); err != nil {

3574 log.Errorx("removing message from rejects mailbox", err, slog.String("messageid", messageID))

3575 }

3576 }

3577 })

3578

3579 // Pass delivered messages to queue for DSN processing and/or hooks.

3580 if delivered {

3581 mr := store.FileMsgReader(a.d.m.MsgPrefix, dataFile)

3582 part, err := a.d.m.LoadPart(mr)

3583 if err != nil {

3584 log.Errorx("loading parsed part for evaluating webhook", err)

3585 } else {

3586 err = queue.Incoming(context.Background(), log, a.d.acc, messageID, *a.d.m, part, a.mailbox)

3587 log.Check(err, "queueing webhook for incoming delivery")

3588 }

3589 } else if nerr > 0 && ndelivered == 0 {

3590 // Don't continue if we had an error and haven't delivered yet. If we only had

3591 // quota-related errors, we keep trying for an account to deliver to.

3592 break

3593 }

3594 }

3595 if ndelivered == 0 && (nerr > 0 || nfull > 0) {

3596 if nerr == 0 {

3597 addError(rcpt, smtp.C452StorageFull, smtp.SeMailbox2Full2, true, "account storage full")

3598 } else {

3599 addError(rcpt, smtp.C451LocalErr, smtp.SeSys3Other0, false, "error processing")

3600 }

3601 }

3602 }

3603

3604 // For each recipient, do final spam analysis and delivery.

3605 for _, rcpt := range c.recipients {

3606 processRecipient(rcpt)

3607 }

3608

3609 // If all recipients failed to deliver, return an error.

3610 if len(c.recipients) == len(deliverErrors) {

3611 same := true

3612 e0 := deliverErrors[0]

3613 var serverError bool

3614 var msgs []string

3615 major := 4

3616 for _, e := range deliverErrors {

3617 serverError = serverError || !e.userError

3618 if e.code != e0.code || e.secode != e0.secode {

3619 same = false

3620 }

3621 msgs = append(msgs, e.errmsg)

3622 if e.code >= 500 {

3623 major = 5

3624 }

3625 }

3626 if same {

3627 xsmtpErrorf(e0.code, e0.secode, !serverError, "%s", strings.Join(msgs, "\n"))

3628 }

3629

3630 // Not all failures had the same error. We'll return each error on a separate line.

3631 lines := []string{}

3632 for _, e := range deliverErrors {

3633 s := fmt.Sprintf("%d %d.%s %s", e.code, e.code/100, e.secode, e.errmsg)

3634 lines = append(lines, s)

3635 }

3636 code := smtp.C451LocalErr

3637 secode := smtp.SeSys3Other0

3638 if major == 5 {

3639 code = smtp.C554TransactionFailed

3640 }

3641 lines = append(lines, "multiple errors")

3642 xsmtpErrorf(code, secode, !serverError, "%s", strings.Join(lines, "\n"))

3643 }

3644 // Generate one DSN for all failed recipients.

3645 if len(deliverErrors) > 0 {

3646 now := time.Now()

3647 dsnMsg := dsn.Message{

3648 SMTPUTF8: c.msgsmtputf8,

3649 From: smtp.Path{Localpart: "postmaster", IPDomain: deliverErrors[0].rcptTo.IPDomain},

3650 To: *c.mailFrom,

3651 Subject: "mail delivery failure",

3652 MessageID: mox.MessageIDGen(false),

3653 References: messageID,

3654

3655 // Per-message details.

3656 ReportingMTA: mox.Conf.Static.HostnameDomain.ASCII,

3657 ReceivedFromMTA: smtp.Ehlo{Name: c.hello, ConnIP: c.remoteIP},

3658 ArrivalDate: now,

3659 }

3660

3661 if len(deliverErrors) > 1 {

3662 dsnMsg.TextBody = "Multiple delivery failures occurred.\n\n"

3663 }

3664

3665 for _, e := range deliverErrors {

3666 kind := "Permanent"

3667 if e.code/100 == 4 {

3668 kind = "Transient"

3669 }

3670 dsnMsg.TextBody += fmt.Sprintf("%s delivery failure to:\n\n\t%s\n\nError:\n\n\t%s\n\n", kind, e.errmsg, e.rcptTo.XString(false))

3671 rcpt := dsn.Recipient{

3672 FinalRecipient: e.rcptTo,

3673 Action: dsn.Failed,

3674 Status: fmt.Sprintf("%d.%s", e.code/100, e.secode),

3675 LastAttemptDate: now,

3676 }

3677 dsnMsg.Recipients = append(dsnMsg.Recipients, rcpt)

3678 }

3679

3680 header, err := message.ReadHeaders(bufio.NewReader(&moxio.AtReader{R: dataFile}))

3681 if err != nil {

3682 c.log.Errorx("reading headers of incoming message for dsn, continuing dsn without headers", err)

3683 }

3684 dsnMsg.Original = header

3685

3686 if Localserve {

3687 c.log.Error("not queueing dsn for incoming delivery due to localserve")

3688 } else if err := queueDSN(context.TODO(), c.log, c, *c.mailFrom, dsnMsg, c.requireTLS != nil && *c.requireTLS); err != nil {

3689 metricServerErrors.WithLabelValues("queuedsn").Inc()

3690 c.log.Errorx("queuing DSN for incoming delivery, no DSN sent", err)

3691 }

3692 }

3693

3694 c.transactionGood++

3695 c.transactionBad-- // Compensate for early earlier pessimistic increase.

3696 c.rset()

3697 c.xwritecodeline(smtp.C250Completed, smtp.SeMailbox2Other0, "it is done", nil)

3698}

3699

3700// Return whether msgFrom address is allowed to send a message to alias.

3701func aliasAllowedMsgFrom(alias config.Alias, msgFrom smtp.Address) bool {

3702 for _, aa := range alias.ParsedAddresses {

3703 if aa.Address == msgFrom {

3704 return true

3705 }

3706 }

3707 lp, err := smtp.ParseLocalpart(alias.LocalpartStr)

3708 xcheckf(err, "parsing alias localpart")

3709 if msgFrom == smtp.NewAddress(lp, alias.Domain) {

3710 return alias.AllowMsgFrom

3711 }

3712 return alias.PostPublic

3713}

3714

3715// ecode returns either ecode, or a more specific error based on err.

3716// For example, ecode can be turned from an "other system" error into a "mail

3717// system full" if the error indicates no disk space is available.

3718func errCodes(code int, ecode string, err error) codes {

3719 switch {

3720 case moxio.IsStorageSpace(err):

3721 switch ecode {

3722 case smtp.SeMailbox2Other0:

3723 if code == smtp.C451LocalErr {

3724 code = smtp.C452StorageFull

3725 }

3726 ecode = smtp.SeMailbox2Full2

3727 case smtp.SeSys3Other0:

3728 if code == smtp.C451LocalErr {

3729 code = smtp.C452StorageFull

3730 }

3731 ecode = smtp.SeSys3StorageFull1

3732 }

3733 }

3734 return codes{code, ecode}

3735}

3736

3737// ../rfc/5321:2079

3738func (c *conn) cmdRset(p *parser) {

3739 // ../rfc/5321:2106

3740 p.xend()

3741

3742 c.rset()

3743 c.xbwritecodeline(smtp.C250Completed, smtp.SeOther00, "all clear", nil)

3744}

3745

3746// ../rfc/5321:2108 ../rfc/5321:1222

3747func (c *conn) cmdVrfy(p *parser) {

3748 // No EHLO/HELO needed.

3749 // ../rfc/5321:2448

3750

3751 // ../rfc/5321:2119 ../rfc/6531:641

3752 p.xspace()

3753 p.xstring()

3754 if p.space() {

3755 p.xtake("SMTPUTF8")

3756 }

3757 p.xend()

3758

3759 // todo future: we could support vrfy and expn for submission? though would need to see if its rfc defines it.

3760

3761 // ../rfc/5321:4239

3762 xsmtpUserErrorf(smtp.C252WithoutVrfy, smtp.SePol7Other0, "no verify but will try delivery")

3763}

3764

3765// ../rfc/5321:2135 ../rfc/5321:1272

3766func (c *conn) cmdExpn(p *parser) {

3767 // No EHLO/HELO needed.

3768 // ../rfc/5321:2448

3769

3770 // ../rfc/5321:2149 ../rfc/6531:645

3771 p.xspace()

3772 p.xstring()

3773 if p.space() {

3774 p.xtake("SMTPUTF8")

3775 }

3776 p.xend()

3777

3778 // todo: we could implement expn for local aliases for authenticated users, when members have permission to list. would anyone use it?

3779

3780 // ../rfc/5321:4239

3781 xsmtpUserErrorf(smtp.C252WithoutVrfy, smtp.SePol7Other0, "no expand but will try delivery")

3782}

3783

3784// ../rfc/5321:2151

3785func (c *conn) cmdHelp(p *parser) {

3786 // Let's not strictly parse the request for help. We are ignoring the text anyway.

3787 // ../rfc/5321:2166

3788

3789 c.xbwritecodeline(smtp.C214Help, smtp.SeOther00, "see rfc 5321 (smtp)", nil)

3790}

3791

3792// ../rfc/5321:2191

3793func (c *conn) cmdNoop(p *parser) {

3794 // No idea why, but if an argument follows, it must adhere to the string ABNF production...

3795 // ../rfc/5321:2203

3796 if p.space() {

3797 p.xstring()

3798 }

3799 p.xend()

3800

3801 c.xbwritecodeline(smtp.C250Completed, smtp.SeOther00, "alrighty", nil)

3802}

3803

3804// ../rfc/5321:2205

3805func (c *conn) cmdQuit(p *parser) {

3806 // ../rfc/5321:2226

3807 p.xend()

3808

3809 c.xwritecodeline(smtp.C221Closing, smtp.SeOther00, "okay thanks bye", nil)

3810 panic(cleanClose)

3811}

3812