1// Package smtpserver implements an SMTP server for submission and incoming delivery of mail messages.

2package smtpserver

4import (

5 "bufio"

6 "bytes"

7 "context"

8 "crypto/md5"

9 "crypto/rsa"

10 "crypto/sha1"

11 "crypto/sha256"

12 "crypto/tls"

13 "encoding/base64"

14 "errors"

15 "fmt"

16 "hash"

17 "io"

18 "math"

19 "net"

20 "os"

21 "runtime/debug"

22 "sort"

23 "strconv"

24 "strings"

25 "sync"

26 "time"

28 "golang.org/x/exp/maps"

30 "github.com/prometheus/client_golang/prometheus"

31 "github.com/prometheus/client_golang/prometheus/promauto"

33 "github.com/mjl-/bstore"

35 "github.com/mjl-/mox/config"

36 "github.com/mjl-/mox/dkim"

37 "github.com/mjl-/mox/dmarc"

38 "github.com/mjl-/mox/dmarcdb"

39 "github.com/mjl-/mox/dns"

40 "github.com/mjl-/mox/dsn"

41 "github.com/mjl-/mox/iprev"

42 "github.com/mjl-/mox/message"

43 "github.com/mjl-/mox/metrics"

44 "github.com/mjl-/mox/mlog"

45 "github.com/mjl-/mox/mox-"

46 "github.com/mjl-/mox/moxio"

47 "github.com/mjl-/mox/moxvar"

48 "github.com/mjl-/mox/publicsuffix"

49 "github.com/mjl-/mox/queue"

50 "github.com/mjl-/mox/ratelimit"

51 "github.com/mjl-/mox/scram"

52 "github.com/mjl-/mox/smtp"

53 "github.com/mjl-/mox/spf"

54 "github.com/mjl-/mox/store"

55 "github.com/mjl-/mox/tlsrptdb"

56)

58// Most logging should be done through conn.log* functions.

59// Only use log in contexts without connection.

60var xlog = mlog.New("smtpserver")

62// We use panic and recover for error handling while executing commands.

63// These errors signal the connection must be closed.

64var errIO = errors.New("fatal io error")

66// If set, regular delivery/submit is sidestepped, email is accepted and

67// delivered to the account named mox.

68var Localserve bool

70var limiterConnectionRate, limiterConnections *ratelimit.Limiter

72// For delivery rate limiting. Variable because changed during tests.

73var limitIPMasked1MessagesPerMinute int = 500

74var limitIPMasked1SizePerMinute int64 = 1000 * 1024 * 1024

76func init() {

77 // Also called by tests, so they don't trigger the rate limiter.

78 limitersInit()

79}

81func limitersInit() {

82 mox.LimitersInit()

83 // todo future: make these configurable

84 limiterConnectionRate = &ratelimit.Limiter{

85 WindowLimits: []ratelimit.WindowLimit{

86 {

87 Window: time.Minute,

88 Limits: [...]int64{300, 900, 2700},

89 },

90 },

91 }

92 limiterConnections = &ratelimit.Limiter{

93 WindowLimits: []ratelimit.WindowLimit{

94 {

95 Window: time.Duration(math.MaxInt64), // All of time.

96 Limits: [...]int64{30, 90, 270},

97 },

98 },

99 }

100}

101

102var (

103 // Delays for bad/suspicious behaviour. Zero during tests.

104 badClientDelay = time.Second // Before reads and after 1-byte writes for probably spammers.

105 authFailDelay = time.Second // Response to authentication failure.

106 unknownRecipientsDelay = 5 * time.Second // Response when all recipients are unknown.

107 firstTimeSenderDelayDefault = 15 * time.Second // Before accepting message from first-time sender.

108)

109

110type codes struct {

111 code int

112 secode string // Enhanced code, but without the leading major int from code.

113}

114

115var (

116 metricConnection = promauto.NewCounterVec(

117 prometheus.CounterOpts{

118 Name: "mox_smtpserver_connection_total",

119 Help: "Incoming SMTP connections.",

120 },

121 []string{

122 "kind", // "deliver" or "submit"

123 },

124 )

125 metricCommands = promauto.NewHistogramVec(

126 prometheus.HistogramOpts{

127 Name: "mox_smtpserver_command_duration_seconds",

128 Help: "SMTP server command duration and result codes in seconds.",

129 Buckets: []float64{0.001, 0.005, 0.01, 0.05, 0.100, 0.5, 1, 5, 10, 20, 30, 60, 120},

130 },

131 []string{

132 "kind", // "deliver" or "submit"

133 "cmd",

134 "code",

135 "ecode",

136 },

137 )

138 metricDelivery = promauto.NewCounterVec(

139 prometheus.CounterOpts{

140 Name: "mox_smtpserver_delivery_total",

141 Help: "SMTP incoming message delivery from external source, not submission. Result values: delivered, reject, unknownuser, accounterror, delivererror. Reason indicates why a message was rejected/accepted.",

142 },

143 []string{

144 "result",

145 "reason",

146 },

147 )

148 // Similar between ../webmail/webmail.go:/metricSubmission and ../smtpserver/server.go:/metricSubmission

149 metricSubmission = promauto.NewCounterVec(

150 prometheus.CounterOpts{

151 Name: "mox_smtpserver_submission_total",

152 Help: "SMTP server incoming submission results, known values (those ending with error are server errors): ok, badmessage, badfrom, badheader, messagelimiterror, recipientlimiterror, localserveerror, queueerror.",

153 },

154 []string{

155 "result",

156 },

157 )

158 metricServerErrors = promauto.NewCounterVec(

159 prometheus.CounterOpts{

160 Name: "mox_smtpserver_errors_total",

161 Help: "SMTP server errors, known values: dkimsign, queuedsn.",

162 },

163 []string{

164 "error",

165 },

166 )

167)

168

169var jitterRand = mox.NewRand()

170

171func durationDefault(delay *time.Duration, def time.Duration) time.Duration {

172 if delay == nil {

173 return def

174 }

175 return *delay

176}

177

178// Listen initializes network listeners for incoming SMTP connection.

179// The listeners are stored for a later call to Serve.

180func Listen() {

181 names := maps.Keys(mox.Conf.Static.Listeners)

182 sort.Strings(names)

183 for _, name := range names {

184 listener := mox.Conf.Static.Listeners[name]

185

186 var tlsConfig *tls.Config

187 if listener.TLS != nil {

188 tlsConfig = listener.TLS.Config

189 }

190

191 maxMsgSize := listener.SMTPMaxMessageSize

192 if maxMsgSize == 0 {

193 maxMsgSize = config.DefaultMaxMsgSize

194 }

195

196 if listener.SMTP.Enabled {

197 hostname := mox.Conf.Static.HostnameDomain

198 if listener.Hostname != "" {

199 hostname = listener.HostnameDomain

200 }

201 port := config.Port(listener.SMTP.Port, 25)

202 for _, ip := range listener.IPs {

203 firstTimeSenderDelay := durationDefault(listener.SMTP.FirstTimeSenderDelay, firstTimeSenderDelayDefault)

204 listen1("smtp", name, ip, port, hostname, tlsConfig, false, false, maxMsgSize, false, listener.SMTP.RequireSTARTTLS, listener.SMTP.DNSBLZones, firstTimeSenderDelay)

205 }

206 }

207 if listener.Submission.Enabled {

208 hostname := mox.Conf.Static.HostnameDomain

209 if listener.Hostname != "" {

210 hostname = listener.HostnameDomain

211 }

212 port := config.Port(listener.Submission.Port, 587)

213 for _, ip := range listener.IPs {

214 listen1("submission", name, ip, port, hostname, tlsConfig, true, false, maxMsgSize, !listener.Submission.NoRequireSTARTTLS, !listener.Submission.NoRequireSTARTTLS, nil, 0)

215 }

216 }

217

218 if listener.Submissions.Enabled {

219 hostname := mox.Conf.Static.HostnameDomain

220 if listener.Hostname != "" {

221 hostname = listener.HostnameDomain

222 }

223 port := config.Port(listener.Submissions.Port, 465)

224 for _, ip := range listener.IPs {

225 listen1("submissions", name, ip, port, hostname, tlsConfig, true, true, maxMsgSize, true, true, nil, 0)

226 }

227 }

228 }

229}

230

231var servers []func()

232

233func listen1(protocol, name, ip string, port int, hostname dns.Domain, tlsConfig *tls.Config, submission, xtls bool, maxMessageSize int64, requireTLSForAuth, requireTLSForDelivery bool, dnsBLs []dns.Domain, firstTimeSenderDelay time.Duration) {

234 addr := net.JoinHostPort(ip, fmt.Sprintf("%d", port))

235 if os.Getuid() == 0 {

236 xlog.Print("listening for smtp", mlog.Field("listener", name), mlog.Field("address", addr), mlog.Field("protocol", protocol))

237 }

238 network := mox.Network(ip)

239 ln, err := mox.Listen(network, addr)

240 if err != nil {

241 xlog.Fatalx("smtp: listen for smtp", err, mlog.Field("protocol", protocol), mlog.Field("listener", name))

242 }

243 if xtls {

244 ln = tls.NewListener(ln, tlsConfig)

245 }

246

247 serve := func() {

248 for {

249 conn, err := ln.Accept()

250 if err != nil {

251 xlog.Infox("smtp: accept", err, mlog.Field("protocol", protocol), mlog.Field("listener", name))

252 continue

253 }

254 resolver := dns.StrictResolver{} // By leaving Pkg empty, it'll be set by each package that uses the resolver, e.g. spf/dkim/dmarc.

255 go serve(name, mox.Cid(), hostname, tlsConfig, conn, resolver, submission, xtls, maxMessageSize, requireTLSForAuth, requireTLSForDelivery, dnsBLs, firstTimeSenderDelay)

256 }

257 }

258

259 servers = append(servers, serve)

260}

261

262// Serve starts serving on all listeners, launching a goroutine per listener.

263func Serve() {

264 for _, serve := range servers {

265 go serve()

266 }

267}

268

269type conn struct {

270 cid int64

271

272 // OrigConn is the original (TCP) connection. We'll read from/write to conn, which

273 // can be wrapped in a tls.Server. We close origConn instead of conn because

274 // closing the TLS connection would send a TLS close notification, which may block

275 // for 5s if the server isn't reading it (because it is also sending it).

276 origConn net.Conn

277 conn net.Conn

278

279 tls bool

280 resolver dns.Resolver

281 r *bufio.Reader

282 w *bufio.Writer

283 tr *moxio.TraceReader // Kept for changing trace level during cmd/auth/data.

284 tw *moxio.TraceWriter

285 slow bool // If set, reads are done with a 1 second sleep, and writes are done 1 byte at a time, to keep spammers busy.

286 lastlog time.Time // Used for printing the delta time since the previous logging for this connection.

287 submission bool // ../rfc/6409:19 applies

288 tlsConfig *tls.Config

289 localIP net.IP

290 remoteIP net.IP

291 hostname dns.Domain

292 log *mlog.Log

293 maxMessageSize int64

294 requireTLSForAuth bool

295 requireTLSForDelivery bool

296 cmd string // Current command.

297 cmdStart time.Time // Start of current command.

298 ncmds int // Number of commands processed. Used to abort connection when first incoming command is unknown/invalid.

299 dnsBLs []dns.Domain

300 firstTimeSenderDelay time.Duration

301

302 // If non-zero, taken into account during Read and Write. Set while processing DATA

303 // command, we don't want the entire delivery to take too long.

304 deadline time.Time

305

306 hello dns.IPDomain // Claimed remote name. Can be ip address for ehlo.

307 ehlo bool // If set, we had EHLO instead of HELO.

308

309 authFailed int // Number of failed auth attempts. For slowing down remote with many failures.

310 username string // Only when authenticated.

311 account *store.Account // Only when authenticated.

312

313 // We track good/bad message transactions to disconnect spammers trying to guess addresses.

314 transactionGood int

315 transactionBad int

316

317 // Message transaction.

318 mailFrom *smtp.Path

319 has8bitmime bool // If MAIL FROM parameter BODY=8BITMIME was sent. Required for SMTPUTF8.

320 smtputf8 bool // todo future: we should keep track of this per recipient. perhaps only a specific recipient requires smtputf8, e.g. due to a utf8 localpart. we should decide ourselves if the message needs smtputf8, e.g. due to utf8 header values.

321 recipients []rcptAccount

322}

323

324type rcptAccount struct {

325 rcptTo smtp.Path

326 local bool // Whether recipient is a local user.

327

328 // Only valid for local delivery.

329 accountName string

330 destination config.Destination

331 canonicalAddress string // Optional catchall part stripped and/or lowercased.

332}

333

334func isClosed(err error) bool {

335 return errors.Is(err, errIO) || moxio.IsClosed(err)

336}

337

338// completely reset connection state as if greeting has just been sent.

339// ../rfc/3207:210

340func (c *conn) reset() {

341 c.ehlo = false

342 c.hello = dns.IPDomain{}

343 c.username = ""

344 if c.account != nil {

345 err := c.account.Close()

346 c.log.Check(err, "closing account")

347 }

348 c.account = nil

349 c.rset()

350}

351

352// for rset command, and a few more cases that reset the mail transaction state.

353// ../rfc/5321:2502

354func (c *conn) rset() {

355 c.mailFrom = nil

356 c.has8bitmime = false

357 c.smtputf8 = false

358 c.recipients = nil

359}

360

361func (c *conn) earliestDeadline(d time.Duration) time.Time {

362 e := time.Now().Add(d)

363 if !c.deadline.IsZero() && c.deadline.Before(e) {

364 return c.deadline

365 }

366 return e

367}

368

369func (c *conn) xcheckAuth() {

370 if c.submission && c.account == nil {

371 // ../rfc/4954:623

372 xsmtpUserErrorf(smtp.C530SecurityRequired, smtp.SePol7Other0, "authentication required")

373 }

374}

375

376func (c *conn) xtrace(level mlog.Level) func() {

377 c.xflush()

378 c.tr.SetTrace(level)

379 c.tw.SetTrace(level)

380 return func() {

381 c.xflush()

382 c.tr.SetTrace(mlog.LevelTrace)

383 c.tw.SetTrace(mlog.LevelTrace)

384 }

385}

386

387// setSlow marks the connection slow (or now), so reads are done with 3 second

388// delay for each read, and writes are done at 1 byte per second, to try to slow

389// down spammers.

390func (c *conn) setSlow(on bool) {

391 if on && !c.slow {

392 c.log.Debug("connection changed to slow")

393 } else if !on && c.slow {

394 c.log.Debug("connection restored to regular pace")

395 }

396 c.slow = on

397}

398

399// Write writes to the connection. It panics on i/o errors, which is handled by the

400// connection command loop.

401func (c *conn) Write(buf []byte) (int, error) {

402 chunk := len(buf)

403 if c.slow {

404 chunk = 1

405 }

406

407 var n int

408 for len(buf) > 0 {

409 // We set a single deadline for Write and Read. This may be a TLS connection.

410 // SetDeadline works on the underlying connection. If we wouldn't touch the read

411 // deadline, and only set the write deadline and do a bunch of writes, the TLS

412 // library would still have to do reads on the underlying connection, and may reach

413 // a read deadline that was set for some earlier read.

414 if err := c.conn.SetDeadline(c.earliestDeadline(30 * time.Second)); err != nil {

415 c.log.Errorx("setting deadline for write", err)

416 }

417

418 nn, err := c.conn.Write(buf[:chunk])

419 if err != nil {

420 panic(fmt.Errorf("write: %s (%w)", err, errIO))

421 }

422 n += nn

423 buf = buf[chunk:]

424 if len(buf) > 0 && badClientDelay > 0 {

425 mox.Sleep(mox.Context, badClientDelay)

426 }

427 }

428 return n, nil

429}

430

431// Read reads from the connection. It panics on i/o errors, which is handled by the

432// connection command loop.

433func (c *conn) Read(buf []byte) (int, error) {

434 if c.slow && badClientDelay > 0 {

435 mox.Sleep(mox.Context, badClientDelay)

436 }

437

438 // todo future: make deadline configurable for callers, and through config file? ../rfc/5321:3610 ../rfc/6409:492

439 // See comment about Deadline instead of individual read/write deadlines at Write.

440 if err := c.conn.SetDeadline(c.earliestDeadline(30 * time.Second)); err != nil {

441 c.log.Errorx("setting deadline for read", err)

442 }

443

444 n, err := c.conn.Read(buf)

445 if err != nil {

446 panic(fmt.Errorf("read: %s (%w)", err, errIO))

447 }

448 return n, err

449}

450

451// Cache of line buffers for reading commands.

452// Filled on demand.

453var bufpool = moxio.NewBufpool(8, 2*1024)

454

455func (c *conn) readline() string {

456 line, err := bufpool.Readline(c.r)

457 if err != nil && errors.Is(err, moxio.ErrLineTooLong) {

458 c.writecodeline(smtp.C500BadSyntax, smtp.SeProto5Other0, "line too long, smtp max is 512, we reached 2048", nil)

459 panic(fmt.Errorf("%s (%w)", err, errIO))

460 } else if err != nil {

461 panic(fmt.Errorf("%s (%w)", err, errIO))

462 }

463 return line

464}

465

466// Buffered-write command response line to connection with codes and msg.

467// Err is not sent to remote but is used for logging and can be empty.

468func (c *conn) bwritecodeline(code int, secode string, msg string, err error) {

469 var ecode string

470 if secode != "" {

471 ecode = fmt.Sprintf("%d.%s", code/100, secode)

472 }

473 metricCommands.WithLabelValues(c.kind(), c.cmd, fmt.Sprintf("%d", code), ecode).Observe(float64(time.Since(c.cmdStart)) / float64(time.Second))

474 c.log.Debugx("smtp command result", err, mlog.Field("kind", c.kind()), mlog.Field("cmd", c.cmd), mlog.Field("code", fmt.Sprintf("%d", code)), mlog.Field("ecode", ecode), mlog.Field("duration", time.Since(c.cmdStart)))

475

476 var sep string

477 if ecode != "" {

478 sep = " "

479 }

480

481 // Separate by newline and wrap long lines.

482 lines := strings.Split(msg, "\n")

483 for i, line := range lines {

484 // ../rfc/5321:3506 ../rfc/5321:2583 ../rfc/5321:2756

485 var prelen = 3 + 1 + len(ecode) + len(sep)

486 for prelen+len(line) > 510 {

487 e := 510 - prelen

488 for ; e > 400 && line[e] != ' '; e-- {

489 }

490 // todo future: understand if ecode should be on each line. won't hurt. at least as long as we don't do expn or vrfy.

491 c.bwritelinef("%d-%s%s%s", code, ecode, sep, line[:e])

492 line = line[e:]

493 }

494 spdash := " "

495 if i < len(lines)-1 {

496 spdash = "-"

497 }

498 c.bwritelinef("%d%s%s%s%s", code, spdash, ecode, sep, line)

499 }

500}

501

502// Buffered-write a formatted response line to connection.

503func (c *conn) bwritelinef(format string, args ...any) {

504 msg := fmt.Sprintf(format, args...)

505 fmt.Fprint(c.w, msg+"\r\n")

506}

507

508// Flush pending buffered writes to connection.

509func (c *conn) xflush() {

510 c.w.Flush() // Errors will have caused a panic in Write.

511}

512

513// Write (with flush) a response line with codes and message. err is not written, used for logging and can be nil.

514func (c *conn) writecodeline(code int, secode string, msg string, err error) {

515 c.bwritecodeline(code, secode, msg, err)

516 c.xflush()

517}

518

519// Write (with flush) a formatted response line to connection.

520func (c *conn) writelinef(format string, args ...any) {

521 c.bwritelinef(format, args...)

522 c.xflush()

523}

524

525var cleanClose struct{} // Sentinel value for panic/recover indicating clean close of connection.

526

527func serve(listenerName string, cid int64, hostname dns.Domain, tlsConfig *tls.Config, nc net.Conn, resolver dns.Resolver, submission, tls bool, maxMessageSize int64, requireTLSForAuth, requireTLSForDelivery bool, dnsBLs []dns.Domain, firstTimeSenderDelay time.Duration) {

528 var localIP, remoteIP net.IP

529 if a, ok := nc.LocalAddr().(*net.TCPAddr); ok {

530 localIP = a.IP

531 } else {

532 // For net.Pipe, during tests.

533 localIP = net.ParseIP("127.0.0.10")

534 }

535 if a, ok := nc.RemoteAddr().(*net.TCPAddr); ok {

536 remoteIP = a.IP

537 } else {

538 // For net.Pipe, during tests.

539 remoteIP = net.ParseIP("127.0.0.10")

540 }

541

542 c := &conn{

543 cid: cid,

544 origConn: nc,

545 conn: nc,

546 submission: submission,

547 tls: tls,

548 resolver: resolver,

549 lastlog: time.Now(),

550 tlsConfig: tlsConfig,

551 localIP: localIP,

552 remoteIP: remoteIP,

553 hostname: hostname,

554 maxMessageSize: maxMessageSize,

555 requireTLSForAuth: requireTLSForAuth,

556 requireTLSForDelivery: requireTLSForDelivery,

557 dnsBLs: dnsBLs,

558 firstTimeSenderDelay: firstTimeSenderDelay,

559 }

560 c.log = xlog.MoreFields(func() []mlog.Pair {

561 now := time.Now()

562 l := []mlog.Pair{

563 mlog.Field("cid", c.cid),

564 mlog.Field("delta", now.Sub(c.lastlog)),

565 }

566 c.lastlog = now

567 if c.username != "" {

568 l = append(l, mlog.Field("username", c.username))

569 }

570 return l

571 })

572 c.tr = moxio.NewTraceReader(c.log, "RC: ", c)

573 c.tw = moxio.NewTraceWriter(c.log, "LS: ", c)

574 c.r = bufio.NewReader(c.tr)

575 c.w = bufio.NewWriter(c.tw)

576

577 metricConnection.WithLabelValues(c.kind()).Inc()

578 c.log.Info("new connection", mlog.Field("remote", c.conn.RemoteAddr()), mlog.Field("local", c.conn.LocalAddr()), mlog.Field("submission", submission), mlog.Field("tls", tls), mlog.Field("listener", listenerName))

579

580 defer func() {

581 c.origConn.Close() // Close actual TCP socket, regardless of TLS on top.

582 c.conn.Close() // If TLS, will try to write alert notification to already closed socket, returning error quickly.

583

584 if c.account != nil {

585 err := c.account.Close()

586 c.log.Check(err, "closing account")

587 c.account = nil

588 }

589

590 x := recover()

591 if x == nil || x == cleanClose {

592 c.log.Info("connection closed")

593 } else if err, ok := x.(error); ok && isClosed(err) {

594 c.log.Infox("connection closed", err)

595 } else {

596 c.log.Error("unhandled panic", mlog.Field("err", x))

597 debug.PrintStack()

598 metrics.PanicInc(metrics.Smtpserver)

599 }

600 }()

601

602 select {

603 case <-mox.Shutdown.Done():

604 // ../rfc/5321:2811 ../rfc/5321:1666 ../rfc/3463:420

605 c.writecodeline(smtp.C421ServiceUnavail, smtp.SeSys3NotAccepting2, "shutting down", nil)

606 return

607 default:

608 }

609

610 if !limiterConnectionRate.Add(c.remoteIP, time.Now(), 1) {

611 c.writecodeline(smtp.C421ServiceUnavail, smtp.SePol7Other0, "connection rate from your ip or network too high, slow down please", nil)

612 return

613 }

614

615 // If remote IP/network resulted in too many authentication failures, refuse to serve.

616 if submission && !mox.LimiterFailedAuth.CanAdd(c.remoteIP, time.Now(), 1) {

617 metrics.AuthenticationRatelimitedInc("submission")

618 c.log.Debug("refusing connection due to many auth failures", mlog.Field("remoteip", c.remoteIP))

619 c.writecodeline(smtp.C421ServiceUnavail, smtp.SePol7Other0, "too many auth failures", nil)

620 return

621 }

622

623 if !limiterConnections.Add(c.remoteIP, time.Now(), 1) {

624 c.log.Debug("refusing connection due to many open connections", mlog.Field("remoteip", c.remoteIP))

625 c.writecodeline(smtp.C421ServiceUnavail, smtp.SePol7Other0, "too many open connections from your ip or network", nil)

626 return

627 }

628 defer limiterConnections.Add(c.remoteIP, time.Now(), -1)

629

630 // We register and unregister the original connection, in case c.conn is replaced

631 // with a TLS connection later on.

632 mox.Connections.Register(nc, "smtp", listenerName)

633 defer mox.Connections.Unregister(nc)

634

635 // ../rfc/5321:964 ../rfc/5321:4294 about announcing software and version

636 // Syntax: ../rfc/5321:2586

637 // We include the string ESMTP. https://cr.yp.to/smtp/greeting.html recommends it.

638 // Should not be too relevant nowadays, but does not hurt and default blackbox

639 // exporter SMTP health check expects it.

640 c.writelinef("%d %s ESMTP mox %s", smtp.C220ServiceReady, c.hostname.ASCII, moxvar.Version)

641

642 for {

643 command(c)

644

645 // If another command is present, don't flush our buffered response yet. Holding

646 // off will cause us to respond with a single packet.

647 n := c.r.Buffered()

648 if n > 0 {

649 buf, err := c.r.Peek(n)

650 if err == nil && bytes.IndexByte(buf, '\n') >= 0 {

651 continue

652 }

653 }

654 c.xflush()

655 }

656}

657

658var commands = map[string]func(c *conn, p *parser){

659 "helo": (*conn).cmdHelo,

660 "ehlo": (*conn).cmdEhlo,

661 "starttls": (*conn).cmdStarttls,

662 "auth": (*conn).cmdAuth,

663 "mail": (*conn).cmdMail,

664 "rcpt": (*conn).cmdRcpt,

665 "data": (*conn).cmdData,

666 "rset": (*conn).cmdRset,

667 "vrfy": (*conn).cmdVrfy,

668 "expn": (*conn).cmdExpn,

669 "help": (*conn).cmdHelp,

670 "noop": (*conn).cmdNoop,

671 "quit": (*conn).cmdQuit,

672}

673

674func command(c *conn) {

675 defer func() {

676 x := recover()

677 if x == nil {

678 return

679 }

680 err, ok := x.(error)

681 if !ok {

682 panic(x)

683 }

684

685 if isClosed(err) {

686 panic(err)

687 }

688

689 var serr smtpError

690 if errors.As(err, &serr) {

691 c.writecodeline(serr.code, serr.secode, fmt.Sprintf("%s (%s)", serr.errmsg, mox.ReceivedID(c.cid)), serr.err)

692 if serr.printStack {

693 debug.PrintStack()

694 }

695 } else {

696 // Other type of panic, we pass it on, aborting the connection.

697 c.log.Errorx("command panic", err)

698 panic(err)

699 }

700 }()

701

702 // todo future: we could wait for either a line or shutdown, and just close the connection on shutdown.

703

704 line := c.readline()

705 t := strings.SplitN(line, " ", 2)

706 var args string

707 if len(t) == 2 {

708 args = " " + t[1]

709 }

710 cmd := t[0]

711 cmdl := strings.ToLower(cmd)

712

713 // todo future: should we return an error for lines that are too long? perhaps for submission or in a pedantic mode. we would have to take extensions for MAIL into account. ../rfc/5321:3500 ../rfc/5321:3552

714

715 select {

716 case <-mox.Shutdown.Done():

717 // ../rfc/5321:2811 ../rfc/5321:1666 ../rfc/3463:420

718 c.writecodeline(smtp.C421ServiceUnavail, smtp.SeSys3NotAccepting2, "shutting down", nil)

719 panic(errIO)

720 default:

721 }

722

723 c.cmd = cmdl

724 c.cmdStart = time.Now()

725

726 p := newParser(args, c.smtputf8, c)

727 fn, ok := commands[cmdl]

728 if !ok {

729 c.cmd = "(unknown)"

730 if c.ncmds == 0 {

731 // Other side is likely speaking something else than SMTP, send error message and

732 // stop processing because there is a good chance whatever they sent has multiple

733 // lines.

734 c.writecodeline(smtp.C500BadSyntax, smtp.SeProto5Syntax2, "please try again speaking smtp", nil)

735 panic(errIO)

736 }

737 // note: not "command not implemented", see ../rfc/5321:2934 ../rfc/5321:2539

738 xsmtpUserErrorf(smtp.C500BadSyntax, smtp.SeProto5BadCmdOrSeq1, "unknown command")

739 }

740 c.ncmds++

741 fn(c, p)

742}

743

744// For use in metric labels.

745func (c *conn) kind() string {

746 if c.submission {

747 return "submission"

748 }

749 return "smtp"

750}

751

752func (c *conn) xneedHello() {

753 if c.hello.IsZero() {

754 xsmtpUserErrorf(smtp.C503BadCmdSeq, smtp.SeProto5BadCmdOrSeq1, "no ehlo/helo yet")

755 }

756}

757

758// If smtp server is configured to require TLS for all mail delivery, abort command.

759func (c *conn) xneedTLSForDelivery() {

760 if c.requireTLSForDelivery && !c.tls {

761 // ../rfc/3207:148

762 xsmtpUserErrorf(smtp.C530SecurityRequired, smtp.SePol7Other0, "STARTTLS required for mail delivery")

763 }

764}

765

766func (c *conn) cmdHelo(p *parser) {

767 c.cmdHello(p, false)

768}

769

770func (c *conn) cmdEhlo(p *parser) {

771 c.cmdHello(p, true)

772}

773

774// ../rfc/5321:1783

775func (c *conn) cmdHello(p *parser, ehlo bool) {

776 var remote dns.IPDomain

777 if c.submission && !moxvar.Pedantic {

778 // Mail clients regularly put bogus information in the hostname/ip. For submission,

779 // the value is of no use, so there is not much point in annoying the user with

780 // errors they cannot fix themselves. Except when in pedantic mode.

781 remote = dns.IPDomain{IP: c.remoteIP}

782 } else {

783 p.xspace()

784 if ehlo {

785 remote = p.xipdomain(true)

786 } else {

787 remote = dns.IPDomain{Domain: p.xdomain()}

788

789 // Verify a remote domain name has an A or AAAA record, CNAME not allowed. ../rfc/5321:722

790 cidctx := context.WithValue(mox.Context, mlog.CidKey, c.cid)

791 ctx, cancel := context.WithTimeout(cidctx, time.Minute)

792 _, err := c.resolver.LookupIPAddr(ctx, remote.Domain.ASCII+".")

793 cancel()

794 if dns.IsNotFound(err) {

795 xsmtpUserErrorf(smtp.C550MailboxUnavail, smtp.SeProto5Other0, "your ehlo domain does not resolve to an IP address")

796 }

797 // For success or temporary resolve errors, we'll just continue.

798 }

799 // ../rfc/5321:1827

800 // Though a few paragraphs earlier is a claim additional data can occur for address

801 // literals (IP addresses), although the ABNF in that document does not allow it.

802 // We allow additional text, but only if space-separated.

803 if len(remote.IP) > 0 && p.space() {

804 p.remainder() // ../rfc/5321:1802 ../rfc/2821:1632

805 }

806 p.xend()

807 }

808

809 // Reset state as if RSET command has been issued. ../rfc/5321:2093 ../rfc/5321:2453

810 c.rset()

811

812 c.ehlo = ehlo

813 c.hello = remote

814

815 // https://www.iana.org/assignments/mail-parameters/mail-parameters.xhtml

816

817 c.bwritelinef("250-%s", c.hostname.ASCII)

818 c.bwritelinef("250-PIPELINING") // ../rfc/2920:108

819 c.bwritelinef("250-SIZE %d", c.maxMessageSize) // ../rfc/1870:70

820 // ../rfc/3207:237

821 if !c.tls && c.tlsConfig != nil {

822 // ../rfc/3207:90

823 c.bwritelinef("250-STARTTLS")

824 }

825 if c.submission {

826 // ../rfc/4954:123

827 if c.tls || !c.requireTLSForAuth {

828 c.bwritelinef("250-AUTH SCRAM-SHA-256 SCRAM-SHA-1 CRAM-MD5 PLAIN")

829 } else {

830 c.bwritelinef("250-AUTH ")

831 }

832 }

833 c.bwritelinef("250-ENHANCEDSTATUSCODES") // ../rfc/2034:71

834 // todo future? c.writelinef("250-DSN")

835 c.bwritelinef("250-8BITMIME") // ../rfc/6152:86

836 c.bwritecodeline(250, "", "SMTPUTF8", nil) // ../rfc/6531:201

837 c.xflush()

838}

839

840// ../rfc/3207:96

841func (c *conn) cmdStarttls(p *parser) {

842 c.xneedHello()

843 p.xend()

844

845 if c.tls {

846 // ../rfc/3207:235

847 xsmtpUserErrorf(smtp.C503BadCmdSeq, smtp.SeProto5BadCmdOrSeq1, "already speaking tls")

848 }

849 if c.account != nil {

850 xsmtpUserErrorf(smtp.C503BadCmdSeq, smtp.SeProto5BadCmdOrSeq1, "cannot starttls after authentication")

851 }

852

853 // We don't want to do TLS on top of c.r because it also prints protocol traces: We

854 // don't want to log the TLS stream. So we'll do TLS on the underlying connection,

855 // but make sure any bytes already read and in the buffer are used for the TLS

856 // handshake.

857 conn := c.conn

858 if n := c.r.Buffered(); n > 0 {

859 conn = &moxio.PrefixConn{

860 PrefixReader: io.LimitReader(c.r, int64(n)),

861 Conn: conn,

862 }

863 }

864

865 c.writecodeline(smtp.C220ServiceReady, smtp.SeOther00, "go!", nil)

866 tlsConn := tls.Server(conn, c.tlsConfig)

867 cidctx := context.WithValue(mox.Context, mlog.CidKey, c.cid)

868 ctx, cancel := context.WithTimeout(cidctx, time.Minute)

869 defer cancel()

870 c.log.Debug("starting tls server handshake")

871 if err := tlsConn.HandshakeContext(ctx); err != nil {

872 panic(fmt.Errorf("starttls handshake: %s (%w)", err, errIO))

873 }

874 cancel()

875 tlsversion, ciphersuite := mox.TLSInfo(tlsConn)

876 c.log.Debug("tls server handshake done", mlog.Field("tls", tlsversion), mlog.Field("ciphersuite", ciphersuite))

877 c.conn = tlsConn

878 c.tr = moxio.NewTraceReader(c.log, "RC: ", c)

879 c.tw = moxio.NewTraceWriter(c.log, "LS: ", c)

880 c.r = bufio.NewReader(c.tr)

881 c.w = bufio.NewWriter(c.tw)

882

883 c.reset() // ../rfc/3207:210

884 c.tls = true

885}

886

887// ../rfc/4954:139

888func (c *conn) cmdAuth(p *parser) {

889 c.xneedHello()

890

891 if !c.submission {

892 xsmtpUserErrorf(smtp.C503BadCmdSeq, smtp.SeProto5BadCmdOrSeq1, "authentication only allowed on submission ports")

893 }

894 if c.account != nil {

895 // ../rfc/4954:152

896 xsmtpUserErrorf(smtp.C503BadCmdSeq, smtp.SeProto5BadCmdOrSeq1, "already authenticated")

897 }

898 if c.mailFrom != nil {

899 // ../rfc/4954:157

900 xsmtpUserErrorf(smtp.C503BadCmdSeq, smtp.SeProto5BadCmdOrSeq1, "authentication not allowed during mail transaction")

901 }

902

903 // todo future: we may want to normalize usernames and passwords, see stringprep in ../rfc/4013:38 and possibly newer mechanisms (though they are opt-in and that may not have happened yet).

904

905 // For many failed auth attempts, slow down verification attempts.

906 // Dropping the connection could also work, but more so when we have a connection rate limiter.

907 // ../rfc/4954:770

908 if c.authFailed > 3 && authFailDelay > 0 {

909 // ../rfc/4954:770

910 mox.Sleep(mox.Context, time.Duration(c.authFailed-3)*authFailDelay)

911 }

912 c.authFailed++ // Compensated on success.

913 defer func() {

914 // On the 3rd failed authentication, start responding slowly. Successful auth will

915 // cause fast responses again.

916 if c.authFailed >= 3 {

917 c.setSlow(true)

918 }

919 }()

920

921 var authVariant string

922 authResult := "error"

923 defer func() {

924 metrics.AuthenticationInc("submission", authVariant, authResult)

925 switch authResult {

926 case "ok":

927 mox.LimiterFailedAuth.Reset(c.remoteIP, time.Now())

928 default:

929 mox.LimiterFailedAuth.Add(c.remoteIP, time.Now(), 1)

930 }

931 }()

932

933 // todo: implement "AUTH LOGIN"? it looks like PLAIN, but without the continuation. it is an obsolete sasl mechanism. an account in desktop outlook appears to go through the cloud, attempting to submit email only with unadvertised and AUTH LOGIN. it appears they don't know "plain".

934

935 // ../rfc/4954:699

936 p.xspace()

937 mech := p.xsaslMech()

938

939 xreadInitial := func() []byte {

940 var auth string

941 if p.empty() {

942 c.writelinef("%d ", smtp.C334ContinueAuth) // ../rfc/4954:205

943 // todo future: handle max length of 12288 octets and return proper responde codes otherwise ../rfc/4954:253

944 auth = c.readline()

945 if auth == "*" {

946 // ../rfc/4954:193

947 authResult = "aborted"

948 xsmtpUserErrorf(smtp.C501BadParamSyntax, smtp.SeProto5Other0, "authentication aborted")

949 }

950 } else {

951 p.xspace()

952 auth = p.remainder()

953 if auth == "" {

954 // ../rfc/4954:235

955 xsmtpUserErrorf(smtp.C501BadParamSyntax, smtp.SeProto5Syntax2, "missing initial auth base64 parameter after space")

956 } else if auth == "=" {

957 // ../rfc/4954:214

958 auth = "" // Base64 decode below will result in empty buffer.

959 }

960 }

961 buf, err := base64.StdEncoding.DecodeString(auth)

962 if err != nil {

963 // ../rfc/4954:235

964 xsmtpUserErrorf(smtp.C501BadParamSyntax, smtp.SeProto5Syntax2, "invalid base64: %s", err)

965 }

966 return buf

967 }

968

969 xreadContinuation := func() []byte {

970 line := c.readline()

971 if line == "*" {

972 authResult = "aborted"

973 xsmtpUserErrorf(smtp.C501BadParamSyntax, smtp.SeProto5Other0, "authentication aborted")

974 }

975 buf, err := base64.StdEncoding.DecodeString(line)

976 if err != nil {

977 // ../rfc/4954:235

978 xsmtpUserErrorf(smtp.C501BadParamSyntax, smtp.SeProto5Syntax2, "invalid base64: %s", err)

979 }

980 return buf

981 }

982

983 switch mech {

984 case "PLAIN":

985 authVariant = "plain"

986

987 // ../rfc/4954:343

988 // ../rfc/4954:326

989 if !c.tls && c.requireTLSForAuth {

990 xsmtpUserErrorf(smtp.C538EncReqForAuth, smtp.SePol7EncReqForAuth11, "authentication requires tls")

991 }

992

993 // Password is in line in plain text, so hide it.

994 defer c.xtrace(mlog.LevelTraceauth)()

995 buf := xreadInitial()

996 c.xtrace(mlog.LevelTrace) // Restore.

997 plain := bytes.Split(buf, []byte{0})

998 if len(plain) != 3 {

999 xsmtpUserErrorf(smtp.C501BadParamSyntax, smtp.SeProto5BadParams4, "auth data should have 3 nul-separated tokens, got %d", len(plain))

1000 }

1001 authz := string(plain[0])

1002 authc := string(plain[1])

1003 password := string(plain[2])

1004

1005 if authz != "" && authz != authc {

1006 authResult = "badcreds"

1007 xsmtpUserErrorf(smtp.C535AuthBadCreds, smtp.SePol7AuthBadCreds8, "cannot assume other role")

1008 }

1009

1010 acc, err := store.OpenEmailAuth(authc, password)

1011 if err != nil && errors.Is(err, store.ErrUnknownCredentials) {

1012 // ../rfc/4954:274

1013 authResult = "badcreds"

1014 c.log.Info("failed authentication attempt", mlog.Field("username", authc), mlog.Field("remote", c.remoteIP))

1015 xsmtpUserErrorf(smtp.C535AuthBadCreds, smtp.SePol7AuthBadCreds8, "bad user/pass")

1016 }

1017 xcheckf(err, "verifying credentials")

1018

1019 authResult = "ok"

1020 c.authFailed = 0

1021 c.setSlow(false)

1022 c.account = acc

1023 c.username = authc

1024 // ../rfc/4954:276

1025 c.writecodeline(smtp.C235AuthSuccess, smtp.SePol7Other0, "nice", nil)

1026

1027 case "CRAM-MD5":

1028 authVariant = strings.ToLower(mech)

1029

1030 p.xempty()

1031

1032 // ../rfc/2195:82

1033 chal := fmt.Sprintf("<%d.%d@%s>", uint64(mox.CryptoRandInt()), time.Now().UnixNano(), mox.Conf.Static.HostnameDomain.ASCII)

1034 c.writelinef("%d %s", smtp.C334ContinueAuth, base64.StdEncoding.EncodeToString([]byte(chal)))

1035

1036 resp := xreadContinuation()

1037 t := strings.Split(string(resp), " ")

1038 if len(t) != 2 || len(t[1]) != 2*md5.Size {

1039 xsmtpUserErrorf(smtp.C501BadParamSyntax, smtp.SeProto5BadParams4, "malformed cram-md5 response")

1040 }

1041 addr := t[0]

1042 c.log.Debug("cram-md5 auth", mlog.Field("address", addr))

1043 acc, _, err := store.OpenEmail(addr)

1044 if err != nil {

1045 if errors.Is(err, store.ErrUnknownCredentials) {

1046 c.log.Info("failed authentication attempt", mlog.Field("username", addr), mlog.Field("remote", c.remoteIP))

1047 xsmtpUserErrorf(smtp.C535AuthBadCreds, smtp.SePol7AuthBadCreds8, "bad user/pass")

1048 }

1049 }

1050 xcheckf(err, "looking up address")

1051 defer func() {

1052 if acc != nil {

1053 err := acc.Close()

1054 c.log.Check(err, "closing account")

1055 }

1056 }()

1057 var ipadhash, opadhash hash.Hash

1058 acc.WithRLock(func() {

1059 err := acc.DB.Read(context.TODO(), func(tx *bstore.Tx) error {

1060 password, err := bstore.QueryTx[store.Password](tx).Get()

1061 if err == bstore.ErrAbsent {

1062 c.log.Info("failed authentication attempt", mlog.Field("username", addr), mlog.Field("remote", c.remoteIP))

1063 xsmtpUserErrorf(smtp.C535AuthBadCreds, smtp.SePol7AuthBadCreds8, "bad user/pass")

1064 }

1065 if err != nil {

1066 return err

1067 }

1068

1069 ipadhash = password.CRAMMD5.Ipad

1070 opadhash = password.CRAMMD5.Opad

1071 return nil

1072 })

1073 xcheckf(err, "tx read")

1074 })

1075 if ipadhash == nil || opadhash == nil {

1076 c.log.Info("cram-md5 auth attempt without derived secrets set, save password again to store secrets", mlog.Field("username", addr))

1077 c.log.Info("failed authentication attempt", mlog.Field("username", addr), mlog.Field("remote", c.remoteIP))

1078 xsmtpUserErrorf(smtp.C535AuthBadCreds, smtp.SePol7AuthBadCreds8, "bad user/pass")

1079 }

1080

1081 // ../rfc/2195:138 ../rfc/2104:142

1082 ipadhash.Write([]byte(chal))

1083 opadhash.Write(ipadhash.Sum(nil))

1084 digest := fmt.Sprintf("%x", opadhash.Sum(nil))

1085 if digest != t[1] {

1086 c.log.Info("failed authentication attempt", mlog.Field("username", addr), mlog.Field("remote", c.remoteIP))

1087 xsmtpUserErrorf(smtp.C535AuthBadCreds, smtp.SePol7AuthBadCreds8, "bad user/pass")

1088 }

1089

1090 authResult = "ok"

1091 c.authFailed = 0

1092 c.setSlow(false)

1093 c.account = acc

1094 acc = nil // Cancel cleanup.

1095 c.username = addr

1096 // ../rfc/4954:276

1097 c.writecodeline(smtp.C235AuthSuccess, smtp.SePol7Other0, "nice", nil)

1098

1099 case "SCRAM-SHA-1", "SCRAM-SHA-256":

1100 // todo: improve handling of errors during scram. e.g. invalid parameters. should we abort the imap command, or continue until the end and respond with a scram-level error?

1101 // todo: use single implementation between ../imapserver/server.go and ../smtpserver/server.go

1102

1103 authVariant = strings.ToLower(mech)

1104 var h func() hash.Hash

1105 if authVariant == "scram-sha-1" {

1106 h = sha1.New

1107 } else {

1108 h = sha256.New

1109 }

1110

1111 // Passwords cannot be retrieved or replayed from the trace.

1112

1113 c0 := xreadInitial()

1114 ss, err := scram.NewServer(h, c0)

1115 xcheckf(err, "starting scram")

1116 c.log.Debug("scram auth", mlog.Field("authentication", ss.Authentication))

1117 acc, _, err := store.OpenEmail(ss.Authentication)

1118 if err != nil {

1119 // todo: we could continue scram with a generated salt, deterministically generated

1120 // from the username. that way we don't have to store anything but attackers cannot

1121 // learn if an account exists. same for absent scram saltedpassword below.

1122 c.log.Info("failed authentication attempt", mlog.Field("username", ss.Authentication), mlog.Field("remote", c.remoteIP))

1123 xsmtpUserErrorf(smtp.C454TempAuthFail, smtp.SeSys3Other0, "scram not possible")

1124 }

1125 defer func() {

1126 if acc != nil {

1127 err := acc.Close()

1128 c.log.Check(err, "closing account")

1129 }

1130 }()

1131 if ss.Authorization != "" && ss.Authorization != ss.Authentication {

1132 xsmtpUserErrorf(smtp.C535AuthBadCreds, smtp.SePol7AuthBadCreds8, "authentication with authorization for different user not supported")

1133 }

1134 var xscram store.SCRAM

1135 acc.WithRLock(func() {

1136 err := acc.DB.Read(context.TODO(), func(tx *bstore.Tx) error {

1137 password, err := bstore.QueryTx[store.Password](tx).Get()

1138 if authVariant == "scram-sha-1" {

1139 xscram = password.SCRAMSHA1

1140 } else {

1141 xscram = password.SCRAMSHA256

1142 }

1143 if err == bstore.ErrAbsent || err == nil && (len(xscram.Salt) == 0 || xscram.Iterations == 0 || len(xscram.SaltedPassword) == 0) {

1144 c.log.Info("scram auth attempt without derived secrets set, save password again to store secrets", mlog.Field("address", ss.Authentication))

1145 c.log.Info("failed authentication attempt", mlog.Field("username", ss.Authentication), mlog.Field("remote", c.remoteIP))

1146 xsmtpUserErrorf(smtp.C454TempAuthFail, smtp.SeSys3Other0, "scram not possible")

1147 }

1148 xcheckf(err, "fetching credentials")

1149 return err

1150 })

1151 xcheckf(err, "read tx")

1152 })

1153 s1, err := ss.ServerFirst(xscram.Iterations, xscram.Salt)

1154 xcheckf(err, "scram first server step")

1155 c.writelinef("%d %s", smtp.C334ContinueAuth, base64.StdEncoding.EncodeToString([]byte(s1))) // ../rfc/4954:187

1156 c2 := xreadContinuation()

1157 s3, err := ss.Finish(c2, xscram.SaltedPassword)

1158 if len(s3) > 0 {

1159 c.writelinef("%d %s", smtp.C334ContinueAuth, base64.StdEncoding.EncodeToString([]byte(s3))) // ../rfc/4954:187

1160 }

1161 if err != nil {

1162 c.readline() // Should be "*" for cancellation.

1163 if errors.Is(err, scram.ErrInvalidProof) {

1164 authResult = "badcreds"

1165 c.log.Info("failed authentication attempt", mlog.Field("username", ss.Authentication), mlog.Field("remote", c.remoteIP))

1166 xsmtpUserErrorf(smtp.C535AuthBadCreds, smtp.SePol7AuthBadCreds8, "bad credentials")

1167 }

1168 xcheckf(err, "server final")

1169 }

1170

1171 // Client must still respond, but there is nothing to say. See ../rfc/9051:6221

1172 // The message should be empty. todo: should we require it is empty?

1173 xreadContinuation()

1174

1175 authResult = "ok"

1176 c.authFailed = 0

1177 c.setSlow(false)

1178 c.account = acc

1179 acc = nil // Cancel cleanup.

1180 c.username = ss.Authentication

1181 // ../rfc/4954:276

1182 c.writecodeline(smtp.C235AuthSuccess, smtp.SePol7Other0, "nice", nil)

1183

1184 default:

1185 // ../rfc/4954:176

1186 xsmtpUserErrorf(smtp.C504ParamNotImpl, smtp.SeProto5BadParams4, "mechanism %s not supported", mech)

1187 }

1188}

1189

1190// ../rfc/5321:1879 ../rfc/5321:1025

1191func (c *conn) cmdMail(p *parser) {

1192 // requirements for maximum line length:

1193 // ../rfc/5321:3500 (base max of 512 including crlf) ../rfc/4954:134 (+500) ../rfc/1870:92 (+26) ../rfc/6152:90 (none specified) ../rfc/6531:231 (+10)

1194 // todo future: enforce?

1195

1196 if c.transactionBad > 10 && c.transactionGood == 0 {

1197 // If we get many bad transactions, it's probably a spammer that is guessing user names.

1198 // Useful in combination with rate limiting.

1199 // ../rfc/5321:4349

1200 c.writecodeline(smtp.C550MailboxUnavail, smtp.SeAddr1Other0, "too many failures", nil)

1201 panic(errIO)

1202 }

1203

1204 c.xneedHello()

1205 c.xcheckAuth()

1206 c.xneedTLSForDelivery()

1207 if c.mailFrom != nil {

1208 // ../rfc/5321:2507, though ../rfc/5321:1029 contradicts, implying a MAIL would also reset, but ../rfc/5321:1160 decides.

1209 xsmtpUserErrorf(smtp.C503BadCmdSeq, smtp.SeProto5BadCmdOrSeq1, "already have MAIL")

1210 }

1211 // Ensure clear transaction state on failure.

1212 defer func() {

1213 x := recover()

1214 if x != nil {

1215 // ../rfc/5321:2514

1216 c.rset()

1217 panic(x)

1218 }

1219 }()

1220 p.xtake(" FROM:")

1221 // note: no space after colon. ../rfc/5321:1093

1222 // Allow illegal space for submission only, not for regular SMTP. Microsoft Outlook

1223 // 365 Apps for Enterprise sends it.

1224 if c.submission && !moxvar.Pedantic {

1225 p.space()

1226 }

1227 rawRevPath := p.xrawReversePath()

1228 paramSeen := map[string]bool{}

1229 for p.space() {

1230 // ../rfc/5321:2273

1231 key := p.xparamKeyword()

1232

1233 K := strings.ToUpper(key)

1234 if paramSeen[K] {

1235 // e.g. ../rfc/6152:128

1236 xsmtpUserErrorf(smtp.C501BadParamSyntax, smtp.SeProto5BadParams4, "duplicate param %q", key)

1237 }

1238 paramSeen[K] = true

1239

1240 switch K {

1241 case "SIZE":

1242 p.xtake("=")

1243 size := p.xnumber(20) // ../rfc/1870:90

1244 if size > c.maxMessageSize {

1245 // ../rfc/1870:136 ../rfc/3463:382

1246 ecode := smtp.SeSys3MsgLimitExceeded4

1247 if size < config.DefaultMaxMsgSize {

1248 ecode = smtp.SeMailbox2MsgLimitExceeded3

1249 }

1250 xsmtpUserErrorf(smtp.C552MailboxFull, ecode, "message too large")

1251 }

1252 // We won't verify the message is exactly the size the remote claims. Buf if it is

1253 // larger, we'll abort the transaction when remote crosses the boundary.

1254 case "BODY":

1255 p.xtake("=")

1256 // ../rfc/6152:90

1257 v := p.xparamValue()

1258 switch strings.ToUpper(v) {

1259 case "7BIT":

1260 c.has8bitmime = false

1261 case "8BITMIME":

1262 c.has8bitmime = true

1263 default:

1264 xsmtpUserErrorf(smtp.C555UnrecognizedAddrParams, smtp.SeProto5BadParams4, "unrecognized parameter %q", key)

1265 }

1266 case "AUTH":

1267 // ../rfc/4954:455

1268

1269 // We act as if we don't trust the client to specify a mailbox. Instead, we always

1270 // check the rfc5321.mailfrom and rfc5322.from before accepting the submission.

1271 // ../rfc/4954:538

1272

1273 // ../rfc/4954:704

1274 // todo future: should we accept utf-8-addr-xtext if there is no smtputf8, and utf-8 if there is? need to find a spec ../rfc/6533:259

1275 p.xtake("=")

1276 p.xtake("<")

1277 p.xtext()

1278 p.xtake(">")

1279 case "SMTPUTF8":

1280 // ../rfc/6531:213

1281 c.smtputf8 = true

1282 default:

1283 // ../rfc/5321:2230

1284 xsmtpUserErrorf(smtp.C555UnrecognizedAddrParams, smtp.SeSys3NotSupported3, "unrecognized parameter %q", key)

1285 }

1286 }

1287

1288 // We now know if we have to parse the address with support for utf8.

1289 pp := newParser(rawRevPath, c.smtputf8, c)

1290 rpath := pp.xbareReversePath()

1291 pp.xempty()

1292 pp = nil

1293 p.xend()

1294

1295 // For submission, check if reverse path is allowed. I.e. authenticated account

1296 // must have the rpath configured. We do a check again on rfc5322.from during DATA.

1297 rpathAllowed := func() bool {

1298 // ../rfc/6409:349

1299 if rpath.IsZero() {

1300 return true

1301 }

1302 accName, _, _, err := mox.FindAccount(rpath.Localpart, rpath.IPDomain.Domain, false)

1303 return err == nil && accName == c.account.Name

1304 }

1305

1306 if !c.submission && !rpath.IPDomain.Domain.IsZero() {

1307 // If rpath domain has null MX record or is otherwise not accepting email, reject.

1308 // ../rfc/7505:181

1309 // ../rfc/5321:4045

1310 cidctx := context.WithValue(mox.Context, mlog.CidKey, c.cid)

1311 ctx, cancel := context.WithTimeout(cidctx, time.Minute)

1312 valid, err := checkMXRecords(ctx, c.resolver, rpath.IPDomain.Domain)

1313 cancel()

1314 if err != nil {

1315 c.log.Infox("temporary reject for temporary mx lookup error", err)

1316 xsmtpServerErrorf(codes{smtp.C451LocalErr, smtp.SeNet4Other0}, "cannot verify mx records for mailfrom domain")

1317 } else if !valid {

1318 c.log.Info("permanent reject because mailfrom domain does not accept mail")

1319 xsmtpUserErrorf(smtp.C550MailboxUnavail, smtp.SePol7SenderHasNullMX27, "mailfrom domain not configured for mail")

1320 }

1321 }

1322

1323 if c.submission && (len(rpath.IPDomain.IP) > 0 || !rpathAllowed()) {

1324 // ../rfc/6409:522

1325 c.log.Info("submission with unconfigured mailfrom", mlog.Field("user", c.username), mlog.Field("mailfrom", rpath.String()))

1326 xsmtpUserErrorf(smtp.C550MailboxUnavail, smtp.SePol7DeliveryUnauth1, "must match authenticated user")

1327 } else if !c.submission && len(rpath.IPDomain.IP) > 0 {

1328 // todo future: allow if the IP is the same as this connection is coming from? does later code allow this?

1329 c.log.Info("delivery from address without domain", mlog.Field("mailfrom", rpath.String()))

1330 xsmtpUserErrorf(smtp.C550MailboxUnavail, smtp.SePol7Other0, "domain name required")

1331 }

1332

1333 if Localserve && strings.HasPrefix(string(rpath.Localpart), "mailfrom") {

1334 c.xlocalserveError(rpath.Localpart)

1335 }

1336

1337 c.mailFrom = &rpath

1338

1339 c.bwritecodeline(smtp.C250Completed, smtp.SeAddr1Other0, "looking good", nil)

1340}

1341

1342// ../rfc/5321:1916 ../rfc/5321:1054

1343func (c *conn) cmdRcpt(p *parser) {

1344 c.xneedHello()

1345 c.xcheckAuth()

1346 c.xneedTLSForDelivery()

1347 if c.mailFrom == nil {

1348 // ../rfc/5321:1088

1349 xsmtpUserErrorf(smtp.C503BadCmdSeq, smtp.SeProto5BadCmdOrSeq1, "missing MAIL FROM")

1350 }

1351

1352 // ../rfc/5321:1985

1353 p.xtake(" TO:")

1354 // note: no space after colon. ../rfc/5321:1093

1355 // Allow illegal space for submission only, not for regular SMTP. Microsoft Outlook

1356 // 365 Apps for Enterprise sends it.

1357 if c.submission && !moxvar.Pedantic {

1358 p.space()

1359 }

1360 var fpath smtp.Path

1361 if p.take("<POSTMASTER>") {

1362 fpath = smtp.Path{Localpart: "postmaster"}

1363 } else {

1364 fpath = p.xforwardPath()

1365 }

1366 for p.space() {

1367 // ../rfc/5321:2275

1368 key := p.xparamKeyword()

1369 // K := strings.ToUpper(key)

1370 // todo future: DSN, ../rfc/3461, with "NOTIFY"

1371 // ../rfc/5321:2230

1372 xsmtpUserErrorf(smtp.C555UnrecognizedAddrParams, smtp.SeSys3NotSupported3, "unrecognized parameter %q", key)

1373 }

1374 p.xend()

1375

1376 // todo future: for submission, should we do explicit verification that domains are fully qualified? also for mail from. ../rfc/6409:420

1377

1378 if len(c.recipients) >= 100 {

1379 // ../rfc/5321:3535 ../rfc/5321:3571

1380 xsmtpUserErrorf(smtp.C452StorageFull, smtp.SeProto5TooManyRcpts3, "max of 100 recipients reached")

1381 }

1382

1383 // We don't want to allow delivery to multiple recipients with a null reverse path.

1384 // Why would anyone send like that? Null reverse path is intended for delivery

1385 // notifications, they should go to a single recipient.

1386 if !c.submission && len(c.recipients) > 0 && c.mailFrom.IsZero() {

1387 xsmtpUserErrorf(smtp.C452StorageFull, smtp.SeProto5TooManyRcpts3, "only one recipient allowed with null reverse address")

1388 }

1389

1390 // Do not accept multiple recipients if remote does not pass SPF. Because we don't

1391 // want to generate DSNs to unverified domains. This is the moment we

1392 // can refuse individual recipients, DATA will be too late. Because mail

1393 // servers must handle a max recipient limit gracefully and still send to the

1394 // recipients that are accepted, this should not cause problems. Though we are in

1395 // violation because the limit must be >= 100.

1396 // ../rfc/5321:3598

1397 // ../rfc/5321:4045

1398 // Also see ../rfc/7489:2214

1399 if !c.submission && len(c.recipients) == 1 && !Localserve {

1400 // note: because of check above, mailFrom cannot be the null address.

1401 var pass bool

1402 d := c.mailFrom.IPDomain.Domain

1403 if !d.IsZero() {

1404 // todo: use this spf result for DATA.

1405 spfArgs := spf.Args{

1406 RemoteIP: c.remoteIP,

1407 MailFromLocalpart: c.mailFrom.Localpart,

1408 MailFromDomain: d,

1409 HelloDomain: c.hello,

1410 LocalIP: c.localIP,

1411 LocalHostname: c.hostname,

1412 }

1413 cidctx := context.WithValue(mox.Context, mlog.CidKey, c.cid)

1414 spfctx, spfcancel := context.WithTimeout(cidctx, time.Minute)

1415 defer spfcancel()

1416 receivedSPF, _, _, err := spf.Verify(spfctx, c.resolver, spfArgs)

1417 spfcancel()

1418 if err != nil {

1419 c.log.Errorx("spf verify for multiple recipients", err)

1420 }

1421 pass = receivedSPF.Identity == spf.ReceivedMailFrom && receivedSPF.Result == spf.StatusPass

1422 }

1423 if !pass {

1424 xsmtpUserErrorf(smtp.C452StorageFull, smtp.SeProto5TooManyRcpts3, "only one recipient allowed without spf pass")

1425 }

1426 }

1427

1428 if Localserve {

1429 if strings.HasPrefix(string(fpath.Localpart), "rcptto") {

1430 c.xlocalserveError(fpath.Localpart)

1431 }

1432

1433 // If account or destination doesn't exist, it will be handled during delivery. For

1434 // submissions, which is the common case, we'll deliver to the logged in user,

1435 // which is typically the mox user.

1436 acc, _ := mox.Conf.Account("mox")

1437 dest := acc.Destinations["mox@localhost"]

1438 c.recipients = append(c.recipients, rcptAccount{fpath, true, "mox", dest, "mox@localhost"})

1439 } else if len(fpath.IPDomain.IP) > 0 {

1440 if !c.submission {

1441 xsmtpUserErrorf(smtp.C550MailboxUnavail, smtp.SeAddr1UnknownDestMailbox1, "not accepting email for ip")

1442 }

1443 c.recipients = append(c.recipients, rcptAccount{fpath, false, "", config.Destination{}, ""})

1444 } else if accountName, canonical, addr, err := mox.FindAccount(fpath.Localpart, fpath.IPDomain.Domain, true); err == nil {

1445 // note: a bare postmaster, without domain, is handled by FindAccount. ../rfc/5321:735

1446 c.recipients = append(c.recipients, rcptAccount{fpath, true, accountName, addr, canonical})

1447 } else if errors.Is(err, mox.ErrDomainNotFound) {

1448 if !c.submission {

1449 xsmtpUserErrorf(smtp.C550MailboxUnavail, smtp.SeAddr1UnknownDestMailbox1, "not accepting email for domain")

1450 }

1451 // We'll be delivering this email.

1452 c.recipients = append(c.recipients, rcptAccount{fpath, false, "", config.Destination{}, ""})

1453 } else if errors.Is(err, mox.ErrAccountNotFound) {

1454 if c.submission {

1455 // For submission, we're transparent about which user exists. Should be fine for the typical small-scale deploy.

1456 // ../rfc/5321:1071

1457 xsmtpUserErrorf(smtp.C550MailboxUnavail, smtp.SeAddr1UnknownDestMailbox1, "no such user")

1458 }

1459 // We pretend to accept. We don't want to let remote know the user does not exist

1460 // until after DATA. Because then remote has committed to sending a message.

1461 // note: not local for !c.submission is the signal this address is in error.

1462 c.recipients = append(c.recipients, rcptAccount{fpath, false, "", config.Destination{}, ""})

1463 } else {

1464 c.log.Errorx("looking up account for delivery", err, mlog.Field("rcptto", fpath))

1465 xsmtpServerErrorf(codes{smtp.C451LocalErr, smtp.SeSys3Other0}, "error processing")

1466 }

1467 c.bwritecodeline(smtp.C250Completed, smtp.SeAddr1Other0, "now on the list", nil)

1468}

1469

1470// ../rfc/5321:1992 ../rfc/5321:1098

1471func (c *conn) cmdData(p *parser) {

1472 c.xneedHello()

1473 c.xcheckAuth()

1474 c.xneedTLSForDelivery()

1475 if c.mailFrom == nil {

1476 // ../rfc/5321:1130

1477 xsmtpUserErrorf(smtp.C503BadCmdSeq, smtp.SeProto5BadCmdOrSeq1, "missing MAIL FROM")

1478 }

1479 if len(c.recipients) == 0 {

1480 // ../rfc/5321:1130

1481 xsmtpUserErrorf(smtp.C503BadCmdSeq, smtp.SeProto5BadCmdOrSeq1, "missing RCPT TO")

1482 }

1483

1484 // ../rfc/5321:2066

1485 p.xend()

1486

1487 // todo future: we could start a reader for a single line. we would then create a context that would be canceled on i/o errors.

1488

1489 // Entire delivery should be done within 30 minutes, or we abort.

1490 cidctx := context.WithValue(mox.Context, mlog.CidKey, c.cid)

1491 cmdctx, cmdcancel := context.WithTimeout(cidctx, 30*time.Minute)

1492 defer cmdcancel()

1493 // Deadline is taken into account by Read and Write.

1494 c.deadline, _ = cmdctx.Deadline()

1495 defer func() {

1496 c.deadline = time.Time{}

1497 }()

1498

1499 // ../rfc/5321:1994

1500 c.writelinef("354 see you at the bare dot")

1501

1502 // Mark as tracedata.

1503 defer c.xtrace(mlog.LevelTracedata)()

1504

1505 // We read the data into a temporary file. We limit the size and do basic analysis while reading.

1506 dataFile, err := store.CreateMessageTemp("smtp-deliver")

1507 if err != nil {

1508 xsmtpServerErrorf(errCodes(smtp.C451LocalErr, smtp.SeSys3Other0, err), "creating temporary file for message: %s", err)

1509 }

1510 defer func() {

1511 if dataFile != nil {

1512 err := os.Remove(dataFile.Name())

1513 c.log.Check(err, "removing temporary message file", mlog.Field("path", dataFile.Name()))

1514 err = dataFile.Close()

1515 c.log.Check(err, "removing temporary message file")

1516 }

1517 }()

1518 msgWriter := message.NewWriter(dataFile)

1519 dr := smtp.NewDataReader(c.r)

1520 n, err := io.Copy(&limitWriter{maxSize: c.maxMessageSize, w: msgWriter}, dr)

1521 c.xtrace(mlog.LevelTrace) // Restore.

1522 if err != nil {

1523 if errors.Is(err, errMessageTooLarge) {

1524 // ../rfc/1870:136 and ../rfc/3463:382

1525 ecode := smtp.SeSys3MsgLimitExceeded4

1526 if n < config.DefaultMaxMsgSize {

1527 ecode = smtp.SeMailbox2MsgLimitExceeded3

1528 }

1529 c.writecodeline(smtp.C451LocalErr, ecode, fmt.Sprintf("error copying data to file (%s)", mox.ReceivedID(c.cid)), err)

1530 panic(fmt.Errorf("remote sent too much DATA: %w", errIO))

1531 }

1532

1533 // Something is failing on our side. We want to let remote know. So write an error response,

1534 // then discard the remaining data so the remote client is more likely to see our

1535 // response. Our write is synchronous, there is a risk no window/buffer space is

1536 // available and our write blocks us from reading remaining data, leading to

1537 // deadlock. We have a timeout on our connection writes though, so worst case we'll

1538 // abort the connection due to expiration.

1539 c.writecodeline(smtp.C451LocalErr, smtp.SeSys3Other0, fmt.Sprintf("error copying data to file (%s)", mox.ReceivedID(c.cid)), err)

1540 io.Copy(io.Discard, dr)

1541 return

1542 }

1543

1544 // Basic sanity checks on messages before we send them out to the world. Just

1545 // trying to be strict in what we do to others and liberal in what we accept.

1546 if c.submission {

1547 if !msgWriter.HaveBody {

1548 // ../rfc/6409:541

1549 xsmtpUserErrorf(smtp.C554TransactionFailed, smtp.SeMsg6Other0, "message requires both header and body section")

1550 }

1551 // Check only for pedantic mode because ios mail will attempt to send smtputf8 with

1552 // non-ascii in message from localpart without using 8bitmime.

1553 if moxvar.Pedantic && msgWriter.Has8bit && !c.has8bitmime {

1554 // ../rfc/5321:906

1555 xsmtpUserErrorf(smtp.C500BadSyntax, smtp.SeMsg6Other0, "message with non-us-ascii requires 8bitmime extension")

1556 }

1557 }

1558

1559 if Localserve {

1560 // Require that message can be parsed fully.

1561 p, err := message.Parse(c.log, false, dataFile)

1562 if err == nil {

1563 err = p.Walk(c.log, nil)

1564 }

1565 if err != nil {

1566 // ../rfc/6409:541

1567 xsmtpUserErrorf(smtp.C554TransactionFailed, smtp.SeMsg6Other0, "malformed message: %v", err)

1568 }

1569 }

1570

1571 // Prepare "Received" header.

1572 // ../rfc/5321:2051 ../rfc/5321:3302

1573 // ../rfc/5321:3311 ../rfc/6531:578

1574 var recvFrom string

1575 var iprevStatus iprev.Status // Only for delivery, not submission.

1576 if c.submission {

1577 // Hide internal hosts.

1578 // todo future: make this a config option, where admins specify ip ranges that they don't want exposed. also see ../rfc/5321:4321

1579 recvFrom = message.HeaderCommentDomain(mox.Conf.Static.HostnameDomain, c.smtputf8)

1580 } else {

1581 if len(c.hello.IP) > 0 {

1582 recvFrom = smtp.AddressLiteral(c.hello.IP)

1583 } else {

1584 // ASCII-only version added after the extended-domain syntax below, because the

1585 // comment belongs to "BY" which comes immediately after "FROM".

1586 recvFrom = c.hello.Domain.XName(c.smtputf8)

1587 }

1588 iprevctx, iprevcancel := context.WithTimeout(cmdctx, time.Minute)

1589 var revName string

1590 var revNames []string

1591 iprevStatus, revName, revNames, err = iprev.Lookup(iprevctx, c.resolver, c.remoteIP)

1592 iprevcancel()

1593 if err != nil {

1594 c.log.Infox("reverse-forward lookup", err, mlog.Field("remoteip", c.remoteIP))

1595 }

1596 c.log.Debug("dns iprev check", mlog.Field("addr", c.remoteIP), mlog.Field("status", iprevStatus))

1597 var name string

1598 if revName != "" {

1599 name = revName

1600 } else if len(revNames) > 0 {

1601 name = revNames[0]

1602 }

1603 name = strings.TrimSuffix(name, ".")

1604 recvFrom += " ("

1605 if name != "" && name != c.hello.Domain.XName(c.smtputf8) {

1606 recvFrom += name + " "

1607 }

1608 recvFrom += smtp.AddressLiteral(c.remoteIP) + ")"

1609 if c.smtputf8 && c.hello.Domain.Unicode != "" {

1610 recvFrom += " (" + c.hello.Domain.ASCII + ")"

1611 }

1612 }

1613 recvBy := mox.Conf.Static.HostnameDomain.XName(c.smtputf8)

1614 recvBy += " (" + smtp.AddressLiteral(c.localIP) + ")" // todo: hide ip if internal?

1615 if c.smtputf8 && mox.Conf.Static.HostnameDomain.Unicode != "" {

1616 // This syntax is part of "VIA".

1617 recvBy += " (" + mox.Conf.Static.HostnameDomain.ASCII + ")"

1618 }

1619

1620 // ../rfc/3848:34 ../rfc/6531:791

1621 with := "SMTP"

1622 if c.smtputf8 {

1623 with = "UTF8SMTP"

1624 } else if c.ehlo {

1625 with = "ESMTP"

1626 }

1627 if c.tls {

1628 with += "S"

1629 }

1630 if c.account != nil {

1631 // ../rfc/4954:660

1632 with += "A"

1633 }

1634

1635 // Assume transaction does not succeed. If it does, we'll compensate.

1636 c.transactionBad++

1637

1638 recvHdrFor := func(rcptTo string) string {

1639 recvHdr := &message.HeaderWriter{}

1640 // For additional Received-header clauses, see:

1641 // https://www.iana.org/assignments/mail-parameters/mail-parameters.xhtml#table-mail-parameters-8

1642 recvHdr.Add(" ", "Received:", "from", recvFrom, "by", recvBy, "via", "tcp", "with", with, "id", mox.ReceivedID(c.cid)) // ../rfc/5321:3158

1643 if c.tls {

1644 tlsConn := c.conn.(*tls.Conn)

1645 tlsComment := message.TLSReceivedComment(c.log, tlsConn.ConnectionState())

1646 recvHdr.Add(" ", tlsComment...)

1647 }

1648 recvHdr.Add(" ", "for", "<"+rcptTo+">;", time.Now().Format(message.RFC5322Z))

1649 return recvHdr.String()

1650 }

1651

1652 // Submission is easiest because user is trusted. Far fewer checks to make. So

1653 // handle it first, and leave the rest of the function for handling wild west

1654 // internet traffic.

1655 if c.submission {

1656 c.submit(cmdctx, recvHdrFor, msgWriter, &dataFile)

1657 } else {

1658 c.deliver(cmdctx, recvHdrFor, msgWriter, iprevStatus, &dataFile)

1659 }

1660}

1661

1662// submit is used for mail from authenticated users that we will try to deliver.

1663func (c *conn) submit(ctx context.Context, recvHdrFor func(string) string, msgWriter *message.Writer, pdataFile **os.File) {

1664 // Similar between ../smtpserver/server.go:/submit\( and ../webmail/webmail.go:/MessageSubmit\(

1665

1666 dataFile := *pdataFile

1667

1668 var msgPrefix []byte

1669

1670 // Check that user is only sending email as one of its configured identities. Not

1671 // for other users.

1672 // We don't check the Sender field, there is no expectation of verification, ../rfc/7489:2948

1673 // and with Resent headers it seems valid to have someone else as Sender. ../rfc/5322:1578

1674 msgFrom, header, err := message.From(c.log, true, dataFile)

1675 if err != nil {

1676 metricSubmission.WithLabelValues("badmessage").Inc()

1677 c.log.Infox("parsing message From address", err, mlog.Field("user", c.username))

1678 xsmtpUserErrorf(smtp.C550MailboxUnavail, smtp.SeMsg6Other0, "cannot parse header or From address: %v", err)

1679 }

1680 accName, _, _, err := mox.FindAccount(msgFrom.Localpart, msgFrom.Domain, true)

1681 if err != nil || accName != c.account.Name {

1682 // ../rfc/6409:522

1683 if err == nil {

1684 err = mox.ErrAccountNotFound

1685 }

1686 metricSubmission.WithLabelValues("badfrom").Inc()

1687 c.log.Infox("verifying message From address", err, mlog.Field("user", c.username), mlog.Field("msgfrom", msgFrom))

1688 xsmtpUserErrorf(smtp.C550MailboxUnavail, smtp.SePol7DeliveryUnauth1, "must match authenticated user")

1689 }

1690

1691 // Outgoing messages should not have a Return-Path header. The final receiving mail

1692 // server will add it.

1693 // ../rfc/5321:3233

1694 if header.Values("Return-Path") != nil {

1695 metricSubmission.WithLabelValues("badheader").Inc()

1696 xsmtpUserErrorf(smtp.C550MailboxUnavail, smtp.SeMsg6Other0, "message must not have Return-Path header")

1697 }

1698

1699 // Add Message-Id header if missing.

1700 // ../rfc/5321:4131 ../rfc/6409:751

1701 messageID := header.Get("Message-Id")

1702 if messageID == "" {

1703 messageID = mox.MessageIDGen(c.smtputf8)

1704 msgPrefix = append(msgPrefix, fmt.Sprintf("Message-Id: <%s>\r\n", messageID)...)

1705 }

1706

1707 // ../rfc/6409:745

1708 if header.Get("Date") == "" {

1709 msgPrefix = append(msgPrefix, "Date: "+time.Now().Format(message.RFC5322Z)+"\r\n"...)

1710 }

1711

1712 // Check outoging message rate limit.

1713 err = c.account.DB.Read(ctx, func(tx *bstore.Tx) error {

1714 rcpts := make([]smtp.Path, len(c.recipients))

1715 for i, r := range c.recipients {

1716 rcpts[i] = r.rcptTo

1717 }

1718 msglimit, rcptlimit, err := c.account.SendLimitReached(tx, rcpts)

1719 xcheckf(err, "checking sender limit")

1720 if msglimit >= 0 {

1721 metricSubmission.WithLabelValues("messagelimiterror").Inc()

1722 xsmtpUserErrorf(smtp.C451LocalErr, smtp.SePol7DeliveryUnauth1, "max number of messages (%d) over past 24h reached, try increasing per-account setting MaxOutgoingMessagesPerDay", msglimit)

1723 } else if rcptlimit >= 0 {

1724 metricSubmission.WithLabelValues("recipientlimiterror").Inc()

1725 xsmtpUserErrorf(smtp.C451LocalErr, smtp.SePol7DeliveryUnauth1, "max number of new/first-time recipients (%d) over past 24h reached, try increasing per-account setting MaxFirstTimeRecipientsPerDay", rcptlimit)

1726 }

1727 return nil

1728 })

1729 xcheckf(err, "read-only transaction")

1730

1731 // todo future: in a pedantic mode, we can parse the headers, and return an error if rcpt is only in To or Cc header, and not in the non-empty Bcc header. indicates a client that doesn't blind those bcc's.

1732

1733 // Add DKIM signatures.

1734 confDom, ok := mox.Conf.Domain(msgFrom.Domain)

1735 if !ok {

1736 c.log.Error("domain disappeared", mlog.Field("domain", msgFrom.Domain))

1737 xsmtpServerErrorf(codes{smtp.C451LocalErr, smtp.SeSys3Other0}, "internal error")

1738 }

1739

1740 dkimConfig := confDom.DKIM

1741 if len(dkimConfig.Sign) > 0 {

1742 if canonical, err := mox.CanonicalLocalpart(msgFrom.Localpart, confDom); err != nil {

1743 c.log.Errorx("determining canonical localpart for dkim signing", err, mlog.Field("localpart", msgFrom.Localpart))

1744 } else if dkimHeaders, err := dkim.Sign(ctx, canonical, msgFrom.Domain, dkimConfig, c.smtputf8, store.FileMsgReader(msgPrefix, dataFile)); err != nil {

1745 c.log.Errorx("dkim sign for domain", err, mlog.Field("domain", msgFrom.Domain))

1746 metricServerErrors.WithLabelValues("dkimsign").Inc()

1747 } else {

1748 msgPrefix = append(msgPrefix, []byte(dkimHeaders)...)

1749 }

1750 }

1751

1752 authResults := message.AuthResults{

1753 Hostname: mox.Conf.Static.HostnameDomain.XName(c.smtputf8),

1754 Comment: mox.Conf.Static.HostnameDomain.ASCIIExtra(c.smtputf8),

1755 Methods: []message.AuthMethod{

1756 {

1757 Method: "auth",

1758 Result: "pass",

1759 Props: []message.AuthProp{

1760 message.MakeAuthProp("smtp", "mailfrom", c.mailFrom.XString(c.smtputf8), true, c.mailFrom.ASCIIExtra(c.smtputf8)),

1761 },

1762 },

1763 },

1764 }

1765 msgPrefix = append(msgPrefix, []byte(authResults.Header())...)

1766

1767 // We always deliver through the queue. It would be more efficient to deliver

1768 // directly, but we don't want to circumvent all the anti-spam measures. Accounts

1769 // on a single mox instance should be allowed to block each other.

1770 for i, rcptAcc := range c.recipients {

1771 if Localserve {

1772 code, timeout := localserveNeedsError(rcptAcc.rcptTo.Localpart)

1773 if timeout {

1774 c.log.Info("timing out submission due to special localpart")

1775 mox.Sleep(mox.Context, time.Hour)

1776 xsmtpServerErrorf(codes{smtp.C451LocalErr, smtp.SeSys3Other0}, "timing out submission due to special localpart")

1777 } else if code != 0 {

1778 c.log.Info("failure due to special localpart", mlog.Field("code", code))

1779 xsmtpServerErrorf(codes{code, smtp.SeOther00}, "failure with code %d due to special localpart", code)

1780 }

1781 }

1782

1783 xmsgPrefix := append([]byte(recvHdrFor(rcptAcc.rcptTo.String())), msgPrefix...)

1784

1785 msgSize := int64(len(xmsgPrefix)) + msgWriter.Size

1786 if _, err := queue.Add(ctx, c.log, c.account.Name, *c.mailFrom, rcptAcc.rcptTo, msgWriter.Has8bit, c.smtputf8, msgSize, messageID, xmsgPrefix, dataFile, nil, i == len(c.recipients)-1); err != nil {

1787 // Aborting the transaction is not great. But continuing and generating DSNs will

1788 // probably result in errors as well...

1789 metricSubmission.WithLabelValues("queueerror").Inc()

1790 c.log.Errorx("queuing message", err)

1791 xsmtpServerErrorf(errCodes(smtp.C451LocalErr, smtp.SeSys3Other0, err), "error delivering message: %v", err)

1792 }

1793 metricSubmission.WithLabelValues("ok").Inc()

1794 c.log.Info("message queued for delivery", mlog.Field("mailfrom", *c.mailFrom), mlog.Field("rcptto", rcptAcc.rcptTo), mlog.Field("smtputf8", c.smtputf8), mlog.Field("msgsize", msgSize))

1795

1796 err := c.account.DB.Insert(ctx, &store.Outgoing{Recipient: rcptAcc.rcptTo.XString(true)})

1797 xcheckf(err, "adding outgoing message")

1798 }

1799

1800 err = dataFile.Close()

1801 c.log.Check(err, "closing file after submission")

1802 *pdataFile = nil

1803

1804 c.transactionGood++

1805 c.transactionBad-- // Compensate for early earlier pessimistic increase.

1806

1807 c.rset()

1808 c.writecodeline(smtp.C250Completed, smtp.SeMailbox2Other0, "it is done", nil)

1809}

1810

1811func ipmasked(ip net.IP) (string, string, string) {

1812 if ip.To4() != nil {

1813 m1 := ip.String()

1814 m2 := ip.Mask(net.CIDRMask(26, 32)).String()

1815 m3 := ip.Mask(net.CIDRMask(21, 32)).String()

1816 return m1, m2, m3

1817 }

1818 m1 := ip.Mask(net.CIDRMask(64, 128)).String()

1819 m2 := ip.Mask(net.CIDRMask(48, 128)).String()

1820 m3 := ip.Mask(net.CIDRMask(32, 128)).String()

1821 return m1, m2, m3

1822}

1823

1824func localserveNeedsError(lp smtp.Localpart) (code int, timeout bool) {

1825 s := string(lp)

1826 if strings.HasSuffix(s, "temperror") {

1827 return smtp.C451LocalErr, false

1828 } else if strings.HasSuffix(s, "permerror") {

1829 return smtp.C550MailboxUnavail, false

1830 } else if strings.HasSuffix(s, "timeout") {

1831 return 0, true

1832 }

1833 if len(s) < 3 {

1834 return 0, false

1835 }

1836 s = s[len(s)-3:]

1837 v, err := strconv.ParseInt(s, 10, 32)

1838 if err != nil {

1839 return 0, false

1840 }

1841 if v < 400 || v > 600 {

1842 return 0, false

1843 }

1844 return int(v), false

1845}

1846

1847func (c *conn) xlocalserveError(lp smtp.Localpart) {

1848 code, timeout := localserveNeedsError(lp)

1849 if timeout {

1850 c.log.Info("timing out due to special localpart")

1851 mox.Sleep(mox.Context, time.Hour)

1852 xsmtpServerErrorf(codes{smtp.C451LocalErr, smtp.SeSys3Other0}, "timing out command due to special localpart")

1853 } else if code != 0 {

1854 c.log.Info("failure due to special localpart", mlog.Field("code", code))

1855 metricDelivery.WithLabelValues("delivererror", "localserve").Inc()

1856 xsmtpServerErrorf(codes{code, smtp.SeOther00}, "failure with code %d due to special localpart", code)

1857 }

1858}

1859

1860// deliver is called for incoming messages from external, typically untrusted

1861// sources. i.e. not submitted by authenticated users.

1862func (c *conn) deliver(ctx context.Context, recvHdrFor func(string) string, msgWriter *message.Writer, iprevStatus iprev.Status, pdataFile **os.File) {

1863 dataFile := *pdataFile

1864

1865 // todo: in decision making process, if we run into (some) temporary errors, attempt to continue. if we decide to accept, all good. if we decide to reject, we'll make it a temporary reject.

1866

1867 msgFrom, headers, err := message.From(c.log, false, dataFile)

1868 if err != nil {

1869 c.log.Infox("parsing message for From address", err)

1870 }

1871

1872 // Basic loop detection. ../rfc/5321:4065 ../rfc/5321:1526

1873 if len(headers.Values("Received")) > 100 {

1874 xsmtpUserErrorf(smtp.C550MailboxUnavail, smtp.SeNet4Loop6, "loop detected, more than 100 Received headers")

1875 }

1876

1877 // We'll be building up an Authentication-Results header.

1878 authResults := message.AuthResults{

1879 Hostname: mox.Conf.Static.HostnameDomain.XName(c.smtputf8),

1880 }

1881

1882 // Reverse IP lookup results.

1883 // todo future: how useful is this?

1884 // ../rfc/5321:2481

1885 authResults.Methods = append(authResults.Methods, message.AuthMethod{

1886 Method: "iprev",

1887 Result: string(iprevStatus),

1888 Props: []message.AuthProp{

1889 message.MakeAuthProp("policy", "iprev", c.remoteIP.String(), false, ""),

1890 },

1891 })

1892

1893 // SPF and DKIM verification in parallel.

1894 var wg sync.WaitGroup

1895

1896 // DKIM

1897 wg.Add(1)

1898 var dkimResults []dkim.Result

1899 var dkimErr error

1900 go func() {

1901 defer func() {

1902 x := recover() // Should not happen, but don't take program down if it does.

1903 if x != nil {

1904 c.log.Error("dkim verify panic", mlog.Field("err", x))

1905 debug.PrintStack()

1906 metrics.PanicInc(metrics.Dkimverify)

1907 }

1908 }()

1909 defer wg.Done()

1910 // We always evaluate all signatures. We want to build up reputation for each

1911 // domain in the signature.

1912 const ignoreTestMode = false

1913 // todo future: longer timeout? we have to read through the entire email, which can be large, possibly multiple times.

1914 dkimctx, dkimcancel := context.WithTimeout(ctx, time.Minute)

1915 defer dkimcancel()

1916 // todo future: we could let user configure which dkim headers they require

1917 dkimResults, dkimErr = dkim.Verify(dkimctx, c.resolver, c.smtputf8, dkim.DefaultPolicy, dataFile, ignoreTestMode)

1918 dkimcancel()

1919 }()

1920

1921 // SPF.

1922 // ../rfc/7208:472

1923 var receivedSPF spf.Received

1924 var spfDomain dns.Domain

1925 var spfExpl string

1926 var spfErr error

1927 spfArgs := spf.Args{

1928 RemoteIP: c.remoteIP,

1929 MailFromLocalpart: c.mailFrom.Localpart,

1930 MailFromDomain: c.mailFrom.IPDomain.Domain, // Can be empty.

1931 HelloDomain: c.hello,

1932 LocalIP: c.localIP,

1933 LocalHostname: c.hostname,

1934 }

1935 wg.Add(1)

1936 go func() {

1937 defer func() {

1938 x := recover() // Should not happen, but don't take program down if it does.

1939 if x != nil {

1940 c.log.Error("spf verify panic", mlog.Field("err", x))

1941 debug.PrintStack()

1942 metrics.PanicInc(metrics.Spfverify)

1943 }

1944 }()

1945 defer wg.Done()

1946 spfctx, spfcancel := context.WithTimeout(ctx, time.Minute)

1947 defer spfcancel()

1948 receivedSPF, spfDomain, spfExpl, spfErr = spf.Verify(spfctx, c.resolver, spfArgs)

1949 spfcancel()

1950 if spfErr != nil {

1951 c.log.Infox("spf verify", spfErr)

1952 }

1953 }()

1954

1955 // Wait for DKIM and SPF validation to finish.

1956 wg.Wait()

1957

1958 // Give immediate response if all recipients are unknown.

1959 nunknown := 0

1960 for _, r := range c.recipients {

1961 if !r.local {

1962 nunknown++

1963 }

1964 }

1965 if nunknown == len(c.recipients) {

1966 // During RCPT TO we found that the address does not exist.

1967 c.log.Info("deliver attempt to unknown user(s)", mlog.Field("recipients", c.recipients))

1968

1969 // Crude attempt to slow down someone trying to guess names. Would work better

1970 // with connection rate limiter.

1971 if unknownRecipientsDelay > 0 {

1972 mox.Sleep(ctx, unknownRecipientsDelay)

1973 }

1974

1975 // todo future: if remote does not look like a properly configured mail system, respond with generic 451 error? to prevent any random internet system from discovering accounts. we could give proper response if spf for ehlo or mailfrom passes.

1976 xsmtpUserErrorf(smtp.C550MailboxUnavail, smtp.SeAddr1UnknownDestMailbox1, "no such user(s)")

1977 }

1978

1979 // Add DKIM results to Authentication-Results header.

1980 authResAddDKIM := func(result, comment, reason string, props []message.AuthProp) {

1981 dm := message.AuthMethod{

1982 Method: "dkim",

1983 Result: result,

1984 Comment: comment,

1985 Reason: reason,

1986 Props: props,

1987 }

1988 authResults.Methods = append(authResults.Methods, dm)

1989 }

1990 if dkimErr != nil {

1991 c.log.Errorx("dkim verify", dkimErr)

1992 authResAddDKIM("none", "", dkimErr.Error(), nil)

1993 } else if len(dkimResults) == 0 {

1994 c.log.Info("no dkim-signature header", mlog.Field("mailfrom", c.mailFrom))

1995 authResAddDKIM("none", "", "no dkim signatures", nil)

1996 }

1997 for i, r := range dkimResults {

1998 var domain, selector dns.Domain

1999 var identity *dkim.Identity

2000 var comment string

2001 var props []message.AuthProp

2002 if r.Sig != nil {

2003 // todo future: also specify whether dns record was dnssec-signed.

2004 if r.Record != nil && r.Record.PublicKey != nil {

2005 if pubkey, ok := r.Record.PublicKey.(*rsa.PublicKey); ok {

2006 comment = fmt.Sprintf("%d bit rsa", pubkey.N.BitLen())

2007 }

2008 }

2009

2010 sig := base64.StdEncoding.EncodeToString(r.Sig.Signature)

2011 sig = sig[:12] // Must be at least 8 characters and unique among the signatures.

2012 props = []message.AuthProp{

2013 message.MakeAuthProp("header", "d", r.Sig.Domain.XName(c.smtputf8), true, r.Sig.Domain.ASCIIExtra(c.smtputf8)),

2014 message.MakeAuthProp("header", "s", r.Sig.Selector.XName(c.smtputf8), true, r.Sig.Selector.ASCIIExtra(c.smtputf8)),

2015 message.MakeAuthProp("header", "a", r.Sig.Algorithm(), false, ""),

2016 message.MakeAuthProp("header", "b", sig, false, ""), // ../rfc/6008:147

2017 }

2018 domain = r.Sig.Domain

2019 selector = r.Sig.Selector

2020 if r.Sig.Identity != nil {

2021 props = append(props, message.MakeAuthProp("header", "i", r.Sig.Identity.String(), true, ""))

2022 identity = r.Sig.Identity

2023 }

2024 }

2025 var errmsg string

2026 if r.Err != nil {

2027 errmsg = r.Err.Error()

2028 }

2029 authResAddDKIM(string(r.Status), comment, errmsg, props)

2030 c.log.Debugx("dkim verification result", r.Err, mlog.Field("index", i), mlog.Field("mailfrom", c.mailFrom), mlog.Field("status", r.Status), mlog.Field("domain", domain), mlog.Field("selector", selector), mlog.Field("identity", identity))

2031 }

2032

2033 // Add SPF results to Authentication-Results header. ../rfc/7208:2141

2034 var spfIdentity *dns.Domain

2035 var mailFromValidation = store.ValidationUnknown

2036 var ehloValidation = store.ValidationUnknown

2037 switch receivedSPF.Identity {

2038 case spf.ReceivedHELO:

2039 if len(spfArgs.HelloDomain.IP) == 0 {

2040 spfIdentity = &spfArgs.HelloDomain.Domain

2041 }

2042 ehloValidation = store.SPFValidation(receivedSPF.Result)

2043 case spf.ReceivedMailFrom:

2044 spfIdentity = &spfArgs.MailFromDomain

2045 mailFromValidation = store.SPFValidation(receivedSPF.Result)

2046 }

2047 var props []message.AuthProp

2048 if spfIdentity != nil {

2049 props = []message.AuthProp{message.MakeAuthProp("smtp", string(receivedSPF.Identity), spfIdentity.XName(c.smtputf8), true, spfIdentity.ASCIIExtra(c.smtputf8))}

2050 }

2051 authResults.Methods = append(authResults.Methods, message.AuthMethod{

2052 Method: "spf",

2053 Result: string(receivedSPF.Result),

2054 Props: props,

2055 })

2056 switch receivedSPF.Result {

2057 case spf.StatusPass:

2058 c.log.Debug("spf pass", mlog.Field("ip", spfArgs.RemoteIP), mlog.Field("mailfromdomain", spfArgs.MailFromDomain.ASCII)) // todo: log the domain that was actually verified.

2059 case spf.StatusFail:

2060 if spfExpl != "" {

2061 // Filter out potentially hostile text. ../rfc/7208:2529

2062 for _, b := range []byte(spfExpl) {

2063 if b < ' ' || b >= 0x7f {

2064 spfExpl = ""

2065 break

2066 }

2067 }

2068 if spfExpl != "" {

2069 if len(spfExpl) > 800 {

2070 spfExpl = spfExpl[:797] + "..."

2071 }

2072 spfExpl = "remote claims: " + spfExpl

2073 }

2074 }

2075 if spfExpl == "" {

2076 spfExpl = fmt.Sprintf("your ip %s is not on the SPF allowlist for domain %s", spfArgs.RemoteIP, spfDomain.ASCII)

2077 }

2078 c.log.Info("spf fail", mlog.Field("explanation", spfExpl)) // todo future: get this to the client. how? in smtp session in case of a reject due to dmarc fail?

2079 case spf.StatusTemperror:

2080 c.log.Infox("spf temperror", spfErr)

2081 case spf.StatusPermerror:

2082 c.log.Infox("spf permerror", spfErr)

2083 case spf.StatusNone, spf.StatusNeutral, spf.StatusSoftfail:

2084 default:

2085 c.log.Error("unknown spf status, treating as None/Neutral", mlog.Field("status", receivedSPF.Result))

2086 receivedSPF.Result = spf.StatusNone

2087 }

2088

2089 // DMARC

2090 var dmarcUse bool

2091 var dmarcResult dmarc.Result

2092 const applyRandomPercentage = true

2093 var dmarcMethod message.AuthMethod

2094 var msgFromValidation = store.ValidationNone

2095 if msgFrom.IsZero() {

2096 dmarcResult.Status = dmarc.StatusNone

2097 dmarcMethod = message.AuthMethod{

2098 Method: "dmarc",

2099 Result: string(dmarcResult.Status),

2100 }

2101 } else {

2102 msgFromValidation = alignment(ctx, msgFrom.Domain, dkimResults, receivedSPF.Result, spfIdentity)

2103

2104 dmarcctx, dmarccancel := context.WithTimeout(ctx, time.Minute)

2105 defer dmarccancel()

2106 dmarcUse, dmarcResult = dmarc.Verify(dmarcctx, c.resolver, msgFrom.Domain, dkimResults, receivedSPF.Result, spfIdentity, applyRandomPercentage)

2107 dmarccancel()

2108 dmarcMethod = message.AuthMethod{

2109 Method: "dmarc",

2110 Result: string(dmarcResult.Status),

2111 Props: []message.AuthProp{

2112 // ../rfc/7489:1489

2113 message.MakeAuthProp("header", "from", msgFrom.Domain.ASCII, true, msgFrom.Domain.ASCIIExtra(c.smtputf8)),

2114 },

2115 }

2116

2117 if dmarcResult.Status == dmarc.StatusPass && msgFromValidation == store.ValidationRelaxed {

2118 msgFromValidation = store.ValidationDMARC

2119 }

2120

2121 // todo future: consider enforcing an spf fail if there is no dmarc policy or the dmarc policy is none. ../rfc/7489:1507

2122 }

2123 authResults.Methods = append(authResults.Methods, dmarcMethod)

2124 c.log.Debug("dmarc verification", mlog.Field("result", dmarcResult.Status), mlog.Field("domain", msgFrom.Domain))

2125

2126 // Prepare for analyzing content, calculating reputation.

2127 ipmasked1, ipmasked2, ipmasked3 := ipmasked(c.remoteIP)

2128 var verifiedDKIMDomains []string

2129 dkimSeen := map[string]bool{}

2130 for _, r := range dkimResults {

2131 // A message can have multiple signatures for the same identity. For example when

2132 // signing the message multiple times with different algorithms (rsa and ed25519).

2133 if r.Status != dkim.StatusPass {

2134 continue

2135 }

2136 d := r.Sig.Domain.Name()

2137 if !dkimSeen[d] {

2138 dkimSeen[d] = true

2139 verifiedDKIMDomains = append(verifiedDKIMDomains, d)

2140 }

2141 }

2142

2143 // When we deliver, we try to remove from rejects mailbox based on message-id.

2144 // We'll parse it when we need it, but it is the same for each recipient.

2145 var messageID string

2146 var parsedMessageID bool

2147

2148 // We build up a DSN for each failed recipient. If we have recipients in dsnMsg

2149 // after processing, we queue the DSN. Unless all recipients failed, in which case

2150 // we may just fail the mail transaction instead (could be common for failure to

2151 // deliver to a single recipient, e.g. for junk mail).

2152 // ../rfc/3464:436

2153 type deliverError struct {

2154 rcptTo smtp.Path

2155 code int

2156 secode string

2157 userError bool

2158 errmsg string

2159 }

2160 var deliverErrors []deliverError

2161 addError := func(rcptAcc rcptAccount, code int, secode string, userError bool, errmsg string) {

2162 e := deliverError{rcptAcc.rcptTo, code, secode, userError, errmsg}

2163 c.log.Info("deliver error", mlog.Field("rcptto", e.rcptTo), mlog.Field("code", code), mlog.Field("secode", "secode"), mlog.Field("usererror", userError), mlog.Field("errmsg", errmsg))

2164 deliverErrors = append(deliverErrors, e)

2165 }

2166

2167 // For each recipient, do final spam analysis and delivery.

2168 for _, rcptAcc := range c.recipients {

2169 log := c.log.Fields(mlog.Field("mailfrom", c.mailFrom), mlog.Field("rcptto", rcptAcc.rcptTo))

2170

2171 // If this is not a valid local user, we send back a DSN. This can only happen when

2172 // there are also valid recipients, and only when remote is SPF-verified, so the DSN

2173 // should not cause backscatter.

2174 // In case of serious errors, we abort the transaction. We may have already

2175 // delivered some messages. Perhaps it would be better to continue with other

2176 // deliveries, and return an error at the end? Though the failure conditions will

2177 // probably prevent any other successful deliveries too...

2178 // We'll continue delivering to other recipients. ../rfc/5321:3275

2179 if !rcptAcc.local {

2180 metricDelivery.WithLabelValues("unknownuser", "").Inc()

2181 addError(rcptAcc, smtp.C550MailboxUnavail, smtp.SeAddr1UnknownDestMailbox1, true, "no such user")

2182 continue

2183 }

2184

2185 acc, err := store.OpenAccount(rcptAcc.accountName)

2186 if err != nil {

2187 log.Errorx("open account", err, mlog.Field("account", rcptAcc.accountName))

2188 metricDelivery.WithLabelValues("accounterror", "").Inc()

2189 addError(rcptAcc, smtp.C451LocalErr, smtp.SeSys3Other0, false, "error processing")

2190 continue

2191 }

2192 defer func() {

2193 if acc != nil {

2194 err := acc.Close()

2195 log.Check(err, "closing account after delivery")

2196 }

2197 }()

2198

2199 // We don't want to let a single IP or network deliver too many messages to an

2200 // account. They may fill up the mailbox, either with messages that have to be

2201 // purged, or by filling the disk. We check both cases for IP's and networks.

2202 var rateError bool // Whether returned error represents a rate error.

2203 err = acc.DB.Read(ctx, func(tx *bstore.Tx) (retErr error) {

2204 now := time.Now()

2205 defer func() {

2206 log.Debugx("checking message and size delivery rates", retErr, mlog.Field("duration", time.Since(now)))

2207 }()

2208

2209 checkCount := func(msg store.Message, window time.Duration, limit int) {

2210 if retErr != nil {

2211 return

2212 }

2213 q := bstore.QueryTx[store.Message](tx)

2214 q.FilterNonzero(msg)

2215 q.FilterGreater("Received", now.Add(-window))

2216 q.FilterEqual("Expunged", false)

2217 n, err := q.Count()

2218 if err != nil {

2219 retErr = err

2220 return

2221 }

2222 if n >= limit {

2223 rateError = true

2224 retErr = fmt.Errorf("more than %d messages in past %s from your ip/network", limit, window)

2225 }

2226 }

2227

2228 checkSize := func(msg store.Message, window time.Duration, limit int64) {

2229 if retErr != nil {

2230 return

2231 }

2232 q := bstore.QueryTx[store.Message](tx)

2233 q.FilterNonzero(msg)

2234 q.FilterGreater("Received", now.Add(-window))

2235 q.FilterEqual("Expunged", false)

2236 size := msgWriter.Size

2237 err := q.ForEach(func(v store.Message) error {

2238 size += v.Size

2239 return nil

2240 })

2241 if err != nil {

2242 retErr = err

2243 return

2244 }

2245 if size > limit {

2246 rateError = true

2247 retErr = fmt.Errorf("more than %d bytes in past %s from your ip/network", limit, window)

2248 }

2249 }

2250

2251 // todo future: make these configurable

2252 // todo: should we have a limit for forwarded messages? they are stored with empty RemoteIPMasked*

2253

2254 const day = 24 * time.Hour

2255 checkCount(store.Message{RemoteIPMasked1: ipmasked1}, time.Minute, limitIPMasked1MessagesPerMinute)

2256 checkCount(store.Message{RemoteIPMasked1: ipmasked1}, day, 20*500)

2257 checkCount(store.Message{RemoteIPMasked2: ipmasked2}, time.Minute, 1500)

2258 checkCount(store.Message{RemoteIPMasked2: ipmasked2}, day, 20*1500)

2259 checkCount(store.Message{RemoteIPMasked3: ipmasked3}, time.Minute, 4500)

2260 checkCount(store.Message{RemoteIPMasked3: ipmasked3}, day, 20*4500)

2261

2262 const MB = 1024 * 1024

2263 checkSize(store.Message{RemoteIPMasked1: ipmasked1}, time.Minute, limitIPMasked1SizePerMinute)

2264 checkSize(store.Message{RemoteIPMasked1: ipmasked1}, day, 3*1000*MB)

2265 checkSize(store.Message{RemoteIPMasked2: ipmasked2}, time.Minute, 3000*MB)

2266 checkSize(store.Message{RemoteIPMasked2: ipmasked2}, day, 3*3000*MB)

2267 checkSize(store.Message{RemoteIPMasked3: ipmasked3}, time.Minute, 9000*MB)

2268 checkSize(store.Message{RemoteIPMasked3: ipmasked3}, day, 3*9000*MB)

2269

2270 return retErr

2271 })

2272 if err != nil && !rateError {

2273 log.Errorx("checking delivery rates", err)

2274 metricDelivery.WithLabelValues("checkrates", "").Inc()

2275 addError(rcptAcc, smtp.C451LocalErr, smtp.SeSys3Other0, false, "error processing")

2276 continue

2277 } else if err != nil {

2278 log.Debugx("refusing due to high delivery rate", err)

2279 metricDelivery.WithLabelValues("highrate", "").Inc()

2280 c.setSlow(true)

2281 addError(rcptAcc, smtp.C452StorageFull, smtp.SeMailbox2Full2, true, err.Error())

2282 continue

2283 }

2284

2285 // ../rfc/5321:3204

2286 // Received-SPF header goes before Received. ../rfc/7208:2038

2287 msgPrefix := []byte(

2288 "Delivered-To: " + rcptAcc.rcptTo.XString(c.smtputf8) + "\r\n" + // ../rfc/9228:274

2289 "Return-Path: <" + c.mailFrom.String() + ">\r\n" + // ../rfc/5321:3300

2290 authResults.Header() +

2291 receivedSPF.Header() +

2292 recvHdrFor(rcptAcc.rcptTo.String()),

2293 )

2294

2295 m := &store.Message{

2296 Received: time.Now(),

2297 RemoteIP: c.remoteIP.String(),

2298 RemoteIPMasked1: ipmasked1,

2299 RemoteIPMasked2: ipmasked2,

2300 RemoteIPMasked3: ipmasked3,

2301 EHLODomain: c.hello.Domain.Name(),

2302 MailFrom: c.mailFrom.String(),

2303 MailFromLocalpart: c.mailFrom.Localpart,

2304 MailFromDomain: c.mailFrom.IPDomain.Domain.Name(),

2305 RcptToLocalpart: rcptAcc.rcptTo.Localpart,

2306 RcptToDomain: rcptAcc.rcptTo.IPDomain.Domain.Name(),

2307 MsgFromLocalpart: msgFrom.Localpart,

2308 MsgFromDomain: msgFrom.Domain.Name(),

2309 MsgFromOrgDomain: publicsuffix.Lookup(ctx, msgFrom.Domain).Name(),

2310 EHLOValidated: ehloValidation == store.ValidationPass,

2311 MailFromValidated: mailFromValidation == store.ValidationPass,

2312 MsgFromValidated: msgFromValidation == store.ValidationStrict || msgFromValidation == store.ValidationDMARC || msgFromValidation == store.ValidationRelaxed,

2313 EHLOValidation: ehloValidation,

2314 MailFromValidation: mailFromValidation,

2315 MsgFromValidation: msgFromValidation,

2316 DKIMDomains: verifiedDKIMDomains,

2317 Size: int64(len(msgPrefix)) + msgWriter.Size,

2318 MsgPrefix: msgPrefix,

2319 }

2320 d := delivery{m, dataFile, rcptAcc, acc, msgFrom, c.dnsBLs, dmarcUse, dmarcResult, dkimResults, iprevStatus}

2321 a := analyze(ctx, log, c.resolver, d)

2322 if a.reason != "" {

2323 xmoxreason := "X-Mox-Reason: " + a.reason + "\r\n"

2324 m.MsgPrefix = append([]byte(xmoxreason), m.MsgPrefix...)