mirror of
https://blitiri.com.ar/repos/chasquid
synced 2026-01-09 17:55:57 +00:00
WIP: Add smarthost support
WORK IN PROGRESS -- WORK IN PROGRESS -- WORK IN PROGRESS This patch adds support for delivering mail via a smarthost. In this mode, all accepted mail gets delivered through an SMTP connection to a specific host, statically configured.
This commit is contained in:
Alberto Bertogli
145
internal/courier/smarthost.go
Normal file
145
internal/courier/smarthost.go
Normal file
@@ -0,0 +1,145 @@
|
||||
package courier
|
||||
|
||||
import (
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"net"
|
||||
netsmtp "net/smtp"
|
||||
"net/url"
|
||||
"time"
|
||||
|
||||
"blitiri.com.ar/go/chasquid/internal/expvarom"
|
||||
"blitiri.com.ar/go/chasquid/internal/smtp"
|
||||
"blitiri.com.ar/go/chasquid/internal/trace"
|
||||
)
|
||||
|
||||
var (
|
||||
// Timeouts for smarthost delivery.
|
||||
shDialTimeout = 1 * time.Minute
|
||||
shTotalTimeout = 10 * time.Minute
|
||||
)
|
||||
|
||||
// Exported variables.
|
||||
var (
|
||||
shAttempts = expvarom.NewInt("chasquid/smarthostOut/attempts",
|
||||
"count of attempts to deliver via smarthost")
|
||||
shErrors = expvarom.NewMap("chasquid/smarthostOut/errors",
|
||||
"reason", "count of smarthost delivery errors, per reason")
|
||||
shSuccess = expvarom.NewInt("chasquid/smarthostOut/success",
|
||||
"count of successful delivering via smarthost")
|
||||
)
|
||||
|
||||
// SmartHost delivers remote mail via smarthost relaying.
|
||||
type SmartHost struct {
|
||||
HelloDomain string
|
||||
URL url.URL
|
||||
|
||||
// For testing.
|
||||
rootCAs *x509.CertPool
|
||||
}
|
||||
|
||||
// Deliver an email. On failures, returns an error, and whether or not it is
|
||||
// permanent.
|
||||
func (s *SmartHost) Deliver(from string, to string, data []byte) (error, bool) {
|
||||
tr := trace.New("Courier.SmartHost", to)
|
||||
defer tr.Finish()
|
||||
tr.Debugf("%s -> %s", from, to)
|
||||
shAttempts.Add(1)
|
||||
|
||||
conn, onTLS, err := s.dial()
|
||||
if err != nil {
|
||||
shErrors.Add("dial", 1)
|
||||
return tr.Errorf("Could not dial %q: %v", s.URL.Host, err), false
|
||||
}
|
||||
|
||||
defer conn.Close()
|
||||
conn.SetDeadline(time.Now().Add(shTotalTimeout))
|
||||
|
||||
host, _, _ := net.SplitHostPort(s.URL.Host)
|
||||
|
||||
c, err := smtp.NewClient(conn, host)
|
||||
if err != nil {
|
||||
shErrors.Add("client", 1)
|
||||
return tr.Errorf("Error creating client: %v", err), false
|
||||
}
|
||||
|
||||
if err = c.Hello(s.HelloDomain); err != nil {
|
||||
shErrors.Add("hello", 1)
|
||||
return tr.Errorf("Error saying hello: %v", err), false
|
||||
}
|
||||
|
||||
if !onTLS {
|
||||
if ok, _ := c.Extension("STARTTLS"); !ok {
|
||||
shErrors.Add("starttls-support", 1)
|
||||
return tr.Errorf("Server does not support STARTTLS"), false
|
||||
}
|
||||
|
||||
config := &tls.Config{
|
||||
ServerName: host,
|
||||
RootCAs: s.rootCAs,
|
||||
}
|
||||
if err = c.StartTLS(config); err != nil {
|
||||
shErrors.Add("starttls-exchange", 1)
|
||||
return tr.Errorf("Error in STARTTLS: %v", err), false
|
||||
}
|
||||
}
|
||||
|
||||
if s.URL.User != nil {
|
||||
user := s.URL.User.Username()
|
||||
password, _ := s.URL.User.Password()
|
||||
auth := netsmtp.PlainAuth("", user, password, host)
|
||||
if err = c.Auth(auth); err != nil {
|
||||
shErrors.Add("auth", 1)
|
||||
return tr.Errorf("AUTH error: %v", err), false
|
||||
}
|
||||
}
|
||||
|
||||
// smtp.Client.Mail will add the <> for us when the address is empty.
|
||||
if from == "<>" {
|
||||
from = ""
|
||||
}
|
||||
|
||||
if err = c.MailAndRcpt(from, to); err != nil {
|
||||
shErrors.Add("mail", 1)
|
||||
return tr.Errorf("MAIL+RCPT %v", err), smtp.IsPermanent(err)
|
||||
}
|
||||
|
||||
w, err := c.Data()
|
||||
if err != nil {
|
||||
shErrors.Add("data", 1)
|
||||
return tr.Errorf("DATA %v", err), smtp.IsPermanent(err)
|
||||
}
|
||||
_, err = w.Write(data)
|
||||
if err != nil {
|
||||
shErrors.Add("dataw", 1)
|
||||
return tr.Errorf("DATA writing: %v", err), smtp.IsPermanent(err)
|
||||
}
|
||||
|
||||
err = w.Close()
|
||||
if err != nil {
|
||||
shErrors.Add("close", 1)
|
||||
return tr.Errorf("DATA closing %v", err), smtp.IsPermanent(err)
|
||||
}
|
||||
|
||||
_ = c.Quit()
|
||||
tr.Debugf("done")
|
||||
shSuccess.Add(1)
|
||||
|
||||
return nil, false
|
||||
}
|
||||
|
||||
func (s *SmartHost) dial() (conn net.Conn, onTLS bool, err error) {
|
||||
dialer := &net.Dialer{Timeout: shDialTimeout}
|
||||
|
||||
if s.URL.Scheme == "tls" {
|
||||
onTLS = true
|
||||
config := &tls.Config{
|
||||
RootCAs: s.rootCAs,
|
||||
}
|
||||
conn, err = tls.DialWithDialer(dialer, "tcp", s.URL.Host, config)
|
||||
} else {
|
||||
onTLS = false
|
||||
conn, err = dialer.Dial("tcp", s.URL.Host)
|
||||
}
|
||||
return
|
||||
}
|
||||
220
internal/courier/smarthost_test.go
Normal file
220
internal/courier/smarthost_test.go
Normal file
@@ -0,0 +1,220 @@
|
||||
package courier
|
||||
|
||||
import (
|
||||
"net/url"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func newSmartHost(t *testing.T, addr string) *SmartHost {
|
||||
return &SmartHost{
|
||||
HelloDomain: "hello",
|
||||
URL: url.URL{
|
||||
Scheme: "smtp",
|
||||
Host: addr,
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func TestSmartHost(t *testing.T) {
|
||||
// Shorten the total timeout, so the test fails quickly if the protocol
|
||||
// gets stuck.
|
||||
shTotalTimeout = 3 * time.Second
|
||||
|
||||
responses := map[string]string{
|
||||
"_welcome": "220 welcome\n",
|
||||
"EHLO hello": "250-ehlo ok\n250 STARTTLS AUTH HELP\n",
|
||||
"STARTTLS": "220 tls ok\n",
|
||||
"_STARTTLS": "ok",
|
||||
|
||||
// Auth corresponds to the user and password below.
|
||||
"AUTH PLAIN AHVzZXIAcGFzc3dvcmQ=": "235 auth ok\n",
|
||||
|
||||
"MAIL FROM:<me@me>": "250 mail ok\n",
|
||||
"RCPT TO:<to@to>": "250 rcpt ok\n",
|
||||
"DATA": "354 send data\n",
|
||||
"_DATA": "250 data ok\n",
|
||||
"QUIT": "250 quit ok\n",
|
||||
}
|
||||
srv := newFakeServer(t, responses)
|
||||
|
||||
sh := newSmartHost(t, srv.addr)
|
||||
sh.URL.User = url.UserPassword("user", "password")
|
||||
sh.rootCAs = srv.rootCA()
|
||||
err, _ := sh.Deliver("me@me", "to@to", []byte("data"))
|
||||
if err != nil {
|
||||
t.Errorf("deliver failed: %v", err)
|
||||
}
|
||||
|
||||
srv.wg.Wait()
|
||||
}
|
||||
|
||||
func TestSmartHostBadAuth(t *testing.T) {
|
||||
// Shorten the total timeout, so the test fails quickly if the protocol
|
||||
// gets stuck.
|
||||
shTotalTimeout = 3 * time.Second
|
||||
|
||||
responses := map[string]string{
|
||||
"_welcome": "220 welcome\n",
|
||||
"EHLO hello": "250-ehlo ok\n250-STARTTLS\n250 AUTH PLAIN\n",
|
||||
"STARTTLS": "220 tls ok\n",
|
||||
"_STARTTLS": "ok",
|
||||
|
||||
// Auth corresponds to the user and password below.
|
||||
"AUTH PLAIN AHVzZXIAcGFzc3dvcmQ=": "454 auth error\n",
|
||||
|
||||
// The client will use an "*" to abort the auth on errors.
|
||||
"*": "501 invalid command\n",
|
||||
|
||||
"QUIT": "250 quit ok\n",
|
||||
}
|
||||
srv := newFakeServer(t, responses)
|
||||
|
||||
sh := newSmartHost(t, srv.addr)
|
||||
sh.URL.User = url.UserPassword("user", "password")
|
||||
sh.rootCAs = srv.rootCA()
|
||||
err, _ := sh.Deliver("me@me", "to@to", []byte("data"))
|
||||
if !strings.HasPrefix(err.Error(), "AUTH error: 454 auth error") {
|
||||
t.Errorf("expected error in AUTH, got %q", err)
|
||||
}
|
||||
|
||||
srv.wg.Wait()
|
||||
}
|
||||
|
||||
func TestSmartHostBadCert(t *testing.T) {
|
||||
// Shorten the total timeout, so the test fails quickly if the protocol
|
||||
// gets stuck.
|
||||
shTotalTimeout = 3 * time.Second
|
||||
|
||||
responses := map[string]string{
|
||||
"_welcome": "220 welcome\n",
|
||||
"EHLO hello": "250-ehlo ok\n250 STARTTLS\n",
|
||||
"STARTTLS": "220 tls ok\n",
|
||||
"_STARTTLS": "ok",
|
||||
}
|
||||
srv := newFakeServer(t, responses)
|
||||
|
||||
sh := newSmartHost(t, srv.addr)
|
||||
// We do NOT set the root CA to our test server's certificate, so we
|
||||
// expect the STARTTLS negotiation to fail.
|
||||
err, _ := sh.Deliver("me@me", "to@to", []byte("data"))
|
||||
if !strings.HasPrefix(err.Error(), "Error in STARTTLS:") {
|
||||
t.Errorf("expected error in STARTTLS, got %q", err)
|
||||
}
|
||||
|
||||
srv.wg.Wait()
|
||||
}
|
||||
|
||||
func TestSmartHostErrors(t *testing.T) {
|
||||
// Shorten the total timeout, so the test fails quickly if the protocol
|
||||
// gets stuck.
|
||||
shTotalTimeout = 1 * time.Second
|
||||
|
||||
cases := []struct {
|
||||
responses map[string]string
|
||||
errPrefix string
|
||||
}{
|
||||
// First test: hang response, should fail due to timeout.
|
||||
{
|
||||
map[string]string{"_welcome": "220 no newline"},
|
||||
"",
|
||||
},
|
||||
|
||||
// No STARTTLS support.
|
||||
{
|
||||
map[string]string{
|
||||
"_welcome": "220 rcpt to not allowed\n",
|
||||
"EHLO hello": "250-ehlo ok\n250 HELP\n",
|
||||
},
|
||||
"Server does not support STARTTLS",
|
||||
},
|
||||
|
||||
// MAIL FROM not allowed.
|
||||
{
|
||||
map[string]string{
|
||||
"_welcome": "220 mail from not allowed\n",
|
||||
"EHLO hello": "250-ehlo ok\n250 STARTTLS\n",
|
||||
"STARTTLS": "220 tls ok\n",
|
||||
"_STARTTLS": "ok",
|
||||
"MAIL FROM:<me@me>": "501 mail error\n",
|
||||
},
|
||||
"MAIL+RCPT 501 mail error",
|
||||
},
|
||||
|
||||
// RCPT TO not allowed.
|
||||
{
|
||||
map[string]string{
|
||||
"_welcome": "220 rcpt to not allowed\n",
|
||||
"EHLO hello": "250-ehlo ok\n250 STARTTLS\n",
|
||||
"STARTTLS": "220 tls ok\n",
|
||||
"_STARTTLS": "ok",
|
||||
"MAIL FROM:<me@me>": "250 mail ok\n",
|
||||
"RCPT TO:<to@to>": "501 rcpt error\n",
|
||||
},
|
||||
"MAIL+RCPT 501 rcpt error",
|
||||
},
|
||||
|
||||
// DATA error.
|
||||
{
|
||||
map[string]string{
|
||||
"_welcome": "220 data error\n",
|
||||
"EHLO hello": "250-ehlo ok\n250 STARTTLS\n",
|
||||
"STARTTLS": "220 tls ok\n",
|
||||
"_STARTTLS": "ok",
|
||||
"MAIL FROM:<me@me>": "250 mail ok\n",
|
||||
"RCPT TO:<to@to>": "250 rcpt ok\n",
|
||||
"DATA": "554 data error\n",
|
||||
},
|
||||
"DATA 554 data error",
|
||||
},
|
||||
|
||||
// DATA response error.
|
||||
{
|
||||
map[string]string{
|
||||
"_welcome": "220 data error\n",
|
||||
"EHLO hello": "250-ehlo ok\n250 STARTTLS\n",
|
||||
"STARTTLS": "220 tls ok\n",
|
||||
"_STARTTLS": "ok",
|
||||
"MAIL FROM:<me@me>": "250 mail ok\n",
|
||||
"RCPT TO:<to@to>": "250 rcpt ok\n",
|
||||
"DATA": "354 send data\n",
|
||||
"_DATA": "551 data response error\n",
|
||||
},
|
||||
"DATA closing 551 data response error",
|
||||
},
|
||||
}
|
||||
|
||||
for _, c := range cases {
|
||||
srv := newFakeServer(t, c.responses)
|
||||
sh := newSmartHost(t, srv.addr)
|
||||
sh.rootCAs = srv.rootCA()
|
||||
|
||||
err, _ := sh.Deliver("me@me", "to@to", []byte("data"))
|
||||
if err == nil {
|
||||
t.Errorf("deliver not failed in case %q: %v",
|
||||
c.responses["_welcome"], err)
|
||||
continue
|
||||
}
|
||||
t.Logf("failed as expected: %v", err)
|
||||
|
||||
if !strings.HasPrefix(err.Error(), c.errPrefix) {
|
||||
t.Errorf("expected error prefix %q, got %q",
|
||||
c.errPrefix, err)
|
||||
}
|
||||
|
||||
srv.wg.Wait()
|
||||
}
|
||||
}
|
||||
|
||||
func TestSmartHostDialError(t *testing.T) {
|
||||
sh := newSmartHost(t, "localhost:1")
|
||||
err, permanent := sh.Deliver("me@me", "to@to", []byte("data"))
|
||||
if err == nil {
|
||||
t.Errorf("delivery worked, expected failure")
|
||||
}
|
||||
if permanent {
|
||||
t.Errorf("expected transient failure, got permanent (%v)", err)
|
||||
}
|
||||
t.Logf("got transient failure, as expected: %v", err)
|
||||
}
|
||||
Reference in New Issue
Block a user