smtp/conn.go

   1 // mailpopbox
   2 // Copyright 2020 Blue Static <https://www.bluestatic.org>
   3 // This program is free software licensed under the GNU General Public License,
   4 // version 3.0. The full text of the license can be found in LICENSE.txt.
   5 // SPDX-License-Identifier: GPL-3.0-only
   6
   7 package smtp
   8
   9 import (
  10         "bytes"
  11         "crypto/tls"
  12         "encoding/base64"
  13         "fmt"
  14         "net"
  15         "net/mail"
  16         "net/textproto"
  17         "strings"
  18         "time"
  19
  20         "go.uber.org/zap"
  21 )
  22
  23 type state int
  24
  25 const (
  26         stateNew state = iota // Before EHLO.
  27         stateInitial
  28         stateMail
  29         stateRecipient
  30         stateData
  31 )
  32
  33 type delivery int
  34
  35 func (d delivery) String() string {
  36         switch d {
  37         case deliverUnknown:
  38                 return "unknown"
  39         case deliverInbound:
  40                 return "inbound"
  41         case deliverOutbound:
  42                 return "outbound"
  43         }
  44         panic("Unknown delivery")
  45 }
  46
  47 const (
  48         deliverUnknown  delivery = iota
  49         deliverInbound           // Mail is not from one of this server's domains.
  50         deliverOutbound          // Mail IS from one of this server's domains.
  51 )
  52
  53 type connection struct {
  54         server Server
  55
  56         tp *textproto.Conn
  57
  58         nc         net.Conn
  59         remoteAddr net.Addr
  60
  61         esmtp bool
  62         tls   *tls.ConnectionState
  63
  64         log *zap.Logger
  65
  66         // The authcid from a PLAIN SASL login. Non-empty iff tls is non-nil and
  67         // doAUTH() succeeded.
  68         authc string
  69
  70         state
  71         line string
  72
  73         delivery
  74         // For deliverOutbound, replaces the From and Reply-To values.
  75         sendAs *mail.Address
  76
  77         ehlo     string
  78         mailFrom *mail.Address
  79         rcptTo   []mail.Address
  80 }
  81
  82 func AcceptConnection(netConn net.Conn, server Server, log *zap.Logger) {
  83         conn := connection{
  84                 server:     server,
  85                 tp:         textproto.NewConn(netConn),
  86                 nc:         netConn,
  87                 remoteAddr: netConn.RemoteAddr(),
  88                 log:        log.With(zap.Stringer("client", netConn.RemoteAddr())),
  89                 state:      stateNew,
  90         }
  91
  92         conn.log.Info("accepted connection")
  93         conn.writeReply(220, fmt.Sprintf("%s ESMTP [%s] (mailpopbox)",
  94                 server.Name(), netConn.LocalAddr()))
  95
  96         for {
  97                 var err error
  98                 conn.line, err = conn.tp.ReadLine()
  99                 if err != nil {
 100                         conn.log.Error("ReadLine()", zap.Error(err))
 101                         conn.tp.Close()
 102                         return
 103                 }
 104
 105                 lineForLog := conn.line
 106                 const authPlain = "AUTH PLAIN "
 107                 if strings.HasPrefix(conn.line, authPlain) {
 108                         lineForLog = authPlain + "[redacted]"
 109                 }
 110                 conn.log.Info("ReadLine()", zap.String("line", lineForLog))
 111
 112                 var cmd string
 113                 if _, err = fmt.Sscanf(conn.line, "%s", &cmd); err != nil {
 114                         conn.reply(ReplyBadSyntax)
 115                         continue
 116                 }
 117
 118                 switch strings.ToUpper(cmd) {
 119                 case "QUIT":
 120                         conn.writeReply(221, "Goodbye")
 121                         conn.tp.Close()
 122                         return
 123                 case "HELO":
 124                         conn.esmtp = false
 125                         fallthrough
 126                 case "EHLO":
 127                         conn.esmtp = true
 128                         conn.doEHLO()
 129                 case "STARTTLS":
 130                         conn.doSTARTTLS()
 131                 case "AUTH":
 132                         conn.doAUTH()
 133                 case "MAIL":
 134                         conn.doMAIL()
 135                 case "RCPT":
 136                         conn.doRCPT()
 137                 case "DATA":
 138                         conn.doDATA()
 139                 case "RSET":
 140                         conn.doRSET()
 141                 case "VRFY":
 142                         conn.writeReply(252, "I'll do my best")
 143                 case "EXPN":
 144                         conn.writeReply(550, "access denied")
 145                 case "NOOP":
 146                         conn.reply(ReplyOK)
 147                 case "HELP":
 148                         conn.writeReply(250, "https://tools.ietf.org/html/rfc5321")
 149                 default:
 150                         conn.writeReply(500, "unrecognized command")
 151                 }
 152         }
 153 }
 154
 155 func (conn *connection) reply(reply ReplyLine) error {
 156         return conn.writeReply(reply.Code, reply.Message)
 157 }
 158
 159 func (conn *connection) writeReply(code int, msg string) error {
 160         conn.log.Info("writeReply", zap.Int("code", code))
 161         var err error
 162         if len(msg) > 0 {
 163                 err = conn.tp.PrintfLine("%d %s", code, msg)
 164         } else {
 165                 err = conn.tp.PrintfLine("%d", code)
 166         }
 167         if err != nil {
 168                 conn.log.Error("writeReply",
 169                         zap.Int("code", code),
 170                         zap.Error(err))
 171         }
 172         return err
 173 }
 174
 175 // parsePath parses out either a forward-, reverse-, or return-path from the
 176 // current connection line. Returns a (valid-path, ReplyOK) if it was
 177 // successfully parsed.
 178 func (conn *connection) parsePath(command string) (string, ReplyLine) {
 179         if len(conn.line) < len(command) {
 180                 return "", ReplyBadSyntax
 181         }
 182         if strings.ToUpper(command) != strings.ToUpper(conn.line[:len(command)]) {
 183                 return "", ReplyLine{500, "unrecognized command"}
 184         }
 185         params := conn.line[len(command):]
 186         idx := strings.Index(params, ">")
 187         if idx == -1 {
 188                 return "", ReplyBadSyntax
 189         }
 190         return strings.ToLower(params[:idx+1]), ReplyOK
 191 }
 192
 193 func (conn *connection) doEHLO() {
 194         conn.resetBuffers()
 195
 196         var cmd string
 197         _, err := fmt.Sscanf(conn.line, "%s %s", &cmd, &conn.ehlo)
 198         if err != nil {
 199                 conn.reply(ReplyBadSyntax)
 200                 return
 201         }
 202
 203         if cmd == "HELO" {
 204                 conn.writeReply(250, fmt.Sprintf("Hello %s [%s]", conn.ehlo, conn.remoteAddr))
 205         } else {
 206                 conn.tp.PrintfLine("250-Hello %s [%s]", conn.ehlo, conn.remoteAddr)
 207                 if conn.server.TLSConfig() != nil && conn.tls == nil {
 208                         conn.tp.PrintfLine("250-STARTTLS")
 209                 }
 210                 if conn.tls != nil {
 211                         conn.tp.PrintfLine("250-AUTH PLAIN")
 212                 }
 213                 conn.tp.PrintfLine("250 SIZE %d", 40960000)
 214         }
 215
 216         conn.log.Info("doEHLO()", zap.String("ehlo", conn.ehlo))
 217
 218         conn.state = stateInitial
 219 }
 220
 221 func (conn *connection) doSTARTTLS() {
 222         if conn.state != stateInitial {
 223                 conn.reply(ReplyBadSequence)
 224                 return
 225         }
 226
 227         tlsConfig := conn.server.TLSConfig()
 228         if !conn.esmtp || tlsConfig == nil {
 229                 conn.writeReply(500, "unrecognized command")
 230                 return
 231         }
 232
 233         conn.log.Info("doSTARTTLS()")
 234         conn.writeReply(220, "initiate TLS connection")
 235
 236         tlsConn := tls.Server(conn.nc, tlsConfig)
 237         if err := tlsConn.Handshake(); err != nil {
 238                 conn.log.Error("failed to do TLS handshake", zap.Error(err))
 239                 return
 240         }
 241
 242         conn.nc = tlsConn
 243         conn.tp = textproto.NewConn(tlsConn)
 244         conn.state = stateNew
 245
 246         connState := tlsConn.ConnectionState()
 247         conn.tls = &connState
 248
 249         conn.log.Info("TLS connection done", zap.String("state", conn.getTransportString()))
 250 }
 251
 252 func (conn *connection) doAUTH() {
 253         if conn.state != stateInitial || conn.tls == nil {
 254                 conn.reply(ReplyBadSequence)
 255                 return
 256         }
 257
 258         if conn.authc != "" {
 259                 conn.writeReply(503, "already authenticated")
 260                 return
 261         }
 262
 263         var cmd, authType, authString string
 264         n, err := fmt.Sscanf(conn.line, "%s %s %s", &cmd, &authType, &authString)
 265         if n < 2 {
 266                 conn.reply(ReplyBadSyntax)
 267                 return
 268         }
 269
 270         if authType != "PLAIN" {
 271                 conn.writeReply(504, "unrecognized auth type")
 272                 return
 273         }
 274
 275         // If only 2 tokens were scanned, then an initial response was not provided.
 276         if n == 2 && conn.line[len(conn.line)-1] != ' ' {
 277                 conn.reply(ReplyBadSyntax)
 278                 return
 279         }
 280
 281         conn.log.Info("doAUTH()")
 282
 283         if authString == "" {
 284                 conn.writeReply(334, " ")
 285
 286                 authString, err = conn.tp.ReadLine()
 287                 if err != nil {
 288                         conn.log.Error("failed to read auth line", zap.Error(err))
 289                         conn.reply(ReplyBadSyntax)
 290                         return
 291                 }
 292         }
 293
 294         authBytes, err := base64.StdEncoding.DecodeString(authString)
 295         if err != nil {
 296                 conn.reply(ReplyBadSyntax)
 297                 return
 298         }
 299
 300         authParts := strings.Split(string(authBytes), "\x00")
 301         if len(authParts) != 3 {
 302                 conn.log.Error("bad auth line syntax")
 303                 conn.reply(ReplyBadSyntax)
 304                 return
 305         }
 306
 307         if !conn.server.Authenticate(authParts[0], authParts[1], authParts[2]) {
 308                 conn.log.Error("failed to authenticate", zap.String("authc", authParts[1]))
 309                 conn.writeReply(535, "invalid credentials")
 310                 return
 311         }
 312
 313         conn.log.Info("authenticated", zap.String("authz", authParts[0]), zap.String("authc", authParts[1]))
 314         conn.authc = authParts[1]
 315         conn.reply(ReplyOK)
 316 }
 317
 318 func (conn *connection) doMAIL() {
 319         if conn.state != stateInitial {
 320                 conn.reply(ReplyBadSequence)
 321                 return
 322         }
 323
 324         mailFrom, reply := conn.parsePath("MAIL FROM:")
 325         if reply != ReplyOK {
 326                 conn.reply(reply)
 327                 return
 328         }
 329
 330         var err error
 331         conn.mailFrom, err = mail.ParseAddress(mailFrom)
 332         if err != nil || conn.mailFrom == nil {
 333                 conn.reply(ReplyBadSyntax)
 334                 return
 335         }
 336
 337         if conn.server.VerifyAddress(*conn.mailFrom) == ReplyOK {
 338                 if DomainForAddress(*conn.mailFrom) != DomainForAddressString(conn.authc) {
 339                         conn.writeReply(550, "not authenticated")
 340                         return
 341                 }
 342                 conn.delivery = deliverOutbound
 343         } else {
 344                 conn.delivery = deliverInbound
 345         }
 346
 347         conn.log.Info("doMAIL()", zap.String("address", conn.mailFrom.Address))
 348
 349         conn.state = stateMail
 350         conn.reply(ReplyOK)
 351 }
 352
 353 func (conn *connection) doRCPT() {
 354         if conn.state != stateMail && conn.state != stateRecipient {
 355                 conn.reply(ReplyBadSequence)
 356                 return
 357         }
 358
 359         rcptTo, reply := conn.parsePath("RCPT TO:")
 360         if reply != ReplyOK {
 361                 conn.reply(reply)
 362                 return
 363         }
 364
 365         address, err := mail.ParseAddress(rcptTo)
 366         if err != nil {
 367                 conn.reply(ReplyBadSyntax)
 368                 return
 369         }
 370
 371         if reply := conn.server.VerifyAddress(*address); reply != ReplyOK && conn.delivery == deliverInbound {
 372                 conn.log.Warn("invalid address",
 373                         zap.String("address", address.Address),
 374                         zap.Stringer("reply", reply))
 375                 conn.reply(reply)
 376                 return
 377         }
 378
 379         conn.log.Info("doRCPT()",
 380                 zap.String("address", address.Address),
 381                 zap.String("delivery", conn.delivery.String()))
 382
 383         conn.rcptTo = append(conn.rcptTo, *address)
 384
 385         conn.state = stateRecipient
 386         conn.reply(ReplyOK)
 387 }
 388
 389 func (conn *connection) doDATA() {
 390         if conn.state != stateRecipient {
 391                 conn.reply(ReplyBadSequence)
 392                 return
 393         }
 394
 395         conn.writeReply(354, "Start mail input; end with <CRLF>.<CRLF>")
 396         conn.log.Info("doDATA()")
 397
 398         data, err := conn.tp.ReadDotBytes()
 399         if err != nil {
 400                 conn.log.Error("failed to ReadDotBytes()",
 401                         zap.Error(err),
 402                         zap.String("bytes", fmt.Sprintf("%x", data)))
 403                 conn.writeReply(552, "transaction failed")
 404                 return
 405         }
 406
 407         received := time.Now()
 408         env := Envelope{
 409                 RemoteAddr: conn.remoteAddr,
 410                 EHLO:       conn.ehlo,
 411                 MailFrom:   *conn.mailFrom,
 412                 RcptTo:     conn.rcptTo,
 413                 Received:   received,
 414                 ID:         generateEnvelopeId("m", received),
 415                 Data:       data,
 416         }
 417
 418         conn.handleSendAs(&env)
 419
 420         conn.log.Info("received message",
 421                 zap.Int("bytes", len(data)),
 422                 zap.Time("date", received),
 423                 zap.String("id", env.ID),
 424                 zap.String("delivery", conn.delivery.String()))
 425
 426         trace := conn.getReceivedInfo(env)
 427
 428         env.Data = append(trace, env.Data...)
 429
 430         if conn.delivery == deliverInbound {
 431                 if reply := conn.server.OnMessageDelivered(env); reply != nil {
 432                         conn.log.Warn("message was rejected", zap.String("id", env.ID))
 433                         conn.reply(*reply)
 434                         return
 435                 }
 436         } else if conn.delivery == deliverOutbound {
 437                 conn.server.RelayMessage(env)
 438         }
 439
 440         conn.state = stateInitial
 441         conn.resetBuffers()
 442         conn.reply(ReplyOK)
 443 }
 444
 445 func (conn *connection) handleSendAs(env *Envelope) {
 446         if conn.delivery != deliverOutbound {
 447                 return
 448         }
 449
 450         // Find the separator between the message header and body.
 451         headerIdx := bytes.Index(env.Data, []byte("\n\n"))
 452         if headerIdx == -1 {
 453                 conn.log.Error("send-as: could not find headers index")
 454                 return
 455         }
 456
 457         var buf bytes.Buffer
 458
 459         headers := bytes.SplitAfter(env.Data[:headerIdx], []byte("\n"))
 460
 461         var fromIdx, subjectIdx int
 462         for i, header := range headers {
 463                 if bytes.HasPrefix(header, []byte("From:")) {
 464                         fromIdx = i
 465                         continue
 466                 }
 467                 if bytes.HasPrefix(header, []byte("Subject:")) {
 468                         subjectIdx = i
 469                         continue
 470                 }
 471         }
 472
 473         if subjectIdx == -1 {
 474                 conn.log.Error("send-as: could not find Subject header")
 475                 return
 476         }
 477         if fromIdx == -1 {
 478                 conn.log.Error("send-as: could not find From header")
 479                 return
 480         }
 481
 482         sendAs := SendAsSubject.FindSubmatchIndex(headers[subjectIdx])
 483         if sendAs == nil {
 484                 // No send-as modification.
 485                 return
 486         }
 487
 488         // Submatch 0 is the whole sendas magic. Submatch 1 is the address prefix.
 489         sendAsUser := headers[subjectIdx][sendAs[2]:sendAs[3]]
 490         sendAsAddress := string(sendAsUser) + "@" + DomainForAddressString(conn.authc)
 491
 492         for i, header := range headers {
 493                 if i == subjectIdx {
 494                         buf.Write(header[:sendAs[0]])
 495                         buf.Write(header[sendAs[1]:])
 496                 } else if i == fromIdx {
 497                         addressStart := bytes.LastIndexByte(header, byte('<'))
 498                         buf.Write(header[:addressStart+1])
 499                         buf.WriteString(sendAsAddress)
 500                         buf.WriteString(">\n")
 501                 } else {
 502                         buf.Write(header)
 503                 }
 504         }
 505
 506         buf.Write(env.Data[headerIdx:])
 507
 508         env.Data = buf.Bytes()
 509         env.MailFrom.Address = sendAsAddress
 510 }
 511
 512 func (conn *connection) getReceivedInfo(envelope Envelope) []byte {
 513         base := fmt.Sprintf("Received: from %s (%s)\r\n        ", conn.ehlo, lookupRemoteHost(conn.remoteAddr))
 514
 515         with := "SMTP"
 516         if conn.esmtp {
 517                 with = "E" + with
 518         }
 519         if conn.tls != nil {
 520                 with += "S"
 521         }
 522         base += fmt.Sprintf("by %s (mailpopbox) with %s id %s\r\n        ", conn.server.Name(), with, envelope.ID)
 523
 524         if len(envelope.RcptTo) > 0 {
 525                 base += fmt.Sprintf("for <%s>\r\n        ", envelope.RcptTo[0].Address)
 526         }
 527
 528         transport := conn.getTransportString()
 529         date := envelope.Received.Format(time.RFC1123Z) // Same as RFC 5322 § 3.3
 530         base += fmt.Sprintf("(using %s);\r\n        %s\r\n", transport, date)
 531
 532         return []byte(base)
 533 }
 534
 535 func (conn *connection) getTransportString() string {
 536         if conn.tls == nil {
 537                 return "PLAINTEXT"
 538         }
 539
 540         ciphers := map[uint16]string{
 541                 tls.TLS_RSA_WITH_RC4_128_SHA:                      "TLS_RSA_WITH_RC4_128_SHA",
 542                 tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA:                 "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
 543                 tls.TLS_RSA_WITH_AES_128_CBC_SHA:                  "TLS_RSA_WITH_AES_128_CBC_SHA",
 544                 tls.TLS_RSA_WITH_AES_256_CBC_SHA:                  "TLS_RSA_WITH_AES_256_CBC_SHA",
 545                 tls.TLS_RSA_WITH_AES_128_CBC_SHA256:               "TLS_RSA_WITH_AES_128_CBC_SHA256",
 546                 tls.TLS_RSA_WITH_AES_128_GCM_SHA256:               "TLS_RSA_WITH_AES_128_GCM_SHA256",
 547                 tls.TLS_RSA_WITH_AES_256_GCM_SHA384:               "TLS_RSA_WITH_AES_256_GCM_SHA384",
 548                 tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA:              "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",
 549                 tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:          "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
 550                 tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:          "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
 551                 tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA:                "TLS_ECDHE_RSA_WITH_RC4_128_SHA",
 552                 tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:           "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
 553                 tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:            "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
 554                 tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:            "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
 555                 tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:       "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
 556                 tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:         "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
 557                 tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:         "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
 558                 tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:       "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
 559                 tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:         "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
 560                 tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:       "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
 561                 tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:   "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
 562                 tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
 563                 tls.TLS_AES_128_GCM_SHA256:                        "TLS_AES_128_GCM_SHA256",
 564                 tls.TLS_AES_256_GCM_SHA384:                        "TLS_AES_256_GCM_SHA384",
 565                 tls.TLS_CHACHA20_POLY1305_SHA256:                  "TLS_CHACHA20_POLY1305_SHA256",
 566         }
 567         versions := map[uint16]string{
 568                 tls.VersionSSL30: "SSLv3.0",
 569                 tls.VersionTLS10: "TLSv1.0",
 570                 tls.VersionTLS11: "TLSv1.1",
 571                 tls.VersionTLS12: "TLSv1.2",
 572                 tls.VersionTLS13: "TLSv1.3",
 573         }
 574
 575         state := conn.tls
 576
 577         version := versions[state.Version]
 578         cipher := ciphers[state.CipherSuite]
 579
 580         if version == "" {
 581                 version = fmt.Sprintf("%x", state.Version)
 582         }
 583         if cipher == "" {
 584                 cipher = fmt.Sprintf("%x", state.CipherSuite)
 585         }
 586
 587         name := ""
 588         if state.ServerName != "" {
 589                 name = fmt.Sprintf(" name=%s", state.ServerName)
 590         }
 591
 592         return fmt.Sprintf("%s cipher=%s%s", version, cipher, name)
 593 }
 594
 595 func (conn *connection) doRSET() {
 596         conn.log.Info("doRSET()")
 597         conn.state = stateInitial
 598         conn.resetBuffers()
 599         conn.reply(ReplyOK)
 600 }
 601
 602 func (conn *connection) resetBuffers() {
 603         conn.delivery = deliverUnknown
 604         conn.sendAs = nil
 605         conn.mailFrom = nil
 606         conn.rcptTo = make([]mail.Address, 0)
 607 }