feat(transport): Remote delivery over SMTP (#104)

Implements a new mode "transport", that allows filtermail to be used for remote delivery. In transport mode, filtermail listens for LMTP connections, splits messages by domain and performs delivery to remote MTAs over SMTP. SMTP client tries to open socket on all resolved addresses in parallel and uses one that succeeds the first, fixing the issue described in: chatmail/relay#900 Extends the built-in SMTP client with STARTTLS support. Extends the built-in SMTP server with LMTP greeting support. Groundwork required for mxdeliv endpoint (HTTP channel for MTA-to-MTA communication): chatmail/relay#900 Signed-off-by: Jagoda Ślązak <jslazak@jslazak.com>
2026-09-20 14:20:08 +00:00 · 2026-04-15 22:12:09 +02:00
parent ec0413bd5f
commit cf64778f71
15 changed files with 815 additions and 120 deletions
@@ -0,0 +1,49 @@
+//! Dangerous TLS implementation of accepting invalid certificates for Rustls.
+
+use rustls::pki_types::{CertificateDer, ServerName, UnixTime};
+use tokio_rustls::rustls;
+
+#[derive(Debug, Default)]
+pub(super) struct NoCertificateVerification();
+
+impl rustls::client::danger::ServerCertVerifier for NoCertificateVerification {
+    fn verify_server_cert(
+        &self,
+        _end_entity: &CertificateDer<'_>,
+        _intermediates: &[CertificateDer<'_>],
+        _server_name: &ServerName<'_>,
+        _ocsp_response: &[u8],
+        _now: UnixTime,
+    ) -> Result<rustls::client::danger::ServerCertVerified, rustls::Error> {
+        Ok(rustls::client::danger::ServerCertVerified::assertion())
+    }
+
+    fn verify_tls12_signature(
+        &self,
+        message: &[u8],
+        cert: &CertificateDer<'_>,
+        dss: &rustls::DigitallySignedStruct,
+    ) -> Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
+        let provider = rustls::crypto::ring::default_provider();
+        let supported_schemes = &provider.signature_verification_algorithms;
+        rustls::crypto::verify_tls12_signature(message, cert, dss, supported_schemes)
+    }
+
+    fn verify_tls13_signature(
+        &self,
+        message: &[u8],
+        cert: &CertificateDer<'_>,
+        dss: &rustls::DigitallySignedStruct,
+    ) -> Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
+        let provider = rustls::crypto::ring::default_provider();
+        let supported_schemes = &provider.signature_verification_algorithms;
+        rustls::crypto::verify_tls13_signature(message, cert, dss, supported_schemes)
+    }
+
+    fn supported_verify_schemes(&self) -> Vec<rustls::SignatureScheme> {
+        let provider = rustls::crypto::ring::default_provider();
+        provider
+            .signature_verification_algorithms
+            .supported_schemes()
+    }
+}