cqrenet/relay
6
0
Fork 0
mirror of https://github.com/chatmail/relay.git synced 2026-09-24 08:10:10 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,228 Commits 230 Branches 15 Tags
59e5dea59743aa794e8f9f8a53bc550ced577e8a
Commit Graph
12 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Alex V.andmissytake ed9b4092a8 test: add error-path tests for all bug fixes 
- test_doveauth: invalid localpart chars rejected, concurrent same-account creation
- test_expire: --mdir filtering uses msg.path correctly
- test_metadata: TURN exception returns N\n, success returns credentials
- test_turnserver: socket timeout, connection refused, happy path
- test_dns: get_dkim_entry returns (None, None) on CalledProcessError
- test_rshell: dovecot_recalc_quota handles empty/malformed output
 2026-03-05 16:27:15 +01:00
Alex V.andmissytake 1b8ad3ca12 fix: handle turn_credentials exceptions in metadata proxy 
ConnectionRefusedError/FileNotFoundError/TimeoutError from
turn_credentials() would kill the dict proxy connection.
Return N (not found) response instead and log the error.
 2026-03-05 16:27:15 +01:00
Alex V.andmissytake f85d304e65 fix: add 5s timeout to TURN credential socket 
Hung TURN daemon would block dict proxy handler thread indefinitely.
Per Python docs, settimeout() raises TimeoutError on expiry.
 2026-03-05 16:27:15 +01:00
Alex V.andmissytake 4d1856d8f1 fix(security): validate localpart chars and fix account creation race 
- Reject localparts with chars outside [a-z0-9._-] to prevent
  filesystem issues from crafted usernames via IMAP/SMTP auth
- Use filelock to serialize concurrent account creation for same
  address, preventing TOCTOU race where two threads both create
  an account and last writer wins
 2026-03-05 16:27:15 +01:00
Alex V.andmissytake ae2ab52aa9 fix(security): remove deprecated TLS 1.0/1.1 from nginx config 
TLS 1.0/1.1 deprecated by RFC 8996. Nginx default is TLSv1.2 TLSv1.3.
Aligns with postfix (>=TLSv1.2) and dovecot (TLSv1.3) in the same stack.
 2026-03-05 16:27:15 +01:00
Alex V.andmissytake d0c396538b fix(security): use secrets.choice instead of random.choices for username 
Per Python docs, secrets module should be used for security-sensitive
data. random.choices uses Mersenne Twister PRNG which is predictable.
secrets.choice was already used for password generation in the same file.
 2026-03-05 16:27:15 +01:00
Alex V.andmissytake 78a4e28408 fix: guard against IndexError in dovecot_recalc_quota 
doveadm output ends with empty line, parts=[] causes parts[2] crash.
 2026-03-05 16:27:15 +01:00
Alex V.andmissytake 2432d4f498 fix: remove dead code and potential NameError in run_cmd 
check_call always returns 0 or raises, making retcode!=0 branches
unreachable. Also remote_data was undefined with --skip-dns-check.
 2026-03-05 16:27:15 +01:00
Alex V.andmissytake 31301abb42 fix: handle build_webpages returning None in WebsiteDeployer 
Exception in _build_webpages was silently caught, returning None.
rsync then received "None/" as source path, silently breaking deploy.
 2026-03-05 16:27:15 +01:00
Alex V.andmissytake 6b4edd8502 fix: return tuple from get_dkim_entry on CalledProcessError 
Bare return yielded None, causing TypeError on tuple unpacking
in perform_initial_checks on fresh servers without DKIM keys.
 2026-03-05 16:27:15 +01:00
Alex V.andmissytake 9c467ab3e8 chore: fix ruff formatting in acmetool, dovecot, postfix deployers 2026-03-05 16:27:15 +01:00
Alex V.andj4n b128935940 fix: use msg.path instead of nonexistent msg.relpath in fsreport 
FileEntry namedtuple has (path, mtime, size), not relpath.
Crashes with AttributeError when --mdir flag is used.
 2026-03-05 13:52:09 +01:00