Switch from BLF-CRYPT to SHA512-CRYPT

Add time as a prefix.

README.md

@@ -52,7 +52,6 @@ scripts/
     init.sh  # create venv/other perequires
     deploy.sh  # run pyinfra based deploy of everything
     test.sh # run all local and online tests 
-    bench.sh # run performance benchmark tests
 
 ```
 

chatmaild/src/chatmaild/dictproxy.py

@@ -95,7 +95,7 @@ def main():
             while True:
                 msg = self.rfile.readline().strip().decode()
                 if not msg:
-                    break
+                    continue
                 res = handle_dovecot_request(msg, db)
                 if res:
                     print(f"sending result: {res!r}", file=sys.stderr)

deploy-chatmail/src/deploy_chatmail/__init__.py

@@ -110,7 +110,7 @@ def _configure_opendkim(domain: str, dkim_selector: str) -> bool:
     return need_restart
 
 
-def _configure_postfix(domain: str, debug: bool = False) -> bool:
+def _configure_postfix(domain: str) -> bool:
     """Configures Postfix SMTP server."""
     need_restart = False
 
@@ -124,20 +124,21 @@ def _configure_postfix(domain: str, debug: bool = False) -> bool:
     )
     need_restart |= main_config.changed
 
-    master_config = files.template(
-        src=importlib.resources.files(__package__).joinpath("postfix/master.cf.j2"),
+    master_config = files.put(
+        src=importlib.resources.files(__package__)
+        .joinpath("postfix/master.cf")
+        .open("rb"),
         dest="/etc/postfix/master.cf",
         user="root",
         group="root",
         mode="644",
-        debug=debug,
     )
     need_restart |= master_config.changed
 
     return need_restart
 
 
-def _configure_dovecot(mail_server: str, debug: bool = False) -> bool:
+def _configure_dovecot(mail_server: str) -> bool:
     """Configures Dovecot IMAP server."""
     need_restart = False
 
@@ -148,7 +149,6 @@ def _configure_dovecot(mail_server: str, debug: bool = False) -> bool:
         group="root",
         mode="644",
         config={"hostname": mail_server},
-        debug=debug,
     )
     need_restart |= main_config.changed
     auth_config = files.put(
@@ -160,16 +160,6 @@ def _configure_dovecot(mail_server: str, debug: bool = False) -> bool:
     )
     need_restart |= auth_config.changed
 
-    files.put(
-        src=importlib.resources.files(__package__)
-        .joinpath("dovecot/expunge.cron")
-        .open("rb"),
-        dest="/etc/cron.d/expunge",
-        user="root",
-        group="root",
-        mode="644",
-    )
-
     return need_restart
 
 
@@ -215,9 +205,8 @@ def deploy_chatmail(mail_domain: str, mail_server: str, dkim_selector: str) -> N
     )
 
     _install_chatmaild()
-    debug = False
-    dovecot_need_restart = _configure_dovecot(mail_server, debug=debug)
-    postfix_need_restart = _configure_postfix(mail_domain, debug=debug)
+    dovecot_need_restart = _configure_dovecot(mail_server)
+    postfix_need_restart = _configure_postfix(mail_domain)
     opendkim_need_restart = _configure_opendkim(mail_domain, dkim_selector)
 
     systemd.service(

deploy-chatmail/src/deploy_chatmail/dovecot/dovecot.conf.j2

@@ -4,17 +4,11 @@ protocols = imap lmtp
 
 auth_mechanisms = plain
 
-{% if debug == true %}
 auth_verbose = yes
 auth_debug = yes
 auth_debug_passwords = yes
 auth_verbose_passwords = plain
 auth_cache_size = 100M
-mail_debug = yes
-{% endif %}
-
-
-mail_plugins = quota
 
 # Authentication for system users.
 passdb {
@@ -66,28 +60,13 @@ mail_privileged_group = vmail
 # Enable IMAP COMPRESS (RFC 4978).
 # <https://datatracker.ietf.org/doc/html/rfc4978.html>
 protocol imap {
-  mail_plugins = $mail_plugins imap_zlib imap_quota
-}
-
-protocol lmtp {
-  mail_plugins = $mail_plugins quota
+  mail_plugins = $mail_plugins imap_zlib
 }
 
 plugin {
   imap_compress_deflate_level = 6
 }
 
-plugin {
-  # for now we define static quota-rules for all users 
-  quota = maildir:User quota
-  quota_rule = *:storage=100M
-  quota_max_mail_size=30M
-  quota_grace = 0
-  # quota_over_flag_value = TRUE
-}
-
-
-
 service lmtp {
   user=vmail
 

deploy-chatmail/src/deploy_chatmail/dovecot/expunge.cron

@@ -1,4 +0,0 @@
-2 0 * * * dovecot doveadm expunge -A SEEN BEFORE 40d INBOX
-2 0 * * * dovecot doveadm expunge -A SEEN BEFORE 40d Deltachat
-2 0 * * * dovecot doveadm expunge -A SEEN BEFORE 40d Trash
-2 30 * * * dovecot doveadm purge -A

deploy-chatmail/src/deploy_chatmail/postfix/main.cf.j2

@@ -37,8 +37,6 @@ mydestination =
 relayhost = 
 mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
 mailbox_size_limit = 0
-# maximum 30MB sized messages
-message_size_limit = 31457280
 recipient_delimiter = +
 inet_interfaces = all
 inet_protocols = all

deploy-chatmail/src/deploy_chatmail/postfix/master.cf

@@ -9,11 +9,7 @@
 # service type  private unpriv  chroot  wakeup  maxproc command + args
 #               (yes)   (yes)   (no)    (never) (100)
 # ==========================================================================
-{% if debug == true %}
-smtp      inet  n       -       y       -       -       smtpd -v
-{% else %}
 smtp      inet  n       -       y       -       -       smtpd
-{% endif %}
 #smtp      inet  n       -       y       -       1       postscreen
 #smtpd     pass  -       -       y       -       -       smtpd
 #dnsblog   unix  -       -       y       -       0       dnsblog
@@ -32,7 +28,7 @@ submission inet n       -       y       -       -       smtpd
   -o smtpd_recipient_restrictions=
   -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
   -o milter_macro_daemon_name=ORIGINATING
-  -o content_filter=filter:unix:private/filtermail
+  -o content_filter=filter:unix:private/filtemail
 smtps     inet  n       -       y       -       -       smtpd
   -o syslog_name=postfix/smtps
   -o smtpd_tls_wrappermode=yes

online-tests/benchmark.py

@@ -1,34 +0,0 @@
-def test_tls_serialized_connect(benchmark, imap_or_smtp):
-    def connect():
-        imap_or_smtp.connect()
-
-    benchmark(connect)
-
-
-def test_login(benchmark, imap_or_smtp, gencreds):
-    cls = imap_or_smtp.__class__
-    conns = []
-    for i in range(20):
-        conn = cls(imap_or_smtp.host)
-        conn.connect()
-        conns.append(conn)
-
-    def login():
-        conn = conns.pop()
-        conn.login(*gencreds())
-
-    benchmark(login)
-
-
-def test_send_and_receive_10(benchmark, cmfactory, lp):
-    """send many messages between two accounts"""
-    ac1, ac2 = cmfactory.get_online_accounts(2)
-    chat = cmfactory.get_accepted_chat(ac1, ac2)
-
-    def send_10_receive_all():
-        for i in range(10):
-            chat.send_text(f"hello {i}")
-        for i in range(10):
-            ac2.wait_next_incoming_message()
-
-    benchmark(send_10_receive_all)

online-tests/conftest.py

@@ -1,57 +1,15 @@
 import os
 import io
-import random
-import subprocess
 import imaplib
 import smtplib
 import itertools
 import pytest
-
-
-def pytest_addoption(parser):
-    parser.addoption(
-        "--slow", action="store_true", default=False, help="also run slow tests"
-    )
-
-
-def pytest_runtest_setup(item):
-    markers = list(item.iter_markers(name="slow"))
-    if markers:
-        if not item.config.getoption("--slow"):
-            pytest.skip("skipping slow test, use --slow to run")
+import time
 
 
 @pytest.fixture
 def maildomain():
-    domain = os.environ.get("CHATMAIL_DOMAIN")
-    if not domain:
-        pytest.skip("set CHATMAIL_DOMAIN to a ssh-reachable chatmail instance")
-    return domain
-
-
-@pytest.fixture
-def sshdomain(maildomain):
-    return os.environ.get("CHATMAIL_SSH", maildomain)
-
-
-@pytest.fixture
-def maildomain2():
-    domain = os.environ.get("CHATMAIL_DOMAIN2")
-    if not domain:
-        pytest.skip("set CHATMAIL_DOMAIN2 to a ssh-reachable chatmail instance")
-    return domain
-
-
-@pytest.fixture
-def sshdomain2(maildomain2):
-    return os.environ.get("CHATMAIL_SSH2", maildomain2)
-
-
-def pytest_report_header():
-    domain = os.environ.get("CHATMAIL_DOMAIN")
-    if domain:
-        text = f"chatmail test instance: {domain}"
-        return ["-" * len(text), text, "-" * len(text)]
+    return os.environ.get("CHATMAIL_DOMAIN", "c1.testrun.org")
 
 
 @pytest.fixture
@@ -60,10 +18,6 @@ def imap(maildomain):
 
 
 class ImapConn:
-    AuthError = imaplib.IMAP4.error
-    logcmd = "journalctl -f -u dovecot"
-    name = "dovecot"
-
     def __init__(self, host):
         self.host = host
 
@@ -82,10 +36,6 @@ def smtp(maildomain):
 
 
 class SmtpConn:
-    AuthError = smtplib.SMTPAuthenticationError
-    logcmd = "journalctl -f -t postfix/smtpd -t postfix/smtp -t postfix/lmtp"
-    name = "postfix"
-
     def __init__(self, host):
         self.host = host
 
@@ -98,27 +48,17 @@ class SmtpConn:
         self.conn.login(user, password)
 
 
-@pytest.fixture(params=["imap", "smtp"])
-def imap_or_smtp(request):
-    return request.getfixturevalue(request.param)
-
-
 @pytest.fixture
 def gencreds(maildomain):
+    prefix = str(time.time())
     count = itertools.count()
-    next(count)
 
-    def gen(domain=None):
-        domain = domain if domain else maildomain
+    def gen():
         while 1:
             num = next(count)
-            alphanumeric = "abcdefghijklmnopqrstuvwxyz1234567890"
-            user = "".join(random.choices(alphanumeric, k=10))
-            user = f"ac{num}_{user}"
-            password = "".join(random.choices(alphanumeric, k=10))
-            yield f"{user}@{domain}", f"{password}"
+            yield f"user{prefix}_{num}@{maildomain}", f"password{prefix}_{num}"
 
-    return lambda domain=None: next(gen(domain))
+    return lambda: next(gen())
 
 
 #
@@ -133,20 +73,13 @@ class ChatmailTestProcess:
     def __init__(self, pytestconfig, maildomain, gencreds):
         self.pytestconfig = pytestconfig
         self.maildomain = maildomain
-        assert "." in self.maildomain, maildomain
         self.gencreds = gencreds
         self._addr2files = {}
 
     def get_liveconfig_producer(self):
         while 1:
-            user, password = self.gencreds(self.maildomain)
-            config = {
-                "addr": user,
-                "mail_pw": password,
-            }
-            # speed up account configuration
-            config["mail_server"] = self.maildomain
-            config["send_server"] = self.maildomain
+            user, password = self.gencreds()
+            config = {"addr": user, "mail_pw": password}
             yield config
 
     def cache_maybe_retrieve_configured_db_files(self, cache_addr, db_target_path):
@@ -157,45 +90,17 @@ class ChatmailTestProcess:
 
 
 @pytest.fixture
-def cmfactory(request, gencreds, tmpdir, data, maildomain):
+def cmfactory(request, maildomain, gencreds, tmpdir, data):
     # cloned from deltachat.testplugin.amfactory
     pytest.importorskip("deltachat")
     from deltachat.testplugin import ACFactory
 
     testproc = ChatmailTestProcess(request.config, maildomain, gencreds)
     am = ACFactory(request=request, tmpdir=tmpdir, testprocess=testproc, data=data)
-
-    # nb. a bit hacky
-    # would probably be better if deltachat's test machinery grows native support
-    def switch_maildomain(maildomain2):
-        am.testprocess.maildomain = maildomain2
-
-    am.switch_maildomain = switch_maildomain
-
     yield am
     if hasattr(request.node, "rep_call") and request.node.rep_call.failed:
-        if testproc.pytestconfig.getoption("--extra-info"):
+        if testprocess.pytestconfig.getoption("--extra-info"):
             logfile = io.StringIO()
             am.dump_imap_summary(logfile=logfile)
             print(logfile.getvalue())
             # request.node.add_report_section("call", "imap-server-state", s)
-
-
-@pytest.fixture
-def remote(sshdomain):
-    return Remote(sshdomain)
-
-
-class Remote:
-    def __init__(self, sshdomain):
-        self.sshdomain = sshdomain
-
-    def iter_output(self, logcmd=""):
-        getjournal = f"journalctl -f" if not logcmd else logcmd
-        self.popen = subprocess.Popen(
-            ["ssh", f"root@{self.sshdomain}", getjournal],
-            stdout=subprocess.PIPE,
-        )
-        while 1:
-            line = self.popen.stdout.readline()
-            yield line.decode().strip().lower()

online-tests/pytest.ini

@@ -1,3 +1,2 @@
 [pytest]
-addopts = -vrsx --strict-markers
-markers = slow: mark test as slow (requires --slow option to run)
+addopts = -vrsx

online-tests/test_0_basic.py

@@ -1,15 +0,0 @@
-def test_remote(remote, imap_or_smtp):
-    lineproducer = remote.iter_output(imap_or_smtp.logcmd)
-    imap_or_smtp.connect()
-    assert imap_or_smtp.name in next(lineproducer)
-
-
-def test_use_two_chatmailservers(cmfactory, maildomain2):
-    ac1 = cmfactory.new_online_configuring_account(cache=False)
-    cmfactory.switch_maildomain(maildomain2)
-    ac2 = cmfactory.new_online_configuring_account(cache=False)
-    cmfactory.bring_accounts_online()
-    cmfactory.get_accepted_chat(ac1, ac2)
-    domain1 = ac1.get_config("addr").split("@")[1]
-    domain2 = ac2.get_config("addr").split("@")[1]
-    assert domain1 != domain2

online-tests/test_0_login.py

@@ -1,36 +1,55 @@
 import pytest
+import imaplib
+import smtplib
 
 
-def test_login_basic_functioning(imap_or_smtp, gencreds, lp):
-    """Test a) that an initial login creates a user automatically
-    and b) verify we can also login a second time with the same password
-    and c) that using a different password fails the login."""
+class TestDovecot:
+    def test_login_ok(self, imap, gencreds):
         user, password = gencreds()
-    lp.sec(f"login first time with {user} {password}")
-    imap_or_smtp.connect()
-    imap_or_smtp.login(user, password)
-    lp.indent("success")
+        imap.connect()
+        imap.login(user, password)
+        # verify it works on another connection
+        imap.connect()
+        imap.login(user, password)
 
-    lp.sec(f"reconnect and login second time {user} {password}")
-    imap_or_smtp.connect()
-    imap_or_smtp.login(user, password)
-    imap_or_smtp.connect()
-    lp.sec("success")
+    def test_login_same_password(self, imap, gencreds):
+        """Test two different users logging in with the same password.
 
-    lp.sec(f"reconnect and verify wrong password fails {user} ")
-    imap_or_smtp.connect()
-    with pytest.raises(imap_or_smtp.AuthError):
-        imap_or_smtp.login(user, password + "wrong")
-
-
-def test_login_same_password(imap_or_smtp, gencreds):
-    """Test two different users logging in with the same password
-    to ensure that authentication process does not confuse the users
+        This ensures that authentication process does not confuse the users
         by using only the password hash as a key.
         """
         user1, password1 = gencreds()
-    user2, _ = gencreds()
-    imap_or_smtp.connect()
-    imap_or_smtp.login(user1, password1)
-    imap_or_smtp.connect()
-    imap_or_smtp.login(user2, password1)
+        user2, _password2 = gencreds()
+        imap.connect()
+        imap.login(user1, password1)
+        imap.connect()
+        imap.login(user2, password1)
+
+    def test_login_fail(self, imap, gencreds):
+        user, password = gencreds()
+        imap.connect()
+        imap.login(user, password)
+        imap.connect()
+        with pytest.raises(imaplib.IMAP4.error) as excinfo:
+            imap.login(user, password + "wrong")
+        assert "AUTHENTICATIONFAILED" in str(excinfo)
+
+
+class TestPostfix:
+    def test_login_ok(self, smtp, gencreds):
+        user, password = gencreds()
+        smtp.connect()
+        smtp.login(user, password)
+        # verify it works on another connection
+        smtp.connect()
+        smtp.login(user, password)
+
+    def test_login_fail(self, smtp, gencreds):
+        user, password = gencreds()
+        smtp.connect()
+        smtp.login(user, password)
+        smtp.connect()
+        with pytest.raises(smtplib.SMTPAuthenticationError) as excinfo:
+            smtp.login(user, password + "wrong")
+        assert excinfo.value.smtp_code == 535
+        assert "authentication failed" in str(excinfo)

online-tests/test_1_deltachat.py

@@ -1,69 +1,11 @@
-import random
-import pytest
-
-
-class TestEndToEndDeltaChat:
-    "Tests that use Delta Chat accounts on the chat mail instance."
-
+class TestMailSending:
     def test_one_on_one(self, cmfactory, lp):
-        """Test that a DC account can send a message to a second DC account
-        on the same chat-mail instance."""
         ac1, ac2 = cmfactory.get_online_accounts(2)
         chat = cmfactory.get_accepted_chat(ac1, ac2)
 
         lp.sec("ac1: prepare and send text message to ac2")
-        chat.send_text("message0")
+        msg1 = chat.send_text("message0")
 
         lp.sec("wait for ac2 to receive message")
         msg2 = ac2._evtracker.wait_next_incoming_message()
         assert msg2.text == "message0"
-
-    @pytest.mark.slow
-    def test_exceed_quota(self, cmfactory, lp, tmpdir, remote):
-        """This is a very slow test as it needs to upload >100MB of mail data
-        before quota is exceeded, and thus depends on the speed of the upload.
-        """
-        ac1, ac2 = cmfactory.get_online_accounts(2)
-        chat = cmfactory.get_accepted_chat(ac1, ac2)
-
-        quota = 1024 * 1024 * 100
-        attachsize = 1 * 1024 * 1024
-        num_to_send = quota // attachsize + 2
-        lp.sec(f"ac1: send {num_to_send} large files to ac2")
-        lp.indent(f"per-user quota is assumed to be: {quota/(1024*1024)}MB")
-        alphanumeric = "abcdefghijklmnopqrstuvwxyz1234567890"
-        msgs = []
-        for i in range(num_to_send):
-            attachment = tmpdir / f"attachment{i}"
-            data = "".join(random.choice(alphanumeric) for i in range(1024))
-            with open(attachment, "w+") as f:
-                for j in range(attachsize // len(data)):
-                    f.write(data)
-
-            msg = chat.send_file(str(attachment))
-            msgs.append(msg)
-            lp.indent(f"Sent out msg {i}, size {attachsize/(1024*1024)}MB")
-
-        lp.sec("ac2: check messages are arriving until quota is reached")
-
-        addr = ac2.get_config("addr").lower()
-        saved_ok = 0
-        for line in remote.iter_output("journalctl -f -u dovecot"):
-            if addr not in line:
-                # print(line)
-                continue
-            if "quota" in line:
-                if "quota exceeded" in line:
-                    if saved_ok < num_to_send // 2:
-                        pytest.fail(
-                            f"quota exceeded too early: after {saved_ok} messages already"
-                        )
-                    lp.indent("good, message sending failed because quota was exceeded")
-                    return
-            if "saved mail to inbox" in line:
-                saved_ok += 1
-                print(f"{saved_ok}: {line}")
-                if saved_ok >= num_to_send:
-                    break
-
-        pytest.fail("sending succeeded although messages should exceed quota")

plan.txt

@@ -2,10 +2,13 @@
 
 ## Dovecot goals/steps
 
-- automatic expiry of messages older than M days
-   - also expunge unread messages
+2. (holger) per-user storage quota (adaptive)
+   a) define a static 100MB per-user quota
 
-- limit: configure max-connections per account
+3. automatic expiry of messages older than M days
+   - delete unconditionally messages older than 40 days
+
+4. limit: max-connections per account
 
 
 ## Filtermail

scripts/bench.sh

@@ -1,4 +0,0 @@
-#!/bin/bash
-set -e
-
-online-tests/venv/bin/pytest online-tests/benchmark.py -vrx 

scripts/get_imap_capabilities.py

@@ -7,7 +7,7 @@ domain = os.environ.get("CHATMAIL_DOMAIN", "c3.testrun.org")
 print("connecting")
 conn = imaplib.IMAP4_SSL(domain)
 print("logging in")
-conn.login(f"imapcapa", "pass")
+conn.login(f"measure{time.time()}", "pass")
 status, res = conn.capability()
 for capa in sorted(res[0].decode().split()):
     print(capa)

scripts/init.sh

@@ -10,7 +10,7 @@ chatmaild/venv/bin/pip install pytest
 chatmaild/venv/bin/pip install -e chatmaild
 
 python3 -m venv online-tests/venv
-online-tests/venv/bin/pip install pytest pytest-timeout pdbpp deltachat pytest-benchmark
+online-tests/venv/bin/pip install pytest pytest-timeout pdbpp deltachat
 
 python3 -m venv venv
 venv/bin/pip install build

scripts/test.sh

@@ -4,4 +4,4 @@ pushd chatmaild/src/chatmaild
 ../../venv/bin/pytest
 popd
 
-online-tests/venv/bin/pytest online-tests/ -vrx --durations=5 --slow
+online-tests/venv/bin/pytest online-tests/ -vrx --durations=5