tests: add rate limit tests

We do not need them, all mails are delivered to Dovecot over LMTP.

README.md

@@ -1,60 +1,40 @@
 # Chat Mail server configuration
 
-This package deploys Postfix and Dovecot servers, including OpenDKIM for DKIM signing.
-
-Postfix uses Dovecot for authentication as described in <https://www.postfix.org/SASL_README.html#server_dovecot>
+This repository setups a ready-to-go chatmail instance
+comprised of a minimal setup of the battle-tested 
+[postfix smtp server](https://www.postfix.org) and [dovecot imap server](https://www.dovecot.org).
 
 ## Getting started 
 
-prepare:
+1. prepare your local system:
 
-    pip install -e chatmail-infra
+    scripts/init.sh 
+
+2. set environment variable to the chatmail domain you want to setup:
+
+    export CHATMAIL_DOMAIN=c1.testrun.org   # replace with your host
+
+3. run the deploy of the chat mail instance: 
+
+    scripts/deploy.sh 
 
 
-then run with pyinfra command line tool: 
+## Running tests and benchmarks (offline and online) 
 
-    CHATMAIL_DOMAIN=c1.testrun.org pyinfra --ssh-user root c1.testrun.org deploy.py
+1. Set `CHATMAIL_SSH` so that `ssh root@$CHATMAIL_SSH` allows 
+   to login to the chatmail instance server. 
 
+2. To run local and online tests: 
 
-## Structure (wip)
-```
+    scripts/test.sh 
 
-# package doveauth tool and deploy chatmail server to a envvar-specified ssh-reachable host 
-deploy.py 
+3. To run benchmarks against your chatmail instance: 
 
-# chatmail pyinfra deploy package 
-chatmail-pyinfra 
-    pyproject.toml
-    chatmail/__init__ ...
+    scripts/bench.sh 
 
-# doveauth tool used by dovecot's auth mechanism on the host system 
-doveauth
-    README.md
-    pyproject.toml
-    doveauth.py
-    test_doveauth.py
-
-# lmtp server to block (outgoing) unencrypted messages 
-filtermail 
-    README.md
-    pyproject.toml
-    .... 
-
-# online tests (after deploy)
-
-online-tests  # runnable via pytest 
-
-
-
-# scripts for setup/development/deployment 
-
-scripts/
-    init.sh  # create venv/other perequires
-    deploy.sh  # run pyinfra based deploy of everything
-    test.sh # run all local and online tests 
+## Running tests (offline and online) 
 
 ```
-
 ## Dovecot/Postfix configuration
 
 ### Ports
@@ -64,4 +44,16 @@ Dovecot listens on ports 143(imap) and 993 (imaps).
 
 ## DNS
 
-For DKIM you must add a DNS entry as in /etc/opendkim/selector.txt (where selector is the opendkim_selector configured in the chatmail inventory).
+For DKIM you must add a DNS entry as found in /etc/opendkim/selector.txt on your chatmail instance.
+The above `scripts/deploy.sh` prints out the DKIM selector and DNS entry you
+need to setup with your DNS provider. 
+
+## Emergency Commands
+
+If you need to stop account creation,
+e.g. because some script is wildly creating accounts,
+just run `touch /tmp/nocreate`.
+You can remove the file
+as soon as the attacker was banned
+by different means.
+

chatmaild/pyproject.toml

@@ -10,7 +10,6 @@ dependencies = [
 ]
 
 [project.scripts]
-doveauth = "chatmaild.doveauth:main"
 doveauth-dictproxy = "chatmaild.dictproxy:main"
 filtermail = "chatmaild.filtermail:main"
 

chatmaild/src/chatmaild/dictproxy.py

@@ -1,3 +1,4 @@
+import logging
 import os
 import sys
 import json
@@ -11,12 +12,14 @@ import subprocess
 
 from .database import Database
 
+NOCREATE_FILE = "/etc/chatmail-nocreate"
+
 
 def encrypt_password(password: str):
     password = password.encode("ascii")
     # https://doc.dovecot.org/configuration_manual/authentication/password_schemes/
     process = subprocess.Popen(
-        ["doveadm", "pw", "-s", "BLF-CRYPT"],
+        ["doveadm", "pw", "-s", "SHA512-CRYPT"],
         stdin=subprocess.PIPE,
         stdout=subprocess.PIPE,
     )
@@ -27,6 +30,9 @@ def encrypt_password(password: str):
 
 
 def create_user(db, user, password):
+    if os.path.exists(NOCREATE_FILE):
+        logging.warning(f"Didn't create account: {NOCREATE_FILE} exists. Delete the file to enable account creation.")
+        return
     with db.write_transaction() as conn:
         conn.create_user(user, password)
     return dict(home=f"/home/vmail/{user}", uid="vmail", gid="vmail", password=password)
@@ -59,7 +65,7 @@ def handle_dovecot_request(msg, db):
     if short_command == "L":  # LOOKUP
         parts = msg[1:].split("\t")
         keyname, user = parts[:2]
-        namespace, type, arg = keyname.split("/", 3)
+        namespace, type, *args = keyname.split("/")
         reply_command = "F"
         res = ""
         if namespace == "shared":
@@ -70,7 +76,7 @@ def handle_dovecot_request(msg, db):
                 else:
                     reply_command = "N"
             elif type == "passdb":
-                res = lookup_passdb(db, user, password=arg)
+                res = lookup_passdb(db, user, password=args[0])
                 if res:
                     reply_command = "O"
                 else:
@@ -95,7 +101,7 @@ def main():
             while True:
                 msg = self.rfile.readline().strip().decode()
                 if not msg:
-                    continue
+                    break
                 res = handle_dovecot_request(msg, db)
                 if res:
                     print(f"sending result: {res!r}", file=sys.stderr)

chatmaild/src/chatmaild/doveauth.py

@@ -1,65 +0,0 @@
-#!/usr/bin/env python3
-import base64
-import sys
-
-from .database import Database
-
-
-def get_user_data(db, user):
-    with db.read_connection() as conn:
-        result = conn.get_user(user)
-    if result:
-        result["uid"] = "vmail"
-        result["gid"] = "vmail"
-    return result
-
-
-def create_user(db, user, password):
-    with db.write_transaction() as conn:
-        conn.create_user(user, password)
-    return dict(home=f"/home/vmail/{user}", uid="vmail", gid="vmail", password=password)
-
-
-def verify_user(db, user, password):
-    userdata = get_user_data(db, user)
-    if userdata:
-        if userdata.get("password") == password:
-            userdata["status"] = "ok"
-        else:
-            userdata["status"] = "fail"
-    else:
-        userdata = create_user(db, user, password)
-        userdata["status"] = "ok"
-
-    return userdata
-
-
-def lookup_user(db, user):
-    userdata = get_user_data(db, user)
-    if userdata:
-        userdata["status"] = "ok"
-    else:
-        userdata["status"] = "fail"
-    return userdata
-
-
-def dump_result(res):
-    for key, value in res.items():
-        print(f"{key}={value}")
-
-
-def main():
-    db = Database("/home/vmail/passdb.sqlite")
-    if sys.argv[1] == "hexauth":
-        login = base64.b16decode(sys.argv[2]).decode()
-        password = base64.b16decode(sys.argv[3]).decode()
-        res = verify_user(db, login, password)
-        dump_result(res)
-    elif sys.argv[1] == "hexlookup":
-        login = base64.b16decode(sys.argv[2]).decode()
-        res = lookup_user(db, login)
-        dump_result(res)
-
-
-if __name__ == "__main__":
-    main()

chatmaild/src/chatmaild/filtermail.py

@@ -9,9 +9,8 @@ from aiosmtpd.controller import UnixSocketController
 from smtplib import SMTP as SMTPClient
 
 
-def check_encrypted(content):
+def check_encrypted(message):
     """Check that the message is an OpenPGP-encrypted message."""
-    message = BytesParser(policy=policy.default).parsebytes(content)
     if not message.is_multipart():
         return False
     if message.get("subject") != "...":
@@ -47,7 +46,8 @@ class ExampleHandler:
 
         valid_recipients = []
 
-        mail_encrypted = check_encrypted(envelope.content)
+        message = BytesParser(policy=policy.default).parsebytes(envelope.content)
+        mail_encrypted = check_encrypted(message)
 
         res = []
         for recipient in envelope.rcpt_tos:
@@ -68,7 +68,13 @@ class ExampleHandler:
                 continue
 
             is_outgoing = recipient_local_domain[1] != my_local_domain[1]
-            if is_outgoing and not mail_encrypted:
+
+            if (
+                is_outgoing
+                and not mail_encrypted
+                and message.get("secure-join") != "vc-request"
+                and message.get("secure-join") != "vg-request"
+            ):
                 res += ["500 Outgoing mail must be encrypted"]
                 continue
 

chatmaild/src/chatmaild/test_doveauth.py

@@ -1,7 +1,9 @@
+import os
+
 import pytest
 
-from .dictproxy import get_user_data
-from .doveauth import verify_user
+import chatmaild.dictproxy
+from .dictproxy import get_user_data, lookup_passdb
 from .database import Database, DBError
 
 
@@ -13,16 +15,31 @@ def db(tmpdir):
 
 
 def test_basic(db):
-    verify_user(db, "link2xt@c1.testrun.org", "asdf")
+    chatmaild.dictproxy.NOCREATE_FILE = "/tmp/nocreate"
+    if os.path.exists(chatmaild.dictproxy.NOCREATE_FILE):
+        os.remove(chatmaild.dictproxy.NOCREATE_FILE)
+    lookup_passdb(db, "link2xt@c1.testrun.org", "asdf")
     data = get_user_data(db, "link2xt@c1.testrun.org")
     assert data
 
 
-def test_verify_or_create(db):
-    res = verify_user(db, "newuser1@something.org", "kajdlkajsldk12l3kj1983")
-    assert res["status"] == "ok"
-    res = verify_user(db, "newuser1@something.org", "kajdlqweqwe")
-    assert res["status"] == "fail"
+def test_dont_overwrite_password_on_wrong_login(db):
+    """Test that logging in with a different password doesn't create a new user"""
+    res = lookup_passdb(db, "newuser1@something.org", "kajdlkajsldk12l3kj1983")
+    assert res["password"]
+    res2 = lookup_passdb(db, "newuser1@something.org", "kajdlqweqwe")
+    # this function always returns a password hash, which is actually compared by dovecot.
+    assert res["password"] == res2["password"]
+
+
+def test_nocreate_file(db):
+    chatmaild.dictproxy.NOCREATE_FILE = "/tmp/nocreate"
+    with open(chatmaild.dictproxy.NOCREATE_FILE, "w+") as f:
+        f.write("")
+    assert os.path.exists(chatmaild.dictproxy.NOCREATE_FILE)
+    lookup_passdb(db, "newuser1@something.org", "kajdlqweqwe")
+    assert not get_user_data(db, "newuser1@something.org")
+    os.remove(chatmaild.dictproxy.NOCREATE_FILE)
 
 
 def test_db_version(db):

chatmaild/src/chatmaild/test_filtermail.py

@@ -1,12 +1,16 @@
-import pytest
-
 from .filtermail import check_encrypted
+from email.parser import BytesParser
+from email import policy
 
 
 def test_filtermail():
-    assert not check_encrypted(b"foo")
+    def check_encrypted_bstr(content):
+        message = BytesParser(policy=policy.default).parsebytes(content)
+        return check_encrypted(message)
 
-    assert not check_encrypted(
+    assert not check_encrypted_bstr(b"foo")
+
+    assert not check_encrypted_bstr(
         "\r\n".join(
             [
                 "Subject: =?utf-8?q?Message_from_foobar=40c2=2Etestrun=2Eorg?=",
@@ -36,7 +40,7 @@ def test_filtermail():
         ).encode()
     )
 
-    assert not check_encrypted(
+    assert not check_encrypted_bstr(
         "\r\n".join(
             [
                 "Subject: =?utf-8?q?Message_from_foobar=40c2=2Etestrun=2Eorg?=",
@@ -67,7 +71,7 @@ def test_filtermail():
     )
 
     # https://xkcd.com/1181/
-    assert not check_encrypted(
+    assert not check_encrypted_bstr(
         "\r\n".join(
             [
                 "Subject: =?utf-8?q?Message_from_foobar=40c2=2Etestrun=2Eorg?=",
@@ -99,7 +103,7 @@ def test_filtermail():
         ).encode()
     )
 
-    assert check_encrypted(
+    assert check_encrypted_bstr(
         "\r\n".join(
             [
                 "Subject: ...",
@@ -172,7 +176,7 @@ def test_filtermail():
         ).encode()
     )
 
-    assert not check_encrypted(
+    assert not check_encrypted_bstr(
         "\r\n".join(
             [
                 "Subject: Buy Penis Enlargement at www.malicious-domain.com",
@@ -245,7 +249,7 @@ def test_filtermail():
         ).encode()
     )
 
-    assert not check_encrypted(
+    assert not check_encrypted_bstr(
         "\r\n".join(
             [
                 "Subject: Message opened",

deploy-chatmail/src/deploy_chatmail/__init__.py

@@ -110,7 +110,7 @@ def _configure_opendkim(domain: str, dkim_selector: str) -> bool:
     return need_restart
 
 
-def _configure_postfix(domain: str) -> bool:
+def _configure_postfix(domain: str, debug: bool = False) -> bool:
     """Configures Postfix SMTP server."""
     need_restart = False
 
@@ -124,21 +124,20 @@ def _configure_postfix(domain: str) -> bool:
     )
     need_restart |= main_config.changed
 
-    master_config = files.put(
-        src=importlib.resources.files(__package__)
-        .joinpath("postfix/master.cf")
-        .open("rb"),
+    master_config = files.template(
+        src=importlib.resources.files(__package__).joinpath("postfix/master.cf.j2"),
         dest="/etc/postfix/master.cf",
         user="root",
         group="root",
         mode="644",
+        debug=debug,
     )
     need_restart |= master_config.changed
 
     return need_restart
 
 
-def _configure_dovecot(mail_server: str) -> bool:
+def _configure_dovecot(mail_server: str, debug: bool = False) -> bool:
     """Configures Dovecot IMAP server."""
     need_restart = False
 
@@ -149,6 +148,7 @@ def _configure_dovecot(mail_server: str) -> bool:
         group="root",
         mode="644",
         config={"hostname": mail_server},
+        debug=debug,
     )
     need_restart |= main_config.changed
     auth_config = files.put(
@@ -160,6 +160,16 @@ def _configure_dovecot(mail_server: str) -> bool:
     )
     need_restart |= auth_config.changed
 
+    files.put(
+        src=importlib.resources.files(__package__)
+        .joinpath("dovecot/expunge.cron")
+        .open("rb"),
+        dest="/etc/cron.d/expunge",
+        user="root",
+        group="root",
+        mode="644",
+    )
+
     return need_restart
 
 
@@ -171,7 +181,7 @@ def deploy_chatmail(mail_domain: str, mail_server: str, dkim_selector: str) -> N
     :param dkim_selector:
     """
 
-    apt.update(name="apt update")
+    apt.update(name="apt update", cache_time=24 * 3600)
     server.group(name="Create vmail group", group="vmail", system=True)
     server.user(name="Create vmail user", user="vmail", group="vmail", system=True)
 
@@ -205,8 +215,9 @@ def deploy_chatmail(mail_domain: str, mail_server: str, dkim_selector: str) -> N
     )
 
     _install_chatmaild()
-    dovecot_need_restart = _configure_dovecot(mail_server)
-    postfix_need_restart = _configure_postfix(mail_domain)
+    debug = False
+    dovecot_need_restart = _configure_dovecot(mail_server, debug=debug)
+    postfix_need_restart = _configure_postfix(mail_domain, debug=debug)
     opendkim_need_restart = _configure_opendkim(mail_domain, dkim_selector)
 
     systemd.service(

deploy-chatmail/src/deploy_chatmail/acmetool/__init__.py

@@ -50,8 +50,8 @@ def deploy_acmetool(nginx_hook=False, email="", domains=[]):
     systemd.service(
         name="Setup acmetool-redirector service",
         service="acmetool-redirector.service",
-        running=True,
-        enabled=True,
+        running=False,
+        enabled=False,
         restarted=service_file.changed,
     )
 

deploy-chatmail/src/deploy_chatmail/dovecot/auth.conf

@@ -1,5 +1,5 @@
 uri = proxy:/run/dovecot/doveauth.socket:auth
 iterate_disable = yes
 default_pass_scheme = plain
-password_key = passdb/%w
-user_key = userdb/%u
+password_key = passdb/%w/%u
+user_key = userdb/%u

deploy-chatmail/src/deploy_chatmail/dovecot/dovecot.conf.j2

@@ -4,10 +4,23 @@ protocols = imap lmtp
 
 auth_mechanisms = plain
 
+{% if debug == true %}
 auth_verbose = yes
 auth_debug = yes
 auth_debug_passwords = yes
 auth_verbose_passwords = plain
+auth_cache_size = 100M
+mail_debug = yes
+{% endif %}
+
+
+mail_plugins = quota
+
+# these are the capabilities Delta Chat cares about actually 
+# so let's keep the network overhead per login small
+# https://github.com/deltachat/deltachat-core-rust/blob/master/src/imap/capabilities.rs
+imap_capability = IMAP4rev1 IDLE MOVE QUOTA CONDSTORE
+
 
 # Authentication for system users.
 passdb {
@@ -59,13 +72,28 @@ mail_privileged_group = vmail
 # Enable IMAP COMPRESS (RFC 4978).
 # <https://datatracker.ietf.org/doc/html/rfc4978.html>
 protocol imap {
-  mail_plugins = $mail_plugins imap_zlib
+  mail_plugins = $mail_plugins imap_zlib imap_quota
+}
+
+protocol lmtp {
+  mail_plugins = $mail_plugins quota
 }
 
 plugin {
   imap_compress_deflate_level = 6
 }
 
+plugin {
+  # for now we define static quota-rules for all users 
+  quota = maildir:User quota
+  quota_rule = *:storage=100M
+  quota_max_mail_size=30M
+  quota_grace = 0
+  # quota_over_flag_value = TRUE
+}
+
+
+
 service lmtp {
   user=vmail
 

deploy-chatmail/src/deploy_chatmail/dovecot/expunge.cron

@@ -0,0 +1,4 @@
+2 0 * * * dovecot doveadm expunge -A SEEN BEFORE 40d INBOX
+2 0 * * * dovecot doveadm expunge -A SEEN BEFORE 40d Deltachat
+2 0 * * * dovecot doveadm expunge -A SEEN BEFORE 40d Trash
+2 30 * * * dovecot doveadm purge -A

deploy-chatmail/src/deploy_chatmail/postfix/main.cf.j2

@@ -37,6 +37,8 @@ mydestination =
 relayhost = 
 mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
 mailbox_size_limit = 0
+# maximum 30MB sized messages
+message_size_limit = 31457280
 recipient_delimiter = +
 inet_interfaces = all
 inet_protocols = all

deploy-chatmail/src/deploy_chatmail/postfix/master.cf.j2

@@ -9,7 +9,11 @@
 # service type  private unpriv  chroot  wakeup  maxproc command + args
 #               (yes)   (yes)   (no)    (never) (100)
 # ==========================================================================
-smtp      inet  n       -       y       -       -       smtpd
+{% if debug == true %}
+smtp      inet  n       -       y       -       -       smtpd -v
+{% else %}
+smtp      inet  n       -       y       -       -       smtpd 
+{% endif %}
 #smtp      inet  n       -       y       -       1       postscreen
 #smtpd     pass  -       -       y       -       -       smtpd
 #dnsblog   unix  -       -       y       -       0       dnsblog
@@ -28,7 +32,7 @@ submission inet n       -       y       -       -       smtpd
   -o smtpd_recipient_restrictions=
   -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
   -o milter_macro_daemon_name=ORIGINATING
-  -o content_filter=filter:unix:private/filtemail
+  -o content_filter=filter:unix:private/filtermail
 smtps     inet  n       -       y       -       -       smtpd
   -o syslog_name=postfix/smtps
   -o smtpd_tls_wrappermode=yes
@@ -66,8 +70,6 @@ showq     unix  n       -       y       -       -       showq
 error     unix  -       -       y       -       -       error
 retry     unix  -       -       y       -       -       error
 discard   unix  -       -       y       -       -       discard
-local     unix  -       n       n       -       -       local
-virtual   unix  -       n       n       -       -       virtual
 lmtp      unix  -       -       y       -       -       lmtp
 anvil     unix  -       -       y       -       1       anvil
 scache    unix  -       -       y       -       1       scache

online-tests/benchmark.py

@@ -0,0 +1,34 @@
+def test_tls_serialized_connect(benchmark, imap_or_smtp):
+    def connect():
+        imap_or_smtp.connect()
+
+    benchmark(connect)
+
+
+def test_login(benchmark, imap_or_smtp, gencreds):
+    cls = imap_or_smtp.__class__
+    conns = []
+    for i in range(20):
+        conn = cls(imap_or_smtp.host)
+        conn.connect()
+        conns.append(conn)
+
+    def login():
+        conn = conns.pop()
+        conn.login(*gencreds())
+
+    benchmark(login)
+
+
+def test_send_and_receive_10(benchmark, cmfactory, lp):
+    """send many messages between two accounts"""
+    ac1, ac2 = cmfactory.get_online_accounts(2)
+    chat = cmfactory.get_accepted_chat(ac1, ac2)
+
+    def send_10_receive_all():
+        for i in range(10):
+            chat.send_text(f"hello {i}")
+        for i in range(10):
+            ac2.wait_next_incoming_message()
+
+    benchmark(send_10_receive_all)

online-tests/conftest.py

@@ -1,14 +1,57 @@
 import os
 import io
+import random
+import subprocess
 import imaplib
 import smtplib
 import itertools
 import pytest
 
 
+def pytest_addoption(parser):
+    parser.addoption(
+        "--slow", action="store_true", default=False, help="also run slow tests"
+    )
+
+
+def pytest_runtest_setup(item):
+    markers = list(item.iter_markers(name="slow"))
+    if markers:
+        if not item.config.getoption("--slow"):
+            pytest.skip("skipping slow test, use --slow to run")
+
+
 @pytest.fixture
 def maildomain():
-    return os.environ.get("CHATMAIL_DOMAIN", "c1.testrun.org")
+    domain = os.environ.get("CHATMAIL_DOMAIN")
+    if not domain:
+        pytest.skip("set CHATMAIL_DOMAIN to a ssh-reachable chatmail instance")
+    return domain
+
+
+@pytest.fixture
+def sshdomain(maildomain):
+    return os.environ.get("CHATMAIL_SSH", maildomain)
+
+
+@pytest.fixture
+def maildomain2():
+    domain = os.environ.get("CHATMAIL_DOMAIN2")
+    if not domain:
+        pytest.skip("set CHATMAIL_DOMAIN2 to a ssh-reachable chatmail instance")
+    return domain
+
+
+@pytest.fixture
+def sshdomain2(maildomain2):
+    return os.environ.get("CHATMAIL_SSH2", maildomain2)
+
+
+def pytest_report_header():
+    domain = os.environ.get("CHATMAIL_DOMAIN")
+    if domain:
+        text = f"chatmail test instance: {domain}"
+        return ["-" * len(text), text, "-" * len(text)]
 
 
 @pytest.fixture
@@ -17,6 +60,10 @@ def imap(maildomain):
 
 
 class ImapConn:
+    AuthError = imaplib.IMAP4.error
+    logcmd = "journalctl -f -u dovecot"
+    name = "dovecot"
+
     def __init__(self, host):
         self.host = host
 
@@ -35,6 +82,10 @@ def smtp(maildomain):
 
 
 class SmtpConn:
+    AuthError = smtplib.SMTPAuthenticationError
+    logcmd = "journalctl -f -t postfix/smtpd -t postfix/smtp -t postfix/lmtp"
+    name = "postfix"
+
     def __init__(self, host):
         self.host = host
 
@@ -47,16 +98,27 @@ class SmtpConn:
         self.conn.login(user, password)
 
 
+@pytest.fixture(params=["imap", "smtp"])
+def imap_or_smtp(request):
+    return request.getfixturevalue(request.param)
+
+
 @pytest.fixture
 def gencreds(maildomain):
     count = itertools.count()
+    next(count)
 
-    def gen():
+    def gen(domain=None):
+        domain = domain if domain else maildomain
         while 1:
             num = next(count)
-            yield f"user{num}@{maildomain}", f"password{num}"
+            alphanumeric = "abcdefghijklmnopqrstuvwxyz1234567890"
+            user = "".join(random.choices(alphanumeric, k=10))
+            user = f"ac{num}_{user}"
+            password = "".join(random.choices(alphanumeric, k=10))
+            yield f"{user}@{domain}", f"{password}"
 
-    return lambda: next(gen())
+    return lambda domain=None: next(gen(domain))
 
 
 #
@@ -71,13 +133,20 @@ class ChatmailTestProcess:
     def __init__(self, pytestconfig, maildomain, gencreds):
         self.pytestconfig = pytestconfig
         self.maildomain = maildomain
+        assert "." in self.maildomain, maildomain
         self.gencreds = gencreds
         self._addr2files = {}
 
     def get_liveconfig_producer(self):
         while 1:
-            user, password = self.gencreds()
-            config = {"addr": user, "mail_pw": password}
+            user, password = self.gencreds(self.maildomain)
+            config = {
+                "addr": user,
+                "mail_pw": password,
+            }
+            # speed up account configuration
+            config["mail_server"] = self.maildomain
+            config["send_server"] = self.maildomain
             yield config
 
     def cache_maybe_retrieve_configured_db_files(self, cache_addr, db_target_path):
@@ -88,17 +157,45 @@ class ChatmailTestProcess:
 
 
 @pytest.fixture
-def cmfactory(request, maildomain, gencreds, tmpdir, data):
+def cmfactory(request, gencreds, tmpdir, data, maildomain):
     # cloned from deltachat.testplugin.amfactory
     pytest.importorskip("deltachat")
     from deltachat.testplugin import ACFactory
 
     testproc = ChatmailTestProcess(request.config, maildomain, gencreds)
     am = ACFactory(request=request, tmpdir=tmpdir, testprocess=testproc, data=data)
+
+    # nb. a bit hacky
+    # would probably be better if deltachat's test machinery grows native support
+    def switch_maildomain(maildomain2):
+        am.testprocess.maildomain = maildomain2
+
+    am.switch_maildomain = switch_maildomain
+
     yield am
     if hasattr(request.node, "rep_call") and request.node.rep_call.failed:
-        if testprocess.pytestconfig.getoption("--extra-info"):
+        if testproc.pytestconfig.getoption("--extra-info"):
             logfile = io.StringIO()
             am.dump_imap_summary(logfile=logfile)
             print(logfile.getvalue())
             # request.node.add_report_section("call", "imap-server-state", s)
+
+
+@pytest.fixture
+def remote(sshdomain):
+    return Remote(sshdomain)
+
+
+class Remote:
+    def __init__(self, sshdomain):
+        self.sshdomain = sshdomain
+
+    def iter_output(self, logcmd=""):
+        getjournal = f"journalctl -f" if not logcmd else logcmd
+        self.popen = subprocess.Popen(
+            ["ssh", f"root@{self.sshdomain}", getjournal],
+            stdout=subprocess.PIPE,
+        )
+        while 1:
+            line = self.popen.stdout.readline()
+            yield line.decode().strip().lower()

online-tests/pytest.ini

@@ -1,2 +1,3 @@
 [pytest]
-addopts = -vrsx
+addopts = -vrsx --strict-markers
+markers = slow: mark test as slow (requires --slow option to run)

online-tests/test_0_basic.py

@@ -0,0 +1,15 @@
+def test_remote(remote, imap_or_smtp):
+    lineproducer = remote.iter_output(imap_or_smtp.logcmd)
+    imap_or_smtp.connect()
+    assert imap_or_smtp.name in next(lineproducer)
+
+
+def test_use_two_chatmailservers(cmfactory, maildomain2):
+    ac1 = cmfactory.new_online_configuring_account(cache=False)
+    cmfactory.switch_maildomain(maildomain2)
+    ac2 = cmfactory.new_online_configuring_account(cache=False)
+    cmfactory.bring_accounts_online()
+    cmfactory.get_accepted_chat(ac1, ac2)
+    domain1 = ac1.get_config("addr").split("@")[1]
+    domain2 = ac2.get_config("addr").split("@")[1]
+    assert domain1 != domain2

online-tests/test_0_login.py

@@ -1,42 +1,331 @@
-import pytest
-import imaplib
 import smtplib
 
-
-class TestDovecot:
-    def test_login_ok(self, imap, gencreds):
-        user, password = gencreds()
-        imap.connect()
-        imap.login(user, password)
-        # verify it works on another connection
-        imap.connect()
-        imap.login(user, password)
-
-    def test_login_fail(self, imap, gencreds):
-        user, password = gencreds()
-        imap.connect()
-        imap.login(user, password)
-        imap.connect()
-        with pytest.raises(imaplib.IMAP4.error) as excinfo:
-            imap.login(user, password + "wrong")
-        assert "AUTHENTICATIONFAILED" in str(excinfo)
+import pytest
 
 
-class TestPostfix:
-    def test_login_ok(self, smtp, gencreds):
-        user, password = gencreds()
+def test_login_basic_functioning(imap_or_smtp, gencreds, lp):
+    """Test a) that an initial login creates a user automatically
+    and b) verify we can also login a second time with the same password
+    and c) that using a different password fails the login."""
+    user, password = gencreds()
+    lp.sec(f"login first time with {user} {password}")
+    imap_or_smtp.connect()
+    imap_or_smtp.login(user, password)
+    lp.indent("success")
+
+    lp.sec(f"reconnect and login second time {user} {password}")
+    imap_or_smtp.connect()
+    imap_or_smtp.login(user, password)
+    imap_or_smtp.connect()
+    lp.sec("success")
+
+    lp.sec(f"reconnect and verify wrong password fails {user} ")
+    imap_or_smtp.connect()
+    with pytest.raises(imap_or_smtp.AuthError):
+        imap_or_smtp.login(user, password + "wrong")
+
+
+def test_login_same_password(imap_or_smtp, gencreds):
+    """Test two different users logging in with the same password
+    to ensure that authentication process does not confuse the users
+    by using only the password hash as a key.
+    """
+    user1, password1 = gencreds()
+    user2, _ = gencreds()
+    imap_or_smtp.connect()
+    imap_or_smtp.login(user1, password1)
+    imap_or_smtp.connect()
+    imap_or_smtp.login(user2, password1)
+
+
+@pytest.mark.parametrize(
+    ("authenticated", "existing_from", "outside_to", "log_msg"),
+    [
+        (False, False, False, "Sending message with forged FROM of chatmail user to chatmail user"),
+        (False, True, False, "Sending message with forged FROM of outside user to chatmail user"),
+        (False, False, True, "Sending message with forged FROM of chatmail user to outside user"),
+        (False, True, True, "Sending message with forged FROM of outside user to outside user"),
+        (True, False, False, "Sending authenticated message with forged FROM of chatmail user to chatmail user"),
+        (True, True, False, "Sending authenticated message with forged FROM of outside user to chatmail user"),
+        (True, False, True, "Sending authenticated message with forged FROM of chatmail user to outside user"),
+        (True, True, True, "Sending authenticated message with forged FROM of outside user to outside user"),
+    ]
+)
+def test_send_with_forged_from(smtp, gencreds, lp, authenticated, existing_from, outside_to, log_msg):
+    """Test that users can't impersonate each other."""
+    if outside_to:
+        to_addr = "recipient@example.org"
+    else:
+        to_addr, password = gencreds()
         smtp.connect()
-        smtp.login(user, password)
-        # verify it works on another connection
-        smtp.connect()
-        smtp.login(user, password)
+        smtp.login(to_addr, password)
+        smtp.conn.close()
 
-    def test_login_fail(self, smtp, gencreds):
-        user, password = gencreds()
+    if existing_from:
+        from_addr, password = gencreds()
         smtp.connect()
-        smtp.login(user, password)
-        smtp.connect()
-        with pytest.raises(smtplib.SMTPAuthenticationError) as excinfo:
-            smtp.login(user, password + "wrong")
-        assert excinfo.value.smtp_code == 535
-        assert "authentication failed" in str(excinfo)
+        smtp.login(from_addr, password)
+        smtp.conn.close()
+    else:
+        from_addr = f"9d8znohcoimafiilvsjfovaniufsmdj@{smtp.host}"
+
+    smtp.connect()
+    if authenticated:
+        attacker_addr, password = gencreds()
+        smtp.login(attacker_addr, password)
+
+    mail = "\r\n".join([
+        "Subject: ...",
+        f"From: <{from_addr}>",
+        f"To: <{to_addr}>",
+        "Date: Sun, 15 Oct 2023 16:43:21 +0000",
+        "Message-ID: <Mr.UVyJWZmkCKM.hGzNc6glBE_@c2.testrun.org>",
+        "In-Reply-To: <Mr.MvmCz-GQbi_.6FGRkhDf05c@c2.testrun.org>",
+        "References: <Mr.3gckbNy5bch.uK3Hd2Ws6-w@c2.testrun.org>",
+        "\t<Mr.MvmCz-GQbi_.6FGRkhDf05c@c2.testrun.org>",
+        "Chat-Version: 1.0",
+        f"Autocrypt: addr={from_addr}; prefer-encrypt=mutual;",
+        "\tkeydata=xjMEZSwWjhYJKwYBBAHaRw8BAQdAQBEhqeJh0GueHB6kF/DUQqYCxARNBVokg/AzT+7LqH",
+        "\trNFzxiYXJiYXpAYzIudGVzdHJ1bi5vcmc+wosEEBYIADMCGQEFAmUsFo4CGwMECwkIBwYVCAkKCwID",
+        "\tFgIBFiEEFTfUNvVnY3b9F7yHnmme1PfUhX8ACgkQnmme1PfUhX9A4AEAnHWHp49eBCMHK5t66gYPiW",
+        "\tXQuB1mwUjzGfYWB+0RXUoA/0xcQ3FbUNlGKW7Blp6eMFfViv6Mv2d3kNSXACB6nmcMzjgEZSwWjhIK",
+        "\tKwYBBAGXVQEFAQEHQBpY5L2M1XHo0uxf8SX1wNLBp/OVvidoWHQF2Jz+kJsUAwEIB8J4BBgWCAAgBQ",
+        "\tJlLBaOAhsMFiEEFTfUNvVnY3b9F7yHnmme1PfUhX8ACgkQnmme1PfUhX/INgEA37AJaNvruYsJVanP",
+        "\tIXnYw4CKd55UAwl8Zcy+M2diAbkA/0fHHcGV4r78hpbbL1Os52DPOdqYQRauIeJUeG+G6bQO",
+        "MIME-Version: 1.0",
+        'Content-Type: multipart/encrypted; protocol="application/pgp-encrypted";',
+        '\tboundary="YFrteb74qSXmggbOxZL9dRnhymywAi"',
+        "",
+        "",
+        "--YFrteb74qSXmggbOxZL9dRnhymywAi",
+        "Content-Description: PGP/MIME version identification",
+        "Content-Type: application/pgp-encrypted",
+        "",
+        "Version: 1",
+        "",
+        "",
+        "--YFrteb74qSXmggbOxZL9dRnhymywAi",
+        "Content-Description: OpenPGP encrypted message",
+        'Content-Disposition: inline; filename="encrypted.asc";',
+        'Content-Type: application/octet-stream; name="encrypted.asc"',
+        "",
+        "-----BEGIN PGP MESSAGE-----",
+        "",
+        "wU4DhW3gBZ/VvCYSAQdA8bMs2spwbKdGjVsL1ByPkNrqD7frpB73maeL6I6SzDYg",
+        "O5G53tv339RdKq3WRcCtEEvxjHlUx2XNwXzC04BpmfvBTgNfPUyLDzjXnxIBB0Ae",
+        "8ymwGvXMCCimHXN0Dg8Ui62KOi03h0UgheoHWovJSCDF4CKre/xtFr3nL7lq/PKI",
+        "JsjVNz7/RK9FSXF6WwfONtLCyQGEuVAsB/KXfCBEyfKhaMwGHvhujRidGW5uV1no",
+        "lMGl3ODmo29Lgeu2uSE7EpJRZoe6hU6ddmBkqxax61ZtkaFlGFFpdo2K8balNNdz",
+        "ZsJ/9mmI9x3oOJ4/l1nhQbUO9ADbs7gJhFdV5Qkp30b5fCI7bU+aoe1ccBbLe/WM",
+        "YUty1PqcuQT7XjA+XmYuL261tvW8pBetT+i33/E2d8PzzYt2IuK9qeevyS+yxdwA",
+        "kfwejFWzzsUlJaDxs1x4XOxkMgSj+jo+g12dFOb7fyClsAnq23iDb8AuaT/BScAI",
+        "+lO+gher69+6LmM7VGHLG5k762J1jTaQCaKt1s8TAWV99Eo4491vL6fyvk3l/Cfg",
+        "RXSwiWFgj19Pn0Rq7CD9v22UE2vdUMBTcV4aw79mClk1YQ23jbF0y5DCjPdJ62Zo",
+        "tskBgFt3NoWV80jZ76zIBLrrjLwCCll8JjJtFwSkt2GX5RFBsVa4A8IDht9RtEk7",
+        "rrHgbSZQfkauEi/mH3/6CDZoLqSHudUZ7d4MaJwun1TkFYGe2ORwGJd4OBj3oGJp",
+        "H8YBwCpk///L/fKjX0Gg3M8nrpM4wrRFhPKidAgO/kcm25X4+ZHlVkWBTCt5RWKI",
+        "fHh6oLDZCqCfcgMkE1KKmwfIHaUkhq5BPRigwy6i5dh1DM4+1UCLh3dxzVbqE9b9",
+        "61NB19nXdRtDA2sOUnj9ve6m/wEPyCb6/zBQZqvCBYb1/AjdXpUrFT+DbpfyxaXN",
+        "XfhDVb5mNqNM/IVj0V5fvTc6vOfYbzQtPm10H+FdWWfb+rJRfyC3MA2w2IqstFe3",
+        "w3bu2iE6CQvSqRvge+ZqLKt/NqYwOURiUmpuklbl3kPJ97+mfKWoiqk8Iz1VY+bb",
+        "NMUC7aoGv+jcoj+WS6PYO8N6BeRVUUB3ZJSf8nzjgxm1/BcM+UD3BPrlhT11ODRs",
+        "baifGbprMWwt3dhb8cQgRT8GPdpO1OsDkzL6iikMjLHWWiA99GV6ruiHsIPw6boW",
+        "A6/uSOskbDHOROotKmddGTBd0iiHXAoQsJFt1ZjUkt6EHrgWs+GAvrvKpXs1mrz8",
+        "uj3GwEFrHS+Xuf2UDgpszYT3hI2cL/kUtGakVR7m7vVMZqXBUbZdGAEb1PZNPwsI",
+        "E4aMK02+EVB+tSN4Fzj99N2YD0inVYt+oPjr2tHhUS6aSGBNS/48Ki47DOg4Sxkn",
+        "lkOWnEbCD+XTnbDd",
+        "=agR5",
+        "-----END PGP MESSAGE-----",
+        "",
+        "",
+        "--YFrteb74qSXmggbOxZL9dRnhymywAi--",
+        "",
+        "",
+    ]).encode()
+
+    if not authenticated:
+        smtperror = smtplib.SMTPRecipientsRefused
+    else:
+        smtperror = smtplib.SMTPException
+
+    lp.sec(log_msg)
+    with pytest.raises(smtperror):
+        smtp.conn.sendmail(from_addr, to_addr, mail)
+
+
+def test_no_internal_rate_limit(smtp, gencreds):
+    """Test that there is no rate limit between accounts on the same chatmail server."""
+    to_addr, password = gencreds()
+    smtp.connect()
+    smtp.login(to_addr, password)
+
+    user, password = gencreds()
+    smtp.connect()
+    smtp.login(user, password)
+
+    mail = "\r\n".join(
+        [
+            "Subject: ...",
+            f"From: <{user}>",
+            f"To: <{to_addr}>",
+            "Date: Sun, 15 Oct 2023 16:43:21 +0000",
+            "Message-ID: <Mr.UVyJWZmkCKM.hGzNc6glBE_@c2.testrun.org>",
+            "In-Reply-To: <Mr.MvmCz-GQbi_.6FGRkhDf05c@c2.testrun.org>",
+            "References: <Mr.3gckbNy5bch.uK3Hd2Ws6-w@c2.testrun.org>",
+            "\t<Mr.MvmCz-GQbi_.6FGRkhDf05c@c2.testrun.org>",
+            "Chat-Version: 1.0",
+            f"Autocrypt: addr={user}; prefer-encrypt=mutual;",
+            "\tkeydata=xjMEZSwWjhYJKwYBBAHaRw8BAQdAQBEhqeJh0GueHB6kF/DUQqYCxARNBVokg/AzT+7LqH",
+            "\trNFzxiYXJiYXpAYzIudGVzdHJ1bi5vcmc+wosEEBYIADMCGQEFAmUsFo4CGwMECwkIBwYVCAkKCwID",
+            "\tFgIBFiEEFTfUNvVnY3b9F7yHnmme1PfUhX8ACgkQnmme1PfUhX9A4AEAnHWHp49eBCMHK5t66gYPiW",
+            "\tXQuB1mwUjzGfYWB+0RXUoA/0xcQ3FbUNlGKW7Blp6eMFfViv6Mv2d3kNSXACB6nmcMzjgEZSwWjhIK",
+            "\tKwYBBAGXVQEFAQEHQBpY5L2M1XHo0uxf8SX1wNLBp/OVvidoWHQF2Jz+kJsUAwEIB8J4BBgWCAAgBQ",
+            "\tJlLBaOAhsMFiEEFTfUNvVnY3b9F7yHnmme1PfUhX8ACgkQnmme1PfUhX/INgEA37AJaNvruYsJVanP",
+            "\tIXnYw4CKd55UAwl8Zcy+M2diAbkA/0fHHcGV4r78hpbbL1Os52DPOdqYQRauIeJUeG+G6bQO",
+            "MIME-Version: 1.0",
+            'Content-Type: multipart/encrypted; protocol="application/pgp-encrypted";',
+            '\tboundary="YFrteb74qSXmggbOxZL9dRnhymywAi"',
+            "",
+            "",
+            "--YFrteb74qSXmggbOxZL9dRnhymywAi",
+            "Content-Description: PGP/MIME version identification",
+            "Content-Type: application/pgp-encrypted",
+            "",
+            "Version: 1",
+            "",
+            "",
+            "--YFrteb74qSXmggbOxZL9dRnhymywAi",
+            "Content-Description: OpenPGP encrypted message",
+            'Content-Disposition: inline; filename="encrypted.asc";',
+            'Content-Type: application/octet-stream; name="encrypted.asc"',
+            "",
+            "-----BEGIN PGP MESSAGE-----",
+            "",
+            "wU4DhW3gBZ/VvCYSAQdA8bMs2spwbKdGjVsL1ByPkNrqD7frpB73maeL6I6SzDYg",
+            "O5G53tv339RdKq3WRcCtEEvxjHlUx2XNwXzC04BpmfvBTgNfPUyLDzjXnxIBB0Ae",
+            "8ymwGvXMCCimHXN0Dg8Ui62KOi03h0UgheoHWovJSCDF4CKre/xtFr3nL7lq/PKI",
+            "JsjVNz7/RK9FSXF6WwfONtLCyQGEuVAsB/KXfCBEyfKhaMwGHvhujRidGW5uV1no",
+            "lMGl3ODmo29Lgeu2uSE7EpJRZoe6hU6ddmBkqxax61ZtkaFlGFFpdo2K8balNNdz",
+            "ZsJ/9mmI9x3oOJ4/l1nhQbUO9ADbs7gJhFdV5Qkp30b5fCI7bU+aoe1ccBbLe/WM",
+            "YUty1PqcuQT7XjA+XmYuL261tvW8pBetT+i33/E2d8PzzYt2IuK9qeevyS+yxdwA",
+            "kfwejFWzzsUlJaDxs1x4XOxkMgSj+jo+g12dFOb7fyClsAnq23iDb8AuaT/BScAI",
+            "+lO+gher69+6LmM7VGHLG5k762J1jTaQCaKt1s8TAWV99Eo4491vL6fyvk3l/Cfg",
+            "RXSwiWFgj19Pn0Rq7CD9v22UE2vdUMBTcV4aw79mClk1YQ23jbF0y5DCjPdJ62Zo",
+            "tskBgFt3NoWV80jZ76zIBLrrjLwCCll8JjJtFwSkt2GX5RFBsVa4A8IDht9RtEk7",
+            "rrHgbSZQfkauEi/mH3/6CDZoLqSHudUZ7d4MaJwun1TkFYGe2ORwGJd4OBj3oGJp",
+            "H8YBwCpk///L/fKjX0Gg3M8nrpM4wrRFhPKidAgO/kcm25X4+ZHlVkWBTCt5RWKI",
+            "fHh6oLDZCqCfcgMkE1KKmwfIHaUkhq5BPRigwy6i5dh1DM4+1UCLh3dxzVbqE9b9",
+            "61NB19nXdRtDA2sOUnj9ve6m/wEPyCb6/zBQZqvCBYb1/AjdXpUrFT+DbpfyxaXN",
+            "XfhDVb5mNqNM/IVj0V5fvTc6vOfYbzQtPm10H+FdWWfb+rJRfyC3MA2w2IqstFe3",
+            "w3bu2iE6CQvSqRvge+ZqLKt/NqYwOURiUmpuklbl3kPJ97+mfKWoiqk8Iz1VY+bb",
+            "NMUC7aoGv+jcoj+WS6PYO8N6BeRVUUB3ZJSf8nzjgxm1/BcM+UD3BPrlhT11ODRs",
+            "baifGbprMWwt3dhb8cQgRT8GPdpO1OsDkzL6iikMjLHWWiA99GV6ruiHsIPw6boW",
+            "A6/uSOskbDHOROotKmddGTBd0iiHXAoQsJFt1ZjUkt6EHrgWs+GAvrvKpXs1mrz8",
+            "uj3GwEFrHS+Xuf2UDgpszYT3hI2cL/kUtGakVR7m7vVMZqXBUbZdGAEb1PZNPwsI",
+            "E4aMK02+EVB+tSN4Fzj99N2YD0inVYt+oPjr2tHhUS6aSGBNS/48Ki47DOg4Sxkn",
+            "lkOWnEbCD+XTnbDd",
+            "=agR5",
+            "-----END PGP MESSAGE-----",
+            "",
+            "",
+            "--YFrteb74qSXmggbOxZL9dRnhymywAi--",
+            "",
+            "",
+        ]
+    ).encode()
+    for i in range(100):
+        print("Sending mail", str(i))
+        smtp.conn.sendmail(user, to_addr, mail)
+
+
+@pytest.mark.xfail(reason="No rate limit at the moment")
+def test_exceed_rate_limit(smtp, gencreds):
+    """Test that the outbound rate limit is exceeded if we send a lot of messages at once."""
+    user, password = gencreds()
+    smtp.connect()
+    smtp.login(user, password)
+
+    to_addr = "foobar@example.org"
+    mail = "\r\n".join(
+        [
+            "Subject: ...",
+            f"From: <{user}>",
+            f"To: <{to_addr}>",
+            "Date: Sun, 15 Oct 2023 16:43:21 +0000",
+            "Message-ID: <Mr.UVyJWZmkCKM.hGzNc6glBE_@c2.testrun.org>",
+            "In-Reply-To: <Mr.MvmCz-GQbi_.6FGRkhDf05c@c2.testrun.org>",
+            "References: <Mr.3gckbNy5bch.uK3Hd2Ws6-w@c2.testrun.org>",
+            "\t<Mr.MvmCz-GQbi_.6FGRkhDf05c@c2.testrun.org>",
+            "Chat-Version: 1.0",
+            f"Autocrypt: addr={user}; prefer-encrypt=mutual;",
+            "\tkeydata=xjMEZSwWjhYJKwYBBAHaRw8BAQdAQBEhqeJh0GueHB6kF/DUQqYCxARNBVokg/AzT+7LqH",
+            "\trNFzxiYXJiYXpAYzIudGVzdHJ1bi5vcmc+wosEEBYIADMCGQEFAmUsFo4CGwMECwkIBwYVCAkKCwID",
+            "\tFgIBFiEEFTfUNvVnY3b9F7yHnmme1PfUhX8ACgkQnmme1PfUhX9A4AEAnHWHp49eBCMHK5t66gYPiW",
+            "\tXQuB1mwUjzGfYWB+0RXUoA/0xcQ3FbUNlGKW7Blp6eMFfViv6Mv2d3kNSXACB6nmcMzjgEZSwWjhIK",
+            "\tKwYBBAGXVQEFAQEHQBpY5L2M1XHo0uxf8SX1wNLBp/OVvidoWHQF2Jz+kJsUAwEIB8J4BBgWCAAgBQ",
+            "\tJlLBaOAhsMFiEEFTfUNvVnY3b9F7yHnmme1PfUhX8ACgkQnmme1PfUhX/INgEA37AJaNvruYsJVanP",
+            "\tIXnYw4CKd55UAwl8Zcy+M2diAbkA/0fHHcGV4r78hpbbL1Os52DPOdqYQRauIeJUeG+G6bQO",
+            "MIME-Version: 1.0",
+            'Content-Type: multipart/encrypted; protocol="application/pgp-encrypted";',
+            '\tboundary="YFrteb74qSXmggbOxZL9dRnhymywAi"',
+            "",
+            "",
+            "--YFrteb74qSXmggbOxZL9dRnhymywAi",
+            "Content-Description: PGP/MIME version identification",
+            "Content-Type: application/pgp-encrypted",
+            "",
+            "Version: 1",
+            "",
+            "",
+            "--YFrteb74qSXmggbOxZL9dRnhymywAi",
+            "Content-Description: OpenPGP encrypted message",
+            'Content-Disposition: inline; filename="encrypted.asc";',
+            'Content-Type: application/octet-stream; name="encrypted.asc"',
+            "",
+            "-----BEGIN PGP MESSAGE-----",
+            "",
+            "wU4DhW3gBZ/VvCYSAQdA8bMs2spwbKdGjVsL1ByPkNrqD7frpB73maeL6I6SzDYg",
+            "O5G53tv339RdKq3WRcCtEEvxjHlUx2XNwXzC04BpmfvBTgNfPUyLDzjXnxIBB0Ae",
+            "8ymwGvXMCCimHXN0Dg8Ui62KOi03h0UgheoHWovJSCDF4CKre/xtFr3nL7lq/PKI",
+            "JsjVNz7/RK9FSXF6WwfONtLCyQGEuVAsB/KXfCBEyfKhaMwGHvhujRidGW5uV1no",
+            "lMGl3ODmo29Lgeu2uSE7EpJRZoe6hU6ddmBkqxax61ZtkaFlGFFpdo2K8balNNdz",
+            "ZsJ/9mmI9x3oOJ4/l1nhQbUO9ADbs7gJhFdV5Qkp30b5fCI7bU+aoe1ccBbLe/WM",
+            "YUty1PqcuQT7XjA+XmYuL261tvW8pBetT+i33/E2d8PzzYt2IuK9qeevyS+yxdwA",
+            "kfwejFWzzsUlJaDxs1x4XOxkMgSj+jo+g12dFOb7fyClsAnq23iDb8AuaT/BScAI",
+            "+lO+gher69+6LmM7VGHLG5k762J1jTaQCaKt1s8TAWV99Eo4491vL6fyvk3l/Cfg",
+            "RXSwiWFgj19Pn0Rq7CD9v22UE2vdUMBTcV4aw79mClk1YQ23jbF0y5DCjPdJ62Zo",
+            "tskBgFt3NoWV80jZ76zIBLrrjLwCCll8JjJtFwSkt2GX5RFBsVa4A8IDht9RtEk7",
+            "rrHgbSZQfkauEi/mH3/6CDZoLqSHudUZ7d4MaJwun1TkFYGe2ORwGJd4OBj3oGJp",
+            "H8YBwCpk///L/fKjX0Gg3M8nrpM4wrRFhPKidAgO/kcm25X4+ZHlVkWBTCt5RWKI",
+            "fHh6oLDZCqCfcgMkE1KKmwfIHaUkhq5BPRigwy6i5dh1DM4+1UCLh3dxzVbqE9b9",
+            "61NB19nXdRtDA2sOUnj9ve6m/wEPyCb6/zBQZqvCBYb1/AjdXpUrFT+DbpfyxaXN",
+            "XfhDVb5mNqNM/IVj0V5fvTc6vOfYbzQtPm10H+FdWWfb+rJRfyC3MA2w2IqstFe3",
+            "w3bu2iE6CQvSqRvge+ZqLKt/NqYwOURiUmpuklbl3kPJ97+mfKWoiqk8Iz1VY+bb",
+            "NMUC7aoGv+jcoj+WS6PYO8N6BeRVUUB3ZJSf8nzjgxm1/BcM+UD3BPrlhT11ODRs",
+            "baifGbprMWwt3dhb8cQgRT8GPdpO1OsDkzL6iikMjLHWWiA99GV6ruiHsIPw6boW",
+            "A6/uSOskbDHOROotKmddGTBd0iiHXAoQsJFt1ZjUkt6EHrgWs+GAvrvKpXs1mrz8",
+            "uj3GwEFrHS+Xuf2UDgpszYT3hI2cL/kUtGakVR7m7vVMZqXBUbZdGAEb1PZNPwsI",
+            "E4aMK02+EVB+tSN4Fzj99N2YD0inVYt+oPjr2tHhUS6aSGBNS/48Ki47DOg4Sxkn",
+            "lkOWnEbCD+XTnbDd",
+            "=agR5",
+            "-----END PGP MESSAGE-----",
+            "",
+            "",
+            "--YFrteb74qSXmggbOxZL9dRnhymywAi--",
+            "",
+            "",
+        ]
+    ).encode()
+    for i in range(100):
+        print("Sending mail", str(i))
+        try:
+            smtp.conn.sendmail(user, to_addr, mail)
+        except smtplib.SMTPSenderRefused as e:
+            if i == 0:
+                pytest.fail(f"rate limit was exceeded too early with msg {i} - maybe wait a minute before testing?")
+            if i < 41:
+                pytest.fail(f"rate limit was exceeded too early with msg {i}")
+            assert e.smtp_code == 450
+            assert b'4.7.1 Error: too much mail from' in e.smtp_error
+            return
+    pytest.fail("Rate limit was not exceeded")

online-tests/test_1_deltachat.py

@@ -1,11 +1,83 @@
-class TestMailSending:
+import random
+import pytest
+
+
+class TestEndToEndDeltaChat:
+    "Tests that use Delta Chat accounts on the chat mail instance."
+
     def test_one_on_one(self, cmfactory, lp):
+        """Test that a DC account can send a message to a second DC account
+        on the same chat-mail instance."""
         ac1, ac2 = cmfactory.get_online_accounts(2)
         chat = cmfactory.get_accepted_chat(ac1, ac2)
 
         lp.sec("ac1: prepare and send text message to ac2")
-        msg1 = chat.send_text("message0")
+        chat.send_text("message0")
 
         lp.sec("wait for ac2 to receive message")
         msg2 = ac2._evtracker.wait_next_incoming_message()
         assert msg2.text == "message0"
+
+    @pytest.mark.slow
+    def test_exceed_quota(self, cmfactory, lp, tmpdir, remote):
+        """This is a very slow test as it needs to upload >100MB of mail data
+        before quota is exceeded, and thus depends on the speed of the upload.
+        """
+        ac1, ac2 = cmfactory.get_online_accounts(2)
+        chat = cmfactory.get_accepted_chat(ac1, ac2)
+
+        quota = 1024 * 1024 * 100
+        attachsize = 1 * 1024 * 1024
+        num_to_send = quota // attachsize + 2
+        lp.sec(f"ac1: send {num_to_send} large files to ac2")
+        lp.indent(f"per-user quota is assumed to be: {quota/(1024*1024)}MB")
+        alphanumeric = "abcdefghijklmnopqrstuvwxyz1234567890"
+        msgs = []
+        for i in range(num_to_send):
+            attachment = tmpdir / f"attachment{i}"
+            data = "".join(random.choice(alphanumeric) for i in range(1024))
+            with open(attachment, "w+") as f:
+                for j in range(attachsize // len(data)):
+                    f.write(data)
+
+            msg = chat.send_file(str(attachment))
+            msgs.append(msg)
+            lp.indent(f"Sent out msg {i}, size {attachsize/(1024*1024)}MB")
+
+        lp.sec("ac2: check messages are arriving until quota is reached")
+
+        addr = ac2.get_config("addr").lower()
+        saved_ok = 0
+        for line in remote.iter_output("journalctl -f -u dovecot"):
+            if addr not in line:
+                # print(line)
+                continue
+            if "quota" in line:
+                if "quota exceeded" in line:
+                    if saved_ok < num_to_send // 2:
+                        pytest.fail(
+                            f"quota exceeded too early: after {saved_ok} messages already"
+                        )
+                    lp.indent("good, message sending failed because quota was exceeded")
+                    return
+            if "saved mail to inbox" in line:
+                saved_ok += 1
+                print(f"{saved_ok}: {line}")
+                if saved_ok >= num_to_send:
+                    break
+
+        pytest.fail("sending succeeded although messages should exceed quota")
+
+    def test_securejoin(self, cmfactory, lp, maildomain2):
+        ac1 = cmfactory.new_online_configuring_account(cache=False)
+        cmfactory.switch_maildomain(maildomain2)
+        ac2 = cmfactory.new_online_configuring_account(cache=False)
+        cmfactory.bring_accounts_online()
+
+        lp.sec("ac1: create QR code and let ac2 scan it, starting the securejoin")
+        qr = ac1.get_setup_contact_qr()
+
+        lp.sec("ac2: start QR-code based setup contact protocol")
+        ch = ac2.qr_setup_contact(qr)
+        assert ch.id >= 10
+        ac1._evtracker.wait_securejoin_inviter_progress(1000)

plan.txt

@@ -2,19 +2,10 @@
 
 ## Dovecot goals/steps
 
-2. (holger) per-user storage quota (adaptive)
-   a) define a static 100MB per-user quota
+- automatic expiry of messages older than M days
+   - also expunge unread messages
 
-3. automatic expiry of messages older than M days
-   - delete unconditionally messages older than 40 days
-
-4. limit: max-connections per account
-
-
-## Filtermail
-
-- (alex, Only allow (outgoing) mails if secure-join or autocrypt-pgp-encrypted format.
-  TODO: mime-parse mails and check/add tests
+- limit: configure max-connections per account
 
 
 ## nami: send out rate limit / rspamd

scripts/bench.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+set -e
+
+online-tests/venv/bin/pytest online-tests/benchmark.py -vrx 

scripts/deploy.sh

@@ -2,8 +2,9 @@
 : ${CHATMAIL_DOMAIN:=c1.testrun.org}
 export CHATMAIL_DOMAIN
 
-venv/bin/python3 -m build -n --sdist chatmaild --outdir dist
+chatmaild/venv/bin/python3 -m build -n --sdist chatmaild --outdir dist
 
-deploy-chatmail/venv/bin/pyinfra --ssh-user root "$CHATMAIL_DOMAIN" deploy.py
+deploy-chatmail/venv/bin/pyinfra --ssh-user root "$CHATMAIL_DOMAIN" \
+    deploy-chatmail/src/deploy_chatmail/deploy.py
 
 rm -r dist/

scripts/get_imap_capabilities.py

@@ -7,7 +7,7 @@ domain = os.environ.get("CHATMAIL_DOMAIN", "c3.testrun.org")
 print("connecting")
 conn = imaplib.IMAP4_SSL(domain)
 print("logging in")
-conn.login(f"measure{time.time()}", "pass")
+conn.login(f"imapcapa", "pass")
 status, res = conn.capability()
 for capa in sorted(res[0].decode().split()):
     print(capa)

scripts/init.sh

@@ -6,12 +6,9 @@ deploy-chatmail/venv/bin/pip install -e deploy-chatmail
 deploy-chatmail/venv/bin/pip install -e chatmaild
 
 python3 -m venv chatmaild/venv
-chatmaild/venv/bin/pip install pytest
+sudo apt install -y dovecot-core && sudo systemctl disable --now dovecot
+chatmaild/venv/bin/pip install --upgrade pytest build 'setuptools>=68'
 chatmaild/venv/bin/pip install -e chatmaild
 
 python3 -m venv online-tests/venv
-online-tests/venv/bin/pip install pytest pytest-timeout pdbpp deltachat
-
-python3 -m venv venv
-venv/bin/pip install build
-venv/bin/pip install 'setuptools>=68'
+online-tests/venv/bin/pip install pytest pytest-timeout pdbpp deltachat pytest-benchmark

scripts/measure_tls_and_logins.py

@@ -1,3 +1,4 @@
+#!/usr/bin/env python3
 import os
 import time
 import imaplib

scripts/remote-deploy.sh

@@ -2,7 +2,7 @@
 set -e
 
 : ${CHATMAIL_DOMAIN:=c1.testrun.org}
-: ${CHATMAIL_SSH_HOST:=$CHATMAIL_DOMAIN}
+: ${CHATMAIL_SSH:=$CHATMAIL_DOMAIN}
 
-rsync -avz . "root@$CHATMAIL_SSH_HOST:/root/chatmail" --exclude='/.git' --filter="dir-merge,- .gitignore"
-ssh "root@$CHATMAIL_SSH_HOST" "cd /root/chatmail; apt install -y python3-venv; python3 -m venv venv; venv/bin/pip install pyinfra build; venv/bin/python3 -m build -n --sdist chatmaild --outdir dist; venv/bin/pip install -e ./deploy-chatmail -e ./chatmaild; export CHATMAIL_DOMAIN=$CHATMAIL_DOMAIN; venv/bin/pyinfra @local deploy.py"
+rsync -avz . "root@$CHATMAIL_SSH:/root/chatmail" --exclude='/.git' --filter="dir-merge,- .gitignore"
+ssh "root@$CHATMAIL_SSH" "cd /root/chatmail; apt install -y python3-venv; python3 -m venv venv; venv/bin/pip install pyinfra build; venv/bin/python3 -m build -n --sdist chatmaild --outdir dist; venv/bin/pip install -e ./deploy-chatmail -e ./chatmaild; export CHATMAIL_DOMAIN=$CHATMAIL_DOMAIN; venv/bin/pyinfra @local deploy.py"

scripts/test.sh

@@ -1,7 +1,3 @@
 #!/bin/bash
-set -e
-pushd chatmaild/src/chatmaild
-../../venv/bin/pytest
-popd
-
-online-tests/venv/bin/pytest online-tests/ -vrx --durations=5
+chatmaild/venv/bin/pytest chatmaild/ $@
+online-tests/venv/bin/pytest online-tests/ -vrx --durations=5 $@