shift functions to a DictProxy class

This reverts commit fb2ea27477.

.github/workflows/ci.yaml

@@ -0,0 +1,18 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Lint chatmaild
+        working-directory: chatmaild
+        run: pipx run tox
+      - name: Lint deploy-chatmail
+        working-directory: deploy-chatmail
+        run: pipx run tox

chatmaild/src/chatmaild/dictproxy.py

@@ -2,13 +2,13 @@ import logging
 import os
 import sys
 import json
+import crypt
 from socketserver import (
     UnixStreamServer,
     StreamRequestHandler,
     ThreadingMixIn,
 )
 import pwd
-import subprocess
 
 from .database import Database
 
@@ -16,77 +16,73 @@ NOCREATE_FILE = "/etc/chatmail-nocreate"
 
 
 def encrypt_password(password: str):
-    password = password.encode("ascii")
     # https://doc.dovecot.org/configuration_manual/authentication/password_schemes/
-    process = subprocess.Popen(
-        ["doveadm", "pw", "-s", "SHA512-CRYPT"],
-        stdin=subprocess.PIPE,
-        stdout=subprocess.PIPE,
-    )
-    stdout_data, _stderr_data = process.communicate(
-        input=password + b"\n" + password + b"\n"
-    )
-    return stdout_data.decode("ascii").strip()
+    passhash = crypt.crypt(password, crypt.METHOD_SHA512)
+    return "{SHA512-CRYPT}" + passhash
 
 
-def create_user(db, user, password):
-    if os.path.exists(NOCREATE_FILE):
-        logging.warning(f"Didn't create account: {NOCREATE_FILE} exists. Delete the file to enable account creation.")
-        return
-    with db.write_transaction() as conn:
-        conn.create_user(user, password)
-    return dict(home=f"/home/vmail/{user}", uid="vmail", gid="vmail", password=password)
+class DictProxy:
+    def __init__(self, db, mail_domain):
+        self.db = db
+        self.mail_domain = mail_domain
+
+    def create_user(self, user, password):
+        if os.path.exists(NOCREATE_FILE):
+            logging.warning(f"Didn't create account: {NOCREATE_FILE} exists.")
+            return
+        with self.db.write_transaction() as conn:
+            conn.create_user(user, password)
+        return dict(home=f"/home/vmail/{user}", uid="vmail", gid="vmail", password=password)
+
+    def get_user_data(self, user):
+        with self.db.read_connection() as conn:
+            result = conn.get_user(user)
+        if result:
+            result["uid"] = "vmail"
+            result["gid"] = "vmail"
+        return result
 
 
-def get_user_data(db, user):
-    with db.read_connection() as conn:
-        result = conn.get_user(user)
-    if result:
-        result["uid"] = "vmail"
-        result["gid"] = "vmail"
-    return result
+    def lookup_userdb(self, user):
+        return self.get_user_data(user)
 
 
-def lookup_userdb(db, user):
-    return get_user_data(db, user)
+    def lookup_passdb(self, user, password):
+        userdata = self.get_user_data(user)
+        if not userdata:
+            return self.create_user(user, encrypt_password(password))
+        userdata["password"] = userdata["password"].strip()
+        return userdata
 
 
-def lookup_passdb(db, user, password):
-    userdata = get_user_data(db, user)
-    if not userdata:
-        return create_user(db, user, encrypt_password(password))
-    userdata["password"] = userdata["password"].strip()
-    return userdata
-
-
-def handle_dovecot_request(msg, db, mail_domain):
-    print(f"received msg: {msg!r}", file=sys.stderr)
-    short_command = msg[0]
-    if short_command == "L":  # LOOKUP
-        parts = msg[1:].split("\t")
-        keyname, user = parts[:2]
-        namespace, type, *args = keyname.split("/")
-        reply_command = "F"
-        res = ""
-        if namespace == "shared":
-            if type == "userdb":
-                if user.endswith(f"@{mail_domain}"):
-                    res = lookup_userdb(db, user)
-                if res:
-                    reply_command = "O"
-                else:
-                    reply_command = "N"
-            elif type == "passdb":
-                if user.endswith(f"@{mail_domain}"):
-                    res = lookup_passdb(db, user, password=args[0])
-                if res:
-                    reply_command = "O"
-                else:
-                    reply_command = "N"
-        print(f"res: {res!r}", file=sys.stderr)
-        json_res = json.dumps(res) if res else ""
-        return f"{reply_command}{json_res}\n"
-    return None
+    def handle_dovecot_request(self, msg):
+        print(f"received msg: {msg!r}", file=sys.stderr)
+        short_command = msg[0]
+        if short_command == "L":  # LOOKUP
+            parts = msg[1:].split("\t")
+            keyname, user = parts[:2]
+            namespace, type, *args = keyname.split("/")
+            reply_command = "F"
+            res = ""
+            if namespace == "shared":
+                if type == "userdb":
+                    if user.endswith(f"@{self.mail_domain}"):
+                        res = lookup_userdb(db, user)
+                    if res:
+                        reply_command = "O"
+                    else:
+                        reply_command = "N"
+                elif type == "passdb":
+                    if user.endswith(f"@{self.mail_domain}"):
+                        res = lookup_passdb(db, user, password=args[0])
+                    if res:
+                        reply_command = "O"
+                    else:
+                        reply_command = "N"
+            print(f"res: {res!r}", file=sys.stderr)
+            json_res = json.dumps(res) if res else ""
+            return f"{reply_command}{json_res}\n"
+        return None
 
 
 class ThreadedUnixStreamServer(ThreadingMixIn, UnixStreamServer):
@@ -96,17 +92,18 @@ class ThreadedUnixStreamServer(ThreadingMixIn, UnixStreamServer):
 def main():
     socket = sys.argv[1]
     passwd_entry = pwd.getpwnam(sys.argv[2])
-    db = Database(sys.argv[3])
     with open("/etc/mailname", "r") as fp:
         mail_domain = fp.read().strip()
 
+    db = Database(sys.argv[3])
+    dictproxy = DictProxy(db, mail_domain)
     class Handler(StreamRequestHandler):
         def handle(self):
             while True:
                 msg = self.rfile.readline().strip().decode()
                 if not msg:
                     break
-                res = handle_dovecot_request(msg, db, mail_domain)
+                res = dictproxy.handle_dovecot_request(msg)
                 if res:
                     print(f"sending result: {res!r}", file=sys.stderr)
                     self.wfile.write(res.encode("ascii"))

chatmaild/src/chatmaild/filtermail.py

@@ -1,11 +1,14 @@
 #!/usr/bin/env python3
 import asyncio
 import logging
+import time
+import sys
 from email.parser import BytesParser
 from email import policy
+from email.utils import parseaddr
 
-from aiosmtpd.lmtp import LMTP
-from aiosmtpd.controller import UnixSocketController
+from aiosmtpd.smtp import SMTP
+from aiosmtpd.controller import Controller
 from smtplib import SMTP as SMTPClient
 
 
@@ -31,79 +34,93 @@ def check_encrypted(message):
     return True
 
 
-class ExampleController(UnixSocketController):
+class SMTPController(Controller):
     def factory(self):
-        return LMTP(self.handler, **self.SMTP_kwargs)
+        return SMTP(self.handler, **self.SMTP_kwargs)
 
 
-class ExampleHandler:
-    async def handle_RCPT(self, server, session, envelope, address, rcpt_options):
-        envelope.rcpt_tos.append(address)
+class BeforeQueueHandler:
+    def __init__(self):
+        self.send_rate_limiter = SendRateLimiter()
+
+    async def handle_MAIL(self, server, session, envelope, address, mail_options):
+        logging.info(f"handle_MAIL from {address}")
+        envelope.mail_from = address
+        if not self.send_rate_limiter.is_sending_allowed(address):
+            return f"450 4.7.1: Too much mail from {address}"
+
+        parts = envelope.mail_from.split("@")
+        if len(parts) != 2:
+            return f"500 Invalid from address <{envelope.mail_from!r}>"
+
         return "250 OK"
 
     async def handle_DATA(self, server, session, envelope):
-        logging.info("Processing DATA message from %s", envelope.mail_from)
-
-        valid_recipients = []
-
-        message = BytesParser(policy=policy.default).parsebytes(envelope.content)
-        mail_encrypted = check_encrypted(message)
-
-        res = []
-        for recipient in envelope.rcpt_tos:
-            my_local_domain = envelope.mail_from.split("@")
-            if len(my_local_domain) != 2:
-                res += [f"500 Invalid from address <{envelope.mail_from}>"]
-                continue
-
-            if envelope.mail_from == recipient:
-                # Always allow sending emails to self.
-                valid_recipients += [recipient]
-                res += ["250 OK"]
-                continue
-
-            recipient_local_domain = recipient.split("@")
-            if len(recipient_local_domain) != 2:
-                res += [f"500 Invalid address <{recipient}>"]
-                continue
-
-            is_outgoing = recipient_local_domain[1] != my_local_domain[1]
-
-            if (
-                is_outgoing
-                and not mail_encrypted
-                and message.get("secure-join") != "vc-request"
-                and message.get("secure-join") != "vg-request"
-            ):
-                res += ["500 Outgoing mail must be encrypted"]
-                continue
-
-            valid_recipients += [recipient]
-            res += ["250 OK"]
-
-        # Reinject the mail back into Postfix.
-        if valid_recipients:
-            logging.info("Reinjecting the mail")
-            client = SMTPClient("localhost", "10026")
-            client.sendmail(envelope.mail_from, valid_recipients, envelope.content)
-
-        return "\r\n".join(res)
+        logging.info("handle_DATA before-queue")
+        error = check_DATA(envelope)
+        if error:
+            return error
+        logging.info("re-injecting the mail that passed checks")
+        client = SMTPClient("localhost", "10025")
+        client.sendmail(envelope.mail_from, envelope.rcpt_tos, envelope.content)
+        return "250 OK"
 
 
-async def asyncmain(loop):
-    controller = ExampleController(
-        ExampleHandler(), unix_socket="/var/spool/postfix/private/filtermail"
-    )
-    controller.start()
+async def asyncmain_beforequeue(port):
+    Controller(BeforeQueueHandler(), hostname="127.0.0.1", port=port).start()
+
+
+def check_DATA(envelope):
+    """the central filtering function for e-mails."""
+    logging.info(f"Processing DATA message from {envelope.mail_from}")
+
+    message = BytesParser(policy=policy.default).parsebytes(envelope.content)
+    mail_encrypted = check_encrypted(message)
+
+    _, from_addr = parseaddr(message.get("from").strip())
+    logging.info(f"mime-from: {from_addr} envelope-from: {envelope.mail_from!r}")
+    if envelope.mail_from.lower() != from_addr.lower():
+        return f"500 Invalid FROM <{from_addr!r}> for <{envelope.mail_from!r}>"
+
+    envelope_from_domain = from_addr.split("@").pop()
+    for recipient in envelope.rcpt_tos:
+        if envelope.mail_from == recipient:
+            # Always allow sending emails to self.
+            continue
+        res = recipient.split("@")
+        if len(res) != 2:
+            return f"500 Invalid address <{recipient}>"
+        _recipient_addr, recipient_domain = res
+
+        is_outgoing = recipient_domain != envelope_from_domain
+        if is_outgoing and not mail_encrypted:
+            is_securejoin = message.get("secure-join") in ["vc-request", "vg-request"]
+            if not is_securejoin:
+                return f"500 Invalid unencrypted mail to <{recipient}>"
+
+
+class SendRateLimiter:
+    MAX_USER_SEND_PER_MINUTE = 80
+
+    def __init__(self):
+        self.addr2timestamps = {}
+
+    def is_sending_allowed(self, mail_from):
+        last = self.addr2timestamps.setdefault(mail_from, [])
+        now = time.time()
+        last[:] = [ts for ts in last if ts >= (now - 60)]
+        if len(last) <= self.MAX_USER_SEND_PER_MINUTE:
+            last.append(now)
+            return True
+        return False
 
 
 def main():
+    args = sys.argv[1:]
+    assert len(args) == 1
     logging.basicConfig(level=logging.INFO)
     loop = asyncio.new_event_loop()
     asyncio.set_event_loop(loop)
-    loop.create_task(asyncmain(loop=loop))
+    task = asyncmain_beforequeue(port=int(args[0]))
+    loop.create_task(task)
     loop.run_forever()
-
-
-if __name__ == "__main__":
-    main()

chatmaild/src/chatmaild/filtermail.service

@@ -1,8 +1,8 @@
 [Unit]
-Description=Email filter for chatmail servers
+Description=Chatmail Postfix BeforeQeue filter 
 
 [Service]
-ExecStart=/usr/local/bin/filtermail
+ExecStart=/usr/local/bin/filtermail 10080
 Restart=always
 RestartSec=30
 

chatmaild/src/chatmaild/test_doveauth.py

@@ -1,53 +0,0 @@
-import os
-
-import pytest
-
-import chatmaild.dictproxy
-from .dictproxy import get_user_data, lookup_passdb
-from .database import Database, DBError
-
-
-@pytest.fixture()
-def db(tmpdir):
-    db_path = tmpdir / "passdb.sqlite"
-    print("database path:", db_path)
-    return Database(db_path)
-
-
-def test_basic(db):
-    chatmaild.dictproxy.NOCREATE_FILE = "/tmp/nocreate"
-    if os.path.exists(chatmaild.dictproxy.NOCREATE_FILE):
-        os.remove(chatmaild.dictproxy.NOCREATE_FILE)
-    lookup_passdb(db, "link2xt@c1.testrun.org", "asdf")
-    data = get_user_data(db, "link2xt@c1.testrun.org")
-    assert data
-
-
-def test_dont_overwrite_password_on_wrong_login(db):
-    """Test that logging in with a different password doesn't create a new user"""
-    res = lookup_passdb(db, "newuser1@something.org", "kajdlkajsldk12l3kj1983")
-    assert res["password"]
-    res2 = lookup_passdb(db, "newuser1@something.org", "kajdlqweqwe")
-    # this function always returns a password hash, which is actually compared by dovecot.
-    assert res["password"] == res2["password"]
-
-
-def test_nocreate_file(db):
-    chatmaild.dictproxy.NOCREATE_FILE = "/tmp/nocreate"
-    with open(chatmaild.dictproxy.NOCREATE_FILE, "w+") as f:
-        f.write("")
-    assert os.path.exists(chatmaild.dictproxy.NOCREATE_FILE)
-    lookup_passdb(db, "newuser1@something.org", "kajdlqweqwe")
-    assert not get_user_data(db, "newuser1@something.org")
-    os.remove(chatmaild.dictproxy.NOCREATE_FILE)
-
-
-def test_db_version(db):
-    assert db.get_schema_version() == 1
-
-
-def test_too_high_db_version(db):
-    with db.write_transaction() as conn:
-        conn.execute("PRAGMA user_version=%s;" % (999,))
-    with pytest.raises(DBError):
-        db.ensure_tables()

chatmaild/src/chatmaild/test_filtermail.py

@@ -1,290 +0,0 @@
-from .filtermail import check_encrypted
-from email.parser import BytesParser
-from email import policy
-
-
-def test_filtermail():
-    def check_encrypted_bstr(content):
-        message = BytesParser(policy=policy.default).parsebytes(content)
-        return check_encrypted(message)
-
-    assert not check_encrypted_bstr(b"foo")
-
-    assert not check_encrypted_bstr(
-        "\r\n".join(
-            [
-                "Subject: =?utf-8?q?Message_from_foobar=40c2=2Etestrun=2Eorg?=",
-                "Chat-Disposition-Notification-To: foobar@c2.testrun.org",
-                "Chat-User-Avatar: 0",
-                "From: <foobar@c2.testrun.org>",
-                "To: <barbaz@c2.testrun.org>",
-                "Date: Sun, 15 Oct 2023 16:41:44 +0000",
-                "Message-ID: <Mr.3gckbNy5bch.uK3Hd2Ws6-w@c2.testrun.org>",
-                "References: <Mr.3gckbNy5bch.uK3Hd2Ws6-w@c2.testrun.org>",
-                "Chat-Version: 1.0",
-                "Autocrypt: addr=foobar@c2.testrun.org; prefer-encrypt=mutual;",
-                "\tkeydata=xjMEZSrw3hYJKwYBBAHaRw8BAQdAiEKNQFU28c6qsx4vo/JHdt73RXdjMOmByf/XsGiJ7m",
-                "\tnNFzxmb29iYXJAYzIudGVzdHJ1bi5vcmc+wosEEBYIADMCGQEFAmUq8N4CGwMECwkIBwYVCAkKCwID",
-                "\tFgIBFiEEGil0OvTIa6RngmCLUYNnEa9leJAACgkQUYNnEa9leJCX3gEAhm0MehE5byBBU1avPczr/I",
-                "\tHjNLht7Qf6++mAhlJmtDcA/0C8VYJhsUpmiDjuZaMDWNv4FO2BJG6LH7gSm6n7ClMJzjgEZSrw3hIK",
-                "\tKwYBBAGXVQEFAQEHQAxGG/QW0owCfMp1A+vXEMwgzWcBpNFr58kX2eXuPpM6AwEIB8J4BBgWCAAgBQ",
-                "\tJlKvDeAhsMFiEEGil0OvTIa6RngmCLUYNnEa9leJAACgkQUYNnEa9leJDg1gEAwLf8KDoAAKyYgjyI",
-                "\tvYvO9VEgBni1C4Xx1VjcaEmlDK8BALoFuUCK+enw76TtDcAUKhlhUiM6SDRExkS4Nskp/BcK",
-                "MIME-Version: 1.0",
-                "Content-Type: text/plain; charset=utf-8; format=flowed; delsp=no",
-                "",
-                "Hi!",
-                "",
-                "",
-            ]
-        ).encode()
-    )
-
-    assert not check_encrypted_bstr(
-        "\r\n".join(
-            [
-                "Subject: =?utf-8?q?Message_from_foobar=40c2=2Etestrun=2Eorg?=",
-                "Chat-Disposition-Notification-To: foobar@c2.testrun.org",
-                "Chat-User-Avatar: 0",
-                "From: <foobar@c2.testrun.org>",
-                "To: <barbaz@c2.testrun.org>",
-                "Date: Sun, 15 Oct 2023 16:41:44 +0000",
-                "Message-ID: <Mr.3gckbNy5bch.uK3Hd2Ws6-w@c2.testrun.org>",
-                "References: <Mr.3gckbNy5bch.uK3Hd2Ws6-w@c2.testrun.org>",
-                "Chat-Version: 1.0",
-                "Autocrypt: addr=foobar@c2.testrun.org; prefer-encrypt=mutual;",
-                "\tkeydata=xjMEZSrw3hYJKwYBBAHaRw8BAQdAiEKNQFU28c6qsx4vo/JHdt73RXdjMOmByf/XsGiJ7m",
-                "\tnNFzxmb29iYXJAYzIudGVzdHJ1bi5vcmc+wosEEBYIADMCGQEFAmUq8N4CGwMECwkIBwYVCAkKCwID",
-                "\tFgIBFiEEGil0OvTIa6RngmCLUYNnEa9leJAACgkQUYNnEa9leJCX3gEAhm0MehE5byBBU1avPczr/I",
-                "\tHjNLht7Qf6++mAhlJmtDcA/0C8VYJhsUpmiDjuZaMDWNv4FO2BJG6LH7gSm6n7ClMJzjgEZSrw3hIK",
-                "\tKwYBBAGXVQEFAQEHQAxGG/QW0owCfMp1A+vXEMwgzWcBpNFr58kX2eXuPpM6AwEIB8J4BBgWCAAgBQ",
-                "\tJlKvDeAhsMFiEEGil0OvTIa6RngmCLUYNnEa9leJAACgkQUYNnEa9leJDg1gEAwLf8KDoAAKyYgjyI",
-                "\tvYvO9VEgBni1C4Xx1VjcaEmlDK8BALoFuUCK+enw76TtDcAUKhlhUiM6SDRExkS4Nskp/BcK",
-                "MIME-Version: 1.0",
-                "Content-Type: text/plain; charset=utf-8; format=flowed; delsp=no",
-                "",
-                "Hi!",
-                "",
-                "",
-            ]
-        ).encode()
-    )
-
-    # https://xkcd.com/1181/
-    assert not check_encrypted_bstr(
-        "\r\n".join(
-            [
-                "Subject: =?utf-8?q?Message_from_foobar=40c2=2Etestrun=2Eorg?=",
-                "Chat-Disposition-Notification-To: foobar@c2.testrun.org",
-                "Chat-User-Avatar: 0",
-                "From: <foobar@c2.testrun.org>",
-                "To: <barbaz@c2.testrun.org>",
-                "Date: Sun, 15 Oct 2023 16:41:44 +0000",
-                "Message-ID: <Mr.3gckbNy5bch.uK3Hd2Ws6-w@c2.testrun.org>",
-                "References: <Mr.3gckbNy5bch.uK3Hd2Ws6-w@c2.testrun.org>",
-                "Chat-Version: 1.0",
-                "Autocrypt: addr=foobar@c2.testrun.org; prefer-encrypt=mutual;",
-                "\tkeydata=xjMEZSrw3hYJKwYBBAHaRw8BAQdAiEKNQFU28c6qsx4vo/JHdt73RXdjMOmByf/XsGiJ7m",
-                "\tnNFzxmb29iYXJAYzIudGVzdHJ1bi5vcmc+wosEEBYIADMCGQEFAmUq8N4CGwMECwkIBwYVCAkKCwID",
-                "\tFgIBFiEEGil0OvTIa6RngmCLUYNnEa9leJAACgkQUYNnEa9leJCX3gEAhm0MehE5byBBU1avPczr/I",
-                "\tHjNLht7Qf6++mAhlJmtDcA/0C8VYJhsUpmiDjuZaMDWNv4FO2BJG6LH7gSm6n7ClMJzjgEZSrw3hIK",
-                "\tKwYBBAGXVQEFAQEHQAxGG/QW0owCfMp1A+vXEMwgzWcBpNFr58kX2eXuPpM6AwEIB8J4BBgWCAAgBQ",
-                "\tJlKvDeAhsMFiEEGil0OvTIa6RngmCLUYNnEa9leJAACgkQUYNnEa9leJDg1gEAwLf8KDoAAKyYgjyI",
-                "\tvYvO9VEgBni1C4Xx1VjcaEmlDK8BALoFuUCK+enw76TtDcAUKhlhUiM6SDRExkS4Nskp/BcK",
-                "MIME-Version: 1.0",
-                "Content-Type: text/plain; charset=utf-8; format=flowed; delsp=no",
-                "",
-                "-----BEGIN PGP MESSAGE-----",
-                "Hi!",
-                "-----END PGP MESSAGE-----",
-                "",
-                "",
-            ]
-        ).encode()
-    )
-
-    assert check_encrypted_bstr(
-        "\r\n".join(
-            [
-                "Subject: ...",
-                "From: <barbaz@c2.testrun.org>",
-                "To: <foobar@c2.testrun.org>",
-                "Date: Sun, 15 Oct 2023 16:43:21 +0000",
-                "Message-ID: <Mr.UVyJWZmkCKM.hGzNc6glBE_@c2.testrun.org>",
-                "In-Reply-To: <Mr.MvmCz-GQbi_.6FGRkhDf05c@c2.testrun.org>",
-                "References: <Mr.3gckbNy5bch.uK3Hd2Ws6-w@c2.testrun.org>",
-                "\t<Mr.MvmCz-GQbi_.6FGRkhDf05c@c2.testrun.org>",
-                "Chat-Version: 1.0",
-                "Autocrypt: addr=barbaz@c2.testrun.org; prefer-encrypt=mutual;",
-                "\tkeydata=xjMEZSwWjhYJKwYBBAHaRw8BAQdAQBEhqeJh0GueHB6kF/DUQqYCxARNBVokg/AzT+7LqH",
-                "\trNFzxiYXJiYXpAYzIudGVzdHJ1bi5vcmc+wosEEBYIADMCGQEFAmUsFo4CGwMECwkIBwYVCAkKCwID",
-                "\tFgIBFiEEFTfUNvVnY3b9F7yHnmme1PfUhX8ACgkQnmme1PfUhX9A4AEAnHWHp49eBCMHK5t66gYPiW",
-                "\tXQuB1mwUjzGfYWB+0RXUoA/0xcQ3FbUNlGKW7Blp6eMFfViv6Mv2d3kNSXACB6nmcMzjgEZSwWjhIK",
-                "\tKwYBBAGXVQEFAQEHQBpY5L2M1XHo0uxf8SX1wNLBp/OVvidoWHQF2Jz+kJsUAwEIB8J4BBgWCAAgBQ",
-                "\tJlLBaOAhsMFiEEFTfUNvVnY3b9F7yHnmme1PfUhX8ACgkQnmme1PfUhX/INgEA37AJaNvruYsJVanP",
-                "\tIXnYw4CKd55UAwl8Zcy+M2diAbkA/0fHHcGV4r78hpbbL1Os52DPOdqYQRauIeJUeG+G6bQO",
-                "MIME-Version: 1.0",
-                'Content-Type: multipart/encrypted; protocol="application/pgp-encrypted";',
-                '\tboundary="YFrteb74qSXmggbOxZL9dRnhymywAi"',
-                "",
-                "",
-                "--YFrteb74qSXmggbOxZL9dRnhymywAi",
-                "Content-Description: PGP/MIME version identification",
-                "Content-Type: application/pgp-encrypted",
-                "",
-                "Version: 1",
-                "",
-                "",
-                "--YFrteb74qSXmggbOxZL9dRnhymywAi",
-                "Content-Description: OpenPGP encrypted message",
-                'Content-Disposition: inline; filename="encrypted.asc";',
-                'Content-Type: application/octet-stream; name="encrypted.asc"',
-                "",
-                "-----BEGIN PGP MESSAGE-----",
-                "",
-                "wU4DhW3gBZ/VvCYSAQdA8bMs2spwbKdGjVsL1ByPkNrqD7frpB73maeL6I6SzDYg",
-                "O5G53tv339RdKq3WRcCtEEvxjHlUx2XNwXzC04BpmfvBTgNfPUyLDzjXnxIBB0Ae",
-                "8ymwGvXMCCimHXN0Dg8Ui62KOi03h0UgheoHWovJSCDF4CKre/xtFr3nL7lq/PKI",
-                "JsjVNz7/RK9FSXF6WwfONtLCyQGEuVAsB/KXfCBEyfKhaMwGHvhujRidGW5uV1no",
-                "lMGl3ODmo29Lgeu2uSE7EpJRZoe6hU6ddmBkqxax61ZtkaFlGFFpdo2K8balNNdz",
-                "ZsJ/9mmI9x3oOJ4/l1nhQbUO9ADbs7gJhFdV5Qkp30b5fCI7bU+aoe1ccBbLe/WM",
-                "YUty1PqcuQT7XjA+XmYuL261tvW8pBetT+i33/E2d8PzzYt2IuK9qeevyS+yxdwA",
-                "kfwejFWzzsUlJaDxs1x4XOxkMgSj+jo+g12dFOb7fyClsAnq23iDb8AuaT/BScAI",
-                "+lO+gher69+6LmM7VGHLG5k762J1jTaQCaKt1s8TAWV99Eo4491vL6fyvk3l/Cfg",
-                "RXSwiWFgj19Pn0Rq7CD9v22UE2vdUMBTcV4aw79mClk1YQ23jbF0y5DCjPdJ62Zo",
-                "tskBgFt3NoWV80jZ76zIBLrrjLwCCll8JjJtFwSkt2GX5RFBsVa4A8IDht9RtEk7",
-                "rrHgbSZQfkauEi/mH3/6CDZoLqSHudUZ7d4MaJwun1TkFYGe2ORwGJd4OBj3oGJp",
-                "H8YBwCpk///L/fKjX0Gg3M8nrpM4wrRFhPKidAgO/kcm25X4+ZHlVkWBTCt5RWKI",
-                "fHh6oLDZCqCfcgMkE1KKmwfIHaUkhq5BPRigwy6i5dh1DM4+1UCLh3dxzVbqE9b9",
-                "61NB19nXdRtDA2sOUnj9ve6m/wEPyCb6/zBQZqvCBYb1/AjdXpUrFT+DbpfyxaXN",
-                "XfhDVb5mNqNM/IVj0V5fvTc6vOfYbzQtPm10H+FdWWfb+rJRfyC3MA2w2IqstFe3",
-                "w3bu2iE6CQvSqRvge+ZqLKt/NqYwOURiUmpuklbl3kPJ97+mfKWoiqk8Iz1VY+bb",
-                "NMUC7aoGv+jcoj+WS6PYO8N6BeRVUUB3ZJSf8nzjgxm1/BcM+UD3BPrlhT11ODRs",
-                "baifGbprMWwt3dhb8cQgRT8GPdpO1OsDkzL6iikMjLHWWiA99GV6ruiHsIPw6boW",
-                "A6/uSOskbDHOROotKmddGTBd0iiHXAoQsJFt1ZjUkt6EHrgWs+GAvrvKpXs1mrz8",
-                "uj3GwEFrHS+Xuf2UDgpszYT3hI2cL/kUtGakVR7m7vVMZqXBUbZdGAEb1PZNPwsI",
-                "E4aMK02+EVB+tSN4Fzj99N2YD0inVYt+oPjr2tHhUS6aSGBNS/48Ki47DOg4Sxkn",
-                "lkOWnEbCD+XTnbDd",
-                "=agR5",
-                "-----END PGP MESSAGE-----",
-                "",
-                "",
-                "--YFrteb74qSXmggbOxZL9dRnhymywAi--",
-                "",
-                "",
-            ]
-        ).encode()
-    )
-
-    assert not check_encrypted_bstr(
-        "\r\n".join(
-            [
-                "Subject: Buy Penis Enlargement at www.malicious-domain.com",
-                "From: <barbaz@c2.testrun.org>",
-                "To: <foobar@c2.testrun.org>",
-                "Date: Sun, 15 Oct 2023 16:43:21 +0000",
-                "Message-ID: <Mr.UVyJWZmkCKM.hGzNc6glBE_@c2.testrun.org>",
-                "In-Reply-To: <Mr.MvmCz-GQbi_.6FGRkhDf05c@c2.testrun.org>",
-                "References: <Mr.3gckbNy5bch.uK3Hd2Ws6-w@c2.testrun.org>",
-                "\t<Mr.MvmCz-GQbi_.6FGRkhDf05c@c2.testrun.org>",
-                "Chat-Version: 1.0",
-                "Autocrypt: addr=barbaz@c2.testrun.org; prefer-encrypt=mutual;",
-                "\tkeydata=xjMEZSwWjhYJKwYBBAHaRw8BAQdAQBEhqeJh0GueHB6kF/DUQqYCxARNBVokg/AzT+7LqH",
-                "\trNFzxiYXJiYXpAYzIudGVzdHJ1bi5vcmc+wosEEBYIADMCGQEFAmUsFo4CGwMECwkIBwYVCAkKCwID",
-                "\tFgIBFiEEFTfUNvVnY3b9F7yHnmme1PfUhX8ACgkQnmme1PfUhX9A4AEAnHWHp49eBCMHK5t66gYPiW",
-                "\tXQuB1mwUjzGfYWB+0RXUoA/0xcQ3FbUNlGKW7Blp6eMFfViv6Mv2d3kNSXACB6nmcMzjgEZSwWjhIK",
-                "\tKwYBBAGXVQEFAQEHQBpY5L2M1XHo0uxf8SX1wNLBp/OVvidoWHQF2Jz+kJsUAwEIB8J4BBgWCAAgBQ",
-                "\tJlLBaOAhsMFiEEFTfUNvVnY3b9F7yHnmme1PfUhX8ACgkQnmme1PfUhX/INgEA37AJaNvruYsJVanP",
-                "\tIXnYw4CKd55UAwl8Zcy+M2diAbkA/0fHHcGV4r78hpbbL1Os52DPOdqYQRauIeJUeG+G6bQO",
-                "MIME-Version: 1.0",
-                'Content-Type: multipart/encrypted; protocol="application/pgp-encrypted";',
-                '\tboundary="YFrteb74qSXmggbOxZL9dRnhymywAi"',
-                "",
-                "",
-                "--YFrteb74qSXmggbOxZL9dRnhymywAi",
-                "Content-Description: PGP/MIME version identification",
-                "Content-Type: application/pgp-encrypted",
-                "",
-                "Version: 1",
-                "",
-                "",
-                "--YFrteb74qSXmggbOxZL9dRnhymywAi",
-                "Content-Description: OpenPGP encrypted message",
-                'Content-Disposition: inline; filename="encrypted.asc";',
-                'Content-Type: application/octet-stream; name="encrypted.asc"',
-                "",
-                "-----BEGIN PGP MESSAGE-----",
-                "",
-                "wU4DhW3gBZ/VvCYSAQdA8bMs2spwbKdGjVsL1ByPkNrqD7frpB73maeL6I6SzDYg",
-                "O5G53tv339RdKq3WRcCtEEvxjHlUx2XNwXzC04BpmfvBTgNfPUyLDzjXnxIBB0Ae",
-                "8ymwGvXMCCimHXN0Dg8Ui62KOi03h0UgheoHWovJSCDF4CKre/xtFr3nL7lq/PKI",
-                "JsjVNz7/RK9FSXF6WwfONtLCyQGEuVAsB/KXfCBEyfKhaMwGHvhujRidGW5uV1no",
-                "lMGl3ODmo29Lgeu2uSE7EpJRZoe6hU6ddmBkqxax61ZtkaFlGFFpdo2K8balNNdz",
-                "ZsJ/9mmI9x3oOJ4/l1nhQbUO9ADbs7gJhFdV5Qkp30b5fCI7bU+aoe1ccBbLe/WM",
-                "YUty1PqcuQT7XjA+XmYuL261tvW8pBetT+i33/E2d8PzzYt2IuK9qeevyS+yxdwA",
-                "kfwejFWzzsUlJaDxs1x4XOxkMgSj+jo+g12dFOb7fyClsAnq23iDb8AuaT/BScAI",
-                "+lO+gher69+6LmM7VGHLG5k762J1jTaQCaKt1s8TAWV99Eo4491vL6fyvk3l/Cfg",
-                "RXSwiWFgj19Pn0Rq7CD9v22UE2vdUMBTcV4aw79mClk1YQ23jbF0y5DCjPdJ62Zo",
-                "tskBgFt3NoWV80jZ76zIBLrrjLwCCll8JjJtFwSkt2GX5RFBsVa4A8IDht9RtEk7",
-                "rrHgbSZQfkauEi/mH3/6CDZoLqSHudUZ7d4MaJwun1TkFYGe2ORwGJd4OBj3oGJp",
-                "H8YBwCpk///L/fKjX0Gg3M8nrpM4wrRFhPKidAgO/kcm25X4+ZHlVkWBTCt5RWKI",
-                "fHh6oLDZCqCfcgMkE1KKmwfIHaUkhq5BPRigwy6i5dh1DM4+1UCLh3dxzVbqE9b9",
-                "61NB19nXdRtDA2sOUnj9ve6m/wEPyCb6/zBQZqvCBYb1/AjdXpUrFT+DbpfyxaXN",
-                "XfhDVb5mNqNM/IVj0V5fvTc6vOfYbzQtPm10H+FdWWfb+rJRfyC3MA2w2IqstFe3",
-                "w3bu2iE6CQvSqRvge+ZqLKt/NqYwOURiUmpuklbl3kPJ97+mfKWoiqk8Iz1VY+bb",
-                "NMUC7aoGv+jcoj+WS6PYO8N6BeRVUUB3ZJSf8nzjgxm1/BcM+UD3BPrlhT11ODRs",
-                "baifGbprMWwt3dhb8cQgRT8GPdpO1OsDkzL6iikMjLHWWiA99GV6ruiHsIPw6boW",
-                "A6/uSOskbDHOROotKmddGTBd0iiHXAoQsJFt1ZjUkt6EHrgWs+GAvrvKpXs1mrz8",
-                "uj3GwEFrHS+Xuf2UDgpszYT3hI2cL/kUtGakVR7m7vVMZqXBUbZdGAEb1PZNPwsI",
-                "E4aMK02+EVB+tSN4Fzj99N2YD0inVYt+oPjr2tHhUS6aSGBNS/48Ki47DOg4Sxkn",
-                "lkOWnEbCD+XTnbDd",
-                "=agR5",
-                "-----END PGP MESSAGE-----",
-                "",
-                "",
-                "--YFrteb74qSXmggbOxZL9dRnhymywAi--",
-                "",
-                "",
-            ]
-        ).encode()
-    )
-
-    assert not check_encrypted_bstr(
-        "\r\n".join(
-            [
-                "Subject: Message opened",
-                "From: <barbaz@c2.testrun.org>",
-                "To: <foobar@c2.testrun.org>",
-                "Date: Sun, 15 Oct 2023 16:43:25 +0000",
-                "Message-ID: <Mr.78MWtlV7RAi.goCFzBhCYfy@c2.testrun.org>",
-                "Auto-Submitted: auto-replied",
-                "Chat-Version: 1.0",
-                "MIME-Version: 1.0",
-                "Content-Type: multipart/report; report-type=disposition-notification;",
-                '\tboundary="Gl92xgZjOShJ5PGHntqYkoo2OK2Dvi"',
-                "",
-                "",
-                "--Gl92xgZjOShJ5PGHntqYkoo2OK2Dvi",
-                "Content-Type: text/plain; charset=utf-8; format=flowed; delsp=no",
-                "",
-                'The "Hi!" message you sent was displayed on the screen of the recipient.',
-                "",
-                "This is no guarantee the content was read.",
-                "",
-                "",
-                "--Gl92xgZjOShJ5PGHntqYkoo2OK2Dvi",
-                "Content-Type: message/disposition-notification",
-                "",
-                "Reporting-UA: Delta Chat 1.124.1",
-                "Original-Recipient: rfc822;barbaz@c2.testrun.org",
-                "Final-Recipient: rfc822;barbaz@c2.testrun.org",
-                "Original-Message-ID: <Mr.MvmCz-GQbi_.6FGRkhDf05c@c2.testrun.org>",
-                "Disposition: manual-action/MDN-sent-automatically; displayed",
-                "",
-                "",
-                "--Gl92xgZjOShJ5PGHntqYkoo2OK2Dvi--",
-                "",
-                "",
-            ]
-        ).encode()
-    )

deploy-chatmail/src/deploy_chatmail/__init__.py

@@ -34,43 +34,28 @@ def _install_chatmaild() -> None:
             commands=[f"pip install --break-system-packages {remote_path}"],
         )
 
-        files.put(
-            name="upload doveauth-dictproxy.service",
-            src=importlib.resources.files("chatmaild")
-            .joinpath("doveauth-dictproxy.service")
-            .open("rb"),
-            dest="/etc/systemd/system/doveauth-dictproxy.service",
-            user="root",
-            group="root",
-            mode="644",
-        )
-        systemd.service(
-            name="Setup doveauth-dictproxy service",
-            service="doveauth-dictproxy.service",
-            running=True,
-            enabled=True,
-            restarted=True,
-            daemon_reload=True,
-        )
-
-        files.put(
-            name="upload filtermail.service",
-            src=importlib.resources.files("chatmaild")
-            .joinpath("filtermail.service")
-            .open("rb"),
-            dest="/etc/systemd/system/filtermail.service",
-            user="root",
-            group="root",
-            mode="644",
-        )
-        systemd.service(
-            name="Setup filtermail service",
-            service="filtermail.service",
-            running=True,
-            enabled=True,
-            restarted=True,
-            daemon_reload=True,
-        )
+        for fn in (
+            "doveauth-dictproxy",
+            "filtermail",
+        ):
+            files.put(
+                name=f"Upload {fn}.service",
+                src=importlib.resources.files("chatmaild")
+                .joinpath(f"{fn}.service")
+                .open("rb"),
+                dest=f"/etc/systemd/system/{fn}.service",
+                user="root",
+                group="root",
+                mode="644",
+            )
+            systemd.service(
+                name=f"Setup {fn} service",
+                service=f"{fn}.service",
+                running=True,
+                enabled=True,
+                restarted=True,
+                daemon_reload=True,
+            )
 
 
 def _configure_opendkim(domain: str, dkim_selector: str) -> bool:
@@ -173,6 +158,33 @@ def _configure_dovecot(mail_server: str, debug: bool = False) -> bool:
     return need_restart
 
 
+def _configure_nginx(domain: str, debug: bool = False) -> bool:
+    """Configures nginx HTTP server."""
+    need_restart = False
+
+    main_config = files.template(
+        src=importlib.resources.files(__package__).joinpath("nginx.conf.j2"),
+        dest="/etc/nginx/nginx.conf",
+        user="root",
+        group="root",
+        mode="644",
+        config={"domain_name": domain},
+    )
+    need_restart |= main_config.changed
+
+    autoconfig = files.template(
+        src=importlib.resources.files(__package__).joinpath("autoconfig.xml.j2"),
+        dest="/var/www/html/.well-known/autoconfig/mail/config-v1.1.xml",
+        user="root",
+        group="root",
+        mode="644",
+        config={"domain_name": domain},
+    )
+    need_restart |= autoconfig.changed
+
+    return need_restart
+
+
 def deploy_chatmail(mail_domain: str, mail_server: str, dkim_selector: str) -> None:
     """Deploy a chat-mail instance.
 
@@ -194,7 +206,7 @@ def deploy_chatmail(mail_domain: str, mail_server: str, dkim_selector: str) -> N
     )
 
     # Deploy acmetool to have TLS certificates.
-    deploy_acmetool(domains=[mail_server])
+    deploy_acmetool(nginx_hook=True, domains=[mail_server])
 
     apt.packages(
         name="Install Postfix",
@@ -214,11 +226,17 @@ def deploy_chatmail(mail_domain: str, mail_server: str, dkim_selector: str) -> N
         ],
     )
 
+    apt.packages(
+        name="Install nginx",
+        packages=["nginx"],
+    )
+
     _install_chatmaild()
     debug = False
     dovecot_need_restart = _configure_dovecot(mail_server, debug=debug)
     postfix_need_restart = _configure_postfix(mail_domain, debug=debug)
     opendkim_need_restart = _configure_opendkim(mail_domain, dkim_selector)
+    nginx_need_restart = _configure_nginx(mail_domain)
 
     systemd.service(
         name="Start and enable OpenDKIM",
@@ -244,6 +262,14 @@ def deploy_chatmail(mail_domain: str, mail_server: str, dkim_selector: str) -> N
         restarted=dovecot_need_restart,
     )
 
+    systemd.service(
+        name="Start and enable nginx",
+        service="nginx.service",
+        running=True,
+        enabled=True,
+        restarted=nginx_need_restart,
+    )
+
     # This file is used by auth proxy.
     # https://wiki.debian.org/EtcMailName
     server.shell(
@@ -251,6 +277,22 @@ def deploy_chatmail(mail_domain: str, mail_server: str, dkim_selector: str) -> N
         commands=[f"echo {mail_domain} >/etc/mailname; chmod 644 /etc/mailname"],
     )
 
+    journald_conf = files.put(
+        name="Configure journald",
+        src=importlib.resources.files(__package__).joinpath("journald.conf"),
+        dest="/etc/systemd/journald.conf",
+        user="root",
+        group="root",
+        mode="644",
+    )
+    systemd.service(
+        name="Start and enable journald",
+        service="systemd-journald.service",
+        running=True,
+        enabled=True,
+        restarted=journald_conf,
+    )
+
     def callback():
         result = server.shell(
             commands=[

deploy-chatmail/src/deploy_chatmail/acmetool/__init__.py

@@ -1,6 +1,6 @@
 import importlib.resources
 
-from pyinfra.operations import apt, files, systemd, server
+from pyinfra.operations import apt, files, server
 
 
 def deploy_acmetool(nginx_hook=False, email="", domains=[]):
@@ -38,22 +38,13 @@ def deploy_acmetool(nginx_hook=False, email="", domains=[]):
         email=email,
     )
 
-    service_file = files.put(
-        src=importlib.resources.files(__package__)
-        .joinpath("acmetool-redirector.service")
-        .open("rb"),
-        dest="/etc/systemd/system/acmetool-redirector.service",
+    files.template(
+        src=importlib.resources.files(__package__).joinpath("target.yaml.j2"),
+        dest="/var/lib/acme/conf/target",
         user="root",
         group="root",
         mode="644",
     )
-    systemd.service(
-        name="Setup acmetool-redirector service",
-        service="acmetool-redirector.service",
-        running=False,
-        enabled=False,
-        restarted=service_file.changed,
-    )
 
     for domain in domains:
         server.shell(

deploy-chatmail/src/deploy_chatmail/acmetool/acmetool-redirector.service

@@ -1,11 +0,0 @@
-[Unit]
-Description=acmetool HTTP redirector
-
-[Service]
-Type=notify
-ExecStart=/usr/bin/acmetool redirector --service.uid=daemon
-Restart=always
-RestartSec=30
-
-[Install]
-WantedBy=multi-user.target

deploy-chatmail/src/deploy_chatmail/acmetool/target.yaml.j2

@@ -0,0 +1,7 @@
+request:
+  provider: https://acme-v02.api.letsencrypt.org/directory
+  key:
+    type: rsa
+  challenge:
+    webroot-paths:
+    - /var/www/html/.well-known/acme-challenge

deploy-chatmail/src/deploy_chatmail/autoconfig.xml.j2

@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<clientConfig version="1.1">
+  <emailProvider id="{{ config.domain_name }}">
+    <domain>{{ config.domain_name }}</domain>
+    <displayName>{{ config.domain_name }} chatmail</displayName>
+    <displayShortName>{{ config.domain_name }}</displayShortName>
+    <incomingServer type="imap">
+      <hostname>{{ config.domain_name }}</hostname>
+      <port>993</port>
+      <socketType>SSL</socketType>
+      <authentication>password-cleartext</authentication>
+      <username>%EMAILADDRESS%</username>
+    </incomingServer>
+    <incomingServer type="imap">
+      <hostname>{{ config.domain_name }}</hostname>
+      <port>143</port>
+      <socketType>STARTTLS</socketType>
+      <authentication>password-cleartext</authentication>
+      <username>%EMAILADDRESS%</username>
+    </incomingServer>
+    <outgoingServer type="smtp">
+      <hostname>{{ config.domain_name }}</hostname>
+      <port>465</port>
+      <socketType>SSL</socketType>
+      <authentication>password-cleartext</authentication>
+      <username>%EMAILADDRESS%</username>
+    </outgoingServer>
+    <outgoingServer type="smtp">
+      <hostname>{{ config.domain_name }}</hostname>
+      <port>587</port>
+      <socketType>STARTTLS</socketType>
+      <authentication>password-cleartext</authentication>
+      <username>%EMAILADDRESS%</username>
+    </outgoingServer>
+  </emailProvider>
+</clientConfig>

deploy-chatmail/src/deploy_chatmail/journald.conf

@@ -0,0 +1,2 @@
+[Journal]
+MaxRetentionSec=3d

deploy-chatmail/src/deploy_chatmail/nginx.conf.j2

@@ -0,0 +1,47 @@
+user www-data;
+worker_processes auto;
+pid /run/nginx.pid;
+error_log /var/log/nginx/error.log;
+
+events {
+	worker_connections 768;
+	# multi_accept on;
+}
+
+http {
+	sendfile on;
+	tcp_nopush on;
+
+	# Do not emit nginx version on error pages.
+	server_tokens off;
+
+	include /etc/nginx/mime.types;
+	default_type application/octet-stream;
+
+	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
+	ssl_prefer_server_ciphers on;
+	ssl_certificate /var/lib/acme/live/{{ config.domain_name }}/fullchain;
+	ssl_certificate_key /var/lib/acme/live/{{ config.domain_name }}/privkey;
+
+	gzip on;
+
+	server {
+		listen 80 default_server;
+		listen [::]:80 default_server;
+		listen 443 ssl default_server;
+		listen [::]:443 ssl default_server;
+
+		root /var/www/html;
+
+		index index.html index.htm;
+
+		server_name _;
+
+		location / {
+			# First attempt to serve request as file, then
+			# as directory, then fall back to displaying a 404.
+			try_files $uri $uri/ =404;
+		}
+	}
+}
+

deploy-chatmail/src/deploy_chatmail/postfix/master.cf.j2

@@ -32,7 +32,7 @@ submission inet n       -       y       -       -       smtpd
   -o smtpd_recipient_restrictions=
   -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
   -o milter_macro_daemon_name=ORIGINATING
-  -o content_filter=filter:unix:private/filtermail
+  -o smtpd_proxy_filter=127.0.0.1:10080
 smtps     inet  n       -       y       -       -       smtpd
   -o syslog_name=postfix/smtps
   -o smtpd_tls_wrappermode=yes
@@ -47,7 +47,7 @@ smtps     inet  n       -       y       -       -       smtpd
   -o smtpd_recipient_restrictions=
   -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
   -o milter_macro_daemon_name=ORIGINATING
-  -o content_filter=filter:unix:private/filtermail
+  -o smtpd_proxy_filter=127.0.0.1:10080
 #628       inet  n       -       y       -       -       qmqpd
 pickup    unix  n       -       y       60      1       pickup
 cleanup   unix  n       -       y       -       0       cleanup
@@ -76,5 +76,5 @@ scache    unix  -       -       y       -       1       scache
 postlog   unix-dgram n  -       n       -       1       postlogd
 filter    unix -        n       n       -       -       lmtp
 # Local SMTP server for reinjecting filered mail.
-localhost:10026 inet  n       -       n       -       10      smtpd
-        -o content_filter=
+localhost:10025 inet  n       -       n       -       10      smtpd
+  -o syslog_name=postfix/reinject

online-tests/benchmark.py

@@ -1,34 +0,0 @@
-def test_tls_serialized_connect(benchmark, imap_or_smtp):
-    def connect():
-        imap_or_smtp.connect()
-
-    benchmark(connect)
-
-
-def test_login(benchmark, imap_or_smtp, gencreds):
-    cls = imap_or_smtp.__class__
-    conns = []
-    for i in range(20):
-        conn = cls(imap_or_smtp.host)
-        conn.connect()
-        conns.append(conn)
-
-    def login():
-        conn = conns.pop()
-        conn.login(*gencreds())
-
-    benchmark(login)
-
-
-def test_send_and_receive_10(benchmark, cmfactory, lp):
-    """send many messages between two accounts"""
-    ac1, ac2 = cmfactory.get_online_accounts(2)
-    chat = cmfactory.get_accepted_chat(ac1, ac2)
-
-    def send_10_receive_all():
-        for i in range(10):
-            chat.send_text(f"hello {i}")
-        for i in range(10):
-            ac2.wait_next_incoming_message()
-
-    benchmark(send_10_receive_all)

online-tests/pytest.ini

@@ -1,3 +0,0 @@
-[pytest]
-addopts = -vrsx --strict-markers
-markers = slow: mark test as slow (requires --slow option to run)

online-tests/test_0_basic.py

@@ -1,15 +0,0 @@
-def test_remote(remote, imap_or_smtp):
-    lineproducer = remote.iter_output(imap_or_smtp.logcmd)
-    imap_or_smtp.connect()
-    assert imap_or_smtp.name in next(lineproducer)
-
-
-def test_use_two_chatmailservers(cmfactory, maildomain2):
-    ac1 = cmfactory.new_online_configuring_account(cache=False)
-    cmfactory.switch_maildomain(maildomain2)
-    ac2 = cmfactory.new_online_configuring_account(cache=False)
-    cmfactory.bring_accounts_online()
-    cmfactory.get_accepted_chat(ac1, ac2)
-    domain1 = ac1.get_config("addr").split("@")[1]
-    domain2 = ac2.get_config("addr").split("@")[1]
-    assert domain1 != domain2

scripts/get_imap_capabilities.py

@@ -11,4 +11,3 @@ conn.login(f"imapcapa", "pass")
 status, res = conn.capability()
 for capa in sorted(res[0].decode().split()):
     print(capa)
-

scripts/init.sh

@@ -6,9 +6,8 @@ deploy-chatmail/venv/bin/pip install -e deploy-chatmail
 deploy-chatmail/venv/bin/pip install -e chatmaild
 
 python3 -m venv chatmaild/venv
-sudo apt install -y dovecot-core && sudo systemctl disable --now dovecot
 chatmaild/venv/bin/pip install --upgrade pytest build 'setuptools>=68'
 chatmaild/venv/bin/pip install -e chatmaild
 
 python3 -m venv online-tests/venv
-online-tests/venv/bin/pip install pytest pytest-timeout pdbpp deltachat pytest-benchmark
+online-tests/venv/bin/pip install pytest pytest-timeout pdbpp deltachat 

scripts/measure_tls_and_logins.py

@@ -5,7 +5,7 @@ import imaplib
 
 domain = os.environ.get("CHATMAIL_DOMAIN", "c3.testrun.org")
 
-NUM_CONNECTIONS=10
+NUM_CONNECTIONS = 10
 
 conns = []
 
@@ -16,7 +16,7 @@ for i in range(NUM_CONNECTIONS):
     conns.append(conn)
 
 tlsdone = time.time()
-duration = tlsdone-start
+duration = tlsdone - start
 print(f"{duration}: TLS connections opening TLS connections")
 
 for i, conn in enumerate(conns):

tests/chatmaild/conftest.py

@@ -0,0 +1,9 @@
+import pytest
+from chatmaild.database import Database
+
+
+@pytest.fixture()
+def db(tmpdir):
+    db_path = tmpdir / "passdb.sqlite"
+    print("database path:", db_path)
+    return Database(db_path)

tests/chatmaild/test_dictproxy.py

@@ -0,0 +1,48 @@
+import os
+
+import pytest
+
+import chatmaild.dictproxy
+from chatmaild.dictproxy import DictProxy
+from chatmaild.database import DBError
+
+
+@pytest.fixture
+def dictproxy(db, maildomain):
+    return DictProxy(db, maildomain)
+
+
+def test_basic(dictproxy, tmpdir, monkeypatch):
+    monkeypatch.setattr(
+        chatmaild.dictproxy, "NOCREATE_FILE", tmpdir.join("nocreate").strpath
+    )
+    dictproxy.lookup_passdb("link2xt@c1.testrun.org", "asdf")
+    assert dictproxy.get_user_data("link2xt@c1.testrun.org")
+
+
+def test_dont_overwrite_password_on_wrong_login(dictproxy):
+    """Test that logging in with a different password doesn't create a new user"""
+    res = dictproxy.lookup_passdb("newuser1@something.org", "kajdlkajsldk12l3kj1983")
+    assert res["password"]
+    res2 = dictproxy.lookup_passdb("newuser1@something.org", "kajdlqweqwe")
+    # this function always returns a password hash, which is actually compared by dovecot.
+    assert res["password"] == res2["password"]
+
+
+def test_nocreate_file(dictproxy, tmpdir, monkeypatch):
+    nocreate = tmpdir.join("nocreate")
+    monkeypatch.setattr(chatmaild.dictproxy, "NOCREATE_FILE", str(nocreate))
+    nocreate.write("")
+    dictproxy.lookup_passdb("newuser1@something.org", "kajdlqweqwe")
+    assert not dictproxy.get_user_data("newuser1@something.org")
+
+
+def test_db_version(db):
+    assert db.get_schema_version() == 1
+
+
+def test_too_high_db_version(db):
+    with db.write_transaction() as conn:
+        conn.execute("PRAGMA user_version=%s;" % (999,))
+    with pytest.raises(DBError):
+        db.ensure_tables()

tests/chatmaild/test_filtermail.py

@@ -0,0 +1,51 @@
+from chatmaild.filtermail import check_encrypted, check_DATA, SendRateLimiter
+import pytest
+
+
+def test_reject_forged_from(maildata, gencreds):
+    class env:
+        mail_from = gencreds()[0]
+        rcpt_tos = [gencreds()[0]]
+
+    # test that the filter lets good mail through
+    env.content = maildata("plain.eml", from_addr=env.mail_from).as_bytes()
+    assert not check_DATA(envelope=env)
+
+    # test that the filter rejects forged mail
+    env.content = maildata("plain.eml", from_addr="forged@c3.testrun.org").as_bytes()
+    error = check_DATA(envelope=env)
+    assert "500" in error
+
+
+def test_filtermail_no_encryption_detection(maildata):
+    msg = maildata("plain.eml")
+    assert not check_encrypted(msg)
+
+    # https://xkcd.com/1181/
+    msg = maildata("fake-encrypted.eml")
+    assert not check_encrypted(msg)
+
+
+def test_filtermail_encryption_detection(maildata):
+    msg = maildata("encrypted.eml")
+    assert check_encrypted(msg)
+
+    # if the subject is not "..." it is not considered ac-encrypted
+    msg.replace_header("Subject", "Click this link")
+    assert not check_encrypted(msg)
+
+
+def test_filtermail_mdn_is_not_encrypted(maildata):
+    assert not check_encrypted(maildata("mdn.eml"))
+
+
+def test_send_rate_limiter():
+    limiter = SendRateLimiter()
+    for i in range(100):
+        if limiter.is_sending_allowed("some@example.org"):
+            if i <= SendRateLimiter.MAX_USER_SEND_PER_MINUTE:
+                continue
+            pytest.fail("limiter didn't work")
+        else:
+            assert i == SendRateLimiter.MAX_USER_SEND_PER_MINUTE + 1
+            break

tests/conftest.py

@@ -1,19 +1,34 @@
 import os
 import io
+import time
 import random
 import subprocess
 import imaplib
 import smtplib
 import itertools
+from email.parser import BytesParser
+from email import policy
+from pathlib import Path
+from math import ceil
 import pytest
 
 
+conftestdir = Path(__file__).parent
+
+
 def pytest_addoption(parser):
     parser.addoption(
         "--slow", action="store_true", default=False, help="also run slow tests"
     )
 
 
+def pytest_configure(config):
+    config._benchresults = {}
+    config.addinivalue_line(
+        "markers", "slow: mark test to require --slow option to run"
+    )
+
+
 def pytest_runtest_setup(item):
     markers = list(item.iter_markers(name="slow"))
     if markers:
@@ -54,6 +69,49 @@ def pytest_report_header():
         return ["-" * len(text), text, "-" * len(text)]
 
 
+@pytest.fixture
+def benchmark(request):
+    def bench(func, num, name=None):
+        if name is None:
+            name = func.__name__
+        durations = []
+        for i in range(num):
+            now = time.time()
+            func()
+            durations.append(time.time() - now)
+        durations.sort()
+        request.config._benchresults[name] = durations
+
+    return bench
+
+
+def pytest_terminal_summary(terminalreporter):
+    tr = terminalreporter
+    results = tr.config._benchresults
+    if not results:
+        return
+
+    tr.section("benchmark results")
+    float_names = "median min max".split()
+    width = max(map(len, float_names))
+
+    def fcol(parts):
+        return " ".join(part.rjust(width) for part in parts)
+
+    headers = f"{'benchmark name': <30} " + fcol(float_names)
+    tr.write_line(headers)
+    tr.write_line("-" * len(headers))
+    for name, durations in results.items():
+        measures = [
+            sorted(durations)[len(durations) // 2],
+            min(durations),
+            max(durations),
+        ]
+        line = f"{name: <30} "
+        line += fcol(f"{float: 2.2f}" for float in measures)
+        tr.write_line(line)
+
+
 @pytest.fixture
 def imap(maildomain):
     return ImapConn(maildomain)
@@ -75,6 +133,24 @@ class ImapConn:
         print(f"imap-login {user!r} {password!r}")
         self.conn.login(user, password)
 
+    def fetch_all(self):
+        print("imap-fetch all")
+        status, res = self.conn.select()
+        if int(res[0]) == 0:
+            raise ValueError("no messages in imap folder")
+        status, results = self.conn.fetch("1:*", "(RFC822)")
+        assert status == "OK"
+        return results
+
+    def fetch_all_messages(self):
+        print("imap-fetch all messages")
+        results = self.fetch_all()
+        messages = []
+        for item in results:
+            if len(item) == 2:
+                messages.append(item[1].decode())
+        return messages
+
 
 @pytest.fixture
 def smtp(maildomain):
@@ -97,6 +173,11 @@ class SmtpConn:
         print(f"smtp-login {user!r} {password!r}")
         self.conn.login(user, password)
 
+    def sendmail(self, from_addr, to_addrs, msg):
+        print(f"smtp-sendmail from={from_addr!r} to_addrs={to_addrs!r}")
+        print(f"smtp-sendmail message size: {len(msg)}")
+        return self.conn.sendmail(from_addr=from_addr, to_addrs=to_addrs, msg=msg)
+
 
 @pytest.fixture(params=["imap", "smtp"])
 def imap_or_smtp(request):
@@ -198,4 +279,72 @@ class Remote:
         )
         while 1:
             line = self.popen.stdout.readline()
-            yield line.decode().strip().lower()
+            res = line.decode().strip().lower()
+            if res:
+                yield res
+            else:
+                break
+
+
+@pytest.fixture
+def maildata(request, gencreds):
+    datadir = conftestdir.joinpath("mail-data")
+
+    def maildata(name, parsed=True, from_addr=None, to_addr=None):
+        if from_addr is None:
+            from_addr = gencreds()[0]
+        if to_addr is None:
+            to_addr = gencreds()[0]
+        data = datadir.joinpath(name).read_text()
+        text = data.format(from_addr=from_addr, to_addr=to_addr)
+        return BytesParser(policy=policy.default).parsebytes(text.encode())
+
+    return maildata
+
+
+@pytest.fixture
+def cmsetup(maildomain, gencreds):
+    return CMSetup(maildomain, gencreds)
+
+
+class CMSetup:
+    def __init__(self, maildomain, gencreds):
+        self.maildomain = maildomain
+        self.gencreds = gencreds
+
+    def gen_users(self, num):
+        print(f"Creating {num} online users")
+        users = []
+        for i in range(num):
+            addr, password = self.gencreds()
+            user = CMUser(self.maildomain, addr, password)
+            assert user.smtp
+            users.append(user)
+        return users
+
+
+class CMUser:
+    def __init__(self, maildomain, addr, password):
+        self.maildomain = maildomain
+        self.addr = addr
+        self.password = password
+        self._smtp = None
+        self._imap = None
+
+    @property
+    def smtp(self):
+        if not self._smtp:
+            handle = SmtpConn(self.maildomain)
+            handle.connect()
+            handle.login(self.addr, self.password)
+            self._smtp = handle
+        return self._smtp
+
+    @property
+    def imap(self):
+        if not self._imap:
+            imap = ImapConn(self.maildomain)
+            imap.connect()
+            imap.login(self.addr, self.password)
+            self._imap = imap
+        return self._imap

tests/mail-data/encrypted.eml

@@ -0,0 +1,66 @@
+From: {from_addr}
+To: {to_addr}
+Subject: ...
+Date: Sun, 15 Oct 2023 16:43:21 +0000
+Message-ID: <Mr.UVyJWZmkCKM.hGzNc6glBE_@c2.testrun.org>
+In-Reply-To: <Mr.MvmCz-GQbi_.6FGRkhDf05c@c2.testrun.org>
+References: <Mr.3gckbNy5bch.uK3Hd2Ws6-w@c2.testrun.org>
+	<Mr.MvmCz-GQbi_.6FGRkhDf05c@c2.testrun.org>
+Chat-Version: 1.0
+Autocrypt: addr={from_addr}; prefer-encrypt=mutual;
+	keydata=xjMEZSwWjhYJKwYBBAHaRw8BAQdAQBEhqeJh0GueHB6kF/DUQqYCxARNBVokg/AzT+7LqH
+	rNFzxiYXJiYXpAYzIudGVzdHJ1bi5vcmc+wosEEBYIADMCGQEFAmUsFo4CGwMECwkIBwYVCAkKCwID
+	FgIBFiEEFTfUNvVnY3b9F7yHnmme1PfUhX8ACgkQnmme1PfUhX9A4AEAnHWHp49eBCMHK5t66gYPiW
+	XQuB1mwUjzGfYWB+0RXUoA/0xcQ3FbUNlGKW7Blp6eMFfViv6Mv2d3kNSXACB6nmcMzjgEZSwWjhIK
+	KwYBBAGXVQEFAQEHQBpY5L2M1XHo0uxf8SX1wNLBp/OVvidoWHQF2Jz+kJsUAwEIB8J4BBgWCAAgBQ
+	JlLBaOAhsMFiEEFTfUNvVnY3b9F7yHnmme1PfUhX8ACgkQnmme1PfUhX/INgEA37AJaNvruYsJVanP
+	IXnYw4CKd55UAwl8Zcy+M2diAbkA/0fHHcGV4r78hpbbL1Os52DPOdqYQRauIeJUeG+G6bQO
+MIME-Version: 1.0
+Content-Type: multipart/encrypted; protocol="application/pgp-encrypted";
+	boundary="YFrteb74qSXmggbOxZL9dRnhymywAi"
+
+
+--YFrteb74qSXmggbOxZL9dRnhymywAi
+Content-Description: PGP/MIME version identification
+Content-Type: application/pgp-encrypted
+
+Version: 1
+
+
+--YFrteb74qSXmggbOxZL9dRnhymywAi
+Content-Description: OpenPGP encrypted message
+Content-Disposition: inline; filename="encrypted.asc";
+Content-Type: application/octet-stream; name="encrypted.asc"
+
+-----BEGIN PGP MESSAGE-----
+
+wU4DhW3gBZ/VvCYSAQdA8bMs2spwbKdGjVsL1ByPkNrqD7frpB73maeL6I6SzDYg
+O5G53tv339RdKq3WRcCtEEvxjHlUx2XNwXzC04BpmfvBTgNfPUyLDzjXnxIBB0Ae
+8ymwGvXMCCimHXN0Dg8Ui62KOi03h0UgheoHWovJSCDF4CKre/xtFr3nL7lq/PKI
+JsjVNz7/RK9FSXF6WwfONtLCyQGEuVAsB/KXfCBEyfKhaMwGHvhujRidGW5uV1no
+lMGl3ODmo29Lgeu2uSE7EpJRZoe6hU6ddmBkqxax61ZtkaFlGFFpdo2K8balNNdz
+ZsJ/9mmI9x3oOJ4/l1nhQbUO9ADbs7gJhFdV5Qkp30b5fCI7bU+aoe1ccBbLe/WM
+YUty1PqcuQT7XjA+XmYuL261tvW8pBetT+i33/E2d8PzzYt2IuK9qeevyS+yxdwA
+kfwejFWzzsUlJaDxs1x4XOxkMgSj+jo+g12dFOb7fyClsAnq23iDb8AuaT/BScAI
++lO+gher69+6LmM7VGHLG5k762J1jTaQCaKt1s8TAWV99Eo4491vL6fyvk3l/Cfg
+RXSwiWFgj19Pn0Rq7CD9v22UE2vdUMBTcV4aw79mClk1YQ23jbF0y5DCjPdJ62Zo
+tskBgFt3NoWV80jZ76zIBLrrjLwCCll8JjJtFwSkt2GX5RFBsVa4A8IDht9RtEk7
+rrHgbSZQfkauEi/mH3/6CDZoLqSHudUZ7d4MaJwun1TkFYGe2ORwGJd4OBj3oGJp
+H8YBwCpk///L/fKjX0Gg3M8nrpM4wrRFhPKidAgO/kcm25X4+ZHlVkWBTCt5RWKI
+fHh6oLDZCqCfcgMkE1KKmwfIHaUkhq5BPRigwy6i5dh1DM4+1UCLh3dxzVbqE9b9
+61NB19nXdRtDA2sOUnj9ve6m/wEPyCb6/zBQZqvCBYb1/AjdXpUrFT+DbpfyxaXN
+XfhDVb5mNqNM/IVj0V5fvTc6vOfYbzQtPm10H+FdWWfb+rJRfyC3MA2w2IqstFe3
+w3bu2iE6CQvSqRvge+ZqLKt/NqYwOURiUmpuklbl3kPJ97+mfKWoiqk8Iz1VY+bb
+NMUC7aoGv+jcoj+WS6PYO8N6BeRVUUB3ZJSf8nzjgxm1/BcM+UD3BPrlhT11ODRs
+baifGbprMWwt3dhb8cQgRT8GPdpO1OsDkzL6iikMjLHWWiA99GV6ruiHsIPw6boW
+A6/uSOskbDHOROotKmddGTBd0iiHXAoQsJFt1ZjUkt6EHrgWs+GAvrvKpXs1mrz8
+uj3GwEFrHS+Xuf2UDgpszYT3hI2cL/kUtGakVR7m7vVMZqXBUbZdGAEb1PZNPwsI
+E4aMK02+EVB+tSN4Fzj99N2YD0inVYt+oPjr2tHhUS6aSGBNS/48Ki47DOg4Sxkn
+lkOWnEbCD+XTnbDd
+=agR5
+-----END PGP MESSAGE-----
+
+
+--YFrteb74qSXmggbOxZL9dRnhymywAi--
+
+

tests/mail-data/fake-encrypted.eml

@@ -0,0 +1,25 @@
+Subject: =?utf-8?q?Message_from_foobar=40c2=2Etestrun=2Eorg?=
+Chat-Disposition-Notification-To: foobar@c2.testrun.org
+Chat-User-Avatar: 0
+From: <{from_addr}>
+To: <{to_addr}>
+Date: Sun, 15 Oct 2023 16:41:44 +0000
+Message-ID: <Mr.3gckbNy5bch.uK3Hd2Ws6-w@c2.testrun.org>
+References: <Mr.3gckbNy5bch.uK3Hd2Ws6-w@c2.testrun.org>
+Chat-Version: 1.0
+Autocrypt: addr={from_addr}; prefer-encrypt=mutual;
+	keydata=xjMEZSrw3hYJKwYBBAHaRw8BAQdAiEKNQFU28c6qsx4vo/JHdt73RXdjMOmByf/XsGiJ7m
+	nNFzxmb29iYXJAYzIudGVzdHJ1bi5vcmc+wosEEBYIADMCGQEFAmUq8N4CGwMECwkIBwYVCAkKCwID
+	FgIBFiEEGil0OvTIa6RngmCLUYNnEa9leJAACgkQUYNnEa9leJCX3gEAhm0MehE5byBBU1avPczr/I
+	HjNLht7Qf6++mAhlJmtDcA/0C8VYJhsUpmiDjuZaMDWNv4FO2BJG6LH7gSm6n7ClMJzjgEZSrw3hIK
+	KwYBBAGXVQEFAQEHQAxGG/QW0owCfMp1A+vXEMwgzWcBpNFr58kX2eXuPpM6AwEIB8J4BBgWCAAgBQ
+	JlKvDeAhsMFiEEGil0OvTIa6RngmCLUYNnEa9leJAACgkQUYNnEa9leJDg1gEAwLf8KDoAAKyYgjyI
+	vYvO9VEgBni1C4Xx1VjcaEmlDK8BALoFuUCK+enw76TtDcAUKhlhUiM6SDRExkS4Nskp/BcK
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8; format=flowed; delsp=no
+
+-----BEGIN PGP MESSAGE-----
+Hi!
+-----END PGP MESSAGE-----
+
+

tests/mail-data/mdn.eml

@@ -0,0 +1,33 @@
+Subject: Message opened
+From: <barbaz@c2.testrun.org>
+To: <foobar@c2.testrun.org>
+Date: Sun, 15 Oct 2023 16:43:25 +0000
+Message-ID: <Mr.78MWtlV7RAi.goCFzBhCYfy@c2.testrun.org>
+Auto-Submitted: auto-replied
+Chat-Version: 1.0
+MIME-Version: 1.0
+Content-Type: multipart/report; report-type=disposition-notification;
+	boundary="Gl92xgZjOShJ5PGHntqYkoo2OK2Dvi"
+
+
+--Gl92xgZjOShJ5PGHntqYkoo2OK2Dvi
+Content-Type: text/plain; charset=utf-8; format=flowed; delsp=no
+
+The "Hi!" message you sent was displayed on the screen of the recipient.
+
+This is no guarantee the content was read.
+
+
+--Gl92xgZjOShJ5PGHntqYkoo2OK2Dvi
+Content-Type: message/disposition-notification
+
+Reporting-UA: Delta Chat 1.124.1
+Original-Recipient: rfc822;barbaz@c2.testrun.org
+Final-Recipient: rfc822;barbaz@c2.testrun.org
+Original-Message-ID: <Mr.MvmCz-GQbi_.6FGRkhDf05c@c2.testrun.org>
+Disposition: manual-action/MDN-sent-automatically; displayed
+
+
+--Gl92xgZjOShJ5PGHntqYkoo2OK2Dvi--
+
+

tests/mail-data/plain.eml

@@ -0,0 +1,23 @@
+Subject: =?utf-8?q?Message_from_foobar=40c2=2Etestrun=2Eorg?=
+Chat-Disposition-Notification-To: foobar@c2.testrun.org
+Chat-User-Avatar: 0
+From: <{from_addr}>
+To: <{to_addr}>
+Date: Sun, 15 Oct 2023 16:41:44 +0000
+Message-ID: <Mr.3gckbNy5bch.uK3Hd2Ws6-w@c2.testrun.org>
+References: <Mr.3gckbNy5bch.uK3Hd2Ws6-w@c2.testrun.org>
+Chat-Version: 1.0
+Autocrypt: addr=foobar@c2.testrun.org; prefer-encrypt=mutual;
+	keydata=xjMEZSrw3hYJKwYBBAHaRw8BAQdAiEKNQFU28c6qsx4vo/JHdt73RXdjMOmByf/XsGiJ7m
+	nNFzxmb29iYXJAYzIudGVzdHJ1bi5vcmc+wosEEBYIADMCGQEFAmUq8N4CGwMECwkIBwYVCAkKCwID
+	FgIBFiEEGil0OvTIa6RngmCLUYNnEa9leJAACgkQUYNnEa9leJCX3gEAhm0MehE5byBBU1avPczr/I
+	HjNLht7Qf6++mAhlJmtDcA/0C8VYJhsUpmiDjuZaMDWNv4FO2BJG6LH7gSm6n7ClMJzjgEZSrw3hIK
+	KwYBBAGXVQEFAQEHQAxGG/QW0owCfMp1A+vXEMwgzWcBpNFr58kX2eXuPpM6AwEIB8J4BBgWCAAgBQ
+	JlKvDeAhsMFiEEGil0OvTIa6RngmCLUYNnEa9leJAACgkQUYNnEa9leJDg1gEAwLf8KDoAAKyYgjyI
+	vYvO9VEgBni1C4Xx1VjcaEmlDK8BALoFuUCK+enw76TtDcAUKhlhUiM6SDRExkS4Nskp/BcK
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8; format=flowed; delsp=no
+
+Hi!
+
+

tests/online/benchmark.py

@@ -0,0 +1,60 @@
+def test_tls_imap(benchmark, imap):
+    def imap_connect():
+        imap.connect()
+
+    benchmark(imap_connect, 10)
+
+
+def test_login_imap(benchmark, imap, gencreds):
+    def imap_connect_and_login():
+        imap.connect()
+        imap.login(*gencreds())
+
+    benchmark(imap_connect_and_login, 10)
+
+
+def test_tls_smtp(benchmark, smtp):
+    def smtp_connect():
+        smtp.connect()
+
+    benchmark(smtp_connect, 10)
+
+
+def test_login_smtp(benchmark, smtp, gencreds):
+    def smtp_connect_and_login():
+        smtp.connect()
+        smtp.login(*gencreds())
+
+    benchmark(smtp_connect_and_login, 10)
+
+
+class TestDC:
+    def test_autoconfigure(self, benchmark, cmfactory):
+        def autoconfig_and_idle_ready():
+            cmfactory.get_online_accounts(1)
+
+        benchmark(autoconfig_and_idle_ready, 5)
+
+    def test_ping_pong(self, benchmark, cmfactory):
+        ac1, ac2 = cmfactory.get_online_accounts(2)
+        chat = cmfactory.get_accepted_chat(ac1, ac2)
+
+        def ping_pong():
+            chat.send_text("ping")
+            msg = ac2.wait_next_incoming_message()
+            msg.chat.send_text("pong")
+            ac1.wait_next_incoming_message()
+
+        benchmark(ping_pong, 5)
+
+    def test_send_10_receive_10(self, benchmark, cmfactory, lp):
+        ac1, ac2 = cmfactory.get_online_accounts(2)
+        chat = cmfactory.get_accepted_chat(ac1, ac2)
+
+        def send_10_receive_10():
+            for i in range(10):
+                chat.send_text(f"hello {i}")
+            for i in range(10):
+                ac2.wait_next_incoming_message()
+
+        benchmark(send_10_receive_10, 5)

tests/online/test_0_login.py

@@ -1,4 +1,5 @@
 import pytest
+import smtplib
 
 
 def test_login_basic_functioning(imap_or_smtp, gencreds, lp):

tests/online/test_1_basic.py

@@ -0,0 +1,63 @@
+import smtplib
+import pytest
+
+
+def test_remote(remote, imap_or_smtp):
+    lineproducer = remote.iter_output(imap_or_smtp.logcmd)
+    imap_or_smtp.connect()
+    assert imap_or_smtp.name in next(lineproducer)
+
+
+def test_use_two_chatmailservers(cmfactory, maildomain2):
+    ac1 = cmfactory.new_online_configuring_account(cache=False)
+    cmfactory.switch_maildomain(maildomain2)
+    ac2 = cmfactory.new_online_configuring_account(cache=False)
+    cmfactory.bring_accounts_online()
+    cmfactory.get_accepted_chat(ac1, ac2)
+    domain1 = ac1.get_config("addr").split("@")[1]
+    domain2 = ac2.get_config("addr").split("@")[1]
+    assert domain1 != domain2
+
+
+@pytest.mark.parametrize("forgeaddr", ["internal", "someone@example.org"])
+def test_reject_forged_from(cmsetup, maildata, lp, forgeaddr):
+    user1, user3 = cmsetup.gen_users(2)
+
+    lp.sec("send encrypted message with forged from")
+    print("envelope_from", user1.addr)
+    if forgeaddr == "internal":
+        addr_to_forge = cmsetup.gen_users(1)[0].addr
+    else:
+        addr_to_forge = "someone@example.org"
+
+    print("message to inject:")
+    msg = maildata("encrypted.eml", from_addr=addr_to_forge, to_addr=user3.addr)
+    msg = msg.as_string()
+    for line in msg.split("\n")[:4]:
+        print(f"   {line}")
+
+    lp.sec("Send forged mail and check remote postfix lmtp processing result")
+    with pytest.raises(smtplib.SMTPException) as e:
+        user1.smtp.sendmail(from_addr=user1.addr, to_addrs=[user3.addr], msg=msg)
+    assert "500" in str(e.value)
+
+
+@pytest.mark.slow
+def test_exceed_rate_limit(cmsetup, gencreds, maildata):
+    """Test that the per-account send-mail limit is exceeded."""
+    user1, user2 = cmsetup.gen_users(2)
+    mail = maildata(
+        "encrypted.eml", from_addr=user1.addr, to_addr=user2.addr
+    ).as_string()
+    for i in range(100):
+        print("Sending mail", str(i))
+        try:
+            user1.smtp.sendmail(user1.addr, [user2.addr], mail)
+        except smtplib.SMTPException as e:
+            if i < 80:
+                pytest.fail(f"rate limit was exceeded too early with msg {i}")
+            outcome = e.recipients[user2.addr]
+            assert outcome[0] == 450
+            assert b"4.7.1: Too much mail from" in outcome[1]
+            return
+    pytest.fail("Rate limit was not exceeded")

tests/pytest.ini

@@ -0,0 +1,2 @@
+[pytest]
+addopts = -vrsx --strict-markers