test: report if rate limit from last test was still active

chatmaild/src/chatmaild/dictproxy.py

@@ -31,9 +31,7 @@ def encrypt_password(password: str):
 
 def create_user(db, user, password):
     if os.path.exists(NOCREATE_FILE):
-        logging.warning(
+        logging.warning(f"Didn't create account: {NOCREATE_FILE} exists. Delete the file to enable account creation.")
-            f"Didn't create account: {NOCREATE_FILE} exists. Delete the file to enable account creation."
-        )
         return
     with db.write_transaction() as conn:
         conn.create_user(user, password)
@@ -61,7 +59,7 @@ def lookup_passdb(db, user, password):
     return userdata
 
 
-def handle_dovecot_request(msg, db, mail_domain):
+def handle_dovecot_request(msg, db):
     print(f"received msg: {msg!r}", file=sys.stderr)
     short_command = msg[0]
     if short_command == "L":  # LOOKUP
@@ -72,15 +70,13 @@ def handle_dovecot_request(msg, db, mail_domain):
         res = ""
         if namespace == "shared":
             if type == "userdb":
-                if user.endswith(f"@{mail_domain}"):
+                res = lookup_userdb(db, user)
-                    res = lookup_userdb(db, user)
                 if res:
                     reply_command = "O"
                 else:
                     reply_command = "N"
             elif type == "passdb":
-                if user.endswith(f"@{mail_domain}"):
+                res = lookup_passdb(db, user, password=args[0])
-                    res = lookup_passdb(db, user, password=args[0])
                 if res:
                     reply_command = "O"
                 else:
@@ -99,8 +95,6 @@ def main():
     socket = sys.argv[1]
     passwd_entry = pwd.getpwnam(sys.argv[2])
     db = Database(sys.argv[3])
-    with open("/etc/mailname", "r") as fp:
-        mail_domain = fp.read().strip()
 
     class Handler(StreamRequestHandler):
         def handle(self):
@@ -108,7 +102,7 @@ def main():
                 msg = self.rfile.readline().strip().decode()
                 if not msg:
                     break
-                res = handle_dovecot_request(msg, db, mail_domain)
+                res = handle_dovecot_request(msg, db)
                 if res:
                     print(f"sending result: {res!r}", file=sys.stderr)
                     self.wfile.write(res.encode("ascii"))

chatmaild/src/chatmaild/filtermail-after.service

@@ -1,10 +0,0 @@
-[Unit]
-Description=Chatmail Postfix AfterQueue filter 
-
-[Service]
-ExecStart=/usr/local/bin/filtermail afterqueue /var/spool/postfix/private/filtermail-afterqueue
-Restart=always
-RestartSec=30
-
-[Install]
-WantedBy=multi-user.target

chatmaild/src/chatmaild/filtermail-before.service

@@ -1,10 +0,0 @@
-[Unit]
-Description=Chatmail Postfix BeforeQeue filter 
-
-[Service]
-ExecStart=/usr/local/bin/filtermail beforequeue 10080
-Restart=always
-RestartSec=30
-
-[Install]
-WantedBy=multi-user.target

chatmaild/src/chatmaild/filtermail.py

@@ -1,15 +1,11 @@
 #!/usr/bin/env python3
 import asyncio
 import logging
-import time
-import sys
 from email.parser import BytesParser
 from email import policy
-from email.utils import parseaddr
 
 from aiosmtpd.lmtp import LMTP
-from aiosmtpd.smtp import SMTP
+from aiosmtpd.controller import UnixSocketController
-from aiosmtpd.controller import UnixSocketController, Controller
 from smtplib import SMTP as SMTPClient
 
 
@@ -35,138 +31,79 @@ def check_encrypted(message):
     return True
 
 
-class BeforeQueueHandler:
+class ExampleController(UnixSocketController):
-    def __init__(self):
+    def factory(self):
-        self.send_rate_limiter = SendRateLimiter()
+        return LMTP(self.handler, **self.SMTP_kwargs)
-
-    async def handle_MAIL(self, server, session, envelope, address, mail_options):
-        logging.info(f"handle_MAIL from {address}")
-        if self.send_rate_limiter.is_sending_allowed(address):
-            envelope.mail_from = address
-            return "250 OK"
-        return f"450 4.7.1: Too much mail from {address}"
-
-    async def handle_DATA(self, server, session, envelope):
-        logging.info("handle_DATA before-queue: re-injecting the mail")
-        client = SMTPClient("localhost", "10026")
-        client.sendmail(envelope.mail_from, envelope.rcpt_tos, envelope.content)
-        return "250 OK"
 
 
-class SendRateLimiter:
+class ExampleHandler:
-    MAX_USER_SEND_PER_MINUTE = 80
-
-    def __init__(self):
-        self.addr2timestamps = {}
-
-    def is_sending_allowed(self, mail_from):
-        last = self.addr2timestamps.setdefault(mail_from, [])
-        now = time.time()
-        last[:] = [ts for ts in last if ts >= (now - 60)]
-        if len(last) <= self.MAX_USER_SEND_PER_MINUTE:
-            last.append(now)
-            return True
-        return False
-
-
-class AfterQueueHandler:
     async def handle_RCPT(self, server, session, envelope, address, rcpt_options):
         envelope.rcpt_tos.append(address)
         return "250 OK"
 
     async def handle_DATA(self, server, session, envelope):
-        valid_recipients, res = lmtp_handle_DATA(envelope)
+        logging.info("Processing DATA message from %s", envelope.mail_from)
+
+        valid_recipients = []
+
+        message = BytesParser(policy=policy.default).parsebytes(envelope.content)
+        mail_encrypted = check_encrypted(message)
+
+        res = []
+        for recipient in envelope.rcpt_tos:
+            my_local_domain = envelope.mail_from.split("@")
+            if len(my_local_domain) != 2:
+                res += [f"500 Invalid from address <{envelope.mail_from}>"]
+                continue
+
+            if envelope.mail_from == recipient:
+                # Always allow sending emails to self.
+                valid_recipients += [recipient]
+                res += ["250 OK"]
+                continue
+
+            recipient_local_domain = recipient.split("@")
+            if len(recipient_local_domain) != 2:
+                res += [f"500 Invalid address <{recipient}>"]
+                continue
+
+            is_outgoing = recipient_local_domain[1] != my_local_domain[1]
+
+            if (
+                is_outgoing
+                and not mail_encrypted
+                and message.get("secure-join") != "vc-request"
+                and message.get("secure-join") != "vg-request"
+            ):
+                res += ["500 Outgoing mail must be encrypted"]
+                continue
+
+            valid_recipients += [recipient]
+            res += ["250 OK"]
+
         # Reinject the mail back into Postfix.
         if valid_recipients:
-            logging.info("afterqueue: re-injecting the mail")
+            logging.info("Reinjecting the mail")
-            client = SMTPClient("localhost", "10027")
+            client = SMTPClient("localhost", "10026")
             client.sendmail(envelope.mail_from, valid_recipients, envelope.content)
-        else:
-            logging.info("no valid recipients, ignoring mail")
 
         return "\r\n".join(res)
 
 
-def lmtp_handle_DATA(envelope):
+async def asyncmain(loop):
-    """the central filtering function for e-mails."""
+    controller = ExampleController(
-    logging.info(f"Processing DATA message from {envelope.mail_from}")
+        ExampleHandler(), unix_socket="/var/spool/postfix/private/filtermail"
-
+    )
-    message = BytesParser(policy=policy.default).parsebytes(envelope.content)
+    controller.start()
-    mail_encrypted = check_encrypted(message)
-
-    valid_recipients = []
-    res = []
-    for recipient in envelope.rcpt_tos:
-        my_local_domain = envelope.mail_from.split("@")
-        if len(my_local_domain) != 2:
-            res += [f"500 Invalid from address <{envelope.mail_from}>"]
-            continue
-
-        _, from_addr = parseaddr(message.get("from").strip())
-        logging.info(f"mime-from: {from_addr} envelope-from: {envelope.mail_from}")
-        if envelope.mail_from.lower() != from_addr.lower():
-            res += [f"500 Invalid FROM <{from_addr}> for <{envelope.mail_from}>"]
-            continue
-
-        if envelope.mail_from == recipient:
-            # Always allow sending emails to self.
-            valid_recipients += [recipient]
-            res += ["250 OK"]
-            continue
-
-        recipient_local_domain = recipient.split("@")
-        if len(recipient_local_domain) != 2:
-            res += [f"500 Invalid address <{recipient}>"]
-            continue
-
-        is_outgoing = recipient_local_domain[1] != my_local_domain[1]
-
-        if (
-            is_outgoing
-            and not mail_encrypted
-            and message.get("secure-join") != "vc-request"
-            and message.get("secure-join") != "vg-request"
-        ):
-            res += ["500 Outgoing mail must be encrypted"]
-            continue
-
-        valid_recipients += [recipient]
-        res += ["250 OK"]
-
-    assert len(envelope.rcpt_tos) == len(res)
-    assert len(valid_recipients) <= len(res)
-    return valid_recipients, res
-
-
-class UnixController(UnixSocketController):
-    def factory(self):
-        return LMTP(self.handler, **self.SMTP_kwargs)
-
-
-class SMTPController(Controller):
-    def factory(self):
-        return SMTP(self.handler, **self.SMTP_kwargs)
-
-
-async def asyncmain_afterqueue(loop, unix_socket_fn):
-    UnixController(AfterQueueHandler(), unix_socket=unix_socket_fn).start()
-
-
-async def asyncmain_beforequeue(loop, port):
-    Controller(BeforeQueueHandler(), hostname="127.0.0.1", port=port).start()
 
 
 def main():
-    args = sys.argv[1:]
-    assert len(args) == 2
     logging.basicConfig(level=logging.INFO)
     loop = asyncio.new_event_loop()
     asyncio.set_event_loop(loop)
-    if args[0] == "afterqueue":
+    loop.create_task(asyncmain(loop=loop))
-        task = asyncmain_afterqueue(loop, args[1])
-    elif args[0] == "beforequeue":
-        task = asyncmain_beforequeue(loop, port=int(args[1]))
-    else:
-        raise SystemExit(1)
-    loop.create_task(task)
     loop.run_forever()
+
+
+if __name__ == "__main__":
+    main()

chatmaild/src/chatmaild/filtermail.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=Email filter for chatmail servers
+
+[Service]
+ExecStart=/usr/local/bin/filtermail
+Restart=always
+RestartSec=30
+
+[Install]
+WantedBy=multi-user.target

chatmaild/src/chatmaild/test_filtermail.py

@@ -1,45 +1,6 @@
-from .filtermail import check_encrypted, lmtp_handle_DATA, SendRateLimiter
+from .filtermail import check_encrypted
 from email.parser import BytesParser
 from email import policy
-import pytest
-
-
-def test_reject_forged_from():
-    def makemail(from_addr):
-        return BytesParser(policy=policy.default).parsebytes(
-            "\r\n".join(
-                [
-                    f"From: <{from_addr}",
-                    "To: <barbaz@c3.testrun.org>",
-                    "Date: Sun, 15 Oct 2023 16:41:44 +0000",
-                    "Message-ID: <Mr.3gckbNy5bch.uK3Hd2Ws6-w@c2.testrun.org>",
-                    "References: <Mr.3gckbNy5bch.uK3Hd2Ws6-w@c2.testrun.org>",
-                    "Chat-Version: 1.0",
-                    "MIME-Version: 1.0",
-                    "Content-Type: text/plain; charset=utf-8; format=flowed; delsp=no",
-                    "",
-                    "Hi!",
-                    "",
-                    "",
-                ]
-            ).encode()
-        )
-
-    class envelope:
-        mail_from = "bob@c3.testrun.org"
-        rcpt_tos = ["somebody@c3.testrun.org"]
-
-    # test that the filter lets good mail through
-    envelope.content = makemail(envelope.mail_from).as_bytes()
-    valid_recipients, res = lmtp_handle_DATA(envelope=envelope)
-    assert valid_recipients == envelope.rcpt_tos
-    assert len(res) == 1 and "250" in res[0]
-
-    # test that the filter rejects forged mail
-    envelope.content = makemail("forged@c3.testrun.org").as_bytes()
-    valid_recipients, res = lmtp_handle_DATA(envelope=envelope)
-    assert not valid_recipients
-    assert len(res) == 1 and "500" in res[0]
 
 
 def test_filtermail():
@@ -327,15 +288,3 @@ def test_filtermail():
             ]
         ).encode()
     )
-
-
-def test_send_rate_limiter():
-    limiter = SendRateLimiter()
-    for i in range(100):
-        if limiter.is_sending_allowed("some@example.org"):
-            if i <= SendRateLimiter.MAX_USER_SEND_PER_MINUTE:
-                continue
-            pytest.fail("limiter didn't work")
-        else:
-            assert i == SendRateLimiter.MAX_USER_SEND_PER_MINUTE + 1
-            break

deploy-chatmail/src/deploy_chatmail/__init__.py

@@ -53,25 +53,24 @@ def _install_chatmaild() -> None:
             daemon_reload=True,
         )
 
-        for fn in ("filtermail-after", "filtermail-before"):
+        files.put(
-            files.put(
+            name="upload filtermail.service",
-                name=f"upload {fn}.service",
+            src=importlib.resources.files("chatmaild")
-                src=importlib.resources.files("chatmaild")
+            .joinpath("filtermail.service")
-                .joinpath(f"{fn}.service")
+            .open("rb"),
-                .open("rb"),
+            dest="/etc/systemd/system/filtermail.service",
-                dest=f"/etc/systemd/system/{fn}.service",
+            user="root",
-                user="root",
+            group="root",
-                group="root",
+            mode="644",
-                mode="644",
+        )
-            )
+        systemd.service(
-            systemd.service(
+            name="Setup filtermail service",
-                name=f"Setup {fn} service",
+            service="filtermail.service",
-                service=f"{fn}.service",
+            running=True,
-                running=True,
+            enabled=True,
-                enabled=True,
+            restarted=True,
-                restarted=True,
+            daemon_reload=True,
-                daemon_reload=True,
+        )
-            )
 
 
 def _configure_opendkim(domain: str, dkim_selector: str) -> bool:
@@ -174,33 +173,6 @@ def _configure_dovecot(mail_server: str, debug: bool = False) -> bool:
     return need_restart
 
 
-def _configure_nginx(domain: str, debug: bool = False) -> bool:
-    """Configures nginx HTTP server."""
-    need_restart = False
-
-    main_config = files.template(
-        src=importlib.resources.files(__package__).joinpath("nginx.conf.j2"),
-        dest="/etc/nginx/nginx.conf",
-        user="root",
-        group="root",
-        mode="644",
-        config={"domain_name": domain},
-    )
-    need_restart |= main_config.changed
-
-    autoconfig = files.template(
-        src=importlib.resources.files(__package__).joinpath("autoconfig.xml.j2"),
-        dest="/var/www/html/.well-known/autoconfig/mail/config-v1.1.xml",
-        user="root",
-        group="root",
-        mode="644",
-        config={"domain_name": domain},
-    )
-    need_restart |= autoconfig.changed
-
-    return need_restart
-
-
 def deploy_chatmail(mail_domain: str, mail_server: str, dkim_selector: str) -> None:
     """Deploy a chat-mail instance.
 
@@ -222,7 +194,7 @@ def deploy_chatmail(mail_domain: str, mail_server: str, dkim_selector: str) -> N
     )
 
     # Deploy acmetool to have TLS certificates.
-    deploy_acmetool(nginx_hook=True, domains=[mail_server])
+    deploy_acmetool(domains=[mail_server])
 
     apt.packages(
         name="Install Postfix",
@@ -242,17 +214,11 @@ def deploy_chatmail(mail_domain: str, mail_server: str, dkim_selector: str) -> N
         ],
     )
 
-    apt.packages(
-        name="Install nginx",
-        packages=["nginx"],
-    )
-
     _install_chatmaild()
     debug = False
     dovecot_need_restart = _configure_dovecot(mail_server, debug=debug)
     postfix_need_restart = _configure_postfix(mail_domain, debug=debug)
     opendkim_need_restart = _configure_opendkim(mail_domain, dkim_selector)
-    nginx_need_restart = _configure_nginx(mail_domain)
 
     systemd.service(
         name="Start and enable OpenDKIM",
@@ -278,21 +244,6 @@ def deploy_chatmail(mail_domain: str, mail_server: str, dkim_selector: str) -> N
         restarted=dovecot_need_restart,
     )
 
-    systemd.service(
-        name="Start and enable nginx",
-        service="nginx.service",
-        running=True,
-        enabled=True,
-        restarted=nginx_need_restart,
-    )
-
-    # This file is used by auth proxy.
-    # https://wiki.debian.org/EtcMailName
-    server.shell(
-        name="Setup /etc/mailname",
-        commands=[f"echo {mail_domain} >/etc/mailname; chmod 644 /etc/mailname"],
-    )
-
     def callback():
         result = server.shell(
             commands=[

deploy-chatmail/src/deploy_chatmail/acmetool/__init__.py

@@ -38,13 +38,22 @@ def deploy_acmetool(nginx_hook=False, email="", domains=[]):
         email=email,
     )
 
-    files.template(
+    service_file = files.put(
-        src=importlib.resources.files(__package__).joinpath("target.yaml.j2"),
+        src=importlib.resources.files(__package__)
-        dest="/var/lib/acme/conf/target",
+        .joinpath("acmetool-redirector.service")
+        .open("rb"),
+        dest="/etc/systemd/system/acmetool-redirector.service",
         user="root",
         group="root",
         mode="644",
     )
+    systemd.service(
+        name="Setup acmetool-redirector service",
+        service="acmetool-redirector.service",
+        running=False,
+        enabled=False,
+        restarted=service_file.changed,
+    )
 
     for domain in domains:
         server.shell(

deploy-chatmail/src/deploy_chatmail/acmetool/acmetool-redirector.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=acmetool HTTP redirector
+
+[Service]
+Type=notify
+ExecStart=/usr/bin/acmetool redirector --service.uid=daemon
+Restart=always
+RestartSec=30
+
+[Install]
+WantedBy=multi-user.target

deploy-chatmail/src/deploy_chatmail/acmetool/target.yaml.j2

@@ -1,7 +0,0 @@
-request:
-  provider: https://acme-v02.api.letsencrypt.org/directory
-  key:
-    type: rsa
-  challenge:
-    webroot-paths:
-    - /var/www/html/.well-known/acme-challenge

deploy-chatmail/src/deploy_chatmail/autoconfig.xml.j2

@@ -1,37 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-
-<clientConfig version="1.1">
-  <emailProvider id="{{ config.domain_name }}">
-    <domain>{{ config.domain_name }}</domain>
-    <displayName>{{ config.domain_name }} chatmail</displayName>
-    <displayShortName>{{ config.domain_name }}</displayShortName>
-    <incomingServer type="imap">
-      <hostname>{{ config.domain_name }}</hostname>
-      <port>993</port>
-      <socketType>SSL</socketType>
-      <authentication>password-cleartext</authentication>
-      <username>%EMAILADDRESS%</username>
-    </incomingServer>
-    <incomingServer type="imap">
-      <hostname>{{ config.domain_name }}</hostname>
-      <port>143</port>
-      <socketType>STARTTLS</socketType>
-      <authentication>password-cleartext</authentication>
-      <username>%EMAILADDRESS%</username>
-    </incomingServer>
-    <outgoingServer type="smtp">
-      <hostname>{{ config.domain_name }}</hostname>
-      <port>465</port>
-      <socketType>SSL</socketType>
-      <authentication>password-cleartext</authentication>
-      <username>%EMAILADDRESS%</username>
-    </outgoingServer>
-    <outgoingServer type="smtp">
-      <hostname>{{ config.domain_name }}</hostname>
-      <port>587</port>
-      <socketType>STARTTLS</socketType>
-      <authentication>password-cleartext</authentication>
-      <username>%EMAILADDRESS%</username>
-    </outgoingServer>
-  </emailProvider>
-</clientConfig>

deploy-chatmail/src/deploy_chatmail/nginx.conf.j2

@@ -1,47 +0,0 @@
-user www-data;
-worker_processes auto;
-pid /run/nginx.pid;
-error_log /var/log/nginx/error.log;
-
-events {
-	worker_connections 768;
-	# multi_accept on;
-}
-
-http {
-	sendfile on;
-	tcp_nopush on;
-
-	# Do not emit nginx version on error pages.
-	server_tokens off;
-
-	include /etc/nginx/mime.types;
-	default_type application/octet-stream;
-
-	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
-	ssl_prefer_server_ciphers on;
-	ssl_certificate /var/lib/acme/live/{{ config.domain_name }}/fullchain;
-	ssl_certificate_key /var/lib/acme/live/{{ config.domain_name }}/privkey;
-
-	gzip on;
-
-	server {
-		listen 80 default_server;
-		listen [::]:80 default_server;
-		listen 443 ssl default_server;
-		listen [::]:443 ssl default_server;
-
-		root /var/www/html;
-
-		index index.html index.htm;
-
-		server_name _;
-
-		location / {
-			# First attempt to serve request as file, then
-			# as directory, then fall back to displaying a 404.
-			try_files $uri $uri/ =404;
-		}
-	}
-}
-

deploy-chatmail/src/deploy_chatmail/postfix/main.cf.j2

@@ -29,6 +29,9 @@ myhostname = {{ config.domain_name }}
 alias_maps = hash:/etc/aliases
 alias_database = hash:/etc/aliases
 
+# hard limit, also on internal messages
+smtpd_client_message_rate_limit = 80
+
 # Postfix does not deliver mail for any domain by itself.
 # Primary domain is listed in `virtual_mailbox_domains` instead
 # and handed over to Dovecot.

deploy-chatmail/src/deploy_chatmail/postfix/master.cf.j2

@@ -32,8 +32,7 @@ submission inet n       -       y       -       -       smtpd
   -o smtpd_recipient_restrictions=
   -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
   -o milter_macro_daemon_name=ORIGINATING
-  -o smtpd_proxy_filter=127.0.0.1:10080
+  -o content_filter=filter:unix:private/filtermail
-  -o content_filter=filter:unix:private/filtermail-afterqueue
 smtps     inet  n       -       y       -       -       smtpd
   -o syslog_name=postfix/smtps
   -o smtpd_tls_wrappermode=yes
@@ -48,7 +47,7 @@ smtps     inet  n       -       y       -       -       smtpd
   -o smtpd_recipient_restrictions=
   -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
   -o milter_macro_daemon_name=ORIGINATING
-  -o smtpd_proxy_filter=127.0.0.1:10080
+  -o content_filter=filter:unix:private/filtermail
 #628       inet  n       -       y       -       -       qmqpd
 pickup    unix  n       -       y       60      1       pickup
 cleanup   unix  n       -       y       -       0       cleanup
@@ -78,6 +77,4 @@ postlog   unix-dgram n  -       n       -       1       postlogd
 filter    unix -        n       n       -       -       lmtp
 # Local SMTP server for reinjecting filered mail.
 localhost:10026 inet  n       -       n       -       10      smtpd
-        -o content_filter=filter:unix:private/filtermail-afterqueue
-localhost:10027 inet  n       -       n       -       10      smtpd
         -o content_filter=

online-tests/conftest.py

@@ -75,24 +75,6 @@ class ImapConn:
         print(f"imap-login {user!r} {password!r}")
         self.conn.login(user, password)
 
-    def fetch_all(self):
-        print("imap-fetch all")
-        status, res = self.conn.select()
-        if int(res[0]) == 0:
-            raise ValueError("no messages in imap folder")
-        status, results = self.conn.fetch("1:*", "(RFC822)")
-        assert status == "OK"
-        return results
-
-    def fetch_all_messages(self):
-        print("imap-fetch all messages")
-        results = self.fetch_all()
-        messages = []
-        for item in results:
-            if len(item) == 2:
-                messages.append(item[1].decode())
-        return messages
-
 
 @pytest.fixture
 def smtp(maildomain):
@@ -115,11 +97,6 @@ class SmtpConn:
         print(f"smtp-login {user!r} {password!r}")
         self.conn.login(user, password)
 
-    def sendmail(self, from_addr, to_addrs, msg):
-        print(f"smtp-sendmail from={from_addr!r} to_addrs={to_addrs!r}")
-        print(f"smtp-sendmail message size: {len(msg)}")
-        return self.conn.sendmail(from_addr=from_addr, to_addrs=to_addrs, msg=msg)
-
 
 @pytest.fixture(params=["imap", "smtp"])
 def imap_or_smtp(request):
@@ -221,66 +198,4 @@ class Remote:
         )
         while 1:
             line = self.popen.stdout.readline()
-            res = line.decode().strip().lower()
+            yield line.decode().strip().lower()
-            if res:
-                yield res
-            else:
-                break
-
-
-@pytest.fixture
-def mailgen(request):
-    class Mailgen:
-        def get_encrypted(self, from_addr, to_addr):
-            data = request.fspath.dirpath("mailgen/encrypted.eml").read()
-            return data.format(from_addr=from_addr, to_addr=to_addr)
-
-    return Mailgen()
-
-
-@pytest.fixture
-def cmsetup(maildomain, gencreds):
-    return CMSetup(maildomain, gencreds)
-
-
-class CMSetup:
-    def __init__(self, maildomain, gencreds):
-        self.maildomain = maildomain
-        self.gencreds = gencreds
-
-    def gen_users(self, num):
-        print(f"Creating {num} online users")
-        users = []
-        for i in range(num):
-            addr, password = self.gencreds()
-            user = CMUser(self.maildomain, addr, password)
-            assert user.smtp
-            users.append(user)
-        return users
-
-
-class CMUser:
-    def __init__(self, maildomain, addr, password):
-        self.maildomain = maildomain
-        self.addr = addr
-        self.password = password
-        self._smtp = None
-        self._imap = None
-
-    @property
-    def smtp(self):
-        if not self._smtp:
-            handle = SmtpConn(self.maildomain)
-            handle.connect()
-            handle.login(self.addr, self.password)
-            self._smtp = handle
-        return self._smtp
-
-    @property
-    def imap(self):
-        if not self._imap:
-            imap = ImapConn(self.maildomain)
-            imap.connect()
-            imap.login(self.addr, self.password)
-            self._imap = imap
-        return self._imap

online-tests/mailgen/encrypted.eml

@@ -1,66 +0,0 @@
-From: {from_addr}
-To: {to_addr}
-Subject: ...
-Date: Sun, 15 Oct 2023 16:43:21 +0000
-Message-ID: <Mr.UVyJWZmkCKM.hGzNc6glBE_@c2.testrun.org>
-In-Reply-To: <Mr.MvmCz-GQbi_.6FGRkhDf05c@c2.testrun.org>
-References: <Mr.3gckbNy5bch.uK3Hd2Ws6-w@c2.testrun.org>
-	<Mr.MvmCz-GQbi_.6FGRkhDf05c@c2.testrun.org>
-Chat-Version: 1.0
-Autocrypt: addr={from_addr}; prefer-encrypt=mutual;
-	keydata=xjMEZSwWjhYJKwYBBAHaRw8BAQdAQBEhqeJh0GueHB6kF/DUQqYCxARNBVokg/AzT+7LqH
-	rNFzxiYXJiYXpAYzIudGVzdHJ1bi5vcmc+wosEEBYIADMCGQEFAmUsFo4CGwMECwkIBwYVCAkKCwID
-	FgIBFiEEFTfUNvVnY3b9F7yHnmme1PfUhX8ACgkQnmme1PfUhX9A4AEAnHWHp49eBCMHK5t66gYPiW
-	XQuB1mwUjzGfYWB+0RXUoA/0xcQ3FbUNlGKW7Blp6eMFfViv6Mv2d3kNSXACB6nmcMzjgEZSwWjhIK
-	KwYBBAGXVQEFAQEHQBpY5L2M1XHo0uxf8SX1wNLBp/OVvidoWHQF2Jz+kJsUAwEIB8J4BBgWCAAgBQ
-	JlLBaOAhsMFiEEFTfUNvVnY3b9F7yHnmme1PfUhX8ACgkQnmme1PfUhX/INgEA37AJaNvruYsJVanP
-	IXnYw4CKd55UAwl8Zcy+M2diAbkA/0fHHcGV4r78hpbbL1Os52DPOdqYQRauIeJUeG+G6bQO
-MIME-Version: 1.0
-Content-Type: multipart/encrypted; protocol="application/pgp-encrypted";
-	boundary="YFrteb74qSXmggbOxZL9dRnhymywAi"
-
-
---YFrteb74qSXmggbOxZL9dRnhymywAi
-Content-Description: PGP/MIME version identification
-Content-Type: application/pgp-encrypted
-
-Version: 1
-
-
---YFrteb74qSXmggbOxZL9dRnhymywAi
-Content-Description: OpenPGP encrypted message
-Content-Disposition: inline; filename="encrypted.asc";
-Content-Type: application/octet-stream; name="encrypted.asc"
-
------BEGIN PGP MESSAGE-----
-
-wU4DhW3gBZ/VvCYSAQdA8bMs2spwbKdGjVsL1ByPkNrqD7frpB73maeL6I6SzDYg
-O5G53tv339RdKq3WRcCtEEvxjHlUx2XNwXzC04BpmfvBTgNfPUyLDzjXnxIBB0Ae
-8ymwGvXMCCimHXN0Dg8Ui62KOi03h0UgheoHWovJSCDF4CKre/xtFr3nL7lq/PKI
-JsjVNz7/RK9FSXF6WwfONtLCyQGEuVAsB/KXfCBEyfKhaMwGHvhujRidGW5uV1no
-lMGl3ODmo29Lgeu2uSE7EpJRZoe6hU6ddmBkqxax61ZtkaFlGFFpdo2K8balNNdz
-ZsJ/9mmI9x3oOJ4/l1nhQbUO9ADbs7gJhFdV5Qkp30b5fCI7bU+aoe1ccBbLe/WM
-YUty1PqcuQT7XjA+XmYuL261tvW8pBetT+i33/E2d8PzzYt2IuK9qeevyS+yxdwA
-kfwejFWzzsUlJaDxs1x4XOxkMgSj+jo+g12dFOb7fyClsAnq23iDb8AuaT/BScAI
-+lO+gher69+6LmM7VGHLG5k762J1jTaQCaKt1s8TAWV99Eo4491vL6fyvk3l/Cfg
-RXSwiWFgj19Pn0Rq7CD9v22UE2vdUMBTcV4aw79mClk1YQ23jbF0y5DCjPdJ62Zo
-tskBgFt3NoWV80jZ76zIBLrrjLwCCll8JjJtFwSkt2GX5RFBsVa4A8IDht9RtEk7
-rrHgbSZQfkauEi/mH3/6CDZoLqSHudUZ7d4MaJwun1TkFYGe2ORwGJd4OBj3oGJp
-H8YBwCpk///L/fKjX0Gg3M8nrpM4wrRFhPKidAgO/kcm25X4+ZHlVkWBTCt5RWKI
-fHh6oLDZCqCfcgMkE1KKmwfIHaUkhq5BPRigwy6i5dh1DM4+1UCLh3dxzVbqE9b9
-61NB19nXdRtDA2sOUnj9ve6m/wEPyCb6/zBQZqvCBYb1/AjdXpUrFT+DbpfyxaXN
-XfhDVb5mNqNM/IVj0V5fvTc6vOfYbzQtPm10H+FdWWfb+rJRfyC3MA2w2IqstFe3
-w3bu2iE6CQvSqRvge+ZqLKt/NqYwOURiUmpuklbl3kPJ97+mfKWoiqk8Iz1VY+bb
-NMUC7aoGv+jcoj+WS6PYO8N6BeRVUUB3ZJSf8nzjgxm1/BcM+UD3BPrlhT11ODRs
-baifGbprMWwt3dhb8cQgRT8GPdpO1OsDkzL6iikMjLHWWiA99GV6ruiHsIPw6boW
-A6/uSOskbDHOROotKmddGTBd0iiHXAoQsJFt1ZjUkt6EHrgWs+GAvrvKpXs1mrz8
-uj3GwEFrHS+Xuf2UDgpszYT3hI2cL/kUtGakVR7m7vVMZqXBUbZdGAEb1PZNPwsI
-E4aMK02+EVB+tSN4Fzj99N2YD0inVYt+oPjr2tHhUS6aSGBNS/48Ki47DOg4Sxkn
-lkOWnEbCD+XTnbDd
-=agR5
------END PGP MESSAGE-----
-
-
---YFrteb74qSXmggbOxZL9dRnhymywAi--
-
-

online-tests/test_0_basic.py

@@ -1,7 +1,3 @@
-import smtplib
-import pytest
-
-
 def test_remote(remote, imap_or_smtp):
     lineproducer = remote.iter_output(imap_or_smtp.logcmd)
     imap_or_smtp.connect()
@@ -17,36 +13,3 @@ def test_use_two_chatmailservers(cmfactory, maildomain2):
     domain1 = ac1.get_config("addr").split("@")[1]
     domain2 = ac2.get_config("addr").split("@")[1]
     assert domain1 != domain2
-
-
-@pytest.mark.parametrize("forgeaddr", ["internal", "someone@example.org"])
-def test_reject_forged_from(cmsetup, mailgen, lp, remote, forgeaddr):
-    user1, user3 = cmsetup.gen_users(2)
-
-    lp.sec("send encrypted message with forged from")
-    print("envelope_from", user1.addr)
-    if forgeaddr == "internal":
-        addr_to_forge = cmsetup.gen_users(1)[0].addr
-    else:
-        addr_to_forge = "someone@example.org"
-
-    print("message to inject:")
-    msg = mailgen.get_encrypted(from_addr=addr_to_forge, to_addr=user3.addr)
-    for line in msg.split("\n")[:4]:
-        print(f"   {line}")
-
-    lp.sec("Send forged mail and check remote postfix lmtp processing result")
-    remote_log = remote.iter_output("journalctl -t postfix/lmtp")
-    user1.smtp.sendmail(from_addr=user1.addr, to_addrs=[user3.addr], msg=msg)
-    for line in remote_log:
-        # print(line)
-        if "500 invalid from" in line and user3.addr in line:
-            break
-    else:
-        pytest.fail("remote postfix/filtermail failed to reject message")
-
-    # check that the logged in user (who sent the forged msg) got a non-delivery notice
-    for message in user1.imap.fetch_all_messages():
-        if "Invalid FROM" in message and addr_to_forge in message:
-            return
-    pytest.fail(f"forged From={addr_to_forge} did not cause non-delivery notice")

online-tests/test_0_login.py

@@ -37,20 +37,176 @@ def test_login_same_password(imap_or_smtp, gencreds):
     imap_or_smtp.login(user2, password1)
 
 
-@pytest.mark.slow
+@pytest.mark.xfail(reason="Only rate limit is internal as well now")
-def test_exceed_rate_limit(cmsetup, gencreds, mailgen):
+def test_no_internal_rate_limit(smtp, gencreds):
-    """Test that the per-account send-mail limit is exceeded."""
+    """Test that there is no rate limit between accounts on the same chatmail server."""
-    user1, user2 = cmsetup.gen_users(2)
+    user, password = gencreds()
-    mail = mailgen.get_encrypted(user1.addr, user2.addr)
+    to_addr, = gencreds()
+    smtp.connect()
+    smtp.login(user, password)
+
+    mail = "\r\n".join(
+        [
+            "Subject: ...",
+            f"From: <{user}>",
+            f"To: <{to_addr}>",
+            "Date: Sun, 15 Oct 2023 16:43:21 +0000",
+            "Message-ID: <Mr.UVyJWZmkCKM.hGzNc6glBE_@c2.testrun.org>",
+            "In-Reply-To: <Mr.MvmCz-GQbi_.6FGRkhDf05c@c2.testrun.org>",
+            "References: <Mr.3gckbNy5bch.uK3Hd2Ws6-w@c2.testrun.org>",
+            "\t<Mr.MvmCz-GQbi_.6FGRkhDf05c@c2.testrun.org>",
+            "Chat-Version: 1.0",
+            f"Autocrypt: addr={user}; prefer-encrypt=mutual;",
+            "\tkeydata=xjMEZSwWjhYJKwYBBAHaRw8BAQdAQBEhqeJh0GueHB6kF/DUQqYCxARNBVokg/AzT+7LqH",
+            "\trNFzxiYXJiYXpAYzIudGVzdHJ1bi5vcmc+wosEEBYIADMCGQEFAmUsFo4CGwMECwkIBwYVCAkKCwID",
+            "\tFgIBFiEEFTfUNvVnY3b9F7yHnmme1PfUhX8ACgkQnmme1PfUhX9A4AEAnHWHp49eBCMHK5t66gYPiW",
+            "\tXQuB1mwUjzGfYWB+0RXUoA/0xcQ3FbUNlGKW7Blp6eMFfViv6Mv2d3kNSXACB6nmcMzjgEZSwWjhIK",
+            "\tKwYBBAGXVQEFAQEHQBpY5L2M1XHo0uxf8SX1wNLBp/OVvidoWHQF2Jz+kJsUAwEIB8J4BBgWCAAgBQ",
+            "\tJlLBaOAhsMFiEEFTfUNvVnY3b9F7yHnmme1PfUhX8ACgkQnmme1PfUhX/INgEA37AJaNvruYsJVanP",
+            "\tIXnYw4CKd55UAwl8Zcy+M2diAbkA/0fHHcGV4r78hpbbL1Os52DPOdqYQRauIeJUeG+G6bQO",
+            "MIME-Version: 1.0",
+            'Content-Type: multipart/encrypted; protocol="application/pgp-encrypted";',
+            '\tboundary="YFrteb74qSXmggbOxZL9dRnhymywAi"',
+            "",
+            "",
+            "--YFrteb74qSXmggbOxZL9dRnhymywAi",
+            "Content-Description: PGP/MIME version identification",
+            "Content-Type: application/pgp-encrypted",
+            "",
+            "Version: 1",
+            "",
+            "",
+            "--YFrteb74qSXmggbOxZL9dRnhymywAi",
+            "Content-Description: OpenPGP encrypted message",
+            'Content-Disposition: inline; filename="encrypted.asc";',
+            'Content-Type: application/octet-stream; name="encrypted.asc"',
+            "",
+            "-----BEGIN PGP MESSAGE-----",
+            "",
+            "wU4DhW3gBZ/VvCYSAQdA8bMs2spwbKdGjVsL1ByPkNrqD7frpB73maeL6I6SzDYg",
+            "O5G53tv339RdKq3WRcCtEEvxjHlUx2XNwXzC04BpmfvBTgNfPUyLDzjXnxIBB0Ae",
+            "8ymwGvXMCCimHXN0Dg8Ui62KOi03h0UgheoHWovJSCDF4CKre/xtFr3nL7lq/PKI",
+            "JsjVNz7/RK9FSXF6WwfONtLCyQGEuVAsB/KXfCBEyfKhaMwGHvhujRidGW5uV1no",
+            "lMGl3ODmo29Lgeu2uSE7EpJRZoe6hU6ddmBkqxax61ZtkaFlGFFpdo2K8balNNdz",
+            "ZsJ/9mmI9x3oOJ4/l1nhQbUO9ADbs7gJhFdV5Qkp30b5fCI7bU+aoe1ccBbLe/WM",
+            "YUty1PqcuQT7XjA+XmYuL261tvW8pBetT+i33/E2d8PzzYt2IuK9qeevyS+yxdwA",
+            "kfwejFWzzsUlJaDxs1x4XOxkMgSj+jo+g12dFOb7fyClsAnq23iDb8AuaT/BScAI",
+            "+lO+gher69+6LmM7VGHLG5k762J1jTaQCaKt1s8TAWV99Eo4491vL6fyvk3l/Cfg",
+            "RXSwiWFgj19Pn0Rq7CD9v22UE2vdUMBTcV4aw79mClk1YQ23jbF0y5DCjPdJ62Zo",
+            "tskBgFt3NoWV80jZ76zIBLrrjLwCCll8JjJtFwSkt2GX5RFBsVa4A8IDht9RtEk7",
+            "rrHgbSZQfkauEi/mH3/6CDZoLqSHudUZ7d4MaJwun1TkFYGe2ORwGJd4OBj3oGJp",
+            "H8YBwCpk///L/fKjX0Gg3M8nrpM4wrRFhPKidAgO/kcm25X4+ZHlVkWBTCt5RWKI",
+            "fHh6oLDZCqCfcgMkE1KKmwfIHaUkhq5BPRigwy6i5dh1DM4+1UCLh3dxzVbqE9b9",
+            "61NB19nXdRtDA2sOUnj9ve6m/wEPyCb6/zBQZqvCBYb1/AjdXpUrFT+DbpfyxaXN",
+            "XfhDVb5mNqNM/IVj0V5fvTc6vOfYbzQtPm10H+FdWWfb+rJRfyC3MA2w2IqstFe3",
+            "w3bu2iE6CQvSqRvge+ZqLKt/NqYwOURiUmpuklbl3kPJ97+mfKWoiqk8Iz1VY+bb",
+            "NMUC7aoGv+jcoj+WS6PYO8N6BeRVUUB3ZJSf8nzjgxm1/BcM+UD3BPrlhT11ODRs",
+            "baifGbprMWwt3dhb8cQgRT8GPdpO1OsDkzL6iikMjLHWWiA99GV6ruiHsIPw6boW",
+            "A6/uSOskbDHOROotKmddGTBd0iiHXAoQsJFt1ZjUkt6EHrgWs+GAvrvKpXs1mrz8",
+            "uj3GwEFrHS+Xuf2UDgpszYT3hI2cL/kUtGakVR7m7vVMZqXBUbZdGAEb1PZNPwsI",
+            "E4aMK02+EVB+tSN4Fzj99N2YD0inVYt+oPjr2tHhUS6aSGBNS/48Ki47DOg4Sxkn",
+            "lkOWnEbCD+XTnbDd",
+            "=agR5",
+            "-----END PGP MESSAGE-----",
+            "",
+            "",
+            "--YFrteb74qSXmggbOxZL9dRnhymywAi--",
+            "",
+            "",
+        ]
+    ).encode()
+    for i in range(100):
+        print("Sending mail", str(i))
+        smtp.conn.sendmail(user, to_addr, mail)
+
+
+def test_exceed_rate_limit(smtp, gencreds):
+    """Test that the outbound rate limit is exceeded if we send a lot of messages at once."""
+    user, password = gencreds()
+    smtp.connect()
+    smtp.login(user, password)
+
+    to_addr = "foobar@example.org"
+    mail = "\r\n".join(
+        [
+            "Subject: ...",
+            f"From: <{user}>",
+            f"To: <{to_addr}>",
+            "Date: Sun, 15 Oct 2023 16:43:21 +0000",
+            "Message-ID: <Mr.UVyJWZmkCKM.hGzNc6glBE_@c2.testrun.org>",
+            "In-Reply-To: <Mr.MvmCz-GQbi_.6FGRkhDf05c@c2.testrun.org>",
+            "References: <Mr.3gckbNy5bch.uK3Hd2Ws6-w@c2.testrun.org>",
+            "\t<Mr.MvmCz-GQbi_.6FGRkhDf05c@c2.testrun.org>",
+            "Chat-Version: 1.0",
+            f"Autocrypt: addr={user}; prefer-encrypt=mutual;",
+            "\tkeydata=xjMEZSwWjhYJKwYBBAHaRw8BAQdAQBEhqeJh0GueHB6kF/DUQqYCxARNBVokg/AzT+7LqH",
+            "\trNFzxiYXJiYXpAYzIudGVzdHJ1bi5vcmc+wosEEBYIADMCGQEFAmUsFo4CGwMECwkIBwYVCAkKCwID",
+            "\tFgIBFiEEFTfUNvVnY3b9F7yHnmme1PfUhX8ACgkQnmme1PfUhX9A4AEAnHWHp49eBCMHK5t66gYPiW",
+            "\tXQuB1mwUjzGfYWB+0RXUoA/0xcQ3FbUNlGKW7Blp6eMFfViv6Mv2d3kNSXACB6nmcMzjgEZSwWjhIK",
+            "\tKwYBBAGXVQEFAQEHQBpY5L2M1XHo0uxf8SX1wNLBp/OVvidoWHQF2Jz+kJsUAwEIB8J4BBgWCAAgBQ",
+            "\tJlLBaOAhsMFiEEFTfUNvVnY3b9F7yHnmme1PfUhX8ACgkQnmme1PfUhX/INgEA37AJaNvruYsJVanP",
+            "\tIXnYw4CKd55UAwl8Zcy+M2diAbkA/0fHHcGV4r78hpbbL1Os52DPOdqYQRauIeJUeG+G6bQO",
+            "MIME-Version: 1.0",
+            'Content-Type: multipart/encrypted; protocol="application/pgp-encrypted";',
+            '\tboundary="YFrteb74qSXmggbOxZL9dRnhymywAi"',
+            "",
+            "",
+            "--YFrteb74qSXmggbOxZL9dRnhymywAi",
+            "Content-Description: PGP/MIME version identification",
+            "Content-Type: application/pgp-encrypted",
+            "",
+            "Version: 1",
+            "",
+            "",
+            "--YFrteb74qSXmggbOxZL9dRnhymywAi",
+            "Content-Description: OpenPGP encrypted message",
+            'Content-Disposition: inline; filename="encrypted.asc";',
+            'Content-Type: application/octet-stream; name="encrypted.asc"',
+            "",
+            "-----BEGIN PGP MESSAGE-----",
+            "",
+            "wU4DhW3gBZ/VvCYSAQdA8bMs2spwbKdGjVsL1ByPkNrqD7frpB73maeL6I6SzDYg",
+            "O5G53tv339RdKq3WRcCtEEvxjHlUx2XNwXzC04BpmfvBTgNfPUyLDzjXnxIBB0Ae",
+            "8ymwGvXMCCimHXN0Dg8Ui62KOi03h0UgheoHWovJSCDF4CKre/xtFr3nL7lq/PKI",
+            "JsjVNz7/RK9FSXF6WwfONtLCyQGEuVAsB/KXfCBEyfKhaMwGHvhujRidGW5uV1no",
+            "lMGl3ODmo29Lgeu2uSE7EpJRZoe6hU6ddmBkqxax61ZtkaFlGFFpdo2K8balNNdz",
+            "ZsJ/9mmI9x3oOJ4/l1nhQbUO9ADbs7gJhFdV5Qkp30b5fCI7bU+aoe1ccBbLe/WM",
+            "YUty1PqcuQT7XjA+XmYuL261tvW8pBetT+i33/E2d8PzzYt2IuK9qeevyS+yxdwA",
+            "kfwejFWzzsUlJaDxs1x4XOxkMgSj+jo+g12dFOb7fyClsAnq23iDb8AuaT/BScAI",
+            "+lO+gher69+6LmM7VGHLG5k762J1jTaQCaKt1s8TAWV99Eo4491vL6fyvk3l/Cfg",
+            "RXSwiWFgj19Pn0Rq7CD9v22UE2vdUMBTcV4aw79mClk1YQ23jbF0y5DCjPdJ62Zo",
+            "tskBgFt3NoWV80jZ76zIBLrrjLwCCll8JjJtFwSkt2GX5RFBsVa4A8IDht9RtEk7",
+            "rrHgbSZQfkauEi/mH3/6CDZoLqSHudUZ7d4MaJwun1TkFYGe2ORwGJd4OBj3oGJp",
+            "H8YBwCpk///L/fKjX0Gg3M8nrpM4wrRFhPKidAgO/kcm25X4+ZHlVkWBTCt5RWKI",
+            "fHh6oLDZCqCfcgMkE1KKmwfIHaUkhq5BPRigwy6i5dh1DM4+1UCLh3dxzVbqE9b9",
+            "61NB19nXdRtDA2sOUnj9ve6m/wEPyCb6/zBQZqvCBYb1/AjdXpUrFT+DbpfyxaXN",
+            "XfhDVb5mNqNM/IVj0V5fvTc6vOfYbzQtPm10H+FdWWfb+rJRfyC3MA2w2IqstFe3",
+            "w3bu2iE6CQvSqRvge+ZqLKt/NqYwOURiUmpuklbl3kPJ97+mfKWoiqk8Iz1VY+bb",
+            "NMUC7aoGv+jcoj+WS6PYO8N6BeRVUUB3ZJSf8nzjgxm1/BcM+UD3BPrlhT11ODRs",
+            "baifGbprMWwt3dhb8cQgRT8GPdpO1OsDkzL6iikMjLHWWiA99GV6ruiHsIPw6boW",
+            "A6/uSOskbDHOROotKmddGTBd0iiHXAoQsJFt1ZjUkt6EHrgWs+GAvrvKpXs1mrz8",
+            "uj3GwEFrHS+Xuf2UDgpszYT3hI2cL/kUtGakVR7m7vVMZqXBUbZdGAEb1PZNPwsI",
+            "E4aMK02+EVB+tSN4Fzj99N2YD0inVYt+oPjr2tHhUS6aSGBNS/48Ki47DOg4Sxkn",
+            "lkOWnEbCD+XTnbDd",
+            "=agR5",
+            "-----END PGP MESSAGE-----",
+            "",
+            "",
+            "--YFrteb74qSXmggbOxZL9dRnhymywAi--",
+            "",
+            "",
+        ]
+    ).encode()
     for i in range(100):
         print("Sending mail", str(i))
         try:
-            user1.smtp.sendmail(user1.addr, [user2.addr], mail)
+            smtp.conn.sendmail(user, to_addr, mail)
-        except smtplib.SMTPException as e:
+        except smtplib.SMTPSenderRefused as e:
-            if i < 80:
+            if i == 0:
+                pytest.fail(f"rate limit was exceeded too early with msg {i} - maybe wait a minute before testing?")
+            if i < 41:
                 pytest.fail(f"rate limit was exceeded too early with msg {i}")
-            outcome = e.recipients[user2.addr]
+            assert e.smtp_code == 450
-            assert outcome[0] == 450
+            assert b'4.7.1 Error: too much mail from' in e.smtp_error
-            assert b'4.7.1: Too much mail from' in outcome[1]
             return
     pytest.fail("Rate limit was not exceeded")