1package mox

3import (

4 "bytes"

5 "context"

6 "crypto"

7 "crypto/ecdsa"

8 "crypto/ed25519"

9 "crypto/elliptic"

10 cryptorand "crypto/rand"

11 "crypto/rsa"

12 "crypto/tls"

13 "crypto/x509"

14 "encoding/base64"

15 "encoding/pem"

16 "errors"

17 "fmt"

18 "io"

19 "log/slog"

20 "net"

21 "net/http"

22 "net/url"

23 "os"

24 "os/user"

25 "path/filepath"

26 "regexp"

27 "slices"

28 "strconv"

29 "strings"

30 "sync"

31 "time"

33 "golang.org/x/text/unicode/norm"

35 "github.com/mjl-/autocert"

37 "github.com/mjl-/sconf"

39 "github.com/mjl-/mox/autotls"

40 "github.com/mjl-/mox/config"

41 "github.com/mjl-/mox/dkim"

42 "github.com/mjl-/mox/dns"

43 "github.com/mjl-/mox/message"

44 "github.com/mjl-/mox/mlog"

45 "github.com/mjl-/mox/moxio"

46 "github.com/mjl-/mox/mtasts"

47 "github.com/mjl-/mox/smtp"

48)

50var pkglog = mlog.New("mox", nil)

52// Pedantic enables stricter parsing.

53var Pedantic bool

55// Config paths are set early in program startup. They will point to files in

56// the same directory.

57var (

58 ConfigStaticPath string

59 ConfigDynamicPath string

60 Conf = Config{Log: map[string]slog.Level{"": slog.LevelError}}

61)

63var ErrConfig = errors.New("config error")

65// Set by packages webadmin, webaccount, webmail, webapisrv to prevent cyclic dependencies.

66var NewWebadminHandler = func(basePath string, isForwarded bool) http.Handler { return nopHandler }

67var NewWebaccountHandler = func(basePath string, isForwarded bool) http.Handler { return nopHandler }

68var NewWebmailHandler = func(maxMsgSize int64, basePath string, isForwarded bool, accountPath string) http.Handler {

69 return nopHandler

70}

71var NewWebapiHandler = func(maxMsgSize int64, basePath string, isForwarded bool) http.Handler { return nopHandler }

73var nopHandler = http.HandlerFunc(nil)

75// Config as used in the code, a processed version of what is in the config file.

76//

77// Use methods to lookup a domain/account/address in the dynamic configuration.

78type Config struct {

79 Static config.Static // Does not change during the lifetime of a running instance.

81 logMutex sync.Mutex // For accessing the log levels.

82 Log map[string]slog.Level

84 dynamicMutex sync.Mutex

85 Dynamic config.Dynamic // Can only be accessed directly by tests. Use methods on Config for locked access.

86 dynamicMtime time.Time

87 DynamicLastCheck time.Time // For use by quickstart only to skip checks.

89 // From canonical full address (localpart@domain, lower-cased when

90 // case-insensitive, stripped of catchall separator) to account and address.

91 // Domains are IDNA names in utf8. Dynamic config lock must be held when accessing.

92 AccountDestinationsLocked map[string]AccountDestination

94 // Like AccountDestinationsLocked, but for aliases.

95 aliases map[string]config.Alias

96}

98type AccountDestination struct {

99 Catchall bool // If catchall destination for its domain.

100 Localpart smtp.Localpart // In original casing as written in config file.

101 Account string

102 Destination config.Destination

103}

104

105// LogLevelSet sets a new log level for pkg. An empty pkg sets the default log

106// value that is used if no explicit log level is configured for a package.

107// This change is ephemeral, no config file is changed.

108func (c *Config) LogLevelSet(log mlog.Log, pkg string, level slog.Level) {

109 c.logMutex.Lock()

110 defer c.logMutex.Unlock()

111 l := c.copyLogLevels()

112 l[pkg] = level

113 c.Log = l

114 log.Print("log level changed", slog.String("pkg", pkg), slog.Any("level", mlog.LevelStrings[level]))

115 mlog.SetConfig(c.Log)

116}

117

118// LogLevelRemove removes a configured log level for a package.

119func (c *Config) LogLevelRemove(log mlog.Log, pkg string) {

120 c.logMutex.Lock()

121 defer c.logMutex.Unlock()

122 l := c.copyLogLevels()

123 delete(l, pkg)

124 c.Log = l

125 log.Print("log level cleared", slog.String("pkg", pkg))

126 mlog.SetConfig(c.Log)

127}

128

129// copyLogLevels returns a copy of c.Log, for modifications.

130// must be called with log lock held.

131func (c *Config) copyLogLevels() map[string]slog.Level {

132 m := map[string]slog.Level{}

133 for pkg, level := range c.Log {

134 m[pkg] = level

135 }

136 return m

137}

138

139// LogLevels returns a copy of the current log levels.

140func (c *Config) LogLevels() map[string]slog.Level {

141 c.logMutex.Lock()

142 defer c.logMutex.Unlock()

143 return c.copyLogLevels()

144}

145

146// DynamicLockUnlock locks the dynamic config, will try updating the latest state

147// from disk, and return an unlock function. Should be called as "defer

148// Conf.DynamicLockUnlock()()".

149func (c *Config) DynamicLockUnlock() func() {

150 c.dynamicMutex.Lock()

151 now := time.Now()

152 if now.Sub(c.DynamicLastCheck) > time.Second {

153 c.DynamicLastCheck = now

154 if fi, err := os.Stat(ConfigDynamicPath); err != nil {

155 pkglog.Errorx("stat domains config", err)

156 } else if !fi.ModTime().Equal(c.dynamicMtime) {

157 if errs := c.loadDynamic(); len(errs) > 0 {

158 pkglog.Errorx("loading domains config", errs[0], slog.Any("errors", errs))

159 } else {

160 pkglog.Info("domains config reloaded")

161 c.dynamicMtime = fi.ModTime()

162 }

163 }

164 }

165 return c.dynamicMutex.Unlock

166}

167

168func (c *Config) withDynamicLock(fn func()) {

169 defer c.DynamicLockUnlock()()

170 fn()

171}

172

173// must be called with dynamic lock held.

174func (c *Config) loadDynamic() []error {

175 d, mtime, accDests, aliases, err := ParseDynamicConfig(context.Background(), pkglog, ConfigDynamicPath, c.Static)

176 if err != nil {

177 return err

178 }

179 c.Dynamic = d

180 c.dynamicMtime = mtime

181 c.AccountDestinationsLocked = accDests

182 c.aliases = aliases

183 c.allowACMEHosts(pkglog, true)

184 return nil

185}

186

187// DynamicConfig returns a shallow copy of the dynamic config. Must not be modified.

188func (c *Config) DynamicConfig() (config config.Dynamic) {

189 c.withDynamicLock(func() {

190 config = c.Dynamic // Shallow copy.

191 })

192 return

193}

194

195func (c *Config) Domains() (l []string) {

196 c.withDynamicLock(func() {

197 for name := range c.Dynamic.Domains {

198 l = append(l, name)

199 }

200 })

201 slices.Sort(l)

202 return l

203}

204

205func (c *Config) Accounts() (l []string) {

206 c.withDynamicLock(func() {

207 for name := range c.Dynamic.Accounts {

208 l = append(l, name)

209 }

210 })

211 return

212}

213

214func (c *Config) AccountsDisabled() (all, disabled []string) {

215 c.withDynamicLock(func() {

216 for name, conf := range c.Dynamic.Accounts {

217 all = append(all, name)

218 if conf.LoginDisabled != "" {

219 disabled = append(disabled, name)

220 }

221 }

222 })

223 return

224}

225

226// DomainLocalparts returns a mapping of encoded localparts to account names for a

227// domain, and encoded localparts to aliases. An empty localpart is a catchall

228// destination for a domain.

229func (c *Config) DomainLocalparts(d dns.Domain) (map[string]string, map[string]config.Alias) {

230 suffix := "@" + d.Name()

231 m := map[string]string{}

232 aliases := map[string]config.Alias{}

233 c.withDynamicLock(func() {

234 for addr, ad := range c.AccountDestinationsLocked {

235 if strings.HasSuffix(addr, suffix) {

236 if ad.Catchall {

237 m[""] = ad.Account

238 } else {

239 m[ad.Localpart.String()] = ad.Account

240 }

241 }

242 }

243 for addr, a := range c.aliases {

244 if strings.HasSuffix(addr, suffix) {

245 aliases[a.LocalpartStr] = a

246 }

247 }

248 })

249 return m, aliases

250}

251

252func (c *Config) Domain(d dns.Domain) (dom config.Domain, ok bool) {

253 c.withDynamicLock(func() {

254 dom, ok = c.Dynamic.Domains[d.Name()]

255 })

256 return

257}

258

259func (c *Config) DomainConfigs() (doms []config.Domain) {

260 c.withDynamicLock(func() {

261 doms = make([]config.Domain, 0, len(c.Dynamic.Domains))

262 for _, d := range c.Dynamic.Domains {

263 doms = append(doms, d)

264 }

265 })

266 return

267}

268

269func (c *Config) Account(name string) (acc config.Account, ok bool) {

270 c.withDynamicLock(func() {

271 acc, ok = c.Dynamic.Accounts[name]

272 })

273 return

274}

275

276func (c *Config) AccountDestination(addr string) (accDest AccountDestination, alias *config.Alias, ok bool) {

277 c.withDynamicLock(func() {

278 accDest, ok = c.AccountDestinationsLocked[addr]

279 if !ok {

280 var a config.Alias

281 a, ok = c.aliases[addr]

282 if ok {

283 alias = &a

284 }

285 }

286 })

287 return

288}

289

290func (c *Config) Routes(accountName string, domain dns.Domain) (accountRoutes, domainRoutes, globalRoutes []config.Route) {

291 c.withDynamicLock(func() {

292 acc := c.Dynamic.Accounts[accountName]

293 accountRoutes = acc.Routes

294

295 dom := c.Dynamic.Domains[domain.Name()]

296 domainRoutes = dom.Routes

297

298 globalRoutes = c.Dynamic.Routes

299 })

300 return

301}

302

303func (c *Config) IsClientSettingsDomain(d dns.Domain) (is bool) {

304 c.withDynamicLock(func() {

305 _, is = c.Dynamic.ClientSettingDomains[d]

306 })

307 return

308}

309

310func (c *Config) allowACMEHosts(log mlog.Log, checkACMEHosts bool) {

311 for _, l := range c.Static.Listeners {

312 if l.TLS == nil || l.TLS.ACME == "" {

313 continue

314 }

315

316 m := c.Static.ACME[l.TLS.ACME].Manager

317 hostnames := map[dns.Domain]struct{}{}

318

319 hostnames[c.Static.HostnameDomain] = struct{}{}

320 if l.HostnameDomain.ASCII != "" {

321 hostnames[l.HostnameDomain] = struct{}{}

322 }

323

324 for _, dom := range c.Dynamic.Domains {

325 // Do not allow TLS certificates for domains for which we only accept DMARC/TLS

326 // reports as external party.

327 if dom.ReportsOnly {

328 continue

329 }

330

331 // Do not fetch TLS certs for disabled domains. The A/AAAA records may not be

332 // configured or still point to a previous machine before a migration.

333 if dom.Disabled {

334 continue

335 }

336

337 if l.AutoconfigHTTPS.Enabled && !l.AutoconfigHTTPS.NonTLS {

338 if d, err := dns.ParseDomain("autoconfig." + dom.Domain.ASCII); err != nil {

339 log.Errorx("parsing autoconfig domain", err, slog.Any("domain", dom.Domain))

340 } else {

341 hostnames[d] = struct{}{}

342 }

343 }

344

345 if l.MTASTSHTTPS.Enabled && dom.MTASTS != nil && !l.MTASTSHTTPS.NonTLS {

346 d, err := dns.ParseDomain("mta-sts." + dom.Domain.ASCII)

347 if err != nil {

348 log.Errorx("parsing mta-sts domain", err, slog.Any("domain", dom.Domain))

349 } else {

350 hostnames[d] = struct{}{}

351 }

352 }

353

354 if dom.ClientSettingsDomain != "" {

355 hostnames[dom.ClientSettingsDNSDomain] = struct{}{}

356 }

357 }

358

359 if l.WebserverHTTPS.Enabled {

360 for from := range c.Dynamic.WebDNSDomainRedirects {

361 hostnames[from] = struct{}{}

362 }

363 for _, wh := range c.Dynamic.WebHandlers {

364 hostnames[wh.DNSDomain] = struct{}{}

365 }

366 }

367

368 public := c.Static.Listeners["public"]

369 ips := public.IPs

370 if len(public.NATIPs) > 0 {

371 ips = public.NATIPs

372 }

373 if public.IPsNATed {

374 ips = nil

375 }

376 m.SetAllowedHostnames(log, dns.StrictResolver{Pkg: "autotls", Log: log.Logger}, hostnames, ips, checkACMEHosts)

377 }

378}

379

380// todo future: write config parsing & writing code that can read a config and remembers the exact tokens including newlines and comments, and can write back a modified file. the goal is to be able to write a config file automatically (after changing fields through the ui), but not loose comments and whitespace, to still get useful diffs for storing the config in a version control system.

381

382// WriteDynamicLocked prepares an updated internal state for the new dynamic

383// config, then writes it to disk and activates it.

384//

385// Returns ErrConfig if the configuration is not valid.

386//

387// Must be called with config lock held.

388func WriteDynamicLocked(ctx context.Context, log mlog.Log, c config.Dynamic) error {

389 accDests, aliases, errs := prepareDynamicConfig(ctx, log, ConfigDynamicPath, Conf.Static, &c)

390 if len(errs) > 0 {

391 errstrs := make([]string, len(errs))

392 for i, err := range errs {

393 errstrs[i] = err.Error()

394 }

395 return fmt.Errorf("%w: %s", ErrConfig, strings.Join(errstrs, "; "))

396 }

397

398 var b bytes.Buffer

399 err := sconf.Write(&b, c)

400 if err != nil {

401 return err

402 }

403 f, err := os.OpenFile(ConfigDynamicPath, os.O_WRONLY, 0660)

404 if err != nil {

405 return err

406 }

407 defer func() {

408 if f != nil {

409 err := f.Close()

410 log.Check(err, "closing file after error")

411 }

412 }()

413 buf := b.Bytes()

414 if _, err := f.Write(buf); err != nil {

415 return fmt.Errorf("write domains.conf: %v", err)

416 }

417 if err := f.Truncate(int64(len(buf))); err != nil {

418 return fmt.Errorf("truncate domains.conf after write: %v", err)

419 }

420 if err := f.Sync(); err != nil {

421 return fmt.Errorf("sync domains.conf after write: %v", err)

422 }

423 if err := moxio.SyncDir(log, filepath.Dir(ConfigDynamicPath)); err != nil {

424 return fmt.Errorf("sync dir of domains.conf after write: %v", err)

425 }

426

427 fi, err := f.Stat()

428 if err != nil {

429 return fmt.Errorf("stat after writing domains.conf: %v", err)

430 }

431

432 if err := f.Close(); err != nil {

433 return fmt.Errorf("close written domains.conf: %v", err)

434 }

435 f = nil

436

437 Conf.dynamicMtime = fi.ModTime()

438 Conf.DynamicLastCheck = time.Now()

439 Conf.Dynamic = c

440 Conf.AccountDestinationsLocked = accDests

441 Conf.aliases = aliases

442

443 Conf.allowACMEHosts(log, true)

444

445 return nil

446}

447

448// MustLoadConfig loads the config, quitting on errors.

449func MustLoadConfig(doLoadTLSKeyCerts, checkACMEHosts bool) {

450 errs := LoadConfig(context.Background(), pkglog, doLoadTLSKeyCerts, checkACMEHosts)

451 if len(errs) > 1 {

452 pkglog.Error("loading config file: multiple errors")

453 for _, err := range errs {

454 pkglog.Errorx("config error", err)

455 }

456 pkglog.Fatal("stopping after multiple config errors")

457 } else if len(errs) == 1 {

458 pkglog.Fatalx("loading config file", errs[0])

459 }

460}

461

462// LoadConfig attempts to parse and load a config, returning any errors

463// encountered.

464func LoadConfig(ctx context.Context, log mlog.Log, doLoadTLSKeyCerts, checkACMEHosts bool) []error {

465 Shutdown, ShutdownCancel = context.WithCancel(context.Background())

466 Context, ContextCancel = context.WithCancel(context.Background())

467

468 c, errs := ParseConfig(ctx, log, ConfigStaticPath, false, doLoadTLSKeyCerts, checkACMEHosts)

469 if len(errs) > 0 {

470 return errs

471 }

472

473 mlog.SetConfig(c.Log)

474 SetConfig(c)

475 return nil

476}

477

478// SetConfig sets a new config. Not to be used during normal operation.

479func SetConfig(c *Config) {

480 // Cannot just assign *c to Conf, it would copy the mutex.

481 Conf = Config{c.Static, sync.Mutex{}, c.Log, sync.Mutex{}, c.Dynamic, c.dynamicMtime, c.DynamicLastCheck, c.AccountDestinationsLocked, c.aliases}

482

483 // If we have non-standard CA roots, use them for all HTTPS requests.

484 if Conf.Static.TLS.CertPool != nil {

485 http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{

486 RootCAs: Conf.Static.TLS.CertPool,

487 }

488 }

489

490 SetPedantic(c.Static.Pedantic)

491}

492

493// Set pedantic in all packages.

494func SetPedantic(p bool) {

495 dkim.Pedantic = p

496 dns.Pedantic = p

497 message.Pedantic = p

498 smtp.Pedantic = p

499 Pedantic = p

500}

501

502// ParseConfig parses the static config at path p. If checkOnly is true, no changes

503// are made, such as registering ACME identities. If doLoadTLSKeyCerts is true,

504// the TLS KeyCerts configuration is loaded and checked. This is used during the

505// quickstart in the case the user is going to provide their own certificates.

506// If checkACMEHosts is true, the hosts allowed for acme are compared with the

507// explicitly configured ips we are listening on.

508func ParseConfig(ctx context.Context, log mlog.Log, p string, checkOnly, doLoadTLSKeyCerts, checkACMEHosts bool) (c *Config, errs []error) {

509 c = &Config{

510 Static: config.Static{

511 DataDir: ".",

512 },

513 }

514

515 f, err := os.Open(p)

516 if err != nil {

517 if os.IsNotExist(err) && os.Getenv("MOXCONF") == "" {

518 return nil, []error{fmt.Errorf("open config file: %v (hint: use mox -config ... or set MOXCONF=...)", err)}

519 }

520 return nil, []error{fmt.Errorf("open config file: %v", err)}

521 }

522 defer f.Close()

523 if err := sconf.Parse(f, &c.Static); err != nil {

524 return nil, []error{fmt.Errorf("parsing %s%v", p, err)}

525 }

526

527 if xerrs := PrepareStaticConfig(ctx, log, p, c, checkOnly, doLoadTLSKeyCerts); len(xerrs) > 0 {

528 return nil, xerrs

529 }

530

531 pp := filepath.Join(filepath.Dir(p), "domains.conf")

532 c.Dynamic, c.dynamicMtime, c.AccountDestinationsLocked, c.aliases, errs = ParseDynamicConfig(ctx, log, pp, c.Static)

533

534 if !checkOnly {

535 c.allowACMEHosts(log, checkACMEHosts)

536 }

537

538 return c, errs

539}

540

541// PrepareStaticConfig parses the static config file and prepares data structures

542// for starting mox. If checkOnly is set no substantial changes are made, like

543// creating an ACME registration.

544func PrepareStaticConfig(ctx context.Context, log mlog.Log, configFile string, conf *Config, checkOnly, doLoadTLSKeyCerts bool) (errs []error) {

545 addErrorf := func(format string, args ...any) {

546 errs = append(errs, fmt.Errorf(format, args...))

547 }

548

549 c := &conf.Static

550

551 // check that mailbox is in unicode NFC normalized form.

552 checkMailboxNormf := func(mailbox string, format string, args ...any) {

553 s := norm.NFC.String(mailbox)

554 if mailbox != s {

555 msg := fmt.Sprintf(format, args...)

556 addErrorf("%s: mailbox %q is not in NFC normalized form, should be %q", msg, mailbox, s)

557 }

558 }

559

560 // Post-process logging config.

561 if logLevel, ok := mlog.Levels[c.LogLevel]; ok {

562 conf.Log = map[string]slog.Level{"": logLevel}

563 } else {

564 addErrorf("invalid log level %q", c.LogLevel)

565 }

566 for pkg, s := range c.PackageLogLevels {

567 if logLevel, ok := mlog.Levels[s]; ok {

568 conf.Log[pkg] = logLevel

569 } else {

570 addErrorf("invalid package log level %q", s)

571 }

572 }

573

574 if c.User == "" {

575 c.User = "mox"

576 }

577 u, err := user.Lookup(c.User)

578 if err != nil {

579 uid, err := strconv.ParseUint(c.User, 10, 32)

580 if err != nil {

581 addErrorf("parsing unknown user %s as uid: %v (hint: add user mox with \"useradd -d $PWD mox\" or specify a different username on the quickstart command-line)", c.User, err)

582 } else {

583 // We assume the same gid as uid.

584 c.UID = uint32(uid)

585 c.GID = uint32(uid)

586 }

587 } else {

588 if uid, err := strconv.ParseUint(u.Uid, 10, 32); err != nil {

589 addErrorf("parsing uid %s: %v", u.Uid, err)

590 } else {

591 c.UID = uint32(uid)

592 }

593 if gid, err := strconv.ParseUint(u.Gid, 10, 32); err != nil {

594 addErrorf("parsing gid %s: %v", u.Gid, err)

595 } else {

596 c.GID = uint32(gid)

597 }

598 }

599

600 hostname, err := dns.ParseDomain(c.Hostname)

601 if err != nil {

602 addErrorf("parsing hostname: %s", err)

603 } else if hostname.Name() != c.Hostname {

604 addErrorf("hostname must be in unicode form %q instead of %q", hostname.Name(), c.Hostname)

605 }

606 c.HostnameDomain = hostname

607

608 if c.HostTLSRPT.Account != "" {

609 tlsrptLocalpart, err := smtp.ParseLocalpart(c.HostTLSRPT.Localpart)

610 if err != nil {

611 addErrorf("invalid localpart %q for host tlsrpt: %v", c.HostTLSRPT.Localpart, err)

612 } else if tlsrptLocalpart.IsInternational() {

613 // Does not appear documented in ../rfc/8460, but similar to DMARC it makes sense

614 // to keep this ascii-only addresses.

615 addErrorf("host TLSRPT localpart %q is an internationalized address, only conventional ascii-only address allowed for interopability", tlsrptLocalpart)

616 }

617 c.HostTLSRPT.ParsedLocalpart = tlsrptLocalpart

618 }

619

620 // Return private key for host name for use with an ACME. Used to return the same

621 // private key as pre-generated for use with DANE, with its public key in DNS.

622 // We only use this key for Listener's that have this ACME configured, and for

623 // which the effective listener host name (either specific to the listener, or the

624 // global name) is requested. Other host names can get a fresh private key, they

625 // don't appear in DANE records.

626 //

627 // - run 0: only use listener with explicitly matching host name in listener

628 // (default quickstart config does not set it).

629 // - run 1: only look at public listener (and host matching mox host name)

630 // - run 2: all listeners (and host matching mox host name)

631 findACMEHostPrivateKey := func(acmeName, host string, keyType autocert.KeyType, run int) crypto.Signer {

632 for listenerName, l := range Conf.Static.Listeners {

633 if l.TLS == nil || l.TLS.ACME != acmeName {

634 continue

635 }

636 if run == 0 && host != l.HostnameDomain.ASCII {

637 continue

638 }

639 if run == 1 && listenerName != "public" || host != Conf.Static.HostnameDomain.ASCII {

640 continue

641 }

642 switch keyType {

643 case autocert.KeyRSA2048:

644 if len(l.TLS.HostPrivateRSA2048Keys) == 0 {

645 continue

646 }

647 return l.TLS.HostPrivateRSA2048Keys[0]

648 case autocert.KeyECDSAP256:

649 if len(l.TLS.HostPrivateECDSAP256Keys) == 0 {

650 continue

651 }

652 return l.TLS.HostPrivateECDSAP256Keys[0]

653 default:

654 return nil

655 }

656 }

657 return nil

658 }

659 // Make a function for an autocert.Manager.GetPrivateKey, using findACMEHostPrivateKey.

660 makeGetPrivateKey := func(acmeName string) func(host string, keyType autocert.KeyType) (crypto.Signer, error) {

661 return func(host string, keyType autocert.KeyType) (crypto.Signer, error) {

662 key := findACMEHostPrivateKey(acmeName, host, keyType, 0)

663 if key == nil {

664 key = findACMEHostPrivateKey(acmeName, host, keyType, 1)

665 }

666 if key == nil {

667 key = findACMEHostPrivateKey(acmeName, host, keyType, 2)

668 }

669 if key != nil {

670 log.Debug("found existing private key for certificate for host",

671 slog.String("acmename", acmeName),

672 slog.String("host", host),

673 slog.Any("keytype", keyType))

674 return key, nil

675 }

676 log.Debug("generating new private key for certificate for host",

677 slog.String("acmename", acmeName),

678 slog.String("host", host),

679 slog.Any("keytype", keyType))

680 switch keyType {

681 case autocert.KeyRSA2048:

682 return rsa.GenerateKey(cryptorand.Reader, 2048)

683 case autocert.KeyECDSAP256:

684 return ecdsa.GenerateKey(elliptic.P256(), cryptorand.Reader)

685 default:

686 return nil, fmt.Errorf("unrecognized requested key type %v", keyType)

687 }

688 }

689 }

690 for name, acme := range c.ACME {

691 addAcmeErrorf := func(format string, args ...any) {

692 addErrorf("acme provider %s: %s", name, fmt.Sprintf(format, args...))

693 }

694

695 var eabKeyID string

696 var eabKey []byte

697 if acme.ExternalAccountBinding != nil {

698 eabKeyID = acme.ExternalAccountBinding.KeyID

699 p := configDirPath(configFile, acme.ExternalAccountBinding.KeyFile)

700 buf, err := os.ReadFile(p)

701 if err != nil {

702 addAcmeErrorf("reading external account binding key: %s", err)

703 } else {

704 dec := make([]byte, base64.RawURLEncoding.DecodedLen(len(buf)))

705 n, err := base64.RawURLEncoding.Decode(dec, buf)

706 if err != nil {

707 addAcmeErrorf("parsing external account binding key as base64: %s", err)

708 } else {

709 eabKey = dec[:n]

710 }

711 }

712 }

713

714 if checkOnly {

715 continue

716 }

717

718 acmeDir := dataDirPath(configFile, c.DataDir, "acme")

719 os.MkdirAll(acmeDir, 0770)

720 manager, err := autotls.Load(log, name, acmeDir, acme.ContactEmail, acme.DirectoryURL, eabKeyID, eabKey, makeGetPrivateKey(name), Shutdown.Done())

721 if err != nil {

722 addAcmeErrorf("loading ACME identity: %s", err)

723 }

724 acme.Manager = manager

725

726 // Help configurations from older quickstarts.

727 if acme.IssuerDomainName == "" && acme.DirectoryURL == "https://acme-v02.api.letsencrypt.org/directory" {

728 acme.IssuerDomainName = "letsencrypt.org"

729 }

730

731 c.ACME[name] = acme

732 }

733

734 var haveUnspecifiedSMTPListener bool

735 for name, l := range c.Listeners {

736 addListenerErrorf := func(format string, args ...any) {

737 addErrorf("listener %s: %s", name, fmt.Sprintf(format, args...))

738 }

739

740 if l.Hostname != "" {

741 d, err := dns.ParseDomain(l.Hostname)

742 if err != nil {

743 addListenerErrorf("parsing hostname %q: %s", l.Hostname, err)

744 }

745 l.HostnameDomain = d

746 }

747 if l.TLS != nil {

748 if l.TLS.ACME != "" && len(l.TLS.KeyCerts) != 0 {

749 addListenerErrorf("cannot have ACME and static key/certificates")

750 } else if l.TLS.ACME != "" {

751 acme, ok := c.ACME[l.TLS.ACME]

752 if !ok {

753 addListenerErrorf("unknown ACME provider %q", l.TLS.ACME)

754 }

755

756 // If only checking or with missing ACME definition, we don't have an acme manager,

757 // so set an empty tls config to continue.

758 var tlsconfig, tlsconfigFallback *tls.Config

759 if checkOnly || acme.Manager == nil {

760 tlsconfig = &tls.Config{}

761 tlsconfigFallback = &tls.Config{}

762 } else {

763 hostname := c.HostnameDomain

764 if l.Hostname != "" {

765 hostname = l.HostnameDomain

766 }

767 // If SNI is absent, we will use the listener hostname, but reject connections with

768 // an SNI hostname that is not allowlisted.

769 // Incoming SMTP deliveries use tlsconfigFallback for interoperability. TLS

770 // connections for unknown SNI hostnames fall back to a certificate for the

771 // listener hostname instead of causing the TLS connection to fail.

772 tlsconfig = acme.Manager.TLSConfig(hostname, true, false)

773 tlsconfigFallback = acme.Manager.TLSConfig(hostname, true, true)

774 l.TLS.ACMEConfig = acme.Manager.ACMETLSConfig

775 }

776 l.TLS.Config = tlsconfig

777 l.TLS.ConfigFallback = tlsconfigFallback

778 } else if len(l.TLS.KeyCerts) != 0 {

779 if doLoadTLSKeyCerts {

780 if err := loadTLSKeyCerts(configFile, "listener "+name, l.TLS); err != nil {

781 addListenerErrorf("%w", err)

782 }

783 }

784 } else {

785 addListenerErrorf("cannot have TLS config without ACME and without static keys/certificates")

786 }

787 for _, privKeyFile := range l.TLS.HostPrivateKeyFiles {

788 keyPath := configDirPath(configFile, privKeyFile)

789 privKey, err := loadPrivateKeyFile(keyPath)

790 if err != nil {

791 addListenerErrorf("parsing host private key for DANE and ACME certificates: %v", err)

792 continue

793 }

794 switch k := privKey.(type) {

795 case *rsa.PrivateKey:

796 if k.N.BitLen() != 2048 {

797 log.Error("need rsa key with 2048 bits, for host private key for DANE/ACME certificates, ignoring",

798 slog.String("listener", name),

799 slog.String("file", keyPath),

800 slog.Int("bits", k.N.BitLen()))

801 continue

802 }

803 l.TLS.HostPrivateRSA2048Keys = append(l.TLS.HostPrivateRSA2048Keys, k)

804 case *ecdsa.PrivateKey:

805 if k.Curve != elliptic.P256() {

806 log.Error("unrecognized ecdsa curve for host private key for DANE/ACME certificates, ignoring", slog.String("listener", name), slog.String("file", keyPath))

807 continue

808 }

809 l.TLS.HostPrivateECDSAP256Keys = append(l.TLS.HostPrivateECDSAP256Keys, k)

810 default:

811 log.Error("unrecognized key type for host private key for DANE/ACME certificates, ignoring",

812 slog.String("listener", name),

813 slog.String("file", keyPath),

814 slog.String("keytype", fmt.Sprintf("%T", privKey)))

815 continue

816 }

817 }

818 if l.TLS.ACME != "" && (len(l.TLS.HostPrivateRSA2048Keys) == 0) != (len(l.TLS.HostPrivateECDSAP256Keys) == 0) {

819 log.Warn("uncommon configuration with either only an RSA 2048 or ECDSA P256 host private key for DANE/ACME certificates; this ACME implementation can retrieve certificates for both type of keys, it is recommended to set either both or none; continuing")

820 }

821

822 // TLS 1.2 was introduced in 2008. TLS <1.2 was deprecated by ../rfc/8996:31 and ../rfc/8997:66 in 2021.

823 var minVersion uint16 = tls.VersionTLS12

824 if l.TLS.MinVersion != "" {

825 versions := map[string]uint16{

826 "TLSv1.0": tls.VersionTLS10,

827 "TLSv1.1": tls.VersionTLS11,

828 "TLSv1.2": tls.VersionTLS12,

829 "TLSv1.3": tls.VersionTLS13,

830 }

831 v, ok := versions[l.TLS.MinVersion]

832 if !ok {

833 addListenerErrorf("unknown TLS mininum version %q", l.TLS.MinVersion)

834 }

835 minVersion = v

836 }

837 if l.TLS.Config != nil {

838 l.TLS.Config.MinVersion = minVersion

839 }

840 if l.TLS.ConfigFallback != nil {

841 l.TLS.ConfigFallback.MinVersion = minVersion

842 }

843 if l.TLS.ACMEConfig != nil {

844 l.TLS.ACMEConfig.MinVersion = minVersion

845 }

846 } else {

847 var needsTLS []string

848 needtls := func(s string, v bool) {

849 if v {

850 needsTLS = append(needsTLS, s)

851 }

852 }

853 needtls("IMAPS", l.IMAPS.Enabled)

854 needtls("SMTP", l.SMTP.Enabled && !l.SMTP.NoSTARTTLS)

855 needtls("Submissions", l.Submissions.Enabled)

856 needtls("Submission", l.Submission.Enabled && !l.Submission.NoRequireSTARTTLS)

857 needtls("AccountHTTPS", l.AccountHTTPS.Enabled)

858 needtls("AdminHTTPS", l.AdminHTTPS.Enabled)

859 needtls("AutoconfigHTTPS", l.AutoconfigHTTPS.Enabled && !l.AutoconfigHTTPS.NonTLS)

860 needtls("MTASTSHTTPS", l.MTASTSHTTPS.Enabled && !l.MTASTSHTTPS.NonTLS)

861 needtls("WebserverHTTPS", l.WebserverHTTPS.Enabled)

862 if len(needsTLS) > 0 {

863 addListenerErrorf("no tls config specified, but requires tls for %s", strings.Join(needsTLS, ", "))

864 }

865 }

866 if l.AutoconfigHTTPS.Enabled && l.MTASTSHTTPS.Enabled && l.AutoconfigHTTPS.Port == l.MTASTSHTTPS.Port && l.AutoconfigHTTPS.NonTLS != l.MTASTSHTTPS.NonTLS {

867 addListenerErrorf("autoconfig and mta-sts enabled on same port but with both http and https")

868 }

869 if l.SMTP.Enabled {

870 if len(l.IPs) == 0 {

871 haveUnspecifiedSMTPListener = true

872 }

873 for _, ipstr := range l.IPs {

874 ip := net.ParseIP(ipstr)

875 if ip == nil {

876 addListenerErrorf("invalid IP %q", ipstr)

877 continue

878 }

879 if ip.IsUnspecified() {

880 haveUnspecifiedSMTPListener = true

881 break

882 }

883 if len(c.SpecifiedSMTPListenIPs) >= 2 {

884 haveUnspecifiedSMTPListener = true

885 } else if len(c.SpecifiedSMTPListenIPs) > 0 && (c.SpecifiedSMTPListenIPs[0].To4() == nil) == (ip.To4() == nil) {

886 haveUnspecifiedSMTPListener = true

887 } else {

888 c.SpecifiedSMTPListenIPs = append(c.SpecifiedSMTPListenIPs, ip)

889 }

890 }

891 }

892 for _, s := range l.SMTP.DNSBLs {

893 d, err := dns.ParseDomain(s)

894 if err != nil {

895 addListenerErrorf("parsing DNSBL zone %q: %s", s, err)

896 continue

897 }

898 l.SMTP.DNSBLZones = append(l.SMTP.DNSBLZones, d)

899 }

900 if l.IPsNATed && len(l.NATIPs) > 0 {

901 addListenerErrorf("both IPsNATed and NATIPs configued (remove deprecated IPsNATed)")

902 }

903 for _, ipstr := range l.NATIPs {

904 ip := net.ParseIP(ipstr)

905 if ip == nil {

906 addListenerErrorf("invalid ip %q", ipstr)

907 } else if ip.IsUnspecified() || ip.IsLoopback() {

908 addListenerErrorf("NAT ip that is the unspecified or loopback address %s", ipstr)

909 }

910 }

911 cleanPath := func(kind string, enabled bool, path string) string {

912 if !enabled {

913 return path

914 }

915 if path != "" && !strings.HasPrefix(path, "/") {

916 addListenerErrorf("%s with path %q that must start with a slash", kind, path)

917 } else if path != "" && !strings.HasSuffix(path, "/") {

918 log.Warn("http service path should end with a slash, using effective path with slash", slog.String("kind", kind), slog.String("path", path), slog.String("effectivepath", path+"/"))

919 path += "/"

920 }

921 return path

922 }

923 l.AccountHTTP.Path = cleanPath("AccountHTTP", l.AccountHTTP.Enabled, l.AccountHTTP.Path)

924 l.AccountHTTPS.Path = cleanPath("AccountHTTPS", l.AccountHTTPS.Enabled, l.AccountHTTPS.Path)

925 l.AdminHTTP.Path = cleanPath("AdminHTTP", l.AdminHTTP.Enabled, l.AdminHTTP.Path)

926 l.AdminHTTPS.Path = cleanPath("AdminHTTPS", l.AdminHTTPS.Enabled, l.AdminHTTPS.Path)

927 l.WebmailHTTP.Path = cleanPath("WebmailHTTP", l.WebmailHTTP.Enabled, l.WebmailHTTP.Path)

928 l.WebmailHTTPS.Path = cleanPath("WebmailHTTPS", l.WebmailHTTPS.Enabled, l.WebmailHTTPS.Path)

929 l.WebAPIHTTP.Path = cleanPath("WebAPIHTTP", l.WebAPIHTTP.Enabled, l.WebAPIHTTP.Path)

930 l.WebAPIHTTPS.Path = cleanPath("WebAPIHTTPS", l.WebAPIHTTPS.Enabled, l.WebAPIHTTPS.Path)

931 c.Listeners[name] = l

932 }

933 if haveUnspecifiedSMTPListener {

934 c.SpecifiedSMTPListenIPs = nil

935 }

936

937 var zerouse config.SpecialUseMailboxes

938 if len(c.DefaultMailboxes) > 0 && (c.InitialMailboxes.SpecialUse != zerouse || len(c.InitialMailboxes.Regular) > 0) {

939 addErrorf("cannot have both DefaultMailboxes and InitialMailboxes")

940 }

941 // DefaultMailboxes is deprecated.

942 for _, mb := range c.DefaultMailboxes {

943 checkMailboxNormf(mb, "default mailbox")

944 // We don't create parent mailboxes for default mailboxes.

945 if ParentMailboxName(mb) != "" {

946 addErrorf("default mailbox cannot be a child mailbox")

947 }

948 }

949 checkSpecialUseMailbox := func(nameOpt string) {

950 if nameOpt != "" {

951 checkMailboxNormf(nameOpt, "special-use initial mailbox")

952 if strings.EqualFold(nameOpt, "inbox") {

953 addErrorf("initial mailbox cannot be set to Inbox (Inbox is always created)")

954 }

955 // We don't currently create parent mailboxes for initial mailboxes.

956 if ParentMailboxName(nameOpt) != "" {

957 addErrorf("initial mailboxes cannot be child mailboxes")

958 }

959 }

960 }

961 checkSpecialUseMailbox(c.InitialMailboxes.SpecialUse.Archive)

962 checkSpecialUseMailbox(c.InitialMailboxes.SpecialUse.Draft)

963 checkSpecialUseMailbox(c.InitialMailboxes.SpecialUse.Junk)

964 checkSpecialUseMailbox(c.InitialMailboxes.SpecialUse.Sent)

965 checkSpecialUseMailbox(c.InitialMailboxes.SpecialUse.Trash)

966 for _, name := range c.InitialMailboxes.Regular {

967 checkMailboxNormf(name, "regular initial mailbox")

968 if strings.EqualFold(name, "inbox") {

969 addErrorf("initial regular mailbox cannot be set to Inbox (Inbox is always created)")

970 }

971 if ParentMailboxName(name) != "" {

972 addErrorf("initial mailboxes cannot be child mailboxes")

973 }

974 }

975

976 checkTransportSMTP := func(name string, isTLS bool, t *config.TransportSMTP) {

977 addTransportErrorf := func(format string, args ...any) {

978 addErrorf("transport %s: %s", name, fmt.Sprintf(format, args...))

979 }

980

981 var err error

982 t.DNSHost, err = dns.ParseDomain(t.Host)

983 if err != nil {

984 addTransportErrorf("bad host %s: %v", t.Host, err)

985 }

986

987 if isTLS && t.STARTTLSInsecureSkipVerify {

988 addTransportErrorf("cannot have STARTTLSInsecureSkipVerify with immediate TLS")

989 }

990 if isTLS && t.NoSTARTTLS {

991 addTransportErrorf("cannot have NoSTARTTLS with immediate TLS")

992 }

993

994 if t.Auth == nil {

995 return

996 }

997 seen := map[string]bool{}

998 for _, m := range t.Auth.Mechanisms {

999 if seen[m] {

1000 addTransportErrorf("duplicate authentication mechanism %s", m)

1001 }

1002 seen[m] = true

1003 switch m {

1004 case "SCRAM-SHA-256-PLUS":

1005 case "SCRAM-SHA-256":

1006 case "SCRAM-SHA-1-PLUS":

1007 case "SCRAM-SHA-1":

1008 case "CRAM-MD5":

1009 case "PLAIN":

1010 default:

1011 addTransportErrorf("unknown authentication mechanism %s", m)

1012 }

1013 }

1014

1015 t.Auth.EffectiveMechanisms = t.Auth.Mechanisms

1016 if len(t.Auth.EffectiveMechanisms) == 0 {

1017 t.Auth.EffectiveMechanisms = []string{"SCRAM-SHA-256-PLUS", "SCRAM-SHA-256", "SCRAM-SHA-1-PLUS", "SCRAM-SHA-1", "CRAM-MD5"}

1018 }

1019 }

1020

1021 checkTransportSocks := func(name string, t *config.TransportSocks) {

1022 addTransportErrorf := func(format string, args ...any) {

1023 addErrorf("transport %s: %s", name, fmt.Sprintf(format, args...))

1024 }

1025

1026 _, _, err := net.SplitHostPort(t.Address)

1027 if err != nil {

1028 addTransportErrorf("bad address %s: %v", t.Address, err)

1029 }

1030 for _, ipstr := range t.RemoteIPs {

1031 ip := net.ParseIP(ipstr)

1032 if ip == nil {

1033 addTransportErrorf("bad ip %s", ipstr)

1034 } else {

1035 t.IPs = append(t.IPs, ip)

1036 }

1037 }

1038 t.Hostname, err = dns.ParseDomain(t.RemoteHostname)

1039 if err != nil {

1040 addTransportErrorf("bad hostname %s: %v", t.RemoteHostname, err)

1041 }

1042 }

1043

1044 checkTransportDirect := func(name string, t *config.TransportDirect) {

1045 addTransportErrorf := func(format string, args ...any) {

1046 addErrorf("transport %s: %s", name, fmt.Sprintf(format, args...))

1047 }

1048

1049 if t.DisableIPv4 && t.DisableIPv6 {

1050 addTransportErrorf("both IPv4 and IPv6 are disabled, enable at least one")

1051 }

1052 t.IPFamily = "ip"

1053 if t.DisableIPv4 {

1054 t.IPFamily = "ip6"

1055 }

1056 if t.DisableIPv6 {

1057 t.IPFamily = "ip4"

1058 }

1059 }

1060

1061 for name, t := range c.Transports {

1062 addTransportErrorf := func(format string, args ...any) {

1063 addErrorf("transport %s: %s", name, fmt.Sprintf(format, args...))

1064 }

1065

1066 n := 0

1067 if t.Submissions != nil {

1068 n++

1069 checkTransportSMTP(name, true, t.Submissions)

1070 }

1071 if t.Submission != nil {

1072 n++

1073 checkTransportSMTP(name, false, t.Submission)

1074 }

1075 if t.SMTP != nil {

1076 n++

1077 checkTransportSMTP(name, false, t.SMTP)

1078 }

1079 if t.Socks != nil {

1080 n++

1081 checkTransportSocks(name, t.Socks)

1082 }

1083 if t.Direct != nil {

1084 n++

1085 checkTransportDirect(name, t.Direct)

1086 }

1087 if n > 1 {

1088 addTransportErrorf("cannot have multiple methods in a transport")

1089 }

1090 }

1091

1092 // Load CA certificate pool.

1093 if c.TLS.CA != nil {

1094 if c.TLS.CA.AdditionalToSystem {

1095 var err error

1096 c.TLS.CertPool, err = x509.SystemCertPool()

1097 if err != nil {

1098 addErrorf("fetching system CA cert pool: %v", err)

1099 }

1100 } else {

1101 c.TLS.CertPool = x509.NewCertPool()

1102 }

1103 for _, certfile := range c.TLS.CA.CertFiles {

1104 p := configDirPath(configFile, certfile)

1105 pemBuf, err := os.ReadFile(p)

1106 if err != nil {

1107 addErrorf("reading TLS CA cert file: %v", err)

1108 continue

1109 } else if !c.TLS.CertPool.AppendCertsFromPEM(pemBuf) {

1110 // todo: can we check more fully if we're getting some useful data back?

1111 addErrorf("no CA certs added from %q", p)

1112 }

1113 }

1114 }

1115 return

1116}

1117

1118// PrepareDynamicConfig parses the dynamic config file given a static file.

1119func ParseDynamicConfig(ctx context.Context, log mlog.Log, dynamicPath string, static config.Static) (c config.Dynamic, mtime time.Time, accDests map[string]AccountDestination, aliases map[string]config.Alias, errs []error) {

1120 addErrorf := func(format string, args ...any) {

1121 errs = append(errs, fmt.Errorf(format, args...))

1122 }

1123

1124 f, err := os.Open(dynamicPath)

1125 if err != nil {

1126 addErrorf("parsing domains config: %v", err)

1127 return

1128 }

1129 defer f.Close()

1130 fi, err := f.Stat()

1131 if err != nil {

1132 addErrorf("stat domains config: %v", err)

1133 }

1134 if err := sconf.Parse(f, &c); err != nil {

1135 addErrorf("parsing dynamic config file: %v", err)

1136 return

1137 }

1138

1139 accDests, aliases, errs = prepareDynamicConfig(ctx, log, dynamicPath, static, &c)

1140 return c, fi.ModTime(), accDests, aliases, errs

1141}

1142

1143func prepareDynamicConfig(ctx context.Context, log mlog.Log, dynamicPath string, static config.Static, c *config.Dynamic) (accDests map[string]AccountDestination, aliases map[string]config.Alias, errs []error) {

1144 addErrorf := func(format string, args ...any) {

1145 errs = append(errs, fmt.Errorf(format, args...))

1146 }

1147

1148 // Check that mailbox is in unicode NFC normalized form.

1149 checkMailboxNormf := func(mailbox string, what string, errorf func(format string, args ...any)) {

1150 s := norm.NFC.String(mailbox)

1151 if mailbox != s {

1152 errorf("%s: mailbox %q is not in NFC normalized form, should be %q", what, mailbox, s)

1153 }

1154 }

1155

1156 // Validate postmaster account exists.

1157 if _, ok := c.Accounts[static.Postmaster.Account]; !ok {

1158 addErrorf("postmaster account %q does not exist", static.Postmaster.Account)

1159 }

1160 checkMailboxNormf(static.Postmaster.Mailbox, "postmaster mailbox", addErrorf)

1161

1162 accDests = map[string]AccountDestination{}

1163 aliases = map[string]config.Alias{}

1164

1165 // Validate host TLSRPT account/address.

1166 if static.HostTLSRPT.Account != "" {

1167 if _, ok := c.Accounts[static.HostTLSRPT.Account]; !ok {

1168 addErrorf("host tlsrpt account %q does not exist", static.HostTLSRPT.Account)

1169 }

1170 checkMailboxNormf(static.HostTLSRPT.Mailbox, "host tlsrpt mailbox", addErrorf)

1171

1172 // Localpart has been parsed already.

1173

1174 addrFull := smtp.NewAddress(static.HostTLSRPT.ParsedLocalpart, static.HostnameDomain).String()

1175 dest := config.Destination{

1176 Mailbox: static.HostTLSRPT.Mailbox,

1177 HostTLSReports: true,

1178 }

1179 accDests[addrFull] = AccountDestination{false, static.HostTLSRPT.ParsedLocalpart, static.HostTLSRPT.Account, dest}

1180 }

1181

1182 var haveSTSListener, haveWebserverListener bool

1183 for _, l := range static.Listeners {

1184 if l.MTASTSHTTPS.Enabled {

1185 haveSTSListener = true

1186 }

1187 if l.WebserverHTTP.Enabled || l.WebserverHTTPS.Enabled {

1188 haveWebserverListener = true

1189 }

1190 }

1191

1192 checkRoutes := func(descr string, routes []config.Route) {

1193 parseRouteDomains := func(l []string) []string {

1194 var r []string

1195 for _, e := range l {

1196 if e == "." {

1197 r = append(r, e)

1198 continue

1199 }

1200 prefix := ""

1201 if strings.HasPrefix(e, ".") {

1202 prefix = "."

1203 e = e[1:]

1204 }

1205 d, err := dns.ParseDomain(e)

1206 if err != nil {

1207 addErrorf("%s: invalid domain %s: %v", descr, e, err)

1208 }

1209 r = append(r, prefix+d.ASCII)

1210 }

1211 return r

1212 }

1213

1214 for i := range routes {

1215 routes[i].FromDomainASCII = parseRouteDomains(routes[i].FromDomain)

1216 routes[i].ToDomainASCII = parseRouteDomains(routes[i].ToDomain)

1217 var ok bool

1218 routes[i].ResolvedTransport, ok = static.Transports[routes[i].Transport]

1219 if !ok {

1220 addErrorf("%s: route references undefined transport %s", descr, routes[i].Transport)

1221 }

1222 }

1223 }

1224

1225 checkRoutes("global routes", c.Routes)

1226

1227 // Validate domains.

1228 c.ClientSettingDomains = map[dns.Domain]struct{}{}

1229 for d, domain := range c.Domains {

1230 addDomainErrorf := func(format string, args ...any) {

1231 addErrorf(fmt.Sprintf("domain %v: %s", d, fmt.Sprintf(format, args...)))

1232 }

1233

1234 dnsdomain, err := dns.ParseDomain(d)

1235 if err != nil {

1236 addDomainErrorf("parsing domain: %s", err)

1237 } else if dnsdomain.Name() != d {

1238 addDomainErrorf("must be specified in unicode form, %s", dnsdomain.Name())

1239 }

1240

1241 domain.Domain = dnsdomain

1242

1243 if domain.ClientSettingsDomain != "" {

1244 csd, err := dns.ParseDomain(domain.ClientSettingsDomain)

1245 if err != nil {

1246 addDomainErrorf("bad client settings domain %q: %s", domain.ClientSettingsDomain, err)

1247 }

1248 domain.ClientSettingsDNSDomain = csd

1249 c.ClientSettingDomains[csd] = struct{}{}

1250 }

1251

1252 if domain.LocalpartCatchallSeparator != "" && len(domain.LocalpartCatchallSeparators) != 0 {

1253 addDomainErrorf("cannot have both LocalpartCatchallSeparator and LocalpartCatchallSeparators")

1254 }

1255 domain.LocalpartCatchallSeparatorsEffective = domain.LocalpartCatchallSeparators

1256 if domain.LocalpartCatchallSeparator != "" {

1257 domain.LocalpartCatchallSeparatorsEffective = append(domain.LocalpartCatchallSeparatorsEffective, domain.LocalpartCatchallSeparator)

1258 }

1259 sepSeen := map[string]bool{}

1260 for _, sep := range domain.LocalpartCatchallSeparatorsEffective {

1261 if sepSeen[sep] {

1262 addDomainErrorf("duplicate localpart catchall separator %q", sep)

1263 }

1264 sepSeen[sep] = true

1265 }

1266

1267 for _, sign := range domain.DKIM.Sign {

1268 if _, ok := domain.DKIM.Selectors[sign]; !ok {

1269 addDomainErrorf("unknown selector %s for signing", sign)

1270 }

1271 }

1272 for name, sel := range domain.DKIM.Selectors {

1273 addSelectorErrorf := func(format string, args ...any) {

1274 addDomainErrorf("selector %s: %s", name, fmt.Sprintf(format, args...))

1275 }

1276

1277 seld, err := dns.ParseDomain(name)

1278 if err != nil {

1279 addSelectorErrorf("parsing selector: %s", err)

1280 } else if seld.Name() != name {

1281 addSelectorErrorf("must be specified in unicode form, %q", seld.Name())

1282 }

1283 sel.Domain = seld

1284

1285 if sel.Expiration != "" {

1286 exp, err := time.ParseDuration(sel.Expiration)

1287 if err != nil {

1288 addSelectorErrorf("invalid expiration %q: %v", sel.Expiration, err)

1289 } else {

1290 sel.ExpirationSeconds = int(exp / time.Second)

1291 }

1292 }

1293

1294 sel.HashEffective = sel.Hash

1295 switch sel.HashEffective {

1296 case "":

1297 sel.HashEffective = "sha256"

1298 case "sha1":

1299 log.Error("using sha1 with DKIM is deprecated as not secure enough, switch to sha256")

1300 case "sha256":

1301 default:

1302 addSelectorErrorf("unsupported hash %q", sel.HashEffective)

1303 }

1304

1305 pemBuf, err := os.ReadFile(configDirPath(dynamicPath, sel.PrivateKeyFile))

1306 if err != nil {

1307 addSelectorErrorf("reading private key: %s", err)

1308 continue

1309 }

1310 p, _ := pem.Decode(pemBuf)

1311 if p == nil {

1312 addSelectorErrorf("private key has no PEM block")

1313 continue

1314 }

1315 key, err := x509.ParsePKCS8PrivateKey(p.Bytes)

1316 if err != nil {

1317 addSelectorErrorf("parsing private key: %s", err)

1318 continue

1319 }

1320 switch k := key.(type) {

1321 case *rsa.PrivateKey:

1322 if k.N.BitLen() < 1024 {

1323 // ../rfc/6376:757

1324 // Let's help user do the right thing.

1325 addSelectorErrorf("rsa keys should be >= 1024 bits, is %d bits", k.N.BitLen())

1326 }

1327 sel.Key = k

1328 sel.Algorithm = fmt.Sprintf("rsa-%d", k.N.BitLen())

1329 case ed25519.PrivateKey:

1330 if sel.HashEffective != "sha256" {

1331 addSelectorErrorf("hash algorithm %q is not supported with ed25519, only sha256 is", sel.HashEffective)

1332 }

1333 sel.Key = k

1334 sel.Algorithm = "ed25519"

1335 default:

1336 addSelectorErrorf("private key type %T not yet supported", key)

1337 }

1338

1339 if len(sel.Headers) == 0 {

1340 // ../rfc/6376:2139

1341 // ../rfc/6376:2203

1342 // ../rfc/6376:2212

1343 // By default we seal signed headers, and we sign user-visible headers to

1344 // prevent/limit reuse of previously signed messages: All addressing fields, date

1345 // and subject, message-referencing fields, parsing instructions (content-type).

1346 sel.HeadersEffective = strings.Split("From,To,Cc,Bcc,Reply-To,References,In-Reply-To,Subject,Date,Message-Id,Content-Type", ",")

1347 } else {

1348 var from bool

1349 for _, h := range sel.Headers {

1350 from = from || strings.EqualFold(h, "From")

1351 // ../rfc/6376:2269

1352 if strings.EqualFold(h, "DKIM-Signature") || strings.EqualFold(h, "Received") || strings.EqualFold(h, "Return-Path") {

1353 log.Error("DKIM-signing header %q is recommended against as it may be modified in transit")

1354 }

1355 }

1356 if !from {

1357 addSelectorErrorf("From-field must always be DKIM-signed")

1358 }

1359 sel.HeadersEffective = sel.Headers

1360 }

1361

1362 domain.DKIM.Selectors[name] = sel

1363 }

1364

1365 if domain.MTASTS != nil {

1366 if !haveSTSListener {

1367 addDomainErrorf("MTA-STS enabled, but there is no listener for MTASTS", d)

1368 }

1369 sts := domain.MTASTS

1370 if sts.PolicyID == "" {

1371 addDomainErrorf("invalid empty MTA-STS PolicyID")

1372 }

1373 switch sts.Mode {

1374 case mtasts.ModeNone, mtasts.ModeTesting, mtasts.ModeEnforce:

1375 default:

1376 addDomainErrorf("invalid mtasts mode %q", sts.Mode)

1377 }

1378 }

1379

1380 checkRoutes("routes for domain", domain.Routes)

1381

1382 c.Domains[d] = domain

1383 }

1384

1385 // To determine ReportsOnly.

1386 domainHasAddress := map[string]bool{}

1387

1388 // Validate email addresses.

1389 for accName, acc := range c.Accounts {

1390 addAccountErrorf := func(format string, args ...any) {

1391 addErrorf("account %q: %s", accName, fmt.Sprintf(format, args...))

1392 }

1393

1394 var err error

1395 acc.DNSDomain, err = dns.ParseDomain(acc.Domain)

1396 if err != nil {

1397 addAccountErrorf("parsing domain %s: %s", acc.Domain, err)

1398 }

1399

1400 if strings.EqualFold(acc.RejectsMailbox, "Inbox") {

1401 addAccountErrorf("cannot set RejectsMailbox to inbox, messages will be removed automatically from the rejects mailbox")

1402 }

1403 checkMailboxNormf(acc.RejectsMailbox, "rejects mailbox", addErrorf)

1404

1405 if len(acc.LoginDisabled) > 256 {

1406 addAccountErrorf("message for disabled login must be <256 characters")

1407 }

1408 for _, c := range acc.LoginDisabled {

1409 // For IMAP and SMTP. IMAP only allows UTF8 after "ENABLE IMAPrev2".

1410 if c < ' ' || c >= 0x7f {

1411 addAccountErrorf("message cannot contain control characters including newlines, and must be ascii-only")

1412 }

1413 }

1414

1415 if acc.AutomaticJunkFlags.JunkMailboxRegexp != "" {

1416 r, err := regexp.Compile(acc.AutomaticJunkFlags.JunkMailboxRegexp)

1417 if err != nil {

1418 addAccountErrorf("invalid JunkMailboxRegexp regular expression: %v", err)

1419 }

1420 acc.JunkMailbox = r

1421 }

1422 if acc.AutomaticJunkFlags.NeutralMailboxRegexp != "" {

1423 r, err := regexp.Compile(acc.AutomaticJunkFlags.NeutralMailboxRegexp)

1424 if err != nil {

1425 addAccountErrorf("invalid NeutralMailboxRegexp regular expression: %v", err)

1426 }

1427 acc.NeutralMailbox = r

1428 }

1429 if acc.AutomaticJunkFlags.NotJunkMailboxRegexp != "" {

1430 r, err := regexp.Compile(acc.AutomaticJunkFlags.NotJunkMailboxRegexp)

1431 if err != nil {

1432 addAccountErrorf("invalid NotJunkMailboxRegexp regular expression: %v", err)

1433 }

1434 acc.NotJunkMailbox = r

1435 }

1436

1437 if acc.JunkFilter != nil {

1438 params := acc.JunkFilter.Params

1439 if params.MaxPower < 0 || params.MaxPower > 0.5 {

1440 addAccountErrorf("junk filter MaxPower must be >= 0 and < 0.5")

1441 }

1442 if params.TopWords < 0 {

1443 addAccountErrorf("junk filter TopWords must be >= 0")

1444 }

1445 if params.IgnoreWords < 0 || params.IgnoreWords > 0.5 {

1446 addAccountErrorf("junk filter IgnoreWords must be >= 0 and < 0.5")

1447 }

1448 if params.RareWords < 0 {

1449 addAccountErrorf("junk filter RareWords must be >= 0")

1450 }

1451 }

1452

1453 acc.ParsedFromIDLoginAddresses = make([]smtp.Address, len(acc.FromIDLoginAddresses))

1454 for i, s := range acc.FromIDLoginAddresses {

1455 a, err := smtp.ParseAddress(s)

1456 if err != nil {

1457 addAccountErrorf("invalid fromid login address %q: %v", s, err)

1458 }

1459 // We check later on if address belongs to account.

1460 dom, ok := c.Domains[a.Domain.Name()]

1461 if !ok {

1462 addAccountErrorf("unknown domain in fromid login address %q", s)

1463 } else if len(dom.LocalpartCatchallSeparatorsEffective) == 0 {

1464 addAccountErrorf("localpart catchall separator not configured for domain for fromid login address %q", s)

1465 }

1466 acc.ParsedFromIDLoginAddresses[i] = a

1467 }

1468

1469 // Clear any previously derived state.

1470 acc.Aliases = nil

1471

1472 c.Accounts[accName] = acc

1473

1474 if acc.OutgoingWebhook != nil {

1475 u, err := url.Parse(acc.OutgoingWebhook.URL)

1476 if err == nil && (u.Scheme != "http" && u.Scheme != "https") {

1477 err = errors.New("scheme must be http or https")

1478 }

1479 if err != nil {

1480 addAccountErrorf("parsing outgoing hook url %q: %v", acc.OutgoingWebhook.URL, err)

1481 }

1482

1483 // note: outgoing hook events are in ../queue/hooks.go, ../mox-/config.go, ../queue.go and ../webapi/gendoc.sh. keep in sync.

1484 outgoingHookEvents := []string{"delivered", "suppressed", "delayed", "failed", "relayed", "expanded", "canceled", "unrecognized"}

1485 for _, e := range acc.OutgoingWebhook.Events {

1486 if !slices.Contains(outgoingHookEvents, e) {

1487 addAccountErrorf("unknown outgoing hook event %q", e)

1488 }

1489 }

1490 }

1491 if acc.IncomingWebhook != nil {

1492 u, err := url.Parse(acc.IncomingWebhook.URL)

1493 if err == nil && (u.Scheme != "http" && u.Scheme != "https") {

1494 err = errors.New("scheme must be http or https")

1495 }

1496 if err != nil {

1497 addAccountErrorf("parsing incoming hook url %q: %v", acc.IncomingWebhook.URL, err)

1498 }

1499 }

1500

1501 // todo deprecated: only localpart as keys for Destinations, we are replacing them with full addresses. if domains.conf is written, we won't have to do this again.

1502 replaceLocalparts := map[string]string{}

1503

1504 for addrName, dest := range acc.Destinations {

1505 addDestErrorf := func(format string, args ...any) {

1506 addAccountErrorf("destination %q: %s", addrName, fmt.Sprintf(format, args...))

1507 }

1508

1509 checkMailboxNormf(dest.Mailbox, "destination mailbox", addDestErrorf)

1510

1511 if dest.SMTPError != "" {

1512 if len(dest.SMTPError) > 256 {

1513 addDestErrorf("smtp error must be smaller than 256 bytes")

1514 }

1515 for _, c := range dest.SMTPError {

1516 if c < ' ' || c >= 0x7f {

1517 addDestErrorf("smtp error cannot contain contain control characters (including newlines) or non-ascii")

1518 break

1519 }

1520 }

1521

1522 if dest.Mailbox != "" {

1523 addDestErrorf("cannot have both SMTPError and Mailbox")

1524 }

1525 if len(dest.Rulesets) != 0 {

1526 addDestErrorf("cannot have both SMTPError and Rulesets")

1527 }

1528

1529 t := strings.SplitN(dest.SMTPError, " ", 2)

1530 switch t[0] {

1531 default:

1532 addDestErrorf("smtp error must be 421 or 550 (with optional message), not %q", dest.SMTPError)

1533

1534 case "421":

1535 dest.SMTPErrorCode = smtp.C451LocalErr

1536 dest.SMTPErrorSecode = smtp.SeSys3Other0

1537 dest.SMTPErrorMsg = "error processing"

1538 case "550":

1539 dest.SMTPErrorCode = smtp.C550MailboxUnavail

1540 dest.SMTPErrorSecode = smtp.SeAddr1UnknownDestMailbox1

1541 dest.SMTPErrorMsg = "no such user(s)"

1542 }

1543 if len(t) > 1 {

1544 dest.SMTPErrorMsg = strings.TrimSpace(t[1])

1545 }

1546 acc.Destinations[addrName] = dest

1547 }

1548

1549 if dest.MessageAuthRequiredSMTPError != "" {

1550 if len(dest.MessageAuthRequiredSMTPError) > 256 {

1551 addDestErrorf("message authentication required smtp error must be smaller than 256 bytes")

1552 }

1553 for _, c := range dest.MessageAuthRequiredSMTPError {

1554 if c < ' ' || c >= 0x7f {

1555 addDestErrorf("message authentication required smtp error cannot contain contain control characters (including newlines) or non-ascii")

1556 break

1557 }

1558 }

1559 }

1560

1561 for i, rs := range dest.Rulesets {

1562 addRulesetErrorf := func(format string, args ...any) {

1563 addDestErrorf("ruleset %d: %s", i+1, fmt.Sprintf(format, args...))

1564 }

1565

1566 checkMailboxNormf(rs.Mailbox, "ruleset mailbox", addRulesetErrorf)

1567

1568 n := 0

1569

1570 if rs.SMTPMailFromRegexp != "" {

1571 n++

1572 r, err := regexp.Compile(rs.SMTPMailFromRegexp)

1573 if err != nil {

1574 addRulesetErrorf("invalid SMTPMailFrom regular expression: %v", err)

1575 }

1576 c.Accounts[accName].Destinations[addrName].Rulesets[i].SMTPMailFromRegexpCompiled = r

1577 }

1578 if rs.MsgFromRegexp != "" {

1579 n++

1580 r, err := regexp.Compile(rs.MsgFromRegexp)

1581 if err != nil {

1582 addRulesetErrorf("invalid MsgFrom regular expression: %v", err)

1583 }

1584 c.Accounts[accName].Destinations[addrName].Rulesets[i].MsgFromRegexpCompiled = r

1585 }

1586 if rs.VerifiedDomain != "" {

1587 n++

1588 d, err := dns.ParseDomain(rs.VerifiedDomain)

1589 if err != nil {

1590 addRulesetErrorf("invalid VerifiedDomain: %v", err)

1591 }

1592 c.Accounts[accName].Destinations[addrName].Rulesets[i].VerifiedDNSDomain = d

1593 }

1594

1595 var hdr [][2]*regexp.Regexp

1596 for k, v := range rs.HeadersRegexp {

1597 n++

1598 if strings.ToLower(k) != k {

1599 addRulesetErrorf("header field %q must only have lower case characters", k)

1600 }

1601 if strings.ToLower(v) != v {

1602 addRulesetErrorf("header value %q must only have lower case characters", v)

1603 }

1604 rk, err := regexp.Compile(k)

1605 if err != nil {

1606 addRulesetErrorf("invalid rule header regexp %q: %v", k, err)

1607 }

1608 rv, err := regexp.Compile(v)

1609 if err != nil {

1610 addRulesetErrorf("invalid rule header regexp %q: %v", v, err)

1611 }

1612 hdr = append(hdr, [...]*regexp.Regexp{rk, rv})

1613 }

1614 c.Accounts[accName].Destinations[addrName].Rulesets[i].HeadersRegexpCompiled = hdr

1615

1616 if n == 0 {

1617 addRulesetErrorf("ruleset must have at least one rule")

1618 }

1619

1620 if rs.IsForward && rs.ListAllowDomain != "" {

1621 addRulesetErrorf("ruleset cannot have both IsForward and ListAllowDomain")

1622 }

1623 if rs.IsForward {

1624 if rs.SMTPMailFromRegexp == "" || rs.VerifiedDomain == "" {

1625 addRulesetErrorf("ruleset with IsForward must have both SMTPMailFromRegexp and VerifiedDomain too")

1626 }

1627 }

1628 if rs.ListAllowDomain != "" {

1629 d, err := dns.ParseDomain(rs.ListAllowDomain)

1630 if err != nil {

1631 addRulesetErrorf("invalid ListAllowDomain %q: %v", rs.ListAllowDomain, err)

1632 }

1633 c.Accounts[accName].Destinations[addrName].Rulesets[i].ListAllowDNSDomain = d

1634 }

1635

1636 checkMailboxNormf(rs.AcceptRejectsToMailbox, "rejects mailbox", addRulesetErrorf)

1637 if strings.EqualFold(rs.AcceptRejectsToMailbox, "inbox") {

1638 addRulesetErrorf("AcceptRejectsToMailbox cannot be set to Inbox")

1639 }

1640 }

1641

1642 // Catchall destination for domain.

1643 if strings.HasPrefix(addrName, "@") {

1644 d, err := dns.ParseDomain(addrName[1:])

1645 if err != nil {

1646 addDestErrorf("parsing domain %q", addrName[1:])

1647 continue

1648 } else if _, ok := c.Domains[d.Name()]; !ok {

1649 addDestErrorf("unknown domain for address")

1650 continue

1651 }

1652 domainHasAddress[d.Name()] = true

1653 addrFull := "@" + d.Name()

1654 if _, ok := accDests[addrFull]; ok {

1655 addDestErrorf("duplicate canonicalized catchall destination address %s", addrFull)

1656 }

1657 accDests[addrFull] = AccountDestination{true, "", accName, dest}

1658 continue

1659 }

1660

1661 // todo deprecated: remove support for parsing destination as just a localpart instead full address.

1662 var address smtp.Address

1663 if localpart, err := smtp.ParseLocalpart(addrName); err != nil && errors.Is(err, smtp.ErrBadLocalpart) {

1664 address, err = smtp.ParseAddress(addrName)

1665 if err != nil {

1666 addDestErrorf("invalid email address")

1667 continue

1668 } else if _, ok := c.Domains[address.Domain.Name()]; !ok {

1669 addDestErrorf("unknown domain for address")

1670 continue

1671 }

1672 } else {

1673 if err != nil {

1674 addDestErrorf("invalid localpart %q", addrName)

1675 continue

1676 }

1677 address = smtp.NewAddress(localpart, acc.DNSDomain)

1678 if _, ok := c.Domains[acc.DNSDomain.Name()]; !ok {

1679 addDestErrorf("unknown domain %s", acc.DNSDomain.Name())

1680 continue

1681 }

1682 replaceLocalparts[addrName] = address.Pack(true)

1683 }

1684

1685 origLP := address.Localpart

1686 dc := c.Domains[address.Domain.Name()]

1687 domainHasAddress[address.Domain.Name()] = true

1688 lp := CanonicalLocalpart(address.Localpart, dc)

1689 var hasSep bool

1690 for _, sep := range dc.LocalpartCatchallSeparatorsEffective {

1691 if strings.Contains(string(address.Localpart), sep) {

1692 hasSep = true

1693 addDestErrorf("localpart of address %s includes domain catchall separator %s", address, sep)

1694 }

1695 }

1696 if !hasSep {

1697 address.Localpart = lp

1698 }

1699 addrFull := address.Pack(true)

1700 if _, ok := accDests[addrFull]; ok {

1701 addDestErrorf("duplicate canonicalized destination address %s", addrFull)

1702 }

1703 accDests[addrFull] = AccountDestination{false, origLP, accName, dest}

1704 }

1705

1706 for lp, addr := range replaceLocalparts {

1707 dest, ok := acc.Destinations[lp]

1708 if !ok {

1709 addAccountErrorf("could not find localpart %q to replace with address in destinations", lp)

1710 } else {

1711 log.Warn(`deprecation warning: support for account destination addresses specified as just localpart ("username") instead of full email address will be removed in the future; update domains.conf, for each Account, for each Destination, ensure each key is an email address by appending "@" and the default domain for the account`,

1712 slog.Any("localpart", lp),

1713 slog.Any("address", addr),

1714 slog.String("account", accName))

1715 acc.Destinations[addr] = dest

1716 delete(acc.Destinations, lp)

1717 }

1718 }

1719

1720 // Now that all addresses are parsed, check if all fromid login addresses match

1721 // configured addresses.

1722 for i, a := range acc.ParsedFromIDLoginAddresses {

1723 // For domain catchall.