Import upstream v0.16.22, stripped

Upstream commit: 474dd0229cb20cf513036619781ed97bd8073c3f
Enterprise-only files removed or emptied: 63
Enterprise-only snippets removed: 117 in 50 files
Dangling module declarations removed: 5
Cargo edits turning enterprise off: 14
Verification: clean
Enterprise feature gates left for rebuilt features: 19 in 18 files

Produced by tools/fork/strip.py. The full report is in docs/fork/strip-reports/ on main.
This commit is contained in:
2026-09-18 10:21:56 -07:00
commit 7dae9b29fd
1650 changed files with 485521 additions and 0 deletions
+288
View File
@@ -0,0 +1,288 @@
/*
* SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
*
* SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
*/
use super::{Command, ResponseCode, SerializeResponse, Session, State};
use common::{
KV_RATE_LIMIT_IMAP,
network::{SessionResult, SessionStream},
};
use imap_proto::receiver::{self, Request};
use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt};
use trc::{AddContext, SecurityEvent};
use types::{collection::Collection, field::SieveField};
impl<T: SessionStream> Session<T> {
pub async fn ingest(&mut self, bytes: &[u8]) -> SessionResult {
let mut bytes = bytes.iter();
let mut requests = Vec::with_capacity(2);
let mut needs_literal = None;
loop {
match self.receiver.parse(&mut bytes) {
Ok(request) => match self.validate_request(request).await {
Ok(request) => {
requests.push(request);
}
Err(err) => {
let mut disconnect = err.must_disconnect();
if let Err(err) = self.write_error(err).await {
trc::error!(err.span_id(self.session_id));
disconnect = true;
}
if disconnect {
return SessionResult::Close;
}
}
},
Err(receiver::Error::NeedsMoreData) => {
break;
}
Err(receiver::Error::NeedsLiteral { size }) => {
needs_literal = size.into();
break;
}
Err(receiver::Error::Error { response }) => {
// Check for port scanners
if matches!(
(&self.state, response.key(trc::Key::Code)),
(
State::NotAuthenticated { .. },
Some(trc::Value::String(v))
) if v == "PARSE"
) {
match self.server.is_scanner_fail2banned(self.remote_addr).await {
Ok(true) => {
trc::event!(
Security(SecurityEvent::ScanBan),
SpanId = self.session_id,
RemoteIp = self.remote_addr,
Reason = "Invalid ManageSieve command",
);
return SessionResult::Close;
}
Ok(false) => {}
Err(err) => {
trc::error!(
err.span_id(self.session_id)
.details("Failed to check for fail2ban")
);
}
}
}
if let Err(err) = self.write_error(response).await {
trc::error!(err.span_id(self.session_id));
return SessionResult::Close;
}
break;
}
}
}
for request in requests {
let command = request.command;
match match command {
Command::ListScripts => self.handle_listscripts().await,
Command::PutScript => self.handle_putscript(request).await,
Command::SetActive => self.handle_setactive(request).await,
Command::GetScript => self.handle_getscript(request).await,
Command::DeleteScript => self.handle_deletescript(request).await,
Command::RenameScript => self.handle_renamescript(request).await,
Command::CheckScript => self.handle_checkscript(request).await,
Command::HaveSpace => self.handle_havespace(request).await,
Command::Capability => self.handle_capability("").await,
Command::Authenticate => Box::pin(self.handle_authenticate(request)).await,
Command::StartTls => self.handle_start_tls().await,
Command::Logout => self.handle_logout().await,
Command::Noop => self.handle_noop(request).await,
Command::Unauthenticate => self.handle_unauthenticate().await,
} {
Ok(response) => {
if let Err(err) = self.write(&response).await {
trc::error!(err.span_id(self.session_id));
return SessionResult::Close;
}
match command {
Command::Logout => return SessionResult::Close,
Command::StartTls => return SessionResult::UpgradeTls,
_ => (),
}
}
Err(err) => {
let mut disconnect = err.must_disconnect();
if let Err(err) = self.write_error(err).await {
trc::error!(err.span_id(self.session_id));
disconnect = true;
}
if disconnect {
return SessionResult::Close;
}
}
}
}
if let Some(needs_literal) = needs_literal
&& let Err(err) = self
.write(format!("OK Ready for {} bytes.\r\n", needs_literal).as_bytes())
.await
{
trc::error!(err.span_id(self.session_id));
return SessionResult::Close;
}
SessionResult::Continue
}
async fn validate_request(&self, command: Request<Command>) -> trc::Result<Request<Command>> {
match &command.command {
Command::Capability | Command::Logout | Command::Noop => Ok(command),
Command::Authenticate => {
if let State::NotAuthenticated { .. } = &self.state {
if self.stream.is_tls() || self.server.core.imap.allow_plain_auth {
Ok(command)
} else {
Err(trc::ManageSieveEvent::Error
.into_err()
.code(ResponseCode::EncryptNeeded)
.details("Cannot authenticate over plain-text."))
}
} else {
Err(trc::ManageSieveEvent::Error
.into_err()
.details("Already authenticated."))
}
}
Command::StartTls => {
if !self.stream.is_tls() {
Ok(command)
} else {
Err(trc::ManageSieveEvent::Error
.into_err()
.details("Already in TLS mode."))
}
}
Command::HaveSpace
| Command::PutScript
| Command::ListScripts
| Command::SetActive
| Command::GetScript
| Command::DeleteScript
| Command::RenameScript
| Command::CheckScript
| Command::Unauthenticate => {
if let State::Authenticated { access_token, .. } = &self.state {
if let Some(rate) = &self.server.core.imap.rate_requests {
if self
.server
.in_memory_store()
.is_rate_allowed(
KV_RATE_LIMIT_IMAP,
&access_token.account_id().to_be_bytes(),
rate,
true,
)
.await
.caused_by(trc::location!())?
.is_none()
{
Ok(command)
} else {
Err(trc::LimitEvent::TooManyRequests
.into_err()
.code(ResponseCode::TryLater))
}
} else {
Ok(command)
}
} else {
Err(trc::ManageSieveEvent::Error
.into_err()
.details("Not authenticated."))
}
}
}
}
}
impl<T: AsyncWrite + AsyncRead + Unpin> Session<T> {
#[inline(always)]
pub async fn write(&mut self, bytes: &[u8]) -> trc::Result<()> {
trc::event!(
ManageSieve(trc::ManageSieveEvent::RawOutput),
SpanId = self.session_id,
Size = bytes.len(),
Contents = trc::Value::from_maybe_string(bytes),
);
self.stream.write_all(bytes).await.map_err(|err| {
trc::NetworkEvent::WriteError
.into_err()
.reason(err)
.caused_by(trc::location!())
})?;
self.stream.flush().await.map_err(|err| {
trc::NetworkEvent::FlushError
.into_err()
.reason(err)
.caused_by(trc::location!())
})?;
Ok(())
}
pub async fn write_error(&mut self, error: trc::Error) -> trc::Result<()> {
let bytes = error.serialize();
trc::error!(error.span_id(self.session_id));
self.write(&bytes).await
}
#[inline(always)]
pub async fn read(&mut self, bytes: &mut [u8]) -> trc::Result<usize> {
let len = self.stream.read(bytes).await.map_err(|err| {
trc::NetworkEvent::ReadError
.into_err()
.reason(err)
.caused_by(trc::location!())
})?;
trc::event!(
ManageSieve(trc::ManageSieveEvent::RawInput),
SpanId = self.session_id,
Size = len,
Contents = trc::Value::from_maybe_string(bytes.get(0..len).unwrap_or_default()),
);
Ok(len)
}
}
impl<T: AsyncWrite + AsyncRead> Session<T> {
pub async fn get_script_id(&self, account_id: u32, name: &str) -> trc::Result<u32> {
self.server
.document_ids_matching(
account_id,
Collection::SieveScript,
SieveField::Name,
name.to_lowercase().as_bytes(),
)
.await
.caused_by(trc::location!())
.and_then(|results| {
results.min().ok_or_else(|| {
trc::ManageSieveEvent::Error
.into_err()
.code(ResponseCode::NonExistent)
.reason("There is no script by that name")
})
})
}
}
+314
View File
@@ -0,0 +1,314 @@
/*
* SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
*
* SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
*/
pub mod client;
pub mod session;
use std::{borrow::Cow, net::IpAddr, sync::Arc};
use common::{
Inner, Server,
auth::AccessToken,
network::{ServerInstance, limiter::InFlight},
};
use compact_str::CompactString;
use imap_proto::receiver::{CommandParser, Receiver};
use tokio::io::{AsyncRead, AsyncWrite};
pub struct Session<T: AsyncRead + AsyncWrite> {
pub server: Server,
pub instance: Arc<ServerInstance>,
pub receiver: Receiver<Command>,
pub state: State,
pub remote_addr: IpAddr,
pub stream: T,
pub session_id: u64,
pub in_flight: InFlight,
}
pub enum State {
NotAuthenticated {
auth_failures: u32,
},
Authenticated {
access_token: AccessToken,
in_flight: Option<InFlight>,
},
}
impl State {
pub fn access_token(&self) -> &AccessToken {
match self {
State::Authenticated { access_token, .. } => access_token,
State::NotAuthenticated { .. } => unreachable!("Not authenticated"),
}
}
}
#[derive(Clone)]
pub struct ManageSieveSessionManager {
pub inner: Arc<Inner>,
}
impl ManageSieveSessionManager {
pub fn new(inner: Arc<Inner>) -> Self {
Self { inner }
}
}
#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
pub enum Command {
Authenticate,
StartTls,
Logout,
Capability,
HaveSpace,
PutScript,
ListScripts,
SetActive,
GetScript,
DeleteScript,
RenameScript,
CheckScript,
#[default]
Noop,
Unauthenticate,
}
impl CommandParser for Command {
fn parse(value: &[u8], _is_uid: bool) -> Option<Self> {
match value {
b"AUTHENTICATE" => Some(Command::Authenticate),
b"STARTTLS" => Some(Command::StartTls),
b"LOGOUT" => Some(Command::Logout),
b"CAPABILITY" => Some(Command::Capability),
b"HAVESPACE" => Some(Command::HaveSpace),
b"PUTSCRIPT" => Some(Command::PutScript),
b"LISTSCRIPTS" => Some(Command::ListScripts),
b"SETACTIVE" => Some(Command::SetActive),
b"GETSCRIPT" => Some(Command::GetScript),
b"DELETESCRIPT" => Some(Command::DeleteScript),
b"RENAMESCRIPT" => Some(Command::RenameScript),
b"CHECKSCRIPT" => Some(Command::CheckScript),
b"NOOP" => Some(Command::Noop),
b"UNAUTHENTICATE" => Some(Command::Unauthenticate),
_ => None,
}
}
fn tokenize_brackets(&self) -> bool {
false
}
}
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct StatusResponse {
pub code: Option<ResponseCode>,
pub message: Cow<'static, str>,
pub rtype: ResponseType,
}
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum ResponseType {
Ok,
No,
Bye,
}
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum ResponseCode {
AuthTooWeak,
EncryptNeeded,
Quota,
QuotaMaxScripts,
QuotaMaxSize,
Referral,
Sasl,
TransitionNeeded,
TryLater,
Active,
NonExistent,
AlreadyExists,
Tag(String),
Warnings,
}
impl ResponseCode {
pub fn serialize(&self, buf: &mut Vec<u8>) {
buf.extend_from_slice(match self {
ResponseCode::AuthTooWeak => b"AUTH-TOO-WEAK",
ResponseCode::EncryptNeeded => b"ENCRYPT-NEEDED",
ResponseCode::Quota => b"QUOTA",
ResponseCode::QuotaMaxScripts => b"QUOTA/MAXSCRIPTS",
ResponseCode::QuotaMaxSize => b"QUOTA/MAXSIZE",
ResponseCode::Referral => b"REFERRAL",
ResponseCode::Sasl => b"SASL",
ResponseCode::TransitionNeeded => b"TRANSITION-NEEDED",
ResponseCode::TryLater => b"TRYLATER",
ResponseCode::Active => b"ACTIVE",
ResponseCode::NonExistent => b"NONEXISTENT",
ResponseCode::AlreadyExists => b"ALREADYEXISTS",
ResponseCode::Tag(tag) => {
buf.extend_from_slice(b"TAG {");
buf.extend_from_slice(tag.len().to_string().as_bytes());
buf.extend_from_slice(b"}\r\n");
buf.extend_from_slice(tag.as_bytes());
return;
}
ResponseCode::Warnings => b"WARNINGS",
});
}
pub fn as_str(&self) -> &'static str {
match self {
ResponseCode::AuthTooWeak => "AUTH-TOO-WEAK",
ResponseCode::EncryptNeeded => "ENCRYPT-NEEDED",
ResponseCode::Quota => "QUOTA",
ResponseCode::QuotaMaxScripts => "QUOTA/MAXSCRIPTS",
ResponseCode::QuotaMaxSize => "QUOTA/MAXSIZE",
ResponseCode::Referral => "REFERRAL",
ResponseCode::Sasl => "SASL",
ResponseCode::TransitionNeeded => "TRANSITION-NEEDED",
ResponseCode::TryLater => "TRYLATER",
ResponseCode::Active => "ACTIVE",
ResponseCode::NonExistent => "NONEXISTENT",
ResponseCode::AlreadyExists => "ALREADYEXISTS",
ResponseCode::Tag(_) => "TAG",
ResponseCode::Warnings => "WARNINGS",
}
}
}
impl ResponseType {
pub fn serialize(&self, buf: &mut Vec<u8>) {
buf.extend_from_slice(self.as_str().as_bytes());
}
pub fn as_str(&self) -> &'static str {
match self {
ResponseType::Ok => "OK",
ResponseType::No => "NO",
ResponseType::Bye => "BYE",
}
}
}
impl StatusResponse {
pub fn serialize(self, mut buf: Vec<u8>) -> Vec<u8> {
self.rtype.serialize(&mut buf);
if let Some(code) = &self.code {
buf.extend_from_slice(b" (");
code.serialize(&mut buf);
buf.push(b')');
}
if !self.message.is_empty() {
buf.extend_from_slice(b" \"");
for ch in self.message.as_bytes() {
if b"\"\\".contains(ch) {
buf.push(b'\\');
}
buf.push(*ch);
}
buf.push(b'\"');
}
buf.extend_from_slice(b"\r\n");
buf
}
pub fn into_bytes(self) -> Vec<u8> {
self.serialize(Vec::with_capacity(16))
}
pub fn with_code(mut self, code: ResponseCode) -> Self {
self.code = Some(code);
self
}
pub fn no(message: impl Into<Cow<'static, str>>) -> Self {
StatusResponse {
code: None,
message: message.into(),
rtype: ResponseType::No,
}
}
pub fn ok(message: impl Into<Cow<'static, str>>) -> Self {
StatusResponse {
code: None,
message: message.into(),
rtype: ResponseType::Ok,
}
}
pub fn bye(message: impl Into<Cow<'static, str>>) -> Self {
StatusResponse {
code: None,
message: message.into(),
rtype: ResponseType::Bye,
}
}
pub fn database_failure() -> Self {
StatusResponse {
code: Some(ResponseCode::TryLater),
message: Cow::Borrowed("Database failure"),
rtype: ResponseType::No,
}
}
}
pub trait SerializeResponse {
fn serialize(&self) -> Vec<u8>;
}
impl SerializeResponse for trc::Error {
fn serialize(&self) -> Vec<u8> {
let mut buf = Vec::with_capacity(64);
buf.extend_from_slice(self.value_as_str(trc::Key::Type).unwrap_or("NO").as_bytes());
if let Some(code) = self
.value_as_str(trc::Key::Code)
.or_else(|| match self.as_ref() {
trc::EventType::Store(trc::StoreEvent::NotFound) => {
Some(ResponseCode::NonExistent.as_str())
}
trc::EventType::Store(_) => Some(ResponseCode::TryLater.as_str()),
trc::EventType::Limit(trc::LimitEvent::Quota) => Some(ResponseCode::Quota.as_str()),
trc::EventType::Limit(_) => Some(ResponseCode::TryLater.as_str()),
_ => None,
})
{
buf.extend_from_slice(b" (");
buf.extend_from_slice(code.as_bytes());
buf.push(b')');
}
let message = self
.value_as_str(trc::Key::Details)
.unwrap_or_else(|| self.as_ref().message());
buf.extend_from_slice(b" \"");
for ch in message.as_bytes() {
if b"\"\\".contains(ch) {
buf.push(b'\\');
}
buf.push(*ch);
}
buf.push(b'\"');
buf.extend_from_slice(b"\r\n");
buf
}
}
impl From<ResponseCode> for trc::Value {
fn from(value: ResponseCode) -> Self {
trc::Value::String(CompactString::const_new(value.as_str()))
}
}
impl From<ResponseType> for trc::Value {
fn from(value: ResponseType) -> Self {
trc::Value::String(CompactString::const_new(value.as_str()))
}
}
+151
View File
@@ -0,0 +1,151 @@
/*
* SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
*
* SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
*/
use super::{ManageSieveSessionManager, Session, State};
use crate::SERVER_GREETING;
use common::{
BuildServer,
network::{SessionData, SessionManager, SessionResult, SessionStream},
};
use imap_proto::receiver::{self, Receiver};
use tokio_rustls::server::TlsStream;
impl SessionManager for ManageSieveSessionManager {
#[allow(clippy::manual_async_fn)]
fn handle<T: SessionStream>(
self,
session: SessionData<T>,
) -> impl std::future::Future<Output = ()> + Send {
async move {
// Create session
let server = self.inner.build_server();
let mut session = Session {
receiver: Receiver::with_max_request_size(server.core.imap.max_request_size)
.with_start_state(receiver::State::Command { is_uid: false }),
server,
instance: session.instance,
state: State::NotAuthenticated { auth_failures: 0 },
session_id: session.session_id,
stream: session.stream,
in_flight: session.in_flight,
remote_addr: session.remote_ip,
};
if session
.write(&session.handle_capability(SERVER_GREETING).await.unwrap())
.await
.is_ok()
&& session.handle_conn().await
&& session.instance.acceptor.is_tls()
&& let Ok(mut session) = session.into_tls().await
{
let _ = session
.write(&session.handle_capability(SERVER_GREETING).await.unwrap())
.await;
session.handle_conn().await;
}
}
}
#[allow(clippy::manual_async_fn)]
fn shutdown(&self) -> impl std::future::Future<Output = ()> + Send {
async {}
}
}
impl<T: SessionStream> Session<T> {
pub async fn handle_conn(&mut self) -> bool {
let mut buf = vec![0; 8192];
let mut shutdown_rx = self.instance.shutdown_rx.clone();
loop {
tokio::select! {
result = tokio::time::timeout(
if !matches!(self.state, State::NotAuthenticated {..}) {
self.server.core.imap.timeout_auth
} else {
self.server.core.imap.timeout_unauth
},
self.read(&mut buf)) => {
match result {
Ok(Ok(bytes_read)) => {
if bytes_read > 0 {
match self.ingest(&buf[..bytes_read]).await {
SessionResult::Continue => (),
SessionResult::UpgradeTls => {
return true;
}
SessionResult::Close => {
break;
}
}
} else {
trc::event!(
Network(trc::NetworkEvent::Closed),
SpanId = self.session_id,
CausedBy = trc::location!()
);
break;
}
}
Ok(Err(err)) => {
trc::event!(
Network(trc::NetworkEvent::ReadError),
SpanId = self.session_id,
Reason = err,
CausedBy = trc::location!()
);
break;
}
Err(_) => {
trc::event!(
Network(trc::NetworkEvent::Timeout),
SpanId = self.session_id,
CausedBy = trc::location!()
);
self
.write(b"BYE \"Connection timed out.\"\r\n")
.await
.ok();
break;
}
}
},
_ = shutdown_rx.changed() => {
trc::event!(
Network(trc::NetworkEvent::Closed),
SpanId = self.session_id,
Reason = "Server shutting down",
CausedBy = trc::location!()
);
self.write(b"BYE \"Server shutting down.\"\r\n").await.ok();
break;
}
};
}
false
}
pub async fn into_tls(self) -> Result<Session<TlsStream<T>>, ()> {
let receiver = Receiver::with_max_request_size(self.server.core.imap.max_request_size)
.with_start_state(receiver::State::Command { is_uid: false });
Ok(Session {
stream: self
.instance
.tls_accept(self.stream, self.session_id)
.await?,
state: self.state,
instance: self.instance,
in_flight: self.in_flight,
session_id: self.session_id,
server: self.server,
receiver,
remote_addr: self.remote_addr,
})
}
}