jambotron_gang/reactive-mail-server
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Безопасность, SMTP, очередь отправки, DKIM, деплой на Jambotron (Jambotron v0.2.3 75.1–75.3)

Browse Source 
- SMTP-сервер переписан: разбор по строкам, AUTH PLAIN/LOGIN, нет открытого релея,
  MAIL FROM только свой после входа, 250 только после сохранения (иначе 451), лимит размера
- отправка наружу: очередь outbound_queue (V2) с повторами ~22 ч и уведомлением о недоставке;
  Jakarta Mail, режимы off / mx / smarthost, байты письма не меняются (DKIM)
- DKIM: подпись utils-mail-dkim, проверка Apache jDKIM; ключ PKCS#8, старый PKCS#1 читается
- права: письма, папки, вложения — только владельцу (было: любой по номеру); имена вложений без ../
- секреты без значений по умолчанию (DB_PASSWORD, JWT_SECRET), регистрация закрыта,
  admin123 и /api/simulate/receive — только профиль dev
- веб-клиент внутри jar (относительный /api), Dockerfile в 3 этапа, не root, health;
  docker-compose.jambotron.yml: секреты создаются при первом запуске, наружу только 8080
- gradle-wrapper.jar был в .gitignore — сборка не запускалась
- тесты: 26 (SMTP реальным клиентом и сокетом, GreenMail, DKIM подпись+проверка, очередь)

α
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
jambotron α
2026-11-05 03:37:43 +01:00
parent b6f6d41813
commit 165edf1a1e
44 changed files with 2626 additions and 1715 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/main/java/com/mailserver/config/DataInitializer.java
+28 -6
View File
@@ -4,24 +4,46 @@ import com.mailserver.repository.UserRepository;
import com.mailserver.service.UserService;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.CommandLineRunner;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import java.security.SecureRandom;
import java.util.Base64;
/**
* First mailbox on an empty database: {@code mailserver.admin.email} (default admin@&lt;first domain&gt;) with
* {@code mailserver.admin.password}; no password given — a random one, printed to the log once.
*/
@Configuration
public class DataInitializer {
private static final Logger log = LoggerFactory.getLogger(DataInitializer.class);
@Bean
public CommandLineRunner initDatabase(UserService userService, UserRepository userRepository) {
public CommandLineRunner initDatabase(UserService userService, UserRepository userRepository, MailDomains domains,
@Value("${mailserver.admin.email:}") String email,
@Value("${mailserver.admin.password:}") String password) {
return args -> {
userRepository.count().block(); // Ждём инициализации
if (userRepository.count().block() == 0) {
log.info("База данных пуста, создаю тестового пользователя...");
userService.register("admin@mailserver.local", "admin123", "Администратор").block();
log.info("✓ Тестовый пользователь создан: admin@mailserver.local / admin123");
if (userRepository.count().block() > 0) {
return;
}
String address = email.isBlank() ? "admin@" + domains.domains().iterator().next() : email.trim().toLowerCase();
boolean generated = password.isBlank();
String secret = generated ? randomPassword() : password;
userService.register(address, secret, "Administrator").block();
if (generated) {
log.warn("First mailbox created: {} — password: {} (shown once, change it)", address, secret);
} else {
log.info("First mailbox created: {}", address);
}
};
}
private static String randomPassword() {
byte[] bytes = new byte[18];
new SecureRandom().nextBytes(bytes);
return Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);
}
}
backend/src/main/java/com/mailserver/config/JwtConfig.java
+7 -4
View File
@@ -5,14 +5,17 @@ import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import java.nio.charset.StandardCharsets;
@Configuration
public class JwtConfig {
@Value("${jwt.secret:MailServerSecretKeyForJWTTokenGenerationMustBeLongEnough2024!}")
private String jwtSecret;
/** JWT_SECRET from the environment, at least 32 bytes; no default — a known key would let anyone log in. */
@Bean
public JwtUtils jwtUtils() {
public JwtUtils jwtUtils(@Value("${jwt.secret:}") String jwtSecret) {
if (jwtSecret.getBytes(StandardCharsets.UTF_8).length < 32) {
throw new IllegalStateException("jwt.secret (JWT_SECRET) must be set, at least 32 bytes");
}
return new JwtUtils(jwtSecret);
}
}
backend/src/main/java/com/mailserver/config/MailDomains.java
+51
View File
@@ -0,0 +1,51 @@
package com.mailserver.config;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;
import java.util.Arrays;
import java.util.Locale;
import java.util.Set;
import java.util.stream.Collectors;
/**
* Domains whose mailboxes live on this server ({@code mailserver.domains}), and the optional catch-all mailbox
* ({@code mailserver.catch-all}): when set, mail to ANY address is stored there and nothing is delivered outside —
* a mail trap for dev/staging.
*/
@Component
public class MailDomains {
private final Set<String> domains;
private final String catchAll;
public MailDomains(@Value("${mailserver.domains:localhost}") String domains,
@Value("${mailserver.catch-all:}") String catchAll) {
this.domains = Arrays.stream(domains.split(","))
.map(d -> d.trim().toLowerCase(Locale.ROOT))
.filter(d -> !d.isEmpty())
.collect(Collectors.toUnmodifiableSet());
this.catchAll = catchAll.trim().toLowerCase(Locale.ROOT);
if (this.domains.isEmpty()) {
throw new IllegalStateException("mailserver.domains is empty");
}
}
public boolean isLocal(String address) {
return domains.contains(domainOf(address));
}
/** Mailbox that receives everything, or null. */
public String catchAll() {
return catchAll.isEmpty() ? null : catchAll;
}
public Set<String> domains() {
return domains;
}
public static String domainOf(String address) {
int at = address == null ? -1 : address.lastIndexOf('@');
return at < 0 ? "" : address.substring(at + 1).toLowerCase(Locale.ROOT);
}
}
backend/src/main/java/com/mailserver/config/MailServerConfig.java
+52
View File
@@ -0,0 +1,52 @@
package com.mailserver.config;
import com.mailserver.delivery.SmtpDeliveryClient;
import com.mailserver.smtp.MailRouter;
import com.mailserver.smtp.SmtpServer;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.scheduling.annotation.EnableScheduling;
import java.time.Duration;
import java.util.Locale;
/** SMTP server, outbound delivery client and the queue scheduler. */
@Configuration
@EnableScheduling
public class MailServerConfig {
@Bean(initMethod = "start", destroyMethod = "stop")
@ConditionalOnProperty(name = "mailserver.smtp.enabled", havingValue = "true", matchIfMissing = true)
public SmtpServer smtpServer(MailRouter router,
@Value("${mailserver.smtp.host:0.0.0.0}") String host,
@Value("${mailserver.smtp.port:3025}") int port,
@Value("${mailserver.smtp.hostname:localhost}") String hostname,
@Value("${mailserver.smtp.max-message-bytes:26214400}") long maxBytes,
@Value("${mailserver.smtp.auth-without-tls:false}") boolean authWithoutTls,
@Value("${mailserver.smtp.idle-timeout:5m}") Duration idleTimeout) {
return new SmtpServer(new SmtpServer.Settings(host, port, hostname, maxBytes, authWithoutTls, idleTimeout), router);
}
/**
* mailserver.outbound.mode: off | mx | smarthost. For smarthost — host, port, username, password,
* tls (starttls | ssl | none).
*/
@Bean
public SmtpDeliveryClient smtpDeliveryClient(@Value("${mailserver.outbound.mode:off}") String mode,
@Value("${mailserver.outbound.host:}") String host,
@Value("${mailserver.outbound.port:587}") int port,
@Value("${mailserver.outbound.username:}") String username,
@Value("${mailserver.outbound.password:}") String password,
@Value("${mailserver.outbound.tls:starttls}") String tls,
@Value("${mailserver.smtp.hostname:localhost}") String hostname,
@Value("${mailserver.outbound.timeout-ms:30000}") int timeoutMs) {
SmtpDeliveryClient.Mode m = SmtpDeliveryClient.Mode.valueOf(mode.trim().toUpperCase(Locale.ROOT));
if (m == SmtpDeliveryClient.Mode.SMARTHOST && host.isBlank()) {
throw new IllegalStateException("mailserver.outbound.mode=smarthost needs mailserver.outbound.host");
}
return new SmtpDeliveryClient(new SmtpDeliveryClient.Settings(m, host, port, username, password,
SmtpDeliveryClient.Tls.valueOf(tls.trim().toUpperCase(Locale.ROOT)), hostname, timeoutMs, 25));
}
}
backend/src/main/java/com/mailserver/config/SecurityConfig.java
+10 -4
View File
@@ -16,15 +16,19 @@ import org.springframework.web.cors.reactive.UrlBasedCorsConfigurationSource;
public class SecurityConfig {
private final JwtAuthenticationFilter jwtAuthenticationFilter;
private final String corsOrigins;
public SecurityConfig(JwtAuthenticationFilter jwtAuthenticationFilter) {
public SecurityConfig(JwtAuthenticationFilter jwtAuthenticationFilter,
@org.springframework.beans.factory.annotation.Value("${mailserver.cors.origins:}") String corsOrigins) {
this.jwtAuthenticationFilter = jwtAuthenticationFilter;
this.corsOrigins = corsOrigins;
}
@Bean
public CorsConfigurationSource corsConfigurationSource() {
CorsConfiguration configuration = new CorsConfiguration();
configuration.setAllowedOrigins(java.util.Arrays.asList("http://localhost:4200", "http://localhost:4201"));
// The web client is served from the same origin; other origins only for development (ng serve)
configuration.setAllowedOrigins(java.util.Arrays.stream(corsOrigins.split(",")).map(String::trim).filter(o -> !o.isEmpty()).toList());
configuration.setAllowedMethods(java.util.Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS"));
configuration.setAllowedHeaders(java.util.Arrays.asList("Authorization", "Content-Type", "Accept", "X-Requested-With"));
configuration.setAllowCredentials(true);
@@ -40,8 +44,10 @@ public class SecurityConfig {
.csrf(ServerHttpSecurity.CsrfSpec::disable)
.cors(cors -> cors.configurationSource(corsConfigurationSource()))
.authorizeExchange(exchange -> exchange
.pathMatchers("/api/login", "/api/register").permitAll()
.anyExchange().authenticated()
.pathMatchers("/api/login", "/api/register", "/actuator/health").permitAll()
.pathMatchers("/api/**", "/actuator/**").authenticated()
// the web client (static files, SPA routes)
.anyExchange().permitAll()
)
.addFilterAt(jwtAuthenticationFilter, SecurityWebFiltersOrder.AUTHENTICATION);
backend/src/main/java/com/mailserver/config/SmtpServerConfig.java
-379
View File
@@ -1,379 +0,0 @@
package com.mailserver.config;
import com.mailserver.service.DkimService;
import com.mailserver.service.DmarcService;
import com.mailserver.service.MailService;
import com.mailserver.service.SmtpRelayService;
import com.mailserver.service.SpfService;
import jakarta.annotation.PostConstruct;
import jakarta.annotation.PreDestroy;
import jakarta.mail.MessagingException;
import jakarta.mail.Session;
import jakarta.mail.internet.AddressException;
import jakarta.mail.internet.InternetAddress;
import jakarta.mail.internet.MimeMessage;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Configuration;
import reactor.core.publisher.Mono;
import reactor.core.publisher.Sinks;
import reactor.netty.DisposableServer;
import reactor.netty.tcp.TcpServer;
import java.io.*;
import java.nio.charset.StandardCharsets;
import java.util.*;
/**
* Встроенный SMTP-сервер на Spring WebFlux (TcpServer).
* Поддерживает команды: HELO/EHLO, MAIL FROM, RCPT TO, DATA, QUIT, RSET, NOOP.
* Обрабатывает входящие письма и сохраняет их через MailService.
*/
@Configuration
public class SmtpServerConfig {
private static final Logger log = LoggerFactory.getLogger(SmtpServerConfig.class);
private final MailService mailService;
private final SmtpRelayService smtpRelayService;
private final DkimService dkimService;
private final SpfService spfService;
private final DmarcService dmarcService;
@Value("${mailserver.smtp.port:3025}")
private int smtpPort;
@Value("${mailserver.smtp.hostname:localhost}")
private String smtpHostname;
@Value("${mailserver.smtp.enabled:true}")
private boolean enabled;
private DisposableServer disposableServer;
private final Map<String, String> capabilities = new HashMap<>();
public SmtpServerConfig(MailService mailService, SmtpRelayService smtpRelayService,
DkimService dkimService,
SpfService spfService, DmarcService dmarcService) {
this.mailService = mailService;
this.smtpRelayService = smtpRelayService;
this.dkimService = dkimService;
this.spfService = spfService;
this.dmarcService = dmarcService;
capabilities.put("SIZE", "10485760");
capabilities.put("8BITMIME", "");
capabilities.put("ENHANCEDSTATUSCODES", "");
capabilities.put("PIPELINING", "");
}
@PostConstruct
public void start() {
if (!enabled) {
log.info("SMTP-сервер отключён (mailserver.smtp.enabled=false)");
return;
}
try {
disposableServer = TcpServer.create()
.port(smtpPort)
.handle((inbound, outbound) ->
outbound.sendString(Mono.just("220 " + smtpHostname + " ESMTP ready\r\n"))
.then(handleSmtpSession(inbound, outbound))
)
.bind()
.block(java.time.Duration.ofSeconds(10));
log.info("SMTP-сервер запущен на порту {} (хост: {})", smtpPort, smtpHostname);
} catch (Exception e) {
log.error("Не удалось запустить SMTP-сервер на порту {}: {}", smtpPort, e.getMessage());
// Не бросаем исключение, чтобы приложение могло стартовать без SMTP
}
}
@PreDestroy
public void stop() {
if (disposableServer != null) {
try {
disposableServer.dispose();
} catch (Exception e) {
log.warn("Ошибка при остановке SMTP-сервера: {}", e.getMessage());
}
log.info("SMTP-сервер остановлен");
}
}
private Mono<Void> handleSmtpSession(reactor.netty.NettyInbound inbound,
reactor.netty.NettyOutbound outbound) {
SmtpSession session = new SmtpSession();
return inbound.receive()
.asString(StandardCharsets.UTF_8)
.doOnNext(line -> log.debug("SMTP: команда: {}", line.trim()))
.concatMap(line -> {
line = line.trim();
if (line.isEmpty()) {
return Mono.empty();
}
String[] parts = line.split("\\s+", 2);
String command = parts[0].toUpperCase();
String argument = parts.length > 1 ? parts[1] : "";
switch (command) {
case "HELO": {
session.helo = true;
session.ehlo = false;
session.hostname = argument;
return Mono.just("250 " + smtpHostname + " Hello " + argument + "\r\n");
}
case "EHLO": {
session.helo = true;
session.ehlo = true;
session.hostname = argument;
return Mono.just(buildEhloResponse(argument));
}
case "MAIL": {
if (!session.helo) {
return Mono.just("503 Hello required first\r\n");
}
String mailFrom = extractEmail(argument);
if (mailFrom == null) {
return Mono.just("501 Syntax: MAIL FROM:<address>\r\n");
}
session.mailFrom = mailFrom;
return Mono.just("250 OK\r\n");
}
case "RCPT": {
if (!session.helo) {
return Mono.just("503 Hello required first\r\n");
}
if (session.mailFrom == null) {
return Mono.just("503 MAIL required first\r\n");
}
String rcptTo = extractEmail(argument);
if (rcptTo == null) {
return Mono.just("501 Syntax: RCPT TO:<address>\r\n");
}
session.recipients.add(rcptTo);
return Mono.just("250 OK\r\n");
}
case "DATA": {
if (!session.helo) {
return Mono.just("503 Hello required first\r\n");
}
if (session.mailFrom == null) {
return Mono.just("503 MAIL required first\r\n");
}
if (session.recipients.isEmpty()) {
return Mono.just("503 RCPT required first\r\n");
}
session.dataReady = true;
return Mono.just("354 Start mail input; end with <CRLF>.<CRLF>\r\n");
}
case "QUIT": {
session.quit = true;
return Mono.just("221 " + smtpHostname + " Bye\r\n");
}
case "RSET": {
session.reset();
return Mono.just("250 OK\r\n");
}
case "NOOP":
return Mono.just("250 OK\r\n");
case "VRFY":
return Mono.just("252 Cannot VRFY user but will accept message\r\n");
case "EXPN":
return Mono.just("252 Cannot EXPN user but will accept message\r\n");
default: {
// Если в режиме DATA, накапливаем тело
if (session.dataReady) {
if (line.equals(".")) {
session.dataReady = false;
String body = session.dataBody.toString();
for (String recipient : session.recipients) {
try {
processIncomingMail(session.mailFrom, recipient, body);
} catch (Exception e) {
log.error("SMTP: ошибка обработки письма для {}: {}", recipient, e.getMessage());
}
}
session.reset();
session.dataBody.setLength(0);
return Mono.just("250 OK: message accepted\r\n");
} else {
if (line.startsWith(".")) {
session.dataBody.append(line.substring(1));
} else {
session.dataBody.append(line);
}
session.dataBody.append("\n");
return Mono.empty();
}
} else {
return Mono.just("502 Command not implemented\r\n");
}
}
}
})
.filter(s -> !s.isEmpty())
.transform(outbound::sendString)
.then();
}
private String buildEhloResponse(String hostname) {
StringBuilder sb = new StringBuilder();
sb.append("250-").append(smtpHostname).append(" Hello ").append(hostname).append("\r\n");
for (Map.Entry<String, String> cap : capabilities.entrySet()) {
if (cap.getValue() != null && !cap.getValue().isEmpty()) {
sb.append("250-").append(cap.getKey()).append(" ").append(cap.getValue()).append("\r\n");
} else {
sb.append("250-").append(cap.getKey()).append("\r\n");
}
}
sb.append("250 AUTH LOGIN PLAIN\r\n");
return sb.toString();
}
private void processIncomingMail(String from, String recipient, String body) {
try {
Properties props = new Properties();
Session mailSession = Session.getDefaultInstance(props);
ByteArrayInputStream bais = new ByteArrayInputStream(body.getBytes(StandardCharsets.UTF_8));
MimeMessage mimeMessage = new MimeMessage(mailSession, bais);
String senderEmail = from;
String senderName = null;
InternetAddress[] fromAddresses = (InternetAddress[]) mimeMessage.getFrom();
if (fromAddresses != null && fromAddresses.length > 0) {
InternetAddress fromAddr = fromAddresses[0];
senderEmail = fromAddr.getAddress();
senderName = fromAddr.getPersonal();
}
String subject = mimeMessage.getSubject();
if (subject == null) subject = "";
Object content = mimeMessage.getContent();
String messageBody;
boolean isHtml = false;
if (content instanceof String) {
messageBody = (String) content;
} else if (content instanceof jakarta.mail.internet.MimeMultipart) {
messageBody = extractTextFromMultipart((jakarta.mail.internet.MimeMultipart) content);
isHtml = messageBody != null && (messageBody.contains("<html") || messageBody.contains("<HTML"));
} else {
messageBody = content != null ? content.toString() : "";
}
if (messageBody == null) messageBody = "";
boolean dkimPassed = dkimService.verifyMessage(mimeMessage);
String dkimDomain = null;
if (dkimPassed) {
String[] dkimHeaders = mimeMessage.getHeader("DKIM-Signature");
if (dkimHeaders != null && dkimHeaders.length > 0 && !dkimHeaders[0].isEmpty()) {
dkimDomain = extractDkimDomain(dkimHeaders[0]);
}
}
SpfService.SpfResult spfResult = spfService.checkSpf(senderEmail, "127.0.0.1");
boolean spfPassed = spfResult == SpfService.SpfResult.PASS;
log.info("SPF проверка для {}: {} ({})", senderEmail, spfResult, spfResult.getDescription());
DmarcService.DmarcResult dmarcResult = dmarcService.checkDmarc(
senderEmail, "127.0.0.1", spfPassed, dkimPassed, dkimDomain);
log.info("DMARC проверка для {}: {} ({})", senderEmail, dmarcResult, dmarcResult.getDescription());
boolean isSpam = dmarcService.shouldMarkAsSpam(dmarcResult)
|| spfResult == SpfService.SpfResult.FAIL
|| spfResult == SpfService.SpfResult.SOFTFAIL;
if (isSpam) {
log.info("Письмо от {} помечено как спам (SPF: {}, DKIM: {}, DMARC: {})",
senderEmail, spfResult, dkimPassed, dmarcResult);
}
mailService.receiveMessage(senderEmail, senderName, recipient, subject, messageBody, isHtml, isSpam).block();
log.info("SMTP: письмо сохранено от {} для {} (тема: {})", senderEmail, recipient, subject);
} catch (AddressException e) {
log.error("SMTP: ошибка адреса: {}", e.getMessage());
} catch (MessagingException e) {
log.error("SMTP: ошибка парсинга MIME: {}", e.getMessage());
} catch (IllegalArgumentException e) {
// Получатель не найден в системе — пытаемся доставить через SMTP релей
log.info("SMTP: получатель {} не найден в системе, пытаемся доставить через релей", recipient);
try {
// Формируем MIME-контент для релея
Properties props = new Properties();
Session mailSession = Session.getDefaultInstance(props);
ByteArrayInputStream bais = new ByteArrayInputStream(body.getBytes(StandardCharsets.UTF_8));
MimeMessage mimeMessage = new MimeMessage(mailSession, bais);
ByteArrayOutputStream baos = new ByteArrayOutputStream();
mimeMessage.writeTo(baos);
String mimeContent = baos.toString(StandardCharsets.UTF_8);
smtpRelayService.relayMessage(from, recipient, mimeContent).block();
} catch (Exception relayEx) {
log.error("SMTP: релей не смог доставить письмо для {}: {}", recipient, relayEx.getMessage());
}
} catch (Exception e) {
log.error("SMTP: ошибка обработки письма: {}", e.getMessage(), e);
}
}
private String extractTextFromMultipart(jakarta.mail.internet.MimeMultipart multipart)
throws MessagingException, IOException {
StringBuilder text = new StringBuilder();
for (int i = 0; i < multipart.getCount(); i++) {
var bodyPart = multipart.getBodyPart(i);
String contentType = bodyPart.getContentType();
if (contentType != null && contentType.toLowerCase().contains("text")) {
Object partContent = bodyPart.getContent();
if (partContent instanceof String) {
text.append(partContent);
} else if (partContent instanceof InputStream) {
try (InputStream is = (InputStream) partContent) {
text.append(is.toString());
}
}
}
}
return text.toString();
}
private String extractDkimDomain(String dkimHeader) {
int index = dkimHeader.indexOf("d=");
if (index == -1) return null;
int start = index + 2;
int end = dkimHeader.indexOf(";", start);
if (end == -1) end = dkimHeader.length();
return dkimHeader.substring(start, end).trim();
}
private String extractEmail(String argument) {
int start = argument.indexOf('<');
int end = argument.indexOf('>');
if (start == -1 || end == -1) return null;
return argument.substring(start + 1, end).trim().toLowerCase();
}
private static class SmtpSession {
boolean helo = false;
boolean ehlo = false;
boolean quit = false;
String hostname;
String mailFrom;
List<String> recipients = new ArrayList<>();
boolean dataReady = false;
StringBuilder dataBody = new StringBuilder();
void reset() {
mailFrom = null;
recipients.clear();
dataReady = false;
dataBody.setLength(0);
}
}
}
backend/src/main/java/com/mailserver/config/SpaWebFilter.java
+26
View File
@@ -0,0 +1,26 @@
package com.mailserver.config;
import org.springframework.core.annotation.Order;
import org.springframework.stereotype.Component;
import org.springframework.web.server.ServerWebExchange;
import org.springframework.web.server.WebFilter;
import org.springframework.web.server.WebFilterChain;
import reactor.core.publisher.Mono;
/** Angular routes (/inbox, /message/5, …) are pages of the web client: serve index.html for them. */
@Component
@Order(-100)
public class SpaWebFilter implements WebFilter {
@Override
public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
String path = exchange.getRequest().getPath().pathWithinApplication().value();
boolean page = exchange.getRequest().getMethod().matches("GET")
&& !path.startsWith("/api") && !path.startsWith("/actuator")
&& !path.equals("/") && !path.substring(path.lastIndexOf('/') + 1).contains(".");
if (page) {
return chain.filter(exchange.mutate().request(exchange.getRequest().mutate().path("/index.html").build()).build());
}
return chain.filter(exchange);
}
}
backend/src/main/java/com/mailserver/controller/MailController.java
+60 -69
View File
@@ -16,6 +16,10 @@ import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
import org.springframework.http.codec.multipart.FilePart;
import org.springframework.security.core.Authentication;
import com.mailserver.config.MailDomains;
import com.mailserver.service.SubmissionService;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.DeleteMapping;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
@@ -46,10 +50,18 @@ public class MailController {
private final UserService userService;
private final MailService mailService;
private final SubmissionService submissionService;
private final MailDomains domains;
private final boolean registrationEnabled;
public MailController(UserService userService, MailService mailService) {
public MailController(UserService userService, MailService mailService, SubmissionService submissionService,
MailDomains domains,
@Value("${mailserver.registration.enabled:false}") boolean registrationEnabled) {
this.userService = userService;
this.mailService = mailService;
this.submissionService = submissionService;
this.domains = domains;
this.registrationEnabled = registrationEnabled;
}
private Mono<String> getCurrentUserEmail(Mono<Authentication> authenticationMono) {
@@ -59,9 +71,15 @@ public class MailController {
// --- Users ---
@PostMapping("/register")
public Mono<?> register(@Valid @RequestBody Mono<RegisterRequest> requestMono) {
return requestMono.flatMap(request ->
userService.register(request.getEmail(), request.getPassword(), request.getDisplayName())
public Mono<ResponseEntity<?>> register(@Valid @RequestBody Mono<RegisterRequest> requestMono) {
if (!registrationEnabled) {
return Mono.just(org.springframework.http.ResponseEntity.status(HttpStatus.FORBIDDEN)
.body(Map.of("error", "Registration is closed")));
}
return requestMono.flatMap(request -> !domains.isLocal(request.getEmail())
? Mono.just(org.springframework.http.ResponseEntity.badRequest()
.body(Map.of("error", "Mailboxes can only be created in: " + String.join(", ", domains.domains()))))
: userService.register(request.getEmail().trim().toLowerCase(java.util.Locale.ROOT), request.getPassword(), request.getDisplayName())
.map(user -> org.springframework.http.ResponseEntity.status(HttpStatus.CREATED)
.body(Map.of("message", "User registered")))
.onErrorResume(IllegalArgumentException.class, e ->
@@ -124,25 +142,15 @@ public class MailController {
}
@PostMapping("/send")
public Mono<Object> sendMessage(
public Mono<MessageResponse> sendMessage(
Mono<Authentication> authenticationMono,
@Valid @RequestBody Mono<SendRequest> requestMono) {
return authenticationMono.zipWith(requestMono)
.flatMap(pair -> {
String email = pair.getT1().getName();
SendRequest request = pair.getT2();
return mailService.sendMessage(email, request)
.map(response -> (Object) org.springframework.http.ResponseEntity.ok(response))
.onErrorResume(e -> {
log.error("Ошибка при отправке письма: {}", e.getMessage(), e);
return Mono.just((Object) org.springframework.http.ResponseEntity.badRequest()
.body(Map.of("error", e.getMessage())));
});
});
.flatMap(pair -> submissionService.send(pair.getT1().getName(), pair.getT2()));
}
@PutMapping("/messages/{id}/read")
public Mono<?> markAsRead(@PathVariable Long id, Mono<Authentication> authenticationMono) {
public Mono<ResponseEntity<?>> markAsRead(@PathVariable Long id, Mono<Authentication> authenticationMono) {
return authenticationMono.flatMap(auth ->
userService.findByEmail(auth.getName())
.flatMap(user -> mailService.markAsRead(id, user.getId())
@@ -151,7 +159,7 @@ public class MailController {
}
@DeleteMapping("/messages/{id}")
public Mono<?> deleteMessage(@PathVariable Long id, Mono<Authentication> authenticationMono) {
public Mono<ResponseEntity<?>> deleteMessage(@PathVariable Long id, Mono<Authentication> authenticationMono) {
return authenticationMono.flatMap(auth ->
userService.findByEmail(auth.getName())
.flatMap(user -> mailService.deleteMessage(id, user.getId())
@@ -159,29 +167,10 @@ public class MailController {
);
}
// --- Simulate incoming message (для тестов) ---
@PostMapping("/simulate/receive")
public Mono<?> simulateReceive(@RequestBody Mono<Map<String, String>> bodyMono) {
return bodyMono.flatMap(body ->
mailService.receiveMessage(
body.get("senderEmail"),
body.get("senderName"),
body.get("recipientEmail"),
body.get("subject"),
body.get("body"),
"true".equals(body.get("html"))
)
.then(Mono.just(org.springframework.http.ResponseEntity.ok(Map.of("message", "Message received"))))
.onErrorResume(e ->
Mono.just(org.springframework.http.ResponseEntity.badRequest().body(Map.of("error", e.getMessage()))))
);
}
// --- Attachments ---
@PostMapping(value = "/messages/{messageId}/attachments", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
public Mono<?> uploadAttachment(
public Mono<ResponseEntity<?>> uploadAttachment(
@PathVariable Long messageId,
Mono<Authentication> authenticationMono,
@RequestBody Mono<Flux<FilePart>> filePartsMono) {
@@ -192,7 +181,7 @@ public class MailController {
.flatMapMany(user -> pair.getT2())
.next()
.flatMap(file -> {
String originalFilename = file.filename();
String originalFilename = safeFilename(file.filename());
String uniqueName = UUID.randomUUID() + "_" + originalFilename;
Path filePath = Paths.get(mailService.getAttachmentsDir(), uniqueName);
try {
@@ -214,7 +203,8 @@ public class MailController {
return userService.findByEmail(email)
.flatMap(user -> mailService.saveAttachmentReactive(
messageId, user.getId(),
originalFilename, file.headers().getContentType().toString(),
originalFilename,
file.headers().getContentType() != null ? file.headers().getContentType().toString() : "application/octet-stream",
bytes.length, filePath.toString()))
.map(response -> org.springframework.http.ResponseEntity.status(HttpStatus.CREATED).body(response));
});
@@ -233,39 +223,40 @@ public class MailController {
}
@GetMapping("/attachments/{attachmentId}/download")
public Mono<Object> downloadAttachment(
public Mono<ResponseEntity<byte[]>> downloadAttachment(
@PathVariable Long attachmentId,
Mono<Authentication> authenticationMono) {
return authenticationMono.flatMap(auth ->
userService.findByEmail(auth.getName())
.flatMap(user -> {
try {
AttachmentResponse info = mailService.getAttachmentInfo(attachmentId, user.getId());
Path filePath = Paths.get(mailService.getAttachmentFilePath(attachmentId, user.getId()));
byte[] bytes;
try {
bytes = Files.readAllBytes(filePath);
} catch (IOException e) {
return Mono.just((Object) org.springframework.http.ResponseEntity.badRequest()
.body(Map.of("error", "Failed to read file: " + e.getMessage())));
}
DataBuffer buffer = new DefaultDataBufferFactory().wrap(bytes);
return Mono.just((Object) org.springframework.http.ResponseEntity.ok()
.header(HttpHeaders.CONTENT_DISPOSITION,
"attachment; filename=\"" + info.getFilename() + "\"")
.contentType(MediaType.parseMediaType(
info.getContentType() != null ? info.getContentType() : "application/octet-stream"))
.body(buffer)
);
} catch (IllegalArgumentException e) {
return Mono.just((Object) org.springframework.http.ResponseEntity.badRequest().body(Map.of("error", e.getMessage())));
}
})
);
return authenticationMono.flatMap(auth -> userService.findByEmail(auth.getName()))
.flatMap(user -> mailService.getAttachment(attachmentId, user.getId()))
.flatMap(attachment -> Mono.fromCallable(() -> Files.readAllBytes(Paths.get(attachment.getFilePath())))
.subscribeOn(reactor.core.scheduler.Schedulers.boundedElastic())
.map(bytes -> ResponseEntity.ok()
.header(HttpHeaders.CONTENT_DISPOSITION, org.springframework.http.ContentDisposition.attachment()
.filename(attachment.getFilename(), java.nio.charset.StandardCharsets.UTF_8).build().toString())
.contentType(contentType(attachment.getContentType()))
.body(bytes)));
}
private static MediaType contentType(String value) {
try {
return value == null ? MediaType.APPLICATION_OCTET_STREAM : MediaType.parseMediaType(value);
} catch (org.springframework.util.InvalidMimeTypeException e) {
return MediaType.APPLICATION_OCTET_STREAM;
}
}
/** Only the last path segment, no control characters — a file name cannot leave the attachments folder. */
static String safeFilename(String name) {
String base = name == null ? "" : name.replace('\\', '/');
base = base.substring(base.lastIndexOf('/') + 1).replaceAll("[\\p{Cntrl}\"]", "").trim();
if (base.isEmpty() || base.equals(".") || base.equals("..")) {
return "file";
}
return base.length() > 200 ? base.substring(base.length() - 200) : base;
}
@DeleteMapping("/attachments/{attachmentId}")
public Mono<?> deleteAttachment(
public Mono<ResponseEntity<?>> deleteAttachment(
@PathVariable Long attachmentId,
Mono<Authentication> authenticationMono) {
return authenticationMono.flatMap(auth ->
@@ -333,7 +324,7 @@ public class MailController {
}
@DeleteMapping("/contacts/{id}")
public Mono<?> deleteContact(
public Mono<ResponseEntity<?>> deleteContact(
@PathVariable Long id,
Mono<Authentication> authenticationMono) {
return authenticationMono.flatMap(auth ->
backend/src/main/java/com/mailserver/delivery/DeliveryWorker.java
+96
View File
@@ -0,0 +1,96 @@
package com.mailserver.delivery;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.scheduling.annotation.Scheduled;
import org.springframework.stereotype.Component;
import java.time.Duration;
import java.time.Instant;
import java.util.List;
/**
* Sends queued messages. Temporary failure (4xx, no connection, DNS) — retry later with growing pauses,
* about 22 hours in total; permanent failure (5xx) or retries used up — FAILED and a bounce to the sender's inbox.
* Runs on the scheduler thread: blocking here is fine, it is not the network event loop.
*/
@Component
public class DeliveryWorker {
private static final Logger log = LoggerFactory.getLogger(DeliveryWorker.class);
static final List<Duration> RETRY_PAUSES = List.of(
Duration.ofMinutes(1), Duration.ofMinutes(5), Duration.ofMinutes(15), Duration.ofHours(1),
Duration.ofHours(3), Duration.ofHours(6), Duration.ofHours(12));
private static final int BATCH = 20;
/** Tells the sender that a message did not reach someone. */
public interface BounceSender {
void bounce(OutboundMessage message, String reason);
}
private final OutboundRepository repository;
private final SmtpDeliveryClient client;
private final BounceSender bounces;
public DeliveryWorker(OutboundRepository repository, SmtpDeliveryClient client, BounceSender bounces) {
this.repository = repository;
this.client = client;
this.bounces = bounces;
}
@Scheduled(initialDelayString = "${mailserver.queue.initial-delay-ms:5000}", fixedDelayString = "${mailserver.queue.poll-ms:15000}")
public void deliverDue() {
List<OutboundMessage> due = repository.findDue(Instant.now(), BATCH).collectList().block();
if (due == null) {
return;
}
for (OutboundMessage message : due) {
try {
attempt(message, Instant.now());
} catch (RuntimeException e) {
log.error("Queue item {} not processed: {}", message.getId(), e.toString());
}
}
}
void attempt(OutboundMessage message, Instant now) {
SmtpDeliveryClient.Result result = client.deliver(message.getMailFrom(), message.getRcptTo(), message.getMessage());
message.setAttempts(message.getAttempts() + 1);
message.setLastError(result.outcome() == SmtpDeliveryClient.Outcome.DELIVERED ? null : truncate(result.detail()));
switch (result.outcome()) {
case DELIVERED -> finish(message, OutboundMessage.DELIVERED, now);
case PERMANENT -> fail(message, now, result.detail());
case TEMPORARY -> {
if (message.getAttempts() > RETRY_PAUSES.size()) {
fail(message, now, "gave up after " + message.getAttempts() + " attempts: " + result.detail());
} else {
message.setNextAttemptAt(now.plus(RETRY_PAUSES.get(message.getAttempts() - 1)));
repository.save(message).block();
log.info("Queue item {} to {}: retry at {} ({})", message.getId(), message.getRcptTo(),
message.getNextAttemptAt(), result.detail());
}
}
}
}
private void fail(OutboundMessage message, Instant now, String reason) {
finish(message, OutboundMessage.FAILED, now);
log.warn("Queue item {} to {} FAILED: {}", message.getId(), message.getRcptTo(), reason);
try {
bounces.bounce(message, reason);
} catch (RuntimeException e) {
log.error("Bounce for queue item {} not stored: {}", message.getId(), e.toString());
}
}
private void finish(OutboundMessage message, String status, Instant now) {
message.setStatus(status);
message.setFinishedAt(now);
repository.save(message).block();
}
private static String truncate(String text) {
return text == null || text.length() <= 1000 ? text : text.substring(0, 1000);
}
}
backend/src/main/java/com/mailserver/delivery/OutboundMessage.java
+57
View File
@@ -0,0 +1,57 @@
package com.mailserver.delivery;
import org.springframework.data.annotation.Id;
import org.springframework.data.relational.core.mapping.Column;
import org.springframework.data.relational.core.mapping.Table;
import java.time.Instant;
@Table("outbound_queue")
public class OutboundMessage {
public static final String PENDING = "PENDING";
public static final String DELIVERED = "DELIVERED";
public static final String FAILED = "FAILED";
@Id
private Long id;
@Column("mail_from")
private String mailFrom;
@Column("rcpt_to")
private String rcptTo;
@Column("message")
private byte[] message;
@Column("status")
private String status = PENDING;
@Column("attempts")
private int attempts;
@Column("next_attempt_at")
private Instant nextAttemptAt;
@Column("last_error")
private String lastError;
@Column("created_at")
private Instant createdAt;
@Column("finished_at")
private Instant finishedAt;
public Long getId() { return id; }
public void setId(Long id) { this.id = id; }
public String getMailFrom() { return mailFrom; }
public void setMailFrom(String mailFrom) { this.mailFrom = mailFrom; }
public String getRcptTo() { return rcptTo; }
public void setRcptTo(String rcptTo) { this.rcptTo = rcptTo; }
public byte[] getMessage() { return message; }
public void setMessage(byte[] message) { this.message = message; }
public String getStatus() { return status; }
public void setStatus(String status) { this.status = status; }
public int getAttempts() { return attempts; }
public void setAttempts(int attempts) { this.attempts = attempts; }
public Instant getNextAttemptAt() { return nextAttemptAt; }
public void setNextAttemptAt(Instant nextAttemptAt) { this.nextAttemptAt = nextAttemptAt; }
public String getLastError() { return lastError; }
public void setLastError(String lastError) { this.lastError = lastError; }
public Instant getCreatedAt() { return createdAt; }
public void setCreatedAt(Instant createdAt) { this.createdAt = createdAt; }
public Instant getFinishedAt() { return finishedAt; }
public void setFinishedAt(Instant finishedAt) { this.finishedAt = finishedAt; }
}
backend/src/main/java/com/mailserver/delivery/OutboundQueue.java
+28
View File
@@ -0,0 +1,28 @@
package com.mailserver.delivery;
import org.springframework.stereotype.Service;
import reactor.core.publisher.Mono;
import java.time.Instant;
/** Puts a message for one external recipient into the delivery queue (the worker sends it). */
@Service
public class OutboundQueue {
private final OutboundRepository repository;
public OutboundQueue(OutboundRepository repository) {
this.repository = repository;
}
public Mono<OutboundMessage> enqueue(String mailFrom, String rcptTo, byte[] signedMessage) {
OutboundMessage message = new OutboundMessage();
message.setMailFrom(mailFrom);
message.setRcptTo(rcptTo);
message.setMessage(signedMessage);
message.setStatus(OutboundMessage.PENDING);
message.setCreatedAt(Instant.now());
message.setNextAttemptAt(Instant.now());
return repository.save(message);
}
}
backend/src/main/java/com/mailserver/delivery/OutboundRepository.java
+13
View File
@@ -0,0 +1,13 @@
package com.mailserver.delivery;
import org.springframework.data.r2dbc.repository.Query;
import org.springframework.data.r2dbc.repository.R2dbcRepository;
import reactor.core.publisher.Flux;
import java.time.Instant;
public interface OutboundRepository extends R2dbcRepository<OutboundMessage, Long> {
@Query("SELECT * FROM outbound_queue WHERE status = 'PENDING' AND next_attempt_at <= :now ORDER BY next_attempt_at LIMIT :limit")
Flux<OutboundMessage> findDue(Instant now, int limit);
}
backend/src/main/java/com/mailserver/delivery/SmtpDeliveryClient.java
+244
View File
@@ -0,0 +1,244 @@
package com.mailserver.delivery;
import jakarta.mail.Address;
import jakarta.mail.AuthenticationFailedException;
import jakarta.mail.MessagingException;
import jakarta.mail.SendFailedException;
import jakarta.mail.Session;
import jakarta.mail.Transport;
import jakarta.mail.internet.InternetAddress;
import jakarta.mail.internet.MimeMessage;
import org.eclipse.angus.mail.smtp.SMTPAddressFailedException;
import org.eclipse.angus.mail.smtp.SMTPSendFailedException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.xbill.DNS.Lookup;
import org.xbill.DNS.MXRecord;
import org.xbill.DNS.Record;
import org.xbill.DNS.TextParseException;
import org.xbill.DNS.Type;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.OutputStream;
import java.util.Arrays;
import java.util.Comparator;
import java.util.List;
import java.util.Locale;
import java.util.Properties;
/**
* Delivers one message to one recipient over SMTP (Jakarta Mail), blocking.
* <ul>
* <li><b>mx</b> — straight to the recipient's MX servers on port 25, lowest preference first; STARTTLS when offered,
* without certificate checks — opportunistic, like Postfix {@code smtp_tls_security_level=may};</li>
* <li><b>smarthost</b> — everything through one provider (Resend, SES, …) with login and verified TLS;</li>
* <li><b>off</b> — nothing leaves the server.</li>
* </ul>
* The message bytes are sent exactly as given (they carry the DKIM signature).
*/
public class SmtpDeliveryClient {
private static final Logger log = LoggerFactory.getLogger(SmtpDeliveryClient.class);
public enum Mode { OFF, MX, SMARTHOST }
public enum Tls { NONE, STARTTLS, SSL }
/** port — of the smarthost; mxPort — of recipients' MX servers (25; another value only in tests). */
public record Settings(Mode mode, String host, int port, String username, String password, Tls tls,
String heloName, int timeoutMs, int mxPort) {
}
public enum Outcome { DELIVERED, TEMPORARY, PERMANENT }
public record Result(Outcome outcome, String detail) {
static Result delivered(String detail) { return new Result(Outcome.DELIVERED, detail); }
static Result temporary(String detail) { return new Result(Outcome.TEMPORARY, detail); }
static Result permanent(String detail) { return new Result(Outcome.PERMANENT, detail); }
}
/** MX hosts of a domain, best first; empty — the domain has no mail server. */
public interface MxResolver {
List<String> resolve(String domain) throws TemporaryDnsException;
}
public static class TemporaryDnsException extends Exception {
public TemporaryDnsException(String message) {
super(message);
}
}
private final Settings settings;
private final MxResolver resolver;
public SmtpDeliveryClient(Settings settings) {
this(settings, SmtpDeliveryClient::dnsMx);
}
public SmtpDeliveryClient(Settings settings, MxResolver resolver) {
this.settings = settings;
this.resolver = resolver;
}
public Mode mode() {
return settings.mode();
}
public Result deliver(String from, String recipient, byte[] message) {
return switch (settings.mode()) {
case OFF -> Result.permanent("outbound delivery is disabled on this server");
case SMARTHOST -> send(settings.host(), settings.port(), true, from, recipient, message);
case MX -> viaMx(from, recipient, message);
};
}
private Result viaMx(String from, String recipient, byte[] message) {
String domain = recipient.substring(recipient.lastIndexOf('@') + 1).toLowerCase(Locale.ROOT);
List<String> hosts;
try {
hosts = resolver.resolve(domain);
} catch (TemporaryDnsException e) {
return Result.temporary("DNS: " + e.getMessage());
}
if (hosts.isEmpty()) {
return Result.permanent("domain " + domain + " does not accept mail (no MX/A record)");
}
Result last = null;
for (String host : hosts) {
last = send(host, settings.mxPort(), false, from, recipient, message);
// A server answered with a decision — do not ask the next MX; only a connection problem moves on
if (last.outcome() != Outcome.TEMPORARY || last.detail().startsWith("4")) {
return last;
}
}
return last;
}
private Result send(String host, int port, boolean smarthost, String from, String recipient, byte[] message) {
Properties props = new Properties();
props.put("mail.smtp.host", host);
props.put("mail.smtp.port", String.valueOf(port));
props.put("mail.smtp.localhost", settings.heloName());
props.put("mail.smtp.connectiontimeout", String.valueOf(settings.timeoutMs()));
props.put("mail.smtp.timeout", String.valueOf(settings.timeoutMs()));
props.put("mail.smtp.writetimeout", String.valueOf(settings.timeoutMs()));
props.put("mail.smtp.from", from);
props.put("mail.smtp.allow8bitmime", "true");
boolean login = false;
if (smarthost) {
switch (settings.tls()) {
case STARTTLS -> {
props.put("mail.smtp.starttls.enable", "true");
props.put("mail.smtp.starttls.required", "true");
}
case SSL -> props.put("mail.smtp.ssl.enable", "true");
case NONE -> { }
}
props.put("mail.smtp.ssl.checkserveridentity", "true");
login = settings.username() != null && !settings.username().isBlank();
props.put("mail.smtp.auth", String.valueOf(login));
} else {
props.put("mail.smtp.starttls.enable", "true");
props.put("mail.smtp.ssl.trust", "*");
}
Session session = Session.getInstance(props);
try (Transport transport = session.getTransport(settings.tls() == Tls.SSL && smarthost ? "smtps" : "smtp")) {
if (login) {
transport.connect(host, port, settings.username(), settings.password());
} else {
transport.connect(host, port, null, null);
}
transport.sendMessage(new RawMessage(session, message), new Address[]{new InternetAddress(recipient)});
log.info("Delivered {} -> {} via {}:{}", from, recipient, host, port);
return Result.delivered(host);
} catch (AuthenticationFailedException e) {
return Result.temporary("login to " + host + " failed: " + e.getMessage());
} catch (MessagingException e) {
int code = replyCode(e);
String text = code > 0 ? code + " " + oneLine(e) : "connection to " + host + ": " + oneLine(e);
log.warn("Delivery {} -> {} via {}: {}", from, recipient, host, text);
return code >= 500 ? Result.permanent(text) : Result.temporary(text);
}
}
/** SMTP reply code from the exception chain, 0 — no reply (connection problem). */
static int replyCode(Exception e) {
Exception current = e;
while (current != null) {
if (current instanceof SMTPAddressFailedException f) {
return f.getReturnCode();
}
if (current instanceof SMTPSendFailedException f) {
return f.getReturnCode();
}
current = current instanceof MessagingException m ? m.getNextException()
: current.getCause() instanceof Exception c ? c : null;
if (current instanceof SendFailedException sf && sf.getInvalidAddresses() != null
&& sf.getNextException() == null) {
return 550;
}
}
return 0;
}
private static String oneLine(Exception e) {
String message = String.valueOf(e.getMessage()).replaceAll("\\s+", " ").trim();
return message.length() > 500 ? message.substring(0, 500) : message;
}
/** MX hosts by preference (RFC 5321 5.1); no MX — the domain itself (implicit MX); null MX "." — none. */
static List<String> dnsMx(String domain) throws TemporaryDnsException {
try {
Lookup lookup = new Lookup(domain, Type.MX);
Record[] records = lookup.run();
switch (lookup.getResult()) {
case Lookup.SUCCESSFUL -> {
List<String> hosts = Arrays.stream(records)
.map(MXRecord.class::cast)
.sorted(Comparator.comparingInt(MXRecord::getPriority))
.map(mx -> mx.getTarget().toString(true))
.filter(host -> !host.isEmpty() && !host.equals("."))
.toList();
return hosts;
}
case Lookup.TYPE_NOT_FOUND -> {
Lookup a = new Lookup(domain, Type.A);
a.run();
return a.getResult() == Lookup.SUCCESSFUL ? List.of(domain) : List.of();
}
case Lookup.HOST_NOT_FOUND -> {
return List.of();
}
default -> throw new TemporaryDnsException(lookup.getErrorString());
}
} catch (TextParseException e) {
return List.of();
}
}
/** A message written to the wire byte for byte as received (keeps the DKIM signature valid). */
static final class RawMessage extends MimeMessage {
private final byte[] raw;
RawMessage(Session session, byte[] raw) throws MessagingException {
super(session, new ByteArrayInputStream(raw));
this.raw = raw;
}
@Override
public void writeTo(OutputStream os, String[] ignoreHeaders) throws IOException {
os.write(raw);
}
@Override
public void writeTo(OutputStream os) throws IOException {
os.write(raw);
}
@Override
public int getSize() {
return raw.length;
}
}
}
backend/src/main/java/com/mailserver/dev/DevController.java
+31
View File
@@ -0,0 +1,31 @@
package com.mailserver.dev;
import com.mailserver.service.MailService;
import org.springframework.context.annotation.Profile;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RestController;
import reactor.core.publisher.Mono;
import java.util.Map;
/** Dev profile only: put a message into a mailbox without SMTP (any sender — never on a real server). */
@RestController
@Profile("dev")
public class DevController {
private final MailService mailService;
public DevController(MailService mailService) {
this.mailService = mailService;
}
@PostMapping("/api/simulate/receive")
public Mono<ResponseEntity<Map<String, String>>> simulateReceive(@RequestBody Map<String, String> body) {
return mailService.receiveMessage(body.get("senderEmail"), body.get("senderName"), body.get("recipientEmail"),
body.getOrDefault("subject", ""), body.getOrDefault("body", ""), "true".equals(body.get("html")))
.thenReturn(ResponseEntity.ok(Map.of("message", "Message received")))
.onErrorResume(e -> Mono.just(ResponseEntity.badRequest().body(Map.of("error", String.valueOf(e.getMessage())))));
}
}
backend/src/main/java/com/mailserver/service/DkimService.java
+158 -407
View File
@@ -1,458 +1,209 @@
package com.mailserver.service;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.openssl.jcajce.JcaPEMWriter;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Service;
import jakarta.annotation.PostConstruct;
import jakarta.mail.MessagingException;
import jakarta.mail.Session;
import jakarta.mail.internet.InternetAddress;
import jakarta.mail.internet.MimeMessage;
import org.springframework.core.io.ClassPathResource;
import org.apache.james.jdkim.DKIMVerifier;
import org.apache.james.jdkim.api.PublicKeyRecordRetriever;
import org.apache.james.jdkim.api.SignatureRecord;
import org.apache.james.jdkim.exceptions.FailException;
import org.apache.james.jdkim.impl.DNSPublicKeyRecordRetriever;
import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;
import org.bouncycastle.openssl.PEMKeyPair;
import org.bouncycastle.openssl.PEMParser;
import org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter;
import org.simplejavamail.utils.mail.dkim.Canonicalization;
import org.simplejavamail.utils.mail.dkim.DkimMessage;
import org.simplejavamail.utils.mail.dkim.DkimSigner;
import org.simplejavamail.utils.mail.dkim.SigningAlgorithm;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Service;
import java.io.*;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.Reader;
import java.io.StringReader;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.security.*;
import java.security.spec.InvalidKeySpecException;
import java.security.cert.CertificateException;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.nio.file.attribute.PosixFilePermissions;
import java.security.KeyFactory;
import java.security.KeyPairGenerator;
import java.security.interfaces.RSAPrivateCrtKey;
import java.security.interfaces.RSAPrivateKey;
import java.security.spec.RSAPublicKeySpec;
import java.util.Base64;
import java.util.List;
import java.util.Locale;
import java.util.Properties;
/**
* Сервис для DKIM (DomainKeys Identified Mail) подписи и верификации писем.
*
* DKIM добавляет криптографическую подпись к каждому исходящему письму,
* чтобы получатель мог проверить, что письмо действительно отправлено
* владельцем домена и не было изменено в пути.
*
* При старте генерирует RSA-ключ (2048 бит) и сохраняет его в файл.
* Подписывает заголовки From, Subject, Date, To и тело сообщения.
* DKIM (RFC 6376): signs our outgoing mail and verifies incoming mail.
* Signing — simple-java-mail utils-mail-dkim (rsa-sha256, relaxed/relaxed); verification — Apache James jDKIM
* with the sender's public key from DNS. The key is generated once and kept in {@code keys-dir/dkim-private.pem};
* the DNS record to publish is printed to the log at start and available from {@link #dnsRecord()}.
*/
@Service
public class DkimService {
private static final Logger log = LoggerFactory.getLogger(DkimService.class);
private static final String DKIM_SELECTOR = "default";
/** Result of checking an incoming message. */
public record Verification(boolean signed, boolean passed, String domain) {
static final Verification NONE = new Verification(false, false, null);
}
@Value("${mailserver.dkim.domain:localhost}")
private String domain;
private final String domain;
private final String selector;
private final Path keysDir;
private final boolean enabled;
private final DKIMVerifier verifier;
@Value("${mailserver.dkim.keys-dir:./dkim-keys}")
private String keysDir;
@Value("${mailserver.dkim.enabled:true}")
private boolean enabled;
private PrivateKey privateKey;
private PublicKey publicKey;
private RSAPrivateKey privateKey;
private String publicKeyBase64;
@Autowired
public DkimService(@Value("${mailserver.dkim.domain:localhost}") String domain,
@Value("${mailserver.dkim.selector:mail}") String selector,
@Value("${mailserver.dkim.keys-dir:./dkim-keys}") String keysDir,
@Value("${mailserver.dkim.enabled:true}") boolean enabled) {
this(domain, selector, Paths.get(keysDir), enabled, new DNSPublicKeyRecordRetriever());
}
// Tests pass their own public key lookup instead of DNS
DkimService(String domain, String selector, Path keysDir, boolean enabled, PublicKeyRecordRetriever keys) {
this.domain = domain.toLowerCase(Locale.ROOT);
this.selector = selector;
this.keysDir = keysDir;
this.enabled = enabled;
this.verifier = new DKIMVerifier(keys);
}
@PostConstruct
public void init() {
Security.addProvider(new BouncyCastleProvider());
if (!enabled) {
log.info("DKIM подписи отключены");
log.info("DKIM signing disabled");
return;
}
try {
Path keyDir = Paths.get(keysDir);
Files.createDirectories(keyDir);
Path privateKeyFile = keyDir.resolve("dkim-private.pem");
Path publicKeyFile = keyDir.resolve("dkim-public.pem");
if (Files.exists(privateKeyFile) && Files.exists(publicKeyFile)) {
// Загружаем существующие ключи
loadKeys(privateKeyFile, publicKeyFile);
log.info("DKIM: загружены существующие ключи для домена {}", domain);
Files.createDirectories(keysDir);
Path keyFile = keysDir.resolve("dkim-private.pem");
if (Files.exists(keyFile)) {
privateKey = readPrivateKey(Files.readString(keyFile));
log.info("DKIM: key loaded for {}", domain);
} else {
// Генерируем новые ключи
KeyPair keyPair = generateKeyPair();
privateKey = keyPair.getPrivate();
publicKey = keyPair.getPublic();
saveKeys(privateKeyFile, publicKeyFile, keyPair);
log.info("DKIM: сгенерированы новые ключи для домена {}", domain);
KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA");
generator.initialize(2048);
privateKey = (RSAPrivateKey) generator.generateKeyPair().getPrivate();
String pem = "-----BEGIN PRIVATE KEY-----\n"
+ Base64.getMimeEncoder(64, "\n".getBytes()).encodeToString(privateKey.getEncoded())
+ "\n-----END PRIVATE KEY-----\n";
Files.writeString(keyFile, pem);
restrict(keyFile);
log.info("DKIM: new key generated for {}", domain);
}
// Формируем публичный ключ в формате DNS TXT-записи
publicKeyBase64 = encodePublicKeyForDns(publicKey);
log.info("DKIM публичный ключ для DNS TXT-записи (_{}._domainkey.{}):", DKIM_SELECTOR, domain);
log.info("v=DKIM1; k=rsa; p={}", publicKeyBase64);
publicKeyBase64 = Base64.getEncoder().encodeToString(publicKeyOf(privateKey));
log.info("DKIM DNS record — TXT {}._domainkey.{}: {}", selector, domain, dnsRecord());
} catch (Exception e) {
log.error("Ошибка инициализации DKIM", e);
throw new IllegalStateException("DKIM key cannot be loaded from " + keysDir, e);
}
}
/**
* Генерирует RSA-ключ 2048 бит для DKIM.
*/
private KeyPair generateKeyPair() throws NoSuchAlgorithmException {
KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
keyPairGenerator.initialize(2048);
return keyPairGenerator.generateKeyPair();
/** TXT value to publish at {@code <selector>._domainkey.<domain>}. */
public String dnsRecord() {
return publicKeyBase64 == null ? null : "v=DKIM1; k=rsa; p=" + publicKeyBase64;
}
/**
* Сохраняет ключи в PEM-формат.
* Signs the message when it is from our domain; otherwise returns it unchanged.
* The result is the exact byte sequence to send — do not re-serialize it.
*/
private void saveKeys(Path privateKeyFile, Path publicKeyFile, KeyPair keyPair)
throws IOException, NoSuchAlgorithmException, InvalidKeySpecException {
try (FileWriter fw = new FileWriter(privateKeyFile.toFile());
JcaPEMWriter pemWriter = new JcaPEMWriter(fw)) {
pemWriter.writeObject(keyPair.getPrivate());
pemWriter.flush();
}
try (FileWriter fw = new FileWriter(publicKeyFile.toFile());
JcaPEMWriter pemWriter = new JcaPEMWriter(fw)) {
pemWriter.writeObject(keyPair.getPublic());
pemWriter.flush();
}
}
/**
* Загружает ключи из PEM-файлов.
*/
private void loadKeys(Path privateKeyFile, Path publicKeyFile)
throws IOException, NoSuchAlgorithmException, InvalidKeySpecException {
String pkcs8Private = Files.readString(privateKeyFile);
String derEncoded = pkcs8Private
.replace("-----BEGIN PRIVATE KEY-----", "")
.replace("-----END PRIVATE KEY-----", "")
.replaceAll("\\s", "");
byte[] decoded = Base64.getDecoder().decode(derEncoded);
PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(decoded);
KeyFactory keyFactory = KeyFactory.getInstance("RSA");
privateKey = keyFactory.generatePrivate(spec);
String pkcs8Public = Files.readString(publicKeyFile);
String derEncodedPublic = pkcs8Public
.replace("-----BEGIN PUBLIC KEY-----", "")
.replace("-----END PUBLIC KEY-----", "")
.replaceAll("\\s", "");
byte[] decodedPublic = Base64.getDecoder().decode(derEncodedPublic);
X509EncodedKeySpec pubSpec = new X509EncodedKeySpec(decodedPublic);
publicKey = keyFactory.generatePublic(pubSpec);
}
/**
* Кодирует публичный ключ для DNS TXT-записи.
*/
private String encodePublicKeyForDns(PublicKey key) {
byte[] encoded = key.getEncoded();
return Base64.getEncoder().withoutPadding().encodeToString(encoded);
}
/**
* Подписывает MIME-сообщение DKIM-подписью.
* Добавляет заголовок DKIM-Signature в письмо.
*
* @param mimeMessage MIME-сообщение для подписи
* @throws MessagingException если не удалось добавить заголовок
*/
public void signMessage(MimeMessage mimeMessage) throws MessagingException {
public byte[] sign(byte[] message) throws MessagingException, IOException {
if (!enabled || privateKey == null) {
return;
return message;
}
MimeMessage mime = new MimeMessage(Session.getInstance(new Properties()), new ByteArrayInputStream(message));
if (mime.getFrom() == null || mime.getFrom().length == 0
|| !(mime.getFrom()[0] instanceof InternetAddress from)
|| !domain.equals(domainOf(from.getAddress()))) {
return message;
}
DkimSigner signer = new DkimSigner(domain, selector, privateKey);
signer.setCheckDomainKey(false); // the DNS record may not be published yet (tests, new server)
signer.setSigningAlgorithm(SigningAlgorithm.SHA256_WITH_RSA);
signer.setHeaderCanonicalization(Canonicalization.RELAXED);
signer.setBodyCanonicalization(Canonicalization.RELAXED);
signer.setLengthParam(false);
signer.setCopyHeaderFields(false);
ByteArrayOutputStream out = new ByteArrayOutputStream(message.length + 1024);
DkimMessage signed = new DkimMessage(mime, signer);
signed.setAllow8bitMIME(true);
signed.writeTo(out);
return out.toByteArray();
}
/** Checks DKIM signatures of an incoming message (public key from the signer's DNS). */
public Verification verify(byte[] message) {
try {
// Извлекаем заголовки для подписи
String from = extractHeader(mimeMessage, "From");
String subject = extractHeader(mimeMessage, "Subject");
String date = extractHeader(mimeMessage, "Date");
String to = extractHeader(mimeMessage, "To");
String messageId = extractHeader(mimeMessage, "Message-ID");
// Извлекаем тело сообщения
String body = extractBody(mimeMessage);
// Формируем канонизированное тело (relaxed канонизация)
String canonicalBody = canonicalizeBody(body);
// Формируем канонизированные заголовки
String headerCanonicalization = "r";
String bodyCanonicalization = "r";
String algorithm = "rsa-sha256";
// Строим заголовки для подписи
StringBuilder headersToSign = new StringBuilder();
String[] headerNames = {"from", "subject", "date", "to", "message-id"};
String[] headerValues = {from, subject, date, to, messageId};
for (int i = 0; i < headerNames.length; i++) {
headersToSign.append(headerNames[i]).append(":").append(headerValues[i]).append("\r\n");
List<SignatureRecord> valid;
synchronized (verifier) { // DKIMVerifier keeps results between calls
verifier.resetResults();
valid = verifier.verify(new ByteArrayInputStream(message));
}
// Вычисляем хэш тела
byte[] bodyHash = hashBody(canonicalBody);
// Формируем signing input
String headerCanon = headersToSign.toString();
byte[] signingInput = (headerCanon + "bh=" + Base64.getEncoder().withoutPadding().encodeToString(bodyHash) + "\rbh=" + Base64.getEncoder().withoutPadding().encodeToString(bodyHash)).getBytes();
// Подписываем
Signature signature = Signature.getInstance("SHA256withRSA", "BC");
signature.initSign(privateKey);
signature.update(signingInput);
byte[] signatureBytes = signature.sign();
// Формируем DKIM-Signature заголовок
String b64Signature = Base64.getEncoder().withoutPadding().encodeToString(signatureBytes);
String b64BodyHash = Base64.getEncoder().withoutPadding().encodeToString(bodyHash);
StringBuilder dkimHeader = new StringBuilder();
dkimHeader.append("v=1; ");
dkimHeader.append("a=").append(algorithm).append("; ");
dkimHeader.append("d=").append(domain).append("; ");
dkimHeader.append("s=").append(DKIM_SELECTOR).append("; ");
dkimHeader.append("c=").append(headerCanonicalization).append("/").append(bodyCanonicalization).append("; ");
dkimHeader.append("h=").append(String.join(":", headerNames)).append("; ");
dkimHeader.append("bh=").append(b64BodyHash).append("; ");
dkimHeader.append("b=").append(b64Signature);
mimeMessage.setHeader("DKIM-Signature", dkimHeader.toString());
log.debug("DKIM: сообщение подписано для домена {}", domain);
} catch (Exception e) {
log.error("DKIM: ошибка подписи сообщения", e);
// Не бросаем исключение — письмо будет отправлено без подписи
if (valid == null) {
return Verification.NONE;
}
if (valid.isEmpty()) {
return new Verification(true, false, null);
}
return new Verification(true, true, valid.get(0).getDToken().toString().toLowerCase(Locale.ROOT));
} catch (FailException e) {
log.info("DKIM: signature failed: {}", e.getMessage());
return new Verification(true, false, null);
} catch (IOException e) {
log.warn("DKIM: message cannot be read: {}", e.getMessage());
return new Verification(true, false, null);
}
}
/**
* Верифицирует DKIM-подпись входящего сообщения.
*
* @param mimeMessage MIME-сообщение с DKIM-подписью
* @return true если подпись валидна, false если подпись отсутствует или невалидна
*/
public boolean verifyMessage(MimeMessage mimeMessage) {
if (!enabled) {
return true; // Если DKIM отключён, считаем все письма валидными
}
static String domainOf(String address) {
int at = address == null ? -1 : address.lastIndexOf('@');
return at < 0 ? "" : address.substring(at + 1).toLowerCase(Locale.ROOT);
}
private static RSAPrivateKey readPrivateKey(String pem) throws IOException {
try (Reader reader = new StringReader(pem); PEMParser parser = new PEMParser(reader)) {
Object object = parser.readObject();
JcaPEMKeyConverter converter = new JcaPEMKeyConverter();
// PKCS#8 ("PRIVATE KEY") and the older PKCS#1 ("RSA PRIVATE KEY") written by earlier versions
if (object instanceof PEMKeyPair pair) {
return (RSAPrivateKey) converter.getKeyPair(pair).getPrivate();
}
if (object instanceof PrivateKeyInfo info) {
return (RSAPrivateKey) converter.getPrivateKey(info);
}
throw new IOException("Not an RSA private key: " + (object == null ? "empty file" : object.getClass().getSimpleName()));
}
}
private static byte[] publicKeyOf(RSAPrivateKey key) throws Exception {
RSAPrivateCrtKey crt = (RSAPrivateCrtKey) key;
return KeyFactory.getInstance("RSA")
.generatePublic(new RSAPublicKeySpec(crt.getModulus(), crt.getPublicExponent()))
.getEncoded();
}
private static void restrict(Path file) {
try {
String dkimHeader = mimeMessage.getHeader("DKIM-Signature")[0];
if (dkimHeader == null || dkimHeader.isEmpty()) {
log.debug("DKIM: подпись не найдена в сообщении");
return false;
}
// Извлекаем домен из подписи
String domain = extractDkimValue(dkimHeader, "d=");
if (domain == null || domain.isEmpty()) {
log.warn("DKIM: не удалось извлечь домен из подписи");
return false;
}
// В реальном мире здесь мы бы:
// 1. Сделали DNS-запрос для _domainkey.<domain>
// 2. Получили публичный ключ
// 3. Проверили подпись
//
// Для локального сервера мы проверяем, что подпись присутствует
// и имеет корректный формат
String version = extractDkimValue(dkimHeader, "v=");
String algorithm = extractDkimValue(dkimHeader, "a=");
String selector = extractDkimValue(dkimHeader, "s=");
String signature = extractDkimValue(dkimHeader, "b=");
if (version == null || !version.equals("1")) {
log.warn("DKIM: неверная версия подписи");
return false;
}
if (algorithm == null || !algorithm.startsWith("rsa-")) {
log.warn("DKIM: неподдерживаемый алгоритм: {}", algorithm);
return false;
}
if (signature == null || signature.isEmpty()) {
log.warn("DKIM: подпись пуста");
return false;
}
// Проверяем, что подпись — валидный Base64
try {
Base64.getDecoder().decode(signature);
} catch (IllegalArgumentException e) {
log.warn("DKIM: подпись не является валидным Base64");
return false;
}
log.info("DKIM: подпись найдена для домена {} (селектор: {})", domain, selector);
// Если письмо подписано нашим собственным ключом, проверяем полностью
if (domain.equals(this.domain) && privateKey != null) {
return verifyLocalSignature(mimeMessage, dkimHeader);
}
// Для внешних доменов проверяем только формат
return true;
} catch (Exception e) {
log.error("DKIM: ошибка верификации", e);
return false;
Files.setPosixFilePermissions(file, PosixFilePermissions.fromString("rw-------"));
} catch (UnsupportedOperationException | IOException ignored) {
// not a POSIX file system
}
}
/**
* Верифицирует подпись локального домена.
*/
private boolean verifyLocalSignature(MimeMessage mimeMessage, String dkimHeader) {
try {
String from = extractHeader(mimeMessage, "From");
String subject = extractHeader(mimeMessage, "Subject");
String date = extractHeader(mimeMessage, "Date");
String to = extractHeader(mimeMessage, "To");
String messageId = extractHeader(mimeMessage, "Message-ID");
String body = extractBody(mimeMessage);
String canonicalBody = canonicalizeBody(body);
StringBuilder headersToSign = new StringBuilder();
String[] headerNames = {"from", "subject", "date", "to", "message-id"};
String[] headerValues = {from, subject, date, to, messageId};
for (int i = 0; i < headerNames.length; i++) {
headersToSign.append(headerNames[i]).append(":").append(headerValues[i]).append("\r\n");
}
byte[] bodyHash = hashBody(canonicalBody);
String b64BodyHash = extractDkimValue(dkimHeader, "bh=");
String b64Signature = extractDkimValue(dkimHeader, "b=");
// Проверяем хэш тела
if (b64BodyHash != null) {
byte[] claimedBodyHash = Base64.getDecoder().decode(b64BodyHash);
if (!MessageDigest.isEqual(bodyHash, claimedBodyHash)) {
log.warn("DKIM: хэш тела не совпадает");
return false;
}
}
// Проверяем подпись
String headerCanon = headersToSign.toString();
byte[] signingInput = (headerCanon + "bh=" + b64BodyHash + "\rbh=" + b64BodyHash).getBytes();
Signature signature = Signature.getInstance("SHA256withRSA", "BC");
signature.initVerify(publicKey);
signature.update(signingInput);
byte[] signatureBytes = Base64.getDecoder().decode(b64Signature);
boolean valid = signature.verify(signatureBytes);
if (valid) {
log.info("DKIM: подпись локального домена верифицирована");
} else {
log.warn("DKIM: подпись локального домена не верифицирована");
}
return valid;
} catch (Exception e) {
log.error("DKIM: ошибка верификации локальной подписи", e);
return false;
}
}
/**
* Извлекает значение параметра из DKIM-заголовка.
*/
private String extractDkimValue(String dkimHeader, String param) {
int index = dkimHeader.indexOf(param);
if (index == -1) return null;
int start = index + param.length();
int end = dkimHeader.indexOf(";", start);
if (end == -1) end = dkimHeader.length();
return dkimHeader.substring(start, end).trim();
}
/**
* Извлекает заголовок из MIME-сообщения.
*/
private String extractHeader(MimeMessage mimeMessage, String name) throws MessagingException {
String[] headers = mimeMessage.getHeader(name);
if (headers == null || headers.length == 0) return "";
return headers[0];
}
/**
* Извлекает тело MIME-сообщения.
*/
private String extractBody(MimeMessage mimeMessage) throws MessagingException, IOException {
Object content = mimeMessage.getContent();
if (content instanceof String) {
return (String) content;
} else if (content instanceof jakarta.mail.internet.MimeMultipart) {
jakarta.mail.internet.MimeMultipart multipart = (jakarta.mail.internet.MimeMultipart) content;
StringBuilder body = new StringBuilder();
for (int i = 0; i < multipart.getCount(); i++) {
var part = multipart.getBodyPart(i);
String contentType = part.getContentType();
if (contentType != null && contentType.toLowerCase().contains("text")) {
Object partContent = part.getContent();
if (partContent instanceof String) {
body.append(partContent);
}
}
}
return body.toString();
}
return "";
}
/**
* Канонизация тела сообщения (relaxed канонизация).
* Убирает лишние пробелы и переводы строк.
*/
private String canonicalizeBody(String body) {
if (body == null) return "";
// Relaxed: нормализуем CRLF в LF, убираем пробелы в конце строк
return body.replaceAll("\\r\\n", "\n")
.replaceAll("\\r", "\n")
.replaceAll(" +\n", "\n")
.replaceAll("\n+", "\n")
.trim();
}
/**
* Вычисляет SHA-256 хэш тела сообщения.
*/
private byte[] hashBody(String body) throws NoSuchAlgorithmException {
MessageDigest digest = MessageDigest.getInstance("SHA-256");
return digest.digest(body.getBytes());
}
/**
* Возвращает публичный ключ в формате DNS TXT-записи.
* Используется для публикации в DNS.
*/
public String getPublicKeyForDns() {
if (publicKeyBase64 == null) return null;
return "v=DKIM1; k=rsa; p=" + publicKeyBase64;
}
/**
* Возвращает домен DKIM.
*/
public String getDomain() {
return domain;
}
/**
* Возвращает селектор DKIM.
*/
public String getSelector() {
return DKIM_SELECTOR;
}
}
backend/src/main/java/com/mailserver/service/LocalDelivery.java
+130
View File
@@ -0,0 +1,130 @@
package com.mailserver.service;
import com.mailserver.delivery.DeliveryWorker;
import com.mailserver.delivery.OutboundMessage;
import jakarta.mail.BodyPart;
import jakarta.mail.MessagingException;
import jakarta.mail.Multipart;
import jakarta.mail.Part;
import jakarta.mail.Session;
import jakarta.mail.internet.InternetAddress;
import jakarta.mail.internet.MimeMessage;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Service;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.nio.charset.StandardCharsets;
import java.util.Properties;
/**
* Stores a message in one of our mailboxes. Mail from outside is checked first — DKIM (signature),
* SPF (the connecting IP against the envelope sender's domain), DMARC (policy of the From domain);
* a failure marks it as spam. Mail from our own logged-in users is trusted.
*/
@Service
public class LocalDelivery implements DeliveryWorker.BounceSender {
private static final Logger log = LoggerFactory.getLogger(LocalDelivery.class);
private final MailService mailService;
private final DkimService dkimService;
private final SpfService spfService;
private final DmarcService dmarcService;
private final String hostname;
public LocalDelivery(MailService mailService, DkimService dkimService, SpfService spfService,
DmarcService dmarcService, @Value("${mailserver.smtp.hostname:localhost}") String hostname) {
this.mailService = mailService;
this.dkimService = dkimService;
this.spfService = spfService;
this.dmarcService = dmarcService;
this.hostname = hostname;
}
/** Blocking: call from a worker thread. */
public void deliver(byte[] raw, String mailbox, String remoteIp, String envelopeFrom, boolean trusted)
throws MessagingException, IOException {
MimeMessage mime = new MimeMessage(Session.getInstance(new Properties()), new ByteArrayInputStream(raw));
String senderEmail = envelopeFrom;
String senderName = null;
if (mime.getFrom() != null && mime.getFrom().length > 0 && mime.getFrom()[0] instanceof InternetAddress from) {
senderEmail = from.getAddress();
senderName = from.getPersonal();
}
String subject = mime.getSubject() == null ? "" : mime.getSubject();
Body body = body(mime);
boolean spam = false;
if (!trusted) {
DkimService.Verification dkim = dkimService.verify(raw);
String spfSender = envelopeFrom == null || envelopeFrom.isEmpty() ? senderEmail : envelopeFrom;
SpfService.SpfResult spf = spfService.checkSpf(spfSender, remoteIp);
boolean spfPassed = spf == SpfService.SpfResult.PASS;
DmarcService.DmarcResult dmarc = dmarcService.checkDmarc(senderEmail, remoteIp, spfPassed, dkim.passed(), dkim.domain());
spam = dmarcService.shouldMarkAsSpam(dmarc) || spf == SpfService.SpfResult.FAIL || (dkim.signed() && !dkim.passed());
log.info("Incoming {} -> {} from {}: DKIM {}, SPF {}, DMARC {}{}", senderEmail, mailbox, remoteIp,
dkim.signed() ? (dkim.passed() ? "pass " + dkim.domain() : "fail") : "none", spf, dmarc, spam ? " → spam" : "");
}
mailService.receiveMessage(senderEmail, senderName, mailbox, subject, body.text(), body.html(), spam).block();
}
/** Non-delivery report into the sender's inbox — only when the sender is our mailbox. */
@Override
public void bounce(OutboundMessage message, String reason) {
String text = "Your message to " + message.getRcptTo() + " could not be delivered.\n\n"
+ "Reason: " + reason + "\n\nAttempts: " + message.getAttempts() + "\n";
try {
mailService.receiveMessage("mailer-daemon@" + hostname, "Mail Delivery System", message.getMailFrom(),
"Undelivered: message to " + message.getRcptTo(), text, false, false).block();
} catch (IllegalArgumentException notOurs) {
log.info("Bounce not stored: sender {} is not a local mailbox", message.getMailFrom());
}
}
record Body(String text, boolean html) {
}
/** HTML part when the message has one, otherwise the plain text; nested multiparts are walked. */
static Body body(Part part) throws MessagingException, IOException {
String html = find(part, "text/html");
if (html != null) {
return new Body(html, true);
}
String plain = find(part, "text/plain");
return new Body(plain == null ? "" : plain, false);
}
private static String find(Part part, String type) throws MessagingException, IOException {
if (Part.ATTACHMENT.equalsIgnoreCase(part.getDisposition())) {
return null;
}
if (part.isMimeType(type)) {
Object content = part.getContent();
if (content instanceof String s) {
return s;
}
if (content instanceof InputStream in) {
try (in) {
return new String(in.readAllBytes(), StandardCharsets.UTF_8);
}
}
return null;
}
if (part.isMimeType("multipart/*") && part.getContent() instanceof Multipart multipart) {
for (int i = 0; i < multipart.getCount(); i++) {
BodyPart child = multipart.getBodyPart(i);
String found = find(child, type);
if (found != null) {
return found;
}
}
}
return null;
}
}
backend/src/main/java/com/mailserver/service/MailService.java
+62 -195
View File
@@ -7,7 +7,6 @@ import com.mailserver.domain.Message;
import com.mailserver.domain.User;
import com.mailserver.dto.AttachmentResponse;
import com.mailserver.dto.MessageResponse;
import com.mailserver.dto.SendRequest;
import com.mailserver.repository.AttachmentRepository;
import com.mailserver.repository.ContactRepository;
import com.mailserver.repository.FolderRepository;
@@ -15,16 +14,14 @@ import com.mailserver.repository.MessageRepository;
import com.mailserver.repository.UserRepository;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import jakarta.mail.MessagingException;
import jakarta.mail.Session;
import jakarta.mail.internet.MimeMessage;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.data.domain.PageRequest;
import org.springframework.data.domain.Sort;
import org.springframework.http.HttpStatus;
import org.springframework.stereotype.Service;
import org.springframework.web.server.ResponseStatusException;
import reactor.core.publisher.Flux;
import reactor.core.publisher.Mono;
import reactor.core.publisher.Sinks;
import java.io.*;
import java.nio.charset.StandardCharsets;
@@ -36,8 +33,6 @@ import java.util.ArrayList;
import java.util.List;
import java.util.Properties;
import java.util.UUID;
import reactor.netty.Connection;
import reactor.netty.tcp.TcpClient;
@Service
public class MailService {
@@ -50,64 +45,44 @@ public class MailService {
private final AttachmentRepository attachmentRepository;
private final ContactRepository contactRepository;
private final SpamFilterService spamFilterService;
private final DkimService dkimService;
@Value("${mailserver.attachments.dir:./attachments}")
private String attachmentsDir;
@Value("${mailserver.smtp.port:3025}")
private int smtpPort;
@Value("${mailserver.smtp.hostname:localhost}")
private String smtpHostname;
public MailService(MessageRepository messageRepository, FolderRepository folderRepository,
UserRepository userRepository, AttachmentRepository attachmentRepository,
ContactRepository contactRepository,
SpamFilterService spamFilterService,
DkimService dkimService) {
SpamFilterService spamFilterService) {
this.messageRepository = messageRepository;
this.folderRepository = folderRepository;
this.userRepository = userRepository;
this.attachmentRepository = attachmentRepository;
this.contactRepository = contactRepository;
this.spamFilterService = spamFilterService;
this.dkimService = dkimService;
}
public Mono<MessageResponse> sendMessage(String fromEmail, SendRequest request) {
return userRepository.findByEmail(fromEmail)
.switchIfEmpty(Mono.error(new IllegalArgumentException("Sender not found: " + fromEmail)))
.flatMap(fromUser ->
folderRepository.findByUserIdAndName(fromUser.getId(), "Sent")
.switchIfEmpty(Mono.error(new IllegalStateException("Sent folder not found")))
.flatMap(sentFolder -> {
Message message = new Message();
message.setFolderId(sentFolder.getId());
message.setSenderEmail(fromEmail);
message.setSenderName(fromUser.getDisplayName());
message.setRecipientEmail(request.getTo());
message.setSubject(request.getSubject());
message.setBody(request.getBody());
message.setHtml(request.isHtml());
message.setRead(true);
message.setReceivedAt(Instant.now());
message.setMessageId(UUID.randomUUID().toString());
message.setMessageSize((long) (request.getSubject().length() + request.getBody().length()));
return messageRepository.save(message);
})
.flatMap(message ->
sendViaSmtp(fromEmail, request.getTo(), request.getSubject(), request.getBody(),
request.isHtml(), message.getMessageId())
.doOnSuccess(v -> log.info("Email sent via SMTP: {} -> {}", fromEmail, request.getTo()))
.onErrorResume(e -> {
log.error("SMTP send failed: {}", e.getMessage(), e);
return Mono.empty();
})
.thenReturn(message)
)
.map(this::toResponse)
);
/** Copy of a message we sent, in the sender's "Sent" folder. */
public Mono<MessageResponse> saveSent(User fromUser, String to, String subject, String body, boolean html, String messageId) {
return folderRepository.findByUserIdAndName(fromUser.getId(), "Sent")
.switchIfEmpty(Mono.error(new IllegalStateException("Sent folder not found")))
.flatMap(sentFolder -> {
Message message = new Message();
message.setFolderId(sentFolder.getId());
message.setSenderEmail(fromUser.getEmail());
message.setSenderName(fromUser.getDisplayName());
message.setRecipientEmail(to);
message.setSubject(subject);
message.setBody(body);
message.setHtml(html);
message.setRead(true);
message.setReceivedAt(Instant.now());
message.setMessageId(messageId);
message.setMessageSize((long) (subject.length() + body.length()));
return messageRepository.save(message);
})
.map(this::toResponse);
}
public Mono<Void> receiveMessage(String senderEmail, String senderName, String recipientEmail,
@@ -149,13 +124,15 @@ public class MailService {
public Flux<MessageResponse> getMessages(Long folderId, Long userId, int page, int size) {
PageRequest pageable = PageRequest.of(page, size, Sort.by(Sort.Direction.DESC, "receivedAt"));
return messageRepository.findByFolderId(folderId, pageable)
return ownedFolder(folderId, userId)
.flatMapMany(folder -> messageRepository.findByFolderId(folder.getId(), pageable))
.map(this::toResponse);
}
public Flux<MessageResponse> searchMessages(Long folderId, Long userId, String keyword, int page, int size) {
PageRequest pageable = PageRequest.of(page, size, Sort.by(Sort.Direction.DESC, "receivedAt"));
return messageRepository.searchInFolder(folderId, keyword, pageable)
return ownedFolder(folderId, userId)
.flatMapMany(folder -> messageRepository.searchInFolder(folder.getId(), keyword, pageable))
.map(this::toResponse);
}
@@ -164,17 +141,17 @@ public class MailService {
String sender, String recipient,
int page, int size) {
PageRequest pageable = PageRequest.of(page, size, Sort.by(Sort.Direction.DESC, "receivedAt"));
return messageRepository.searchWithFilters(folderId, subject, body, sender, recipient, pageable)
return ownedFolder(folderId, userId)
.flatMapMany(folder -> messageRepository.searchWithFilters(folder.getId(), subject, body, sender, recipient, pageable))
.map(this::toResponse);
}
public Mono<MessageResponse> getMessage(Long messageId, Long userId) {
return messageRepository.findById(messageId)
.map(this::toResponse);
return ownedMessage(messageId, userId).map(this::toResponse);
}
public Mono<Void> markAsRead(Long messageId, Long userId) {
return messageRepository.findById(messageId)
return ownedMessage(messageId, userId)
.flatMap(message -> {
message.setRead(true);
return messageRepository.save(message).then();
@@ -182,7 +159,29 @@ public class MailService {
}
public Mono<Void> deleteMessage(Long messageId, Long userId) {
return messageRepository.deleteById(messageId);
return ownedMessage(messageId, userId).flatMap(messageRepository::delete);
}
/** The folder, when it belongs to the user; otherwise 404 — never someone else's mail. */
private Mono<Folder> ownedFolder(Long folderId, Long userId) {
return folderRepository.findById(folderId)
.filter(folder -> folder.getUserId().equals(userId))
.switchIfEmpty(Mono.error(new ResponseStatusException(HttpStatus.NOT_FOUND, "Folder not found")));
}
private Mono<Message> ownedMessage(Long messageId, Long userId) {
return messageRepository.findById(messageId)
.filterWhen(message -> folderRepository.findById(message.getFolderId())
.map(folder -> folder.getUserId().equals(userId))
.defaultIfEmpty(false))
.switchIfEmpty(Mono.error(new ResponseStatusException(HttpStatus.NOT_FOUND, "Message not found")));
}
private Mono<Attachment> ownedAttachment(Long attachmentId, Long userId) {
return attachmentRepository.findById(attachmentId)
.filterWhen(attachment -> ownedMessage(attachment.getMessageId(), userId).hasElement()
.onErrorReturn(false))
.switchIfEmpty(Mono.error(new ResponseStatusException(HttpStatus.NOT_FOUND, "Attachment not found")));
}
private MessageResponse toResponse(Message message) {
@@ -206,7 +205,7 @@ public class MailService {
public Mono<AttachmentResponse> saveAttachmentReactive(Long messageId, Long userId,
String originalFilename, String contentType,
long sizeBytes, String filePath) {
return messageRepository.findById(messageId)
return ownedMessage(messageId, userId)
.flatMap(message -> {
Attachment attachment = new Attachment();
attachment.setMessageId(messageId);
@@ -223,30 +222,24 @@ public class MailService {
return attachmentsDir;
}
public String getAttachmentFilePath(Long attachmentId, Long userId) {
return attachmentRepository.findById(attachmentId)
.map(Attachment::getFilePath)
.block();
}
public AttachmentResponse getAttachmentInfo(Long attachmentId, Long userId) {
return attachmentRepository.findById(attachmentId)
.map(this::toAttachmentResponse)
.block();
/** The attachment record (file path, name, type) — only the owner's. */
public Mono<Attachment> getAttachment(Long attachmentId, Long userId) {
return ownedAttachment(attachmentId, userId);
}
public Flux<AttachmentResponse> getMessageAttachments(Long messageId, Long userId) {
return attachmentRepository.findByMessageId(messageId)
return ownedMessage(messageId, userId)
.flatMapMany(message -> attachmentRepository.findByMessageId(message.getId()))
.map(this::toAttachmentResponse);
}
public Mono<Void> deleteAttachment(Long attachmentId, Long userId) {
return attachmentRepository.findById(attachmentId)
return ownedAttachment(attachmentId, userId)
.flatMap(attachment -> {
try {
Files.deleteIfExists(Paths.get(attachment.getFilePath()));
} catch (IOException e) {
// Игнорируем
log.warn("Attachment file {} not deleted: {}", attachment.getFilePath(), e.getMessage());
}
return attachmentRepository.delete(attachment);
});
@@ -261,132 +254,6 @@ public class MailService {
return resp;
}
private Mono<Void> sendViaSmtp(String from, String to, String subject, String body,
boolean isHtml, String messageId) {
TcpClient client = TcpClient.create()
.host(smtpHostname)
.port(smtpPort)
.option(io.netty.channel.ChannelOption.SO_TIMEOUT, 30000)
.option(io.netty.channel.ChannelOption.CONNECT_TIMEOUT_MILLIS, 10000);
Properties props = new Properties();
Session mailSession = Session.getDefaultInstance(props);
MimeMessage mimeMessage = new MimeMessage(mailSession);
try {
mimeMessage.setFrom(from);
mimeMessage.setRecipient(jakarta.mail.Message.RecipientType.TO, new jakarta.mail.internet.InternetAddress(to));
mimeMessage.setSubject(subject);
mimeMessage.setText(body, isHtml ? "text/html" : "text/plain", "UTF-8");
mimeMessage.setHeader("Message-ID", "<" + messageId + "@" + smtpHostname + ">");
mimeMessage.setSentDate(new java.util.Date());
dkimService.signMessage(mimeMessage);
ByteArrayOutputStream baos = new ByteArrayOutputStream();
mimeMessage.writeTo(baos);
String mimeContent = baos.toString(StandardCharsets.UTF_8);
StringBuilder dataBody = new StringBuilder();
String[] lines = mimeContent.split("\\r?\\n");
for (String mimeLine : lines) {
if (mimeLine.startsWith(".")) {
dataBody.append(".").append(mimeLine);
} else {
dataBody.append(mimeLine);
}
dataBody.append("\r\n");
}
dataBody.append(".\r\n");
// SMTP — последовательный протокол: команда -> ответ -> команда -> ответ
// connection.inbound().receive() можно подписать только ОДИН раз,
// поэтому используем Sinks.Many с directBestEffort для шаринга ответов
return client.connect()
.flatMap(connection -> {
// Sinks.Many — один поток чтения, много подписчиков через multicast
Sinks.Many<String> responseSink = Sinks.many().replay().limit(1);
// Подписываемся на inbound ОДИН раз и пишем все ответы в sink
connection.inbound()
.receive()
.asString(StandardCharsets.UTF_8)
.doOnNext(line -> {
String trimmed = line.trim();
log.debug("SMTP клиент ответ: {}", trimmed);
responseSink.tryEmitNext(trimmed);
})
.subscribe();
// Собираем все команды в список для последовательной отправки
List<String> commands = new ArrayList<>();
commands.add("EHLO " + smtpHostname + "\r\n");
commands.add("MAIL FROM:<" + from + ">\r\n");
commands.add("RCPT TO:<" + to + ">\r\n");
commands.add("DATA\r\n");
commands.add(dataBody.toString());
commands.add("QUIT\r\n");
// Ожидаемые коды ответов для каждой команды (включая banner)
List<String> expectedCodes = new ArrayList<>();
expectedCodes.add("220"); // banner
expectedCodes.add("250"); // EHLO
expectedCodes.add("250"); // MAIL FROM
expectedCodes.add("250"); // RCPT TO
expectedCodes.add("354"); // DATA
expectedCodes.add("250"); // тело DATA (завершение)
expectedCodes.add("221"); // QUIT
// Последовательно отправляем команды и ждём ответы
Mono<Void> send = Mono.empty();
for (int i = 0; i < commands.size(); i++) {
final String cmd = commands.get(i);
final String expectedCode = expectedCodes.get(i);
send = send.then(sendAndAwait(connection, cmd, responseSink, expectedCode));
}
return send.then(Mono.fromRunnable(() -> connection.dispose()));
});
} catch (MessagingException | IOException e) {
return Mono.error(new RuntimeException("Failed to prepare SMTP message", e));
}
}
/**
* Отправляет SMTP команду и ждёт ответ с указанным кодом.
* Для многострочных ответов (EHLO) читает до строки без '-' в конце кода.
*/
private Mono<Void> sendAndAwait(Connection connection, String command,
Sinks.Many<String> responseSink,
String expectedCode) {
log.debug("SMTP клиент команда: {}", command.trim());
// Отправляем команду
Mono<Void> send = connection.outbound()
.sendString(Mono.just(command))
.then();
// Ждём ответ из sink — каждый вызов получает свой Flux подписчика
Mono<Void> readResponse = responseSink.asFlux()
.takeWhile(line -> {
if (expectedCode != null && line.startsWith(expectedCode + "-")) {
return true;
}
return false;
})
.doOnNext(line -> {
if (expectedCode != null && !line.startsWith(expectedCode)) {
log.warn("SMTP неожиданный ответ (ожидалось {}): {}", expectedCode, line);
}
})
.then()
.timeout(java.time.Duration.ofSeconds(30))
.onErrorResume(e -> Mono.error(new RuntimeException("SMTP response timeout", e)));
return send.then(readResponse);
}
// --- Contacts ---
public Flux<Contact> getContacts(Long userId) {
backend/src/main/java/com/mailserver/service/SubmissionService.java
+74
View File
@@ -0,0 +1,74 @@
package com.mailserver.service;
import com.mailserver.dto.MessageResponse;
import com.mailserver.dto.SendRequest;
import com.mailserver.repository.UserRepository;
import com.mailserver.smtp.MailRouter;
import com.mailserver.smtp.SmtpBackend;
import jakarta.mail.Message;
import jakarta.mail.Session;
import jakarta.mail.internet.InternetAddress;
import jakarta.mail.internet.MimeMessage;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.HttpStatus;
import org.springframework.stereotype.Service;
import org.springframework.web.server.ResponseStatusException;
import reactor.core.publisher.Mono;
import reactor.core.scheduler.Schedulers;
import java.io.ByteArrayOutputStream;
import java.util.Date;
import java.util.List;
import java.util.Locale;
import java.util.Properties;
import java.util.UUID;
/** "Send" in the web client: builds the MIME message and routes it like an authenticated SMTP submission. */
@Service
public class SubmissionService {
private final UserRepository users;
private final MailService mailService;
private final MailRouter router;
private final String hostname;
public SubmissionService(UserRepository users, MailService mailService, MailRouter router,
@Value("${mailserver.smtp.hostname:localhost}") String hostname) {
this.users = users;
this.mailService = mailService;
this.router = router;
this.hostname = hostname;
}
public Mono<MessageResponse> send(String fromEmail, SendRequest request) {
String to = request.getTo().trim().toLowerCase(Locale.ROOT);
return users.findByEmail(fromEmail)
.switchIfEmpty(Mono.error(new ResponseStatusException(HttpStatus.UNAUTHORIZED)))
.flatMap(user -> Mono.fromCallable(() -> {
SmtpBackend.Route route = router.route(to, user.getEmail());
switch (route) {
case LOCAL, OUTBOUND -> { }
case UNKNOWN_USER -> throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "No such mailbox: " + to);
case OUTBOUND_DISABLED -> throw new ResponseStatusException(HttpStatus.BAD_REQUEST,
"Sending outside is disabled on this server");
case RELAY_DENIED -> throw new IllegalStateException("logged-in user denied relay");
}
String messageId = UUID.randomUUID() + "@" + hostname;
MimeMessage mime = new MimeMessage(Session.getInstance(new Properties()));
mime.setFrom(new InternetAddress(user.getEmail(), user.getDisplayName(), "UTF-8"));
mime.setRecipient(Message.RecipientType.TO, new InternetAddress(to));
mime.setSubject(request.getSubject(), "UTF-8");
mime.setText(request.getBody(), "UTF-8", request.isHtml() ? "html" : "plain");
mime.setSentDate(new Date());
mime.saveChanges();
mime.setHeader("Message-ID", "<" + messageId + ">");
ByteArrayOutputStream bytes = new ByteArrayOutputStream();
mime.writeTo(bytes);
router.accept(new SmtpBackend.Envelope("127.0.0.1", hostname, user.getEmail(), user.getEmail(),
List.of(new SmtpBackend.Recipient(to, route))), bytes.toByteArray());
return messageId;
}).subscribeOn(Schedulers.boundedElastic())
.flatMap(messageId -> mailService.saveSent(user, to, request.getSubject(), request.getBody(),
request.isHtml(), messageId)));
}
}
backend/src/main/java/com/mailserver/smtp/MailRouter.java
+83
View File
@@ -0,0 +1,83 @@
package com.mailserver.smtp;
import com.mailserver.config.MailDomains;
import com.mailserver.delivery.OutboundQueue;
import com.mailserver.delivery.SmtpDeliveryClient;
import com.mailserver.domain.User;
import com.mailserver.repository.UserRepository;
import com.mailserver.service.DkimService;
import com.mailserver.service.LocalDelivery;
import com.mailserver.service.UserService;
import org.springframework.stereotype.Service;
import java.util.Locale;
/**
* Where mail goes — one rule for SMTP and for the web client:
* our domain → our mailbox (or "no such user"); catch-all set → everything into that mailbox;
* someone else's domain → the delivery queue, only for a logged-in sender (never an open relay).
*/
@Service
public class MailRouter implements SmtpBackend {
private final MailDomains domains;
private final UserRepository users;
private final UserService userService;
private final LocalDelivery localDelivery;
private final OutboundQueue queue;
private final DkimService dkim;
private final SmtpDeliveryClient client;
public MailRouter(MailDomains domains, UserRepository users, UserService userService, LocalDelivery localDelivery,
OutboundQueue queue, DkimService dkim, SmtpDeliveryClient client) {
this.domains = domains;
this.users = users;
this.userService = userService;
this.localDelivery = localDelivery;
this.queue = queue;
this.dkim = dkim;
this.client = client;
}
@Override
public boolean authenticate(String username, String password) {
User user = users.findByEmail(username.toLowerCase(Locale.ROOT)).block();
return user != null && user.isActive() && userService.checkPassword(user, password);
}
@Override
public Route route(String recipient, String authenticatedUser) {
if (domains.catchAll() != null) {
return Route.LOCAL;
}
if (domains.isLocal(recipient)) {
return Boolean.TRUE.equals(users.existsByEmail(recipient.toLowerCase(Locale.ROOT)).block())
? Route.LOCAL : Route.UNKNOWN_USER;
}
if (authenticatedUser == null) {
return Route.RELAY_DENIED;
}
return client.mode() == SmtpDeliveryClient.Mode.OFF ? Route.OUTBOUND_DISABLED : Route.OUTBOUND;
}
@Override
public void accept(Envelope envelope, byte[] message) throws Exception {
boolean trusted = envelope.authenticatedUser() != null;
byte[] signed = null;
for (Recipient recipient : envelope.recipients()) {
switch (recipient.route()) {
case LOCAL -> {
String mailbox = domains.catchAll() != null ? domains.catchAll() : recipient.address();
localDelivery.deliver(message, mailbox, envelope.remoteIp(), envelope.mailFrom(), trusted);
}
case OUTBOUND -> {
if (signed == null) {
signed = dkim.sign(message);
}
queue.enqueue(envelope.mailFrom(), recipient.address(), signed).block();
}
default -> throw new IllegalStateException("Recipient was not accepted: " + recipient);
}
}
}
}
backend/src/main/java/com/mailserver/smtp/SmtpBackend.java
+41
View File
@@ -0,0 +1,41 @@
package com.mailserver.smtp;
import java.util.List;
/**
* What the SMTP server asks the rest of the application. All methods may block (database, DNS):
* the server calls them on a worker thread, never on the network event loop.
*/
public interface SmtpBackend {
/** Where a recipient goes, decided at RCPT TO. */
enum Route {
/** A mailbox of ours (or the catch-all mailbox) — store it. */
LOCAL,
/** Someone else's address, sender is logged in — queue for delivery. */
OUTBOUND,
/** Address of our domain that does not exist. */
UNKNOWN_USER,
/** Someone else's address and the sender is not logged in: we are not an open relay. */
RELAY_DENIED,
/** Someone else's address, outbound delivery is switched off on this server. */
OUTBOUND_DISABLED
}
record Recipient(String address, Route route) {
}
record Envelope(String remoteIp, String helo, String mailFrom, String authenticatedUser, List<Recipient> recipients) {
}
/** true — the address and password belong to an active mailbox. */
boolean authenticate(String username, String password);
Route route(String recipient, String authenticatedUser);
/**
* Stores or queues the message for every recipient. Returns normally only when the message is safe
* (stored or queued) — then the client gets 250. Any exception → 451, the client will retry.
*/
void accept(Envelope envelope, byte[] message) throws Exception;
}
backend/src/main/java/com/mailserver/smtp/SmtpServer.java
+460
View File
@@ -0,0 +1,460 @@
package com.mailserver.smtp;
import io.netty.handler.codec.LineBasedFrameDecoder;
import io.netty.handler.timeout.ReadTimeoutHandler;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import reactor.core.publisher.Flux;
import reactor.core.publisher.Mono;
import reactor.core.scheduler.Schedulers;
import reactor.netty.DisposableServer;
import reactor.netty.tcp.TcpServer;
import java.io.ByteArrayOutputStream;
import java.net.InetSocketAddress;
import java.nio.charset.StandardCharsets;
import java.time.Duration;
import java.time.ZonedDateTime;
import java.time.format.DateTimeFormatter;
import java.util.ArrayList;
import java.util.Base64;
import java.util.List;
import java.util.Locale;
import java.util.concurrent.TimeUnit;
/**
* SMTP server (RFC 5321) on Reactor Netty.
* <ul>
* <li>input is split into lines by {@link LineBasedFrameDecoder} — a network packet may hold half a line or many
* pipelined commands, both work;</li>
* <li>AUTH PLAIN / LOGIN against our mailboxes; someone else's address is accepted only from a logged-in sender
* (no open relay); a logged-in sender may use only his own address in MAIL FROM;</li>
* <li>the message is stored or queued before the client gets 250 — on failure 451 and the client retries;</li>
* <li>database and DNS work runs on a worker thread, not on the event loop.</li>
* </ul>
* No STARTTLS yet: AUTH is offered only when {@code authWithoutTls} is on (a closed network: inside a VM or a docker network).
*/
public class SmtpServer {
private static final Logger log = LoggerFactory.getLogger(SmtpServer.class);
// RFC 5321 4.5.3.1.6: a text line is at most 1000 octets with CRLF; we allow more for sloppy clients
static final int MAX_LINE = 64 * 1024;
static final int MAX_RECIPIENTS = 100;
private static final int MAX_BAD_COMMANDS = 20;
public record Settings(String host, int port, String hostname, long maxMessageBytes, boolean authWithoutTls,
Duration idleTimeout) {
}
private final Settings settings;
private final SmtpBackend backend;
private DisposableServer server;
public SmtpServer(Settings settings, SmtpBackend backend) {
this.settings = settings;
this.backend = backend;
}
public void start() {
server = TcpServer.create()
.host(settings.host())
.port(settings.port())
.doOnConnection(connection -> connection
.addHandlerFirst("smtp-idle", new ReadTimeoutHandler(settings.idleTimeout().toSeconds(), TimeUnit.SECONDS))
.addHandlerLast("smtp-lines", new LineBasedFrameDecoder(MAX_LINE, true, false)))
.handle((inbound, outbound) -> {
String[] remoteIp = {"unknown"};
inbound.withConnection(c -> {
if (c.address() instanceof InetSocketAddress address && address.getAddress() != null) {
remoteIp[0] = address.getAddress().getHostAddress();
}
});
Session session = new Session(remoteIp[0]);
Flux<String> replies = inbound.receive().asByteArray()
.concatMap(session::onLine)
.onErrorResume(e -> {
log.debug("SMTP {}: connection closed: {}", session.remoteIp, e.toString());
return Mono.just("421 4.4.2 " + settings.hostname() + " closing connection\r\n");
})
.takeUntil(reply -> session.closing);
return outbound.sendString(Flux.concat(
Mono.just("220 " + settings.hostname() + " ESMTP ready\r\n"), replies), StandardCharsets.US_ASCII);
})
.bindNow(Duration.ofSeconds(10));
log.info("SMTP server listening on {}:{} ({})", settings.host(), port(), settings.hostname());
}
public int port() {
return server.port();
}
public void stop() {
if (server != null) {
server.disposeNow(Duration.ofSeconds(5));
}
}
private enum State { COMMAND, DATA, AUTH_PLAIN, AUTH_LOGIN_USER, AUTH_LOGIN_PASSWORD }
private final class Session {
final String remoteIp;
State state = State.COMMAND;
String helo;
boolean extended;
String authenticatedUser;
String pendingAuthUser;
String mailFrom;
final List<SmtpBackend.Recipient> recipients = new ArrayList<>();
final ByteArrayOutputStream data = new ByteArrayOutputStream();
boolean dataTooBig;
int badCommands;
volatile boolean closing;
Session(String remoteIp) {
this.remoteIp = remoteIp;
}
Mono<String> onLine(byte[] raw) {
byte[] line = stripCr(raw);
return switch (state) {
case DATA -> onDataLine(line);
case AUTH_PLAIN -> authPlain(ascii(line));
case AUTH_LOGIN_USER -> authLoginUser(ascii(line));
case AUTH_LOGIN_PASSWORD -> authLoginPassword(ascii(line));
case COMMAND -> onCommand(ascii(line));
};
}
private Mono<String> onCommand(String line) {
String[] parts = line.trim().split("\\s+", 2);
String verb = parts[0].toUpperCase(Locale.ROOT);
String arg = parts.length > 1 ? parts[1].trim() : "";
return switch (verb) {
case "EHLO", "HELO" -> hello(verb.equals("EHLO"), arg);
case "AUTH" -> auth(arg);
case "MAIL" -> mail(arg);
case "RCPT" -> rcpt(arg);
case "DATA" -> dataStart();
case "RSET" -> {
resetTransaction();
yield reply("250 2.0.0 OK");
}
case "NOOP" -> reply("250 2.0.0 OK");
case "VRFY" -> reply("252 2.5.0 Cannot VRFY user, but will accept message");
case "STARTTLS" -> reply("454 4.7.0 TLS not available");
case "QUIT" -> {
closing = true;
yield reply("221 2.0.0 " + settings.hostname() + " Bye");
}
case "" -> reply("500 5.5.2 Empty command");
default -> bad("500 5.5.1 Command not recognized");
};
}
private Mono<String> hello(boolean ehlo, String arg) {
if (arg.isEmpty()) {
return reply("501 5.5.4 Hostname required");
}
helo = arg;
extended = ehlo;
resetTransaction();
if (!ehlo) {
return reply("250 " + settings.hostname());
}
StringBuilder sb = new StringBuilder();
sb.append("250-").append(settings.hostname()).append(" Hello ").append(arg).append("\r\n");
sb.append("250-SIZE ").append(settings.maxMessageBytes()).append("\r\n");
sb.append("250-8BITMIME\r\n");
sb.append("250-PIPELINING\r\n");
if (settings.authWithoutTls()) {
sb.append("250-AUTH PLAIN LOGIN\r\n");
}
sb.append("250 ENHANCEDSTATUSCODES\r\n");
return Mono.just(sb.toString());
}
private Mono<String> auth(String arg) {
if (!settings.authWithoutTls()) {
return reply("538 5.7.11 Encryption required for requested authentication mechanism");
}
if (helo == null || !extended) {
return reply("503 5.5.1 EHLO first");
}
if (authenticatedUser != null) {
return reply("503 5.5.1 Already authenticated");
}
if (mailFrom != null) {
return reply("503 5.5.1 AUTH not allowed during a mail transaction");
}
String[] parts = arg.split("\\s+", 2);
String mechanism = parts[0].toUpperCase(Locale.ROOT);
String initial = parts.length > 1 ? parts[1] : null;
if (mechanism.equals("PLAIN")) {
if (initial == null) {
state = State.AUTH_PLAIN;
return reply("334 ");
}
return authPlain(initial);
}
if (mechanism.equals("LOGIN")) {
if (initial != null) {
return authLoginUser(initial);
}
state = State.AUTH_LOGIN_USER;
return reply("334 " + b64("Username:"));
}
return reply("504 5.5.4 Unrecognized authentication type");
}
private Mono<String> authPlain(String response) {
state = State.COMMAND;
if (response.equals("*")) {
return reply("501 5.0.0 Authentication cancelled");
}
String decoded = unb64(response);
// authzid \0 authcid \0 password
String[] fields = decoded == null ? new String[0] : decoded.split("\0", -1);
if (fields.length != 3) {
return reply("501 5.5.2 Cannot decode AUTH PLAIN response");
}
return checkPassword(fields[1], fields[2]);
}
private Mono<String> authLoginUser(String response) {
if (response.equals("*")) {
state = State.COMMAND;
return reply("501 5.0.0 Authentication cancelled");
}
pendingAuthUser = unb64(response);
if (pendingAuthUser == null) {
state = State.COMMAND;
return reply("501 5.5.2 Cannot decode username");
}
state = State.AUTH_LOGIN_PASSWORD;
return reply("334 " + b64("Password:"));
}
private Mono<String> authLoginPassword(String response) {
state = State.COMMAND;
String user = pendingAuthUser;
pendingAuthUser = null;
if (response.equals("*")) {
return reply("501 5.0.0 Authentication cancelled");
}
String password = unb64(response);
if (password == null) {
return reply("501 5.5.2 Cannot decode password");
}
return checkPassword(user, password);
}
private Mono<String> checkPassword(String user, String password) {
String username = user.trim().toLowerCase(Locale.ROOT);
return blocking(() -> backend.authenticate(username, password))
.map(ok -> {
if (ok) {
authenticatedUser = username;
log.info("SMTP {}: authenticated as {}", remoteIp, username);
return "235 2.7.0 Authentication successful\r\n";
}
log.warn("SMTP {}: authentication failed for {}", remoteIp, username);
badCommands++;
return "535 5.7.8 Authentication credentials invalid\r\n";
});
}
private Mono<String> mail(String arg) {
if (helo == null) {
return reply("503 5.5.1 EHLO/HELO first");
}
if (mailFrom != null) {
return reply("503 5.5.1 Sender already specified");
}
if (!arg.regionMatches(true, 0, "FROM:", 0, 5)) {
return reply("501 5.5.4 Syntax: MAIL FROM:<address>");
}
String rest = arg.substring(5).trim();
String address = path(rest);
if (address == null) {
return reply("501 5.1.7 Bad sender address syntax");
}
Long size = sizeParam(rest);
if (size != null && size > settings.maxMessageBytes()) {
return reply("552 5.3.4 Message size exceeds fixed limit");
}
if (authenticatedUser != null && !address.isEmpty() && !address.equals(authenticatedUser)) {
return reply("553 5.7.1 Sender address not owned by authenticated user");
}
mailFrom = address;
return reply("250 2.1.0 Sender OK");
}
private Mono<String> rcpt(String arg) {
if (mailFrom == null) {
return reply("503 5.5.1 MAIL first");
}
if (!arg.regionMatches(true, 0, "TO:", 0, 3)) {
return reply("501 5.5.4 Syntax: RCPT TO:<address>");
}
String address = path(arg.substring(3).trim());
if (address == null || address.isEmpty() || address.indexOf('@') < 1) {
return reply("501 5.1.3 Bad recipient address syntax");
}
if (recipients.size() >= MAX_RECIPIENTS) {
return reply("452 4.5.3 Too many recipients");
}
String user = authenticatedUser;
return blocking(() -> backend.route(address, user))
.map(route -> switch (route) {
case LOCAL, OUTBOUND -> {
recipients.add(new SmtpBackend.Recipient(address, route));
yield "250 2.1.5 Recipient OK\r\n";
}
case UNKNOWN_USER -> "550 5.1.1 No such user here\r\n";
case RELAY_DENIED -> {
log.warn("SMTP {}: relay denied {} -> {}", remoteIp, mailFrom, address);
yield "550 5.7.1 Relaying denied: authentication required\r\n";
}
case OUTBOUND_DISABLED -> "550 5.7.1 Outbound delivery is disabled on this server\r\n";
});
}
private Mono<String> dataStart() {
if (mailFrom == null) {
return reply("503 5.5.1 MAIL first");
}
if (recipients.isEmpty()) {
return reply("554 5.5.1 No valid recipients");
}
state = State.DATA;
data.reset();
dataTooBig = false;
return reply("354 End data with <CR><LF>.<CR><LF>");
}
private Mono<String> onDataLine(byte[] line) {
if (line.length == 1 && line[0] == '.') {
state = State.COMMAND;
if (dataTooBig) {
resetTransaction();
return reply("552 5.3.4 Message size exceeds fixed limit");
}
SmtpBackend.Envelope envelope = new SmtpBackend.Envelope(
remoteIp, helo, mailFrom, authenticatedUser, List.copyOf(recipients));
byte[] message = withReceivedHeader(data.toByteArray());
resetTransaction();
return blocking(() -> {
backend.accept(envelope, message);
return true;
})
.map(ok -> "250 2.0.0 Message accepted\r\n")
.onErrorResume(e -> {
log.error("SMTP {}: message from {} not stored: {}", remoteIp, envelope.mailFrom(), e.toString());
return Mono.just("451 4.3.0 Message not stored, try again later\r\n");
});
}
if (!dataTooBig) {
int offset = line.length > 0 && line[0] == '.' ? 1 : 0; // dot-unstuffing (RFC 5321 4.5.2)
data.write(line, offset, line.length - offset);
data.write('\r');
data.write('\n');
if (data.size() > settings.maxMessageBytes()) {
dataTooBig = true;
data.reset();
}
}
return Mono.empty();
}
private byte[] withReceivedHeader(byte[] message) {
String received = "Received: from " + helo + " ([" + remoteIp + "])\r\n"
+ "\tby " + settings.hostname() + " with " + (authenticatedUser != null ? "ESMTPA" : "ESMTP") + ";\r\n"
+ "\t" + DateTimeFormatter.RFC_1123_DATE_TIME.format(ZonedDateTime.now()) + "\r\n";
byte[] header = received.getBytes(StandardCharsets.US_ASCII);
byte[] all = new byte[header.length + message.length];
System.arraycopy(header, 0, all, 0, header.length);
System.arraycopy(message, 0, all, header.length, message.length);
return all;
}
private void resetTransaction() {
mailFrom = null;
recipients.clear();
data.reset();
dataTooBig = false;
}
private Mono<String> bad(String text) {
if (++badCommands > MAX_BAD_COMMANDS) {
closing = true;
return reply("421 4.7.0 Too many errors, closing connection");
}
return reply(text);
}
}
private static Mono<String> reply(String line) {
return Mono.just(line + "\r\n");
}
private static <T> Mono<T> blocking(java.util.concurrent.Callable<T> work) {
return Mono.fromCallable(work).subscribeOn(Schedulers.boundedElastic());
}
/** "<a@b> SIZE=1" → "a@b"; "<>" → "" (null sender of bounces); malformed → null. */
static String path(String text) {
int start = text.indexOf('<');
int end = text.indexOf('>', start + 1);
if (start != 0 || end < 0) {
return null;
}
String address = text.substring(1, end).trim();
int colon = address.indexOf(':'); // source route "@a,@b:user@host" (RFC 5321 4.1.2) — ignored
if (address.startsWith("@") && colon > 0) {
address = address.substring(colon + 1);
}
if (address.contains(" ") || address.contains("<")) {
return null;
}
return address.toLowerCase(Locale.ROOT);
}
private static Long sizeParam(String text) {
for (String param : text.substring(text.indexOf('>') + 1).trim().split("\\s+")) {
if (param.regionMatches(true, 0, "SIZE=", 0, 5)) {
try {
return Long.parseLong(param.substring(5));
} catch (NumberFormatException e) {
return null;
}
}
}
return null;
}
private static byte[] stripCr(byte[] line) {
if (line.length > 0 && line[line.length - 1] == '\r') {
byte[] copy = new byte[line.length - 1];
System.arraycopy(line, 0, copy, 0, copy.length);
return copy;
}
return line;
}
private static String ascii(byte[] line) {
return new String(line, StandardCharsets.UTF_8);
}
private static String b64(String text) {
return Base64.getEncoder().encodeToString(text.getBytes(StandardCharsets.UTF_8));
}
private static String unb64(String text) {
try {
return new String(Base64.getDecoder().decode(text.trim()), StandardCharsets.UTF_8);
} catch (IllegalArgumentException e) {
return null;
}
}
}