tracker

51.8 KB

1. // hl:smtp plugin — an SMTP submission client (libsmtp.so, dlopen'd by the runtime)
2. //
3. // Mission 137. Sending mail, and nothing else: there is no receiving (IMAP/POP),
4. // no DKIM signing and no queue-with-retry here — see plugins/smtp/README.md for
5. // why each of those is somewhere else's job.
6. //
7. // SHAPE
8. // hl_smtp_open(host, port, options) → Number mailer id
9. // hl_smtp_send(id, message) → Number job id, or an hl_error REFUSAL
10. // hl_smtp_results(id) → the result source (iterator + wake fd)
11. // hl_smtp_close(id) → null
12. //
13. // THE SPLIT BETWEEN THE THREADS is the whole design:
14. //
15. // • `send()` runs on the Hybriel thread and does everything that can FAIL
16. // LOCALLY — validating the addresses, refusing a header injection, rendering
17. // the RFC 5322 message. Those are located errors at the caller's own line,
18. // which they can only be if they happen before the job leaves.
19. // • the WORKER thread does the conversation (connect, EHLO, STARTTLS, AUTH,
20. // MAIL/RCPT/DATA, QUIT). Nothing on the Hybriel thread waits for it: the
21. // result goes onto a queue and the queue's eventfd is rung, which is mission
22. // 125's bell — the event loop is parked in one `epoll_wait` over every
23. // source's fd and comes back with the answer.
24. //
25. // So a server that sends a mail keeps serving while the mail is in flight, and a
26. // script that only sends mail drains the same source with `for (r of m.results())`.
27. // One source, the two consumptions the runtime already gives every plugin source
28. // (`hl:http1`'s server iterator has been both since mission 012/052).
29. //
30. // TLS rides plugins/http/tls_common.zig — the SAME OpenSSL layer the servers use,
31. // through the client half mission 137 added to it. There is no second TLS here.
33. const std = @import("std");
34. const api = @import("plugin_api");
35. const http = @import("http_common");
36. const tls = @import("tls_common");
38. const HlValue = api.HlValue;
39. const HlObject = api.HlObject;
40. const HlField = api.HlField;
41. const HlIterator = api.HlIterator;
42. const HlString = api.HlString;
44. const linux = std.os.linux;
45. const c = std.c;
46. const PthreadMutex = c.pthread_mutex_t;
47. const PthreadCond = c.pthread_cond_t;
49. // per-mailer state is touched by two threads: the plugins' allocator (plugin_api.zig)
50. const allocator = api.allocator;
52. fn mutexLock(m: *PthreadMutex) void {
53. _ = c.pthread_mutex_lock(m);
54. }
55. fn mutexUnlock(m: *PthreadMutex) void {
56. _ = c.pthread_mutex_unlock(m);
57. }
58. fn condSignal(cnd: *PthreadCond) void {
59. _ = c.pthread_cond_signal(cnd);
60. }
61. fn condBroadcast(cnd: *PthreadCond) void {
62. _ = c.pthread_cond_broadcast(cnd);
63. }
64. fn condWait(cnd: *PthreadCond, m: *PthreadMutex) void {
65. _ = c.pthread_cond_wait(cnd, m);
66. }
68. /// Direct syscall for stderr — std.debug.print pulls in std.Progress, whose
69. /// global state is ABI-incompatible when a .so is loaded into a differently
70. /// built binary (the same reason tls_common.zig has its own).
71. fn logMsg(msg: []const u8) void {
72. _ = linux.write(2, msg.ptr, msg.len);
73. }
75. // ── REFUSALS ────────────────────────────────────────────────────────────────
76. //
77. // An hl_error returned at the top level of a plugin call becomes a LOCATED
78. // runtime error at the `__native` call site and is offered to `on Error(e)`
79. // first (plugin_loader / native_bridge). That is the channel every local refusal
80. // here uses, so `m.send(…)` with a newline in the subject points at the line the
81. // author wrote and is catchable exactly like any other plugin failure.
82. //
83. // The text is rendered into a module buffer: a plugin call never yields, and the
84. // runtime dupes the string into its own tracker the instant the call returns.
85. var err_buf: [1024]u8 = undefined;
87. fn refuse(comptime fmt: []const u8, args: anytype) HlValue {
88. const s = std.fmt.bufPrint(&err_buf, fmt, args) catch "hl:smtp refused the message";
89. return api.makeError(s);
90. }
92. // ── ARGUMENT READING ────────────────────────────────────────────────────────
94. fn fieldOf(v: HlValue, key: []const u8) ?HlValue {
95. if (v.type != .hl_object) return null;
96. const obj = v.data.object;
97. for (obj.fields[0..obj.field_count]) |f| {
98. if (std.mem.eql(u8, f.key.ptr[0..f.key.len], key)) return f.value;
99. }
100. return null;
101. }
103. fn strField(v: HlValue, key: []const u8) ?[]const u8 {
104. const f = fieldOf(v, key) orelse return null;
105. if (f.type != .hl_string) return null;
106. return f.data.string.ptr[0..f.data.string.len];
107. }
109. fn boolField(v: HlValue, key: []const u8, dflt: bool) bool {
110. const f = fieldOf(v, key) orelse return dflt;
111. return switch (f.type) {
112. .hl_bool => f.data.boolean,
113. else => dflt,
114. };
115. }
117. fn numField(v: HlValue, key: []const u8, dflt: f64) f64 {
118. const f = fieldOf(v, key) orelse return dflt;
119. if (f.type != .hl_number) return dflt;
120. return f.data.number;
121. }
123. /// THE SENDER'S ADDRESS, under either name.
124. ///
125. /// `from` is a RESERVED WORD in Hybriel (`import X from './x.hl'`), so
126. /// `{ from = "a@b" }` does not parse and `msg.from` is not a member access.
127. /// Rather than force every caller to write the quoted-key form, both spellings
128. /// are read here: `"from" = …` (the quoted key, which parses fine and is what
129. /// mission 137's brief names) and `sender = …` (the bare-identifier form, for a
130. /// caller who would rather not quote). Same field, one meaning; the quoted one
131. /// wins if a message somehow carries both.
132. fn senderField(v: HlValue) ?[]const u8 {
133. if (strField(v, "from")) |s| return s;
134. return strField(v, "sender");
135. }
137. fn dupOpt(s: ?[]const u8) ?[]u8 {
138. const src = s orelse return null;
139. if (src.len == 0) return null;
140. return allocator.dupe(u8, src) catch null;
141. }
143. // ── CONFIGURATION ───────────────────────────────────────────────────────────
145. const TlsMode = enum { starttls, implicit, none };
146. const AuthMode = enum { auto, plain, login, none };
148. // ── THE JOB AND ITS RESULT ──────────────────────────────────────────────────
150. const Job = struct {
151. id: u32,
152. from: []u8,
153. /// Envelope recipients — every RCPT TO the conversation issues.
154. rcpt: [][]u8,
155. /// The rendered RFC 5322 message: CRLF line endings, dot-stuffed, WITHOUT
156. /// the terminating ".". Built on the Hybriel thread by `send`.
157. data: []u8,
159. fn deinit(self: *Job) void {
160. allocator.free(self.from);
161. for (self.rcpt) |r| allocator.free(r);
162. allocator.free(self.rcpt);
163. allocator.free(self.data);
164. }
165. };
167. const Result = struct {
168. id: u32,
169. ok: bool,
170. /// The last SMTP reply code the conversation saw (0 = never got one).
171. code: u16,
172. /// Which step answered: "connect", "greeting", "ehlo", "starttls", "auth",
173. /// "mail", "rcpt", "data", "body", "quit", "done".
174. stage: []const u8,
175. /// The server's own text, or this plugin's reason for giving up.
176. message: []u8,
177. /// Did the conversation run inside TLS by the time DATA was sent?
178. secure: bool,
179. rcpt: [][]u8,
180. };
182. // ── THE MAILER ──────────────────────────────────────────────────────────────
184. const Mailer = struct {
185. id: u32,
186. host: []u8,
187. port: u16,
188. user: ?[]u8,
189. pass: ?[]u8,
190. from: []u8,
191. helo: []u8,
192. tls_mode: TlsMode,
193. auth_mode: AuthMode,
194. ca_file: ?[]u8,
195. verify: bool,
196. /// Send AUTH over a connection that never became TLS. OFF by default: the
197. /// credentials would be on the wire in the clear, and a default that leaks
198. /// them is not a default, it is a bug with a setting.
199. allow_insecure_auth: bool,
200. timeout_ms: u32,
202. mutex: PthreadMutex,
203. /// The worker parks here for the next job; the drain parks here for the next
204. /// result. One lock covers both queues and `outstanding`, which is what makes
205. /// "no results and nothing outstanding" a single consistent observation.
206. condvar: PthreadCond,
207. jobs: std.ArrayListUnmanaged(Job) = .empty,
208. results: std.ArrayListUnmanaged(Result) = .empty,
209. /// Jobs accepted and not yet answered. The blocking drain ends when this is
210. /// zero and the result queue is empty — that is what lets a script that only
211. /// sends mail terminate.
212. outstanding: usize = 0,
213. next_job: u32 = 1,
214. stop: bool = false,
216. /// Mission 125's bell for the event loop. Rung whenever a result becomes
217. /// visible; over-ringing is free, a missed ring is the only bug there is.
218. wake_fd: i32 = -1,
219. worker: ?std.Thread = null,
220. /// The source object is made ONCE: two iterators over one queue would each
221. /// steal half the results.
222. source: ?*HlIterator = null,
223. registered: bool = false,
225. fn enqueue(self: *Mailer, job: Job) void {
226. mutexLock(&self.mutex);
227. defer mutexUnlock(&self.mutex);
228. self.jobs.append(allocator, job) catch return;
229. self.outstanding += 1;
230. condBroadcast(&self.condvar);
231. }
233. fn takeJob(self: *Mailer) ?Job {
234. mutexLock(&self.mutex);
235. defer mutexUnlock(&self.mutex);
236. while (self.jobs.items.len == 0 and !self.stop) {
237. condWait(&self.condvar, &self.mutex);
238. }
239. if (self.jobs.items.len == 0) return null;
240. return self.jobs.orderedRemove(0);
241. }
243. fn publish(self: *Mailer, result: Result) void {
244. mutexLock(&self.mutex);
245. self.results.append(allocator, result) catch {};
246. if (self.outstanding > 0) self.outstanding -= 1;
247. condBroadcast(&self.condvar);
248. // Rung while the append is still under the lock — the loop drains the
249. // eventfd counter only immediately AFTER a wake, never before blocking,
250. // so a bell rung any time after that drain leaves the level up and the
251. // next epoll_wait returns at once (native/src/loop_wait.zig).
252. http.ringWake(self.wake_fd);
253. mutexUnlock(&self.mutex);
254. }
256. fn tryTake(self: *Mailer) ?Result {
257. mutexLock(&self.mutex);
258. defer mutexUnlock(&self.mutex);
259. if (self.results.items.len == 0) return null;
260. return self.results.orderedRemove(0);
261. }
263. /// Blocking take for the drain form. `null` means DONE, not "nothing yet":
264. /// every accepted job has been answered and its answer taken.
265. fn take(self: *Mailer) ?Result {
266. mutexLock(&self.mutex);
267. defer mutexUnlock(&self.mutex);
268. while (self.results.items.len == 0 and self.outstanding > 0 and !self.stop) {
269. condWait(&self.condvar, &self.mutex);
270. }
271. if (self.results.items.len == 0) return null;
272. return self.results.orderedRemove(0);
273. }
274. };
276. var mailers: std.ArrayListUnmanaged(*Mailer) = .empty;
277. var mailers_mutex: PthreadMutex = c.PTHREAD_MUTEX_INITIALIZER;
278. var next_mailer_id: u32 = 1;
280. fn mailerById(id: u32) ?*Mailer {
281. mutexLock(&mailers_mutex);
282. defer mutexUnlock(&mailers_mutex);
283. for (mailers.items) |m| {
284. if (m.id == id) return m;
285. }
286. return null;
287. }
289. // ── HEADER INJECTION IS A REFUSAL, NOT AN ESCAPE ────────────────────────────
290. //
291. // A CR or an LF inside a `to`, a `from` or a `subject` ends the header and
292. // starts a new one — that is the whole of SMTP header injection, and it is how a
293. // contact form becomes an open relay (`subject = "hi\r\nBcc: everyone@…"`).
294. // Stripping the characters silently would deliver a mail the author did not
295. // write; escaping them is not defined for a header field. So it is a located
296. // refusal, at the caller's line, naming the field and the character.
297. fn checkHeaderValue(field: []const u8, value: []const u8) ?HlValue {
298. for (value, 0..) |ch, i| {
299. if (ch == '\r' or ch == '\n') {
300. return refuse(
301. "hl:smtp refused the message: {s} contains a {s} at byte {d} — a line break in a header field is how mail headers are injected, so it is never sent and never stripped",
302. .{ field, if (ch == '\r') "carriage return" else "line feed", i },
303. );
304. }
305. if (ch == 0) {
306. return refuse(
307. "hl:smtp refused the message: {s} contains a NUL byte at byte {d}",
308. .{ field, i },
309. );
310. }
311. }
312. return null;
313. }
315. /// An envelope address additionally may not carry the delimiters the envelope
316. /// itself is made of: `MAIL FROM:<a@b>` is a command, and a `<`, `>` or a space
317. /// inside the address would rewrite it.
318. fn checkAddress(field: []const u8, value: []const u8) ?HlValue {
319. if (checkHeaderValue(field, value)) |e| return e;
320. if (value.len == 0) {
321. return refuse("hl:smtp refused the message: {s} is empty", .{field});
322. }
323. for (value) |ch| {
324. if (ch == '<' or ch == '>' or ch == ' ' or ch == '\t') {
325. return refuse(
326. "hl:smtp refused the message: the address '{s}' in {s} contains '{c}' — an envelope address is written between angle brackets and may not carry them, or whitespace",
327. .{ value, field, ch },
328. );
329. }
330. }
331. if (std.mem.indexOfScalar(u8, value, '@') == null) {
332. return refuse(
333. "hl:smtp refused the message: the address '{s}' in {s} has no '@'",
334. .{ value, field },
335. );
336. }
337. return null;
338. }
340. // ── MESSAGE RENDERING ───────────────────────────────────────────────────────
342. const b64 = std.base64.standard.Encoder;
344. fn b64Alloc(src: []const u8) ![]u8 {
345. const out = try allocator.alloc(u8, b64.calcSize(src.len));
346. _ = b64.encode(out, src);
347. return out;
348. }
350. fn isAscii(s: []const u8) bool {
351. for (s) |ch| {
352. if (ch >= 0x80) return false;
353. }
354. return true;
355. }
357. const day_names = [_][]const u8{ "Thu", "Fri", "Sat", "Sun", "Mon", "Tue", "Wed" };
358. const month_names = [_][]const u8{ "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec" };
360. /// RFC 5322 §3.3 date-time, always +0000. A mail without a Date is not a mail —
361. /// receivers add their own and it reads as a forgery.
362. fn writeDate(w: *std.ArrayListUnmanaged(u8)) !void {
363. var ts: linux.timespec = undefined;
364. _ = linux.clock_gettime(linux.CLOCK.REALTIME, &ts);
365. const secs: u64 = @intCast(@max(@as(i64, ts.sec), 0));
366. const es = std.time.epoch.EpochSeconds{ .secs = secs };
367. const yd = es.getEpochDay().calculateYearDay();
368. const md = yd.calculateMonthDay();
369. const ds = es.getDaySeconds();
370. // 1970-01-01 was a Thursday, which is why day_names starts there.
371. const dow = day_names[@intCast(es.getEpochDay().day % 7)];
372. var buf: [64]u8 = undefined;
373. const line = try std.fmt.bufPrint(&buf, "Date: {s}, {d:0>2} {s} {d} {d:0>2}:{d:0>2}:{d:0>2} +0000\r\n", .{
374. dow,
375. @as(u32, md.day_index) + 1,
376. month_names[md.month.numeric() - 1],
377. yd.year,
378. ds.getHoursIntoDay(),
379. ds.getMinutesIntoHour(),
380. ds.getSecondsIntoMinute(),
381. });
382. try w.appendSlice(allocator, line);
383. }
385. fn randomHex(out: []u8) void {
386. var raw: [32]u8 = undefined;
387. const need = (out.len + 1) / 2;
388. if (linux.getrandom(&raw, need, 0) != need) {
389. @memset(out, '0');
390. return;
391. }
392. const hex = "0123456789abcdef";
393. for (out, 0..) |*ch, i| {
394. const byte = raw[i / 2];
395. const nib: u8 = if (i % 2 == 0) (byte >> 4) else (byte & 0x0f);
396. ch.* = hex[nib];
397. }
398. }
400. /// A header value that is not pure ASCII becomes an RFC 2047 encoded-word.
401. /// Writing raw UTF-8 into a header is only legal with SMTPUTF8 negotiated, which
402. /// this client does not do — so an umlaut in a subject would arrive as mojibake.
403. fn appendHeader(w: *std.ArrayListUnmanaged(u8), name: []const u8, value: []const u8) !void {
404. try w.appendSlice(allocator, name);
405. try w.appendSlice(allocator, ": ");
406. if (isAscii(value)) {
407. try w.appendSlice(allocator, value);
408. } else {
409. const enc = try b64Alloc(value);
410. defer allocator.free(enc);
411. try w.appendSlice(allocator, "=?UTF-8?B?");
412. try w.appendSlice(allocator, enc);
413. try w.appendSlice(allocator, "?=");
414. }
415. try w.appendSlice(allocator, "\r\n");
416. }
418. /// CRLF DISCIPLINE AND DOT-STUFFING, in one pass over the assembled message.
419. ///
420. /// SMTP's line terminator is CRLF and its end-of-data marker is a line holding
421. /// exactly ".", so a body line that legitimately begins with "." must be sent as
422. /// ".." (RFC 5321 §4.5.2) or it truncates the mail — and a lone LF, which every
423. /// text a program builds is full of, is not a line ending at all on the wire.
424. fn appendDotStuffed(w: *std.ArrayListUnmanaged(u8), body: []const u8) !void {
425. var at_line_start = true;
426. var i: usize = 0;
427. while (i < body.len) : (i += 1) {
428. const ch = body[i];
429. if (ch == '\r') {
430. // Normalise CR and CRLF alike to one CRLF; a bare CR is a line
431. // ending in nothing that talks SMTP.
432. if (i + 1 < body.len and body[i + 1] == '\n') i += 1;
433. try w.appendSlice(allocator, "\r\n");
434. at_line_start = true;
435. continue;
436. }
437. if (ch == '\n') {
438. try w.appendSlice(allocator, "\r\n");
439. at_line_start = true;
440. continue;
441. }
442. if (at_line_start and ch == '.') try w.append(allocator, '.');
443. try w.append(allocator, ch);
444. at_line_start = false;
445. }
446. if (!at_line_start) try w.appendSlice(allocator, "\r\n");
447. }
449. // ── THE CONNECTION ──────────────────────────────────────────────────────────
451. const Conn = struct {
452. fd: i32 = -1,
453. ssl: ?*tls.SSL = null,
454. ctx: ?tls.TlsContext = null,
455. buf: [4096]u8 = undefined,
456. len: usize = 0,
457. pos: usize = 0,
459. fn writeAll(self: *Conn, bytes: []const u8) bool {
460. if (self.ssl) |ssl| {
461. const ctx = &(self.ctx orelse return false);
462. return ctx.writeAll(ssl, bytes) == bytes.len;
463. }
464. var off: usize = 0;
465. while (off < bytes.len) {
466. const rc = linux.write(self.fd, bytes.ptr + off, bytes.len - off);
467. const n: isize = @bitCast(rc);
468. if (n <= 0) return false;
469. off += @intCast(n);
470. }
471. return true;
472. }
474. fn fill(self: *Conn) bool {
475. if (self.ssl) |ssl| {
476. const ctx = &(self.ctx orelse return false);
477. const n = ctx.read(ssl, self.buf[0..]);
478. if (n <= 0) return false;
479. self.len = @intCast(n);
480. self.pos = 0;
481. return true;
482. }
483. const rc = linux.read(self.fd, &self.buf, self.buf.len);
484. const n: isize = @bitCast(rc);
485. if (n <= 0) return false;
486. self.len = @intCast(n);
487. self.pos = 0;
488. return true;
489. }
491. /// One CRLF-terminated reply line, without its terminator, appended into
492. /// `out` (which is cleared first). `false` = the peer went away or timed out.
493. fn readLine(self: *Conn, out: *std.ArrayListUnmanaged(u8)) bool {
494. out.clearRetainingCapacity();
495. while (true) {
496. if (self.pos >= self.len) {
497. if (!self.fill()) return false;
498. }
499. const ch = self.buf[self.pos];
500. self.pos += 1;
501. if (ch == '\n') {
502. if (out.items.len > 0 and out.items[out.items.len - 1] == '\r') {
503. _ = out.pop();
504. }
505. return true;
506. }
507. out.append(allocator, ch) catch return false;
508. if (out.items.len > 65536) return false;
509. }
510. }
512. fn close(self: *Conn) void {
513. if (self.ssl) |ssl| {
514. if (self.ctx) |*ctx| ctx.shutdownAndFree(ssl);
515. self.ssl = null;
516. }
517. if (self.ctx) |*ctx| {
518. ctx.deinit();
519. self.ctx = null;
520. }
521. if (self.fd >= 0) {
522. _ = linux.close(self.fd);
523. self.fd = -1;
524. }
525. }
526. };
528. /// A complete SMTP reply: the code, and every line's text joined with "; ".
529. const Reply = struct {
530. code: u16 = 0,
531. text: std.ArrayListUnmanaged(u8) = .empty,
533. fn deinit(self: *Reply) void {
534. self.text.deinit(allocator);
535. }
536. };
538. /// Read a reply, following RFC 5321 §4.2's multiline form (`250-…` continues,
539. /// `250 …` ends). Returns false if the connection died mid-reply.
540. fn readReply(conn: *Conn, reply: *Reply) bool {
541. reply.text.clearRetainingCapacity();
542. reply.code = 0;
543. var line: std.ArrayListUnmanaged(u8) = .empty;
544. defer line.deinit(allocator);
545. var first = true;
546. while (true) {
547. if (!conn.readLine(&line)) return false;
548. const s = line.items;
549. if (s.len < 3) return false;
550. const code = std.fmt.parseInt(u16, s[0..3], 10) catch return false;
551. if (first) {
552. reply.code = code;
553. first = false;
554. }
555. const rest = if (s.len > 4) s[4..] else "";
556. if (reply.text.items.len > 0) reply.text.appendSlice(allocator, "; ") catch {};
557. reply.text.appendSlice(allocator, rest) catch {};
558. if (s.len == 3 or s[3] != '-') return true;
559. }
560. }
562. fn command(conn: *Conn, reply: *Reply, parts: []const []const u8) bool {
563. for (parts) |p| {
564. if (!conn.writeAll(p)) return false;
565. }
566. if (!conn.writeAll("\r\n")) return false;
567. return readReply(conn, reply);
568. }
570. /// Does the EHLO capability list advertise `name`? Case-insensitive, and
571. /// anchored on a word boundary so "AUTH" does not match "AUTHOR".
572. fn advertises(caps: []const u8, name: []const u8) bool {
573. var i: usize = 0;
574. while (i + name.len <= caps.len) : (i += 1) {
575. if (std.ascii.eqlIgnoreCase(caps[i .. i + name.len], name)) {
576. const before_ok = i == 0 or !std.ascii.isAlphanumeric(caps[i - 1]);
577. const after = i + name.len;
578. const after_ok = after >= caps.len or !std.ascii.isAlphanumeric(caps[after]);
579. if (before_ok and after_ok) return true;
580. }
581. }
582. return false;
583. }
585. // ── DIALLING ────────────────────────────────────────────────────────────────
587. /// Connect to host:port with `timeout_ms` bounding BOTH the connect and every
588. /// later read/write. A blocking connect(2) ignores SO_SNDTIMEO, so the connect
589. /// is made non-blocking and polled; the socket goes back to blocking afterwards
590. /// and the two socket timeouts carry the rest of the conversation.
591. fn dial(host: []const u8, port: u16, timeout_ms: u32, reason: *std.ArrayListUnmanaged(u8)) ?i32 {
592. // libc's resolver, not a hand-rolled one: /etc/hosts, /etc/resolv.conf,
593. // nsswitch and IPv6 are the host's configuration, and a mail client that
594. // answers differently from every other program on the machine is a bug.
595. var host_z_buf: [256]u8 = undefined;
596. if (host.len >= host_z_buf.len) {
597. reason.appendSlice(allocator, "the host name is too long") catch {};
598. return null;
599. }
600. @memcpy(host_z_buf[0..host.len], host);
601. host_z_buf[host.len] = 0;
602. var port_buf: [8]u8 = undefined;
603. const port_s = std.fmt.bufPrintZ(&port_buf, "{d}", .{port}) catch {
604. reason.appendSlice(allocator, "bad port") catch {};
605. return null;
606. };
608. const hints = c.addrinfo{
609. .flags = .{},
610. .family = c.AF.UNSPEC,
611. .socktype = c.SOCK.STREAM,
612. .protocol = 0,
613. .addrlen = 0,
614. .canonname = null,
615. .addr = null,
616. .next = null,
617. };
618. var res: ?*c.addrinfo = null;
619. const rc_ai = c.getaddrinfo(@ptrCast(&host_z_buf), port_s.ptr, &hints, &res);
620. if (rc_ai != @as(c.EAI, @enumFromInt(0)) or res == null) {
621. reason.appendSlice(allocator, "could not resolve the host") catch {};
622. return null;
623. }
624. defer c.freeaddrinfo(res.?);
626. var last: []const u8 = "connection refused";
627. var cursor: ?*c.addrinfo = res;
628. while (cursor) |ai| : (cursor = ai.next) {
629. const sa = ai.addr orelse continue;
630. const rc = linux.socket(@intCast(ai.family), linux.SOCK.STREAM | linux.SOCK.CLOEXEC, 0);
631. const fd: i32 = @intCast(@as(isize, @bitCast(rc)));
632. if (fd < 0) continue;
634. const flags_rc = linux.fcntl(fd, linux.F.GETFL, @as(usize, 0));
635. var oflags: linux.O = @bitCast(@as(u32, @truncate(flags_rc)));
636. oflags.NONBLOCK = true;
637. _ = linux.fcntl(fd, linux.F.SETFL, @as(usize, @as(u32, @bitCast(oflags))));
639. const crc = linux.connect(fd, @ptrCast(sa), ai.addrlen);
640. const cerr: isize = @bitCast(crc);
641. var connected = cerr == 0;
642. if (!connected) {
643. // A negative return is -errno; INPROGRESS is the non-blocking
644. // connect's ordinary answer, not a failure.
645. const e: linux.E = @enumFromInt(@as(u16, @intCast(-cerr)));
646. if (e != .INPROGRESS and e != .INTR) {
647. last = "connection refused";
648. _ = linux.close(fd);
649. continue;
650. }
651. var pfd = [_]linux.pollfd{.{ .fd = fd, .events = linux.POLL.OUT, .revents = 0 }};
652. const prc = linux.poll(&pfd, 1, @intCast(timeout_ms));
653. const pn: isize = @bitCast(prc);
654. if (pn <= 0) {
655. last = "the connection attempt timed out";
656. _ = linux.close(fd);
657. continue;
658. }
659. var soerr: i32 = 0;
660. var slen: linux.socklen_t = @sizeOf(i32);
661. _ = linux.getsockopt(fd, linux.SOL.SOCKET, linux.SO.ERROR, @ptrCast(&soerr), &slen);
662. if (soerr != 0) {
663. last = "connection refused";
664. _ = linux.close(fd);
665. continue;
666. }
667. connected = true;
668. }
670. oflags.NONBLOCK = false;
671. _ = linux.fcntl(fd, linux.F.SETFL, @as(usize, @as(u32, @bitCast(oflags))));
672. const tv = linux.timeval{
673. .sec = @intCast(timeout_ms / 1000),
674. .usec = @intCast((timeout_ms % 1000) * 1000),
675. };
676. _ = linux.setsockopt(fd, linux.SOL.SOCKET, linux.SO.RCVTIMEO, @ptrCast(&tv), @sizeOf(linux.timeval));
677. _ = linux.setsockopt(fd, linux.SOL.SOCKET, linux.SO.SNDTIMEO, @ptrCast(&tv), @sizeOf(linux.timeval));
678. return fd;
679. }
680. reason.appendSlice(allocator, last) catch {};
681. return null;
682. }
684. // ── THE CONVERSATION ────────────────────────────────────────────────────────
686. const Outcome = struct {
687. ok: bool,
688. code: u16,
689. stage: []const u8,
690. message: []u8,
691. secure: bool,
692. };
694. fn own(text: []const u8) []u8 {
695. return allocator.dupe(u8, text) catch allocator.alloc(u8, 0) catch unreachable;
696. }
698. fn fail(stage: []const u8, code: u16, secure: bool, text: []const u8) Outcome {
699. return .{ .ok = false, .code = code, .stage = stage, .message = own(text), .secure = secure };
700. }
702. fn runJob(m: *Mailer, job: *const Job) Outcome {
703. var conn = Conn{};
704. defer conn.close();
706. var reason: std.ArrayListUnmanaged(u8) = .empty;
707. defer reason.deinit(allocator);
709. const fd = dial(m.host, m.port, m.timeout_ms, &reason) orelse
710. return fail("connect", 0, false, reason.items);
711. conn.fd = fd;
713. var secure = false;
714. if (m.tls_mode == .implicit) {
715. const ctx = tls.TlsContext.initClient(.{
716. .ca_file = if (m.ca_file) |ca| ca else null,
717. .verify = m.verify,
718. .tag = "smtp",
719. }) orelse return fail("connect", 0, false, "TLS is unavailable (no usable libssl on this host, or the CA file could not be loaded)");
720. conn.ctx = ctx;
721. conn.ssl = conn.ctx.?.connect(fd, m.host, "smtp") orelse
722. return fail("connect", 0, false, "the implicit TLS handshake failed (see the smtp: lines on stderr)");
723. secure = true;
724. }
726. var reply = Reply{};
727. defer reply.deinit();
729. if (!readReply(&conn, &reply)) return fail("greeting", 0, secure, "the server sent no greeting");
730. if (reply.code != 220) return fail("greeting", reply.code, secure, reply.text.items);
732. // EHLO, and keep the capability list — STARTTLS and AUTH are both read off it.
733. var caps: std.ArrayListUnmanaged(u8) = .empty;
734. defer caps.deinit(allocator);
735. if (!command(&conn, &reply, &.{ "EHLO ", m.helo })) return fail("ehlo", 0, secure, "the connection closed during EHLO");
736. if (reply.code != 250) return fail("ehlo", reply.code, secure, reply.text.items);
737. caps.appendSlice(allocator, reply.text.items) catch {};
739. if (m.tls_mode == .starttls and !secure) {
740. if (!advertises(caps.items, "STARTTLS")) {
741. return fail("starttls", 0, secure, "the server does not advertise STARTTLS (set tls = \"none\" to accept a plaintext session deliberately)");
742. }
743. if (!command(&conn, &reply, &.{"STARTTLS"})) return fail("starttls", 0, secure, "the connection closed during STARTTLS");
744. if (reply.code != 220) return fail("starttls", reply.code, secure, reply.text.items);
746. const ctx = tls.TlsContext.initClient(.{
747. .ca_file = if (m.ca_file) |ca| ca else null,
748. .verify = m.verify,
749. .tag = "smtp",
750. }) orelse return fail("starttls", 0, secure, "TLS is unavailable (no usable libssl on this host, or the CA file could not be loaded)");
751. conn.ctx = ctx;
752. // The SAME socket, mid-protocol: this is what STARTTLS is, and the
753. // client half of tls_common.zig takes it as it stands.
754. conn.ssl = conn.ctx.?.connect(fd, m.host, "smtp") orelse
755. return fail("starttls", 0, secure, "the STARTTLS handshake failed (see the smtp: lines on stderr)");
756. secure = true;
757. conn.len = 0;
758. conn.pos = 0;
760. // RFC 3207 §4.2: everything learned before the upgrade is discarded and
761. // EHLO is re-issued inside TLS — a capability list from the plaintext
762. // half is exactly what an attacker in the middle would have written.
763. caps.clearRetainingCapacity();
764. if (!command(&conn, &reply, &.{ "EHLO ", m.helo })) return fail("ehlo", 0, secure, "the connection closed during the post-STARTTLS EHLO");
765. if (reply.code != 250) return fail("ehlo", reply.code, secure, reply.text.items);
766. caps.appendSlice(allocator, reply.text.items) catch {};
767. }
769. // AUTH
770. if (m.user != null and m.pass != null and m.auth_mode != .none) {
771. if (!secure and !m.allow_insecure_auth) {
772. return fail("auth", 0, secure, "refusing to send credentials over a plaintext connection — use tls = \"starttls\" (the default) or \"implicit\", or set allowInsecureAuth = true to say the clear text is intended");
773. }
774. const wants_login = switch (m.auth_mode) {
775. .login => true,
776. .plain => false,
777. else => !advertises(caps.items, "PLAIN") and advertises(caps.items, "LOGIN"),
778. };
779. const outcome = if (wants_login) authLogin(m, &conn, &reply, secure) else authPlain(m, &conn, &reply, secure);
780. if (outcome) |o| return o;
781. }
783. if (!command(&conn, &reply, &.{ "MAIL FROM:<", job.from, ">" })) return fail("mail", 0, secure, "the connection closed during MAIL FROM");
784. if (reply.code != 250) return fail("mail", reply.code, secure, reply.text.items);
786. for (job.rcpt) |r| {
787. if (!command(&conn, &reply, &.{ "RCPT TO:<", r, ">" })) return fail("rcpt", 0, secure, "the connection closed during RCPT TO");
788. // 251 = "will forward"; anything else non-2xx is a rejected recipient,
789. // and one rejected recipient fails the whole send rather than silently
790. // delivering to the rest (the app decides what to do about it).
791. if (reply.code != 250 and reply.code != 251) return fail("rcpt", reply.code, secure, reply.text.items);
792. }
794. if (!command(&conn, &reply, &.{"DATA"})) return fail("data", 0, secure, "the connection closed during DATA");
795. if (reply.code != 354) return fail("data", reply.code, secure, reply.text.items);
797. if (!conn.writeAll(job.data)) return fail("body", 0, secure, "the connection closed while the message was being written");
798. if (!conn.writeAll(".\r\n")) return fail("body", 0, secure, "the connection closed at the end-of-data marker");
799. if (!readReply(&conn, &reply)) return fail("body", 0, secure, "the server never acknowledged the message");
800. if (reply.code != 250) return fail("body", reply.code, secure, reply.text.items);
802. const accepted = own(reply.text.items);
803. // QUIT is courtesy: the message is accepted the moment DATA answered 250, so
804. // a server that drops the socket instead of saying 221 has not lost it.
805. _ = command(&conn, &reply, &.{"QUIT"});
806. return .{ .ok = true, .code = 250, .stage = "done", .message = accepted, .secure = secure };
807. }
809. /// AUTH PLAIN — RFC 4616: base64 of "\0user\0pass", in the command itself.
810. fn authPlain(m: *Mailer, conn: *Conn, reply: *Reply, secure: bool) ?Outcome {
811. const user = m.user.?;
812. const pass = m.pass.?;
813. const raw = allocator.alloc(u8, 2 + user.len + pass.len) catch return fail("auth", 0, secure, "out of memory");
814. defer allocator.free(raw);
815. raw[0] = 0;
816. @memcpy(raw[1 .. 1 + user.len], user);
817. raw[1 + user.len] = 0;
818. @memcpy(raw[2 + user.len ..], pass);
819. const enc = b64Alloc(raw) catch return fail("auth", 0, secure, "out of memory");
820. defer allocator.free(enc);
822. if (!command(conn, reply, &.{ "AUTH PLAIN ", enc })) return fail("auth", 0, secure, "the connection closed during AUTH PLAIN");
823. if (reply.code != 235) return fail("auth", reply.code, secure, reply.text.items);
824. return null;
825. }
827. /// AUTH LOGIN — the de-facto challenge/response form: base64 username, then
828. /// base64 password, each answering a 334.
829. fn authLogin(m: *Mailer, conn: *Conn, reply: *Reply, secure: bool) ?Outcome {
830. if (!command(conn, reply, &.{"AUTH LOGIN"})) return fail("auth", 0, secure, "the connection closed during AUTH LOGIN");
831. if (reply.code != 334) return fail("auth", reply.code, secure, reply.text.items);
833. const user_enc = b64Alloc(m.user.?) catch return fail("auth", 0, secure, "out of memory");
834. defer allocator.free(user_enc);
835. if (!command(conn, reply, &.{user_enc})) return fail("auth", 0, secure, "the connection closed after the username");
836. if (reply.code != 334) return fail("auth", reply.code, secure, reply.text.items);
838. const pass_enc = b64Alloc(m.pass.?) catch return fail("auth", 0, secure, "out of memory");
839. defer allocator.free(pass_enc);
840. if (!command(conn, reply, &.{pass_enc})) return fail("auth", 0, secure, "the connection closed after the password");
841. if (reply.code != 235) return fail("auth", reply.code, secure, reply.text.items);
842. return null;
843. }
845. fn workerLoop(m: *Mailer) void {
846. while (true) {
847. var job = m.takeJob() orelse break;
848. const outcome = runJob(m, &job);
849. const rcpt: [][]u8 = allocator.alloc([]u8, job.rcpt.len) catch &.{};
850. for (job.rcpt, 0..) |r, i| {
851. if (i < rcpt.len) rcpt[i] = allocator.dupe(u8, r) catch own("");
852. }
853. m.publish(.{
854. .id = job.id,
855. .ok = outcome.ok,
856. .code = outcome.code,
857. .stage = outcome.stage,
858. .message = outcome.message,
859. .secure = outcome.secure,
860. .rcpt = rcpt,
861. });
862. job.deinit();
863. }
864. }
866. // ── THE RESULT SOURCE ───────────────────────────────────────────────────────
868. /// The loader converts a nested `hl_object` by recursing and running THAT
869. /// object's own `deinit_fn` before it runs this one, so the `to` list is already
870. /// gone by the time this is called — touching it here is a double free (measured,
871. /// mission 137). Only the string values this object owns are freed here.
872. fn resultObjDeinit(obj: *HlObject) callconv(.c) void {
873. const fields = obj.fields[0..obj.field_count];
874. for (fields) |f| {
875. if (f.value.type == .hl_string) {
876. allocator.free(@constCast(f.value.data.string.ptr[0..f.value.data.string.len]));
877. }
878. }
879. allocator.free(fields);
880. allocator.destroy(obj);
881. }
883. fn rcptObjDeinit(obj: *HlObject) callconv(.c) void {
884. const fields = obj.fields[0..obj.field_count];
885. for (fields) |f| {
886. allocator.free(@constCast(f.key.ptr[0..f.key.len]));
887. if (f.value.type == .hl_string) {
888. allocator.free(@constCast(f.value.data.string.ptr[0..f.value.data.string.len]));
889. }
890. }
891. allocator.free(fields);
892. allocator.destroy(obj);
893. }
895. /// Contiguous "0".."n-1" keys is how the loader recognises an ordered hybrid, so
896. /// `res.to` arrives in Hybriel as a list however many recipients there were.
897. fn rcptValue(rcpt: [][]u8) HlValue {
898. const fields = allocator.alloc(HlField, rcpt.len) catch return api.makeNull();
899. var built: usize = 0;
900. for (rcpt, 0..) |r, i| {
901. var key_buf: [24]u8 = undefined;
902. const key_src = std.fmt.bufPrint(&key_buf, "{d}", .{i}) catch break;
903. const key = allocator.dupe(u8, key_src) catch break;
904. fields[built] = .{ .key = .{ .ptr = key.ptr, .len = key.len }, .value = api.makeString(r) };
905. built += 1;
906. }
907. const obj = allocator.create(HlObject) catch return api.makeNull();
908. obj.* = .{ .fields = fields.ptr, .field_count = built, .deinit_fn = &rcptObjDeinit };
909. return api.makeObject(obj);
910. }
912. fn resultValue(r: Result) HlValue {
913. const fields = allocator.alloc(HlField, 7) catch return api.makeNull();
914. fields[0] = .{ .key = http.hlStr("id"), .value = api.makeNumber(@floatFromInt(r.id)) };
915. fields[1] = .{ .key = http.hlStr("ok"), .value = api.makeBool(r.ok) };
916. fields[2] = .{ .key = http.hlStr("code"), .value = api.makeNumber(@floatFromInt(r.code)) };
917. // `stage` names a compile-time constant, so it is DUPED here: the deinit
918. // below frees every string field it finds, and handing it a `.rodata`
919. // pointer is a segfault (measured, mission 137). One rule for all fields
920. // beats a per-field exception nobody will remember.
921. fields[3] = .{ .key = http.hlStr("stage"), .value = api.makeString(own(r.stage)) };
922. fields[4] = .{ .key = http.hlStr("message"), .value = api.makeString(r.message) };
923. fields[5] = .{ .key = http.hlStr("secure"), .value = api.makeBool(r.secure) };
924. fields[6] = .{ .key = http.hlStr("to"), .value = rcptValue(r.rcpt) };
925. const obj = allocator.create(HlObject) catch return api.makeNull();
926. obj.* = .{ .fields = fields.ptr, .field_count = 7, .deinit_fn = &resultObjDeinit };
927. allocator.free(r.rcpt);
928. return api.makeObject(obj);
929. }
931. fn resultsTryNext(ctx: ?*anyopaque) callconv(.c) HlValue {
932. const m: *Mailer = @ptrCast(@alignCast(ctx orelse return api.makeNull()));
933. const r = m.tryTake() orelse return api.makeNull();
934. return resultValue(r);
935. }
937. fn resultsNext(ctx: ?*anyopaque) callconv(.c) HlValue {
938. const m: *Mailer = @ptrCast(@alignCast(ctx orelse return api.makeNull()));
939. const r = m.take() orelse return api.makeNull();
940. return resultValue(r);
941. }
943. fn resultsDeinit(_: ?*anyopaque) callconv(.c) void {}
945. // ── EXPORTS ─────────────────────────────────────────────────────────────────
947. /// __native("smtp.open", host, port, options) → Number mailer id
948. export fn hl_smtp_open(argc: u32, argv: [*]const HlValue) callconv(.c) HlValue {
949. if (argc < 2 or argv[0].type != .hl_string or argv[1].type != .hl_number) {
950. return refuse("hl:smtp open: host must be a String and port a Number", .{});
951. }
952. const host = argv[0].data.string.ptr[0..argv[0].data.string.len];
953. const port_f = argv[1].data.number;
954. if (port_f < 1 or port_f > 65535) {
955. return refuse("hl:smtp open: {d} is not a port number", .{port_f});
956. }
957. const opts: HlValue = if (argc >= 3) argv[2] else api.makeNull();
959. const tls_name = strField(opts, "tls") orelse "starttls";
960. const tls_mode: TlsMode = if (std.ascii.eqlIgnoreCase(tls_name, "starttls"))
961. .starttls
962. else if (std.ascii.eqlIgnoreCase(tls_name, "implicit"))
963. .implicit
964. else if (std.ascii.eqlIgnoreCase(tls_name, "none"))
965. .none
966. else
967. return refuse("hl:smtp open: tls = \"{s}\" is not one of \"starttls\", \"implicit\", \"none\"", .{tls_name});
969. const auth_name = strField(opts, "auth") orelse "auto";
970. const auth_mode: AuthMode = if (std.ascii.eqlIgnoreCase(auth_name, "auto"))
971. .auto
972. else if (std.ascii.eqlIgnoreCase(auth_name, "plain"))
973. .plain
974. else if (std.ascii.eqlIgnoreCase(auth_name, "login"))
975. .login
976. else if (std.ascii.eqlIgnoreCase(auth_name, "none"))
977. .none
978. else
979. return refuse("hl:smtp open: auth = \"{s}\" is not one of \"auto\", \"plain\", \"login\", \"none\"", .{auth_name});
981. // A MAILER WITHOUT A SENDER OPENS (ticket #13): an app that never sends
982. // must not abort at load for want of one. A message that ends up with no
983. // sender at all is refused at send(), located at that call.
984. const from = senderField(opts) orelse "";
985. if (from.len > 0) {
986. if (checkAddress("the mailer's \"from\" (or sender)", from)) |e| return e;
987. }
989. const helo = strField(opts, "helo") orelse "localhost";
990. if (checkHeaderValue("helo", helo)) |e| return e;
992. const m = allocator.create(Mailer) catch return refuse("hl:smtp open: out of memory", .{});
993. m.* = .{
994. .id = 0,
995. .host = allocator.dupe(u8, host) catch return refuse("hl:smtp open: out of memory", .{}),
996. .port = @intFromFloat(port_f),
997. .user = dupOpt(strField(opts, "user")),
998. .pass = dupOpt(strField(opts, "pass")),
999. .from = allocator.dupe(u8, from) catch return refuse("hl:smtp open: out of memory", .{}),
1000. .helo = allocator.dupe(u8, helo) catch return refuse("hl:smtp open: out of memory", .{}),
1001. .tls_mode = tls_mode,
1002. .auth_mode = auth_mode,
1003. .ca_file = dupOpt(strField(opts, "caFile")),
1004. .verify = boolField(opts, "verify", true),
1005. .allow_insecure_auth = boolField(opts, "allowInsecureAuth", false),
1006. .timeout_ms = @intFromFloat(@max(1000, numField(opts, "timeout", 30000))),
1007. .mutex = c.PTHREAD_MUTEX_INITIALIZER,
1008. .condvar = c.PTHREAD_COND_INITIALIZER,
1009. .wake_fd = http.makeWakeFd(),
1010. };
1012. mutexLock(&mailers_mutex);
1013. m.id = next_mailer_id;
1014. next_mailer_id += 1;
1015. mailers.append(allocator, m) catch {};
1016. mutexUnlock(&mailers_mutex);
1018. m.worker = std.Thread.spawn(.{}, workerLoop, .{m}) catch {
1019. return refuse("hl:smtp open: could not start the sender thread", .{});
1020. };
1021. return api.makeNumber(@floatFromInt(m.id));
1022. }
1024. /// __native("smtp.send", id, message) → Number job id, or a located refusal.
1025. ///
1026. /// Everything this function does happens on the HYBRIEL thread, before the job
1027. /// exists: that is deliberate, because a refusal is only located if it is raised
1028. /// at the call site and a worker thread has no call site.
1029. export fn hl_smtp_send(argc: u32, argv: [*]const HlValue) callconv(.c) HlValue {
1030. if (argc < 2 or argv[0].type != .hl_number) {
1031. return refuse("hl:smtp send: expected a mailer id and a message", .{});
1032. }
1033. const m = mailerById(@intFromFloat(argv[0].data.number)) orelse
1034. return refuse("hl:smtp send: this Mailer is closed", .{});
1035. const msg = argv[1];
1036. if (msg.type != .hl_object) {
1037. return refuse("hl:smtp send: the message must be a hybrid with to, subject and text (or html)", .{});
1038. }
1040. const from = senderField(msg) orelse m.from;
1041. if (from.len == 0) {
1042. return refuse("hl:smtp refused the message: it has no \"from\" and neither has the mailer — give one in the message or in the Mailer's options", .{});
1043. }
1044. if (checkAddress("\"from\"", from)) |e| return e;
1046. // `to` is one address or a list of them. A single String is the common case
1047. // and a list is the same message with more RCPT TO lines — never several
1048. // messages, so every recipient sees the same To: header.
1049. var rcpt: std.ArrayListUnmanaged([]u8) = .empty;
1050. var rcpt_failed = false;
1051. defer if (rcpt_failed) {
1052. for (rcpt.items) |r| allocator.free(r);
1053. rcpt.deinit(allocator);
1054. };
1055. const to_field = fieldOf(msg, "to") orelse return refuse("hl:smtp send: the message has no 'to'", .{});
1056. switch (to_field.type) {
1057. .hl_string => {
1058. const one = to_field.data.string.ptr[0..to_field.data.string.len];
1059. if (checkAddress("to", one)) |e| {
1060. rcpt_failed = true;
1061. return e;
1062. }
1063. rcpt.append(allocator, allocator.dupe(u8, one) catch "") catch {};
1064. },
1065. .hl_object => {
1066. const list = to_field.data.object;
1067. for (list.fields[0..list.field_count]) |f| {
1068. if (f.value.type != .hl_string) continue;
1069. const one = f.value.data.string.ptr[0..f.value.data.string.len];
1070. if (checkAddress("to", one)) |e| {
1071. rcpt_failed = true;
1072. return e;
1073. }
1074. rcpt.append(allocator, allocator.dupe(u8, one) catch "") catch {};
1075. }
1076. },
1077. else => return refuse("hl:smtp send: 'to' must be a String or a list of Strings", .{}),
1078. }
1079. if (rcpt.items.len == 0) {
1080. rcpt_failed = true;
1081. return refuse("hl:smtp send: 'to' names no recipient", .{});
1082. }
1084. const subject = strField(msg, "subject") orelse "";
1085. if (checkHeaderValue("subject", subject)) |e| {
1086. rcpt_failed = true;
1087. return e;
1088. }
1090. const text = strField(msg, "text");
1091. const html = strField(msg, "html");
1092. if (text == null and html == null) {
1093. rcpt_failed = true;
1094. return refuse("hl:smtp send: the message has neither 'text' nor 'html'", .{});
1095. }
1097. var body: std.ArrayListUnmanaged(u8) = .empty;
1098. var body_failed = false;
1099. defer if (body_failed) body.deinit(allocator);
1101. renderMessage(&body, m, from, rcpt.items, subject, text, html) catch {
1102. body_failed = true;
1103. rcpt_failed = true;
1104. return refuse("hl:smtp send: out of memory rendering the message", .{});
1105. };
1107. mutexLock(&m.mutex);
1108. const job_id = m.next_job;
1109. m.next_job += 1;
1110. mutexUnlock(&m.mutex);
1112. m.enqueue(.{
1113. .id = job_id,
1114. .from = allocator.dupe(u8, from) catch "",
1115. .rcpt = rcpt.toOwnedSlice(allocator) catch &[_][]u8{},
1116. .data = body.toOwnedSlice(allocator) catch &[_]u8{},
1117. });
1118. return api.makeNumber(@floatFromInt(job_id));
1119. }
1121. fn renderMessage(
1122. out: *std.ArrayListUnmanaged(u8),
1123. m: *Mailer,
1124. from: []const u8,
1125. rcpt: []const []u8,
1126. subject: []const u8,
1127. text: ?[]const u8,
1128. html: ?[]const u8,
1129. ) !void {
1130. var head: std.ArrayListUnmanaged(u8) = .empty;
1131. defer head.deinit(allocator);
1133. try appendHeader(&head, "From", from);
1135. var to_join: std.ArrayListUnmanaged(u8) = .empty;
1136. defer to_join.deinit(allocator);
1137. for (rcpt, 0..) |r, i| {
1138. if (i > 0) try to_join.appendSlice(allocator, ", ");
1139. try to_join.appendSlice(allocator, r);
1140. }
1141. try appendHeader(&head, "To", to_join.items);
1142. try appendHeader(&head, "Subject", subject);
1143. try writeDate(&head);
1145. var mid: [32]u8 = undefined;
1146. randomHex(&mid);
1147. try head.appendSlice(allocator, "Message-ID: <");
1148. try head.appendSlice(allocator, &mid);
1149. try head.append(allocator, '@');
1150. try head.appendSlice(allocator, m.helo);
1151. try head.appendSlice(allocator, ">\r\n");
1152. try head.appendSlice(allocator, "MIME-Version: 1.0\r\n");
1154. if (text != null and html != null) {
1155. var boundary: [24]u8 = undefined;
1156. randomHex(&boundary);
1157. try head.appendSlice(allocator, "Content-Type: multipart/alternative; boundary=\"hl-");
1158. try head.appendSlice(allocator, &boundary);
1159. try head.appendSlice(allocator, "\"\r\n\r\n");
1160. // The plain part first: RFC 2046 §5.1.4 orders alternatives worst-first,
1161. // so a reader that understands HTML picks the LAST one it can render.
1162. try head.appendSlice(allocator, "--hl-");
1163. try head.appendSlice(allocator, &boundary);
1164. try head.appendSlice(allocator, "\r\nContent-Type: text/plain; charset=utf-8\r\nContent-Transfer-Encoding: 8bit\r\n\r\n");
1165. try out.appendSlice(allocator, head.items);
1166. try appendDotStuffed(out, text.?);
1167. try out.appendSlice(allocator, "--hl-");
1168. try out.appendSlice(allocator, &boundary);
1169. try out.appendSlice(allocator, "\r\nContent-Type: text/html; charset=utf-8\r\nContent-Transfer-Encoding: 8bit\r\n\r\n");
1170. try appendDotStuffed(out, html.?);
1171. try out.appendSlice(allocator, "--hl-");
1172. try out.appendSlice(allocator, &boundary);
1173. try out.appendSlice(allocator, "--\r\n");
1174. return;
1175. }
1177. const single = text orelse html.?;
1178. const ctype = if (text != null) "text/plain" else "text/html";
1179. try head.appendSlice(allocator, "Content-Type: ");
1180. try head.appendSlice(allocator, ctype);
1181. try head.appendSlice(allocator, "; charset=utf-8\r\nContent-Transfer-Encoding: 8bit\r\n\r\n");
1182. try out.appendSlice(allocator, head.items);
1183. try appendDotStuffed(out, single);
1184. }
1186. /// __native("smtp.results", id) → the mailer's ONE result source.
1187. export fn hl_smtp_results(argc: u32, argv: [*]const HlValue) callconv(.c) HlValue {
1188. if (argc < 1 or argv[0].type != .hl_number) return api.makeNull();
1189. const m = mailerById(@intFromFloat(argv[0].data.number)) orelse
1190. return refuse("hl:smtp results: this Mailer is closed", .{});
1191. if (m.source == null) {
1192. const iter = allocator.create(HlIterator) catch return api.makeNull();
1193. iter.* = .{
1194. .context = @ptrCast(m),
1195. .next_fn = &resultsNext,
1196. .deinit_fn = &resultsDeinit,
1197. .try_next_fn = &resultsTryNext,
1198. .wake_fd = m.wake_fd,
1199. };
1200. m.source = iter;
1201. }
1202. return api.makeIterator(m.source.?);
1203. }
1205. /// __native("smtp.mark_registered", id) → refuses a SECOND consumer.
1206. /// The drain (`for (r of m.results())`) and the event loop take results off the
1207. /// same queue, so a program doing both would see each result exactly once, in
1208. /// one of two places, at random. Saying so is cheaper than debugging it.
1209. export fn hl_smtp_mark_registered(argc: u32, argv: [*]const HlValue) callconv(.c) HlValue {
1210. if (argc < 1 or argv[0].type != .hl_number) return api.makeNull();
1211. const m = mailerById(@intFromFloat(argv[0].data.number)) orelse
1212. return refuse("hl:smtp deliver: this Mailer is closed", .{});
1213. if (m.registered) {
1214. return refuse("hl:smtp deliver: this Mailer already delivers its results to the event loop", .{});
1215. }
1216. m.registered = true;
1217. return api.makeNull();
1218. }
1220. /// __native("smtp.pending", id) → how many sends have not been answered yet.
1221. export fn hl_smtp_pending(argc: u32, argv: [*]const HlValue) callconv(.c) HlValue {
1222. if (argc < 1 or argv[0].type != .hl_number) return api.makeNumber(0);
1223. const m = mailerById(@intFromFloat(argv[0].data.number)) orelse return api.makeNumber(0);
1224. mutexLock(&m.mutex);
1225. defer mutexUnlock(&m.mutex);
1226. return api.makeNumber(@floatFromInt(m.outstanding));
1227. }
1229. /// __native("smtp.close", id) — stop the worker. Queued jobs still in hand are
1230. /// dropped; a job already in conversation finishes, because abandoning a socket
1231. /// between DATA and its 250 is how a message gets delivered twice.
1232. export fn hl_smtp_close(argc: u32, argv: [*]const HlValue) callconv(.c) HlValue {
1233. if (argc < 1 or argv[0].type != .hl_number) return api.makeNull();
1234. const m = mailerById(@intFromFloat(argv[0].data.number)) orelse return api.makeNull();
1236. mutexLock(&m.mutex);
1237. m.stop = true;
1238. condBroadcast(&m.condvar);
1239. mutexUnlock(&m.mutex);
1240. http.ringWake(m.wake_fd);
1242. if (m.worker) |t| {
1243. t.join();
1244. m.worker = null;
1245. }
1247. mutexLock(&mailers_mutex);
1248. for (mailers.items, 0..) |candidate, i| {
1249. if (candidate == m) {
1250. _ = mailers.orderedRemove(i);
1251. break;
1252. }
1253. }
1254. mutexUnlock(&mailers_mutex);
1255. return api.makeNull();
1256. }