tracker

51.8 KB

1. // hl:smtp plugin — an SMTP submission client (libsmtp.so, dlopen'd by the runtime)
2. //
3. // Mission 137. Sending mail, and nothing else: there is no receiving (IMAP/POP),
4. // no DKIM signing and no queue-with-retry here — see plugins/smtp/README.md for
5. // why each of those is somewhere else's job.
6. //
7. // SHAPE
8. // hl_smtp_open(host, port, options) → Number mailer id
9. // hl_smtp_send(id, message) → Number job id, or an hl_error REFUSAL
10. // hl_smtp_results(id) → the result source (iterator + wake fd)
11. // hl_smtp_close(id) → null
12. //
13. // THE SPLIT BETWEEN THE THREADS is the whole design:
14. //
15. // • `send()` runs on the Hybriel thread and does everything that can FAIL
16. // LOCALLY — validating the addresses, refusing a header injection, rendering
17. // the RFC 5322 message. Those are located errors at the caller's own line,
18. // which they can only be if they happen before the job leaves.
19. // • the WORKER thread does the conversation (connect, EHLO, STARTTLS, AUTH,
20. // MAIL/RCPT/DATA, QUIT). Nothing on the Hybriel thread waits for it: the
21. // result goes onto a queue and the queue's eventfd is rung, which is mission
22. // 125's bell — the event loop is parked in one `epoll_wait` over every
23. // source's fd and comes back with the answer.
24. //
25. // So a server that sends a mail keeps serving while the mail is in flight, and a
26. // script that only sends mail drains the same source with `for (r of m.results())`.
27. // One source, the two consumptions the runtime already gives every plugin source
28. // (`hl:http1`'s server iterator has been both since mission 012/052).
29. //
30. // TLS rides plugins/http/tls_common.zig — the SAME OpenSSL layer the servers use,
31. // through the client half mission 137 added to it. There is no second TLS here.
33. const std = @import("std");
34. const api = @import("plugin_api");
35. const http = @import("http_common");
36. const tls = @import("tls_common");
38. const HlValue = api.HlValue;
39. const HlObject = api.HlObject;
40. const HlField = api.HlField;
41. const HlIterator = api.HlIterator;
42. const HlString = api.HlString;
44. const linux = std.os.linux;
45. const c = std.c;
46. const PthreadMutex = c.pthread_mutex_t;
47. const PthreadCond = c.pthread_cond_t;
49. // Per-mailer state is touched by two threads, so the thread-safe production
50. // allocator is the only correct choice — the same reasoning as the HTTP plugins.
51. const allocator = std.heap.smp_allocator;
53. fn mutexLock(m: *PthreadMutex) void {
54. _ = c.pthread_mutex_lock(m);
55. }
56. fn mutexUnlock(m: *PthreadMutex) void {
57. _ = c.pthread_mutex_unlock(m);
58. }
59. fn condSignal(cnd: *PthreadCond) void {
60. _ = c.pthread_cond_signal(cnd);
61. }
62. fn condBroadcast(cnd: *PthreadCond) void {
63. _ = c.pthread_cond_broadcast(cnd);
64. }
65. fn condWait(cnd: *PthreadCond, m: *PthreadMutex) void {
66. _ = c.pthread_cond_wait(cnd, m);
67. }
69. /// Direct syscall for stderr — std.debug.print pulls in std.Progress, whose
70. /// global state is ABI-incompatible when a .so is loaded into a differently
71. /// built binary (the same reason tls_common.zig has its own).
72. fn logMsg(msg: []const u8) void {
73. _ = linux.write(2, msg.ptr, msg.len);
74. }
76. // ── REFUSALS ────────────────────────────────────────────────────────────────
77. //
78. // An hl_error returned at the top level of a plugin call becomes a LOCATED
79. // runtime error at the `__native` call site and is offered to `on Error(e)`
80. // first (plugin_loader / native_bridge). That is the channel every local refusal
81. // here uses, so `m.send(…)` with a newline in the subject points at the line the
82. // author wrote and is catchable exactly like any other plugin failure.
83. //
84. // The text is rendered into a module buffer: a plugin call never yields, and the
85. // runtime dupes the string into its own tracker the instant the call returns.
86. var err_buf: [1024]u8 = undefined;
88. fn refuse(comptime fmt: []const u8, args: anytype) HlValue {
89. const s = std.fmt.bufPrint(&err_buf, fmt, args) catch "hl:smtp refused the message";
90. return api.makeError(s);
91. }
93. // ── ARGUMENT READING ────────────────────────────────────────────────────────
95. fn fieldOf(v: HlValue, key: []const u8) ?HlValue {
96. if (v.type != .hl_object) return null;
97. const obj = v.data.object;
98. for (obj.fields[0..obj.field_count]) |f| {
99. if (std.mem.eql(u8, f.key.ptr[0..f.key.len], key)) return f.value;
100. }
101. return null;
102. }
104. fn strField(v: HlValue, key: []const u8) ?[]const u8 {
105. const f = fieldOf(v, key) orelse return null;
106. if (f.type != .hl_string) return null;
107. return f.data.string.ptr[0..f.data.string.len];
108. }
110. fn boolField(v: HlValue, key: []const u8, dflt: bool) bool {
111. const f = fieldOf(v, key) orelse return dflt;
112. return switch (f.type) {
113. .hl_bool => f.data.boolean,
114. else => dflt,
115. };
116. }
118. fn numField(v: HlValue, key: []const u8, dflt: f64) f64 {
119. const f = fieldOf(v, key) orelse return dflt;
120. if (f.type != .hl_number) return dflt;
121. return f.data.number;
122. }
124. /// THE SENDER'S ADDRESS, under either name.
125. ///
126. /// `from` is a RESERVED WORD in Hybriel (`import X from './x.hl'`), so
127. /// `{ from = "a@b" }` does not parse and `msg.from` is not a member access.
128. /// Rather than force every caller to write the quoted-key form, both spellings
129. /// are read here: `"from" = …` (the quoted key, which parses fine and is what
130. /// mission 137's brief names) and `sender = …` (the bare-identifier form, for a
131. /// caller who would rather not quote). Same field, one meaning; the quoted one
132. /// wins if a message somehow carries both.
133. fn senderField(v: HlValue) ?[]const u8 {
134. if (strField(v, "from")) |s| return s;
135. return strField(v, "sender");
136. }
138. fn dupOpt(s: ?[]const u8) ?[]u8 {
139. const src = s orelse return null;
140. if (src.len == 0) return null;
141. return allocator.dupe(u8, src) catch null;
142. }
144. // ── CONFIGURATION ───────────────────────────────────────────────────────────
146. const TlsMode = enum { starttls, implicit, none };
147. const AuthMode = enum { auto, plain, login, none };
149. // ── THE JOB AND ITS RESULT ──────────────────────────────────────────────────
151. const Job = struct {
152. id: u32,
153. from: []u8,
154. /// Envelope recipients — every RCPT TO the conversation issues.
155. rcpt: [][]u8,
156. /// The rendered RFC 5322 message: CRLF line endings, dot-stuffed, WITHOUT
157. /// the terminating ".". Built on the Hybriel thread by `send`.
158. data: []u8,
160. fn deinit(self: *Job) void {
161. allocator.free(self.from);
162. for (self.rcpt) |r| allocator.free(r);
163. allocator.free(self.rcpt);
164. allocator.free(self.data);
165. }
166. };
168. const Result = struct {
169. id: u32,
170. ok: bool,
171. /// The last SMTP reply code the conversation saw (0 = never got one).
172. code: u16,
173. /// Which step answered: "connect", "greeting", "ehlo", "starttls", "auth",
174. /// "mail", "rcpt", "data", "body", "quit", "done".
175. stage: []const u8,
176. /// The server's own text, or this plugin's reason for giving up.
177. message: []u8,
178. /// Did the conversation run inside TLS by the time DATA was sent?
179. secure: bool,
180. rcpt: [][]u8,
181. };
183. // ── THE MAILER ──────────────────────────────────────────────────────────────
185. const Mailer = struct {
186. id: u32,
187. host: []u8,
188. port: u16,
189. user: ?[]u8,
190. pass: ?[]u8,
191. from: []u8,
192. helo: []u8,
193. tls_mode: TlsMode,
194. auth_mode: AuthMode,
195. ca_file: ?[]u8,
196. verify: bool,
197. /// Send AUTH over a connection that never became TLS. OFF by default: the
198. /// credentials would be on the wire in the clear, and a default that leaks
199. /// them is not a default, it is a bug with a setting.
200. allow_insecure_auth: bool,
201. timeout_ms: u32,
203. mutex: PthreadMutex,
204. /// The worker parks here for the next job; the drain parks here for the next
205. /// result. One lock covers both queues and `outstanding`, which is what makes
206. /// "no results and nothing outstanding" a single consistent observation.
207. condvar: PthreadCond,
208. jobs: std.ArrayListUnmanaged(Job) = .empty,
209. results: std.ArrayListUnmanaged(Result) = .empty,
210. /// Jobs accepted and not yet answered. The blocking drain ends when this is
211. /// zero and the result queue is empty — that is what lets a script that only
212. /// sends mail terminate.
213. outstanding: usize = 0,
214. next_job: u32 = 1,
215. stop: bool = false,
217. /// Mission 125's bell for the event loop. Rung whenever a result becomes
218. /// visible; over-ringing is free, a missed ring is the only bug there is.
219. wake_fd: i32 = -1,
220. worker: ?std.Thread = null,
221. /// The source object is made ONCE: two iterators over one queue would each
222. /// steal half the results.
223. source: ?*HlIterator = null,
224. registered: bool = false,
226. fn enqueue(self: *Mailer, job: Job) void {
227. mutexLock(&self.mutex);
228. defer mutexUnlock(&self.mutex);
229. self.jobs.append(allocator, job) catch return;
230. self.outstanding += 1;
231. condBroadcast(&self.condvar);
232. }
234. fn takeJob(self: *Mailer) ?Job {
235. mutexLock(&self.mutex);
236. defer mutexUnlock(&self.mutex);
237. while (self.jobs.items.len == 0 and !self.stop) {
238. condWait(&self.condvar, &self.mutex);
239. }
240. if (self.jobs.items.len == 0) return null;
241. return self.jobs.orderedRemove(0);
242. }
244. fn publish(self: *Mailer, result: Result) void {
245. mutexLock(&self.mutex);
246. self.results.append(allocator, result) catch {};
247. if (self.outstanding > 0) self.outstanding -= 1;
248. condBroadcast(&self.condvar);
249. // Rung while the append is still under the lock — the loop drains the
250. // eventfd counter only immediately AFTER a wake, never before blocking,
251. // so a bell rung any time after that drain leaves the level up and the
252. // next epoll_wait returns at once (native/src/loop_wait.zig).
253. http.ringWake(self.wake_fd);
254. mutexUnlock(&self.mutex);
255. }
257. fn tryTake(self: *Mailer) ?Result {
258. mutexLock(&self.mutex);
259. defer mutexUnlock(&self.mutex);
260. if (self.results.items.len == 0) return null;
261. return self.results.orderedRemove(0);
262. }
264. /// Blocking take for the drain form. `null` means DONE, not "nothing yet":
265. /// every accepted job has been answered and its answer taken.
266. fn take(self: *Mailer) ?Result {
267. mutexLock(&self.mutex);
268. defer mutexUnlock(&self.mutex);
269. while (self.results.items.len == 0 and self.outstanding > 0 and !self.stop) {
270. condWait(&self.condvar, &self.mutex);
271. }
272. if (self.results.items.len == 0) return null;
273. return self.results.orderedRemove(0);
274. }
275. };
277. var mailers: std.ArrayListUnmanaged(*Mailer) = .empty;
278. var mailers_mutex: PthreadMutex = c.PTHREAD_MUTEX_INITIALIZER;
279. var next_mailer_id: u32 = 1;
281. fn mailerById(id: u32) ?*Mailer {
282. mutexLock(&mailers_mutex);
283. defer mutexUnlock(&mailers_mutex);
284. for (mailers.items) |m| {
285. if (m.id == id) return m;
286. }
287. return null;
288. }
290. // ── HEADER INJECTION IS A REFUSAL, NOT AN ESCAPE ────────────────────────────
291. //
292. // A CR or an LF inside a `to`, a `from` or a `subject` ends the header and
293. // starts a new one — that is the whole of SMTP header injection, and it is how a
294. // contact form becomes an open relay (`subject = "hi\r\nBcc: everyone@…"`).
295. // Stripping the characters silently would deliver a mail the author did not
296. // write; escaping them is not defined for a header field. So it is a located
297. // refusal, at the caller's line, naming the field and the character.
298. fn checkHeaderValue(field: []const u8, value: []const u8) ?HlValue {
299. for (value, 0..) |ch, i| {
300. if (ch == '\r' or ch == '\n') {
301. return refuse(
302. "hl:smtp refused the message: {s} contains a {s} at byte {d} — a line break in a header field is how mail headers are injected, so it is never sent and never stripped",
303. .{ field, if (ch == '\r') "carriage return" else "line feed", i },
304. );
305. }
306. if (ch == 0) {
307. return refuse(
308. "hl:smtp refused the message: {s} contains a NUL byte at byte {d}",
309. .{ field, i },
310. );
311. }
312. }
313. return null;
314. }
316. /// An envelope address additionally may not carry the delimiters the envelope
317. /// itself is made of: `MAIL FROM:<a@b>` is a command, and a `<`, `>` or a space
318. /// inside the address would rewrite it.
319. fn checkAddress(field: []const u8, value: []const u8) ?HlValue {
320. if (checkHeaderValue(field, value)) |e| return e;
321. if (value.len == 0) {
322. return refuse("hl:smtp refused the message: {s} is empty", .{field});
323. }
324. for (value) |ch| {
325. if (ch == '<' or ch == '>' or ch == ' ' or ch == '\t') {
326. return refuse(
327. "hl:smtp refused the message: the address '{s}' in {s} contains '{c}' — an envelope address is written between angle brackets and may not carry them, or whitespace",
328. .{ value, field, ch },
329. );
330. }
331. }
332. if (std.mem.indexOfScalar(u8, value, '@') == null) {
333. return refuse(
334. "hl:smtp refused the message: the address '{s}' in {s} has no '@'",
335. .{ value, field },
336. );
337. }
338. return null;
339. }
341. // ── MESSAGE RENDERING ───────────────────────────────────────────────────────
343. const b64 = std.base64.standard.Encoder;
345. fn b64Alloc(src: []const u8) ![]u8 {
346. const out = try allocator.alloc(u8, b64.calcSize(src.len));
347. _ = b64.encode(out, src);
348. return out;
349. }
351. fn isAscii(s: []const u8) bool {
352. for (s) |ch| {
353. if (ch >= 0x80) return false;
354. }
355. return true;
356. }
358. const day_names = [_][]const u8{ "Thu", "Fri", "Sat", "Sun", "Mon", "Tue", "Wed" };
359. const month_names = [_][]const u8{ "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec" };
361. /// RFC 5322 §3.3 date-time, always +0000. A mail without a Date is not a mail —
362. /// receivers add their own and it reads as a forgery.
363. fn writeDate(w: *std.ArrayListUnmanaged(u8)) !void {
364. var ts: linux.timespec = undefined;
365. _ = linux.clock_gettime(linux.CLOCK.REALTIME, &ts);
366. const secs: u64 = @intCast(@max(@as(i64, ts.sec), 0));
367. const es = std.time.epoch.EpochSeconds{ .secs = secs };
368. const yd = es.getEpochDay().calculateYearDay();
369. const md = yd.calculateMonthDay();
370. const ds = es.getDaySeconds();
371. // 1970-01-01 was a Thursday, which is why day_names starts there.
372. const dow = day_names[@intCast(es.getEpochDay().day % 7)];
373. var buf: [64]u8 = undefined;
374. const line = try std.fmt.bufPrint(&buf, "Date: {s}, {d:0>2} {s} {d} {d:0>2}:{d:0>2}:{d:0>2} +0000\r\n", .{
375. dow,
376. @as(u32, md.day_index) + 1,
377. month_names[md.month.numeric() - 1],
378. yd.year,
379. ds.getHoursIntoDay(),
380. ds.getMinutesIntoHour(),
381. ds.getSecondsIntoMinute(),
382. });
383. try w.appendSlice(allocator, line);
384. }
386. fn randomHex(out: []u8) void {
387. var raw: [32]u8 = undefined;
388. const need = (out.len + 1) / 2;
389. if (linux.getrandom(&raw, need, 0) != need) {
390. @memset(out, '0');
391. return;
392. }
393. const hex = "0123456789abcdef";
394. for (out, 0..) |*ch, i| {
395. const byte = raw[i / 2];
396. const nib: u8 = if (i % 2 == 0) (byte >> 4) else (byte & 0x0f);
397. ch.* = hex[nib];
398. }
399. }
401. /// A header value that is not pure ASCII becomes an RFC 2047 encoded-word.
402. /// Writing raw UTF-8 into a header is only legal with SMTPUTF8 negotiated, which
403. /// this client does not do — so an umlaut in a subject would arrive as mojibake.
404. fn appendHeader(w: *std.ArrayListUnmanaged(u8), name: []const u8, value: []const u8) !void {
405. try w.appendSlice(allocator, name);
406. try w.appendSlice(allocator, ": ");
407. if (isAscii(value)) {
408. try w.appendSlice(allocator, value);
409. } else {
410. const enc = try b64Alloc(value);
411. defer allocator.free(enc);
412. try w.appendSlice(allocator, "=?UTF-8?B?");
413. try w.appendSlice(allocator, enc);
414. try w.appendSlice(allocator, "?=");
415. }
416. try w.appendSlice(allocator, "\r\n");
417. }
419. /// CRLF DISCIPLINE AND DOT-STUFFING, in one pass over the assembled message.
420. ///
421. /// SMTP's line terminator is CRLF and its end-of-data marker is a line holding
422. /// exactly ".", so a body line that legitimately begins with "." must be sent as
423. /// ".." (RFC 5321 §4.5.2) or it truncates the mail — and a lone LF, which every
424. /// text a program builds is full of, is not a line ending at all on the wire.
425. fn appendDotStuffed(w: *std.ArrayListUnmanaged(u8), body: []const u8) !void {
426. var at_line_start = true;
427. var i: usize = 0;
428. while (i < body.len) : (i += 1) {
429. const ch = body[i];
430. if (ch == '\r') {
431. // Normalise CR and CRLF alike to one CRLF; a bare CR is a line
432. // ending in nothing that talks SMTP.
433. if (i + 1 < body.len and body[i + 1] == '\n') i += 1;
434. try w.appendSlice(allocator, "\r\n");
435. at_line_start = true;
436. continue;
437. }
438. if (ch == '\n') {
439. try w.appendSlice(allocator, "\r\n");
440. at_line_start = true;
441. continue;
442. }
443. if (at_line_start and ch == '.') try w.append(allocator, '.');
444. try w.append(allocator, ch);
445. at_line_start = false;
446. }
447. if (!at_line_start) try w.appendSlice(allocator, "\r\n");
448. }
450. // ── THE CONNECTION ──────────────────────────────────────────────────────────
452. const Conn = struct {
453. fd: i32 = -1,
454. ssl: ?*tls.SSL = null,
455. ctx: ?tls.TlsContext = null,
456. buf: [4096]u8 = undefined,
457. len: usize = 0,
458. pos: usize = 0,
460. fn writeAll(self: *Conn, bytes: []const u8) bool {
461. if (self.ssl) |ssl| {
462. const ctx = &(self.ctx orelse return false);
463. return ctx.writeAll(ssl, bytes) == bytes.len;
464. }
465. var off: usize = 0;
466. while (off < bytes.len) {
467. const rc = linux.write(self.fd, bytes.ptr + off, bytes.len - off);
468. const n: isize = @bitCast(rc);
469. if (n <= 0) return false;
470. off += @intCast(n);
471. }
472. return true;
473. }
475. fn fill(self: *Conn) bool {
476. if (self.ssl) |ssl| {
477. const ctx = &(self.ctx orelse return false);
478. const n = ctx.read(ssl, self.buf[0..]);
479. if (n <= 0) return false;
480. self.len = @intCast(n);
481. self.pos = 0;
482. return true;
483. }
484. const rc = linux.read(self.fd, &self.buf, self.buf.len);
485. const n: isize = @bitCast(rc);
486. if (n <= 0) return false;
487. self.len = @intCast(n);
488. self.pos = 0;
489. return true;
490. }
492. /// One CRLF-terminated reply line, without its terminator, appended into
493. /// `out` (which is cleared first). `false` = the peer went away or timed out.
494. fn readLine(self: *Conn, out: *std.ArrayListUnmanaged(u8)) bool {
495. out.clearRetainingCapacity();
496. while (true) {
497. if (self.pos >= self.len) {
498. if (!self.fill()) return false;
499. }
500. const ch = self.buf[self.pos];
501. self.pos += 1;
502. if (ch == '\n') {
503. if (out.items.len > 0 and out.items[out.items.len - 1] == '\r') {
504. _ = out.pop();
505. }
506. return true;
507. }
508. out.append(allocator, ch) catch return false;
509. if (out.items.len > 65536) return false;
510. }
511. }
513. fn close(self: *Conn) void {
514. if (self.ssl) |ssl| {
515. if (self.ctx) |*ctx| ctx.shutdownAndFree(ssl);
516. self.ssl = null;
517. }
518. if (self.ctx) |*ctx| {
519. ctx.deinit();
520. self.ctx = null;
521. }
522. if (self.fd >= 0) {
523. _ = linux.close(self.fd);
524. self.fd = -1;
525. }
526. }
527. };
529. /// A complete SMTP reply: the code, and every line's text joined with "; ".
530. const Reply = struct {
531. code: u16 = 0,
532. text: std.ArrayListUnmanaged(u8) = .empty,
534. fn deinit(self: *Reply) void {
535. self.text.deinit(allocator);
536. }
537. };
539. /// Read a reply, following RFC 5321 §4.2's multiline form (`250-…` continues,
540. /// `250 …` ends). Returns false if the connection died mid-reply.
541. fn readReply(conn: *Conn, reply: *Reply) bool {
542. reply.text.clearRetainingCapacity();
543. reply.code = 0;
544. var line: std.ArrayListUnmanaged(u8) = .empty;
545. defer line.deinit(allocator);
546. var first = true;
547. while (true) {
548. if (!conn.readLine(&line)) return false;
549. const s = line.items;
550. if (s.len < 3) return false;
551. const code = std.fmt.parseInt(u16, s[0..3], 10) catch return false;
552. if (first) {
553. reply.code = code;
554. first = false;
555. }
556. const rest = if (s.len > 4) s[4..] else "";
557. if (reply.text.items.len > 0) reply.text.appendSlice(allocator, "; ") catch {};
558. reply.text.appendSlice(allocator, rest) catch {};
559. if (s.len == 3 or s[3] != '-') return true;
560. }
561. }
563. fn command(conn: *Conn, reply: *Reply, parts: []const []const u8) bool {
564. for (parts) |p| {
565. if (!conn.writeAll(p)) return false;
566. }
567. if (!conn.writeAll("\r\n")) return false;
568. return readReply(conn, reply);
569. }
571. /// Does the EHLO capability list advertise `name`? Case-insensitive, and
572. /// anchored on a word boundary so "AUTH" does not match "AUTHOR".
573. fn advertises(caps: []const u8, name: []const u8) bool {
574. var i: usize = 0;
575. while (i + name.len <= caps.len) : (i += 1) {
576. if (std.ascii.eqlIgnoreCase(caps[i .. i + name.len], name)) {
577. const before_ok = i == 0 or !std.ascii.isAlphanumeric(caps[i - 1]);
578. const after = i + name.len;
579. const after_ok = after >= caps.len or !std.ascii.isAlphanumeric(caps[after]);
580. if (before_ok and after_ok) return true;
581. }
582. }
583. return false;
584. }
586. // ── DIALLING ────────────────────────────────────────────────────────────────
588. /// Connect to host:port with `timeout_ms` bounding BOTH the connect and every
589. /// later read/write. A blocking connect(2) ignores SO_SNDTIMEO, so the connect
590. /// is made non-blocking and polled; the socket goes back to blocking afterwards
591. /// and the two socket timeouts carry the rest of the conversation.
592. fn dial(host: []const u8, port: u16, timeout_ms: u32, reason: *std.ArrayListUnmanaged(u8)) ?i32 {
593. // libc's resolver, not a hand-rolled one: /etc/hosts, /etc/resolv.conf,
594. // nsswitch and IPv6 are the host's configuration, and a mail client that
595. // answers differently from every other program on the machine is a bug.
596. var host_z_buf: [256]u8 = undefined;
597. if (host.len >= host_z_buf.len) {
598. reason.appendSlice(allocator, "the host name is too long") catch {};
599. return null;
600. }
601. @memcpy(host_z_buf[0..host.len], host);
602. host_z_buf[host.len] = 0;
603. var port_buf: [8]u8 = undefined;
604. const port_s = std.fmt.bufPrintZ(&port_buf, "{d}", .{port}) catch {
605. reason.appendSlice(allocator, "bad port") catch {};
606. return null;
607. };
609. const hints = c.addrinfo{
610. .flags = .{},
611. .family = c.AF.UNSPEC,
612. .socktype = c.SOCK.STREAM,
613. .protocol = 0,
614. .addrlen = 0,
615. .canonname = null,
616. .addr = null,
617. .next = null,
618. };
619. var res: ?*c.addrinfo = null;
620. const rc_ai = c.getaddrinfo(@ptrCast(&host_z_buf), port_s.ptr, &hints, &res);
621. if (rc_ai != @as(c.EAI, @enumFromInt(0)) or res == null) {
622. reason.appendSlice(allocator, "could not resolve the host") catch {};
623. return null;
624. }
625. defer c.freeaddrinfo(res.?);
627. var last: []const u8 = "connection refused";
628. var cursor: ?*c.addrinfo = res;
629. while (cursor) |ai| : (cursor = ai.next) {
630. const sa = ai.addr orelse continue;
631. const rc = linux.socket(@intCast(ai.family), linux.SOCK.STREAM | linux.SOCK.CLOEXEC, 0);
632. const fd: i32 = @intCast(@as(isize, @bitCast(rc)));
633. if (fd < 0) continue;
635. const flags_rc = linux.fcntl(fd, linux.F.GETFL, @as(usize, 0));
636. var oflags: linux.O = @bitCast(@as(u32, @truncate(flags_rc)));
637. oflags.NONBLOCK = true;
638. _ = linux.fcntl(fd, linux.F.SETFL, @as(usize, @as(u32, @bitCast(oflags))));
640. const crc = linux.connect(fd, @ptrCast(sa), ai.addrlen);
641. const cerr: isize = @bitCast(crc);
642. var connected = cerr == 0;
643. if (!connected) {
644. // A negative return is -errno; INPROGRESS is the non-blocking
645. // connect's ordinary answer, not a failure.
646. const e: linux.E = @enumFromInt(@as(u16, @intCast(-cerr)));
647. if (e != .INPROGRESS and e != .INTR) {
648. last = "connection refused";
649. _ = linux.close(fd);
650. continue;
651. }
652. var pfd = [_]linux.pollfd{.{ .fd = fd, .events = linux.POLL.OUT, .revents = 0 }};
653. const prc = linux.poll(&pfd, 1, @intCast(timeout_ms));
654. const pn: isize = @bitCast(prc);
655. if (pn <= 0) {
656. last = "the connection attempt timed out";
657. _ = linux.close(fd);
658. continue;
659. }
660. var soerr: i32 = 0;
661. var slen: linux.socklen_t = @sizeOf(i32);
662. _ = linux.getsockopt(fd, linux.SOL.SOCKET, linux.SO.ERROR, @ptrCast(&soerr), &slen);
663. if (soerr != 0) {
664. last = "connection refused";
665. _ = linux.close(fd);
666. continue;
667. }
668. connected = true;
669. }
671. oflags.NONBLOCK = false;
672. _ = linux.fcntl(fd, linux.F.SETFL, @as(usize, @as(u32, @bitCast(oflags))));
673. const tv = linux.timeval{
674. .sec = @intCast(timeout_ms / 1000),
675. .usec = @intCast((timeout_ms % 1000) * 1000),
676. };
677. _ = linux.setsockopt(fd, linux.SOL.SOCKET, linux.SO.RCVTIMEO, @ptrCast(&tv), @sizeOf(linux.timeval));
678. _ = linux.setsockopt(fd, linux.SOL.SOCKET, linux.SO.SNDTIMEO, @ptrCast(&tv), @sizeOf(linux.timeval));
679. return fd;
680. }
681. reason.appendSlice(allocator, last) catch {};
682. return null;
683. }
685. // ── THE CONVERSATION ────────────────────────────────────────────────────────
687. const Outcome = struct {
688. ok: bool,
689. code: u16,
690. stage: []const u8,
691. message: []u8,
692. secure: bool,
693. };
695. fn own(text: []const u8) []u8 {
696. return allocator.dupe(u8, text) catch allocator.alloc(u8, 0) catch unreachable;
697. }
699. fn fail(stage: []const u8, code: u16, secure: bool, text: []const u8) Outcome {
700. return .{ .ok = false, .code = code, .stage = stage, .message = own(text), .secure = secure };
701. }
703. fn runJob(m: *Mailer, job: *const Job) Outcome {
704. var conn = Conn{};
705. defer conn.close();
707. var reason: std.ArrayListUnmanaged(u8) = .empty;
708. defer reason.deinit(allocator);
710. const fd = dial(m.host, m.port, m.timeout_ms, &reason) orelse
711. return fail("connect", 0, false, reason.items);
712. conn.fd = fd;
714. var secure = false;
715. if (m.tls_mode == .implicit) {
716. const ctx = tls.TlsContext.initClient(.{
717. .ca_file = if (m.ca_file) |ca| ca else null,
718. .verify = m.verify,
719. .tag = "smtp",
720. }) orelse return fail("connect", 0, false, "TLS is unavailable (no usable libssl on this host, or the CA file could not be loaded)");
721. conn.ctx = ctx;
722. conn.ssl = conn.ctx.?.connect(fd, m.host, "smtp") orelse
723. return fail("connect", 0, false, "the implicit TLS handshake failed (see the smtp: lines on stderr)");
724. secure = true;
725. }
727. var reply = Reply{};
728. defer reply.deinit();
730. if (!readReply(&conn, &reply)) return fail("greeting", 0, secure, "the server sent no greeting");
731. if (reply.code != 220) return fail("greeting", reply.code, secure, reply.text.items);
733. // EHLO, and keep the capability list — STARTTLS and AUTH are both read off it.
734. var caps: std.ArrayListUnmanaged(u8) = .empty;
735. defer caps.deinit(allocator);
736. if (!command(&conn, &reply, &.{ "EHLO ", m.helo })) return fail("ehlo", 0, secure, "the connection closed during EHLO");
737. if (reply.code != 250) return fail("ehlo", reply.code, secure, reply.text.items);
738. caps.appendSlice(allocator, reply.text.items) catch {};
740. if (m.tls_mode == .starttls and !secure) {
741. if (!advertises(caps.items, "STARTTLS")) {
742. return fail("starttls", 0, secure, "the server does not advertise STARTTLS (set tls = \"none\" to accept a plaintext session deliberately)");
743. }
744. if (!command(&conn, &reply, &.{"STARTTLS"})) return fail("starttls", 0, secure, "the connection closed during STARTTLS");
745. if (reply.code != 220) return fail("starttls", reply.code, secure, reply.text.items);
747. const ctx = tls.TlsContext.initClient(.{
748. .ca_file = if (m.ca_file) |ca| ca else null,
749. .verify = m.verify,
750. .tag = "smtp",
751. }) orelse return fail("starttls", 0, secure, "TLS is unavailable (no usable libssl on this host, or the CA file could not be loaded)");
752. conn.ctx = ctx;
753. // The SAME socket, mid-protocol: this is what STARTTLS is, and the
754. // client half of tls_common.zig takes it as it stands.
755. conn.ssl = conn.ctx.?.connect(fd, m.host, "smtp") orelse
756. return fail("starttls", 0, secure, "the STARTTLS handshake failed (see the smtp: lines on stderr)");
757. secure = true;
758. conn.len = 0;
759. conn.pos = 0;
761. // RFC 3207 §4.2: everything learned before the upgrade is discarded and
762. // EHLO is re-issued inside TLS — a capability list from the plaintext
763. // half is exactly what an attacker in the middle would have written.
764. caps.clearRetainingCapacity();
765. if (!command(&conn, &reply, &.{ "EHLO ", m.helo })) return fail("ehlo", 0, secure, "the connection closed during the post-STARTTLS EHLO");
766. if (reply.code != 250) return fail("ehlo", reply.code, secure, reply.text.items);
767. caps.appendSlice(allocator, reply.text.items) catch {};
768. }
770. // AUTH
771. if (m.user != null and m.pass != null and m.auth_mode != .none) {
772. if (!secure and !m.allow_insecure_auth) {
773. return fail("auth", 0, secure, "refusing to send credentials over a plaintext connection — use tls = \"starttls\" (the default) or \"implicit\", or set allowInsecureAuth = true to say the clear text is intended");
774. }
775. const wants_login = switch (m.auth_mode) {
776. .login => true,
777. .plain => false,
778. else => !advertises(caps.items, "PLAIN") and advertises(caps.items, "LOGIN"),
779. };
780. const outcome = if (wants_login) authLogin(m, &conn, &reply, secure) else authPlain(m, &conn, &reply, secure);
781. if (outcome) |o| return o;
782. }
784. if (!command(&conn, &reply, &.{ "MAIL FROM:<", job.from, ">" })) return fail("mail", 0, secure, "the connection closed during MAIL FROM");
785. if (reply.code != 250) return fail("mail", reply.code, secure, reply.text.items);
787. for (job.rcpt) |r| {
788. if (!command(&conn, &reply, &.{ "RCPT TO:<", r, ">" })) return fail("rcpt", 0, secure, "the connection closed during RCPT TO");
789. // 251 = "will forward"; anything else non-2xx is a rejected recipient,
790. // and one rejected recipient fails the whole send rather than silently
791. // delivering to the rest (the app decides what to do about it).
792. if (reply.code != 250 and reply.code != 251) return fail("rcpt", reply.code, secure, reply.text.items);
793. }
795. if (!command(&conn, &reply, &.{"DATA"})) return fail("data", 0, secure, "the connection closed during DATA");
796. if (reply.code != 354) return fail("data", reply.code, secure, reply.text.items);
798. if (!conn.writeAll(job.data)) return fail("body", 0, secure, "the connection closed while the message was being written");
799. if (!conn.writeAll(".\r\n")) return fail("body", 0, secure, "the connection closed at the end-of-data marker");
800. if (!readReply(&conn, &reply)) return fail("body", 0, secure, "the server never acknowledged the message");
801. if (reply.code != 250) return fail("body", reply.code, secure, reply.text.items);
803. const accepted = own(reply.text.items);
804. // QUIT is courtesy: the message is accepted the moment DATA answered 250, so
805. // a server that drops the socket instead of saying 221 has not lost it.
806. _ = command(&conn, &reply, &.{"QUIT"});
807. return .{ .ok = true, .code = 250, .stage = "done", .message = accepted, .secure = secure };
808. }
810. /// AUTH PLAIN — RFC 4616: base64 of "\0user\0pass", in the command itself.
811. fn authPlain(m: *Mailer, conn: *Conn, reply: *Reply, secure: bool) ?Outcome {
812. const user = m.user.?;
813. const pass = m.pass.?;
814. const raw = allocator.alloc(u8, 2 + user.len + pass.len) catch return fail("auth", 0, secure, "out of memory");
815. defer allocator.free(raw);
816. raw[0] = 0;
817. @memcpy(raw[1 .. 1 + user.len], user);
818. raw[1 + user.len] = 0;
819. @memcpy(raw[2 + user.len ..], pass);
820. const enc = b64Alloc(raw) catch return fail("auth", 0, secure, "out of memory");
821. defer allocator.free(enc);
823. if (!command(conn, reply, &.{ "AUTH PLAIN ", enc })) return fail("auth", 0, secure, "the connection closed during AUTH PLAIN");
824. if (reply.code != 235) return fail("auth", reply.code, secure, reply.text.items);
825. return null;
826. }
828. /// AUTH LOGIN — the de-facto challenge/response form: base64 username, then
829. /// base64 password, each answering a 334.
830. fn authLogin(m: *Mailer, conn: *Conn, reply: *Reply, secure: bool) ?Outcome {
831. if (!command(conn, reply, &.{"AUTH LOGIN"})) return fail("auth", 0, secure, "the connection closed during AUTH LOGIN");
832. if (reply.code != 334) return fail("auth", reply.code, secure, reply.text.items);
834. const user_enc = b64Alloc(m.user.?) catch return fail("auth", 0, secure, "out of memory");
835. defer allocator.free(user_enc);
836. if (!command(conn, reply, &.{user_enc})) return fail("auth", 0, secure, "the connection closed after the username");
837. if (reply.code != 334) return fail("auth", reply.code, secure, reply.text.items);
839. const pass_enc = b64Alloc(m.pass.?) catch return fail("auth", 0, secure, "out of memory");
840. defer allocator.free(pass_enc);
841. if (!command(conn, reply, &.{pass_enc})) return fail("auth", 0, secure, "the connection closed after the password");
842. if (reply.code != 235) return fail("auth", reply.code, secure, reply.text.items);
843. return null;
844. }
846. fn workerLoop(m: *Mailer) void {
847. while (true) {
848. var job = m.takeJob() orelse break;
849. const outcome = runJob(m, &job);
850. const rcpt: [][]u8 = allocator.alloc([]u8, job.rcpt.len) catch &.{};
851. for (job.rcpt, 0..) |r, i| {
852. if (i < rcpt.len) rcpt[i] = allocator.dupe(u8, r) catch own("");
853. }
854. m.publish(.{
855. .id = job.id,
856. .ok = outcome.ok,
857. .code = outcome.code,
858. .stage = outcome.stage,
859. .message = outcome.message,
860. .secure = outcome.secure,
861. .rcpt = rcpt,
862. });
863. job.deinit();
864. }
865. }
867. // ── THE RESULT SOURCE ───────────────────────────────────────────────────────
869. /// The loader converts a nested `hl_object` by recursing and running THAT
870. /// object's own `deinit_fn` before it runs this one, so the `to` list is already
871. /// gone by the time this is called — touching it here is a double free (measured,
872. /// mission 137). Only the string values this object owns are freed here.
873. fn resultObjDeinit(obj: *HlObject) callconv(.c) void {
874. const fields = obj.fields[0..obj.field_count];
875. for (fields) |f| {
876. if (f.value.type == .hl_string) {
877. allocator.free(@constCast(f.value.data.string.ptr[0..f.value.data.string.len]));
878. }
879. }
880. allocator.free(fields);
881. allocator.destroy(obj);
882. }
884. fn rcptObjDeinit(obj: *HlObject) callconv(.c) void {
885. const fields = obj.fields[0..obj.field_count];
886. for (fields) |f| {
887. allocator.free(@constCast(f.key.ptr[0..f.key.len]));
888. if (f.value.type == .hl_string) {
889. allocator.free(@constCast(f.value.data.string.ptr[0..f.value.data.string.len]));
890. }
891. }
892. allocator.free(fields);
893. allocator.destroy(obj);
894. }
896. /// Contiguous "0".."n-1" keys is how the loader recognises an ordered hybrid, so
897. /// `res.to` arrives in Hybriel as a list however many recipients there were.
898. fn rcptValue(rcpt: [][]u8) HlValue {
899. const fields = allocator.alloc(HlField, rcpt.len) catch return api.makeNull();
900. var built: usize = 0;
901. for (rcpt, 0..) |r, i| {
902. var key_buf: [24]u8 = undefined;
903. const key_src = std.fmt.bufPrint(&key_buf, "{d}", .{i}) catch break;
904. const key = allocator.dupe(u8, key_src) catch break;
905. fields[built] = .{ .key = .{ .ptr = key.ptr, .len = key.len }, .value = api.makeString(r) };
906. built += 1;
907. }
908. const obj = allocator.create(HlObject) catch return api.makeNull();
909. obj.* = .{ .fields = fields.ptr, .field_count = built, .deinit_fn = &rcptObjDeinit };
910. return api.makeObject(obj);
911. }
913. fn resultValue(r: Result) HlValue {
914. const fields = allocator.alloc(HlField, 7) catch return api.makeNull();
915. fields[0] = .{ .key = http.hlStr("id"), .value = api.makeNumber(@floatFromInt(r.id)) };
916. fields[1] = .{ .key = http.hlStr("ok"), .value = api.makeBool(r.ok) };
917. fields[2] = .{ .key = http.hlStr("code"), .value = api.makeNumber(@floatFromInt(r.code)) };
918. // `stage` names a compile-time constant, so it is DUPED here: the deinit
919. // below frees every string field it finds, and handing it a `.rodata`
920. // pointer is a segfault (measured, mission 137). One rule for all fields
921. // beats a per-field exception nobody will remember.
922. fields[3] = .{ .key = http.hlStr("stage"), .value = api.makeString(own(r.stage)) };
923. fields[4] = .{ .key = http.hlStr("message"), .value = api.makeString(r.message) };
924. fields[5] = .{ .key = http.hlStr("secure"), .value = api.makeBool(r.secure) };
925. fields[6] = .{ .key = http.hlStr("to"), .value = rcptValue(r.rcpt) };
926. const obj = allocator.create(HlObject) catch return api.makeNull();
927. obj.* = .{ .fields = fields.ptr, .field_count = 7, .deinit_fn = &resultObjDeinit };
928. allocator.free(r.rcpt);
929. return api.makeObject(obj);
930. }
932. fn resultsTryNext(ctx: ?*anyopaque) callconv(.c) HlValue {
933. const m: *Mailer = @ptrCast(@alignCast(ctx orelse return api.makeNull()));
934. const r = m.tryTake() orelse return api.makeNull();
935. return resultValue(r);
936. }
938. fn resultsNext(ctx: ?*anyopaque) callconv(.c) HlValue {
939. const m: *Mailer = @ptrCast(@alignCast(ctx orelse return api.makeNull()));
940. const r = m.take() orelse return api.makeNull();
941. return resultValue(r);
942. }
944. fn resultsDeinit(_: ?*anyopaque) callconv(.c) void {}
946. // ── EXPORTS ─────────────────────────────────────────────────────────────────
948. /// __native("smtp.open", host, port, options) → Number mailer id
949. export fn hl_smtp_open(argc: u32, argv: [*]const HlValue) callconv(.c) HlValue {
950. if (argc < 2 or argv[0].type != .hl_string or argv[1].type != .hl_number) {
951. return refuse("hl:smtp open: host must be a String and port a Number", .{});
952. }
953. const host = argv[0].data.string.ptr[0..argv[0].data.string.len];
954. const port_f = argv[1].data.number;
955. if (port_f < 1 or port_f > 65535) {
956. return refuse("hl:smtp open: {d} is not a port number", .{port_f});
957. }
958. const opts: HlValue = if (argc >= 3) argv[2] else api.makeNull();
960. const tls_name = strField(opts, "tls") orelse "starttls";
961. const tls_mode: TlsMode = if (std.ascii.eqlIgnoreCase(tls_name, "starttls"))
962. .starttls
963. else if (std.ascii.eqlIgnoreCase(tls_name, "implicit"))
964. .implicit
965. else if (std.ascii.eqlIgnoreCase(tls_name, "none"))
966. .none
967. else
968. return refuse("hl:smtp open: tls = \"{s}\" is not one of \"starttls\", \"implicit\", \"none\"", .{tls_name});
970. const auth_name = strField(opts, "auth") orelse "auto";
971. const auth_mode: AuthMode = if (std.ascii.eqlIgnoreCase(auth_name, "auto"))
972. .auto
973. else if (std.ascii.eqlIgnoreCase(auth_name, "plain"))
974. .plain
975. else if (std.ascii.eqlIgnoreCase(auth_name, "login"))
976. .login
977. else if (std.ascii.eqlIgnoreCase(auth_name, "none"))
978. .none
979. else
980. return refuse("hl:smtp open: auth = \"{s}\" is not one of \"auto\", \"plain\", \"login\", \"none\"", .{auth_name});
982. // A MAILER WITHOUT A SENDER OPENS (ticket #13): an app that never sends
983. // must not abort at load for want of one. A message that ends up with no
984. // sender at all is refused at send(), located at that call.
985. const from = senderField(opts) orelse "";
986. if (from.len > 0) {
987. if (checkAddress("the mailer's \"from\" (or sender)", from)) |e| return e;
988. }
990. const helo = strField(opts, "helo") orelse "localhost";
991. if (checkHeaderValue("helo", helo)) |e| return e;
993. const m = allocator.create(Mailer) catch return refuse("hl:smtp open: out of memory", .{});
994. m.* = .{
995. .id = 0,
996. .host = allocator.dupe(u8, host) catch return refuse("hl:smtp open: out of memory", .{}),
997. .port = @intFromFloat(port_f),
998. .user = dupOpt(strField(opts, "user")),
999. .pass = dupOpt(strField(opts, "pass")),
1000. .from = allocator.dupe(u8, from) catch return refuse("hl:smtp open: out of memory", .{}),
1001. .helo = allocator.dupe(u8, helo) catch return refuse("hl:smtp open: out of memory", .{}),
1002. .tls_mode = tls_mode,
1003. .auth_mode = auth_mode,
1004. .ca_file = dupOpt(strField(opts, "caFile")),
1005. .verify = boolField(opts, "verify", true),
1006. .allow_insecure_auth = boolField(opts, "allowInsecureAuth", false),
1007. .timeout_ms = @intFromFloat(@max(1000, numField(opts, "timeout", 30000))),
1008. .mutex = c.PTHREAD_MUTEX_INITIALIZER,
1009. .condvar = c.PTHREAD_COND_INITIALIZER,
1010. .wake_fd = http.makeWakeFd(),
1011. };
1013. mutexLock(&mailers_mutex);
1014. m.id = next_mailer_id;
1015. next_mailer_id += 1;
1016. mailers.append(allocator, m) catch {};
1017. mutexUnlock(&mailers_mutex);
1019. m.worker = std.Thread.spawn(.{}, workerLoop, .{m}) catch {
1020. return refuse("hl:smtp open: could not start the sender thread", .{});
1021. };
1022. return api.makeNumber(@floatFromInt(m.id));
1023. }
1025. /// __native("smtp.send", id, message) → Number job id, or a located refusal.
1026. ///
1027. /// Everything this function does happens on the HYBRIEL thread, before the job
1028. /// exists: that is deliberate, because a refusal is only located if it is raised
1029. /// at the call site and a worker thread has no call site.
1030. export fn hl_smtp_send(argc: u32, argv: [*]const HlValue) callconv(.c) HlValue {
1031. if (argc < 2 or argv[0].type != .hl_number) {
1032. return refuse("hl:smtp send: expected a mailer id and a message", .{});
1033. }
1034. const m = mailerById(@intFromFloat(argv[0].data.number)) orelse
1035. return refuse("hl:smtp send: this Mailer is closed", .{});
1036. const msg = argv[1];
1037. if (msg.type != .hl_object) {
1038. return refuse("hl:smtp send: the message must be a hybrid with to, subject and text (or html)", .{});
1039. }
1041. const from = senderField(msg) orelse m.from;
1042. if (from.len == 0) {
1043. return refuse("hl:smtp refused the message: it has no \"from\" and neither has the mailer — give one in the message or in the Mailer's options", .{});
1044. }
1045. if (checkAddress("\"from\"", from)) |e| return e;
1047. // `to` is one address or a list of them. A single String is the common case
1048. // and a list is the same message with more RCPT TO lines — never several
1049. // messages, so every recipient sees the same To: header.
1050. var rcpt: std.ArrayListUnmanaged([]u8) = .empty;
1051. var rcpt_failed = false;
1052. defer if (rcpt_failed) {
1053. for (rcpt.items) |r| allocator.free(r);
1054. rcpt.deinit(allocator);
1055. };
1056. const to_field = fieldOf(msg, "to") orelse return refuse("hl:smtp send: the message has no 'to'", .{});
1057. switch (to_field.type) {
1058. .hl_string => {
1059. const one = to_field.data.string.ptr[0..to_field.data.string.len];
1060. if (checkAddress("to", one)) |e| {
1061. rcpt_failed = true;
1062. return e;
1063. }
1064. rcpt.append(allocator, allocator.dupe(u8, one) catch "") catch {};
1065. },
1066. .hl_object => {
1067. const list = to_field.data.object;
1068. for (list.fields[0..list.field_count]) |f| {
1069. if (f.value.type != .hl_string) continue;
1070. const one = f.value.data.string.ptr[0..f.value.data.string.len];
1071. if (checkAddress("to", one)) |e| {
1072. rcpt_failed = true;
1073. return e;
1074. }
1075. rcpt.append(allocator, allocator.dupe(u8, one) catch "") catch {};
1076. }
1077. },
1078. else => return refuse("hl:smtp send: 'to' must be a String or a list of Strings", .{}),
1079. }
1080. if (rcpt.items.len == 0) {
1081. rcpt_failed = true;
1082. return refuse("hl:smtp send: 'to' names no recipient", .{});
1083. }
1085. const subject = strField(msg, "subject") orelse "";
1086. if (checkHeaderValue("subject", subject)) |e| {
1087. rcpt_failed = true;
1088. return e;
1089. }
1091. const text = strField(msg, "text");
1092. const html = strField(msg, "html");
1093. if (text == null and html == null) {
1094. rcpt_failed = true;
1095. return refuse("hl:smtp send: the message has neither 'text' nor 'html'", .{});
1096. }
1098. var body: std.ArrayListUnmanaged(u8) = .empty;
1099. var body_failed = false;
1100. defer if (body_failed) body.deinit(allocator);
1102. renderMessage(&body, m, from, rcpt.items, subject, text, html) catch {
1103. body_failed = true;
1104. rcpt_failed = true;
1105. return refuse("hl:smtp send: out of memory rendering the message", .{});
1106. };
1108. mutexLock(&m.mutex);
1109. const job_id = m.next_job;
1110. m.next_job += 1;
1111. mutexUnlock(&m.mutex);
1113. m.enqueue(.{
1114. .id = job_id,
1115. .from = allocator.dupe(u8, from) catch "",
1116. .rcpt = rcpt.toOwnedSlice(allocator) catch &[_][]u8{},
1117. .data = body.toOwnedSlice(allocator) catch &[_]u8{},
1118. });
1119. return api.makeNumber(@floatFromInt(job_id));
1120. }
1122. fn renderMessage(
1123. out: *std.ArrayListUnmanaged(u8),
1124. m: *Mailer,
1125. from: []const u8,
1126. rcpt: []const []u8,
1127. subject: []const u8,
1128. text: ?[]const u8,
1129. html: ?[]const u8,
1130. ) !void {
1131. var head: std.ArrayListUnmanaged(u8) = .empty;
1132. defer head.deinit(allocator);
1134. try appendHeader(&head, "From", from);
1136. var to_join: std.ArrayListUnmanaged(u8) = .empty;
1137. defer to_join.deinit(allocator);
1138. for (rcpt, 0..) |r, i| {
1139. if (i > 0) try to_join.appendSlice(allocator, ", ");
1140. try to_join.appendSlice(allocator, r);
1141. }
1142. try appendHeader(&head, "To", to_join.items);
1143. try appendHeader(&head, "Subject", subject);
1144. try writeDate(&head);
1146. var mid: [32]u8 = undefined;
1147. randomHex(&mid);
1148. try head.appendSlice(allocator, "Message-ID: <");
1149. try head.appendSlice(allocator, &mid);
1150. try head.append(allocator, '@');
1151. try head.appendSlice(allocator, m.helo);
1152. try head.appendSlice(allocator, ">\r\n");
1153. try head.appendSlice(allocator, "MIME-Version: 1.0\r\n");
1155. if (text != null and html != null) {
1156. var boundary: [24]u8 = undefined;
1157. randomHex(&boundary);
1158. try head.appendSlice(allocator, "Content-Type: multipart/alternative; boundary=\"hl-");
1159. try head.appendSlice(allocator, &boundary);
1160. try head.appendSlice(allocator, "\"\r\n\r\n");
1161. // The plain part first: RFC 2046 §5.1.4 orders alternatives worst-first,
1162. // so a reader that understands HTML picks the LAST one it can render.
1163. try head.appendSlice(allocator, "--hl-");
1164. try head.appendSlice(allocator, &boundary);
1165. try head.appendSlice(allocator, "\r\nContent-Type: text/plain; charset=utf-8\r\nContent-Transfer-Encoding: 8bit\r\n\r\n");
1166. try out.appendSlice(allocator, head.items);
1167. try appendDotStuffed(out, text.?);
1168. try out.appendSlice(allocator, "--hl-");
1169. try out.appendSlice(allocator, &boundary);
1170. try out.appendSlice(allocator, "\r\nContent-Type: text/html; charset=utf-8\r\nContent-Transfer-Encoding: 8bit\r\n\r\n");
1171. try appendDotStuffed(out, html.?);
1172. try out.appendSlice(allocator, "--hl-");
1173. try out.appendSlice(allocator, &boundary);
1174. try out.appendSlice(allocator, "--\r\n");
1175. return;
1176. }
1178. const single = text orelse html.?;
1179. const ctype = if (text != null) "text/plain" else "text/html";
1180. try head.appendSlice(allocator, "Content-Type: ");
1181. try head.appendSlice(allocator, ctype);
1182. try head.appendSlice(allocator, "; charset=utf-8\r\nContent-Transfer-Encoding: 8bit\r\n\r\n");
1183. try out.appendSlice(allocator, head.items);
1184. try appendDotStuffed(out, single);
1185. }
1187. /// __native("smtp.results", id) → the mailer's ONE result source.
1188. export fn hl_smtp_results(argc: u32, argv: [*]const HlValue) callconv(.c) HlValue {
1189. if (argc < 1 or argv[0].type != .hl_number) return api.makeNull();
1190. const m = mailerById(@intFromFloat(argv[0].data.number)) orelse
1191. return refuse("hl:smtp results: this Mailer is closed", .{});
1192. if (m.source == null) {
1193. const iter = allocator.create(HlIterator) catch return api.makeNull();
1194. iter.* = .{
1195. .context = @ptrCast(m),
1196. .next_fn = &resultsNext,
1197. .deinit_fn = &resultsDeinit,
1198. .try_next_fn = &resultsTryNext,
1199. .wake_fd = m.wake_fd,
1200. };
1201. m.source = iter;
1202. }
1203. return api.makeIterator(m.source.?);
1204. }
1206. /// __native("smtp.mark_registered", id) → refuses a SECOND consumer.
1207. /// The drain (`for (r of m.results())`) and the event loop take results off the
1208. /// same queue, so a program doing both would see each result exactly once, in
1209. /// one of two places, at random. Saying so is cheaper than debugging it.
1210. export fn hl_smtp_mark_registered(argc: u32, argv: [*]const HlValue) callconv(.c) HlValue {
1211. if (argc < 1 or argv[0].type != .hl_number) return api.makeNull();
1212. const m = mailerById(@intFromFloat(argv[0].data.number)) orelse
1213. return refuse("hl:smtp deliver: this Mailer is closed", .{});
1214. if (m.registered) {
1215. return refuse("hl:smtp deliver: this Mailer already delivers its results to the event loop", .{});
1216. }
1217. m.registered = true;
1218. return api.makeNull();
1219. }
1221. /// __native("smtp.pending", id) → how many sends have not been answered yet.
1222. export fn hl_smtp_pending(argc: u32, argv: [*]const HlValue) callconv(.c) HlValue {
1223. if (argc < 1 or argv[0].type != .hl_number) return api.makeNumber(0);
1224. const m = mailerById(@intFromFloat(argv[0].data.number)) orelse return api.makeNumber(0);
1225. mutexLock(&m.mutex);
1226. defer mutexUnlock(&m.mutex);
1227. return api.makeNumber(@floatFromInt(m.outstanding));
1228. }
1230. /// __native("smtp.close", id) — stop the worker. Queued jobs still in hand are
1231. /// dropped; a job already in conversation finishes, because abandoning a socket
1232. /// between DATA and its 250 is how a message gets delivered twice.
1233. export fn hl_smtp_close(argc: u32, argv: [*]const HlValue) callconv(.c) HlValue {
1234. if (argc < 1 or argv[0].type != .hl_number) return api.makeNull();
1235. const m = mailerById(@intFromFloat(argv[0].data.number)) orelse return api.makeNull();
1237. mutexLock(&m.mutex);
1238. m.stop = true;
1239. condBroadcast(&m.condvar);
1240. mutexUnlock(&m.mutex);
1241. http.ringWake(m.wake_fd);
1243. if (m.worker) |t| {
1244. t.join();
1245. m.worker = null;
1246. }
1248. mutexLock(&mailers_mutex);
1249. for (mailers.items, 0..) |candidate, i| {
1250. if (candidate == m) {
1251. _ = mailers.orderedRemove(i);
1252. break;
1253. }
1254. }
1255. mutexUnlock(&mailers_mutex);
1256. return api.makeNull();
1257. }