647 lines
22 KiB
Rust
647 lines
22 KiB
Rust
//! mailer-bin: CLI and IPC binary for the @push.rocks/smartmta Rust crates.
|
|
//!
|
|
//! Supports two modes:
|
|
//! 1. **CLI mode** — traditional subcommands for testing and standalone use
|
|
//! 2. **Management mode** (`--management`) — JSON-over-stdin/stdout IPC for
|
|
//! integration with `@push.rocks/smartrust` from TypeScript
|
|
|
|
use clap::{Parser, Subcommand};
|
|
use serde::{Deserialize, Serialize};
|
|
use std::io::{self, BufRead, Write};
|
|
use std::net::IpAddr;
|
|
|
|
/// mailer-bin: Rust-powered email security tools
|
|
#[derive(Parser)]
|
|
#[command(name = "mailer-bin", version, about)]
|
|
struct Cli {
|
|
#[command(subcommand)]
|
|
command: Option<Commands>,
|
|
|
|
/// Run in management/IPC mode (JSON-over-stdin/stdout for smartrust bridge)
|
|
#[arg(long)]
|
|
management: bool,
|
|
}
|
|
|
|
#[derive(Subcommand)]
|
|
enum Commands {
|
|
/// Print version information
|
|
Version,
|
|
|
|
/// Validate an email address
|
|
Validate {
|
|
/// The email address to validate
|
|
email: String,
|
|
},
|
|
|
|
/// Detect bounce type from an SMTP response
|
|
Bounce {
|
|
/// The SMTP response or diagnostic message
|
|
message: String,
|
|
},
|
|
|
|
/// Check IP reputation via DNSBL
|
|
CheckIp {
|
|
/// The IP address to check
|
|
ip: String,
|
|
},
|
|
|
|
/// Verify DKIM/SPF/DMARC for an email (reads raw message from stdin)
|
|
VerifyEmail {
|
|
/// Sender IP address for SPF check
|
|
#[arg(long)]
|
|
ip: Option<String>,
|
|
|
|
/// HELO domain for SPF check
|
|
#[arg(long)]
|
|
helo: Option<String>,
|
|
|
|
/// Receiving server hostname
|
|
#[arg(long, default_value = "localhost")]
|
|
hostname: String,
|
|
|
|
/// MAIL FROM address for SPF check
|
|
#[arg(long)]
|
|
mail_from: Option<String>,
|
|
},
|
|
|
|
/// Sign an email with DKIM (reads raw message from stdin)
|
|
DkimSign {
|
|
/// Signing domain
|
|
#[arg(long)]
|
|
domain: String,
|
|
|
|
/// DKIM selector
|
|
#[arg(long, default_value = "mta")]
|
|
selector: String,
|
|
|
|
/// Path to RSA private key PEM file
|
|
#[arg(long)]
|
|
key: String,
|
|
},
|
|
}
|
|
|
|
// --- IPC types for smartrust bridge ---
|
|
|
|
#[derive(Deserialize)]
|
|
struct IpcRequest {
|
|
id: String,
|
|
method: String,
|
|
params: serde_json::Value,
|
|
}
|
|
|
|
#[derive(Serialize)]
|
|
struct IpcResponse {
|
|
id: String,
|
|
success: bool,
|
|
#[serde(skip_serializing_if = "Option::is_none")]
|
|
result: Option<serde_json::Value>,
|
|
#[serde(skip_serializing_if = "Option::is_none")]
|
|
error: Option<String>,
|
|
}
|
|
|
|
#[derive(Serialize)]
|
|
struct IpcEvent {
|
|
event: String,
|
|
data: serde_json::Value,
|
|
}
|
|
|
|
fn main() {
|
|
let cli = Cli::parse();
|
|
|
|
if cli.management {
|
|
run_management_mode();
|
|
return;
|
|
}
|
|
|
|
match cli.command {
|
|
Some(Commands::Version) | None => {
|
|
println!(
|
|
"mailer-bin v{} (core: {}, smtp: {}, security: {})",
|
|
env!("CARGO_PKG_VERSION"),
|
|
mailer_core::version(),
|
|
mailer_smtp::version(),
|
|
mailer_security::version(),
|
|
);
|
|
}
|
|
|
|
Some(Commands::Validate { email }) => {
|
|
let result = mailer_core::validate_email(&email);
|
|
println!(
|
|
"{}",
|
|
serde_json::to_string_pretty(&serde_json::json!({
|
|
"email": email,
|
|
"valid": result.is_valid,
|
|
"formatValid": result.format_valid,
|
|
"score": result.score,
|
|
"error": result.error_message,
|
|
}))
|
|
.unwrap()
|
|
);
|
|
}
|
|
|
|
Some(Commands::Bounce { message }) => {
|
|
let detection = mailer_core::detect_bounce_type(Some(&message), None, None);
|
|
println!(
|
|
"{}",
|
|
serde_json::to_string_pretty(&detection).unwrap()
|
|
);
|
|
}
|
|
|
|
Some(Commands::CheckIp { ip }) => {
|
|
let rt = tokio::runtime::Runtime::new().unwrap();
|
|
rt.block_on(async {
|
|
let ip_addr: IpAddr = match ip.parse() {
|
|
Ok(addr) => addr,
|
|
Err(e) => {
|
|
eprintln!("Invalid IP address: {}", e);
|
|
std::process::exit(1);
|
|
}
|
|
};
|
|
|
|
let resolver = hickory_resolver::TokioResolver::builder_tokio().map(|b| b.build())
|
|
.expect("Failed to create DNS resolver");
|
|
|
|
match mailer_security::check_reputation(
|
|
ip_addr,
|
|
mailer_security::DEFAULT_DNSBL_SERVERS,
|
|
&resolver,
|
|
)
|
|
.await
|
|
{
|
|
Ok(result) => {
|
|
println!("{}", serde_json::to_string_pretty(&result).unwrap());
|
|
}
|
|
Err(e) => {
|
|
eprintln!("Error: {}", e);
|
|
std::process::exit(1);
|
|
}
|
|
}
|
|
});
|
|
}
|
|
|
|
Some(Commands::VerifyEmail {
|
|
ip,
|
|
helo,
|
|
hostname,
|
|
mail_from,
|
|
}) => {
|
|
let rt = tokio::runtime::Runtime::new().unwrap();
|
|
rt.block_on(async {
|
|
// Read raw message from stdin
|
|
let mut raw_message = Vec::new();
|
|
io::stdin()
|
|
.lock()
|
|
.read_to_end(&mut raw_message)
|
|
.expect("Failed to read from stdin");
|
|
|
|
let authenticator = mailer_security::default_authenticator()
|
|
.expect("Failed to create authenticator");
|
|
|
|
// DKIM verification
|
|
let dkim_results = mailer_security::verify_dkim(&raw_message, &authenticator)
|
|
.await
|
|
.unwrap_or_else(|e| {
|
|
vec![mailer_security::DkimVerificationResult {
|
|
is_valid: false,
|
|
domain: None,
|
|
selector: None,
|
|
status: "error".to_string(),
|
|
details: Some(e.to_string()),
|
|
}]
|
|
});
|
|
|
|
let mut output = serde_json::json!({
|
|
"dkim": dkim_results,
|
|
});
|
|
|
|
// SPF verification (if IP provided)
|
|
if let (Some(ip_str), Some(helo_domain), Some(sender)) =
|
|
(&ip, &helo, &mail_from)
|
|
{
|
|
if let Ok(ip_addr) = ip_str.parse::<IpAddr>() {
|
|
match mailer_security::check_spf(
|
|
ip_addr,
|
|
helo_domain,
|
|
&hostname,
|
|
sender,
|
|
&authenticator,
|
|
)
|
|
.await
|
|
{
|
|
Ok(spf_result) => {
|
|
output["spf"] = serde_json::to_value(&spf_result).unwrap();
|
|
}
|
|
Err(e) => {
|
|
output["spf"] =
|
|
serde_json::json!({"error": e.to_string()});
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
println!("{}", serde_json::to_string_pretty(&output).unwrap());
|
|
});
|
|
}
|
|
|
|
Some(Commands::DkimSign {
|
|
domain,
|
|
selector,
|
|
key,
|
|
}) => {
|
|
// Read private key
|
|
let key_pem = std::fs::read_to_string(&key).unwrap_or_else(|e| {
|
|
eprintln!("Failed to read key file '{}': {}", key, e);
|
|
std::process::exit(1);
|
|
});
|
|
|
|
// Read raw message from stdin
|
|
let mut raw_message = Vec::new();
|
|
io::stdin()
|
|
.lock()
|
|
.read_to_end(&mut raw_message)
|
|
.expect("Failed to read from stdin");
|
|
|
|
match mailer_security::sign_dkim(&raw_message, &domain, &selector, &key_pem) {
|
|
Ok(header) => {
|
|
// Output signed message: DKIM header + original message
|
|
print!("{}", header);
|
|
io::stdout().write_all(&raw_message).unwrap();
|
|
}
|
|
Err(e) => {
|
|
eprintln!("DKIM signing failed: {}", e);
|
|
std::process::exit(1);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
use std::io::Read;
|
|
|
|
/// Run in management/IPC mode for smartrust bridge.
|
|
fn run_management_mode() {
|
|
// Signal readiness
|
|
let ready_event = IpcEvent {
|
|
event: "ready".to_string(),
|
|
data: serde_json::json!({
|
|
"version": env!("CARGO_PKG_VERSION"),
|
|
"core_version": mailer_core::version(),
|
|
"security_version": mailer_security::version(),
|
|
}),
|
|
};
|
|
println!("{}", serde_json::to_string(&ready_event).unwrap());
|
|
io::stdout().flush().unwrap();
|
|
|
|
let rt = tokio::runtime::Runtime::new().unwrap();
|
|
|
|
let stdin = io::stdin();
|
|
for line in stdin.lock().lines() {
|
|
let line = match line {
|
|
Ok(l) => l,
|
|
Err(_) => break,
|
|
};
|
|
|
|
if line.trim().is_empty() {
|
|
continue;
|
|
}
|
|
|
|
let req: IpcRequest = match serde_json::from_str(&line) {
|
|
Ok(r) => r,
|
|
Err(e) => {
|
|
let resp = IpcResponse {
|
|
id: "unknown".to_string(),
|
|
success: false,
|
|
result: None,
|
|
error: Some(format!("Invalid request: {}", e)),
|
|
};
|
|
println!("{}", serde_json::to_string(&resp).unwrap());
|
|
io::stdout().flush().unwrap();
|
|
continue;
|
|
}
|
|
};
|
|
|
|
let response = rt.block_on(handle_ipc_request(&req));
|
|
println!("{}", serde_json::to_string(&response).unwrap());
|
|
io::stdout().flush().unwrap();
|
|
}
|
|
}
|
|
|
|
async fn handle_ipc_request(req: &IpcRequest) -> IpcResponse {
|
|
match req.method.as_str() {
|
|
"ping" => IpcResponse {
|
|
id: req.id.clone(),
|
|
success: true,
|
|
result: Some(serde_json::json!({"pong": true})),
|
|
error: None,
|
|
},
|
|
|
|
"version" => IpcResponse {
|
|
id: req.id.clone(),
|
|
success: true,
|
|
result: Some(serde_json::json!({
|
|
"bin": env!("CARGO_PKG_VERSION"),
|
|
"core": mailer_core::version(),
|
|
"security": mailer_security::version(),
|
|
"smtp": mailer_smtp::version(),
|
|
})),
|
|
error: None,
|
|
},
|
|
|
|
"validateEmail" => {
|
|
let email = req.params.get("email").and_then(|v| v.as_str()).unwrap_or("");
|
|
let result = mailer_core::validate_email(email);
|
|
IpcResponse {
|
|
id: req.id.clone(),
|
|
success: true,
|
|
result: Some(serde_json::json!({
|
|
"valid": result.is_valid,
|
|
"formatValid": result.format_valid,
|
|
"score": result.score,
|
|
"error": result.error_message,
|
|
})),
|
|
error: None,
|
|
}
|
|
}
|
|
|
|
"detectBounce" => {
|
|
let smtp_response = req.params.get("smtpResponse").and_then(|v| v.as_str());
|
|
let diagnostic = req.params.get("diagnosticCode").and_then(|v| v.as_str());
|
|
let status = req.params.get("statusCode").and_then(|v| v.as_str());
|
|
let detection = mailer_core::detect_bounce_type(smtp_response, diagnostic, status);
|
|
IpcResponse {
|
|
id: req.id.clone(),
|
|
success: true,
|
|
result: Some(serde_json::to_value(&detection).unwrap()),
|
|
error: None,
|
|
}
|
|
}
|
|
|
|
"checkIpReputation" => {
|
|
let ip_str = req.params.get("ip").and_then(|v| v.as_str()).unwrap_or("");
|
|
match ip_str.parse::<IpAddr>() {
|
|
Ok(ip_addr) => {
|
|
let resolver = match hickory_resolver::TokioResolver::builder_tokio().map(|b| b.build()) {
|
|
Ok(r) => r,
|
|
Err(e) => {
|
|
return IpcResponse {
|
|
id: req.id.clone(),
|
|
success: false,
|
|
result: None,
|
|
error: Some(format!("DNS resolver error: {}", e)),
|
|
};
|
|
}
|
|
};
|
|
match mailer_security::check_reputation(
|
|
ip_addr,
|
|
mailer_security::DEFAULT_DNSBL_SERVERS,
|
|
&resolver,
|
|
)
|
|
.await
|
|
{
|
|
Ok(result) => IpcResponse {
|
|
id: req.id.clone(),
|
|
success: true,
|
|
result: Some(serde_json::to_value(&result).unwrap()),
|
|
error: None,
|
|
},
|
|
Err(e) => IpcResponse {
|
|
id: req.id.clone(),
|
|
success: false,
|
|
result: None,
|
|
error: Some(e.to_string()),
|
|
},
|
|
}
|
|
}
|
|
Err(e) => IpcResponse {
|
|
id: req.id.clone(),
|
|
success: false,
|
|
result: None,
|
|
error: Some(format!("Invalid IP address: {}", e)),
|
|
},
|
|
}
|
|
}
|
|
|
|
"verifyDkim" => {
|
|
let raw_message = req
|
|
.params
|
|
.get("rawMessage")
|
|
.and_then(|v| v.as_str())
|
|
.unwrap_or("");
|
|
let authenticator = match mailer_security::default_authenticator() {
|
|
Ok(a) => a,
|
|
Err(e) => {
|
|
return IpcResponse {
|
|
id: req.id.clone(),
|
|
success: false,
|
|
result: None,
|
|
error: Some(format!("Authenticator error: {}", e)),
|
|
};
|
|
}
|
|
};
|
|
match mailer_security::verify_dkim(raw_message.as_bytes(), &authenticator).await {
|
|
Ok(results) => IpcResponse {
|
|
id: req.id.clone(),
|
|
success: true,
|
|
result: Some(serde_json::to_value(&results).unwrap()),
|
|
error: None,
|
|
},
|
|
Err(e) => IpcResponse {
|
|
id: req.id.clone(),
|
|
success: false,
|
|
result: None,
|
|
error: Some(e.to_string()),
|
|
},
|
|
}
|
|
}
|
|
|
|
"signDkim" => {
|
|
let raw_message = req
|
|
.params
|
|
.get("rawMessage")
|
|
.and_then(|v| v.as_str())
|
|
.unwrap_or("");
|
|
let domain = req.params.get("domain").and_then(|v| v.as_str()).unwrap_or("");
|
|
let selector = req
|
|
.params
|
|
.get("selector")
|
|
.and_then(|v| v.as_str())
|
|
.unwrap_or("mta");
|
|
let private_key = req
|
|
.params
|
|
.get("privateKey")
|
|
.and_then(|v| v.as_str())
|
|
.unwrap_or("");
|
|
|
|
match mailer_security::sign_dkim(raw_message.as_bytes(), domain, selector, private_key) {
|
|
Ok(header) => IpcResponse {
|
|
id: req.id.clone(),
|
|
success: true,
|
|
result: Some(serde_json::json!({
|
|
"header": header,
|
|
"signedMessage": format!("{}{}", header, raw_message),
|
|
})),
|
|
error: None,
|
|
},
|
|
Err(e) => IpcResponse {
|
|
id: req.id.clone(),
|
|
success: false,
|
|
result: None,
|
|
error: Some(e.to_string()),
|
|
},
|
|
}
|
|
}
|
|
|
|
"verifyEmail" => {
|
|
let raw_message = req
|
|
.params
|
|
.get("rawMessage")
|
|
.and_then(|v| v.as_str())
|
|
.unwrap_or("");
|
|
let ip_str = req.params.get("ip").and_then(|v| v.as_str()).unwrap_or("");
|
|
let helo = req
|
|
.params
|
|
.get("heloDomain")
|
|
.and_then(|v| v.as_str())
|
|
.unwrap_or("");
|
|
let hostname = req
|
|
.params
|
|
.get("hostname")
|
|
.and_then(|v| v.as_str())
|
|
.unwrap_or("localhost");
|
|
let mail_from = req
|
|
.params
|
|
.get("mailFrom")
|
|
.and_then(|v| v.as_str())
|
|
.unwrap_or("");
|
|
|
|
match ip_str.parse::<IpAddr>() {
|
|
Ok(ip_addr) => {
|
|
let authenticator = match mailer_security::default_authenticator() {
|
|
Ok(a) => a,
|
|
Err(e) => {
|
|
return IpcResponse {
|
|
id: req.id.clone(),
|
|
success: false,
|
|
result: None,
|
|
error: Some(format!("Authenticator error: {}", e)),
|
|
};
|
|
}
|
|
};
|
|
match mailer_security::verify_email_security(
|
|
raw_message.as_bytes(),
|
|
ip_addr,
|
|
helo,
|
|
hostname,
|
|
mail_from,
|
|
&authenticator,
|
|
)
|
|
.await
|
|
{
|
|
Ok(result) => IpcResponse {
|
|
id: req.id.clone(),
|
|
success: true,
|
|
result: Some(serde_json::to_value(&result).unwrap()),
|
|
error: None,
|
|
},
|
|
Err(e) => IpcResponse {
|
|
id: req.id.clone(),
|
|
success: false,
|
|
result: None,
|
|
error: Some(e.to_string()),
|
|
},
|
|
}
|
|
}
|
|
Err(e) => IpcResponse {
|
|
id: req.id.clone(),
|
|
success: false,
|
|
result: None,
|
|
error: Some(format!("Invalid IP address: {}", e)),
|
|
},
|
|
}
|
|
}
|
|
|
|
"scanContent" => {
|
|
let subject = req.params.get("subject").and_then(|v| v.as_str());
|
|
let text_body = req.params.get("textBody").and_then(|v| v.as_str());
|
|
let html_body = req.params.get("htmlBody").and_then(|v| v.as_str());
|
|
let attachment_names: Vec<String> = req.params.get("attachmentNames")
|
|
.and_then(|v| v.as_array())
|
|
.map(|a| a.iter().filter_map(|v| v.as_str().map(String::from)).collect())
|
|
.unwrap_or_default();
|
|
let result = mailer_security::content_scanner::scan_content(
|
|
subject, text_body, html_body, &attachment_names
|
|
);
|
|
IpcResponse {
|
|
id: req.id.clone(),
|
|
success: true,
|
|
result: Some(serde_json::to_value(&result).unwrap()),
|
|
error: None,
|
|
}
|
|
}
|
|
|
|
"checkSpf" => {
|
|
let ip_str = req.params.get("ip").and_then(|v| v.as_str()).unwrap_or("");
|
|
let helo = req
|
|
.params
|
|
.get("heloDomain")
|
|
.and_then(|v| v.as_str())
|
|
.unwrap_or("");
|
|
let hostname = req
|
|
.params
|
|
.get("hostname")
|
|
.and_then(|v| v.as_str())
|
|
.unwrap_or("localhost");
|
|
let mail_from = req
|
|
.params
|
|
.get("mailFrom")
|
|
.and_then(|v| v.as_str())
|
|
.unwrap_or("");
|
|
|
|
match ip_str.parse::<IpAddr>() {
|
|
Ok(ip_addr) => {
|
|
let authenticator = match mailer_security::default_authenticator() {
|
|
Ok(a) => a,
|
|
Err(e) => {
|
|
return IpcResponse {
|
|
id: req.id.clone(),
|
|
success: false,
|
|
result: None,
|
|
error: Some(format!("Authenticator error: {}", e)),
|
|
};
|
|
}
|
|
};
|
|
match mailer_security::check_spf(ip_addr, helo, hostname, mail_from, &authenticator)
|
|
.await
|
|
{
|
|
Ok(result) => IpcResponse {
|
|
id: req.id.clone(),
|
|
success: true,
|
|
result: Some(serde_json::to_value(&result).unwrap()),
|
|
error: None,
|
|
},
|
|
Err(e) => IpcResponse {
|
|
id: req.id.clone(),
|
|
success: false,
|
|
result: None,
|
|
error: Some(e.to_string()),
|
|
},
|
|
}
|
|
}
|
|
Err(e) => IpcResponse {
|
|
id: req.id.clone(),
|
|
success: false,
|
|
result: None,
|
|
error: Some(format!("Invalid IP address: {}", e)),
|
|
},
|
|
}
|
|
}
|
|
|
|
_ => IpcResponse {
|
|
id: req.id.clone(),
|
|
success: false,
|
|
result: None,
|
|
error: Some(format!("Unknown method: {}", req.method)),
|
|
},
|
|
}
|
|
}
|