2022-05-18 10:24:37 +00:00
|
|
|
mod bayou;
|
2022-05-19 10:10:48 +00:00
|
|
|
mod config;
|
2022-05-18 10:24:37 +00:00
|
|
|
mod cryptoblob;
|
2022-06-17 16:39:36 +00:00
|
|
|
mod imap;
|
2022-07-13 10:30:35 +00:00
|
|
|
mod k2v_util;
|
2022-05-31 15:07:34 +00:00
|
|
|
mod lmtp;
|
2022-05-19 10:10:48 +00:00
|
|
|
mod login;
|
2022-06-27 14:56:20 +00:00
|
|
|
mod mail;
|
2022-05-19 13:14:36 +00:00
|
|
|
mod server;
|
2022-05-18 10:24:37 +00:00
|
|
|
mod time;
|
|
|
|
|
2022-05-19 13:14:36 +00:00
|
|
|
use std::path::PathBuf;
|
2022-05-18 12:54:48 +00:00
|
|
|
|
2022-05-19 13:14:36 +00:00
|
|
|
use anyhow::{bail, Result};
|
|
|
|
use clap::{Parser, Subcommand};
|
|
|
|
use rand::prelude::*;
|
|
|
|
|
2022-05-19 10:10:48 +00:00
|
|
|
use config::*;
|
2022-05-19 13:14:36 +00:00
|
|
|
use cryptoblob::*;
|
2022-05-19 13:17:58 +00:00
|
|
|
use login::{static_provider::*, *};
|
2022-05-19 12:33:49 +00:00
|
|
|
use server::Server;
|
2022-05-18 10:24:37 +00:00
|
|
|
|
2022-05-19 13:14:36 +00:00
|
|
|
#[derive(Parser, Debug)]
|
|
|
|
#[clap(author, version, about, long_about = None)]
|
|
|
|
struct Args {
|
|
|
|
#[clap(subcommand)]
|
|
|
|
command: Command,
|
|
|
|
}
|
|
|
|
|
|
|
|
#[derive(Subcommand, Debug)]
|
|
|
|
enum Command {
|
|
|
|
/// Runs the IMAP+LMTP server daemon
|
|
|
|
Server {
|
2022-06-30 08:50:03 +00:00
|
|
|
#[clap(short, long, env = "CONFIG_FILE", default_value = "aerogramme.toml")]
|
2022-05-19 13:14:36 +00:00
|
|
|
config_file: PathBuf,
|
|
|
|
},
|
2022-05-31 15:07:34 +00:00
|
|
|
/// TEST TEST TEST
|
|
|
|
Test {
|
2022-06-30 08:50:03 +00:00
|
|
|
#[clap(short, long, env = "CONFIG_FILE", default_value = "aerogramme.toml")]
|
2022-05-31 15:07:34 +00:00
|
|
|
config_file: PathBuf,
|
|
|
|
},
|
2022-05-19 13:14:36 +00:00
|
|
|
/// Initializes key pairs for a user and adds a key decryption password
|
|
|
|
FirstLogin {
|
|
|
|
#[clap(flatten)]
|
|
|
|
creds: StorageCredsArgs,
|
2022-05-23 15:31:53 +00:00
|
|
|
#[clap(flatten)]
|
|
|
|
user_secrets: UserSecretsArgs,
|
2022-05-19 13:14:36 +00:00
|
|
|
},
|
|
|
|
/// Initializes key pairs for a user and dumps keys to stdout for usage with static
|
|
|
|
/// login provider
|
|
|
|
InitializeLocalKeys {
|
|
|
|
#[clap(flatten)]
|
|
|
|
creds: StorageCredsArgs,
|
|
|
|
},
|
|
|
|
/// Adds a key decryption password for a user
|
|
|
|
AddPassword {
|
|
|
|
#[clap(flatten)]
|
|
|
|
creds: StorageCredsArgs,
|
2022-05-23 15:31:53 +00:00
|
|
|
#[clap(flatten)]
|
|
|
|
user_secrets: UserSecretsArgs,
|
2022-05-19 13:14:36 +00:00
|
|
|
/// Automatically generate password
|
|
|
|
#[clap(short, long)]
|
|
|
|
gen: bool,
|
|
|
|
},
|
|
|
|
/// Deletes a key decription password for a user
|
|
|
|
DeletePassword {
|
|
|
|
#[clap(flatten)]
|
|
|
|
creds: StorageCredsArgs,
|
2022-05-23 15:31:53 +00:00
|
|
|
#[clap(flatten)]
|
|
|
|
user_secrets: UserSecretsArgs,
|
2022-05-19 13:14:36 +00:00
|
|
|
/// Allow to delete all passwords
|
|
|
|
#[clap(long)]
|
|
|
|
allow_delete_all: bool,
|
|
|
|
},
|
|
|
|
/// Dumps all encryption keys for user
|
|
|
|
ShowKeys {
|
|
|
|
#[clap(flatten)]
|
|
|
|
creds: StorageCredsArgs,
|
2022-05-23 15:31:53 +00:00
|
|
|
#[clap(flatten)]
|
|
|
|
user_secrets: UserSecretsArgs,
|
2022-05-19 13:14:36 +00:00
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
#[derive(Parser, Debug)]
|
|
|
|
struct StorageCredsArgs {
|
|
|
|
/// Name of the region to use
|
|
|
|
#[clap(short = 'r', long, env = "AWS_REGION")]
|
|
|
|
region: String,
|
|
|
|
/// Url of the endpoint to connect to for K2V
|
|
|
|
#[clap(short = 'k', long, env = "K2V_ENDPOINT")]
|
|
|
|
k2v_endpoint: String,
|
|
|
|
/// Url of the endpoint to connect to for S3
|
|
|
|
#[clap(short = 's', long, env = "S3_ENDPOINT")]
|
|
|
|
s3_endpoint: String,
|
|
|
|
/// Access key ID
|
|
|
|
#[clap(short = 'A', long, env = "AWS_ACCESS_KEY_ID")]
|
|
|
|
aws_access_key_id: String,
|
|
|
|
/// Access key ID
|
|
|
|
#[clap(short = 'S', long, env = "AWS_SECRET_ACCESS_KEY")]
|
|
|
|
aws_secret_access_key: String,
|
|
|
|
/// Bucket name
|
|
|
|
#[clap(short = 'b', long, env = "BUCKET")]
|
|
|
|
bucket: String,
|
|
|
|
}
|
|
|
|
|
2022-05-23 15:31:53 +00:00
|
|
|
#[derive(Parser, Debug)]
|
|
|
|
struct UserSecretsArgs {
|
|
|
|
/// User secret
|
|
|
|
#[clap(short = 'U', long, env = "USER_SECRET")]
|
|
|
|
user_secret: String,
|
|
|
|
/// Alternate user secrets (comma-separated list of strings)
|
|
|
|
#[clap(long, env = "ALTERNATE_USER_SECRETS", default_value = "")]
|
|
|
|
alternate_user_secrets: String,
|
|
|
|
}
|
|
|
|
|
2022-05-18 10:24:37 +00:00
|
|
|
#[tokio::main]
|
2022-05-19 13:14:36 +00:00
|
|
|
async fn main() -> Result<()> {
|
2022-05-20 11:36:45 +00:00
|
|
|
if std::env::var("RUST_LOG").is_err() {
|
2022-06-30 08:50:03 +00:00
|
|
|
std::env::set_var("RUST_LOG", "main=info,aerogramme=info,k2v_client=info")
|
2022-05-20 11:36:45 +00:00
|
|
|
}
|
2022-06-02 15:59:29 +00:00
|
|
|
|
2022-06-29 18:00:38 +00:00
|
|
|
// Abort on panic (same behavior as in Go)
|
|
|
|
std::panic::set_hook(Box::new(|panic_info| {
|
2023-05-15 16:23:23 +00:00
|
|
|
eprintln!("{}", panic_info);
|
2022-07-15 14:15:48 +00:00
|
|
|
eprintln!("{:?}", backtrace::Backtrace::new());
|
2022-06-29 18:00:38 +00:00
|
|
|
std::process::abort();
|
|
|
|
}));
|
|
|
|
|
2022-06-02 15:59:29 +00:00
|
|
|
tracing_subscriber::fmt::init();
|
2022-05-20 11:36:45 +00:00
|
|
|
|
2022-05-19 13:14:36 +00:00
|
|
|
let args = Args::parse();
|
|
|
|
|
|
|
|
match args.command {
|
|
|
|
Command::Server { config_file } => {
|
|
|
|
let config = read_config(config_file)?;
|
|
|
|
|
2022-06-03 09:38:01 +00:00
|
|
|
let server = Server::new(config).await?;
|
2022-05-19 13:14:36 +00:00
|
|
|
server.run().await?;
|
|
|
|
}
|
2022-05-31 15:07:34 +00:00
|
|
|
Command::Test { config_file } => {
|
|
|
|
let config = read_config(config_file)?;
|
|
|
|
|
2022-06-29 10:52:58 +00:00
|
|
|
let _server = Server::new(config).await?;
|
2022-06-15 16:40:39 +00:00
|
|
|
//server.test().await?;
|
2022-05-31 15:07:34 +00:00
|
|
|
}
|
2022-05-23 15:31:53 +00:00
|
|
|
Command::FirstLogin {
|
|
|
|
creds,
|
|
|
|
user_secrets,
|
|
|
|
} => {
|
2022-05-19 13:14:36 +00:00
|
|
|
let creds = make_storage_creds(creds);
|
2022-05-23 15:31:53 +00:00
|
|
|
let user_secrets = make_user_secrets(user_secrets);
|
2022-05-19 13:14:36 +00:00
|
|
|
|
|
|
|
println!("Please enter your password for key decryption.");
|
|
|
|
println!("If you are using LDAP login, this must be your LDAP password.");
|
|
|
|
println!("If you are using the static login provider, enter any password, and this will also become your password for local IMAP access.");
|
|
|
|
let password = rpassword::prompt_password("Enter password: ")?;
|
|
|
|
let password_confirm = rpassword::prompt_password("Confirm password: ")?;
|
|
|
|
if password != password_confirm {
|
|
|
|
bail!("Passwords don't match.");
|
|
|
|
}
|
|
|
|
|
2022-05-23 15:31:53 +00:00
|
|
|
CryptoKeys::init(&creds, &user_secrets, &password).await?;
|
2022-05-19 13:14:36 +00:00
|
|
|
|
|
|
|
println!("");
|
|
|
|
println!("Cryptographic key setup is complete.");
|
|
|
|
println!("");
|
|
|
|
println!("If you are using the static login provider, add the following section to your .toml configuration file:");
|
|
|
|
println!("");
|
|
|
|
dump_config(&password, &creds);
|
|
|
|
}
|
|
|
|
Command::InitializeLocalKeys { creds } => {
|
|
|
|
let creds = make_storage_creds(creds);
|
|
|
|
|
|
|
|
println!("Please enter a password for local IMAP access.");
|
|
|
|
println!("This password is not used for key decryption, your keys will be printed below (do not lose them!)");
|
|
|
|
println!(
|
|
|
|
"If you plan on using LDAP login, stop right here and use `first-login` instead"
|
|
|
|
);
|
|
|
|
let password = rpassword::prompt_password("Enter password: ")?;
|
|
|
|
let password_confirm = rpassword::prompt_password("Confirm password: ")?;
|
|
|
|
if password != password_confirm {
|
|
|
|
bail!("Passwords don't match.");
|
|
|
|
}
|
|
|
|
|
|
|
|
let master = gen_key();
|
|
|
|
let (_, secret) = gen_keypair();
|
|
|
|
let keys = CryptoKeys::init_without_password(&creds, &master, &secret).await?;
|
|
|
|
|
|
|
|
println!("");
|
|
|
|
println!("Cryptographic key setup is complete.");
|
|
|
|
println!("");
|
|
|
|
println!("Add the following section to your .toml configuration file:");
|
|
|
|
println!("");
|
|
|
|
dump_config(&password, &creds);
|
|
|
|
dump_keys(&keys);
|
|
|
|
}
|
2022-05-23 15:31:53 +00:00
|
|
|
Command::AddPassword {
|
|
|
|
creds,
|
|
|
|
user_secrets,
|
|
|
|
gen,
|
|
|
|
} => {
|
2022-05-19 13:14:36 +00:00
|
|
|
let creds = make_storage_creds(creds);
|
2022-05-23 15:31:53 +00:00
|
|
|
let user_secrets = make_user_secrets(user_secrets);
|
|
|
|
|
2022-05-19 13:14:36 +00:00
|
|
|
let existing_password =
|
|
|
|
rpassword::prompt_password("Enter existing password to decrypt keys: ")?;
|
|
|
|
let new_password = if gen {
|
2022-05-20 19:35:50 +00:00
|
|
|
let password = base64::encode_config(
|
|
|
|
&u128::to_be_bytes(thread_rng().gen())[..10],
|
|
|
|
base64::URL_SAFE_NO_PAD,
|
|
|
|
);
|
2022-05-19 13:14:36 +00:00
|
|
|
println!("Your new password: {}", password);
|
|
|
|
println!("Keep it safe!");
|
|
|
|
password
|
|
|
|
} else {
|
|
|
|
let password = rpassword::prompt_password("Enter new password: ")?;
|
|
|
|
let password_confirm = rpassword::prompt_password("Confirm new password: ")?;
|
|
|
|
if password != password_confirm {
|
|
|
|
bail!("Passwords don't match.");
|
|
|
|
}
|
|
|
|
password
|
|
|
|
};
|
|
|
|
|
2022-05-23 15:31:53 +00:00
|
|
|
let keys = CryptoKeys::open(&creds, &user_secrets, &existing_password).await?;
|
|
|
|
keys.add_password(&creds, &user_secrets, &new_password)
|
|
|
|
.await?;
|
2022-05-19 13:14:36 +00:00
|
|
|
println!("");
|
|
|
|
println!("New password added successfully.");
|
|
|
|
}
|
|
|
|
Command::DeletePassword {
|
|
|
|
creds,
|
2022-05-23 15:31:53 +00:00
|
|
|
user_secrets,
|
2022-05-19 13:14:36 +00:00
|
|
|
allow_delete_all,
|
|
|
|
} => {
|
|
|
|
let creds = make_storage_creds(creds);
|
2022-05-23 15:31:53 +00:00
|
|
|
let user_secrets = make_user_secrets(user_secrets);
|
|
|
|
|
2022-05-19 13:14:36 +00:00
|
|
|
let existing_password = rpassword::prompt_password("Enter password to delete: ")?;
|
|
|
|
|
2022-05-23 15:36:08 +00:00
|
|
|
let keys = match allow_delete_all {
|
|
|
|
true => Some(CryptoKeys::open(&creds, &user_secrets, &existing_password).await?),
|
|
|
|
false => None,
|
|
|
|
};
|
|
|
|
|
|
|
|
CryptoKeys::delete_password(&creds, &existing_password, allow_delete_all).await?;
|
2022-05-19 13:14:36 +00:00
|
|
|
|
|
|
|
println!("");
|
|
|
|
println!("Password was deleted successfully.");
|
|
|
|
|
2022-05-23 15:36:08 +00:00
|
|
|
if let Some(keys) = keys {
|
2022-05-19 13:14:36 +00:00
|
|
|
println!("As a reminder, here are your cryptographic keys:");
|
|
|
|
dump_keys(&keys);
|
|
|
|
}
|
|
|
|
}
|
2022-05-23 15:31:53 +00:00
|
|
|
Command::ShowKeys {
|
|
|
|
creds,
|
|
|
|
user_secrets,
|
|
|
|
} => {
|
2022-05-19 13:14:36 +00:00
|
|
|
let creds = make_storage_creds(creds);
|
2022-05-23 15:31:53 +00:00
|
|
|
let user_secrets = make_user_secrets(user_secrets);
|
|
|
|
|
2022-05-19 13:14:36 +00:00
|
|
|
let existing_password = rpassword::prompt_password("Enter key decryption password: ")?;
|
|
|
|
|
2022-05-23 15:31:53 +00:00
|
|
|
let keys = CryptoKeys::open(&creds, &user_secrets, &existing_password).await?;
|
2022-05-19 13:14:36 +00:00
|
|
|
dump_keys(&keys);
|
|
|
|
}
|
2022-05-19 10:10:48 +00:00
|
|
|
}
|
2022-05-19 13:14:36 +00:00
|
|
|
|
|
|
|
Ok(())
|
2022-05-18 10:24:37 +00:00
|
|
|
}
|
|
|
|
|
2022-05-19 13:14:36 +00:00
|
|
|
fn make_storage_creds(c: StorageCredsArgs) -> StorageCredentials {
|
2022-06-29 13:39:54 +00:00
|
|
|
let s3_region = Region {
|
2022-05-19 13:14:36 +00:00
|
|
|
name: c.region.clone(),
|
|
|
|
endpoint: c.s3_endpoint,
|
|
|
|
};
|
2022-06-29 13:39:54 +00:00
|
|
|
let k2v_region = Region {
|
2022-05-19 13:14:36 +00:00
|
|
|
name: c.region,
|
|
|
|
endpoint: c.k2v_endpoint,
|
|
|
|
};
|
|
|
|
StorageCredentials {
|
|
|
|
k2v_region,
|
|
|
|
s3_region,
|
|
|
|
aws_access_key_id: c.aws_access_key_id,
|
|
|
|
aws_secret_access_key: c.aws_secret_access_key,
|
|
|
|
bucket: c.bucket,
|
|
|
|
}
|
|
|
|
}
|
2022-05-18 12:54:48 +00:00
|
|
|
|
2022-05-23 15:31:53 +00:00
|
|
|
fn make_user_secrets(c: UserSecretsArgs) -> UserSecrets {
|
|
|
|
UserSecrets {
|
|
|
|
user_secret: c.user_secret,
|
|
|
|
alternate_user_secrets: c
|
|
|
|
.alternate_user_secrets
|
2023-05-15 16:23:23 +00:00
|
|
|
.split(',')
|
2022-05-23 15:31:53 +00:00
|
|
|
.map(|x| x.trim())
|
|
|
|
.filter(|x| !x.is_empty())
|
|
|
|
.map(|x| x.to_string())
|
|
|
|
.collect(),
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-05-19 13:14:36 +00:00
|
|
|
fn dump_config(password: &str, creds: &StorageCredentials) {
|
|
|
|
println!("[login_static.users.<username>]");
|
2022-05-20 09:45:13 +00:00
|
|
|
println!(
|
|
|
|
"password = \"{}\"",
|
|
|
|
hash_password(password).expect("unable to hash password")
|
|
|
|
);
|
2022-05-19 13:14:36 +00:00
|
|
|
println!("aws_access_key_id = \"{}\"", creds.aws_access_key_id);
|
|
|
|
println!(
|
|
|
|
"aws_secret_access_key = \"{}\"",
|
|
|
|
creds.aws_secret_access_key
|
|
|
|
);
|
2022-05-19 10:10:48 +00:00
|
|
|
}
|
2022-05-18 10:24:37 +00:00
|
|
|
|
2022-05-19 13:14:36 +00:00
|
|
|
fn dump_keys(keys: &CryptoKeys) {
|
|
|
|
println!("master_key = \"{}\"", base64::encode(&keys.master));
|
|
|
|
println!("secret_key = \"{}\"", base64::encode(&keys.secret));
|
|
|
|
}
|