commit 979022df61e346d29bdb302d70e1d5e14afb6291
Author: Maurus Decimus <11444311+mdecimus@users.noreply.github.com>
Date: Mon Jun 8 16:57:10 2026 +0200
Initial commit
diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..97fd07e
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,7 @@
+# Ignore everything by default
+*
+
+# Allow only what the build needs
+!src
+!Cargo.toml
+!Cargo.lock
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..3488ce8
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,472 @@
+name: "CI"
+
+on:
+ workflow_dispatch:
+ inputs:
+ Docker:
+ required: false
+ default: false
+ type: boolean
+ Release:
+ required: false
+ default: false
+ type: boolean
+ push:
+ tags: ["v*.*.*"]
+
+env:
+ SCCACHE_GHA_ENABLED: true
+ RUSTC_WRAPPER: sccache
+ CARGO_TERM_COLOR: always
+ AWS_LC_SYS_PREBUILT_NASM: 1
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.ref }}
+ cancel-in-progress: true
+
+jobs:
+ multiarch:
+ strategy:
+ fail-fast: false
+ matrix:
+ include:
+ - variant: gnu
+ - variant: musl
+ name: Merge image / ${{matrix.variant}}
+ runs-on: ubuntu-latest
+ permissions:
+ id-token: write
+ contents: read
+ attestations: write
+ packages: write
+ needs: [linux]
+ if: github.event_name == 'push' || inputs.Docker
+ steps:
+ - name: Install Cosign
+ uses: sigstore/cosign-installer@v4.1.1
+ - name: Log In to GitHub Container Registry
+ uses: docker/login-action@v4
+ with:
+ registry: ghcr.io
+ username: ${{github.repository_owner}}
+ password: ${{github.token}}
+
+ - name: Log In to DockerHub
+ uses: docker/login-action@v4
+ with:
+ username: ${{secrets.DOCKERHUB_USERNAME}}
+ password: ${{secrets.DOCKERHUB_TOKEN}}
+
+ - name: Download ${{matrix.variant}} meta bake definition
+ uses: actions/download-artifact@v8
+ with:
+ name: bake-meta-${{matrix.variant}}
+ path: ${{ runner.temp }}/${{matrix.variant}}
+
+ - name: Download ${{matrix.variant}} digests
+ uses: actions/download-artifact@v8
+ with:
+ path: ${{ runner.temp }}/${{matrix.variant}}/digests
+ pattern: digests-${{matrix.variant}}-*
+ merge-multiple: true
+
+ - name: Create ${{matrix.variant}} manifest list and push
+ working-directory: ${{ runner.temp }}/${{matrix.variant}}/digests
+ run: |
+ docker buildx imagetools create $(jq -cr '.target."docker-metadata-action".tags | map(select(startswith("ghcr.io/${{github.repository}}")) | "-t " + .) | join(" ")' ${{ runner.temp }}/${{matrix.variant}}/bake-meta.json) \
+ $(printf 'ghcr.io/${{github.repository}}@sha256:%s ' *)
+ docker buildx imagetools create $(jq -cr '.target."docker-metadata-action".tags | map(select(startswith("index.docker.io/${{github.repository}}")) | "-t " + .) | join(" ")' ${{ runner.temp }}/${{matrix.variant}}/bake-meta.json) \
+ $(printf 'index.docker.io/${{github.repository}}@sha256:%s ' *)
+
+ - name: Inspect ${{matrix.variant}} image
+ id: manifest-digest
+ run: |
+ docker buildx imagetools inspect --format '{{json .Manifest}}' ghcr.io/${{github.repository}}:$(jq -r '.target."docker-metadata-action".args.DOCKER_META_VERSION' ${{ runner.temp }}/${{matrix.variant}}/bake-meta.json) | jq -r '.digest' > GHCR_DIGEST_SHA
+ echo "GHCR_DIGEST_SHA=$(cat GHCR_DIGEST_SHA)" | tee -a "${GITHUB_ENV}"
+ docker buildx imagetools inspect --format '{{json .Manifest}}' index.docker.io/${{github.repository}}:$(jq -r '.target."docker-metadata-action".args.DOCKER_META_VERSION' ${{ runner.temp }}/${{matrix.variant}}/bake-meta.json) | jq -r '.digest' > DOCKERHUB_DIGEST_SHA
+ echo "DOCKERHUB_DIGEST_SHA=$(cat DOCKERHUB_DIGEST_SHA)" | tee -a "${GITHUB_ENV}"
+ cosign sign --yes $(jq --arg GHCR_DIGEST_SHA "$(cat GHCR_DIGEST_SHA)" -cr '.target."docker-metadata-action".tags | map(select(startswith("ghcr.io/${{github.repository}}")) | . + "@" + $GHCR_DIGEST_SHA) | join(" ")' ${{ runner.temp }}/${{matrix.variant}}/bake-meta.json)
+ cosign sign --yes $(jq --arg DOCKERHUB_DIGEST_SHA "$(cat DOCKERHUB_DIGEST_SHA)" -cr '.target."docker-metadata-action".tags | map(select(startswith("index.docker.io/${{github.repository}}")) | . + "@" + $DOCKERHUB_DIGEST_SHA) | join(" ")' ${{ runner.temp }}/${{matrix.variant}}/bake-meta.json)
+
+ - name: Attest GHCR
+ uses: actions/attest-build-provenance@v4
+ with:
+ subject-name: ghcr.io/${{github.repository}}
+ subject-digest: ${{ env.GHCR_DIGEST_SHA }}
+ push-to-registry: true
+
+ - name: Attest Dockerhub
+ uses: actions/attest-build-provenance@v4
+ with:
+ subject-name: index.docker.io/${{github.repository}}
+ subject-digest: ${{ env.DOCKERHUB_DIGEST_SHA }}
+ push-to-registry: true
+
+ linux:
+ permissions:
+ id-token: write
+ contents: write
+ attestations: write
+ packages: write
+ strategy:
+ fail-fast: false
+ matrix:
+ include:
+ - target: x86_64-unknown-linux-gnu
+ platform: linux/amd64
+ suffix: ""
+ - target: x86_64-unknown-linux-musl
+ platform: linux/amd64
+ suffix: "-alpine"
+ - target: aarch64-unknown-linux-gnu
+ platform: linux/arm64
+ suffix: ""
+ - target: aarch64-unknown-linux-musl
+ platform: linux/arm64
+ suffix: "-alpine"
+ - target: armv7-unknown-linux-gnueabihf
+ platform: linux/arm/v7
+ suffix: ""
+ - target: armv7-unknown-linux-musleabihf
+ platform: linux/arm/v7
+ suffix: "-alpine"
+ - target: arm-unknown-linux-gnueabihf
+ platform: linux/arm/v6
+ suffix: ""
+ - target: arm-unknown-linux-musleabihf
+ platform: linux/arm/v6
+ suffix: "-alpine"
+ name: Build / ${{matrix.target}}
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v6.0.2
+
+ - name: Add swap (heavy ARM targets)
+ if: contains(matrix.target, 'arm')
+ run: |
+ sudo fallocate -l 16G /mnt/swapfile
+ sudo chmod 600 /mnt/swapfile
+ sudo mkswap /mnt/swapfile
+ sudo swapon /mnt/swapfile
+ sudo sysctl vm.swappiness=80
+ free -h
+ swapon --show
+
+ - name: Set up QEMU
+ uses: docker/setup-qemu-action@v4
+ with:
+ platforms: "arm64,arm"
+
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@v4
+ with:
+ buildkitd-config-inline: |
+ [registry."docker.io"]
+ mirrors = ["https://mirror.gcr.io"]
+ driver-opts: |
+ network=host
+
+ - name: Log In to GitHub Container Registry
+ uses: docker/login-action@v4
+ with:
+ registry: ghcr.io
+ username: ${{github.repository_owner}}
+ password: ${{github.token}}
+
+ - name: Log In to DockerHub
+ uses: docker/login-action@v4
+ with:
+ username: ${{secrets.DOCKERHUB_USERNAME}}
+ password: ${{secrets.DOCKERHUB_TOKEN}}
+
+ - name: Calculate shasum of external deps
+ id: cal-dep-shasum
+ run: |
+ echo "checksum=$(yq -p toml -oy '.package[] | select((.source | contains("")) or (.checksum | contains("")))' Cargo.lock | sha256sum | awk '{print $1}')" >> "$GITHUB_OUTPUT"
+
+ - name: Cache apt
+ uses: actions/cache@v5.0.5
+ id: apt-cache
+ with:
+ path: |
+ var-cache-apt
+ var-lib-apt
+ key: apt-cache-${{ hashFiles('Dockerfile.build') }}
+
+ - name: Cache Cargo
+ uses: actions/cache@v5.0.5
+ id: cargo-cache
+ with:
+ path: |
+ usr-local-cargo-registry
+ usr-local-cargo-git
+ key: cargo-cache-${{ steps.cal-dep-shasum.outputs.checksum }}
+
+ - name: Inject cache into docker
+ uses: reproducible-containers/buildkit-cache-dance@v3.3.2
+ with:
+ cache-map: |
+ {
+ "var-cache-apt": "/var/cache/apt",
+ "var-lib-apt": "/var/lib/apt",
+ "usr-local-cargo-registry": "/usr/local/cargo/registry",
+ "usr-local-cargo-git": "/usr/local/cargo/git"
+ }
+ skip-extraction: ${{ steps.cargo-cache.outputs.cache-hit }} && ${{ steps.apt-cache.outputs.cache-hit }}
+
+ - name: Extract Metadata for Docker
+ uses: docker/metadata-action@v6
+ id: meta
+ with:
+ images: |
+ index.docker.io/${{github.repository}}
+ ghcr.io/${{github.repository}}
+ flavor: |
+ suffix=${{matrix.suffix}},onlatest=true
+ tags: |
+ type=ref,event=tag
+ type=ref,event=branch,prefix=branch-
+ type=edge,branch=main
+ type=semver,pattern=v{{major}}.{{minor}}
+
+ - name: Build Artifact
+ id: bake
+ uses: docker/bake-action@v7
+ env:
+ DOCKER_BUILD_RECORD_UPLOAD: false
+ TARGET: ${{matrix.target}}
+ GHCR_REPO: ghcr.io/${{github.repository}}
+ BUILD_ENV: ""
+ DOCKER_PLATFORM: ${{matrix.platform}}
+ SUFFIX: ${{matrix.suffix}}
+ with:
+ source: .
+ set: |
+ *.tags=
+ image.output=type=image,"name=ghcr.io/${{github.repository}},index.docker.io/${{github.repository}}",push-by-digest=true,name-canonical=true,push=true,compression=zstd,compression-level=9,force-compression=true,oci-mediatypes=true
+ files: |
+ docker-bake.hcl
+ ${{ steps.meta.outputs.bake-file }}
+ targets: ${{(github.event_name == 'push' || inputs.Docker) && 'build,image' || 'build'}}
+
+ - name: Upload Artifacts
+ uses: actions/upload-artifact@v7
+ with:
+ name: artifact-${{matrix.target}}
+ path: |
+ artifact
+ !artifact/*.json
+
+ - name: Export digest & Rename meta bake definition file
+ if: github.event_name == 'push' || inputs.Docker
+ run: |
+ mv "${{ steps.meta.outputs.bake-file }}" "${{ runner.temp }}/bake-meta.json"
+ mkdir -p ${{ runner.temp }}/digests
+ digest="${{ fromJSON(steps.bake.outputs.metadata).image['containerimage.digest'] }}"
+ touch "${{ runner.temp }}/digests/${digest#sha256:}"
+
+ - name: Upload digest
+ if: github.event_name == 'push' || inputs.Docker
+ uses: actions/upload-artifact@v7
+ with:
+ name: digests-${{matrix.suffix == '' && 'gnu' || 'musl'}}-${{ matrix.target }}
+ path: ${{ runner.temp }}/digests/*
+ if-no-files-found: error
+ retention-days: 1
+
+ - name: Upload GNU meta bake definition
+ uses: actions/upload-artifact@v7
+ if: (github.event_name == 'push' || inputs.Docker) && endsWith(matrix.target,'gnu') && startsWith(matrix.target,'x86')
+ with:
+ name: bake-meta-gnu
+ path: ${{ runner.temp }}/bake-meta.json
+ if-no-files-found: error
+ retention-days: 1
+
+ - name: Upload musl meta bake definition
+ uses: actions/upload-artifact@v7
+ if: (github.event_name == 'push' || inputs.Docker) && endsWith(matrix.target,'musl') && startsWith(matrix.target,'x86')
+ with:
+ name: bake-meta-musl
+ path: ${{ runner.temp }}/bake-meta.json
+ if-no-files-found: error
+ retention-days: 1
+
+ windows:
+ name: Build / ${{matrix.target}}
+ runs-on: windows-latest
+ strategy:
+ fail-fast: false
+ matrix:
+ include:
+ - target: x86_64-pc-windows-msvc
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v6.0.2
+
+ - name: Run sccache-cache
+ uses: mozilla-actions/sccache-action@v0.0.9
+ with:
+ disable_annotations: true
+
+ - name: Build
+ run: |
+ rustup target add ${{matrix.target}}
+ cargo build --release --target ${{matrix.target}} -p proxy
+ mkdir -p artifacts
+ mv ./target/${{matrix.target}}/release/proxy.exe ./artifacts/proxy.exe
+
+ - name: Upload Artifacts
+ uses: actions/upload-artifact@v7
+ with:
+ name: artifact-${{matrix.target}}
+ path: artifacts
+
+ macos:
+ name: Build / ${{matrix.target}}
+ runs-on: macos-latest
+ strategy:
+ fail-fast: false
+ matrix:
+ include:
+ - target: aarch64-apple-darwin
+ - target: x86_64-apple-darwin
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v6.0.2
+
+ - name: Run sccache-cache
+ uses: mozilla-actions/sccache-action@v0.0.9
+ with:
+ disable_annotations: true
+
+ - name: Build
+ run: |
+ rustup target add ${{matrix.target}}
+ cargo build --release --target ${{matrix.target}} -p proxy
+ mkdir -p artifacts
+ mv ./target/${{matrix.target}}/release/proxy ./artifacts/proxy
+
+ - name: Upload Artifacts
+ uses: actions/upload-artifact@v7
+ with:
+ name: artifact-${{matrix.target}}
+ path: artifacts
+
+ release:
+ name: Release
+ permissions:
+ id-token: write
+ contents: write
+ attestations: write
+ if: github.event_name == 'push' || inputs.Release
+ needs: [linux, windows, macos]
+ runs-on: ubuntu-latest
+ steps:
+ # Must run before artifacts are downloaded: checkout cleans the workspace.
+ - name: Checkout (for CHANGELOG)
+ if: startsWith(github.ref, 'refs/tags/')
+ uses: actions/checkout@v6.0.2
+
+ - name: Download Artifacts
+ uses: actions/download-artifact@v8
+ with:
+ path: archive
+ pattern: artifact-*
+
+ - name: Compress
+ run: |
+ set -eux
+ BASE_DIR="$(pwd)/archive"
+ compress_files() {
+ local dir="$1"
+ local archive_dir_name="${dir#artifact-}"
+ cd "$dir"
+ # Process each file in the directory
+ for file in `ls`; do
+ filename="${file%.*}"
+ extension="${file##*.}"
+ if [ "$extension" = "exe" ]; then
+ 7z a -tzip "${filename}-${archive_dir_name}.zip" "$file" > /dev/null
+ else
+ tar -czf "${filename}-${archive_dir_name}.tar.gz" "$file"
+ fi
+ done
+ cd $BASE_DIR
+ }
+ cd $BASE_DIR
+ for arch_dir in `ls`; do
+ dir_name=$(basename "$arch_dir")
+ compress_files "$dir_name"
+ done
+
+ - name: Attest binary
+ id: attest
+ uses: actions/attest-build-provenance@v4
+ with:
+ subject-path: |
+ archive/**/*.tar.gz
+ archive/**/*.zip
+
+ - name: Use cosign to sign existing artifacts
+ uses: sigstore/gh-action-sigstore-python@v3.3.0
+ with:
+ inputs: |
+ archive/**/*.tar.gz
+ archive/**/*.zip
+
+ - name: Build release body
+ run: |
+ if [ "${{ startsWith(github.ref, 'refs/tags/') }}" = "true" ]; then
+ awk '/^## \[/{c++} c==1' CHANGELOG.md > release_body.md
+ echo "" >> release_body.md
+ else
+ : > release_body.md
+ fi
+ cat >> release_body.md <
+
+ ### Check binary attestation [here](${{ steps.attest.outputs.attestation-url }})
+ EOF
+
+ - name: Release
+ uses: softprops/action-gh-release@v3
+ with:
+ files: |
+ archive/**/*.tar.gz
+ archive/**/*.zip
+ archive/**/*.sigstore.json
+ prerelease: ${{!startsWith(github.ref, 'refs/tags/') || null}}
+ tag_name: ${{!startsWith(github.ref, 'refs/tags/') && 'nightly' || null}}
+ # Tag-push releases are created as drafts; the `publish` job un-drafts
+ # them only after all build jobs succeed, so watcher notifications
+ # don't fire on broken builds.
+ draft: ${{ startsWith(github.ref, 'refs/tags/') || null }}
+ body_path: release_body.md
+
+ publish:
+ name: Publish release
+ needs: [linux, windows, macos, multiarch, release]
+ if: startsWith(github.ref, 'refs/tags/')
+ runs-on: ubuntu-latest
+ permissions:
+ contents: write
+ steps:
+ - name: Un-draft release
+ env:
+ GH_TOKEN: ${{ github.token }}
+ run: gh release edit "${{ github.ref_name }}" --draft=false --latest --repo "${{ github.repository }}"
+
+ cleanup:
+ name: Cleanup failed release
+ needs: [linux, windows, macos, multiarch, release]
+ if: failure() && startsWith(github.ref, 'refs/tags/')
+ runs-on: ubuntu-latest
+ permissions:
+ contents: write
+ steps:
+ - name: Delete draft release and tag
+ env:
+ GH_TOKEN: ${{ github.token }}
+ run: gh release delete "${{ github.ref_name }}" --yes --cleanup-tag --repo "${{ github.repository }}" || true
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..c0d0aef
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,5 @@
+/target
+.ignore
+*.md
+!CHANGELOG.md
+!README.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..7b63334
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,13 @@
+# Change Log
+
+All notable changes to this project will be documented in this file. This project adheres to [Semantic Versioning](http://semver.org/).
+
+## [1.0.0] - 2026-06-08
+
+### Added
+- Initial release of the migration proxy: pre-auth routing and socket bridging
+ for SMTP, submission, LMTP, IMAP, POP3, ManageSieve and HTTP/HTTPS.
+
+### Changed
+
+### Fixed
diff --git a/Cargo.lock b/Cargo.lock
new file mode 100644
index 0000000..4f8f699
--- /dev/null
+++ b/Cargo.lock
@@ -0,0 +1,4463 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "ahash"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+dependencies = [
+ "cfg-if",
+ "getrandom 0.3.4",
+ "once_cell",
+ "serde",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+
+[[package]]
+name = "arc-swap"
+version = "1.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a3a1fd6f75306b68087b831f025c712524bcb19aad54e557b1129cfa0a2b207"
+dependencies = [
+ "rustversion",
+]
+
+[[package]]
+name = "arcstr"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03918c3dbd7701a85c6b9887732e2921175f26c350b4563841d0958c21d57e6d"
+
+[[package]]
+name = "asn1-rs"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f43a50ac4fdca5df8e885c21b835997f0a1cdee65494a6847694a98652d9d8"
+dependencies = [
+ "asn1-rs-derive",
+ "asn1-rs-impl",
+ "displaydoc",
+ "nom",
+ "num-traits",
+ "rusticata-macros",
+ "thiserror",
+ "time",
+]
+
+[[package]]
+name = "asn1-rs-derive"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3109e49b1e4909e9db6515a30c633684d68cdeaa252f215214cb4fa1a5bfee2c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "asn1-rs-impl"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "assert-json-diff"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e4f2b81832e72834d7518d8487a0396a28cc408186a2e8854c0f98011faf12"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "astral-tokio-tar"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb50a7aae84a03bf55b067832bc376f4961b790c97e64d3eacee97d389b90277"
+dependencies = [
+ "filetime",
+ "futures-core",
+ "libc",
+ "portable-atomic",
+ "rustc-hash",
+ "tokio",
+ "tokio-stream",
+ "xattr",
+]
+
+[[package]]
+name = "async-lock"
+version = "3.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "290f7f2596bd5b78a9fec8088ccd89180d7f9f55b94b0576823bbbdc72ee8311"
+dependencies = [
+ "event-listener",
+ "event-listener-strategy",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-stream"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b5a71a6f37880a80d1d7f19efd781e4b5de42c88f0722cc13bcb6cc2cfe8476"
+dependencies = [
+ "async-stream-impl",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-stream-impl"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "async-trait"
+version = "0.1.89"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "atoi"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f28d99ec8bfea296261ca1af174f24225171fea9664ba9003cbebee704810528"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "aws-lc-rs"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ec2f1fc3ec205783a5da9a7e6c1509cc69dedf09a1949e412c1e18469326d00"
+dependencies = [
+ "aws-lc-sys",
+ "untrusted 0.7.1",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.41.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a2f9779ce85b93ab6170dd940ad0169b5766ff848247aff13bb788b832fe3f4"
+dependencies = [
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+]
+
+[[package]]
+name = "axum"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
+dependencies = [
+ "axum-core",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "itoa",
+ "matchit",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde_core",
+ "sync_wrapper",
+ "tower",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "backon"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cffb0e931875b666fc4fcb20fee52e9bbd1ef836fd9e9e04ec21555f9f85f7ef"
+dependencies = [
+ "fastrand",
+]
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "bit-vec"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b71798fca2c1fe1086445a7258a4bc81e6e49dcd24c8d0dd9a1e57395b603f51"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "bitflags"
+version = "2.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "84d7ced0ae9557296835c32bf1b1e02b44c746701f898460fb000d7eaa84f00a"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4152116fd6e9dadb291ae18fc1ec3575ed6d84c29642d97890f4b4a3417297e4"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdd35008169921d80bc60d3d0ab416eecb028c4cd653352907921d95084790be"
+dependencies = [
+ "hybrid-array",
+]
+
+[[package]]
+name = "blowfish"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32fa6a061124e37baba002e496d203e23ba3d7b73750be82dbfbc92913048a5b"
+dependencies = [
+ "byteorder",
+ "cipher",
+ "opaque-debug",
+]
+
+[[package]]
+name = "bollard"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee04c4c84f1f811b017f2fbb7dd8815c976e7ca98593de9c1e2afad0f636bff4"
+dependencies = [
+ "async-stream",
+ "base64",
+ "bitflags",
+ "bollard-buildkit-proto",
+ "bollard-stubs",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "hex",
+ "home",
+ "http",
+ "http-body-util",
+ "hyper",
+ "hyper-named-pipe",
+ "hyper-rustls",
+ "hyper-util",
+ "hyperlocal",
+ "log",
+ "num",
+ "pin-project-lite",
+ "rand 0.9.4",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-pki-types",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "serde_urlencoded",
+ "thiserror",
+ "time",
+ "tokio",
+ "tokio-stream",
+ "tokio-util",
+ "tonic",
+ "tower-service",
+ "url",
+ "winapi",
+]
+
+[[package]]
+name = "bollard-buildkit-proto"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85a885520bf6249ab931a764ffdb87b0ceef48e6e7d807cfdb21b751e086e1ad"
+dependencies = [
+ "prost",
+ "prost-types",
+ "tonic",
+ "tonic-prost",
+ "ureq",
+]
+
+[[package]]
+name = "bollard-stubs"
+version = "1.52.1-rc.29.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f0a8ca8799131c1837d1282c3f81f31e76ceb0ce426e04a7fe1ccee3287c066"
+dependencies = [
+ "base64",
+ "bollard-buildkit-proto",
+ "bytes",
+ "prost",
+ "serde",
+ "serde_json",
+ "serde_repr",
+ "time",
+]
+
+[[package]]
+name = "bs58"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf88ba1141d185c399bee5288d850d63b8369520c1eafc32a0430b5b6c287bf4"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "bstr"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63044e1ae8e69f3b5a92c736ca6269b8d12fa7efe39bf34ddb06d102cf0e2cab"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
+
+[[package]]
+name = "cc"
+version = "1.2.63"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "556e016178bb5662a08681bbe0f00f8e17631781a4dfc8c45e466e4b185ec27f"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+
+[[package]]
+name = "chacha20"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "chrono"
+version = "0.4.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
+dependencies = [
+ "iana-time-zone",
+ "js-sys",
+ "num-traits",
+ "serde",
+ "wasm-bindgen",
+ "windows-link",
+]
+
+[[package]]
+name = "cipher"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f8e7987cbd042a63249497f41aed09f8e65add917ea6566effbc56578d6801"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "cmake"
+version = "0.1.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "cmov"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
+
+[[package]]
+name = "colored"
+version = "3.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "combine"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "memchr",
+ "pin-project-lite",
+ "tokio",
+ "tokio-util",
+]
+
+[[package]]
+name = "concurrent-queue"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5eb8a2a1cd12ab0d987a5d5e825195d372001a4094a0376319d5a0ad71c1ba0d"
+dependencies = [
+ "crc-catalog",
+]
+
+[[package]]
+name = "crc-catalog"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "217698eaf96b4a3f0bc4f3662aaa55bdf913cd54d7204591faa790070c6d0853"
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-queue"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f58bbc28f91df819d0aa2a2c00cd19754769c2fad90579b3592b1c9ba7a3115"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+
+[[package]]
+name = "crypto-common"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
+dependencies = [
+ "hybrid-array",
+]
+
+[[package]]
+name = "crypto-mac"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4857fd85a0c34b3c3297875b747c1e02e06b6a0ea32dd892d8192b9ce0813ea6"
+dependencies = [
+ "generic-array",
+ "subtle",
+]
+
+[[package]]
+name = "ctutils"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+dependencies = [
+ "cmov",
+]
+
+[[package]]
+name = "darling"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0"
+dependencies = [
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "data-encoding"
+version = "2.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
+
+[[package]]
+name = "der-parser"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07da5016415d5a3c4dd39b11ed26f915f52fc4e0dc197d87908bc916e51bc1a6"
+dependencies = [
+ "asn1-rs",
+ "displaydoc",
+ "nom",
+ "num-bigint",
+ "num-traits",
+ "rusticata-macros",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+dependencies = [
+ "powerfmt",
+ "serde_core",
+]
+
+[[package]]
+name = "digest"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3dd60d1080a57a05ab032377049e0591415d2b31afd7028356dbf3cc6dcb066"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer 0.10.4",
+ "crypto-common 0.1.6",
+]
+
+[[package]]
+name = "digest"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
+dependencies = [
+ "block-buffer 0.12.0",
+ "crypto-common 0.2.2",
+ "ctutils",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "docker_credential"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29547a1dc60885a552306986316bc9701ba120c1a8db6769fa68691529ad373d"
+dependencies = [
+ "base64",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "dotenvy"
+version = "0.15.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
+
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
+[[package]]
+name = "dyn-clone"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
+
+[[package]]
+name = "either"
+version = "1.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "etcetera"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de48cc4d1c1d97a20fd819def54b890cadde72ed3ad0c614822a0a433361be96"
+dependencies = [
+ "cfg-if",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "event-listener"
+version = "5.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab"
+dependencies = [
+ "concurrent-queue",
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "event-listener-strategy"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93"
+dependencies = [
+ "event-listener",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
+
+[[package]]
+name = "ferroid"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee93edf3c501f0035bbeffeccfed0b79e14c311f12195ec0e661e114a0f60da4"
+dependencies = [
+ "portable-atomic",
+ "rand 0.10.1",
+ "web-time",
+]
+
+[[package]]
+name = "filetime"
+version = "0.2.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c287a33c7f0a620c38e641e7f60827713987b3c0f26e8ddc9462cc69cf75759"
+dependencies = [
+ "cfg-if",
+ "libc",
+]
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "flume"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e139bc46ca777eb5efaf62df0ab8cc5fd400866427e56c68b22e414e53bd3be"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+ "spin",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
+[[package]]
+name = "futures"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-intrusive"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d930c203dd0b6ff06e0201a4a2fe9149b43c684fd4420555b26d21b1a02956f"
+dependencies = [
+ "futures-core",
+ "lock_api",
+ "parking_lot",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+
+[[package]]
+name = "futures-task"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+
+[[package]]
+name = "futures-util"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4bb6743198531e02858aeaea5398fcc883e71851fcbcb5a2f773e2fb6cb1edf2"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+ "rand_core 0.10.1",
+ "wasip2",
+ "wasip3",
+]
+
+[[package]]
+name = "globset"
+version = "0.4.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52dfc19153a48bde0cbd630453615c8151bce3a5adfac7a0aebfbf0a1e1f57e3"
+dependencies = [
+ "aho-corasick",
+ "bstr",
+ "log",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "h2"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "171fefbc92fe4a4de27e0698d6a5b392d6a0e333506bc49133760b3bcf948733"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap 2.14.0",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "foldhash 0.1.5",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash 0.2.0",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
+[[package]]
+name = "hashify"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd1246c0e5493286aeb2dde35b1f4eb9c4ce00e628641210a5e553fc001a1f26"
+dependencies = [
+ "indexmap 2.14.0",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "hashlink"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea0b22561a9c04a7cb1a302c013e0259cd3b4bb619f145b32f72b8b4bcbed230"
+dependencies = [
+ "hashbrown 0.16.1",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hermit-abi"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hkdf"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4aaa26c720c68b866f2c96ef5c1264b3e6f473fe5d4ce61cd44bbe913e553018"
+dependencies = [
+ "hmac 0.13.0",
+]
+
+[[package]]
+name = "hmac"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1441c6b1e930e2817404b5046f1f989899143a12bf92de603b69f4e0aee1e15"
+dependencies = [
+ "crypto-mac",
+ "digest 0.9.0",
+]
+
+[[package]]
+name = "hmac"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
+dependencies = [
+ "digest 0.11.3",
+]
+
+[[package]]
+name = "home"
+version = "0.5.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "http"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8be7462df143984c4598a256ef469b251d7d7f9e271135073e78fc535414f3d0"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "hybrid-array"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9155a582abd142abc056962c29e3ce5ff2ad5469f4246b537ed42c5deba857da"
+dependencies = [
+ "typenum",
+]
+
+[[package]]
+name = "hyper"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55281c53a1894c864990125767da440a4e630446785086f52523b20033b74498"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-named-pipe"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73b7d8abf35697b81a825e386fc151e0d503e8cb5fcb93cc8669c376dfd6f278"
+dependencies = [
+ "hex",
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+ "winapi",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-timeout"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
+dependencies = [
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "base64",
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "hyperlocal"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "986c5ce3b994526b3cd75578e62554abd09f0899d6206de48b3e96ab34ccc8c7"
+dependencies = [
+ "hex",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+
+[[package]]
+name = "icu_properties"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+
+[[package]]
+name = "icu_provider"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown 0.12.3",
+ "serde",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.1",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+
+[[package]]
+name = "itertools"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "jmap-client"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3357aac1ef357587e09f44262f351f7773120fb695e281b34628ef9d84028038"
+dependencies = [
+ "ahash",
+ "async-stream",
+ "base64",
+ "chrono",
+ "futures-util",
+ "maybe-async",
+ "parking_lot",
+ "reqwest",
+ "rustls",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "tokio",
+ "tokio-tungstenite",
+]
+
+[[package]]
+name = "jni"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
+dependencies = [
+ "cfg-if",
+ "combine",
+ "jni-macros",
+ "jni-sys",
+ "log",
+ "simd_cesu8",
+ "thiserror",
+ "walkdir",
+ "windows-link",
+]
+
+[[package]]
+name = "jni-macros"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "simd_cesu8",
+ "syn",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
+dependencies = [
+ "jni-sys-macros",
+]
+
+[[package]]
+name = "jni-sys-macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
+dependencies = [
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "jobserver"
+version = "0.1.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33"
+dependencies = [
+ "getrandom 0.3.4",
+ "libc",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.99"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "142bc4740e452c1e57ade0cbc129f139c9093e354346f0872ef985f4f5cf5f11"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "once_cell",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
+[[package]]
+name = "leb128fmt"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
+[[package]]
+name = "libc"
+version = "0.2.186"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+
+[[package]]
+name = "libsqlite3-sys"
+version = "0.37.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f111c8c41e7c61a49cd34e44c7619462967221a6443b0ec299e0ac30cfb9b1"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "litemap"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "113b30b4cd05f7c06868fdb2854f66a7b9fece9a48425351cd532e810d74024f"
+
+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
+[[package]]
+name = "mail-parser"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8a2420e9ce11c2b0583ca97ddff7ab2398c8a613154e9b72e3bafdbf767f1d7"
+dependencies = [
+ "hashify",
+]
+
+[[package]]
+name = "matchers"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+dependencies = [
+ "regex-automata",
+]
+
+[[package]]
+name = "matchit"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
+
+[[package]]
+name = "maybe-async"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "746873a384ad60adc5db74471dfaba74bd278afbdcfd81db93fafcdfc8b5ca0c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "md-5"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5a279bb9607f9f53c22d496eade00d138d1bdcccd07d74650387cf94942a15"
+dependencies = [
+ "block-buffer 0.9.0",
+ "digest 0.9.0",
+ "opaque-debug",
+]
+
+[[package]]
+name = "md-5"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69b6441f590336821bb897fb28fc622898ccceb1d6cea3fde5ea86b090c4de98"
+dependencies = [
+ "cfg-if",
+ "digest 0.11.3",
+]
+
+[[package]]
+name = "memchr"
+version = "2.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b947ae49db0d222b1dbc6b113ce7248a3fc3a6ca21b696717bfc000ba4484d8"
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "mio"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02bd0af71c67b473010cbbc60715ee815645a4dc942899111f494b4b737d6fda"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "mockito"
+version = "1.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90820618712cab19cfc46b274c6c22546a82affcb3c3bdf0f29e3db8e1bb92c0"
+dependencies = [
+ "assert-json-diff",
+ "bytes",
+ "colored",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "log",
+ "pin-project-lite",
+ "rand 0.9.4",
+ "regex",
+ "serde_json",
+ "serde_urlencoded",
+ "similar",
+ "tokio",
+]
+
+[[package]]
+name = "moka"
+version = "0.12.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "957228ad12042ee839f93c8f257b62b4c0ab5eaae1d4fa60de53b27c9d7c5046"
+dependencies = [
+ "async-lock",
+ "crossbeam-channel",
+ "crossbeam-epoch",
+ "crossbeam-utils",
+ "equivalent",
+ "event-listener",
+ "futures-util",
+ "parking_lot",
+ "portable-atomic",
+ "smallvec",
+ "tagptr",
+ "uuid",
+]
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "nu-ansi-term"
+version = "0.50.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "num"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35bd024e8b2ff75562e5f34e7f4905839deb4b22955ef5e73d2fea1b9813cb23"
+dependencies = [
+ "num-bigint",
+ "num-complex",
+ "num-integer",
+ "num-iter",
+ "num-rational",
+ "num-traits",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-complex"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73f88a1307638156682bada9d7604135552957b7818057dcef22705b4d509495"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-iter"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-rational"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824"
+dependencies = [
+ "num-bigint",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91df4bbde75afed763b708b7eee1e8e7651e02d97f6d5dd763e89367e957b23b"
+dependencies = [
+ "hermit-abi",
+ "libc",
+]
+
+[[package]]
+name = "oid-registry"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f40cff3dde1b6087cc5d5f5d4d65712f34016a03ed60e9c08dcc392736b5b7"
+dependencies = [
+ "asn1-rs",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "opaque-debug"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
+
+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
+[[package]]
+name = "parking"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "parse-display"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "914a1c2265c98e2446911282c6ac86d8524f495792c38c5bd884f80499c7538a"
+dependencies = [
+ "parse-display-derive",
+ "regex",
+ "regex-syntax",
+]
+
+[[package]]
+name = "parse-display-derive"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ae7800a4c974efd12df917266338e79a7a74415173caf7e70aa0a0707345281"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "regex",
+ "regex-syntax",
+ "structmeta",
+ "syn",
+]
+
+[[package]]
+name = "pem"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"
+dependencies = [
+ "base64",
+ "serde_core",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pin-project"
+version = "1.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2466b2336ed02bcdca6b294417127b90ec92038d1d5c4fbeac971a922e0e0924"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c96395f0a926bc13b1c17622aaddda1ecb55d49c8f1bf9777e4d877800a43f8b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+
+[[package]]
+name = "portable-atomic"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+
+[[package]]
+name = "potential_utf"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "prost"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2ea70524a2f82d518bce41317d0fae74151505651af45faf1ffbd6fd33f0568"
+dependencies = [
+ "bytes",
+ "prost-derive",
+]
+
+[[package]]
+name = "prost-derive"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27c6023962132f4b30eb4c172c91ce92d933da334c59c23cddee82358ddafb0b"
+dependencies = [
+ "anyhow",
+ "itertools",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "prost-types"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8991c4cbdb8bc5b11f0b074ffe286c30e523de90fee5ba8132f1399f23cb3dd7"
+dependencies = [
+ "prost",
+]
+
+[[package]]
+name = "proxy"
+version = "1.0.0"
+dependencies = [
+ "ahash",
+ "arc-swap",
+ "aws-lc-rs",
+ "base64",
+ "futures-util",
+ "globset",
+ "jmap-client",
+ "mail-parser",
+ "mockito",
+ "moka",
+ "num_cpus",
+ "parking_lot",
+ "percent-encoding",
+ "proxy-header",
+ "pwhash",
+ "rcgen",
+ "redis",
+ "regex",
+ "rustls",
+ "rustls-pemfile",
+ "rustls-pki-types",
+ "rustls-platform-verifier",
+ "serde",
+ "serde_json",
+ "smtp-proto",
+ "sqlx",
+ "tempfile",
+ "testcontainers",
+ "testcontainers-modules",
+ "thiserror",
+ "tokio",
+ "tokio-rustls",
+ "toml",
+ "tracing",
+ "tracing-subscriber",
+ "x509-parser",
+]
+
+[[package]]
+name = "proxy-header"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc1493f63ddddfba840c3169e997c2905d09538ace72d64e84af6324c6e0e065"
+dependencies = [
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "pwhash"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "419a3ad8fa9f9d445e69d9b185a24878ae6e6f55c96e4512f4a0e28cd3bc5c56"
+dependencies = [
+ "blowfish",
+ "byteorder",
+ "hmac 0.10.1",
+ "md-5 0.9.1",
+ "rand 0.8.6",
+ "sha-1",
+ "sha2 0.9.9",
+]
+
+[[package]]
+name = "quinn"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2",
+ "thiserror",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
+dependencies = [
+ "aws-lc-rs",
+ "bytes",
+ "getrandom 0.3.4",
+ "lru-slab",
+ "rand 0.9.4",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
+dependencies = [
+ "libc",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.2",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.17",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
+[[package]]
+name = "rcgen"
+version = "0.14.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57f6d249aad744e274e682777a50283a225a32705394ee6d5fcc01efa25e4055"
+dependencies = [
+ "pem",
+ "ring",
+ "rustls-pki-types",
+ "time",
+ "x509-parser",
+ "yasna",
+]
+
+[[package]]
+name = "redis"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a12e6b5f4d8ef33944e833e2b1859ad478deab6e431d7337b30ee2efe21f7543"
+dependencies = [
+ "arc-swap",
+ "arcstr",
+ "async-lock",
+ "backon",
+ "bytes",
+ "cfg-if",
+ "combine",
+ "futures-channel",
+ "futures-util",
+ "itoa",
+ "num-bigint",
+ "percent-encoding",
+ "pin-project-lite",
+ "ryu",
+ "sha1_smol",
+ "socket2",
+ "tokio",
+ "tokio-util",
+ "url",
+ "xxhash-rust",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "ref-cast"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "regex"
+version = "1.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
+
+[[package]]
+name = "reqwest"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
+dependencies = [
+ "base64",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
+ "rustls-platform-verifier",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tokio-util",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wasm-streams",
+ "web-sys",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted 0.9.0",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rusticata-macros"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
+dependencies = [
+ "nom",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
+dependencies = [
+ "aws-lc-rs",
+ "log",
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9"
+dependencies = [
+ "web-time",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-platform-verifier"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
+dependencies = [
+ "core-foundation",
+ "core-foundation-sys",
+ "jni",
+ "log",
+ "once_cell",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-platform-verifier-android",
+ "rustls-webpki",
+ "security-framework",
+ "security-framework-sys",
+ "webpki-root-certs",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls-platform-verifier-android"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+dependencies = [
+ "aws-lc-rs",
+ "ring",
+ "rustls-pki-types",
+ "untrusted 0.9.0",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "schannel"
+version = "0.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "schemars"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cd191f9397d57d581cddd31014772520aa448f65ef991055d7f61582c65165f"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemars"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "security-framework"
+version = "3.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
+dependencies = [
+ "bitflags",
+ "core-foundation",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.150"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_repr"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_with"
+version = "3.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e72c1c2cb7b223fafb600a619537a871c2818583d619401b785e7c0b746ccde2"
+dependencies = [
+ "base64",
+ "bs58",
+ "chrono",
+ "hex",
+ "indexmap 1.9.3",
+ "indexmap 2.14.0",
+ "schemars 0.9.0",
+ "schemars 1.2.1",
+ "serde_core",
+ "serde_json",
+ "serde_with_macros",
+ "time",
+]
+
+[[package]]
+name = "serde_with_macros"
+version = "3.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b90c488738ecb4fb0262f41f43bc40efc5868d9fb744319ddf5f5317f417bfac"
+dependencies = [
+ "darling",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "sha-1"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "99cd6713db3cf16b6c84e06321e049a9b9f699826e16096d23bbcc44d15d51a6"
+dependencies = [
+ "block-buffer 0.9.0",
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest 0.9.0",
+ "opaque-debug",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "sha1"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "digest 0.11.3",
+]
+
+[[package]]
+name = "sha1_smol"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbfa15b3dddfee50a0fff136974b3e1bde555604ba463834a7eb7deb6417705d"
+
+[[package]]
+name = "sha2"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d58a1e1bf39749807d89cf2d98ac2dfa0ff1cb3faa38fbb64dd88ac8013d800"
+dependencies = [
+ "block-buffer 0.9.0",
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest 0.9.0",
+ "opaque-debug",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "sha2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "digest 0.11.3",
+]
+
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "simd_cesu8"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94f90157bb87cddf702797c5dadfa0be7d266cdf49e22da2fcaa32eff75b2c33"
+dependencies = [
+ "rustc_version",
+ "simdutf8",
+]
+
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
+
+[[package]]
+name = "similar"
+version = "2.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbbb5d9659141646ae647b42fe094daf6c6192d1620870b449d9557f748b2daa"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "smtp-proto"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97c9f5dd7ec5cc6d743f33fcb96de4eb91bb1cc51c5e0ba40cb285a9012043da"
+
+[[package]]
+name = "socket2"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "spin"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+dependencies = [
+ "lock_api",
+]
+
+[[package]]
+name = "sqlx"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "378620ccc25c62c89d8be1c819e76a88d59bdcc3304733330788948e619bfd71"
+dependencies = [
+ "sqlx-core",
+ "sqlx-macros",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+]
+
+[[package]]
+name = "sqlx-core"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05b44e85bf579a8eeb4ceaa77a3a523baf2bf0e9bac7e40f405d537b5d2d5ccb"
+dependencies = [
+ "base64",
+ "bytes",
+ "cfg-if",
+ "crc",
+ "crossbeam-queue",
+ "either",
+ "event-listener",
+ "futures-core",
+ "futures-intrusive",
+ "futures-io",
+ "futures-util",
+ "hashbrown 0.16.1",
+ "hashlink",
+ "indexmap 2.14.0",
+ "log",
+ "memchr",
+ "percent-encoding",
+ "rustls",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "smallvec",
+ "thiserror",
+ "tokio",
+ "tokio-stream",
+ "tracing",
+ "url",
+ "webpki-roots",
+]
+
+[[package]]
+name = "sqlx-macros"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd2b84f2bc39a5705ef27ec785a11c934a41bbd4a24941e257927cddc26b60bf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "sqlx-core",
+ "sqlx-macros-core",
+ "syn",
+]
+
+[[package]]
+name = "sqlx-macros-core"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb8d96de5fdc85a5c4ec813432b523ec637e80ba98f046555f75f7908ddac7c3"
+dependencies = [
+ "cfg-if",
+ "dotenvy",
+ "either",
+ "heck",
+ "hex",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "sqlx-core",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+ "syn",
+ "tokio",
+ "url",
+]
+
+[[package]]
+name = "sqlx-mysql"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90b8020fe17c5f2c245bfa2505d7ef59c5604839527c740266ad2214acebea27"
+dependencies = [
+ "bitflags",
+ "byteorder",
+ "bytes",
+ "crc",
+ "digest 0.11.3",
+ "dotenvy",
+ "either",
+ "futures-core",
+ "futures-util",
+ "generic-array",
+ "log",
+ "percent-encoding",
+ "serde",
+ "sha1 0.11.0",
+ "sha2 0.11.0",
+ "sqlx-core",
+ "thiserror",
+ "tracing",
+]
+
+[[package]]
+name = "sqlx-postgres"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87a2bdd6e83f6b3ea525ca9fee568030508b58355a43d0b2c1674d5f79dcd65e"
+dependencies = [
+ "atoi",
+ "base64",
+ "bitflags",
+ "byteorder",
+ "crc",
+ "dotenvy",
+ "etcetera",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "hex",
+ "hkdf",
+ "hmac 0.13.0",
+ "itoa",
+ "log",
+ "md-5 0.11.0",
+ "memchr",
+ "rand 0.10.1",
+ "serde",
+ "serde_json",
+ "sha2 0.11.0",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror",
+ "tracing",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-sqlite"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488e99c397a62007e4229aec669a179816339afc6d2620ca6fa420dbee2e982c"
+dependencies = [
+ "atoi",
+ "flume",
+ "form_urlencoded",
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-intrusive",
+ "futures-util",
+ "libsqlite3-sys",
+ "log",
+ "percent-encoding",
+ "serde",
+ "sqlx-core",
+ "thiserror",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "stringprep"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b4df3d392d81bd458a8a621b8bffbd2302a12ffe288a9d931670948749463b1"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+ "unicode-properties",
+]
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "structmeta"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e1575d8d40908d70f6fd05537266b90ae71b15dbbe7a8b7dffa2b759306d329"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "structmeta-derive",
+ "syn",
+]
+
+[[package]]
+name = "structmeta-derive"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "152a0b65a590ff6c3da95cabe2353ee04e6167c896b28e3b14478c2636c922fc"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tagptr"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b2093cf4c8eb1e67749a6762251bc9cd836b6fc171623bd0a9d324d37af2417"
+
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.2",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "testcontainers"
+version = "0.27.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfd5785b5483672915ed5fe3cddf9f546802779fc1eceff0a6fb7321fac81c1e"
+dependencies = [
+ "astral-tokio-tar",
+ "async-trait",
+ "bollard",
+ "bytes",
+ "docker_credential",
+ "either",
+ "etcetera",
+ "ferroid",
+ "futures",
+ "http",
+ "itertools",
+ "log",
+ "memchr",
+ "parse-display",
+ "pin-project-lite",
+ "serde",
+ "serde_json",
+ "serde_with",
+ "thiserror",
+ "tokio",
+ "tokio-stream",
+ "tokio-util",
+ "url",
+]
+
+[[package]]
+name = "testcontainers-modules"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5985fde5befe4ffa77a052e035e16c2da86e8bae301baa9f9904ad3c494d357"
+dependencies = [
+ "testcontainers",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "time"
+version = "0.3.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
+dependencies = [
+ "deranged",
+ "itoa",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
+
+[[package]]
+name = "time-macros"
+version = "0.2.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.52.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "parking_lot",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-stream"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32da49809aab5c3bc678af03902d4ccddea2a87d028d86392a4b1560c6906c70"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-tungstenite"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f72a05e828585856dacd553fba484c242c46e391fb0e58917c942ee9202915c"
+dependencies = [
+ "futures-util",
+ "log",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tungstenite",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "toml"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81f3d15e84cbcd896376e6730314d59fb5a87f31e4b038454184435cd57defee"
+dependencies = [
+ "indexmap 2.14.0",
+ "serde_core",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_parser",
+ "toml_writer",
+ "winnow",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "1.1.1+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
+dependencies = [
+ "winnow",
+]
+
+[[package]]
+name = "toml_writer"
+version = "1.1.1+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "756daf9b1013ebe47a8776667b466417e2d4c5679d441c26230efd9ef78692db"
+
+[[package]]
+name = "tonic"
+version = "0.14.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac2a5518c70fa84342385732db33fb3f44bc4cc748936eb5833d2df34d6445ef"
+dependencies = [
+ "async-trait",
+ "axum",
+ "base64",
+ "bytes",
+ "h2",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-timeout",
+ "hyper-util",
+ "percent-encoding",
+ "pin-project",
+ "socket2",
+ "sync_wrapper",
+ "tokio",
+ "tokio-stream",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tonic-prost"
+version = "0.14.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50849f68853be452acf590cde0b146665b8d507b3b8af17261df47e02c209ea0"
+dependencies = [
+ "bytes",
+ "prost",
+ "tonic",
+]
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "indexmap 2.14.0",
+ "pin-project-lite",
+ "slab",
+ "sync_wrapper",
+ "tokio",
+ "tokio-util",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
+dependencies = [
+ "bitflags",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "pin-project-lite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "url",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "log",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
+dependencies = [
+ "matchers",
+ "nu-ansi-term",
+ "once_cell",
+ "regex-automata",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "tungstenite"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c01152af293afb9c7c2a57e4b559c5620b421f6d133261c60dd2d0cdb38e6b8"
+dependencies = [
+ "bytes",
+ "data-encoding",
+ "http",
+ "httparse",
+ "log",
+ "rand 0.9.4",
+ "rustls",
+ "rustls-pki-types",
+ "sha1 0.10.6",
+ "thiserror",
+]
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-properties"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
+[[package]]
+name = "untrusted"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "ureq"
+version = "3.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dea7109cdcd5864d4eeb1b58a1648dc9bf520360d7af16ec26d0a9354bafcfc0"
+dependencies = [
+ "base64",
+ "log",
+ "percent-encoding",
+ "rustls",
+ "rustls-pki-types",
+ "ureq-proto",
+ "utf8-zero",
+]
+
+[[package]]
+name = "ureq-proto"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e994ba84b0bd1b1b0cf92878b7ef898a5c1760108fe7b6010327e274917a808c"
+dependencies = [
+ "base64",
+ "http",
+ "httparse",
+ "log",
+]
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+ "serde_derive",
+]
+
+[[package]]
+name = "utf8-zero"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8c0a043c9540bae7c578c88f91dda8bd82e59ae27c21baca69c8b191aaf5a6e"
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "uuid"
+version = "1.23.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d258b83ceec21034727ecee8c382cfa6c3e133699b0742c64571814fb420c9f7"
+dependencies = [
+ "getrandom 0.4.2",
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "valuable"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.3+wasi-0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20064672db26d7cdc89c7798c48a0fdfac8213434a1186e5ef29fd560ae223d6"
+dependencies = [
+ "wit-bindgen 0.57.1",
+]
+
+[[package]]
+name = "wasip3"
+version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
+dependencies = [
+ "wit-bindgen 0.51.0",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.122"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ed04576f974d2b2fba0f38c51dbc5518011e38c36bf1143164be765528fd409"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.72"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9473dbd2991ae90b6291c3c32c30c6187ac49aa32f9905d1cce280ec1e110b0f"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.122"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "916151b09da36bd82f6615cbf3a419e2f0ba23a03c6160e8e92eb6bd4aa1dec6"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.122"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "299047362ccbfce148b67ab7e73349f77748e00c8296f9542adfad2ad82c5c5e"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.122"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a929b2c61f11ba3e9bc35b50c1f25cb38e0e892c0c231ae2b8cf78d5dad4437"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "wasm-encoder"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
+dependencies = [
+ "anyhow",
+ "indexmap 2.14.0",
+ "wasm-encoder",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-streams"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1ec4f6517c9e11ae630e200b2b65d193279042e28edd4a2cda233e46670bbb"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+dependencies = [
+ "bitflags",
+ "hashbrown 0.15.5",
+ "indexmap 2.14.0",
+ "semver",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.99"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d621441cfc37b84979402712047321980c178f299193a3589d05b99e8763436"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki-root-certs"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31141ce3fc3e300ae89b78c0dd67f9708061d1d2eda54b8209346fd6be9a92c"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52f5ee44c96cf55f1b349600768e3ece3a8f26010c05265ab73f945bb1a2eb9d"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "whoami"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "998767ef88740d1f5b0682a9c53c24431453923962269c2db68ee43788c5a40d"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "winnow"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0592e1c9d151f854e6fd382574c3a0855250e1d9b2f99d9281c6e6391af352f1"
+
+[[package]]
+name = "wit-bindgen"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+dependencies = [
+ "wit-bindgen-rust-macro",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
+dependencies = [
+ "anyhow",
+ "heck",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+dependencies = [
+ "anyhow",
+ "heck",
+ "indexmap 2.14.0",
+ "prettyplease",
+ "syn",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "indexmap 2.14.0",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap 2.14.0",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser",
+]
+
+[[package]]
+name = "writeable"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+
+[[package]]
+name = "x509-parser"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d43b0f71ce057da06bc0851b23ee24f3f86190b07203dd8f567d0b706a185202"
+dependencies = [
+ "asn1-rs",
+ "data-encoding",
+ "der-parser",
+ "lazy_static",
+ "nom",
+ "oid-registry",
+ "ring",
+ "rusticata-macros",
+ "thiserror",
+ "time",
+]
+
+[[package]]
+name = "xattr"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
+dependencies = [
+ "libc",
+ "rustix",
+]
+
+[[package]]
+name = "xxhash-rust"
+version = "0.8.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdd20c5420375476fbd4394763288da7eb0cc0b8c11deed431a91562af7335d3"
+
+[[package]]
+name = "yasna"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5f6765e852b9b4dc8e2a76843e4d64d1cea8e79bcde0b6901aea8e7c7f08282"
+dependencies = [
+ "bit-vec",
+ "time",
+]
+
+[[package]]
+name = "yoke"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.50"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b065d4f0e55f82fae73202e189638116a87c55ab6b8e6c2721e13dd9d854ad1"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.50"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b631b19d36a892ab55420c92dbc83ccd79274f25be714855d3074aa71cab639"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+
+[[package]]
+name = "zerotrie"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
diff --git a/Cargo.toml b/Cargo.toml
new file mode 100644
index 0000000..46bc42d
--- /dev/null
+++ b/Cargo.toml
@@ -0,0 +1,63 @@
+[package]
+name = "proxy"
+version = "1.0.0"
+edition = "2024"
+rust-version = "1.85"
+license = "AGPL-3.0-only OR LicenseRef-SEL"
+description = "Multi-protocol e-mail proxy"
+authors = ["Stalwart Labs LLC "]
+repository = "https://github.com/stalwartlabs/proxy"
+homepage = "https://github.com/stalwartlabs/proxy"
+readme = "README.md"
+keywords = ["mail", "proxy", "imap", "smtp", "migration"]
+categories = ["email", "network-programming"]
+
+[[bin]]
+name = "proxy"
+path = "src/main.rs"
+
+[dependencies]
+tokio = { version = "1.52", features = ["net", "io-util", "rt-multi-thread", "macros", "signal", "sync", "time"] }
+rustls = { version = "0.23", default-features = false, features = ["std", "aws_lc_rs", "tls12"] }
+tokio-rustls = { version = "0.26", default-features = false, features = ["aws_lc_rs", "tls12"] }
+rustls-pemfile = "2.2"
+rustls-pki-types = "1.14"
+aws-lc-rs = "1.17"
+proxy-header = { version = "0.1.2", features = ["tokio"] }
+smtp-proto = "0.2.1"
+mail-parser = "0.11"
+base64 = "0.22"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+toml = "1"
+globset = "0.4"
+regex = "1.12"
+redis = { version = "1.2", features = ["tokio-comp", "aio", "connection-manager"] }
+sqlx = { version = "0.9", default-features = false, features = ["runtime-tokio", "tls-rustls-aws-lc-rs", "any", "postgres", "mysql", "sqlite"] }
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+moka = { version = "0.12", features = ["future", "sync"] }
+arc-swap = "1"
+parking_lot = "0.12"
+ahash = { version = "0.8", features = ["serde"] }
+num_cpus = "1.17"
+thiserror = "2"
+percent-encoding = "2.3"
+rcgen = "0.14"
+x509-parser = "0.18"
+rustls-platform-verifier = "0.7"
+
+[dev-dependencies]
+tempfile = "3"
+mockito = "1.7"
+testcontainers = "0.27"
+testcontainers-modules = { version = "0.15", features = ["redis", "postgres"] }
+pwhash = "1"
+jmap-client = { version = "0.4", default-features = false, features = ["websockets", "async", "aws_lc_rs"] }
+futures-util = "0.3"
+
+[profile.release]
+opt-level = 3
+lto = "thin"
+codegen-units = 1
+panic = "abort"
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..3f9ca23
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,46 @@
+FROM --platform=$BUILDPLATFORM docker.io/lukemathwalker/cargo-chef:latest-rust-slim-trixie AS chef
+WORKDIR /build
+
+FROM --platform=$BUILDPLATFORM chef AS planner
+COPY . .
+RUN cargo chef prepare --recipe-path /recipe.json
+
+FROM --platform=$BUILDPLATFORM chef AS builder
+ARG TARGETPLATFORM
+RUN case "${TARGETPLATFORM}" in \
+ "linux/arm64") echo "aarch64-unknown-linux-gnu" > /target.txt && echo "-C linker=aarch64-linux-gnu-gcc" > /flags.txt ;; \
+ "linux/amd64") echo "x86_64-unknown-linux-gnu" > /target.txt && echo "-C linker=x86_64-linux-gnu-gcc" > /flags.txt ;; \
+ *) exit 1 ;; \
+ esac
+RUN export DEBIAN_FRONTEND=noninteractive && \
+ apt-get update && \
+ apt-get install -yq --no-install-recommends build-essential cmake libclang-19-dev \
+ g++-aarch64-linux-gnu binutils-aarch64-linux-gnu \
+ g++-x86-64-linux-gnu binutils-x86-64-linux-gnu
+RUN rustup target add "$(cat /target.txt)"
+COPY --from=planner /recipe.json /recipe.json
+RUN RUSTFLAGS="$(cat /flags.txt)" cargo chef cook --target "$(cat /target.txt)" --release -p proxy --recipe-path /recipe.json
+COPY . .
+RUN RUSTFLAGS="$(cat /flags.txt)" cargo build --target "$(cat /target.txt)" --release -p proxy
+RUN mv "/build/target/$(cat /target.txt)/release" "/output"
+
+FROM docker.io/debian:trixie-slim
+RUN export DEBIAN_FRONTEND=noninteractive && \
+ apt-get update && \
+ apt-get install -yq --no-install-recommends ca-certificates curl libcap2-bin && \
+ rm -rf /var/lib/apt/lists/* && \
+ groupadd -r -g 2000 stalwart-proxy && \
+ useradd -r -u 2000 -g 2000 -s /usr/sbin/nologin -M stalwart-proxy && \
+ mkdir -p /etc/proxy && \
+ chown stalwart-proxy:stalwart-proxy /etc/proxy
+COPY --from=builder --chmod=0755 /output/proxy /usr/local/bin/proxy
+RUN setcap 'cap_net_bind_service=+ep' /usr/local/bin/proxy
+USER stalwart-proxy
+WORKDIR /etc/proxy
+VOLUME ["/etc/proxy"]
+EXPOSE 24 25 110 143 465 587 993 995 4190 443 9443
+ENV PROXY_HEALTHCHECK_URL=https://127.0.0.1:9443/healthz
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+ CMD curl -fsSk "$PROXY_HEALTHCHECK_URL" || exit 1
+ENTRYPOINT ["/usr/local/bin/proxy"]
+CMD ["/etc/proxy/config.toml"]
diff --git a/Dockerfile.build b/Dockerfile.build
new file mode 100644
index 0000000..5a9acfe
--- /dev/null
+++ b/Dockerfile.build
@@ -0,0 +1,140 @@
+# syntax=docker/dockerfile:1
+# check=skip=FromPlatformFlagConstDisallowed,RedundantTargetPlatform
+
+# *****************
+# Base image for planner & builder
+# *****************
+FROM --platform=$BUILDPLATFORM rust:slim-trixie AS base
+
+ENV DEBIAN_FRONTEND="noninteractive" \
+ BINSTALL_DISABLE_TELEMETRY=true \
+ CARGO_TERM_COLOR=always \
+ LANG=C.UTF-8 \
+ TZ=UTC \
+ TERM=xterm-256color \
+ AWS_LC_SYS_PREBUILT_NASM=1
+# With zig, we only need libclang and make. ca-certificates is required for curl
+# to verify HTTPS downloads (zig tarballs, crates.io, etc).
+RUN \
+ --mount=type=cache,target=/var/cache/apt,sharing=locked \
+ --mount=type=cache,target=/var/lib/apt,sharing=locked \
+ rm -f /etc/apt/apt.conf.d/docker-clean && \
+ echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' >/etc/apt/apt.conf.d/keep-cache && \
+ apt-get update && \
+ apt-get install -yq --no-install-recommends ca-certificates curl jq xz-utils make libclang-19-dev
+# Zig is pinned to 0.13.0. Zig 0.14+ changed how its default target ABI is
+# resolved for `x86_64-linux-gnu`-style triples, and on this dependency tree
+# (aws-lc-sys, libsqlite3-sys, rust-std 1.87+) that surfaces as ld.lld
+# undefined references to glibc 2.33+ symbols. Zig 0.13 produces binaries with
+# a max glibc ref of ~2.28 which stays compatible with Debian 11 / RHEL 8.
+RUN \
+ ZIG_VERSION=0.13.0 && \
+ curl --retry 5 -fsSL "https://ziglang.org/download/${ZIG_VERSION}/zig-linux-$(uname -m)-${ZIG_VERSION}.tar.xz" | tar -J -x -C /usr/local && \
+ ln -s "/usr/local/zig-linux-$(uname -m)-${ZIG_VERSION}/zig" /usr/local/bin/zig && \
+ zig version
+# Install cargo-binstall
+RUN curl --retry 5 -fL --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
+# Install cargo-chef & sccache & cargo-zigbuild
+RUN cargo binstall --no-confirm cargo-chef sccache cargo-zigbuild
+
+# *****************
+# Planner
+# *****************
+FROM base AS planner
+WORKDIR /app
+COPY . .
+# Generate recipe file
+RUN cargo chef prepare --recipe-path recipe.json
+
+# *****************
+# Builder
+# *****************
+FROM base AS builder
+WORKDIR /app
+COPY --from=planner /app/recipe.json recipe.json
+ARG TARGET
+ARG BUILD_ENV
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+# Install toolchain and specify some env variables
+RUN \
+ rustup set profile minimal && \
+ rustup target add ${TARGET} && \
+ mkdir -p artifact && \
+ touch /env-cargo && \
+ if [ ! -z "${BUILD_ENV}" ]; then \
+ echo "export ${BUILD_ENV}" >> /env-cargo; \
+ echo "Setting up ${BUILD_ENV}"; \
+ fi
+# Cargo-chef cache layer
+RUN \
+ --mount=type=secret,id=ACTIONS_RESULTS_URL,env=ACTIONS_RESULTS_URL \
+ --mount=type=secret,id=ACTIONS_RUNTIME_TOKEN,env=ACTIONS_RUNTIME_TOKEN \
+ --mount=type=cache,target=/usr/local/cargo/registry \
+ --mount=type=cache,target=/usr/local/cargo/git \
+ source /env-cargo && \
+ cargo chef cook --recipe-path recipe.json --zigbuild --release --target ${TARGET} -p proxy
+# Copy the source code
+COPY . .
+ENV RUSTC_WRAPPER="sccache" \
+ SCCACHE_GHA_ENABLED=true
+# Build
+RUN \
+ --mount=type=secret,id=ACTIONS_RESULTS_URL,env=ACTIONS_RESULTS_URL \
+ --mount=type=secret,id=ACTIONS_RUNTIME_TOKEN,env=ACTIONS_RUNTIME_TOKEN \
+ --mount=type=cache,target=/usr/local/cargo/registry \
+ --mount=type=cache,target=/usr/local/cargo/git \
+ source /env-cargo && \
+ cargo zigbuild --release --target ${TARGET} -p proxy && \
+ mv /app/target/${TARGET}/release/proxy /app/artifact/proxy
+
+# *****************
+# Binary stage
+# *****************
+FROM scratch AS binaries
+COPY --from=builder /app/artifact /
+
+# *****************
+# Runtime image for GNU targets
+# *****************
+FROM --platform=$TARGETPLATFORM docker.io/library/debian:trixie-slim AS gnu
+RUN export DEBIAN_FRONTEND=noninteractive && \
+ apt-get update && \
+ apt-get install -yq --no-install-recommends ca-certificates curl tzdata libcap2-bin && \
+ rm -rf /var/lib/apt/lists/* && \
+ groupadd -r -g 2000 stalwart-proxy && \
+ useradd -r -u 2000 -g 2000 -s /usr/sbin/nologin -M stalwart-proxy && \
+ mkdir -p /etc/proxy && \
+ chown stalwart-proxy:stalwart-proxy /etc/proxy
+COPY --from=builder --chmod=0755 /app/artifact/proxy /usr/local/bin/proxy
+RUN setcap 'cap_net_bind_service=+ep' /usr/local/bin/proxy
+USER stalwart-proxy
+WORKDIR /etc/proxy
+VOLUME ["/etc/proxy"]
+EXPOSE 24 25 110 143 465 587 993 995 4190 443 9443
+ENV PROXY_HEALTHCHECK_URL=https://127.0.0.1:9443/healthz
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+ CMD curl -fsSk "$PROXY_HEALTHCHECK_URL" || exit 1
+ENTRYPOINT ["/usr/local/bin/proxy"]
+CMD ["/etc/proxy/config.toml"]
+
+# *****************
+# Runtime image for musl targets
+# *****************
+FROM --platform=$TARGETPLATFORM alpine AS musl
+RUN apk add --update --no-cache ca-certificates curl tzdata libcap && \
+ rm -rf /var/cache/apk/* && \
+ addgroup -S -g 2000 stalwart-proxy && \
+ adduser -S -D -H -u 2000 -G stalwart-proxy -s /sbin/nologin stalwart-proxy && \
+ mkdir -p /etc/proxy && \
+ chown stalwart-proxy:stalwart-proxy /etc/proxy
+COPY --from=builder --chmod=0755 /app/artifact/proxy /usr/local/bin/proxy
+RUN setcap 'cap_net_bind_service=+ep' /usr/local/bin/proxy
+USER stalwart-proxy
+WORKDIR /etc/proxy
+VOLUME ["/etc/proxy"]
+EXPOSE 24 25 110 143 465 587 993 995 4190 443 9443
+ENV PROXY_HEALTHCHECK_URL=https://127.0.0.1:9443/healthz
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+ CMD curl -fsSk "$PROXY_HEALTHCHECK_URL" || exit 1
+ENTRYPOINT ["/usr/local/bin/proxy"]
+CMD ["/etc/proxy/config.toml"]
diff --git a/LICENSES/AGPL-3.0-only.txt b/LICENSES/AGPL-3.0-only.txt
new file mode 100644
index 0000000..0c97efd
--- /dev/null
+++ b/LICENSES/AGPL-3.0-only.txt
@@ -0,0 +1,235 @@
+GNU AFFERO GENERAL PUBLIC LICENSE
+Version 3, 19 November 2007
+
+Copyright (C) 2007 Free Software Foundation, Inc.
+
+Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
+
+ Preamble
+
+The GNU Affero General Public License is a free, copyleft license for software and other kinds of works, specifically designed to ensure cooperation with the community in the case of network server software.
+
+The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, our General Public Licenses are intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users.
+
+When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things.
+
+Developers that use our General Public Licenses protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License which gives you legal permission to copy, distribute and/or modify the software.
+
+A secondary benefit of defending all users' freedom is that improvements made in alternate versions of the program, if they receive widespread use, become available for other developers to incorporate. Many developers of free software are heartened and encouraged by the resulting cooperation. However, in the case of software used on network servers, this result may fail to come about. The GNU General Public License permits making a modified version and letting the public access it on a server without ever releasing its source code to the public.
+
+The GNU Affero General Public License is designed specifically to ensure that, in such cases, the modified source code becomes available to the community. It requires the operator of a network server to provide the source code of the modified version running there to the users of that server. Therefore, public use of a modified version, on a publicly accessible server, gives the public access to the source code of the modified version.
+
+An older license, called the Affero General Public License and published by Affero, was designed to accomplish similar goals. This is a different license, not a version of the Affero GPL, but Affero has released a new version of the Affero GPL which permits relicensing under this license.
+
+The precise terms and conditions for copying, distribution and modification follow.
+
+ TERMS AND CONDITIONS
+
+0. Definitions.
+
+"This License" refers to version 3 of the GNU Affero General Public License.
+
+"Copyright" also means copyright-like laws that apply to other kinds of works, such as semiconductor masks.
+
+"The Program" refers to any copyrightable work licensed under this License. Each licensee is addressed as "you". "Licensees" and "recipients" may be individuals or organizations.
+
+To "modify" a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a "modified version" of the earlier work or a work "based on" the earlier work.
+
+A "covered work" means either the unmodified Program or a work based on the Program.
+
+To "propagate" a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well.
+
+To "convey" a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.
+
+An interactive user interface displays "Appropriate Legal Notices" to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion.
+
+1. Source Code.
+The "source code" for a work means the preferred form of the work for making modifications to it. "Object code" means any non-source form of a work.
+
+A "Standard Interface" means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language.
+
+The "System Libraries" of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A "Major Component", in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it.
+
+The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source.
+
+The Corresponding Source for a work in source code form is that same work.
+
+2. Basic Permissions.
+All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law.
+
+You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you.
+
+Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary.
+
+3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures.
+
+When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures.
+
+4. Conveying Verbatim Copies.
+You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program.
+
+You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee.
+
+5. Conveying Modified Source Versions.
+You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions:
+
+ a) The work must carry prominent notices stating that you modified it, and giving a relevant date.
+
+ b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to "keep intact all notices".
+
+ c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it.
+
+ d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so.
+
+A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an "aggregate" if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.
+
+6. Conveying Non-Source Forms.
+You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways:
+
+ a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange.
+
+ b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge.
+
+ c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b.
+
+ d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements.
+
+ e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d.
+
+A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work.
+
+A "User Product" is either (1) a "consumer product", which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, "normally used" refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product.
+
+"Installation Information" for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.
+
+If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM).
+
+The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network.
+
+Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying.
+
+7. Additional Terms.
+"Additional permissions" are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions.
+
+When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission.
+
+Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms:
+
+ a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or
+
+ b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or
+
+ c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or
+
+ d) Limiting the use for publicity purposes of names of licensors or authors of the material; or
+
+ e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or
+
+ f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors.
+
+All other non-permissive additional terms are considered "further restrictions" within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying.
+
+If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms.
+
+Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way.
+
+8. Termination.
+
+You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11).
+
+However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation.
+
+Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice.
+
+Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10.
+
+9. Acceptance Not Required for Having Copies.
+
+You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so.
+
+10. Automatic Licensing of Downstream Recipients.
+
+Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License.
+
+An "entity transaction" is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts.
+
+You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it.
+
+11. Patents.
+
+A "contributor" is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's "contributor version".
+
+A contributor's "essential patent claims" are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, "control" includes the right to grant patent sublicenses in a manner consistent with the requirements of this License.
+
+Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version.
+
+In the following three paragraphs, a "patent license" is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To "grant" such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party.
+
+If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent
+license to downstream recipients. "Knowingly relying" means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid.
+
+If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it.
+
+A patent license is "discriminatory" if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007.
+
+Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law.
+
+12. No Surrender of Others' Freedom.
+
+If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may
+not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program.
+
+13. Remote Network Interaction; Use with the GNU General Public License.
+
+Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software. This Corresponding Source shall include the Corresponding Source for any work covered by version 3 of the GNU General Public License that is incorporated pursuant to the following paragraph.
+
+Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the work with which it is combined will remain governed by version 3 of the GNU General Public License.
+
+14. Revised Versions of this License.
+
+The Free Software Foundation may publish revised and/or new versions of the GNU Affero General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU Affero General Public License "or any later version" applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU Affero General Public License, you may choose any version ever published by the Free Software Foundation.
+
+If the Program specifies that a proxy can decide which future versions of the GNU Affero General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program.
+
+Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version.
+
+15. Disclaimer of Warranty.
+
+THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+16. Limitation of Liability.
+
+IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+17. Interpretation of Sections 15 and 16.
+
+If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee.
+
+END OF TERMS AND CONDITIONS
+
+ How to Apply These Terms to Your New Programs
+
+If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms.
+
+To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found.
+
+
+ Copyright (C)
+
+ This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.
+
+ You should have received a copy of the GNU Affero General Public License along with this program. If not, see .
+
+Also add information on how to contact you by electronic and paper mail.
+
+If your software can interact with users remotely through a computer network, you should also make sure that it provides a way for users to get its source. For example, if your program is a web application, its interface could display a "Source" link that leads users to an archive of the code. There are many ways you could offer source, and different solutions will be better for different programs; see section 13 for the specific requirements.
+
+You should also get your employer (if you work as a programmer) or school, if any, to sign a "copyright disclaimer" for the program, if necessary. For more information on this, and how to apply and follow the GNU AGPL, see .
diff --git a/LICENSES/LicenseRef-SEL.txt b/LICENSES/LicenseRef-SEL.txt
new file mode 100644
index 0000000..1345ee1
--- /dev/null
+++ b/LICENSES/LicenseRef-SEL.txt
@@ -0,0 +1,213 @@
+# Stalwart Enterprise License 2.0 (SELv2) Agreement
+
+*Last Update: March 29, 2026*
+
+PLEASE CAREFULLY READ THIS STALWART ENTERPRISE LICENSE AGREEMENT ("AGREEMENT"). THIS AGREEMENT CONSTITUTES A LEGALLY BINDING AGREEMENT BETWEEN YOU AND STALWART LABS LLC AND GOVERNS YOUR USE OF THE SOFTWARE (DEFINED BELOW). IF YOU DO NOT AGREE WITH THIS AGREEMENT, YOU MAY NOT USE THE SOFTWARE. IF YOU ARE USING THE SOFTWARE ON BEHALF OF A LEGAL ENTITY, YOU REPRESENT AND WARRANT THAT YOU HAVE AUTHORITY TO AGREE TO THIS AGREEMENT ON BEHALF OF SUCH ENTITY. IF YOU DO NOT HAVE SUCH AUTHORITY, DO NOT USE THE SOFTWARE IN ANY MANNER.
+
+This Agreement is entered into by and between Stalwart Labs LLC and you, or the legal entity on behalf of whom you are acting.
+
+---
+
+## 1. DEFINITIONS
+
+1.1. "Software" refers to the Stalwart Server Enterprise Edition software, including all its versions, updates, modifications, accompanying documentation, and related materials. The Software is self-hosted by Licensee on its own infrastructure.
+
+1.2. "Subscription" refers to the paid access to the Software provided by Licensor to Licensee, billed on a monthly or annual basis.
+
+1.3. "Licensor" refers to Stalwart Labs LLC, the entity providing the Software.
+
+1.4. "Licensee" refers to the individual or entity installing, accessing, or using the Software with a valid Subscription.
+
+1.5. "License Key" refers to the unique code provided by Licensor upon purchasing a Subscription which activates the full features of the Software. Each License Key is bound to the domain name (including all subdomains) designated by Licensee at the time of purchase.
+
+1.6. "Source Code" refers to the human-readable version of the Software's code, as opposed to the compiled machine-readable version.
+
+1.7. "Mailbox" refers to each individual user account or group account provisioned within the Software. The total number of Mailboxes across all domains and tenants hosted by Licensee determines the applicable Subscription tier.
+
+1.8. "Confidential Information" refers to any non-public information disclosed by either party to the other in connection with this Agreement, whether in written, oral, electronic, or other form, that is designated as confidential or that a reasonable person would understand to be confidential given the nature of the information and circumstances of disclosure.
+
+## 2. GRANT OF LICENSE
+
+2.1. Licensor grants Licensee a non-exclusive, non-transferable, non-sublicensable, limited license to download, install, and use the Software during the Subscription term, subject to the terms and conditions of this Agreement.
+
+2.2. The use of the Software is conditioned upon Licensee maintaining an active and valid paid Subscription with Licensor. The paid Subscription covers all versions of the Software and all updates and modifications released during the Subscription term.
+
+2.3. This license grants Licensee the right to use the Software for both personal and commercial purposes. Licensee may install and operate the Software on an unlimited number of servers within its organization, host an unlimited number of domains, and host data for an unlimited number of external organizations (tenants) using the Software's multi-tenancy features. The Subscription tier is determined solely by the total number of Mailboxes provisioned. However, Licensee is expressly prohibited from reselling, leasing, sublicensing, or otherwise redistributing the Software itself.
+
+2.4. This license is further governed by the terms and conditions set forth in any licensing agreements separately executed between Licensor and Licensee. In the event of any conflict between the terms of this Agreement and the terms of a signed licensing agreement, the terms of the signed licensing agreement shall control.
+
+2.5. You are not granted any other rights beyond what is expressly stated herein.
+
+## 3. LICENSE KEYS
+
+3.1. The Software shall not be used without a valid License Key issued by Licensor.
+
+3.2. Licensee is required to use valid License Keys issued by Licensor to run the Software, including any modified versions. Any attempts to bypass the License Key requirement is a violation of this Agreement.
+
+3.3. Distribution or sharing of License Keys to third parties, not associated with Licensee, is strictly prohibited.
+
+3.4. License Keys are bound to the Subscription period. Should your Subscription expire or be cancelled, all License Keys will become invalid after fifteen (15) days from the Subscription expiration or cancellation date.
+
+3.5. Any instance of the Software using such an expired key will revert to the Community Edition functionality after the aforementioned fifteen (15) day period.
+
+## 4. SOURCE CODE USAGE
+
+4.1. Licensee is permitted to view, copy, and modify the Software's Source Code, as made available by Licensor, solely for Licensee's internal business use and in compliance with this Agreement's terms.
+
+4.2. Any modifications to the Source Code do not grant Licensee any ownership rights to the original Software or any modifications. All rights, title, and interest to the Software and its Source Code remain exclusively with Licensor.
+
+4.3. Licensee is strictly prohibited from altering, removing, or in any way tampering with the License Key validation system within the Software. Any such unauthorized modifications will be considered a material breach of this Agreement and may result in legal action.
+
+4.4. Notwithstanding the availability of the Software's Source Code for review and limited modification, the Software and its Source Code are not open source and remain proprietary to Licensor. The provision of access to the Source Code does not confer any rights typically associated with open source software, including but not limited to the right to freely sublicense, or create derivative works for public distribution. All rights not expressly granted herein are reserved by Licensor.
+
+4.5. Notwithstanding the foregoing, you may copy the Source Code for development and testing purposes, without requiring a Subscription.
+
+## 5. INTELLECTUAL PROPERTY RIGHTS
+
+5.1. The Licensor retains all rights, title, and interest in and to the Software, including all intellectual property rights therein. This Agreement does not transfer any ownership rights to the Licensee.
+
+5.2. The Licensee must not remove, alter, or obscure any proprietary notices (including copyright and trademark notices) on the Software.
+
+## 6. SUBSCRIPTION TERMS, RENEWAL, AND CANCELLATION
+
+6.1. Subscriptions are available on a monthly or annual basis. The applicable fees, Mailbox tier, and billing cycle will be as set forth at the time of purchase or as subsequently agreed in writing between the parties.
+
+6.2. Where Licensee has provided a valid payment method (such as a credit card) on file, the Subscription will automatically renew at the end of each billing cycle at the then-current rate, unless Licensee removes the payment method or cancels the Subscription prior to the renewal date. No advance cancellation notice period is required; Licensee may cancel at any time by removing the payment method on file or by notifying Licensor.
+
+6.3. Where Licensee pays by invoice (bank transfer), the Subscription will not automatically renew. Licensor will issue an invoice notification prior to the end of the billing cycle, and the Subscription will renew only upon receipt of payment.
+
+6.4. Upon cancellation of a Subscription by Licensee prior to the end of a paid billing cycle, Licensee is entitled to a prorated refund for the unused portion of the then-current billing period. Refunds will be calculated from the effective date of cancellation through the end of the billing cycle and will be issued within thirty (30) days of the cancellation date.
+
+6.5. Licensor reserves the right to modify Subscription fees upon renewal. Any fee changes will be communicated to Licensee at least thirty (30) days prior to the start of the next billing cycle.
+
+## 7. SUPPORT AND SERVICE LEVELS
+
+7.1. All Licensees with an active Subscription have access to standard community support resources, including documentation and community forums, as made available by Licensor.
+
+7.2. Priority email support is available exclusively to Licensees whose Subscription covers one hundred fifty (150) or more Mailboxes. Priority email support inquiries will receive an initial response within forty-eight (48) hours of receipt during Licensor's standard business hours.
+
+7.3. The forty-eight (48) hour response time set forth in Section 7.2 constitutes a service level commitment. In the event Licensor consistently fails to meet this commitment over a period of thirty (30) consecutive days, the affected Licensee's sole remedy shall be the right to terminate the Subscription and receive a prorated refund for the unused portion of the billing cycle.
+
+7.4. The Software is self-hosted by Licensee on Licensee's own infrastructure. Licensor does not provide hosting services and makes no guarantees regarding uptime, availability, or performance of Licensee's self-hosted deployment.
+
+## 8. TERMINATION
+
+8.1. Licensor may terminate this Agreement immediately upon written notice if Licensee commits a material breach of any term of this Agreement and fails to cure such breach within thirty (30) days of receiving written notice specifying the breach.
+
+8.2. Licensor may terminate this Agreement for convenience upon thirty (30) days' written notice to Licensee. In such event, Licensee shall receive a prorated refund for the unused portion of any prepaid Subscription fees.
+
+8.3. In the event of a termination, Licensee will be provided with written notice, sent to the email address used during Subscription registration, outlining the reasons for the termination.
+
+8.4. Upon termination, all rights granted to Licensee under this Agreement will cease, and Licensee must promptly cease all use of the Software and destroy or delete all copies in its possession, except that Licensee may retain copies of the Source Code obtained prior to termination solely for archival purposes, subject to the continuing obligations of confidentiality and intellectual property protection set forth herein.
+
+## 9. CONFIDENTIALITY
+
+9.1. Each party agrees to hold the other party's Confidential Information in strict confidence and not to disclose such information to any third party, except to employees, contractors, or agents who have a need to know and are bound by confidentiality obligations no less protective than those contained herein.
+
+9.2. Confidential Information does not include information that: (a) is or becomes publicly available through no fault of the receiving party; (b) was rightfully in the receiving party's possession prior to disclosure; (c) is independently developed by the receiving party without use of the disclosing party's Confidential Information; or (d) is rightfully obtained from a third party without restriction on disclosure.
+
+9.3. A receiving party may disclose Confidential Information to the extent required by applicable law, regulation, or court order, provided that the receiving party gives the disclosing party prompt written notice (where legally permissible) and cooperates with the disclosing party's efforts to seek protective treatment of such information.
+
+9.4. The obligations of confidentiality set forth in this Section shall survive the termination or expiration of this Agreement for a period of three (3) years.
+
+## 10. LIMITATION OF LIABILITY
+
+10.1. In no event will the Licensor be liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of profits or revenues, whether incurred directly or indirectly, or any loss of data, use, goodwill, or other intangible losses, resulting from (i) your use or inability to use the Software; (ii) any unauthorized access to or use of your servers and/or any personal information stored therein.
+
+10.2. Except for liability arising from death or personal injury caused by negligence, fraud, willful misconduct, or a party's indemnification obligations under this Agreement, Licensor's total aggregate liability for any and all claims under this Agreement shall be limited to the total Subscription fees paid by Licensee to Licensor in the twelve (12) months immediately preceding the event giving rise to the claim.
+
+## 11. INDEMNIFICATION
+
+11.1. Licensee agrees to indemnify, defend, and hold harmless Licensor, its officers, directors, employees, agents, licensors, suppliers, and any third-party information providers from and against all claims, losses, expenses, damages, and costs, including reasonable attorneys' fees, resulting from any violation of this Agreement or any activity related to Licensee's use or misuse of the Software (including negligent or wrongful conduct).
+
+11.2. Licensor agrees to indemnify, defend, and hold harmless Licensee from and against any third-party claim that the Software, as provided by Licensor, infringes or misappropriates any patent, copyright, trademark, or trade secret of a third party, provided that Licensee: (a) gives Licensor prompt written notice of such claim; (b) grants Licensor sole control of the defense and settlement of such claim; and (c) provides reasonable cooperation at Licensor's expense.
+
+11.3. If the Software becomes, or in Licensor's opinion is likely to become, the subject of an infringement claim, Licensor may at its option and expense: (a) procure for Licensee the right to continue using the Software; (b) modify or replace the Software to make it non-infringing while maintaining substantially equivalent functionality; or (c) if neither (a) nor (b) is commercially practicable, terminate this Agreement and provide Licensee with a prorated refund of any prepaid Subscription fees.
+
+11.4. Licensor shall have no obligation under this Section for any claim arising from: (a) modifications to the Software made by Licensee; (b) use of the Software in combination with products, services, or technologies not provided by Licensor, where the infringement would not have occurred but for such combination; or (c) Licensee's continued use of a version of the Software after being notified of the availability of a non-infringing update.
+
+## 12. DATA PROTECTION AND PRIVACY
+
+12.1. The Software is self-hosted by Licensee, and Licensee retains sole responsibility for all data stored and processed within its deployment of the Software, including any personal data of its users or tenants.
+
+12.2. To the extent that Licensor processes any personal data on behalf of Licensee (for example, in connection with support services or license management), such processing shall be conducted in accordance with applicable data protection laws, including but not limited to the General Data Protection Regulation (GDPR) where applicable, the California Consumer Privacy Act (CCPA) where applicable, and any other relevant data protection legislation.
+
+12.3. Where required by applicable data protection law, the parties shall enter into a separate Data Processing Agreement ("DPA") that sets forth the terms and conditions governing Licensor's processing of personal data on behalf of Licensee.
+
+12.4. In the event of a data breach affecting personal data processed by Licensor in connection with this Agreement, Licensor shall notify Licensee without undue delay and in any event within seventy-two (72) hours of becoming aware of the breach, and shall cooperate with Licensee in investigating and remediating the breach.
+
+12.5. Additional details regarding Licensor's data handling practices are outlined in Licensor's Privacy Policy, which can be accessed on Licensor's website.
+
+## 13. EXPORT COMPLIANCE
+
+13.1. The Software may be subject to export control and sanctions laws of the United States and other jurisdictions. Licensee agrees to comply with all applicable export control laws, including without limitation the U.S. Export Administration Regulations (EAR) and the regulations administered by the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC).
+
+13.2. Licensee represents and warrants that: (a) Licensee is not located in, organized under the laws of, or a resident of any country or territory subject to comprehensive U.S. sanctions (currently including Cuba, Iran, North Korea, Syria, and the Crimea, Donetsk, and Luhansk regions of Ukraine); (b) Licensee is not listed on any U.S. government restricted party list; and (c) Licensee will not export, re-export, or transfer the Software to any prohibited destination, entity, or individual without the required governmental authorizations.
+
+## 14. ANTI-CORRUPTION
+
+14.1. Each party represents and warrants that it has not and will not, in connection with this Agreement, directly or indirectly offer, pay, promise to pay, or authorize the payment of any money or anything of value to any government official, political party, or candidate for political office for the purpose of influencing any act or decision, or securing any improper advantage.
+
+14.2. Each party shall comply with all applicable anti-corruption and anti-bribery laws, including without limitation the U.S. Foreign Corrupt Practices Act (FCPA) and the UK Bribery Act 2010.
+
+## 15. GOVERNING LAW AND DISPUTE RESOLUTION
+
+15.1. This Agreement shall be governed by and construed under the laws of the State of Wyoming, United States of America, without regard to its conflict of laws principles.
+
+15.2. Any dispute, controversy, or claim arising out of or relating to this Agreement, or the breach, termination, or invalidity thereof, shall first be attempted to be resolved through good faith negotiation between the parties for a period of thirty (30) days following written notice of the dispute.
+
+15.3. If the dispute is not resolved through negotiation within the thirty (30) day period, it shall be finally resolved by binding arbitration administered by the American Arbitration Association ("AAA") in accordance with its Commercial Arbitration Rules. The arbitration shall be conducted in Sheridan, Wyoming, before a single arbitrator. The language of the arbitration shall be English.
+
+15.4. The arbitrator's award shall be final and binding and may be entered as a judgment in any court of competent jurisdiction. Each party shall bear its own costs and attorneys' fees in connection with the arbitration, unless the arbitrator determines otherwise.
+
+15.5. Notwithstanding the foregoing, either party may seek injunctive or other equitable relief in any court of competent jurisdiction to protect its intellectual property rights or Confidential Information without first submitting to arbitration.
+
+## 16. NOTICES
+
+16.1. All notices required or permitted under this Agreement shall be in writing and shall be deemed effectively given: (a) upon personal delivery; (b) upon confirmed transmission by email; or (c) one (1) business day after deposit with a nationally recognized overnight courier service.
+
+16.2. Notices to Licensor shall be sent to the address and email set forth in Section 21 (Contact Information) of this Agreement. Notices to Licensee shall be sent to the email address provided during Subscription registration or as subsequently updated by Licensee in writing.
+
+## 17. ASSIGNMENT
+
+17.1. Licensee may not transfer or assign this Agreement or any rights or obligations hereunder without the prior written consent of Licensor, except that Licensee may assign this Agreement without consent in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets, provided that the assignee agrees in writing to be bound by the terms of this Agreement.
+
+17.2. Licensor may assign this Agreement without restriction. Any assignment in violation of this Section shall be null and void.
+
+## 18. DISCLAIMERS AND WARRANTIES
+
+18.1. The Software is provided "AS IS" and "AS AVAILABLE", without warranty of any kind, either express or implied, including, without limitation, warranties of merchantability, fitness for a particular purpose, and non-infringement.
+
+18.2. Licensor does not warrant that the Software will be error-free, that access thereto will be uninterrupted, or that defects will be corrected.
+
+18.3. Licensor warrants that, as of the date of delivery, the Software will perform substantially in accordance with the accompanying documentation for a period of ninety (90) days. Licensee's sole remedy for breach of this warranty shall be, at Licensor's option, repair or replacement of the non-conforming Software, or a refund of the Subscription fees paid for the period during which the Software was non-conforming.
+
+## 19. FORCE MAJEURE
+
+Neither party shall be in default or otherwise liable for any delay in or failure of its performance under this Agreement if such delay or failure arises by any reason of any event beyond the reasonable control of a party, including acts of God, the elements, earthquakes, floods, fires, epidemics, riots, failures or delays in transportation or communications, or any act or failure to act by the other party or such other party's officers, employees, agents, or contractors. The affected party shall give prompt notice to the other party and shall use commercially reasonable efforts to mitigate the effects of the force majeure event. If a force majeure event continues for more than ninety (90) days, either party may terminate this Agreement upon written notice, and Licensee shall receive a prorated refund of any prepaid Subscription fees.
+
+## 20. SURVIVAL
+
+The following Sections shall survive the termination or expiration of this Agreement: Section 1 (Definitions), Section 4.2 (Ownership of Modifications), Section 4.4 (Proprietary Nature of Software), Section 5 (Intellectual Property Rights), Section 9 (Confidentiality), Section 10 (Limitation of Liability), Section 11 (Indemnification), Section 12 (Data Protection and Privacy), Section 13 (Export Compliance), Section 15 (Governing Law and Dispute Resolution), and Section 20 (Survival).
+
+## 21. SEVERABILITY
+
+If any provision of this Agreement is held to be unenforceable or invalid for any reason, that provision shall be reformed to the extent necessary to make it enforceable and consistent with the intent of the parties, and the remaining provisions shall remain in full force and effect.
+
+## 22. ENTIRE AGREEMENT
+
+This Agreement constitutes the entire agreement between the Licensor and the Licensee with respect to the subject matter hereof and supersedes all prior or contemporaneous understandings regarding such subject matter. No amendment to or modification of this Agreement will be binding unless in writing and signed by the Licensor.
+
+## 23. ACCEPTANCE
+
+By downloading, installing, or using the Software, even without explicitly clicking on an "I Agree" button or a similar mechanism, you acknowledge that you have read, understood, and agreed to be bound by the terms and conditions of this Agreement.
+
+## 24. CONTACT INFORMATION
+
+If you have any questions about this Agreement, please contact Stalwart Labs LLC at:
+
+Stalwart Labs LLC
+1309 Coffeen Avenue STE 1200
+Sheridan, Wyoming 82801
+USA
+hello@stalw.art
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..aee0776
--- /dev/null
+++ b/README.md
@@ -0,0 +1,88 @@
+
+
+ 
+
+
+
+
+ Multi-protocol e-mail migration proxy for Stalwart
+
+
+
+
+
+ 
+
+ 
+
+ 
+
+
+ 
+
+ 
+
+
+ 
+
+ 
+
+
+## Features
+
+The migration proxy sits in front of one or more mail backends and decides, on a per-account basis, which backend a given connection belongs to. It terminates IMAP, POP3, ManageSieve, SMTP submission, SMTP/LMTP and HTTP (JMAP) sessions, identifies the account behind each connection from the credentials the client already presents, looks up the destination that account is assigned to, replays the authentication to that backend, and bridges the session. Because the routing decision is made from the existing credentials, no client reconfiguration is required: users keep the same server name, ports and passwords while the proxy routes them to the correct system.
+
+It is built for three scenarios: migrating from legacy servers (Dovecot, Cyrus and other IMAP/POP3/SMTP servers) onto Stalwart one mailbox at a time, migrating between Stalwart versions by running an old and a new deployment side by side, and acting as a cache-locality router in front of a Stalwart cluster so each account is consistently pinned to the same node.
+
+- **Multi-protocol.** Proxies IMAP, POP3, ManageSieve, SMTP submission, SMTP/LMTP pass-through and HTTP/JMAP, including JMAP-over-WebSocket.
+- **Per-account routing.** Resolves each account to a backend through a mapping store backed by a flat file, Redis or a SQL database (PostgreSQL, MySQL or SQLite), with an in-memory cache and a configurable default destination for unmapped accounts.
+- **Credential-aware.** Extracts the routing identifier from SASL `PLAIN`, `OAUTHBEARER` and `XOAUTH2` exchanges, from HTTP Basic and Bearer authentication, and from JWT and Stalwart access-token claims, then replays authentication to the backend without ever persisting passwords.
+- **Backend-friendly forwarding.** Conveys the real client identity using the PROXY protocol for modern backends, or the `XCLIENT` and IMAP `ID` extensions for Dovecot and Postfix, with `Forwarded` and `X-Forwarded-For` headers for HTTP.
+- **Flexible TLS.** Terminates inbound TLS with SNI-based certificate selection, and reaches backends over implicit TLS, STARTTLS or plaintext, with platform, pinned-certificate or mutual-TLS verification on the backend leg.
+- **Resilient.** Per-destination health gating with a circuit breaker, connection retries, idle timeouts and graceful draining on shutdown.
+- **Operable at runtime.** An authenticated HTTP management API exposes statistics, mapping management, cache invalidation, connection control and configuration reload without a restart.
+
+## Installing
+
+The proxy is distributed as a single self-contained binary and as a multi-architecture container image (`amd64`, `arm64`, `armv7` and `armv6`), in both glibc and Alpine/musl variants.
+
+The container image is published to the GitHub Container Registry and Docker Hub. Mount a configuration directory at `/etc/proxy` and run:
+
+```bash
+docker run -d --name proxy \
+ -v /srv/proxy:/etc/proxy \
+ -p 993:993 -p 143:143 -p 995:995 \
+ -p 587:587 -p 465:465 -p 4190:4190 -p 443:443 \
+ ghcr.io/stalwartlabs/proxy:latest
+```
+
+To install directly on a host, the install script provisions the binary, a service account, a service unit and sample configuration files:
+
+```bash
+curl --proto '=https' --tlsv1.2 -sSf \
+ https://raw.githubusercontent.com/stalwartlabs/proxy/main/install.sh | sudo sh
+```
+
+The service is installed but not started, because the sample configuration must first be edited for the local destinations, listeners and TLS certificates. Full instructions are in the [documentation](https://stalw.art/docs/migration/proxy).
+
+## Documentation
+
+All documentation is available at [stalw.art/docs/migration/proxy](https://stalw.art/docs/migration/proxy).
+
+## Support
+
+If you are having problems running Stalwart, found a bug, or just have a question, please head to the [Stalwart Support Portal](https://support.stalw.art) at [support.stalw.art](https://support.stalw.art).
+Additionally, you may purchase an [Enterprise License](https://stalw.art/enterprise) to obtain priority support from Stalwart Labs LLC, including response-time commitments and a private Priority Support area on the portal.
+
+## License
+
+This project is dual-licensed under the **GNU Affero General Public License v3.0** (AGPL-3.0; as published by the Free Software Foundation) and the **Stalwart Enterprise License v1 (SELv1)**:
+
+- The [GNU Affero General Public License v3.0](./LICENSES/AGPL-3.0-only.txt) is a free software license that ensures your freedom to use, modify, and distribute the software, with the condition that any modified versions of the software must also be distributed under the same license.
+- The [Stalwart Enterprise License v1 (SELv1)](./LICENSES/LicenseRef-SEL.txt) is a proprietary license designed for commercial use. It offers additional features and greater flexibility for businesses that do not wish to comply with the AGPL-3.0 license requirements.
+
+Each file in this project contains a license notice at the top, indicating the applicable license(s). The license notice follows the [REUSE guidelines](https://reuse.software/) to ensure clarity and consistency. The full text of each license is available in the [LICENSES](./LICENSES/) directory.
+
+## Copyright
+
+Copyright (C) 2020, Stalwart Labs LLC
diff --git a/docker-bake.hcl b/docker-bake.hcl
new file mode 100644
index 0000000..ec490a3
--- /dev/null
+++ b/docker-bake.hcl
@@ -0,0 +1,50 @@
+variable "TARGET" {
+ default = "$TARGET"
+}
+variable "GHCR_REPO" {
+ default = "$GHCR_REPO"
+}
+variable "BUILD_ENV" {
+ default = "$BUILD_ENV"
+}
+variable "SUFFIX" {
+ default = "$SUFFIX"
+}
+variable "DOCKER_PLATFORM" {
+ default = "$DOCKER_PLATFORM"
+}
+target "docker-metadata-action" {}
+target "build" {
+ secret = [
+ "type=env,id=ACTIONS_RESULTS_URL",
+ "type=env,id=ACTIONS_RUNTIME_TOKEN"
+ ]
+ args = {
+ TARGET = "${TARGET}"
+ BUILD_ENV = equal("", "${BUILD_ENV}") ? null : "${BUILD_ENV}"
+ }
+ target = "binaries"
+ cache-from = [
+ "type=registry,ref=${GHCR_REPO}-buildcache:${TARGET}"
+ ]
+ cache-to = [
+ "type=registry,ref=${GHCR_REPO}-buildcache:${TARGET},mode=max,compression=zstd,compression-level=9,force-compression=true,oci-mediatypes=true,image-manifest=false"
+ ]
+ context = "./"
+ dockerfile = "Dockerfile.build"
+ output = ["./artifact"]
+}
+target "image" {
+ inherits = ["build","docker-metadata-action"]
+ cache-to = [""]
+ cache-from = [
+ "type=registry,ref=${GHCR_REPO}-buildcache:${TARGET}"
+ ]
+ target = equal("", "${SUFFIX}") ? "gnu" : "musl"
+ platforms = [
+ "${DOCKER_PLATFORM}"
+ ]
+ output = [
+ ""
+ ]
+}
diff --git a/install.sh b/install.sh
new file mode 100755
index 0000000..e7d861a
--- /dev/null
+++ b/install.sh
@@ -0,0 +1,1109 @@
+#!/usr/bin/env sh
+# shellcheck shell=dash
+
+#
+# SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+#
+# SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+#
+
+# Migration proxy install script -- based on the rustup installation script.
+
+set -e
+set -u
+
+readonly BASE_URL="https://github.com/stalwartlabs/proxy/releases/latest/download"
+
+main() {
+ downloader --check
+ need_cmd uname
+ need_cmd mktemp
+ need_cmd chmod
+ need_cmd chown
+ need_cmd mkdir
+ need_cmd rm
+ need_cmd tar
+ need_cmd cp
+ need_cmd tr
+ need_cmd hostname
+
+ # Require root
+ if [ "$(id -u)" -ne 0 ]; then
+ err "Install failed: this program needs to run as root."
+ fi
+
+ # Detect OS. The service account is "stalwart-proxy" rather than "proxy"
+ # because Debian ships a system "proxy" user (uid 13) that would collide.
+ local _os _uname _account
+ _uname="$(uname)"
+ _account="stalwart-proxy"
+ case "$_uname" in
+ Linux) _os="linux" ;;
+ Darwin) _os="macos"; _account="_stalwart-proxy" ;;
+ *) err "Install failed: unsupported OS: $_uname" ;;
+ esac
+
+ # Parse arguments
+ local _prefix=""
+ while [ $# -gt 0 ]; do
+ case "$1" in
+ -h|--help)
+ print_usage
+ exit 0
+ ;;
+ --*|-*)
+ err "Unknown flag: $1 (try --help)"
+ ;;
+ *)
+ if [ -n "$_prefix" ]; then
+ err "Only one prefix argument is allowed, got: $_prefix $1"
+ fi
+ _prefix="$1"
+ ;;
+ esac
+ shift
+ done
+
+ # Derive install paths: FHS by default, self-contained under a custom prefix
+ local _bin_dir _bin_file _conf_dir _tls_dir _log_dir
+ local _config_file _mappings_file _token_file _env_file
+ if [ -z "$_prefix" ]; then
+ _bin_dir="/usr/local/bin"
+ _conf_dir="/etc/proxy"
+ _log_dir="/var/log/proxy"
+ else
+ _bin_dir="${_prefix}/bin"
+ _conf_dir="${_prefix}/etc"
+ _log_dir="${_prefix}/logs"
+ fi
+ _tls_dir="${_conf_dir}/tls"
+ _bin_file="${_bin_dir}/proxy"
+ _config_file="${_conf_dir}/config.toml"
+ _mappings_file="${_conf_dir}/mappings.tsv"
+ _token_file="${_conf_dir}/admin.token"
+ _env_file="${_conf_dir}/proxy.env"
+
+ # Detect architecture
+ get_architecture || return 1
+ local _arch="$RETVAL"
+ assert_nz "$_arch" "arch"
+
+ # Create service account
+ create_account "$_os" "$_account"
+
+ # Create directories
+ ensure mkdir -p "$_bin_dir" "$_conf_dir" "$_tls_dir" "$_log_dir"
+
+ # Download and install the binary
+ say "Downloading proxy for ${_arch}..."
+ local _tmp _tar
+ _tmp="$(mktemp -d)"
+ _tar="${_tmp}/proxy.tar.gz"
+ ensure downloader "${BASE_URL}/proxy-${_arch}.tar.gz" "$_tar" "$_arch"
+ ensure tar zxf "$_tar" -C "$_tmp"
+ ensure cp "${_tmp}/proxy" "$_bin_file"
+ ensure chmod 0755 "$_bin_file"
+ ensure rm -rf "$_tmp"
+
+ # Provision config, mappings, env file and admin token (preserve existing files)
+ if [ ! -e "$_config_file" ]; then
+ say "Writing sample config at ${_config_file}..."
+ write_config_file "$_config_file"
+ fi
+ if [ ! -e "$_mappings_file" ]; then
+ say "Writing sample mappings at ${_mappings_file}..."
+ write_mappings_file "$_mappings_file"
+ fi
+ if [ ! -e "$_env_file" ]; then
+ say "Writing env file at ${_env_file}..."
+ write_env_file "$_env_file"
+ fi
+ if [ ! -e "$_token_file" ]; then
+ say "Generating admin token at ${_token_file}..."
+ write_token_file "$_token_file"
+ fi
+
+ # Ownership and permissions
+ say "Setting permissions..."
+ ensure chown -R "${_account}:${_account}" "$_conf_dir" "$_log_dir"
+ ensure chmod 0750 "$_conf_dir" "$_tls_dir" "$_log_dir"
+ ensure chmod 0640 "$_config_file" "$_mappings_file"
+ ensure chown "root:${_account}" "$_env_file" "$_token_file"
+ ensure chmod 0640 "$_env_file" "$_token_file"
+
+ # Install the service (enabled, but not started: the proxy will not run
+ # until the sample config has been edited for the local deployment)
+ say "Installing service..."
+ local _service_type=""
+ local _start_cmd=""
+ case "$_os" in
+ linux)
+ if check_cmd systemctl; then
+ create_service_linux_systemd "$_bin_file" "$_config_file" "$_env_file" "$_account"
+ _service_type="systemd"
+ _start_cmd="systemctl start proxy"
+ else
+ create_service_linux_initd "$_bin_file" "$_config_file" "$_env_file" "$_account"
+ _service_type="initd"
+ _start_cmd="service proxy start"
+ fi
+ ;;
+ macos)
+ create_service_macos "$_bin_file" "$_config_file" "$_env_file" "$_account"
+ _service_type="launchd"
+ _start_cmd="launchctl bootstrap system /Library/LaunchDaemons/proxy.plist"
+ ;;
+ esac
+
+ # Completion message
+ say ""
+ say "Installation complete."
+ say ""
+ say "Before the proxy can start you must:"
+ say " 1. Edit ${_config_file} (destinations, listeners, routing)."
+ say " 2. Install the inbound TLS certificate and key under ${_tls_dir}/."
+ say " 3. Populate ${_mappings_file} with '\\t' lines."
+ say ""
+ say "An admin bearer token was generated at ${_token_file}."
+ say ""
+ say "Once configured, start the service with:"
+ say " ${_start_cmd}"
+ say ""
+
+ return 0
+}
+
+print_usage() {
+ cat <<'EOF'
+Usage: install.sh [PREFIX]
+
+Install the migration proxy into standard FHS paths or under a custom prefix.
+
+Options:
+ -h, --help Show this help.
+
+With no PREFIX, the proxy is installed under standard FHS paths:
+ binary /usr/local/bin/proxy
+ config /etc/proxy/config.toml
+ mappings /etc/proxy/mappings.tsv
+ tls /etc/proxy/tls/
+ token /etc/proxy/admin.token
+ env /etc/proxy/proxy.env
+ logs /var/log/proxy/
+
+When PREFIX is provided, a self-contained layout is used instead:
+ binary $PREFIX/bin/proxy
+ config $PREFIX/etc/config.toml
+ mappings $PREFIX/etc/mappings.tsv
+ tls $PREFIX/etc/tls/
+ token $PREFIX/etc/admin.token
+ env $PREFIX/etc/proxy.env
+ logs $PREFIX/logs/
+EOF
+}
+
+write_config_file() {
+ cat > "$1" <<'EOF'
+# Migration proxy configuration. Edit this template for your deployment.
+# The proxy refuses to boot until every referenced destination, certificate
+# and credential path is valid (see SPEC section 8.4).
+
+[server]
+threads = 0
+hostname = "proxy.example.com"
+shutdown_grace = "30s"
+log_level = "info"
+
+[tls.certificate.default]
+cert = "/etc/proxy/tls/fullchain.pem"
+key = "/etc/proxy/tls/privkey.pem"
+default = true
+
+[tls.protocols]
+min_version = "1.2"
+
+[routing]
+default_destination = "legacy"
+# smtp_passthrough_destination = "stalwart"
+
+[mapping]
+source = "file"
+normalize = "lowercase"
+negative_ttl = "30s"
+positive_ttl = "10m"
+
+[mapping.file]
+path = "/etc/proxy/mappings.tsv"
+
+[destination.legacy]
+host = "10.0.1.10"
+tls_server_name = "mail.legacy.example.com"
+proxy_protocol = true
+[destination.legacy.protocol.imap]
+port = 993
+tls = "implicit"
+[destination.legacy.protocol.pop3]
+port = 995
+tls = "implicit"
+[destination.legacy.protocol.submission]
+port = 587
+tls = "starttls"
+[destination.legacy.protocol.managesieve]
+port = 4190
+tls = "starttls"
+[destination.legacy.protocol.http]
+port = 443
+tls = "implicit"
+
+[destination.stalwart]
+host = "10.0.1.20"
+tls_server_name = "mail.new.example.com"
+proxy_protocol = true
+[destination.stalwart.protocol.imap]
+port = 993
+tls = "implicit"
+[destination.stalwart.protocol.pop3]
+port = 995
+tls = "implicit"
+[destination.stalwart.protocol.submission]
+port = 587
+tls = "starttls"
+[destination.stalwart.protocol.managesieve]
+port = 4190
+tls = "starttls"
+[destination.stalwart.protocol.http]
+port = 443
+tls = "implicit"
+
+[listener.imap]
+protocol = "imap"
+bind = ["0.0.0.0:993", "[::]:993"]
+tls = "implicit"
+
+[listener.imap-starttls]
+protocol = "imap"
+bind = ["0.0.0.0:143", "[::]:143"]
+tls = "starttls"
+
+[listener.pop3]
+protocol = "pop3"
+bind = ["0.0.0.0:995", "[::]:995"]
+tls = "implicit"
+
+[listener.submission]
+protocol = "submission"
+bind = ["0.0.0.0:587", "[::]:587"]
+tls = "starttls"
+
+[listener.submissions]
+protocol = "submission"
+bind = ["0.0.0.0:465", "[::]:465"]
+tls = "implicit"
+
+[listener.managesieve]
+protocol = "managesieve"
+bind = ["0.0.0.0:4190", "[::]:4190"]
+tls = "starttls"
+
+[listener.https]
+protocol = "http"
+bind = ["0.0.0.0:443", "[::]:443"]
+tls = "implicit"
+forwarded = "off"
+
+[[http.route]]
+match = "/.well-known/**"
+destination = "legacy"
+
+[[http.route]]
+match = "/**"
+extract = { from = "authorization" }
+fallback = "default"
+
+[admin]
+bind = "127.0.0.1:9443"
+tls = "implicit"
+bearer_token_file = "/etc/proxy/admin.token"
+min_token_len = 32
+lockout_threshold = 5
+lockout_duration = "5m"
+EOF
+}
+
+write_mappings_file() {
+ cat > "$1" <<'EOF'
+# identifierdestination-id, one per line.
+# alice@legacy.example.com legacy
+# carol@new.example.com stalwart
+EOF
+}
+
+write_env_file() {
+ cat > "$1" <<'EOF'
+# Environment variables for the migration proxy service.
+# Uncomment and edit an entry to override its default.
+
+# Admin bearer token. Overrides [admin].bearer_token_file when set.
+#PROXY_ADMIN_TOKEN=
+
+# Tracing filter. Overrides [server].log_level when set.
+#RUST_LOG=info
+EOF
+}
+
+write_token_file() {
+ local _token
+ _token="$(LC_ALL=C tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 48)"
+ assert_nz "$_token" "admin token"
+ printf '%s\n' "$_token" > "$1"
+}
+
+create_account() {
+ local _os="$1"
+ local _account="$2"
+ if id -u "$_account" > /dev/null 2>&1; then
+ return 0
+ fi
+ say "Creating '${_account}' account..."
+ if [ "$_os" = "macos" ]; then
+ local _last_uid _last_gid _uid _gid
+ _last_uid="$(dscacheutil -q user | grep uid | awk '{print $2}' | sort -n | tail -n 1)"
+ _last_gid="$(dscacheutil -q group | grep gid | awk '{print $2}' | sort -n | tail -n 1)"
+ _uid="$((_last_uid+1))"
+ _gid="$((_last_gid+1))"
+
+ ensure dscl /Local/Default -create Groups/_stalwart-proxy
+ ensure dscl /Local/Default -create Groups/_stalwart-proxy Password \*
+ ensure dscl /Local/Default -create Groups/_stalwart-proxy PrimaryGroupID $_gid
+ ensure dscl /Local/Default -create Groups/_stalwart-proxy RealName "Migration proxy service"
+ ensure dscl /Local/Default -create Groups/_stalwart-proxy RecordName _stalwart-proxy stalwart-proxy
+
+ ensure dscl /Local/Default -create Users/_stalwart-proxy
+ ensure dscl /Local/Default -create Users/_stalwart-proxy NFSHomeDirectory /var/empty
+ ensure dscl /Local/Default -create Users/_stalwart-proxy Password \*
+ ensure dscl /Local/Default -create Users/_stalwart-proxy PrimaryGroupID $_gid
+ ensure dscl /Local/Default -create Users/_stalwart-proxy RealName "Migration proxy service"
+ ensure dscl /Local/Default -create Users/_stalwart-proxy RecordName _stalwart-proxy stalwart-proxy
+ ensure dscl /Local/Default -create Users/_stalwart-proxy UniqueID $_uid
+ ensure dscl /Local/Default -create Users/_stalwart-proxy UserShell /usr/bin/false
+
+ ensure dscl /Local/Default -delete /Users/_stalwart-proxy AuthenticationAuthority
+ ensure dscl /Local/Default -delete /Users/_stalwart-proxy PasswordPolicyOptions
+ else
+ ensure useradd "$_account" -s /usr/sbin/nologin -M -r -U
+ fi
+}
+
+create_service_linux_systemd() {
+ local _bin="$1" _config="$2" _env="$3" _user="$4"
+ cat > /etc/systemd/system/proxy.service < /etc/init.d/proxy < /dev/null \\
+ || return 1
+ start-stop-daemon --start --quiet --pidfile \$PIDFILE --exec \$DAEMON \\
+ --background --make-pidfile --chuid ${_user}:${_user} \\
+ -- \$DAEMON_ARGS \\
+ || return 2
+}
+
+do_stop()
+{
+ start-stop-daemon --stop --quiet --retry=INT/30/KILL/5 --pidfile \$PIDFILE --name proxy
+ RETVAL="\$?"
+ [ "\$RETVAL" = 2 ] && return 2
+ start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec \$DAEMON
+ [ "\$?" = 2 ] && return 2
+ rm -f \$PIDFILE
+ return "\$RETVAL"
+}
+
+case "\$1" in
+ start)
+ [ "\$VERBOSE" != no ] && log_daemon_msg "Starting migration proxy" "proxy"
+ do_start
+ case "\$?" in
+ 0|1) [ "\$VERBOSE" != no ] && log_end_msg 0 ;;
+ 2) [ "\$VERBOSE" != no ] && log_end_msg 1 ;;
+ esac
+ ;;
+ stop)
+ [ "\$VERBOSE" != no ] && log_daemon_msg "Stopping migration proxy" "proxy"
+ do_stop
+ case "\$?" in
+ 0|1) [ "\$VERBOSE" != no ] && log_end_msg 0 ;;
+ 2) [ "\$VERBOSE" != no ] && log_end_msg 1 ;;
+ esac
+ ;;
+ status)
+ status_of_proc "\$DAEMON" "proxy" && exit 0 || exit \$?
+ ;;
+ restart)
+ log_daemon_msg "Restarting migration proxy" "proxy"
+ do_stop
+ case "\$?" in
+ 0|1)
+ do_start
+ case "\$?" in
+ 0) log_end_msg 0 ;;
+ *) log_end_msg 1 ;;
+ esac
+ ;;
+ *)
+ log_end_msg 1
+ ;;
+ esac
+ ;;
+ *)
+ echo "Usage: /etc/init.d/proxy {start|stop|status|restart}" >&2
+ exit 3
+ ;;
+esac
+
+exit 0
+EOF
+ chmod +x /etc/init.d/proxy
+ update-rc.d proxy defaults
+}
+
+create_service_macos() {
+ local _bin="$1" _config="$2" _env="$3" _user="$4"
+ local _plist="/Library/LaunchDaemons/proxy.plist"
+
+ # launchd has no EnvironmentFile equivalent: wrap with sh to source the env file
+ cat > "$_plist" <
+
+
+
+ Label
+ proxy
+ ServiceDescription
+ Migration proxy
+ UserName
+ ${_user}
+ GroupName
+ ${_user}
+ ProgramArguments
+
+ /bin/sh
+ -c
+ set -a; if [ -r "${_env}" ]; then . "${_env}"; fi; set +a; exec "${_bin}" "${_config}"
+
+ RunAtLoad
+
+ KeepAlive
+
+
+
+EOF
+ chmod 0644 "$_plist"
+ chown root:wheel "$_plist"
+}
+
+
+get_architecture() {
+ local _ostype _cputype _bitness _arch _clibtype
+ _ostype="$(uname -s)"
+ _cputype="$(uname -m)"
+ _clibtype="gnu"
+
+ if [ "$_ostype" = Linux ]; then
+ if [ "$(uname -o)" = Android ]; then
+ _ostype=Android
+ fi
+ if ldd --version 2>&1 | grep -q 'musl'; then
+ _clibtype="musl"
+ fi
+ fi
+
+ if [ "$_ostype" = Darwin ] && [ "$_cputype" = i386 ]; then
+ # Darwin `uname -m` lies
+ if sysctl hw.optional.x86_64 | grep -q ': 1'; then
+ _cputype=x86_64
+ fi
+ fi
+
+ if [ "$_ostype" = SunOS ]; then
+ # Both Solaris and illumos presently announce as "SunOS" in "uname -s"
+ # so use "uname -o" to disambiguate. We use the full path to the
+ # system uname in case the user has coreutils uname first in PATH,
+ # which has historically sometimes printed the wrong value here.
+ if [ "$(/usr/bin/uname -o)" = illumos ]; then
+ _ostype=illumos
+ fi
+
+ # illumos systems have multi-arch userlands, and "uname -m" reports the
+ # machine hardware name; e.g., "i86pc" on both 32- and 64-bit x86
+ # systems. Check for the native (widest) instruction set on the
+ # running kernel:
+ if [ "$_cputype" = i86pc ]; then
+ _cputype="$(isainfo -n)"
+ fi
+ fi
+
+ case "$_ostype" in
+
+ Android)
+ _ostype=linux-android
+ ;;
+
+ Linux)
+ check_proc
+ _ostype=unknown-linux-$_clibtype
+ _bitness=$(get_bitness)
+ ;;
+
+ FreeBSD)
+ _ostype=unknown-freebsd
+ ;;
+
+ NetBSD)
+ _ostype=unknown-netbsd
+ ;;
+
+ DragonFly)
+ _ostype=unknown-dragonfly
+ ;;
+
+ Darwin)
+ _ostype=apple-darwin
+ ;;
+
+ illumos)
+ _ostype=unknown-illumos
+ ;;
+
+ MINGW* | MSYS* | CYGWIN* | Windows_NT)
+ _ostype=pc-windows-gnu
+ ;;
+
+ *)
+ err "unrecognized OS type: $_ostype"
+ ;;
+
+ esac
+
+ case "$_cputype" in
+
+ i386 | i486 | i686 | i786 | x86)
+ _cputype=i686
+ ;;
+
+ xscale | arm)
+ _cputype=arm
+ if [ "$_ostype" = "linux-android" ]; then
+ _ostype=linux-androideabi
+ fi
+ ;;
+
+ armv6l)
+ _cputype=arm
+ if [ "$_ostype" = "linux-android" ]; then
+ _ostype=linux-androideabi
+ else
+ _ostype="${_ostype}eabihf"
+ fi
+ ;;
+
+ armv7l | armv8l)
+ _cputype=armv7
+ if [ "$_ostype" = "linux-android" ]; then
+ _ostype=linux-androideabi
+ else
+ _ostype="${_ostype}eabihf"
+ fi
+ ;;
+
+ aarch64 | arm64)
+ _cputype=aarch64
+ ;;
+
+ x86_64 | x86-64 | x64 | amd64)
+ _cputype=x86_64
+ ;;
+
+ mips)
+ _cputype=$(get_endianness mips '' el)
+ ;;
+
+ mips64)
+ if [ "$_bitness" -eq 64 ]; then
+ # only n64 ABI is supported for now
+ _ostype="${_ostype}abi64"
+ _cputype=$(get_endianness mips64 '' el)
+ fi
+ ;;
+
+ ppc)
+ _cputype=powerpc
+ ;;
+
+ ppc64)
+ _cputype=powerpc64
+ ;;
+
+ ppc64le)
+ _cputype=powerpc64le
+ ;;
+
+ s390x)
+ _cputype=s390x
+ ;;
+ riscv64)
+ _cputype=riscv64gc
+ ;;
+ *)
+ err "unknown CPU type: $_cputype"
+
+ esac
+
+ # Detect 64-bit linux with 32-bit userland
+ if [ "${_ostype}" = unknown-linux-gnu ] && [ "${_bitness}" -eq 32 ]; then
+ case $_cputype in
+ x86_64)
+ if [ -n "${RUSTUP_CPUTYPE:-}" ]; then
+ _cputype="$RUSTUP_CPUTYPE"
+ else {
+ # 32-bit executable for amd64 = x32
+ if is_host_amd64_elf; then {
+ echo "This host is running an x32 userland; as it stands, x32 support is poor," 1>&2
+ echo "and there isn't a native toolchain -- you will have to install" 1>&2
+ echo "multiarch compatibility with i686 and/or amd64, then select one" 1>&2
+ echo "by re-running this script with the RUSTUP_CPUTYPE environment variable" 1>&2
+ echo "set to i686 or x86_64, respectively." 1>&2
+ echo 1>&2
+ echo "You will be able to add an x32 target after installation by running" 1>&2
+ echo " rustup target add x86_64-unknown-linux-gnux32" 1>&2
+ exit 1
+ }; else
+ _cputype=i686
+ fi
+ }; fi
+ ;;
+ mips64)
+ _cputype=$(get_endianness mips '' el)
+ ;;
+ powerpc64)
+ _cputype=powerpc
+ ;;
+ aarch64)
+ _cputype=armv7
+ if [ "$_ostype" = "linux-android" ]; then
+ _ostype=linux-androideabi
+ else
+ _ostype="${_ostype}eabihf"
+ fi
+ ;;
+ riscv64gc)
+ err "riscv64 with 32-bit userland unsupported"
+ ;;
+ esac
+ fi
+
+ # Detect armv7 but without the CPU features Rust needs in that build,
+ # and fall back to arm.
+ # See https://github.com/rust-lang/rustup.rs/issues/587.
+ if [ "$_ostype" = "unknown-linux-gnueabihf" ] && [ "$_cputype" = armv7 ]; then
+ if ensure grep '^Features' /proc/cpuinfo | grep -q -v neon; then
+ # At least one processor does not have NEON.
+ _cputype=arm
+ fi
+ fi
+
+ _arch="${_cputype}-${_ostype}"
+
+ RETVAL="$_arch"
+}
+
+check_proc() {
+ # Check for /proc by looking for the /proc/self/exe link
+ # This is only run on Linux
+ if ! test -L /proc/self/exe ; then
+ err "fatal: Unable to find /proc/self/exe. Is /proc mounted? Installation cannot proceed without /proc."
+ fi
+}
+
+get_bitness() {
+ need_cmd head
+ # Architecture detection without dependencies beyond coreutils.
+ # ELF files start out "\x7fELF", and the following byte is
+ # 0x01 for 32-bit and
+ # 0x02 for 64-bit.
+ # The printf builtin on some shells like dash only supports octal
+ # escape sequences, so we use those.
+ local _current_exe_head
+ _current_exe_head=$(head -c 5 /proc/self/exe )
+ if [ "$_current_exe_head" = "$(printf '\177ELF\001')" ]; then
+ echo 32
+ elif [ "$_current_exe_head" = "$(printf '\177ELF\002')" ]; then
+ echo 64
+ else
+ err "unknown platform bitness"
+ fi
+}
+
+is_host_amd64_elf() {
+ need_cmd head
+ need_cmd tail
+ # ELF e_machine detection without dependencies beyond coreutils.
+ # Two-byte field at offset 0x12 indicates the CPU,
+ # but we're interested in it being 0x3E to indicate amd64, or not that.
+ local _current_exe_machine
+ _current_exe_machine=$(head -c 19 /proc/self/exe | tail -c 1)
+ [ "$_current_exe_machine" = "$(printf '\076')" ]
+}
+
+get_endianness() {
+ local cputype=$1
+ local suffix_eb=$2
+ local suffix_el=$3
+
+ # detect endianness without od/hexdump, like get_bitness() does.
+ need_cmd head
+ need_cmd tail
+
+ local _current_exe_endianness
+ _current_exe_endianness="$(head -c 6 /proc/self/exe | tail -c 1)"
+ if [ "$_current_exe_endianness" = "$(printf '\001')" ]; then
+ echo "${cputype}${suffix_el}"
+ elif [ "$_current_exe_endianness" = "$(printf '\002')" ]; then
+ echo "${cputype}${suffix_eb}"
+ else
+ err "unknown platform endianness"
+ fi
+}
+
+say() {
+ printf '%s\n' "$1"
+}
+
+err() {
+ say "$1" >&2
+ exit 1
+}
+
+need_cmd() {
+ if ! check_cmd "$1"; then
+ err "need '$1' (command not found)"
+ fi
+}
+
+check_cmd() {
+ command -v "$1" > /dev/null 2>&1
+}
+
+assert_nz() {
+ if [ -z "$1" ]; then err "assert_nz $2"; fi
+}
+
+# Run a command that should never fail. If the command fails execution
+# will immediately terminate with an error showing the failing
+# command.
+ensure() {
+ if ! "$@"; then err "command failed: $*"; fi
+}
+
+# This wraps curl or wget. Try curl first, if not installed,
+# use wget instead.
+downloader() {
+ local _dld
+ local _ciphersuites
+ local _err
+ local _status
+ local _retry
+ if check_cmd curl; then
+ _dld=curl
+ elif check_cmd wget; then
+ _dld=wget
+ else
+ _dld='curl or wget' # to be used in error message of need_cmd
+ fi
+
+ if [ "$1" = --check ]; then
+ need_cmd "$_dld"
+ elif [ "$_dld" = curl ]; then
+ check_curl_for_retry_support
+ _retry="$RETVAL"
+ get_ciphersuites_for_curl
+ _ciphersuites="$RETVAL"
+ if [ -n "$_ciphersuites" ]; then
+ _err=$(curl $_retry --proto '=https' --tlsv1.2 --ciphers "$_ciphersuites" --silent --show-error --fail --location "$1" --output "$2" 2>&1)
+ _status=$?
+ else
+ echo "Warning: Not enforcing strong cipher suites for TLS, this is potentially less secure"
+ if ! check_help_for "$3" curl --proto --tlsv1.2; then
+ echo "Warning: Not enforcing TLS v1.2, this is potentially less secure"
+ _err=$(curl $_retry --silent --show-error --fail --location "$1" --output "$2" 2>&1)
+ _status=$?
+ else
+ _err=$(curl $_retry --proto '=https' --tlsv1.2 --silent --show-error --fail --location "$1" --output "$2" 2>&1)
+ _status=$?
+ fi
+ fi
+ if [ -n "$_err" ]; then
+ if echo "$_err" | grep -q 404; then
+ err "Binary for platform '$3' not found, this platform may be unsupported."
+ else
+ echo "$_err" >&2
+ fi
+ fi
+ return $_status
+ elif [ "$_dld" = wget ]; then
+ if [ "$(wget -V 2>&1|head -2|tail -1|cut -f1 -d" ")" = "BusyBox" ]; then
+ echo "Warning: using the BusyBox version of wget. Not enforcing strong cipher suites for TLS or TLS v1.2, this is potentially less secure"
+ _err=$(wget "$1" -O "$2" 2>&1)
+ _status=$?
+ else
+ get_ciphersuites_for_wget
+ _ciphersuites="$RETVAL"
+ if [ -n "$_ciphersuites" ]; then
+ _err=$(wget --https-only --secure-protocol=TLSv1_2 --ciphers "$_ciphersuites" "$1" -O "$2" 2>&1)
+ _status=$?
+ else
+ echo "Warning: Not enforcing strong cipher suites for TLS, this is potentially less secure"
+ if ! check_help_for "$3" wget --https-only --secure-protocol; then
+ echo "Warning: Not enforcing TLS v1.2, this is potentially less secure"
+ _err=$(wget "$1" -O "$2" 2>&1)
+ _status=$?
+ else
+ _err=$(wget --https-only --secure-protocol=TLSv1_2 "$1" -O "$2" 2>&1)
+ _status=$?
+ fi
+ fi
+ fi
+ if [ -n "$_err" ]; then
+ if echo "$_err" | grep -q ' 404 Not Found'; then
+ err "Binary for platform '$3' not found, this platform may be unsupported."
+ else
+ echo "$_err" >&2
+ fi
+ fi
+ return $_status
+ else
+ err "Unknown downloader" # should not reach here
+ fi
+}
+
+# Check if curl supports the --retry flag, then pass it to the curl invocation.
+check_curl_for_retry_support() {
+ local _retry_supported=""
+ # "unspecified" is for arch, allows for possibility old OS using macports, homebrew, etc.
+ if check_help_for "notspecified" "curl" "--retry"; then
+ _retry_supported="--retry 3"
+ fi
+
+ RETVAL="$_retry_supported"
+
+}
+
+check_help_for() {
+ local _arch
+ local _cmd
+ local _arg
+ _arch="$1"
+ shift
+ _cmd="$1"
+ shift
+
+ local _category
+ if "$_cmd" --help | grep -q 'For all options use the manual or "--help all".'; then
+ _category="all"
+ else
+ _category=""
+ fi
+
+ case "$_arch" in
+
+ *darwin*)
+ if check_cmd sw_vers; then
+ case $(sw_vers -productVersion) in
+ 10.*)
+ # If we're running on macOS, older than 10.13, then we always
+ # fail to find these options to force fallback
+ if [ "$(sw_vers -productVersion | cut -d. -f2)" -lt 13 ]; then
+ # Older than 10.13
+ echo "Warning: Detected macOS platform older than 10.13"
+ return 1
+ fi
+ ;;
+ 11.*)
+ # We assume Big Sur will be OK for now
+ ;;
+ *)
+ # Unknown product version, warn and continue
+ echo "Warning: Detected unknown macOS major version: $(sw_vers -productVersion)"
+ echo "Warning TLS capabilities detection may fail"
+ ;;
+ esac
+ fi
+ ;;
+
+ esac
+
+ for _arg in "$@"; do
+ if ! "$_cmd" --help $_category | grep -q -- "$_arg"; then
+ return 1
+ fi
+ done
+
+ true # not strictly needed
+}
+
+# Return cipher suite string specified by user, otherwise return strong TLS 1.2-1.3 cipher suites
+# if support by local tools is detected. Detection currently supports these curl backends:
+# GnuTLS and OpenSSL (possibly also LibreSSL and BoringSSL). Return value can be empty.
+get_ciphersuites_for_curl() {
+ if [ -n "${RUSTUP_TLS_CIPHERSUITES-}" ]; then
+ # user specified custom cipher suites, assume they know what they're doing
+ RETVAL="$RUSTUP_TLS_CIPHERSUITES"
+ return
+ fi
+
+ local _openssl_syntax="no"
+ local _gnutls_syntax="no"
+ local _backend_supported="yes"
+ if curl -V | grep -q ' OpenSSL/'; then
+ _openssl_syntax="yes"
+ elif curl -V | grep -iq ' LibreSSL/'; then
+ _openssl_syntax="yes"
+ elif curl -V | grep -iq ' BoringSSL/'; then
+ _openssl_syntax="yes"
+ elif curl -V | grep -iq ' GnuTLS/'; then
+ _gnutls_syntax="yes"
+ else
+ _backend_supported="no"
+ fi
+
+ local _args_supported="no"
+ if [ "$_backend_supported" = "yes" ]; then
+ # "unspecified" is for arch, allows for possibility old OS using macports, homebrew, etc.
+ if check_help_for "notspecified" "curl" "--tlsv1.2" "--ciphers" "--proto"; then
+ _args_supported="yes"
+ fi
+ fi
+
+ local _cs=""
+ if [ "$_args_supported" = "yes" ]; then
+ if [ "$_openssl_syntax" = "yes" ]; then
+ _cs=$(get_strong_ciphersuites_for "openssl")
+ elif [ "$_gnutls_syntax" = "yes" ]; then
+ _cs=$(get_strong_ciphersuites_for "gnutls")
+ fi
+ fi
+
+ RETVAL="$_cs"
+}
+
+# Return cipher suite string specified by user, otherwise return strong TLS 1.2-1.3 cipher suites
+# if support by local tools is detected. Detection currently supports these wget backends:
+# GnuTLS and OpenSSL (possibly also LibreSSL and BoringSSL). Return value can be empty.
+get_ciphersuites_for_wget() {
+ if [ -n "${RUSTUP_TLS_CIPHERSUITES-}" ]; then
+ # user specified custom cipher suites, assume they know what they're doing
+ RETVAL="$RUSTUP_TLS_CIPHERSUITES"
+ return
+ fi
+
+ local _cs=""
+ if wget -V | grep -q '\-DHAVE_LIBSSL'; then
+ # "unspecified" is for arch, allows for possibility old OS using macports, homebrew, etc.
+ if check_help_for "notspecified" "wget" "TLSv1_2" "--ciphers" "--https-only" "--secure-protocol"; then
+ _cs=$(get_strong_ciphersuites_for "openssl")
+ fi
+ elif wget -V | grep -q '\-DHAVE_LIBGNUTLS'; then
+ # "unspecified" is for arch, allows for possibility old OS using macports, homebrew, etc.
+ if check_help_for "notspecified" "wget" "TLSv1_2" "--ciphers" "--https-only" "--secure-protocol"; then
+ _cs=$(get_strong_ciphersuites_for "gnutls")
+ fi
+ fi
+
+ RETVAL="$_cs"
+}
+
+# Return strong TLS 1.2-1.3 cipher suites in OpenSSL or GnuTLS syntax. TLS 1.2
+# excludes non-ECDHE and non-AEAD cipher suites. DHE is excluded due to bad
+# DH params often found on servers (see RFC 7919). Sequence matches or is
+# similar to Firefox 68 ESR with weak cipher suites disabled via about:config.
+# $1 must be openssl or gnutls.
+get_strong_ciphersuites_for() {
+ if [ "$1" = "openssl" ]; then
+ # OpenSSL is forgiving of unknown values, no problems with TLS 1.3 values on versions that don't support it yet.
+ echo "TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384"
+ elif [ "$1" = "gnutls" ]; then
+ # GnuTLS isn't forgiving of unknown values, so this may require a GnuTLS version that supports TLS 1.3 even if wget doesn't.
+ # Begin with SECURE128 (and higher) then remove/add to build cipher suites. Produces same 9 cipher suites as OpenSSL but in slightly different order.
+ echo "SECURE128:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS-ALL:-CIPHER-ALL:-MAC-ALL:-KX-ALL:+AEAD:+ECDHE-ECDSA:+ECDHE-RSA:+AES-128-GCM:+CHACHA20-POLY1305:+AES-256-GCM"
+ fi
+}
+
+# This is just for indicating that commands' results are being
+# intentionally ignored. Usually, because it's being executed
+# as part of error handling.
+ignore() {
+ "$@"
+}
+
+main "$@" || exit 1
diff --git a/resources/config.sample.toml b/resources/config.sample.toml
new file mode 100644
index 0000000..c6a1c1b
--- /dev/null
+++ b/resources/config.sample.toml
@@ -0,0 +1,167 @@
+# Migration proxy sample configuration.
+#
+# This is a starting template. Edit the destinations, mappings, TLS
+# certificates and admin token to match your deployment, then start the
+# service. The proxy refuses to boot until every referenced destination,
+# certificate and credential path is valid (see SPEC section 8.4).
+#
+# Run with: proxy /etc/proxy/config.toml
+# Or set: PROXY_CONFIG=/etc/proxy/config.toml
+
+[server]
+# Worker threads (0 = one per CPU).
+threads = 0
+# Hostname advertised in protocol greetings; defaults to the local IP.
+hostname = "proxy.example.com"
+shutdown_grace = "30s"
+log_level = "info"
+
+# TLS certificates used to TERMINATE inbound implicit-TLS and STARTTLS.
+# Multiple certificates are selected by SNI. Mark one as the default.
+[tls.certificate.default]
+cert = "/etc/proxy/tls/fullchain.pem"
+key = "/etc/proxy/tls/privkey.pem"
+default = true
+
+[tls.protocols]
+min_version = "1.2"
+
+# ---------------------------------------------------------------------------
+# Routing: which destination handles an identifier when it is missing or
+# unmapped, and (optionally) where raw SMTP/25 and LMTP/24 traffic is sent.
+# ---------------------------------------------------------------------------
+[routing]
+default_destination = "legacy"
+# smtp_passthrough_destination = "stalwart"
+
+# ---------------------------------------------------------------------------
+# Mappings: identifier -> destination id. Source is "file", "redis" or "sql".
+# ---------------------------------------------------------------------------
+[mapping]
+source = "file"
+normalize = "lowercase"
+negative_ttl = "30s"
+positive_ttl = "10m"
+
+[mapping.file]
+path = "/etc/proxy/mappings.tsv"
+
+# [mapping.redis]
+# url = "redis://10.0.0.5:6379"
+# key_prefix = "route:"
+
+# [mapping.sql]
+# url = "postgres://user:pass@10.0.0.6/proxy"
+# query = "SELECT destination FROM routes WHERE identifier = $1"
+
+# ---------------------------------------------------------------------------
+# Destinations. The default destination must support every listener protocol
+# declared below. Each destination lists the per-protocol backend port and the
+# TLS mode the proxy must use on the OUTBOUND leg.
+# ---------------------------------------------------------------------------
+[destination.legacy]
+host = "10.0.1.10"
+tls_server_name = "mail.legacy.example.com"
+proxy_protocol = true
+
+[destination.legacy.protocol.imap]
+port = 993
+tls = "implicit"
+[destination.legacy.protocol.pop3]
+port = 995
+tls = "implicit"
+[destination.legacy.protocol.submission]
+port = 587
+tls = "starttls"
+[destination.legacy.protocol.managesieve]
+port = 4190
+tls = "starttls"
+[destination.legacy.protocol.http]
+port = 443
+tls = "implicit"
+
+[destination.stalwart]
+host = "10.0.1.20"
+tls_server_name = "mail.new.example.com"
+proxy_protocol = true
+
+[destination.stalwart.protocol.imap]
+port = 993
+tls = "implicit"
+[destination.stalwart.protocol.pop3]
+port = 995
+tls = "implicit"
+[destination.stalwart.protocol.submission]
+port = 587
+tls = "starttls"
+[destination.stalwart.protocol.managesieve]
+port = 4190
+tls = "starttls"
+[destination.stalwart.protocol.http]
+port = 443
+tls = "implicit"
+
+# ---------------------------------------------------------------------------
+# Listeners: one entry per protocol + TLS mode + bind set.
+# tls = "implicit" | "starttls" | "plain".
+# ---------------------------------------------------------------------------
+[listener.imap]
+protocol = "imap"
+bind = ["0.0.0.0:993", "[::]:993"]
+tls = "implicit"
+
+[listener.imap-starttls]
+protocol = "imap"
+bind = ["0.0.0.0:143", "[::]:143"]
+tls = "starttls"
+
+[listener.pop3]
+protocol = "pop3"
+bind = ["0.0.0.0:995", "[::]:995"]
+tls = "implicit"
+
+[listener.submission]
+protocol = "submission"
+bind = ["0.0.0.0:587", "[::]:587"]
+tls = "starttls"
+
+[listener.submissions]
+protocol = "submission"
+bind = ["0.0.0.0:465", "[::]:465"]
+tls = "implicit"
+
+[listener.managesieve]
+protocol = "managesieve"
+bind = ["0.0.0.0:4190", "[::]:4190"]
+tls = "starttls"
+
+[listener.https]
+protocol = "http"
+bind = ["0.0.0.0:443", "[::]:443"]
+tls = "implicit"
+forwarded = "off"
+
+# ---------------------------------------------------------------------------
+# HTTP routing rules. First match wins. A rule pins a destination by path, or
+# extracts an account identifier and routes it through the mapping store.
+# ---------------------------------------------------------------------------
+[[http.route]]
+match = "/.well-known/**"
+destination = "legacy"
+
+[[http.route]]
+match = "/**"
+extract = { from = "authorization" }
+fallback = "default"
+
+# ---------------------------------------------------------------------------
+# Admin listener: the cache-integrity boundary. Bind to loopback or a dedicated
+# management network only. TLS is mandatory; plaintext admin is rejected.
+# ---------------------------------------------------------------------------
+[admin]
+bind = "127.0.0.1:9443"
+tls = "implicit"
+bearer_token_file = "/etc/proxy/admin.token"
+min_token_len = 32
+lockout_threshold = 5
+lockout_duration = "5m"
diff --git a/src/admin.rs b/src/admin.rs
new file mode 100644
index 0000000..45e28c4
--- /dev/null
+++ b/src/admin.rs
@@ -0,0 +1,678 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use std::collections::HashMap;
+use std::net::IpAddr;
+use std::sync::Arc;
+use std::sync::atomic::Ordering::Relaxed;
+use std::time::{Duration, Instant};
+
+use arc_swap::ArcSwap;
+use parking_lot::Mutex;
+
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::net::TcpListener;
+use tokio_rustls::TlsAcceptor;
+
+use crate::config::{AdminConfig, Config};
+use crate::error::{ProxyError, Result};
+use crate::proto::common::Ctx;
+
+type Shared = Arc>;
+
+const MAX_HEAD: usize = 16 * 1024;
+
+const LOCKOUT_MAX_ENTRIES: usize = 16 * 1024;
+
+struct Lockout {
+ failures: HashMap,
+ threshold: u32,
+ duration: Duration,
+}
+
+impl Lockout {
+ fn is_locked(&self, ip: &IpAddr) -> bool {
+ match self.failures.get(ip) {
+ Some((count, since)) => *count >= self.threshold && since.elapsed() < self.duration,
+ None => false,
+ }
+ }
+
+ fn record_failure(&mut self, ip: IpAddr) {
+ if self.failures.len() >= LOCKOUT_MAX_ENTRIES {
+ let duration = self.duration;
+ self.failures
+ .retain(|_, (_, since)| since.elapsed() < duration);
+ }
+ let entry = self.failures.entry(ip).or_insert((0, Instant::now()));
+ if entry.1.elapsed() >= self.duration {
+ *entry = (0, Instant::now());
+ }
+ entry.0 += 1;
+ entry.1 = Instant::now();
+ }
+
+ fn record_success(&mut self, ip: &IpAddr) {
+ self.failures.remove(ip);
+ }
+}
+
+pub fn load_token(admin: &AdminConfig) -> Result {
+ let token = if let Ok(env) = std::env::var("PROXY_ADMIN_TOKEN") {
+ env
+ } else if let Some(path) = &admin.bearer_token_file {
+ std::fs::read_to_string(path)
+ .map_err(|e| ProxyError::config(format!("failed to read admin token {path}: {e}")))?
+ .trim()
+ .to_string()
+ } else if let Some(inline) = &admin.bearer_token {
+ inline.clone()
+ } else {
+ return Err(ProxyError::config("admin token not configured"));
+ };
+ if token.len() < admin.min_token_len {
+ return Err(ProxyError::config(format!(
+ "admin token is shorter than min_token_len ({})",
+ admin.min_token_len
+ )));
+ }
+ Ok(token)
+}
+
+fn ct_eq(a: &[u8], b: &[u8]) -> bool {
+ if a.len() != b.len() {
+ return false;
+ }
+ let mut diff = 0u8;
+ for (x, y) in a.iter().zip(b) {
+ diff |= x ^ y;
+ }
+ diff == 0
+}
+
+pub async fn run(shared: Shared, config: Arc, config_path: Option>) -> Result<()> {
+ let admin = config
+ .admin
+ .as_ref()
+ .ok_or_else(|| ProxyError::config("admin not configured"))?;
+ let listener = TcpListener::bind(admin.bind)
+ .await
+ .map_err(|e| ProxyError::config(format!("admin bind {}: {e}", admin.bind)))?;
+ tracing::info!(bind = %admin.bind, "admin listener started");
+ serve(shared, config, config_path, listener).await
+}
+
+pub async fn serve(
+ shared: Shared,
+ config: Arc,
+ config_path: Option>,
+ listener: TcpListener,
+) -> Result<()> {
+ let admin = config
+ .admin
+ .as_ref()
+ .ok_or_else(|| ProxyError::config("admin not configured"))?;
+ let token = Arc::new(load_token(admin)?);
+ let acceptor = shared
+ .load()
+ .tls_acceptor
+ .clone()
+ .ok_or_else(|| ProxyError::tls("admin requires TLS but no acceptor available"))?;
+
+ let lockout = Arc::new(Mutex::new(Lockout {
+ failures: HashMap::new(),
+ threshold: admin.lockout_threshold,
+ duration: admin.lockout_duration,
+ }));
+
+ loop {
+ let (tcp, peer) = match listener.accept().await {
+ Ok(p) => p,
+ Err(e) => {
+ tracing::warn!(error = %e, "admin accept failed");
+ continue;
+ }
+ };
+ let acceptor = acceptor.clone();
+ let token = token.clone();
+ let shared = shared.clone();
+ let lockout = lockout.clone();
+ let config_path = config_path.clone();
+ tokio::spawn(async move {
+ if let Err(e) = handle(
+ acceptor,
+ tcp,
+ peer.ip(),
+ token,
+ shared,
+ lockout,
+ config_path,
+ )
+ .await
+ {
+ tracing::debug!(error = %e, "admin request ended");
+ }
+ });
+ }
+}
+
+async fn handle(
+ acceptor: TlsAcceptor,
+ tcp: tokio::net::TcpStream,
+ ip: IpAddr,
+ token: Arc,
+ shared: Shared,
+ lockout: Arc>,
+ config_path: Option>,
+) -> Result<()> {
+ let mut stream = acceptor
+ .accept(tcp)
+ .await
+ .map_err(|e| ProxyError::tls(format!("admin TLS handshake: {e}")))?;
+
+ if lockout.lock().is_locked(&ip) {
+ let _ = write_response(&mut stream, 429, "Too Many Requests", "locked out\n").await;
+ return Ok(());
+ }
+
+ let head = read_head(&mut stream).await?;
+ let request = match parse_request(&head) {
+ Some(r) => r,
+ None => {
+ write_response(&mut stream, 400, "Bad Request", "bad request\n").await?;
+ return Ok(());
+ }
+ };
+
+ if request.path == "/healthz" {
+ match request.method.as_str() {
+ "GET" => write_response(&mut stream, 200, "OK", "ok\n").await?,
+ _ => {
+ write_response(&mut stream, 405, "Method Not Allowed", "method not allowed\n")
+ .await?
+ }
+ }
+ return Ok(());
+ }
+
+ if !authorized(&request, &token) {
+ lockout.lock().record_failure(ip);
+ tracing::warn!(%ip, path = %request.path, "admin 401 unauthorized");
+ write_response(&mut stream, 401, "Unauthorized", "unauthorized\n").await?;
+ return Ok(());
+ }
+ lockout.lock().record_success(&ip);
+
+ let ctx = shared.load_full();
+
+ match (request.method.as_str(), request.path.as_str()) {
+ ("GET", "/stats") => {
+ let hits = ctx.router.stats.hits.load(Relaxed);
+ let misses = ctx.router.stats.misses.load(Relaxed);
+ let total = hits + misses;
+ let hit_rate = if total > 0 {
+ (hits as f64 / total as f64) * 100.0
+ } else {
+ 0.0
+ };
+ let body = serde_json::json!({
+ "cache_hits": hits,
+ "cache_misses": misses,
+ "hit_rate_pct": hit_rate,
+ "cache_entries": ctx.router.cache_entries(),
+ "active_connections": ctx.metrics.active_connections.load(Relaxed),
+ })
+ .to_string();
+ write_json(&mut stream, 200, &body).await?;
+ }
+ ("GET", "/destinations") => {
+ let list: Vec<_> = ctx
+ .dest_health
+ .iter()
+ .map(|(id, health)| {
+ let s = health.snapshot();
+ serde_json::json!({
+ "destination": id,
+ "consecutive_failures": s.consecutive_failures,
+ "down": s.down,
+ })
+ })
+ .collect();
+ let body = serde_json::json!({ "destinations": list }).to_string();
+ write_json(&mut stream, 200, &body).await?;
+ }
+ ("POST", "/destinations/reset") => match request.query_param("destination") {
+ Some(dest) => match ctx.dest_health.get(&dest) {
+ Some(health) => {
+ health.reset();
+ tracing::info!(destination = %dest, "admin reset destination health");
+ write_response(&mut stream, 200, "OK", "ok\n").await?;
+ }
+ None => {
+ write_response(&mut stream, 404, "Not Found", "unknown destination\n").await?;
+ }
+ },
+ None => {
+ write_response(&mut stream, 400, "Bad Request", "destination required\n").await?;
+ }
+ },
+ ("GET", "/mappings") => match request.query_param("identifier") {
+ Some(id) => {
+ let d = ctx.router.diagnose(&id).await;
+ let body = serde_json::json!({
+ "identifier": id,
+ "normalized": d.normalized,
+ "destination": d.destination,
+ "routed_to_default": d.routed_to_default,
+ "cached": d.cached,
+ })
+ .to_string();
+ write_json(&mut stream, 200, &body).await?;
+ }
+ None => {
+ write_response(&mut stream, 400, "Bad Request", "identifier required\n").await?;
+ }
+ },
+ ("PUT", "/mappings") => {
+ match (
+ request.query_param("identifier"),
+ request.query_param("destination"),
+ ) {
+ (Some(id), Some(dest)) => {
+ if !ctx.router.store_writable() {
+ write_response(
+ &mut stream,
+ 501,
+ "Not Implemented",
+ "mapping store is read-only\n",
+ )
+ .await?;
+ } else if !ctx.router.is_valid_destination(&dest) {
+ write_response(&mut stream, 400, "Bad Request", "unknown destination\n")
+ .await?;
+ } else {
+ match ctx.router.upsert(&id, &dest).await {
+ Ok(()) => {
+ tracing::info!(identifier = %crate::observe::redact(&id), %dest, "admin upserted mapping");
+ write_response(&mut stream, 200, "OK", "ok\n").await?;
+ }
+ Err(e) => {
+ tracing::warn!(error = %e, "admin mapping upsert failed");
+ write_response(
+ &mut stream,
+ 500,
+ "Internal Server Error",
+ "upsert failed\n",
+ )
+ .await?;
+ }
+ }
+ }
+ }
+ _ => {
+ write_response(
+ &mut stream,
+ 400,
+ "Bad Request",
+ "identifier and destination required\n",
+ )
+ .await?;
+ }
+ }
+ }
+ ("DELETE", "/mappings") => match request.query_param("identifier") {
+ Some(id) => {
+ if !ctx.router.store_writable() {
+ write_response(
+ &mut stream,
+ 501,
+ "Not Implemented",
+ "mapping store is read-only\n",
+ )
+ .await?;
+ } else {
+ match ctx.router.remove(&id).await {
+ Ok(existed) => {
+ tracing::info!(identifier = %crate::observe::redact(&id), existed, "admin removed mapping");
+ let body = if existed { "removed\n" } else { "absent\n" };
+ write_response(&mut stream, 200, "OK", body).await?;
+ }
+ Err(e) => {
+ tracing::warn!(error = %e, "admin mapping remove failed");
+ write_response(
+ &mut stream,
+ 500,
+ "Internal Server Error",
+ "remove failed\n",
+ )
+ .await?;
+ }
+ }
+ }
+ }
+ None => {
+ write_response(&mut stream, 400, "Bad Request", "identifier required\n").await?;
+ }
+ },
+ ("POST", "/config/reload") => match &config_path {
+ None => {
+ write_response(
+ &mut stream,
+ 503,
+ "Service Unavailable",
+ "config reload not available\n",
+ )
+ .await?;
+ }
+ Some(path) => match reload_config(&shared, path).await {
+ Ok(()) => {
+ tracing::info!("admin reloaded configuration");
+ let body = serde_json::json!({
+ "reloaded": true,
+ "note": "listener binds/protocols, admin bind/token, and cache capacity/TTLs require a restart to change",
+ })
+ .to_string();
+ write_json(&mut stream, 200, &body).await?;
+ }
+ Err(e) => {
+ tracing::warn!(error = %e, "admin config reload failed");
+ write_response(
+ &mut stream,
+ 400,
+ "Bad Request",
+ &format!("reload failed: {e}\n"),
+ )
+ .await?;
+ }
+ },
+ },
+ ("POST", "/cache/invalidate") => {
+ match request.query_param("identifier") {
+ Some(id) => {
+ ctx.router.invalidate(&id).await;
+ tracing::info!(identifier = %crate::observe::redact(&id), "admin invalidated entry");
+ }
+ None => {
+ ctx.router.invalidate_all();
+ tracing::info!("admin invalidated entire cache");
+ }
+ }
+ write_response(&mut stream, 200, "OK", "ok\n").await?;
+ }
+ ("POST", "/mappings/reload") => match ctx.router.reload().await {
+ Ok(()) => {
+ tracing::info!("admin reloaded mappings");
+ write_response(&mut stream, 200, "OK", "reloaded\n").await?;
+ }
+ Err(e) => {
+ tracing::warn!(error = %e, "admin reload failed");
+ write_response(&mut stream, 500, "Internal Server Error", "reload failed\n")
+ .await?;
+ }
+ },
+ ("POST", "/connections/kick") => match request.query_param("identifier") {
+ Some(id) => {
+ let count = ctx.conns.kick(&ctx.router.normalize(&id));
+ tracing::info!(identifier = %crate::observe::redact(&id), count, "admin kicked connections");
+ write_response(&mut stream, 200, "OK", &format!("kicked {count}\n")).await?;
+ }
+ None => {
+ write_response(&mut stream, 400, "Bad Request", "identifier required\n").await?;
+ }
+ },
+ ("POST", "/connections/delay") => {
+ match (
+ request.query_param("identifier"),
+ request.query_param("seconds"),
+ ) {
+ (Some(id), Some(secs)) => match secs.parse::() {
+ Ok(seconds) => {
+ let until =
+ std::time::Instant::now() + std::time::Duration::from_secs(seconds);
+ ctx.conns.set_delay(&ctx.router.normalize(&id), until);
+ tracing::info!(identifier = %crate::observe::redact(&id), seconds, "admin set login delay");
+ write_response(&mut stream, 200, "OK", "ok\n").await?;
+ }
+ Err(_) => {
+ write_response(&mut stream, 400, "Bad Request", "invalid seconds\n")
+ .await?;
+ }
+ },
+ _ => {
+ write_response(
+ &mut stream,
+ 400,
+ "Bad Request",
+ "identifier and seconds required\n",
+ )
+ .await?;
+ }
+ }
+ }
+ (_, "/stats")
+ | (_, "/destinations")
+ | (_, "/destinations/reset")
+ | (_, "/mappings")
+ | (_, "/cache/invalidate")
+ | (_, "/mappings/reload")
+ | (_, "/connections/kick")
+ | (_, "/connections/delay")
+ | (_, "/config/reload") => {
+ write_response(
+ &mut stream,
+ 405,
+ "Method Not Allowed",
+ "method not allowed\n",
+ )
+ .await?;
+ }
+ _ => {
+ write_response(&mut stream, 404, "Not Found", "not found\n").await?;
+ }
+ }
+ Ok(())
+}
+
+struct AdminRequest {
+ method: String,
+ path: String,
+ query: String,
+ auth: Option,
+}
+
+impl AdminRequest {
+ fn query_param(&self, key: &str) -> Option {
+ for pair in self.query.split('&') {
+ if let Some((k, v)) = pair.split_once('=')
+ && k == key
+ {
+ return Some(
+ percent_encoding::percent_decode_str(v)
+ .decode_utf8_lossy()
+ .into_owned(),
+ );
+ }
+ }
+ None
+ }
+}
+
+fn authorized(request: &AdminRequest, token: &str) -> bool {
+ match &request.auth {
+ Some(value) => value
+ .strip_prefix("Bearer ")
+ .map(|t| ct_eq(t.trim().as_bytes(), token.as_bytes()))
+ .unwrap_or(false),
+ None => false,
+ }
+}
+
+fn parse_request(head: &[u8]) -> Option {
+ let text = std::str::from_utf8(head).ok()?;
+ let mut lines = text.split("\r\n");
+ let request_line = lines.next()?;
+ let mut parts = request_line.split(' ');
+ let method = parts.next()?.to_string();
+ let target = parts.next()?;
+ let (raw_path, query) = match target.split_once('?') {
+ Some((p, q)) => (p, q.to_string()),
+ None => (target, String::new()),
+ };
+ let trimmed = raw_path.trim_end_matches('/');
+ let path = if trimmed.is_empty() {
+ "/".to_string()
+ } else {
+ trimmed.to_string()
+ };
+ let mut auth = None;
+ for line in lines {
+ if let Some((name, value)) = line.split_once(':')
+ && name.eq_ignore_ascii_case("authorization")
+ {
+ auth = Some(value.trim().to_string());
+ }
+ }
+ Some(AdminRequest {
+ method,
+ path,
+ query,
+ auth,
+ })
+}
+
+async fn read_head(stream: &mut S) -> Result> {
+ let mut buf = Vec::with_capacity(1024);
+ let mut scratch = [0u8; 1024];
+ loop {
+ if let Some(pos) = find_double_crlf(&buf) {
+ buf.truncate(pos);
+ return Ok(buf);
+ }
+ if buf.len() > MAX_HEAD {
+ return Err(ProxyError::protocol("admin request head too large"));
+ }
+ let n = stream
+ .read(&mut scratch)
+ .await
+ .map_err(|e| ProxyError::protocol(format!("admin read: {e}")))?;
+ if n == 0 {
+ return Err(ProxyError::Closed);
+ }
+ buf.extend_from_slice(&scratch[..n]);
+ }
+}
+
+fn find_double_crlf(buf: &[u8]) -> Option {
+ buf.windows(4).position(|w| w == b"\r\n\r\n").map(|p| p + 4)
+}
+
+async fn write_response(
+ stream: &mut S,
+ code: u16,
+ reason: &str,
+ body: &str,
+) -> Result<()> {
+ write_body(stream, code, reason, "text/plain", body).await
+}
+
+async fn write_json(stream: &mut S, code: u16, body: &str) -> Result<()> {
+ let reason = match code {
+ 200 => "OK",
+ 400 => "Bad Request",
+ 404 => "Not Found",
+ 500 => "Internal Server Error",
+ _ => "OK",
+ };
+ write_body(stream, code, reason, "application/json", body).await
+}
+
+async fn write_body(
+ stream: &mut S,
+ code: u16,
+ reason: &str,
+ content_type: &str,
+ body: &str,
+) -> Result<()> {
+ let response = format!(
+ "HTTP/1.1 {code} {reason}\r\nContent-Length: {}\r\nConnection: close\r\nContent-Type: {content_type}\r\n\r\n{body}",
+ body.len()
+ );
+ stream
+ .write_all(response.as_bytes())
+ .await
+ .map_err(|e| ProxyError::protocol(format!("admin write: {e}")))?;
+ let _ = stream.flush().await;
+ let _ = stream.shutdown().await;
+ Ok(())
+}
+
+async fn reload_config(shared: &Shared, path: &str) -> Result<()> {
+ let raw = tokio::fs::read_to_string(path)
+ .await
+ .map_err(|e| ProxyError::config(format!("read config {path}: {e}")))?;
+ let config = Arc::new(Config::parse_and_validate(&raw)?);
+ let provider = crate::net::tls::provider();
+ let current = shared.load_full();
+ let conns = current.conns.clone();
+ let metrics = current.metrics.clone();
+ let ctx = crate::server::build_ctx(config, &provider, conns, metrics).await?;
+ shared.store(Arc::new(ctx));
+ Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+
+ #[test]
+ fn constant_time_eq() {
+ assert!(ct_eq(b"abc", b"abc"));
+ assert!(!ct_eq(b"abc", b"abd"));
+ assert!(!ct_eq(b"abc", b"ab"));
+ }
+
+ #[test]
+ fn parse_basic_request() {
+ let head = b"POST /cache/invalidate?identifier=user%40example.com HTTP/1.1\r\nHost: x\r\nAuthorization: Bearer secret\r\n";
+ let req = parse_request(head).unwrap();
+ assert_eq!(req.method, "POST");
+ assert_eq!(req.path, "/cache/invalidate");
+ assert_eq!(
+ req.query_param("identifier").as_deref(),
+ Some("user@example.com")
+ );
+ assert_eq!(req.auth.as_deref(), Some("Bearer secret"));
+ }
+
+ #[test]
+ fn parse_trims_trailing_slash() {
+ let req = parse_request(b"GET /stats/ HTTP/1.1\r\nHost: x\r\n").unwrap();
+ assert_eq!(req.path, "/stats");
+ let req = parse_request(b"GET /cache/invalidate/?identifier=a HTTP/1.1\r\nHost: x\r\n")
+ .unwrap();
+ assert_eq!(req.path, "/cache/invalidate");
+ assert_eq!(req.query_param("identifier").as_deref(), Some("a"));
+ let req = parse_request(b"GET / HTTP/1.1\r\nHost: x\r\n").unwrap();
+ assert_eq!(req.path, "/");
+ }
+
+ #[test]
+ fn lockout_after_threshold() {
+ let mut l = Lockout {
+ failures: HashMap::new(),
+ threshold: 2,
+ duration: Duration::from_secs(60),
+ };
+ let ip: IpAddr = "10.0.0.1".parse().unwrap();
+ assert!(!l.is_locked(&ip));
+ l.record_failure(ip);
+ assert!(!l.is_locked(&ip));
+ l.record_failure(ip);
+ assert!(l.is_locked(&ip));
+ l.record_success(&ip);
+ assert!(!l.is_locked(&ip));
+ }
+}
diff --git a/src/config/duration.rs b/src/config/duration.rs
new file mode 100644
index 0000000..3dfb9cb
--- /dev/null
+++ b/src/config/duration.rs
@@ -0,0 +1,74 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use std::time::Duration;
+
+use serde::{Deserialize, Deserializer};
+
+pub fn parse_duration(s: &str) -> Result {
+ let s = s.trim();
+ if s.is_empty() {
+ return Err("empty duration".into());
+ }
+ let split = s
+ .find(|c: char| c.is_ascii_alphabetic())
+ .ok_or_else(|| format!("missing duration unit in {s:?}"))?;
+ let (num, unit) = s.split_at(split);
+ let value: u64 = num
+ .trim()
+ .parse()
+ .map_err(|_| format!("invalid duration value in {s:?}"))?;
+ let multiplier = match unit.trim() {
+ "ms" => return Ok(Duration::from_millis(value)),
+ "s" => 1,
+ "m" => 60,
+ "h" => 3600,
+ "d" => 86400,
+ other => return Err(format!("unknown duration unit {other:?}")),
+ };
+ let secs = value
+ .checked_mul(multiplier)
+ .ok_or_else(|| format!("duration overflow in {s:?}"))?;
+ Ok(Duration::from_secs(secs))
+}
+
+pub fn deserialize<'de, D>(deserializer: D) -> Result
+where
+ D: Deserializer<'de>,
+{
+ let s = String::deserialize(deserializer)?;
+ parse_duration(&s).map_err(serde::de::Error::custom)
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+
+ #[test]
+ fn parses_units() {
+ assert_eq!(parse_duration("30s").unwrap(), Duration::from_secs(30));
+ assert_eq!(parse_duration("10m").unwrap(), Duration::from_secs(600));
+ assert_eq!(parse_duration("5m").unwrap(), Duration::from_secs(300));
+ assert_eq!(parse_duration("1h").unwrap(), Duration::from_secs(3600));
+ assert_eq!(parse_duration("250ms").unwrap(), Duration::from_millis(250));
+ assert!(parse_duration("").is_err());
+ assert!(parse_duration("10x").is_err());
+ assert!(parse_duration("abc").is_err());
+ }
+
+ #[test]
+ fn rejects_overflow_instead_of_wrapping() {
+ let err = parse_duration("100000000000000000000d").unwrap_err();
+ assert!(err.contains("invalid duration value") || err.contains("overflow"));
+ let err = parse_duration("18446744073709551615d").unwrap_err();
+ assert!(err.contains("overflow"));
+ }
+
+ #[test]
+ fn trims_surrounding_whitespace() {
+ assert_eq!(parse_duration(" 30s ").unwrap(), Duration::from_secs(30));
+ }
+}
diff --git a/src/config/mod.rs b/src/config/mod.rs
new file mode 100644
index 0000000..3bc63da
--- /dev/null
+++ b/src/config/mod.rs
@@ -0,0 +1,965 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+pub mod duration;
+
+use std::net::{IpAddr, SocketAddr};
+use std::time::Duration;
+
+use ahash::AHashMap;
+use serde::Deserialize;
+
+use crate::error::{ProxyError, Result};
+use crate::net::cidr::Cidr;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Protocol {
+ Smtp,
+ Submission,
+ Lmtp,
+ Imap,
+ Pop3,
+ #[serde(rename = "managesieve")]
+ ManageSieve,
+ Http,
+}
+
+impl Protocol {
+ pub fn as_str(&self) -> &'static str {
+ match self {
+ Protocol::Smtp => "smtp",
+ Protocol::Submission => "submission",
+ Protocol::Lmtp => "lmtp",
+ Protocol::Imap => "imap",
+ Protocol::Pop3 => "pop3",
+ Protocol::ManageSieve => "managesieve",
+ Protocol::Http => "http",
+ }
+ }
+
+ pub fn is_credential_bearing(&self) -> bool {
+ matches!(
+ self,
+ Protocol::Imap
+ | Protocol::Pop3
+ | Protocol::ManageSieve
+ | Protocol::Submission
+ | Protocol::Http
+ )
+ }
+
+ pub fn is_passthrough(&self) -> bool {
+ matches!(self, Protocol::Smtp | Protocol::Lmtp)
+ }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum TlsMode {
+ Implicit,
+ Starttls,
+ Plain,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum ProxyProtocolMode {
+ Off,
+ Optional,
+ Required,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Default)]
+#[serde(rename_all = "lowercase")]
+pub enum ForwardedMode {
+ #[default]
+ Off,
+ Trust,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Forwarding {
+ Proxy,
+ Xclient,
+ None,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Default)]
+#[serde(rename_all = "lowercase")]
+pub enum Normalize {
+ #[default]
+ None,
+ Lowercase,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum MappingSource {
+ File,
+ Redis,
+ Sql,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct Config {
+ #[serde(default)]
+ pub server: ServerConfig,
+ #[serde(default)]
+ pub tls: TlsConfig,
+ #[serde(default)]
+ pub listener: AHashMap,
+ #[serde(default)]
+ pub destination: AHashMap,
+ pub routing: RoutingConfig,
+ pub mapping: MappingConfig,
+ #[serde(default)]
+ pub capabilities: CapabilitiesConfig,
+ #[serde(default)]
+ pub oauth: OAuthConfig,
+ #[serde(default)]
+ pub http: HttpConfig,
+ pub admin: Option,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct ServerConfig {
+ #[serde(default)]
+ pub threads: usize,
+ #[serde(default = "default_shutdown_grace", with = "duration")]
+ pub shutdown_grace: Duration,
+ #[serde(default = "default_bridge_idle", with = "duration")]
+ pub bridge_idle: Duration,
+ #[serde(default = "default_backend_timeout", with = "duration")]
+ pub backend_timeout: Duration,
+ #[serde(default = "default_backend_connect_retries")]
+ pub backend_connect_retries: u32,
+ #[serde(default = "default_host_down_threshold")]
+ pub host_down_threshold: u32,
+ #[serde(default = "default_host_down_cooldown", with = "duration")]
+ pub host_down_cooldown: Duration,
+ #[serde(default = "default_proxy_ttl")]
+ pub proxy_ttl: u32,
+ #[serde(default = "default_log_level")]
+ pub log_level: String,
+ #[serde(default)]
+ pub hostname: Option,
+}
+
+impl Default for ServerConfig {
+ fn default() -> Self {
+ ServerConfig {
+ threads: 0,
+ shutdown_grace: DEFAULT_SHUTDOWN_GRACE,
+ bridge_idle: DEFAULT_BRIDGE_IDLE,
+ backend_timeout: DEFAULT_BACKEND_TIMEOUT,
+ backend_connect_retries: DEFAULT_BACKEND_CONNECT_RETRIES,
+ host_down_threshold: DEFAULT_HOST_DOWN_THRESHOLD,
+ host_down_cooldown: DEFAULT_HOST_DOWN_COOLDOWN,
+ proxy_ttl: DEFAULT_PROXY_TTL,
+ log_level: DEFAULT_LOG_LEVEL.to_string(),
+ hostname: None,
+ }
+ }
+}
+
+impl ServerConfig {
+ pub fn hostname_for(&self, local: SocketAddr) -> String {
+ match &self.hostname {
+ Some(h) => h.clone(),
+ None => local.ip().to_string(),
+ }
+ }
+}
+
+const DEFAULT_SHUTDOWN_GRACE: Duration = Duration::from_secs(30);
+const DEFAULT_BRIDGE_IDLE: Duration = Duration::from_secs(1800);
+const DEFAULT_BACKEND_TIMEOUT: Duration = Duration::from_secs(10);
+const DEFAULT_BACKEND_CONNECT_RETRIES: u32 = 1;
+const DEFAULT_HOST_DOWN_THRESHOLD: u32 = 5;
+const DEFAULT_HOST_DOWN_COOLDOWN: Duration = Duration::from_secs(30);
+const DEFAULT_PROXY_TTL: u32 = 7;
+const DEFAULT_LOG_LEVEL: &str = "info";
+
+fn default_shutdown_grace() -> Duration {
+ DEFAULT_SHUTDOWN_GRACE
+}
+fn default_bridge_idle() -> Duration {
+ DEFAULT_BRIDGE_IDLE
+}
+fn default_backend_timeout() -> Duration {
+ DEFAULT_BACKEND_TIMEOUT
+}
+fn default_backend_connect_retries() -> u32 {
+ DEFAULT_BACKEND_CONNECT_RETRIES
+}
+fn default_host_down_threshold() -> u32 {
+ DEFAULT_HOST_DOWN_THRESHOLD
+}
+fn default_host_down_cooldown() -> Duration {
+ DEFAULT_HOST_DOWN_COOLDOWN
+}
+fn default_proxy_ttl() -> u32 {
+ DEFAULT_PROXY_TTL
+}
+fn default_log_level() -> String {
+ DEFAULT_LOG_LEVEL.to_string()
+}
+
+#[derive(Debug, Default, Deserialize)]
+pub struct TlsConfig {
+ #[serde(default)]
+ pub certificate: AHashMap,
+ #[serde(default)]
+ pub protocols: TlsProtocols,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct CertificateConfig {
+ pub cert: String,
+ pub key: String,
+ #[serde(default)]
+ pub subjects: Vec,
+ #[serde(default)]
+ pub default: bool,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct TlsProtocols {
+ #[serde(default = "default_min_version")]
+ pub min_version: String,
+ #[serde(default)]
+ pub ignore_client_order: bool,
+ #[serde(default)]
+ pub disable_cipher_suites: Vec,
+}
+
+impl Default for TlsProtocols {
+ fn default() -> Self {
+ TlsProtocols {
+ min_version: default_min_version(),
+ ignore_client_order: false,
+ disable_cipher_suites: Vec::new(),
+ }
+ }
+}
+
+const DEFAULT_MIN_VERSION: &str = "1.2";
+fn default_min_version() -> String {
+ DEFAULT_MIN_VERSION.to_string()
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct ListenerConfig {
+ pub protocol: Protocol,
+ pub bind: Vec,
+ pub tls: TlsMode,
+ #[serde(default = "default_proxy_off")]
+ pub proxy_protocol: ProxyProtocolMode,
+ #[serde(default)]
+ pub proxy_trusted: Vec,
+ #[serde(default = "default_max_connections")]
+ pub max_connections: usize,
+ #[serde(default = "default_preauth_timeout", with = "duration")]
+ pub preauth_timeout: Duration,
+ #[serde(default = "default_max_auth_attempts")]
+ pub max_auth_attempts: u32,
+ #[serde(default)]
+ pub forwarded: ForwardedMode,
+}
+
+const DEFAULT_MAX_CONNECTIONS: usize = 8192;
+const DEFAULT_PREAUTH_TIMEOUT: Duration = Duration::from_secs(30);
+const DEFAULT_MAX_AUTH_ATTEMPTS: u32 = 3;
+
+fn default_proxy_off() -> ProxyProtocolMode {
+ ProxyProtocolMode::Off
+}
+fn default_max_connections() -> usize {
+ DEFAULT_MAX_CONNECTIONS
+}
+fn default_preauth_timeout() -> Duration {
+ DEFAULT_PREAUTH_TIMEOUT
+}
+fn default_max_auth_attempts() -> u32 {
+ DEFAULT_MAX_AUTH_ATTEMPTS
+}
+
+#[derive(Debug, Deserialize)]
+pub struct DestinationConfig {
+ pub host: String,
+ #[serde(default)]
+ pub tls_server_name: Option,
+ #[serde(default = "default_true")]
+ pub proxy_protocol: bool,
+ #[serde(default)]
+ pub forwarding: Option,
+ #[serde(default)]
+ pub forwarded: bool,
+ #[serde(default)]
+ pub tls_allow_invalid_certs: bool,
+ #[serde(default)]
+ pub tls_pinned_cert_sha256: Option,
+ #[serde(default)]
+ pub tls_client_cert: Option,
+ #[serde(default)]
+ pub tls_client_key: Option,
+ #[serde(default)]
+ pub source_ips: Vec,
+ #[serde(default)]
+ pub hide_auth_errors: bool,
+ #[serde(default)]
+ pub allow_plaintext_auth: bool,
+ #[serde(default)]
+ pub protocol: AHashMap,
+}
+
+fn default_true() -> bool {
+ true
+}
+
+impl DestinationConfig {
+ pub fn host_is_ip(&self) -> bool {
+ self.host.parse::().is_ok()
+ }
+
+ pub fn forwarding_for(&self, protocol: Protocol) -> Forwarding {
+ if let Some(ep) = self.protocol.get(&protocol)
+ && let Some(f) = ep.forwarding
+ {
+ return f;
+ }
+ if let Some(f) = self.forwarding {
+ return f;
+ }
+ if self.proxy_protocol {
+ Forwarding::Proxy
+ } else {
+ Forwarding::None
+ }
+ }
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct DestProtocol {
+ pub port: u16,
+ pub tls: TlsMode,
+ #[serde(default)]
+ pub forwarding: Option,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct RoutingConfig {
+ pub default_destination: String,
+ #[serde(default)]
+ pub smtp_passthrough_destination: Option,
+ #[serde(default = "default_master_user_separators")]
+ pub master_user_separators: Vec,
+}
+
+const DEFAULT_MASTER_USER_SEPARATORS: &[&str] = &["%"];
+fn default_master_user_separators() -> Vec {
+ DEFAULT_MASTER_USER_SEPARATORS
+ .iter()
+ .map(|s| s.to_string())
+ .collect()
+}
+
+#[derive(Debug, Deserialize)]
+pub struct MappingConfig {
+ pub source: MappingSource,
+ #[serde(default)]
+ pub normalize: Normalize,
+ #[serde(default = "default_negative_ttl", with = "duration")]
+ pub negative_ttl: Duration,
+ #[serde(default = "default_positive_ttl", with = "duration")]
+ pub positive_ttl: Duration,
+ #[serde(default = "default_cache_max")]
+ pub cache_max_entries: u64,
+ #[serde(default = "default_lookup_timeout", with = "duration")]
+ pub lookup_timeout: Duration,
+ #[serde(default)]
+ pub file: Option,
+ #[serde(default)]
+ pub redis: Option,
+ #[serde(default)]
+ pub sql: Option,
+}
+
+const DEFAULT_NEGATIVE_TTL: Duration = Duration::from_secs(30);
+const DEFAULT_POSITIVE_TTL: Duration = Duration::from_secs(600);
+const DEFAULT_CACHE_MAX: u64 = 1_000_000;
+const DEFAULT_LOOKUP_TIMEOUT: Duration = Duration::from_secs(5);
+
+fn default_negative_ttl() -> Duration {
+ DEFAULT_NEGATIVE_TTL
+}
+fn default_positive_ttl() -> Duration {
+ DEFAULT_POSITIVE_TTL
+}
+fn default_cache_max() -> u64 {
+ DEFAULT_CACHE_MAX
+}
+fn default_lookup_timeout() -> Duration {
+ DEFAULT_LOOKUP_TIMEOUT
+}
+
+#[derive(Debug, Deserialize)]
+pub struct FileMappingConfig {
+ pub path: String,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct RedisMappingConfig {
+ pub url: String,
+ #[serde(default = "default_key_prefix")]
+ pub key_prefix: String,
+ #[serde(default = "default_pool_size")]
+ pub pool_size: usize,
+}
+
+const DEFAULT_KEY_PREFIX: &str = "route:";
+const DEFAULT_POOL_SIZE: usize = 16;
+
+fn default_key_prefix() -> String {
+ DEFAULT_KEY_PREFIX.to_string()
+}
+fn default_pool_size() -> usize {
+ DEFAULT_POOL_SIZE
+}
+
+#[derive(Debug, Deserialize)]
+pub struct SqlMappingConfig {
+ pub url: String,
+ pub query: String,
+ #[serde(default = "default_pool_size")]
+ pub pool_size: usize,
+ #[serde(default)]
+ pub upsert_query: Option,
+ #[serde(default)]
+ pub delete_query: Option,
+}
+
+#[derive(Debug, Default, Deserialize)]
+pub struct CapabilitiesConfig {
+ #[serde(default)]
+ pub imap: ImapCapabilities,
+ #[serde(default)]
+ pub managesieve: ManageSieveCapabilities,
+ #[serde(default)]
+ pub submission: SubmissionCapabilities,
+ #[serde(default)]
+ pub pop3: Pop3Capabilities,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct ImapCapabilities {
+ #[serde(default = "default_imap_advertise")]
+ pub advertise: Vec,
+ #[serde(default = "default_sasl")]
+ pub sasl: Vec,
+ #[serde(default)]
+ pub allow_plain_auth_without_tls: bool,
+ #[serde(default = "default_imap_banner")]
+ pub banner: String,
+}
+
+impl Default for ImapCapabilities {
+ fn default() -> Self {
+ ImapCapabilities {
+ advertise: default_imap_advertise(),
+ sasl: default_sasl(),
+ allow_plain_auth_without_tls: false,
+ banner: default_imap_banner(),
+ }
+ }
+}
+
+const DEFAULT_IMAP_ADVERTISE: &[&str] = &[
+ "IMAP4rev2",
+ "IMAP4rev1",
+ "ENABLE",
+ "SASL-IR",
+ "LITERAL+",
+ "ID",
+ "UTF8=ACCEPT",
+ "JMAPACCESS",
+];
+const DEFAULT_SASL: &[&str] = &["PLAIN", "OAUTHBEARER", "XOAUTH2"];
+const DEFAULT_IMAP_BANNER: &str = "Stalwart IMAP4rev2 at your service.";
+
+fn default_imap_advertise() -> Vec {
+ DEFAULT_IMAP_ADVERTISE
+ .iter()
+ .map(|s| s.to_string())
+ .collect()
+}
+fn default_sasl() -> Vec {
+ DEFAULT_SASL.iter().map(|s| s.to_string()).collect()
+}
+fn default_imap_banner() -> String {
+ DEFAULT_IMAP_BANNER.to_string()
+}
+
+#[derive(Debug, Deserialize)]
+pub struct ManageSieveCapabilities {
+ #[serde(default = "default_sieve_ext")]
+ pub sieve: Vec,
+ #[serde(default = "default_sasl")]
+ pub sasl: Vec,
+ #[serde(default)]
+ pub allow_plain_auth_without_tls: bool,
+ #[serde(default = "default_sieve_impl")]
+ pub implementation: String,
+}
+
+impl Default for ManageSieveCapabilities {
+ fn default() -> Self {
+ ManageSieveCapabilities {
+ sieve: default_sieve_ext(),
+ sasl: default_sasl(),
+ allow_plain_auth_without_tls: false,
+ implementation: default_sieve_impl(),
+ }
+ }
+}
+
+const DEFAULT_SIEVE_EXT: &[&str] = &[
+ "body",
+ "comparator-elbonia",
+ "comparator-i;ascii-casemap",
+ "comparator-i;ascii-numeric",
+ "comparator-i;octet",
+ "convert",
+ "copy",
+ "date",
+ "duplicate",
+ "editheader",
+ "enclose",
+ "encoded-character",
+ "enotify",
+ "envelope",
+ "envelope-deliverby",
+ "envelope-dsn",
+ "environment",
+ "ereject",
+ "extlists",
+ "extracttext",
+ "fcc",
+ "fileinto",
+ "foreverypart",
+ "ihave",
+ "imap4flags",
+ "imapsieve",
+ "include",
+ "index",
+ "mailbox",
+ "mailboxid",
+ "mboxmetadata",
+ "mime",
+ "redirect-deliverby",
+ "redirect-dsn",
+ "regex",
+ "reject",
+ "relational",
+ "replace",
+ "servermetadata",
+ "spamtest",
+ "spamtestplus",
+ "special-use",
+ "subaddress",
+ "vacation",
+ "vacation-seconds",
+ "variables",
+ "virustest",
+];
+const DEFAULT_SIEVE_IMPL: &str = "Stalwart ManageSieve";
+
+fn default_sieve_ext() -> Vec {
+ DEFAULT_SIEVE_EXT.iter().map(|s| s.to_string()).collect()
+}
+fn default_sieve_impl() -> String {
+ DEFAULT_SIEVE_IMPL.to_string()
+}
+
+#[derive(Debug, Deserialize)]
+pub struct SubmissionCapabilities {
+ #[serde(default = "default_ehlo")]
+ pub ehlo: Vec,
+ #[serde(default = "default_sasl")]
+ pub sasl: Vec,
+ #[serde(default)]
+ pub allow_plain_auth_without_tls: bool,
+ #[serde(default = "default_smtp_banner")]
+ pub banner: String,
+}
+
+impl Default for SubmissionCapabilities {
+ fn default() -> Self {
+ SubmissionCapabilities {
+ ehlo: default_ehlo(),
+ sasl: default_sasl(),
+ allow_plain_auth_without_tls: false,
+ banner: default_smtp_banner(),
+ }
+ }
+}
+
+const DEFAULT_EHLO: &[&str] = &[
+ "ENHANCEDSTATUSCODES",
+ "8BITMIME",
+ "BINARYMIME",
+ "SMTPUTF8",
+ "PIPELINING",
+ "CHUNKING",
+ "REQUIRETLS",
+ "SIZE",
+];
+const DEFAULT_SMTP_BANNER: &str = "at your service.";
+
+fn default_ehlo() -> Vec {
+ DEFAULT_EHLO.iter().map(|s| s.to_string()).collect()
+}
+fn default_smtp_banner() -> String {
+ DEFAULT_SMTP_BANNER.to_string()
+}
+
+#[derive(Debug, Deserialize)]
+pub struct Pop3Capabilities {
+ #[serde(default = "default_sasl")]
+ pub sasl: Vec,
+ #[serde(default)]
+ pub allow_plain_auth_without_tls: bool,
+ #[serde(default = "default_pop3_banner")]
+ pub banner: String,
+}
+
+impl Default for Pop3Capabilities {
+ fn default() -> Self {
+ Pop3Capabilities {
+ sasl: default_sasl(),
+ allow_plain_auth_without_tls: false,
+ banner: default_pop3_banner(),
+ }
+ }
+}
+const DEFAULT_POP3_BANNER: &str = "Stalwart POP3 at your service.";
+fn default_pop3_banner() -> String {
+ DEFAULT_POP3_BANNER.to_string()
+}
+
+#[derive(Debug, Deserialize)]
+pub struct OAuthConfig {
+ #[serde(default = "default_jwt_claim")]
+ pub jwt_username_claim: String,
+}
+
+impl Default for OAuthConfig {
+ fn default() -> Self {
+ OAuthConfig {
+ jwt_username_claim: default_jwt_claim(),
+ }
+ }
+}
+const DEFAULT_JWT_CLAIM: &str = "email";
+fn default_jwt_claim() -> String {
+ DEFAULT_JWT_CLAIM.to_string()
+}
+
+#[derive(Debug, Deserialize)]
+pub struct HttpConfig {
+ #[serde(default)]
+ pub route: Vec,
+ #[serde(default = "default_body_cap")]
+ pub body_extract_cap: usize,
+ #[serde(default = "default_head_cap")]
+ pub max_head_size: usize,
+ #[serde(default = "default_relay_idle", with = "duration")]
+ pub relay_idle: Duration,
+ #[serde(default = "default_keepalive_timeout", with = "duration")]
+ pub keepalive_timeout: Duration,
+ #[serde(default = "default_max_keepalive_requests")]
+ pub max_keepalive_requests: u32,
+}
+
+impl Default for HttpConfig {
+ fn default() -> Self {
+ HttpConfig {
+ route: Vec::new(),
+ body_extract_cap: DEFAULT_BODY_CAP,
+ max_head_size: DEFAULT_HEAD_CAP,
+ relay_idle: DEFAULT_RELAY_IDLE,
+ keepalive_timeout: DEFAULT_KEEPALIVE_TIMEOUT,
+ max_keepalive_requests: DEFAULT_MAX_KEEPALIVE_REQUESTS,
+ }
+ }
+}
+
+const DEFAULT_BODY_CAP: usize = 64 * 1024;
+const DEFAULT_HEAD_CAP: usize = 64 * 1024;
+const DEFAULT_RELAY_IDLE: Duration = Duration::from_secs(60);
+const DEFAULT_KEEPALIVE_TIMEOUT: Duration = Duration::from_secs(75);
+const DEFAULT_MAX_KEEPALIVE_REQUESTS: u32 = 1000;
+
+fn default_body_cap() -> usize {
+ DEFAULT_BODY_CAP
+}
+fn default_head_cap() -> usize {
+ DEFAULT_HEAD_CAP
+}
+fn default_relay_idle() -> Duration {
+ DEFAULT_RELAY_IDLE
+}
+fn default_keepalive_timeout() -> Duration {
+ DEFAULT_KEEPALIVE_TIMEOUT
+}
+fn default_max_keepalive_requests() -> u32 {
+ DEFAULT_MAX_KEEPALIVE_REQUESTS
+}
+
+#[derive(Debug, Deserialize)]
+pub struct HttpRoute {
+ #[serde(rename = "match")]
+ pub match_glob: String,
+ #[serde(default)]
+ pub destination: Option,
+ #[serde(default)]
+ pub extract: Option,
+ #[serde(default)]
+ pub fallback: Option,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct HttpExtract {
+ pub from: ExtractFrom,
+ #[serde(default)]
+ pub regex: Option,
+ #[serde(default)]
+ pub param: Option,
+ #[serde(default)]
+ pub header: Option,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum ExtractFrom {
+ Authorization,
+ Query,
+ Body,
+ Header,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct AdminConfig {
+ pub bind: SocketAddr,
+ #[serde(default = "default_admin_tls")]
+ pub tls: TlsMode,
+ #[serde(default)]
+ pub bearer_token_file: Option,
+ #[serde(default)]
+ pub bearer_token: Option,
+ #[serde(default = "default_min_token_len")]
+ pub min_token_len: usize,
+ #[serde(default = "default_lockout_threshold")]
+ pub lockout_threshold: u32,
+ #[serde(default = "default_lockout_duration", with = "duration")]
+ pub lockout_duration: Duration,
+}
+
+const DEFAULT_MIN_TOKEN_LEN: usize = 32;
+const DEFAULT_LOCKOUT_THRESHOLD: u32 = 5;
+const DEFAULT_LOCKOUT_DURATION: Duration = Duration::from_secs(300);
+
+fn default_admin_tls() -> TlsMode {
+ TlsMode::Implicit
+}
+fn default_min_token_len() -> usize {
+ DEFAULT_MIN_TOKEN_LEN
+}
+fn default_lockout_threshold() -> u32 {
+ DEFAULT_LOCKOUT_THRESHOLD
+}
+fn default_lockout_duration() -> Duration {
+ DEFAULT_LOCKOUT_DURATION
+}
+
+impl Config {
+ pub fn parse_and_validate(raw: &str) -> Result {
+ let config: Config =
+ toml::from_str(raw).map_err(|e| ProxyError::config(format!("TOML parse: {e}")))?;
+ config.validate()?;
+ Ok(config)
+ }
+
+ fn destination(&self, id: &str) -> Result<&DestinationConfig> {
+ self.destination
+ .get(id)
+ .ok_or_else(|| ProxyError::config(format!("undeclared destination {id:?}")))
+ }
+
+ fn validate(&self) -> Result<()> {
+ let has_lmtp_listener = self.listener.values().any(|l| l.protocol == Protocol::Lmtp);
+
+ let default_dest = self.destination(&self.routing.default_destination)?;
+
+ for (id, listener) in &self.listener {
+ if listener.bind.is_empty() {
+ return Err(ProxyError::config(format!(
+ "listener {id:?} has no bind addresses"
+ )));
+ }
+ if matches!(
+ listener.proxy_protocol,
+ ProxyProtocolMode::Optional | ProxyProtocolMode::Required
+ ) && listener.proxy_trusted.is_empty()
+ {
+ return Err(ProxyError::config(format!(
+ "listener {id:?} uses proxy_protocol but proxy_trusted is empty"
+ )));
+ }
+ if listener.protocol.is_passthrough() {
+ if listener.tls == TlsMode::Starttls {
+ return Err(ProxyError::config(format!(
+ "listener {id:?} is a pass-through ({}) and cannot use tls=starttls (the proxy bridges raw and does not terminate STARTTLS); use plain or implicit",
+ listener.protocol.as_str()
+ )));
+ }
+ continue;
+ }
+ if listener.protocol == Protocol::Http {
+ continue;
+ }
+ if !default_dest.protocol.contains_key(&listener.protocol) {
+ return Err(ProxyError::config(format!(
+ "default_destination {:?} does not declare protocol {} required by listener {id:?}",
+ self.routing.default_destination,
+ listener.protocol.as_str()
+ )));
+ }
+ }
+
+ if let Some(pt) = &self.routing.smtp_passthrough_destination {
+ let dest = self.destination(pt)?;
+ if !dest.protocol.contains_key(&Protocol::Smtp) {
+ return Err(ProxyError::config(format!(
+ "smtp_passthrough_destination {pt:?} must declare the smtp protocol"
+ )));
+ }
+ if has_lmtp_listener && !dest.protocol.contains_key(&Protocol::Lmtp) {
+ return Err(ProxyError::config(format!(
+ "smtp_passthrough_destination {pt:?} must declare lmtp (an lmtp listener exists)"
+ )));
+ }
+ } else if self.listener.values().any(|l| l.protocol.is_passthrough()) {
+ return Err(ProxyError::config(
+ "smtp/lmtp listener configured but routing.smtp_passthrough_destination is unset",
+ ));
+ }
+
+ for (id, dest) in &self.destination {
+ self.validate_destination(id, dest)?;
+ }
+
+ for route in &self.http.route {
+ globset::Glob::new(&route.match_glob).map_err(|e| {
+ ProxyError::config(format!(
+ "invalid http route glob {:?}: {e}",
+ route.match_glob
+ ))
+ })?;
+ if let Some(dest_id) = &route.destination {
+ let dest = self.destination(dest_id)?;
+ if !dest.protocol.contains_key(&Protocol::Http) {
+ return Err(ProxyError::config(format!(
+ "http route destination {dest_id:?} does not declare the http protocol"
+ )));
+ }
+ }
+ if let Some(extract) = &route.extract {
+ if extract.from == ExtractFrom::Body && extract.regex.is_none() {
+ return Err(ProxyError::config(
+ "http extract from=body requires a regex",
+ ));
+ }
+ if extract.from == ExtractFrom::Query && extract.param.is_none() {
+ return Err(ProxyError::config(
+ "http extract from=query requires a param",
+ ));
+ }
+ if extract.from == ExtractFrom::Header && extract.header.is_none() {
+ return Err(ProxyError::config(
+ "http extract from=header requires a header name",
+ ));
+ }
+ if let Some(re) = &extract.regex {
+ regex::Regex::new(re).map_err(|e| {
+ ProxyError::config(format!("invalid http extract regex {re:?}: {e}"))
+ })?;
+ }
+ }
+ }
+
+ match self.mapping.source {
+ MappingSource::File if self.mapping.file.is_none() => {
+ return Err(ProxyError::config(
+ "mapping.source=file requires [mapping.file]",
+ ));
+ }
+ MappingSource::Redis if self.mapping.redis.is_none() => {
+ return Err(ProxyError::config(
+ "mapping.source=redis requires [mapping.redis]",
+ ));
+ }
+ MappingSource::Sql if self.mapping.sql.is_none() => {
+ return Err(ProxyError::config(
+ "mapping.source=sql requires [mapping.sql]",
+ ));
+ }
+ _ => {}
+ }
+
+ if let Some(admin) = &self.admin {
+ if admin.tls != TlsMode::Implicit {
+ return Err(ProxyError::config(
+ "admin.tls must be implicit (plaintext admin is rejected)",
+ ));
+ }
+ if admin.bearer_token_file.is_none()
+ && admin.bearer_token.is_none()
+ && std::env::var("PROXY_ADMIN_TOKEN").is_err()
+ {
+ return Err(ProxyError::config(
+ "admin requires bearer_token_file, bearer_token, or PROXY_ADMIN_TOKEN",
+ ));
+ }
+ }
+
+ Ok(())
+ }
+
+ fn validate_destination(&self, id: &str, dest: &DestinationConfig) -> Result<()> {
+ let host_is_ip = dest.host_is_ip();
+ for (proto, ep) in &dest.protocol {
+ if proto.is_credential_bearing()
+ && ep.tls == TlsMode::Plain
+ && !dest.allow_plaintext_auth
+ {
+ return Err(ProxyError::config(format!(
+ "destination {id:?} protocol {} uses plaintext TLS but carries credentials; set allow_plaintext_auth to override",
+ proto.as_str()
+ )));
+ }
+ if host_is_ip && ep.tls != TlsMode::Plain && dest.tls_server_name.is_none() {
+ return Err(ProxyError::config(format!(
+ "destination {id:?} has an IP host and a TLS leg ({}) but no tls_server_name",
+ proto.as_str()
+ )));
+ }
+ }
+ Ok(())
+ }
+}
diff --git a/src/error.rs b/src/error.rs
new file mode 100644
index 0000000..d5b171e
--- /dev/null
+++ b/src/error.rs
@@ -0,0 +1,66 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use std::borrow::Cow;
+
+pub type Result = std::result::Result;
+
+#[derive(Debug, thiserror::Error)]
+pub enum ProxyError {
+ #[error("configuration error: {0}")]
+ Config(Cow<'static, str>),
+
+ #[error("i/o error: {0}")]
+ Io(#[from] std::io::Error),
+
+ #[error("tls error: {0}")]
+ Tls(Cow<'static, str>),
+
+ #[error("backend unavailable: {0}")]
+ BackendUnavailable(Cow<'static, str>),
+
+ #[error("backend connection failed: {0}")]
+ BackendConnect(Cow<'static, str>),
+
+ #[error("protocol error: {0}")]
+ Protocol(Cow<'static, str>),
+
+ #[error("the pre-auth dialogue exceeded its limits: {0}")]
+ PreAuth(Cow<'static, str>),
+
+ #[error("connection closed")]
+ Closed,
+}
+
+impl ProxyError {
+ pub fn config(msg: impl Into>) -> Self {
+ ProxyError::Config(msg.into())
+ }
+
+ pub fn tls(msg: impl Into>) -> Self {
+ ProxyError::Tls(msg.into())
+ }
+
+ pub fn backend(msg: impl Into>) -> Self {
+ ProxyError::BackendUnavailable(msg.into())
+ }
+
+ pub fn backend_connect(msg: impl Into>) -> Self {
+ ProxyError::BackendConnect(msg.into())
+ }
+
+ pub fn is_retryable(&self) -> bool {
+ matches!(self, ProxyError::BackendConnect(_) | ProxyError::Io(_))
+ }
+
+ pub fn protocol(msg: impl Into>) -> Self {
+ ProxyError::Protocol(msg.into())
+ }
+
+ pub fn preauth(msg: impl Into>) -> Self {
+ ProxyError::PreAuth(msg.into())
+ }
+}
diff --git a/src/http/head.rs b/src/http/head.rs
new file mode 100644
index 0000000..b5a94ae
--- /dev/null
+++ b/src/http/head.rs
@@ -0,0 +1,654 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+const MAX_HEADERS: usize = 100;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum BodyFraming {
+ None,
+ Length(u64),
+ Chunked,
+ UntilClose,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct ConnFlags {
+ pub is_websocket_upgrade: bool,
+ pub close: bool,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Header {
+ pub name: String,
+ pub value: String,
+}
+
+const HOP_BY_HOP: &[&str] = &[
+ "connection",
+ "keep-alive",
+ "transfer-encoding",
+ "te",
+ "upgrade",
+ "proxy-connection",
+ "trailer",
+ "proxy-authenticate",
+ "proxy-authorization",
+];
+
+fn is_hop_by_hop(name: &str) -> bool {
+ HOP_BY_HOP.iter().any(|h| name.eq_ignore_ascii_case(h))
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Head {
+ pub is_response: bool,
+ pub method: String,
+ pub target: String,
+ pub version: String,
+ pub status: u16,
+ pub reason: String,
+ pub headers: Vec,
+ pub framing: BodyFraming,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ParseError {
+ BadRequest,
+ MethodNotAllowed,
+ TooLarge,
+ VersionNotSupported,
+}
+
+impl ParseError {
+ pub fn status(self) -> u16 {
+ match self {
+ ParseError::BadRequest => 400,
+ ParseError::MethodNotAllowed => 405,
+ ParseError::TooLarge => 431,
+ ParseError::VersionNotSupported => 505,
+ }
+ }
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub enum ParseOutcome {
+ NeedMore,
+ Done { head: Head, consumed: usize },
+}
+
+fn find_head_end(buf: &[u8]) -> Option {
+ buf.windows(4).position(|w| w == b"\r\n\r\n").map(|p| p + 4)
+}
+
+fn reject_bare_cr_lf(head: &[u8]) -> bool {
+ let mut i = 0;
+ while i < head.len() {
+ match head[i] {
+ b'\r' => {
+ if head.get(i + 1) != Some(&b'\n') {
+ return true;
+ }
+ i += 2;
+ }
+ b'\n' => return true,
+ _ => i += 1,
+ }
+ }
+ false
+}
+
+fn split_lines(head: &[u8]) -> Vec<&[u8]> {
+ let mut lines = Vec::new();
+ let mut start = 0;
+ let mut i = 0;
+ while i < head.len() {
+ if head[i] == b'\n' {
+ let mut end = i;
+ if end > start && head[end - 1] == b'\r' {
+ end -= 1;
+ }
+ lines.push(&head[start..end]);
+ start = i + 1;
+ }
+ i += 1;
+ }
+ lines
+}
+
+fn header_value_has_forbidden(value: &str) -> bool {
+ value.bytes().any(|b| b == 0 || b == b'\r' || b == b'\n')
+}
+
+fn parse_content_length(value: &str) -> std::result::Result {
+ value
+ .trim()
+ .parse::()
+ .map_err(|_| ParseError::BadRequest)
+}
+
+fn transfer_encoding_is_chunked(value: &str) -> std::result::Result {
+ let codings: Vec<&str> = value
+ .split(',')
+ .map(|c| c.trim())
+ .filter(|c| !c.is_empty())
+ .collect();
+ if codings.is_empty() {
+ return Ok(false);
+ }
+ let last = codings[codings.len() - 1];
+ if last.eq_ignore_ascii_case("chunked") {
+ Ok(true)
+ } else {
+ Err(ParseError::BadRequest)
+ }
+}
+
+fn status_has_no_body(status: u16) -> bool {
+ (100..200).contains(&status) || status == 204 || status == 205 || status == 304
+}
+
+impl Head {
+ pub fn parse(
+ buf: &[u8],
+ max_head_size: usize,
+ ) -> std::result::Result {
+ Self::parse_inner(buf, max_head_size, false)
+ }
+
+ pub fn parse_response(
+ buf: &[u8],
+ max_head_size: usize,
+ ) -> std::result::Result {
+ Self::parse_inner(buf, max_head_size, true)
+ }
+
+ fn parse_inner(
+ buf: &[u8],
+ max_head_size: usize,
+ is_response: bool,
+ ) -> std::result::Result {
+ let end = match find_head_end(buf) {
+ Some(e) => e,
+ None => {
+ if buf.len() > max_head_size {
+ return Err(ParseError::TooLarge);
+ }
+ return Ok(ParseOutcome::NeedMore);
+ }
+ };
+ if end > max_head_size {
+ return Err(ParseError::TooLarge);
+ }
+
+ let head_bytes = &buf[..end];
+ if reject_bare_cr_lf(head_bytes) {
+ return Err(ParseError::BadRequest);
+ }
+
+ let lines = split_lines(head_bytes);
+ if lines.is_empty() || lines[0].is_empty() {
+ return Err(ParseError::BadRequest);
+ }
+
+ let start_line = std::str::from_utf8(lines[0]).map_err(|_| ParseError::BadRequest)?;
+
+ let mut head = if is_response {
+ Self::parse_status_line(start_line)?
+ } else {
+ Self::parse_request_line(start_line)?
+ };
+
+ if lines.len() - 1 > MAX_HEADERS {
+ return Err(ParseError::TooLarge);
+ }
+
+ let mut content_length: Option = None;
+ let mut has_te = false;
+ let mut te_chunked = false;
+ let mut host_count = 0u32;
+
+ for raw in &lines[1..] {
+ if raw.is_empty() {
+ continue;
+ }
+ if raw[0] == b' ' || raw[0] == b'\t' {
+ return Err(ParseError::BadRequest);
+ }
+ let line = std::str::from_utf8(raw).map_err(|_| ParseError::BadRequest)?;
+ let (name, value) = match line.split_once(':') {
+ Some((n, v)) => (n, v),
+ None => return Err(ParseError::BadRequest),
+ };
+ if name.is_empty() || name.bytes().any(|b| b == b' ' || b == b'\t') {
+ return Err(ParseError::BadRequest);
+ }
+ let value = value.trim();
+ if header_value_has_forbidden(value) {
+ return Err(ParseError::BadRequest);
+ }
+
+ if name.eq_ignore_ascii_case("content-length") {
+ let parsed = parse_content_length(value)?;
+ if let Some(existing) = content_length {
+ if existing != parsed {
+ return Err(ParseError::BadRequest);
+ }
+ } else {
+ content_length = Some(parsed);
+ }
+ } else if name.eq_ignore_ascii_case("transfer-encoding") {
+ has_te = true;
+ if transfer_encoding_is_chunked(value)? {
+ te_chunked = true;
+ }
+ } else if name.eq_ignore_ascii_case("host") {
+ host_count += 1;
+ }
+
+ head.headers.push(Header {
+ name: name.to_string(),
+ value: value.to_string(),
+ });
+ }
+
+ if has_te && content_length.is_some() {
+ return Err(ParseError::BadRequest);
+ }
+
+ if !is_response && host_count != 1 {
+ return Err(ParseError::BadRequest);
+ }
+
+ head.framing = if is_response && status_has_no_body(head.status) {
+ BodyFraming::None
+ } else if has_te {
+ if !te_chunked {
+ return Err(ParseError::BadRequest);
+ }
+ BodyFraming::Chunked
+ } else if let Some(n) = content_length {
+ BodyFraming::Length(n)
+ } else if is_response {
+ BodyFraming::UntilClose
+ } else {
+ BodyFraming::None
+ };
+
+ Ok(ParseOutcome::Done {
+ head,
+ consumed: end,
+ })
+ }
+
+ fn parse_request_line(line: &str) -> std::result::Result {
+ let mut parts = line.split(' ');
+ let method = parts.next().ok_or(ParseError::BadRequest)?;
+ let target = parts.next().ok_or(ParseError::BadRequest)?;
+ let version = parts.next().ok_or(ParseError::BadRequest)?;
+ if parts.next().is_some() {
+ return Err(ParseError::BadRequest);
+ }
+ if method.is_empty() || target.is_empty() {
+ return Err(ParseError::BadRequest);
+ }
+ if target.bytes().any(|b| b < 0x20 || b == 0x7f) {
+ return Err(ParseError::BadRequest);
+ }
+ if version != "HTTP/1.1" {
+ return Err(ParseError::VersionNotSupported);
+ }
+ if method.eq_ignore_ascii_case("CONNECT") {
+ return Err(ParseError::MethodNotAllowed);
+ }
+ Ok(Head {
+ is_response: false,
+ method: method.to_string(),
+ target: target.to_string(),
+ version: version.to_string(),
+ status: 0,
+ reason: String::new(),
+ headers: Vec::new(),
+ framing: BodyFraming::None,
+ })
+ }
+
+ fn parse_status_line(line: &str) -> std::result::Result {
+ let mut parts = line.splitn(3, ' ');
+ let version = parts.next().ok_or(ParseError::BadRequest)?;
+ let code = parts.next().ok_or(ParseError::BadRequest)?;
+ let reason = parts.next().unwrap_or("");
+ if !version.starts_with("HTTP/1.") {
+ return Err(ParseError::BadRequest);
+ }
+ let status = code.parse::().map_err(|_| ParseError::BadRequest)?;
+ if !(100..=599).contains(&status) {
+ return Err(ParseError::BadRequest);
+ }
+ Ok(Head {
+ is_response: true,
+ method: String::new(),
+ target: String::new(),
+ version: version.to_string(),
+ status,
+ reason: reason.to_string(),
+ headers: Vec::new(),
+ framing: BodyFraming::None,
+ })
+ }
+
+ pub fn header(&self, name: &str) -> Option<&str> {
+ self.headers
+ .iter()
+ .find(|h| h.name.eq_ignore_ascii_case(name))
+ .map(|h| h.value.as_str())
+ }
+
+ pub fn set_header(&mut self, name: &str, value: &str) {
+ self.headers.retain(|h| !h.name.eq_ignore_ascii_case(name));
+ self.headers.push(Header {
+ name: name.to_string(),
+ value: value.to_string(),
+ });
+ }
+
+ pub fn remove_header(&mut self, name: &str) {
+ self.headers.retain(|h| !h.name.eq_ignore_ascii_case(name));
+ }
+
+ pub fn path(&self) -> &str {
+ match self.target.split_once('?') {
+ Some((p, _)) => p,
+ None => self.target.as_str(),
+ }
+ }
+
+ pub fn query(&self) -> Option<&str> {
+ self.target.split_once('?').map(|(_, q)| q)
+ }
+
+ pub fn conn_flags(&self) -> ConnFlags {
+ let tokens = self.connection_tokens();
+ let is_websocket_upgrade = self
+ .header("upgrade")
+ .is_some_and(|v| v.eq_ignore_ascii_case("websocket"))
+ && tokens.iter().any(|t| t.eq_ignore_ascii_case("upgrade"));
+ let close = tokens.iter().any(|t| t.eq_ignore_ascii_case("close"));
+ ConnFlags {
+ is_websocket_upgrade,
+ close,
+ }
+ }
+
+ pub fn is_sse(&self) -> bool {
+ self.header("content-type").is_some_and(|v| {
+ v.trim_start()
+ .to_ascii_lowercase()
+ .starts_with("text/event-stream")
+ })
+ }
+
+ pub fn expects_continue(&self) -> bool {
+ self.header("expect")
+ .is_some_and(|v| v.eq_ignore_ascii_case("100-continue"))
+ }
+
+ fn connection_tokens(&self) -> Vec<&str> {
+ let mut tokens = Vec::new();
+ for h in &self.headers {
+ if h.name.eq_ignore_ascii_case("connection") {
+ for token in h.value.split(',') {
+ let token = token.trim();
+ if !token.is_empty() {
+ tokens.push(token);
+ }
+ }
+ }
+ }
+ tokens
+ }
+
+ pub fn serialize(&self, force_close: bool, preserve_upgrade: bool) -> Vec {
+ let mut out = Vec::with_capacity(256);
+ if self.is_response {
+ out.extend_from_slice(b"HTTP/1.1 ");
+ out.extend_from_slice(self.status.to_string().as_bytes());
+ out.push(b' ');
+ out.extend_from_slice(self.reason.as_bytes());
+ out.extend_from_slice(b"\r\n");
+ } else {
+ out.extend_from_slice(self.method.as_bytes());
+ out.push(b' ');
+ out.extend_from_slice(self.target.as_bytes());
+ out.extend_from_slice(b" HTTP/1.1\r\n");
+ }
+
+ let conn_tokens = self.connection_tokens();
+
+ for header in &self.headers {
+ if is_hop_by_hop(&header.name)
+ || conn_tokens
+ .iter()
+ .any(|t| header.name.eq_ignore_ascii_case(t))
+ {
+ continue;
+ }
+ if header.name.eq_ignore_ascii_case("content-length") {
+ continue;
+ }
+ out.extend_from_slice(header.name.as_bytes());
+ out.extend_from_slice(b": ");
+ out.extend_from_slice(header.value.as_bytes());
+ out.extend_from_slice(b"\r\n");
+ }
+
+ match self.framing {
+ BodyFraming::Chunked => {
+ out.extend_from_slice(b"Transfer-Encoding: chunked\r\n");
+ }
+ BodyFraming::Length(n) => {
+ out.extend_from_slice(b"Content-Length: ");
+ out.extend_from_slice(n.to_string().as_bytes());
+ out.extend_from_slice(b"\r\n");
+ }
+ BodyFraming::None | BodyFraming::UntilClose => {}
+ }
+
+ if preserve_upgrade {
+ if let Some(v) = self.header("upgrade") {
+ out.extend_from_slice(b"Upgrade: ");
+ out.extend_from_slice(v.as_bytes());
+ out.extend_from_slice(b"\r\n");
+ }
+ out.extend_from_slice(b"Connection: Upgrade\r\n");
+ } else if force_close {
+ out.extend_from_slice(b"Connection: close\r\n");
+ }
+
+ out.extend_from_slice(b"\r\n");
+ out
+ }
+}
+
+pub fn error_response(status: u16, reason: &str) -> Vec {
+ use std::fmt::Write;
+ let body = format!("{status} {reason}");
+ let mut out = String::with_capacity(body.len() + 96);
+ let _ = write!(
+ out,
+ "HTTP/1.1 {status} {reason}\r\nContent-Type: text/plain; charset=utf-8\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
+ body.len()
+ );
+ out.into_bytes()
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+
+ fn done(buf: &[u8]) -> Head {
+ match Head::parse(buf, 64 * 1024).unwrap() {
+ ParseOutcome::Done { head, .. } => head,
+ ParseOutcome::NeedMore => panic!("need more"),
+ }
+ }
+
+ #[test]
+ fn parse_simple_get() {
+ let buf = b"GET /foo?x=1 HTTP/1.1\r\nHost: example.com\r\n\r\n";
+ let head = done(buf);
+ assert!(!head.is_response);
+ assert_eq!(head.method, "GET");
+ assert_eq!(head.target, "/foo?x=1");
+ assert_eq!(head.path(), "/foo");
+ assert_eq!(head.query(), Some("x=1"));
+ assert_eq!(head.header("host"), Some("example.com"));
+ assert_eq!(head.framing, BodyFraming::None);
+ }
+
+ #[test]
+ fn need_more_until_crlfcrlf() {
+ let buf = b"GET / HTTP/1.1\r\nHost: x\r\n";
+ assert!(matches!(
+ Head::parse(buf, 64 * 1024).unwrap(),
+ ParseOutcome::NeedMore
+ ));
+ }
+
+ #[test]
+ fn reject_te_and_cl() {
+ let buf = b"POST / HTTP/1.1\r\nContent-Length: 5\r\nTransfer-Encoding: chunked\r\n\r\n";
+ assert_eq!(Head::parse(buf, 64 * 1024), Err(ParseError::BadRequest));
+ }
+
+ #[test]
+ fn reject_double_conflicting_cl() {
+ let buf = b"POST / HTTP/1.1\r\nContent-Length: 5\r\nContent-Length: 6\r\n\r\n";
+ assert_eq!(Head::parse(buf, 64 * 1024), Err(ParseError::BadRequest));
+ }
+
+ #[test]
+ fn accept_duplicate_equal_cl() {
+ let buf = b"POST / HTTP/1.1\r\nHost: x\r\nContent-Length: 5\r\nContent-Length: 5\r\n\r\n";
+ let head = done(buf);
+ assert_eq!(head.framing, BodyFraming::Length(5));
+ }
+
+ #[test]
+ fn reject_te_not_chunked() {
+ let buf = b"POST / HTTP/1.1\r\nTransfer-Encoding: gzip\r\n\r\n";
+ assert_eq!(Head::parse(buf, 64 * 1024), Err(ParseError::BadRequest));
+ }
+
+ #[test]
+ fn accept_te_gzip_then_chunked() {
+ let buf = b"POST / HTTP/1.1\r\nHost: x\r\nTransfer-Encoding: gzip, chunked\r\n\r\n";
+ let head = done(buf);
+ assert_eq!(head.framing, BodyFraming::Chunked);
+ }
+
+ #[test]
+ fn reject_bare_lf() {
+ let buf = b"GET / HTTP/1.1\nHost: x\r\n\r\n";
+ assert_eq!(Head::parse(buf, 64 * 1024), Err(ParseError::BadRequest));
+ }
+
+ #[test]
+ fn reject_nul_in_value() {
+ let buf = b"GET / HTTP/1.1\r\nHost: a\x00b\r\n\r\n";
+ assert_eq!(Head::parse(buf, 64 * 1024), Err(ParseError::BadRequest));
+ }
+
+ #[test]
+ fn reject_obs_fold() {
+ let buf = b"GET / HTTP/1.1\r\nHost: x\r\n more\r\n\r\n";
+ assert_eq!(Head::parse(buf, 64 * 1024), Err(ParseError::BadRequest));
+ }
+
+ #[test]
+ fn reject_connect() {
+ let buf = b"CONNECT example.com:443 HTTP/1.1\r\n\r\n";
+ assert_eq!(
+ Head::parse(buf, 64 * 1024),
+ Err(ParseError::MethodNotAllowed)
+ );
+ }
+
+ #[test]
+ fn reject_missing_host() {
+ let buf = b"GET / HTTP/1.1\r\n\r\n";
+ assert_eq!(Head::parse(buf, 64 * 1024), Err(ParseError::BadRequest));
+ }
+
+ #[test]
+ fn reject_duplicate_host() {
+ let buf = b"GET / HTTP/1.1\r\nHost: a\r\nHost: b\r\n\r\n";
+ assert_eq!(Head::parse(buf, 64 * 1024), Err(ParseError::BadRequest));
+ }
+
+ #[test]
+ fn reject_control_in_target() {
+ let buf = b"GET /a\x01b HTTP/1.1\r\nHost: x\r\n\r\n";
+ assert_eq!(Head::parse(buf, 64 * 1024), Err(ParseError::BadRequest));
+ }
+
+ #[test]
+ fn serialize_strips_hop_by_hop() {
+ let buf = b"GET / HTTP/1.1\r\nHost: x\r\nConnection: keep-alive, X-Drop\r\nKeep-Alive: timeout=5\r\nX-Drop: secret\r\nX-Keep: yes\r\n\r\n";
+ let head = done(buf);
+ let out = head.serialize(false, false);
+ let text = String::from_utf8(out).unwrap();
+ assert!(!text.to_lowercase().contains("keep-alive"));
+ assert!(!text.contains("X-Drop"));
+ assert!(!text.to_lowercase().contains("connection:"));
+ assert!(text.contains("X-Keep: yes"));
+ assert!(text.contains("Host: x"));
+ }
+
+ #[test]
+ fn serialize_single_framing_header() {
+ let buf = b"POST / HTTP/1.1\r\nHost: x\r\nContent-Length: 3\r\n\r\n";
+ let head = done(buf);
+ let text = String::from_utf8(head.serialize(false, false)).unwrap();
+ assert_eq!(text.matches("Content-Length:").count(), 1);
+ assert!(text.contains("Content-Length: 3"));
+ }
+
+ #[test]
+ fn serialize_force_close() {
+ let buf = b"GET / HTTP/1.1\r\nHost: x\r\n\r\n";
+ let head = done(buf);
+ let text = String::from_utf8(head.serialize(true, false)).unwrap();
+ assert!(text.contains("Connection: close"));
+ }
+
+ #[test]
+ fn response_until_close() {
+ let buf = b"HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n\r\n";
+ let head = match Head::parse_response(buf, 64 * 1024).unwrap() {
+ ParseOutcome::Done { head, .. } => head,
+ _ => panic!(),
+ };
+ assert_eq!(head.framing, BodyFraming::UntilClose);
+ }
+
+ #[test]
+ fn response_204_no_body() {
+ let buf = b"HTTP/1.1 204 No Content\r\n\r\n";
+ let head = match Head::parse_response(buf, 64 * 1024).unwrap() {
+ ParseOutcome::Done { head, .. } => head,
+ _ => panic!(),
+ };
+ assert_eq!(head.framing, BodyFraming::None);
+ }
+
+ #[test]
+ fn websocket_detection() {
+ let buf =
+ b"GET /ws HTTP/1.1\r\nHost: x\r\nConnection: Upgrade\r\nUpgrade: websocket\r\n\r\n";
+ let head = done(buf);
+ assert!(head.conn_flags().is_websocket_upgrade);
+ }
+}
diff --git a/src/http/mod.rs b/src/http/mod.rs
new file mode 100644
index 0000000..6215e6a
--- /dev/null
+++ b/src/http/mod.rs
@@ -0,0 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+pub mod head;
+pub mod proxy;
+pub mod router;
diff --git a/src/http/proxy.rs b/src/http/proxy.rs
new file mode 100644
index 0000000..7ae979e
--- /dev/null
+++ b/src/http/proxy.rs
@@ -0,0 +1,947 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use std::net::{IpAddr, SocketAddr};
+use std::time::Duration;
+
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::time::timeout;
+
+use crate::config::{ForwardedMode, ListenerConfig, Protocol, TlsMode};
+use crate::error::{ProxyError, Result};
+use crate::net::BoxedStream;
+use crate::proto::common::Ctx;
+
+use super::head::{BodyFraming, Head, ParseError, ParseOutcome, error_response};
+use super::router::{HttpRouter, RouteOutcome};
+
+const READ_CHUNK: usize = 16 * 1024;
+
+#[derive(Clone, Copy)]
+struct Idle {
+ body: Duration,
+ stream: Duration,
+}
+
+struct Reader {
+ buf: Vec,
+ pos: usize,
+ eof: bool,
+}
+
+impl Reader {
+ fn new() -> Self {
+ Reader {
+ buf: Vec::with_capacity(READ_CHUNK),
+ pos: 0,
+ eof: false,
+ }
+ }
+
+ fn data(&self) -> &[u8] {
+ &self.buf[self.pos..]
+ }
+
+ fn is_empty(&self) -> bool {
+ self.pos >= self.buf.len()
+ }
+
+ fn consume(&mut self, n: usize) {
+ self.pos += n;
+ if self.pos >= self.buf.len() {
+ self.buf.clear();
+ self.pos = 0;
+ } else if self.pos >= READ_CHUNK {
+ self.buf.drain(..self.pos);
+ self.pos = 0;
+ }
+ }
+
+ fn take_data(&mut self) -> Vec {
+ let out = self.buf[self.pos..].to_vec();
+ self.buf.clear();
+ self.pos = 0;
+ out
+ }
+
+ async fn fill(&mut self, stream: &mut BoxedStream, idle: Duration) -> Result {
+ let start = self.buf.len();
+ self.buf.resize(start + READ_CHUNK, 0);
+ let n = match timeout(idle, stream.read(&mut self.buf[start..])).await {
+ Ok(r) => r.map_err(|e| ProxyError::protocol(format!("reading stream: {e}")))?,
+ Err(_) => {
+ self.buf.truncate(start);
+ return Err(ProxyError::protocol("read idle timeout"));
+ }
+ };
+ self.buf.truncate(start + n);
+ if n == 0 {
+ self.eof = true;
+ }
+ Ok(n)
+ }
+}
+
+async fn read_client_head(
+ stream: &mut BoxedStream,
+ reader: &mut Reader,
+ max_head: usize,
+ idle: Duration,
+) -> std::result::Result, ParseError> {
+ loop {
+ match Head::parse(reader.data(), max_head)? {
+ ParseOutcome::Done { head, consumed } => {
+ reader.consume(consumed);
+ return Ok(Some(head));
+ }
+ ParseOutcome::NeedMore => {}
+ }
+ if reader.eof {
+ if reader.is_empty() {
+ return Ok(None);
+ }
+ return Err(ParseError::BadRequest);
+ }
+ let n = reader
+ .fill(stream, idle)
+ .await
+ .map_err(|_| ParseError::BadRequest)?;
+ if n == 0 && reader.is_empty() {
+ return Ok(None);
+ }
+ }
+}
+
+async fn read_backend_head(
+ stream: &mut BoxedStream,
+ reader: &mut Reader,
+ max_head: usize,
+ idle: Duration,
+) -> Result {
+ loop {
+ match Head::parse_response(reader.data(), max_head)
+ .map_err(|_| ProxyError::backend("malformed backend response head"))?
+ {
+ ParseOutcome::Done { head, consumed } => {
+ reader.consume(consumed);
+ return Ok(head);
+ }
+ ParseOutcome::NeedMore => {}
+ }
+ let n = reader
+ .fill(stream, idle)
+ .await
+ .map_err(|_| ProxyError::backend("reading backend"))?;
+ if n == 0 {
+ return Err(ProxyError::backend("backend closed before response head"));
+ }
+ }
+}
+
+async fn push_client(stream: &mut BoxedStream, bytes: &[u8]) -> Result<()> {
+ stream
+ .write_all(bytes)
+ .await
+ .map_err(|e| ProxyError::protocol(format!("writing client: {e}")))
+}
+
+async fn flush_client(stream: &mut BoxedStream) -> Result<()> {
+ stream
+ .flush()
+ .await
+ .map_err(|e| ProxyError::protocol(format!("flushing client: {e}")))
+}
+
+async fn push_backend(stream: &mut BoxedStream, bytes: &[u8]) -> Result<()> {
+ stream
+ .write_all(bytes)
+ .await
+ .map_err(|e| ProxyError::backend(format!("writing backend: {e}")))
+}
+
+async fn flush_backend(stream: &mut BoxedStream) -> Result<()> {
+ stream
+ .flush()
+ .await
+ .map_err(|e| ProxyError::backend(format!("flushing backend: {e}")))
+}
+
+async fn write_client(stream: &mut BoxedStream, bytes: &[u8]) -> Result<()> {
+ push_client(stream, bytes).await?;
+ flush_client(stream).await
+}
+
+async fn transfer_length(
+ src: &mut BoxedStream,
+ reader: &mut Reader,
+ dst: &mut BoxedStream,
+ to_backend: bool,
+ mut remaining: u64,
+ idle: Duration,
+) -> Result<()> {
+ while remaining > 0 {
+ if reader.is_empty() {
+ let n = reader.fill(src, idle).await?;
+ if n == 0 {
+ return Err(if to_backend {
+ ProxyError::protocol("client closed mid body")
+ } else {
+ ProxyError::backend("backend closed mid body")
+ });
+ }
+ }
+ let take = {
+ let avail = reader.data();
+ let take = (remaining as usize).min(avail.len());
+ forward(dst, &avail[..take], to_backend).await?;
+ take
+ };
+ reader.consume(take);
+ remaining -= take as u64;
+ }
+ Ok(())
+}
+
+async fn transfer_chunked(
+ src: &mut BoxedStream,
+ reader: &mut Reader,
+ dst: &mut BoxedStream,
+ to_backend: bool,
+ idle: Duration,
+) -> Result<()> {
+ loop {
+ let line = read_chunk_line(src, reader, idle).await?;
+ let size_str = line.split(';').next().unwrap_or("").trim();
+ let size = u64::from_str_radix(size_str, 16)
+ .map_err(|_| ProxyError::protocol("invalid chunk size"))?;
+
+ if size == 0 {
+ let mut frame = format!("{size:x}\r\n").into_bytes();
+ loop {
+ let trailer = read_chunk_line(src, reader, idle).await?;
+ frame.extend_from_slice(trailer.as_bytes());
+ frame.extend_from_slice(b"\r\n");
+ if trailer.is_empty() {
+ break;
+ }
+ }
+ forward(dst, &frame, to_backend).await?;
+ return Ok(());
+ }
+
+ let header = format!("{size:x}\r\n");
+ let mut remaining = size;
+ let mut header_pending = true;
+ while remaining > 0 {
+ if reader.is_empty() {
+ let n = reader.fill(src, idle).await?;
+ if n == 0 {
+ return Err(ProxyError::protocol("closed mid chunk"));
+ }
+ }
+ let take = (remaining as usize).min(reader.data().len());
+ let last = remaining - take as u64 == 0;
+ {
+ let avail = reader.data();
+ if header_pending || last {
+ let mut frame =
+ Vec::with_capacity(header.len() * header_pending as usize + take + 2);
+ if header_pending {
+ frame.extend_from_slice(header.as_bytes());
+ }
+ frame.extend_from_slice(&avail[..take]);
+ if last {
+ frame.extend_from_slice(b"\r\n");
+ }
+ forward(dst, &frame, to_backend).await?;
+ } else {
+ forward(dst, &avail[..take], to_backend).await?;
+ }
+ }
+ header_pending = false;
+ reader.consume(take);
+ remaining -= take as u64;
+ }
+
+ let crlf = read_chunk_line(src, reader, idle).await?;
+ if !crlf.is_empty() {
+ return Err(ProxyError::protocol("malformed chunk terminator"));
+ }
+ }
+}
+
+async fn forward(dst: &mut BoxedStream, bytes: &[u8], to_backend: bool) -> Result<()> {
+ if to_backend {
+ push_backend(dst, bytes).await
+ } else {
+ push_client(dst, bytes).await
+ }
+}
+
+async fn flush_side(dst: &mut BoxedStream, to_backend: bool) -> Result<()> {
+ if to_backend {
+ flush_backend(dst).await
+ } else {
+ flush_client(dst).await
+ }
+}
+
+async fn read_chunk_line(
+ src: &mut BoxedStream,
+ reader: &mut Reader,
+ idle: Duration,
+) -> Result {
+ loop {
+ let found = {
+ let data = reader.data();
+ if let Some(pos) = data.iter().position(|&b| b == b'\n') {
+ let mut end = pos;
+ if end > 0 && data[end - 1] == b'\r' {
+ end -= 1;
+ }
+ let line = String::from_utf8(data[..end].to_vec())
+ .map_err(|_| ProxyError::protocol("invalid chunk line"))?;
+ Some((line, pos + 1))
+ } else {
+ None
+ }
+ };
+ if let Some((line, consumed)) = found {
+ reader.consume(consumed);
+ return Ok(line);
+ }
+ if reader.data().len() > 16 * 1024 {
+ return Err(ProxyError::protocol("chunk line too long"));
+ }
+ let n = reader.fill(src, idle).await?;
+ if n == 0 {
+ return Err(ProxyError::protocol("closed reading chunk line"));
+ }
+ }
+}
+
+async fn stream_until_close(
+ src: &mut BoxedStream,
+ reader: &mut Reader,
+ dst: &mut BoxedStream,
+ to_backend: bool,
+ idle: Duration,
+) -> Result<()> {
+ if !reader.is_empty() {
+ let chunk = reader.take_data();
+ forward(dst, &chunk, to_backend).await?;
+ flush_side(dst, to_backend).await?;
+ }
+ loop {
+ let n = reader.fill(src, idle).await?;
+ if n == 0 {
+ return Ok(());
+ }
+ let chunk = reader.take_data();
+ forward(dst, &chunk, to_backend).await?;
+ flush_side(dst, to_backend).await?;
+ }
+}
+
+fn sanitize_inbound_forwarded(head: &mut Head, listener: &ListenerConfig) {
+ if listener.forwarded != ForwardedMode::Trust {
+ head.remove_header("forwarded");
+ head.remove_header("x-forwarded-for");
+ }
+}
+
+fn apply_outbound_forwarded(head: &mut Head, dest_forwarded: bool, peer: IpAddr) {
+ if !dest_forwarded {
+ return;
+ }
+ let for_node = match peer {
+ IpAddr::V4(v4) => format!("for={v4}"),
+ IpAddr::V6(v6) => format!("for=\"[{v6}]\""),
+ };
+ match head.header("forwarded").map(|v| v.to_string()) {
+ Some(existing) => head.set_header("forwarded", &format!("{existing}, {for_node}")),
+ None => head.set_header("forwarded", &for_node),
+ }
+ let xff = match head.header("x-forwarded-for").map(|v| v.to_string()) {
+ Some(existing) => format!("{existing}, {}", peer),
+ None => peer.to_string(),
+ };
+ head.set_header("x-forwarded-for", &xff);
+}
+
+fn response_no_body(req_method: &str, head: &Head) -> bool {
+ if req_method.eq_ignore_ascii_case("HEAD") {
+ return true;
+ }
+ matches!(head.framing, BodyFraming::None)
+}
+
+enum Disposition {
+ Close,
+ Hijack {
+ backend: BoxedStream,
+ to_backend: Vec,
+ to_client: Vec,
+ },
+}
+
+async fn shutdown_client(stream: &mut BoxedStream) {
+ let _ = timeout(Duration::from_secs(3), stream.shutdown()).await;
+}
+
+pub async fn handle(
+ ctx: &Ctx,
+ listener: &ListenerConfig,
+ mut stream: BoxedStream,
+ peer: SocketAddr,
+ local: SocketAddr,
+) -> Result<()> {
+ let bridge_idle = ctx.config.server.bridge_idle;
+ match serve(ctx, listener, &mut stream, peer, local).await {
+ Ok(Disposition::Close) => {
+ shutdown_client(&mut stream).await;
+ Ok(())
+ }
+ Ok(Disposition::Hijack {
+ backend,
+ to_backend,
+ to_client,
+ }) => {
+ crate::outbound::bridge(stream, backend, &to_backend, &to_client, bridge_idle, None)
+ .await?;
+ Ok(())
+ }
+ Err(e) => Err(e),
+ }
+}
+
+async fn serve(
+ ctx: &Ctx,
+ listener: &ListenerConfig,
+ stream: &mut BoxedStream,
+ peer: SocketAddr,
+ local: SocketAddr,
+) -> Result {
+ let router = ctx.http_router.as_ref();
+ let max_head = router.max_head_size;
+ let body_cap = router.body_extract_cap;
+ let bridge_idle = ctx.config.server.bridge_idle;
+ let idle = Idle {
+ body: router.relay_idle,
+ stream: bridge_idle,
+ };
+ let keepalive_timeout = router.keepalive_timeout;
+ let max_requests = router.max_keepalive_requests;
+
+ let mut reader = Reader::new();
+
+ let first_head = match timeout(
+ listener.preauth_timeout,
+ read_client_head(stream, &mut reader, max_head, listener.preauth_timeout),
+ )
+ .await
+ {
+ Ok(Ok(Some(h))) => h,
+ Ok(Ok(None)) => return Ok(Disposition::Close),
+ Ok(Err(e)) => {
+ let _ = write_client(stream, &error_response(e.status(), reason(e.status()))).await;
+ return Ok(Disposition::Close);
+ }
+ Err(_) => {
+ let _ = write_client(stream, &error_response(408, "Request Timeout")).await;
+ return Ok(Disposition::Close);
+ }
+ };
+
+ let mut first_head = first_head;
+ sanitize_inbound_forwarded(&mut first_head, listener);
+
+ let (buffered_body, dest_id) = match prepare(
+ ctx,
+ router,
+ stream,
+ &mut reader,
+ &mut first_head,
+ body_cap,
+ idle.body,
+ )
+ .await?
+ {
+ Some(t) => t,
+ None => {
+ let _ = write_client(stream, &error_response(404, "Not Found")).await;
+ return Ok(Disposition::Close);
+ }
+ };
+
+ let (dest, ep, tls_cfg) = match ctx.endpoint(&dest_id, Protocol::Http) {
+ Ok(t) => t,
+ Err(_) => {
+ let _ = write_client(stream, &error_response(502, "Bad Gateway")).await;
+ return Ok(Disposition::Close);
+ }
+ };
+
+ if ep.tls == TlsMode::Starttls {
+ let _ = write_client(stream, &error_response(502, "Bad Gateway")).await;
+ return Ok(Disposition::Close);
+ }
+
+ let fwd = dest.forwarding_for(Protocol::Http);
+ if let Err(e) = crate::proto::forward::guard_loop(
+ &ctx.self_binds,
+ dest,
+ ep,
+ fwd,
+ ctx.config.server.proxy_ttl,
+ ) {
+ tracing::warn!(error = %e, destination = %dest_id, "http loop guard");
+ let _ = write_client(stream, &error_response(502, "Bad Gateway")).await;
+ return Ok(Disposition::Close);
+ }
+ let mut backend = match crate::proto::common::establish(ctx, &dest_id, || {
+ crate::outbound::dial(dest, ep, fwd, &tls_cfg, peer, local)
+ })
+ .await
+ {
+ Ok(b) => b,
+ Err(_) => {
+ let _ = write_client(stream, &error_response(502, "Bad Gateway")).await;
+ return Ok(Disposition::Close);
+ }
+ };
+
+ let mut opts = ExchangeOpts {
+ dest_forwarded: dest.forwarded,
+ peer,
+ max_head,
+ idle,
+ force_close: false,
+ };
+ let mut backend_reader = Reader::new();
+
+ let mut current_head = first_head;
+ let mut current_body = buffered_body;
+ let mut served: u32 = 0;
+
+ loop {
+ served += 1;
+ opts.force_close = max_requests != 0 && served >= max_requests;
+
+ let outcome = exchange(
+ stream,
+ &mut reader,
+ &mut backend,
+ &mut backend_reader,
+ &mut current_head,
+ current_body.take(),
+ &opts,
+ )
+ .await;
+
+ match outcome {
+ Ok(ExchangeResult::KeepAlive) => {}
+ Ok(ExchangeResult::Hijack {
+ to_backend,
+ to_client,
+ }) => {
+ return Ok(Disposition::Hijack {
+ backend,
+ to_backend,
+ to_client,
+ });
+ }
+ Ok(ExchangeResult::Close) => return Ok(Disposition::Close),
+ Err(e) => return Err(e),
+ }
+
+ let next = match timeout(
+ keepalive_timeout,
+ read_client_head(stream, &mut reader, max_head, idle.body),
+ )
+ .await
+ {
+ Ok(Ok(Some(h))) => h,
+ Ok(Ok(None)) => return Ok(Disposition::Close),
+ Ok(Err(e)) => {
+ let _ = write_client(stream, &error_response(e.status(), reason(e.status()))).await;
+ return Ok(Disposition::Close);
+ }
+ Err(_) => return Ok(Disposition::Close),
+ };
+
+ let mut next = next;
+ sanitize_inbound_forwarded(&mut next, listener);
+
+ let (next_body, next_dest) = match prepare(
+ ctx,
+ router,
+ stream,
+ &mut reader,
+ &mut next,
+ body_cap,
+ idle.body,
+ )
+ .await?
+ {
+ Some(t) => t,
+ None => {
+ let _ = write_client(stream, &error_response(404, "Not Found")).await;
+ return Ok(Disposition::Close);
+ }
+ };
+
+ if next_dest != dest_id {
+ if let Some(body) = &next_body {
+ drain_buffered(stream, &mut reader, &next, body.len(), idle.body)
+ .await
+ .ok();
+ }
+ let _ = write_client(stream, &error_response(421, "Misdirected Request")).await;
+ return Ok(Disposition::Close);
+ }
+
+ current_head = next;
+ current_body = next_body;
+ }
+}
+
+enum ExchangeResult {
+ KeepAlive,
+ Hijack {
+ to_backend: Vec,
+ to_client: Vec,
+ },
+ Close,
+}
+
+#[derive(Clone, Copy)]
+struct ExchangeOpts {
+ dest_forwarded: bool,
+ peer: SocketAddr,
+ max_head: usize,
+ idle: Idle,
+ force_close: bool,
+}
+
+async fn exchange(
+ client: &mut BoxedStream,
+ client_reader: &mut Reader,
+ backend: &mut BoxedStream,
+ backend_reader: &mut Reader,
+ head: &mut Head,
+ buffered_body: Option>,
+ opts: &ExchangeOpts,
+) -> Result {
+ let max_head = opts.max_head;
+ let idle = opts.idle;
+
+ let flags = head.conn_flags();
+ let is_ws = flags.is_websocket_upgrade;
+ let client_close = opts.force_close || flags.close;
+
+ let expects_continue = head.expects_continue();
+ let req_method = head.method.clone();
+
+ apply_outbound_forwarded(head, opts.dest_forwarded, opts.peer.ip());
+
+ let serialized = head.serialize(false, is_ws);
+ push_backend(backend, &serialized).await?;
+
+ let buffered_len = buffered_body.as_ref().map(|b| b.len());
+ if let Some(body) = &buffered_body {
+ push_backend(backend, body).await?;
+ }
+
+ if is_ws {
+ flush_backend(backend).await?;
+ let resp = read_backend_head(backend, backend_reader, max_head, idle.body).await?;
+ if resp.status == 101 {
+ let resp_bytes = resp.serialize(false, true);
+ write_client(client, &resp_bytes).await?;
+ let to_backend = client_reader.take_data();
+ let to_client = backend_reader.take_data();
+ return Ok(ExchangeResult::Hijack {
+ to_backend,
+ to_client,
+ });
+ }
+ return finish_response(
+ client,
+ backend,
+ backend_reader,
+ &req_method,
+ resp,
+ client_close,
+ idle,
+ )
+ .await;
+ }
+
+ if expects_continue {
+ flush_backend(backend).await?;
+ loop {
+ let interim = read_backend_head(backend, backend_reader, max_head, idle.body).await?;
+ if interim.status == 100 {
+ write_client(client, &interim.serialize(false, false)).await?;
+ stream_request_remainder(client, client_reader, backend, head, buffered_len, idle)
+ .await?;
+ flush_backend(backend).await?;
+ return relay_response(
+ client,
+ backend,
+ backend_reader,
+ &req_method,
+ max_head,
+ client_close,
+ idle,
+ )
+ .await;
+ }
+ if (100..200).contains(&interim.status) {
+ write_client(client, &interim.serialize(false, false)).await?;
+ continue;
+ }
+ return finish_response(
+ client,
+ backend,
+ backend_reader,
+ &req_method,
+ interim,
+ true,
+ idle,
+ )
+ .await;
+ }
+ }
+
+ stream_request_remainder(client, client_reader, backend, head, buffered_len, idle).await?;
+ flush_backend(backend).await?;
+
+ relay_response(
+ client,
+ backend,
+ backend_reader,
+ &req_method,
+ max_head,
+ client_close,
+ idle,
+ )
+ .await
+}
+
+async fn stream_request_remainder(
+ client: &mut BoxedStream,
+ client_reader: &mut Reader,
+ backend: &mut BoxedStream,
+ head: &Head,
+ already_forwarded: Option,
+ idle: Idle,
+) -> Result<()> {
+ match head.framing {
+ BodyFraming::None | BodyFraming::UntilClose => Ok(()),
+ BodyFraming::Length(n) => {
+ let remaining = n.saturating_sub(already_forwarded.unwrap_or(0) as u64);
+ transfer_length(client, client_reader, backend, true, remaining, idle.body).await
+ }
+ BodyFraming::Chunked => {
+ transfer_chunked(client, client_reader, backend, true, idle.body).await
+ }
+ }
+}
+
+async fn relay_response(
+ client: &mut BoxedStream,
+ backend: &mut BoxedStream,
+ backend_reader: &mut Reader,
+ req_method: &str,
+ max_head: usize,
+ client_close: bool,
+ idle: Idle,
+) -> Result {
+ loop {
+ let resp = read_backend_head(backend, backend_reader, max_head, idle.body).await?;
+ if (100..200).contains(&resp.status) {
+ write_client(client, &resp.serialize(false, false)).await?;
+ continue;
+ }
+ return finish_response(
+ client,
+ backend,
+ backend_reader,
+ req_method,
+ resp,
+ client_close,
+ idle,
+ )
+ .await;
+ }
+}
+
+async fn finish_response(
+ client: &mut BoxedStream,
+ backend: &mut BoxedStream,
+ backend_reader: &mut Reader,
+ req_method: &str,
+ resp: Head,
+ force_close: bool,
+ idle: Idle,
+) -> Result {
+ let force_close = force_close || resp.conn_flags().close;
+ let is_sse = resp.is_sse();
+ let no_body = response_no_body(req_method, &resp);
+ let bytes = resp.serialize(force_close, false);
+ push_client(client, &bytes).await?;
+
+ let done = || {
+ if force_close {
+ ExchangeResult::Close
+ } else {
+ ExchangeResult::KeepAlive
+ }
+ };
+
+ if no_body {
+ flush_client(client).await?;
+ return Ok(done());
+ }
+
+ if is_sse {
+ flush_client(client).await?;
+ stream_until_close(backend, backend_reader, client, false, idle.stream).await?;
+ return Ok(ExchangeResult::Close);
+ }
+
+ match resp.framing {
+ BodyFraming::None => {
+ flush_client(client).await?;
+ Ok(done())
+ }
+ BodyFraming::Length(n) => {
+ transfer_length(backend, backend_reader, client, false, n, idle.body).await?;
+ flush_client(client).await?;
+ Ok(done())
+ }
+ BodyFraming::Chunked => {
+ transfer_chunked(backend, backend_reader, client, false, idle.body).await?;
+ flush_client(client).await?;
+ Ok(done())
+ }
+ BodyFraming::UntilClose => {
+ flush_client(client).await?;
+ stream_until_close(backend, backend_reader, client, false, idle.stream).await?;
+ Ok(ExchangeResult::Close)
+ }
+ }
+}
+
+async fn buffer_body(
+ client: &mut BoxedStream,
+ reader: &mut Reader,
+ head: &Head,
+ cap: usize,
+ idle: Duration,
+) -> Result> {
+ let mut body = Vec::new();
+ if let BodyFraming::Length(n) = head.framing {
+ let want = (n as usize).min(cap);
+ while body.len() < want {
+ if reader.is_empty() {
+ let got = reader.fill(client, idle).await?;
+ if got == 0 {
+ break;
+ }
+ }
+ let take = {
+ let avail = reader.data();
+ let take = (want - body.len()).min(avail.len());
+ body.extend_from_slice(&avail[..take]);
+ take
+ };
+ reader.consume(take);
+ }
+ }
+ Ok(body)
+}
+
+async fn drain_buffered(
+ client: &mut BoxedStream,
+ reader: &mut Reader,
+ head: &Head,
+ already: usize,
+ idle: Duration,
+) -> Result<()> {
+ if let BodyFraming::Length(n) = head.framing {
+ let mut remaining = (n as usize).saturating_sub(already) as u64;
+ while remaining > 0 {
+ if reader.is_empty() {
+ let got = reader.fill(client, idle).await?;
+ if got == 0 {
+ break;
+ }
+ }
+ let take = (remaining as usize).min(reader.data().len());
+ reader.consume(take);
+ remaining -= take as u64;
+ }
+ }
+ Ok(())
+}
+
+async fn prepare(
+ ctx: &Ctx,
+ router: &HttpRouter,
+ client: &mut BoxedStream,
+ reader: &mut Reader,
+ head: &mut Head,
+ body_cap: usize,
+ body_idle: Duration,
+) -> Result>, String)>> {
+ let idx = match router.match_index(head) {
+ Some(i) => i,
+ None => return Ok(None),
+ };
+
+ let body = if router.needs_body_at(idx) {
+ if head.expects_continue() {
+ write_client(client, b"HTTP/1.1 100 Continue\r\n\r\n").await?;
+ head.remove_header("expect");
+ }
+ Some(buffer_body(client, reader, head, body_cap, body_idle).await?)
+ } else {
+ None
+ };
+
+ let dest_id = match router.route_at(idx, head, body.as_deref()) {
+ RouteOutcome::Pin { dest_id } => dest_id,
+ RouteOutcome::Identifier {
+ identifier,
+ fallback,
+ } => {
+ if identifier.is_none() && fallback.is_none() {
+ ctx.resolve(None).await.to_string()
+ } else {
+ ctx.resolve(identifier.as_deref()).await.to_string()
+ }
+ }
+ };
+
+ Ok(Some((body, dest_id)))
+}
+
+fn reason(status: u16) -> &'static str {
+ match status {
+ 400 => "Bad Request",
+ 404 => "Not Found",
+ 405 => "Method Not Allowed",
+ 408 => "Request Timeout",
+ 421 => "Misdirected Request",
+ 431 => "Request Header Fields Too Large",
+ 502 => "Bad Gateway",
+ 505 => "HTTP Version Not Supported",
+ _ => "Error",
+ }
+}
diff --git a/src/http/router.rs b/src/http/router.rs
new file mode 100644
index 0000000..69d8e77
--- /dev/null
+++ b/src/http/router.rs
@@ -0,0 +1,439 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use std::time::Duration;
+
+use base64::{Engine, engine::general_purpose::STANDARD as BASE64};
+use globset::{Glob, GlobSet, GlobSetBuilder};
+use regex::Regex;
+
+use crate::config::{ExtractFrom, HttpConfig, HttpExtract, HttpRoute};
+use crate::error::{ProxyError, Result};
+use crate::http::head::Head;
+use crate::token::bearer_identifier;
+
+pub enum RouteOutcome {
+ Pin {
+ dest_id: String,
+ },
+ Identifier {
+ identifier: Option,
+ fallback: Option,
+ },
+}
+
+struct CompiledExtract {
+ from: ExtractFrom,
+ regex: Option,
+ param: Option,
+ header: Option,
+}
+
+struct CompiledRoute {
+ destination: Option,
+ extract: Option,
+ fallback: Option,
+ needs_body: bool,
+}
+
+pub struct HttpRouter {
+ set: GlobSet,
+ routes: Vec,
+ jwt_username_claim: String,
+ pub body_extract_cap: usize,
+ pub max_head_size: usize,
+ pub relay_idle: Duration,
+ pub keepalive_timeout: Duration,
+ pub max_keepalive_requests: u32,
+}
+
+impl HttpRouter {
+ pub fn build(http: &HttpConfig, jwt_username_claim: String) -> Result {
+ let mut builder = GlobSetBuilder::new();
+ let mut routes = Vec::with_capacity(http.route.len());
+ for route in &http.route {
+ builder.add(
+ Glob::new(&route.match_glob)
+ .map_err(|e| ProxyError::config(format!("invalid http route glob: {e}")))?,
+ );
+ routes.push(compile_route(route)?);
+ }
+ let set = builder
+ .build()
+ .map_err(|e| ProxyError::config(format!("invalid http route set: {e}")))?;
+ Ok(HttpRouter {
+ set,
+ routes,
+ jwt_username_claim,
+ body_extract_cap: http.body_extract_cap,
+ max_head_size: http.max_head_size,
+ relay_idle: http.relay_idle,
+ keepalive_timeout: http.keepalive_timeout,
+ max_keepalive_requests: http.max_keepalive_requests,
+ })
+ }
+
+ pub fn match_index(&self, head: &Head) -> Option {
+ let path = head.path();
+ let raw = self.set.matches(path).into_iter().min();
+ let trimmed = path.trim_end_matches('/');
+ let normalized = if trimmed.len() != path.len() && !trimmed.is_empty() {
+ self.set.matches(trimmed).into_iter().min()
+ } else {
+ None
+ };
+ match (raw, normalized) {
+ (Some(a), Some(b)) => Some(a.min(b)),
+ (a, b) => a.or(b),
+ }
+ }
+
+ pub fn needs_body_at(&self, idx: usize) -> bool {
+ self.routes[idx].needs_body
+ }
+
+ pub fn route_at(&self, idx: usize, head: &Head, body: Option<&[u8]>) -> RouteOutcome {
+ let route = &self.routes[idx];
+ if let Some(dest) = &route.destination {
+ return RouteOutcome::Pin {
+ dest_id: dest.clone(),
+ };
+ }
+ let identifier = match &route.extract {
+ Some(extract) => self.extract(extract, head, body),
+ None => None,
+ };
+ RouteOutcome::Identifier {
+ identifier,
+ fallback: route.fallback.clone(),
+ }
+ }
+
+ fn extract(
+ &self,
+ extract: &CompiledExtract,
+ head: &Head,
+ body: Option<&[u8]>,
+ ) -> Option {
+ match extract.from {
+ ExtractFrom::Authorization => self.extract_authorization(head),
+ ExtractFrom::Query => {
+ let param = extract.param.as_deref()?;
+ let query = head.query()?;
+ query_param(query, param)
+ }
+ ExtractFrom::Body => {
+ let re = extract.regex.as_ref()?;
+ let body = body?;
+ let text = std::str::from_utf8(body).ok()?;
+ let caps = re.captures(text)?;
+ let raw = caps.get(1)?.as_str();
+ Some(form_decode(raw))
+ }
+ ExtractFrom::Header => {
+ let name = extract.header.as_deref()?;
+ head.header(name).map(|v| v.to_string())
+ }
+ }
+ }
+
+ fn extract_authorization(&self, head: &Head) -> Option {
+ let value = head.header("authorization")?;
+ let value = value.trim();
+ if let Some(rest) = strip_scheme(value, "basic") {
+ let decoded = BASE64.decode(rest.trim()).ok()?;
+ let text = String::from_utf8(decoded).ok()?;
+ let login = match text.split_once(':') {
+ Some((login, _)) => login,
+ None => text.as_str(),
+ };
+ return Some(login.trim().to_lowercase());
+ }
+ if let Some(rest) = strip_scheme(value, "bearer") {
+ return bearer_identifier(rest.trim(), &self.jwt_username_claim);
+ }
+ None
+ }
+}
+
+fn strip_scheme<'a>(value: &'a str, scheme: &str) -> Option<&'a str> {
+ if value.len() < scheme.len() + 1 {
+ return None;
+ }
+ let (head, rest) = value.split_at(scheme.len());
+ if head.eq_ignore_ascii_case(scheme) && rest.starts_with(' ') {
+ Some(&rest[1..])
+ } else {
+ None
+ }
+}
+
+fn compile_route(route: &HttpRoute) -> Result {
+ let extract = match &route.extract {
+ Some(e) => Some(compile_extract(e)?),
+ None => None,
+ };
+ let needs_body = matches!(
+ &route.extract,
+ Some(HttpExtract {
+ from: ExtractFrom::Body,
+ ..
+ })
+ );
+ Ok(CompiledRoute {
+ destination: route.destination.clone(),
+ extract,
+ fallback: route.fallback.clone(),
+ needs_body,
+ })
+}
+
+fn compile_extract(extract: &HttpExtract) -> Result {
+ let regex = match &extract.regex {
+ Some(re) => Some(
+ Regex::new(re)
+ .map_err(|e| ProxyError::config(format!("invalid http extract regex: {e}")))?,
+ ),
+ None => None,
+ };
+ Ok(CompiledExtract {
+ from: extract.from,
+ regex,
+ param: extract.param.clone(),
+ header: extract.header.clone(),
+ })
+}
+
+fn query_param(query: &str, param: &str) -> Option {
+ for pair in query.split('&') {
+ let (key, value) = match pair.split_once('=') {
+ Some((k, v)) => (k, v),
+ None => (pair, ""),
+ };
+ if form_decode(key) == param {
+ return Some(form_decode(value));
+ }
+ }
+ None
+}
+
+fn form_decode(input: &str) -> String {
+ let replaced = input.replace('+', " ");
+ percent_encoding::percent_decode_str(&replaced)
+ .decode_utf8_lossy()
+ .into_owned()
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+ use crate::config::HttpConfig;
+ use crate::http::head::{Head, ParseOutcome};
+
+ fn parse(buf: &[u8]) -> Head {
+ match Head::parse(buf, 64 * 1024).unwrap() {
+ ParseOutcome::Done { head, .. } => head,
+ _ => panic!("need more"),
+ }
+ }
+
+ fn route(router: &HttpRouter, head: &Head, body: Option<&[u8]>) -> RouteOutcome {
+ let idx = router.match_index(head).expect("route should match");
+ router.route_at(idx, head, body)
+ }
+
+ fn router_from_toml(toml: &str) -> HttpRouter {
+ let http: HttpConfig = toml::from_str(toml).unwrap();
+ HttpRouter::build(&http, "email".to_string()).unwrap()
+ }
+
+ #[test]
+ fn glob_first_match_wins() {
+ let router = router_from_toml(
+ r#"
+[[route]]
+match = "/.well-known/**"
+destination = "legacy"
+[[route]]
+match = "/**"
+destination = "other"
+"#,
+ );
+ let head = parse(b"GET /.well-known/jmap HTTP/1.1\r\nHost: x\r\n\r\n");
+ match route(&router, &head, None) {
+ RouteOutcome::Pin { dest_id } => assert_eq!(dest_id, "legacy"),
+ _ => panic!("expected pin"),
+ }
+ let head = parse(b"GET /other/path HTTP/1.1\r\nHost: x\r\n\r\n");
+ match route(&router, &head, None) {
+ RouteOutcome::Pin { dest_id } => assert_eq!(dest_id, "other"),
+ _ => panic!("expected pin"),
+ }
+ }
+
+ #[test]
+ fn trailing_slash_matches_specific_route_over_catchall() {
+ let router = router_from_toml(
+ r#"
+[[route]]
+match = "/api"
+destination = "legacy"
+[[route]]
+match = "/**"
+destination = "other"
+"#,
+ );
+ let head = parse(b"GET /api/ HTTP/1.1\r\nHost: x\r\n\r\n");
+ match route(&router, &head, None) {
+ RouteOutcome::Pin { dest_id } => assert_eq!(dest_id, "legacy"),
+ _ => panic!("expected pin"),
+ }
+ assert_eq!(head.path(), "/api/");
+ }
+
+ #[test]
+ fn root_path_not_emptied_by_trim() {
+ let router = router_from_toml(
+ r#"
+[[route]]
+match = "/"
+destination = "legacy"
+"#,
+ );
+ let head = parse(b"GET / HTTP/1.1\r\nHost: x\r\n\r\n");
+ match route(&router, &head, None) {
+ RouteOutcome::Pin { dest_id } => assert_eq!(dest_id, "legacy"),
+ _ => panic!("expected pin"),
+ }
+ }
+
+ #[test]
+ fn static_pin_vs_identifier() {
+ let router = router_from_toml(
+ r#"
+[[route]]
+match = "/static"
+destination = "legacy"
+[[route]]
+match = "/**"
+extract = { from = "authorization" }
+fallback = "default"
+"#,
+ );
+ let head = parse(b"GET /static HTTP/1.1\r\nHost: x\r\n\r\n");
+ assert!(matches!(
+ route(&router, &head, None),
+ RouteOutcome::Pin { .. }
+ ));
+ let head = parse(b"GET /dyn HTTP/1.1\r\nHost: x\r\n\r\n");
+ match route(&router, &head, None) {
+ RouteOutcome::Identifier { fallback, .. } => {
+ assert_eq!(fallback.as_deref(), Some("default"));
+ }
+ _ => panic!("expected identifier"),
+ }
+ }
+
+ #[test]
+ fn basic_auth_lowercased() {
+ let router = router_from_toml(
+ r#"
+[[route]]
+match = "/**"
+extract = { from = "authorization" }
+"#,
+ );
+ let creds = BASE64.encode("Alice@Example.COM:secret");
+ let req = format!("GET / HTTP/1.1\r\nHost: x\r\nAuthorization: Basic {creds}\r\n\r\n");
+ let head = parse(req.as_bytes());
+ match route(&router, &head, None) {
+ RouteOutcome::Identifier { identifier, .. } => {
+ assert_eq!(identifier.as_deref(), Some("alice@example.com"));
+ }
+ _ => panic!("expected identifier"),
+ }
+ }
+
+ #[test]
+ fn bearer_uses_bearer_identifier() {
+ use base64::engine::general_purpose::URL_SAFE_NO_PAD;
+ let router = router_from_toml(
+ r#"
+[[route]]
+match = "/**"
+extract = { from = "authorization" }
+"#,
+ );
+ let claims = URL_SAFE_NO_PAD.encode(r#"{"email":"bob@example.com"}"#);
+ let token = format!("hdr.{claims}.sig");
+ let req = format!("GET / HTTP/1.1\r\nHost: x\r\nAuthorization: Bearer {token}\r\n\r\n");
+ let head = parse(req.as_bytes());
+ match route(&router, &head, None) {
+ RouteOutcome::Identifier { identifier, .. } => {
+ assert_eq!(identifier.as_deref(), Some("bob@example.com"));
+ }
+ _ => panic!("expected identifier"),
+ }
+ }
+
+ #[test]
+ fn query_param_url_decoded() {
+ let router = router_from_toml(
+ r#"
+[[route]]
+match = "/oauth/**"
+extract = { from = "query", param = "login_hint" }
+"#,
+ );
+ let head = parse(
+ b"GET /oauth/authorize?login_hint=user%40example.com&x=1 HTTP/1.1\r\nHost: x\r\n\r\n",
+ );
+ match route(&router, &head, None) {
+ RouteOutcome::Identifier { identifier, .. } => {
+ assert_eq!(identifier.as_deref(), Some("user@example.com"));
+ }
+ _ => panic!("expected identifier"),
+ }
+ }
+
+ #[test]
+ fn body_regex_capture() {
+ let router = router_from_toml(
+ r#"
+[[route]]
+match = "/auth/token"
+extract = { from = "body", regex = "username=([^&]+)" }
+"#,
+ );
+ let head = parse(b"POST /auth/token HTTP/1.1\r\nHost: x\r\nContent-Length: 30\r\n\r\n");
+ assert!(router.needs_body_at(router.match_index(&head).unwrap()));
+ let body = b"grant=x&username=joe%40corp.com";
+ match route(&router, &head, Some(body)) {
+ RouteOutcome::Identifier { identifier, .. } => {
+ assert_eq!(identifier.as_deref(), Some("joe@corp.com"));
+ }
+ _ => panic!("expected identifier"),
+ }
+ }
+
+ #[test]
+ fn header_extraction() {
+ let router = router_from_toml(
+ r#"
+[[route]]
+match = "/**"
+extract = { from = "header", header = "X-User" }
+"#,
+ );
+ let head = parse(b"GET / HTTP/1.1\r\nHost: x\r\nX-User: someone\r\n\r\n");
+ match route(&router, &head, None) {
+ RouteOutcome::Identifier { identifier, .. } => {
+ assert_eq!(identifier.as_deref(), Some("someone"));
+ }
+ _ => panic!("expected identifier"),
+ }
+ }
+}
diff --git a/src/imap_receiver.rs b/src/imap_receiver.rs
new file mode 100644
index 0000000..7928f9c
--- /dev/null
+++ b/src/imap_receiver.rs
@@ -0,0 +1,657 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use std::fmt::Display;
+
+#[derive(Debug, Clone)]
+pub enum Error {
+ NeedsMoreData,
+ NeedsLiteral { size: u32 },
+ Parse { message: String },
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Request {
+ pub tag: String,
+ pub command: T,
+ pub tokens: Vec,
+}
+
+pub trait CommandParser: Sized + Default {
+ fn parse(bytes: &[u8], is_uid: bool) -> Option;
+ fn tokenize_brackets(&self) -> bool;
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Token {
+ Argument(Vec),
+ ParenthesisOpen,
+ ParenthesisClose,
+ BracketOpen,
+ BracketClose,
+ Lt,
+ Gt,
+ Dot,
+ Nil,
+}
+
+impl Default for Request {
+ fn default() -> Self {
+ Self {
+ tag: String::new(),
+ command: T::default(),
+ tokens: Vec::new(),
+ }
+ }
+}
+
+#[derive(Debug, Copy, Clone, PartialEq, Eq)]
+pub enum State {
+ Start,
+ Tag,
+ Command { is_uid: bool },
+ Argument { last_ch: u8 },
+ ArgumentQuoted { escaped: bool },
+ Literal { non_sync: bool },
+ LiteralSeek { size: u32, non_sync: bool },
+ LiteralData { remaining: u32 },
+}
+
+pub struct Receiver {
+ buf: ArgumentBuffer,
+ pub request: Request,
+ pub state: State,
+ pub max_request_size: usize,
+ pub current_request_size: usize,
+ pub start_state: State,
+}
+
+const ARG_MAX_LEN: usize = 8000;
+
+struct ArgumentBuffer {
+ buf: Vec,
+}
+
+impl Receiver {
+ pub fn new() -> Self {
+ Receiver {
+ max_request_size: 25 * 1024 * 1024,
+ ..Default::default()
+ }
+ }
+
+ pub fn with_start_state(mut self, state: State) -> Self {
+ self.state = state;
+ self.start_state = state;
+ self
+ }
+
+ pub fn error_reset(&mut self, message: impl Into) -> Error {
+ let _request = std::mem::take(&mut self.request);
+ let err = Error::Parse {
+ message: message.into(),
+ };
+ self.buf = ArgumentBuffer::default();
+ self.state = self.start_state;
+ self.current_request_size = 0;
+ err
+ }
+
+ fn push_argument(&mut self, in_quote: bool) -> Result<(), Error> {
+ if !self.buf.is_empty() {
+ self.current_request_size += self.buf.len();
+ if self.current_request_size > self.max_request_size {
+ return Err(self.error_reset(format!(
+ "Request exceeds maximum limit of {} bytes.",
+ self.max_request_size
+ )));
+ }
+ self.request.tokens.push(Token::Argument(self.buf.take()));
+ } else if in_quote {
+ self.request.tokens.push(Token::Nil);
+ }
+ Ok(())
+ }
+
+ fn push_token(&mut self, token: Token) -> Result<(), Error> {
+ self.current_request_size += 1;
+ if self.current_request_size > self.max_request_size {
+ return Err(self.error_reset(format!(
+ "Request exceeds maximum limit of {} bytes.",
+ self.max_request_size
+ )));
+ }
+ self.request.tokens.push(token);
+ Ok(())
+ }
+
+ pub fn parse(&mut self, bytes: &mut std::slice::Iter<'_, u8>) -> Result, Error> {
+ for &ch in bytes.by_ref() {
+ match self.state {
+ State::Start => {
+ if !ch.is_ascii_whitespace() {
+ self.buf.push_unchecked(ch);
+ self.state = State::Tag;
+ }
+ }
+ State::Tag => match ch {
+ b' ' => {
+ if !self.buf.is_empty() {
+ self.request.tag =
+ String::from_utf8(self.buf.take()).map_err(|_| {
+ self.error_reset("Tag is not a valid UTF-8 string.")
+ })?;
+ self.state = State::Command { is_uid: false };
+ }
+ }
+ b'\t' | b'\r' => {}
+ b'\n' => {
+ return Err(self.error_reset(format!(
+ "Missing command after tag {:?}, found CRLF instead.",
+ self.buf.as_str()
+ )));
+ }
+ _ => {
+ self.buf.push_checked(ch, 128).map_err(|_| {
+ self.error_reset("Tag exceeds maximum length of 128 characters.")
+ })?;
+ }
+ },
+ State::Command { is_uid } => {
+ if ch.is_ascii_alphanumeric() {
+ self.buf
+ .push_checked(ch.to_ascii_uppercase(), 15)
+ .map_err(|_| {
+ self.error_reset("Command exceeds maximum length of 15 characters.")
+ })?;
+ } else if ch.is_ascii_whitespace() {
+ if !self.buf.is_empty() {
+ if !self.buf.as_ref().eq_ignore_ascii_case(b"UID") {
+ self.request.command = T::parse(self.buf.as_ref(), is_uid)
+ .ok_or_else(|| {
+ let err = format!(
+ "Unrecognized command '{}'.",
+ String::from_utf8_lossy(self.buf.as_ref())
+ );
+ self.error_reset(err)
+ })?;
+ self.buf.clear();
+ if ch != b'\n' {
+ self.state = State::Argument { last_ch: b' ' };
+ } else {
+ self.state = self.start_state;
+ self.current_request_size = 0;
+ return Ok(std::mem::take(&mut self.request));
+ }
+ } else {
+ self.buf.clear();
+ self.state = State::Command { is_uid: true };
+ }
+ }
+ } else {
+ return Err(self.error_reset(format!(
+ "Invalid character {:?} in command name.",
+ ch as char
+ )));
+ }
+ }
+ State::Argument { last_ch } => match ch {
+ b'\"' if last_ch.is_ascii_whitespace() => {
+ self.push_argument(false)?;
+ self.state = State::ArgumentQuoted { escaped: false };
+ }
+ b'{' if last_ch.is_ascii_whitespace()
+ || (last_ch == b'~' && self.buf.len() == 1) =>
+ {
+ if last_ch != b'~' {
+ self.push_argument(false)?;
+ } else {
+ self.buf.clear();
+ }
+ self.state = State::Literal { non_sync: false };
+ }
+ b'(' => {
+ self.push_argument(false)?;
+ self.push_token(Token::ParenthesisOpen)?;
+ }
+ b')' => {
+ self.push_argument(false)?;
+ self.push_token(Token::ParenthesisClose)?;
+ }
+ b'[' if self.request.command.tokenize_brackets() => {
+ self.push_argument(false)?;
+ self.push_token(Token::BracketOpen)?;
+ }
+ b']' if self.request.command.tokenize_brackets() => {
+ self.push_argument(false)?;
+ self.push_token(Token::BracketClose)?;
+ }
+ b'<' if self.request.command.tokenize_brackets() => {
+ self.push_argument(false)?;
+ self.push_token(Token::Lt)?;
+ }
+ b'>' if self.request.command.tokenize_brackets() => {
+ self.push_argument(false)?;
+ self.push_token(Token::Gt)?;
+ }
+ b'.' if self.request.command.tokenize_brackets() => {
+ self.push_argument(false)?;
+ self.push_token(Token::Dot)?;
+ }
+ b'\n' => {
+ self.push_argument(false)?;
+ self.state = self.start_state;
+ self.current_request_size = 0;
+ return Ok(std::mem::take(&mut self.request));
+ }
+ _ if ch.is_ascii_whitespace() => {
+ self.push_argument(false)?;
+ self.state = State::Argument { last_ch: ch };
+ }
+ _ => {
+ self.buf.push_checked(ch, ARG_MAX_LEN).map_err(|_| {
+ self.error_reset("Argument exceeds maximum length of 8000 bytes.")
+ })?;
+ self.state = State::Argument { last_ch: ch };
+ }
+ },
+ State::ArgumentQuoted { escaped } => match ch {
+ b'\"' => {
+ if !escaped {
+ self.push_argument(true)?;
+ self.state = State::Argument { last_ch: b' ' };
+ } else {
+ self.buf
+ .push_checked(ch, ARG_MAX_LEN)
+ .map_err(|_| self.error_reset("Quoted argument too long."))?;
+ self.state = State::ArgumentQuoted { escaped: false };
+ }
+ }
+ b'\\' => {
+ if escaped {
+ self.buf
+ .push_checked(ch, ARG_MAX_LEN)
+ .map_err(|_| self.error_reset("Quoted argument too long."))?;
+ }
+ self.state = State::ArgumentQuoted { escaped: !escaped };
+ }
+ b'\n' => {
+ return Err(self.error_reset("Unterminated quoted argument."));
+ }
+ _ => {
+ if escaped {
+ self.buf.push_unchecked(b'\\');
+ }
+ self.buf
+ .push_checked(ch, ARG_MAX_LEN)
+ .map_err(|_| self.error_reset("Quoted argument too long."))?;
+ self.state = State::ArgumentQuoted { escaped: false };
+ }
+ },
+ State::Literal { non_sync } => match ch {
+ b'}' => {
+ if !self.buf.is_empty() {
+ let size = self.buf.as_str().parse::().map_err(|_| {
+ self.error_reset("Literal size is not a valid number.")
+ })?;
+ if self.current_request_size + size as usize > self.max_request_size {
+ return Err(self.error_reset(format!(
+ "Literal exceeds the maximum request size of {} bytes.",
+ self.max_request_size
+ )));
+ }
+ self.state = State::LiteralSeek { size, non_sync };
+ self.buf.resize_buffer(size as usize);
+ self.buf.clear();
+ } else {
+ return Err(self.error_reset("Invalid empty literal."));
+ }
+ }
+ b'+' => {
+ if !self.buf.is_empty() {
+ self.state = State::Literal { non_sync: true };
+ } else {
+ return Err(self.error_reset("Invalid non-sync literal."));
+ }
+ }
+ _ if ch.is_ascii_digit() => {
+ if !non_sync {
+ self.buf.push_checked(ch, 15).map_err(|_| {
+ self.error_reset("Literal size exceeds maximum of 15 digits.")
+ })?;
+ } else {
+ return Err(self.error_reset("Invalid literal."));
+ }
+ }
+ _ => {
+ return Err(self.error_reset(format!(
+ "Invalid character {:?} in literal.",
+ ch as char
+ )));
+ }
+ },
+ State::LiteralSeek { size, non_sync } => {
+ if ch == b'\n' {
+ if size > 0 {
+ self.state = State::LiteralData { remaining: size };
+ } else {
+ self.state = State::Argument { last_ch: b' ' };
+ self.push_token(Token::Nil)?;
+ }
+ if !non_sync {
+ return Err(Error::NeedsLiteral { size });
+ }
+ } else if !ch.is_ascii_whitespace() {
+ return Err(
+ self.error_reset("Expected CRLF after literal, found an invalid char.")
+ );
+ }
+ }
+ State::LiteralData { remaining } => {
+ self.buf.push_unchecked(ch);
+
+ if remaining > 1 {
+ self.state = State::LiteralData {
+ remaining: remaining - 1,
+ };
+ } else {
+ self.push_argument(false)?;
+ self.state = State::Argument { last_ch: b' ' };
+ }
+ }
+ }
+ }
+
+ Err(Error::NeedsMoreData)
+ }
+}
+
+impl ArgumentBuffer {
+ pub fn new() -> Self {
+ ArgumentBuffer {
+ buf: Vec::with_capacity(10),
+ }
+ }
+
+ pub fn resize_buffer(&mut self, size: usize) {
+ if self.buf.capacity() < size {
+ self.buf.reserve(size - self.buf.capacity());
+ }
+ }
+
+ #[inline(always)]
+ pub fn push_checked(&mut self, byte: u8, limit: usize) -> Result<(), ()> {
+ if self.buf.len() < limit {
+ self.buf.push(byte);
+ Ok(())
+ } else {
+ Err(())
+ }
+ }
+
+ #[inline(always)]
+ pub fn push_unchecked(&mut self, byte: u8) {
+ self.buf.push(byte);
+ }
+
+ pub fn take(&mut self) -> Vec {
+ std::mem::take(&mut self.buf)
+ }
+
+ #[inline(always)]
+ pub fn len(&self) -> usize {
+ self.buf.len()
+ }
+
+ #[inline(always)]
+ pub fn is_empty(&self) -> bool {
+ self.buf.is_empty()
+ }
+
+ #[inline(always)]
+ pub fn clear(&mut self) {
+ self.buf.clear();
+ }
+
+ #[inline(always)]
+ pub fn as_str(&self) -> &str {
+ std::str::from_utf8(&self.buf).unwrap_or_default()
+ }
+}
+
+impl AsRef<[u8]> for ArgumentBuffer {
+ fn as_ref(&self) -> &[u8] {
+ &self.buf
+ }
+}
+
+impl Default for ArgumentBuffer {
+ fn default() -> Self {
+ Self::new()
+ }
+}
+
+impl Display for Token {
+ fn fmt(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
+ f.write_str(&String::from_utf8_lossy(self.as_bytes()))
+ }
+}
+
+impl Token {
+ pub fn as_bytes(&self) -> &[u8] {
+ match self {
+ Token::Argument(value) => value,
+ Token::ParenthesisOpen => b"(",
+ Token::ParenthesisClose => b")",
+ Token::BracketOpen => b"[",
+ Token::BracketClose => b"]",
+ Token::Gt => b">",
+ Token::Lt => b"<",
+ Token::Dot => b".",
+ Token::Nil => b"",
+ }
+ }
+}
+
+impl Default for Receiver {
+ fn default() -> Self {
+ Self {
+ buf: Default::default(),
+ request: Default::default(),
+ state: State::Start,
+ start_state: State::Start,
+ max_request_size: 25 * 1024 * 1024,
+ current_request_size: 0,
+ }
+ }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub enum Command {
+ #[default]
+ Other,
+ Capability,
+ Noop,
+ Logout,
+ Id,
+ StartTls,
+ Authenticate,
+ Login,
+ Enable,
+ Unauthenticate,
+}
+
+impl CommandParser for Command {
+ fn parse(bytes: &[u8], _is_uid: bool) -> Option {
+ Some(match bytes {
+ b if b.eq_ignore_ascii_case(b"CAPABILITY") => Command::Capability,
+ b if b.eq_ignore_ascii_case(b"NOOP") => Command::Noop,
+ b if b.eq_ignore_ascii_case(b"LOGOUT") => Command::Logout,
+ b if b.eq_ignore_ascii_case(b"ID") => Command::Id,
+ b if b.eq_ignore_ascii_case(b"STARTTLS") => Command::StartTls,
+ b if b.eq_ignore_ascii_case(b"AUTHENTICATE") => Command::Authenticate,
+ b if b.eq_ignore_ascii_case(b"LOGIN") => Command::Login,
+ b if b.eq_ignore_ascii_case(b"ENABLE") => Command::Enable,
+ b if b.eq_ignore_ascii_case(b"UNAUTHENTICATE") => Command::Unauthenticate,
+ _ => Command::Other,
+ })
+ }
+
+ fn tokenize_brackets(&self) -> bool {
+ false
+ }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Mechanism {
+ Plain,
+ OAuthBearer,
+ XOauth2,
+ Login,
+ Other(String),
+}
+
+impl Mechanism {
+ pub fn parse(bytes: &[u8]) -> Mechanism {
+ if bytes.eq_ignore_ascii_case(b"PLAIN") {
+ Mechanism::Plain
+ } else if bytes.eq_ignore_ascii_case(b"OAUTHBEARER") {
+ Mechanism::OAuthBearer
+ } else if bytes.eq_ignore_ascii_case(b"XOAUTH2") {
+ Mechanism::XOauth2
+ } else if bytes.eq_ignore_ascii_case(b"LOGIN") {
+ Mechanism::Login
+ } else {
+ Mechanism::Other(String::from_utf8_lossy(bytes).to_ascii_uppercase())
+ }
+ }
+}
+
+#[cfg(test)]
+mod tests {
+ use super::{Command, Error, Receiver, Request, Token};
+
+ #[test]
+ fn receiver_parse_ok() {
+ let mut receiver = Receiver::new();
+
+ for (frames, expected_requests) in [
+ (
+ vec!["abcd CAPABILITY\r\n"],
+ vec![Request {
+ tag: "abcd".into(),
+ command: Command::Capability,
+ tokens: vec![],
+ }],
+ ),
+ (
+ vec!["A023 LO", "GOUT\r\n"],
+ vec![Request {
+ tag: "A023".into(),
+ command: Command::Logout,
+ tokens: vec![],
+ }],
+ ),
+ (
+ vec![" A001 AUTHENTICATE GSSAPI \r\n"],
+ vec![Request {
+ tag: "A001".into(),
+ command: Command::Authenticate,
+ tokens: vec![Token::Argument(b"GSSAPI".to_vec())],
+ }],
+ ),
+ (
+ vec!["A03 AUTHENTICATE ", "PLAIN dGVzdAB0ZXN", "0AHRlc3Q=\r\n"],
+ vec![Request {
+ tag: "A03".into(),
+ command: Command::Authenticate,
+ tokens: vec![
+ Token::Argument(b"PLAIN".to_vec()),
+ Token::Argument(b"dGVzdAB0ZXN0AHRlc3Q=".to_vec()),
+ ],
+ }],
+ ),
+ (
+ vec!["A001 LOGIN {11}\r\n", "FRED FOOBAR {7}\r\n", "fat man\r\n"],
+ vec![Request {
+ tag: "A001".into(),
+ command: Command::Login,
+ tokens: vec![
+ Token::Argument(b"FRED FOOBAR".to_vec()),
+ Token::Argument(b"fat man".to_vec()),
+ ],
+ }],
+ ),
+ (
+ vec!["abc LOGIN {0}\r\n", "\r\n"],
+ vec![Request {
+ tag: "abc".into(),
+ command: Command::Login,
+ tokens: vec![Token::Nil],
+ }],
+ ),
+ (
+ vec!["abc LOGIN {0+}\r\n\r\n"],
+ vec![Request {
+ tag: "abc".into(),
+ command: Command::Login,
+ tokens: vec![Token::Nil],
+ }],
+ ),
+ (
+ vec!["001 NOOP\r\n002 CAPABILITY\r\nabc LOGIN hello world\r\n"],
+ vec![
+ Request {
+ tag: "001".into(),
+ command: Command::Noop,
+ tokens: vec![],
+ },
+ Request {
+ tag: "002".into(),
+ command: Command::Capability,
+ tokens: vec![],
+ },
+ Request {
+ tag: "abc".into(),
+ command: Command::Login,
+ tokens: vec![
+ Token::Argument(b"hello".to_vec()),
+ Token::Argument(b"world".to_vec()),
+ ],
+ },
+ ],
+ ),
+ ] {
+ let mut requests = Vec::new();
+ for frame in &frames {
+ let mut bytes = frame.as_bytes().iter();
+ loop {
+ match receiver.parse(&mut bytes) {
+ Ok(request) => requests.push(request),
+ Err(Error::NeedsMoreData | Error::NeedsLiteral { .. }) => break,
+ Err(err) => panic!("{:?} for frames {:#?}", err, frames),
+ }
+ }
+ }
+ assert_eq!(requests, expected_requests, "{:#?}", frames);
+ }
+ }
+
+ #[test]
+ fn receiver_parse_invalid() {
+ let mut receiver = Receiver::::new();
+ for invalid in [
+ "a001 login {abc}\r\n",
+ "a001 login {+30}\r\n",
+ "a001 login {30} junk\r\n",
+ ] {
+ match receiver.parse(&mut invalid.as_bytes().iter()) {
+ Err(Error::Parse { .. }) => {}
+ result => panic!("Expecter error, got: {:?}", result),
+ }
+ }
+ }
+}
diff --git a/src/main.rs b/src/main.rs
new file mode 100644
index 0000000..f8a6e1e
--- /dev/null
+++ b/src/main.rs
@@ -0,0 +1,83 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+mod admin;
+mod config;
+mod error;
+mod http;
+mod imap_receiver;
+mod net;
+mod observe;
+mod outbound;
+mod proto;
+mod route;
+mod sasl;
+mod server;
+mod token;
+
+#[cfg(test)]
+mod tests;
+
+pub use error::{ProxyError, Result};
+
+use std::sync::Arc;
+
+fn main() -> std::process::ExitCode {
+ let config_path = std::env::args()
+ .nth(1)
+ .or_else(|| std::env::var("PROXY_CONFIG").ok());
+ let config_path = match config_path {
+ Some(p) => p,
+ None => {
+ eprintln!("usage: proxy (or set PROXY_CONFIG)");
+ return std::process::ExitCode::from(2);
+ }
+ };
+
+ let raw = match std::fs::read_to_string(&config_path) {
+ Ok(s) => s,
+ Err(e) => {
+ eprintln!("failed to read config {config_path}: {e}");
+ return std::process::ExitCode::FAILURE;
+ }
+ };
+
+ let config = match config::Config::parse_and_validate(&raw) {
+ Ok(c) => Arc::new(c),
+ Err(e) => {
+ eprintln!("invalid configuration: {e}");
+ return std::process::ExitCode::FAILURE;
+ }
+ };
+
+ observe::init(&config.server.log_level);
+
+ let threads = if config.server.threads == 0 {
+ num_cpus::get()
+ } else {
+ config.server.threads
+ };
+
+ let runtime = match tokio::runtime::Builder::new_multi_thread()
+ .worker_threads(threads)
+ .enable_all()
+ .build()
+ {
+ Ok(rt) => rt,
+ Err(e) => {
+ eprintln!("failed to build tokio runtime: {e}");
+ return std::process::ExitCode::FAILURE;
+ }
+ };
+
+ match runtime.block_on(server::run(config, Arc::from(config_path))) {
+ Ok(()) => std::process::ExitCode::SUCCESS,
+ Err(e) => {
+ tracing::error!(error = %e, "fatal error");
+ std::process::ExitCode::FAILURE
+ }
+ }
+}
diff --git a/src/net/acceptor.rs b/src/net/acceptor.rs
new file mode 100644
index 0000000..51c4359
--- /dev/null
+++ b/src/net/acceptor.rs
@@ -0,0 +1,191 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use std::sync::Arc;
+use std::sync::atomic::Ordering;
+
+use arc_swap::ArcSwap;
+use tokio::net::TcpListener;
+use tokio::sync::Semaphore;
+use tracing::Instrument;
+
+use crate::config::{ListenerConfig, TlsMode};
+use crate::net::proxy_protocol::resolve_inbound;
+use crate::proto::common::Ctx;
+use crate::proto::{self};
+
+struct ConnGuard {
+ ctx: Arc,
+}
+
+impl ConnGuard {
+ fn new(ctx: &Arc) -> Self {
+ ctx.metrics
+ .active_connections
+ .fetch_add(1, Ordering::Relaxed);
+ ConnGuard { ctx: ctx.clone() }
+ }
+}
+
+impl Drop for ConnGuard {
+ fn drop(&mut self) {
+ self.ctx
+ .metrics
+ .active_connections
+ .fetch_sub(1, Ordering::Relaxed);
+ }
+}
+
+pub struct Listener {
+ pub id: Arc,
+ pub config: Arc,
+ pub semaphore: Arc,
+}
+
+impl Listener {
+ pub fn new(id: Arc, config: Arc) -> Self {
+ let semaphore = Arc::new(Semaphore::new(config.max_connections));
+ Listener {
+ id,
+ config,
+ semaphore,
+ }
+ }
+
+ pub async fn run(
+ self: Arc,
+ ctx: Arc>,
+ shutdown: tokio::sync::watch::Receiver,
+ ) {
+ let mut handles = Vec::new();
+ for &addr in &self.config.bind {
+ let listener = match TcpListener::bind(addr).await {
+ Ok(l) => l,
+ Err(e) => {
+ tracing::error!(listener = %self.id, %addr, error = %e, "failed to bind");
+ continue;
+ }
+ };
+ tracing::info!(listener = %self.id, %addr, protocol = self.config.protocol.as_str(), "listening");
+ let this = self.clone();
+ let ctx = ctx.clone();
+ let shutdown = shutdown.clone();
+ handles.push(tokio::spawn(async move {
+ this.accept_loop(ctx, listener, shutdown).await;
+ }));
+ }
+ for h in handles {
+ let _ = h.await;
+ }
+ }
+
+ async fn accept_loop(
+ self: Arc,
+ ctx: Arc>,
+ listener: TcpListener,
+ mut shutdown: tokio::sync::watch::Receiver,
+ ) {
+ loop {
+ let (tcp, peer) = tokio::select! {
+ biased;
+ _ = shutdown.changed() => {
+ tracing::debug!(listener = %self.id, "accept loop stopping");
+ return;
+ }
+ accepted = listener.accept() => match accepted {
+ Ok(pair) => pair,
+ Err(e) => {
+ tracing::warn!(listener = %self.id, error = %e, "accept failed");
+ continue;
+ }
+ },
+ };
+ let permit = match self.semaphore.clone().try_acquire_owned() {
+ Ok(p) => p,
+ Err(_) => {
+ tracing::warn!(listener = %self.id, "max_connections reached; dropping connection");
+ drop(tcp);
+ continue;
+ }
+ };
+ let local = tcp.local_addr().unwrap_or(peer);
+ let _ = tcp.set_nodelay(true);
+ let ctx = ctx.load_full();
+ let this = self.clone();
+ let span = tracing::info_span!(
+ "conn",
+ listener = %this.id,
+ protocol = this.config.protocol.as_str(),
+ peer = %peer.ip(),
+ );
+ tokio::spawn(
+ async move {
+ let _permit = permit;
+ let _guard = ConnGuard::new(&ctx);
+ if let Err(e) = this.serve(ctx.clone(), tcp, peer, local).await {
+ tracing::debug!(error = %e, "connection ended");
+ }
+ }
+ .instrument(span),
+ );
+ }
+ }
+
+ async fn serve(
+ &self,
+ ctx: Arc,
+ tcp: tokio::net::TcpStream,
+ peer: std::net::SocketAddr,
+ local: std::net::SocketAddr,
+ ) -> crate::error::Result<()> {
+ let cfg = &self.config;
+ let resolved = match tokio::time::timeout(
+ cfg.preauth_timeout,
+ resolve_inbound(tcp, peer, local, cfg.proxy_protocol, &cfg.proxy_trusted),
+ )
+ .await
+ {
+ Ok(r) => r?,
+ Err(_) => {
+ return Err(crate::error::ProxyError::preauth(
+ "inbound PROXY header timeout",
+ ));
+ }
+ };
+
+ let mut stream = resolved.stream;
+ let peer = resolved.peer;
+ let local = resolved.local;
+
+ if cfg.tls == TlsMode::Implicit {
+ let Some(acceptor) = ctx.tls_acceptor.as_ref() else {
+ return Err(crate::error::ProxyError::tls(
+ "implicit TLS listener but no TLS acceptor configured",
+ ));
+ };
+ stream = match tokio::time::timeout(
+ cfg.preauth_timeout,
+ crate::proto::common::upgrade_tls_inbound(stream, acceptor),
+ )
+ .await
+ {
+ Ok(r) => r?,
+ Err(_) => {
+ return Err(crate::error::ProxyError::tls(
+ "inbound TLS handshake timed out",
+ ));
+ }
+ };
+ }
+
+ if stream.is_tls() {
+ let (version, cipher) = stream.tls_version_and_cipher();
+ tracing::debug!(listener = %self.id, %peer, %version, %cipher, "tls connection");
+ }
+
+ proto::dispatch(&ctx, cfg, stream, peer, local).await
+ }
+}
diff --git a/src/net/cidr.rs b/src/net/cidr.rs
new file mode 100644
index 0000000..b2127f3
--- /dev/null
+++ b/src/net/cidr.rs
@@ -0,0 +1,131 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use std::net::{IpAddr, Ipv6Addr};
+use std::str::FromStr;
+
+use serde::{Deserialize, Deserializer};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Cidr {
+ network: u128,
+ mask: u128,
+ is_v6: bool,
+}
+
+fn to_u128(ip: IpAddr) -> (u128, bool) {
+ match ip {
+ IpAddr::V4(v4) => (u128::from(v4.to_ipv6_mapped()), false),
+ IpAddr::V6(v6) => (u128::from(v6), true),
+ }
+}
+
+impl Cidr {
+ pub fn contains(&self, ip: IpAddr) -> bool {
+ let (mut addr, is_v6) = to_u128(ip);
+ if self.is_v6 != is_v6 {
+ if !self.is_v6 && is_v6 {
+ if let IpAddr::V6(v6) = ip {
+ if let Some(v4) = v6.to_ipv4_mapped() {
+ addr = u128::from(v4.to_ipv6_mapped());
+ } else {
+ return false;
+ }
+ }
+ } else {
+ return false;
+ }
+ }
+ (addr & self.mask) == self.network
+ }
+}
+
+impl FromStr for Cidr {
+ type Err = String;
+
+ fn from_str(s: &str) -> Result {
+ let (addr_str, prefix_str) = match s.split_once('/') {
+ Some((a, p)) => (a, Some(p)),
+ None => (s, None),
+ };
+ let ip: IpAddr = addr_str
+ .trim()
+ .parse()
+ .map_err(|_| format!("invalid IP address in CIDR {s:?}"))?;
+ let (network_raw, is_v6) = to_u128(ip);
+ let max_prefix = if is_v6 { 128 } else { 32 };
+ let prefix: u32 = match prefix_str {
+ Some(p) => p
+ .trim()
+ .parse()
+ .map_err(|_| format!("invalid prefix in CIDR {s:?}"))?,
+ None => max_prefix,
+ };
+ if prefix > max_prefix {
+ return Err(format!("prefix /{prefix} too large for address in {s:?}"));
+ }
+ let total_bits = if is_v6 { 128 } else { 32 };
+ let host_bits = total_bits - prefix;
+ let mask = if host_bits == 0 {
+ u128::MAX
+ } else {
+ (!0u128).checked_shl(host_bits).unwrap_or(0)
+ };
+ let mask = if is_v6 {
+ mask
+ } else {
+ mask | u128::from(Ipv6Addr::new(0, 0, 0, 0, 0, 0xffff, 0, 0))
+ };
+ Ok(Cidr {
+ network: network_raw & mask,
+ mask,
+ is_v6,
+ })
+ }
+}
+
+impl<'de> Deserialize<'de> for Cidr {
+ fn deserialize(deserializer: D) -> Result
+ where
+ D: Deserializer<'de>,
+ {
+ let s = String::deserialize(deserializer)?;
+ s.parse().map_err(serde::de::Error::custom)
+ }
+}
+
+pub fn any_contains(nets: &[Cidr], ip: IpAddr) -> bool {
+ nets.iter().any(|n| n.contains(ip))
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+
+ #[test]
+ fn matches_v4() {
+ let c: Cidr = "10.0.0.0/8".parse().unwrap();
+ assert!(c.contains("10.1.2.3".parse().unwrap()));
+ assert!(c.contains("10.255.255.255".parse().unwrap()));
+ assert!(!c.contains("11.0.0.1".parse().unwrap()));
+ let c: Cidr = "192.168.1.1".parse().unwrap();
+ assert!(c.contains("192.168.1.1".parse().unwrap()));
+ assert!(!c.contains("192.168.1.2".parse().unwrap()));
+ }
+
+ #[test]
+ fn matches_v6() {
+ let c: Cidr = "2001:db8::/32".parse().unwrap();
+ assert!(c.contains("2001:db8::1".parse().unwrap()));
+ assert!(!c.contains("2001:db9::1".parse().unwrap()));
+ }
+
+ #[test]
+ fn mapped_v4_in_v4_net() {
+ let c: Cidr = "10.0.0.0/8".parse().unwrap();
+ assert!(c.contains("::ffff:10.0.0.5".parse().unwrap()));
+ }
+}
diff --git a/src/net/mod.rs b/src/net/mod.rs
new file mode 100644
index 0000000..4d95a1e
--- /dev/null
+++ b/src/net/mod.rs
@@ -0,0 +1,13 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+pub mod acceptor;
+pub mod cidr;
+pub mod proxy_protocol;
+pub mod stream;
+pub mod tls;
+
+pub use stream::BoxedStream;
diff --git a/src/net/proxy_protocol.rs b/src/net/proxy_protocol.rs
new file mode 100644
index 0000000..b17fb4a
--- /dev/null
+++ b/src/net/proxy_protocol.rs
@@ -0,0 +1,195 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use std::net::SocketAddr;
+
+use proxy_header::{ProxiedAddress, ProxyHeader};
+use tokio::io::AsyncReadExt;
+use tokio::net::TcpStream;
+
+use crate::config::ProxyProtocolMode;
+use crate::error::{ProxyError, Result};
+use crate::net::cidr::{Cidr, any_contains};
+use crate::net::stream::{BoxedStream, PrefacedStream};
+
+const V2_MAGIC: [u8; 12] = [
+ 0x0D, 0x0A, 0x0D, 0x0A, 0x00, 0x0D, 0x0A, 0x51, 0x55, 0x49, 0x54, 0x0A,
+];
+const V1_PREFIX: &[u8] = b"PROXY ";
+const MAX_HEADER_PROBE: usize = 1024;
+
+fn could_be_proxy(buf: &[u8]) -> bool {
+ let n = buf.len();
+ let v1 = &V1_PREFIX[..n.min(V1_PREFIX.len())];
+ let v2 = &V2_MAGIC[..n.min(V2_MAGIC.len())];
+ buf.starts_with(v1) || buf.starts_with(v2)
+}
+
+fn normalize(addr: SocketAddr) -> SocketAddr {
+ match addr {
+ SocketAddr::V6(v6) => match v6.ip().to_ipv4_mapped() {
+ Some(v4) => SocketAddr::new(v4.into(), v6.port()),
+ None => addr,
+ },
+ _ => addr,
+ }
+}
+
+pub struct InboundResolution {
+ pub stream: BoxedStream,
+ pub peer: SocketAddr,
+ pub local: SocketAddr,
+}
+
+pub async fn resolve_inbound(
+ stream: TcpStream,
+ tcp_peer: SocketAddr,
+ tcp_local: SocketAddr,
+ mode: ProxyProtocolMode,
+ trusted: &[Cidr],
+) -> Result {
+ if mode == ProxyProtocolMode::Off {
+ return Ok(InboundResolution {
+ stream: Box::new(stream),
+ peer: tcp_peer,
+ local: tcp_local,
+ });
+ }
+
+ let is_trusted = any_contains(trusted, tcp_peer.ip());
+ if !is_trusted {
+ if mode == ProxyProtocolMode::Required {
+ return Err(ProxyError::protocol(
+ "PROXY header required but peer is not trusted",
+ ));
+ }
+ return Ok(InboundResolution {
+ stream: Box::new(stream),
+ peer: tcp_peer,
+ local: tcp_local,
+ });
+ }
+
+ parse_inbound_header(stream, tcp_peer, tcp_local, mode).await
+}
+
+async fn parse_inbound_header(
+ mut stream: TcpStream,
+ tcp_peer: SocketAddr,
+ tcp_local: SocketAddr,
+ mode: ProxyProtocolMode,
+) -> Result {
+ let required = mode == ProxyProtocolMode::Required;
+ let mut buf: Vec = Vec::with_capacity(256);
+
+ loop {
+ let n = stream
+ .read_buf(&mut buf)
+ .await
+ .map_err(|e| ProxyError::protocol(format!("reading PROXY header: {e}")))?;
+ if n == 0 {
+ if required {
+ return Err(ProxyError::protocol(
+ "PROXY header required but connection closed before one arrived",
+ ));
+ }
+ return Ok(InboundResolution {
+ stream: Box::new(PrefacedStream::new(buf, stream)),
+ peer: tcp_peer,
+ local: tcp_local,
+ });
+ }
+
+ if !could_be_proxy(&buf) {
+ if required {
+ return Err(ProxyError::protocol(
+ "PROXY header required from trusted peer but none present",
+ ));
+ }
+ return Ok(InboundResolution {
+ stream: Box::new(PrefacedStream::new(buf, stream)),
+ peer: tcp_peer,
+ local: tcp_local,
+ });
+ }
+
+ match ProxyHeader::parse(&buf, Default::default()) {
+ Ok((header, consumed)) => {
+ let (peer, local) = match header.proxied_address() {
+ Some(addr) => (normalize(addr.source), normalize(addr.destination)),
+ None => (tcp_peer, tcp_local),
+ };
+ let leftover = buf.split_off(consumed);
+ return Ok(InboundResolution {
+ stream: Box::new(PrefacedStream::new(leftover, stream)),
+ peer,
+ local,
+ });
+ }
+ Err(proxy_header::Error::BufferTooShort) if buf.len() < MAX_HEADER_PROBE => {
+ continue;
+ }
+ Err(_) => {
+ if required {
+ return Err(ProxyError::protocol(
+ "invalid PROXY header from trusted peer",
+ ));
+ }
+ return Ok(InboundResolution {
+ stream: Box::new(PrefacedStream::new(buf, stream)),
+ peer: tcp_peer,
+ local: tcp_local,
+ });
+ }
+ }
+ }
+}
+
+pub fn build_outbound_header(peer: SocketAddr, local: SocketAddr) -> Result> {
+ let src = normalize(peer);
+ let dst = normalize(local);
+ let mut buf = Vec::with_capacity(64);
+ if src.is_ipv4() != dst.is_ipv4() {
+ buf.extend_from_slice(b"PROXY UNKNOWN\r\n");
+ return Ok(buf);
+ }
+ let header = ProxyHeader::with_address(ProxiedAddress::stream(src, dst));
+ header
+ .encode_v2(&mut buf)
+ .map_err(|e| ProxyError::backend(format!("PROXY header encode failed: {e}")))?;
+ Ok(buf)
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+
+ #[test]
+ fn normalizes_mapped_v4() {
+ let mapped: SocketAddr = "[::ffff:10.0.0.1]:25".parse().unwrap();
+ assert_eq!(normalize(mapped), "10.0.0.1:25".parse().unwrap());
+ }
+
+ #[test]
+ fn outbound_v2_for_matching_families() {
+ let h = build_outbound_header(
+ "10.0.0.1:12345".parse().unwrap(),
+ "10.0.0.2:993".parse().unwrap(),
+ )
+ .unwrap();
+ assert_eq!(&h[..12], &V2_MAGIC);
+ }
+
+ #[test]
+ fn outbound_unknown_for_family_mismatch() {
+ let h = build_outbound_header(
+ "10.0.0.1:12345".parse().unwrap(),
+ "[2001:db8::1]:993".parse().unwrap(),
+ )
+ .unwrap();
+ assert_eq!(&h, b"PROXY UNKNOWN\r\n");
+ }
+}
diff --git a/src/net/stream.rs b/src/net/stream.rs
new file mode 100644
index 0000000..88a683a
--- /dev/null
+++ b/src/net/stream.rs
@@ -0,0 +1,138 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use std::borrow::Cow;
+use std::pin::Pin;
+use std::task::{Context, Poll};
+
+use tokio::io::{AsyncRead, AsyncWrite, ReadBuf};
+use tokio::net::TcpStream;
+
+pub trait SessionStream: AsyncRead + AsyncWrite + Unpin + Send + 'static {
+ fn is_tls(&self) -> bool;
+ fn tls_version_and_cipher(&self) -> (Cow<'static, str>, Cow<'static, str>);
+}
+
+pub type BoxedStream = Box;
+
+impl SessionStream for TcpStream {
+ fn is_tls(&self) -> bool {
+ false
+ }
+
+ fn tls_version_and_cipher(&self) -> (Cow<'static, str>, Cow<'static, str>) {
+ (Cow::Borrowed(""), Cow::Borrowed(""))
+ }
+}
+
+impl SessionStream for BoxedStream {
+ fn is_tls(&self) -> bool {
+ (**self).is_tls()
+ }
+
+ fn tls_version_and_cipher(&self) -> (Cow<'static, str>, Cow<'static, str>) {
+ (**self).tls_version_and_cipher()
+ }
+}
+
+fn protocol_version_str(v: Option) -> Cow<'static, str> {
+ Cow::Borrowed(match v {
+ Some(rustls::ProtocolVersion::SSLv2) => "SSLv2",
+ Some(rustls::ProtocolVersion::SSLv3) => "SSLv3",
+ Some(rustls::ProtocolVersion::TLSv1_0) => "TLSv1.0",
+ Some(rustls::ProtocolVersion::TLSv1_1) => "TLSv1.1",
+ Some(rustls::ProtocolVersion::TLSv1_2) => "TLSv1.2",
+ Some(rustls::ProtocolVersion::TLSv1_3) => "TLSv1.3",
+ _ => "unknown",
+ })
+}
+
+fn cipher_str(cs: Option) -> Cow<'static, str> {
+ Cow::Borrowed(cs.and_then(|c| c.suite().as_str()).unwrap_or("unknown"))
+}
+
+macro_rules! impl_tls_stream {
+ ($side:path) => {
+ impl SessionStream for $side {
+ fn is_tls(&self) -> bool {
+ true
+ }
+
+ fn tls_version_and_cipher(&self) -> (Cow<'static, str>, Cow<'static, str>) {
+ let (_, conn) = self.get_ref();
+ (
+ protocol_version_str(conn.protocol_version()),
+ cipher_str(conn.negotiated_cipher_suite()),
+ )
+ }
+ }
+ };
+}
+
+impl_tls_stream!(tokio_rustls::server::TlsStream);
+impl_tls_stream!(tokio_rustls::client::TlsStream);
+
+pub struct PrefacedStream {
+ prefix: Vec,
+ pos: usize,
+ io: IO,
+}
+
+impl PrefacedStream {
+ pub fn new(prefix: Vec, io: IO) -> Self {
+ PrefacedStream { prefix, pos: 0, io }
+ }
+}
+
+impl AsyncRead for PrefacedStream {
+ fn poll_read(
+ self: Pin<&mut Self>,
+ cx: &mut Context<'_>,
+ buf: &mut ReadBuf<'_>,
+ ) -> Poll> {
+ let me = self.get_mut();
+ if me.pos < me.prefix.len() {
+ let remaining = &me.prefix[me.pos..];
+ let n = remaining.len().min(buf.remaining());
+ buf.put_slice(&remaining[..n]);
+ me.pos += n;
+ if me.pos == me.prefix.len() {
+ me.prefix = Vec::new();
+ me.pos = 0;
+ }
+ return Poll::Ready(Ok(()));
+ }
+ Pin::new(&mut me.io).poll_read(cx, buf)
+ }
+}
+
+impl AsyncWrite for PrefacedStream {
+ fn poll_write(
+ self: Pin<&mut Self>,
+ cx: &mut Context<'_>,
+ buf: &[u8],
+ ) -> Poll> {
+ Pin::new(&mut self.get_mut().io).poll_write(cx, buf)
+ }
+
+ fn poll_flush(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll> {
+ Pin::new(&mut self.get_mut().io).poll_flush(cx)
+ }
+
+ fn poll_shutdown(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll> {
+ Pin::new(&mut self.get_mut().io).poll_shutdown(cx)
+ }
+}
+
+impl SessionStream for PrefacedStream {
+ fn is_tls(&self) -> bool {
+ false
+ }
+
+ fn tls_version_and_cipher(&self) -> (Cow<'static, str>, Cow<'static, str>) {
+ (Cow::Borrowed(""), Cow::Borrowed(""))
+ }
+}
diff --git a/src/net/tls.rs b/src/net/tls.rs
new file mode 100644
index 0000000..d482e53
--- /dev/null
+++ b/src/net/tls.rs
@@ -0,0 +1,473 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use std::sync::Arc;
+
+use ahash::AHashMap;
+
+use rustls::client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier};
+use rustls::crypto::{CryptoProvider, verify_tls12_signature, verify_tls13_signature};
+use rustls::pki_types::{CertificateDer, PrivateKeyDer, ServerName, UnixTime};
+use rustls::server::{ClientHello, ResolvesServerCert};
+use rustls::sign::CertifiedKey;
+use rustls::version::{TLS12, TLS13};
+use rustls::{
+ ClientConfig, DigitallySignedStruct, ServerConfig, SignatureScheme, SupportedProtocolVersion,
+};
+use rustls_platform_verifier::BuilderVerifierExt;
+
+use crate::config::{Config, DestinationConfig};
+use crate::error::{ProxyError, Result};
+
+pub fn provider() -> Arc {
+ Arc::new(rustls::crypto::aws_lc_rs::default_provider())
+}
+
+static TLS13_ONLY: &[&SupportedProtocolVersion] = &[&TLS13];
+static TLS12_PLUS: &[&SupportedProtocolVersion] = &[&TLS12, &TLS13];
+
+fn protocol_versions(min_version: &str) -> Result<&'static [&'static SupportedProtocolVersion]> {
+ match min_version {
+ "1.3" => Ok(TLS13_ONLY),
+ "1.2" => Ok(TLS12_PLUS),
+ other => Err(ProxyError::config(format!(
+ "unsupported tls min_version {other:?} (use \"1.2\" or \"1.3\")"
+ ))),
+ }
+}
+
+fn load_certs(path: &str) -> Result>> {
+ let data = std::fs::read(path)
+ .map_err(|e| ProxyError::config(format!("failed to read cert {path}: {e}")))?;
+ let certs: std::result::Result, _> =
+ rustls_pemfile::certs(&mut data.as_slice()).collect();
+ let certs = certs.map_err(|e| ProxyError::config(format!("invalid cert {path}: {e}")))?;
+ if certs.is_empty() {
+ return Err(ProxyError::config(format!(
+ "no certificates found in {path}"
+ )));
+ }
+ Ok(certs)
+}
+
+fn load_key(path: &str) -> Result> {
+ let data = std::fs::read(path)
+ .map_err(|e| ProxyError::config(format!("failed to read key {path}: {e}")))?;
+ rustls_pemfile::private_key(&mut data.as_slice())
+ .map_err(|e| ProxyError::config(format!("invalid key {path}: {e}")))?
+ .ok_or_else(|| ProxyError::config(format!("no private key found in {path}")))
+}
+
+fn san_dns_names(cert: &CertificateDer<'_>) -> Vec {
+ use x509_parser::prelude::*;
+ let mut names = Vec::new();
+ if let Ok((_, parsed)) = X509Certificate::from_der(cert.as_ref()) {
+ if let Ok(Some(san)) = parsed.subject_alternative_name() {
+ for gn in &san.value.general_names {
+ if let GeneralName::DNSName(name) = gn {
+ names.push(name.to_string());
+ }
+ }
+ }
+ if names.is_empty() {
+ for cn in parsed.subject().iter_common_name() {
+ if let Ok(s) = cn.as_str() {
+ names.push(s.to_string());
+ }
+ }
+ }
+ }
+ names
+}
+
+#[derive(Debug)]
+pub struct CertificateResolver {
+ certs: AHashMap>,
+ self_signed: Arc,
+}
+
+impl CertificateResolver {
+ pub fn resolve_certificate(&self, name: Option<&str>) -> Arc {
+ let pick = name
+ .and_then(|name| {
+ self.certs.get(name).or_else(|| {
+ name.split_once('.')
+ .and_then(|(_, parent)| self.certs.get(parent))
+ })
+ })
+ .or_else(|| self.certs.get("*"))
+ .or_else(|| {
+ if self.certs.len() == 1 {
+ self.certs.values().next()
+ } else {
+ None
+ }
+ });
+ pick.cloned().unwrap_or_else(|| self.self_signed.clone())
+ }
+}
+
+impl ResolvesServerCert for CertificateResolver {
+ fn resolve(&self, hello: ClientHello<'_>) -> Option> {
+ Some(self.resolve_certificate(hello.server_name()))
+ }
+}
+
+fn certified_key(
+ provider: &CryptoProvider,
+ certs: Vec>,
+ key: PrivateKeyDer<'static>,
+) -> Result> {
+ let signing_key = provider
+ .key_provider
+ .load_private_key(key)
+ .map_err(|e| ProxyError::tls(format!("invalid signing key: {e}")))?;
+ Ok(Arc::new(CertifiedKey::new(certs, signing_key)))
+}
+
+fn self_signed_default(provider: &CryptoProvider) -> Result> {
+ let cert = rcgen::generate_simple_self_signed(vec!["localhost".to_string()])
+ .map_err(|e| ProxyError::tls(format!("self-signed cert generation failed: {e}")))?;
+ let cert_der = CertificateDer::from(cert.cert.der().to_vec());
+ let key_der = PrivateKeyDer::try_from(cert.signing_key.serialize_der())
+ .map_err(|e| ProxyError::tls(format!("self-signed key error: {e}")))?;
+ certified_key(provider, vec![cert_der], key_der)
+}
+
+pub fn build_resolver(config: &Config, provider: &CryptoProvider) -> Result {
+ let mut certs: AHashMap> = AHashMap::new();
+ for cert_cfg in config.tls.certificate.values() {
+ let chain = load_certs(&cert_cfg.cert)?;
+ let key = load_key(&cert_cfg.key)?;
+ let names = if cert_cfg.subjects.is_empty() {
+ san_dns_names(&chain[0])
+ } else {
+ cert_cfg.subjects.clone()
+ };
+ let ck = certified_key(provider, chain, key)?;
+ for name in names {
+ let key = name
+ .strip_prefix("*.")
+ .unwrap_or(&name)
+ .to_ascii_lowercase();
+ certs.insert(key, ck.clone());
+ }
+ if cert_cfg.default {
+ certs.insert("*".to_string(), ck.clone());
+ }
+ }
+ Ok(CertificateResolver {
+ certs,
+ self_signed: self_signed_default(provider)?,
+ })
+}
+
+fn provider_without_disabled(
+ base: &CryptoProvider,
+ disabled: &[String],
+) -> Result> {
+ if disabled.is_empty() {
+ return Ok(Arc::new(base.clone()));
+ }
+ let mut provider = base.clone();
+ provider.cipher_suites.retain(|cs| {
+ cs.suite()
+ .as_str()
+ .map(|name| !disabled.iter().any(|d| d.eq_ignore_ascii_case(name)))
+ .unwrap_or(true)
+ });
+ if provider.cipher_suites.is_empty() {
+ return Err(ProxyError::config(
+ "disable_cipher_suites removed every available cipher suite",
+ ));
+ }
+ Ok(Arc::new(provider))
+}
+
+pub fn build_server_config(
+ config: &Config,
+ provider: Arc,
+) -> Result> {
+ let provider =
+ provider_without_disabled(&provider, &config.tls.protocols.disable_cipher_suites)?;
+ let resolver = build_resolver(config, &provider)?;
+ let versions = protocol_versions(&config.tls.protocols.min_version)?;
+ let mut server_config = ServerConfig::builder_with_provider(provider)
+ .with_protocol_versions(versions)
+ .map_err(|e| ProxyError::tls(format!("tls server config: {e}")))?
+ .with_no_client_auth()
+ .with_cert_resolver(Arc::new(resolver));
+ server_config.ignore_client_order = config.tls.protocols.ignore_client_order;
+ Ok(Arc::new(server_config))
+}
+
+#[derive(Debug)]
+struct NoVerifier;
+
+fn all_schemes() -> Vec {
+ vec![
+ SignatureScheme::RSA_PKCS1_SHA256,
+ SignatureScheme::RSA_PKCS1_SHA384,
+ SignatureScheme::RSA_PKCS1_SHA512,
+ SignatureScheme::ECDSA_NISTP256_SHA256,
+ SignatureScheme::ECDSA_NISTP384_SHA384,
+ SignatureScheme::ECDSA_NISTP521_SHA512,
+ SignatureScheme::RSA_PSS_SHA256,
+ SignatureScheme::RSA_PSS_SHA384,
+ SignatureScheme::RSA_PSS_SHA512,
+ SignatureScheme::ED25519,
+ ]
+}
+
+impl ServerCertVerifier for NoVerifier {
+ fn verify_server_cert(
+ &self,
+ _end_entity: &CertificateDer<'_>,
+ _intermediates: &[CertificateDer<'_>],
+ _server_name: &ServerName<'_>,
+ _ocsp_response: &[u8],
+ _now: UnixTime,
+ ) -> std::result::Result {
+ Ok(ServerCertVerified::assertion())
+ }
+
+ fn verify_tls12_signature(
+ &self,
+ _message: &[u8],
+ _cert: &CertificateDer<'_>,
+ _dss: &DigitallySignedStruct,
+ ) -> std::result::Result {
+ Ok(HandshakeSignatureValid::assertion())
+ }
+
+ fn verify_tls13_signature(
+ &self,
+ _message: &[u8],
+ _cert: &CertificateDer<'_>,
+ _dss: &DigitallySignedStruct,
+ ) -> std::result::Result {
+ Ok(HandshakeSignatureValid::assertion())
+ }
+
+ fn supported_verify_schemes(&self) -> Vec {
+ all_schemes()
+ }
+}
+
+#[derive(Debug)]
+struct PinnedVerifier {
+ pin: [u8; 32],
+ provider: Arc,
+}
+
+fn sha256(bytes: &[u8]) -> [u8; 32] {
+ let digest = aws_lc_rs::digest::digest(&aws_lc_rs::digest::SHA256, bytes);
+ let mut out = [0u8; 32];
+ out.copy_from_slice(digest.as_ref());
+ out
+}
+
+impl ServerCertVerifier for PinnedVerifier {
+ fn verify_server_cert(
+ &self,
+ end_entity: &CertificateDer<'_>,
+ _intermediates: &[CertificateDer<'_>],
+ _server_name: &ServerName<'_>,
+ _ocsp_response: &[u8],
+ _now: UnixTime,
+ ) -> std::result::Result {
+ if sha256(end_entity.as_ref()) == self.pin {
+ Ok(ServerCertVerified::assertion())
+ } else {
+ Err(rustls::Error::InvalidCertificate(
+ rustls::CertificateError::ApplicationVerificationFailure,
+ ))
+ }
+ }
+
+ fn verify_tls12_signature(
+ &self,
+ message: &[u8],
+ cert: &CertificateDer<'_>,
+ dss: &DigitallySignedStruct,
+ ) -> std::result::Result {
+ verify_tls12_signature(
+ message,
+ cert,
+ dss,
+ &self.provider.signature_verification_algorithms,
+ )
+ }
+
+ fn verify_tls13_signature(
+ &self,
+ message: &[u8],
+ cert: &CertificateDer<'_>,
+ dss: &DigitallySignedStruct,
+ ) -> std::result::Result {
+ verify_tls13_signature(
+ message,
+ cert,
+ dss,
+ &self.provider.signature_verification_algorithms,
+ )
+ }
+
+ fn supported_verify_schemes(&self) -> Vec {
+ self.provider
+ .signature_verification_algorithms
+ .supported_schemes()
+ }
+}
+
+fn parse_pin(hex: &str) -> Result<[u8; 32]> {
+ let hex = hex.trim().replace(':', "");
+ if hex.len() != 64 {
+ return Err(ProxyError::config(
+ "tls_pinned_cert_sha256 must be 32 bytes (64 hex chars)",
+ ));
+ }
+ let mut out = [0u8; 32];
+ for (i, byte) in out.iter_mut().enumerate() {
+ *byte = u8::from_str_radix(&hex[i * 2..i * 2 + 2], 16)
+ .map_err(|_| ProxyError::config("tls_pinned_cert_sha256 is not valid hex"))?;
+ }
+ Ok(out)
+}
+
+pub fn build_client_config(
+ dest: &DestinationConfig,
+ provider: Arc,
+ is_http: bool,
+) -> Result> {
+ let builder = ClientConfig::builder_with_provider(provider.clone())
+ .with_protocol_versions(TLS12_PLUS)
+ .map_err(|e| ProxyError::tls(format!("tls client config: {e}")))?;
+
+ let verified = if dest.tls_allow_invalid_certs {
+ builder
+ .dangerous()
+ .with_custom_certificate_verifier(Arc::new(NoVerifier))
+ } else if let Some(pin) = &dest.tls_pinned_cert_sha256 {
+ let verifier = PinnedVerifier {
+ pin: parse_pin(pin)?,
+ provider,
+ };
+ builder
+ .dangerous()
+ .with_custom_certificate_verifier(Arc::new(verifier))
+ } else {
+ builder
+ .with_platform_verifier()
+ .map_err(|e| ProxyError::tls(format!("platform verifier: {e}")))?
+ };
+
+ let mut config = match (&dest.tls_client_cert, &dest.tls_client_key) {
+ (Some(cert), Some(key)) => {
+ let chain = load_certs(cert)?;
+ let der = load_key(key)?;
+ verified
+ .with_client_auth_cert(chain, der)
+ .map_err(|e| ProxyError::tls(format!("backend client certificate: {e}")))?
+ }
+ (None, None) => verified.with_no_client_auth(),
+ _ => {
+ return Err(ProxyError::config(
+ "tls_client_cert and tls_client_key must both be set",
+ ));
+ }
+ };
+
+ if is_http {
+ config.alpn_protocols = vec![b"http/1.1".to_vec()];
+ }
+
+ Ok(Arc::new(config))
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+
+ fn key() -> Arc {
+ let provider = provider();
+ self_signed_default(&provider).unwrap()
+ }
+
+ fn resolver(
+ entries: Vec<(&str, Arc)>,
+ ) -> (CertificateResolver, Arc) {
+ let self_signed = key();
+ let mut certs = AHashMap::new();
+ for (name, ck) in entries {
+ certs.insert(name.to_string(), ck);
+ }
+ (
+ CertificateResolver {
+ certs,
+ self_signed: self_signed.clone(),
+ },
+ self_signed,
+ )
+ }
+
+ #[test]
+ fn sni_exact_then_parent_then_star() {
+ let exact = key();
+ let wild = key();
+ let star = key();
+ let (r, _) = resolver(vec![
+ ("mail.example.com", exact.clone()),
+ ("example.com", wild.clone()),
+ ("*", star.clone()),
+ ]);
+
+ assert!(Arc::ptr_eq(
+ &r.resolve_certificate(Some("mail.example.com")),
+ &exact
+ ));
+ assert!(Arc::ptr_eq(
+ &r.resolve_certificate(Some("host.example.com")),
+ &wild
+ ));
+ assert!(Arc::ptr_eq(
+ &r.resolve_certificate(Some("nomatch.org")),
+ &star
+ ));
+ assert!(Arc::ptr_eq(&r.resolve_certificate(None), &star));
+ }
+
+ #[test]
+ fn sni_single_cert_fallback() {
+ let only = key();
+ let (r, _) = resolver(vec![("mail.example.com", only.clone())]);
+ assert!(Arc::ptr_eq(
+ &r.resolve_certificate(Some("other.org")),
+ &only
+ ));
+ }
+
+ #[test]
+ fn sni_self_signed_when_nothing_matches() {
+ let a = key();
+ let b = key();
+ let (r, self_signed) = resolver(vec![("a.com", a), ("b.com", b)]);
+ assert!(Arc::ptr_eq(
+ &r.resolve_certificate(Some("z.org")),
+ &self_signed
+ ));
+ }
+
+ #[test]
+ fn parse_pin_accepts_hex_and_colons() {
+ let raw = "a".repeat(64);
+ assert!(parse_pin(&raw).is_ok());
+ let colon = "AA:".repeat(31) + "AA";
+ assert!(parse_pin(&colon).is_ok());
+ assert!(parse_pin("tooshort").is_err());
+ assert!(parse_pin(&"z".repeat(64)).is_err());
+ }
+}
diff --git a/src/observe.rs b/src/observe.rs
new file mode 100644
index 0000000..50d6ff7
--- /dev/null
+++ b/src/observe.rs
@@ -0,0 +1,30 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use std::sync::atomic::{AtomicBool, Ordering};
+
+static INITIALIZED: AtomicBool = AtomicBool::new(false);
+
+pub fn init(level: &str) {
+ if INITIALIZED.swap(true, Ordering::SeqCst) {
+ return;
+ }
+ use tracing_subscriber::{EnvFilter, fmt};
+ let filter = EnvFilter::try_from_default_env().unwrap_or_else(|_| EnvFilter::new(level));
+ let _ = fmt().with_env_filter(filter).with_target(false).try_init();
+}
+
+pub fn redact(value: &str) -> String {
+ if value.is_empty() {
+ return "".to_string();
+ }
+ use std::hash::{Hash, Hasher};
+ let mut hasher = std::collections::hash_map::DefaultHasher::new();
+ value.hash(&mut hasher);
+ let tag = hasher.finish() & 0xffff;
+ let visible: String = value.chars().take(2).collect();
+ format!("{visible}***#{tag:04x}")
+}
diff --git a/src/outbound.rs b/src/outbound.rs
new file mode 100644
index 0000000..9ac2ea7
--- /dev/null
+++ b/src/outbound.rs
@@ -0,0 +1,300 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use std::net::SocketAddr;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::time::Duration;
+
+use rustls::ClientConfig;
+use rustls::pki_types::ServerName;
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::net::TcpStream;
+use tokio::time::{Instant, timeout};
+use tokio_rustls::TlsConnector;
+
+use crate::config::{DestProtocol, DestinationConfig, Forwarding, TlsMode};
+use crate::error::{ProxyError, Result};
+use crate::net::BoxedStream;
+use crate::net::proxy_protocol::build_outbound_header;
+
+pub fn server_name(dest: &DestinationConfig) -> Result> {
+ let name = dest
+ .tls_server_name
+ .clone()
+ .unwrap_or_else(|| dest.host.clone());
+ ServerName::try_from(name).map_err(|_| {
+ ProxyError::backend("destination has no valid TLS server name (set tls_server_name)")
+ })
+}
+
+pub async fn dial(
+ dest: &DestinationConfig,
+ ep: &DestProtocol,
+ forwarding: Forwarding,
+ client_config: &Arc,
+ peer: SocketAddr,
+ local: SocketAddr,
+) -> Result {
+ let mut stream = connect_with_source(dest, ep).await?;
+ let _ = stream.set_nodelay(true);
+
+ if forwarding == Forwarding::Proxy {
+ let header = build_outbound_header(peer, local)?;
+ stream
+ .write_all(&header)
+ .await
+ .map_err(|e| ProxyError::backend(format!("writing PROXY header: {e}")))?;
+ }
+
+ match ep.tls {
+ TlsMode::Implicit => tls_connect(Box::new(stream), client_config, dest).await,
+ TlsMode::Plain | TlsMode::Starttls => Ok(Box::new(stream)),
+ }
+}
+
+async fn connect_with_source(dest: &DestinationConfig, ep: &DestProtocol) -> Result {
+ use std::net::{IpAddr, SocketAddr as StdSocketAddr};
+ use tokio::net::TcpSocket;
+
+ if dest.source_ips.is_empty() {
+ return TcpStream::connect((dest.host.as_str(), ep.port))
+ .await
+ .map_err(|e| ProxyError::backend_connect(format!("backend connect failed: {e}")));
+ }
+
+ let addrs = tokio::net::lookup_host((dest.host.as_str(), ep.port))
+ .await
+ .map_err(|e| ProxyError::backend_connect(format!("backend DNS lookup failed: {e}")))?;
+
+ let mut last_err: Option = None;
+ for addr in addrs {
+ let Some(src) = pick_source_ip(&dest.source_ips, addr.is_ipv4()) else {
+ continue;
+ };
+ let socket = match if addr.is_ipv4() {
+ TcpSocket::new_v4()
+ } else {
+ TcpSocket::new_v6()
+ } {
+ Ok(s) => s,
+ Err(e) => {
+ last_err = Some(ProxyError::backend_connect(format!("socket: {e}")));
+ continue;
+ }
+ };
+ let bind_addr = StdSocketAddr::new(src, 0);
+ if let Err(e) = socket.bind(bind_addr) {
+ last_err = Some(ProxyError::backend_connect(format!(
+ "binding source {src}: {e}"
+ )));
+ continue;
+ }
+ match socket.connect(addr).await {
+ Ok(s) => return Ok(s),
+ Err(e) => {
+ let _: IpAddr = src;
+ last_err = Some(ProxyError::backend_connect(format!(
+ "backend connect failed: {e}"
+ )));
+ }
+ }
+ }
+ Err(last_err.unwrap_or_else(|| ProxyError::backend_connect("no usable source IP for backend")))
+}
+
+fn pick_source_ip(source_ips: &[std::net::IpAddr], want_v4: bool) -> Option