zig-smtp/src/ at b2da059ffc0a55a600ade8e46f9329e2107fd644 · jcollie.dev/zig-smtp · Tangled

jcollie.dev / zig-smtp

0

An SMTP client and server library for Zig implementing RFC 5321.

0

zig-smtp / src

6 files

at b2da059ffc0a55a600ade8e46f9329e2107fd644

Jeffrey C. Ollie Complete doctest coverage of the public API 13d ago

Complete doctest coverage of the public API Add identifier-named doctests for every remaining public function and substantive public type: crlf, Reply.read/lines and the four reply class predicates, Command.parse, PathArgs.paramIterator, ParamIterator.init/next, Extensions and Extensions.Auth.any, DataWriter.end, and Server's init, Options, Decision, Envelope, and Handler. Nested declarations get their tests inside the container so autodoc attaches them to the member. Left without doctests, deliberately: Tls.zig and Server.TlsOptions (need a live TLS peer; examples stay in doc comments), plain error sets, and pure data shapes already demonstrated by their containers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012HBHFhoTYa8TU9GLwobfbx

1 week ago

Complete doctest coverage of the public API Add identifier-named doctests for every remaining public function and substantive public type: crlf, Reply.read/lines and the four reply class predicates, Command.parse, PathArgs.paramIterator, ParamIterator.init/next, Extensions and Extensions.Auth.any, DataWriter.end, and Server's init, Options, Decision, Envelope, and Handler. Nested declarations get their tests inside the container so autodoc attaches them to the member. Left without doctests, deliberately: Tls.zig and Server.TlsOptions (need a live TLS peer; examples stay in doc comments), plain error sets, and pure data shapes already demonstrated by their containers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012HBHFhoTYa8TU9GLwobfbx

1 week ago

Add Exim interop tests; switch client TLS to tls.zig The VM test now also runs the zsmtp client against Exim (ports 2625/2626) over plaintext, STARTTLS, and implicit TLS, with taint-safe appendfile delivery checked in /var/spool/exim-mail. Exim exposed a standard-library TLS bug: std.crypto.tls.Client only advances its record-decryption state upon receiving the TLS 1.3 middlebox-compatibility ChangeCipherSpec record, which is optional and disabled by Exim's OpenSSL setup, so the handshake died with TlsUnexpectedMessage. The client-side Tls wrapper now uses ianic/tls.zig (already used server-side) instead: init is in-place (the connection holds interior pointers), and the flush-through workaround is gone since tls.zig flushes each record to the stream. A sendmail interop test was built and passing but removed again since nixpkgs does not package the sendmail MTA. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012HBHFhoTYa8TU9GLwobfbx

1 week ago

Add implicit TLS on the server side Server.Options.starttls becomes tls: ?TlsOptions with a mode field: .starttls keeps the RFC 3207 behavior (advertise, 220, upgrade, state reset) and .implicit performs the tls.zig server handshake before the greeting (SMTPS, port 465 style). Both paths share one upgradeToTls helper; in implicit mode STARTTLS is never advertised and the command gets 502. Breaking rename for Server.Options at version 0.0.0. The serve CLI grows --implicit-tls (requires --tls-cert/--tls-key) and its flag parser now supports valueless flags. Verified locally with openssl s_client (greeting arrives inside the TLS channel) and our own --tls client, plus a STARTTLS regression check. The VM interop test adds an implicit-TLS zsmtp server and a swaks --tlsc subtest against it; all 16 subtests pass. The Status list is complete: TLS in both modes on both sides, AUTH, streaming bodies, and MAIL parameter validation. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012HBHFhoTYa8TU9GLwobfbx

1 week ago

Complete doctest coverage of the public API Add identifier-named doctests for every remaining public function and substantive public type: crlf, Reply.read/lines and the four reply class predicates, Command.parse, PathArgs.paramIterator, ParamIterator.init/next, Extensions and Extensions.Auth.any, DataWriter.end, and Server's init, Options, Decision, Envelope, and Handler. Nested declarations get their tests inside the container so autodoc attaches them to the member. Left without doctests, deliberately: Tls.zig and Server.TlsOptions (need a live TLS peer; examples stay in doc comments), plain error sets, and pure data shapes already demonstrated by their containers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012HBHFhoTYa8TU9GLwobfbx

1 week ago

Add TLS support to client and server Client (std.crypto.tls): - Tls.zig wraps std.crypto.tls.Client for implicit TLS and STARTTLS, verifying against the system trust store by default (caller-managed bundle and insecure modes available) - Client.starttls() does the RFC 3207 exchange; setTransport() swaps in the encrypted reader/writer - Tls.writer() is a flush-through wrapper: std's TLS writer encrypts on flush but leaves records in the stream writer's buffer, which deadlocks request/reply protocols like SMTP Server (ianic/tls.zig, pinned to zig-0.16.x head): - Options.starttls advertises and accepts STARTTLS (TLS 1.3 only): 220, server handshake over the raw stream, transport swap, RFC 3207 state reset; 503 on a second STARTTLS, close_notify on QUIT - tls dependency re-exported as zsmtp.tls for CertKeyPair loading CLI: send grew --tls/--starttls/--insecure, serve grew --tls-cert/--tls-key. Verified end to end over real sockets: zsmtp client <-> zsmtp server STARTTLS, openssl s_client -starttls smtp against the server, and openssl s_server against the client. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012HBHFhoTYa8TU9GLwobfbx

2 weeks ago