optimize ban checks

mail queue

See merge request etke.cc/postmoogle!39

.gitignore

@@ -1,3 +1,4 @@
 /local.db
 /local.db-journal
 /cover.out
+/e2e/main.go

.gitlab-ci.yml

@@ -4,13 +4,13 @@ stages:
 
 lint:
   stage: test
-  image: registry.gitlab.com/etke.cc/base
+  image: registry.gitlab.com/etke.cc/base/build
   script:
     - make lint
 
 unit:
   stage: test
-  image: registry.gitlab.com/etke.cc/base
+  image: registry.gitlab.com/etke.cc/base/build
   script:
     - make test
 
@@ -19,7 +19,7 @@ docker:
   only: ['main', 'tags']
   services:
     - docker:dind
-  image: jdrouet/docker-with-buildx:stable
+  image: ${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}/jdrouet/docker-with-buildx:stable
   before_script:
     - apk --no-cache add make
   script:

.golangci.yml

@@ -1,6 +1,6 @@
 run:
   concurrency: 4
-  timeout: 5m
+  timeout: 30m
   issues-exit-code: 1
   tests: true
   build-tags: []

Dockerfile

@@ -1,20 +1,16 @@
-FROM registry.gitlab.com/etke.cc/base AS builder
+FROM registry.gitlab.com/etke.cc/base/build AS builder
 
 WORKDIR /postmoogle
 COPY . .
 RUN make build
 
-FROM alpine:latest
+FROM registry.gitlab.com/etke.cc/base/app
 
 ENV POSTMOOGLE_DB_DSN /data/postmoogle.db
 
-RUN apk --no-cache add ca-certificates tzdata olm && \
-    adduser -D -g '' postmoogle && \
-    mkdir /data && chown -R postmoogle /data
-
 COPY --from=builder /postmoogle/postmoogle /bin/postmoogle
 
-USER postmoogle
+USER app
 
 ENTRYPOINT ["/bin/postmoogle"]
 

Makefile

@@ -16,6 +16,7 @@ update:
 	go get ./cmd
 	go mod tidy
 	go mod verify
+	go mod vendor
 
 mock:
 	-@rm -rf mocks
@@ -50,4 +51,4 @@ login:
 # docker build
 docker:
 	docker buildx create --use
-	docker buildx build --platform linux/arm/v7,linux/arm64/v8,linux/amd64 --push -t ${CI_REGISTRY_IMAGE}:${CI_COMMIT_TAG} .
+	docker buildx build --platform linux/arm64/v8,linux/amd64 --push -t ${CI_REGISTRY_IMAGE}:${CI_COMMIT_TAG} .

README.md

@@ -4,40 +4,61 @@
 
 An Email to Matrix bridge. 1 room = 1 mailbox.
 
-Postmoogle is an actual SMTP server that allows you to receive emails on your matrix server.
-It can't be used with arbitrary email providers, but setup your own provider "with matrix interface" instead.
+Postmoogle is an actual SMTP server that allows you to send and receive emails on your matrix server.
+It can't be used with arbitrary email providers, because it acts as an actual email provider itself,
+so you can use it to send emails from your apps and scripts as well.
 
 ## Roadmap
 
 ### Receive
 
-- [x] SMTP server
+- [x] SMTP server (plaintext and SSL)
 - [x] Matrix bot
 - [x] Configuration in room's account data
 - [x] Receive emails to matrix rooms
 - [x] Receive attachments
+- [x] Catch-all mailbox
 - [x] Map email threads to matrix threads
+- [x] Multi-domain support
+- [x] automatic banlist
+- [x] automatic greylisting
+
+#### deep dive
+
+> features in that section considered as "nice to have", but not a priority
+
+- [ ] DKIM verification
+- [ ] SPF verification
+- [ ] DMARC verification
 
 ### Send
 
-- [ ] SMTP client
-- [ ] Reply to matrix thread sends reply into email thread
-- [ ] Send a message to matrix room with special format to send a new email
+- [x] SMTP client
+- [x] SMTP server (you can use Postmoogle as general purpose SMTP server to send emails from your scripts or apps)
+- [x] Send a message to matrix room with special format to send a new email, even to multiple email addresses at once
+- [x] Reply to matrix thread sends reply into email thread
 
 ## Configuration
 
+### 1. Bot (mandatory)
+
 env vars
 
 * **POSTMOOGLE_HOMESERVER** - homeserver url, eg: `https://matrix.example.com`
 * **POSTMOOGLE_LOGIN** - user login/localpart, eg: `moogle`
 * **POSTMOOGLE_PASSWORD** - user password
-* **POSTMOOGLE_DOMAIN** - SMTP domain to listen for new emails
-* **POSTMOOGLE_PORT** - SMTP port to listen for new emails
+* **POSTMOOGLE_DOMAINS** - space separated list of SMTP domains to listen for new emails. The first domain acts as the default domain, all other as aliases
 
 <details>
 <summary>other optional config parameters</summary>
 
-* **POSTMOOGLE_NOENCRYPTION** - disable encryption support
+* **POSTMOOGLE_PORT** - SMTP port to listen for new emails
+* **POSTMOOGLE_TLS_PORT** - secure SMTP port to listen for new emails. Requires valid cert and key as well
+* **POSTMOOGLE_TLS_CERT** - space separated list of paths to the SSL certificates (chain) of your domains, note that position in the cert list must match the position of the cert's key in the key list
+* **POSTMOOGLE_TLS_KEY** - space separated list of paths to the SSL certificates' private keys of your domains, note that position on the key list must match the position of cert in the cert list
+* **POSTMOOGLE_TLS_REQUIRED** - require TLS connection, **even** on the non-TLS port (`POSTMOOGLE_PORT`). TLS connections are always required on the TLS port (`POSTMOOGLE_TLS_PORT`) regardless of this setting.
+* **POSTMOOGLE_DATA_SECRET** - secure key (password) to encrypt account data, must be 16, 24, or 32 bytes long
+* **POSTMOOGLE_NOENCRYPTION** - disable matrix encryption (libolm) support
 * **POSTMOOGLE_STATUSMSG** - presence status message
 * **POSTMOOGLE_SENTRY_DSN** - sentry DSN
 * **POSTMOOGLE_LOGLEVEL** - log level
@@ -45,12 +66,15 @@ env vars
 * **POSTMOOGLE_DB_DIALECT** - database dialect (postgres, sqlite3)
 * **POSTMOOGLE_MAXSIZE** - max email size (including attachments) in megabytes
 * **POSTMOOGLE_ADMINS** - a space-separated list of admin users. See `POSTMOOGLE_USERS` for syntax examples
-* <s>**POSTMOOGLE_USERS**</s> - deprecated and ignored, use `!pm users` instead
 
 You can find default values in [config/defaults.go](config/defaults.go)
 
 </details>
 
+### 2. DNS (optional)
+
+Follow the [docs/dns](docs/dns.md)
+
 ## Usage
 
 ### How to start
@@ -70,11 +94,14 @@ If you want to change them - check available options in the help message (`!pm h
 ---
 
 * **!pm mailbox** - Get or set mailbox of the room
+* **!pm domain** - Get or set default domain of the room
 * **!pm owner** - Get or set owner of the room
+* **!pm password** - Get or set SMTP password of the room's mailbox
 
 ---
 
 * **!pm nosender** - Get or set `nosender` of the room (`true` - hide email sender; `false` - show email sender)
+* **!pm norecipient** - Get or set `norecipient` of the room (`true` - hide recipient; `false` - show recipient)
 * **!pm nosubject** - Get or set `nosubject` of the room (`true` - hide email subject; `false` - show email subject)
 * **!pm nohtml** - Get or set `nohtml` of the room (`true` - ignore HTML in email; `false` - parse HTML in emails)
 * **!pm nothreads** - Get or set `nothreads` of the room (`true` - ignore email threads; `false` - convert email threads into matrix threads)
@@ -82,10 +109,28 @@ If you want to change them - check available options in the help message (`!pm h
 
 ---
 
-* **!pm mailboxes** - Show the list of all mailboxes
+* **!pm spamcheck:mx** - only accept email from servers which seem prepared to receive it (those having valid MX records) (`true` - enable, `false` - disable)
+* **!pm spamcheck:smtp** - only accept email from servers which seem prepared to receive it (those listening on an SMTP port) (`true` - enable, `false` - disable)
+* **!pm spamlist** - Get or set `spamlist` of the room (comma-separated list), eg: `spammer@example.com,*@spammer.org,noreply@*`
+
+---
+
+* **!pm dkim** - Get DKIM signature
+* **!pm catch-all** - Configure catch-all mailbox
+* **!pm queue:batch** - max amount of emails to process on each queue check
+* **!pm queue:retries** - max amount of tries per email in queue before removal
 * **!pm users** - Get or set allowed users patterns
+* **!pm mailboxes** - Show the list of all mailboxes
 * **!pm delete** &lt;mailbox&gt; - Delete specific mailbox
 
+---
+
+* **!pm greylist** - Set automatic greylisting duration in minutes (0 - disabled)
+* **!pm banlist** - Enable/disable banlist and show current values
+* **!pm banlist:add** - Ban an IP
+* **!pm banlist:remove** - Unban an IP
+* **!pm banlist:reset** - Reset banlist
+
 </details>
 
 

bot/access.go

@@ -2,8 +2,14 @@ package bot
 
 import (
 	"context"
+	"net"
 	"regexp"
+	"strings"
+	"time"
 
+	"github.com/getsentry/sentry-go"
+	"github.com/raja/argon2pw"
+	"gitlab.com/etke.cc/go/mxidwc"
 	"maunium.net/go/mautrix/id"
 
 	"gitlab.com/etke.cc/postmoogle/utils"
@@ -14,7 +20,17 @@ func parseMXIDpatterns(patterns []string, defaultPattern string) ([]*regexp.Rege
 		patterns = []string{defaultPattern}
 	}
 
-	return utils.WildcardMXIDsToRegexes(patterns)
+	return mxidwc.ParsePatterns(patterns)
+}
+
+func (b *Bot) allowUsers(actorID id.UserID) bool {
+	if len(b.allowedUsers) != 0 {
+		if !mxidwc.Match(actorID.String(), b.allowedUsers) {
+			return false
+		}
+	}
+
+	return true
 }
 
 func (b *Bot) allowAnyone(actorID id.UserID, targetRoomID id.RoomID) bool {
@@ -22,15 +38,12 @@ func (b *Bot) allowAnyone(actorID id.UserID, targetRoomID id.RoomID) bool {
 }
 
 func (b *Bot) allowOwner(actorID id.UserID, targetRoomID id.RoomID) bool {
-	if len(b.allowedUsers) != 0 {
-		if !utils.Match(actorID.String(), b.allowedUsers) {
-			return false
-		}
+	if !b.allowUsers(actorID) {
+		return false
 	}
-
 	cfg, err := b.getRoomSettings(targetRoomID)
 	if err != nil {
-		b.Error(context.Background(), targetRoomID, "failed to retrieve settings: %v", err)
+		b.Error(sentry.SetHubOnContext(context.Background(), sentry.CurrentHub()), targetRoomID, "failed to retrieve settings: %v", err)
 		return false
 	}
 
@@ -43,5 +56,91 @@ func (b *Bot) allowOwner(actorID id.UserID, targetRoomID id.RoomID) bool {
 }
 
 func (b *Bot) allowAdmin(actorID id.UserID, targetRoomID id.RoomID) bool {
-	return utils.Match(actorID.String(), b.allowedAdmins)
+	return mxidwc.Match(actorID.String(), b.allowedAdmins)
+}
+
+func (b *Bot) allowSend(actorID id.UserID, targetRoomID id.RoomID) bool {
+	if !b.allowUsers(actorID) {
+		return false
+	}
+
+	cfg, err := b.getRoomSettings(targetRoomID)
+	if err != nil {
+		b.Error(sentry.SetHubOnContext(context.Background(), sentry.CurrentHub()), targetRoomID, "failed to retrieve settings: %v", err)
+		return false
+	}
+
+	return !cfg.NoSend()
+}
+
+// IsGreylisted checks if host is in greylist
+func (b *Bot) IsGreylisted(addr net.Addr) bool {
+	if b.getBotSettings().Greylist() == 0 {
+		return false
+	}
+
+	greylist := b.getGreylist()
+	greylistedAt, ok := greylist.Get(addr)
+	if !ok {
+		b.log.Debug("greylisting %s", addr.String())
+		greylist.Add(addr)
+		err := b.setGreylist(greylist)
+		if err != nil {
+			b.log.Error("cannot update greylist with %s: %v", addr.String(), err)
+		}
+		return true
+	}
+	duration := time.Duration(b.getBotSettings().Greylist()) * time.Minute
+
+	return greylistedAt.Add(duration).After(time.Now().UTC())
+}
+
+// IsBanned checks if address is banned
+func (b *Bot) IsBanned(addr net.Addr) bool {
+	return b.banlist.Has(addr)
+}
+
+// Ban an address
+func (b *Bot) Ban(addr net.Addr) {
+	if !b.getBotSettings().BanlistEnabled() {
+		return
+	}
+
+	b.log.Debug("banning %s", addr.String())
+	banlist := b.getBanlist()
+	banlist.Add(addr)
+	err := b.setBanlist(banlist)
+	if err != nil {
+		b.log.Error("cannot update banlist with %s: %v", addr.String(), err)
+	}
+}
+
+// AllowAuth check if SMTP login (email) and password are valid
+func (b *Bot) AllowAuth(email, password string) bool {
+	var suffix bool
+	for _, domain := range b.domains {
+		if strings.HasSuffix(email, "@"+domain) {
+			suffix = true
+			break
+		}
+	}
+	if !suffix {
+		return false
+	}
+
+	roomID, ok := b.getMapping(utils.Mailbox(email))
+	if !ok {
+		return false
+	}
+	cfg, err := b.getRoomSettings(roomID)
+	if err != nil {
+		b.log.Error("failed to retrieve settings: %v", err)
+		return false
+	}
+
+	allow, err := argon2pw.CompareHashWithPassword(cfg.Password(), password)
+	if err != nil {
+		b.log.Warn("Password for %s is not valid: %v", email, err)
+	}
+	return allow
 }

bot/bot.go

@@ -6,7 +6,6 @@ import (
 	"regexp"
 	"sync"
 
-	"git.sr.ht/~xn/cache/v2"
 	"github.com/getsentry/sentry-go"
 	"gitlab.com/etke.cc/go/logger"
 	"gitlab.com/etke.cc/linkpearl"
@@ -18,16 +17,16 @@ import (
 // Bot represents matrix bot
 type Bot struct {
 	prefix                  string
-	domain                  string
+	domains                 []string
 	allowedUsers            []*regexp.Regexp
 	allowedAdmins           []*regexp.Regexp
 	commands                commandList
+	banlist                 bglist
 	rooms                   sync.Map
-	botcfg                  cache.Cache[botSettings]
-	cfg                     cache.Cache[roomSettings]
+	sendmail                func(string, string, string) error
 	log                     *logger.Logger
 	lp                      *linkpearl.Linkpearl
-	mu                      map[id.RoomID]*sync.Mutex
+	mu                      map[string]*sync.Mutex
 	handledMembershipEvents sync.Map
 }
 
@@ -36,21 +35,18 @@ func New(
 	lp *linkpearl.Linkpearl,
 	log *logger.Logger,
 	prefix string,
-	domain string,
-	envUsers []string,
+	domains []string,
 	admins []string,
 ) (*Bot, error) {
 	b := &Bot{
-		prefix: prefix,
-		domain: domain,
-		rooms:  sync.Map{},
-		botcfg: cache.NewLRU[botSettings](1),
-		cfg:    cache.NewLRU[roomSettings](1000),
-		log:    log,
-		lp:     lp,
-		mu:     map[id.RoomID]*sync.Mutex{},
+		prefix:  prefix,
+		domains: domains,
+		rooms:   sync.Map{},
+		log:     log,
+		lp:      lp,
+		mu:      map[string]*sync.Mutex{},
 	}
-	users, err := b.initBotUsers(envUsers)
+	users, err := b.initBotUsers()
 	if err != nil {
 		return nil, err
 	}
@@ -66,7 +62,7 @@ func New(
 	}
 	b.allowedAdmins = allowedAdmins
 
-	b.commands = b.buildCommandList()
+	b.commands = b.initCommands()
 
 	return b, nil
 }
@@ -76,9 +72,11 @@ func (b *Bot) Error(ctx context.Context, roomID id.RoomID, message string, args
 	b.log.Error(message, args...)
 	err := fmt.Errorf(message, args...)
 
-	sentry.GetHubFromContext(ctx).CaptureException(err)
+	if hub := sentry.GetHubFromContext(ctx); hub != nil {
+		sentry.GetHubFromContext(ctx).CaptureException(err)
+	}
 	if roomID != "" {
-		b.SendError(ctx, roomID, message)
+		b.SendError(ctx, roomID, err.Error())
 	}
 }
 
@@ -89,9 +87,9 @@ func (b *Bot) SendError(ctx context.Context, roomID id.RoomID, message string) {
 
 // SendNotice sends a notice message to the matrix room
 func (b *Bot) SendNotice(ctx context.Context, roomID id.RoomID, message string) {
-	content := format.RenderMarkdown(message, true, true)
-	content.MsgType = event.MsgNotice
-	_, err := b.lp.Send(roomID, &content)
+	parsed := format.RenderMarkdown(message, true, true)
+	parsed.MsgType = event.MsgNotice
+	_, err := b.lp.Send(roomID, &event.Content{Parsed: &parsed})
 	if err != nil {
 		sentry.GetHubFromContext(ctx).CaptureException(err)
 	}
@@ -105,6 +103,7 @@ func (b *Bot) Start(statusMsg string) error {
 	if err := b.syncRooms(); err != nil {
 		return err
 	}
+	b.syncBanlist()
 
 	b.initSync()
 	b.log.Info("Postmoogle has been started")

bot/command.go

@@ -4,19 +4,30 @@ import (
 	"context"
 	"fmt"
 	"strings"
+	"time"
 
 	"maunium.net/go/mautrix/event"
+	"maunium.net/go/mautrix/format"
 	"maunium.net/go/mautrix/id"
 
 	"gitlab.com/etke.cc/postmoogle/utils"
 )
 
 const (
-	commandHelp      = "help"
-	commandStop      = "stop"
-	commandUsers     = botOptionUsers
-	commandDelete    = "delete"
-	commandMailboxes = "mailboxes"
+	commandHelp          = "help"
+	commandStop          = "stop"
+	commandSend          = "send"
+	commandDKIM          = "dkim"
+	commandCatchAll      = botOptionCatchAll
+	commandUsers         = botOptionUsers
+	commandQueueBatch    = botOptionQueueBatch
+	commandQueueRetries  = botOptionQueueRetries
+	commandDelete        = "delete"
+	commandBanlist       = "banlist"
+	commandBanlistAdd    = "banlist:add"
+	commandBanlistRemove = "banlist:remove"
+	commandBanlistReset  = "banlist:reset"
+	commandMailboxes     = "mailboxes"
 )
 
 type (
@@ -38,7 +49,7 @@ func (c commandList) get(key string) *command {
 	return nil
 }
 
-func (b *Bot) buildCommandList() commandList {
+func (b *Bot) initCommands() commandList {
 	return commandList{
 		// special commands
 		{
@@ -51,6 +62,11 @@ func (b *Bot) buildCommandList() commandList {
 			description: "Disable bridge for the room and clear all configuration",
 			allowed:     b.allowOwner,
 		},
+		{
+			key:         commandSend,
+			description: "Send email",
+			allowed:     b.allowSend,
+		},
 		{allowed: b.allowOwner}, // delimiter
 		// options commands
 		{
@@ -59,13 +75,33 @@ func (b *Bot) buildCommandList() commandList {
 			sanitizer:   utils.Mailbox,
 			allowed:     b.allowOwner,
 		},
+		{
+			key:         roomOptionDomain,
+			description: "Get or set default domain of the room",
+			sanitizer:   utils.SanitizeDomain,
+			allowed:     b.allowOwner,
+		},
 		{
 			key:         roomOptionOwner,
 			description: "Get or set owner of the room",
 			sanitizer:   func(s string) string { return s },
 			allowed:     b.allowOwner,
 		},
+		{
+			key:         roomOptionPassword,
+			description: "Get or set SMTP password of the room's mailbox",
+			allowed:     b.allowOwner,
+		},
 		{allowed: b.allowOwner}, // delimiter
+		{
+			key: roomOptionNoSend,
+			description: fmt.Sprintf(
+				"Get or set `%s` of the room (`true` - disable email sending; `false` - enable email sending)",
+				roomOptionNoSend,
+			),
+			sanitizer: utils.SanitizeBoolString,
+			allowed:   b.allowOwner,
+		},
 		{
 			key: roomOptionNoSender,
 			description: fmt.Sprintf(
@@ -75,6 +111,15 @@ func (b *Bot) buildCommandList() commandList {
 			sanitizer: utils.SanitizeBoolString,
 			allowed:   b.allowOwner,
 		},
+		{
+			key: roomOptionNoRecipient,
+			description: fmt.Sprintf(
+				"Get or set `%s` of the room (`true` - hide recipient; `false` - show recipient)",
+				roomOptionNoRecipient,
+			),
+			sanitizer: utils.SanitizeBoolString,
+			allowed:   b.allowOwner,
+		},
 		{
 			key: roomOptionNoSubject,
 			description: fmt.Sprintf(
@@ -111,12 +156,56 @@ func (b *Bot) buildCommandList() commandList {
 			sanitizer: utils.SanitizeBoolString,
 			allowed:   b.allowOwner,
 		},
+		{allowed: b.allowOwner}, // delimiter
+		{
+			key:         roomOptionSpamcheckMX,
+			description: "only accept email from servers which seem prepared to receive it (those having valid MX records) (`true` - enable, `false` - disable)",
+			sanitizer:   utils.SanitizeBoolString,
+			allowed:     b.allowOwner,
+		},
+		{
+			key:         roomOptionSpamcheckSMTP,
+			description: "only accept email from servers which seem prepared to receive it (those listening on an SMTP port) (`true` - enable, `false` - disable)",
+			sanitizer:   utils.SanitizeBoolString,
+			allowed:     b.allowOwner,
+		},
+		{
+			key: roomOptionSpamlist,
+			description: fmt.Sprintf(
+				"Get or set `%s` of the room (comma-separated list), eg: `spammer@example.com,*@spammer.org,spam@*`",
+				roomOptionSpamlist,
+			),
+			sanitizer: utils.SanitizeStringSlice,
+			allowed:   b.allowOwner,
+		},
 		{allowed: b.allowAdmin}, // delimiter
 		{
 			key:         botOptionUsers,
 			description: "Get or set allowed users",
 			allowed:     b.allowAdmin,
 		},
+		{
+			key:         commandDKIM,
+			description: "Get DKIM signature",
+			allowed:     b.allowAdmin,
+		},
+		{
+			key:         commandCatchAll,
+			description: "Get or set catch-all mailbox",
+			allowed:     b.allowAdmin,
+		},
+		{
+			key:         commandQueueBatch,
+			description: "max amount of emails to process on each queue check",
+			sanitizer:   utils.SanitizeIntString,
+			allowed:     b.allowAdmin,
+		},
+		{
+			key:         commandQueueRetries,
+			description: "max amount of tries per email in queue before removal",
+			sanitizer:   utils.SanitizeIntString,
+			allowed:     b.allowAdmin,
+		},
 		{
 			key:         commandMailboxes,
 			description: "Show the list of all mailboxes",
@@ -127,6 +216,32 @@ func (b *Bot) buildCommandList() commandList {
 			description: "Delete specific mailbox",
 			allowed:     b.allowAdmin,
 		},
+		{allowed: b.allowAdmin}, // delimiter
+		{
+			key:         botOptionGreylist,
+			description: "Set automatic greylisting duration in minutes (0 - disabled)",
+			allowed:     b.allowAdmin,
+		},
+		{
+			key:         commandBanlist,
+			description: "Enable/disable banlist and show current values",
+			allowed:     b.allowAdmin,
+		},
+		{
+			key:         commandBanlistAdd,
+			description: "Ban an IP",
+			allowed:     b.allowAdmin,
+		},
+		{
+			key:         commandBanlistRemove,
+			description: "Unban an IP",
+			allowed:     b.allowAdmin,
+		},
+		{
+			key:         commandBanlistReset,
+			description: "Reset banlist",
+			allowed:     b.allowAdmin,
+		},
 	}
 }
 
@@ -135,6 +250,11 @@ func (b *Bot) handleCommand(ctx context.Context, evt *event.Event, commandSlice
 	if cmd == nil {
 		return
 	}
+	_, err := b.lp.GetClient().UserTyping(evt.RoomID, true, 30*time.Second)
+	if err != nil {
+		b.log.Error("cannot send typing notification: %v", err)
+	}
+	defer b.lp.GetClient().UserTyping(evt.RoomID, false, 30*time.Second) //nolint:errcheck
 
 	if !cmd.allowed(evt.Sender, evt.RoomID) {
 		b.SendNotice(ctx, evt.RoomID, "not allowed to do that, kupo")
@@ -146,10 +266,26 @@ func (b *Bot) handleCommand(ctx context.Context, evt *event.Event, commandSlice
 		b.sendHelp(ctx)
 	case commandStop:
 		b.runStop(ctx)
+	case commandSend:
+		b.runSend(ctx)
+	case commandDKIM:
+		b.runDKIM(ctx, commandSlice)
 	case commandUsers:
 		b.runUsers(ctx, commandSlice)
+	case commandCatchAll:
+		b.runCatchAll(ctx, commandSlice)
 	case commandDelete:
 		b.runDelete(ctx, commandSlice)
+	case botOptionGreylist:
+		b.runGreylist(ctx, commandSlice)
+	case commandBanlist:
+		b.runBanlist(ctx, commandSlice)
+	case commandBanlistAdd:
+		b.runBanlistAdd(ctx, commandSlice)
+	case commandBanlistRemove:
+		b.runBanlistRemove(ctx, commandSlice)
+	case commandBanlistReset:
+		b.runBanlistReset(ctx)
 	case commandMailboxes:
 		b.sendMailboxes(ctx)
 	default:
@@ -157,7 +293,7 @@ func (b *Bot) handleCommand(ctx context.Context, evt *event.Event, commandSlice
 	}
 }
 
-func (b *Bot) parseCommand(message string) []string {
+func (b *Bot) parseCommand(message string, toLower bool) []string {
 	if message == "" {
 		return nil
 	}
@@ -167,8 +303,11 @@ func (b *Bot) parseCommand(message string) []string {
 		return nil
 	}
 
-	message = strings.ToLower(strings.TrimSpace(strings.Replace(message, b.prefix, "", 1)))
-	return strings.Split(message, " ")
+	message = strings.Replace(message, b.prefix, "", 1)
+	if toLower {
+		message = strings.ToLower(message)
+	}
+	return strings.Split(strings.TrimSpace(message), " ")
 }
 
 func (b *Bot) sendIntroduction(ctx context.Context, roomID id.RoomID) {
@@ -181,10 +320,10 @@ func (b *Bot) sendIntroduction(ctx context.Context, roomID id.RoomID) {
 	msg.WriteString(b.prefix)
 	msg.WriteString(" ")
 	msg.WriteString(roomOptionMailbox)
-	msg.WriteString("` command.\n")
+	msg.WriteString(" SOME_INBOX` command.\n")
 
-	msg.WriteString("You will then be able to send emails to `SOME_INBOX@")
-	msg.WriteString(b.domain)
+	msg.WriteString("You will then be able to send emails to ")
+	msg.WriteString(utils.EmailsList("SOME_INBOX", ""))
 	msg.WriteString("` and have them appear in this room.")
 
 	b.SendNotice(ctx, roomID, msg.String())
@@ -222,8 +361,9 @@ func (b *Bot) sendHelp(ctx context.Context) {
 				msg.WriteString("(currently `")
 				msg.WriteString(value)
 				if cmd.key == roomOptionMailbox {
-					msg.WriteString("@")
-					msg.WriteString(b.domain)
+					msg.WriteString(" (")
+					msg.WriteString(utils.EmailsList(value, cfg.Domain()))
+					msg.WriteString(")")
 				}
 				msg.WriteString("`)")
 			}
@@ -237,3 +377,76 @@ func (b *Bot) sendHelp(ctx context.Context) {
 
 	b.SendNotice(ctx, evt.RoomID, msg.String())
 }
+
+func (b *Bot) runSend(ctx context.Context) {
+	evt := eventFromContext(ctx)
+	if !b.allowSend(evt.Sender, evt.RoomID) {
+		return
+	}
+	commandSlice := b.parseCommand(evt.Content.AsMessage().Body, false)
+	to, subject, body, err := utils.ParseSend(commandSlice)
+	if err == utils.ErrInvalidArgs {
+		b.SendNotice(ctx, evt.RoomID, fmt.Sprintf(
+			"Usage:\n"+
+				"```\n"+
+				"%s send someone@example.com\n"+
+				"Subject goes here on a line of its own\n"+
+				"Email content goes here\n"+
+				"on as many lines\n"+
+				"as you want.\n"+
+				"```",
+			b.prefix))
+		return
+	}
+	htmlBody := format.RenderMarkdown(body, true, true).FormattedBody
+
+	cfg, err := b.getRoomSettings(evt.RoomID)
+	if err != nil {
+		b.Error(ctx, evt.RoomID, "failed to retrieve room settings: %v", err)
+		return
+	}
+
+	mailbox := cfg.Mailbox()
+	if mailbox == "" {
+		b.SendNotice(ctx, evt.RoomID, "mailbox is not configured, kupo")
+		return
+	}
+
+	tos := strings.Split(to, ",")
+	// validate first
+	for _, to := range tos {
+		if !utils.AddressValid(to) {
+			b.Error(ctx, evt.RoomID, "email address is not valid")
+			return
+		}
+	}
+
+	b.lock(evt.RoomID.String())
+	defer b.unlock(evt.RoomID.String())
+
+	domain := utils.SanitizeDomain(cfg.Domain())
+	from := mailbox + "@" + domain
+	ID := utils.MessageID(evt.ID, domain)
+	for _, to := range tos {
+		email := utils.NewEmail(ID, "", " "+ID, subject, from, to, body, htmlBody, nil)
+		data := email.Compose(b.getBotSettings().DKIMPrivateKey())
+		if data == "" {
+			b.SendError(ctx, evt.RoomID, "email body is empty")
+			return
+		}
+		queued, err := b.Sendmail(evt.ID, from, to, data)
+		if queued {
+			b.log.Error("cannot send email: %v", err)
+			b.saveSentMetadata(ctx, queued, evt.ID, email, &cfg)
+			continue
+		}
+		if err != nil {
+			b.Error(ctx, evt.RoomID, "cannot send email to %s: %v", to, err)
+			continue
+		}
+		b.saveSentMetadata(ctx, false, evt.ID, email, &cfg)
+	}
+	if len(tos) > 1 {
+		b.SendNotice(ctx, evt.RoomID, "All emails were sent.")
+	}
+}

bot/command_admin.go

@@ -3,9 +3,12 @@ package bot
 import (
 	"context"
 	"fmt"
+	"net"
 	"sort"
+	"strconv"
 	"strings"
 
+	"gitlab.com/etke.cc/go/secgen"
 	"maunium.net/go/mautrix/id"
 
 	"gitlab.com/etke.cc/postmoogle/utils"
@@ -52,9 +55,7 @@ func (b *Bot) sendMailboxes(ctx context.Context) {
 	for _, mailbox := range slice {
 		cfg := mailboxes[mailbox]
 		msg.WriteString("* `")
-		msg.WriteString(mailbox)
-		msg.WriteString("@")
-		msg.WriteString(b.domain)
+		msg.WriteString(utils.EmailsList(mailbox, cfg.Domain()))
 		msg.WriteString("` by ")
 		msg.WriteString(cfg.Owner())
 		msg.WriteString("\n")
@@ -130,3 +131,231 @@ func (b *Bot) runUsers(ctx context.Context, commandSlice []string) {
 	b.allowedUsers = allowedUsers
 	b.SendNotice(ctx, evt.RoomID, "allowed users updated")
 }
+
+func (b *Bot) runDKIM(ctx context.Context, commandSlice []string) {
+	evt := eventFromContext(ctx)
+	cfg := b.getBotSettings()
+	if len(commandSlice) > 1 && commandSlice[1] == "reset" {
+		cfg.Set(botOptionDKIMPrivateKey, "")
+		cfg.Set(botOptionDKIMSignature, "")
+	}
+
+	signature := cfg.DKIMSignature()
+	if signature == "" {
+		var private string
+		var derr error
+		signature, private, derr = secgen.DKIM()
+		if derr != nil {
+			b.Error(ctx, evt.RoomID, "cannot generate DKIM signature: %v", derr)
+			return
+		}
+		cfg.Set(botOptionDKIMSignature, signature)
+		cfg.Set(botOptionDKIMPrivateKey, private)
+		err := b.setBotSettings(cfg)
+		if err != nil {
+			b.Error(ctx, evt.RoomID, "cannot save bot options: %v", err)
+			return
+		}
+	}
+
+	b.SendNotice(ctx, evt.RoomID, fmt.Sprintf(
+		"DKIM signature is: `%s`.\n"+
+			"You need to add it to DNS records of all domains added to postmoogle (if not already):\n"+
+			"Add new DNS record with type = `TXT`, key (subdomain/from): `postmoogle._domainkey` and value (to):\n ```\n%s\n```\n"+
+			"Without that record other email servers may reject your emails as spam, kupo.\n"+
+			"To reset the signature, send `%s dkim reset`",
+		signature, signature, b.prefix))
+}
+
+func (b *Bot) runCatchAll(ctx context.Context, commandSlice []string) {
+	evt := eventFromContext(ctx)
+	cfg := b.getBotSettings()
+	if len(commandSlice) < 2 {
+		var msg strings.Builder
+		msg.WriteString("Currently: `")
+		if cfg.CatchAll() != "" {
+			msg.WriteString(cfg.CatchAll())
+			msg.WriteString(" (")
+			msg.WriteString(utils.EmailsList(cfg.CatchAll(), ""))
+			msg.WriteString(")")
+		} else {
+			msg.WriteString("not set")
+		}
+		msg.WriteString("`\n\n")
+		msg.WriteString("Usage: `")
+		msg.WriteString(b.prefix)
+		msg.WriteString(" catch-all MAILBOX`")
+		msg.WriteString("where mailbox is valid and existing mailbox name\n")
+
+		b.SendNotice(ctx, evt.RoomID, msg.String())
+		return
+	}
+
+	mailbox := utils.Mailbox(commandSlice[1])
+	_, ok := b.GetMapping(mailbox)
+	if !ok {
+		b.SendError(ctx, evt.RoomID, "mailbox does not exist, kupo.")
+		return
+	}
+
+	cfg.Set(botOptionCatchAll, mailbox)
+	err := b.setBotSettings(cfg)
+	if err != nil {
+		b.Error(ctx, evt.RoomID, "cannot save bot options: %v", err)
+		return
+	}
+
+	b.SendNotice(ctx, evt.RoomID, fmt.Sprintf("Catch-all is set to: `%s` (%s).", mailbox, utils.EmailsList(mailbox, "")))
+}
+
+func (b *Bot) printGreylist(ctx context.Context, roomID id.RoomID) {
+	cfg := b.getBotSettings()
+	greylist := b.getGreylist()
+	var msg strings.Builder
+	size := len(greylist)
+	duration := cfg.Greylist()
+	msg.WriteString("Currently: `")
+	if duration == 0 {
+		msg.WriteString("disabled")
+	} else {
+		msg.WriteString(cfg.Get(botOptionGreylist))
+		msg.WriteString("min")
+	}
+	msg.WriteString("`")
+	if size > 0 {
+		msg.WriteString(", total known: ")
+		msg.WriteString(strconv.Itoa(size))
+		msg.WriteString(" hosts (`")
+		msg.WriteString(strings.Join(greylist.Slice(), "`, `"))
+		msg.WriteString("`)\n\n")
+	}
+	if duration == 0 {
+		msg.WriteString("\n\nTo enable greylist: `")
+		msg.WriteString(b.prefix)
+		msg.WriteString(" greylist MIN`")
+		msg.WriteString("where `MIN` is duration in minutes for automatic greylisting\n")
+	}
+
+	b.SendNotice(ctx, roomID, msg.String())
+}
+
+func (b *Bot) runGreylist(ctx context.Context, commandSlice []string) {
+	evt := eventFromContext(ctx)
+	if len(commandSlice) < 2 {
+		b.printGreylist(ctx, evt.RoomID)
+		return
+	}
+	cfg := b.getBotSettings()
+	value := utils.SanitizeIntString(commandSlice[1])
+	cfg.Set(botOptionGreylist, value)
+	err := b.setBotSettings(cfg)
+	if err != nil {
+		b.Error(ctx, evt.RoomID, "cannot set bot config: %v", err)
+	}
+	b.SendNotice(ctx, evt.RoomID, "greylist duration has been updated")
+}
+
+func (b *Bot) runBanlist(ctx context.Context, commandSlice []string) {
+	evt := eventFromContext(ctx)
+	cfg := b.getBotSettings()
+	if len(commandSlice) < 2 {
+		banlist := b.getBanlist()
+		var msg strings.Builder
+		size := len(banlist)
+		if size > 0 {
+			msg.WriteString("Currently: `")
+			msg.WriteString(cfg.Get(botOptionBanlistEnabled))
+			msg.WriteString("`, total: ")
+			msg.WriteString(strconv.Itoa(size))
+			msg.WriteString(" hosts (`")
+			msg.WriteString(strings.Join(banlist.Slice(), "`, `"))
+			msg.WriteString("`)\n\n")
+		}
+		if !cfg.BanlistEnabled() {
+			msg.WriteString("To enable banlist, send `")
+			msg.WriteString(b.prefix)
+			msg.WriteString(" banlist true`\n\n")
+		}
+		msg.WriteString("To ban somebody: `")
+		msg.WriteString(b.prefix)
+		msg.WriteString(" banlist:add IP1 IP2 IP3...`")
+		msg.WriteString("where each ip is IPv4 or IPv6\n")
+
+		b.SendNotice(ctx, evt.RoomID, msg.String())
+		return
+	}
+	value := utils.SanitizeBoolString(commandSlice[1])
+	cfg.Set(botOptionBanlistEnabled, value)
+	err := b.setBotSettings(cfg)
+	if err != nil {
+		b.Error(ctx, evt.RoomID, "cannot set bot config: %v", err)
+	}
+	b.syncBanlist()
+	b.SendNotice(ctx, evt.RoomID, "banlist has been updated")
+}
+
+func (b *Bot) runBanlistAdd(ctx context.Context, commandSlice []string) {
+	evt := eventFromContext(ctx)
+	if len(commandSlice) < 2 {
+		b.runBanlist(ctx, commandSlice)
+		return
+	}
+	banlist := b.getBanlist()
+
+	ips := commandSlice[1:]
+	for _, ip := range ips {
+		addr, err := net.ResolveIPAddr("ip", ip)
+		if err != nil {
+			b.Error(ctx, evt.RoomID, "cannot add %s to banlist: %v", ip, err)
+			return
+		}
+		banlist.Add(addr)
+	}
+
+	err := b.setBanlist(banlist)
+	if err != nil {
+		b.Error(ctx, evt.RoomID, "cannot set banlist: %v", err)
+		return
+	}
+
+	b.SendNotice(ctx, evt.RoomID, "banlist has been updated, kupo")
+}
+
+func (b *Bot) runBanlistRemove(ctx context.Context, commandSlice []string) {
+	evt := eventFromContext(ctx)
+	if len(commandSlice) < 2 {
+		b.runBanlist(ctx, commandSlice)
+		return
+	}
+	banlist := b.getBanlist()
+
+	ips := commandSlice[1:]
+	for _, ip := range ips {
+		addr, err := net.ResolveIPAddr("ip", ip)
+		if err != nil {
+			b.Error(ctx, evt.RoomID, "cannot remove %s from banlist: %v", ip, err)
+			return
+		}
+		banlist.Remove(addr)
+	}
+
+	err := b.setBanlist(banlist)
+	if err != nil {
+		b.Error(ctx, evt.RoomID, "cannot set banlist: %v", err)
+		return
+	}
+
+	b.SendNotice(ctx, evt.RoomID, "banlist has been updated, kupo")
+}
+
+func (b *Bot) runBanlistReset(ctx context.Context) {
+	evt := eventFromContext(ctx)
+
+	err := b.setBanlist(bglist{})
+	if err != nil {
+		b.Error(ctx, evt.RoomID, "cannot set banlist: %v", err)
+		return
+	}
+
+	b.SendNotice(ctx, evt.RoomID, "banlist has been reset, kupo")
+}

bot/command_owner.go

@@ -3,6 +3,10 @@ package bot
 import (
 	"context"
 	"fmt"
+
+	"github.com/raja/argon2pw"
+
+	"gitlab.com/etke.cc/postmoogle/utils"
 )
 
 func (b *Bot) runStop(ctx context.Context) {
@@ -48,28 +52,42 @@ func (b *Bot) getOption(ctx context.Context, name string) {
 
 	value := cfg.Get(name)
 	if value == "" {
-		b.SendNotice(ctx, evt.RoomID, fmt.Sprintf("`%s` is not set, kupo.", name))
+		msg := fmt.Sprintf("`%s` is not set, kupo.\n"+
+			"To set it, send a `%s %s VALUE` command.",
+			name, b.prefix, name)
+		b.SendNotice(ctx, evt.RoomID, msg)
 		return
 	}
 
 	if name == roomOptionMailbox {
-		value = value + "@" + b.domain
+		value = utils.EmailsList(value, cfg.Domain())
 	}
 
-	b.SendNotice(ctx, evt.RoomID, fmt.Sprintf("`%s` of this room is `%s`", name, value))
+	msg := fmt.Sprintf("`%s` of this room is `%s`\n"+
+		"To set it to a new value, send a `%s %s VALUE` command.",
+		name, value, b.prefix, name)
+	if name == roomOptionPassword {
+		msg = fmt.Sprintf("There is an SMTP password already set for this room/mailbox. "+
+			"It's stored in a secure hashed manner, so we can't tell you what the original raw password was. "+
+			"To find the raw password, try to find your old message which had originally set it, "+
+			"or just set a new one with `%s %s NEW_PASSWORD`.",
+			b.prefix, name)
+	}
+	b.SendNotice(ctx, evt.RoomID, msg)
 }
 
+//nolint:gocognit
 func (b *Bot) setOption(ctx context.Context, name, value string) {
 	cmd := b.commands.get(name)
-	if cmd != nil {
+	if cmd != nil && cmd.sanitizer != nil {
 		value = cmd.sanitizer(value)
 	}
 
 	evt := eventFromContext(ctx)
 	if name == roomOptionMailbox {
-		existingID, ok := b.GetMapping(value)
+		existingID, ok := b.getMapping(value)
 		if ok && existingID != "" && existingID != evt.RoomID {
-			b.SendNotice(ctx, evt.RoomID, fmt.Sprintf("Mailbox `%s@%s` already taken, kupo", value, b.domain))
+			b.SendNotice(ctx, evt.RoomID, fmt.Sprintf("Mailbox `%s` (%s) already taken, kupo", value, utils.EmailsList(value, "")))
 			return
 		}
 	}
@@ -80,6 +98,15 @@ func (b *Bot) setOption(ctx context.Context, name, value string) {
 		return
 	}
 
+	if name == roomOptionPassword {
+		value = b.parseCommand(evt.Content.AsMessage().Body, false)[1] // get original value, without forced lower case
+		value, err = argon2pw.GenerateSaltedHash(value)
+		if err != nil {
+			b.Error(ctx, evt.RoomID, "failed to hash password: %v", err)
+			return
+		}
+	}
+
 	old := cfg.Get(name)
 	cfg.Set(name, value)
 
@@ -89,7 +116,7 @@ func (b *Bot) setOption(ctx context.Context, name, value string) {
 			b.rooms.Delete(old)
 		}
 		b.rooms.Store(value, evt.RoomID)
-		value = fmt.Sprintf("%s@%s", value, b.domain)
+		value = fmt.Sprintf("%s@%s", value, utils.SanitizeDomain(cfg.Domain()))
 	}
 
 	err = b.setRoomSettings(evt.RoomID, cfg)
@@ -98,9 +125,9 @@ func (b *Bot) setOption(ctx context.Context, name, value string) {
 		return
 	}
 
-	if name == roomOptionMailbox {
-		value = value + "@" + b.domain
+	msg := fmt.Sprintf("`%s` of this room set to `%s`", name, value)
+	if name == roomOptionPassword {
+		msg = "SMTP password has been set"
 	}
-
-	b.SendNotice(ctx, evt.RoomID, fmt.Sprintf("`%s` of this room set to `%s`", name, value))
+	b.SendNotice(ctx, evt.RoomID, msg)
 }

bot/data.go

@@ -37,12 +37,11 @@ func (b *Bot) syncRooms() error {
 		return err
 	}
 	for _, roomID := range resp.JoinedRooms {
-		b.migrateSettings(roomID)
 		cfg, serr := b.getRoomSettings(roomID)
 		if serr != nil {
-			b.log.Warn("cannot get %s settings: %v", roomID, err)
 			continue
 		}
+		b.migrateRoomSettings(roomID)
 		mailbox := cfg.Mailbox()
 		if mailbox != "" {
 			b.rooms.Store(mailbox, roomID)
@@ -51,3 +50,14 @@ func (b *Bot) syncRooms() error {
 
 	return nil
 }
+
+func (b *Bot) syncBanlist() {
+	b.lock("banlist")
+	defer b.unlock("banlist")
+
+	if !b.getBotSettings().BanlistEnabled() {
+		b.banlist = make(bglist, 0)
+		return
+	}
+	b.banlist = b.getBanlist()
+}

bot/email.go

@@ -12,52 +12,54 @@ import (
 	"gitlab.com/etke.cc/postmoogle/utils"
 )
 
-// account data key
-const acMessagePrefix = "cc.etke.postmoogle.message"
+// account data keys
+const (
+	acQueueKey        = "cc.etke.postmoogle.mailqueue"
+	acMessagePrefix   = "cc.etke.postmoogle.message"
+	acLastEventPrefix = "cc.etke.postmoogle.last"
+)
 
 // event keys
 const (
-	eventMessageIDkey = "cc.etke.postmoogle.messageID"
-	eventInReplyToKey = "cc.etke.postmoogle.inReplyTo"
+	eventMessageIDkey  = "cc.etke.postmoogle.messageID"
+	eventReferencesKey = "cc.etke.postmoogle.references"
+	eventInReplyToKey  = "cc.etke.postmoogle.inReplyTo"
+	eventSubjectKey    = "cc.etke.postmoogle.subject"
+	eventFromKey       = "cc.etke.postmoogle.from"
+	eventToKey         = "cc.etke.postmoogle.to"
 )
 
-func email2content(email *utils.Email, cfg roomSettings, threadID id.EventID) *event.Content {
-	var text strings.Builder
-	if !cfg.NoSender() {
-		text.WriteString("From: ")
-		text.WriteString(email.From)
-		text.WriteString("\n\n")
-	}
-	if !cfg.NoSubject() {
-		text.WriteString("# ")
-		text.WriteString(email.Subject)
-		text.WriteString("\n\n")
-	}
-	if email.HTML != "" && !cfg.NoHTML() {
-		text.WriteString(format.HTMLToMarkdown(email.HTML))
-	} else {
-		text.WriteString(email.Text)
-	}
-
-	parsed := format.RenderMarkdown(text.String(), true, true)
-	parsed.RelatesTo = utils.RelatesTo(cfg.NoThreads(), threadID)
-
-	content := event.Content{
-		Raw: map[string]interface{}{
-			eventMessageIDkey: email.MessageID,
-			eventInReplyToKey: email.InReplyTo,
-		},
-		Parsed: parsed,
-	}
-	return &content
+// SetSendmail sets mail sending func to the bot
+func (b *Bot) SetSendmail(sendmail func(string, string, string) error) {
+	b.sendmail = sendmail
 }
 
-// GetMapping returns mapping of mailbox = room
-func (b *Bot) GetMapping(mailbox string) (id.RoomID, bool) {
+// Sendmail tries to send email immediately, but if it gets 4xx error (greylisting),
+// the email will be added to the queue and retried several times after that
+func (b *Bot) Sendmail(eventID id.EventID, from, to, data string) (bool, error) {
+	err := b.sendmail(from, to, data)
+	if err != nil {
+		if strings.HasPrefix(err.Error(), "4") {
+			b.log.Debug("email %s (from=%s to=%s) was added to the queue: %v", eventID, from, to, err)
+			return true, b.enqueueEmail(eventID.String(), from, to, data)
+		}
+		return false, err
+	}
+
+	return false, nil
+}
+
+// GetDKIMprivkey returns DKIM private key
+func (b *Bot) GetDKIMprivkey() string {
+	return b.getBotSettings().DKIMPrivateKey()
+}
+
+func (b *Bot) getMapping(mailbox string) (id.RoomID, bool) {
 	v, ok := b.rooms.Load(mailbox)
 	if !ok {
 		return "", ok
 	}
+
 	roomID, ok := v.(id.RoomID)
 	if !ok {
 		return "", ok
@@ -66,89 +68,305 @@ func (b *Bot) GetMapping(mailbox string) (id.RoomID, bool) {
 	return roomID, ok
 }
 
-// Send email to matrix room
-func (b *Bot) Send(ctx context.Context, email *utils.Email) error {
-	roomID, ok := b.GetMapping(utils.Mailbox(email.To))
+// GetMapping returns mapping of mailbox = room
+func (b *Bot) GetMapping(mailbox string) (id.RoomID, bool) {
+	roomID, ok := b.getMapping(mailbox)
+	if !ok {
+		catchAll := b.getBotSettings().CatchAll()
+		if catchAll == "" {
+			return roomID, ok
+		}
+		return b.getMapping(catchAll)
+	}
+
+	return roomID, ok
+}
+
+// GetIFOptions returns incoming email filtering options (room settings)
+func (b *Bot) GetIFOptions(roomID id.RoomID) utils.IncomingFilteringOptions {
+	cfg, err := b.getRoomSettings(roomID)
+	if err != nil {
+		b.log.Error("cannot retrieve room settings: %v", err)
+		return roomSettings{}
+	}
+
+	return cfg
+}
+
+// IncomingEmail sends incoming email to matrix room
+func (b *Bot) IncomingEmail(ctx context.Context, email *utils.Email) error {
+	roomID, ok := b.GetMapping(email.Mailbox(true))
 	if !ok {
 		return errors.New("room not found")
 	}
-	b.lock(roomID)
-	defer b.unlock(roomID)
-
 	cfg, err := b.getRoomSettings(roomID)
 	if err != nil {
 		b.Error(ctx, roomID, "cannot get settings: %v", err)
 	}
 
+	b.lock(roomID.String())
+	defer b.unlock(roomID.String())
+
 	var threadID id.EventID
-	if email.InReplyTo != "" && !cfg.NoThreads() {
-		threadID = b.getThreadID(roomID, email.InReplyTo)
+	if email.InReplyTo != "" || email.References != "" {
+		threadID = b.getThreadID(roomID, email.InReplyTo, email.References)
 		if threadID != "" {
 			b.setThreadID(roomID, email.MessageID, threadID)
 		}
 	}
-
-	content := email2content(email, cfg, threadID)
+	content := email.Content(threadID, cfg.ContentOptions())
 	eventID, serr := b.lp.Send(roomID, content)
 	if serr != nil {
 		return utils.UnwrapError(serr)
 	}
-
-	if threadID == "" && !cfg.NoThreads() {
-		b.setThreadID(roomID, email.MessageID, eventID)
+	if threadID == "" {
 		threadID = eventID
 	}
 
+	b.setThreadID(roomID, email.MessageID, threadID)
+	b.setLastEventID(roomID, threadID, eventID)
+	threadID = eventID
+
 	if !cfg.NoFiles() {
 		b.sendFiles(ctx, roomID, email.Files, cfg.NoThreads(), threadID)
 	}
+
 	return nil
 }
 
+// SendEmailReply sends replies from matrix thread to email thread
+func (b *Bot) SendEmailReply(ctx context.Context) {
+	evt := eventFromContext(ctx)
+	cfg, err := b.getRoomSettings(evt.RoomID)
+	if err != nil {
+		b.Error(ctx, evt.RoomID, "cannot retrieve room settings: %v", err)
+		return
+	}
+	mailbox := cfg.Mailbox()
+	if mailbox == "" {
+		b.Error(ctx, evt.RoomID, "mailbox is not configured, kupo")
+		return
+	}
+	domain := utils.SanitizeDomain(cfg.Domain())
+
+	b.lock(evt.RoomID.String())
+	defer b.unlock(evt.RoomID.String())
+
+	fromMailbox := mailbox + "@" + domain
+	meta := b.getParentEmail(evt, domain)
+	// when email was sent from matrix and reply was sent from matrix again
+	if fromMailbox != meta.From {
+		meta.To = meta.From
+	}
+	meta.From = fromMailbox
+
+	if meta.To == "" {
+		b.Error(ctx, evt.RoomID, "cannot find parent email and continue the thread. Please, start a new email thread")
+		return
+	}
+
+	if meta.ThreadID == "" {
+		meta.ThreadID = b.getThreadID(evt.RoomID, meta.InReplyTo, meta.References)
+	}
+	content := evt.Content.AsMessage()
+	if meta.Subject == "" {
+		meta.Subject = strings.SplitN(content.Body, "\n", 1)[0]
+	}
+	body := content.Body
+	htmlBody := content.FormattedBody
+
+	meta.MessageID = utils.MessageID(evt.ID, domain)
+	meta.References = meta.References + " " + meta.MessageID
+	b.log.Debug("send email reply: %+v", meta)
+	email := utils.NewEmail(meta.MessageID, meta.InReplyTo, meta.References, meta.Subject, meta.From, meta.To, body, htmlBody, nil)
+	data := email.Compose(b.getBotSettings().DKIMPrivateKey())
+	if data == "" {
+		b.SendError(ctx, evt.RoomID, "email body is empty")
+		return
+	}
+
+	queued, err := b.Sendmail(evt.ID, meta.From, meta.To, data)
+	if queued {
+		b.log.Error("cannot send email: %v", err)
+		b.saveSentMetadata(ctx, queued, meta.ThreadID, email, &cfg)
+		return
+	}
+
+	if err != nil {
+		b.Error(ctx, evt.RoomID, "cannot send email: %v", err)
+		return
+	}
+
+	b.saveSentMetadata(ctx, queued, meta.ThreadID, email, &cfg)
+}
+
+type parentEmail struct {
+	MessageID  string
+	ThreadID   id.EventID
+	From       string
+	To         string
+	InReplyTo  string
+	References string
+	Subject    string
+}
+
+func (b *Bot) getParentEvent(evt *event.Event) (id.EventID, *event.Event) {
+	content := evt.Content.AsMessage()
+	threadID := utils.EventParent(evt.ID, content)
+	b.log.Debug("looking up for the parent event of %s within thread %s", evt.ID, threadID)
+	if threadID == evt.ID {
+		b.log.Debug("event %s is the thread itself")
+		return threadID, evt
+	}
+	lastEventID := b.getLastEventID(evt.RoomID, threadID)
+	b.log.Debug("the last event of the thread %s (and parent of the %s) is %s", threadID, evt.ID, lastEventID)
+	if lastEventID == evt.ID {
+		return threadID, evt
+	}
+	parentEvt, err := b.lp.GetClient().GetEvent(evt.RoomID, lastEventID)
+	if err != nil {
+		b.log.Error("cannot get parent event: %v", err)
+		return threadID, nil
+	}
+	utils.ParseContent(parentEvt, parentEvt.Type)
+	b.log.Debug("type of the parsed content is: %T", parentEvt.Content.Parsed)
+
+	if !b.lp.GetStore().IsEncrypted(evt.RoomID) {
+		b.log.Debug("found the last event (plaintext) of the thread %s (and parent of the %s): %+v", threadID, evt.ID, parentEvt)
+		return threadID, parentEvt
+	}
+
+	decrypted, err := b.lp.GetMachine().DecryptMegolmEvent(parentEvt)
+	if err != nil {
+		b.log.Error("cannot decrypt parent event: %v", err)
+		return threadID, nil
+	}
+
+	b.log.Debug("found the last event (decrypted) of the thread %s (and parent of the %s): %+v", threadID, evt.ID, parentEvt)
+	return threadID, decrypted
+}
+
+func (b *Bot) getParentEmail(evt *event.Event, domain string) parentEmail {
+	var parent parentEmail
+	threadID, parentEvt := b.getParentEvent(evt)
+	parent.ThreadID = threadID
+	if parentEvt == nil {
+		return parent
+	}
+	if parentEvt.ID == evt.ID {
+		return parent
+	}
+
+	parent.MessageID = utils.MessageID(parentEvt.ID, domain)
+	parent.From = utils.EventField[string](&parentEvt.Content, eventFromKey)
+	parent.To = utils.EventField[string](&parentEvt.Content, eventToKey)
+	parent.InReplyTo = utils.EventField[string](&parentEvt.Content, eventMessageIDkey)
+	parent.References = utils.EventField[string](&parentEvt.Content, eventReferencesKey)
+	if parent.InReplyTo == "" {
+		parent.InReplyTo = parent.MessageID
+	}
+	if parent.References == "" {
+		parent.References = " " + parent.MessageID
+	}
+
+	parent.Subject = utils.EventField[string](&parentEvt.Content, eventSubjectKey)
+	if parent.Subject != "" {
+		parent.Subject = "Re: " + parent.Subject
+	} else {
+		parent.Subject = strings.SplitN(evt.Content.AsMessage().Body, "\n", 1)[0]
+	}
+
+	return parent
+}
+
+// saveSentMetadata used to save metadata from !pm sent and thread reply events to a separate notice message
+// because that metadata is needed to determine email thread relations
+func (b *Bot) saveSentMetadata(ctx context.Context, queued bool, threadID id.EventID, email *utils.Email, cfg *roomSettings) {
+	text := "Email has been sent to " + email.To
+	if queued {
+		text = "Email to " + email.To + " has been queued"
+	}
+
+	evt := eventFromContext(ctx)
+	content := email.Content(threadID, cfg.ContentOptions())
+	notice := format.RenderMarkdown(text, true, true)
+	msgContent, ok := content.Parsed.(*event.MessageEventContent)
+	if !ok {
+		b.Error(ctx, evt.RoomID, "cannot parse message")
+		return
+	}
+	msgContent.MsgType = event.MsgNotice
+	msgContent.Body = notice.Body
+	msgContent.FormattedBody = notice.FormattedBody
+	content.Parsed = msgContent
+	msgID, err := b.lp.Send(evt.RoomID, content)
+	if err != nil {
+		b.Error(ctx, evt.RoomID, "cannot send notice: %v", err)
+		return
+	}
+	domain := utils.SanitizeDomain(cfg.Domain())
+	b.setThreadID(evt.RoomID, utils.MessageID(evt.ID, domain), threadID)
+	b.setThreadID(evt.RoomID, utils.MessageID(msgID, domain), threadID)
+	b.setLastEventID(evt.RoomID, threadID, msgID)
+}
+
 func (b *Bot) sendFiles(ctx context.Context, roomID id.RoomID, files []*utils.File, noThreads bool, parentID id.EventID) {
 	for _, file := range files {
 		req := file.Convert()
-		resp, err := b.lp.GetClient().UploadMedia(req)
+		err := b.lp.SendFile(roomID, req, file.MsgType, utils.RelatesTo(!noThreads, parentID))
 		if err != nil {
 			b.Error(ctx, roomID, "cannot upload file %s: %v", req.FileName, err)
-			continue
-		}
-		_, err = b.lp.Send(roomID, &event.MessageEventContent{
-			MsgType:   event.MsgFile,
-			Body:      req.FileName,
-			URL:       resp.ContentURI.CUString(),
-			RelatesTo: utils.RelatesTo(noThreads, parentID),
-		})
-		if err != nil {
-			b.Error(ctx, roomID, "cannot send uploaded file %s: %v", req.FileName, err)
 		}
 	}
 }
 
-func (b *Bot) getThreadID(roomID id.RoomID, messageID string) id.EventID {
-	key := acMessagePrefix + "." + messageID
-	data := map[string]id.EventID{}
-	err := b.lp.GetClient().GetRoomAccountData(roomID, key, &data)
-	if err != nil {
-		if !strings.Contains(err.Error(), "M_NOT_FOUND") {
-			b.log.Error("cannot retrieve account data %s: %v", key, err)
-			return ""
+func (b *Bot) getThreadID(roomID id.RoomID, messageID string, references string) id.EventID {
+	refs := []string{messageID}
+	if references != "" {
+		refs = append(refs, strings.Split(references, " ")...)
+	}
+
+	for _, refID := range refs {
+		key := acMessagePrefix + "." + refID
+		data, err := b.lp.GetRoomAccountData(roomID, key)
+		if err != nil {
+			b.log.Error("cannot retrieve thread ID from %s: %v", key, err)
+			continue
+		}
+		if data["eventID"] != "" {
+			return id.EventID(data["eventID"])
 		}
 	}
 
-	return data["eventID"]
+	return ""
 }
 
 func (b *Bot) setThreadID(roomID id.RoomID, messageID string, eventID id.EventID) {
 	key := acMessagePrefix + "." + messageID
-	data := map[string]id.EventID{
-		"eventID": eventID,
-	}
-
-	err := b.lp.GetClient().SetRoomAccountData(roomID, key, data)
+	err := b.lp.SetRoomAccountData(roomID, key, map[string]string{"eventID": eventID.String()})
 	if err != nil {
-		if !strings.Contains(err.Error(), "M_NOT_FOUND") {
-			b.log.Error("cannot save account data %s: %v", key, err)
-		}
+		b.log.Error("cannot save thread ID to %s: %v", key, err)
+	}
+}
+
+func (b *Bot) getLastEventID(roomID id.RoomID, threadID id.EventID) id.EventID {
+	key := acLastEventPrefix + "." + threadID.String()
+	data, err := b.lp.GetRoomAccountData(roomID, key)
+	if err != nil {
+		b.log.Error("cannot retrieve last event ID from %s: %v", key, err)
+		return threadID
+	}
+	if data["eventID"] != "" {
+		return id.EventID(data["eventID"])
+	}
+
+	return threadID
+}
+
+func (b *Bot) setLastEventID(roomID id.RoomID, threadID id.EventID, eventID id.EventID) {
+	key := acLastEventPrefix + "." + threadID.String()
+	err := b.lp.SetRoomAccountData(roomID, key, map[string]string{"eventID": eventID.String()})
+	if err != nil {
+		b.log.Error("cannot save thread ID to %s: %v", key, err)
 	}
 }

bot/message.go

@@ -7,14 +7,22 @@ import (
 
 func (b *Bot) handle(ctx context.Context) {
 	evt := eventFromContext(ctx)
+	err := b.lp.GetClient().MarkRead(evt.RoomID, evt.ID)
+	if err != nil {
+		b.log.Error("cannot send read receipt: %v", err)
+	}
+
 	content := evt.Content.AsMessage()
 	if content == nil {
 		b.Error(ctx, evt.RoomID, "cannot read message")
 		return
 	}
 	message := strings.TrimSpace(content.Body)
-	cmd := b.parseCommand(message)
+	cmd := b.parseCommand(message, true)
 	if cmd == nil {
+		if content.RelatesTo != nil {
+			b.SendEmailReply(ctx)
+		}
 		return
 	}
 

bot/mutex.go

@@ -0,0 +1,24 @@
+package bot
+
+import (
+	"sync"
+)
+
+func (b *Bot) lock(key string) {
+	_, ok := b.mu[key]
+	if !ok {
+		b.mu[key] = &sync.Mutex{}
+	}
+
+	b.mu[key].Lock()
+}
+
+func (b *Bot) unlock(key string) {
+	_, ok := b.mu[key]
+	if !ok {
+		return
+	}
+
+	b.mu[key].Unlock()
+	delete(b.mu, key)
+}

bot/mutext.go

@@ -1,26 +0,0 @@
-package bot
-
-import (
-	"sync"
-
-	"maunium.net/go/mautrix/id"
-)
-
-func (b *Bot) lock(roomID id.RoomID) {
-	_, ok := b.mu[roomID]
-	if !ok {
-		b.mu[roomID] = &sync.Mutex{}
-	}
-
-	b.mu[roomID].Lock()
-}
-
-func (b *Bot) unlock(roomID id.RoomID) {
-	_, ok := b.mu[roomID]
-	if !ok {
-		return
-	}
-
-	b.mu[roomID].Unlock()
-	delete(b.mu, roomID)
-}

bot/queue.go

@@ -0,0 +1,153 @@
+package bot
+
+import (
+	"strconv"
+)
+
+const (
+	defaultQueueBatch   = 1
+	defaultQueueRetries = 3
+)
+
+// ProcessQueue starts queue processing
+func (b *Bot) ProcessQueue() {
+	b.log.Debug("staring queue processing...")
+	cfg := b.getBotSettings()
+
+	batchSize := cfg.QueueBatch()
+	if batchSize == 0 {
+		batchSize = defaultQueueBatch
+	}
+
+	retries := cfg.QueueRetries()
+	if retries == 0 {
+		retries = defaultQueueRetries
+	}
+
+	b.popqueue(batchSize, retries)
+	b.log.Debug("ended queue processing")
+}
+
+// popqueue gets emails from queue and tries to send them,
+// if an email was sent successfully - it will be removed from queue
+func (b *Bot) popqueue(batchSize, maxTries int) {
+	b.lock(acQueueKey)
+	defer b.unlock(acQueueKey)
+	index, err := b.lp.GetAccountData(acQueueKey)
+	if err != nil {
+		b.log.Error("cannot get queue index: %v", err)
+	}
+
+	i := 0
+	for id, itemkey := range index {
+		if i > batchSize {
+			b.log.Debug("finished re-deliveries from queue")
+			return
+		}
+		if dequeue := b.processQueueItem(itemkey, maxTries); dequeue {
+			b.log.Debug("email %s has been delivered", id)
+			err = b.dequeueEmail(id)
+			if err != nil {
+				b.log.Error("cannot dequeue email %s: %v", id, err)
+			}
+		}
+		i++
+	}
+}
+
+// processQueueItem tries to process an item from queue
+// returns should the item be dequeued or not
+func (b *Bot) processQueueItem(itemkey string, maxRetries int) bool {
+	b.lock(itemkey)
+	defer b.unlock(itemkey)
+
+	item, err := b.lp.GetAccountData(itemkey)
+	if err != nil {
+		b.log.Error("cannot retrieve a queue item %s: %v", itemkey, err)
+		return false
+	}
+	b.log.Debug("processing queue item %+v", item)
+	attempts, err := strconv.Atoi(item["attempts"])
+	if err != nil {
+		b.log.Error("cannot parse attempts of %s: %v", itemkey, err)
+		return false
+	}
+	if attempts > maxRetries {
+		return true
+	}
+
+	err = b.sendmail(item["from"], item["to"], item["data"])
+	if err == nil {
+		b.log.Debug("email %s from queue was delivered")
+		return true
+	}
+
+	b.log.Debug("attempted to deliver email id=%s, retry=%s, but it's not ready yet: %v", item["id"], item["attempts"], err)
+	attempts++
+	item["attempts"] = strconv.Itoa(attempts)
+	err = b.lp.SetAccountData(itemkey, item)
+	if err != nil {
+		b.log.Error("cannot update attempt count on email %s: %v", itemkey, err)
+	}
+
+	return false
+}
+
+// enqueueEmail adds an email to the queue
+func (b *Bot) enqueueEmail(id, from, to, data string) error {
+	itemkey := acQueueKey + "." + id
+	item := map[string]string{
+		"attempts": "0",
+		"data":     data,
+		"from":     from,
+		"to":       to,
+		"id":       id,
+	}
+
+	b.lock(itemkey)
+	defer b.unlock(itemkey)
+	err := b.lp.SetAccountData(itemkey, item)
+	if err != nil {
+		b.log.Error("cannot enqueue email id=%s: %v", id, err)
+		return err
+	}
+
+	b.lock(acQueueKey)
+	defer b.unlock(acQueueKey)
+	queueIndex, err := b.lp.GetAccountData(acQueueKey)
+	if err != nil {
+		b.log.Error("cannot get queue index: %v", err)
+		return err
+	}
+	queueIndex[id] = itemkey
+	err = b.lp.SetAccountData(acQueueKey, queueIndex)
+	if err != nil {
+		b.log.Error("cannot save queue index: %v", err)
+		return err
+	}
+
+	return nil
+}
+
+// dequeueEmail removes an email from the queue
+func (b *Bot) dequeueEmail(id string) error {
+	index, err := b.lp.GetAccountData(acQueueKey)
+	if err != nil {
+		b.log.Error("cannot get queue index: %v", err)
+		return err
+	}
+	itemkey := index[id]
+	if itemkey == "" {
+		itemkey = acQueueKey + "." + id
+	}
+	delete(index, id)
+	err = b.lp.SetAccountData(acQueueKey, index)
+	if err != nil {
+		b.log.Error("cannot update queue index: %v", err)
+		return err
+	}
+
+	b.lock(itemkey)
+	defer b.unlock(itemkey)
+	return b.lp.SetAccountData(itemkey, nil)
+}

bot/settings_bot.go

@@ -11,7 +11,14 @@ const acBotSettingsKey = "cc.etke.postmoogle.config"
 
 // bot options keys
 const (
-	botOptionUsers = "users"
+	botOptionUsers          = "users"
+	botOptionCatchAll       = "catch-all"
+	botOptionDKIMSignature  = "dkim.pub"
+	botOptionDKIMPrivateKey = "dkim.pem"
+	botOptionQueueBatch     = "queue:batch"
+	botOptionQueueRetries   = "queue:retries"
+	botOptionBanlistEnabled = "banlist:enabled"
+	botOptionGreylist       = "greylist"
 )
 
 type botSettings map[string]string
@@ -40,52 +47,68 @@ func (s botSettings) Users() []string {
 	return []string{value}
 }
 
-func (b *Bot) initBotUsers(envUsers []string) ([]string, error) {
+// CatchAll option
+func (s botSettings) CatchAll() string {
+	return s.Get(botOptionCatchAll)
+}
+
+// BanlistEnabled option
+func (s botSettings) BanlistEnabled() bool {
+	return utils.Bool(s.Get(botOptionBanlistEnabled))
+}
+
+// Greylist option (duration in minutes)
+func (s botSettings) Greylist() int {
+	return utils.Int(s.Get(botOptionGreylist))
+}
+
+// DKIMSignature (DNS TXT record)
+func (s botSettings) DKIMSignature() string {
+	return s.Get(botOptionDKIMSignature)
+}
+
+// DKIMPrivateKey keep it secret
+func (s botSettings) DKIMPrivateKey() string {
+	return s.Get(botOptionDKIMPrivateKey)
+}
+
+// QueueBatch option
+func (s botSettings) QueueBatch() int {
+	return utils.Int(s.Get(botOptionQueueBatch))
+}
+
+// QueueRetries option
+func (s botSettings) QueueRetries() int {
+	return utils.Int(s.Get(botOptionQueueRetries))
+}
+
+func (b *Bot) initBotUsers() ([]string, error) {
 	config := b.getBotSettings()
 	cfgUsers := config.Users()
 	if len(cfgUsers) > 0 {
-		// already migrated
 		return cfgUsers, nil
 	}
-	if len(envUsers) == 0 {
-		_, homeserver, err := b.lp.GetClient().UserID.Parse()
-		if err != nil {
-			return nil, err
-		}
-		config.Set(botOptionUsers, "@*:"+homeserver)
-	} else {
-		// Initialize from environment variable
-		// TODO: remove this migration later and always initialize to `"@*:"+homeserver`
-		config.Set(botOptionUsers, strings.Join(envUsers, " "))
-	}
 
+	_, homeserver, err := b.lp.GetClient().UserID.Parse()
+	if err != nil {
+		return nil, err
+	}
+	config.Set(botOptionUsers, "@*:"+homeserver)
 	return config.Users(), b.setBotSettings(config)
 }
 
 func (b *Bot) getBotSettings() botSettings {
-	cfg := b.botcfg.Get(acBotSettingsKey)
-	if cfg != nil {
-		return cfg
-	}
-
-	config := botSettings{}
-	err := b.lp.GetClient().GetAccountData(acBotSettingsKey, &config)
+	config, err := b.lp.GetAccountData(acBotSettingsKey)
 	if err != nil {
-		if strings.Contains(err.Error(), "M_NOT_FOUND") {
-			err = nil
-		} else {
-			b.log.Error("cannot get bot settings: %v", utils.UnwrapError(err))
-		}
+		b.log.Error("cannot get bot settings: %v", utils.UnwrapError(err))
 	}
-
-	if err == nil {
-		b.botcfg.Set(acBotSettingsKey, config)
+	if config == nil {
+		config = map[string]string{}
 	}
 
 	return config
 }
 
 func (b *Bot) setBotSettings(cfg botSettings) error {
-	b.botcfg.Set(acBotSettingsKey, cfg)
-	return utils.UnwrapError(b.lp.GetClient().SetAccountData(acBotSettingsKey, cfg))
+	return utils.UnwrapError(b.lp.SetAccountData(acBotSettingsKey, cfg))
 }

bot/settings_lists.go

@@ -0,0 +1,116 @@
+package bot
+
+import (
+	"net"
+	"sort"
+	"time"
+
+	"gitlab.com/etke.cc/postmoogle/utils"
+)
+
+// account data keys
+const (
+	acBanlistKey  = "cc.etke.postmoogle.banlist"
+	acGreylistKey = "cc.etke.postmoogle.greylist"
+)
+
+type bglist map[string]string
+
+// Slice returns slice of ban- or greylist items
+func (b bglist) Slice() []string {
+	slice := make([]string, 0, len(b))
+	for item := range b {
+		slice = append(slice, item)
+	}
+	sort.Strings(slice)
+
+	return slice
+}
+
+func (b bglist) getKey(addr net.Addr) string {
+	key := addr.String()
+	host, _, _ := net.SplitHostPort(key) //nolint:errcheck // either way it's ok
+	if host != "" {
+		key = host
+	}
+	return key
+}
+
+// Has addr in ban- or greylist
+func (b bglist) Has(addr net.Addr) bool {
+	_, ok := b[b.getKey(addr)]
+	return ok
+}
+
+// Get when addr was added in ban- or greylist
+func (b bglist) Get(addr net.Addr) (time.Time, bool) {
+	from := b[b.getKey(addr)]
+	if from == "" {
+		return time.Time{}, false
+	}
+	t, err := time.Parse(time.RFC1123Z, from)
+	if err != nil {
+		return time.Time{}, false
+	}
+
+	return t, true
+}
+
+// Add an addr to ban- or greylist
+func (b bglist) Add(addr net.Addr) {
+	key := b.getKey(addr)
+	if _, ok := b[key]; ok {
+		return
+	}
+
+	b[key] = time.Now().UTC().Format(time.RFC1123Z)
+}
+
+// Remove an addr from ban- or greylist
+func (b bglist) Remove(addr net.Addr) {
+	key := b.getKey(addr)
+	if _, ok := b[key]; !ok {
+		return
+	}
+
+	delete(b, key)
+}
+
+func (b *Bot) getBanlist() bglist {
+	config, err := b.lp.GetAccountData(acBanlistKey)
+	if err != nil {
+		b.log.Error("cannot get banlist: %v", utils.UnwrapError(err))
+	}
+	if config == nil {
+		config = make(bglist, 0)
+	}
+
+	return config
+}
+
+func (b *Bot) setBanlist(cfg bglist) error {
+	b.lock("banlist")
+	if cfg == nil {
+		cfg = make(bglist, 0)
+	}
+	b.banlist = cfg
+	defer b.unlock("banlist")
+
+	return utils.UnwrapError(b.lp.SetAccountData(acBanlistKey, cfg))
+}
+
+func (b *Bot) getGreylist() bglist {
+	config, err := b.lp.GetAccountData(acGreylistKey)
+	if err != nil {
+		b.log.Error("cannot get banlist: %v", utils.UnwrapError(err))
+	}
+	if config == nil {
+		config = make(bglist, 0)
+	}
+
+	return config
+}
+
+func (b *Bot) setGreylist(cfg bglist) error {
+	return utils.UnwrapError(b.lp.SetAccountData(acGreylistKey, cfg))
+}

bot/settings_room.go

@@ -1,7 +1,6 @@
 package bot
 
 import (
-	"strconv"
 	"strings"
 
 	"maunium.net/go/mautrix/id"
@@ -14,24 +13,24 @@ const acRoomSettingsKey = "cc.etke.postmoogle.settings"
 
 // option keys
 const (
-	roomOptionOwner     = "owner"
-	roomOptionMailbox   = "mailbox"
-	roomOptionNoSender  = "nosender"
-	roomOptionNoSubject = "nosubject"
-	roomOptionNoHTML    = "nohtml"
-	roomOptionNoThreads = "nothreads"
-	roomOptionNoFiles   = "nofiles"
+	roomOptionOwner         = "owner"
+	roomOptionMailbox       = "mailbox"
+	roomOptionDomain        = "domain"
+	roomOptionNoSend        = "nosend"
+	roomOptionNoSender      = "nosender"
+	roomOptionNoRecipient   = "norecipient"
+	roomOptionNoSubject     = "nosubject"
+	roomOptionNoHTML        = "nohtml"
+	roomOptionNoThreads     = "nothreads"
+	roomOptionNoFiles       = "nofiles"
+	roomOptionPassword      = "password"
+	roomOptionSpamcheckSMTP = "spamcheck:smtp"
+	roomOptionSpamcheckMX   = "spamcheck:mx"
+	roomOptionSpamlist      = "spamlist"
 )
 
 type roomSettings map[string]string
 
-// settingsOld of a room
-type settingsOld struct {
-	Mailbox  string
-	Owner    id.UserID
-	NoSender bool
-}
-
 // Get option
 func (s roomSettings) Get(key string) string {
 	return s[strings.ToLower(strings.TrimSpace(key))]
@@ -46,14 +45,30 @@ func (s roomSettings) Mailbox() string {
 	return s.Get(roomOptionMailbox)
 }
 
+func (s roomSettings) Domain() string {
+	return s.Get(roomOptionDomain)
+}
+
 func (s roomSettings) Owner() string {
 	return s.Get(roomOptionOwner)
 }
 
+func (s roomSettings) Password() string {
+	return s.Get(roomOptionPassword)
+}
+
+func (s roomSettings) NoSend() bool {
+	return utils.Bool(s.Get(roomOptionNoSend))
+}
+
 func (s roomSettings) NoSender() bool {
 	return utils.Bool(s.Get(roomOptionNoSender))
 }
 
+func (s roomSettings) NoRecipient() bool {
+	return utils.Bool(s.Get(roomOptionNoRecipient))
+}
+
 func (s roomSettings) NoSubject() bool {
 	return utils.Bool(s.Get(roomOptionNoSubject))
 }
@@ -70,52 +85,107 @@ func (s roomSettings) NoFiles() bool {
 	return utils.Bool(s.Get(roomOptionNoFiles))
 }
 
-// TODO: remove after migration
-func (b *Bot) migrateSettings(roomID id.RoomID) {
-	var config settingsOld
-	err := b.lp.GetClient().GetRoomAccountData(roomID, acRoomSettingsKey, &config)
-	if err != nil {
-		// any error = no need to migrate
-		return
+func (s roomSettings) SpamcheckSMTP() bool {
+	return utils.Bool(s.Get(roomOptionSpamcheckSMTP))
+}
+
+func (s roomSettings) SpamcheckMX() bool {
+	return utils.Bool(s.Get(roomOptionSpamcheckMX))
+}
+
+func (s roomSettings) Spamlist() []string {
+	return utils.StringSlice(s.Get(roomOptionSpamlist))
+}
+
+func (s roomSettings) migrateSpamlistSettings() {
+	uniq := map[string]struct{}{}
+	emails := utils.StringSlice(s.Get("spamlist:emails"))
+	localparts := utils.StringSlice(s.Get("spamlist:localparts"))
+	hosts := utils.StringSlice(s.Get("spamlist:hosts"))
+	list := utils.StringSlice(s.Get(roomOptionSpamlist))
+	delete(s, "spamlist:emails")
+	delete(s, "spamlist:localparts")
+	delete(s, "spamlist:hosts")
+
+	for _, email := range emails {
+		if email == "" {
+			continue
+		}
+		uniq[email] = struct{}{}
 	}
 
-	if config.Mailbox == "" {
-		return
+	for _, localpart := range localparts {
+		if localpart == "" {
+			continue
+		}
+		uniq[localpart+"@*"] = struct{}{}
 	}
-	cfg := roomSettings{}
-	cfg.Set(roomOptionMailbox, config.Mailbox)
-	cfg.Set(roomOptionOwner, config.Owner.String())
-	cfg.Set(roomOptionNoSender, strconv.FormatBool(config.NoSender))
 
-	err = b.setRoomSettings(roomID, cfg)
-	if err != nil {
-		b.log.Error("cannot migrate settings: %v", err)
+	for _, host := range hosts {
+		if host == "" {
+			continue
+		}
+		uniq["*@"+host] = struct{}{}
+	}
+
+	for _, item := range list {
+		if item == "" {
+			continue
+		}
+		uniq[item] = struct{}{}
+	}
+
+	spamlist := make([]string, 0, len(uniq))
+	for item := range uniq {
+		spamlist = append(spamlist, item)
+	}
+	s.Set(roomOptionSpamlist, strings.Join(spamlist, ","))
+}
+
+// ContentOptions converts room display settings to content options
+func (s roomSettings) ContentOptions() *utils.ContentOptions {
+	return &utils.ContentOptions{
+		HTML:      !s.NoHTML(),
+		Sender:    !s.NoSender(),
+		Recipient: !s.NoRecipient(),
+		Subject:   !s.NoSubject(),
+		Threads:   !s.NoThreads(),
+
+		ToKey:         eventToKey,
+		FromKey:       eventFromKey,
+		SubjectKey:    eventSubjectKey,
+		MessageIDKey:  eventMessageIDkey,
+		InReplyToKey:  eventInReplyToKey,
+		ReferencesKey: eventReferencesKey,
 	}
 }
 
 func (b *Bot) getRoomSettings(roomID id.RoomID) (roomSettings, error) {
-	cfg := b.cfg.Get(roomID.String())
-	if cfg != nil {
-		return cfg, nil
-	}
-
-	config := roomSettings{}
-	err := b.lp.GetClient().GetRoomAccountData(roomID, acRoomSettingsKey, &config)
-	if err != nil {
-		if strings.Contains(err.Error(), "M_NOT_FOUND") {
-			// Suppress `M_NOT_FOUND (HTTP 404): Room account data not found` errors.
-			// Until some settings are explicitly set, we don't store any.
-			// In such cases, just return a default (empty) settings object.
-			err = nil
-		}
-	} else {
-		b.cfg.Set(roomID.String(), config)
+	config, err := b.lp.GetRoomAccountData(roomID, acRoomSettingsKey)
+	if config == nil {
+		config = map[string]string{}
 	}
 
 	return config, utils.UnwrapError(err)
 }
 
 func (b *Bot) setRoomSettings(roomID id.RoomID, cfg roomSettings) error {
-	b.cfg.Set(roomID.String(), cfg)
-	return utils.UnwrapError(b.lp.GetClient().SetRoomAccountData(roomID, acRoomSettingsKey, cfg))
+	return utils.UnwrapError(b.lp.SetRoomAccountData(roomID, acRoomSettingsKey, cfg))
+}
+
+func (b *Bot) migrateRoomSettings(roomID id.RoomID) {
+	cfg, err := b.getRoomSettings(roomID)
+	if err != nil {
+		b.log.Error("cannot retrieve room settings: %v", err)
+		return
+	}
+
+	if cfg["spamlist:emails"] == "" && cfg["spamlist:localparts"] == "" && cfg["spamlist:hosts"] == "" {
+		return
+	}
+	cfg.migrateSpamlistSettings()
+	err = b.setRoomSettings(roomID, cfg)
+	if err != nil {
+		b.log.Error("cannot migrate room settings: %v", err)
+	}
 }

bot/sync.go

@@ -3,11 +3,14 @@ package bot
 import (
 	"context"
 
+	"gitlab.com/etke.cc/go/mxidwc"
 	"maunium.net/go/mautrix"
 	"maunium.net/go/mautrix/event"
 )
 
 func (b *Bot) initSync() {
+	b.lp.SetJoinPermit(b.joinPermit)
+
 	b.lp.OnEventType(
 		event.StateMember,
 		func(_ mautrix.EventSource, evt *event.Event) {
@@ -26,6 +29,16 @@ func (b *Bot) initSync() {
 		})
 }
 
+// joinPermit is called by linkpearl when processing "invite" events and deciding if rooms should be auto-joined or not
+func (b *Bot) joinPermit(evt *event.Event) bool {
+	if !mxidwc.Match(evt.Sender.String(), b.allowedUsers) {
+		b.log.Debug("Rejecting room invitation from unallowed user: %s", evt.Sender)
+		return false
+	}
+
+	return true
+}
+
 func (b *Bot) onMembership(evt *event.Event) {
 	ctx := newContext(evt)
 
@@ -56,6 +69,10 @@ func (b *Bot) onEncryptedMessage(evt *event.Event) {
 	if evt.Sender == b.lp.GetClient().UserID {
 		return
 	}
+	// ignore encrypted events in noecryption mode
+	if b.lp.GetMachine() == nil {
+		return
+	}
 	ctx := newContext(evt)
 
 	decrypted, err := b.lp.GetMachine().DecryptMegolmEvent(evt)

cmd/cmd.go

@@ -10,6 +10,7 @@ import (
 	"github.com/getsentry/sentry-go"
 	_ "github.com/lib/pq"
 	_ "github.com/mattn/go-sqlite3"
+	"github.com/mileusna/crontab"
 	"gitlab.com/etke.cc/go/logger"
 	"gitlab.com/etke.cc/linkpearl"
 	lpcfg "gitlab.com/etke.cc/linkpearl/config"
@@ -17,11 +18,14 @@ import (
 	"gitlab.com/etke.cc/postmoogle/bot"
 	"gitlab.com/etke.cc/postmoogle/config"
 	"gitlab.com/etke.cc/postmoogle/smtp"
+	"gitlab.com/etke.cc/postmoogle/utils"
 )
 
 var (
-	mxb *bot.Bot
-	log *logger.Logger
+	mxb   *bot.Bot
+	cron  *crontab.Crontab
+	smtpm *smtp.Manager
+	log   *logger.Logger
 )
 
 func main() {
@@ -29,6 +33,8 @@ func main() {
 
 	cfg := config.New()
 	log = logger.New("postmoogle.", cfg.LogLevel)
+	utils.SetLogger(log)
+	utils.SetDomains(cfg.Domains)
 
 	log.Info("#############################")
 	log.Info("Postmoogle")
@@ -38,11 +44,14 @@ func main() {
 	log.Debug("starting internal components...")
 	initSentry(cfg)
 	initBot(cfg)
+	initSMTP(cfg)
+	initCron()
 	initShutdown(quit)
 	defer recovery()
 
 	go startBot(cfg.StatusMsg)
-	if err := smtp.Start(cfg.Domain, cfg.Port, cfg.LogLevel, cfg.MaxSize, mxb); err != nil {
+
+	if err := smtpm.Start(); err != nil {
 		//nolint:gocritic
 		log.Fatal("SMTP server crashed: %v", err)
 	}
@@ -67,23 +76,29 @@ func initBot(cfg *config.Config) {
 	}
 	mxlog := logger.New("matrix.", cfg.LogLevel)
 	lp, err := linkpearl.New(&lpcfg.Config{
-		Homeserver:   cfg.Homeserver,
-		Login:        cfg.Login,
-		Password:     cfg.Password,
-		DB:           db,
-		Dialect:      cfg.DB.Dialect,
-		NoEncryption: cfg.NoEncryption,
+		Homeserver:        cfg.Homeserver,
+		Login:             cfg.Login,
+		Password:          cfg.Password,
+		DB:                db,
+		Dialect:           cfg.DB.Dialect,
+		NoEncryption:      cfg.NoEncryption,
+		AccountDataSecret: cfg.DataSecret,
+		AccountDataLogReplace: map[string]string{
+			"password": "<redacted>",
+			"dkim.pem": "<redacted>",
+			"dkim.pub": "<redacted>",
+		},
 		LPLogger:     mxlog,
-		APILogger:    logger.New("api.", cfg.LogLevel),
-		StoreLogger:  logger.New("store.", cfg.LogLevel),
-		CryptoLogger: logger.New("olm.", cfg.LogLevel),
+		APILogger:    logger.New("api.", "INFO"),
+		StoreLogger:  logger.New("store.", "INFO"),
+		CryptoLogger: logger.New("olm.", "INFO"),
 	})
 	if err != nil {
 		// nolint // Fatal = panic, not os.Exit()
 		log.Fatal("cannot initialize matrix bot: %v", err)
 	}
 
-	mxb, err = bot.New(lp, mxlog, cfg.Prefix, cfg.Domain, cfg.Users, cfg.Admins)
+	mxb, err = bot.New(lp, mxlog, cfg.Prefix, cfg.Domains, cfg.Admins)
 	if err != nil {
 		// nolint // Fatal = panic, not os.Exit()
 		log.Fatal("cannot start matrix bot: %v", err)
@@ -91,6 +106,29 @@ func initBot(cfg *config.Config) {
 	log.Debug("bot has been created")
 }
 
+func initSMTP(cfg *config.Config) {
+	smtpm = smtp.NewManager(&smtp.Config{
+		Domains:     cfg.Domains,
+		Port:        cfg.Port,
+		TLSCerts:    cfg.TLS.Certs,
+		TLSKeys:     cfg.TLS.Keys,
+		TLSPort:     cfg.TLS.Port,
+		TLSRequired: cfg.TLS.Required,
+		LogLevel:    cfg.LogLevel,
+		MaxSize:     cfg.MaxSize,
+		Bot:         mxb,
+	})
+}
+
+func initCron() {
+	cron = crontab.New()
+
+	err := cron.AddJob("* * * * *", mxb.ProcessQueue)
+	if err != nil {
+		log.Error("cannot start ProcessQueue cronjob: %v", err)
+	}
+}
+
 func initShutdown(quit chan struct{}) {
 	listener := make(chan os.Signal, 1)
 	signal.Notify(listener, os.Interrupt, syscall.SIGABRT, syscall.SIGHUP, syscall.SIGINT, syscall.SIGQUIT, syscall.SIGTERM)
@@ -114,6 +152,8 @@ func startBot(statusMsg string) {
 
 func shutdown() {
 	log.Info("Shutting down...")
+	cron.Shutdown()
+	smtpm.Stop()
 	mxb.Stop()
 
 	sentry.Flush(5 * time.Second)

config/config.go

@@ -15,13 +15,19 @@ func New() *Config {
 		Login:        env.String("login", defaultConfig.Login),
 		Password:     env.String("password", defaultConfig.Password),
 		Prefix:       env.String("prefix", defaultConfig.Prefix),
-		Domain:       env.String("domain", defaultConfig.Domain),
+		Domains:      migrateDomains("domain", "domains"),
 		Port:         env.String("port", defaultConfig.Port),
 		NoEncryption: env.Bool("noencryption"),
+		DataSecret:   env.String("data.secret", defaultConfig.DataSecret),
 		MaxSize:      env.Int("maxsize", defaultConfig.MaxSize),
 		StatusMsg:    env.String("statusmsg", defaultConfig.StatusMsg),
-		Users:        env.Slice("users"),
 		Admins:       env.Slice("admins"),
+		TLS: TLS{
+			Certs:    env.Slice("tls.cert"),
+			Keys:     env.Slice("tls.key"),
+			Required: env.Bool("tls.required"),
+			Port:     env.String("tls.port", defaultConfig.TLS.Port),
+		},
 		Sentry: Sentry{
 			DSN: env.String("sentry.dsn", defaultConfig.Sentry.DSN),
 		},
@@ -34,3 +40,13 @@ func New() *Config {
 
 	return cfg
 }
+
+func migrateDomains(oldKey, newKey string) []string {
+	domains := []string{}
+	old := env.String(oldKey, "")
+	if old != "" {
+		domains = append(domains, old)
+	}
+
+	return append(domains, env.Slice(newKey)...)
+}

config/defaults.go

@@ -2,7 +2,7 @@ package config
 
 var defaultConfig = &Config{
 	LogLevel:  "INFO",
-	Domain:    "localhost",
+	Domains:   []string{"localhost"},
 	Port:      "25",
 	Prefix:    "!pm",
 	MaxSize:   1024,
@@ -11,4 +11,7 @@ var defaultConfig = &Config{
 		DSN:     "local.db",
 		Dialect: "sqlite3",
 	},
+	TLS: TLS{
+		Port: "587",
+	},
 }

config/types.go

@@ -8,12 +8,14 @@ type Config struct {
 	Login string
 	// Password for login/password auth only
 	Password string
-	// Domain for SMTP
-	Domain string
+	// Domains for SMTP
+	Domains []string
 	// Port for SMTP
 	Port string
 	// RoomID of the admin room
 	LogLevel string
+	// DataSecret is account data secret key (password) to encrypt all account data values
+	DataSecret string
 	// NoEncryption disabled encryption support
 	NoEncryption bool
 	// Prefix for commands
@@ -22,14 +24,15 @@ type Config struct {
 	MaxSize int
 	// StatusMsg of the bot
 	StatusMsg string
-	// Users DEPRECATED holds list of allowed users (wildcards supported), e.g.: @*:example.com, @bot.*:example.com, @admin:*. Empty = homeserver only
-	Users []string
 	// Admins holds list of admin users (wildcards supported), e.g.: @*:example.com, @bot.*:example.com, @admin:*. Empty = no admins
 	Admins []string
 
 	// DB config
 	DB DB
 
+	// TLS config
+	TLS TLS
+
 	// Sentry config
 	Sentry Sentry
 }
@@ -42,6 +45,14 @@ type DB struct {
 	Dialect string
 }
 
+// TLS config
+type TLS struct {
+	Certs    []string
+	Keys     []string
+	Port     string
+	Required bool
+}
+
 // Sentry config
 type Sentry struct {
 	DSN string

docs/dns.md

@@ -0,0 +1,159 @@
+# DNS configuration
+
+the following configuration is required only if you want to send emails from Postmoogle
+
+# MX
+
+Add a new MX DNS record of the `MX` type for your domain that will be used with postmoogle.
+It should point to the same (sub-)domain.
+Looks odd, but some mail servers will refuse to interact with your mail server 
+(and Postmoogle is already a mail server) without MX records.
+
+<details>
+<summary>Example</summary>
+
+```bash
+dig MX example.com
+
+; <<>> DiG 9.18.6 <<>> MX example.com
+;; global options: +cmd
+;; Got answer:
+;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12688
+;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
+
+;; OPT PSEUDOSECTION:
+; EDNS: version: 0, flags:; udp: 1232
+;; QUESTION SECTION:
+;example.com.			IN	MX
+
+;; ANSWER SECTION:
+example.com.		1799	IN	MX	10 example.com.
+
+;; Query time: 40 msec
+;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
+;; WHEN: Tue Sep 06 16:44:47 EEST 2022
+;; MSG SIZE  rcvd: 59
+```
+
+</details>
+
+# SPF
+
+Aadd a new SPF DNS record of the `TXT` type for your domain that will be used with Postmoogle, 
+with format: `v=spf1 ip4:SERVER_IP4 -all` (replace `SERVER_IP4` with your server's IP address),
+for servers with IPv6: `v=spf1 ip6:SERVER_IP6 -all` (you may use both `ip4` and `ip6` in one TXT record).
+
+<details>
+<summary>Example</summary>
+
+```bash
+$ dig txt example.com
+
+; <<>> DiG 9.18.6 <<>> txt example.com
+;; global options: +cmd
+;; Got answer:
+;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24796
+;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1
+
+;; OPT PSEUDOSECTION:
+; EDNS: version: 0, flags:; udp: 1232
+;; QUESTION SECTION:
+;example.com.			IN	TXT
+
+;; ANSWER SECTION:
+example.com.		1799	IN	TXT	"v=spf1 ip4:111.111.111.111 -all"
+
+;; Query time: 36 msec
+;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
+;; WHEN: Sun Sep 04 21:35:04 EEST 2022
+;; MSG SIZE  rcvd: 255
+```
+
+</details>
+
+# DMARC
+
+Add a new DMARC DNS record of the `TXT` type for subdomain `_dmarc` with a proper policy.
+The simplest policy you can use is: `v=DMARC1; p=quarantine;`.
+
+<details>
+<summary>Example</summary>
+
+```bash
+$ dig txt _dmarc.example.com
+
+; <<>> DiG 9.18.6 <<>> txt _dmarc.example.com
+;; global options: +cmd
+;; Got answer:
+;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57306
+;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
+
+;; OPT PSEUDOSECTION:
+; EDNS: version: 0, flags:; udp: 1232
+;; QUESTION SECTION:
+;_dmarc.example.com.			IN	TXT
+
+;; ANSWER SECTION:
+_dmarc.example.com.		1799	IN	TXT	"v=DMARC1; p=quarantine;"
+
+;; Query time: 46 msec
+;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
+;; WHEN: Sun Sep 04 21:31:30 EEST 2022
+;; MSG SIZE  rcvd: 79
+```
+
+</details>
+
+# DKIM
+
+Add new DKIM DNS record of `TXT` type for subdomain `postmoogle._domainkey` that will be used with postmoogle.
+You can get that signature using the `!pm dkim` command:
+
+<details>
+<summary>!pm dkim</summary>
+
+DKIM signature is: `v=DKIM1; k=rsa; p=MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAxJVqmBHhK9FY93q1o3WEaP2GKMh/3LNMyvi1uSjOKxIyfWv685KxX1EUrbHakQRCTtUM7efKEsXsXBh+DQru2TE32yFpL9afA5BbHj3KePGFY8KJ2m0sQxbQcvn2KjJC0IQ15mk0rninPhtphU/2zLsd6e7Rl1m3L+9Osk320GbfDgSKjRPcSiwVMbLJpSOP0H0F3cIu+c1fHZHfmWy0O+us42C3HTLTlD779LTnQnKlAOQD/+DYYqz6TGGxEwUG2BRQ8O8w7/wXEkg/6a/MxNtPnc59g29CpqRsDkuYiR3UIpqzLDoqHlaoKNbYy34R+4aIjfNpmZyR5kIumws+3MJtJt9UhBTMloqd8lZDPaPmX2NEDqbcSTkHMQrphk+EWSCc7OvbKRaXZ0SyJLpLjxRwKrpeO0JAI0ZpnAFS11uBEe9GSS8uzIIFNYVD1vHloAFKvUJEhyuVyz9/SyqTnArN3ZTiC5cqD1MB86q5QPrKqZfp1dAnv7xAJThL0AP/AgMBAAE=`.
+You need to add it to your DNS records (if not already):
+Add new DNS record with type = `TXT`, key (subdomain/from): `postmoogle._domainkey` and value (to):
+
+```
+v=DKIM1; k=rsa; p=MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAxJVqmBHhK9FY93q1o3WEaP2GKMh/3LNMyvi1uSjOKxIyfWv685KxX1EUrbHakQRCTtUM7efKEsXsXBh+DQru2TE32yFpL9afA5BbHj3KePGFY8KJ2m0sQxbQcvn2KjJC0IQ15mk0rninPhtphU/2zLsd6e7Rl1m3L+9Osk320GbfDgSKjRPcSiwVMbLJpSOP0H0F3cIu+c1fHZHfmWy0O+us42C3HTLTlD779LTnQnKlAOQD/+DYYqz6TGGxEwUG2BRQ8O8w7/wXEkg/6a/MxNtPnc59g29CpqRsDkuYiR3UIpqzLDoqHlaoKNbYy34R+4aIjfNpmZyR5kIumws+3MJtJt9UhBTMloqd8lZDPaPmX2NEDqbcSTkHMQrphk+EWSCc7OvbKRaXZ0SyJLpLjxRwKrpeO0JAI0ZpnAFS11uBEe9GSS8uzIIFNYVD1vHloAFKvUJEhyuVyz9/SyqTnArN3ZTiC5cqD1MB86q5QPrKqZfp1dAnv7xAJThL0AP/AgMBAAE=
+```
+
+Without that record other email servers may reject your emails as spam, kupo.
+
+</details>
+
+<details>
+<summary>Example</summary>
+
+```bash
+$ dig TXT postmoogle._domainkey.example.com
+
+; <<>> DiG 9.18.6 <<>> TXT postmoogle._domainkey.example.com
+;; global options: +cmd
+;; Got answer:
+;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59014
+;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
+
+;; OPT PSEUDOSECTION:
+; EDNS: version: 0, flags:; udp: 1232
+;; QUESTION SECTION:
+;postmoogle._domainkey.example.com.	IN	TXT
+
+;; ANSWER SECTION:
+postmoogle._domainkey.example.com. 600	IN TXT  "v=DKIM1; k=rsa; p=MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAxJVqmBHhK9FY93q1o3WEaP2GKMh/3LNMyvi1uSjOKxIyfWv685KxX1EUrbHakQRCTtUM7efKEsXsXBh+DQru2TE32yFpL9afA5BbHj3KePGFY8KJ2m0sQxbQcvn2KjJC0IQ15mk0rninPhtphU/2zLsd6e7Rl1m3L+9Osk320GbfDgSKjRPcSiwVMbLJpSOP0H0F3cIu+c1fHZHfmWy0O+us42C3HTLTlD779LTnQnKlAOQD/+DYYqz6TGGxEwUG2BRQ8O8w7/wXEkg/6a/MxNtPnc59g29CpqRsDkuYiR3UIpqzLDoqHlaoKNbYy34R+4aIjfNpmZyR5kIumws+3MJtJt9UhBTMloqd8lZDPaPmX2NEDqbcSTkHMQrphk+EWSCc7OvbKRaXZ0SyJLpLjxRwKrpeO0JAI0ZpnAFS11uBEe9GSS8uzIIFNYVD1vHloAFKvUJEhyuVyz9/SyqTnArN3ZTiC5cqD1MB86q5QPrKqZfp1dAnv7xAJThL0AP/AgMBAAE="
+
+;; Query time: 90 msec
+;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
+;; WHEN: Mon Sep 05 16:16:21 EEST 2022
+;; MSG SIZE  rcvd: 525
+```
+
+</details>
+
+# rDNS
+
+> additional PTR record will help you to get better spam score
+
+Configure Reverse DNS of your server. Unfortunately, rDNS is provider-specific, so you have to find out how to configure it with your hosting provider. Search for something like: `PROVIDER configure "rdns"` (where `PROVIDER` is your hosting provider name)

e2e/cert.pem

@@ -0,0 +1,31 @@
+-----BEGIN CERTIFICATE-----
+MIIFWTCCA0GgAwIBAgIUfzdKDYiYN1Q1oZ6sNbI5TahmQZwwDQYJKoZIhvcNAQEL
+BQAwOzELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxFzAVBgNVBAoM
+DlBvc3Rtb29nbGUgRGV2MCAXDTIyMDkxMzE0Mzc1MFoYDzIwNTEwMTI5MTQzNzUw
+WjA7MQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEXMBUGA1UECgwO
+UG9zdG1vb2dsZSBEZXYwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDa
+RwXjxG2MYhx1XETSdCBqqDat4ilhApW9impk3M6piRmeEkwTIENpYks9YVjItE9m
+3OnhNDptnIrzGWUIO77xEITcFGwsqkmg3lYOdZHxCfEup9dqFwdY9jeGGQxZkLFw
+nWGcaXHW+qtCBD3shmquC2xftKGUnCrX81jrpvHj4JeY03ENbvolTjLyhgQcj8Fh
+KXsXBWGKOSoU/FIZjy/lhZp5sEdJz25XeT7ktbPTglZTFKL+CkSVdXnVpb1Hys2m
+aiYCFr62g4wZjRdGFYHCva/55LXydFoC+VtjYJ7ifnXkV6c0iSh+vj1k+QrV+/cJ
+A/kTPI2rIWFicYt09AFKf1//BjXsRfBF6DF8tj2RmZPxQfDBRvTQkhNm9FkmfNeF
+KSNsRiRTb7gILs8y2R4BBMdFMQtw6JIfVueMlBAmKGkyVcSeQFY7+bS/BycxLx/Z
+hFN5u3czE+rhS9Nb76ZV9AW1UpsE/8jnWk9B0lVBMz2e8xL0leq4tMDsN+zt+Esr
+IYGD1lKO/iLPWPNRIKQrnb3hyS2an7LeG+VdKaYT1/EyN+qY24EF7XoeOXeHJ+tl
+kPBtYrIZAMu111IyzI7A36IP6VYB9b0wPnnLBgpJAW3A3jW5W9tuMBDxHATuDHfA
+UoVZh7oagPeyIYaAtzJB/7BBfYrrb190VU0FT6SyYQIDAQABo1MwUTAdBgNVHQ4E
+FgQU1yjkuZAaJcrH1JMAY6iFqxoPDR8wHwYDVR0jBBgwFoAU1yjkuZAaJcrH1JMA
+Y6iFqxoPDR8wDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEAJkus
+0wHrehTe0MKditkK/gb5+YGJqywZdhhwVZdK1JlbVAch/TpMn+3tD4GtToG/pN9h
+Id/jaLWl0y5/iytmupdOjcE1yLTlb9McUgBMHNbZ/QNFoTGlaeqIGTFK8QddAtYi
+VaGjDqBSKsAA/Ro1k98I7PWN6wb3nfkJO4/cDixErOSz7IBcdF7WiITnlpmdl8R7
+Xe2yfW6SVCbhNOsyKRUxz7hYgbak0OE1W4J6DTCdeX8Er7fMAmCjfrBQB8vQLs/Y
+5+PJMk6aTq31e7SQoOUe6HCGutnB7UOUjzynkHWeojGv1WwPxT8x53L263FZhdVJ
+vMfJNy1yie/qf90H7UG0LaPDF5CsLSV5iQY7pGXS/Qt1KV8OWsJpB2ZYZpQ24lwX
+X5KTQEB/YM0oCaLg50FgmuqGWqj2O7l5ey69Qz7+WnsT8NuTC/uYmuTnZqndn7IO
+5kWIX1uFWqqLMjirTAJQkecUIJEW324VYD8Ja0ylT8RReyR+ovZyMTS05pjbn5p4
+nA5Rni6hGWqj7HYxp4vI5zA8PyTwtn7Ls9zXSva4GIfXQyJd73VM8bZUl7R4lGoN
+GjdZArhEo+FPMDtFDYB8i+pBx8zZ0p6EVHWFJsuoiIwY5V9QNew2WusvuXTVSMzk
+kwoU0mIWLJVQtTelX1zvQVvs4PZa+iAzkniEjb0=
+-----END CERTIFICATE-----

e2e/key.pem

@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDaRwXjxG2MYhx1
+XETSdCBqqDat4ilhApW9impk3M6piRmeEkwTIENpYks9YVjItE9m3OnhNDptnIrz
+GWUIO77xEITcFGwsqkmg3lYOdZHxCfEup9dqFwdY9jeGGQxZkLFwnWGcaXHW+qtC
+BD3shmquC2xftKGUnCrX81jrpvHj4JeY03ENbvolTjLyhgQcj8FhKXsXBWGKOSoU
+/FIZjy/lhZp5sEdJz25XeT7ktbPTglZTFKL+CkSVdXnVpb1Hys2maiYCFr62g4wZ
+jRdGFYHCva/55LXydFoC+VtjYJ7ifnXkV6c0iSh+vj1k+QrV+/cJA/kTPI2rIWFi
+cYt09AFKf1//BjXsRfBF6DF8tj2RmZPxQfDBRvTQkhNm9FkmfNeFKSNsRiRTb7gI
+Ls8y2R4BBMdFMQtw6JIfVueMlBAmKGkyVcSeQFY7+bS/BycxLx/ZhFN5u3czE+rh
+S9Nb76ZV9AW1UpsE/8jnWk9B0lVBMz2e8xL0leq4tMDsN+zt+EsrIYGD1lKO/iLP
+WPNRIKQrnb3hyS2an7LeG+VdKaYT1/EyN+qY24EF7XoeOXeHJ+tlkPBtYrIZAMu1
+11IyzI7A36IP6VYB9b0wPnnLBgpJAW3A3jW5W9tuMBDxHATuDHfAUoVZh7oagPey
+IYaAtzJB/7BBfYrrb190VU0FT6SyYQIDAQABAoICAFbGgXrpLjvvDS1C/0FDVVfR
+g9tg295rLqhpjJ6Igcg4buy+jWvVGbedkhfWyXsQ47ga/we+wbOt1jeK0vWQ+vnO
+/WKY4+Bl2luPyFp7NwfCUhWgOC0+9nbRe4VeE+DPexswFgweh1lV0huuoAeV8Hc8
+p1rs7oesBgRQA/u7JNLZCKuC86DJi7yk9/Aegyfvpos/+GVQiFRxIV+yZ9ktaXcv
+xBe4kr6vLkisNOqrqc/eMv9YZuvjnRxl1YewGi2eXF9aN74A2NSqO1o1ExmTl0Ca
+NIl9+S9oPhiMlV5OnRuh9rBOgHSMSoMIklPABiTHxI/a+nxBSHjODm8agLx//Lqr
+Deqhl9yOB1IvEODT/4GJVLwGLZCFS+dD390p3a2+NBHAKM922IXexWxJkdxiEwC3
+3gicHvfGwU1eNPkbMJqb3QyJto+is9be1F3npLyffVwczJHeH5wLUOPexPNe4aRd
+Ag+++tnVf36luX7mzwME35vqOoDmdcrwmxDK3IsnOnMCZZbEiOQ3oqQwWoGK7OiL
+6adzoYTypdkdiozJVTz0xLxvZuUdwUydZswUVJeClEgyNk3c5Ln+jIjUwSMf9IqS
+HiiZOT9fYxgctMQ4mWeutABV0XvMaq3B2kJuyGdln5firAMDwzmvR4LeS0EW+lKa
+OxQQAqfBsqcBmc6G8GV5AoIBAQD1j7FEk2IeOqRaGbtH25VI4BkTw8KTuzK+5iHK
+Hjs5F8MPf2IbrjmpHTlANyLJ+IToc5LPDvy4TJRFOQKqge0BiZpS7ggp956y9Oyn
+1vtMkzHUrjHyjU9JzDMDe1+OrAGa/YwPWVZnjvBijS0OWmlYrnto5ZsN5XX9yJ2w
+7CZZPbXAbC9udtD9nc6fVXL3TB9Go/Wury8uwuAfah6ID9Jz6ta5kvhu1GdH7vKx
+zIXL8GS6qYPCPh8fimM02XlfONTEnFA2L6CW2eAKCs2GoF1kW8gWYMWErkGsR/40
+hBqNHBPphTuG7sypPpsHkmKE3tz+A0W5K+E6S9qlrMCF40wzAoIBAQDjjmpVoB7/
+IWDMsSf71LcxVgjZIM3bkL7misgL61WUk9Zq5Om5gTJd44w5nzdh56dGxEuQi3Br
+Du43NnmPiPBgtgvtgWxQx2uDIE2qaj8AQz2vNOMQaTDGZYNE0Wk65yg0Qn/CI/D5
+VL+O6n+CbF8duMXIuUbkakFp76BvfJqLAw9/YUp7AJTTtKjQbNum1X0mwbF9eAb7
+KIMciUrQ92jZ0aPobXlZ2BXOcbTxF3alxh0NPMCGEy8LV+2X+l3NFLuthGVKEyzL
+8vr/dtJykLqzLmW16VW5wOR3mdJe79DnOeW7IAPAPJSpZIdGJgnvAWmjjFbmZoyN
+XeBFjxeQDLMbAoIBAAXYXcfcGkHN84uRgTu8plkNvIsT5dXOZu7UW4mMHqzFPAdq
+aNNv2j+ESpCUv2c/WyqNVblICgv5Bq5/JOkaHqIivGGs+NTG6CgqXFfCbkjsWAtP
++jBj3LdM/QngLe4fegpObr8OyVe9t0shQSlOTaOmw5lDneU+yQg5dkd315HYPjNO
+X/KpMWBYGUsBpbLtRPFRhc+aq+zZBqy4wfFLLx9DP8k7Dl7U/4Be17gTvjuUhVFM
+J66/+82sZaAkbRcvKyFi9yXTDGeK2CJlD29c8dwpsyGVPB5kZ3vKWuq1GkyxlmfA
+nCIiHQ0KSHZtrZqsE2aYfVhjCwFwPMwkyJBnULECggEBAI8vj+1tIdP8FsL2PmiS
+AuvCbTLjF2WvgM/kR9hoLqOdGvCMNh2KFD1L73Jaoyix8WnwHnRHqWdUL8UCPB97
+VXYlVwANzjBOK3KJIxW2YQozRV838iDjb9OHEMB+3K45weyQY3+vyfO5xgeRusZA
+luFG4P1ayCb2TU7xf4xnZX9PX7MRbyJSzVMhfJAZz2T9NRDsFFkU65+icE3GfhNb
+etiEt5SLPi6wb5hFqEuELh5FuQYZUjOLYrDKlTBqVBe1khqvEmU4B5oVvKZ/CBEa
+zL/u1AVRW6XUoG45lkwyrsqwfcPvcyzFce3c2dnkGaAQzX4h0pSLtqlFhtd+IJ99
+vj0CggEBAJfdlbH2dlJB16DiVKFucnIdX4y+h4uv2ZlsVM7XUunsvnbN+PL7QYqD
+zgmVAV9/EKVJGxoFRiGe5rDTXP68PAELGDcetCPQGdYCVKYVlvOjjGDSvZwH+Ca1
+9Jig9gmW2ezdGkqqU4cptVdrmN07R+HNEp9ZnaSUVcLywA1jeCkRrsO55s7++VNC
+nHDfkEWwpRXMbcdFXnEC6IomOBxtY9LDCmWTJmWXhJqgPr9WDSMB37xlfxNUttap
+Ozzugp4UCywam1MgsJB5mueGN4ExfTQ5mnJw8TNmtuxaWeea+Lu7lwQrwwia30nL
+G9eNyx0/usGECLor9sfMmhy55arHNv8=
+-----END PRIVATE KEY-----

e2e/send-stress

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-for i in {0..10..1}; do
+for i in {0..100..1}; do
 	echo "#${i}..."
 	ssmtp test@localhost < $1
 done

go.mod

@@ -2,44 +2,55 @@ module gitlab.com/etke.cc/postmoogle
 
 go 1.18
 
+// replace gitlab.com/etke.cc/linkpearl => ../linkpearl
+
 require (
-	git.sr.ht/~xn/cache/v2 v2.0.0
+	github.com/emersion/go-msgauth v0.6.6
+	github.com/emersion/go-sasl v0.0.0-20200509203442-7bfe0ed36a21
 	github.com/emersion/go-smtp v0.15.0
+	github.com/gabriel-vasile/mimetype v1.4.1
 	github.com/getsentry/sentry-go v0.13.0
 	github.com/jhillyerd/enmime v0.10.0
-	github.com/lib/pq v1.10.6
-	github.com/mattn/go-sqlite3 v1.14.14
+	github.com/lib/pq v1.10.7
+	github.com/mattn/go-sqlite3 v1.14.16
+	github.com/mileusna/crontab v1.2.0
+	github.com/raja/argon2pw v1.0.2-0.20210910183755-a391af63bd39
 	gitlab.com/etke.cc/go/env v1.0.0
 	gitlab.com/etke.cc/go/logger v1.1.0
-	gitlab.com/etke.cc/linkpearl v0.0.0-20220826133247-10dcaedb8085
-	golang.org/x/net v0.0.0-20220822230855-b0a4917ee28c
-	maunium.net/go/mautrix v0.12.0
+	gitlab.com/etke.cc/go/mxidwc v1.0.0
+	gitlab.com/etke.cc/go/secgen v1.1.1
+	gitlab.com/etke.cc/go/trysmtp v1.0.0
+	gitlab.com/etke.cc/go/validator v1.0.4
+	gitlab.com/etke.cc/linkpearl v0.0.0-20221116205701-65547c5608e6
+	golang.org/x/net v0.2.0
+	maunium.net/go/mautrix v0.12.3
 )
 
 require (
 	github.com/cention-sany/utf7 v0.0.0-20170124080048-26cad61bd60a // indirect
-	github.com/emersion/go-sasl v0.0.0-20200509203442-7bfe0ed36a21 // indirect
 	github.com/gogs/chardet v0.0.0-20191104214054-4b6791f73a28 // indirect
 	github.com/google/go-cmp v0.5.8 // indirect
 	github.com/gorilla/mux v1.8.0 // indirect
 	github.com/gorilla/websocket v1.5.0 // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.1 // indirect
 	github.com/jaytaylor/html2text v0.0.0-20200412013138-3577fbdbcff7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.16 // indirect
 	github.com/mattn/go-runewidth v0.0.12 // indirect
+	github.com/mikesmitty/edkey v0.0.0-20170222072505-3356ea4e686a // indirect
 	github.com/olekukonko/tablewriter v0.0.5 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/rivo/uniseg v0.2.0 // indirect
-	github.com/rs/zerolog v1.27.0 // indirect
+	github.com/rs/zerolog v1.28.0 // indirect
 	github.com/ssor/bom v0.0.0-20170718123548-6386211fdfcf // indirect
 	github.com/tidwall/gjson v1.14.3 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
-	github.com/tidwall/pretty v1.2.0 // indirect
+	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tidwall/sjson v1.2.5 // indirect
-	github.com/yuin/goldmark v1.4.12 // indirect
-	golang.org/x/crypto v0.0.0-20220824171710-5757bc0c5503 // indirect
-	golang.org/x/sys v0.0.0-20220825204002-c680a09ffe64 // indirect
-	golang.org/x/text v0.3.7 // indirect
+	github.com/yuin/goldmark v1.5.3 // indirect
+	golang.org/x/crypto v0.3.0 // indirect
+	golang.org/x/sys v0.2.0 // indirect
+	golang.org/x/text v0.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	maunium.net/go/maulogger/v2 v2.3.2 // indirect
 )

go.sum

@@ -1,15 +1,23 @@
-git.sr.ht/~xn/cache/v2 v2.0.0 h1:aYzwGDyVIzjCl2yqcxZjprnu++Q3BmUQeK2agqvcQt8=
-git.sr.ht/~xn/cache/v2 v2.0.0/go.mod h1:HIPSMiDudQ483tRDup586e0YZdwMySIZFWXMPwYMuV8=
 github.com/DATA-DOG/go-sqlmock v1.5.0 h1:Shsta01QNfFxHCfpW6YH2STWB0MudeXXEWMr20OEh60=
 github.com/cention-sany/utf7 v0.0.0-20170124080048-26cad61bd60a h1:MISbI8sU/PSK/ztvmWKFcI7UGb5/HQT7B+i3a2myKgI=
 github.com/cention-sany/utf7 v0.0.0-20170124080048-26cad61bd60a/go.mod h1:2GxOXOlEPAMFPfp014mK1SWq8G8BN8o7/dfYqJrVGn8=
 github.com/coreos/go-systemd/v22 v22.3.3-0.20220203105225-a9a7ef127534/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/emersion/go-message v0.11.2/go.mod h1:C4jnca5HOTo4bGN9YdqNQM9sITuT3Y0K6bSUw9RklvY=
+github.com/emersion/go-message v0.15.0/go.mod h1:wQUEfE+38+7EW8p8aZ96ptg6bAb1iwdgej19uXASlE4=
+github.com/emersion/go-milter v0.3.3/go.mod h1:ablHK0pbLB83kMFBznp/Rj8aV+Kc3jw8cxzzmCNLIOY=
+github.com/emersion/go-msgauth v0.6.6 h1:buv5lL8v/3v4RpHnQFS2IPhE3nxSRX+AxnrEJbDbHhA=
+github.com/emersion/go-msgauth v0.6.6/go.mod h1:A+/zaz9bzukLM6tRWRgJ3BdrBi+TFKTvQ3fGMFOI9SM=
 github.com/emersion/go-sasl v0.0.0-20200509203442-7bfe0ed36a21 h1:OJyUGMJTzHTd1XQp98QTaHernxMYzRaOasRir9hUlFQ=
 github.com/emersion/go-sasl v0.0.0-20200509203442-7bfe0ed36a21/go.mod h1:iL2twTeMvZnrg54ZoPDNfJaJaqy0xIQFuBdrLsmspwQ=
 github.com/emersion/go-smtp v0.15.0 h1:3+hMGMGrqP/lqd7qoxZc1hTU8LY8gHV9RFGWlqSDmP8=
 github.com/emersion/go-smtp v0.15.0/go.mod h1:qm27SGYgoIPRot6ubfQ/GpiPy/g3PaZAVRxiO/sDUgQ=
+github.com/emersion/go-textwrapper v0.0.0-20160606182133-d0e65e56babe/go.mod h1:aqO8z8wPrjkscevZJFVE1wXJrLpC5LtJG7fqLOsPb2U=
+github.com/emersion/go-textwrapper v0.0.0-20200911093747-65d896831594/go.mod h1:aqO8z8wPrjkscevZJFVE1wXJrLpC5LtJG7fqLOsPb2U=
+github.com/gabriel-vasile/mimetype v1.4.1 h1:TRWk7se+TOjCYgRth7+1/OYLNiRNIotknkFtf/dnN7Q=
+github.com/gabriel-vasile/mimetype v1.4.1/go.mod h1:05Vi0w3Y9c/lNvJOdmIwvrrAhX3rYhfQQCaf9VJcv7M=
 github.com/getsentry/sentry-go v0.13.0 h1:20dgTiUSfxRB/EhMPtxcL9ZEbM1ZdR+W/7f7NWD+xWo=
 github.com/getsentry/sentry-go v0.13.0/go.mod h1:EOsfu5ZdvKPfeHYV6pTVQnsjfp30+XA7//UooKNumH0=
 github.com/go-errors/errors v1.0.1 h1:LUHzmkK3GUKUrL/1gfBUxAHzcev3apQlezX/+O7ma6w=
@@ -24,12 +32,15 @@ github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
 github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
 github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc=
 github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/hashicorp/golang-lru/v2 v2.0.1 h1:5pv5N1lT1fjLg2VQ5KWc7kmucp2x/kvFOnxuVTqZ6x4=
+github.com/hashicorp/golang-lru/v2 v2.0.1/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/jaytaylor/html2text v0.0.0-20200412013138-3577fbdbcff7 h1:g0fAGBisHaEQ0TRq1iBvemFRf+8AEWEmBESSiWB3Vsc=
 github.com/jaytaylor/html2text v0.0.0-20200412013138-3577fbdbcff7/go.mod h1:CVKlgaMiht+LXvHG173ujK6JUhZXKb2u/BQtjPDIvyk=
 github.com/jhillyerd/enmime v0.10.0 h1:DZEzhptPRBesvN3gf7K1BOh4rfpqdsdrEoxW1Edr/3s=
 github.com/jhillyerd/enmime v0.10.0/go.mod h1:Qpe8EEemJMFAF8+NZoWdpXvK2Yb9dRF0k/z6mkcDHsA=
-github.com/lib/pq v1.10.6 h1:jbk+ZieJ0D7EVGJYpL9QTz7/YW6UHbmdnZWYyK5cdBs=
-github.com/lib/pq v1.10.6/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/lib/pq v1.10.7 h1:p7ZhMD+KsSRozJr34udlUrhboJwWAgCg34+/ZZNvZZw=
+github.com/lib/pq v1.10.7/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/martinlindhe/base36 v1.0.0/go.mod h1:+AtEs8xrBpCeYgSLoY/aJ6Wf37jtBuR0s35750M27+8=
 github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
@@ -39,8 +50,12 @@ github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/mattn/go-runewidth v0.0.12 h1:Y41i/hVW3Pgwr8gV+J23B9YEY0zxjptBuCWEaxmAOow=
 github.com/mattn/go-runewidth v0.0.12/go.mod h1:RAqKPSqVFrSLVXbA8x7dzmKdmGzieGRCM46jaSJTDAk=
-github.com/mattn/go-sqlite3 v1.14.14 h1:qZgc/Rwetq+MtyE18WhzjokPD93dNqLGNT3QJuLvBGw=
-github.com/mattn/go-sqlite3 v1.14.14/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
+github.com/mattn/go-sqlite3 v1.14.16 h1:yOQRA0RpS5PFz/oikGwBEqvAWhWg5ufRz4ETLjwpU1Y=
+github.com/mattn/go-sqlite3 v1.14.16/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
+github.com/mikesmitty/edkey v0.0.0-20170222072505-3356ea4e686a h1:eU8j/ClY2Ty3qdHnn0TyW3ivFoPC/0F1gQZz8yTxbbE=
+github.com/mikesmitty/edkey v0.0.0-20170222072505-3356ea4e686a/go.mod h1:v8eSC2SMp9/7FTKUncp7fH9IwPfw+ysMObcEz5FWheQ=
+github.com/mileusna/crontab v1.2.0 h1:x9ZmE2A4p6CDqMEGQ+GbqsNtnmbdmWMQYShdQu8LvrU=
+github.com/mileusna/crontab v1.2.0/go.mod h1:dbns64w/u3tUnGZGf8pAa76ZqOfeBX4olW4U1ZwExmc=
 github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
 github.com/pingcap/errors v0.11.4 h1:lFuQV/oaUMGcD2tqt+01ROSmJs75VG1ToEOkZIZ4nE4=
@@ -48,50 +63,71 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/raja/argon2pw v1.0.2-0.20210910183755-a391af63bd39 h1:2by0+lF6NfaNWhlpsv1DfBQzwbAyYUPIsMWYapek/Sk=
+github.com/raja/argon2pw v1.0.2-0.20210910183755-a391af63bd39/go.mod h1:idX/fPqwjX31YMTF2iIpEpNApV2YbQhSFr4iIhJaqp4=
 github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
-github.com/rs/xid v1.3.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
-github.com/rs/zerolog v1.27.0 h1:1T7qCieN22GVc8S4Q2yuexzBb1EqjbgjSH9RohbMjKs=
-github.com/rs/zerolog v1.27.0/go.mod h1:7frBqO0oezxmnO7GF86FY++uy8I0Tk/If5ni1G9Qc0U=
+github.com/rs/xid v1.4.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
+github.com/rs/zerolog v1.28.0 h1:MirSo27VyNi7RJYP3078AA1+Cyzd2GB66qy3aUHvsWY=
+github.com/rs/zerolog v1.28.0/go.mod h1:NILgTygv/Uej1ra5XxGf82ZFSLk58MFGAUS2o6usyD0=
 github.com/ssor/bom v0.0.0-20170718123548-6386211fdfcf h1:pvbZ0lM0XWPBqUKqFU8cmavspvIl9nulOYwdy6IFRRo=
 github.com/ssor/bom v0.0.0-20170718123548-6386211fdfcf/go.mod h1:RJID2RhlZKId02nZ62WenDCkgHFerpIOmW0iT7GKmXM=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
+github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
 github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
 github.com/tidwall/gjson v1.14.3 h1:9jvXn7olKEHU1S9vwoMGliaT8jq1vJ7IH/n9zD9Dnlw=
 github.com/tidwall/gjson v1.14.3/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
 github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
 github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
-github.com/tidwall/pretty v1.2.0 h1:RWIZEg2iJ8/g6fDDYzMpobmaoGh5OLl4AXtGUGPcqCs=
 github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
+github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
 github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
 github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
-github.com/yuin/goldmark v1.4.12 h1:6hffw6vALvEDqJ19dOJvJKOoAOKe4NDaTqvd2sktGN0=
-github.com/yuin/goldmark v1.4.12/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/yuin/goldmark v1.5.3 h1:3HUJmBFbQW9fhQOzMgseU134xfi6hU+mjWywx5Ty+/M=
+github.com/yuin/goldmark v1.5.3/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 gitlab.com/etke.cc/go/env v1.0.0 h1:J98BwzOuELnjsVPFvz5wa79L7IoRV9CmrS41xLYXtSw=
 gitlab.com/etke.cc/go/env v1.0.0/go.mod h1:e1l4RM5MA1sc0R1w/RBDAESWRwgo5cOG9gx8BKUn2C4=
 gitlab.com/etke.cc/go/logger v1.1.0 h1:Yngp/DDLmJ0jJNLvLXrfan5Gi5QV+r7z6kCczTv8t4U=
 gitlab.com/etke.cc/go/logger v1.1.0/go.mod h1:8Vw5HFXlZQ5XeqvUs5zan+GnhrQyYtm/xe+yj8H/0zk=
-gitlab.com/etke.cc/linkpearl v0.0.0-20220826133247-10dcaedb8085 h1:Qr6o2ERYCEkZAOhvIl4cwgUOHBn4sHq+yReCMjg8kvE=
-gitlab.com/etke.cc/linkpearl v0.0.0-20220826133247-10dcaedb8085/go.mod h1:CqwzwxVogKG6gDWTPTen3NyWbTESg42jxoTfXXwDGKQ=
-golang.org/x/crypto v0.0.0-20220824171710-5757bc0c5503 h1:vJ2V3lFLg+bBhgroYuRfyN583UzVveQmIXjc8T/y3to=
-golang.org/x/crypto v0.0.0-20220824171710-5757bc0c5503/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+gitlab.com/etke.cc/go/mxidwc v1.0.0 h1:6EAlJXvs3nU4RaMegYq6iFlyVvLw7JZYnZmNCGMYQP0=
+gitlab.com/etke.cc/go/mxidwc v1.0.0/go.mod h1:E/0kh45SAN9+ntTG0cwkAEKdaPxzvxVmnjwivm9nmz8=
+gitlab.com/etke.cc/go/secgen v1.1.1 h1:RmKOki725HIhWJHzPtAc9X4YvBneczndchpMgoDkE8w=
+gitlab.com/etke.cc/go/secgen v1.1.1/go.mod h1:3pJqRGeWApzx7qXjABqz2o2SMCNpKSZao/gXVdasqE8=
+gitlab.com/etke.cc/go/trysmtp v1.0.0 h1:f/7gSmzohKniVeLSLevI+ZsySYcPUGkT9cRlOTwjOr8=
+gitlab.com/etke.cc/go/trysmtp v1.0.0/go.mod h1:KqRuIB2IPElEEbAxXmFyKtm7S5YiuEb4lxwWthccqyE=
+gitlab.com/etke.cc/go/validator v1.0.4 h1:2HIBP12f/RZr/7KTNH5/PgPTzl1vi7Co3lmhNTWB31A=
+gitlab.com/etke.cc/go/validator v1.0.4/go.mod h1:3vdssRG4LwgdTr9IHz9MjGSEO+3/FO9hXPGMuSeweJ8=
+gitlab.com/etke.cc/linkpearl v0.0.0-20221116205701-65547c5608e6 h1:+HDT2/bx3Hug++aeDE/PaoRRcnKdYzEm6i2RlOAzPXo=
+gitlab.com/etke.cc/linkpearl v0.0.0-20221116205701-65547c5608e6/go.mod h1:Dgtu0qvymNjjky4Bu5WC8+iSohcb5xZ9CtkD3ezDqIA=
+golang.org/x/crypto v0.0.0-20220518034528-6f7dac969898/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.3.0 h1:a06MkbcxBrEFc0w0QIZWXrH/9cCX6KJyWbBOIwAn+7A=
+golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/net v0.0.0-20210501142056-aec3718b3fa0/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
-golang.org/x/net v0.0.0-20220822230855-b0a4917ee28c h1:JVAXQ10yGGVbSyoer5VILysz6YKjdNT2bsvlayjqhes=
-golang.org/x/net v0.0.0-20220822230855-b0a4917ee28c/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.2.0 h1:sZfSu1wtKLGlWI4ZZayP0ck9Y73K1ynO6gqzTdBVdPU=
+golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220825204002-c680a09ffe64 h1:UiNENfZ8gDvpiWw7IpOMQ27spWmThO1RwwdQVbJahJM=
-golang.org/x/sys v0.0.0-20220825204002-c680a09ffe64/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.2.0 h1:ljd4t30dBnAvMZaQCevtY0xLLD0A+bRZXbgLMLU1F/A=
+golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.2.0 h1:z85xZCsEl7bi/KwbNADeBYoOP0++7W1ipu+aGnpwzRM=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.4.0 h1:BrVqGRd7+k1DiOgtnFvAkoQEWQvBc25ouMJM6429SFg=
+golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -100,5 +136,5 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 maunium.net/go/maulogger/v2 v2.3.2 h1:1XmIYmMd3PoQfp9J+PaHhpt80zpfmMqaShzUTC7FwY0=
 maunium.net/go/maulogger/v2 v2.3.2/go.mod h1:TYWy7wKwz/tIXTpsx8G3mZseIRiC5DoMxSZazOHy68A=
-maunium.net/go/mautrix v0.12.0 h1:jyT1TkJBIRJ7+OW7NhmMHmnEEBLsQe9ml+FYwSLhlaU=
-maunium.net/go/mautrix v0.12.0/go.mod h1:hHvNi5iKVAiI2MAdAeXHtP4g9BvNEX2rsQpSF/x6Kx4=
+maunium.net/go/mautrix v0.12.3 h1:pUeO1ThhtZxE6XibGCzDhRuxwDIFNugsreVr1yYq96k=
+maunium.net/go/mautrix v0.12.3/go.mod h1:uOUjkOjm2C+nQS3mr9B5ATjqemZfnPHvjdd1kZezAwg=

smtp/listener.go

@@ -0,0 +1,50 @@
+package smtp
+
+import (
+	"net"
+
+	"gitlab.com/etke.cc/go/logger"
+)
+
+// Listener that rejects connections from banned hosts
+type Listener struct {
+	log      *logger.Logger
+	listener net.Listener
+	isBanned func(net.Addr) bool
+}
+
+func NewListener(actual net.Listener, isBanned func(net.Addr) bool, log *logger.Logger) *Listener {
+	return &Listener{
+		log:      log,
+		listener: actual,
+		isBanned: isBanned,
+	}
+}
+
+// Accept waits for and returns the next connection to the listener.
+func (l *Listener) Accept() (net.Conn, error) {
+	conn, err := l.listener.Accept()
+	if err != nil {
+		return conn, err
+	}
+	if l.isBanned(conn.RemoteAddr()) {
+		conn.Close()
+		l.log.Info("rejected connection from %q (already banned)", conn.RemoteAddr())
+		// Due to go-smtp design, any error returned here will crash whole server,
+		// thus we have to forge a connection
+		return &net.TCPConn{}, nil
+	}
+
+	return conn, nil
+}
+
+// Close closes the listener.
+// Any blocked Accept operations will be unblocked and return errors.
+func (l *Listener) Close() error {
+	return l.listener.Close()
+}
+
+// Addr returns the listener's network address.
+func (l *Listener) Addr() net.Addr {
+	return l.listener.Addr()
+}

smtp/manager.go

@@ -0,0 +1,155 @@
+package smtp
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+	"os"
+	"time"
+
+	"github.com/emersion/go-smtp"
+	"gitlab.com/etke.cc/go/logger"
+	"maunium.net/go/mautrix/id"
+
+	"gitlab.com/etke.cc/postmoogle/utils"
+)
+
+type Config struct {
+	Domains []string
+	Port    string
+
+	TLSCerts    []string
+	TLSKeys     []string
+	TLSPort     string
+	TLSRequired bool
+
+	LogLevel string
+	MaxSize  int
+	Bot      matrixbot
+}
+
+type Manager struct {
+	log  *logger.Logger
+	bot  matrixbot
+	smtp *smtp.Server
+	errs chan error
+
+	port    string
+	tlsPort string
+	tlsCfg  *tls.Config
+}
+
+type matrixbot interface {
+	AllowAuth(string, string) bool
+	IsGreylisted(net.Addr) bool
+	IsBanned(net.Addr) bool
+	Ban(net.Addr)
+	GetMapping(string) (id.RoomID, bool)
+	GetIFOptions(id.RoomID) utils.IncomingFilteringOptions
+	IncomingEmail(context.Context, *utils.Email) error
+	SetSendmail(func(string, string, string) error)
+	GetDKIMprivkey() string
+}
+
+// NewManager creates new SMTP server manager
+func NewManager(cfg *Config) *Manager {
+	log := logger.New("smtp.", cfg.LogLevel)
+	mailsrv := &mailServer{
+		log:     log,
+		bot:     cfg.Bot,
+		domains: cfg.Domains,
+	}
+	cfg.Bot.SetSendmail(mailsrv.SendEmail)
+
+	s := smtp.NewServer(mailsrv)
+	s.ReadTimeout = 10 * time.Second
+	s.WriteTimeout = 10 * time.Second
+	s.MaxMessageBytes = cfg.MaxSize * 1024 * 1024
+	s.AllowInsecureAuth = !cfg.TLSRequired
+	s.EnableREQUIRETLS = cfg.TLSRequired
+	s.EnableSMTPUTF8 = true
+	// set domain in greeting only in single-domain mode
+	if len(cfg.Domains) == 1 {
+		s.Domain = cfg.Domains[0]
+	}
+	if log.GetLevel() == "DEBUG" || log.GetLevel() == "TRACE" {
+		s.Debug = os.Stdout
+	}
+
+	m := &Manager{
+		smtp:    s,
+		bot:     cfg.Bot,
+		log:     log,
+		port:    cfg.Port,
+		tlsPort: cfg.TLSPort,
+	}
+	m.loadTLSConfig(cfg.TLSCerts, cfg.TLSKeys)
+	return m
+}
+
+// Start SMTP server
+func (m *Manager) Start() error {
+	m.errs = make(chan error, 1)
+	go m.listen(m.port, nil)
+	if m.tlsCfg != nil {
+		go m.listen(m.tlsPort, m.tlsCfg)
+	}
+
+	return <-m.errs
+}
+
+// Stop SMTP server
+func (m *Manager) Stop() {
+	err := m.smtp.Close()
+	if err != nil {
+		m.log.Error("cannot stop SMTP server properly: %v", err)
+	}
+	m.log.Info("SMTP server has been stopped")
+}
+
+func (m *Manager) listen(port string, tlsCfg *tls.Config) {
+	var l net.Listener
+	var err error
+	if tlsCfg != nil {
+		l, err = tls.Listen("tcp", ":"+port, tlsCfg)
+	} else {
+		l, err = net.Listen("tcp", ":"+port)
+	}
+	if err != nil {
+		m.log.Error("cannot start listener on %s: %v", port, err)
+		m.errs <- err
+		return
+	}
+	lwrapper := NewListener(l, m.bot.IsBanned, m.log)
+	m.log.Info("Starting SMTP server on port %s", port)
+
+	err = m.smtp.Serve(lwrapper)
+	if err != nil {
+		m.log.Error("cannot start SMTP server on %s: %v", port, err)
+		m.errs <- err
+		close(m.errs)
+	}
+}
+
+func (m *Manager) loadTLSConfig(certs, keys []string) {
+	if len(certs) == 0 || len(keys) == 0 {
+		m.log.Warn("SSL certificates are not provided")
+		return
+	}
+
+	certificates := make([]tls.Certificate, 0, len(certs))
+	for i, path := range certs {
+		tlsCert, err := tls.LoadX509KeyPair(path, keys[i])
+		if err != nil {
+			m.log.Error("cannot load SSL certificate: %v", err)
+			continue
+		}
+		certificates = append(certificates, tlsCert)
+	}
+	if len(certificates) == 0 {
+		return
+	}
+
+	m.tlsCfg = &tls.Config{Certificates: certificates}
+	m.smtp.TLSConfig = m.tlsCfg
+}

smtp/server.go

@@ -2,55 +2,116 @@ package smtp
 
 import (
 	"context"
-	"os"
-	"time"
+	"io"
+	"strings"
 
 	"github.com/emersion/go-smtp"
 	"github.com/getsentry/sentry-go"
 	"gitlab.com/etke.cc/go/logger"
+	"gitlab.com/etke.cc/go/trysmtp"
+
+	"gitlab.com/etke.cc/postmoogle/utils"
 )
 
-type backend struct {
-	log    *logger.Logger
-	domain string
-	client Client
-}
-
-func (b *backend) newSession() *session {
-	return &session{
-		ctx:    sentry.SetHubOnContext(context.Background(), sentry.CurrentHub().Clone()),
-		log:    b.log,
-		domain: b.domain,
-		client: b.client,
+var (
+	// ErrBanned returned to banned hosts
+	ErrBanned = &smtp.SMTPError{
+		Code:         554,
+		EnhancedCode: smtp.EnhancedCode{5, 5, 4},
+		Message:      "please, don't bother me anymore, kupo.",
 	}
-}
-
-func (b *backend) Login(state *smtp.ConnectionState, username, password string) (smtp.Session, error) {
-	return nil, smtp.ErrAuthUnsupported
-}
-
-func (b *backend) AnonymousLogin(state *smtp.ConnectionState) (smtp.Session, error) {
-	return b.newSession(), nil
-}
-
-func Start(domain, port, loglevel string, maxSize int, client Client) error {
-	log := logger.New("smtp.", loglevel)
-	be := &backend{
-		log:    log,
-		domain: domain,
-		client: client,
+	// ErrNoUser returned when no such mailbox found
+	ErrNoUser = &smtp.SMTPError{
+		Code:         550,
+		EnhancedCode: smtp.EnhancedCode{5, 5, 0},
+		Message:      "no such user here, kupo.",
 	}
-	s := smtp.NewServer(be)
-	s.Addr = ":" + port
-	s.Domain = domain
-	s.AuthDisabled = true
-	s.ReadTimeout = 10 * time.Second
-	s.WriteTimeout = 10 * time.Second
-	s.MaxMessageBytes = maxSize * 1024 * 1024
-	if log.GetLevel() == "DEBUG" || log.GetLevel() == "TRACE" {
-		s.Debug = os.Stdout
+)
+
+type mailServer struct {
+	bot     matrixbot
+	log     *logger.Logger
+	domains []string
+}
+
+// Login used for outgoing mail submissions only (when you use postmoogle as smtp server in your scripts)
+func (m *mailServer) Login(state *smtp.ConnectionState, username, password string) (smtp.Session, error) {
+	m.log.Debug("Login state=%+v username=%+v", state, username)
+	if m.bot.IsBanned(state.RemoteAddr) {
+		return nil, ErrBanned
 	}
 
-	log.Info("Starting SMTP server on %s:%s", domain, port)
-	return s.ListenAndServe()
+	if !utils.AddressValid(username) {
+		m.log.Debug("address %s is invalid", username)
+		m.bot.Ban(state.RemoteAddr)
+		return nil, ErrBanned
+	}
+
+	if !m.bot.AllowAuth(username, password) {
+		m.log.Debug("username=%s or password=<redacted> is invalid", username)
+		m.bot.Ban(state.RemoteAddr)
+		return nil, ErrBanned
+	}
+
+	return &outgoingSession{
+		ctx:      sentry.SetHubOnContext(context.Background(), sentry.CurrentHub().Clone()),
+		sendmail: m.SendEmail,
+		privkey:  m.bot.GetDKIMprivkey(),
+		from:     username,
+		log:      m.log,
+		domains:  m.domains,
+	}, nil
+}
+
+// AnonymousLogin used for incoming mail submissions only
+func (m *mailServer) AnonymousLogin(state *smtp.ConnectionState) (smtp.Session, error) {
+	m.log.Debug("AnonymousLogin state=%+v", state)
+	if m.bot.IsBanned(state.RemoteAddr) {
+		return nil, ErrBanned
+	}
+
+	return &incomingSession{
+		ctx:          sentry.SetHubOnContext(context.Background(), sentry.CurrentHub().Clone()),
+		getRoomID:    m.bot.GetMapping,
+		getFilters:   m.bot.GetIFOptions,
+		receiveEmail: m.ReceiveEmail,
+		ban:          m.bot.Ban,
+		greylisted:   m.bot.IsGreylisted,
+		log:          m.log,
+		domains:      m.domains,
+		addr:         state.RemoteAddr,
+	}, nil
+}
+
+// SendEmail to external mail server
+func (m *mailServer) SendEmail(from, to, data string) error {
+	m.log.Debug("Sending email from %s to %s", from, to)
+	conn, err := trysmtp.Connect(from, to)
+	if err != nil {
+		m.log.Error("cannot connect to SMTP server of %s: %v", to, err)
+		return err
+	}
+	defer conn.Close()
+
+	var w io.WriteCloser
+	w, err = conn.Data()
+	if err != nil {
+		m.log.Error("cannot send DATA command: %v", err)
+		return err
+	}
+	defer w.Close()
+	m.log.Debug("sending DATA:\n%s", data)
+	_, err = strings.NewReader(data).WriteTo(w)
+	if err != nil {
+		m.log.Debug("cannot write DATA: %v", err)
+		return err
+	}
+
+	m.log.Debug("email has been sent")
+	return nil
+}
+
+// ReceiveEmail - incoming mail into matrix room
+func (m *mailServer) ReceiveEmail(ctx context.Context, email *utils.Email) error {
+	return m.bot.IncomingEmail(ctx, email)
 }

smtp/session.go

@@ -2,81 +2,99 @@ package smtp
 
 import (
 	"context"
+	"errors"
 	"io"
+	"net"
 
 	"github.com/emersion/go-smtp"
 	"github.com/getsentry/sentry-go"
 	"github.com/jhillyerd/enmime"
 	"gitlab.com/etke.cc/go/logger"
+	"gitlab.com/etke.cc/go/validator"
+	"maunium.net/go/mautrix/id"
 
 	"gitlab.com/etke.cc/postmoogle/utils"
 )
 
-type session struct {
-	log    *logger.Logger
-	domain string
-	client Client
+// incomingSession represents an SMTP-submission session receiving emails from remote servers
+type incomingSession struct {
+	log          *logger.Logger
+	getRoomID    func(string) (id.RoomID, bool)
+	getFilters   func(id.RoomID) utils.IncomingFilteringOptions
+	receiveEmail func(context.Context, *utils.Email) error
+	greylisted   func(net.Addr) bool
+	ban          func(net.Addr)
+	domains      []string
 
 	ctx  context.Context
+	addr net.Addr
 	to   string
 	from string
 }
 
-func (s *session) Mail(from string, opts smtp.MailOptions) error {
+func (s *incomingSession) Mail(from string, opts smtp.MailOptions) error {
 	sentry.GetHubFromContext(s.ctx).Scope().SetTag("from", from)
+	if !utils.AddressValid(from) {
+		s.log.Debug("address %s is invalid", from)
+		s.ban(s.addr)
+		return ErrBanned
+	}
 	s.from = from
 	s.log.Debug("mail from %s, options: %+v", from, opts)
 	return nil
 }
 
-func (s *session) Rcpt(to string) error {
+func (s *incomingSession) Rcpt(to string) error {
 	sentry.GetHubFromContext(s.ctx).Scope().SetTag("to", to)
-
-	if utils.Hostname(to) != s.domain {
+	s.to = to
+	var domainok bool
+	for _, domain := range s.domains {
+		if utils.Hostname(to) == domain {
+			domainok = true
+			break
+		}
+	}
+	if !domainok {
 		s.log.Debug("wrong domain of %s", to)
-		return smtp.ErrAuthRequired
+		return ErrNoUser
 	}
 
-	_, ok := s.client.GetMapping(utils.Mailbox(to))
+	roomID, ok := s.getRoomID(utils.Mailbox(to))
 	if !ok {
 		s.log.Debug("mapping for %s not found", to)
-		return smtp.ErrAuthRequired
+		return ErrNoUser
+	}
+
+	validations := s.getFilters(roomID)
+	if !validateEmail(s.from, s.to, s.log, validations) {
+		s.ban(s.addr)
+		return ErrBanned
 	}
 
-	s.to = to
 	s.log.Debug("mail to %s", to)
 	return nil
 }
 
-func (s *session) parseAttachments(parts []*enmime.Part) []*utils.File {
-	files := make([]*utils.File, 0, len(parts))
-	for _, attachment := range parts {
-		for _, err := range attachment.Errors {
-			s.log.Warn("attachment error: %v", err)
+func (s *incomingSession) Data(r io.Reader) error {
+	if s.greylisted(s.addr) {
+		return &smtp.SMTPError{
+			Code:         451,
+			EnhancedCode: smtp.EnhancedCode{4, 5, 1},
+			Message:      "You have been greylisted, try again a bit later.",
 		}
-		file := utils.NewFile(attachment.FileName, attachment.ContentType, attachment.Content)
-		files = append(files, file)
 	}
-
-	return files
-}
-
-func (s *session) Data(r io.Reader) error {
 	parser := enmime.NewParser()
 	eml, err := parser.ReadEnvelope(r)
 	if err != nil {
 		return err
 	}
 
-	attachments := s.parseAttachments(eml.Attachments)
-	inlines := s.parseAttachments(eml.Inlines)
-	files := make([]*utils.File, 0, len(attachments)+len(inlines))
-	files = append(files, attachments...)
-	files = append(files, inlines...)
+	files := parseAttachments(eml.Attachments, s.log)
 
 	email := utils.NewEmail(
 		eml.GetHeader("Message-Id"),
 		eml.GetHeader("In-Reply-To"),
+		eml.GetHeader("References"),
 		eml.GetHeader("Subject"),
 		s.from,
 		s.to,
@@ -84,11 +102,84 @@ func (s *session) Data(r io.Reader) error {
 		eml.HTML,
 		files)
 
-	return s.client.Send(s.ctx, email)
+	return s.receiveEmail(s.ctx, email)
+}
+func (s *incomingSession) Reset()        {}
+func (s *incomingSession) Logout() error { return nil }
+
+// outgoingSession represents an SMTP-submission session sending emails from external scripts, using postmoogle as SMTP server
+type outgoingSession struct {
+	log      *logger.Logger
+	sendmail func(string, string, string) error
+	privkey  string
+	domains  []string
+
+	ctx  context.Context
+	to   string
+	from string
 }
 
-func (s *session) Reset() {}
-
-func (s *session) Logout() error {
+func (s *outgoingSession) Mail(from string, opts smtp.MailOptions) error {
+	sentry.GetHubFromContext(s.ctx).Scope().SetTag("from", from)
+	if !utils.AddressValid(from) {
+		return errors.New("please, provide email address")
+	}
 	return nil
 }
+
+func (s *outgoingSession) Rcpt(to string) error {
+	sentry.GetHubFromContext(s.ctx).Scope().SetTag("to", to)
+	s.to = to
+
+	s.log.Debug("mail to %s", to)
+	return nil
+}
+
+func (s *outgoingSession) Data(r io.Reader) error {
+	parser := enmime.NewParser()
+	eml, err := parser.ReadEnvelope(r)
+	if err != nil {
+		return err
+	}
+
+	files := parseAttachments(eml.Attachments, s.log)
+
+	email := utils.NewEmail(
+		eml.GetHeader("Message-Id"),
+		eml.GetHeader("In-Reply-To"),
+		eml.GetHeader("References"),
+		eml.GetHeader("Subject"),
+		s.from,
+		s.to,
+		eml.Text,
+		eml.HTML,
+		files)
+
+	return s.sendmail(email.From, email.To, email.Compose(s.privkey))
+}
+func (s *outgoingSession) Reset()        {}
+func (s *outgoingSession) Logout() error { return nil }
+
+func validateEmail(from, to string, log *logger.Logger, options utils.IncomingFilteringOptions) bool {
+	enforce := validator.Enforce{
+		Email: true,
+		MX:    options.SpamcheckMX(),
+		SMTP:  options.SpamcheckSMTP(),
+	}
+	v := validator.New(options.Spamlist(), enforce, to, log)
+
+	return v.Email(from)
+}
+
+func parseAttachments(parts []*enmime.Part, log *logger.Logger) []*utils.File {
+	files := make([]*utils.File, 0, len(parts))
+	for _, attachment := range parts {
+		for _, err := range attachment.Errors {
+			log.Warn("attachment error: %v", err)
+		}
+		file := utils.NewFile(attachment.FileName, attachment.Content)
+		files = append(files, file)
+	}
+
+	return files
+}

smtp/smtp.go

@@ -1,15 +0,0 @@
-package smtp
-
-import (
-	"context"
-
-	"maunium.net/go/mautrix/id"
-
-	"gitlab.com/etke.cc/postmoogle/utils"
-)
-
-// Client interface to send emails
-type Client interface {
-	GetMapping(string) (id.RoomID, bool)
-	Send(ctx context.Context, email *utils.Email) error
-}

utils/command.go

@@ -0,0 +1,25 @@
+package utils
+
+import (
+	"fmt"
+	"strings"
+)
+
+// ErrInvalidArgs returned when a command's arguments are invalid
+var ErrInvalidArgs = fmt.Errorf("invalid arguments")
+
+// ParseSend parses "!pm send" command, returns to, subject, body, err
+func ParseSend(commandSlice []string) (string, string, string, error) {
+	message := strings.Join(commandSlice, " ")
+	lines := strings.Split(message, "\n")
+	if len(lines) < 3 {
+		return "", "", "", ErrInvalidArgs
+	}
+
+	commandSlice = strings.Split(lines[0], " ")
+	to := commandSlice[1]
+	subject := lines[1]
+	body := strings.Join(lines[2:], "\n")
+
+	return to, subject, body, nil
+}

utils/email.go

@@ -1,28 +1,84 @@
 package utils
 
+import (
+	"crypto"
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+	"net/mail"
+	"strings"
+	"time"
+
+	"github.com/emersion/go-msgauth/dkim"
+	"github.com/jhillyerd/enmime"
+	"maunium.net/go/mautrix/event"
+	"maunium.net/go/mautrix/format"
+	"maunium.net/go/mautrix/id"
+)
+
+// IncomingFilteringOptions for incoming mail
+type IncomingFilteringOptions interface {
+	SpamcheckSMTP() bool
+	SpamcheckMX() bool
+	Spamlist() []string
+}
+
 // Email object
 type Email struct {
-	MessageID string
-	InReplyTo string
-	From      string
-	To        string
-	Subject   string
-	Text      string
-	HTML      string
-	Files     []*File
+	Date       string
+	MessageID  string
+	InReplyTo  string
+	References string
+	From       string
+	To         string
+	Subject    string
+	Text       string
+	HTML       string
+	Files      []*File
+}
+
+// ContentOptions represents settings that specify how an email is to be converted to a Matrix message
+type ContentOptions struct {
+	// On/Off
+	Sender    bool
+	Recipient bool
+	Subject   bool
+	HTML      bool
+	Threads   bool
+
+	// Keys
+	MessageIDKey  string
+	InReplyToKey  string
+	ReferencesKey string
+	SubjectKey    string
+	FromKey       string
+	ToKey         string
+}
+
+// AddressValid checks if email address is valid
+func AddressValid(email string) bool {
+	_, err := mail.ParseAddress(email)
+	return err == nil
+}
+
+// MessageID generates email Message-Id from matrix event ID
+func MessageID(eventID id.EventID, domain string) string {
+	return fmt.Sprintf("<%s@%s>", eventID, domain)
 }
 
 // NewEmail constructs Email object
-func NewEmail(messageID, inReplyTo, subject, from, to, text, html string, files []*File) *Email {
+func NewEmail(messageID, inReplyTo, references, subject, from, to, text, html string, files []*File) *Email {
 	email := &Email{
-		MessageID: messageID,
-		InReplyTo: inReplyTo,
-		From:      from,
-		To:        to,
-		Subject:   subject,
-		Text:      text,
-		HTML:      html,
-		Files:     files,
+		Date:       time.Now().UTC().Format(time.RFC1123Z),
+		MessageID:  messageID,
+		InReplyTo:  inReplyTo,
+		References: references,
+		From:       from,
+		To:         to,
+		Subject:    subject,
+		Text:       text,
+		HTML:       html,
+		Files:      files,
 	}
 
 	if html != "" {
@@ -35,3 +91,123 @@ func NewEmail(messageID, inReplyTo, subject, from, to, text, html string, files
 
 	return email
 }
+
+// Mailbox returns postmoogle's mailbox, parsing it from FROM (if incoming=false) or TO (incoming=true)
+func (e *Email) Mailbox(incoming bool) string {
+	if incoming {
+		return Mailbox(e.To)
+	}
+	return Mailbox(e.From)
+}
+
+// Content converts the email object to a Matrix event content
+func (e *Email) Content(threadID id.EventID, options *ContentOptions) *event.Content {
+	var text strings.Builder
+	if options.Sender {
+		text.WriteString(e.From)
+	}
+	if options.Recipient {
+		text.WriteString(" ➡️ ")
+		text.WriteString(e.To)
+	}
+	if options.Sender || options.Recipient {
+		text.WriteString("\n\n")
+	}
+	if options.Subject && threadID == "" {
+		text.WriteString("# ")
+		text.WriteString(e.Subject)
+		text.WriteString("\n\n")
+	}
+	if e.HTML != "" && options.HTML {
+		text.WriteString(format.HTMLToMarkdown(e.HTML))
+	} else {
+		text.WriteString(e.Text)
+	}
+
+	parsed := format.RenderMarkdown(text.String(), true, true)
+	parsed.RelatesTo = RelatesTo(options.Threads, threadID)
+
+	content := event.Content{
+		Raw: map[string]interface{}{
+			options.MessageIDKey:  e.MessageID,
+			options.InReplyToKey:  e.InReplyTo,
+			options.ReferencesKey: e.References,
+			options.SubjectKey:    e.Subject,
+			options.FromKey:       e.From,
+			options.ToKey:         e.To,
+		},
+		Parsed: &parsed,
+	}
+	return &content
+}
+
+// Compose converts the email object to a string (to be used for delivery via SMTP) and possibly DKIM-signs it
+func (e *Email) Compose(privkey string) string {
+	textSize := len(e.Text)
+	htmlSize := len(e.HTML)
+	if textSize == 0 && htmlSize == 0 {
+		return ""
+	}
+
+	mail := enmime.Builder().
+		From("", e.From).
+		To("", e.To).
+		Header("Message-Id", e.MessageID).
+		Subject(e.Subject)
+	if textSize > 0 {
+		mail = mail.Text([]byte(e.Text))
+	}
+	if htmlSize > 0 {
+		mail = mail.HTML([]byte(e.HTML))
+	}
+	if e.InReplyTo != "" {
+		mail = mail.Header("In-Reply-To", e.InReplyTo)
+	}
+	if e.References != "" {
+		mail = mail.Header("References", e.References)
+	}
+
+	root, err := mail.Build()
+	if err != nil {
+		log.Error("cannot compose email: %v", err)
+		return ""
+	}
+	var data strings.Builder
+	err = root.Encode(&data)
+	if err != nil {
+		log.Error("cannot encode email: %v", err)
+		return ""
+	}
+
+	domain := strings.SplitN(e.From, "@", 2)[1]
+	return e.sign(domain, privkey, data)
+}
+
+func (e *Email) sign(domain, privkey string, data strings.Builder) string {
+	if privkey == "" {
+		return data.String()
+	}
+	pemblock, _ := pem.Decode([]byte(privkey))
+	if pemblock == nil {
+		return data.String()
+	}
+	parsedkey, err := x509.ParsePKCS8PrivateKey(pemblock.Bytes)
+	if err != nil {
+		return data.String()
+	}
+	signer := parsedkey.(crypto.Signer)
+
+	options := &dkim.SignOptions{
+		Domain:   domain,
+		Selector: "postmoogle",
+		Signer:   signer,
+	}
+
+	var msg strings.Builder
+	err = dkim.Sign(&msg, strings.NewReader(data.String()), options)
+	if err != nil {
+		return data.String()
+	}
+
+	return msg.String()
+}

utils/file.go

@@ -2,30 +2,37 @@ package utils
 
 import (
 	"bytes"
+	"strings"
 
+	"github.com/gabriel-vasile/mimetype"
 	"maunium.net/go/mautrix"
+	"maunium.net/go/mautrix/event"
 )
 
 type File struct {
 	Name    string
 	Type    string
+	MsgType event.MessageType
 	Length  int
 	Content []byte
 }
 
-func NewFile(name, contentType string, content []byte) *File {
+func NewFile(name string, content []byte) *File {
 	file := &File{
 		Name:    name,
-		Type:    contentType,
 		Content: content,
 	}
 	file.Length = len(content)
 
+	mtype := mimetype.Detect(content)
+	file.Type = mtype.String()
+	file.MsgType = mimeMsgType(file.Type)
+
 	return file
 }
 
-func (f *File) Convert() mautrix.ReqUploadMedia {
-	return mautrix.ReqUploadMedia{
+func (f *File) Convert() *mautrix.ReqUploadMedia {
+	return &mautrix.ReqUploadMedia{
 		ContentBytes:  f.Content,
 		Content:       bytes.NewReader(f.Content),
 		ContentLength: int64(f.Length),
@@ -33,3 +40,23 @@ func (f *File) Convert() mautrix.ReqUploadMedia {
 		FileName:      f.Name,
 	}
 }
+
+func mimeMsgType(mime string) event.MessageType {
+	if mime == "" {
+		return event.MsgFile
+	}
+	if !strings.Contains(mime, "/") {
+		return event.MsgFile
+	}
+	msection := strings.Split(mime, "/")[0]
+	switch msection {
+	case "image":
+		return event.MsgImage
+	case "video":
+		return event.MsgVideo
+	case "audio":
+		return event.MsgAudio
+	default:
+		return event.MsgFile
+	}
+}

utils/matrix.go

@@ -6,23 +6,72 @@ import (
 	"maunium.net/go/mautrix/id"
 )
 
-// RelatesTo block of matrix event content
-func RelatesTo(noThreads bool, parentID id.EventID) *event.RelatesTo {
+// RelatesTo returns relation object of a matrix event (either threads or reply-to)
+func RelatesTo(threads bool, parentID id.EventID) *event.RelatesTo {
 	if parentID == "" {
 		return nil
 	}
 
-	if noThreads {
+	if threads {
 		return &event.RelatesTo{
-			InReplyTo: &event.InReplyTo{
-				EventID: parentID,
-			},
+			Type:    event.RelThread,
+			EventID: parentID,
 		}
 	}
 
 	return &event.RelatesTo{
-		Type:    event.RelThread,
-		EventID: parentID,
+		InReplyTo: &event.InReplyTo{
+			EventID: parentID,
+		},
+	}
+}
+
+// EventParent returns parent event ID (either from thread or from reply-to relation)
+func EventParent(currentID id.EventID, content *event.MessageEventContent) id.EventID {
+	if content == nil {
+		return currentID
+	}
+
+	if content.GetRelatesTo() == nil {
+		return currentID
+	}
+
+	threadParent := content.RelatesTo.GetThreadParent()
+	if threadParent != "" {
+		return threadParent
+	}
+
+	replyParent := content.RelatesTo.GetReplyTo()
+	if replyParent != "" {
+		return replyParent
+	}
+
+	return currentID
+}
+
+// EventField returns field value from raw event content
+func EventField[T comparable](content *event.Content, field string) T {
+	var zero T
+	raw := content.Raw[field]
+	if raw == nil {
+		return zero
+	}
+
+	v, ok := raw.(T)
+	if !ok {
+		return zero
+	}
+
+	return v
+}
+
+func ParseContent(evt *event.Event, eventType event.Type) {
+	if evt.Content.Parsed != nil {
+		return
+	}
+	perr := evt.Content.ParseRaw(eventType)
+	if perr != nil {
+		log.Error("cannot parse event content: %v", perr)
 	}
 }
 

utils/user.go

@@ -1,104 +0,0 @@
-package utils
-
-import (
-	"fmt"
-	"regexp"
-	"strings"
-)
-
-// WildcardMXIDsToRegexes converts a list of wildcard patterns to a list of regular expressions
-func WildcardMXIDsToRegexes(wildCardPatterns []string) ([]*regexp.Regexp, error) {
-	regexPatterns := make([]*regexp.Regexp, len(wildCardPatterns))
-
-	for idx, wildCardPattern := range wildCardPatterns {
-		regex, err := parseMXIDWildcard(wildCardPattern)
-		if err != nil {
-			return nil, fmt.Errorf("failed to parse allowed user rule `%s`: %s", wildCardPattern, err)
-		}
-		regexPatterns[idx] = regex
-	}
-
-	return regexPatterns, nil
-}
-
-// Match tells if the given user id is allowed to use the bot, according to the given whitelist
-func Match(userID string, allowed []*regexp.Regexp) bool {
-	for _, regex := range allowed {
-		if regex.MatchString(userID) {
-			return true
-		}
-	}
-
-	return false
-}
-
-// parseMXIDWildcard parses a user whitelisting wildcard rule and returns a regular expression which corresponds to it
-//
-// Example conversion: `@bot.*.something:*.example.com` -> `^bot\.([^:@]*)\.something:([^:@]*)\.example.com$`
-// Example of recognized wildcard patterns: `@someone:example.com`, `@*:example.com`, `@bot.*:example.com`, `@someone:*`, `@someone:*.example.com`
-//
-// The `*` wildcard character is normally interpretted as "a number of literal characters or an empty string".
-// Our implementation below matches this (yielding `([^:@])*`), which could provide a slightly suboptimal regex in these cases:
-// - `@*:example.com` -> `^@([^:@])*:example\.com$`, although `^@([^:@])+:example\.com$` would be preferable
-// - `@someone:*` -> `@someone:([^:@])*$`, although `@someone:([^:@])+$` would be preferable
-// When it's a bare wildcard (`*`, instead of `*.example.com`) we likely prefer to yield a regex that matches **at least one character**.
-// This probably doesn't matter because mxids that we'll match against are all valid and fully complete.
-func parseMXIDWildcard(wildCardRule string) (*regexp.Regexp, error) {
-	if !strings.HasPrefix(wildCardRule, "@") {
-		return nil, fmt.Errorf("rules need to be fully-qualified, starting with a @")
-	}
-
-	remainingRule := wildCardRule[1:]
-	if strings.Contains(remainingRule, "@") {
-		return nil, fmt.Errorf("rules cannot contain more than one @")
-	}
-
-	parts := strings.Split(remainingRule, ":")
-	if len(parts) != 2 {
-		return nil, fmt.Errorf("expected exactly 2 parts in the rule, separated by `:`")
-	}
-
-	localPart := parts[0]
-	localPartPattern, err := getRegexPatternForPart(localPart)
-	if err != nil {
-		return nil, fmt.Errorf("failed to convert local part `%s` to regex: %s", localPart, err)
-	}
-
-	domainPart := parts[1]
-	domainPartPattern, err := getRegexPatternForPart(domainPart)
-	if err != nil {
-		return nil, fmt.Errorf("failed to convert domain part `%s` to regex: %s", domainPart, err)
-	}
-
-	finalPattern := fmt.Sprintf("^@%s:%s$", localPartPattern, domainPartPattern)
-
-	regex, err := regexp.Compile(finalPattern)
-	if err != nil {
-		return nil, fmt.Errorf("failed to compile regex `%s`: %s", finalPattern, err)
-	}
-
-	return regex, nil
-}
-
-func getRegexPatternForPart(part string) (string, error) {
-	if part == "" {
-		return "", fmt.Errorf("rejecting empty part")
-	}
-
-	var pattern strings.Builder
-	for _, rune := range part {
-		if rune == '*' {
-			// We match everything except for `:` and `@`, because that would be an invalid MXID anyway.
-			//
-			// If the whole part is `*` (only) instead of merely containing `*` within it,
-			// we may also consider replacing it with `([^:@]+)` (+, instead of *).
-			// See parseMXIDWildcard for notes about this.
-			pattern.WriteString("([^:@]*)")
-			continue
-		}
-
-		pattern.WriteString(regexp.QuoteMeta(string(rune)))
-	}
-
-	return pattern.String(), nil
-}

utils/user_test.go

@@ -1,221 +0,0 @@
-package utils
-
-import "testing"
-
-func TestRuleToRegex(t *testing.T) {
-	type testDataDefinition struct {
-		name           string
-		checkedValue   string
-		expectedResult string
-		expectedError  bool
-	}
-
-	tests := []testDataDefinition{
-		{
-			name:           "simple pattern without wildcards succeeds",
-			checkedValue:   "@someone:example.com",
-			expectedResult: `^@someone:example\.com$`,
-			expectedError:  false,
-		},
-		{
-			name:           "pattern with wildcard as the whole local part succeeds",
-			checkedValue:   "@*:example.com",
-			expectedResult: `^@([^:@]*):example\.com$`,
-			expectedError:  false,
-		},
-		{
-			name:           "pattern with wildcard within the local part succeeds",
-			checkedValue:   "@bot.*.something:example.com",
-			expectedResult: `^@bot\.([^:@]*)\.something:example\.com$`,
-			expectedError:  false,
-		},
-		{
-			name:           "pattern with wildcard as the whole domain part succeeds",
-			checkedValue:   "@someone:*",
-			expectedResult: `^@someone:([^:@]*)$`,
-			expectedError:  false,
-		},
-		{
-			name:           "pattern with wildcard within the domain part succeeds",
-			checkedValue:   "@someone:*.organization.com",
-			expectedResult: `^@someone:([^:@]*)\.organization\.com$`,
-			expectedError:  false,
-		},
-		{
-			name:           "pattern with wildcard in both parts succeeds",
-			checkedValue:   "@*:*",
-			expectedResult: `^@([^:@]*):([^:@]*)$`,
-			expectedError:  false,
-		},
-		{
-			name:           "pattern that does not appear fully-qualified fails",
-			checkedValue:   "someone:example.com",
-			expectedResult: ``,
-			expectedError:  true,
-		},
-		{
-			name:           "pattern that does not appear fully-qualified fails",
-			checkedValue:   "@someone",
-			expectedResult: ``,
-			expectedError:  true,
-		},
-		{
-			name:           "pattern with empty domain part fails",
-			checkedValue:   "@someone:",
-			expectedResult: ``,
-			expectedError:  true,
-		},
-		{
-			name:           "pattern with empty local part fails",
-			checkedValue:   "@:example.com",
-			expectedResult: ``,
-			expectedError:  true,
-		},
-		{
-			name:           "pattern with multiple @ fails",
-			checkedValue:   "@someone@someone:example.com",
-			expectedResult: ``,
-			expectedError:  true,
-		},
-		{
-			name:           "pattern with multiple : fails",
-			checkedValue:   "@someone:someone:example.com",
-			expectedResult: ``,
-			expectedError:  true,
-		},
-	}
-
-	for _, testData := range tests {
-		func(testData testDataDefinition) {
-			t.Run(testData.name, func(t *testing.T) {
-				actualResult, err := parseMXIDWildcard(testData.checkedValue)
-
-				if testData.expectedError {
-					if err != nil {
-						return
-					}
-
-					t.Errorf("expected an error, but did not get one")
-				}
-
-				if err != nil {
-					t.Errorf("did not expect an error, but got one: %s", err)
-				}
-
-				if actualResult.String() == testData.expectedResult {
-					return
-				}
-
-				t.Errorf(
-					"Expected `%s` to yield `%s`, not `%s`",
-					testData.checkedValue,
-					testData.expectedResult,
-					actualResult.String(),
-				)
-			})
-		}(testData)
-	}
-}
-
-func TestMatch(t *testing.T) {
-	type testDataDefinition struct {
-		name           string
-		checkedValue   string
-		allowedUsers   []string
-		expectedResult bool
-	}
-
-	tests := []testDataDefinition{
-		{
-			name:           "Empty allowed users allows no one",
-			checkedValue:   "@someone:example.com",
-			allowedUsers:   []string{},
-			expectedResult: false,
-		},
-		{
-			name:           "Direct full mxid match is allowed",
-			checkedValue:   "@someone:example.com",
-			allowedUsers:   []string{"@someone:example.com"},
-			expectedResult: true,
-		},
-		{
-			name:           "Direct full mxid match later on is allowed",
-			checkedValue:   "@someone:example.com",
-			allowedUsers:   []string{"@another:example.com", "@someone:example.com"},
-			expectedResult: true,
-		},
-		{
-			name:           "No mxid match is not allowed",
-			checkedValue:   "@someone:example.com",
-			allowedUsers:   []string{"@another:example.com"},
-			expectedResult: false,
-		},
-		{
-			name:           "mxid localpart only wildcard match is allowed",
-			checkedValue:   "@someone:example.com",
-			allowedUsers:   []string{"@*:example.com"},
-			expectedResult: true,
-		},
-		{
-			name:           "mxid localpart with wildcard match is allowed",
-			checkedValue:   "@bot.abc:example.com",
-			allowedUsers:   []string{"@bot.*:example.com"},
-			expectedResult: true,
-		},
-		{
-			name:           "mxid localpart with wildcard match is not allowed when it does not match",
-			checkedValue:   "@bot.abc:example.com",
-			allowedUsers:   []string{"@employee.*:example.com"},
-			expectedResult: false,
-		},
-		{
-			name:           "mxid localpart wildcard for another domain is not allowed",
-			checkedValue:   "@someone:example.com",
-			allowedUsers:   []string{"@*:another.com"},
-			expectedResult: false,
-		},
-		{
-			name:           "mxid domainpart with only wildcard match is allowed",
-			checkedValue:   "@someone:example.com",
-			allowedUsers:   []string{"@someone:*"},
-			expectedResult: true,
-		},
-		{
-			name:           "mxid domainpart with wildcard match is allowed",
-			checkedValue:   "@someone:example.organization.com",
-			allowedUsers:   []string{"@someone:*.organization.com"},
-			expectedResult: true,
-		},
-		{
-			name:           "mxid domainpart with wildcard match is not allowed when it does not match",
-			checkedValue:   "@someone:example.another.com",
-			allowedUsers:   []string{"@someone:*.organization.com"},
-			expectedResult: false,
-		},
-	}
-
-	for _, testData := range tests {
-		func(testData testDataDefinition) {
-			t.Run(testData.name, func(t *testing.T) {
-				allowedUserRegexes, err := WildcardMXIDsToRegexes(testData.allowedUsers)
-				if err != nil {
-					t.Error(err)
-				}
-
-				actualResult := Match(testData.checkedValue, allowedUserRegexes)
-
-				if actualResult == testData.expectedResult {
-					return
-				}
-
-				t.Errorf(
-					"Expected `%s` compared against `%v` to yield `%v`, not `%v`",
-					testData.checkedValue,
-					testData.allowedUsers,
-					testData.expectedResult,
-					actualResult,
-				)
-			})
-		}(testData)
-	}
-}

utils/utils.go

@@ -3,15 +3,56 @@ package utils
 import (
 	"strconv"
 	"strings"
+
+	"gitlab.com/etke.cc/go/logger"
 )
 
+var (
+	log     *logger.Logger
+	domains []string
+)
+
+// SetLogger for utils
+func SetLogger(loggerInstance *logger.Logger) {
+	log = loggerInstance
+}
+
+// SetDomains for later use
+func SetDomains(slice []string) {
+	domains = slice
+}
+
 // Mailbox returns mailbox part from email address
 func Mailbox(email string) string {
 	index := strings.LastIndex(email, "@")
 	if index == -1 {
 		return email
 	}
-	return email[:strings.LastIndex(email, "@")]
+	return email[:index]
+}
+
+// EmailsList returns human-readable list of mailbox's emails for all available domains
+func EmailsList(mailbox string, domain string) string {
+	var msg strings.Builder
+	domain = SanitizeDomain(domain)
+	msg.WriteString(mailbox)
+	msg.WriteString("@")
+	msg.WriteString(domain)
+
+	count := len(domains) - 1
+	for i, aliasDomain := range domains {
+		if i < count {
+			msg.WriteString(", ")
+		}
+		if aliasDomain == domain {
+			continue
+		}
+		msg.WriteString(mailbox)
+		msg.WriteString("@")
+		msg.WriteString(aliasDomain)
+	}
+
+	return msg.String()
 }
 
 // Hostname returns hostname part from email address
@@ -19,6 +60,22 @@ func Hostname(email string) string {
 	return email[strings.LastIndex(email, "@")+1:]
 }
 
+// SanitizeDomain checks that input domain is available for use
+func SanitizeDomain(domain string) string {
+	domain = strings.TrimSpace(domain)
+	if domain == "" {
+		return domains[0]
+	}
+
+	for _, allowed := range domains {
+		if domain == allowed {
+			return domain
+		}
+	}
+
+	return domains[0]
+}
+
 // Bool converts string to boolean
 func Bool(str string) bool {
 	str = strings.ToLower(str)
@@ -33,3 +90,50 @@ func Bool(str string) bool {
 func SanitizeBoolString(str string) string {
 	return strconv.FormatBool(Bool(str))
 }
+
+// Int converts string to integer
+func Int(str string) int {
+	if str == "" {
+		return 0
+	}
+
+	i, err := strconv.Atoi(str)
+	if err != nil {
+		return 0
+	}
+
+	return i
+}
+
+// SanitizeBoolString converts string to integer and back to string
+func SanitizeIntString(str string) string {
+	return strconv.Itoa(Int(str))
+}
+
+// StringSlice converts comma-separated string to slice
+func StringSlice(str string) []string {
+	if str == "" {
+		return nil
+	}
+
+	str = strings.TrimSpace(str)
+	if strings.IndexByte(str, ',') == -1 {
+		return []string{str}
+	}
+
+	return strings.Split(str, ",")
+}
+
+// SanitizeBoolString converts string to slice and back to string
+func SanitizeStringSlice(str string) string {
+	parts := StringSlice(str)
+	if len(parts) == 0 {
+		return str
+	}
+
+	for i, part := range parts {
+		parts[i] = strings.TrimSpace(part)
+	}
+
+	return strings.Join(parts, ",")
+}

vendor/github.com/cention-sany/utf7/.travis.yml

@@ -0,0 +1,12 @@
+language: go
+
+go:
+  - 1.4.2
+  - 1.7.4
+  - tip
+
+install:
+  - go get -v ./...
+  - go get golang.org/x/text/encoding
+  - go get golang.org/x/text/transform
+  

vendor/github.com/cention-sany/utf7/LICENSE

@@ -0,0 +1,29 @@
+Copyright (c) 2013 The Go-IMAP Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+ * Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+
+ * Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the
+   distribution.
+
+ * Neither the name of the go-imap project nor the names of its
+   contributors may be used to endorse or promote products derived
+   from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

vendor/github.com/cention-sany/utf7/README.md

@@ -0,0 +1,2 @@
+# utf7 [![Build Status](https://travis-ci.org/cention-sany/utf7.png?branch=master)](https://travis-ci.org/cention-sany/utf7) [![GoDoc](https://godoc.org/github.com/cention-sany/utf7?status.png)](https://godoc.org/github.com/cention-sany/utf7) [![Exago](https://api.exago.io:443/badge/cov/github.com/cention-sany/utf7)](https://exago.io/project/github.com/cention-sany/utf7) [![Exago](https://api.exago.io:443/badge/rank/github.com/cention-sany/utf7)](https://exago.io/project/github.com/cention-sany/utf7)
+RFC 2152 - UTF7 encoding and decoding.

vendor/github.com/cention-sany/utf7/utf7.go

@@ -0,0 +1,518 @@
+// Copyright 2013 The Go-IMAP Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+/*
+This package modified from:
+https://github.com/mxk/go-imap/blob/master/imap/utf7.go
+https://github.com/mxk/go-imap/blob/master/imap/utf7_test.go
+IMAP specification uses modified UTF-7. Following are the differences:
+  1) Printable US-ASCII except & (0x20 to 0x25 and 0x27 to 0x7e) MUST represent by themselves.
+  2) '&' is used to shift modified BASE64 instead of '+'.
+  3) Can NOT use superfluous null shift (&...-&...- should be just &......-).
+  4) ',' is used in BASE64 code instead of '/'.
+  5) '&' is represented '&-'. You can have many '&-&-&-&-'.
+  6) No implicit shift from BASE64 to US-ASCII. All BASE64 must end with '-'.
+
+Actual UTF-7 specification:
+Rule 1: direct characters: 62 alphanumeric characters and 9 symbols: ' ( ) , - . / : ?
+Rule 2: optional direct characters: all other printable characters in the range
+U+0020–U+007E except ~ \ + and space. Plus sign (+) may be encoded as +-
+(special case). Plus sign (+) mean the start of 'modified Base64 encoded UTF-16'.
+The end of this block is indicated by any character not in the modified Base64.
+If character after modified Base64 is a '-' then it is consumed.
+
+Example:
+  "1 + 1 = 2" is encoded as "1 +- 1 +AD0 2" //+AD0 is the '=' sign.
+  "£1" is encoded as "+AKM-1" //+AKM- is the '£' sign where '-' is consumed.
+
+A "+" character followed immediately by any character other than members
+of modified Base64 or "-" is an ill-formed sequence. Convert to Unicode code
+point then apply modified BASE64 (rfc2045) to it. Modified BASE64 do not use
+padding instead add extra bits. Lines should never be broken in the middle of
+a UTF-7 shifted sequence. Rule 3: Space, tab, carriage return and line feed may
+also be represented directly as single ASCII bytes. Further content transfer
+encoding may be needed if using in email environment.
+*/
+package utf7
+
+import (
+	"bytes"
+	"encoding/base64"
+	"errors"
+	"io/ioutil"
+	"unicode/utf16"
+	"unicode/utf8"
+
+	"golang.org/x/text/encoding"
+	"golang.org/x/text/transform"
+)
+
+const (
+	uRepl = '\uFFFD' // Unicode replacement code point
+	u7min = 0x20     // Minimum self-representing UTF-7 value
+	u7max = 0x7E     // Maximum self-representing UTF-7 value
+)
+
+// copy from golang.org/x/text/encoding/internal
+type simpleEncoding struct {
+	Decoder transform.Transformer
+	Encoder transform.Transformer
+}
+
+func (e *simpleEncoding) NewDecoder() *encoding.Decoder {
+	return &encoding.Decoder{Transformer: e.Decoder}
+}
+
+func (e *simpleEncoding) NewEncoder() *encoding.Encoder {
+	return &encoding.Encoder{Transformer: e.Encoder}
+}
+
+var (
+	UTF7 encoding.Encoding = &simpleEncoding{
+		utf7Decoder{},
+		utf7Encoder{},
+	}
+)
+
+// ErrBadUTF7 is returned to indicate invalid modified UTF-7 encoding.
+var ErrBadUTF7 = errors.New("utf7: bad utf-7 encoding")
+
+// Base64 codec for code points outside of the 0x20-0x7E range.
+const modifiedbase64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
+
+var u7enc = base64.NewEncoding(modifiedbase64)
+
+func isModifiedBase64(r byte) bool {
+	if r >= 'A' && r <= 'Z' {
+		return true
+	} else if r >= 'a' && r <= 'z' {
+		return true
+	} else if r >= '0' && r <= '9' {
+		return true
+	} else if r == '+' || r == '/' {
+		return true
+	}
+	return false
+	// bs := []byte(modifiedbase64)
+	// for _, b := range bs {
+	// 	if b == r {
+	// 		return true
+	// 	}
+	// }
+	// return false
+}
+
+type utf7Decoder struct {
+	transform.NopResetter
+}
+
+func (d utf7Decoder) Transform(dst, src []byte, atEOF bool) (nDst, nSrc int, err error) {
+	var implicit bool
+	var tmp int
+
+	nd, n := len(dst), len(src)
+	if n == 0 && !atEOF {
+		return 0, 0, transform.ErrShortSrc
+	}
+	for ; nSrc < n; nSrc++ {
+		if nDst >= nd {
+			return nDst, nSrc, transform.ErrShortDst
+		}
+		if c := src[nSrc]; ((c < u7min || c > u7max) &&
+			c != '\t' && c != '\r' && c != '\n') ||
+			c == '~' || c == '\\' {
+			return nDst, nSrc, ErrBadUTF7 // Illegal code point in ASCII mode
+		} else if c != '+' {
+			dst[nDst] = c // character can self represent
+			nDst++
+			continue
+		}
+		// found '+'
+		start := nSrc + 1
+		tmp = nSrc // nSrc remain pointing to '+', tmp point to end of BASE64
+		// Find the end of the Base64 or "+-" segment
+		implicit = false
+		for tmp++; tmp < n && src[tmp] != '-'; tmp++ {
+			if !isModifiedBase64(src[tmp]) {
+				if tmp == start {
+					return nDst, tmp, ErrBadUTF7 // '+' next char must modified base64
+				}
+				// implicit shift back to ASCII - no need '-' character
+				implicit = true
+				break
+			}
+		}
+		if tmp == start {
+			if tmp == n {
+				// did not find '-' sign and '+' is last character
+				// total nSrc no include '+'
+				if atEOF {
+					return nDst, nSrc, ErrBadUTF7 // '+' can not at the end
+				}
+				// '+' can not at the end, so get more data
+				return nDst, nSrc, transform.ErrShortSrc
+			}
+			dst[nDst] = '+' // Escape sequence "+-"
+			nDst++
+		} else if tmp == n && !atEOF {
+			// no end of BASE64 marker and still has data
+			// probably the marker at next block of data
+			// so go get more data.
+			return nDst, nSrc, transform.ErrShortSrc
+		} else if b := utf7dec(src[start:tmp]); len(b) > 0 {
+			if len(b)+nDst > nd {
+				// need more space on dst for the decoded modified BASE64 unicode
+				// total nSrc no include '+'
+				return nDst, nSrc, transform.ErrShortDst
+			}
+			copy(dst[nDst:], b) // Control or non-ASCII code points in Base64
+			nDst += len(b)
+			if implicit {
+				if nDst >= nd {
+					return nDst, tmp, transform.ErrShortDst
+				}
+				dst[nDst] = src[tmp] // implicit shift
+				nDst++
+			}
+			if tmp == n {
+				return nDst, tmp, nil
+			}
+		} else {
+			return nDst, nSrc, ErrBadUTF7 // bad encoding
+		}
+		nSrc = tmp
+	}
+	return
+}
+
+type utf7Encoder struct {
+	transform.NopResetter
+}
+
+func calcExpectedSize(runeSize int) (round int) {
+	numerator := runeSize * 17
+	round = numerator / 12
+	remain := numerator % 12
+	if remain >= 6 {
+		round++
+	}
+	return
+}
+
+func (e utf7Encoder) Transform(dst, src []byte, atEOF bool) (nDst, nSrc int, err error) {
+	var c byte
+	var b []byte
+	var endminus, needMoreSrc, needMoreDst, foundASCII, hasRuneStart bool
+	var tmp, compare, lastRuneStart int
+	var currentSize, maxRuneStart int
+	var rn rune
+
+	nd, n := len(dst), len(src)
+	if n == 0 {
+		if !atEOF {
+			return 0, 0, transform.ErrShortSrc
+		} else {
+			return 0, 0, nil
+		}
+	}
+	for nSrc = 0; nSrc < n; {
+		if nDst >= nd {
+			return nDst, nSrc, transform.ErrShortDst
+		}
+		c = src[nSrc]
+		if canSelf(c) {
+			nSrc++
+			dst[nDst] = c
+			nDst++
+			continue
+		} else if c == '+' {
+			if nDst+2 > nd {
+				return nDst, nSrc, transform.ErrShortDst
+			}
+			nSrc++
+			dst[nDst], dst[nDst+1] = '+', '-'
+			nDst += 2
+			continue
+		}
+		start := nSrc
+		tmp = nSrc // nSrc still point to first non-ASCII
+		currentSize = 0
+		maxRuneStart = nSrc
+		needMoreDst = false
+		if utf8.RuneStart(src[nSrc]) {
+			hasRuneStart = true
+		} else {
+			hasRuneStart = false
+		}
+		foundASCII = true
+		for tmp++; tmp < n && !canSelf(src[tmp]) && src[tmp] != '+'; tmp++ {
+			// if next printable ASCII code point found the loop stop
+			if utf8.RuneStart(src[tmp]) {
+				hasRuneStart = true
+				lastRuneStart = tmp
+				rn, _ = utf8.DecodeRune(src[maxRuneStart:tmp])
+				if rn >= 0x10000 {
+					currentSize += 4
+				} else {
+					currentSize += 2
+				}
+				if calcExpectedSize(currentSize)+2 > nd-nDst {
+					needMoreDst = true
+				} else {
+					maxRuneStart = tmp
+				}
+			}
+		}
+
+		// following to adjust tmp to right pointer as now tmp can not
+		// find any good ending (searching end with no result). Adjustment
+		// base on another earlier feasible valid rune position.
+		needMoreSrc = false
+		if tmp == n {
+			foundASCII = false
+			if !atEOF {
+				if !hasRuneStart {
+					return nDst, nSrc, transform.ErrShortSrc
+				} else {
+					//re-adjust tmp to good position to encode
+					if !utf8.Valid(src[maxRuneStart:]) {
+						if maxRuneStart == start {
+							return nDst, nSrc, transform.ErrShortSrc
+						}
+						needMoreSrc = true
+						tmp = maxRuneStart
+					}
+				}
+			}
+		}
+
+		endminus = false
+		if hasRuneStart && !needMoreSrc {
+			// need check if dst enough buffer for transform
+			rn, _ = utf8.DecodeRune(src[lastRuneStart:tmp])
+			if rn >= 0x10000 {
+				currentSize += 4
+			} else {
+				currentSize += 2
+			}
+			if calcExpectedSize(currentSize)+2 > nd-nDst {
+				// can not use tmp value as transofrmed size too
+				// big for dst
+				endminus = true
+				needMoreDst = true
+				tmp = maxRuneStart
+			}
+		}
+
+		b = utf7enc(src[start:tmp])
+		if len(b) < 2 || b[0] != '+' {
+			return nDst, nSrc, ErrBadUTF7 // Illegal code point in ASCII mode
+		}
+
+		if foundASCII {
+			// printable ASCII found - check if BASE64 type
+			if isModifiedBase64(src[tmp]) || src[tmp] == '-' {
+				endminus = true
+			}
+		} else {
+			endminus = true
+		}
+		compare = nDst + len(b)
+		if endminus {
+			compare++
+		}
+		if compare > nd {
+			return nDst, nSrc, transform.ErrShortDst
+		}
+		copy(dst[nDst:], b)
+		nDst += len(b)
+		if endminus {
+			dst[nDst] = '-'
+			nDst++
+		}
+		nSrc = tmp
+
+		if needMoreDst {
+			return nDst, nSrc, transform.ErrShortDst
+		}
+
+		if needMoreSrc {
+			return nDst, nSrc, transform.ErrShortSrc
+		}
+	}
+	return
+}
+
+// UTF7Encode converts a string from UTF-8 encoding to modified UTF-7. This
+// encoding is used by the Mailbox International Naming Convention (RFC 3501
+// section 5.1.3). Invalid UTF-8 byte sequences are replaced by the Unicode
+// replacement code point (U+FFFD).
+func UTF7Encode(s string) string {
+	return string(UTF7EncodeBytes([]byte(s)))
+}
+
+const (
+	setD = iota
+	setO
+	setRule3
+	setInvalid
+)
+
+// get the set of characters group.
+func getSetType(c byte) int {
+	if (c >= 44 && c <= ':') || c == '?' {
+		return setD
+	} else if c == 39 || c == '(' || c == ')' {
+		return setD
+	} else if c >= 'A' && c <= 'Z' {
+		return setD
+	} else if c >= 'a' && c <= 'z' {
+		return setD
+	} else if c == '+' || c == '\\' {
+		return setInvalid
+	} else if c > ' ' && c < '~' {
+		return setO
+	} else if c == ' ' || c == '\t' ||
+		c == '\r' || c == '\n' {
+		return setRule3
+	}
+	return setInvalid
+}
+
+// Check if can represent by themselves.
+func canSelf(c byte) bool {
+	t := getSetType(c)
+	if t == setInvalid {
+		return false
+	}
+	return true
+}
+
+// UTF7EncodeBytes converts a byte slice from UTF-8 encoding to modified UTF-7.
+func UTF7EncodeBytes(s []byte) []byte {
+	input := bytes.NewReader(s)
+	reader := transform.NewReader(input, UTF7.NewEncoder())
+	output, err := ioutil.ReadAll(reader)
+	if err != nil {
+		return nil
+	}
+	return output
+}
+
+// utf7enc converts string s from UTF-8 to UTF-16-BE, encodes the result as
+// Base64, removes the padding, and adds UTF-7 shifts.
+func utf7enc(s []byte) []byte {
+	// len(s) is sufficient for UTF-8 to UTF-16 conversion if there are no
+	// control code points (see table below).
+	b := make([]byte, 0, len(s)+4)
+	for len(s) > 0 {
+		r, size := utf8.DecodeRune(s)
+		if r > utf8.MaxRune {
+			r, size = utf8.RuneError, 1 // Bug fix (issue 3785)
+		}
+		s = s[size:]
+		if r1, r2 := utf16.EncodeRune(r); r1 != uRepl {
+			//log.Println("surrogate triggered")
+			b = append(b, byte(r1>>8), byte(r1))
+			r = r2
+		}
+		b = append(b, byte(r>>8), byte(r))
+	}
+
+	// Encode as Base64
+	//n := u7enc.EncodedLen(len(b)) + 2 // plus 2 for prefix '+' and suffix '-'
+	n := u7enc.EncodedLen(len(b)) + 1 // plus for prefix '+'
+	b64 := make([]byte, n)
+	u7enc.Encode(b64[1:], b)
+
+	// Strip padding
+	n -= 2 - (len(b)+2)%3
+	b64 = b64[:n]
+
+	// Add UTF-7 shifts
+	b64[0] = '+'
+	//b64[n-1] = '-'
+	return b64
+}
+
+// UTF7Decode converts a string from modified UTF-7 encoding to UTF-8.
+func UTF7Decode(u string) (s string, err error) {
+	b, err := UTF7DecodeBytes([]byte(u))
+	s = string(b)
+	return
+}
+
+// UTF7DecodeBytes converts a byte slice from modified UTF-7 encoding to UTF-8.
+func UTF7DecodeBytes(u []byte) ([]byte, error) {
+	input := bytes.NewReader([]byte(u))
+	reader := transform.NewReader(input, UTF7.NewDecoder())
+	output, err := ioutil.ReadAll(reader)
+	if err != nil {
+		return nil, err
+	}
+	return output, nil
+}
+
+// utf7dec extracts UTF-16-BE bytes from Base64 data and converts them to UTF-8.
+// A nil slice is returned if the encoding is invalid.
+func utf7dec(b64 []byte) []byte {
+	var b []byte
+
+	// Allocate a single block of memory large enough to store the Base64 data
+	// (if padding is required), UTF-16-BE bytes, and decoded UTF-8 bytes.
+	// Since a 2-byte UTF-16 sequence may expand into a 3-byte UTF-8 sequence,
+	// double the space allocation for UTF-8.
+	if n := len(b64); b64[n-1] == '=' {
+		return nil
+	} else if n&3 == 0 {
+		b = make([]byte, u7enc.DecodedLen(n)*3)
+	} else {
+		n += 4 - n&3
+		b = make([]byte, n+u7enc.DecodedLen(n)*3)
+		copy(b[copy(b, b64):n], []byte("=="))
+		b64, b = b[:n], b[n:]
+	}
+
+	// Decode Base64 into the first 1/3rd of b
+	n, err := u7enc.Decode(b, b64)
+	if err != nil || n&1 == 1 {
+		return nil
+	}
+
+	// Decode UTF-16-BE into the remaining 2/3rds of b
+	b, s := b[:n], b[n:]
+	j := 0
+	for i := 0; i < n; i += 2 {
+		r := rune(b[i])<<8 | rune(b[i+1])
+		if utf16.IsSurrogate(r) {
+			if i += 2; i == n {
+				//log.Println("surrogate error1!")
+				return nil
+			}
+			r2 := rune(b[i])<<8 | rune(b[i+1])
+			//log.Printf("surrogate! 0x%04X 0x%04X\n", r, r2)
+			if r = utf16.DecodeRune(r, r2); r == uRepl {
+				return nil
+			}
+		}
+		j += utf8.EncodeRune(s[j:], r)
+	}
+	return s[:j]
+}
+
+/*
+The following table shows the number of bytes required to encode each code point
+in the specified range using UTF-8 and UTF-16 representations:
+
++-----------------+-------+--------+
+| Code points     | UTF-8 | UTF-16 |
++-----------------+-------+--------+
+| 000000 - 00007F |   1   |   2    |
+| 000080 - 0007FF |   2   |   2    |
+| 000800 - 00FFFF |   3   |   2    |
+| 010000 - 10FFFF |   4   |   4    |
++-----------------+-------+--------+
+
+Source: http://en.wikipedia.org/wiki/Comparison_of_Unicode_encodings
+*/

vendor/github.com/emersion/go-msgauth/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2017 emersion
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

vendor/github.com/emersion/go-msgauth/dkim/canonical.go

@@ -0,0 +1,204 @@
+package dkim
+
+import (
+	"io"
+	"regexp"
+	"strings"
+)
+
+var rxReduceWS = regexp.MustCompile(`[ \t\r\n]+`)
+
+// Canonicalization is a canonicalization algorithm.
+type Canonicalization string
+
+const (
+	CanonicalizationSimple  Canonicalization = "simple"
+	CanonicalizationRelaxed                  = "relaxed"
+)
+
+type canonicalizer interface {
+	CanonicalizeHeader(s string) string
+	CanonicalizeBody(w io.Writer) io.WriteCloser
+}
+
+var canonicalizers = map[Canonicalization]canonicalizer{
+	CanonicalizationSimple:  new(simpleCanonicalizer),
+	CanonicalizationRelaxed: new(relaxedCanonicalizer),
+}
+
+// crlfFixer fixes any lone LF without a preceding CR.
+type crlfFixer struct {
+	cr bool
+}
+
+func (cf *crlfFixer) Fix(b []byte) []byte {
+	res := make([]byte, 0, len(b))
+	for _, ch := range b {
+		prevCR := cf.cr
+		cf.cr = false
+		switch ch {
+		case '\r':
+			cf.cr = true
+		case '\n':
+			if !prevCR {
+				res = append(res, '\r')
+			}
+		}
+		res = append(res, ch)
+	}
+	return res
+}
+
+type simpleCanonicalizer struct{}
+
+func (c *simpleCanonicalizer) CanonicalizeHeader(s string) string {
+	return s
+}
+
+type simpleBodyCanonicalizer struct {
+	w         io.Writer
+	crlfBuf   []byte
+	crlfFixer crlfFixer
+}
+
+func (c *simpleBodyCanonicalizer) Write(b []byte) (int, error) {
+	written := len(b)
+	b = append(c.crlfBuf, b...)
+
+	b = c.crlfFixer.Fix(b)
+
+	end := len(b)
+	// If it ends with \r, maybe the next write will begin with \n
+	if end > 0 && b[end-1] == '\r' {
+		end--
+	}
+	// Keep all \r\n sequences
+	for end >= 2 {
+		prev := b[end-2]
+		cur := b[end-1]
+		if prev != '\r' || cur != '\n' {
+			break
+		}
+		end -= 2
+	}
+
+	c.crlfBuf = b[end:]
+
+	var err error
+	if end > 0 {
+		_, err = c.w.Write(b[:end])
+	}
+	return written, err
+}
+
+func (c *simpleBodyCanonicalizer) Close() error {
+	// Flush crlfBuf if it ends with a single \r (without a matching \n)
+	if len(c.crlfBuf) > 0 && c.crlfBuf[len(c.crlfBuf)-1] == '\r' {
+		if _, err := c.w.Write(c.crlfBuf); err != nil {
+			return err
+		}
+	}
+	c.crlfBuf = nil
+
+	if _, err := c.w.Write([]byte(crlf)); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (c *simpleCanonicalizer) CanonicalizeBody(w io.Writer) io.WriteCloser {
+	return &simpleBodyCanonicalizer{w: w}
+}
+
+type relaxedCanonicalizer struct{}
+
+func (c *relaxedCanonicalizer) CanonicalizeHeader(s string) string {
+	kv := strings.SplitN(s, ":", 2)
+
+	k := strings.TrimSpace(strings.ToLower(kv[0]))
+
+	var v string
+	if len(kv) > 1 {
+		v = rxReduceWS.ReplaceAllString(kv[1], " ")
+		v = strings.TrimSpace(v)
+
+	}
+
+	return k + ":" + v + crlf
+}
+
+type relaxedBodyCanonicalizer struct {
+	w         io.Writer
+	crlfBuf   []byte
+	wsp       bool
+	written   bool
+	crlfFixer crlfFixer
+}
+
+func (c *relaxedBodyCanonicalizer) Write(b []byte) (int, error) {
+	written := len(b)
+
+	b = c.crlfFixer.Fix(b)
+
+	canonical := make([]byte, 0, len(b))
+	for _, ch := range b {
+		if ch == ' ' || ch == '\t' {
+			c.wsp = true
+		} else if ch == '\r' || ch == '\n' {
+			c.wsp = false
+			c.crlfBuf = append(c.crlfBuf, ch)
+		} else {
+			if len(c.crlfBuf) > 0 {
+				canonical = append(canonical, c.crlfBuf...)
+				c.crlfBuf = c.crlfBuf[:0]
+			}
+			if c.wsp {
+				canonical = append(canonical, ' ')
+				c.wsp = false
+			}
+
+			canonical = append(canonical, ch)
+		}
+	}
+
+	if !c.written && len(canonical) > 0 {
+		c.written = true
+	}
+
+	_, err := c.w.Write(canonical)
+	return written, err
+}
+
+func (c *relaxedBodyCanonicalizer) Close() error {
+	if c.written {
+		if _, err := c.w.Write([]byte(crlf)); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (c *relaxedCanonicalizer) CanonicalizeBody(w io.Writer) io.WriteCloser {
+	return &relaxedBodyCanonicalizer{w: w}
+}
+
+type limitedWriter struct {
+	W io.Writer
+	N int64
+}
+
+func (w *limitedWriter) Write(b []byte) (int, error) {
+	if w.N <= 0 {
+		return len(b), nil
+	}
+
+	skipped := 0
+	if int64(len(b)) > w.N {
+		b = b[:w.N]
+		skipped = int(int64(len(b)) - w.N)
+	}
+
+	n, err := w.W.Write(b)
+	w.N -= int64(n)
+	return n + skipped, err
+}

vendor/github.com/emersion/go-msgauth/dkim/dkim.go

@@ -0,0 +1,10 @@
+// Package dkim creates and verifies DKIM signatures, as specified in RFC 6376.
+package dkim
+
+import (
+	"time"
+)
+
+var now = time.Now
+
+const headerFieldName = "DKIM-Signature"

vendor/github.com/emersion/go-msgauth/dkim/header.go

@@ -0,0 +1,169 @@
+package dkim
+
+import (
+	"bufio"
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"net/textproto"
+	"sort"
+	"strings"
+)
+
+const crlf = "\r\n"
+
+type header []string
+
+func readHeader(r *bufio.Reader) (header, error) {
+	tr := textproto.NewReader(r)
+
+	var h header
+	for {
+		l, err := tr.ReadLine()
+		if err != nil {
+			return h, fmt.Errorf("failed to read header: %v", err)
+		}
+
+		if len(l) == 0 {
+			break
+		} else if len(h) > 0 && (l[0] == ' ' || l[0] == '\t') {
+			// This is a continuation line
+			h[len(h)-1] += l + crlf
+		} else {
+			h = append(h, l+crlf)
+		}
+	}
+
+	return h, nil
+}
+
+func writeHeader(w io.Writer, h header) error {
+	for _, kv := range h {
+		if _, err := w.Write([]byte(kv)); err != nil {
+			return err
+		}
+	}
+	_, err := w.Write([]byte(crlf))
+	return err
+}
+
+func foldHeaderField(kv string) string {
+	buf := bytes.NewBufferString(kv)
+
+	line := make([]byte, 75) // 78 - len("\r\n\s")
+	first := true
+	var fold strings.Builder
+	for len, err := buf.Read(line); err != io.EOF; len, err = buf.Read(line) {
+		if first {
+			first = false
+		} else {
+			fold.WriteString("\r\n ")
+		}
+		fold.Write(line[:len])
+	}
+
+	return fold.String() + crlf
+}
+
+func parseHeaderField(s string) (k string, v string) {
+	kv := strings.SplitN(s, ":", 2)
+	k = strings.TrimSpace(kv[0])
+	if len(kv) > 1 {
+		v = strings.TrimSpace(kv[1])
+	}
+	return
+}
+
+func parseHeaderParams(s string) (map[string]string, error) {
+	pairs := strings.Split(s, ";")
+	params := make(map[string]string)
+	for _, s := range pairs {
+		kv := strings.SplitN(s, "=", 2)
+		if len(kv) != 2 {
+			if strings.TrimSpace(s) == "" {
+				continue
+			}
+			return params, errors.New("dkim: malformed header params")
+		}
+
+		params[strings.TrimSpace(kv[0])] = strings.TrimSpace(kv[1])
+	}
+	return params, nil
+}
+
+func formatHeaderParams(headerFieldName string, params map[string]string) string {
+	keys, bvalue, bfound := sortParams(params)
+
+	s := headerFieldName + ":"
+	var line string
+
+	for _, k := range keys {
+		v := params[k]
+		nextLength := 3 + len(line) + len(v) + len(k)
+		if nextLength > 75 {
+			s += line + crlf
+			line = ""
+		}
+		line = fmt.Sprintf("%v %v=%v;", line, k, v)
+	}
+
+	if line != "" {
+		s += line
+	}
+
+	if bfound {
+		bfiled := foldHeaderField(" b=" + bvalue)
+		s += crlf + bfiled
+	}
+
+	return s
+}
+
+func sortParams(params map[string]string) ([]string, string, bool) {
+	keys := make([]string, 0, len(params))
+	bfound := false
+	var bvalue string
+	for k := range params {
+		if k == "b" {
+			bvalue = params["b"]
+			bfound = true
+		} else {
+			keys = append(keys, k)
+		}
+	}
+	sort.Strings(keys)
+	return keys, bvalue, bfound
+}
+
+type headerPicker struct {
+	h      header
+	picked map[string]int
+}
+
+func newHeaderPicker(h header) *headerPicker {
+	return &headerPicker{
+		h:      h,
+		picked: make(map[string]int),
+	}
+}
+
+func (p *headerPicker) Pick(key string) string {
+	at := p.picked[key]
+	for i := len(p.h) - 1; i >= 0; i-- {
+		kv := p.h[i]
+		k, _ := parseHeaderField(kv)
+
+		if !strings.EqualFold(k, key) {
+			continue
+		}
+
+		if at == 0 {
+			p.picked[key]++
+			return kv
+		}
+		at--
+	}
+
+	return ""
+}

vendor/github.com/emersion/go-msgauth/dkim/query.go

@@ -0,0 +1,177 @@
+package dkim
+
+import (
+	"crypto"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"net"
+	"strings"
+
+	"golang.org/x/crypto/ed25519"
+)
+
+type verifier interface {
+	Public() crypto.PublicKey
+	Verify(hash crypto.Hash, hashed []byte, sig []byte) error
+}
+
+type rsaVerifier struct {
+	*rsa.PublicKey
+}
+
+func (v rsaVerifier) Public() crypto.PublicKey {
+	return v.PublicKey
+}
+
+func (v rsaVerifier) Verify(hash crypto.Hash, hashed, sig []byte) error {
+	return rsa.VerifyPKCS1v15(v.PublicKey, hash, hashed, sig)
+}
+
+type ed25519Verifier struct {
+	ed25519.PublicKey
+}
+
+func (v ed25519Verifier) Public() crypto.PublicKey {
+	return v.PublicKey
+}
+
+func (v ed25519Verifier) Verify(hash crypto.Hash, hashed, sig []byte) error {
+	if !ed25519.Verify(v.PublicKey, hashed, sig) {
+		return errors.New("dkim: invalid Ed25519 signature")
+	}
+	return nil
+}
+
+type queryResult struct {
+	Verifier  verifier
+	KeyAlgo   string
+	HashAlgos []string
+	Notes     string
+	Services  []string
+	Flags     []string
+}
+
+// QueryMethod is a DKIM query method.
+type QueryMethod string
+
+const (
+	// DNS TXT resource record (RR) lookup algorithm
+	QueryMethodDNSTXT QueryMethod = "dns/txt"
+)
+
+type txtLookupFunc func(domain string) ([]string, error)
+type queryFunc func(domain, selector string, txtLookup txtLookupFunc) (*queryResult, error)
+
+var queryMethods = map[QueryMethod]queryFunc{
+	QueryMethodDNSTXT: queryDNSTXT,
+}
+
+func queryDNSTXT(domain, selector string, txtLookup txtLookupFunc) (*queryResult, error) {
+	var txts []string
+	var err error
+	if txtLookup != nil {
+		txts, err = txtLookup(selector + "._domainkey." + domain)
+	} else {
+		txts, err = net.LookupTXT(selector + "._domainkey." + domain)
+	}
+
+	if netErr, ok := err.(net.Error); ok && netErr.Temporary() {
+		return nil, tempFailError("key unavailable: " + err.Error())
+	} else if err != nil {
+		return nil, permFailError("no key for signature: " + err.Error())
+	}
+
+	// Long keys are split in multiple parts
+	txt := strings.Join(txts, "")
+
+	return parsePublicKey(txt)
+}
+
+func parsePublicKey(s string) (*queryResult, error) {
+	params, err := parseHeaderParams(s)
+	if err != nil {
+		return nil, permFailError("key syntax error: " + err.Error())
+	}
+
+	res := new(queryResult)
+
+	if v, ok := params["v"]; ok && v != "DKIM1" {
+		return nil, permFailError("incompatible public key version")
+	}
+
+	p, ok := params["p"]
+	if !ok {
+		return nil, permFailError("key syntax error: missing public key data")
+	}
+	if p == "" {
+		return nil, permFailError("key revoked")
+	}
+	p = strings.ReplaceAll(p, " ", "")
+	b, err := base64.StdEncoding.DecodeString(p)
+	if err != nil {
+		return nil, permFailError("key syntax error: " + err.Error())
+	}
+	switch params["k"] {
+	case "rsa", "":
+		pub, err := x509.ParsePKIXPublicKey(b)
+		if err != nil {
+			// RFC 6376 is inconsistent about whether RSA public keys should
+			// be formatted as RSAPublicKey or SubjectPublicKeyInfo.
+			// Erratum 3017 (https://www.rfc-editor.org/errata/eid3017) proposes
+			// allowing both.
+			pub, err = x509.ParsePKCS1PublicKey(b)
+			if err != nil {
+				return nil, permFailError("key syntax error: " + err.Error())
+			}
+		}
+		rsaPub, ok := pub.(*rsa.PublicKey)
+		if !ok {
+			return nil, permFailError("key syntax error: not an RSA public key")
+		}
+		// RFC 8301 section 3.2: verifiers MUST NOT consider signatures using
+		// RSA keys of less than 1024 bits as valid signatures.
+		if rsaPub.Size()*8 < 1024 {
+			return nil, permFailError(fmt.Sprintf("key is too short: want 1024 bits, has %v bits", rsaPub.Size()*8))
+		}
+		res.Verifier = rsaVerifier{rsaPub}
+		res.KeyAlgo = "rsa"
+	case "ed25519":
+		if len(b) != ed25519.PublicKeySize {
+			return nil, permFailError(fmt.Sprintf("invalid Ed25519 public key size: %v bytes", len(b)))
+		}
+		ed25519Pub := ed25519.PublicKey(b)
+		res.Verifier = ed25519Verifier{ed25519Pub}
+		res.KeyAlgo = "ed25519"
+	default:
+		return nil, permFailError("unsupported key algorithm")
+	}
+
+	if hashesStr, ok := params["h"]; ok {
+		res.HashAlgos = parseTagList(hashesStr)
+	}
+	if notes, ok := params["n"]; ok {
+		res.Notes = notes
+	}
+	if servicesStr, ok := params["s"]; ok {
+		services := parseTagList(servicesStr)
+
+		hasWildcard := false
+		for _, s := range services {
+			if s == "*" {
+				hasWildcard = true
+				break
+			}
+		}
+		if !hasWildcard {
+			res.Services = services
+		}
+	}
+	if flagsStr, ok := params["t"]; ok {
+		res.Flags = parseTagList(flagsStr)
+	}
+
+	return res, nil
+}

vendor/github.com/emersion/go-msgauth/dkim/sign.go

@@ -0,0 +1,346 @@
+package dkim
+
+import (
+	"bufio"
+	"bytes"
+	"crypto"
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/base64"
+	"fmt"
+	"io"
+	"strconv"
+	"strings"
+	"time"
+
+	"golang.org/x/crypto/ed25519"
+)
+
+var randReader io.Reader = rand.Reader
+
+// SignOptions is used to configure Sign. Domain, Selector and Signer are
+// mandatory.
+type SignOptions struct {
+	// The SDID claiming responsibility for an introduction of a message into the
+	// mail stream. Hence, the SDID value is used to form the query for the public
+	// key. The SDID MUST correspond to a valid DNS name under which the DKIM key
+	// record is published.
+	//
+	// This can't be empty.
+	Domain string
+	// The selector subdividing the namespace for the domain.
+	//
+	// This can't be empty.
+	Selector string
+	// The Agent or User Identifier (AUID) on behalf of which the SDID is taking
+	// responsibility.
+	//
+	// This is optional.
+	Identifier string
+
+	// The key used to sign the message.
+	//
+	// Supported Signer.Public() values are *rsa.PublicKey and
+	// ed25519.PublicKey.
+	Signer crypto.Signer
+	// The hash algorithm used to sign the message. If zero, a default hash will
+	// be chosen.
+	//
+	// The only supported hash algorithm is crypto.SHA256.
+	Hash crypto.Hash
+
+	// Header and body canonicalization algorithms.
+	//
+	// If empty, CanonicalizationSimple is used.
+	HeaderCanonicalization Canonicalization
+	BodyCanonicalization   Canonicalization
+
+	// A list of header fields to include in the signature. If nil, all headers
+	// will be included. If not nil, "From" MUST be in the list.
+	//
+	// See RFC 6376 section 5.4.1 for recommended header fields.
+	HeaderKeys []string
+
+	// The expiration time. A zero value means no expiration.
+	Expiration time.Time
+
+	// A list of query methods used to retrieve the public key.
+	//
+	// If nil, it is implicitly defined as QueryMethodDNSTXT.
+	QueryMethods []QueryMethod
+}
+
+// Signer generates a DKIM signature.
+//
+// The whole message header and body must be written to the Signer. Close should
+// always be called (either after the whole message has been written, or after
+// an error occured and the signer won't be used anymore). Close may return an
+// error in case signing fails.
+//
+// After a successful Close, Signature can be called to retrieve the
+// DKIM-Signature header field that the caller should prepend to the message.
+type Signer struct {
+	pw        *io.PipeWriter
+	done      <-chan error
+	sigParams map[string]string // only valid after done received nil
+}
+
+// NewSigner creates a new signer. It returns an error if SignOptions is
+// invalid.
+func NewSigner(options *SignOptions) (*Signer, error) {
+	if options == nil {
+		return nil, fmt.Errorf("dkim: no options specified")
+	}
+	if options.Domain == "" {
+		return nil, fmt.Errorf("dkim: no domain specified")
+	}
+	if options.Selector == "" {
+		return nil, fmt.Errorf("dkim: no selector specified")
+	}
+	if options.Signer == nil {
+		return nil, fmt.Errorf("dkim: no signer specified")
+	}
+
+	headerCan := options.HeaderCanonicalization
+	if headerCan == "" {
+		headerCan = CanonicalizationSimple
+	}
+	if _, ok := canonicalizers[headerCan]; !ok {
+		return nil, fmt.Errorf("dkim: unknown header canonicalization %q", headerCan)
+	}
+
+	bodyCan := options.BodyCanonicalization
+	if bodyCan == "" {
+		bodyCan = CanonicalizationSimple
+	}
+	if _, ok := canonicalizers[bodyCan]; !ok {
+		return nil, fmt.Errorf("dkim: unknown body canonicalization %q", bodyCan)
+	}
+
+	var keyAlgo string
+	switch options.Signer.Public().(type) {
+	case *rsa.PublicKey:
+		keyAlgo = "rsa"
+	case ed25519.PublicKey:
+		keyAlgo = "ed25519"
+	default:
+		return nil, fmt.Errorf("dkim: unsupported key algorithm %T", options.Signer.Public())
+	}
+
+	hash := options.Hash
+	var hashAlgo string
+	switch options.Hash {
+	case 0: // sha256 is the default
+		hash = crypto.SHA256
+		fallthrough
+	case crypto.SHA256:
+		hashAlgo = "sha256"
+	case crypto.SHA1:
+		return nil, fmt.Errorf("dkim: hash algorithm too weak: sha1")
+	default:
+		return nil, fmt.Errorf("dkim: unsupported hash algorithm")
+	}
+
+	if options.HeaderKeys != nil {
+		ok := false
+		for _, k := range options.HeaderKeys {
+			if strings.EqualFold(k, "From") {
+				ok = true
+				break
+			}
+		}
+		if !ok {
+			return nil, fmt.Errorf("dkim: the From header field must be signed")
+		}
+	}
+
+	done := make(chan error, 1)
+	pr, pw := io.Pipe()
+
+	s := &Signer{
+		pw:   pw,
+		done: done,
+	}
+
+	closeReadWithError := func(err error) {
+		pr.CloseWithError(err)
+		done <- err
+	}
+
+	go func() {
+		defer close(done)
+
+		// Read header
+		br := bufio.NewReader(pr)
+		h, err := readHeader(br)
+		if err != nil {
+			closeReadWithError(err)
+			return
+		}
+
+		// Hash body
+		hasher := hash.New()
+		can := canonicalizers[bodyCan].CanonicalizeBody(hasher)
+		if _, err := io.Copy(can, br); err != nil {
+			closeReadWithError(err)
+			return
+		}
+		if err := can.Close(); err != nil {
+			closeReadWithError(err)
+			return
+		}
+		bodyHashed := hasher.Sum(nil)
+
+		params := map[string]string{
+			"v":  "1",
+			"a":  keyAlgo + "-" + hashAlgo,
+			"bh": base64.StdEncoding.EncodeToString(bodyHashed),
+			"c":  string(headerCan) + "/" + string(bodyCan),
+			"d":  options.Domain,
+			//"l": "", // TODO
+			"s": options.Selector,
+			"t": formatTime(now()),
+			//"z": "", // TODO
+		}
+
+		var headerKeys []string
+		if options.HeaderKeys != nil {
+			headerKeys = options.HeaderKeys
+		} else {
+			for _, kv := range h {
+				k, _ := parseHeaderField(kv)
+				headerKeys = append(headerKeys, k)
+			}
+		}
+		params["h"] = formatTagList(headerKeys)
+
+		if options.Identifier != "" {
+			params["i"] = options.Identifier
+		}
+
+		if options.QueryMethods != nil {
+			methods := make([]string, len(options.QueryMethods))
+			for i, method := range options.QueryMethods {
+				methods[i] = string(method)
+			}
+			params["q"] = formatTagList(methods)
+		}
+
+		if !options.Expiration.IsZero() {
+			params["x"] = formatTime(options.Expiration)
+		}
+
+		// Hash and sign headers
+		hasher.Reset()
+		picker := newHeaderPicker(h)
+		for _, k := range headerKeys {
+			kv := picker.Pick(k)
+			if kv == "" {
+				// The Signer MAY include more instances of a header field name
+				// in "h=" than there are actual corresponding header fields so
+				// that the signature will not verify if additional header
+				// fields of that name are added.
+				continue
+			}
+
+			kv = canonicalizers[headerCan].CanonicalizeHeader(kv)
+			if _, err := io.WriteString(hasher, kv); err != nil {
+				closeReadWithError(err)
+				return
+			}
+		}
+
+		params["b"] = ""
+		sigField := formatSignature(params)
+		sigField = canonicalizers[headerCan].CanonicalizeHeader(sigField)
+		sigField = strings.TrimRight(sigField, crlf)
+		if _, err := io.WriteString(hasher, sigField); err != nil {
+			closeReadWithError(err)
+			return
+		}
+		hashed := hasher.Sum(nil)
+
+		// Don't pass Hash to Sign for ed25519 as it doesn't support it
+		// and will return an error ("ed25519: cannot sign hashed message").
+		if keyAlgo == "ed25519" {
+			hash = crypto.Hash(0)
+		}
+
+		sig, err := options.Signer.Sign(randReader, hashed, hash)
+		if err != nil {
+			closeReadWithError(err)
+			return
+		}
+		params["b"] = base64.StdEncoding.EncodeToString(sig)
+
+		s.sigParams = params
+		closeReadWithError(nil)
+	}()
+
+	return s, nil
+}
+
+// Write implements io.WriteCloser.
+func (s *Signer) Write(b []byte) (n int, err error) {
+	return s.pw.Write(b)
+}
+
+// Close implements io.WriteCloser. The error return by Close must be checked.
+func (s *Signer) Close() error {
+	if err := s.pw.Close(); err != nil {
+		return err
+	}
+	return <-s.done
+}
+
+// Signature returns the whole DKIM-Signature header field. It can only be
+// called after a successful Signer.Close call.
+//
+// The returned value contains both the header field name, its value and the
+// final CRLF.
+func (s *Signer) Signature() string {
+	if s.sigParams == nil {
+		panic("dkim: Signer.Signature must only be called after a succesful Signer.Close")
+	}
+	return formatSignature(s.sigParams)
+}
+
+// Sign signs a message. It reads it from r and writes the signed version to w.
+func Sign(w io.Writer, r io.Reader, options *SignOptions) error {
+	s, err := NewSigner(options)
+	if err != nil {
+		return err
+	}
+	defer s.Close()
+
+	// We need to keep the message in a buffer so we can write the new DKIM
+	// header field before the rest of the message
+	var b bytes.Buffer
+	mw := io.MultiWriter(&b, s)
+
+	if _, err := io.Copy(mw, r); err != nil {
+		return err
+	}
+	if err := s.Close(); err != nil {
+		return err
+	}
+
+	if _, err := io.WriteString(w, s.Signature()); err != nil {
+		return err
+	}
+	_, err = io.Copy(w, &b)
+	return err
+}
+
+func formatSignature(params map[string]string) string {
+	sig := formatHeaderParams(headerFieldName, params)
+	return sig
+}
+
+func formatTagList(l []string) string {
+	return strings.Join(l, ":")
+}
+
+func formatTime(t time.Time) string {
+	return strconv.FormatInt(t.Unix(), 10)
+}

vendor/github.com/emersion/go-msgauth/dkim/verify.go

@@ -0,0 +1,462 @@
+package dkim
+
+import (
+	"bufio"
+	"crypto"
+	"crypto/subtle"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+	"unicode"
+)
+
+type permFailError string
+
+func (err permFailError) Error() string {
+	return "dkim: " + string(err)
+}
+
+// IsPermFail returns true if the error returned by Verify is a permanent
+// failure. A permanent failure is for instance a missing required field or a
+// malformed header.
+func IsPermFail(err error) bool {
+	_, ok := err.(permFailError)
+	return ok
+}
+
+type tempFailError string
+
+func (err tempFailError) Error() string {
+	return "dkim: " + string(err)
+}
+
+// IsTempFail returns true if the error returned by Verify is a temporary
+// failure.
+func IsTempFail(err error) bool {
+	_, ok := err.(tempFailError)
+	return ok
+}
+
+type failError string
+
+func (err failError) Error() string {
+	return "dkim: " + string(err)
+}
+
+// isFail returns true if the error returned by Verify is a signature error.
+func isFail(err error) bool {
+	_, ok := err.(failError)
+	return ok
+}
+
+// ErrTooManySignatures is returned by Verify when the message exceeds the
+// maximum number of signatures.
+var ErrTooManySignatures = errors.New("dkim: too many signatures")
+
+var requiredTags = []string{"v", "a", "b", "bh", "d", "h", "s"}
+
+// A Verification is produced by Verify when it checks if one signature is
+// valid. If the signature is valid, Err is nil.
+type Verification struct {
+	// The SDID claiming responsibility for an introduction of a message into the
+	// mail stream.
+	Domain string
+	// The Agent or User Identifier (AUID) on behalf of which the SDID is taking
+	// responsibility.
+	Identifier string
+
+	// The list of signed header fields.
+	HeaderKeys []string
+
+	// The time that this signature was created. If unknown, it's set to zero.
+	Time time.Time
+	// The expiration time. If the signature doesn't expire, it's set to zero.
+	Expiration time.Time
+
+	// Err is nil if the signature is valid.
+	Err error
+}
+
+type signature struct {
+	i int
+	v string
+}
+
+// VerifyOptions allows to customize the default signature verification
+// behavior.
+type VerifyOptions struct {
+	// LookupTXT returns the DNS TXT records for the given domain name. If nil,
+	// net.LookupTXT is used.
+	LookupTXT func(domain string) ([]string, error)
+	// MaxVerifications controls the maximum number of signature verifications
+	// to perform. If more signatures are present, the first MaxVerifications
+	// signatures are verified, the rest are ignored and ErrTooManySignatures
+	// is returned. If zero, there is no maximum.
+	MaxVerifications int
+}
+
+// Verify checks if a message's signatures are valid. It returns one
+// verification per signature.
+//
+// There is no guarantee that the reader will be completely consumed.
+func Verify(r io.Reader) ([]*Verification, error) {
+	return VerifyWithOptions(r, nil)
+}
+
+// VerifyWithOptions performs the same task as Verify, but allows specifying
+// verification options.
+func VerifyWithOptions(r io.Reader, options *VerifyOptions) ([]*Verification, error) {
+	// Read header
+	bufr := bufio.NewReader(r)
+	h, err := readHeader(bufr)
+	if err != nil {
+		return nil, err
+	}
+
+	// Scan header fields for signatures
+	var signatures []*signature
+	for i, kv := range h {
+		k, v := parseHeaderField(kv)
+		if strings.EqualFold(k, headerFieldName) {
+			signatures = append(signatures, &signature{i, v})
+		}
+	}
+
+	tooManySignatures := false
+	if options != nil && options.MaxVerifications > 0 && len(signatures) > options.MaxVerifications {
+		tooManySignatures = true
+		signatures = signatures[:options.MaxVerifications]
+	}
+
+	var verifs []*Verification
+	if len(signatures) == 1 {
+		// If there is only one signature - just verify it.
+		v, err := verify(h, bufr, h[signatures[0].i], signatures[0].v, options)
+		if err != nil && !IsTempFail(err) && !IsPermFail(err) && !isFail(err) {
+			return nil, err
+		}
+		v.Err = err
+		verifs = []*Verification{v}
+	} else {
+		verifs, err = parallelVerify(bufr, h, signatures, options)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	if tooManySignatures {
+		return verifs, ErrTooManySignatures
+	}
+	return verifs, nil
+}
+
+func parallelVerify(r io.Reader, h header, signatures []*signature, options *VerifyOptions) ([]*Verification, error) {
+	pipeWriters := make([]*io.PipeWriter, len(signatures))
+	// We can't pass pipeWriter to io.MultiWriter directly,
+	// we need a slice of io.Writer, but we also need *io.PipeWriter
+	// to call Close on it.
+	writers := make([]io.Writer, len(signatures))
+	chans := make([]chan *Verification, len(signatures))
+
+	for i, sig := range signatures {
+		// Be careful with loop variables and goroutines.
+		i, sig := i, sig
+
+		chans[i] = make(chan *Verification, 1)
+
+		pr, pw := io.Pipe()
+		writers[i] = pw
+		pipeWriters[i] = pw
+
+		go func() {
+			v, err := verify(h, pr, h[sig.i], sig.v, options)
+
+			// Make sure we consume the whole reader, otherwise io.Copy on
+			// other side can block forever.
+			io.Copy(ioutil.Discard, pr)
+
+			v.Err = err
+			chans[i] <- v
+		}()
+	}
+
+	if _, err := io.Copy(io.MultiWriter(writers...), r); err != nil {
+		return nil, err
+	}
+	for _, wr := range pipeWriters {
+		wr.Close()
+	}
+
+	verifications := make([]*Verification, len(signatures))
+	for i, ch := range chans {
+		verifications[i] = <-ch
+	}
+
+	// Return unexpected failures as a separate error.
+	for _, v := range verifications {
+		err := v.Err
+		if err != nil && !IsTempFail(err) && !IsPermFail(err) && !isFail(err) {
+			v.Err = nil
+			return verifications, err
+		}
+	}
+	return verifications, nil
+}
+
+func verify(h header, r io.Reader, sigField, sigValue string, options *VerifyOptions) (*Verification, error) {
+	verif := new(Verification)
+
+	params, err := parseHeaderParams(sigValue)
+	if err != nil {
+		return verif, permFailError("malformed signature tags: " + err.Error())
+	}
+
+	if params["v"] != "1" {
+		return verif, permFailError("incompatible signature version")
+	}
+
+	verif.Domain = stripWhitespace(params["d"])
+
+	for _, tag := range requiredTags {
+		if _, ok := params[tag]; !ok {
+			return verif, permFailError("signature missing required tag")
+		}
+	}
+
+	if i, ok := params["i"]; ok {
+		verif.Identifier = stripWhitespace(i)
+		if !strings.HasSuffix(verif.Identifier, "@"+verif.Domain) && !strings.HasSuffix(verif.Identifier, "."+verif.Domain) {
+			return verif, permFailError("domain mismatch")
+		}
+	} else {
+		verif.Identifier = "@" + verif.Domain
+	}
+
+	headerKeys := parseTagList(params["h"])
+	ok := false
+	for _, k := range headerKeys {
+		if strings.EqualFold(k, "from") {
+			ok = true
+			break
+		}
+	}
+	if !ok {
+		return verif, permFailError("From field not signed")
+	}
+	verif.HeaderKeys = headerKeys
+
+	if timeStr, ok := params["t"]; ok {
+		t, err := parseTime(timeStr)
+		if err != nil {
+			return verif, permFailError("malformed time: " + err.Error())
+		}
+		verif.Time = t
+	}
+	if expiresStr, ok := params["x"]; ok {
+		t, err := parseTime(expiresStr)
+		if err != nil {
+			return verif, permFailError("malformed expiration time: " + err.Error())
+		}
+		verif.Expiration = t
+		if now().After(t) {
+			return verif, permFailError("signature has expired")
+		}
+	}
+
+	// Query public key
+	// TODO: compute hash in parallel
+	methods := []string{string(QueryMethodDNSTXT)}
+	if methodsStr, ok := params["q"]; ok {
+		methods = parseTagList(methodsStr)
+	}
+	var res *queryResult
+	for _, method := range methods {
+		if query, ok := queryMethods[QueryMethod(method)]; ok {
+			if options != nil {
+				res, err = query(verif.Domain, stripWhitespace(params["s"]), options.LookupTXT)
+			} else {
+				res, err = query(verif.Domain, stripWhitespace(params["s"]), nil)
+			}
+			break
+		}
+	}
+	if err != nil {
+		return verif, err
+	} else if res == nil {
+		return verif, permFailError("unsupported public key query method")
+	}
+
+	// Parse algos
+	algos := strings.SplitN(stripWhitespace(params["a"]), "-", 2)
+	if len(algos) != 2 {
+		return verif, permFailError("malformed algorithm name")
+	}
+	keyAlgo := algos[0]
+	hashAlgo := algos[1]
+
+	// Check hash algo
+	if res.HashAlgos != nil {
+		ok := false
+		for _, algo := range res.HashAlgos {
+			if algo == hashAlgo {
+				ok = true
+				break
+			}
+		}
+		if !ok {
+			return verif, permFailError("inappropriate hash algorithm")
+		}
+	}
+	var hash crypto.Hash
+	switch hashAlgo {
+	case "sha1":
+		// RFC 8301 section 3.1: rsa-sha1 MUST NOT be used for signing or
+		// verifying.
+		return verif, permFailError(fmt.Sprintf("hash algorithm too weak: %v", hashAlgo))
+	case "sha256":
+		hash = crypto.SHA256
+	default:
+		return verif, permFailError("unsupported hash algorithm")
+	}
+
+	// Check key algo
+	if res.KeyAlgo != keyAlgo {
+		return verif, permFailError("inappropriate key algorithm")
+	}
+
+	if res.Services != nil {
+		ok := false
+		for _, s := range res.Services {
+			if s == "email" {
+				ok = true
+				break
+			}
+		}
+		if !ok {
+			return verif, permFailError("inappropriate service")
+		}
+	}
+
+	headerCan, bodyCan := parseCanonicalization(params["c"])
+	if _, ok := canonicalizers[headerCan]; !ok {
+		return verif, permFailError("unsupported header canonicalization algorithm")
+	}
+	if _, ok := canonicalizers[bodyCan]; !ok {
+		return verif, permFailError("unsupported body canonicalization algorithm")
+	}
+
+	// The body length "l" parameter is insecure, because it allows parts of
+	// the message body to not be signed. Reject messages which have it set.
+	if _, ok := params["l"]; ok {
+		// TODO: technically should be policyError
+		return verif, failError("message contains an insecure body length tag")
+	}
+
+	// Parse body hash and signature
+	bodyHashed, err := decodeBase64String(params["bh"])
+	if err != nil {
+		return verif, permFailError("malformed body hash: " + err.Error())
+	}
+	sig, err := decodeBase64String(params["b"])
+	if err != nil {
+		return verif, permFailError("malformed signature: " + err.Error())
+	}
+
+	// Check body hash
+	hasher := hash.New()
+	wc := canonicalizers[bodyCan].CanonicalizeBody(hasher)
+	if _, err := io.Copy(wc, r); err != nil {
+		return verif, err
+	}
+	if err := wc.Close(); err != nil {
+		return verif, err
+	}
+	if subtle.ConstantTimeCompare(hasher.Sum(nil), bodyHashed) != 1 {
+		return verif, failError("body hash did not verify")
+	}
+
+	// Compute data hash
+	hasher.Reset()
+	picker := newHeaderPicker(h)
+	for _, key := range headerKeys {
+		kv := picker.Pick(key)
+		if kv == "" {
+			// The field MAY contain names of header fields that do not exist
+			// when signed; nonexistent header fields do not contribute to the
+			// signature computation
+			continue
+		}
+
+		kv = canonicalizers[headerCan].CanonicalizeHeader(kv)
+		if _, err := hasher.Write([]byte(kv)); err != nil {
+			return verif, err
+		}
+	}
+	canSigField := removeSignature(sigField)
+	canSigField = canonicalizers[headerCan].CanonicalizeHeader(canSigField)
+	canSigField = strings.TrimRight(canSigField, "\r\n")
+	if _, err := hasher.Write([]byte(canSigField)); err != nil {
+		return verif, err
+	}
+	hashed := hasher.Sum(nil)
+
+	// Check signature
+	if err := res.Verifier.Verify(hash, hashed, sig); err != nil {
+		return verif, failError("signature did not verify: " + err.Error())
+	}
+
+	return verif, nil
+}
+
+func parseTagList(s string) []string {
+	tags := strings.Split(s, ":")
+	for i, t := range tags {
+		tags[i] = stripWhitespace(t)
+	}
+	return tags
+}
+
+func parseCanonicalization(s string) (headerCan, bodyCan Canonicalization) {
+	headerCan = CanonicalizationSimple
+	bodyCan = CanonicalizationSimple
+
+	cans := strings.SplitN(stripWhitespace(s), "/", 2)
+	if cans[0] != "" {
+		headerCan = Canonicalization(cans[0])
+	}
+	if len(cans) > 1 {
+		bodyCan = Canonicalization(cans[1])
+	}
+	return
+}
+
+func parseTime(s string) (time.Time, error) {
+	sec, err := strconv.ParseInt(stripWhitespace(s), 10, 64)
+	if err != nil {
+		return time.Time{}, err
+	}
+	return time.Unix(sec, 0), nil
+}
+
+func decodeBase64String(s string) ([]byte, error) {
+	return base64.StdEncoding.DecodeString(stripWhitespace(s))
+}
+
+func stripWhitespace(s string) string {
+	return strings.Map(func(r rune) rune {
+		if unicode.IsSpace(r) {
+			return -1
+		}
+		return r
+	}, s)
+}
+
+func removeSignature(s string) string {
+	return regexp.MustCompile(`(b\s*=)[^;]+`).ReplaceAllString(s, "$1")
+}

vendor/github.com/emersion/go-sasl/.build.yml

@@ -0,0 +1,19 @@
+image: alpine/latest
+packages:
+  - go
+  # Required by codecov
+  - bash
+  - findutils
+sources:
+  - https://github.com/emersion/go-sasl
+tasks:
+  - build: |
+      cd go-sasl
+      go build -v ./...
+  - test: |
+      cd go-sasl
+      go test -coverprofile=coverage.txt -covermode=atomic ./...
+  - upload-coverage: |
+      cd go-sasl
+      export CODECOV_TOKEN=3f257f71-a128-4834-8f68-2b534e9f4cb1
+      curl -s https://codecov.io/bash | bash

vendor/github.com/emersion/go-sasl/.gitignore

@@ -0,0 +1,24 @@
+# Compiled Object files, Static and Dynamic libs (Shared Objects)
+*.o
+*.a
+*.so
+
+# Folders
+_obj
+_test
+
+# Architecture specific extensions/prefixes
+*.[568vq]
+[568vq].out
+
+*.cgo1.go
+*.cgo2.c
+_cgo_defun.c
+_cgo_gotypes.go
+_cgo_export.*
+
+_testmain.go
+
+*.exe
+*.test
+*.prof

vendor/github.com/emersion/go-sasl/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2016 emersion
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

vendor/github.com/emersion/go-sasl/README.md

@@ -0,0 +1,17 @@
+# go-sasl
+
+[![GoDoc](https://godoc.org/github.com/emersion/go-sasl?status.svg)](https://godoc.org/github.com/emersion/go-sasl)
+[![Build Status](https://travis-ci.org/emersion/go-sasl.svg?branch=master)](https://travis-ci.org/emersion/go-sasl)
+
+A [SASL](https://tools.ietf.org/html/rfc4422) library written in Go.
+
+Implemented mechanisms:
+* [ANONYMOUS](https://tools.ietf.org/html/rfc4505)
+* [EXTERNAL](https://tools.ietf.org/html/rfc4422#appendix-A)
+* [LOGIN](https://tools.ietf.org/html/draft-murchison-sasl-login-00) (obsolete, use PLAIN instead)
+* [PLAIN](https://tools.ietf.org/html/rfc4616)
+* [OAUTHBEARER](https://tools.ietf.org/html/rfc7628)
+
+## License
+
+MIT

vendor/github.com/emersion/go-sasl/anonymous.go

@@ -0,0 +1,56 @@
+package sasl
+
+// The ANONYMOUS mechanism name.
+const Anonymous = "ANONYMOUS"
+
+type anonymousClient struct {
+	Trace string
+}
+
+func (c *anonymousClient) Start() (mech string, ir []byte, err error) {
+	mech = Anonymous
+	ir = []byte(c.Trace)
+	return
+}
+
+func (c *anonymousClient) Next(challenge []byte) (response []byte, err error) {
+	return nil, ErrUnexpectedServerChallenge
+}
+
+// A client implementation of the ANONYMOUS authentication mechanism, as
+// described in RFC 4505.
+func NewAnonymousClient(trace string) Client {
+	return &anonymousClient{trace}
+}
+
+// Get trace information from clients logging in anonymously.
+type AnonymousAuthenticator func(trace string) error
+
+type anonymousServer struct {
+	done bool
+	authenticate AnonymousAuthenticator
+}
+
+func (s *anonymousServer) Next(response []byte) (challenge []byte, done bool, err error) {
+	if s.done {
+		err = ErrUnexpectedClientResponse
+		return
+	}
+
+	// No initial response, send an empty challenge
+	if response == nil {
+		return []byte{}, false, nil
+	}
+
+	s.done = true
+
+	err = s.authenticate(string(response))
+	done = true
+	return
+}
+
+// A server implementation of the ANONYMOUS authentication mechanism, as
+// described in RFC 4505.
+func NewAnonymousServer(authenticator AnonymousAuthenticator) Server {
+	return &anonymousServer{authenticate: authenticator}
+}

vendor/github.com/emersion/go-sasl/external.go

@@ -0,0 +1,26 @@
+package sasl
+
+// The EXTERNAL mechanism name.
+const External = "EXTERNAL"
+
+type externalClient struct {
+	Identity string
+}
+
+func (a *externalClient) Start() (mech string, ir []byte, err error) {
+	mech = External
+	ir = []byte(a.Identity)
+	return
+}
+
+func (a *externalClient) Next(challenge []byte) (response []byte, err error) {
+	return nil, ErrUnexpectedServerChallenge
+}
+
+// An implementation of the EXTERNAL authentication mechanism, as described in
+// RFC 4422. Authorization identity may be left blank to indicate that the
+// client is requesting to act as the identity associated with the
+// authentication credentials.
+func NewExternalClient(identity string) Client {
+	return &externalClient{identity}
+}

vendor/github.com/emersion/go-sasl/login.go

@@ -0,0 +1,89 @@
+package sasl
+
+import (
+	"bytes"
+)
+
+// The LOGIN mechanism name.
+const Login = "LOGIN"
+
+var expectedChallenge = []byte("Password:")
+
+type loginClient struct {
+	Username string
+	Password string
+}
+
+func (a *loginClient) Start() (mech string, ir []byte, err error) {
+	mech = "LOGIN"
+	ir = []byte(a.Username)
+	return
+}
+
+func (a *loginClient) Next(challenge []byte) (response []byte, err error) {
+	if bytes.Compare(challenge, expectedChallenge) != 0 {
+		return nil, ErrUnexpectedServerChallenge
+	} else {
+		return []byte(a.Password), nil
+	}
+}
+
+// A client implementation of the LOGIN authentication mechanism for SMTP,
+// as described in http://www.iana.org/go/draft-murchison-sasl-login
+//
+// It is considered obsolete, and should not be used when other mechanisms are
+// available. For plaintext password authentication use PLAIN mechanism.
+func NewLoginClient(username, password string) Client {
+	return &loginClient{username, password}
+}
+
+// Authenticates users with an username and a password.
+type LoginAuthenticator func(username, password string) error
+
+type loginState int
+
+const (
+	loginNotStarted loginState = iota
+	loginWaitingUsername
+	loginWaitingPassword
+)
+
+type loginServer struct {
+	state              loginState
+	username, password string
+	authenticate       LoginAuthenticator
+}
+
+// A server implementation of the LOGIN authentication mechanism, as described
+// in https://tools.ietf.org/html/draft-murchison-sasl-login-00.
+//
+// LOGIN is obsolete and should only be enabled for legacy clients that cannot
+// be updated to use PLAIN.
+func NewLoginServer(authenticator LoginAuthenticator) Server {
+	return &loginServer{authenticate: authenticator}
+}
+
+func (a *loginServer) Next(response []byte) (challenge []byte, done bool, err error) {
+	switch a.state {
+	case loginNotStarted:
+		// Check for initial response field, as per RFC4422 section 3
+		if response == nil {
+			challenge = []byte("Username:")
+			break
+		}
+		a.state++
+		fallthrough
+	case loginWaitingUsername:
+		a.username = string(response)
+		challenge = []byte("Password:")
+	case loginWaitingPassword:
+		a.password = string(response)
+		err = a.authenticate(a.username, a.password)
+		done = true
+	default:
+		err = ErrUnexpectedClientResponse
+	}
+
+	a.state++
+	return
+}

vendor/github.com/emersion/go-sasl/oauthbearer.go

@@ -0,0 +1,191 @@
+package sasl
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+// The OAUTHBEARER mechanism name.
+const OAuthBearer = "OAUTHBEARER"
+
+type OAuthBearerError struct {
+	Status  string `json:"status"`
+	Schemes string `json:"schemes"`
+	Scope   string `json:"scope"`
+}
+
+type OAuthBearerOptions struct {
+	Username string
+	Token    string
+	Host     string
+	Port     int
+}
+
+// Implements error
+func (err *OAuthBearerError) Error() string {
+	return fmt.Sprintf("OAUTHBEARER authentication error (%v)", err.Status)
+}
+
+type oauthBearerClient struct {
+	OAuthBearerOptions
+}
+
+func (a *oauthBearerClient) Start() (mech string, ir []byte, err error) {
+	mech = OAuthBearer
+	var str = "n,a=" + a.Username + ","
+
+	if a.Host != "" {
+		str += "\x01host=" + a.Host
+	}
+
+	if a.Port != 0 {
+		str += "\x01port=" + strconv.Itoa(a.Port)
+	}
+	str += "\x01auth=Bearer " + a.Token + "\x01\x01"
+	ir = []byte(str)
+	return
+}
+
+func (a *oauthBearerClient) Next(challenge []byte) ([]byte, error) {
+	authBearerErr := &OAuthBearerError{}
+	if err := json.Unmarshal(challenge, authBearerErr); err != nil {
+		return nil, err
+	} else {
+		return nil, authBearerErr
+	}
+}
+
+// An implementation of the OAUTHBEARER authentication mechanism, as
+// described in RFC 7628.
+func NewOAuthBearerClient(opt *OAuthBearerOptions) Client {
+	return &oauthBearerClient{*opt}
+}
+
+type OAuthBearerAuthenticator func(opts OAuthBearerOptions) *OAuthBearerError
+
+type oauthBearerServer struct {
+	done         bool
+	failErr      error
+	authenticate OAuthBearerAuthenticator
+}
+
+func (a *oauthBearerServer) fail(descr string) ([]byte, bool, error) {
+	blob, err := json.Marshal(OAuthBearerError{
+		Status:  "invalid_request",
+		Schemes: "bearer",
+	})
+	if err != nil {
+		panic(err) // wtf
+	}
+	a.failErr = errors.New(descr)
+	return blob, false, nil
+}
+
+func (a *oauthBearerServer) Next(response []byte) (challenge []byte, done bool, err error) {
+	// Per RFC, we cannot just send an error, we need to return JSON-structured
+	// value as a challenge and then after getting dummy response from the
+	// client stop the exchange.
+	if a.failErr != nil {
+		// Server libraries (go-smtp, go-imap) will not call Next on
+		// protocol-specific SASL cancel response ('*'). However, GS2 (and
+		// indirectly OAUTHBEARER) defines a protocol-independent way to do so
+		// using 0x01.
+		if len(response) != 1 && response[0] != 0x01 {
+			return nil, true, errors.New("unexpected response")
+		}
+		return nil, true, a.failErr
+	}
+
+	if a.done {
+		err = ErrUnexpectedClientResponse
+		return
+	}
+
+	// Generate empty challenge.
+	if response == nil {
+		return []byte{}, false, nil
+	}
+
+	a.done = true
+
+	// Cut n,a=username,\x01host=...\x01auth=...
+	// into
+	//   n
+	//   a=username
+	//   \x01host=...\x01auth=...\x01\x01
+	parts := bytes.SplitN(response, []byte{','}, 3)
+	if len(parts) != 3 {
+		return a.fail("Invalid response")
+	}
+	if !bytes.Equal(parts[0], []byte{'n'}) {
+		return a.fail("Invalid response, missing 'n'")
+	}
+	opts := OAuthBearerOptions{}
+	if !bytes.HasPrefix(parts[1], []byte("a=")) {
+		return a.fail("Invalid response, missing 'a'")
+	}
+	opts.Username = string(bytes.TrimPrefix(parts[1], []byte("a=")))
+
+	// Cut \x01host=...\x01auth=...\x01\x01
+	// into
+	//   *empty*
+	//   host=...
+	//   auth=...
+	//   *empty*
+	//
+	// Note that this code does not do a lot of checks to make sure the input
+	// follows the exact format specified by RFC.
+	params := bytes.Split(parts[2], []byte{0x01})
+	for _, p := range params {
+		// Skip empty fields (one at start and end).
+		if len(p) == 0 {
+			continue
+		}
+
+		pParts := bytes.SplitN(p, []byte{'='}, 2)
+		if len(pParts) != 2 {
+			return a.fail("Invalid response, missing '='")
+		}
+
+		switch string(pParts[0]) {
+		case "host":
+			opts.Host = string(pParts[1])
+		case "port":
+			port, err := strconv.ParseUint(string(pParts[1]), 10, 16)
+			if err != nil {
+				return a.fail("Invalid response, malformed 'port' value")
+			}
+			opts.Port = int(port)
+		case "auth":
+			const prefix = "bearer "
+			strValue := string(pParts[1])
+			// Token type is case-insensitive.
+			if !strings.HasPrefix(strings.ToLower(strValue), prefix) {
+				return a.fail("Unsupported token type")
+			}
+			opts.Token = strValue[len(prefix):]
+		default:
+			return a.fail("Invalid response, unknown parameter: " + string(pParts[0]))
+		}
+	}
+
+	authzErr := a.authenticate(opts)
+	if authzErr != nil {
+		blob, err := json.Marshal(authzErr)
+		if err != nil {
+			panic(err) // wtf
+		}
+		a.failErr = authzErr
+		return blob, false, nil
+	}
+
+	return nil, true, nil
+}
+
+func NewOAuthBearerServer(auth OAuthBearerAuthenticator) Server {
+	return &oauthBearerServer{authenticate: auth}
+}

vendor/github.com/emersion/go-sasl/plain.go

@@ -0,0 +1,77 @@
+package sasl
+
+import (
+	"bytes"
+	"errors"
+)
+
+// The PLAIN mechanism name.
+const Plain = "PLAIN"
+
+type plainClient struct {
+	Identity string
+	Username string
+	Password string
+}
+
+func (a *plainClient) Start() (mech string, ir []byte, err error) {
+	mech = "PLAIN"
+	ir = []byte(a.Identity + "\x00" + a.Username + "\x00" + a.Password)
+	return
+}
+
+func (a *plainClient) Next(challenge []byte) (response []byte, err error) {
+	return nil, ErrUnexpectedServerChallenge
+}
+
+// A client implementation of the PLAIN authentication mechanism, as described
+// in RFC 4616. Authorization identity may be left blank to indicate that it is
+// the same as the username.
+func NewPlainClient(identity, username, password string) Client {
+	return &plainClient{identity, username, password}
+}
+
+// Authenticates users with an identity, a username and a password. If the
+// identity is left blank, it indicates that it is the same as the username.
+// If identity is not empty and the server doesn't support it, an error must be
+// returned.
+type PlainAuthenticator func(identity, username, password string) error
+
+type plainServer struct {
+	done bool
+	authenticate PlainAuthenticator
+}
+
+func (a *plainServer) Next(response []byte) (challenge []byte, done bool, err error) {
+	if a.done {
+		err = ErrUnexpectedClientResponse
+		return
+	}
+
+	// No initial response, send an empty challenge
+	if response == nil {
+		return []byte{}, false, nil
+	}
+
+	a.done = true
+
+	parts := bytes.Split(response, []byte("\x00"))
+	if len(parts) != 3 {
+		err = errors.New("Invalid response")
+		return
+	}
+
+	identity := string(parts[0])
+	username := string(parts[1])
+	password := string(parts[2])
+
+	err = a.authenticate(identity, username, password)
+	done = true
+	return
+}
+
+// A server implementation of the PLAIN authentication mechanism, as described
+// in RFC 4616.
+func NewPlainServer(authenticator PlainAuthenticator) Server {
+	return &plainServer{authenticate: authenticator}
+}

vendor/github.com/emersion/go-sasl/sasl.go

@@ -0,0 +1,45 @@
+// Library for Simple Authentication and Security Layer (SASL) defined in RFC 4422.
+package sasl
+
+// Note:
+//   Most of this code was copied, with some modifications, from net/smtp. It
+//   would be better if Go provided a standard package (e.g. crypto/sasl) that
+//   could be shared by SMTP, IMAP, and other packages.
+
+import (
+	"errors"
+)
+
+// Common SASL errors.
+var (
+	ErrUnexpectedClientResponse = errors.New("sasl: unexpected client response")
+	ErrUnexpectedServerChallenge = errors.New("sasl: unexpected server challenge")
+)
+
+// Client interface to perform challenge-response authentication.
+type Client interface {
+	// Begins SASL authentication with the server. It returns the
+	// authentication mechanism name and "initial response" data (if required by
+	// the selected mechanism). A non-nil error causes the client to abort the
+	// authentication attempt.
+	//
+	// A nil ir value is different from a zero-length value. The nil value
+	// indicates that the selected mechanism does not use an initial response,
+	// while a zero-length value indicates an empty initial response, which must
+	// be sent to the server.
+	Start() (mech string, ir []byte, err error)
+
+	// Continues challenge-response authentication. A non-nil error causes
+	// the client to abort the authentication attempt.
+	Next(challenge []byte) (response []byte, err error)
+}
+
+// Server interface to perform challenge-response authentication.
+type Server interface {
+	// Begins or continues challenge-response authentication. If the client
+	// supplies an initial response, response is non-nil.
+	//
+	// If the authentication is finished, done is set to true. If the
+	// authentication has failed, an error is returned.
+	Next(response []byte) (challenge []byte, done bool, err error)
+}

vendor/github.com/emersion/go-smtp/.build.yml

@@ -0,0 +1,19 @@
+image: alpine/edge
+packages:
+  - go
+  # Required by codecov
+  - bash
+  - findutils
+sources:
+  - https://github.com/emersion/go-smtp
+tasks:
+  - build: |
+      cd go-smtp
+      go build -v ./...
+  - test: |
+      cd go-smtp
+      go test -coverprofile=coverage.txt -covermode=atomic ./...
+  - upload-coverage: |
+      cd go-smtp
+      export CODECOV_TOKEN=3f257f71-a128-4834-8f68-2b534e9f4cb1
+      curl -s https://codecov.io/bash | bash

vendor/github.com/emersion/go-smtp/.gitignore

@@ -0,0 +1,26 @@
+# Compiled Object files, Static and Dynamic libs (Shared Objects)
+*.o
+*.a
+*.so
+
+# Folders
+_obj
+_test
+
+# Architecture specific extensions/prefixes
+*.[568vq]
+[568vq].out
+
+*.cgo1.go
+*.cgo2.c
+_cgo_defun.c
+_cgo_gotypes.go
+_cgo_export.*
+
+_testmain.go
+
+*.exe
+*.test
+*.prof
+
+/main.go

vendor/github.com/emersion/go-smtp/LICENSE

@@ -0,0 +1,24 @@
+The MIT License (MIT)
+
+Copyright (c) 2010 The Go Authors
+Copyright (c) 2014 Gleez Technologies
+Copyright (c) 2016 emersion
+Copyright (c) 2016 Proton Technologies AG
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

vendor/github.com/emersion/go-smtp/README.md

@@ -0,0 +1,151 @@
+# go-smtp
+
+[![godocs.io](https://godocs.io/github.com/emersion/go-smtp?status.svg)](https://godocs.io/github.com/emersion/go-smtp)
+[![builds.sr.ht status](https://builds.sr.ht/~emersion/go-smtp/commits.svg)](https://builds.sr.ht/~emersion/go-smtp/commits?)
+[![codecov](https://codecov.io/gh/emersion/go-smtp/branch/master/graph/badge.svg)](https://codecov.io/gh/emersion/go-smtp)
+
+An ESMTP client and server library written in Go.
+
+## Features
+
+* ESMTP client & server implementing [RFC 5321](https://tools.ietf.org/html/rfc5321)
+* Support for SMTP [AUTH](https://tools.ietf.org/html/rfc4954) and [PIPELINING](https://tools.ietf.org/html/rfc2920)
+* UTF-8 support for subject and message
+* [LMTP](https://tools.ietf.org/html/rfc2033) support
+
+## Usage
+
+### Client
+
+```go
+package main
+
+import (
+	"log"
+	"strings"
+
+	"github.com/emersion/go-sasl"
+	"github.com/emersion/go-smtp"
+)
+
+func main() {
+	// Set up authentication information.
+	auth := sasl.NewPlainClient("", "user@example.com", "password")
+
+	// Connect to the server, authenticate, set the sender and recipient,
+	// and send the email all in one step.
+	to := []string{"recipient@example.net"}
+	msg := strings.NewReader("To: recipient@example.net\r\n" +
+		"Subject: discount Gophers!\r\n" +
+		"\r\n" +
+		"This is the email body.\r\n")
+	err := smtp.SendMail("mail.example.com:25", auth, "sender@example.org", to, msg)
+	if err != nil {
+		log.Fatal(err)
+	}
+}
+```
+
+If you need more control, you can use `Client` instead.
+
+### Server
+
+```go
+package main
+
+import (
+	"errors"
+	"io"
+	"io/ioutil"
+	"log"
+	"time"
+
+	"github.com/emersion/go-smtp"
+)
+
+// The Backend implements SMTP server methods.
+type Backend struct{}
+
+// Login handles a login command with username and password.
+func (bkd *Backend) Login(state *smtp.ConnectionState, username, password string) (smtp.Session, error) {
+	if username != "username" || password != "password" {
+		return nil, errors.New("Invalid username or password")
+	}
+	return &Session{}, nil
+}
+
+// AnonymousLogin requires clients to authenticate using SMTP AUTH before sending emails
+func (bkd *Backend) AnonymousLogin(state *smtp.ConnectionState) (smtp.Session, error) {
+	return nil, smtp.ErrAuthRequired
+}
+
+// A Session is returned after successful login.
+type Session struct{}
+
+func (s *Session) Mail(from string, opts smtp.MailOptions) error {
+	log.Println("Mail from:", from)
+	return nil
+}
+
+func (s *Session) Rcpt(to string) error {
+	log.Println("Rcpt to:", to)
+	return nil
+}
+
+func (s *Session) Data(r io.Reader) error {
+	if b, err := ioutil.ReadAll(r); err != nil {
+		return err
+	} else {
+		log.Println("Data:", string(b))
+	}
+	return nil
+}
+
+func (s *Session) Reset() {}
+
+func (s *Session) Logout() error {
+	return nil
+}
+
+func main() {
+	be := &Backend{}
+
+	s := smtp.NewServer(be)
+
+	s.Addr = ":1025"
+	s.Domain = "localhost"
+	s.ReadTimeout = 10 * time.Second
+	s.WriteTimeout = 10 * time.Second
+	s.MaxMessageBytes = 1024 * 1024
+	s.MaxRecipients = 50
+	s.AllowInsecureAuth = true
+
+	log.Println("Starting server at", s.Addr)
+	if err := s.ListenAndServe(); err != nil {
+		log.Fatal(err)
+	}
+}
+```
+
+You can use the server manually with `telnet`:
+```
+$ telnet localhost 1025
+EHLO localhost
+AUTH PLAIN
+AHVzZXJuYW1lAHBhc3N3b3Jk
+MAIL FROM:<root@nsa.gov>
+RCPT TO:<root@gchq.gov.uk>
+DATA
+Hey <3
+.
+```
+
+## Relationship with net/smtp
+
+The Go standard library provides a SMTP client implementation in `net/smtp`.
+However `net/smtp` is frozen: it's not getting any new features. go-smtp
+provides a server implementation and a number of client improvements.
+
+## Licence
+
+MIT

vendor/github.com/emersion/go-smtp/backend.go

@@ -0,0 +1,102 @@
+package smtp
+
+import (
+	"errors"
+	"io"
+)
+
+var (
+	ErrAuthRequired    = errors.New("Please authenticate first")
+	ErrAuthUnsupported = errors.New("Authentication not supported")
+)
+
+// A SMTP server backend.
+type Backend interface {
+	// Authenticate a user. Return smtp.ErrAuthUnsupported if you don't want to
+	// support this.
+	Login(state *ConnectionState, username, password string) (Session, error)
+
+	// Called if the client attempts to send mail without logging in first.
+	// Return smtp.ErrAuthRequired if you don't want to support this.
+	AnonymousLogin(state *ConnectionState) (Session, error)
+}
+
+type BodyType string
+
+const (
+	Body7Bit       BodyType = "7BIT"
+	Body8BitMIME   BodyType = "8BITMIME"
+	BodyBinaryMIME BodyType = "BINARYMIME"
+)
+
+// MailOptions contains custom arguments that were
+// passed as an argument to the MAIL command.
+type MailOptions struct {
+	// Value of BODY= argument, 7BIT, 8BITMIME or BINARYMIME.
+	Body BodyType
+
+	// Size of the body. Can be 0 if not specified by client.
+	Size int
+
+	// TLS is required for the message transmission.
+	//
+	// The message should be rejected if it can't be transmitted
+	// with TLS.
+	RequireTLS bool
+
+	// The message envelope or message header contains UTF-8-encoded strings.
+	// This flag is set by SMTPUTF8-aware (RFC 6531) client.
+	UTF8 bool
+
+	// The authorization identity asserted by the message sender in decoded
+	// form with angle brackets stripped.
+	//
+	// nil value indicates missing AUTH, non-nil empty string indicates
+	// AUTH=<>.
+	//
+	// Defined in RFC 4954.
+	Auth *string
+}
+
+// Session is used by servers to respond to an SMTP client.
+//
+// The methods are called when the remote client issues the matching command.
+type Session interface {
+	// Discard currently processed message.
+	Reset()
+
+	// Free all resources associated with session.
+	Logout() error
+
+	// Set return path for currently processed message.
+	Mail(from string, opts MailOptions) error
+	// Add recipient for currently processed message.
+	Rcpt(to string) error
+	// Set currently processed message contents and send it.
+	Data(r io.Reader) error
+}
+
+// LMTPSession is an add-on interface for Session. It can be implemented by
+// LMTP servers to provide extra functionality.
+type LMTPSession interface {
+	// LMTPData is the LMTP-specific version of Data method.
+	// It can be optionally implemented by the backend to provide
+	// per-recipient status information when it is used over LMTP
+	// protocol.
+	//
+	// LMTPData implementation sets status information using passed
+	// StatusCollector by calling SetStatus once per each AddRcpt
+	// call, even if AddRcpt was called multiple times with
+	// the same argument. SetStatus must not be called after
+	// LMTPData returns.
+	//
+	// Return value of LMTPData itself is used as a status for
+	// recipients that got no status set before using StatusCollector.
+	LMTPData(r io.Reader, status StatusCollector) error
+}
+
+// StatusCollector allows a backend to provide per-recipient status
+// information.
+type StatusCollector interface {
+	SetStatus(rcptTo string, err error)
+}

vendor/github.com/emersion/go-smtp/client.go

@@ -0,0 +1,679 @@
+// Copyright 2010 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package smtp
+
+import (
+	"crypto/tls"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/textproto"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/emersion/go-sasl"
+)
+
+// A Client represents a client connection to an SMTP server.
+type Client struct {
+	// Text is the textproto.Conn used by the Client. It is exported to allow for
+	// clients to add extensions.
+	Text *textproto.Conn
+
+	// keep a reference to the connection so it can be used to create a TLS
+	// connection later
+	conn net.Conn
+	// whether the Client is using TLS
+	tls        bool
+	serverName string
+	lmtp       bool
+	// map of supported extensions
+	ext map[string]string
+	// supported auth mechanisms
+	auth       []string
+	localName  string   // the name to use in HELO/EHLO/LHLO
+	didHello   bool     // whether we've said HELO/EHLO/LHLO
+	helloError error    // the error from the hello
+	rcpts      []string // recipients accumulated for the current session
+
+	// Time to wait for command responses (this includes 3xx reply to DATA).
+	CommandTimeout time.Duration
+	// Time to wait for responses after final dot.
+	SubmissionTimeout time.Duration
+
+	// Logger for all network activity.
+	DebugWriter io.Writer
+}
+
+// Dial returns a new Client connected to an SMTP server at addr.
+// The addr must include a port, as in "mail.example.com:smtp".
+func Dial(addr string) (*Client, error) {
+	conn, err := net.Dial("tcp", addr)
+	if err != nil {
+		return nil, err
+	}
+	host, _, _ := net.SplitHostPort(addr)
+	return NewClient(conn, host)
+}
+
+// DialTLS returns a new Client connected to an SMTP server via TLS at addr.
+// The addr must include a port, as in "mail.example.com:smtps".
+//
+// A nil tlsConfig is equivalent to a zero tls.Config.
+func DialTLS(addr string, tlsConfig *tls.Config) (*Client, error) {
+	conn, err := tls.Dial("tcp", addr, tlsConfig)
+	if err != nil {
+		return nil, err
+	}
+	host, _, _ := net.SplitHostPort(addr)
+	return NewClient(conn, host)
+}
+
+// NewClient returns a new Client using an existing connection and host as a
+// server name to be used when authenticating.
+func NewClient(conn net.Conn, host string) (*Client, error) {
+	c := &Client{
+		serverName: host,
+		localName:  "localhost",
+		// As recommended by RFC 5321. For DATA command reply (3xx one) RFC
+		// recommends a slightly shorter timeout but we do not bother
+		// differentiating these.
+		CommandTimeout: 5 * time.Minute,
+		// 10 minutes + 2 minute buffer in case the server is doing transparent
+		// forwarding and also follows recommended timeouts.
+		SubmissionTimeout: 12 * time.Minute,
+	}
+
+	c.setConn(conn)
+
+	_, _, err := c.Text.ReadResponse(220)
+	if err != nil {
+		c.Text.Close()
+		if protoErr, ok := err.(*textproto.Error); ok {
+			return nil, toSMTPErr(protoErr)
+		}
+		return nil, err
+	}
+
+	return c, nil
+}
+
+// NewClientLMTP returns a new LMTP Client (as defined in RFC 2033) using an
+// existing connector and host as a server name to be used when authenticating.
+func NewClientLMTP(conn net.Conn, host string) (*Client, error) {
+	c, err := NewClient(conn, host)
+	if err != nil {
+		return nil, err
+	}
+	c.lmtp = true
+	return c, nil
+}
+
+// setConn sets the underlying network connection for the client.
+func (c *Client) setConn(conn net.Conn) {
+	c.conn = conn
+
+	var r io.Reader = conn
+	var w io.Writer = conn
+
+	r = &lineLimitReader{
+		R: conn,
+		// Doubled maximum line length per RFC 5321 (Section 4.5.3.1.6)
+		LineLimit: 2000,
+	}
+
+	r = io.TeeReader(r, clientDebugWriter{c})
+	w = io.MultiWriter(w, clientDebugWriter{c})
+
+	rwc := struct {
+		io.Reader
+		io.Writer
+		io.Closer
+	}{
+		Reader: r,
+		Writer: w,
+		Closer: conn,
+	}
+	c.Text = textproto.NewConn(rwc)
+
+	_, isTLS := conn.(*tls.Conn)
+	c.tls = isTLS
+}
+
+// Close closes the connection.
+func (c *Client) Close() error {
+	return c.Text.Close()
+}
+
+// hello runs a hello exchange if needed.
+func (c *Client) hello() error {
+	if !c.didHello {
+		c.didHello = true
+		err := c.ehlo()
+		if err != nil {
+			c.helloError = c.helo()
+		}
+	}
+	return c.helloError
+}
+
+// Hello sends a HELO or EHLO to the server as the given host name.
+// Calling this method is only necessary if the client needs control
+// over the host name used. The client will introduce itself as "localhost"
+// automatically otherwise. If Hello is called, it must be called before
+// any of the other methods.
+//
+// If server returns an error, it will be of type *SMTPError.
+func (c *Client) Hello(localName string) error {
+	if err := validateLine(localName); err != nil {
+		return err
+	}
+	if c.didHello {
+		return errors.New("smtp: Hello called after other methods")
+	}
+	c.localName = localName
+	return c.hello()
+}
+
+// cmd is a convenience function that sends a command and returns the response
+// textproto.Error returned by c.Text.ReadResponse is converted into SMTPError.
+func (c *Client) cmd(expectCode int, format string, args ...interface{}) (int, string, error) {
+	c.conn.SetDeadline(time.Now().Add(c.CommandTimeout))
+	defer c.conn.SetDeadline(time.Time{})
+
+	id, err := c.Text.Cmd(format, args...)
+	if err != nil {
+		return 0, "", err
+	}
+	c.Text.StartResponse(id)
+	defer c.Text.EndResponse(id)
+	code, msg, err := c.Text.ReadResponse(expectCode)
+	if err != nil {
+		if protoErr, ok := err.(*textproto.Error); ok {
+			smtpErr := toSMTPErr(protoErr)
+			return code, smtpErr.Message, smtpErr
+		}
+		return code, msg, err
+	}
+	return code, msg, nil
+}
+
+// helo sends the HELO greeting to the server. It should be used only when the
+// server does not support ehlo.
+func (c *Client) helo() error {
+	c.ext = nil
+	_, _, err := c.cmd(250, "HELO %s", c.localName)
+	return err
+}
+
+// ehlo sends the EHLO (extended hello) greeting to the server. It
+// should be the preferred greeting for servers that support it.
+func (c *Client) ehlo() error {
+	cmd := "EHLO"
+	if c.lmtp {
+		cmd = "LHLO"
+	}
+
+	_, msg, err := c.cmd(250, "%s %s", cmd, c.localName)
+	if err != nil {
+		return err
+	}
+	ext := make(map[string]string)
+	extList := strings.Split(msg, "\n")
+	if len(extList) > 1 {
+		extList = extList[1:]
+		for _, line := range extList {
+			args := strings.SplitN(line, " ", 2)
+			if len(args) > 1 {
+				ext[args[0]] = args[1]
+			} else {
+				ext[args[0]] = ""
+			}
+		}
+	}
+	if mechs, ok := ext["AUTH"]; ok {
+		c.auth = strings.Split(mechs, " ")
+	}
+	c.ext = ext
+	return err
+}
+
+// StartTLS sends the STARTTLS command and encrypts all further communication.
+// Only servers that advertise the STARTTLS extension support this function.
+//
+// A nil config is equivalent to a zero tls.Config.
+//
+// If server returns an error, it will be of type *SMTPError.
+func (c *Client) StartTLS(config *tls.Config) error {
+	if err := c.hello(); err != nil {
+		return err
+	}
+	_, _, err := c.cmd(220, "STARTTLS")
+	if err != nil {
+		return err
+	}
+	if config == nil {
+		config = &tls.Config{}
+	}
+	if config.ServerName == "" {
+		// Make a copy to avoid polluting argument
+		config = config.Clone()
+		config.ServerName = c.serverName
+	}
+	if testHookStartTLS != nil {
+		testHookStartTLS(config)
+	}
+	c.setConn(tls.Client(c.conn, config))
+	return c.ehlo()
+}
+
+// TLSConnectionState returns the client's TLS connection state.
+// The return values are their zero values if StartTLS did
+// not succeed.
+func (c *Client) TLSConnectionState() (state tls.ConnectionState, ok bool) {
+	tc, ok := c.conn.(*tls.Conn)
+	if !ok {
+		return
+	}
+	return tc.ConnectionState(), true
+}
+
+// Verify checks the validity of an email address on the server.
+// If Verify returns nil, the address is valid. A non-nil return
+// does not necessarily indicate an invalid address. Many servers
+// will not verify addresses for security reasons.
+//
+// If server returns an error, it will be of type *SMTPError.
+func (c *Client) Verify(addr string) error {
+	if err := validateLine(addr); err != nil {
+		return err
+	}
+	if err := c.hello(); err != nil {
+		return err
+	}
+	_, _, err := c.cmd(250, "VRFY %s", addr)
+	return err
+}
+
+// Auth authenticates a client using the provided authentication mechanism.
+// Only servers that advertise the AUTH extension support this function.
+//
+// If server returns an error, it will be of type *SMTPError.
+func (c *Client) Auth(a sasl.Client) error {
+	if err := c.hello(); err != nil {
+		return err
+	}
+	encoding := base64.StdEncoding
+	mech, resp, err := a.Start()
+	if err != nil {
+		return err
+	}
+	resp64 := make([]byte, encoding.EncodedLen(len(resp)))
+	encoding.Encode(resp64, resp)
+	code, msg64, err := c.cmd(0, strings.TrimSpace(fmt.Sprintf("AUTH %s %s", mech, resp64)))
+	for err == nil {
+		var msg []byte
+		switch code {
+		case 334:
+			msg, err = encoding.DecodeString(msg64)
+		case 235:
+			// the last message isn't base64 because it isn't a challenge
+			msg = []byte(msg64)
+		default:
+			err = toSMTPErr(&textproto.Error{Code: code, Msg: msg64})
+		}
+		if err == nil {
+			if code == 334 {
+				resp, err = a.Next(msg)
+			} else {
+				resp = nil
+			}
+		}
+		if err != nil {
+			// abort the AUTH
+			c.cmd(501, "*")
+			break
+		}
+		if resp == nil {
+			break
+		}
+		resp64 = make([]byte, encoding.EncodedLen(len(resp)))
+		encoding.Encode(resp64, resp)
+		code, msg64, err = c.cmd(0, string(resp64))
+	}
+	return err
+}
+
+// Mail issues a MAIL command to the server using the provided email address.
+// If the server supports the 8BITMIME extension, Mail adds the BODY=8BITMIME
+// parameter.
+// This initiates a mail transaction and is followed by one or more Rcpt calls.
+//
+// If opts is not nil, MAIL arguments provided in the structure will be added
+// to the command. Handling of unsupported options depends on the extension.
+//
+// If server returns an error, it will be of type *SMTPError.
+func (c *Client) Mail(from string, opts *MailOptions) error {
+	if err := validateLine(from); err != nil {
+		return err
+	}
+	if err := c.hello(); err != nil {
+		return err
+	}
+	cmdStr := "MAIL FROM:<%s>"
+	if _, ok := c.ext["8BITMIME"]; ok {
+		cmdStr += " BODY=8BITMIME"
+	}
+	if _, ok := c.ext["SIZE"]; ok && opts != nil && opts.Size != 0 {
+		cmdStr += " SIZE=" + strconv.Itoa(opts.Size)
+	}
+	if opts != nil && opts.RequireTLS {
+		if _, ok := c.ext["REQUIRETLS"]; ok {
+			cmdStr += " REQUIRETLS"
+		} else {
+			return errors.New("smtp: server does not support REQUIRETLS")
+		}
+	}
+	if opts != nil && opts.UTF8 {
+		if _, ok := c.ext["SMTPUTF8"]; ok {
+			cmdStr += " SMTPUTF8"
+		} else {
+			return errors.New("smtp: server does not support SMTPUTF8")
+		}
+	}
+	if opts != nil && opts.Auth != nil {
+		if _, ok := c.ext["AUTH"]; ok {
+			cmdStr += " AUTH=" + encodeXtext(*opts.Auth)
+		}
+		// We can safely discard parameter if server does not support AUTH.
+	}
+	_, _, err := c.cmd(250, cmdStr, from)
+	return err
+}
+
+// Rcpt issues a RCPT command to the server using the provided email address.
+// A call to Rcpt must be preceded by a call to Mail and may be followed by
+// a Data call or another Rcpt call.
+//
+// If server returns an error, it will be of type *SMTPError.
+func (c *Client) Rcpt(to string) error {
+	if err := validateLine(to); err != nil {
+		return err
+	}
+	if _, _, err := c.cmd(25, "RCPT TO:<%s>", to); err != nil {
+		return err
+	}
+	c.rcpts = append(c.rcpts, to)
+	return nil
+}
+
+type dataCloser struct {
+	c *Client
+	io.WriteCloser
+	statusCb func(rcpt string, status *SMTPError)
+}
+
+func (d *dataCloser) Close() error {
+	d.WriteCloser.Close()
+
+	d.c.conn.SetDeadline(time.Now().Add(d.c.SubmissionTimeout))
+	defer d.c.conn.SetDeadline(time.Time{})
+
+	expectedResponses := len(d.c.rcpts)
+	if d.c.lmtp {
+		for expectedResponses > 0 {
+			rcpt := d.c.rcpts[len(d.c.rcpts)-expectedResponses]
+			if _, _, err := d.c.Text.ReadResponse(250); err != nil {
+				if protoErr, ok := err.(*textproto.Error); ok {
+					if d.statusCb != nil {
+						d.statusCb(rcpt, toSMTPErr(protoErr))
+					}
+				} else {
+					return err
+				}
+			} else if d.statusCb != nil {
+				d.statusCb(rcpt, nil)
+			}
+			expectedResponses--
+		}
+		return nil
+	} else {
+		_, _, err := d.c.Text.ReadResponse(250)
+		if err != nil {
+			if protoErr, ok := err.(*textproto.Error); ok {
+				return toSMTPErr(protoErr)
+			}
+			return err
+		}
+		return nil
+	}
+}
+
+// Data issues a DATA command to the server and returns a writer that
+// can be used to write the mail headers and body. The caller should
+// close the writer before calling any more methods on c. A call to
+// Data must be preceded by one or more calls to Rcpt.
+//
+// If server returns an error, it will be of type *SMTPError.
+func (c *Client) Data() (io.WriteCloser, error) {
+	_, _, err := c.cmd(354, "DATA")
+	if err != nil {
+		return nil, err
+	}
+	return &dataCloser{c, c.Text.DotWriter(), nil}, nil
+}
+
+// LMTPData is the LMTP-specific version of the Data method. It accepts a callback
+// that will be called for each status response received from the server.
+//
+// Status callback will receive a SMTPError argument for each negative server
+// reply and nil for each positive reply. I/O errors will not be reported using
+// callback and instead will be returned by the Close method of io.WriteCloser.
+// Callback will be called for each successfull Rcpt call done before in the
+// same order.
+func (c *Client) LMTPData(statusCb func(rcpt string, status *SMTPError)) (io.WriteCloser, error) {
+	if !c.lmtp {
+		return nil, errors.New("smtp: not a LMTP client")
+	}
+
+	_, _, err := c.cmd(354, "DATA")
+	if err != nil {
+		return nil, err
+	}
+	return &dataCloser{c, c.Text.DotWriter(), statusCb}, nil
+}
+
+var testHookStartTLS func(*tls.Config) // nil, except for tests
+
+// SendMail connects to the server at addr, switches to TLS if
+// possible, authenticates with the optional mechanism a if possible,
+// and then sends an email from address from, to addresses to, with
+// message r.
+// The addr must include a port, as in "mail.example.com:smtp".
+//
+// The addresses in the to parameter are the SMTP RCPT addresses.
+//
+// The r parameter should be an RFC 822-style email with headers
+// first, a blank line, and then the message body. The lines of r
+// should be CRLF terminated. The r headers should usually include
+// fields such as "From", "To", "Subject", and "Cc".  Sending "Bcc"
+// messages is accomplished by including an email address in the to
+// parameter but not including it in the r headers.
+//
+// SendMail is intended to be used for very simple use-cases. If you want to
+// customize SendMail's behavior, use a Client instead.
+//
+// The SendMail function and the go-smtp package are low-level
+// mechanisms and provide no support for DKIM signing (see go-msgauth), MIME
+// attachments (see the mime/multipart package or the go-message package), or
+// other mail functionality.
+func SendMail(addr string, a sasl.Client, from string, to []string, r io.Reader) error {
+	if err := validateLine(from); err != nil {
+		return err
+	}
+	for _, recp := range to {
+		if err := validateLine(recp); err != nil {
+			return err
+		}
+	}
+	c, err := Dial(addr)
+	if err != nil {
+		return err
+	}
+	defer c.Close()
+	if err = c.hello(); err != nil {
+		return err
+	}
+	if ok, _ := c.Extension("STARTTLS"); ok {
+		if err = c.StartTLS(nil); err != nil {
+			return err
+		}
+	}
+	if a != nil && c.ext != nil {
+		if _, ok := c.ext["AUTH"]; !ok {
+			return errors.New("smtp: server doesn't support AUTH")
+		}
+		if err = c.Auth(a); err != nil {
+			return err
+		}
+	}
+	if err = c.Mail(from, nil); err != nil {
+		return err
+	}
+	for _, addr := range to {
+		if err = c.Rcpt(addr); err != nil {
+			return err
+		}
+	}
+	w, err := c.Data()
+	if err != nil {
+		return err
+	}
+	_, err = io.Copy(w, r)
+	if err != nil {
+		return err
+	}
+	err = w.Close()
+	if err != nil {
+		return err
+	}
+	return c.Quit()
+}
+
+// Extension reports whether an extension is support by the server.
+// The extension name is case-insensitive. If the extension is supported,
+// Extension also returns a string that contains any parameters the
+// server specifies for the extension.
+func (c *Client) Extension(ext string) (bool, string) {
+	if err := c.hello(); err != nil {
+		return false, ""
+	}
+	if c.ext == nil {
+		return false, ""
+	}
+	ext = strings.ToUpper(ext)
+	param, ok := c.ext[ext]
+	return ok, param
+}
+
+// Reset sends the RSET command to the server, aborting the current mail
+// transaction.
+func (c *Client) Reset() error {
+	if err := c.hello(); err != nil {
+		return err
+	}
+	if _, _, err := c.cmd(250, "RSET"); err != nil {
+		return err
+	}
+	c.rcpts = nil
+	return nil
+}
+
+// Noop sends the NOOP command to the server. It does nothing but check
+// that the connection to the server is okay.
+func (c *Client) Noop() error {
+	if err := c.hello(); err != nil {
+		return err
+	}
+	_, _, err := c.cmd(250, "NOOP")
+	return err
+}
+
+// Quit sends the QUIT command and closes the connection to the server.
+//
+// If Quit fails the connection is not closed, Close should be used
+// in this case.
+func (c *Client) Quit() error {
+	if err := c.hello(); err != nil {
+		return err
+	}
+	_, _, err := c.cmd(221, "QUIT")
+	if err != nil {
+		return err
+	}
+	return c.Text.Close()
+}
+
+func parseEnhancedCode(s string) (EnhancedCode, error) {
+	parts := strings.Split(s, ".")
+	if len(parts) != 3 {
+		return EnhancedCode{}, fmt.Errorf("wrong amount of enhanced code parts")
+	}
+
+	code := EnhancedCode{}
+	for i, part := range parts {
+		num, err := strconv.Atoi(part)
+		if err != nil {
+			return code, err
+		}
+		code[i] = num
+	}
+	return code, nil
+}
+
+// toSMTPErr converts textproto.Error into SMTPError, parsing
+// enhanced status code if it is present.
+func toSMTPErr(protoErr *textproto.Error) *SMTPError {
+	if protoErr == nil {
+		return nil
+	}
+	smtpErr := &SMTPError{
+		Code:    protoErr.Code,
+		Message: protoErr.Msg,
+	}
+
+	parts := strings.SplitN(protoErr.Msg, " ", 2)
+	if len(parts) != 2 {
+		return smtpErr
+	}
+
+	enchCode, err := parseEnhancedCode(parts[0])
+	if err != nil {
+		return smtpErr
+	}
+
+	msg := parts[1]
+
+	// Per RFC 2034, enhanced code should be prepended to each line.
+	msg = strings.ReplaceAll(msg, "\n"+parts[0]+" ", "\n")
+
+	smtpErr.EnhancedCode = enchCode
+	smtpErr.Message = msg
+	return smtpErr
+}
+
+type clientDebugWriter struct {
+	c *Client
+}
+
+func (cdw clientDebugWriter) Write(b []byte) (int, error) {
+	if cdw.c.DebugWriter == nil {
+		return len(b), nil
+	}
+	return cdw.c.DebugWriter.Write(b)
+}

vendor/github.com/emersion/go-smtp/data.go

@@ -0,0 +1,147 @@
+package smtp
+
+import (
+	"bufio"
+	"io"
+)
+
+type EnhancedCode [3]int
+
+// SMTPError specifies the error code, enhanced error code (if any) and
+// message returned by the server.
+type SMTPError struct {
+	Code         int
+	EnhancedCode EnhancedCode
+	Message      string
+}
+
+// NoEnhancedCode is used to indicate that enhanced error code should not be
+// included in response.
+//
+// Note that RFC 2034 requires an enhanced code to be included in all 2xx, 4xx
+// and 5xx responses. This constant is exported for use by extensions, you
+// should probably use EnhancedCodeNotSet instead.
+var NoEnhancedCode = EnhancedCode{-1, -1, -1}
+
+// EnhancedCodeNotSet is a nil value of EnhancedCode field in SMTPError, used
+// to indicate that backend failed to provide enhanced status code. X.0.0 will
+// be used (X is derived from error code).
+var EnhancedCodeNotSet = EnhancedCode{0, 0, 0}
+
+func (err *SMTPError) Error() string {
+	return err.Message
+}
+
+func (err *SMTPError) Temporary() bool {
+	return err.Code/100 == 4
+}
+
+var ErrDataTooLarge = &SMTPError{
+	Code:         552,
+	EnhancedCode: EnhancedCode{5, 3, 4},
+	Message:      "Maximum message size exceeded",
+}
+
+type dataReader struct {
+	r     *bufio.Reader
+	state int
+
+	limited bool
+	n       int64 // Maximum bytes remaining
+}
+
+func newDataReader(c *Conn) *dataReader {
+	dr := &dataReader{
+		r: c.text.R,
+	}
+
+	if c.server.MaxMessageBytes > 0 {
+		dr.limited = true
+		dr.n = int64(c.server.MaxMessageBytes)
+	}
+
+	return dr
+}
+
+func (r *dataReader) Read(b []byte) (n int, err error) {
+	if r.limited {
+		if r.n <= 0 {
+			return 0, ErrDataTooLarge
+		}
+		if int64(len(b)) > r.n {
+			b = b[0:r.n]
+		}
+	}
+
+	// Code below is taken from net/textproto with only one modification to
+	// not rewrite CRLF -> LF.
+
+	// Run data through a simple state machine to
+	// elide leading dots and detect ending .\r\n line.
+	const (
+		stateBeginLine = iota // beginning of line; initial state; must be zero
+		stateDot              // read . at beginning of line
+		stateDotCR            // read .\r at beginning of line
+		stateCR               // read \r (possibly at end of line)
+		stateData             // reading data in middle of line
+		stateEOF              // reached .\r\n end marker line
+	)
+	for n < len(b) && r.state != stateEOF {
+		var c byte
+		c, err = r.r.ReadByte()
+		if err != nil {
+			if err == io.EOF {
+				err = io.ErrUnexpectedEOF
+			}
+			break
+		}
+		switch r.state {
+		case stateBeginLine:
+			if c == '.' {
+				r.state = stateDot
+				continue
+			}
+			r.state = stateData
+		case stateDot:
+			if c == '\r' {
+				r.state = stateDotCR
+				continue
+			}
+			if c == '\n' {
+				r.state = stateEOF
+				continue
+			}
+
+			r.state = stateData
+		case stateDotCR:
+			if c == '\n' {
+				r.state = stateEOF
+				continue
+			}
+			r.state = stateData
+		case stateCR:
+			if c == '\n' {
+				r.state = stateBeginLine
+				break
+			}
+			r.state = stateData
+		case stateData:
+			if c == '\r' {
+				r.state = stateCR
+			}
+			if c == '\n' {
+				r.state = stateBeginLine
+			}
+		}
+		b[n] = c
+		n++
+	}
+	if err == nil && r.state == stateEOF {
+		err = io.EOF
+	}
+
+	if r.limited {
+		r.n -= int64(n)
+	}
+	return
+}

vendor/github.com/emersion/go-smtp/lengthlimit_reader.go

@@ -0,0 +1,47 @@
+package smtp
+
+import (
+	"errors"
+	"io"
+)
+
+var ErrTooLongLine = errors.New("smtp: too longer line in input stream")
+
+// lineLimitReader reads from the underlying Reader but restricts
+// line length of lines in input stream to a certain length.
+//
+// If line length exceeds the limit - Read returns ErrTooLongLine
+type lineLimitReader struct {
+	R         io.Reader
+	LineLimit int
+
+	curLineLength int
+}
+
+func (r *lineLimitReader) Read(b []byte) (int, error) {
+	if r.curLineLength > r.LineLimit && r.LineLimit > 0 {
+		return 0, ErrTooLongLine
+	}
+
+	n, err := r.R.Read(b)
+	if err != nil {
+		return n, err
+	}
+
+	if r.LineLimit == 0 {
+		return n, nil
+	}
+
+	for _, chr := range b[:n] {
+		if chr == '\n' {
+			r.curLineLength = 0
+		}
+		r.curLineLength++
+
+		if r.curLineLength > r.LineLimit {
+			return 0, ErrTooLongLine
+		}
+	}
+
+	return n, nil
+}

vendor/github.com/emersion/go-smtp/parse.go

@@ -0,0 +1,70 @@
+package smtp
+
+import (
+	"fmt"
+	"strings"
+)
+
+func parseCmd(line string) (cmd string, arg string, err error) {
+	line = strings.TrimRight(line, "\r\n")
+
+	l := len(line)
+	switch {
+	case strings.HasPrefix(strings.ToUpper(line), "STARTTLS"):
+		return "STARTTLS", "", nil
+	case l == 0:
+		return "", "", nil
+	case l < 4:
+		return "", "", fmt.Errorf("Command too short: %q", line)
+	case l == 4:
+		return strings.ToUpper(line), "", nil
+	case l == 5:
+		// Too long to be only command, too short to have args
+		return "", "", fmt.Errorf("Mangled command: %q", line)
+	}
+
+	// If we made it here, command is long enough to have args
+	if line[4] != ' ' {
+		// There wasn't a space after the command?
+		return "", "", fmt.Errorf("Mangled command: %q", line)
+	}
+
+	// I'm not sure if we should trim the args or not, but we will for now
+	//return strings.ToUpper(line[0:4]), strings.Trim(line[5:], " "), nil
+	return strings.ToUpper(line[0:4]), strings.Trim(line[5:], " \n\r"), nil
+}
+
+// Takes the arguments proceeding a command and files them
+// into a map[string]string after uppercasing each key.  Sample arg
+// string:
+//		" BODY=8BITMIME SIZE=1024 SMTPUTF8"
+// The leading space is mandatory.
+func parseArgs(args []string) (map[string]string, error) {
+	argMap := map[string]string{}
+	for _, arg := range args {
+		if arg == "" {
+			continue
+		}
+		m := strings.Split(arg, "=")
+		switch len(m) {
+		case 2:
+			argMap[strings.ToUpper(m[0])] = m[1]
+		case 1:
+			argMap[strings.ToUpper(m[0])] = ""
+		default:
+			return nil, fmt.Errorf("Failed to parse arg string: %q", arg)
+		}
+	}
+	return argMap, nil
+}
+
+func parseHelloArgument(arg string) (string, error) {
+	domain := arg
+	if idx := strings.IndexRune(arg, ' '); idx >= 0 {
+		domain = arg[:idx]
+	}
+	if domain == "" {
+		return "", fmt.Errorf("Invalid domain")
+	}
+	return domain, nil
+}

vendor/github.com/emersion/go-smtp/server.go

@@ -0,0 +1,263 @@
+package smtp
+
+import (
+	"crypto/tls"
+	"errors"
+	"io"
+	"log"
+	"net"
+	"os"
+	"sync"
+	"time"
+
+	"github.com/emersion/go-sasl"
+)
+
+var errTCPAndLMTP = errors.New("smtp: cannot start LMTP server listening on a TCP socket")
+
+// A function that creates SASL servers.
+type SaslServerFactory func(conn *Conn) sasl.Server
+
+// Logger interface is used by Server to report unexpected internal errors.
+type Logger interface {
+	Printf(format string, v ...interface{})
+	Println(v ...interface{})
+}
+
+// A SMTP server.
+type Server struct {
+	// TCP or Unix address to listen on.
+	Addr string
+	// The server TLS configuration.
+	TLSConfig *tls.Config
+	// Enable LMTP mode, as defined in RFC 2033. LMTP mode cannot be used with a
+	// TCP listener.
+	LMTP bool
+
+	Domain            string
+	MaxRecipients     int
+	MaxMessageBytes   int
+	MaxLineLength     int
+	AllowInsecureAuth bool
+	Strict            bool
+	Debug             io.Writer
+	ErrorLog          Logger
+	ReadTimeout       time.Duration
+	WriteTimeout      time.Duration
+
+	// Advertise SMTPUTF8 (RFC 6531) capability.
+	// Should be used only if backend supports it.
+	EnableSMTPUTF8 bool
+
+	// Advertise REQUIRETLS (RFC 8689) capability.
+	// Should be used only if backend supports it.
+	EnableREQUIRETLS bool
+
+	// Advertise BINARYMIME (RFC 3030) capability.
+	// Should be used only if backend supports it.
+	EnableBINARYMIME bool
+
+	// If set, the AUTH command will not be advertised and authentication
+	// attempts will be rejected. This setting overrides AllowInsecureAuth.
+	AuthDisabled bool
+
+	// The server backend.
+	Backend Backend
+
+	caps  []string
+	auths map[string]SaslServerFactory
+	done  chan struct{}
+
+	locker    sync.Mutex
+	listeners []net.Listener
+	conns     map[*Conn]struct{}
+}
+
+// New creates a new SMTP server.
+func NewServer(be Backend) *Server {
+	return &Server{
+		// Doubled maximum line length per RFC 5321 (Section 4.5.3.1.6)
+		MaxLineLength: 2000,
+
+		Backend:  be,
+		done:     make(chan struct{}, 1),
+		ErrorLog: log.New(os.Stderr, "smtp/server ", log.LstdFlags),
+		caps:     []string{"PIPELINING", "8BITMIME", "ENHANCEDSTATUSCODES", "CHUNKING"},
+		auths: map[string]SaslServerFactory{
+			sasl.Plain: func(conn *Conn) sasl.Server {
+				return sasl.NewPlainServer(func(identity, username, password string) error {
+					if identity != "" && identity != username {
+						return errors.New("Identities not supported")
+					}
+
+					state := conn.State()
+					session, err := be.Login(&state, username, password)
+					if err != nil {
+						return err
+					}
+
+					conn.SetSession(session)
+					return nil
+				})
+			},
+		},
+		conns: make(map[*Conn]struct{}),
+	}
+}
+
+// Serve accepts incoming connections on the Listener l.
+func (s *Server) Serve(l net.Listener) error {
+	s.locker.Lock()
+	s.listeners = append(s.listeners, l)
+	s.locker.Unlock()
+
+	for {
+		c, err := l.Accept()
+		if err != nil {
+			select {
+			case <-s.done:
+				// we called Close()
+				return nil
+			default:
+				return err
+			}
+		}
+
+		go s.handleConn(newConn(c, s))
+	}
+}
+
+func (s *Server) handleConn(c *Conn) error {
+	s.locker.Lock()
+	s.conns[c] = struct{}{}
+	s.locker.Unlock()
+
+	defer func() {
+		c.Close()
+
+		s.locker.Lock()
+		delete(s.conns, c)
+		s.locker.Unlock()
+	}()
+
+	c.greet()
+
+	for {
+		line, err := c.ReadLine()
+		if err == nil {
+			cmd, arg, err := parseCmd(line)
+			if err != nil {
+				c.protocolError(501, EnhancedCode{5, 5, 2}, "Bad command")
+				continue
+			}
+
+			c.handle(cmd, arg)
+		} else {
+			if err == io.EOF {
+				return nil
+			}
+			if err == ErrTooLongLine {
+				c.WriteResponse(500, EnhancedCode{5, 4, 0}, "Too long line, closing connection")
+				return nil
+			}
+
+			if neterr, ok := err.(net.Error); ok && neterr.Timeout() {
+				c.WriteResponse(221, EnhancedCode{2, 4, 2}, "Idle timeout, bye bye")
+				return nil
+			}
+
+			c.WriteResponse(221, EnhancedCode{2, 4, 0}, "Connection error, sorry")
+			return err
+		}
+	}
+}
+
+// ListenAndServe listens on the network address s.Addr and then calls Serve
+// to handle requests on incoming connections.
+//
+// If s.Addr is blank and LMTP is disabled, ":smtp" is used.
+func (s *Server) ListenAndServe() error {
+	network := "tcp"
+	if s.LMTP {
+		network = "unix"
+	}
+
+	addr := s.Addr
+	if !s.LMTP && addr == "" {
+		addr = ":smtp"
+	}
+
+	l, err := net.Listen(network, addr)
+	if err != nil {
+		return err
+	}
+
+	return s.Serve(l)
+}
+
+// ListenAndServeTLS listens on the TCP network address s.Addr and then calls
+// Serve to handle requests on incoming TLS connections.
+//
+// If s.Addr is blank, ":smtps" is used.
+func (s *Server) ListenAndServeTLS() error {
+	if s.LMTP {
+		return errTCPAndLMTP
+	}
+
+	addr := s.Addr
+	if addr == "" {
+		addr = ":smtps"
+	}
+
+	l, err := tls.Listen("tcp", addr, s.TLSConfig)
+	if err != nil {
+		return err
+	}
+
+	return s.Serve(l)
+}
+
+// Close immediately closes all active listeners and connections.
+//
+// Close returns any error returned from closing the server's underlying
+// listener(s).
+func (s *Server) Close() error {
+	select {
+	case <-s.done:
+		return errors.New("smtp: server already closed")
+	default:
+		close(s.done)
+	}
+
+	var err error
+	for _, l := range s.listeners {
+		if lerr := l.Close(); lerr != nil && err == nil {
+			err = lerr
+		}
+	}
+
+	s.locker.Lock()
+	for conn := range s.conns {
+		conn.Close()
+	}
+	s.locker.Unlock()
+
+	return err
+}
+
+// EnableAuth enables an authentication mechanism on this server.
+//
+// This function should not be called directly, it must only be used by
+// libraries implementing extensions of the SMTP protocol.
+func (s *Server) EnableAuth(name string, f SaslServerFactory) {
+	s.auths[name] = f
+}
+
+// ForEachConn iterates through all opened connections.
+func (s *Server) ForEachConn(f func(*Conn)) {
+	s.locker.Lock()
+	defer s.locker.Unlock()
+	for conn := range s.conns {
+		f(conn)
+	}
+}

vendor/github.com/emersion/go-smtp/smtp.go

@@ -0,0 +1,30 @@
+// Package smtp implements the Simple Mail Transfer Protocol as defined in RFC 5321.
+//
+// It also implements the following extensions:
+//
+//  8BITMIME: RFC 1652
+//  AUTH: RFC 2554
+//  STARTTLS: RFC 3207
+//  ENHANCEDSTATUSCODES: RFC 2034
+//  SMTPUTF8: RFC 6531
+//  REQUIRETLS: RFC 8689
+//  CHUNKING: RFC 3030
+//  BINARYMIME: RFC 3030
+//
+// LMTP (RFC 2033) is also supported.
+//
+// Additional extensions may be handled by other packages.
+package smtp
+
+import (
+	"errors"
+	"strings"
+)
+
+// validateLine checks to see if a line has CR or LF as per RFC 5321
+func validateLine(line string) error {
+	if strings.ContainsAny(line, "\n\r") {
+		return errors.New("smtp: A line must not contain CR or LF")
+	}
+	return nil
+}

vendor/github.com/gabriel-vasile/mimetype/.gitattributes

@@ -0,0 +1 @@
+testdata/* linguist-vendored

vendor/github.com/gabriel-vasile/mimetype/CODE_OF_CONDUCT.md

@@ -0,0 +1,76 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, sex characteristics, gender identity and expression,
+level of experience, education, socio-economic status, nationality, personal
+appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+ advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+ address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+ professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at vasile.gabriel@email.com. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see
+https://www.contributor-covenant.org/faq

vendor/github.com/gabriel-vasile/mimetype/CONTRIBUTING.md

@@ -0,0 +1,12 @@
+## Contribute
+Contributions to **mimetype** are welcome. If you find an issue and you consider
+contributing, you can use the [Github issues tracker](https://github.com/gabriel-vasile/mimetype/issues)
+in order to report it, or better yet, open a pull request.
+
+Code contributions must respect these rules:
+ - code must be test covered
+ - code must be formatted using gofmt tool
+ - exported names must be documented
+
+**Important**: By submitting a pull request, you agree to allow the project
+owner to license your work under the same license as that used by the project.

vendor/github.com/gabriel-vasile/mimetype/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2018-2020 Gabriel Vasile
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

vendor/github.com/gabriel-vasile/mimetype/README.md

@@ -0,0 +1,108 @@
+<h1 align="center">
+  mimetype
+</h1>
+
+<h4 align="center">
+  A package for detecting MIME types and extensions based on magic numbers
+</h4>
+<h6 align="center">
+  Goroutine safe, extensible, no C bindings
+</h6>
+
+<p align="center">
+  <a href="https://travis-ci.org/gabriel-vasile/mimetype">
+    <img alt="Build Status" src="https://travis-ci.org/gabriel-vasile/mimetype.svg?branch=master">
+  </a>
+  <a href="https://pkg.go.dev/github.com/gabriel-vasile/mimetype">
+    <img alt="Go Reference" src="https://pkg.go.dev/badge/github.com/gabriel-vasile/mimetype.svg">
+  </a>
+  <a href="https://goreportcard.com/report/github.com/gabriel-vasile/mimetype">
+    <img alt="Go report card" src="https://goreportcard.com/badge/github.com/gabriel-vasile/mimetype">
+  </a>
+  <a href="https://codecov.io/gh/gabriel-vasile/mimetype">
+    <img alt="Code coverage" src="https://codecov.io/gh/gabriel-vasile/mimetype/branch/master/graph/badge.svg?token=qcfJF1kkl2"/>
+  </a>
+  <a href="LICENSE">
+    <img alt="License" src="https://img.shields.io/badge/License-MIT-green.svg">
+  </a>
+</p>
+
+## Features
+- fast and precise MIME type and file extension detection
+- long list of [supported MIME types](supported_mimes.md)
+- posibility to [extend](https://pkg.go.dev/github.com/gabriel-vasile/mimetype#example-package-Extend) with other file formats
+- common file formats are prioritized
+- [text vs. binary files differentiation](https://pkg.go.dev/github.com/gabriel-vasile/mimetype#example-package-TextVsBinary)
+- safe for concurrent usage
+
+## Install
+```bash
+go get github.com/gabriel-vasile/mimetype
+```
+
+## Usage
+```go
+mtype := mimetype.Detect([]byte)
+// OR
+mtype, err := mimetype.DetectReader(io.Reader)
+// OR
+mtype, err := mimetype.DetectFile("/path/to/file")
+fmt.Println(mtype.String(), mtype.Extension())
+```
+See the [runnable Go Playground examples](https://pkg.go.dev/github.com/gabriel-vasile/mimetype#pkg-overview).
+
+## Usage'
+Only use libraries like **mimetype** as a last resort. Content type detection
+using magic numbers is slow, inaccurate, and non-standard. Most of the times
+protocols have methods for specifying such metadata; e.g., `Content-Type` header
+in HTTP and SMTP.
+
+## FAQ
+Q: My file is in the list of [supported MIME types](supported_mimes.md) but
+it is not correctly detected. What should I do?
+
+A: Some file formats (often Microsoft Office documents) keep their signatures
+towards the end of the file. Try increasing the number of bytes used for detection
+with:
+```go
+mimetype.SetLimit(1024*1024) // Set limit to 1MB.
+// or
+mimetype.SetLimit(0) // No limit, whole file content used.
+mimetype.DetectFile("file.doc")
+```
+If increasing the limit does not help, please
+[open an issue](https://github.com/gabriel-vasile/mimetype/issues/new?assignees=&labels=&template=mismatched-mime-type-detected.md&title=).
+
+## Structure
+**mimetype** uses a hierarchical structure to keep the MIME type detection logic.
+This reduces the number of calls needed for detecting the file type. The reason
+behind this choice is that there are file formats used as containers for other
+file formats. For example, Microsoft Office files are just zip archives,
+containing specific metadata files. Once a file has been identified as a
+zip, there is no need to check if it is a text file, but it is worth checking if
+it is an Microsoft Office file.
+
+To prevent loading entire files into memory, when detecting from a
+[reader](https://pkg.go.dev/github.com/gabriel-vasile/mimetype#DetectReader)
+or from a [file](https://pkg.go.dev/github.com/gabriel-vasile/mimetype#DetectFile)
+**mimetype** limits itself to reading only the header of the input.
+<div align="center">
+  <img alt="structure" src="https://github.com/gabriel-vasile/mimetype/blob/420a05228c6a6efbb6e6f080168a25663414ff36/mimetype.gif?raw=true" width="88%">
+</div>
+
+## Performance
+Thanks to the hierarchical structure, searching for common formats first,
+and limiting itself to file headers, **mimetype** matches the performance of
+stdlib `http.DetectContentType` while outperforming the alternative package.
+
+```bash
+                            mimetype  http.DetectContentType      filetype
+BenchmarkMatchTar-24       250 ns/op         400 ns/op           3778 ns/op
+BenchmarkMatchZip-24       524 ns/op         351 ns/op           4884 ns/op
+BenchmarkMatchJpeg-24      103 ns/op         228 ns/op            839 ns/op
+BenchmarkMatchGif-24       139 ns/op         202 ns/op            751 ns/op
+BenchmarkMatchPng-24       165 ns/op         221 ns/op           1176 ns/op
+```
+
+## Contributing
+See [CONTRIBUTING.md](CONTRIBUTING.md).

vendor/github.com/gabriel-vasile/mimetype/internal/charset/charset.go

@@ -0,0 +1,309 @@
+package charset
+
+import (
+	"bytes"
+	"encoding/xml"
+	"strings"
+	"unicode/utf8"
+
+	"golang.org/x/net/html"
+)
+
+const (
+	F = 0 /* character never appears in text */
+	T = 1 /* character appears in plain ASCII text */
+	I = 2 /* character appears in ISO-8859 text */
+	X = 3 /* character appears in non-ISO extended ASCII (Mac, IBM PC) */
+)
+
+var (
+	boms = []struct {
+		bom []byte
+		enc string
+	}{
+		{[]byte{0xEF, 0xBB, 0xBF}, "utf-8"},
+		{[]byte{0x00, 0x00, 0xFE, 0xFF}, "utf-32be"},
+		{[]byte{0xFF, 0xFE, 0x00, 0x00}, "utf-32le"},
+		{[]byte{0xFE, 0xFF}, "utf-16be"},
+		{[]byte{0xFF, 0xFE}, "utf-16le"},
+	}
+
+	// https://github.com/file/file/blob/fa93fb9f7d21935f1c7644c47d2975d31f12b812/src/encoding.c#L241
+	textChars = [256]byte{
+		/*                  BEL BS HT LF VT FF CR    */
+		F, F, F, F, F, F, F, T, T, T, T, T, T, T, F, F, /* 0x0X */
+		/*                              ESC          */
+		F, F, F, F, F, F, F, F, F, F, F, T, F, F, F, F, /* 0x1X */
+		T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0x2X */
+		T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0x3X */
+		T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0x4X */
+		T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0x5X */
+		T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0x6X */
+		T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, F, /* 0x7X */
+		/*            NEL                            */
+		X, X, X, X, X, T, X, X, X, X, X, X, X, X, X, X, /* 0x8X */
+		X, X, X, X, X, X, X, X, X, X, X, X, X, X, X, X, /* 0x9X */
+		I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, /* 0xaX */
+		I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, /* 0xbX */
+		I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, /* 0xcX */
+		I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, /* 0xdX */
+		I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, /* 0xeX */
+		I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, /* 0xfX */
+	}
+)
+
+// FromBOM returns the charset declared in the BOM of content.
+func FromBOM(content []byte) string {
+	for _, b := range boms {
+		if bytes.HasPrefix(content, b.bom) {
+			return b.enc
+		}
+	}
+	return ""
+}
+
+// FromPlain returns the charset of a plain text. It relies on BOM presence
+// and it falls back on checking each byte in content.
+func FromPlain(content []byte) string {
+	if len(content) == 0 {
+		return ""
+	}
+	if cset := FromBOM(content); cset != "" {
+		return cset
+	}
+	origContent := content
+	// Try to detect UTF-8.
+	// First eliminate any partial rune at the end.
+	for i := len(content) - 1; i >= 0 && i > len(content)-4; i-- {
+		b := content[i]
+		if b < 0x80 {
+			break
+		}
+		if utf8.RuneStart(b) {
+			content = content[:i]
+			break
+		}
+	}
+	hasHighBit := false
+	for _, c := range content {
+		if c >= 0x80 {
+			hasHighBit = true
+			break
+		}
+	}
+	if hasHighBit && utf8.Valid(content) {
+		return "utf-8"
+	}
+
+	// ASCII is a subset of UTF8. Follow W3C recommendation and replace with UTF8.
+	if ascii(origContent) {
+		return "utf-8"
+	}
+
+	return latin(origContent)
+}
+
+func latin(content []byte) string {
+	hasControlBytes := false
+	for _, b := range content {
+		t := textChars[b]
+		if t != T && t != I {
+			return ""
+		}
+		if b >= 0x80 && b <= 0x9F {
+			hasControlBytes = true
+		}
+	}
+	// Code range 0x80 to 0x9F is reserved for control characters in ISO-8859-1
+	// (so-called C1 Controls). Windows 1252, however, has printable punctuation
+	// characters in this range.
+	if hasControlBytes {
+		return "windows-1252"
+	}
+	return "iso-8859-1"
+}
+
+func ascii(content []byte) bool {
+	for _, b := range content {
+		if textChars[b] != T {
+			return false
+		}
+	}
+	return true
+}
+
+// FromXML returns the charset of an XML document. It relies on the XML
+// header <?xml version="1.0" encoding="UTF-8"?> and falls back on the plain
+// text content.
+func FromXML(content []byte) string {
+	if cset := fromXML(content); cset != "" {
+		return cset
+	}
+	return FromPlain(content)
+}
+func fromXML(content []byte) string {
+	content = trimLWS(content)
+	dec := xml.NewDecoder(bytes.NewReader(content))
+	rawT, err := dec.RawToken()
+	if err != nil {
+		return ""
+	}
+
+	t, ok := rawT.(xml.ProcInst)
+	if !ok {
+		return ""
+	}
+
+	return strings.ToLower(xmlEncoding(string(t.Inst)))
+}
+
+// FromHTML returns the charset of an HTML document. It first looks if a BOM is
+// present and if so uses it to determine the charset. If no BOM is present,
+// it relies on the meta tag <meta charset="UTF-8"> and falls back on the
+// plain text content.
+func FromHTML(content []byte) string {
+	if cset := FromBOM(content); cset != "" {
+		return cset
+	}
+	if cset := fromHTML(content); cset != "" {
+		return cset
+	}
+	return FromPlain(content)
+}
+
+func fromHTML(content []byte) string {
+	z := html.NewTokenizer(bytes.NewReader(content))
+	for {
+		switch z.Next() {
+		case html.ErrorToken:
+			return ""
+
+		case html.StartTagToken, html.SelfClosingTagToken:
+			tagName, hasAttr := z.TagName()
+			if !bytes.Equal(tagName, []byte("meta")) {
+				continue
+			}
+			attrList := make(map[string]bool)
+			gotPragma := false
+
+			const (
+				dontKnow = iota
+				doNeedPragma
+				doNotNeedPragma
+			)
+			needPragma := dontKnow
+
+			name := ""
+			for hasAttr {
+				var key, val []byte
+				key, val, hasAttr = z.TagAttr()
+				ks := string(key)
+				if attrList[ks] {
+					continue
+				}
+				attrList[ks] = true
+				for i, c := range val {
+					if 'A' <= c && c <= 'Z' {
+						val[i] = c + 0x20
+					}
+				}
+
+				switch ks {
+				case "http-equiv":
+					if bytes.Equal(val, []byte("content-type")) {
+						gotPragma = true
+					}
+
+				case "content":
+					name = fromMetaElement(string(val))
+					if name != "" {
+						needPragma = doNeedPragma
+					}
+
+				case "charset":
+					name = string(val)
+					needPragma = doNotNeedPragma
+				}
+			}
+
+			if needPragma == dontKnow || needPragma == doNeedPragma && !gotPragma {
+				continue
+			}
+
+			if strings.HasPrefix(name, "utf-16") {
+				name = "utf-8"
+			}
+
+			return name
+		}
+	}
+}
+
+func fromMetaElement(s string) string {
+	for s != "" {
+		csLoc := strings.Index(s, "charset")
+		if csLoc == -1 {
+			return ""
+		}
+		s = s[csLoc+len("charset"):]
+		s = strings.TrimLeft(s, " \t\n\f\r")
+		if !strings.HasPrefix(s, "=") {
+			continue
+		}
+		s = s[1:]
+		s = strings.TrimLeft(s, " \t\n\f\r")
+		if s == "" {
+			return ""
+		}
+		if q := s[0]; q == '"' || q == '\'' {
+			s = s[1:]
+			closeQuote := strings.IndexRune(s, rune(q))
+			if closeQuote == -1 {
+				return ""
+			}
+			return s[:closeQuote]
+		}
+
+		end := strings.IndexAny(s, "; \t\n\f\r")
+		if end == -1 {
+			end = len(s)
+		}
+		return s[:end]
+	}
+	return ""
+}
+
+func xmlEncoding(s string) string {
+	param := "encoding="
+	idx := strings.Index(s, param)
+	if idx == -1 {
+		return ""
+	}
+	v := s[idx+len(param):]
+	if v == "" {
+		return ""
+	}
+	if v[0] != '\'' && v[0] != '"' {
+		return ""
+	}
+	idx = strings.IndexRune(v[1:], rune(v[0]))
+	if idx == -1 {
+		return ""
+	}
+	return v[1 : idx+1]
+}
+
+// trimLWS trims whitespace from beginning of the input.
+// TODO: find a way to call trimLWS once per detection instead of once in each
+// detector which needs the trimmed input.
+func trimLWS(in []byte) []byte {
+	firstNonWS := 0
+	for ; firstNonWS < len(in) && isWS(in[firstNonWS]); firstNonWS++ {
+	}
+
+	return in[firstNonWS:]
+}
+
+func isWS(b byte) bool {
+	return b == '\t' || b == '\n' || b == '\x0c' || b == '\r' || b == ' '
+}

vendor/github.com/gabriel-vasile/mimetype/internal/json/json.go

@@ -0,0 +1,544 @@
+// Copyright (c) 2009 The Go Authors. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//    * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//    * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//    * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Package json provides a JSON value parser state machine.
+// This package is almost entirely copied from the Go stdlib.
+// Changes made to it permit users of the package to tell
+// if some slice of bytes is a valid beginning of a json string.
+package json
+
+import (
+	"fmt"
+)
+
+type (
+	scanStatus int
+)
+
+const (
+	parseObjectKey   = iota // parsing object key (before colon)
+	parseObjectValue        // parsing object value (after colon)
+	parseArrayValue         // parsing array value
+
+	scanContinue     scanStatus = iota // uninteresting byte
+	scanBeginLiteral                   // end implied by next result != scanContinue
+	scanBeginObject                    // begin object
+	scanObjectKey                      // just finished object key (string)
+	scanObjectValue                    // just finished non-last object value
+	scanEndObject                      // end object (implies scanObjectValue if possible)
+	scanBeginArray                     // begin array
+	scanArrayValue                     // just finished array value
+	scanEndArray                       // end array (implies scanArrayValue if possible)
+	scanSkipSpace                      // space byte; can skip; known to be last "continue" result
+	scanEnd                            // top-level value ended *before* this byte; known to be first "stop" result
+	scanError                          // hit an error, scanner.err.
+
+	// This limits the max nesting depth to prevent stack overflow.
+	// This is permitted by https://tools.ietf.org/html/rfc7159#section-9
+	maxNestingDepth = 10000
+)
+
+type (
+	scanner struct {
+		step       func(*scanner, byte) scanStatus
+		parseState []int
+		endTop     bool
+		err        error
+		index      int
+	}
+)
+
+// Scan returns the number of bytes scanned and if there was any error
+// in trying to reach the end of data.
+func Scan(data []byte) (int, error) {
+	s := &scanner{}
+	_ = checkValid(data, s)
+	return s.index, s.err
+}
+
+// checkValid verifies that data is valid JSON-encoded data.
+// scan is passed in for use by checkValid to avoid an allocation.
+func checkValid(data []byte, scan *scanner) error {
+	scan.reset()
+	for _, c := range data {
+		scan.index++
+		if scan.step(scan, c) == scanError {
+			return scan.err
+		}
+	}
+	if scan.eof() == scanError {
+		return scan.err
+	}
+	return nil
+}
+
+func isSpace(c byte) bool {
+	return c == ' ' || c == '\t' || c == '\r' || c == '\n'
+}
+
+func (s *scanner) reset() {
+	s.step = stateBeginValue
+	s.parseState = s.parseState[0:0]
+	s.err = nil
+}
+
+// eof tells the scanner that the end of input has been reached.
+// It returns a scan status just as s.step does.
+func (s *scanner) eof() scanStatus {
+	if s.err != nil {
+		return scanError
+	}
+	if s.endTop {
+		return scanEnd
+	}
+	s.step(s, ' ')
+	if s.endTop {
+		return scanEnd
+	}
+	if s.err == nil {
+		s.err = fmt.Errorf("unexpected end of JSON input")
+	}
+	return scanError
+}
+
+// pushParseState pushes a new parse state p onto the parse stack.
+// an error state is returned if maxNestingDepth was exceeded, otherwise successState is returned.
+func (s *scanner) pushParseState(c byte, newParseState int, successState scanStatus) scanStatus {
+	s.parseState = append(s.parseState, newParseState)
+	if len(s.parseState) <= maxNestingDepth {
+		return successState
+	}
+	return s.error(c, "exceeded max depth")
+}
+
+// popParseState pops a parse state (already obtained) off the stack
+// and updates s.step accordingly.
+func (s *scanner) popParseState() {
+	n := len(s.parseState) - 1
+	s.parseState = s.parseState[0:n]
+	if n == 0 {
+		s.step = stateEndTop
+		s.endTop = true
+	} else {
+		s.step = stateEndValue
+	}
+}
+
+// stateBeginValueOrEmpty is the state after reading `[`.
+func stateBeginValueOrEmpty(s *scanner, c byte) scanStatus {
+	if c <= ' ' && isSpace(c) {
+		return scanSkipSpace
+	}
+	if c == ']' {
+		return stateEndValue(s, c)
+	}
+	return stateBeginValue(s, c)
+}
+
+// stateBeginValue is the state at the beginning of the input.
+func stateBeginValue(s *scanner, c byte) scanStatus {
+	if c <= ' ' && isSpace(c) {
+		return scanSkipSpace
+	}
+	switch c {
+	case '{':
+		s.step = stateBeginStringOrEmpty
+		return s.pushParseState(c, parseObjectKey, scanBeginObject)
+	case '[':
+		s.step = stateBeginValueOrEmpty
+		return s.pushParseState(c, parseArrayValue, scanBeginArray)
+	case '"':
+		s.step = stateInString
+		return scanBeginLiteral
+	case '-':
+		s.step = stateNeg
+		return scanBeginLiteral
+	case '0': // beginning of 0.123
+		s.step = state0
+		return scanBeginLiteral
+	case 't': // beginning of true
+		s.step = stateT
+		return scanBeginLiteral
+	case 'f': // beginning of false
+		s.step = stateF
+		return scanBeginLiteral
+	case 'n': // beginning of null
+		s.step = stateN
+		return scanBeginLiteral
+	}
+	if '1' <= c && c <= '9' { // beginning of 1234.5
+		s.step = state1
+		return scanBeginLiteral
+	}
+	return s.error(c, "looking for beginning of value")
+}
+
+// stateBeginStringOrEmpty is the state after reading `{`.
+func stateBeginStringOrEmpty(s *scanner, c byte) scanStatus {
+	if c <= ' ' && isSpace(c) {
+		return scanSkipSpace
+	}
+	if c == '}' {
+		n := len(s.parseState)
+		s.parseState[n-1] = parseObjectValue
+		return stateEndValue(s, c)
+	}
+	return stateBeginString(s, c)
+}
+
+// stateBeginString is the state after reading `{"key": value,`.
+func stateBeginString(s *scanner, c byte) scanStatus {
+	if c <= ' ' && isSpace(c) {
+		return scanSkipSpace
+	}
+	if c == '"' {
+		s.step = stateInString
+		return scanBeginLiteral
+	}
+	return s.error(c, "looking for beginning of object key string")
+}
+
+// stateEndValue is the state after completing a value,
+// such as after reading `{}` or `true` or `["x"`.
+func stateEndValue(s *scanner, c byte) scanStatus {
+	n := len(s.parseState)
+	if n == 0 {
+		// Completed top-level before the current byte.
+		s.step = stateEndTop
+		s.endTop = true
+		return stateEndTop(s, c)
+	}
+	if c <= ' ' && isSpace(c) {
+		s.step = stateEndValue
+		return scanSkipSpace
+	}
+	ps := s.parseState[n-1]
+	switch ps {
+	case parseObjectKey:
+		if c == ':' {
+			s.parseState[n-1] = parseObjectValue
+			s.step = stateBeginValue
+			return scanObjectKey
+		}
+		return s.error(c, "after object key")
+	case parseObjectValue:
+		if c == ',' {
+			s.parseState[n-1] = parseObjectKey
+			s.step = stateBeginString
+			return scanObjectValue
+		}
+		if c == '}' {
+			s.popParseState()
+			return scanEndObject
+		}
+		return s.error(c, "after object key:value pair")
+	case parseArrayValue:
+		if c == ',' {
+			s.step = stateBeginValue
+			return scanArrayValue
+		}
+		if c == ']' {
+			s.popParseState()
+			return scanEndArray
+		}
+		return s.error(c, "after array element")
+	}
+	return s.error(c, "")
+}
+
+// stateEndTop is the state after finishing the top-level value,
+// such as after reading `{}` or `[1,2,3]`.
+// Only space characters should be seen now.
+func stateEndTop(s *scanner, c byte) scanStatus {
+	if c != ' ' && c != '\t' && c != '\r' && c != '\n' {
+		// Complain about non-space byte on next call.
+		s.error(c, "after top-level value")
+	}
+	return scanEnd
+}
+
+// stateInString is the state after reading `"`.
+func stateInString(s *scanner, c byte) scanStatus {
+	if c == '"' {
+		s.step = stateEndValue
+		return scanContinue
+	}
+	if c == '\\' {
+		s.step = stateInStringEsc
+		return scanContinue
+	}
+	if c < 0x20 {
+		return s.error(c, "in string literal")
+	}
+	return scanContinue
+}
+
+// stateInStringEsc is the state after reading `"\` during a quoted string.
+func stateInStringEsc(s *scanner, c byte) scanStatus {
+	switch c {
+	case 'b', 'f', 'n', 'r', 't', '\\', '/', '"':
+		s.step = stateInString
+		return scanContinue
+	case 'u':
+		s.step = stateInStringEscU
+		return scanContinue
+	}
+	return s.error(c, "in string escape code")
+}
+
+// stateInStringEscU is the state after reading `"\u` during a quoted string.
+func stateInStringEscU(s *scanner, c byte) scanStatus {
+	if '0' <= c && c <= '9' || 'a' <= c && c <= 'f' || 'A' <= c && c <= 'F' {
+		s.step = stateInStringEscU1
+		return scanContinue
+	}
+	// numbers
+	return s.error(c, "in \\u hexadecimal character escape")
+}
+
+// stateInStringEscU1 is the state after reading `"\u1` during a quoted string.
+func stateInStringEscU1(s *scanner, c byte) scanStatus {
+	if '0' <= c && c <= '9' || 'a' <= c && c <= 'f' || 'A' <= c && c <= 'F' {
+		s.step = stateInStringEscU12
+		return scanContinue
+	}
+	// numbers
+	return s.error(c, "in \\u hexadecimal character escape")
+}
+
+// stateInStringEscU12 is the state after reading `"\u12` during a quoted string.
+func stateInStringEscU12(s *scanner, c byte) scanStatus {
+	if '0' <= c && c <= '9' || 'a' <= c && c <= 'f' || 'A' <= c && c <= 'F' {
+		s.step = stateInStringEscU123
+		return scanContinue
+	}
+	// numbers
+	return s.error(c, "in \\u hexadecimal character escape")
+}
+
+// stateInStringEscU123 is the state after reading `"\u123` during a quoted string.
+func stateInStringEscU123(s *scanner, c byte) scanStatus {
+	if '0' <= c && c <= '9' || 'a' <= c && c <= 'f' || 'A' <= c && c <= 'F' {
+		s.step = stateInString
+		return scanContinue
+	}
+	// numbers
+	return s.error(c, "in \\u hexadecimal character escape")
+}
+
+// stateNeg is the state after reading `-` during a number.
+func stateNeg(s *scanner, c byte) scanStatus {
+	if c == '0' {
+		s.step = state0
+		return scanContinue
+	}
+	if '1' <= c && c <= '9' {
+		s.step = state1
+		return scanContinue
+	}
+	return s.error(c, "in numeric literal")
+}
+
+// state1 is the state after reading a non-zero integer during a number,
+// such as after reading `1` or `100` but not `0`.
+func state1(s *scanner, c byte) scanStatus {
+	if '0' <= c && c <= '9' {
+		s.step = state1
+		return scanContinue
+	}
+	return state0(s, c)
+}
+
+// state0 is the state after reading `0` during a number.
+func state0(s *scanner, c byte) scanStatus {
+	if c == '.' {
+		s.step = stateDot
+		return scanContinue
+	}
+	if c == 'e' || c == 'E' {
+		s.step = stateE
+		return scanContinue
+	}
+	return stateEndValue(s, c)
+}
+
+// stateDot is the state after reading the integer and decimal point in a number,
+// such as after reading `1.`.
+func stateDot(s *scanner, c byte) scanStatus {
+	if '0' <= c && c <= '9' {
+		s.step = stateDot0
+		return scanContinue
+	}
+	return s.error(c, "after decimal point in numeric literal")
+}
+
+// stateDot0 is the state after reading the integer, decimal point, and subsequent
+// digits of a number, such as after reading `3.14`.
+func stateDot0(s *scanner, c byte) scanStatus {
+	if '0' <= c && c <= '9' {
+		return scanContinue
+	}
+	if c == 'e' || c == 'E' {
+		s.step = stateE
+		return scanContinue
+	}
+	return stateEndValue(s, c)
+}
+
+// stateE is the state after reading the mantissa and e in a number,
+// such as after reading `314e` or `0.314e`.
+func stateE(s *scanner, c byte) scanStatus {
+	if c == '+' || c == '-' {
+		s.step = stateESign
+		return scanContinue
+	}
+	return stateESign(s, c)
+}
+
+// stateESign is the state after reading the mantissa, e, and sign in a number,
+// such as after reading `314e-` or `0.314e+`.
+func stateESign(s *scanner, c byte) scanStatus {
+	if '0' <= c && c <= '9' {
+		s.step = stateE0
+		return scanContinue
+	}
+	return s.error(c, "in exponent of numeric literal")
+}
+
+// stateE0 is the state after reading the mantissa, e, optional sign,
+// and at least one digit of the exponent in a number,
+// such as after reading `314e-2` or `0.314e+1` or `3.14e0`.
+func stateE0(s *scanner, c byte) scanStatus {
+	if '0' <= c && c <= '9' {
+		return scanContinue
+	}
+	return stateEndValue(s, c)
+}
+
+// stateT is the state after reading `t`.
+func stateT(s *scanner, c byte) scanStatus {
+	if c == 'r' {
+		s.step = stateTr
+		return scanContinue
+	}
+	return s.error(c, "in literal true (expecting 'r')")
+}
+
+// stateTr is the state after reading `tr`.
+func stateTr(s *scanner, c byte) scanStatus {
+	if c == 'u' {
+		s.step = stateTru
+		return scanContinue
+	}
+	return s.error(c, "in literal true (expecting 'u')")
+}
+
+// stateTru is the state after reading `tru`.
+func stateTru(s *scanner, c byte) scanStatus {
+	if c == 'e' {
+		s.step = stateEndValue
+		return scanContinue
+	}
+	return s.error(c, "in literal true (expecting 'e')")
+}
+
+// stateF is the state after reading `f`.
+func stateF(s *scanner, c byte) scanStatus {
+	if c == 'a' {
+		s.step = stateFa
+		return scanContinue
+	}
+	return s.error(c, "in literal false (expecting 'a')")
+}
+
+// stateFa is the state after reading `fa`.
+func stateFa(s *scanner, c byte) scanStatus {
+	if c == 'l' {
+		s.step = stateFal
+		return scanContinue
+	}
+	return s.error(c, "in literal false (expecting 'l')")
+}
+
+// stateFal is the state after reading `fal`.
+func stateFal(s *scanner, c byte) scanStatus {
+	if c == 's' {
+		s.step = stateFals
+		return scanContinue
+	}
+	return s.error(c, "in literal false (expecting 's')")
+}
+
+// stateFals is the state after reading `fals`.
+func stateFals(s *scanner, c byte) scanStatus {
+	if c == 'e' {
+		s.step = stateEndValue
+		return scanContinue
+	}
+	return s.error(c, "in literal false (expecting 'e')")
+}
+
+// stateN is the state after reading `n`.
+func stateN(s *scanner, c byte) scanStatus {
+	if c == 'u' {
+		s.step = stateNu
+		return scanContinue
+	}
+	return s.error(c, "in literal null (expecting 'u')")
+}
+
+// stateNu is the state after reading `nu`.
+func stateNu(s *scanner, c byte) scanStatus {
+	if c == 'l' {
+		s.step = stateNul
+		return scanContinue
+	}
+	return s.error(c, "in literal null (expecting 'l')")
+}
+
+// stateNul is the state after reading `nul`.
+func stateNul(s *scanner, c byte) scanStatus {
+	if c == 'l' {
+		s.step = stateEndValue
+		return scanContinue
+	}
+	return s.error(c, "in literal null (expecting 'l')")
+}
+
+// stateError is the state after reaching a syntax error,
+// such as after reading `[1}` or `5.1.2`.
+func stateError(s *scanner, c byte) scanStatus {
+	return scanError
+}
+
+// error records an error and switches to the error state.
+func (s *scanner) error(c byte, context string) scanStatus {
+	s.step = stateError
+	s.err = fmt.Errorf("invalid character <<%c>> %s", c, context)
+	return scanError
+}

vendor/github.com/gabriel-vasile/mimetype/internal/magic/archive.go

@@ -0,0 +1,116 @@
+package magic
+
+import (
+	"bytes"
+	"encoding/binary"
+)
+
+var (
+	// SevenZ matches a 7z archive.
+	SevenZ = prefix([]byte{0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C})
+	// Gzip matches gzip files based on http://www.zlib.org/rfc-gzip.html#header-trailer.
+	Gzip = prefix([]byte{0x1f, 0x8b})
+	// Fits matches an Flexible Image Transport System file.
+	Fits = prefix([]byte{
+		0x53, 0x49, 0x4D, 0x50, 0x4C, 0x45, 0x20, 0x20, 0x3D, 0x20,
+		0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+		0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x54,
+	})
+	// Xar matches an eXtensible ARchive format file.
+	Xar = prefix([]byte{0x78, 0x61, 0x72, 0x21})
+	// Bz2 matches a bzip2 file.
+	Bz2 = prefix([]byte{0x42, 0x5A, 0x68})
+	// Ar matches an ar (Unix) archive file.
+	Ar = prefix([]byte{0x21, 0x3C, 0x61, 0x72, 0x63, 0x68, 0x3E})
+	// Deb matches a Debian package file.
+	Deb = offset([]byte{
+		0x64, 0x65, 0x62, 0x69, 0x61, 0x6E, 0x2D,
+		0x62, 0x69, 0x6E, 0x61, 0x72, 0x79,
+	}, 8)
+	// Warc matches a Web ARChive file.
+	Warc = prefix([]byte("WARC/1.0"), []byte("WARC/1.1"))
+	// Cab matches a Microsoft Cabinet archive file.
+	Cab = prefix([]byte("MSCF\x00\x00\x00\x00"))
+	// Xz matches an xz compressed stream based on https://tukaani.org/xz/xz-file-format.txt.
+	Xz = prefix([]byte{0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00})
+	// Lzip matches an Lzip compressed file.
+	Lzip = prefix([]byte{0x4c, 0x5a, 0x49, 0x50})
+	// RPM matches an RPM or Delta RPM package file.
+	RPM = prefix([]byte{0xed, 0xab, 0xee, 0xdb}, []byte("drpm"))
+	// Cpio matches a cpio archive file.
+	Cpio = prefix([]byte("070707"), []byte("070701"), []byte("070702"))
+	// RAR matches a RAR archive file.
+	RAR = prefix([]byte("Rar!\x1A\x07\x00"), []byte("Rar!\x1A\x07\x01\x00"))
+)
+
+// InstallShieldCab matches an InstallShield Cabinet archive file.
+func InstallShieldCab(raw []byte, _ uint32) bool {
+	return len(raw) > 7 &&
+		bytes.Equal(raw[0:4], []byte("ISc(")) &&
+		raw[6] == 0 &&
+		(raw[7] == 1 || raw[7] == 2 || raw[7] == 4)
+}
+
+// Zstd matches a Zstandard archive file.
+func Zstd(raw []byte, limit uint32) bool {
+	return len(raw) >= 4 &&
+		(0x22 <= raw[0] && raw[0] <= 0x28 || raw[0] == 0x1E) && // Different Zstandard versions.
+		bytes.HasPrefix(raw[1:], []byte{0xB5, 0x2F, 0xFD})
+}
+
+// CRX matches a Chrome extension file: a zip archive prepended by a package header.
+func CRX(raw []byte, limit uint32) bool {
+	const minHeaderLen = 16
+	if len(raw) < minHeaderLen || !bytes.HasPrefix(raw, []byte("Cr24")) {
+		return false
+	}
+	pubkeyLen := binary.LittleEndian.Uint32(raw[8:12])
+	sigLen := binary.LittleEndian.Uint32(raw[12:16])
+	zipOffset := minHeaderLen + pubkeyLen + sigLen
+	if uint32(len(raw)) < zipOffset {
+		return false
+	}
+	return Zip(raw[zipOffset:], limit)
+}
+
+// Tar matches a (t)ape (ar)chive file.
+//
+// Signature source: https://www.nationalarchives.gov.uk/PRONOM/Format/proFormatSearch.aspx?status=detailReport&id=385&strPageToDisplay=signatures
+func Tar(raw []byte, _ uint32) bool {
+	if len(raw) < 256 {
+		return false
+	}
+
+	rules := []struct {
+		min, max uint8
+		i        int
+	}{
+		{0x21, 0xEF, 0},
+		{0x30, 0x37, 105},
+		{0x20, 0x37, 106},
+		{0x00, 0x00, 107},
+		{0x30, 0x37, 113},
+		{0x20, 0x37, 114},
+		{0x00, 0x00, 115},
+		{0x30, 0x37, 121},
+		{0x20, 0x37, 122},
+		{0x00, 0x00, 123},
+		{0x30, 0x37, 134},
+		{0x30, 0x37, 146},
+		{0x30, 0x37, 153},
+		{0x00, 0x37, 154},
+	}
+	for _, r := range rules {
+		if raw[r.i] < r.min || raw[r.i] > r.max {
+			return false
+		}
+	}
+
+	for _, i := range []uint8{135, 147, 155} {
+		if raw[i] != 0x00 && raw[i] != 0x20 {
+			return false
+		}
+	}
+
+	return true
+}

vendor/github.com/gabriel-vasile/mimetype/internal/magic/audio.go

@@ -0,0 +1,76 @@
+package magic
+
+import (
+	"bytes"
+	"encoding/binary"
+)
+
+var (
+	// Flac matches a Free Lossless Audio Codec file.
+	Flac = prefix([]byte("\x66\x4C\x61\x43\x00\x00\x00\x22"))
+	// Midi matches a Musical Instrument Digital Interface file.
+	Midi = prefix([]byte("\x4D\x54\x68\x64"))
+	// Ape matches a Monkey's Audio file.
+	Ape = prefix([]byte("\x4D\x41\x43\x20\x96\x0F\x00\x00\x34\x00\x00\x00\x18\x00\x00\x00\x90\xE3"))
+	// MusePack matches a Musepack file.
+	MusePack = prefix([]byte("MPCK"))
+	// Au matches a Sun Microsystems au file.
+	Au = prefix([]byte("\x2E\x73\x6E\x64"))
+	// Amr matches an Adaptive Multi-Rate file.
+	Amr = prefix([]byte("\x23\x21\x41\x4D\x52"))
+	// Voc matches a Creative Voice file.
+	Voc = prefix([]byte("Creative Voice File"))
+	// M3u matches a Playlist file.
+	M3u = prefix([]byte("#EXTM3U"))
+	// AAC matches an Advanced Audio Coding file.
+	AAC = prefix([]byte{0xFF, 0xF1}, []byte{0xFF, 0xF9})
+)
+
+// Mp3 matches an mp3 file.
+func Mp3(raw []byte, limit uint32) bool {
+	if len(raw) < 3 {
+		return false
+	}
+
+	if bytes.HasPrefix(raw, []byte("ID3")) {
+		// MP3s with an ID3v2 tag will start with "ID3"
+		// ID3v1 tags, however appear at the end of the file.
+		return true
+	}
+
+	// Match MP3 files without tags
+	switch binary.BigEndian.Uint16(raw[:2]) & 0xFFFE {
+	case 0xFFFA:
+		// MPEG ADTS, layer III, v1
+		return true
+	case 0xFFF2:
+		// MPEG ADTS, layer III, v2
+		return true
+	case 0xFFE2:
+		// MPEG ADTS, layer III, v2.5
+		return true
+	}
+
+	return false
+}
+
+// Wav matches a Waveform Audio File Format file.
+func Wav(raw []byte, limit uint32) bool {
+	return len(raw) > 12 &&
+		bytes.Equal(raw[:4], []byte("RIFF")) &&
+		bytes.Equal(raw[8:12], []byte{0x57, 0x41, 0x56, 0x45})
+}
+
+// Aiff matches Audio Interchange File Format file.
+func Aiff(raw []byte, limit uint32) bool {
+	return len(raw) > 12 &&
+		bytes.Equal(raw[:4], []byte{0x46, 0x4F, 0x52, 0x4D}) &&
+		bytes.Equal(raw[8:12], []byte{0x41, 0x49, 0x46, 0x46})
+}
+
+// Qcp matches a Qualcomm Pure Voice file.
+func Qcp(raw []byte, limit uint32) bool {
+	return len(raw) > 12 &&
+		bytes.Equal(raw[:4], []byte("RIFF")) &&
+		bytes.Equal(raw[8:12], []byte("QLCM"))
+}

vendor/github.com/gabriel-vasile/mimetype/internal/magic/binary.go

@@ -0,0 +1,196 @@
+package magic
+
+import (
+	"bytes"
+	"debug/macho"
+	"encoding/binary"
+)
+
+var (
+	// Lnk matches Microsoft lnk binary format.
+	Lnk = prefix([]byte{0x4C, 0x00, 0x00, 0x00, 0x01, 0x14, 0x02, 0x00})
+	// Wasm matches a web assembly File Format file.
+	Wasm = prefix([]byte{0x00, 0x61, 0x73, 0x6D})
+	// Exe matches a Windows/DOS executable file.
+	Exe = prefix([]byte{0x4D, 0x5A})
+	// Elf matches an Executable and Linkable Format file.
+	Elf = prefix([]byte{0x7F, 0x45, 0x4C, 0x46})
+	// Nes matches a Nintendo Entertainment system ROM file.
+	Nes = prefix([]byte{0x4E, 0x45, 0x53, 0x1A})
+	// SWF matches an Adobe Flash swf file.
+	SWF = prefix([]byte("CWS"), []byte("FWS"), []byte("ZWS"))
+	// Torrent has bencoded text in the beginning.
+	Torrent = prefix([]byte("d8:announce"))
+)
+
+// Java bytecode and Mach-O binaries share the same magic number.
+// More info here https://github.com/threatstack/libmagic/blob/master/magic/Magdir/cafebabe
+func classOrMachOFat(in []byte) bool {
+	// There should be at least 8 bytes for both of them because the only way to
+	// quickly distinguish them is by comparing byte at position 7
+	if len(in) < 8 {
+		return false
+	}
+
+	return bytes.HasPrefix(in, []byte{0xCA, 0xFE, 0xBA, 0xBE})
+}
+
+// Class matches a java class file.
+func Class(raw []byte, limit uint32) bool {
+	return classOrMachOFat(raw) && raw[7] > 30
+}
+
+// MachO matches Mach-O binaries format.
+func MachO(raw []byte, limit uint32) bool {
+	if classOrMachOFat(raw) && raw[7] < 20 {
+		return true
+	}
+
+	if len(raw) < 4 {
+		return false
+	}
+
+	be := binary.BigEndian.Uint32(raw)
+	le := binary.LittleEndian.Uint32(raw)
+
+	return be == macho.Magic32 ||
+		le == macho.Magic32 ||
+		be == macho.Magic64 ||
+		le == macho.Magic64
+}
+
+// Dbf matches a dBase file.
+// https://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm
+func Dbf(raw []byte, limit uint32) bool {
+	if len(raw) < 68 {
+		return false
+	}
+
+	// 3rd and 4th bytes contain the last update month and day of month.
+	if !(0 < raw[2] && raw[2] < 13 && 0 < raw[3] && raw[3] < 32) {
+		return false
+	}
+
+	// 12, 13, 30, 31 are reserved bytes and always filled with 0x00.
+	if raw[12] != 0x00 || raw[13] != 0x00 || raw[30] != 0x00 || raw[31] != 0x00 {
+		return false
+	}
+	// Production MDX flag;
+	// 0x01 if a production .MDX file exists for this table;
+	// 0x00 if no .MDX file exists.
+	if raw[28] > 0x01 {
+		return false
+	}
+
+	// dbf type is dictated by the first byte.
+	dbfTypes := []byte{
+		0x02, 0x03, 0x04, 0x05, 0x30, 0x31, 0x32, 0x42, 0x62, 0x7B, 0x82,
+		0x83, 0x87, 0x8A, 0x8B, 0x8E, 0xB3, 0xCB, 0xE5, 0xF5, 0xF4, 0xFB,
+	}
+	for _, b := range dbfTypes {
+		if raw[0] == b {
+			return true
+		}
+	}
+
+	return false
+}
+
+// ElfObj matches an object file.
+func ElfObj(raw []byte, limit uint32) bool {
+	return len(raw) > 17 && ((raw[16] == 0x01 && raw[17] == 0x00) ||
+		(raw[16] == 0x00 && raw[17] == 0x01))
+}
+
+// ElfExe matches an executable file.
+func ElfExe(raw []byte, limit uint32) bool {
+	return len(raw) > 17 && ((raw[16] == 0x02 && raw[17] == 0x00) ||
+		(raw[16] == 0x00 && raw[17] == 0x02))
+}
+
+// ElfLib matches a shared library file.
+func ElfLib(raw []byte, limit uint32) bool {
+	return len(raw) > 17 && ((raw[16] == 0x03 && raw[17] == 0x00) ||
+		(raw[16] == 0x00 && raw[17] == 0x03))
+}
+
+// ElfDump matches a core dump file.
+func ElfDump(raw []byte, limit uint32) bool {
+	return len(raw) > 17 && ((raw[16] == 0x04 && raw[17] == 0x00) ||
+		(raw[16] == 0x00 && raw[17] == 0x04))
+}
+
+// Dcm matches a DICOM medical format file.
+func Dcm(raw []byte, limit uint32) bool {
+	return len(raw) > 131 &&
+		bytes.Equal(raw[128:132], []byte{0x44, 0x49, 0x43, 0x4D})
+}
+
+// Marc matches a MARC21 (MAchine-Readable Cataloging) file.
+func Marc(raw []byte, limit uint32) bool {
+	// File is at least 24 bytes ("leader" field size).
+	if len(raw) < 24 {
+		return false
+	}
+
+	// Fixed bytes at offset 20.
+	if !bytes.Equal(raw[20:24], []byte("4500")) {
+		return false
+	}
+
+	// First 5 bytes are ASCII digits.
+	for i := 0; i < 5; i++ {
+		if raw[i] < '0' || raw[i] > '9' {
+			return false
+		}
+	}
+
+	// Field terminator is present in first 2048 bytes.
+	return bytes.Contains(raw[:min(2048, len(raw))], []byte{0x1E})
+}
+
+// Glb matches a glTF model format file.
+// GLB is the binary file format representation of 3D models save in
+// the GL transmission Format (glTF).
+// see more: https://docs.fileformat.com/3d/glb/
+//           https://www.iana.org/assignments/media-types/model/gltf-binary
+// GLB file format is based on little endian and its header structure
+// show  below:
+//
+// <-- 12-byte header                             -->
+// | magic            | version          | length   |
+// | (uint32)         | (uint32)         | (uint32) |
+// | \x67\x6C\x54\x46 | \x01\x00\x00\x00 | ...      |
+// | g   l   T   F    | 1                | ...      |
+var Glb = prefix([]byte("\x67\x6C\x54\x46\x02\x00\x00\x00"),
+	[]byte("\x67\x6C\x54\x46\x01\x00\x00\x00"))
+
+// TzIf matches a Time Zone Information Format (TZif) file.
+// See more: https://tools.ietf.org/id/draft-murchison-tzdist-tzif-00.html#rfc.section.3
+// Its header structure is shown below:
+// +---------------+---+
+// |  magic    (4) | <-+-- version (1)
+// +---------------+---+---------------------------------------+
+// |           [unused - reserved for future use] (15)         |
+// +---------------+---------------+---------------+-----------+
+// |  isutccnt (4) |  isstdcnt (4) |  leapcnt  (4) |
+// +---------------+---------------+---------------+
+// |  timecnt  (4) |  typecnt  (4) |  charcnt  (4) |
+func TzIf(raw []byte, limit uint32) bool {
+	// File is at least 44 bytes (header size).
+	if len(raw) < 44 {
+		return false
+	}
+
+	if !bytes.HasPrefix(raw, []byte("TZif")) {
+		return false
+	}
+
+	// Field "typecnt" MUST not be zero.
+	if binary.BigEndian.Uint32(raw[36:40]) == 0 {
+		return false
+	}
+
+	// Version has to be NUL (0x00), '2' (0x32) or '3' (0x33).
+	return raw[4] == 0x00 || raw[4] == 0x32 || raw[4] == 0x33
+}

vendor/github.com/gabriel-vasile/mimetype/internal/magic/database.go

@@ -0,0 +1,13 @@
+package magic
+
+var (
+	// Sqlite matches an SQLite database file.
+	Sqlite = prefix([]byte{
+		0x53, 0x51, 0x4c, 0x69, 0x74, 0x65, 0x20, 0x66,
+		0x6f, 0x72, 0x6d, 0x61, 0x74, 0x20, 0x33, 0x00,
+	})
+	// MsAccessAce matches Microsoft Access dababase file.
+	MsAccessAce = offset([]byte("Standard ACE DB"), 4)
+	// MsAccessMdb matches legacy Microsoft Access database file (JET, 2003 and earlier).
+	MsAccessMdb = offset([]byte("Standard Jet DB"), 4)
+)

vendor/github.com/gabriel-vasile/mimetype/internal/magic/document.go

@@ -0,0 +1,62 @@
+package magic
+
+import "bytes"
+
+var (
+	// Pdf matches a Portable Document Format file.
+	// https://github.com/file/file/blob/11010cc805546a3e35597e67e1129a481aed40e8/magic/Magdir/pdf
+	Pdf = prefix(
+		// usual pdf signature
+		[]byte("%PDF-"),
+		// new-line prefixed signature
+		[]byte("\012%PDF-"),
+		// UTF-8 BOM prefixed signature
+		[]byte("\xef\xbb\xbf%PDF-"),
+	)
+	// Fdf matches a Forms Data Format file.
+	Fdf = prefix([]byte("%FDF"))
+	// Mobi matches a Mobi file.
+	Mobi = offset([]byte("BOOKMOBI"), 60)
+	// Lit matches a Microsoft Lit file.
+	Lit = prefix([]byte("ITOLITLS"))
+)
+
+// DjVu matches a DjVu file.
+func DjVu(raw []byte, limit uint32) bool {
+	if len(raw) < 12 {
+		return false
+	}
+	if !bytes.HasPrefix(raw, []byte{0x41, 0x54, 0x26, 0x54, 0x46, 0x4F, 0x52, 0x4D}) {
+		return false
+	}
+	return bytes.HasPrefix(raw[12:], []byte("DJVM")) ||
+		bytes.HasPrefix(raw[12:], []byte("DJVU")) ||
+		bytes.HasPrefix(raw[12:], []byte("DJVI")) ||
+		bytes.HasPrefix(raw[12:], []byte("THUM"))
+}
+
+// P7s matches an .p7s signature File (PEM, Base64).
+func P7s(raw []byte, limit uint32) bool {
+	// Check for PEM Encoding.
+	if bytes.HasPrefix(raw, []byte("-----BEGIN PKCS7")) {
+		return true
+	}
+	// Check if DER Encoding is long enough.
+	if len(raw) < 20 {
+		return false
+	}
+	// Magic Bytes for the signedData ASN.1 encoding.
+	startHeader := [][]byte{{0x30, 0x80}, {0x30, 0x81}, {0x30, 0x82}, {0x30, 0x83}, {0x30, 0x84}}
+	signedDataMatch := []byte{0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x07}
+	// Check if Header is correct. There are multiple valid headers.
+	for i, match := range startHeader {
+		// If first bytes match, then check for ASN.1 Object Type.
+		if bytes.HasPrefix(raw, match) {
+			if bytes.HasPrefix(raw[i+2:], signedDataMatch) {
+				return true
+			}
+		}
+	}
+
+	return false
+}

vendor/github.com/gabriel-vasile/mimetype/internal/magic/font.go

@@ -0,0 +1,39 @@
+package magic
+
+import (
+	"bytes"
+)
+
+var (
+	// Woff matches a Web Open Font Format file.
+	Woff = prefix([]byte("wOFF"))
+	// Woff2 matches a Web Open Font Format version 2 file.
+	Woff2 = prefix([]byte("wOF2"))
+	// Otf matches an OpenType font file.
+	Otf = prefix([]byte{0x4F, 0x54, 0x54, 0x4F, 0x00})
+)
+
+// Ttf matches a TrueType font file.
+func Ttf(raw []byte, limit uint32) bool {
+	if !bytes.HasPrefix(raw, []byte{0x00, 0x01, 0x00, 0x00}) {
+		return false
+	}
+	return !MsAccessAce(raw, limit) && !MsAccessMdb(raw, limit)
+}
+
+// Eot matches an Embedded OpenType font file.
+func Eot(raw []byte, limit uint32) bool {
+	return len(raw) > 35 &&
+		bytes.Equal(raw[34:36], []byte{0x4C, 0x50}) &&
+		(bytes.Equal(raw[8:11], []byte{0x02, 0x00, 0x01}) ||
+			bytes.Equal(raw[8:11], []byte{0x01, 0x00, 0x00}) ||
+			bytes.Equal(raw[8:11], []byte{0x02, 0x00, 0x02}))
+}
+
+// Ttc matches a TrueType Collection font file.
+func Ttc(raw []byte, limit uint32) bool {
+	return len(raw) > 7 &&
+		bytes.HasPrefix(raw, []byte("ttcf")) &&
+		(bytes.Equal(raw[4:8], []byte{0x00, 0x01, 0x00, 0x00}) ||
+			bytes.Equal(raw[4:8], []byte{0x00, 0x02, 0x00, 0x00}))
+}

vendor/github.com/gabriel-vasile/mimetype/internal/magic/ftyp.go

@@ -0,0 +1,57 @@
+package magic
+
+var (
+	// AVIF matches an AV1 Image File Format still or animated.
+	// Wikipedia page seems outdated listing image/avif-sequence for animations.
+	// https://github.com/AOMediaCodec/av1-avif/issues/59
+	AVIF = ftyp([]byte("avif"), []byte("avis"))
+	// Mp4 matches an MP4 file.
+	Mp4 = ftyp(
+		[]byte("avc1"), []byte("dash"), []byte("iso2"), []byte("iso3"),
+		[]byte("iso4"), []byte("iso5"), []byte("iso6"), []byte("isom"),
+		[]byte("mmp4"), []byte("mp41"), []byte("mp42"), []byte("mp4v"),
+		[]byte("mp71"), []byte("MSNV"), []byte("NDAS"), []byte("NDSC"),
+		[]byte("NSDC"), []byte("NSDH"), []byte("NDSM"), []byte("NDSP"),
+		[]byte("NDSS"), []byte("NDXC"), []byte("NDXH"), []byte("NDXM"),
+		[]byte("NDXP"), []byte("NDXS"), []byte("F4V "), []byte("F4P "),
+	)
+	// ThreeGP matches a 3GPP file.
+	ThreeGP = ftyp(
+		[]byte("3gp1"), []byte("3gp2"), []byte("3gp3"), []byte("3gp4"),
+		[]byte("3gp5"), []byte("3gp6"), []byte("3gp7"), []byte("3gs7"),
+		[]byte("3ge6"), []byte("3ge7"), []byte("3gg6"),
+	)
+	// ThreeG2 matches a 3GPP2 file.
+	ThreeG2 = ftyp(
+		[]byte("3g24"), []byte("3g25"), []byte("3g26"), []byte("3g2a"),
+		[]byte("3g2b"), []byte("3g2c"), []byte("KDDI"),
+	)
+	// AMp4 matches an audio MP4 file.
+	AMp4 = ftyp(
+		// audio for Adobe Flash Player 9+
+		[]byte("F4A "), []byte("F4B "),
+		// Apple iTunes AAC-LC (.M4A) Audio
+		[]byte("M4B "), []byte("M4P "),
+		// MPEG-4 (.MP4) for SonyPSP
+		[]byte("MSNV"),
+		// Nero Digital AAC Audio
+		[]byte("NDAS"),
+	)
+	// QuickTime matches a QuickTime File Format file.
+	QuickTime = ftyp([]byte("qt  "), []byte("moov"))
+	// Mqv matches a Sony / Mobile QuickTime  file.
+	Mqv = ftyp([]byte("mqt "))
+	// M4a matches an audio M4A file.
+	M4a = ftyp([]byte("M4A "))
+	// M4v matches an Appl4 M4V video file.
+	M4v = ftyp([]byte("M4V "), []byte("M4VH"), []byte("M4VP"))
+	// Heic matches a High Efficiency Image Coding (HEIC) file.
+	Heic = ftyp([]byte("heic"), []byte("heix"))
+	// HeicSequence matches a High Efficiency Image Coding (HEIC) file sequence.
+	HeicSequence = ftyp([]byte("hevc"), []byte("hevx"))
+	// Heif matches a High Efficiency Image File Format (HEIF) file.
+	Heif = ftyp([]byte("mif1"), []byte("heim"), []byte("heis"), []byte("avic"))
+	// HeifSequence matches a High Efficiency Image File Format (HEIF) file sequence.
+	HeifSequence = ftyp([]byte("msf1"), []byte("hevm"), []byte("hevs"), []byte("avcs"))
+	// TODO: add support for remaining video formats at ftyps.com.
+)

vendor/github.com/gabriel-vasile/mimetype/internal/magic/geo.go

@@ -0,0 +1,55 @@
+package magic
+
+import (
+	"bytes"
+	"encoding/binary"
+)
+
+// Shp matches a shape format file.
+// https://www.esri.com/library/whitepapers/pdfs/shapefile.pdf
+func Shp(raw []byte, limit uint32) bool {
+	if len(raw) < 112 {
+		return false
+	}
+
+	if !(binary.BigEndian.Uint32(raw[0:4]) == 9994 &&
+		binary.BigEndian.Uint32(raw[4:8]) == 0 &&
+		binary.BigEndian.Uint32(raw[8:12]) == 0 &&
+		binary.BigEndian.Uint32(raw[12:16]) == 0 &&
+		binary.BigEndian.Uint32(raw[16:20]) == 0 &&
+		binary.BigEndian.Uint32(raw[20:24]) == 0 &&
+		binary.LittleEndian.Uint32(raw[28:32]) == 1000) {
+		return false
+	}
+
+	shapeTypes := []int{
+		0,  // Null shape
+		1,  // Point
+		3,  // Polyline
+		5,  // Polygon
+		8,  // MultiPoint
+		11, // PointZ
+		13, // PolylineZ
+		15, // PolygonZ
+		18, // MultiPointZ
+		21, // PointM
+		23, // PolylineM
+		25, // PolygonM
+		28, // MultiPointM
+		31, // MultiPatch
+	}
+
+	for _, st := range shapeTypes {
+		if st == int(binary.LittleEndian.Uint32(raw[108:112])) {
+			return true
+		}
+	}
+
+	return false
+}
+
+// Shx matches a shape index format file.
+// https://www.esri.com/library/whitepapers/pdfs/shapefile.pdf
+func Shx(raw []byte, limit uint32) bool {
+	return bytes.HasPrefix(raw, []byte{0x00, 0x00, 0x27, 0x0A})
+}

vendor/github.com/gabriel-vasile/mimetype/internal/magic/image.go

@@ -0,0 +1,106 @@
+package magic
+
+import "bytes"
+
+var (
+	// Png matches a Portable Network Graphics file.
+	// https://www.w3.org/TR/PNG/
+	Png = prefix([]byte{0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A})
+	// Apng matches an Animated Portable Network Graphics file.
+	// https://wiki.mozilla.org/APNG_Specification
+	Apng = offset([]byte("acTL"), 37)
+	// Jpg matches a Joint Photographic Experts Group file.
+	Jpg = prefix([]byte{0xFF, 0xD8, 0xFF})
+	// Jp2 matches a JPEG 2000 Image file (ISO 15444-1).
+	Jp2 = jpeg2k([]byte{0x6a, 0x70, 0x32, 0x20})
+	// Jpx matches a JPEG 2000 Image file (ISO 15444-2).
+	Jpx = jpeg2k([]byte{0x6a, 0x70, 0x78, 0x20})
+	// Jpm matches a JPEG 2000 Image file (ISO 15444-6).
+	Jpm = jpeg2k([]byte{0x6a, 0x70, 0x6D, 0x20})
+	// Gif matches a Graphics Interchange Format file.
+	Gif = prefix([]byte("GIF87a"), []byte("GIF89a"))
+	// Bmp matches a bitmap image file.
+	Bmp = prefix([]byte{0x42, 0x4D})
+	// Ps matches a PostScript file.
+	Ps = prefix([]byte("%!PS-Adobe-"))
+	// Psd matches a Photoshop Document file.
+	Psd = prefix([]byte("8BPS"))
+	// Ico matches an ICO file.
+	Ico = prefix([]byte{0x00, 0x00, 0x01, 0x00}, []byte{0x00, 0x00, 0x02, 0x00})
+	// Icns matches an ICNS (Apple Icon Image format) file.
+	Icns = prefix([]byte("icns"))
+	// Tiff matches a Tagged Image File Format file.
+	Tiff = prefix([]byte{0x49, 0x49, 0x2A, 0x00}, []byte{0x4D, 0x4D, 0x00, 0x2A})
+	// Bpg matches a Better Portable Graphics file.
+	Bpg = prefix([]byte{0x42, 0x50, 0x47, 0xFB})
+	// Xcf matches GIMP image data.
+	Xcf = prefix([]byte("gimp xcf"))
+	// Pat matches GIMP pattern data.
+	Pat = offset([]byte("GPAT"), 20)
+	// Gbr matches GIMP brush data.
+	Gbr = offset([]byte("GIMP"), 20)
+	// Hdr matches Radiance HDR image.
+	// https://web.archive.org/web/20060913152809/http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/
+	Hdr = prefix([]byte("#?RADIANCE\n"))
+	// Xpm matches X PixMap image data.
+	Xpm = prefix([]byte{0x2F, 0x2A, 0x20, 0x58, 0x50, 0x4D, 0x20, 0x2A, 0x2F})
+)
+
+func jpeg2k(sig []byte) Detector {
+	return func(raw []byte, _ uint32) bool {
+		if len(raw) < 24 {
+			return false
+		}
+
+		if !bytes.Equal(raw[4:8], []byte{0x6A, 0x50, 0x20, 0x20}) &&
+			!bytes.Equal(raw[4:8], []byte{0x6A, 0x50, 0x32, 0x20}) {
+			return false
+		}
+		return bytes.Equal(raw[20:24], sig)
+	}
+}
+
+// Webp matches a WebP file.
+func Webp(raw []byte, _ uint32) bool {
+	return len(raw) > 12 &&
+		bytes.Equal(raw[0:4], []byte("RIFF")) &&
+		bytes.Equal(raw[8:12], []byte{0x57, 0x45, 0x42, 0x50})
+}
+
+// Dwg matches a CAD drawing file.
+func Dwg(raw []byte, _ uint32) bool {
+	if len(raw) < 6 || raw[0] != 0x41 || raw[1] != 0x43 {
+		return false
+	}
+	dwgVersions := [][]byte{
+		{0x31, 0x2E, 0x34, 0x30},
+		{0x31, 0x2E, 0x35, 0x30},
+		{0x32, 0x2E, 0x31, 0x30},
+		{0x31, 0x30, 0x30, 0x32},
+		{0x31, 0x30, 0x30, 0x33},
+		{0x31, 0x30, 0x30, 0x34},
+		{0x31, 0x30, 0x30, 0x36},
+		{0x31, 0x30, 0x30, 0x39},
+		{0x31, 0x30, 0x31, 0x32},
+		{0x31, 0x30, 0x31, 0x34},
+		{0x31, 0x30, 0x31, 0x35},
+		{0x31, 0x30, 0x31, 0x38},
+		{0x31, 0x30, 0x32, 0x31},
+		{0x31, 0x30, 0x32, 0x34},
+		{0x31, 0x30, 0x33, 0x32},
+	}
+
+	for _, d := range dwgVersions {
+		if bytes.Equal(raw[2:6], d) {
+			return true
+		}
+	}
+
+	return false
+}
+
+// Jxl matches JPEG XL image file.
+func Jxl(raw []byte, _ uint32) bool {
+	return bytes.HasPrefix(raw, []byte{0xFF, 0x0A}) ||
+		bytes.HasPrefix(raw, []byte("\x00\x00\x00\x0cJXL\x20\x0d\x0a\x87\x0a"))
+}

vendor/github.com/gabriel-vasile/mimetype/internal/magic/magic.go

@@ -0,0 +1,239 @@
+// Package magic holds the matching functions used to find MIME types.
+package magic
+
+import (
+	"bytes"
+	"fmt"
+)
+
+type (
+	// Detector receiveѕ the raw data of a file and returns whether the data
+	// meets any conditions. The limit parameter is an upper limit to the number
+	// of bytes received and is used to tell if the byte slice represents the
+	// whole file or is just the header of a file: len(raw) < limit or len(raw)>limit.
+	Detector func(raw []byte, limit uint32) bool
+	xmlSig   struct {
+		// the local name of the root tag
+		localName []byte
+		// the namespace of the XML document
+		xmlns []byte
+	}
+)
+
+// prefix creates a Detector which returns true if any of the provided signatures
+// is the prefix of the raw input.
+func prefix(sigs ...[]byte) Detector {
+	return func(raw []byte, limit uint32) bool {
+		for _, s := range sigs {
+			if bytes.HasPrefix(raw, s) {
+				return true
+			}
+		}
+		return false
+	}
+}
+
+// offset creates a Detector which returns true if the provided signature can be
+// found at offset in the raw input.
+func offset(sig []byte, offset int) Detector {
+	return func(raw []byte, limit uint32) bool {
+		return len(raw) > offset && bytes.HasPrefix(raw[offset:], sig)
+	}
+}
+
+// ciPrefix is like prefix but the check is case insensitive.
+func ciPrefix(sigs ...[]byte) Detector {
+	return func(raw []byte, limit uint32) bool {
+		for _, s := range sigs {
+			if ciCheck(s, raw) {
+				return true
+			}
+		}
+		return false
+	}
+}
+func ciCheck(sig, raw []byte) bool {
+	if len(raw) < len(sig)+1 {
+		return false
+	}
+	// perform case insensitive check
+	for i, b := range sig {
+		db := raw[i]
+		if 'A' <= b && b <= 'Z' {
+			db &= 0xDF
+		}
+		if b != db {
+			return false
+		}
+	}
+
+	return true
+}
+
+// xml creates a Detector which returns true if any of the provided XML signatures
+// matches the raw input.
+func xml(sigs ...xmlSig) Detector {
+	return func(raw []byte, limit uint32) bool {
+		raw = trimLWS(raw)
+		if len(raw) == 0 {
+			return false
+		}
+		for _, s := range sigs {
+			if xmlCheck(s, raw) {
+				return true
+			}
+		}
+		return false
+	}
+}
+func xmlCheck(sig xmlSig, raw []byte) bool {
+	raw = raw[:min(len(raw), 512)]
+
+	if len(sig.localName) == 0 {
+		return bytes.Index(raw, sig.xmlns) > 0
+	}
+	if len(sig.xmlns) == 0 {
+		return bytes.Index(raw, sig.localName) > 0
+	}
+
+	localNameIndex := bytes.Index(raw, sig.localName)
+	return localNameIndex != -1 && localNameIndex < bytes.Index(raw, sig.xmlns)
+}
+
+// markup creates a Detector which returns true is any of the HTML signatures
+// matches the raw input.
+func markup(sigs ...[]byte) Detector {
+	return func(raw []byte, limit uint32) bool {
+		if bytes.HasPrefix(raw, []byte{0xEF, 0xBB, 0xBF}) {
+			// We skip the UTF-8 BOM if present to ensure we correctly
+			// process any leading whitespace. The presence of the BOM
+			// is taken into account during charset detection in charset.go.
+			raw = trimLWS(raw[3:])
+		} else {
+			raw = trimLWS(raw)
+		}
+		if len(raw) == 0 {
+			return false
+		}
+		for _, s := range sigs {
+			if markupCheck(s, raw) {
+				return true
+			}
+		}
+		return false
+	}
+}
+func markupCheck(sig, raw []byte) bool {
+	if len(raw) < len(sig)+1 {
+		return false
+	}
+
+	// perform case insensitive check
+	for i, b := range sig {
+		db := raw[i]
+		if 'A' <= b && b <= 'Z' {
+			db &= 0xDF
+		}
+		if b != db {
+			return false
+		}
+	}
+	// Next byte must be space or right angle bracket.
+	if db := raw[len(sig)]; db != ' ' && db != '>' {
+		return false
+	}
+
+	return true
+}
+
+// ftyp creates a Detector which returns true if any of the FTYP signatures
+// matches the raw input.
+func ftyp(sigs ...[]byte) Detector {
+	return func(raw []byte, limit uint32) bool {
+		if len(raw) < 12 {
+			return false
+		}
+		for _, s := range sigs {
+			if bytes.Equal(raw[4:12], append([]byte("ftyp"), s...)) {
+				return true
+			}
+		}
+		return false
+	}
+}
+
+func newXMLSig(localName, xmlns string) xmlSig {
+	ret := xmlSig{xmlns: []byte(xmlns)}
+	if localName != "" {
+		ret.localName = []byte(fmt.Sprintf("<%s", localName))
+	}
+
+	return ret
+}
+
+// A valid shebang starts with the "#!" characters,
+// followed by any number of spaces,
+// followed by the path to the interpreter,
+// and, optionally, followed by the arguments for the interpreter.
+//
+// Ex:
+//  #! /usr/bin/env php
+// /usr/bin/env is the interpreter, php is the first and only argument.
+func shebang(sigs ...[]byte) Detector {
+	return func(raw []byte, limit uint32) bool {
+		for _, s := range sigs {
+			if shebangCheck(s, firstLine(raw)) {
+				return true
+			}
+		}
+		return false
+	}
+}
+
+func shebangCheck(sig, raw []byte) bool {
+	if len(raw) < len(sig)+2 {
+		return false
+	}
+	if raw[0] != '#' || raw[1] != '!' {
+		return false
+	}
+
+	return bytes.Equal(trimLWS(trimRWS(raw[2:])), sig)
+}
+
+// trimLWS trims whitespace from beginning of the input.
+func trimLWS(in []byte) []byte {
+	firstNonWS := 0
+	for ; firstNonWS < len(in) && isWS(in[firstNonWS]); firstNonWS++ {
+	}
+
+	return in[firstNonWS:]
+}
+
+// trimRWS trims whitespace from the end of the input.
+func trimRWS(in []byte) []byte {
+	lastNonWS := len(in) - 1
+	for ; lastNonWS > 0 && isWS(in[lastNonWS]); lastNonWS-- {
+	}
+
+	return in[:lastNonWS+1]
+}
+
+func firstLine(in []byte) []byte {
+	lineEnd := 0
+	for ; lineEnd < len(in) && in[lineEnd] != '\n'; lineEnd++ {
+	}
+
+	return in[:lineEnd]
+}
+
+func isWS(b byte) bool {
+	return b == '\t' || b == '\n' || b == '\x0c' || b == '\r' || b == ' '
+}
+
+func min(a, b int) int {
+	if a < b {
+		return a
+	}
+	return b
+}

vendor/github.com/gabriel-vasile/mimetype/internal/magic/ms_office.go

@@ -0,0 +1,225 @@
+package magic
+
+import (
+	"bytes"
+	"encoding/binary"
+)
+
+var (
+	xlsxSigFiles = []string{
+		"xl/worksheets/",
+		"xl/drawings/",
+		"xl/theme/",
+		"xl/_rels/",
+		"xl/styles.xml",
+		"xl/workbook.xml",
+		"xl/sharedStrings.xml",
+	}
+	docxSigFiles = []string{
+		"word/media/",
+		"word/_rels/document.xml.rels",
+		"word/document.xml",
+		"word/styles.xml",
+		"word/fontTable.xml",
+		"word/settings.xml",
+		"word/numbering.xml",
+		"word/header",
+		"word/footer",
+	}
+	pptxSigFiles = []string{
+		"ppt/slides/",
+		"ppt/media/",
+		"ppt/slideLayouts/",
+		"ppt/theme/",
+		"ppt/slideMasters/",
+		"ppt/tags/",
+		"ppt/notesMasters/",
+		"ppt/_rels/",
+		"ppt/handoutMasters/",
+		"ppt/notesSlides/",
+		"ppt/presentation.xml",
+		"ppt/tableStyles.xml",
+		"ppt/presProps.xml",
+		"ppt/viewProps.xml",
+	}
+)
+
+// Xlsx matches a Microsoft Excel 2007 file.
+func Xlsx(raw []byte, limit uint32) bool {
+	return zipContains(raw, xlsxSigFiles...)
+}
+
+// Docx matches a Microsoft Word 2007 file.
+func Docx(raw []byte, limit uint32) bool {
+	return zipContains(raw, docxSigFiles...)
+}
+
+// Pptx matches a Microsoft PowerPoint 2007 file.
+func Pptx(raw []byte, limit uint32) bool {
+	return zipContains(raw, pptxSigFiles...)
+}
+
+// Ole matches an Open Linking and Embedding file.
+//
+// https://en.wikipedia.org/wiki/Object_Linking_and_Embedding
+func Ole(raw []byte, limit uint32) bool {
+	return bytes.HasPrefix(raw, []byte{0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1})
+}
+
+// Aaf matches an Advanced Authoring Format file.
+// See: https://pyaaf.readthedocs.io/en/latest/about.html
+// See: https://en.wikipedia.org/wiki/Advanced_Authoring_Format
+func Aaf(raw []byte, limit uint32) bool {
+	if len(raw) < 31 {
+		return false
+	}
+	return bytes.HasPrefix(raw[8:], []byte{0x41, 0x41, 0x46, 0x42, 0x0D, 0x00, 0x4F, 0x4D}) &&
+		(raw[30] == 0x09 || raw[30] == 0x0C)
+}
+
+// Doc matches a Microsoft Word 97-2003 file.
+// See: https://github.com/decalage2/oletools/blob/412ee36ae45e70f42123e835871bac956d958461/oletools/common/clsid.py
+func Doc(raw []byte, _ uint32) bool {
+	clsids := [][]byte{
+		// Microsoft Word 97-2003 Document (Word.Document.8)
+		{0x06, 0x09, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46},
+		// Microsoft Word 6.0-7.0 Document (Word.Document.6)
+		{0x00, 0x09, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46},
+		// Microsoft Word Picture (Word.Picture.8)
+		{0x07, 0x09, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46},
+	}
+
+	for _, clsid := range clsids {
+		if matchOleClsid(raw, clsid) {
+			return true
+		}
+	}
+
+	return false
+}
+
+// Ppt matches a Microsoft PowerPoint 97-2003 file or a PowerPoint 95 presentation.
+func Ppt(raw []byte, limit uint32) bool {
+	// Root CLSID test is the safest way to detect identify OLE, however, the format
+	// often places the root CLSID at the end of the file.
+	if matchOleClsid(raw, []byte{
+		0x10, 0x8d, 0x81, 0x64, 0x9b, 0x4f, 0xcf, 0x11,
+		0x86, 0xea, 0x00, 0xaa, 0x00, 0xb9, 0x29, 0xe8,
+	}) || matchOleClsid(raw, []byte{
+		0x70, 0xae, 0x7b, 0xea, 0x3b, 0xfb, 0xcd, 0x11,
+		0xa9, 0x03, 0x00, 0xaa, 0x00, 0x51, 0x0e, 0xa3,
+	}) {
+		return true
+	}
+
+	lin := len(raw)
+	if lin < 520 {
+		return false
+	}
+	pptSubHeaders := [][]byte{
+		{0xA0, 0x46, 0x1D, 0xF0},
+		{0x00, 0x6E, 0x1E, 0xF0},
+		{0x0F, 0x00, 0xE8, 0x03},
+	}
+	for _, h := range pptSubHeaders {
+		if bytes.HasPrefix(raw[512:], h) {
+			return true
+		}
+	}
+
+	if bytes.HasPrefix(raw[512:], []byte{0xFD, 0xFF, 0xFF, 0xFF}) &&
+		raw[518] == 0x00 && raw[519] == 0x00 {
+		return true
+	}
+
+	return lin > 1152 && bytes.Contains(raw[1152:min(4096, lin)],
+		[]byte("P\x00o\x00w\x00e\x00r\x00P\x00o\x00i\x00n\x00t\x00 D\x00o\x00c\x00u\x00m\x00e\x00n\x00t"))
+}
+
+// Xls matches a Microsoft Excel 97-2003 file.
+func Xls(raw []byte, limit uint32) bool {
+	// Root CLSID test is the safest way to detect identify OLE, however, the format
+	// often places the root CLSID at the end of the file.
+	if matchOleClsid(raw, []byte{
+		0x10, 0x08, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00,
+	}) || matchOleClsid(raw, []byte{
+		0x20, 0x08, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00,
+	}) {
+		return true
+	}
+
+	lin := len(raw)
+	if lin < 520 {
+		return false
+	}
+	xlsSubHeaders := [][]byte{
+		{0x09, 0x08, 0x10, 0x00, 0x00, 0x06, 0x05, 0x00},
+		{0xFD, 0xFF, 0xFF, 0xFF, 0x10},
+		{0xFD, 0xFF, 0xFF, 0xFF, 0x1F},
+		{0xFD, 0xFF, 0xFF, 0xFF, 0x22},
+		{0xFD, 0xFF, 0xFF, 0xFF, 0x23},
+		{0xFD, 0xFF, 0xFF, 0xFF, 0x28},
+		{0xFD, 0xFF, 0xFF, 0xFF, 0x29},
+	}
+	for _, h := range xlsSubHeaders {
+		if bytes.HasPrefix(raw[512:], h) {
+			return true
+		}
+	}
+
+	return lin > 1152 && bytes.Contains(raw[1152:min(4096, lin)],
+		[]byte("W\x00k\x00s\x00S\x00S\x00W\x00o\x00r\x00k\x00B\x00o\x00o\x00k"))
+}
+
+// Pub matches a Microsoft Publisher file.
+func Pub(raw []byte, limit uint32) bool {
+	return matchOleClsid(raw, []byte{
+		0x01, 0x12, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46,
+	})
+}
+
+// Msg matches a Microsoft Outlook email file.
+func Msg(raw []byte, limit uint32) bool {
+	return matchOleClsid(raw, []byte{
+		0x0B, 0x0D, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46,
+	})
+}
+
+// Msi matches a Microsoft Windows Installer file.
+// http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
+func Msi(raw []byte, limit uint32) bool {
+	return matchOleClsid(raw, []byte{
+		0x84, 0x10, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46,
+	})
+}
+
+// Helper to match by a specific CLSID of a compound file.
+//
+// http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
+func matchOleClsid(in []byte, clsid []byte) bool {
+	// Microsoft Compound files v3 have a sector length of 512, while v4 has 4096.
+	// Change sector offset depending on file version.
+	// https://www.loc.gov/preservation/digital/formats/fdd/fdd000392.shtml
+	sectorLength := 512
+	if len(in) < sectorLength {
+		return false
+	}
+	if in[26] == 0x04 && in[27] == 0x00 {
+		sectorLength = 4096
+	}
+
+	// SecID of first sector of the directory stream.
+	firstSecID := int(binary.LittleEndian.Uint32(in[48:52]))
+
+	// Expected offset of CLSID for root storage object.
+	clsidOffset := sectorLength*(1+firstSecID) + 80
+
+	if len(in) <= clsidOffset+16 {
+		return false
+	}
+
+	return bytes.HasPrefix(in[clsidOffset:], clsid)
+}

vendor/github.com/gabriel-vasile/mimetype/internal/magic/ogg.go

@@ -0,0 +1,42 @@
+package magic
+
+import (
+	"bytes"
+)
+
+/*
+ NOTE:
+
+ In May 2003, two Internet RFCs were published relating to the format.
+ The Ogg bitstream was defined in RFC 3533 (which is classified as
+ 'informative') and its Internet content type (application/ogg) in RFC
+ 3534 (which is, as of 2006, a proposed standard protocol). In
+ September 2008, RFC 3534 was obsoleted by RFC 5334, which added
+ content types video/ogg, audio/ogg and filename extensions .ogx, .ogv,
+ .oga, .spx.
+
+ See:
+ https://tools.ietf.org/html/rfc3533
+ https://developer.mozilla.org/en-US/docs/Web/HTTP/Configuring_servers_for_Ogg_media#Serve_media_with_the_correct_MIME_type
+ https://github.com/file/file/blob/master/magic/Magdir/vorbis
+*/
+
+// Ogg matches an Ogg file.
+func Ogg(raw []byte, limit uint32) bool {
+	return bytes.HasPrefix(raw, []byte("\x4F\x67\x67\x53\x00"))
+}
+
+// OggAudio matches an audio ogg file.
+func OggAudio(raw []byte, limit uint32) bool {
+	return len(raw) >= 37 && (bytes.HasPrefix(raw[28:], []byte("\x7fFLAC")) ||
+		bytes.HasPrefix(raw[28:], []byte("\x01vorbis")) ||
+		bytes.HasPrefix(raw[28:], []byte("OpusHead")) ||
+		bytes.HasPrefix(raw[28:], []byte("Speex\x20\x20\x20")))
+}
+
+// OggVideo matches a video ogg file.
+func OggVideo(raw []byte, limit uint32) bool {
+	return len(raw) >= 37 && (bytes.HasPrefix(raw[28:], []byte("\x80theora")) ||
+		bytes.HasPrefix(raw[28:], []byte("fishead\x00")) ||
+		bytes.HasPrefix(raw[28:], []byte("\x01video\x00\x00\x00"))) // OGM video
+}

vendor/github.com/gabriel-vasile/mimetype/internal/magic/text.go

@@ -0,0 +1,375 @@
+package magic
+
+import (
+	"bufio"
+	"bytes"
+	"strings"
+	"time"
+
+	"github.com/gabriel-vasile/mimetype/internal/charset"
+	"github.com/gabriel-vasile/mimetype/internal/json"
+)
+
+var (
+	// HTML matches a Hypertext Markup Language file.
+	HTML = markup(
+		[]byte("<!DOCTYPE HTML"),
+		[]byte("<HTML"),
+		[]byte("<HEAD"),
+		[]byte("<SCRIPT"),
+		[]byte("<IFRAME"),
+		[]byte("<H1"),
+		[]byte("<DIV"),
+		[]byte("<FONT"),
+		[]byte("<TABLE"),
+		[]byte("<A"),
+		[]byte("<STYLE"),
+		[]byte("<TITLE"),
+		[]byte("<B"),
+		[]byte("<BODY"),
+		[]byte("<BR"),
+		[]byte("<P"),
+	)
+	// XML matches an Extensible Markup Language file.
+	XML = markup([]byte("<?XML"))
+	// Owl2 matches an Owl ontology file.
+	Owl2 = xml(newXMLSig("Ontology", `xmlns="http://www.w3.org/2002/07/owl#"`))
+	// Rss matches a Rich Site Summary file.
+	Rss = xml(newXMLSig("rss", ""))
+	// Atom matches an Atom Syndication Format file.
+	Atom = xml(newXMLSig("feed", `xmlns="http://www.w3.org/2005/Atom"`))
+	// Kml matches a Keyhole Markup Language file.
+	Kml = xml(
+		newXMLSig("kml", `xmlns="http://www.opengis.net/kml/2.2"`),
+		newXMLSig("kml", `xmlns="http://earth.google.com/kml/2.0"`),
+		newXMLSig("kml", `xmlns="http://earth.google.com/kml/2.1"`),
+		newXMLSig("kml", `xmlns="http://earth.google.com/kml/2.2"`),
+	)
+	// Xliff matches a XML Localization Interchange File Format file.
+	Xliff = xml(newXMLSig("xliff", `xmlns="urn:oasis:names:tc:xliff:document:1.2"`))
+	// Collada matches a COLLAborative Design Activity file.
+	Collada = xml(newXMLSig("COLLADA", `xmlns="http://www.collada.org/2005/11/COLLADASchema"`))
+	// Gml matches a Geography Markup Language file.
+	Gml = xml(
+		newXMLSig("", `xmlns:gml="http://www.opengis.net/gml"`),
+		newXMLSig("", `xmlns:gml="http://www.opengis.net/gml/3.2"`),
+		newXMLSig("", `xmlns:gml="http://www.opengis.net/gml/3.3/exr"`),
+	)
+	// Gpx matches a GPS Exchange Format file.
+	Gpx = xml(newXMLSig("gpx", `xmlns="http://www.topografix.com/GPX/1/1"`))
+	// Tcx matches a Training Center XML file.
+	Tcx = xml(newXMLSig("TrainingCenterDatabase", `xmlns="http://www.garmin.com/xmlschemas/TrainingCenterDatabase/v2"`))
+	// X3d matches an Extensible 3D Graphics file.
+	X3d = xml(newXMLSig("X3D", `xmlns:xsd="http://www.w3.org/2001/XMLSchema-instance"`))
+	// Amf matches an Additive Manufacturing XML file.
+	Amf = xml(newXMLSig("amf", ""))
+	// Threemf matches a 3D Manufacturing Format file.
+	Threemf = xml(newXMLSig("model", `xmlns="http://schemas.microsoft.com/3dmanufacturing/core/2015/02"`))
+	// Xfdf matches a XML Forms Data Format file.
+	Xfdf = xml(newXMLSig("xfdf", `xmlns="http://ns.adobe.com/xfdf/"`))
+	// VCard matches a Virtual Contact File.
+	VCard = ciPrefix([]byte("BEGIN:VCARD\n"), []byte("BEGIN:VCARD\r\n"))
+	// ICalendar matches a iCalendar file.
+	ICalendar = ciPrefix([]byte("BEGIN:VCALENDAR\n"), []byte("BEGIN:VCALENDAR\r\n"))
+	phpPageF  = ciPrefix(
+		[]byte("<?PHP"),
+		[]byte("<?\n"),
+		[]byte("<?\r"),
+		[]byte("<? "),
+	)
+	phpScriptF = shebang(
+		[]byte("/usr/local/bin/php"),
+		[]byte("/usr/bin/php"),
+		[]byte("/usr/bin/env php"),
+	)
+	// Js matches a Javascript file.
+	Js = shebang(
+		[]byte("/bin/node"),
+		[]byte("/usr/bin/node"),
+		[]byte("/bin/nodejs"),
+		[]byte("/usr/bin/nodejs"),
+		[]byte("/usr/bin/env node"),
+		[]byte("/usr/bin/env nodejs"),
+	)
+	// Lua matches a Lua programming language file.
+	Lua = shebang(
+		[]byte("/usr/bin/lua"),
+		[]byte("/usr/local/bin/lua"),
+		[]byte("/usr/bin/env lua"),
+	)
+	// Perl matches a Perl programming language file.
+	Perl = shebang(
+		[]byte("/usr/bin/perl"),
+		[]byte("/usr/bin/env perl"),
+	)
+	// Python matches a Python programming language file.
+	Python = shebang(
+		[]byte("/usr/bin/python"),
+		[]byte("/usr/local/bin/python"),
+		[]byte("/usr/bin/env python"),
+	)
+	// Tcl matches a Tcl programming language file.
+	Tcl = shebang(
+		[]byte("/usr/bin/tcl"),
+		[]byte("/usr/local/bin/tcl"),
+		[]byte("/usr/bin/env tcl"),
+		[]byte("/usr/bin/tclsh"),
+		[]byte("/usr/local/bin/tclsh"),
+		[]byte("/usr/bin/env tclsh"),
+		[]byte("/usr/bin/wish"),
+		[]byte("/usr/local/bin/wish"),
+		[]byte("/usr/bin/env wish"),
+	)
+	// Rtf matches a Rich Text Format file.
+	Rtf = prefix([]byte("{\\rtf1"))
+)
+
+// Text matches a plain text file.
+//
+// TODO: This function does not parse BOM-less UTF16 and UTF32 files. Not really
+// sure it should. Linux file utility also requires a BOM for UTF16 and UTF32.
+func Text(raw []byte, limit uint32) bool {
+	// First look for BOM.
+	if cset := charset.FromBOM(raw); cset != "" {
+		return true
+	}
+	// Binary data bytes as defined here: https://mimesniff.spec.whatwg.org/#binary-data-byte
+	for _, b := range raw {
+		if b <= 0x08 ||
+			b == 0x0B ||
+			0x0E <= b && b <= 0x1A ||
+			0x1C <= b && b <= 0x1F {
+			return false
+		}
+	}
+	return true
+}
+
+// Php matches a PHP: Hypertext Preprocessor file.
+func Php(raw []byte, limit uint32) bool {
+	if res := phpPageF(raw, limit); res {
+		return res
+	}
+	return phpScriptF(raw, limit)
+}
+
+// JSON matches a JavaScript Object Notation file.
+func JSON(raw []byte, limit uint32) bool {
+	raw = trimLWS(raw)
+	// #175 A single JSON string, number or bool is not considered JSON.
+	// JSON objects and arrays are reported as JSON.
+	if len(raw) < 2 || (raw[0] != '[' && raw[0] != '{') {
+		return false
+	}
+	parsed, err := json.Scan(raw)
+	// If the full file content was provided, check there is no error.
+	if limit == 0 || len(raw) < int(limit) {
+		return err == nil
+	}
+
+	// If a section of the file was provided, check if all of it was parsed.
+	return parsed == len(raw) && len(raw) > 0
+}
+
+// GeoJSON matches a RFC 7946 GeoJSON file.
+//
+// GeoJSON detection implies searching for key:value pairs like: `"type": "Feature"`
+// in the input.
+// BUG(gabriel-vasile): The "type" key should be searched for in the root object.
+func GeoJSON(raw []byte, limit uint32) bool {
+	raw = trimLWS(raw)
+	if len(raw) == 0 {
+		return false
+	}
+	// GeoJSON is always a JSON object, not a JSON array or any other JSON value.
+	if raw[0] != '{' {
+		return false
+	}
+
+	s := []byte(`"type"`)
+	si, sl := bytes.Index(raw, s), len(s)
+
+	if si == -1 {
+		return false
+	}
+
+	// If the "type" string is the suffix of the input,
+	// there is no need to search for the value of the key.
+	if si+sl == len(raw) {
+		return false
+	}
+	// Skip the "type" part.
+	raw = raw[si+sl:]
+	// Skip any whitespace before the colon.
+	raw = trimLWS(raw)
+	// Check for colon.
+	if len(raw) == 0 || raw[0] != ':' {
+		return false
+	}
+	// Skip any whitespace after the colon.
+	raw = trimLWS(raw[1:])
+
+	geoJSONTypes := [][]byte{
+		[]byte(`"Feature"`),
+		[]byte(`"FeatureCollection"`),
+		[]byte(`"Point"`),
+		[]byte(`"LineString"`),
+		[]byte(`"Polygon"`),
+		[]byte(`"MultiPoint"`),
+		[]byte(`"MultiLineString"`),
+		[]byte(`"MultiPolygon"`),
+		[]byte(`"GeometryCollection"`),
+	}
+	for _, t := range geoJSONTypes {
+		if bytes.HasPrefix(raw, t) {
+			return true
+		}
+	}
+
+	return false
+}
+
+// NdJSON matches a Newline delimited JSON file. All complete lines from raw
+// must be valid JSON documents meaning they contain one of the valid JSON data
+// types.
+func NdJSON(raw []byte, limit uint32) bool {
+	lCount, hasObjOrArr := 0, false
+	sc := bufio.NewScanner(dropLastLine(raw, limit))
+	for sc.Scan() {
+		l := sc.Bytes()
+		// Empty lines are allowed in NDJSON.
+		if l = trimRWS(trimLWS(l)); len(l) == 0 {
+			continue
+		}
+		_, err := json.Scan(l)
+		if err != nil {
+			return false
+		}
+		if l[0] == '[' || l[0] == '{' {
+			hasObjOrArr = true
+		}
+		lCount++
+	}
+
+	return lCount > 1 && hasObjOrArr
+}
+
+// HAR matches a HAR Spec file.
+// Spec: http://www.softwareishard.com/blog/har-12-spec/
+func HAR(raw []byte, limit uint32) bool {
+	s := []byte(`"log"`)
+	si, sl := bytes.Index(raw, s), len(s)
+
+	if si == -1 {
+		return false
+	}
+
+	// If the "log" string is the suffix of the input,
+	// there is no need to search for the value of the key.
+	if si+sl == len(raw) {
+		return false
+	}
+	// Skip the "log" part.
+	raw = raw[si+sl:]
+	// Skip any whitespace before the colon.
+	raw = trimLWS(raw)
+	// Check for colon.
+	if len(raw) == 0 || raw[0] != ':' {
+		return false
+	}
+	// Skip any whitespace after the colon.
+	raw = trimLWS(raw[1:])
+
+	harJSONTypes := [][]byte{
+		[]byte(`"version"`),
+		[]byte(`"creator"`),
+		[]byte(`"entries"`),
+	}
+	for _, t := range harJSONTypes {
+		si := bytes.Index(raw, t)
+		if si > -1 {
+			return true
+		}
+	}
+
+	return false
+}
+
+// Svg matches a SVG file.
+func Svg(raw []byte, limit uint32) bool {
+	return bytes.Contains(raw, []byte("<svg"))
+}
+
+// Srt matches a SubRip file.
+func Srt(in []byte, _ uint32) bool {
+	s := bufio.NewScanner(bytes.NewReader(in))
+	if !s.Scan() {
+		return false
+	}
+	// First line must be 1.
+	if s.Text() != "1" {
+		return false
+	}
+
+	if !s.Scan() {
+		return false
+	}
+	secondLine := s.Text()
+	// Timestamp format (e.g: 00:02:16,612 --> 00:02:19,376) limits secondLine
+	// length to exactly 29 characters.
+	if len(secondLine) != 29 {
+		return false
+	}
+	// Decimal separator of fractional seconds in the timestamps must be a
+	// comma, not a period.
+	if strings.Contains(secondLine, ".") {
+		return false
+	}
+	// For Go <1.17, comma is not recognised as a decimal separator by `time.Parse`.
+	secondLine = strings.ReplaceAll(secondLine, ",", ".")
+	// Second line must be a time range.
+	ts := strings.Split(secondLine, " --> ")
+	if len(ts) != 2 {
+		return false
+	}
+	const layout = "15:04:05.000"
+	t0, err := time.Parse(layout, ts[0])
+	if err != nil {
+		return false
+	}
+	t1, err := time.Parse(layout, ts[1])
+	if err != nil {
+		return false
+	}
+	if t0.After(t1) {
+		return false
+	}
+
+	// A third line must exist and not be empty. This is the actual subtitle text.
+	return s.Scan() && len(s.Bytes()) != 0
+}
+
+// Vtt matches a Web Video Text Tracks (WebVTT) file. See
+// https://www.iana.org/assignments/media-types/text/vtt.
+func Vtt(raw []byte, limit uint32) bool {
+	// Prefix match.
+	prefixes := [][]byte{
+		{0xEF, 0xBB, 0xBF, 0x57, 0x45, 0x42, 0x56, 0x54, 0x54, 0x0A}, // UTF-8 BOM, "WEBVTT" and a line feed
+		{0xEF, 0xBB, 0xBF, 0x57, 0x45, 0x42, 0x56, 0x54, 0x54, 0x0D}, // UTF-8 BOM, "WEBVTT" and a carriage return
+		{0xEF, 0xBB, 0xBF, 0x57, 0x45, 0x42, 0x56, 0x54, 0x54, 0x20}, // UTF-8 BOM, "WEBVTT" and a space
+		{0xEF, 0xBB, 0xBF, 0x57, 0x45, 0x42, 0x56, 0x54, 0x54, 0x09}, // UTF-8 BOM, "WEBVTT" and a horizontal tab
+		{0x57, 0x45, 0x42, 0x56, 0x54, 0x54, 0x0A},                   // "WEBVTT" and a line feed
+		{0x57, 0x45, 0x42, 0x56, 0x54, 0x54, 0x0D},                   // "WEBVTT" and a carriage return
+		{0x57, 0x45, 0x42, 0x56, 0x54, 0x54, 0x20},                   // "WEBVTT" and a space
+		{0x57, 0x45, 0x42, 0x56, 0x54, 0x54, 0x09},                   // "WEBVTT" and a horizontal tab
+	}
+	for _, p := range prefixes {
+		if bytes.HasPrefix(raw, p) {
+			return true
+		}
+	}
+
+	// Exact match.
+	return bytes.Equal(raw, []byte{0xEF, 0xBB, 0xBF, 0x57, 0x45, 0x42, 0x56, 0x54, 0x54}) || // UTF-8 BOM and "WEBVTT"
+		bytes.Equal(raw, []byte{0x57, 0x45, 0x42, 0x56, 0x54, 0x54}) // "WEBVTT"
+}

vendor/github.com/gabriel-vasile/mimetype/internal/magic/text_csv.go

@@ -0,0 +1,51 @@
+package magic
+
+import (
+	"bytes"
+	"encoding/csv"
+	"io"
+)
+
+// Csv matches a comma-separated values file.
+func Csv(raw []byte, limit uint32) bool {
+	return sv(raw, ',', limit)
+}
+
+// Tsv matches a tab-separated values file.
+func Tsv(raw []byte, limit uint32) bool {
+	return sv(raw, '\t', limit)
+}
+
+func sv(in []byte, comma rune, limit uint32) bool {
+	r := csv.NewReader(dropLastLine(in, limit))
+	r.Comma = comma
+	r.TrimLeadingSpace = true
+	r.LazyQuotes = true
+	r.Comment = '#'
+
+	lines, err := r.ReadAll()
+	return err == nil && r.FieldsPerRecord > 1 && len(lines) > 1
+}
+
+// dropLastLine drops the last incomplete line from b.
+//
+// mimetype limits itself to ReadLimit bytes when performing a detection.
+// This means, for file formats like CSV for NDJSON, the last line of the input
+// can be an incomplete line.
+func dropLastLine(b []byte, cutAt uint32) io.Reader {
+	if cutAt == 0 {
+		return bytes.NewReader(b)
+	}
+	if uint32(len(b)) >= cutAt {
+		for i := cutAt - 1; i > 0; i-- {
+			if b[i] == '\n' {
+				return bytes.NewReader(b[:i])
+			}
+		}
+
+		// No newline was found between the 0 index and cutAt.
+		return bytes.NewReader(b[:cutAt])
+	}
+
+	return bytes.NewReader(b)
+}

vendor/github.com/gabriel-vasile/mimetype/internal/magic/video.go

@@ -0,0 +1,85 @@
+package magic
+
+import (
+	"bytes"
+)
+
+var (
+	// Flv matches a Flash video file.
+	Flv = prefix([]byte("\x46\x4C\x56\x01"))
+	// Asf matches an Advanced Systems Format file.
+	Asf = prefix([]byte{
+		0x30, 0x26, 0xB2, 0x75, 0x8E, 0x66, 0xCF, 0x11,
+		0xA6, 0xD9, 0x00, 0xAA, 0x00, 0x62, 0xCE, 0x6C,
+	})
+	// Rmvb matches a RealMedia Variable Bitrate file.
+	Rmvb = prefix([]byte{0x2E, 0x52, 0x4D, 0x46})
+)
+
+// WebM matches a WebM file.
+func WebM(raw []byte, limit uint32) bool {
+	return isMatroskaFileTypeMatched(raw, "webm")
+}
+
+// Mkv matches a mkv file.
+func Mkv(raw []byte, limit uint32) bool {
+	return isMatroskaFileTypeMatched(raw, "matroska")
+}
+
+// isMatroskaFileTypeMatched is used for webm and mkv file matching.
+// It checks for .Eߣ sequence. If the sequence is found,
+// then it means it is Matroska media container, including WebM.
+// Then it verifies which of the file type it is representing by matching the
+// file specific string.
+func isMatroskaFileTypeMatched(in []byte, flType string) bool {
+	if bytes.HasPrefix(in, []byte("\x1A\x45\xDF\xA3")) {
+		return isFileTypeNamePresent(in, flType)
+	}
+	return false
+}
+
+// isFileTypeNamePresent accepts the matroska input data stream and searches
+// for the given file type in the stream. Return whether a match is found.
+// The logic of search is: find first instance of \x42\x82 and then
+// search for given string after n bytes of above instance.
+func isFileTypeNamePresent(in []byte, flType string) bool {
+	ind, maxInd, lenIn := 0, 4096, len(in)
+	if lenIn < maxInd { // restricting length to 4096
+		maxInd = lenIn
+	}
+	ind = bytes.Index(in[:maxInd], []byte("\x42\x82"))
+	if ind > 0 && lenIn > ind+2 {
+		ind += 2
+
+		// filetype name will be present exactly
+		// n bytes after the match of the two bytes "\x42\x82"
+		n := vintWidth(int(in[ind]))
+		if lenIn > ind+n {
+			return bytes.HasPrefix(in[ind+n:], []byte(flType))
+		}
+	}
+	return false
+}
+
+// vintWidth parses the variable-integer width in matroska containers
+func vintWidth(v int) int {
+	mask, max, num := 128, 8, 1
+	for num < max && v&mask == 0 {
+		mask = mask >> 1
+		num++
+	}
+	return num
+}
+
+// Mpeg matches a Moving Picture Experts Group file.
+func Mpeg(raw []byte, limit uint32) bool {
+	return len(raw) > 3 && bytes.HasPrefix(raw, []byte{0x00, 0x00, 0x01}) &&
+		raw[3] >= 0xB0 && raw[3] <= 0xBF
+}
+
+// Avi matches an Audio Video Interleaved file.
+func Avi(raw []byte, limit uint32) bool {
+	return len(raw) > 16 &&
+		bytes.Equal(raw[:4], []byte("RIFF")) &&
+		bytes.Equal(raw[8:16], []byte("AVI LIST"))
+}

vendor/github.com/gabriel-vasile/mimetype/internal/magic/zip.go

@@ -0,0 +1,92 @@
+package magic
+
+import (
+	"bytes"
+	"encoding/binary"
+	"strings"
+)
+
+var (
+	// Odt matches an OpenDocument Text file.
+	Odt = offset([]byte("mimetypeapplication/vnd.oasis.opendocument.text"), 30)
+	// Ott matches an OpenDocument Text Template file.
+	Ott = offset([]byte("mimetypeapplication/vnd.oasis.opendocument.text-template"), 30)
+	// Ods matches an OpenDocument Spreadsheet file.
+	Ods = offset([]byte("mimetypeapplication/vnd.oasis.opendocument.spreadsheet"), 30)
+	// Ots matches an OpenDocument Spreadsheet Template file.
+	Ots = offset([]byte("mimetypeapplication/vnd.oasis.opendocument.spreadsheet-template"), 30)
+	// Odp matches an OpenDocument Presentation file.
+	Odp = offset([]byte("mimetypeapplication/vnd.oasis.opendocument.presentation"), 30)
+	// Otp matches an OpenDocument Presentation Template file.
+	Otp = offset([]byte("mimetypeapplication/vnd.oasis.opendocument.presentation-template"), 30)
+	// Odg matches an OpenDocument Drawing file.
+	Odg = offset([]byte("mimetypeapplication/vnd.oasis.opendocument.graphics"), 30)
+	// Otg matches an OpenDocument Drawing Template file.
+	Otg = offset([]byte("mimetypeapplication/vnd.oasis.opendocument.graphics-template"), 30)
+	// Odf matches an OpenDocument Formula file.
+	Odf = offset([]byte("mimetypeapplication/vnd.oasis.opendocument.formula"), 30)
+	// Odc matches an OpenDocument Chart file.
+	Odc = offset([]byte("mimetypeapplication/vnd.oasis.opendocument.chart"), 30)
+	// Epub matches an EPUB file.
+	Epub = offset([]byte("mimetypeapplication/epub+zip"), 30)
+	// Sxc matches an OpenOffice Spreadsheet file.
+	Sxc = offset([]byte("mimetypeapplication/vnd.sun.xml.calc"), 30)
+)
+
+// Zip matches a zip archive.
+func Zip(raw []byte, limit uint32) bool {
+	return len(raw) > 3 &&
+		raw[0] == 0x50 && raw[1] == 0x4B &&
+		(raw[2] == 0x3 || raw[2] == 0x5 || raw[2] == 0x7) &&
+		(raw[3] == 0x4 || raw[3] == 0x6 || raw[3] == 0x8)
+}
+
+// Jar matches a Java archive file.
+func Jar(raw []byte, limit uint32) bool {
+	return zipContains(raw, "META-INF/MANIFEST.MF")
+}
+
+// zipTokenizer holds the source zip file and scanned index.
+type zipTokenizer struct {
+	in []byte
+	i  int // current index
+}
+
+// next returns the next file name from the zip headers.
+// https://web.archive.org/web/20191129114319/https://users.cs.jmu.edu/buchhofp/forensics/formats/pkzip.html
+func (t *zipTokenizer) next() (fileName string) {
+	if t.i > len(t.in) {
+		return
+	}
+	in := t.in[t.i:]
+	// pkSig is the signature of the zip local file header.
+	pkSig := []byte("PK\003\004")
+	pkIndex := bytes.Index(in, pkSig)
+	// 30 is the offset of the file name in the header.
+	fNameOffset := pkIndex + 30
+	// end if signature not found or file name offset outside of file.
+	if pkIndex == -1 || fNameOffset > len(in) {
+		return
+	}
+
+	fNameLen := int(binary.LittleEndian.Uint16(in[pkIndex+26 : pkIndex+28]))
+	if fNameLen <= 0 || fNameOffset+fNameLen > len(in) {
+		return
+	}
+	t.i += fNameOffset + fNameLen
+	return string(in[fNameOffset : fNameOffset+fNameLen])
+}
+
+// zipContains returns true if the zip file headers from in contain any of the paths.
+func zipContains(in []byte, paths ...string) bool {
+	t := zipTokenizer{in: in}
+	for i, tok := 0, t.next(); tok != ""; i, tok = i+1, t.next() {
+		for p := range paths {
+			if strings.HasPrefix(tok, paths[p]) {
+				return true
+			}
+		}
+	}
+
+	return false
+}

vendor/github.com/gabriel-vasile/mimetype/mime.go

@@ -0,0 +1,186 @@
+package mimetype
+
+import (
+	"mime"
+
+	"github.com/gabriel-vasile/mimetype/internal/charset"
+	"github.com/gabriel-vasile/mimetype/internal/magic"
+)
+
+// MIME struct holds information about a file format: the string representation
+// of the MIME type, the extension and the parent file format.
+type MIME struct {
+	mime      string
+	aliases   []string
+	extension string
+	// detector receives the raw input and a limit for the number of bytes it is
+	// allowed to check. It returns whether the input matches a signature or not.
+	detector magic.Detector
+	children []*MIME
+	parent   *MIME
+}
+
+// String returns the string representation of the MIME type, e.g., "application/zip".
+func (m *MIME) String() string {
+	return m.mime
+}
+
+// Extension returns the file extension associated with the MIME type.
+// It includes the leading dot, as in ".html". When the file format does not
+// have an extension, the empty string is returned.
+func (m *MIME) Extension() string {
+	return m.extension
+}
+
+// Parent returns the parent MIME type from the hierarchy.
+// Each MIME type has a non-nil parent, except for the root MIME type.
+//
+// For example, the application/json and text/html MIME types have text/plain as
+// their parent because they are text files who happen to contain JSON or HTML.
+// Another example is the ZIP format, which is used as container
+// for Microsoft Office files, EPUB files, JAR files, and others.
+func (m *MIME) Parent() *MIME {
+	return m.parent
+}
+
+// Is checks whether this MIME type, or any of its aliases, is equal to the
+// expected MIME type. MIME type equality test is done on the "type/subtype"
+// section, ignores any optional MIME parameters, ignores any leading and
+// trailing whitespace, and is case insensitive.
+func (m *MIME) Is(expectedMIME string) bool {
+	// Parsing is needed because some detected MIME types contain parameters
+	// that need to be stripped for the comparison.
+	expectedMIME, _, _ = mime.ParseMediaType(expectedMIME)
+	found, _, _ := mime.ParseMediaType(m.mime)
+
+	if expectedMIME == found {
+		return true
+	}
+
+	for _, alias := range m.aliases {
+		if alias == expectedMIME {
+			return true
+		}
+	}
+
+	return false
+}
+
+func newMIME(
+	mime, extension string,
+	detector magic.Detector,
+	children ...*MIME) *MIME {
+	m := &MIME{
+		mime:      mime,
+		extension: extension,
+		detector:  detector,
+		children:  children,
+	}
+
+	for _, c := range children {
+		c.parent = m
+	}
+
+	return m
+}
+
+func (m *MIME) alias(aliases ...string) *MIME {
+	m.aliases = aliases
+	return m
+}
+
+// match does a depth-first search on the signature tree. It returns the deepest
+// successful node for which all the children detection functions fail.
+func (m *MIME) match(in []byte, readLimit uint32) *MIME {
+	for _, c := range m.children {
+		if c.detector(in, readLimit) {
+			return c.match(in, readLimit)
+		}
+	}
+
+	needsCharset := map[string]func([]byte) string{
+		"text/plain": charset.FromPlain,
+		"text/html":  charset.FromHTML,
+		"text/xml":   charset.FromXML,
+	}
+	// ps holds optional MIME parameters.
+	ps := map[string]string{}
+	if f, ok := needsCharset[m.mime]; ok {
+		if cset := f(in); cset != "" {
+			ps["charset"] = cset
+		}
+	}
+
+	return m.cloneHierarchy(ps)
+}
+
+// flatten transforms an hierarchy of MIMEs into a slice of MIMEs.
+func (m *MIME) flatten() []*MIME {
+	out := []*MIME{m}
+	for _, c := range m.children {
+		out = append(out, c.flatten()...)
+	}
+
+	return out
+}
+
+// clone creates a new MIME with the provided optional MIME parameters.
+func (m *MIME) clone(ps map[string]string) *MIME {
+	clonedMIME := m.mime
+	if len(ps) > 0 {
+		clonedMIME = mime.FormatMediaType(m.mime, ps)
+	}
+
+	return &MIME{
+		mime:      clonedMIME,
+		aliases:   m.aliases,
+		extension: m.extension,
+	}
+}
+
+// cloneHierarchy creates a clone of m and all its ancestors. The optional MIME
+// parametes are set on the last child of the hierarchy.
+func (m *MIME) cloneHierarchy(ps map[string]string) *MIME {
+	ret := m.clone(ps)
+	lastChild := ret
+	for p := m.Parent(); p != nil; p = p.Parent() {
+		pClone := p.clone(nil)
+		lastChild.parent = pClone
+		lastChild = pClone
+	}
+
+	return ret
+}
+
+func (m *MIME) lookup(mime string) *MIME {
+	for _, n := range append(m.aliases, m.mime) {
+		if n == mime {
+			return m
+		}
+	}
+
+	for _, c := range m.children {
+		if m := c.lookup(mime); m != nil {
+			return m
+		}
+	}
+	return nil
+}
+
+// Extend adds detection for a sub-format. The detector is a function
+// returning true when the raw input file satisfies a signature.
+// The sub-format will be detected if all the detectors in the parent chain return true.
+// The extension should include the leading dot, as in ".html".
+func (m *MIME) Extend(detector func(raw []byte, limit uint32) bool, mime, extension string, aliases ...string) {
+	c := &MIME{
+		mime:      mime,
+		extension: extension,
+		detector:  detector,
+		parent:    m,
+		aliases:   aliases,
+	}
+
+	mu.Lock()
+	m.children = append([]*MIME{c}, m.children...)
+	mu.Unlock()
+}