Kolab Groupware OBS

Changes of Revision 30

guam.spec Changed

@@ -20,7 +20,7 @@
 %define lock_version() %{1}%{?_isa} = %(rpm -q --queryformat "%{VERSION}" %{1})
 
 Name:               guam
-Version:            0.8.1
+Version:            0.8.2
 Release:            0.20160219.git%{?dist}
 Summary:            A Smart Reverse IMAP Proxy
 
@@ -30,8 +30,7 @@
 
 Source0:            guam-%{version}.tar.gz
 
-Patch9991:          guam-0.8-T1312-set-HOME-environment-variable-in-sysvinit-script.patch
-Patch9992:          guam-0.8.1-relax-dependencies-set-correct-version-number.patch
+Patch9991:          guam-0.8.2-relax-dependencies.patch
 
 BuildRequires:      erlang >= 17.4
 BuildRequires:      erlang-asn1
@@ -100,7 +99,6 @@
 %setup -q
 
 %patch9991 -p1
-%patch9992 -p1
 
 %build
 rebar compile
@@ -161,17 +159,6 @@
 %check
 rebar skip_deps=true eunit -v
 
-%pretrans
-test -d /opt/kolab_guam/lib || exit 0
-cd /opt/kolab_guam/lib || exit 0
-for dir in $(ls -d /opt/kolab_guam*/ | grep -v kolab_guam); do
-    if [ -d ${dir} -a ! -L ${dir} ]; then
-        dir=$(basename ${dir})
-        rm -rf -- /opt/kolab_guam/lib/${dir} >/dev/null 2>&1 || :
-    fi
-done >/dev/null 2>&1 || :
-exit 0
-
 %pre
 if [ $1 == 1 ]; then
     /usr/sbin/groupadd --system %{guam_group} 2> /dev/null || :
@@ -222,6 +209,9 @@
 /opt/%{realname}/
 
 %changelog
+* Wed Jul 6 2016 Aaron Seigo <seigo@kolabsystems.com> - 0.8.2-1
+- Release of version 0.8.2
+
 * Tue Jul  5 2016 Jeroen van Meeuwen <vanmeeuwen@kolabsys.com> - 0.8.1-1
 - Release of version 0.8.1

guam-0.8-T1312-set-HOME-environment-variable-in-sysvinit-script.patch Deleted

guam-0.8.1-relax-dependencies-set-correct-version-number.patch Deleted

@@ -1,24 +0,0 @@
-diff -ur guam-0.8.1.orig/rebar.config guam-0.8.1/rebar.config
---- guam-0.8.1.orig/rebar.config	2016-07-04 12:40:07.000000000 +0200
-+++ guam-0.8.1/rebar.config	2016-07-05 11:13:53.683350555 +0200
-@@ -3,7 +3,7 @@
- 
- { deps_dir, "deps" }.
- { deps, [
--    { lager, "(2.0|2.1|2.2).*", { git, "git://github.com/basho/lager.git", { tag, "2.2.0" } } },
-+    { lager, "3.*", { git, "git://github.com/basho/lager.git" } },
-     { lager_syslog, "2.*", { git, "git://github.com/basho/lager_syslog.git", { tag, "2.1.3" } } },
-     { eimap, ".*", { git, "https://git.kolab.org/diffusion/EI/eimap.git", { tag, "0.2.5" } } }
-     %% pull in the proper version of meck before jobs 0.3 gets around to pulling in the wrong version
-diff -ur guam-0.8.1.orig/rel/reltool.config guam-0.8.1/rel/reltool.config
---- guam-0.8.1.orig/rel/reltool.config	2016-07-04 12:40:07.000000000 +0200
-+++ guam-0.8.1/rel/reltool.config	2016-07-05 11:14:03.958466677 +0200
-@@ -4,7 +4,7 @@
-        {lib_dirs, ["../deps"]},
-        {erts, [{mod_cond, derived}, {app_file, strip}]},
-        {app_file, strip},
--       {rel, "kolab_guam", "0.9",
-+       {rel, "kolab_guam", "0.8.1",
-         [
-          kernel,
-          stdlib,

guam-0.8.2-relax-dependencies.patch Added

debian.changelog Changed

debian.series Changed

debian.tar.gz/.arcconfig Added

debian.tar.gz/.erlang Added

debian.tar.gz/.gitignore Added

debian.tar.gz/CHANGELOG.md Added

debian.tar.gz/Makefile Added

debian.tar.gz/README.md Added

@@ -0,0 +1,30 @@
+Guam
+====
+
+Guam is an IMAP proxy and filter written in Erlang developed by Kolab Systems.
+
+Information on the design, deployment, etc. of Guam can be found in the docs
+directory.
+
+Building
+--------
+
+Building guam for development is easy. First, ensure you have Erlang and make
+installed. Thenn run `make deps-up` to fetch the dependencies into the build
+tree, then run `make` to build Guam. Finally, you can run it easily from the
+top level directory with `make run`. You will probably wish to modify the
+app.config file before doing so.
+
+To turn a build into a distributable release, go into the rel directory and
+run `../rebar generate`. This will create a kolab_guam directory (or update
+the contents of it if it already exists) which can be then packaged up and
+used.
+
+Getting Involved
+----------------
+The maintainer of Guam is Aaron Seigo <seigo@kolabsystems.com>, and here is
+the [project page](https://git.kolab.org/tag/guam/). The git repository can be
+found at https://git.kolab.org/diffusion/G/guam.git
+
+Disccusion can be had on the Kolab dev list <devel@lists.kolab.org>
+

debian.tar.gz/app.config Added

@@ -0,0 +1,74 @@
+[
+ %% SASL config
+ {sasl, [
+         {sasl_error_logger, {file, "log/sasl-error.log"}},
+         {errlog_type, error},
+         {error_logger_mf_dir, "log/sasl"},      % Log directory
+         {error_logger_mf_maxbytes, 10485760},   % 10 MB max file size
+         {error_logger_mf_maxfiles, 5}           % 5 files max
+        ]},
+{ kolab_guam,
+  [
+    { imap_servers, [
+                { default, [
+                                { host, "192.168.56.101" },
+                                { port, 143 },
+                                { tls, no }
+                           ]
+                },
+                { kolabsys, [
+                                { host, "imap.kolabsys.com" },
+                                { port, 143 },
+                                { tls, starttls }
+                           ]
+                }
+            ]
+    },
+    { listeners, [
+            { default, [
+                         { port, 1143 },
+                         { imap_server, default },
+                         { rules, [
+                                   { filter_groupware, [] }
+                                  ]
+                         },
+                         { listener_pool_size, 10 },
+                         { tls_config, [ { certfile, "/etc/ssl/sample.pem" } ] }
+                       ]
+            },
+            { default_tls, [
+                         { port, 1993 },
+                         { imap_server, default },
+                         { rules, [
+                                   { filter_groupware, [] }
+                                  ]
+                         },
+                         { implicit_tls, true },
+                         { tls_config, [ { certfile, "/etc/ssl/sample.cert" }, { keyfile, "/etc/ssl/sample.key" } ] }
+                       ]
+            },
+            { kolabsys, [
+                         { port, 1994 },
+                         { imap_server, kolabsys },
+                         { rules, [
+                                   { filter_groupware, [] }
+                                  ]
+                         }
+                       ]
+            }
+        ]
+    }
+  ]
+},
+{ lager,
+  [
+    {
+        handlers,
+        [
+            { lager_console_backend, debug },
+            { lager_file_backend, [ { file, "log/error.log"}, { level, error } ] },
+            { lager_file_backend, [ { file, "log/console.log"}, { level, debug } ] }
+        ] }
+  ] }
+].
+

debian.tar.gz/apps Added

debian.tar.gz/apps/kolab_guam Added

debian.tar.gz/apps/kolab_guam/src Added

debian.tar.gz/apps/kolab_guam/src/kolab_guam.app.src Added

debian.tar.gz/apps/kolab_guam/src/kolab_guam.erl Added

@@ -0,0 +1,40 @@
+%% Copyright 2015 Kolab Systems AG (http://www.kolabsys.com)
+%%
+%% Aaron Seigo (Kolab Systems) <seigo a kolabsys.com>
+%%
+%% This program is free software: you can redistribute it and/or modify
+%% it under the terms of the GNU General Public License as published by
+%% the Free Software Foundation, either version 3 of the License, or
+%% (at your option) any later version.
+%%
+%% This program is distributed in the hope that it will be useful,
+%% but WITHOUT ANY WARRANTY; without even the implied warranty of
+%% MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+%% GNU General Public License for more details.
+%%
+%% You should have received a copy of the GNU General Public License
+%% along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+-module(kolab_guam).
+
+-behaviour(application).
+
+%% Application callbacks
+-export([start/0, start/2, stop/0, stop/1]).
+
+start() ->
+    ssl:start(),
+    application:start(kolab_guam).
+stop() -> application:stop(kolab_guam).
+
+%% ===================================================================
+%% Application callbacks
+%% ===================================================================
+
+start(_StartType, _StartArgs) ->
+    lager:info("Starting Kolab Guam IMAP session proxy ..."),
+    lager:info("    Starting the main supervisor ..."),
+    kolab_guam_sup:start_link().
+
+stop(_State) ->
+    ok.

debian.tar.gz/apps/kolab_guam/src/kolab_guam_listener.erl Added

@@ -0,0 +1,99 @@
+%% Copyright 2015 Kolab Systems AG (http://www.kolabsys.com)
+%%
+%% Aaron Seigo (Kolab Systems) <seigo a kolabsys.com>
+%%
+%% This program is free software: you can redistribute it and/or modify
+%% it under the terms of the GNU General Public License as published by
+%% the Free Software Foundation, either version 3 of the License, or
+%% (at your option) any later version.
+%%
+%% This program is distributed in the hope that it will be useful,
+%% but WITHOUT ANY WARRANTY; without even the implied warranty of
+%% MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+%% GNU General Public License for more details.
+%%
+%% You should have received a copy of the GNU General Public License
+%% along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+-module(kolab_guam_listener).
+
+-behaviour(supervisor).
+-define(DEFAULT_IMAP_PORT, 143).
+-define(DEFAULT_LISTENER_POOL_SIZE, 10).
+
+%% API
+-export([start_link/2, create_initial_listeners/2, cleanup/1]).
+
+%% gen_supervisor callbacks
+-export([init/1]).
+
+%% state record definition
+%%TODO: support reconfiguration requests
+
+%% public API
+start_link(Name, Config) -> supervisor:start_link(?MODULE, [Name, Config]).
+
+%% gen_server API
+init([Name, Config]) ->
+    Host = proplists:get_value(host, Config, none),
+    NetIface = proplists:get_value(net_iface, Config, none),
+    Port = proplists:get_value(port, Config, ?DEFAULT_IMAP_PORT),
+    ImplicitTLS = proplists:get_value(implicit_tls, Config, false),
+    TLSConfig = proplists:get_value(tls_config, Config, []),
+    Rules = proplists:get_value(rules, Config, []),
+    Options = listen_options(NetIface, Host, ImplicitTLS, TLSConfig),
+    lager:info("Starting listener \"~p\" on port ~B (~p) with ~B rules", [Name, Port, Options, length(Rules)]),
+    { ok, ListenSocket } = listen(ImplicitTLS, Port, Options),
+    spawn_link(?MODULE, cleanup, [ListenSocket]),
+    %% setting up the initial listeners must be done async to allow the init to be done and the supervisor to be setup
+    ListenerPoolSize = proplists:get_value(listener_pool_size, Config, ?DEFAULT_LISTENER_POOL_SIZE),
+    spawn_link(kolab_guam_listener, create_initial_listeners, [ListenerPoolSize, self()]),
+    ImapConfig = imap_config(proplists:get_value(imap_server, Config, none)),
+    lager:debug("ImapConfig is ~p", [ImapConfig]),
+    {ok, { { simple_one_for_one, 60, 3600 },
+         [ { session, { kolab_guam_session, start_link, [self(), ListenSocket, ImapConfig, ImplicitTLS, TLSConfig, Rules] }, temporary, 1000, worker, [kolab_guam_session] } ]
+         }
+    }.
+
+imap_config(none) -> kolab_guam_sup:default_imap_server_config();
+imap_config(Backend) -> kolab_guam_sup:imap_server_config(Backend).
+
+-spec listen_options(Iface :: string(), Hostname :: string(), ImplicitTLS :: boolean(), TLSConfig :: list()) -> list().
+listen_options(none, none, ImplicitTLS, TLSConfig) -> default_listen_options(ImplicitTLS, TLSConfig);
+listen_options(none, Hostname, ImplicitTLS, TLSConfig) ->
+    case inet:gethostbyname(Hostname) of
+        { ok, { hostent, _HostName, _Unused, inet, _Ver, [IP] } } ->
+            [ { ip, IP } | default_listen_options(ImplicitTLS, TLSConfig) ];
+        _ ->
+            listen_options(none, none, ImplicitTLS, TLSConfig)
+    end;
+listen_options(Iface, Hostname, ImplicitTLS, TLSConfig) ->
+    { ok, Ifaces } = inet:getifaddrs(),
+    case proplists:get_value(Iface, Ifaces) of
+        undefined -> listen_options(none, Hostname, ImplicitTLS, TLSConfig);
+        Info -> Addr = proplists:get_value(addr, Info, none),
+                %lager:info("YEAH! ~p", [Addr]),
+                listen_options(none, Addr, ImplicitTLS, TLSConfig)
+    end.
+
+default_listen_options(true, TLSConfig) -> default_listen_options() ++ TLSConfig;
+default_listen_options(_ImplicitTLS, _Config) -> default_listen_options().
+default_listen_options() -> [ { reuseaddr, true }, {active, once }, inet6 ].
+
+create_initial_listeners(ListenerPoolSize, PID) when is_pid(PID) ->
+    lager:debug("Creating session pool of size ~p for listener ~p", [ListenerPoolSize, PID]),
+    [ supervisor:start_child(PID, []) || _ <- lists:seq(1, ListenerPoolSize) ].
+
+cleanup(Socket) ->
+    process_flag(trap_exit, true),
+    receive
+        { 'EXIT', _PID, _  } -> ok;
+        _ -> cleanup(Socket)
+    end,
+    gen_tcp:close(Socket).
+
+listen(true, Port, Options) -> ssl:listen(Port, Options);
+listen(_ImplicitTLS, Port, Options) -> gen_tcp:listen(Port, Options).
+
+%% private API
+

debian.tar.gz/apps/kolab_guam/src/kolab_guam_rule.erl Added

@@ -0,0 +1,26 @@
+%% Copyright 2015 Kolab Systems AG (http://www.kolabsys.com)
+%%
+%% Aaron Seigo (Kolab Systems) <seigo a kolabsys.com>
+%%
+%% This program is free software: you can redistribute it and/or modify
+%% it under the terms of the GNU General Public License as published by
+%% the Free Software Foundation, either version 3 of the License, or
+%% (at your option) any later version.
+%%
+%% This program is distributed in the hope that it will be useful,
+%% but WITHOUT ANY WARRANTY; without even the implied warranty of
+%% MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+%% GNU General Public License for more details.
+%%
+%% You should have received a copy of the GNU General Public License
+%% along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+-module(kolab_guam_rule).
+
+-callback new(Args :: any()) -> any().
+-callback applies(ConnectionDetails :: list(), Buffer :: binary(), State :: any()) -> { true, State :: any() } |
+                                                                                      { false, State :: any() } |
+                                                                                      { notyet, State :: any() }.
+-callback apply_to_client_message(ImapSession :: pid(), Command :: binary(), State :: any()) -> { ProcessedCommand :: binary(), State :: any() }.
+-callback apply_to_server_message(ImapSession :: pid(), Command :: binary(), State :: any()) -> { ProcessedCommand :: binary(), State :: any() }.
+-callback imap_data(ResponseToken :: any(), Response :: any(), State :: any()) -> State ::any().

debian.tar.gz/apps/kolab_guam/src/kolab_guam_session.erl Added

@@ -0,0 +1,364 @@
+%% Copyright 2015 Kolab Systems AG (http://www.kolabsys.com)
+%%
+%% Aaron Seigo (Kolab Systems) <seigo a kolabsys.com>
+%%
+%% This program is free software: you can redistribute it and/or modify
+%% it under the terms of the GNU General Public License as published by
+%% the Free Software Foundation, either version 3 of the License, or
+%% (at your option) any later version.
+%%
+%% This program is distributed in the hope that it will be useful,
+%% but WITHOUT ANY WARRANTY; without even the implied warranty of
+%% MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+%% GNU General Public License for more details.
+%%
+%% You should have received a copy of the GNU General Public License
+%% along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+-module(kolab_guam_session).
+
+-behaviour(gen_server).
+
+%% API
+-export([ start_link/6 ]).
+
+%% gen_server callbacks
+-export([init/1, handle_call/3, handle_cast/2, handle_info/2, terminate/2, code_change/3]).
+
+%% state record definition
+-record(state, { socket, super_pid, tls_config = [], client_implicit_tls = false, client_tls_active = false, server_config = [],
+                 rules_active = [], rules_deciding = [], imap_session, inflator, deflator }).
+
+%% public API
+start_link(SupervisorPID, ListenSocket, ImapConfig, ImplicitTLS, TLSConfig, Rules) -> gen_server:start_link(?MODULE, [SupervisorPID, ListenSocket, ImapConfig, ImplicitTLS, TLSConfig, Rules], []).
+
+%% gen_server API
+init([SupervisorPID, ListenSocket, ServerConfig, ImplicitTLS, TLSConfig, Rules]) ->
+    %% accepting a connection is blocking .. so do it async
+    %% lager:debug("Starting a session handler on socket ~p for listener ~p", [ListenSocket, SupervisorPID]),
+    process_flag(trap_exit, true),
+    ActiveRules = init_rules(Rules),
+    gen_server:cast(self(), accept),
+    %% lager:debug("Rules are ~p from ~p", [ActiveRules, Rules]),
+    { ok, #state{ socket = ListenSocket, super_pid = SupervisorPID, client_implicit_tls = ImplicitTLS, tls_config = TLSConfig, server_config = ServerConfig, rules_deciding = ActiveRules } }.
+
+handle_call(_Request, _From, State) ->
+    { reply, ok, State }.
+
+handle_cast(accept, State = #state{ socket = ListenSocket, server_config = ServerConfig }) ->
+    %% try to rate limit our responses a bit here so that hammering the socket with connections is survivable
+    timer:sleep(3),
+    { ok, AcceptSocket, TLSActive } = accept_client(ListenSocket, State),
+    { ok, ImapSession } = eimap:start_link(ServerConfig),
+    eimap:connect(ImapSession, self(), server_hello),
+    { noreply, State#state{ socket = AcceptSocket, imap_session = ImapSession, client_tls_active = TLSActive } };
+handle_cast(_Msg, State) ->
+    { noreply, State }.
+
+handle_info({ tcp_closed, _Socket }, State) ->
+    %lager:debug("Client closed socket"),
+    { stop, normal, State };
+handle_info({ tcp_error, _Socket, _Error }, State) ->
+    %lager:debug("Socket error"),
+    { stop, normal, State };
+handle_info({ ssl_closed, _Socket }, State) ->
+    %lager:debug("Client closed socket"),
+    { stop, normal, State };
+handle_info({ ssl_error, _Socket, _Error }, State) ->
+    %lager:debug("Socket error"),
+    { stop, normal, State };
+handle_info({ tcp, Socket, Data }, #state{ client_tls_active = false } = State) ->
+    %lager:debug("Data coming in from client over TCP ~s", [Data]),
+    process_client_data(Socket, Data, State);
+handle_info({ ssl, Socket, Data }, State) ->
+    %lager:debug("Data coming in from client over SSL, ~p", [Data]),
+    process_client_data(Socket, Data, State);
+handle_info({ server_hello, ServerHello }, #state{ imap_session = ImapSession, tls_config = TLSConfig, socket = Socket, client_implicit_tls = ImplicitTLS, client_tls_active = TLSActive, deflator = Deflator } = State) ->
+    CorrectedHello = correct_hello(TLSActive, ImplicitTLS, TLSConfig, ServerHello),
+    ServerIdent = proplists:get_value(server_id, ServerHello, <<>>),
+    FullGreeting = <<"* OK [CAPABILITIES ", CorrectedHello/binary, "] ", ServerIdent/binary, "\r\n">>,
+    eimap:start_passthrough(ImapSession, self()),
+    relay_response(Socket, postprocess_server_data(Deflator, FullGreeting), TLSActive),
+    { noreply, State };
+handle_info({ { rule_data, Module, ResponseToken }, Data }, #state{ rules_active = ActiveRules } = State) ->
+    %lager:debug("Got back data requested by rule ~p: ~p", [Module, Data]),
+    NewActiveRules =
+    case proplists:get_value(Module, ActiveRules) of
+        undefined -> ActiveRules;
+        ModuleState ->
+            NewModuleState = Module:imap_data(ResponseToken, Data, ModuleState),
+            lists:reverse(lists:foldl(fun({ Rule, RuleState }, Acc) ->
+                                              case Rule =:= Module of
+                                                  true -> [{ Rule, NewModuleState }|Acc];
+                                                  _ -> [{ Rule, RuleState }|Acc]
+                                              end
+                                      end,
+                          [], ActiveRules))
+    end,
+    %TODO: should we also support non-active rules doing imapy things here?
+    { noreply, State#state{ rules_active = NewActiveRules } };
+handle_info({ imap_server_response, Data }, #state{ socket = Socket, imap_session = ImapSession, client_tls_active = TLS, deflator = Deflator, rules_active = ActiveRules } = State) ->
+    %lager:debug("FROM SERVER: ~s", [Data]),
+    { ModifiedData, CurrentlyActiveRules } = apply_ruleset_serverside(ImapSession, Data, ActiveRules),
+    relay_response(Socket, postprocess_server_data(Deflator, ModifiedData), TLS),
+    { noreply, State#state{ rules_active = CurrentlyActiveRules } };
+handle_info({ 'EXIT', PID, _Reason }, #state { imap_session = PID } = State) ->
+    { stop, normal, State };
+handle_info(Info, State) ->
+    lager:debug("Received unexpected info... ~p", [Info]),
+    { noreply, State }.
+
+terminate(_Reason, #state{ inflator = Inflator, deflator = Deflator, socket = Socket, client_tls_active = TLS }) ->
+    %lager:debug("Termination!~p", [self()]),
+    close_zlib_handle(Inflator),
+    close_zlib_handle(Deflator),
+    close_socket(TLS, Socket),
+    ok.
+
+code_change(_OldVsn, State, _Extra) ->
+    { ok, State }.
+
+%% private API
+accept_client(ListenSocket, #state{ client_implicit_tls = true, super_pid = SupervisorPID }) ->
+    AcceptResult = ssl:transport_accept(ListenSocket),
+    AcceptSocket = post_accept_bookkeeping(implicit_tls, ListenSocket, SupervisorPID, AcceptResult),
+    %% prep for the next listen
+    ok = ssl:ssl_accept(AcceptSocket),
+    ok = ssl:setopts(AcceptSocket, [{ active, once }, { mode, binary }]),
+    % lager:info("~p All done!", [self()]),
+    { ok, AcceptSocket, true };
+accept_client(ListenSocket, #state{ super_pid = SupervisorPID }) ->
+    AcceptResult = gen_tcp:accept(ListenSocket),
+    AcceptSocket = post_accept_bookkeeping(no_implicit_tls, ListenSocket, SupervisorPID, AcceptResult),
+    ok = inet:setopts(AcceptSocket, [{ active, once }, { mode, binary }]),
+    { ok, AcceptSocket, false }.
+
+post_accept_bookkeeping(ImplicitTls, ListenSocket, SupervisorPID, AcceptResult) ->
+    %% start a new accepting process to replace this one, which is now in use
+    supervisor:start_child(SupervisorPID, []),
+    %% prep for the next listen
+    case ImplicitTls of
+        implicit_tls -> ok = ssl:setopts(ListenSocket, [{ active, once }, { mode, binary }]);
+        _ -> ok = inet:setopts(ListenSocket, [{ active, once }])
+    end,
+    %% assert that the accept worked
+    { ok, AcceptSocket } = AcceptResult,
+    AcceptSocket.
+
+close_zlib_handle(undefined) -> ok;
+close_zlib_handle(Z) -> zlib:close(Z).
+
+close_socket(_TLS, undefined) -> ok;
+close_socket(true, Socket) -> ssl:close(Socket);
+close_socket(_TLS, Socket) -> gen_tcp:close(Socket).
+
+process_client_data(Socket, Data, #state{ rules_deciding = UndecidedRules, tls_config = TLSConfig, client_tls_active = TLS, rules_active = ActiveRules, socket = Socket, imap_session = ImapSession, inflator = Inflator, deflator = Deflator, server_config = ServerConfig } = State) ->
+    %%TODO: multipacket input from clients
+    % TODO: refactor so starttls and compress commands can be made into rules
+    PreprocessData = preprocess_client_data(Inflator, Data),
+    %lager:info("FROM CLIENT: ~s", [PreprocessData]),
+    { TLSActive, CurrentSocket, CurrentInflator, CurrentDeflator, CurrentUndecidedRules, CurrentActiveRules } =
+    case check_for_transmission_change_commands(TLS, TLSConfig, PreprocessData, Deflator, Socket) of
+        { socket_upgraded, SSLSocket } ->
+            %% if we have upgraded our socket, then do so to the backend if that hasn't happened auomatically
+            case proplists:get_value(implicit_tls, ServerConfig, false) of
+                false -> eimap:starttls(ImapSession, undefined, undefined);
+                _ -> ok
+            end,
+            { true, SSLSocket, Inflator, Deflator, UndecidedRules, ActiveRules };
+        { compression, NewInflator, NewDeflator } ->
+            eimap:compress(ImapSession), % TODO: make optional
+            { TLS, Socket, NewInflator, NewDeflator, UndecidedRules, ActiveRules };
+        nochange ->
+            %%lager:debug("... now applying rules"),
+            { ModifiedData, NewUndecidedRules, NewActiveRules } = apply_ruleset_clientside(ImapSession, Socket, PreprocessData, UndecidedRules, ActiveRules),
+            %%lager:info("The modified data is: ~s", [ModifiedData]),
+            %lager:info("The post-processed data is: ~s", [PostProcessed]),
+            eimap:passthrough_data(ImapSession, ModifiedData),
+            { TLS, Socket, Inflator, Deflator, NewUndecidedRules, NewActiveRules}
+    end,
+    set_socket_active(TLSActive, CurrentSocket),
+    { noreply, State#state{ rules_deciding = CurrentUndecidedRules, rules_active = CurrentActiveRules,
+                            socket = CurrentSocket, client_tls_active = TLSActive,
+                            inflator = CurrentInflator, deflator = CurrentDeflator } }.
+
+preprocess_client_data(undefined, Data) ->
+    Data;
+preprocess_client_data(Z, Data) ->
+    joined(zlib:inflate(Z, Data), <<>>).
+
+postprocess_server_data(undefined, Data) ->
+    %% we aren't compressing so there is nothing to do
+    Data;
+postprocess_server_data(Z, Data) ->
+    joined(zlib:deflate(Z, Data, sync), <<>>).
+
+joined([], Binary) -> Binary;
+joined([H|Rest], Binary) -> joined(Rest, <<Binary/binary, H/binary>>).
+
+init_rules(RuleConfig) -> init_rule(RuleConfig, []).
+init_rule([], Acc) -> Acc;
+init_rule([{ RuleName, Config }|RuleConfig], Acc) ->
+    Module = full_rule_name(RuleName),
+    %% we try to new the module, but if something goes wrong, e.g. it does not exist,
+    %% then we skip this config block because it is BROKEN
+    try Module:new(Config) of
+        ModuleState -> init_rule(RuleConfig, [{ Module, ModuleState }|Acc])
+    catch
+        Type:Error ->
+            lager:warning("Could not create rule for ~p due to failure: ~p ~p", [RuleName, Type, Error]),
+            init_rule(RuleConfig, Acc)
+    end;
+init_rule([_|RuleConfig], Acc) ->
+    init_rule(RuleConfig, Acc).
+
+full_rule_name(Module) when is_atom(Module) -> list_to_atom("kolab_guam_rule_" ++ atom_to_list(Module)).
+
+apply_ruleset_serverside(ImapSession, ServerData, CurrentlyActiveRules) ->
+    %TODO: allow undecided rules to opt-in here as well
+    apply_next_rule_serverside(ImapSession, ServerData, [], CurrentlyActiveRules).
+
+apply_next_rule_serverside(_ImapSession, ServerData, ActiveRulesAcc, []) -> { ServerData, lists:reverse(ActiveRulesAcc) };
+apply_next_rule_serverside(ImapSession, ServerData, ActiveRulesAcc, [{ Module, RuleState } | ActiveRules]) ->
+    %TODO: allow rules to remove themselves from the action during serverside processing?
+    { ModifiedData, ModifiedRuleState } = Module:apply_to_server_message(ImapSession, ServerData, RuleState),
+    apply_next_rule_serverside(ImapSession, ModifiedData, [{ Module, ModifiedRuleState } | ActiveRulesAcc], ActiveRules).
+
+apply_ruleset_clientside(ImapSession, Socket, ClientData, UndecidedRules, CurrentlyActiveRules) ->
+    { StillUndecided, NewlyActive } = check_undecided(Socket, ClientData, UndecidedRules),
+    ActiveRules = CurrentlyActiveRules ++ NewlyActive,
+    { ModifiedData, ActiveRulesRun } = apply_next_rule_clientside(ImapSession, ClientData, [], ActiveRules),
+    { ModifiedData, StillUndecided, ActiveRulesRun }.
+
+check_undecided(Socket, ClientData, Rules) -> check_next_undecided_rule(Socket, ClientData, Rules, { [], [] }).
+check_next_undecided_rule(_Socket, _ClientData, [], Accs) -> Accs;
+check_next_undecided_rule(Socket, ClientData, [Rule|Rules], { UndecidedAcc, NewActiveAcc }) ->
+    { Module, RuleState } = Rule,
+    %%lager:debug("Does ~p apply with state ~p? let's find out!", [Module, RuleState]),
+    check_next_undecided_rule(Socket, ClientData, Rules, applies(Module, Module:applies(Socket, ClientData, RuleState), UndecidedAcc, NewActiveAcc)).
+
+applies(Module, { true, RuleState }, UndecidedAcc, NewActiveAcc) -> { UndecidedAcc, [{ Module, RuleState }|NewActiveAcc] };
+applies(_Module, { false, _RuleState }, UndecidedAcc, NewActiveAcc) -> { UndecidedAcc, NewActiveAcc };
+applies(Module, { notyet, RuleState }, UndecidedAcc, NewActiveAcc) -> { [{ Module, RuleState }|UndecidedAcc], NewActiveAcc }.
+
+apply_next_rule_clientside(_ImapSession, ClientData, ActiveRulesAcc, []) -> { ClientData, lists:reverse(ActiveRulesAcc) };
+apply_next_rule_clientside(ImapSession, ClientData, ActiveRulesAcc, [{ Module, RuleState }|Rules]) ->
+    { Data, NewState } = Module:apply_to_client_message(ImapSession, ClientData, RuleState),
+    apply_next_rule_clientside(ImapSession, Data, [{ Module, NewState } | ActiveRulesAcc], Rules).
+
+relay_response(Socket, Data, false) ->
+    %lager:debug("Sending over non-secure socket ..."),
+    gen_tcp:send(Socket, Data);
+relay_response(Socket, Data, _TLS) ->
+    %lager:debug("Sending over TLS!"),
+    ssl:send(Socket, Data).
+
+check_for_transmission_change_commands(TLS, TLSConfig, Buffer, Deflator, Socket) ->
+    {Tag, Command, _Data } = eimap_utils:split_command_into_components(Buffer),
+    case check_tls_state(TLS, TLSConfig, Command, Deflator, Socket, Tag) of
+        nochange -> check_compress_request(Deflator, Command, Socket, TLS, Tag);
+        Response -> Response
+    end.
+
+check_tls_state(false, TLSConfig, <<"STARTTLS">>, Deflator, Socket, Tag) -> start_client_tls(TLSConfig, Deflator, Socket, Tag);
+check_tls_state(false, TLSConfig, <<"starttls">>, Deflator, Socket, Tag) -> start_client_tls(TLSConfig, Deflator, Socket, Tag);
+check_tls_state(_TLS, _TLSConfig, _Buffer, _Deflator, _Socket, _Tag) -> nochange.
+
+start_client_tls(TLSConfig, Deflator, Socket, Tag) ->
+    Response = <<Tag/binary, " OK Begin TLS negotiation now\r\n">>,
+    relay_response(Socket, postprocess_server_data(Deflator, Response), false),
+    { ok, SSLSocket } = ssl:ssl_accept(Socket, TLSConfig),
+    { socket_upgraded, SSLSocket }.
+
+check_compress_request(undefined, <<"COMPRESS">>, Socket, TLS, Tag) -> start_client_compression(Socket, TLS, Tag);
+check_compress_request(undefined, <<"compress">>, Socket, TLS, Tag) -> start_client_compression(Socket, TLS, Tag);
+check_compress_request(_Deflator, _Command, _Socket, _TLS, _Tag) -> nochange.
+
+start_client_compression(Socket, TLS, Tag) ->
+    Response = <<Tag/binary, " OK DEFLATE active\r\n">>,
+    relay_response(Socket, postprocess_server_data(undefined, Response), TLS),
+    %% create an inflate/deflate pair for use with the client
+    Inflator = zlib:open(),
+    ok = zlib:inflateInit(Inflator, -15),
+    Deflator = zlib:open(),
+    ok = zlib:deflateInit(Deflator, 1, deflated, -15, 8, default),
+    { compression, Inflator, Deflator }.
+
+
+set_socket_active(true, Socket) -> ssl:setopts(Socket, [{ active, once }]);
+set_socket_active(_, Socket) -> inet:setopts(Socket, [{ active, once }]).
+
+-spec correct_hello(TLSActive :: true | false, ImplicitTLS :: true | false, TlSConfig :: [] | list(), ServerHello :: binary()) -> CorrectedHello :: binary().
+correct_hello(true, true, _TLSConfig, ServerResponse) ->
+    % the connection is already secured, so don't advertise starttls to the client
+    ensure_hello_does_not_have_starttls(ServerResponse);
+correct_hello(true, _ImplicitTLS, _TLSConfig, ServerResponse) ->
+    % the connection is already secured, so don't advertise starttls to the client
+    ensure_hello_does_not_have_starttls(ServerResponse);
+correct_hello(_TLSActive, _ImplicitTLS, [], ServerResponse) ->
+    % guam does not have a TLS config and so can not provide TLS to the client
+    ensure_hello_does_not_have_starttls(ServerResponse);
+correct_hello(_TLSActive, _ImplicitTLS, _TLSConfig, ServerResponse) ->
+    % guam has a TLS config, and it is not currently active, so make sure to include
+    % STARTTLS in our response regardless of what the backend says
+    ensure_hello_has_starttls(ServerResponse).
+
+ensure_hello_has_starttls(ServerResponse) ->
+    ServerHello = proplists:get_value(capabilities, ServerResponse, <<>>),
+    case binary:match(ServerHello, <<"STARTTLS">>) of
+        nomatch -> add_starttls_to_capabilities(ServerHello);
+        _ -> ServerHello
+    end.
+
+add_starttls_to_capabilities(ServerHello) ->
+    case binary:match(ServerHello, <<"CAPABILITY ">>) of
+        nomatch -> add_starttls_after_imap4_atom(ServerHello);
+        { Start, End } ->
+            Prefix = binary:part(ServerHello, 0, Start + End),
+            Suffix = binary:part(ServerHello, Start + End, size(ServerHello) - Start - End),
+            CorrectHello = <<Prefix/binary, "STARTTLS ", Suffix/binary>>,
+            remove_auth_offers(CorrectHello)
+    end.
+
+add_starttls_after_imap4_atom(ServerHello) ->
+    case binary:match(ServerHello, <<"IMAP4rev1 ">>) of
+        nomatch -> <<"STARTTLS ", ServerHello/binary>>;
+        { Start, End } ->
+            Prefix = binary:part(ServerHello, 0, Start + End),
+            Suffix = binary:part(ServerHello, Start + End, size(ServerHello) - Start - End),
+            CorrectHello = <<Prefix/binary, "STARTTLS ", Suffix/binary>>,
+            remove_auth_offers(CorrectHello)
+    end.
+
+ensure_hello_does_not_have_starttls(ServerResponse) ->
+    ServerHello = proplists:get_value(capabilities, ServerResponse, <<>>),
+    case binary:match(ServerHello, <<"STARTTLS">>) of
+        nomatch -> ServerHello;
+        { Start, End } ->
+            Prefix = binary:part(ServerHello, 0, Start),
+            Suffix = binary:part(ServerHello, Start + End, size(ServerHello) - Start - End),
+            <<Prefix/binary, Suffix/binary>>
+    end.
+
+remove_auth_offers(ServerHello) ->
+    case binary:match(ServerHello, <<"AUTH=">>) of
+        nomatch -> ensure_advertise_login_disabled(ServerHello);
+        { Start, _End } ->
+            Prefix = binary:part(ServerHello, 0, Start),
+            Suffix =
+            case binary:match(ServerHello, <<" ">>, [{ scope, { Start, size(ServerHello) - Start } }]) of
+                nomatch ->
+                    %% end of the line, so no suffix
+                    <<>>;
+                { SpaceStart, SpaceEnd } ->
+                    binary:part(ServerHello, SpaceStart + SpaceEnd, size(ServerHello) - SpaceStart - SpaceEnd)
+            end,
+            remove_auth_offers(<<Prefix/binary, Suffix/binary>>)
+    end.
+
+ensure_advertise_login_disabled(ServerHello) ->
+    case binary:match(ServerHello, <<"LOGINDISABLED">>) of
+        nomatch -> <<ServerHello/binary, " LOGINDISABLED">>;
+        _ -> ServerHello
+    end.
+

debian.tar.gz/apps/kolab_guam/src/kolab_guam_sup.erl Added

@@ -0,0 +1,54 @@
+%% Copyright 2015 Kolab Systems AG (http://www.kolabsys.com)
+%%
+%% Aaron Seigo (Kolab Systems) <seigo a kolabsys.com>
+%%
+%% This program is free software: you can redistribute it and/or modify
+%% it under the terms of the GNU General Public License as published by
+%% the Free Software Foundation, either version 3 of the License, or
+%% (at your option) any later version.
+%%
+%% This program is distributed in the hope that it will be useful,
+%% but WITHOUT ANY WARRANTY; without even the implied warranty of
+%% MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+%% GNU General Public License for more details.
+%%
+%% You should have received a copy of the GNU General Public License
+%% along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+-module(kolab_guam_sup).
+
+-behaviour(supervisor).
+
+%% API
+-export([start_link/0, default_imap_server_config/0, imap_server_config/1]).
+
+%% Supervisor callbacks
+-export([init/1]).
+
+%% ===================================================================
+%% API functions
+%% ===================================================================
+
+start_link() ->
+    supervisor:start_link({local, ?MODULE}, ?MODULE, []).
+
+default_imap_server_config() -> imap_server_config(default).
+
+imap_server_config(DefinitionName) when is_atom(DefinitionName) ->
+    ServerDefinitions = application:get_env(kolab_guam, imap_servers, []),
+    proplists:get_value(DefinitionName, ServerDefinitions, []).
+
+%% ===================================================================
+%% Supervisor callbacks
+%% ===================================================================
+
+init([]) ->
+    lager:debug("Creating listeners ..."),
+    ListenersConfig = application:get_env(kolab_guam, listeners, []),
+    Children = [ create_child(Name, ListenerConfig) || { Name, ListenerConfig } <- ListenersConfig ],
+    lager:debug("We have ~p~n", [Children]),
+    { ok, { { one_for_one, 5, 10}, Children } }.
+
+create_child(Name, ListenerConfig) ->
+    lager:debug("Making listener \"~p\" with ~p", [Name, ListenerConfig]),
+    { Name, { kolab_guam_listener, start_link, [Name, ListenerConfig] }, permanent, 5000, supervisor, [Name] }.

debian.tar.gz/apps/kolab_guam/src/rules Added

debian.tar.gz/apps/kolab_guam/src/rules/kolab_guam_rule_filter_groupware.erl Added

@@ -0,0 +1,141 @@
+%% Copyright 2015 Kolab Systems AG (http://www.kolabsys.com)
+%%
+%% Aaron Seigo (Kolab Systems) <seigo a kolabsys.com>
+%%
+%% This program is free software: you can redistribute it and/or modify
+%% it under the terms of the GNU General Public License as published by
+%% the Free Software Foundation, either version 3 of the License, or
+%% (at your option) any later version.
+%%
+%% This program is distributed in the hope that it will be useful,
+%% but WITHOUT ANY WARRANTY; without even the implied warranty of
+%% MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+%% GNU General Public License for more details.
+%%
+%% You should have received a copy of the GNU General Public License
+%% along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+-module(kolab_guam_rule_filter_groupware).
+-export([new/1, applies/3, imap_data/3, apply_to_client_message/3, apply_to_server_message/3]).
+-behavior(kolab_guam_rule).
+
+-record(state, { blacklist = [], tag = <<>>, active = false, last_chunk = <<>>,
+                 trigger_commands = [<<"LIST">>, <<"list">>, <<"XLIST">>, <<"xlist">>, <<"LSUB">>, <<"lsub">>]}).
+
+new(_Config) -> #state { blacklist = undefined }.
+
+applies(_ConnectionDetails, Buffer, State) ->
+    { _Tag, Command, Data } = eimap_utils:split_command_into_components(Buffer),
+    %lager:debug("********** Checking ...~n    Command: ~s ~s", [Command, Data]),
+    { apply_if_id_matches(Command, Data, State), State }.
+
+apply_to_client_message(ImapSession, Buffer, State) ->
+    { Tag, Command, Data } = eimap_utils:split_command_into_components(Buffer),
+    { Active, StateTag }=
+    case is_triggering_command(Command, Data, State) of
+        true -> fetch_metadata(ImapSession, State), { true, Tag };
+        _ -> { false, <<>> }
+    end,
+    %lager:info("Client sent: ~s ~s ~p", [Command, Data, Active]),
+    { Buffer, State#state{ active = Active, tag = StateTag }}.
+
+apply_to_server_message(_ImapSession, Buffer, #state{ active = true } = State) ->
+    filter_folders(Buffer, State);
+apply_to_server_message(_ImapSession, Buffer, State) -> { Buffer, State }.
+
+imap_data(blacklist, { error, _Reason }, State) -> State;
+imap_data(blacklist, Response, State) ->
+    %TODO: we don't need Foo/Bar if we already have Foo, so filter folders-of-groupwarefolders
+    Blacklist = lists:foldl(fun({ _Folder, [ { _Property, null } ]}, Acc) -> Acc;
+                               ({ _Folder, [ { _Property, <<"mail", _Rest/binary>> } ]}, Acc) -> Acc;
+                               ({ Folder, _ }, Acc) -> [{ Folder, <<Folder/binary, "/">> }|Acc] end,
+                            [], Response),
+    State#state{ blacklist = Blacklist }.
+
+%%PRIVATE
+is_triggering_command(Command, Data, #state{ trigger_commands = TriggerCommands }) ->
+    %% if the command is in the list of trigger commands and the ending is not "" (which means "send me
+    %% the root and separator" according to RFC 3501), then it is treated as a triggering event
+    lists:any(fun(T) -> (Command =:= T) andalso (binary:longest_common_suffix([Data, <<"\"\"">>]) =/= 2) end,
+              TriggerCommands).
+
+
+fetch_metadata(none, #state{ blacklist = undefined }) -> ok;
+fetch_metadata(ImapSession, #state{ blacklist = undefined }) ->
+    eimap:get_folder_metadata(ImapSession, self(), { rule_data, ?MODULE, blacklist }, "*", ["/shared/vendor/kolab/folder-type"]);
+fetch_metadata(_ImapSession, _State) -> ok.
+
+apply_if_id_matches(<<"ID">>, Data, _State) ->
+    apply_if_found_kolab(binary:match(Data, <<"/Kolab">>));
+apply_if_id_matches(Command, Data, State) ->
+    case is_triggering_command(Command, Data, State) of
+        true -> true;
+        _ -> notyet
+    end.
+
+apply_if_found_kolab(nomatch) -> true;
+apply_if_found_kolab(_) -> false.
+
+filter_folders(<<>>, State) ->
+    { <<>>, State#state{ active = true } };
+filter_folders(Buffer, #state{ last_chunk = LeftOvers } = State) ->
+    FullBuffer = <<LeftOvers/binary, Buffer/binary>>,
+    { FullLinesBuffer, LastChunk } = eimap_utils:only_full_lines(FullBuffer),
+    ListResponses = binary:split(FullLinesBuffer, <<"\r\n">>, [ global ]),
+    { Response, More } = filter_folders(State, ListResponses, { <<>>, true }),
+    %io:format("Filtered ... ~p~n", [Response]),
+    { <<Response/binary, "\r\n">>, State#state { active = More, last_chunk = LastChunk } }.
+
+filter_folders(_State, [], Return) -> Return;
+filter_folders(_State, _Folders, { Acc, false }) -> { Acc, false };
+filter_folders(State, [Unfiltered|Folders], { Acc, _More }) -> filter_folders(State, Folders, filter_folder(State, Unfiltered, Acc)).
+
+filter_folder(_State, <<>>, Acc) -> { Acc, true };
+filter_folder(State, <<"* LIST ", Details/binary>> = Response, Acc) -> { filter_on_details(State, Response, Acc, Details), true };
+filter_folder(State, <<"* XLIST ", Details/binary>> = Response, Acc) -> { filter_on_details(State, Response, Acc, Details), true };
+filter_folder(State, <<"* LSUB ", Details/binary>> = Response, Acc) -> { filter_on_details(State, Response, Acc, Details), true };
+filter_folder(#state{ tag = Tag }, Response, Acc) ->
+    HasMore =
+    case byte_size(Tag) =< byte_size(Response) of
+        true ->
+            case binary:match(Response, Tag, [{ scope, { 0, byte_size(Tag) } }]) of
+                nomatch -> true;
+                _ -> false % we have found our closing tag!
+            end;
+        false -> true
+    end,
+    { add_response(Response, Acc), HasMore }.
+
+filter_on_details(#state{ blacklist = Blacklist }, Response, Acc, Details) ->
+    %% first determine if we have a quoted item or a non-quoted item and start from there
+    DetailsSize = byte_size(Details),
+    { Quoted, Start } = case binary:at(Details, DetailsSize - 1) of $" -> { quoted, DetailsSize - 2 }; _ -> { unquoted, DetailsSize - 1 } end,
+    Folder = find_folder_name(Details, Quoted, Start, Start, binary:at(Details, Start)),
+    %io:format("COMPARING ~p ??? ~p~n", [Folder, in_blacklist(Folder, Blacklist)]),
+    case in_blacklist(Folder, Blacklist) of
+        true -> Acc;
+        _ -> add_response(Response, Acc)
+    end.
+
+find_folder_name(Details, quoted, End, Start, $") ->
+    binary:part(Details, Start + 1, End - Start);
+find_folder_name(Details, unquoted, End, Start, $ ) ->
+    binary:part(Details, Start + 1, End - Start);
+find_folder_name(Details, _Quoted, _End, 0, _) ->
+    Details;
+find_folder_name(Details, Quoted, End, Start, _) ->
+    find_folder_name(Details, Quoted, End, Start - 1, binary:at(Details, Start - 1)).
+
+add_response(Response, <<>>) -> Response;
+add_response(Response, Acc) -> <<Acc/binary, "\r\n", Response/binary>>.
+
+in_blacklist(_Folder, undefined) -> false;
+in_blacklist(_Folder, []) -> false;
+in_blacklist(Folder, [{ Literal, Prefix }|List]) ->
+    case Literal =:= Folder of
+        true -> true;
+        _ -> case binary:match(Folder, Prefix) of
+                 { 0, _ } -> true;
+                 _ -> in_blacklist(Folder, List)
+             end
+    end.

debian.tar.gz/apps/kolab_guam/test Added

debian.tar.gz/apps/kolab_guam/test/kolab_guam_rules_SUITE.erl Added

@@ -0,0 +1,89 @@
+%% Copyright 2015 Kolab Systems AG (http://www.kolabsys.com)
+%%
+%% Aaron Seigo (Kolab Systems) <seigo a kolabsys.com>
+%%
+%% This program is free software: you can redistribute it and/or modify
+%% it under the terms of the GNU General Public License as published by
+%% the Free Software Foundation, either version 3 of the License, or
+%% (at your option) any later version.
+%%
+%% This program is distributed in the hope that it will be useful,
+%% but WITHOUT ANY WARRANTY; without even the implied warranty of
+%% MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+%% GNU General Public License for more details.
+%%
+%% You should have received a copy of the GNU General Public License
+%% along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+-module(kolab_guam_rules_SUITE).
+
+% easier than exporting by name
+-compile(export_all).
+
+% required for common_test to work
+-include("ct.hrl").
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%% common test callbacks %%
+%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+% Specify a list of all unit test functions
+all() -> [
+          kolab_guam_rule_filter_groupware_responsefiltering_test,
+          kolab_guam_rule_filter_groupware_responsefiltering_multipacket_test
+         ].
+
+% required, but can just return Config. this is a suite level setup function.
+init_per_suite(Config) ->
+        Config.
+
+% required, but can just return Config. this is a suite level tear down function.
+end_per_suite(Config) ->
+        Config.
+
+% optional, can do function level setup for all functions,
+% or for individual functions by matching on TestCase.
+init_per_testcase(_TestCase, Config) ->
+        Config.
+
+% optional, can do function level tear down for all functions,
+% or for individual functions by matching on TestCase.
+end_per_testcase(_TestCase, Config) ->
+        Config.
+
+% c("apps/kolab_guam/test/kolab_guam_sup_tests.erl"). eunit:test(kolab_guam_sup_tests).
+
+kolab_guam_rule_filter_groupware_responsefiltering_test(_TestConfig) ->
+    Data = [
+        {
+            <<"* LIST (\\Noinferiors \\Subscribed) \"/\" INBOX\r\n* LIST (\\Subscribed) \"/\" Archive\r\n* LIST (\\Subscribed \\HasChildren) \"/\" Calendar\r\n* LIST (\\Subscribed) \"/\" \"Calendar/Personal Calendar\"\r\n* LIST (\\Subscribed) \"/\" Configuration\r\n* LIST (\\Subscribed \\HasChildren) \"/\" Contacts\r\n* LIST (\\Subscribed) \"/\" \"Contacts/Personal Contacts\"\r\n* LIST (\\Subscribed) \"/\" Drafts\r\n* LIST (\\Subscribed) \"/\" Files\r\n* LIST (\\Subscribed) \"/\" Journal\r\n* LIST (\\Subscribed) \"/\" Notes\r\n* LIST (\\Subscribed) \"/\" Sent\r\n* LIST (\\Subscribed) \"/\" Spam\r\n* LIST (\\Subscribed) \"/\" Tasks\r\n* LIST (\\Subscribed) \"/\" Trash\r\n7 OK Completed (0.000 secs 15 calls)\r\n">>,
+            <<"* LIST (\\Noinferiors \\Subscribed) \"/\" INBOX\r\n* LIST (\\Subscribed) \"/\" Archive\r\n* LIST (\\Subscribed) \"/\" Drafts\r\n* LIST (\\Subscribed) \"/\" Sent\r\n* LIST (\\Subscribed) \"/\" Spam\r\n* LIST (\\Subscribed) \"/\" Trash\r\n7 OK Completed (0.000 secs 15 calls)\r\n">>
+        }
+    ],
+    Config = {}, %%TODO?
+    State = kolab_guam_rule_filter_groupware:new(Config),
+    ServerConfig = kolab_guam_sup:default_imap_server_config(),
+    { ok, ImapSession } = eimap:start_link(ServerConfig),
+    { _, ReadyState } = kolab_guam_rule_filter_groupware:apply_to_client_message(ImapSession, <<"7 list (subscribed) \"\" \"*\" return (special-use)">>, State),
+    lists:foreach(fun({ Input, Filtered }) -> { Filtered, NewState } = kolab_guam_rule_filter_groupware:apply_to_server_message(ImapSession, Input, ReadyState) end, Data).
+
+kolab_guam_rule_filter_groupware_responsefiltering_multipacket_test(_TestConfig) ->
+    Data = [
+        {
+            [
+                <<"* LIST (\\Noinferiors \\Subscribed) \"/\" INBOX\r\n* LIST (\\Subscribed) \"/\" Archive\r\n* LIST (\\Subscribed \\HasChildren) \"/\" Calendar\r\n* LIST (\\Subscribed) \"/\" \"Calendar/Personal Calendar\"\r\n* LIST (\\Subscribed) \"/\" Configuration\r\n* LIST (\\Subscribed \\HasChildren) \"/\" Contacts\r\n* LIST (\\Subscribed) \"/\" \"Contacts/Personal Contacts\"\r\n* LIST (\\Subscribed) \"/\" Drafts\r\n* LIST (\\Subscribed) \"/\" Files\r\n* LIST (\\Subscribed) \"/\" Journal\r\n* LIST (\\Subscribed)">>,
+                <<"\"/\" Notes\r\n* LIST (\\Subscribed) \"/\" Sent\r\n* LIST (\\Subscribed) \"/\" Spam\r\n* LIST (\\Subscribed) \"/\" Tasks\r\n* LIST (\\Subscribed) \"/\" Trash\r\n7 OK Completed (0.000 secs 15 calls)\r\n">>
+            ],
+            <<"* LIST (\\Noinferiors \\Subscribed) \"/\" INBOX\r\n* LIST (\\Subscribed) \"/\" Archive\r\n* LIST (\\Subscribed) \"/\" Drafts\r\n* LIST (\\Subscribed) \"/\" Sent\r\n* LIST (\\Subscribed) \"/\" Spam\r\n* LIST (\\Subscribed) \"/\" Trash\r\n7 OK Completed (0.000 secs 15 calls)\r\n">>
+        }
+    ],
+    Config = {}, %%TODO?
+    State = kolab_guam_rule_filter_groupware:new(Config),
+    { _, ReadyState } = kolab_guam_rule_filter_groupware:apply_to_client_message(<<"7 list (subscribed) \"\" \"*\" return (special-use)">>, State),
+    lists:foreach(fun({ Input, Filtered }) -> Filtered = filter_groupware_packets(ReadyState, Input, <<>>) end, Data).
+
+filter_groupware_packets(_ReadyState, [], Buffer) -> Buffer;
+filter_groupware_packets(ReadyState, [Input|More], Buffer) ->
+    { Processed, State } = kolab_guam_rule_filter_groupware:apply_to_server_message(Input, ReadyState),
+    filter_groupware_packets(State, More, <<Buffer/binary, Processed/binary>>).
+

debian.tar.gz/apps/kolab_guam/test/kolab_guam_sup_SUITE.erl Added

@@ -0,0 +1,82 @@
+%% Copyright 2015 Kolab Systems AG (http://www.kolabsys.com)
+%%
+%% Aaron Seigo (Kolab Systems) <seigo a kolabsys.com>
+%%
+%% This program is free software: you can redistribute it and/or modify
+%% it under the terms of the GNU General Public License as published by
+%% the Free Software Foundation, either version 3 of the License, or
+%% (at your option) any later version.
+%%
+%% This program is distributed in the hope that it will be useful,
+%% but WITHOUT ANY WARRANTY; without even the implied warranty of
+%% MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+%% GNU General Public License for more details.
+%%
+%% You should have received a copy of the GNU General Public License
+%% along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+-module(kolab_guam_sup_SUITE).
+
+% easier than exporting by name
+-compile(export_all).
+
+% required for common_test to work
+-include("ct.hrl").
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%% common test callbacks %%
+%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+% Specify a list of all unit test functions
+all() -> [imap_server_config_test, imap_server_settings_to_config_test].
+
+% required, but can just return Config. this is a suite level setup function.
+init_per_suite(Config) ->
+        Config.
+
+% required, but can just return Config. this is a suite level tear down function.
+end_per_suite(Config) ->
+        Config.
+
+% optional, can do function level setup for all functions,
+% or for individual functions by matching on TestCase.
+init_per_testcase(_TestCase, Config) ->
+        Config.
+
+% optional, can do function level tear down for all functions,
+% or for individual functions by matching on TestCase.
+end_per_testcase(_TestCase, Config) ->
+        Config.
+
+% c("apps/kolab_guam/test/kolab_guam_sup_tests.erl"). eunit:test(kolab_guam_sup_tests).
+
+imap_server_settings_to_config_test(_TestConfig) ->
+    Configs = [
+        {
+            [],
+            #eimap_server_config{}
+        },
+        {
+            [ { tls, false } ],
+            #eimap_server_config{ tls = false }
+        },
+        {
+            [ { host, "192.168.56.101" }, { port, 993 }, { tls, true } ],
+            #eimap_server_config{ host = "192.168.56.101", port = 993, tls = true }
+        }
+    ],
+    lists:foreach(fun({ Config, Record }) -> Record = kolab_guam_sup:imap_server_settings_to_config(Config) end, Configs).
+
+default_imap_server_config_test(_TestConfig) ->
+    Expected = #eimap_server_config{ host = "192.168.56.102", port = 994, tls = true },
+    Expected = kolab_guam_sup:default_imap_server_config().
+
+imap_server_config_test(_TestConfig) ->
+    Configs = [
+        {
+            test_default,
+            #eimap_server_config{ host = "192.168.56.101", port = 993, tls = false }
+        }
+    ],
+    lists:foreach(fun({ Config, Record }) -> Record = kolab_guam_sup:imap_server_config(Config) end, Configs).
+

debian.tar.gz/apps/kolab_guam/test/test.config Added

@@ -0,0 +1,37 @@
+%% -*- tab-width: 4;erlang-indent-level: 4;indent-tabs-mode: nil -*-
+
+[
+{ kolab_guam,
+  [
+    { imap_servers, [
+                { default, [
+                                { host, "192.168.56.102" },
+                                { port, 994 },
+                                { tls, true }
+                           ]
+                },
+                { test_default, [
+                                { host, "192.168.56.101" },
+                                { port, 993 },
+                                { tls, false }
+                           ]
+                }
+            ]
+    },
+    { listeners, [
+            { default, [ { port, 1936 }, { imap_server, test_default } ]  }
+        ]
+    }
+  ]
+},
+{ lager,
+  [
+    {
+        handlers,
+        [
+            { lager_console_backend, info },
+            { lager_file_backend, [ { file, "log/error.log"}, { level, error } ] },
+            { lager_file_backend, [ { file, "log/console.log"}, { level, debug } ] }
+        ] }
+  ] }
+].

debian.tar.gz/autogen.sh Added

debian.tar.gz/compat Deleted

debian.tar.gz/contrib Added

debian.tar.gz/contrib/guam.service Added

debian.tar.gz/contrib/guam.sysvinit Added

@@ -0,0 +1,105 @@
+#!/bin/sh
+### BEGIN INIT INFO
+# Provides:
+# Required-Start:    $remote_fs $syslog
+# Required-Stop:     $remote_fs $syslog
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Start daemon at boot time
+# Description:       Enable service provided by daemon.
+### END INIT INFO
+
+name=`basename $0`
+
+export HOME=/opt/kolab_guam/
+
+start_cmd="$name start"
+restart_cmd="$name restart"
+stop_cmd="$name stop"
+ping_cmd="$name ping"
+user=""
+
+
+get_pid() {
+    cat "$pid_file"
+}
+
+is_running() {
+    $ping_cmd > /dev/null 2>&1
+}
+
+case "$1" in
+    start)
+    if is_running; then
+        echo "Already started"
+    else
+        echo "Starting $name"
+        if [ -z "$user" ]; then
+            $start_cmd
+        else
+            sudo -u "$user" $start_cmd
+        fi
+        sleep 2
+        
+        for i in {1..10}
+        do
+            if is_running; then
+                break;
+            fi
+            
+            echo -n "."
+            sleep 1
+        done
+        
+        if ! is_running; then
+            echo "Unable to start"
+            exit 1
+        fi
+    fi
+    ;;
+    stop)
+    if is_running; then
+        echo -n "Stopping $name.."
+        $stop_cmd
+        for i in {1..10}
+        do
+            if ! is_running; then
+                break
+            fi
+
+            echo -n "."
+            sleep 1
+        done
+        echo
+
+        if is_running; then
+            echo "Not stopped; may still be shutting down or shutdown may have failed"
+            exit 1
+        else
+            echo "Stopped"
+            if [ -f "$pid_file" ]; then
+                rm "$pid_file"
+            fi
+        fi
+    else
+        echo "Not running"
+    fi
+    ;;
+    restart)
+    $restart_cmd
+    ;;
+    status)
+    if is_running; then
+        echo "Running"
+    else
+        echo "Stopped"
+        exit 1
+    fi
+    ;;
+    *)
+    echo "Usage: $0 {start|stop|restart|status}"
+    exit 1
+    ;;
+esac
+
+exit 0

debian.tar.gz/copyright Deleted

@@ -1,24 +0,0 @@
-Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: guam
-Source: https://kolab.org/about/guam
-
-Files: *
-Copyright: 2016 Kolab Systems AG <contact@kolabsys.com>
-License: GPL-3.0+
-
-License: GPL-3.0+
- This program is free software: you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation, either version 3 of the License, or
- (at your option) any later version.
- .
- This package is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- GNU General Public License for more details.
- .
- You should have received a copy of the GNU General Public License
- along with this program. If not, see <http://www.gnu.org/licenses/>.
- .
- On Debian systems, the complete text of the GNU General
- Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".

debian.tar.gz/cover.spec.in Added

debian.tar.gz/docs Added

debian.tar.gz/docs/CHANGELOG Added

@@ -0,0 +1,17 @@
+v0.3
+
+  * FIX: ensure connection process is cleaned up when the client closes the socket or errors out before the imap connection is not terminated
+  * FIX: folder filtering now works across network packets (so if a list is split on the network; common w/large folder lists)
+  * FEATURE: implicit SSL on listeners supported with { implicit_tls, true }
+  * FEATURE: transparent STARTTLS to imap backends supported with { tls, starttls} in imap-servers config
+  * FEATURE: a listener can be bound to a specific network interface with { host, <hostname or ip addr> }
+  * FEATURE: listeners may specify which imap-servers entry to use with { imap_server, <NAME_OF_IMAP_SERVER_CONFIG> }
+  * DOCUMENTATION: added basic deployment documentation
+
+
+v0.2
+  * IMPROVEMENT: Use the 'native' Erlang SSL config for tls_config; more flexible, less custom documentation/knowledge
+  * FEATURE: STARTTLS supported between client and guam
+
+v0.1
+  * Initial release with basic rulesets and filtering of groupware folders

debian.tar.gz/docs/deployment.md Added

@@ -0,0 +1,160 @@
+Deploying Guam
+==============
+
+This document covers the deployment of Guam in a Kolab environment.
+
+Installation
+------------
+TBD
+
+Running Guam
+------------
+
+Guam includes a kolab_guam binary in the bin/ directory. This binary can be used
+to start, stop, restart, etc. Guam. For example, assumign kolab_guam is in your
+path:
+
+    kolab_guam start   # starts Guam in the background
+    kolab_guam console # starts Guam in a foreground console
+    kolab_guam ping    # determine if the server is running or not
+    kolab_guam attach  # attaches to a running Guam and opens a console to it
+    kolab_guam stop    # stop Guam
+    kolab_guam restart # restarts Guam
+
+The version of Guam packaged with Kolab comes with a systemd module file,
+which can be used to integrate with systemd managed operating systems.
+
+Configuration
+-------------
+Guam's config is stored in releases/<version#>/sys.config.
+
+The file contains configuration for the following aspect of Guam:
+
+    * imap_servers: The IMAP servers to connet to
+    * listeners: the ports Guam should be listening on
+
+These are all wrapped in a { kolab_guam, [ ... ] } entry in the file.
+
+### imap_servers
+
+imap_servers can have one or more entries in it, one for each IMAP server that
+Guam may use. Each IMAP server can have the following aspects specified:
+
+    * host: an IP address or hostname to connect to
+    * port: the port to connet to
+    * tls: false for no encryption, true for implicit SSL or starttls for
+           the encryption to be started with STARTTLS on IMAP servers that 
+           advertise that capability (NOTE: starttls not included in v0.2)
+
+An IMAP server labeled "default" is required to exist for proper functionality.
+
+Example:
+
+    { imap_servers, [
+                    { default, [
+                                 { host, "192.168.56.101" },
+                                 { port, 993 },
+                                 { tls, true }
+                               ]
+                    },
+                    { other_server, [
+                                 { host, "kolab.acmeinc.com" },
+                                 { port, 143 }
+                                 { tls, false }
+                    ]
+    },
+
+
+If running Guam on the same server as the IMAP backend, it is recommended
+to set tls to false as encryption between Guam and the IMAP server is in that
+case is superfluous and therefore simply a waste of resources.
+
+### listeners
+
+For each port that Guam should listen on one listener configuration must be
+present. This configuration also controls which rules are applied. Each listener
+is defined by a key, which is the name used in e.g. logging, and a value which
+contains the configuration specifics. Example:
+
+    { listeners, [
+       { default, [
+                { host, "127.0.0.1" },
+                { port, 1936 },
+                { imap_server, default },
+                { rules, [ { filter_groupware, [] } ] },
+                { listener_pool_size, 50 },
+                { tls_config, [ { certfile, "/etc/ssl/sample.pem" } ] }
+            ]
+       },
+       { default, [
+                { net_iface, "eth0" },
+                { port, 1993 },
+                { imap_server, default },
+                { implicit_tls, true },
+                { rules, [ { filter_groupware, [] } ] },
+                { tls_config, [ { certfile, "/etc/ssl/sample.pem" } ] }
+            ]
+        }
+    }
+
+The host entry is optional, and is used to bind the connection to a specific
+network interface by ip address. Alternatively, the net_iface may be defined and
+guam will attempt to bind to an address on that network device. net_iface overrides
+host, though host will be used as a fallback if net_iface does not produce a network
+interface. Leaving host and net_iface empty will cause Guam to bind to the port accross
+all network interfaces available to it.
+
+port defines the port the listener is active on.
+
+imap_server refers to the entry in the imap_servers block. If not provided, the
+default entry in the imap_servers configuration is used.
+
+rules contains the rules to apply to sessions with this listener. If not provided,
+then no rules are applied. The rules are a list containing pairs of rule names
+and rule configuration. In the above example, there is exactly one rule to be
+applied and it has no specific configuration. A more elaborate example might be:
+
+    { rules, [
+        { filter_groupware, [] },
+        { deny_access, [ "badhost.com" ] },
+        { filter_users, [ "*@acme.com", { silent, true } ] }
+        ]
+    }
+
+The number of listeners idling on the socket to accept connections can be set
+with listener_pool_size. This is a trade off between connection latency and
+resource usage under load. In normal usage, the default value should suffice
+and this configuration may be left out.
+
+Finally, there is the tls_config. This must be provided if STARTTLS is to be
+supported. (Implicit TLS is currently not supported by listeners.) The minimum
+configuration provides the path to a PEM bundle, however one can also define
+the path to cacerts, client certs, individuals key/cert files (e.g. not in a PEM
+bundle) as well as the cyphers to be used. See this for full details of all
+supported options:
+
+    http://www.erlang.org/doc/man/ssl.html
+
+
+Logging
+-------
+
+Logging is controlled with a top-level group in the group with the key "lager".
+A sample configuration would look like this:
+
+{ lager,
+    [
+    {
+        handlers,
+        [
+        { lager_console_backend, debug },
+        { lager_file_backend, [ { file, "log/error.log"}, { level, error } ] },
+        { lager_file_backend, [ { file, "log/console.log"}, { level, debug } ] }
+        ] }
+    ] }
+
+Each handler describes where the messages are routed (console, file, ...) and 
+the message levels which are directed to those end points. The message levels
+used in egara include: info, warn, error and debug.
+
+See https://github.com/basho/lager for more details on lager configuration.

debian.tar.gz/docs/design_overview.md Added

@@ -0,0 +1,93 @@
+Data Types
+==========
+
+* Address: IPv4/IPv6, IP address, port
+* IMAP Server: address and port of an IMAP server
+* Rule Set: list of rules
+* Rule: Scope, IMAP server, list of Transforms
+* ScopeData record: { atom ConnectionState, address Incoming, binary Command }
+* SessionState record: { socket Socket, address Incoming, eimap IMAP, [FilterData] filter_data_cache }
+* FilterData: { atom Name, any Data }
+
+Modules
+=======
+* kolab_guam_imap: Erlang application adapted from egara_imap, a stateful imap client
+* kolab_guam_listener: Socket listener
+* kolab_guam_session: Handler for a given client connection
+
+
+Behaviors
+=========
+* Scope - used to see if a rule set matches a given session
+    * matches(ScopeData) -> match
+                            { match, [filter_data] }
+                            unsure
+                            nomatch
+
+* Condition
+    * matches(SessionState, binary Command) -> { pre, function Filter }
+                                               { post, function Filter }
+                                               { auth, function Filter }
+                                               pass
+* Filter
+    * auth_command(SessionState, binary Command) -> binary NewCommand
+                                               { binary NewCommand, final }
+                                               drop
+    * auth_response(SessionState, binary Command, binary Response) -> binary NewResponse
+                                                                      { binary NewResponse, final }
+                                                                      { binary NewResponse, more }
+                                                                      drop
+    * command(SessionState, binary Command) -> binary NewCommand
+                                               { binary NewCommand, final }
+                                               drop
+    * response(SessionState, binary Command, binary Response) -> binary NewResponse
+                                                                 { binary NewResponse, final }
+                                                                 { binary NewResponse, more }
+                                                                 drop
+
+
+Process Hierarchy
+=================
+There is one supervisor for the set of Listeners.
+
+Each configured Address results in one Listener process responsible for
+connections on that Address. Each Listener holds one pre-allocated Session
+process for use with the next connection.
+
+Session processes have no supervision (a crash will represent a forced
+disconnect) and are spawned by Listeners. Each Session process has an IMAP
+process which communicates with the backend.
+
+
+Working Data Set
+================
+
+At program start, or on reconfiguration, the following is read from configuration:
+
+* IMAP server addresses as { atom name, imap_server Address } tuples
+* atom default_imap_server, must reference a server in IMAP server addresses
+* The addresses to listen on, and for each address a Listener is started which:
+    * opens the socket for listening (or dies trying)
+    * reads in the matching RuleSets for that address
+    * optional atom default_imap_server, must reference a server in IMAP server addresses
+
+Sessions
+========
+On creation of a new session due to a client connection, all auth rule sets are matched
+prior to connection. If a rule set matches and identifies the IMAP server to connect to
+then it is responsible for connecting to the IMAP server in question. Once connection
+is established, authentication is established via the same set of auth filters.
+
+Once the IMAP process is in the auth state, for each command the pre conditions are run,
+the resulting command is sent, and the post conditions are run upon data receiption.
+
+If connection is lost to the IMAP server, then the session also terminates immediately.
+
+Egara Integration
+=================
+Sending events to egara so as to capture events as they occur in the Kolab data loss
+prevention and auditing framework will be accomplished thorugh a custom lager backend
+and formater. The formater will take a term and turn it into appropriate json (or simply
+send it across to egara if "raw" Erlang terms are supported for input at that point),
+and the backend will route the messages to egara, holding them in local storage until
+successfully sent to an egara sink.

debian.tar.gz/docs/functional_description.md Added

@@ -0,0 +1,54 @@
+Functional description
+======================
+The Kolab Payload Filter (KPF), aka Guam, is responsible for sitting between a Kolab Groupware Server and a user's client software and applying a set of dynamic transformations to requests from the client and responses from the server in a fashion that is transparent to the client and generally secure.
+
+It needs to support various matching and filtering rules which may vary based on the user's account as well as source and destination network addresses.
+
+Use Cases
+=========
+* Filter all groupware folders from mail listings to allow usable and safe access to a Kolab Groupware Server over imap from clients that do not understand groupware folders.
+* Deny access to files that are marked for security / privacy reasons (secret, etc.)
+* Allow access to a limited set of content from outside the office and full access inside the office
+
+Design Brief
+============
+The system will be written in Erlang around the following concepts.
+
+KPF will listen on one or more network interfaces (IP address + port) to accept incoming connections from clients. Each connection will behandled in its own Erlang process, giving data separation and scalability "for free".
+
+Rule sets form the core of the filtering logic. A rule set contains zero (a null set) or more rules in a chain, each of which may:
+    * match command types and alloy/deny/filter access
+        * e.g. filter out groupware folders (the primary Munich use case)
+    * match path (folder, message, ..) and allow/deny/filter access
+    * match message properties / tags and allow/deny/filter access based on those
+    * arbitrary Erlang functions
+
+Rule set chains are applied in first-to-last order allowing multiple transformations
+in a predictable order.
+
+Rule sets are paired with matching criterion include:
+    * scope
+        * default (apply to all)
+        * group (accounts may belong to 0..N groups)
+        * account (a specific account or a regular expression)
+    * incoming (external) address the client is accessing from
+    * destination (local) address the client is connecting to
+
+When a client connects the KPF will:
+
+    1. Load / apply matching rule sets associated with applicable addresses
+    2. Perform authentication
+        * may pass through a rule set first, including:
+            * transformation of account name
+            * transformation of account dest
+            * application of white/black lists
+        * authenticate against Kolab Groupware server
+    3. Load all rule sets that apply to the authenticated account
+    4. Each request passes through the rule sets, possibly modifying request
+       and/or response
+
+This allows behavior to be modified based on where the client is, which address they connect to, what they access and which account they authenticate to. The results of the  rule set passes are arbitrary, allowing for future expansion beyond the initial simple use case of filtering folders.
+
+Rule sets would be stored in a <define storage location> and modified using a <web interface?>.
+
+Initially we would implement the "bare" framework for the above and only implement the filter-groupware-folders rule. Further rule development would occur on as-needed basis.

debian.tar.gz/rebar Added

debian.tar.gz/rebar.config Added

@@ -0,0 +1,30 @@
+%% -*- tab-width: 4;erlang-indent-level: 4;indent-tabs-mode: nil -*-
+%% ex: ft=erlang ts=4 sw=4 et
+
+{ deps_dir, "deps" }.
+{ deps, [
+    { lager, "(2.0|2.1|2.2).*", { git, "git://github.com/basho/lager.git", { tag, "2.2.0" } } },
+    { lager_syslog, "2.*", { git, "git://github.com/basho/lager_syslog.git", { tag, "2.1.3" } } },
+    { eimap, ".*", { git, "https://git.kolab.org/diffusion/EI/eimap.git", { tag, "0.2.5" } } }
+    %% pull in the proper version of meck before jobs 0.3 gets around to pulling in the wrong version
+   ]
+}.
+
+{ erl_opts, [ %%no_debug_info,
+            {parse_transform, lager_transform},
+            {platform_define, "(linux|solaris|freebsd|darwin)", 'HAVE_SENDFILE'}
+            ]
+}.
+{ sub_dirs, [
+    "apps/kolab_guam",
+    "rel"
+ ]}.
+{ erl_first_files, ["apps/kolab_guam/src/kolab_guam_rule.erl"] }.
+{ erl_opts, [debug_info, fail_on_warning] }.
+{ eunit_opts, [verbose, {skip_deps, true }] }.
+{ eunit_exclude_deps, true }.
+{ cover_enabled, true }.
+
+%%{require_otp_vsn, "17"}.
+{ pre_hooks, [ { clean, "rm -fr ebin priv erl_crash.dump" } ] }.
+

debian.tar.gz/rel Added

debian.tar.gz/rel/files Added

debian.tar.gz/rel/files/erl Added

@@ -0,0 +1,44 @@
+#!/bin/sh
+
+# /bin/sh on Solaris is not a POSIX compatible shell, but /usr/bin/ksh is.
+if [ `uname -s` = 'SunOS' -a "${POSIX_SHELL}" != "true" ]; then
+    POSIX_SHELL="true"
+    export POSIX_SHELL
+    exec /usr/bin/ksh $0 "$@"
+fi
+
+# clear it so if we invoke other scripts, they run as ksh as well
+unset POSIX_SHELL
+
+## This script replaces the default "erl" in erts-VSN/bin. This is
+## necessary as escript depends on erl and in turn, erl depends on
+## having access to a bootscript (start.boot). Note that this script
+## is ONLY invoked as a side-effect of running escript -- the embedded
+## node bypasses erl and uses erlexec directly (as it should).
+##
+## Note that this script makes the assumption that there is a
+## start_clean.boot file available in $ROOTDIR/release/VSN.
+
+# Determine the abspath of where this script is executing from.
+ERTS_BIN_DIR=$(cd ${0%/*} && pwd -P)
+
+# Now determine the root directory -- this script runs from erts-VSN/bin,
+# so we simply need to strip off two dirs from the end of the ERTS_BIN_DIR
+# path.
+ROOTDIR=${ERTS_BIN_DIR%/*/*}
+
+# Parse out release and erts info
+START_ERL=`cat $ROOTDIR/releases/start_erl.data`
+ERTS_VSN=${START_ERL% *}
+APP_VSN=${START_ERL#* }
+
+BINDIR=$ROOTDIR/erts-$ERTS_VSN/bin
+EMU=beam
+PROGNAME=`echo $0 | sed 's/.*\\///'`
+CMD="$BINDIR/erlexec"
+export EMU
+export ROOTDIR
+export BINDIR
+export PROGNAME
+
+exec $CMD -boot $ROOTDIR/releases/$APP_VSN/start_clean ${1+"$@"}

debian.tar.gz/rel/files/install_upgrade.escript Added

@@ -0,0 +1,55 @@
+#!/usr/bin/env escript
+%%! -noshell -noinput
+%% -*- mode: erlang;erlang-indent-level: 4;indent-tabs-mode: nil -*-
+%% ex: ft=erlang ts=4 sw=4 et
+%% This file is left for backward-compatibility.
+%% You, probably, shouldn't include it to new projects.
+
+
+main([NodeName, Cookie, ReleasePackage]) ->
+    io:format("WARNING: 'install_upgrade.escript' is deprecated! "
+              "Use 'nodetool upgrade' instead.~n"),
+    NodeRoot = filename:dirname(filename:dirname(escript:script_name())),
+    NodeTool = which_nodetool(NodeRoot),
+    process_flag(trap_exit, true),
+    Port = erlang:open_port(
+             {spawn_executable, NodeTool},
+             [{args, ["-sname", NodeName,
+                      "-setcookie", Cookie,
+                      "upgrade", ReleasePackage]},
+              binary, exit_status, use_stdio, stderr_to_stdout, hide]),
+    port_loop(Port);
+main(_) ->
+    halt(1).
+
+
+which_nodetool(NodeRoot) ->
+    %% ${RELEASE_ROOT}/
+    %%   bin/install_upgrade.escript
+    %%   bin/nodetool ?
+    %%   erts-<erts_ver>/bin/nodetool ?
+    %%   releases/<app_ver>/nodetool ?
+    %%   releases/start_erl.data
+    {ok, Content} = file:read_file(filename:join([NodeRoot, "releases", "start_erl.data"])),
+    [ErtsVsn, AppVsn] = binary:split(Content, <<" ">>),
+    Probes = [
+              filename:join([NodeRoot, "bin", "nodetool"]),
+              filename:join([NodeRoot, <<"erts-", ErtsVsn/binary>>, "bin", "nodetool"]),
+              filename:join([NodeRoot, "releases", AppVsn, "bin", "nodetool"])
+             ],
+    case lists:dropwhile(fun(Path) -> not filelib:is_regular(Path) end, Probes) of
+        [] ->
+            io:format("ERROR: can't find 'nodetool' in ~p.~n", [Probes]),
+            halt(2);
+        [Path | _] ->
+            Path
+    end.
+
+port_loop(Port) ->
+    receive
+        {Port, {data, Data}} ->
+            io:put_chars(Data),
+            port_loop(Port);
+        {Port, {exit_status, Status}} ->
+            halt(Status)
+    end.

debian.tar.gz/rel/files/kolab_guam Added

@@ -0,0 +1,433 @@
+#!/bin/sh
+# -*- tab-width:4;indent-tabs-mode:nil -*-
+# ex: ts=4 sw=4 et
+
+# /bin/sh on Solaris is not a POSIX compatible shell, but /usr/bin/ksh is.
+if [ `uname -s` = 'SunOS' -a "${POSIX_SHELL}" != "true" ]; then
+    POSIX_SHELL="true"
+    export POSIX_SHELL
+    # To support 'whoami' on old Solaris systems, add /usr/ucb to path
+    # (New Solaris systems do not have 'whoami')
+    PATH=/usr/ucb:$PATH
+    export PATH
+    exec /usr/bin/ksh $0 "$@"
+fi
+
+# clear it so if we invoke other scripts, they run as ksh
+unset POSIX_SHELL
+
+RUNNER_SCRIPT_DIR=$(cd ${0%/*} && pwd -P)
+RUNNER_SCRIPT=${0##*/}
+
+CALLER_DIR=$PWD
+
+RUNNER_BASE_DIR=${RUNNER_SCRIPT_DIR%/*}
+RUNNER_ETC_DIR=$RUNNER_BASE_DIR/etc
+# Note the trailing slash on $PIPE_DIR/
+PIPE_DIR=/tmp/$RUNNER_BASE_DIR/
+RUNNER_USER=
+
+# Make sure this script is running as the appropriate user
+if [ "$RUNNER_USER" ]; then
+    WHOAMI=$(id -un 2>/dev/null || whoami 2>/dev/null)
+    if [ $? -ne 0 ]; then
+        echo "Could not determine user name."
+        exit 1
+    fi
+    if [ "x$WHOAMI" != "x$RUNNER_USER" ]; then
+        # The 'su' command is more portable, but can't be configured as 'sudo'
+        # can to allow non-interactive calls from non-root users.
+        type sudo > /dev/null 2>&1
+        if [ $? -eq 0 ]; then
+            echo "Attempting to restart script through sudo -H -u $RUNNER_USER" >&2
+            exec sudo -H -u $RUNNER_USER -i $RUNNER_SCRIPT_DIR/$RUNNER_SCRIPT $@
+        else
+            if [ "x$WHOAMI" != "xroot" ]; then
+                echo "Only root can run $RUNNER_SCRIPT as $RUNNER_USER without requiring a password."
+                exit 1
+            else
+                echo "Attempting to restart script through su $RUNNER_USER" >&2
+                exec su $RUNNER_USER -c $RUNNER_SCRIPT_DIR/$RUNNER_SCRIPT $@
+            fi
+        fi
+    fi
+fi
+
+# Identify the script name
+SCRIPT=`basename $0`
+
+# Parse out release and erts info
+START_ERL=`cat $RUNNER_BASE_DIR/releases/start_erl.data`
+ERTS_VSN=${START_ERL% *}
+APP_VSN=${START_ERL#* }
+
+# Use $CWD/vm.args if exists, otherwise releases/APP_VSN/vm.args, or
+# else etc/vm.args
+if [ -e "$CALLER_DIR/vm.args" ]; then
+    VMARGS_PATH=$CALLER_DIR/vm.args
+    USE_DIR=$CALLER_DIR
+else
+    USE_DIR=$RUNNER_BASE_DIR
+    if [ -e "$RUNNER_BASE_DIR/releases/$APP_VSN/vm.args" ]; then
+        VMARGS_PATH="$RUNNER_BASE_DIR/releases/$APP_VSN/vm.args"
+    else
+        VMARGS_PATH="$RUNNER_ETC_DIR/vm.args"
+    fi
+fi
+
+RUNNER_LOG_DIR=$USE_DIR/log
+# Make sure log directory exists
+mkdir -p $RUNNER_LOG_DIR
+
+# Use releases/VSN/sys.config if it exists otherwise use etc/app.config
+if [ -e "$USE_DIR/sys.config" ]; then
+    CONFIG_PATH="$USE_DIR/sys.config"
+else
+    if [ -e "$RUNNER_BASE_DIR/releases/$APP_VSN/sys.config" ]; then
+        CONFIG_PATH="$RUNNER_BASE_DIR/releases/$APP_VSN/sys.config"
+    else
+        CONFIG_PATH="$RUNNER_ETC_DIR/app.config"
+    fi
+fi
+
+# Extract the target node name from node.args
+NAME_ARG=`egrep '^\-s?name' $VMARGS_PATH`
+if [ -z "$NAME_ARG" ]; then
+    echo "vm.args needs to have either -name or -sname parameter."
+    exit 1
+fi
+
+# Extract the name type and name from the NAME_ARG for REMSH
+REMSH_TYPE=`echo $NAME_ARG | awk '{print $1}'`
+REMSH_NAME=`echo $NAME_ARG | awk '{print $2}'`
+
+# Test if REMSH_NAME contains a @ and set REMSH_HOSTNAME_PART 
+# and REMSH_NAME_PART according REMSH_TYPE
+MAYBE_FQDN_HOSTNAME=`hostname`
+HOSTNAME=`echo $MAYBE_FQDN_HOSTNAME | awk -F. '{print $1}'`
+
+REMSH_HOSTNAME_PART="$MAYBE_FQDN_HOSTNAME"
+case "$REMSH_NAME" in
+    *@*)
+        REMSH_HOSTNAME_PART=`echo $REMSH_NAME | awk -F@ '{print $2}'`
+        REMSH_NAME_PART=`echo $REMSH_NAME | awk -F@ '{print $1}'`
+        ;;
+    *)
+        REMSH_NAME_PART="$REMSH_NAME"
+        if [ "$REMSH_TYPE" = "-sname" ]; then
+            REMSH_HOSTNAME_PART="$HOSTNAME"
+        else
+            # -name type, check if `hostname` is fqdn
+            if [ "$MAYBE_FQDN_HOSTNAME" = "$HOSTNAME" ]; then
+                echo "Hostname must be a fqdn domain name when node is configured with long names"
+                echo "and the full node name isn't configured in vm.args"
+                exit 1
+            fi
+        fi
+        ;;
+esac
+
+# Note the `date +%s`, used to allow multiple remsh to the same node
+# transparently
+REMSH_NAME_ARG="$REMSH_TYPE remsh`date +%s`@$REMSH_HOSTNAME_PART"
+REMSH_REMSH_ARG="-remsh $REMSH_NAME_PART@$REMSH_HOSTNAME_PART"
+
+# Extract the target cookie
+COOKIE_ARG=`grep '^\-setcookie' $VMARGS_PATH`
+if [ -z "$COOKIE_ARG" ]; then
+    echo "vm.args needs to have a -setcookie parameter."
+    exit 1
+fi
+
+# Make sure CWD is set to the right dir
+cd $USE_DIR
+
+# Make sure log directory exists
+mkdir -p $USE_DIR/log
+
+RUNNER_SCRIPT_DATA=
+if [ -e "$RUNNER_BASE_DIR/releases/$APP_VSN/runner_script.data" ]; then
+    RUNNER_SCRIPT_DATA=`cat $RUNNER_BASE_DIR/releases/$APP_VSN/runner_script.data`
+fi
+
+if [ -z "$RUNNER_SCRIPT_DATA" ]; then
+    ROOTDIR=$RUNNER_BASE_DIR
+    ERTS_PATH=$RUNNER_BASE_DIR/erts-$ERTS_VSN/bin
+    if [ -e "$RUNNER_BASE_DIR/releases/$APP_VSN/nodetool" ]; then
+        NODETOOL="$ERTS_PATH/escript $RUNNER_BASE_DIR/releases/$APP_VSN/nodetool $NAME_ARG $COOKIE_ARG"
+    else
+        NODETOOL="$ERTS_PATH/escript $ERTS_PATH/nodetool $NAME_ARG $COOKIE_ARG"
+    fi
+    SLIM_ARGS=
+elif [ "$RUNNER_SCRIPT_DATA" = "slim" ]; then
+    # Setup system paths
+    SYSTEM_ERL_PATH=`which erl`
+    if [ ! -x "$SYSTEM_ERL_PATH" ]; then
+        echo "Failed to find erl. Is Erlang/OTP available in PATH?"
+        exit 1
+    fi
+    SYSTEM_HOME_BIN=${SYSTEM_ERL_PATH%/*}
+    ROOTDIR=$SYSTEM_HOME_BIN/../lib/erlang
+    ERTS_PATH=$ROOTDIR/erts-$ERTS_VSN/bin
+    unset SYSTEM_ERL_PATH
+    unset SYSTEM_HOME_BIN
+
+    LOCAL_ERTS_PATH=$RUNNER_BASE_DIR/erts-$ERTS_VSN/bin
+    NODETOOL="$ERTS_PATH/escript $RUNNER_BASE_DIR/releases/$APP_VSN/nodetool $NAME_ARG $COOKIE_ARG"
+    unset LOCAL_ERL_PATH
+
+    # Setup additional arguments for slim release
+    SLIM_ARGS="-boot_var RELTOOL_EXT_LIB $RUNNER_BASE_DIR/lib -sasl releases_dir \"$RUNNER_BASE_DIR/releases\""
+else
+    echo "Unknown runner_script.data"
+    exit 1
+fi
+
+# Setup remote shell command to control node
+REMSH="$ERTS_PATH/erl -hidden $REMSH_NAME_ARG $REMSH_REMSH_ARG $COOKIE_ARG"
+
+# Common functions
+
+# Ping node without allowing nodetool to take stdin
+ping_node() {
+    $NODETOOL ping < /dev/null
+}
+
+# Set the PID global variable, return 1 on error
+get_pid() {
+    PID=`$NODETOOL getpid < /dev/null`
+    ES=$?
+    if [ "$ES" -ne 0 ]; then
+        echo "Node is not running!"
+        return 1
+    fi
+
+    # don't allow empty or init pid's
+    if [ -z $PID ] || [ "$PID" -le 1 ]; then
+        return 1
+    fi
+
+    return 0
+}
+
+# Check the first argument for instructions
+case "$1" in
+    start|start_boot)
+        # Make sure there is not already a node running
+        RES=`ping_node`
+        if [ "$RES" = "pong" ]; then
+            echo "Node is already running!"
+            exit 1
+        fi
+        case "$1" in
+            start)
+                shift
+                START_OPTION="console"
+                HEART_OPTION="start"
+                ;;
+            start_boot)
+                shift
+                START_OPTION="console_boot"
+                HEART_OPTION="start_boot"
+                ;;
+        esac
+        RUN_PARAM=$(printf "\'%s\' " "$@")
+        HEART_COMMAND="$RUNNER_BASE_DIR/bin/$SCRIPT $HEART_OPTION $RUN_PARAM"
+        export HEART_COMMAND
+        mkdir -p $PIPE_DIR
+        $ERTS_PATH/run_erl -daemon $PIPE_DIR $RUNNER_LOG_DIR "exec $RUNNER_BASE_DIR/bin/$SCRIPT $START_OPTION $RUN_PARAM" 2>&1
+        ;;
+
+    stop)
+        # Wait for the node to completely stop...
+        case `uname -s` in
+            Darwin)
+                # Make sure we explicitly set this because iTerm.app doesn't for
+                # some reason.
+                COMMAND_MODE=unix2003
+        esac
+
+        # Get the PID from nodetool
+        get_pid
+        GPR=$?
+        if [ "$GPR" -ne 0 ] || [ -z $PID ]; then
+            exit $GPR
+        fi
+
+        # Tell nodetool to initiate a stop
+        $NODETOOL stop
+        ES=$?
+        if [ "$ES" -ne 0 ]; then
+            exit $ES
+        fi
+
+        # Wait for the node to completely stop...
+        while `kill -s 0 $PID 2>/dev/null`
+        do
+            sleep 1
+        done
+        ;;
+
+    restart)
+        ## Restart the VM without exiting the process
+        $NODETOOL restart
+        ES=$?
+        if [ "$ES" -ne 0 ]; then
+            exit $ES
+        fi
+        ;;
+
+    reboot)
+        ## Restart the VM completely (uses heart to restart it)
+        $NODETOOL reboot
+        ES=$?
+        if [ "$ES" -ne 0 ]; then
+            exit $ES
+        fi
+        ;;
+
+    ping)
+        ## See if the VM is alive
+        ping_node
+        ES=$?
+        if [ "$ES" -ne 0 ]; then
+            exit $ES
+        fi
+        ;;
+
+    attach)
+        # Make sure a node is running
+        ping_node
+        ES=$?
+        if [ "$ES" -ne 0 ]; then
+            echo "Node is not running!"
+            exit $ES
+        fi
+
+        shift
+        exec $ERTS_PATH/to_erl $PIPE_DIR
+        ;;
+
+    eval)
+        # Make sure a node IS running
+        ping_node > /dev/null 2>&1
+        ES=$?
+        if [ "$ES" -ne 0 ]; then
+            echo "Node is not running!"
+            exit $ES
+        fi
+
+        shift
+        $NODETOOL eval "$1"
+        ES_EVAL=$?
+        if [ "$ES_EVAL" -ne 0 ]; then
+            exit $ES_EVAL
+        fi
+        ;;
+
+    remote_console)
+        # Make sure a node is running
+        ping_node
+        ES=$?
+        if [ "$ES" -ne 0 ]; then
+            echo "Node is not running!"
+            exit $ES
+        fi
+
+        shift
+        exec $REMSH
+        ;;
+
+    upgrade)
+        if [ -z "$2" ]; then
+            echo "Missing upgrade package argument"
+            echo "Usage: $SCRIPT upgrade {package base name}"
+            echo "NOTE {package base name} MUST NOT include the .tar.gz suffix"
+            exit 1
+        fi
+
+        # Make sure a node IS running
+        ping_node
+        ES=$?
+        if [ "$ES" -ne 0 ]; then
+            echo "Node is not running!"
+            exit $ES
+        fi
+
+        $NODETOOL upgrade $2
+        ;;
+
+    console|console_clean|console_boot)
+        # .boot file typically just $SCRIPT (ie, the app name)
+        # however, for debugging, sometimes start_clean.boot is useful.
+        # For e.g. 'setup', one may even want to name another boot script.
+        case "$1" in
+            console)        BOOTFILE=$SCRIPT ;;
+            console_clean)  BOOTFILE=start_clean ;;
+            console_boot)
+                shift
+                BOOTFILE="$1"
+                shift
+                ;;
+        esac
+        # Setup beam-required vars
+        BINDIR=$ROOTDIR/erts-$ERTS_VSN/bin
+        EMU=beam
+        PROGNAME=`echo $0 | sed 's/.*\\///'`
+        CMD="$BINDIR/erlexec $SLIM_ARGS -boot $RUNNER_BASE_DIR/releases/$APP_VSN/$BOOTFILE -mode embedded -config $CONFIG_PATH -args_file $VMARGS_PATH"
+        export EMU
+        export ROOTDIR
+        export BINDIR
+        export PROGNAME
+
+        # Dump environment info for logging purposes
+        echo "Exec: $CMD" -- ${1+"$@"}
+        echo "Root: $ROOTDIR"
+
+        # Log the startup
+        logger -t "$SCRIPT[$$]" "Starting up"
+
+        # Start the VM
+        exec $CMD -- ${1+"$@"}
+        ;;
+
+    foreground)
+        # start up the release in the foreground for use by runit
+        # or other supervision services
+
+        BOOTFILE=$SCRIPT
+        FOREGROUNDOPTIONS="-noinput +Bd"
+
+        # Setup beam-required vars
+        BINDIR=$ROOTDIR/erts-$ERTS_VSN/bin
+        EMU=beam
+        PROGNAME=`echo $0 | sed 's/.*\///'`
+        CMD="$BINDIR/erlexec $SLIM_ARGS $FOREGROUNDOPTIONS -boot $RUNNER_BASE_DIR/releases/$APP_VSN/$BOOTFILE -config $CONFIG_PATH -args_file $VMARGS_PATH"
+        export EMU
+        export ROOTDIR
+        export BINDIR
+        export PROGNAME
+
+        # Dump environment info for logging purposes
+        echo "Exec: $CMD" -- ${1+"$@"}
+        echo "Root: $ROOTDIR"
+
+        # Start the VM
+        exec $CMD -- ${1+"$@"}
+        ;;
+    getpid)
+        # Get the PID from nodetool
+        get_pid
+        ES=$?
+        if [ "$ES" -ne 0 ] || [ -z $PID ]; then
+            exit $ES
+        fi
+        echo $PID
+        ;;
+    *)
+        echo "Usage: $SCRIPT {start|start_boot <file>|foreground|stop|restart|reboot|ping|console|getpid|console_clean|console_boot <file>|attach|eval|remote_console|upgrade}"
+        exit 1
+        ;;
+esac
+
+exit 0

debian.tar.gz/rel/files/kolab_guam.cmd Added

@@ -0,0 +1,116 @@
+@setlocal
+
+@set node_name=kolab_guam
+
+@rem Get the absolute path to the parent directory,
+@rem which is assumed to be the node root.
+@for /F "delims=" %%I in ("%~dp0..") do @set node_root=%%~fI
+
+@rem CWD to the node root directory
+@cd %node_root%
+
+@set releases_dir=%node_root%\releases
+
+@rem Parse ERTS version and release version from start_erl.data
+@for /F "usebackq tokens=1,2" %%I in ("%releases_dir%\start_erl.data") do @(
+    @call :set_trim erts_version %%I
+    @call :set_trim release_version %%J
+)
+
+@if exist "%releases_dir%\%release_version%\vm.args" (
+    @set vm_args="%releases_dir%\%release_version%\vm.args"
+) else (
+    @set vm_args="%node_root%\etc\vm.args"
+)
+
+@if exist "%releases_dir%\%release_version%\sys.config" (
+    @set sys_config="%releases_dir%\%release_version%\sys.config"
+) else (
+    @set sys_config="%node_root%\etc\app.config"
+)
+
+@set node_boot_script=%releases_dir%\%release_version%\%node_name%
+@set clean_boot_script=%releases_dir%\%release_version%\start_clean
+
+@rem extract erlang cookie from vm.args
+@for /f "usebackq tokens=1-2" %%I in (`findstr /b \-setcookie "%vm_args%"`) do @set erlang_cookie=%%J
+
+@set erts_bin=%node_root%\erts-%erts_version%\bin
+
+@set service_name=%node_name%_%release_version%
+
+@set erlsrv="%erts_bin%\erlsrv.exe"
+@set epmd="%erts_bin%\epmd.exe"
+@set escript="%erts_bin%\escript.exe"
+@set werl="%erts_bin%\werl.exe"
+@set nodetool="%erts_bin%\nodetool"
+
+@if "%1"=="usage" @goto usage
+@if "%1"=="install" @goto install
+@if "%1"=="uninstall" @goto uninstall
+@if "%1"=="start" @goto start
+@if "%1"=="stop" @goto stop
+@if "%1"=="restart" @call :stop && @goto start
+@if "%1"=="console" @goto console
+@if "%1"=="ping" @goto ping
+@if "%1"=="query" @goto query
+@if "%1"=="attach" @goto attach
+@if "%1"=="upgrade" @goto upgrade
+@echo Unknown command: "%1"
+
+:usage
+@echo Usage: %~n0 [install^|uninstall^|start^|stop^|restart^|console^|ping^|query^|attach^|upgrade]
+@goto :EOF
+
+:install
+@set description=Erlang node %node_name% in %node_root%
+@set start_erl=%node_root%\bin\start_erl.cmd
+@set args= ++ %node_name% ++ %node_root%
+@%erlsrv% add %service_name% -c "%description%" -sname %node_name% -w "%node_root%" -m "%start_erl%" -args "%args%" -stopaction "init:stop()."
+@goto :EOF
+
+:uninstall
+@%erlsrv% remove %service_name%
+@%epmd% -kill
+@goto :EOF
+
+:start
+@%erlsrv% start %service_name%
+@goto :EOF
+
+:stop
+@%erlsrv% stop %service_name%
+@goto :EOF
+
+:console
+@start "%node_name% console" %werl% -boot "%node_boot_script%" -config "%sys_config%" -args_file "%vm_args%" -sname %node_name%
+@goto :EOF
+
+:ping
+@%escript% %nodetool% ping -sname "%node_name%" -setcookie "%erlang_cookie%"
+@exit %ERRORLEVEL%
+@goto :EOF
+
+:query
+@%erlsrv% list %service_name%
+@exit %ERRORLEVEL%
+@goto :EOF
+
+:attach
+@for /f "usebackq" %%I in (`hostname`) do @set hostname=%%I
+start "%node_name% attach" %werl% -boot "%clean_boot_script%" -remsh %node_name%@%hostname% -sname console -setcookie %erlang_cookie%
+@goto :EOF
+
+:upgrade
+@if "%2"=="" (
+    @echo Missing upgrade package argument
+    @echo Usage: %~n0 upgrade {package base name}
+    @echo NOTE {package base name} MUST NOT include the .tar.gz suffix
+    @goto :EOF
+)
+@%escript% %nodetool% -sname "%node_name%" -setcookie "%erlang_cookie%" upgrade %2
+@goto :EOF
+
+:set_trim
+@set %1=%2
+@goto :EOF

debian.tar.gz/rel/files/nodetool Added

@@ -0,0 +1,219 @@
+#!/usr/bin/env escript
+%% -*- mode: erlang;erlang-indent-level: 4;indent-tabs-mode: nil -*-
+%% ex: ft=erlang ts=4 sw=4 et
+%% -------------------------------------------------------------------
+%%
+%% nodetool: Helper Script for interacting with live nodes
+%%
+%% -------------------------------------------------------------------
+main(Args) ->
+    ok = start_epmd(),
+    %% Extract the args
+    {RestArgs, TargetNode} = process_args(Args, [], undefined),
+
+    %% any commands that don't need a running node
+    case RestArgs of
+        ["chkconfig", File] ->
+            case file:consult(File) of
+                {ok, _} ->
+                    io:format("ok\n"),
+                    halt(0);
+                {error, {Line, Mod, Term}} ->
+                    io:format(standard_error, ["Error on line ",
+                              file:format_error({Line, Mod, Term}), "\n"], []),
+                    halt(1);
+                {error, R} ->
+                    io:format(standard_error, ["Error reading config file: ",
+                              file:format_error(R), "\n"], []),
+                    halt(1)
+            end;
+        _ ->
+            ok
+    end,
+
+    %% See if the node is currently running  -- if it's not, we'll bail
+    case {net_kernel:hidden_connect_node(TargetNode),
+          net_adm:ping(TargetNode)} of
+        {true, pong} ->
+            ok;
+        {false,pong} ->
+            io:format("Failed to connect to node ~p .\n", [TargetNode]),
+            halt(1);
+        {_, pang} ->
+            io:format("Node ~p not responding to pings.\n", [TargetNode]),
+            halt(1)
+    end,
+
+    case RestArgs of
+        ["getpid"] ->
+            io:format("~p\n",
+                      [list_to_integer(rpc:call(TargetNode, os, getpid, []))]);
+        ["ping"] ->
+            %% If we got this far, the node already responsed to a
+            %% ping, so just dump a "pong"
+            io:format("pong\n");
+        ["stop"] ->
+            io:format("~p\n", [rpc:call(TargetNode, init, stop, [], 60000)]);
+        ["restart"] ->
+            io:format("~p\n", [rpc:call(TargetNode, init, restart, [], 60000)]);
+        ["reboot"] ->
+            io:format("~p\n", [rpc:call(TargetNode, init, reboot, [], 60000)]);
+        ["rpc", Module, Function | RpcArgs] ->
+            case rpc:call(TargetNode,
+                          list_to_atom(Module),
+                          list_to_atom(Function),
+                          [RpcArgs], 60000) of
+                ok ->
+                    ok;
+                {badrpc, Reason} ->
+                    io:format("RPC to ~p failed: ~p\n", [TargetNode, Reason]),
+                    halt(1);
+                _ ->
+                    halt(1)
+            end;
+        ["rpc_infinity", Module, Function | RpcArgs] ->
+            case rpc:call(TargetNode,
+                          list_to_atom(Module),
+                          list_to_atom(Function),
+                          [RpcArgs], infinity) of
+                ok ->
+                    ok;
+                {badrpc, Reason} ->
+                    io:format("RPC to ~p failed: ~p\n", [TargetNode, Reason]),
+                    halt(1);
+                _ ->
+                    halt(1)
+            end;
+        ["rpcterms", Module, Function, ArgsAsString] ->
+            case rpc:call(TargetNode,
+                          list_to_atom(Module),
+                          list_to_atom(Function),
+                          consult(ArgsAsString), 60000) of
+                {badrpc, Reason} ->
+                    io:format("RPC to ~p failed: ~p\n", [TargetNode, Reason]),
+                    halt(1);
+                Other ->
+                    io:format("~p\n", [Other])
+            end;
+        ["eval", Str0] ->
+            Str = string:strip(Str0, right, $.) ++ ".",
+            Bindings = erl_eval:new_bindings(),
+            case rpc:call(TargetNode,
+                          erl_eval,
+                          exprs,
+                          [parse(Str), Bindings],
+                          60000) of
+                {badrpc, Reason} ->
+                    io:format("RPC to ~p failed: ~p\n", [TargetNode, Reason]),
+                    halt(1);
+                {value, Value, _Bindings} ->
+                    io:format("~p\n", [Value])
+            end;
+        ["upgrade", ReleasePackage] ->
+            %% TODO: This script currently does NOT support slim releases.
+            %% Necessary steps to upgrade a slim release are as follows:
+            %% 1. unpack relup archive manually
+            %% 2. copy releases directory and necessary libraries
+            %% 3. using release_hander:set_unpacked/2 .
+            %% For more details, see https://github.com/rebar/rebar/pull/52
+            %% and https://github.com/rebar/rebar/issues/202
+            {ok, Vsn} = rpc:call(TargetNode, release_handler, unpack_release,
+                                 [ReleasePackage], 60000),
+            io:format("Unpacked Release ~p\n", [Vsn]),
+            {ok, OtherVsn, Desc} = rpc:call(TargetNode, release_handler,
+                                            check_install_release, [Vsn], 60000),
+            {ok, OtherVsn, Desc} = rpc:call(TargetNode, release_handler,
+                                            install_release, [Vsn], 60000),
+            io:format("Installed Release ~p\n", [Vsn]),
+            ok = rpc:call(TargetNode, release_handler, make_permanent, [Vsn], 60000),
+            io:format("Made Release ~p Permanent\n", [Vsn]);
+        Other ->
+            io:format("Other: ~p\n", [Other]),
+            io:format("Usage: nodetool {chkconfig|getpid|ping|stop|restart|reboot|rpc|rpc_infinity|rpcterms|eval|upgrade}\n")
+    end,
+    net_kernel:stop().
+
+process_args([], Acc, TargetNode) ->
+    {lists:reverse(Acc), TargetNode};
+process_args(["-setcookie", Cookie | Rest], Acc, TargetNode) ->
+    erlang:set_cookie(node(), list_to_atom(Cookie)),
+    process_args(Rest, Acc, TargetNode);
+process_args(["-name", TargetName | Rest], Acc, _) ->
+    ThisNode = append_node_suffix(TargetName, "_maint_"),
+    {ok, _} = net_kernel:start([ThisNode, longnames]),
+    process_args(Rest, Acc, nodename(TargetName));
+process_args(["-sname", TargetName | Rest], Acc, _) ->
+    ThisNode = append_node_suffix(TargetName, "_maint_"),
+    {ok, _} = net_kernel:start([ThisNode, shortnames]),
+    process_args(Rest, Acc, nodename(TargetName));
+process_args([Arg | Rest], Acc, Opts) ->
+    process_args(Rest, [Arg | Acc], Opts).
+
+
+start_epmd() ->
+    [] = os:cmd(epmd_path() ++ " -daemon"),
+    ok.
+
+epmd_path() ->
+    ErtsBinDir = filename:dirname(escript:script_name()),
+    Name = "epmd",
+    case os:find_executable(Name, ErtsBinDir) of
+        false ->
+            case os:find_executable(Name) of
+                false ->
+                    io:format("Could not find epmd.~n"),
+                    halt(1);
+                GlobalEpmd ->
+                    GlobalEpmd
+            end;
+        Epmd ->
+            Epmd
+    end.
+
+
+nodename(Name) ->
+    case string:tokens(Name, "@") of
+        [_Node, _Host] ->
+            list_to_atom(Name);
+        [Node] ->
+            [_, Host] = string:tokens(atom_to_list(node()), "@"),
+            list_to_atom(lists:concat([Node, "@", Host]))
+    end.
+
+append_node_suffix(Name, Suffix) ->
+    case string:tokens(Name, "@") of
+        [Node, Host] ->
+            list_to_atom(lists:concat([Node, Suffix, os:getpid(), "@", Host]));
+        [Node] ->
+            list_to_atom(lists:concat([Node, Suffix, os:getpid()]))
+    end.
+
+
+%%
+%% Given a string or binary, parse it into a list of terms, ala file:consult/0
+%%
+consult(Str) when is_list(Str) ->
+    consult([], Str, []);
+consult(Bin) when is_binary(Bin)->
+    consult([], binary_to_list(Bin), []).
+
+consult(Cont, Str, Acc) ->
+    case erl_scan:tokens(Cont, Str, 0) of
+        {done, Result, Remaining} ->
+            case Result of
+                {ok, Tokens, _} ->
+                    {ok, Term} = erl_parse:parse_term(Tokens),
+                    consult([], Remaining, [Term | Acc]);
+                {eof, _Other} ->
+                    lists:reverse(Acc);
+                {error, Info, _} ->
+                    {error, Info}
+            end;
+        {more, Cont1} ->
+            consult(Cont1, eof, Acc)
+    end.
+
+parse(Str) ->
+    {ok, Tokens, _} = erl_scan:string(Str),
+    {ok, Exprs} = erl_parse:parse_exprs(Tokens),
+    Exprs.

debian.tar.gz/rel/files/start_erl.cmd Added

@@ -0,0 +1,40 @@
+@setlocal
+
+@rem Parse arguments. erlsrv.exe prepends erl arguments prior to first ++.
+@rem Other args are position dependent.
+@set args="%*"
+@for /F "delims=++ tokens=1,2,3" %%I in (%args%) do @(
+    @set erl_args=%%I
+    @call :set_trim node_name %%J
+    @rem Trim spaces from the left of %%K (node_root), which may have spaces inside
+    @for /f "tokens=* delims= " %%a in ("%%K") do @set node_root=%%a
+)
+
+@set releases_dir=%node_root%\releases
+
+@rem parse ERTS version and release version from start_erl.dat
+@for /F "usebackq tokens=1,2" %%I in ("%releases_dir%\start_erl.data") do @(
+    @call :set_trim erts_version %%I
+    @call :set_trim release_version %%J
+)
+
+@set erl_exe="%node_root%\erts-%erts_version%\bin\erl.exe"
+@set boot_file="%releases_dir%\%release_version%\%node_name%"
+
+@if exist "%releases_dir%\%release_version%\sys.config" (
+    @set app_config="%releases_dir%\%release_version%\sys.config"
+) else (
+    @set app_config="%node_root%\etc\app.config"
+)
+
+@if exist "%releases_dir%\%release_version%\vm.args" (
+    @set vm_args="%releases_dir%\%release_version%\vm.args"
+) else (
+    @set vm_args="%node_root%\etc\vm.args"
+)
+
+@%erl_exe% %erl_args% -boot %boot_file% -config %app_config% -args_file %vm_args%
+
+:set_trim
+@set %1=%2
+@goto :EOF

debian.tar.gz/rel/files/sys.config Added

@@ -0,0 +1,85 @@
+%% Example configuration for Guam.
+[
+    {
+        kolab_guam, [
+            {
+                imap_servers, [
+                    {
+                        imap, [
+                            { host, "127.0.0.1" },
+                            { port, 143 },
+                            { tls, starttls }
+                        ]
+                    },
+                    {
+                        imaps, [
+                            { host, "127.0.0.1" },
+                            { port, 993 },
+                            { tls, true }
+                        ]
+                    }
+                ]
+            },
+            {
+                listeners, [
+                    {
+                        imap, [
+                            { port, 9143 },
+                            { imap_server, imap },
+                            {
+                                rules, [
+                                    { filter_groupware, [] }
+                                ]
+                            },
+                            {
+                                tls_config, [
+                                    { certfile, "/etc/pki/tls/private/localhost.pem" }
+                                ]
+                            }
+                        ]
+                    },
+                    {
+                        imaps, [
+                            { port, 9993 },
+                            { implicit_tls, true },
+                            { imap_server, imaps },
+                            {
+                                rules, [
+                                    { filter_groupware, [] }
+                                ]
+                            },
+                            {
+                                tls_config, [
+                                    { certfile, "/etc/pki/tls/private/localhost.pem" }
+                                ]
+                            }
+                        ]
+                    }
+                ]
+            }
+        ]
+    },
+
+    {
+        lager, [
+            {
+                handlers, [
+                    { lager_console_backend, debug },
+                    { lager_file_backend, [ { file, "log/error.log"}, { level, error } ] },
+                    { lager_file_backend, [ { file, "log/console.log"}, { level, info } ] }
+                ]
+            }
+        ]
+    },
+
+    %% SASL config
+    {
+        sasl, [
+            { sasl_error_logger, { file, "log/sasl-error.log" } },
+            { errlog_type, error },
+            { error_logger_mf_dir, "log/sasl" },      % Log directory
+            { error_logger_mf_maxbytes, 10485760 },   % 10 MB max file size
+            { error_logger_mf_maxfiles, 5 }           % 5 files max
+        ]
+    }
+].

debian.tar.gz/rel/files/vm.args Added

debian.tar.gz/rel/reltool.config Added

@@ -0,0 +1,51 @@
+%% -*- mode: erlang -*-
+%% ex: ft=erlang
+{sys, [
+       {lib_dirs, ["../deps"]},
+       {erts, [{mod_cond, derived}, {app_file, strip}]},
+       {app_file, strip},
+       {rel, "kolab_guam", "0.8.2",
+        [
+         kernel,
+         stdlib,
+         sasl,
+         compiler,
+         syntax_tools,
+         goldrush,
+         lager,
+         lager_syslog,
+         crypto,
+         kolab_guam
+        ]},
+       {rel, "start_clean", "",
+        [
+         kernel,
+         stdlib
+        ]},
+       {boot_rel, "kolab_guam"},
+       {profile, embedded},
+       {incl_cond, derived},
+       {excl_archive_filters, [".*"]}, %% Do not archive built libs
+       {excl_sys_filters, ["^bin/(?!start_clean.boot)",
+                           "^erts.*/bin/(dialyzer|typer)",
+                           "^erts.*/(doc|info|include|lib|man|src)"]},
+       {excl_app_filters, ["\.gitignore"]},
+       {app, kolab_guam, [{mod_cond, app}, {incl_cond, include}, {lib_dir, "../apps/kolab_guam"}]}
+      ]}.
+
+{target_dir, "kolab_guam"}.
+
+{overlay, [
+           {mkdir, "log/sasl"},
+           {copy, "files/erl", "\{\{erts_vsn\}\}/bin/erl"},
+           {copy, "files/nodetool", "releases/\{\{rel_vsn\}\}/nodetool"},
+           {copy, "kolab_guam/bin/start_clean.boot",
+                  "\{\{erts_vsn\}\}/bin/start_clean.boot"},
+           {copy, "files/kolab_guam", "bin/kolab_guam"},
+           {copy, "files/kolab_guam.cmd", "bin/kolab_guam.cmd"},
+           {copy, "files/start_erl.cmd", "bin/start_erl.cmd"},
+           %% Following line may be safely removed in new projects
+           {copy, "files/install_upgrade.escript", "bin/install_upgrade.escript"},
+           {copy, "files/sys.config", "releases/\{\{rel_vsn\}\}/sys.config"},
+           {copy, "files/vm.args", "releases/\{\{rel_vsn\}\}/vm.args"}
+          ]}.

debian.tar.gz/source Deleted

debian.tar.gz/source/format Deleted

debian.tar.gz/test.spec.in Added

guam-0.8.1.tar.gz/app.config -> guam-0.8.2.tar.gz/app.config Changed

guam-0.8.1.tar.gz/apps/kolab_guam/src/kolab_guam.app.src -> guam-0.8.2.tar.gz/apps/kolab_guam/src/kolab_guam.app.src Changed

guam-0.8.1.tar.gz/apps/kolab_guam/src/kolab_guam_listener.erl -> guam-0.8.2.tar.gz/apps/kolab_guam/src/kolab_guam_listener.erl Changed

@@ -19,9 +19,10 @@
 
 -behaviour(supervisor).
 -define(DEFAULT_IMAP_PORT, 143).
+-define(DEFAULT_LISTENER_POOL_SIZE, 10).
 
 %% API
--export([start_link/2, create_initial_listeners/1, cleanup/1]).
+-export([start_link/2, create_initial_listeners/2, cleanup/1]).
 
 %% gen_supervisor callbacks
 -export([init/1]).
@@ -45,7 +46,8 @@
     { ok, ListenSocket } = listen(ImplicitTLS, Port, Options),
     spawn_link(?MODULE, cleanup, [ListenSocket]),
     %% setting up the initial listeners must be done async to allow the init to be done and the supervisor to be setup
-    spawn_link(kolab_guam_listener, create_initial_listeners, [self()]),
+    ListenerPoolSize = proplists:get_value(listener_pool_size, Config, ?DEFAULT_LISTENER_POOL_SIZE),
+    spawn_link(kolab_guam_listener, create_initial_listeners, [ListenerPoolSize, self()]),
     ImapConfig = imap_config(proplists:get_value(imap_server, Config, none)),
     lager:debug("ImapConfig is ~p", [ImapConfig]),
     {ok, { { simple_one_for_one, 60, 3600 },
@@ -78,9 +80,9 @@
 default_listen_options(_ImplicitTLS, _Config) -> default_listen_options().
 default_listen_options() -> [ { reuseaddr, true }, {active, once }, inet6 ].
 
-create_initial_listeners(PID) when is_pid(PID) ->
-    lager:debug("Creating session pool for listener ~p", [PID]),
-    [ supervisor:start_child(PID, []) || _ <- lists:seq(1, 20) ].
+create_initial_listeners(ListenerPoolSize, PID) when is_pid(PID) ->
+    lager:debug("Creating session pool of size ~p for listener ~p", [ListenerPoolSize, PID]),
+    [ supervisor:start_child(PID, []) || _ <- lists:seq(1, ListenerPoolSize) ].
 
 cleanup(Socket) ->
     process_flag(trap_exit, true),

guam-0.8.1.tar.gz/apps/kolab_guam/src/kolab_guam_session.erl -> guam-0.8.2.tar.gz/apps/kolab_guam/src/kolab_guam_session.erl Changed

@@ -46,6 +46,8 @@
     { reply, ok, State }.
 
 handle_cast(accept, State = #state{ socket = ListenSocket, server_config = ServerConfig }) ->
+    %% try to rate limit our responses a bit here so that hammering the socket with connections is survivable
+    timer:sleep(3),
     { ok, AcceptSocket, TLSActive } = accept_client(ListenSocket, State),
     { ok, ImapSession } = eimap:start_link(ServerConfig),
     eimap:connect(ImapSession, self(), server_hello),
@@ -118,22 +120,31 @@
 
 %% private API
 accept_client(ListenSocket, #state{ client_implicit_tls = true, super_pid = SupervisorPID }) ->
-    { ok, AcceptSocket } = ssl:transport_accept(ListenSocket),
+    AcceptResult = ssl:transport_accept(ListenSocket),
+    AcceptSocket = post_accept_bookkeeping(implicit_tls, ListenSocket, SupervisorPID, AcceptResult),
+    %% prep for the next listen
     ok = ssl:ssl_accept(AcceptSocket),
     ok = ssl:setopts(AcceptSocket, [{ active, once }, { mode, binary }]),
-    %% start a new accepting process to replace this one, which is now i use
-    supervisor:start_child(SupervisorPID, []),
-    ok = ssl:setopts(ListenSocket, [{ active, once }, { mode, binary }]),
     % lager:info("~p All done!", [self()]),
     { ok, AcceptSocket, true };
 accept_client(ListenSocket, #state{ super_pid = SupervisorPID }) ->
-    { ok, AcceptSocket } = gen_tcp:accept(ListenSocket),
+    AcceptResult = gen_tcp:accept(ListenSocket),
+    AcceptSocket = post_accept_bookkeeping(no_implicit_tls, ListenSocket, SupervisorPID, AcceptResult),
     ok = inet:setopts(AcceptSocket, [{ active, once }, { mode, binary }]),
-    %% start a new accepting process to replace this one, which is now i use
-    supervisor:start_child(SupervisorPID, []),
-    ok = inet:setopts(ListenSocket, [{ active, once }]),
     { ok, AcceptSocket, false }.
 
+post_accept_bookkeeping(ImplicitTls, ListenSocket, SupervisorPID, AcceptResult) ->
+    %% start a new accepting process to replace this one, which is now in use
+    supervisor:start_child(SupervisorPID, []),
+    %% prep for the next listen
+    case ImplicitTls of
+        implicit_tls -> ok = ssl:setopts(ListenSocket, [{ active, once }, { mode, binary }]);
+        _ -> ok = inet:setopts(ListenSocket, [{ active, once }])
+    end,
+    %% assert that the accept worked
+    { ok, AcceptSocket } = AcceptResult,
+    AcceptSocket.
+
 close_zlib_handle(undefined) -> ok;
 close_zlib_handle(Z) -> zlib:close(Z).

guam-0.8.1.tar.gz/contrib/guam.sysvinit -> guam-0.8.2.tar.gz/contrib/guam.sysvinit Changed

guam-0.8.1.tar.gz/docs/deployment.md -> guam-0.8.2.tar.gz/docs/deployment.md Changed

guam-0.8.1.tar.gz/rel/reltool.config -> guam-0.8.2.tar.gz/rel/reltool.config Changed