FROM ubuntu:18.04

RUN sed -i "s/archive.ubuntu.com/mirrors.ustc.edu.cn/g" /etc/apt/sources.list
RUN sed -i "s/security.ubuntu.com/mirrors.ustc.edu.cn/g" /etc/apt/sources.list
RUN apt update

RUN mkdir /root/exim4

COPY *.deb /root/exim4/
COPY *.ddeb /root/exim4/

RUN dpkg -i /root/exim4/*.deb || apt --fix-broken install -y
RUN dpkg -i /root/exim4/*.deb && dpkg -i /root/exim4/*.ddeb

RUN sed -i "s/127.0.0.1 ; ::1/0.0.0.0/g" /etc/exim4/update-exim4.conf.conf
RUN sed -i "1i\MAIN_TLS_ENABLE = yes" /etc/exim4/exim4.conf.template
COPY exim.crt /etc/exim4/exim.crt
COPY exim.key /etc/exim4/exim.key
COPY exim_start /exim_start
RUN update-exim4.conf && chmod +x /exim_start

CMD ["/exim_start"]

#!/bin/sh -e

if [ -n "$EX4DEBUG" ]; then
  echo "now debugging $0 $@"
  set -x
fi

DIR=/etc/exim4
CERT=$DIR/exim.crt
KEY=$DIR/exim.key

# This exim binary was built with GnuTLS which does not support dhparams
# from a file. See /usr/share/doc/exim4-base/README.Debian.gz
#DH=$DIR/exim.dhparam

if ! which openssl > /dev/null ;then
    echo "$0: openssl is not installed, exiting" 1>&2
    exit 1
fi

# valid for three years
DAYS=1095

if [ "$1" != "--force" ] && [ -f $CERT ] && [ -f $KEY ]; then
  echo "[*] $CERT and $KEY exists!"
  echo "    Use \"$0 --force\" to force generation!"
  exit 0
fi

if [ "$1" = "--force" ]; then
  shift
fi     

#SSLEAY=/tmp/exim.ssleay.$$.cnf
SSLEAY="$(tempfile -m600 -pexi)"

cat > $SSLEAY <<EOM
RANDFILE = $HOME/.rnd
[ req ]
default_bits = 1024
default_keyfile = exim.key
distinguished_name = req_distinguished_name
[ req_distinguished_name ]
countryName = Country Code (2 letters)
countryName_default = US
countryName_min = 2
countryName_max = 2
stateOrProvinceName = State or Province Name (full name)
localityName = Locality Name (eg, city)
organizationName = Organization Name (eg, company; recommended)
organizationName_max = 64
organizationalUnitName = Organizational Unit Name (eg, section)
organizationalUnitName_max = 64
commonName = Server name (eg. ssl.domain.tld; required!!!)
commonName_max = 64
emailAddress = Email Address
emailAddress_max = 40
EOM

echo "[*] Creating a self signed SSL certificate for Exim!"
echo "    This may be sufficient to establish encrypted connections but for"
echo "    secure identification you need to buy a real certificate!"
echo "    "
echo "    Please enter the hostname of your MTA at the Common Name (CN) prompt!"
echo "    "

openssl req -config $SSLEAY -x509 -newkey rsa:1024 -keyout $KEY -out $CERT -days $DAYS -nodes
#see README.Debian.gz*# openssl dhparam -check -text -5 512 -out $DH
rm -f $SSLEAY

chown root:Debian-exim $KEY $CERT $DH
chmod 640 $KEY $CERT $DH

echo "[*] Done generating self signed certificates for exim!"
echo "    Refer to the documentation and example configuration files"
echo "    over at /usr/share/doc/exim4-base/ for an idea on how to enable TLS"
echo "    support in your mail transfer agent."

#!/bin/bash

/etc/init.d/exim4 start
/bin/bash

#!/bin/bash
wget https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/exim4/4.90.1-1ubuntu1.5/exim4_4.90.1.orig.tar.xz
wget https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/exim4/4.90.1-1ubuntu1.5/exim4_4.90.1-1ubuntu1.5.debian.tar.xz
wget https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/exim4/4.90.1-1ubuntu1.5/exim4_4.90.1-1ubuntu1.5.dsc
dpkg-source --no-check -x exim4_4.90.1-1ubuntu1.5.dsc

# /etc/apt/source.list 里面记得加上deb-src
apt-get build-dep exim4
apt-get install --no-install-recommends devscripts 

cd exim4-4.90.1
perl -i -pe 's/^\s*#\s*OPENSSL\s*:=\s*1/OPENSSL:=1/' debian/rules
dch -l +openssl 'rebuild with openssl'
debian/rules binary

int
tls_write(BOOL is_server, const uschar *buff, size_t len, BOOL more)
{
int outbytes, error, left;
SSL *ssl = is_server ? server_ssl : client_ssl;
static gstring * corked = NULL;

DEBUG(D_tls) debug_printf("%s(%p, %lu%s)\n", __FUNCTION__,
  buff, (unsigned long)len, more ? ", more" : "");

/* Lacking a CORK or MSG_MORE facility (such as GnuTLS has) we copy data when
"more" is notified.  This hack is only ok if small amounts are involved AND only
one stream does it, in one context (i.e. no store reset).  Currently it is used
for the responses to the received SMTP MAIL , RCPT, DATA sequence, only. */

if (is_server && (more || corked))
  {
  corked = string_catn(corked, buff, len);
  if (more)
    return len;
  buff = CUS corked->s;
  len = corked->ptr;
  corked = NULL;
  }
...
}

int
smtp_setup_msg(void)
{
......
# MAIL FROM
    if (rc == OK || rc == DISCARD)
      {
      BOOL more = pipeline_response();

      if (!user_msg)
        smtp_printf("%s%s%s", more, US"250 OK",
                  #ifndef DISABLE_PRDR
                    prdr_requested ? US", PRDR Requested" : US"",
                      #else
                    US"",
                  #endif
                    US"\r\n");
      else
        {
      #ifndef DISABLE_PRDR
        if (prdr_requested)
           user_msg = string_sprintf("%s%s", user_msg, US", PRDR Requested");
      #endif
        smtp_user_msg(US"250", user_msg);
        }
......
# RCPT TO
    if (rc == OK)
      {
      BOOL more = pipeline_response();

      if (user_msg)
        smtp_user_msg(US"250", user_msg);
      else
        smtp_printf("250 Accepted\r\n", more);
      receive_add_recipient(recipient, -1);
......

#define STRING_SPRINTF_BUFFER_SIZE (8192 * 4)

# exim 4.90
uschar *
string_sprintf(const char *format, ...)
{
va_list ap;
uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
va_start(ap, format);
if (!string_vformat(buffer, sizeof(buffer), format, ap))
  log_write(0, LOG_MAIN|LOG_PANIC_DIE,
    "string_sprintf expansion was longer than " SIZE_T_FMT
    "; format string was (%s)\nexpansion started '%.32s'",
    sizeof(buffer), format, buffer);
va_end(ap);
return string_copy(buffer);
}

uschar *
string_copy(const uschar *s)
{
int len = Ustrlen(s) + 1;
uschar *ss = store_get(len);
memcpy(ss, s, len);
return ss;
}

# exim 4.92

uschar *
string_sprintf(const char *format, ...)
{
#ifdef COMPILE_UTILITY
uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
gstring g = { .size = STRING_SPRINTF_BUFFER_SIZE, .ptr = 0, .s = buffer };
gstring * gp = &g;
#else
gstring * gp = string_get(STRING_SPRINTF_BUFFER_SIZE);
#endif
gstring * gp2;
va_list ap;

va_start(ap, format);
gp2 = string_vformat(gp, FALSE, format, ap);
gp->s[gp->ptr] = '\0';
va_end(ap);

if (!gp2)
  log_write(0, LOG_MAIN|LOG_PANIC_DIE,
    "string_sprintf expansion was longer than %d; format string was (%s)\n"
    "expansion started '%.32s'",
    gp->size, format, gp->s);

#ifdef COMPILE_UTILITY
return string_copy(gp->s);
#else
gstring_reset_unused(gp);
return gp->s;
#endif
}

def _verify(self):
        result = {}
        self.normalize_url()
        # To establish socket
        socket.setdefaulttimeout(5)
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.connect((self.ip, self.port))
        # To establish ssl
        context = ssl._create_unverified_context()
        # check server
        header = sock.recv(1024)
        while True:
            if b"ESMTP Exim 4.9" not in header:
                break
            sock.send(b"EHLO hh\r\n")
            data = sock.recv(1024)
            if b"250-STARTTLS\r\n" not in data or b"250-PIPELINING" not in data:
                break
            sock.send(b"STARTTLS\r\n")
            data = sock.recv(1024)
            if b"220 TLS go ahead" not in data:
                break
            tls_s = context.wrap_socket(sock, server_hostname=self.ip)
            # TLS mode
            tls_s.send(b"EHLO hh\r\n")
            data = tls_s.recv(1024)
            if b"HELP\r\n" not in data:
                break
            tls_s.send(b"MAIL FROM: <>\r\n")
            data = tls_s.recv(1024)
            if b"OK\r\n" not in data:
                break
            rcpt_data1 = b"RCPT TO: <postmaster>\r\n"
            for i in range(6):
                rcpt_data1 += b"RCPT TO: <postmaster>\r\n"
            rcpt_data1 += b"NO"
            tls_s.send(rcpt_data1)
            socket.setdefaulttimeout(1)
            try:
                tls_s.unwrap()
            except socket.timeout:
                pass
            socket.setdefaulttimeout(5)
            tls_s._sslobj = None
            # plaintext mode
            sock = tls_s
            sock.send(b"OP\r\n")
            data = sock.recv(1024)
            if b"OK\r\n" not in data:
                break
            sock.send(b"EHLO hh\r\n")
            data = sock.recv(1024)
            if b"HELP\r\n" not in data:
                break
            sock.send(b"STARTTLS\r\n")
            data = sock.recv(1024)
            if b"220 TLS go ahead" not in data:
                break
            tls_s = context.wrap_socket(sock, server_hostname=self.ip)
            # TLS mode
            tls_s.send(b"NOOP\r\n")
            # fd.interactive()
            data = tls_s.recv(1024)
            if b"250 Accepted" in data:
                result["VerifyInfo"] = {}
                result['VerifyInfo']["Target"] = self.ip
                result['VerifyInfo']["Port"] = self.port
                result['VerifyInfo']["INFO"] = header
            break
        return self.parse_output(result)

from cryptography.hazmat.bindings.openssl.binding import Binding
binding = Binding()
lib = binding.lib
_FFI = binding.ffi
no_zero_allocator = _FFI.new_allocator(should_clear_after_alloc=True)

lib.SSL_library_init()
lib.OpenSSL_add_all_algorithms()
lib.SSL_load_error_strings()
method = lib.TLSv1_2_client_method()
ctx = lib.SSL_CTX_new(method)
tls_s = lib.SSL_new(ctx)
lib.SSL_set_fd(tls_s, sock.fileno())
lib.SSL_set_connect_state(tls_s)
ret = lib.SSL_do_handshake(tls_s)
# pause()
if ret:
    ret = lib.SSL_write(tls_s, b"HELP\r\n", 6)
    if ret >= 0:
        buf = no_zero_allocator("char []", 0x1000)
        ret = lib.SSL_read(tls_s, buf, 0x1000)
        data = _FFI.buffer(buf, ret)
        print(data[:])
lib.SSL_shutdown(tls_s)