feat: support s/mime encryption

app/dashboard/views/mailbox_detail.py

@@ -179,12 +179,53 @@ def mailbox_detail_route(mailbox_id):
 
         elif request.form.get("form-name") == "toggle-pgp":
             if request.form.get("pgp-enabled") == "on":
+                if not mailbox.disable_smime:
+                    mailbox.disable_smime = True
+                    flash(f"S/MIME is disabled on {mailbox.email}", "warning")
                 mailbox.disable_pgp = False
                 flash(f"PGP is enabled on {mailbox.email}", "success")
             else:
                 mailbox.disable_pgp = True
                 flash(f"PGP is disabled on {mailbox.email}", "info")
 
+            Session.commit()
+            return redirect(
+                url_for("dashboard.mailbox_detail_route", mailbox_id=mailbox_id)
+            )
+        elif request.form.get("form-name") == "smime":
+            if request.form.get("action") == "save":
+                if not current_user.is_premium():
+                    flash("Only premium plan can add S/MIME Key", "warning")
+                    return redirect(
+                        url_for("dashboard.mailbox_detail_route", mailbox_id=mailbox_id)
+                    )
+
+                mailbox.smime_public_key = request.form.get("smime")
+                Session.commit()
+                flash("Your S/MIME public key is saved successfully", "success")
+                return redirect(
+                    url_for("dashboard.mailbox_detail_route", mailbox_id=mailbox_id)
+                )
+            elif request.form.get("action") == "remove":
+                # Free user can decide to remove their added S/MIME key
+                mailbox.smime_public_key = None
+                mailbox.disable_smime = False
+                Session.commit()
+                flash("Your S/MIME public key is removed successfully", "success")
+                return redirect(
+                    url_for("dashboard.mailbox_detail_route", mailbox_id=mailbox_id)
+                )
+        elif request.form.get("form-name") == "toggle-smime":
+            if request.form.get("smime-enabled") == "on":
+                if not mailbox.disable_pgp:
+                    mailbox.disable_pgp = True
+                    flash(f"PGP is disabled on {mailbox.email}", "warning")
+                mailbox.disable_smime = False
+                flash(f"S/MIME is enabled on {mailbox.email}", "success")
+            else:
+                mailbox.disable_smime = True
+                flash(f"S/MIME is disabled on {mailbox.email}", "info")
+
             Session.commit()
             return redirect(
                 url_for("dashboard.mailbox_detail_route", mailbox_id=mailbox_id)

app/models.py

@@ -2566,6 +2566,12 @@ class Mailbox(Base, ModelMixin):
         sa.Boolean, default=False, nullable=False, server_default="0"
     )
 
+    # smime
+    smime_public_key = sa.Column(sa.Text, nullable=True)
+    disable_smime = sa.Column(
+        sa.Boolean, default=True, nullable=False, server_default="0"
+    )
+
     # incremented when a check is failed on the mailbox
     # alert when the number exceeds a threshold
     # used in sanity_check()
@@ -2588,6 +2594,12 @@ def pgp_enabled(self) -> bool:
 
         return False
 
+    def smime_enabled(self) -> bool:
+        if self.smime_public_key and not self.disable_smime:
+            return True
+
+        return False
+
     def nb_alias(self):
         return (
             AliasMailbox.filter_by(mailbox_id=self.id).count()

email_handler.py

@@ -32,8 +32,10 @@
 """
 import argparse
 import email
+import smail
 import time
 import uuid
+from asn1crypto import pem, x509
 from email import encoders
 from email.encoders import encode_noop
 from email.message import Message
@@ -535,6 +537,21 @@ def prepare_pgp_message(
     return msg
 
 
+def prepare_smime_message(orig_msg: Message, public_key: str) -> Message:
+    # clone orig message to avoid modifying it
+    clone_msg = copy(orig_msg)
+
+    # create certificate object using public key
+    _, _, der_bytes = pem.unarmor(public_key.encode())
+    cert = x509.Certificate.load(der_bytes)
+
+    # encrypt the message
+    clone_msg = smail.encrypt_message(clone_msg, [cert])
+
+    # return the message
+    return clone_msg
+
+
 def sign_msg(msg: Message) -> Message:
     container = MIMEMultipart(
         "signed", protocol="application/pgp-signature", micalg="pgp-sha256"
@@ -908,6 +925,26 @@ def forward_email_to_mailbox(
                 f"""PGP encryption fails with {mailbox.email}'s PGP key""",
             )
 
+    # create SMIME email if needed
+    if mailbox.smime_enabled() and user.is_premium():
+        LOG.d("Encrypt message using S/MIME for mailbox %s", mailbox)
+
+        try:
+            msg = prepare_smime_message(msg, mailbox.smime_public_key)
+        except Exception as exceptasdf:
+            LOG.w(
+                "Cannot S/MIME encrypt message %s -> %s. %s %s",
+                contact,
+                alias,
+                mailbox,
+                user,
+            )
+            LOG.w(exceptasdf)
+            msg = add_header(
+                msg,
+                f"""S/MIME encryption fails with {mailbox.email}'s S/MIME key""",
+            )
+
     # add custom header
     add_or_replace_header(msg, headers.SL_DIRECTION, "Forward")
 

migrations/versions/2023_111521_fb0ab73c1825_.py

@@ -0,0 +1,31 @@
+"""empty message
+
+Revision ID: fb0ab73c1825
+Revises: 4bc54632d9aa
+Create Date: 2023-11-15 21:50:40.424160
+
+"""
+import sqlalchemy_utils
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision = 'fb0ab73c1825'
+down_revision = '4bc54632d9aa'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.add_column('mailbox', sa.Column('disable_smime', sa.Boolean(), server_default='0', nullable=False))
+    op.add_column('mailbox', sa.Column('smime_public_key', sa.Text(), nullable=True))
+    # ### end Alembic commands ###
+
+
+def downgrade():
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.drop_column('mailbox', 'smime_public_key')
+    op.drop_column('mailbox', 'disable_smime')
+    # ### end Alembic commands ###

pyproject.toml

@@ -112,6 +112,7 @@ SQLAlchemy = "1.3.24"
 redis = "^4.5.3"
 newrelic-telemetry-sdk = "^0.5.0"
 aiospamc = "0.10"
+python-smail = "^0.9.0"
 
 [tool.poetry.dev-dependencies]
 pytest = "^7.0.0"