Complete (but untested) socketmap implementation

.pylintrc

+[MASTER]
+
+# A comma-separated list of package or module names from where C extensions may
+# be loaded. Extensions are loading into the active Python interpreter and may
+# run arbitrary code.
+extension-pkg-whitelist=
+
+# Add files or directories to the blacklist. They should be base names, not
+# paths.
+ignore=
+
+# Add files or directories matching the regex patterns to the blacklist. The
+# regex matches against base names, not paths.
+ignore-patterns=
+
+# Python code to execute, usually for sys.path manipulation such as
+# pygtk.require().
+#init-hook=
+
+# Use multiple processes to speed up Pylint. Specifying 0 will auto-detect the
+# number of processors available to use.
+jobs=0
+
+# Control the amount of potential inferred values when inferring a single
+# object. This can help the performance when dealing with large functions or
+# complex, nested conditions.
+limit-inference-results=100
+
+# List of plugins (as comma separated values of python module names) to load,
+# usually to register additional checkers.
+load-plugins=
+
+# Pickle collected data for later comparisons.
+persistent=yes
+
+# Specify a configuration file.
+#rcfile=
+
+# When enabled, pylint would attempt to guess common misconfiguration and emit
+# user-friendly hints instead of false-positive error messages.
+suggestion-mode=yes
+
+# Allow loading of arbitrary C extensions. Extensions are imported into the
+# active Python interpreter and may run arbitrary code.
+unsafe-load-any-extension=no
+
+
+[MESSAGES CONTROL]
+
+# Only show warnings with the listed confidence levels. Leave empty to show
+# all. Valid levels: HIGH, INFERENCE, INFERENCE_FAILURE, UNDEFINED.
+confidence=
+
+# Disable the message, report, category or checker with the given id(s). You
+# can either give multiple identifiers separated by comma (,) or put this
+# option multiple times (only on the command line, not in the configuration
+# file where it should appear only once). You can also use "--disable=all" to
+# disable everything first and then reenable specific checks. For example, if
+# you want to run only the similarities checker, you can use "--disable=all
+# --enable=similarities". If you want to run only the classes checker, but have
+# no Warning level messages displayed, use "--disable=all --enable=classes
+# --disable=W".
+disable=missing-module-docstring,
+        missing-class-docstring,
+        missing-function-docstring,
+        too-few-public-methods
+
+# Enable the message, report, category or checker with the given id(s). You can
+# either give multiple identifier separated by comma (,) or put this option
+# multiple time (only on the command line, not in the configuration file where
+# it should appear only once). See also the "--disable" option for examples.
+enable=
+
+
+[REPORTS]
+
+# Python expression which should return a score less than or equal to 10. You
+# have access to the variables 'error', 'warning', 'refactor', and 'convention'
+# which contain the number of messages in each category, as well as 'statement'
+# which is the total number of statements analyzed. This score is used by the
+# global evaluation report (RP0004).
+evaluation=10.0 - ((float(5 * error + warning + refactor + convention) / statement) * 10)
+
+# Template used to display messages. This is a python new-style format string
+# used to format the message information. See doc for all details.
+#msg-template=
+
+# Set the output format. Available formats are text, parseable, colorized, json
+# and msvs (visual studio). You can also give a reporter class, e.g.
+# mypackage.mymodule.MyReporterClass.
+output-format=text
+
+# Tells whether to display a full report or only the messages.
+reports=no
+
+# Activate the evaluation score.
+score=yes
+
+
+[REFACTORING]
+
+# Maximum number of nested blocks for function / method body
+max-nested-blocks=5
+
+# Complete name of functions that never returns. When checking for
+# inconsistent-return-statements if a never returning function is called then
+# it will be considered as an explicit return statement and no message will be
+# printed.
+never-returning-functions=sys.exit
+
+
+[SIMILARITIES]
+
+# Ignore comments when computing similarities.
+ignore-comments=yes
+
+# Ignore docstrings when computing similarities.
+ignore-docstrings=yes
+
+# Ignore imports when computing similarities.
+ignore-imports=no
+
+# Minimum lines number of a similarity.
+min-similarity-lines=6
+
+
+[TYPECHECK]
+
+# List of decorators that produce context managers, such as
+# contextlib.contextmanager. Add to this list to register other decorators that
+# produce valid context managers.
+contextmanager-decorators=contextlib.contextmanager
+
+# List of members which are set dynamically and missed by pylint inference
+# system, and so shouldn't trigger E1101 when accessed. Python regular
+# expressions are accepted.
+generated-members=query,UniqueConstraint
+
+# Tells whether missing members accessed in mixin class should be ignored. A
+# mixin class is detected if its name ends with "mixin" (case insensitive).
+ignore-mixin-members=yes
+
+# Tells whether to warn about missing members when the owner of the attribute
+# is inferred to be None.
+ignore-none=yes
+
+# This flag controls whether pylint should warn about no-member and similar
+# checks whenever an opaque object is returned when inferring. The inference
+# can return multiple potential results while evaluating a Python object, but
+# some branches might not be evaluated, which results in partial inference. In
+# that case, it might be useful to still emit no-member and other checks for
+# the rest of the inferred objects.
+ignore-on-opaque-inference=yes
+
+# List of class names for which member attributes should not be checked (useful
+# for classes with dynamically set attributes). This supports the use of
+# qualified names.
+ignored-classes=optparse.Values,thread._local,_thread._local,SQLObject,Registrant,scoped_session
+
+# List of module names for which member attributes should not be checked
+# (useful for modules/projects where namespaces are manipulated during runtime
+# and thus existing member attributes cannot be deduced by static analysis). It
+# supports qualified module names, as well as Unix pattern matching.
+ignored-modules=
+
+# Show a hint with possible names when a member name was not found. The aspect
+# of finding the hint is based on edit distance.
+missing-member-hint=yes
+
+# The minimum edit distance a name should have in order to be considered a
+# similar match for a missing member name.
+missing-member-hint-distance=1
+
+# The total number of similar names that should be taken in consideration when
+# showing a hint for a missing member.
+missing-member-max-choices=1
+
+# List of decorators that change the signature of a decorated function.
+signature-mutators=
+
+
+[BASIC]
+
+# Naming style matching correct argument names.
+argument-naming-style=snake_case
+
+# Regular expression matching correct argument names. Overrides argument-
+# naming-style.
+#argument-rgx=
+
+# Naming style matching correct attribute names.
+attr-naming-style=snake_case
+
+# Regular expression matching correct attribute names. Overrides attr-naming-
+# style.
+#attr-rgx=
+
+# Bad variable names which should always be refused, separated by a comma.
+bad-names=foo,
+          bar,
+          baz,
+          toto,
+          tutu,
+          tata
+
+# Naming style matching correct class attribute names.
+class-attribute-naming-style=any
+
+# Regular expression matching correct class attribute names. Overrides class-
+# attribute-naming-style.
+#class-attribute-rgx=
+
+# Naming style matching correct class names.
+class-naming-style=PascalCase
+
+# Regular expression matching correct class names. Overrides class-naming-
+# style.
+#class-rgx=
+
+# Naming style matching correct constant names.
+const-naming-style=UPPER_CASE
+
+# Regular expression matching correct constant names. Overrides const-naming-
+# style.
+#const-rgx=
+
+# Minimum line length for functions/classes that require docstrings, shorter
+# ones are exempt.
+docstring-min-length=-1
+
+# Naming style matching correct function names.
+function-naming-style=snake_case
+
+# Regular expression matching correct function names. Overrides function-
+# naming-style.
+#function-rgx=
+
+# Good variable names which should always be accepted, separated by a comma.
+good-names=i,
+           j,
+           k,
+           a,
+           b,
+           e,
+           _,
+           dn,
+           op,
+
+# Include a hint for the correct naming format with invalid-name.
+include-naming-hint=no
+
+# Naming style matching correct inline iteration names.
+inlinevar-naming-style=any
+
+# Regular expression matching correct inline iteration names. Overrides
+# inlinevar-naming-style.
+#inlinevar-rgx=
+
+# Naming style matching correct method names.
+method-naming-style=snake_case
+
+# Regular expression matching correct method names. Overrides method-naming-
+# style.
+#method-rgx=
+
+# Naming style matching correct module names.
+module-naming-style=snake_case
+
+# Regular expression matching correct module names. Overrides module-naming-
+# style.
+#module-rgx=
+
+# Colon-delimited sets of names that determine each other's naming style when
+# the name regexes allow several styles.
+name-group=
+
+# Regular expression which should only match function or class names that do
+# not require a docstring.
+no-docstring-rgx=^_
+
+# List of decorators that produce properties, such as abc.abstractproperty. Add
+# to this list to register other decorators that produce valid properties.
+# These decorators are taken in consideration only for invalid-name.
+property-classes=abc.abstractproperty
+
+# Naming style matching correct variable names.
+variable-naming-style=snake_case
+
+# Regular expression matching correct variable names. Overrides variable-
+# naming-style.
+#variable-rgx=
+
+
+[MISCELLANEOUS]
+
+# List of note tags to take in consideration, separated by a comma.
+notes=FIXME,
+      XXX,
+      TODO
+
+
+[VARIABLES]
+
+# List of additional names supposed to be defined in builtins. Remember that
+# you should avoid defining new builtins when possible.
+additional-builtins=
+
+# Tells whether unused global variables should be treated as a violation.
+allow-global-unused-variables=yes
+
+# List of strings which can identify a callback function by name. A callback
+# name must start or end with one of those strings.
+callbacks=cb_,
+          _cb
+
+# A regular expression matching the name of dummy variables (i.e. expected to
+# not be used).
+dummy-variables-rgx=_+$|(_[a-zA-Z0-9_]*[a-zA-Z0-9]+?$)|dummy|^ignored_|^unused_
+
+# Argument names that match this expression will be ignored. Default to name
+# with leading underscore.
+ignored-argument-names=_.*|^ignored_|^unused_
+
+# Tells whether we should check for unused import in __init__ files.
+init-import=no
+
+# List of qualified module names which can have objects that can redefine
+# builtins.
+redefining-builtins-modules=six.moves,past.builtins,future.builtins,builtins,io
+
+
+[STRING]
+
+# This flag controls whether the implicit-str-concat-in-sequence should
+# generate a warning on implicit string concatenation in sequences defined over
+# several lines.
+check-str-concat-over-line-jumps=no
+
+
+[SPELLING]
+
+# Limits count of emitted suggestions for spelling mistakes.
+max-spelling-suggestions=4
+
+# Spelling dictionary name. Available dictionaries: none. To make it work,
+# install the python-enchant package.
+spelling-dict=
+
+# List of comma separated words that should not be checked.
+spelling-ignore-words=
+
+# A path to a file that contains the private dictionary; one word per line.
+spelling-private-dict-file=
+
+# Tells whether to store unknown words to the private dictionary (see the
+# --spelling-private-dict-file option) instead of raising a message.
+spelling-store-unknown-words=no
+
+
+[FORMAT]
+
+# Expected format of line ending, e.g. empty (any line ending), LF or CRLF.
+expected-line-ending-format=
+
+# Regexp for a line that is allowed to be longer than the limit.
+ignore-long-lines=^\s*(# )?<?https?://\S+>?$
+
+# Number of spaces of indent required inside a hanging or continued line.
+indent-after-paren=1
+
+# String used as indentation unit. This is usually "    " (4 spaces) or "\t" (1
+# tab).
+indent-string=\t
+
+# Maximum number of characters on a single line.
+max-line-length=160
+
+# Maximum number of lines in a module.
+max-module-lines=1000
+
+# List of optional constructs for which whitespace checking is disabled. `dict-
+# separator` is used to allow tabulation in dicts, etc.: {1  : 1,\n222: 2}.
+# `trailing-comma` allows a space between comma and closing bracket: (a, ).
+# `empty-line` allows space-only lines.
+no-space-check=trailing-comma,
+               dict-separator
+
+# Allow the body of a class to be on the same line as the declaration if body
+# contains single statement.
+single-line-class-stmt=no
+
+# Allow the body of an if to be on the same line as the test if there is no
+# else.
+single-line-if-stmt=no
+
+
+[LOGGING]
+
+# Format style used to check logging format string. `old` means using %
+# formatting, `new` is for `{}` formatting,and `fstr` is for f-strings.
+logging-format-style=old
+
+# Logging modules to check that the string format arguments are in logging
+# function parameter format.
+logging-modules=logging
+
+
+[IMPORTS]
+
+# List of modules that can be imported at any level, not just the top level
+# one.
+allow-any-import-level=
+
+# Allow wildcard imports from modules that define __all__.
+allow-wildcard-with-all=no
+
+# Analyse import fallback blocks. This can be used to support both Python 2 and
+# 3 compatible code, which means that the block might have code that exists
+# only in one or another interpreter, leading to false positives when analysed.
+analyse-fallback-blocks=no
+
+# Deprecated modules which should not be used, separated by a comma.
+deprecated-modules=optparse,tkinter.tix
+
+# Create a graph of external dependencies in the given file (report RP0402 must
+# not be disabled).
+ext-import-graph=
+
+# Create a graph of every (i.e. internal and external) dependencies in the
+# given file (report RP0402 must not be disabled).
+import-graph=
+
+# Create a graph of internal dependencies in the given file (report RP0402 must
+# not be disabled).
+int-import-graph=
+
+# Force import order to recognize a module as part of the standard
+# compatibility libraries.
+known-standard-library=
+
+# Force import order to recognize a module as part of a third party library.
+known-third-party=enchant
+
+# Couples of modules and preferred modules, separated by a comma.
+preferred-modules=
+
+
+[CLASSES]
+
+# List of method names used to declare (i.e. assign) instance attributes.
+defining-attr-methods=__init__,
+                      __new__,
+                      setUp,
+                      __post_init__
+
+# List of member names, which should be excluded from the protected access
+# warning.
+exclude-protected=_asdict,
+                  _fields,
+                  _replace,
+                  _source,
+                  _make
+
+# List of valid names for the first argument in a class method.
+valid-classmethod-first-arg=cls
+
+# List of valid names for the first argument in a metaclass class method.
+valid-metaclass-classmethod-first-arg=cls
+
+
+[DESIGN]
+
+# Maximum number of arguments for function / method.
+max-args=7
+
+# Maximum number of attributes for a class (see R0902).
+max-attributes=12
+
+# Maximum number of boolean expressions in an if statement (see R0916).
+max-bool-expr=5
+
+# Maximum number of branch for function / method body.
+max-branches=15
+
+# Maximum number of locals for function / method body.
+max-locals=15
+
+# Maximum number of parents for a class (see R0901).
+max-parents=7
+
+# Maximum number of public methods for a class (see R0904).
+max-public-methods=30
+
+# Maximum number of return / yield for function / method body.
+max-returns=12
+
+# Maximum number of statements in function / method body.
+max-statements=50
+
+# Minimum number of public methods for a class (see R0903).
+min-public-methods=2
+
+
+[EXCEPTIONS]
+
+# Exceptions that will emit a warning when being caught. Defaults to
+# "BaseException, Exception".
+overgeneral-exceptions=BaseException,
+                       Exception

README.md

+Socketmap proxy for uffd mail alias lookup
+==========================================
+
+Run it like this:
+```
+SERVER_API_KEY=my_secret_api_key server.py --socket-path /var/run/uffd-socketmap.sock --api-url=https://sso.example.com
+```
+
+Configure Postfix to use it by setting `virtual_alias_maps` in `/etc/postfix/main.cf` like this:
+```
+virtual_alias_maps = socketmap:unix:/var/run/uffd-socketmap.sock:virtual
+```

server.py

+import os
+import sys
+import logging
+import socket
+import socketserver
+
+import click
+import requests
+
+logger = logging.getLogger(__name__)
+
+class UffdAPI:
+	def __init__(self, baseurl, key):
+		self.baseurl = baseurl
+		self.key = key
+		self.session = requests.Session()
+		self.session.headers['Authorization'] = 'Bearer '+self.key
+
+	def get(self, endpoint, **kwargs):
+		resp = self.session.get(self.baseurl + endpoint, params=kwargs)
+		if not resp.ok:
+			raise requests.exceptions.RequestException(f'API responded with status {resp.status_code}')
+		return resp.json()
+
+	def get_aliases(self, mail_address):
+		'''Return list of alias addresses for a given mail address'''
+		results = self.get('/api/v1/getmails', receive_address=mail_address)
+		destinations = []
+		for result in results:
+			destinations += result['destination_addresses']
+		logger.debug('API getmails response for %s: %s', repr(mail_address), destinations)
+		return destinations
+
+# From https://cr.yp.to/proto/netstrings.txt
+#
+# Any string of 8-bit bytes may be encoded as [len]":"[string]",".
+# Here [string] is the string and [len] is a nonempty sequence of ASCII
+# digits giving the length of [string] in decimal. The ASCII digits are
+# <30> for 0, <31> for 1, and so on up through <39> for 9. Extra zeros
+# at the front of [len] are prohibited: [len] begins with <30> exactly
+# when [string] is empty.
+#
+# For example, the string "hello world!" is encoded as <31 32 3a 68
+# 65 6c 6c 6f 20 77 6f 72 6c 64 21 2c>, i.e., "12:hello world!,". The
+# empty string is encoded as "0:,".
+#
+# [len]":"[string]"," is called a netstring. [string] is called the
+# interpretation of the netstring.
+
+def encode_netstring(string):
+	'''Return netstring encoding of a Python str as bytes'''
+	string = string.encode('utf8')
+	return b'%d:%s,'%(len(string), string)
+
+def _parse_netstring_length(netstring):
+	if b':' not in netstring:
+		raise ValueError()
+	length, rest = netstring.split(b':', 1)
+	if not length.isdigit():
+		raise ValueError()
+	length = int(length)
+	return length, rest
+
+def is_netstring_complete(netstring):
+	'''Return whether the argument (bytes) is a complete netstring
+
+	Raises ValueError if the argument is invalid instead of only incomplete.'''
+	if b':' not in netstring:
+		return False
+	length, rest = _parse_netstring_length(netstring)
+	return len(rest) >= length + 1
+
+def decode_netstring(netstring):
+	'''Decode netstring at the beginning of argument
+
+	Returns (decoded_str, remaining_bytes). Raises ValueError if argument does
+	not start with a valid and complete netstring or the encoded string is not
+	valid UTF-8.'''
+	length, rest = _parse_netstring_length(netstring)
+	string, comma, rest = rest[:length], rest[length:length+1], rest[length+1:]
+	if len(string) != length or comma != b',':
+		raise ValueError()
+	# UnicodeDecodeError is a subclass of ValueError
+	return string.decode('utf8'), rest
+
+# From socketmap_table(5)
+#
+# PROTOCOL
+# Socketmaps use a simple protocol: the client sends one request, and the
+# server sends one reply. Each request and each reply are sent as one
+# netstring object.
+#
+# REQUEST FORMAT
+# The socketmap protocol supports only the lookup request. The request
+# has the following form:
+#
+# name <space> key
+#     Search the named socketmap for the specified key.
+#
+# [...]
+# REPLY FORMAT
+# The Postfix socketmap client requires that replies are not longer than
+# 100000 characters (not including the netstring encapsulation). Replies
+# must have the following form:
+#
+# OK <space> data
+#     The requested data was found.
+#
+# NOTFOUND <space>
+#     The requested data was not found.
+#
+# TEMP <space> reason
+#
+# TIMEOUT <space> reason
+#
+# PERM <space> reason
+#     The request failed. The reason, if non-empty, is descriptive
+#     text.
+
+class SocketmapsRequestHandler(socketserver.BaseRequestHandler):
+	api = None # Overwritten
+
+	def handle(self):
+		buf = b''
+		while not is_netstring_complete(buf):
+			chunk = self.request.recv(4096)
+			if not chunk:
+				return
+			buf += chunk
+		request, rest = decode_netstring(buf)
+		if rest:
+			return
+		try:
+			response = self.handle_request(request)
+		except: # pylint: disable=bare-except
+			logger.exception('Exception during request')
+			self.request.sendall(encode_netstring('TEMP Internal Error'))
+			return
+		loglevel = logging.INFO
+		if isinstance(response, tuple) and len(response) == 2:
+			response, loglevel = response
+		logger.log(loglevel, 'Request %s -> %s', repr(request), repr(response))
+		self.request.sendall(encode_netstring(response))
+
+	def handle_request(self, request):
+		if ' ' not in request:
+			return 'PERM Malformed request', logging.WARNING
+		name, key = request.split(' ', 1)
+		if name == 'virtual':
+			# With other lookup methods (like LDAP), virtual(5) attempts to lookup
+			# "user@domain" first, then "user", then "@domain", until it finds
+			# a match. With socketmap virtual(5) only attempts to lookup "user@domain".
+			# To be a drop-in replacement for LDAP, we have to emulate this behaviour.
+			if '@' not in key:
+				return 'PERM Key is not a mail address', logging.WARNING
+			user, domain = key.split('@', 1)
+			results = self.api.get_aliases(f'{user}@{domain}')
+			if not results:
+				results = self.api.get_aliases(f'{user}')
+			if not results:
+				results = self.api.get_aliases(f'@{domain}')
+			if not results:
+				return 'NOTFOUND '
+			# Values returned by UffdAPI.get_aliases() could theoretically contain
+			# commas (currently, we should sanitize this in uffd though). Since we
+			# use a comma as the value delimiter, we should escape commas in the
+			# values in some way. However, regardless of the lookup table used by
+			# Postfix, it internally processes multiple lookup results as a
+			# comma-separated list. So even with LDAP, which is able to respond with
+			# multiple values and allows safe transfer of values that contain commas,
+			# a value that contains one or more commas is processed as if it was
+			# multiple values.
+			# There is no way for escaping the separator here and it would not
+			# matter anyway.
+			return 'OK ' + ','.join(results)
+		return 'PERM Unknown request name', logging.WARNING
+
+def make_requesthandler(api):
+	class RequestHandler(SocketmapsRequestHandler):
+		pass
+	RequestHandler.api = api
+	return RequestHandler
+
+class FilenoUnixStreamServer(socketserver.UnixStreamServer):
+	def __init__(self, fd, RequestHandlerClass, bind_and_activate=True):
+		self.server_fd = fd
+		super().__init__(None, RequestHandlerClass, bind_and_activate=bind_and_activate)
+
+	def server_bind(self):
+		self.socket.close() # UnixStreamServer.__init__ creates an unbound socket
+		self.socket = socket.fromfd(self.server_fd, socket.AF_UNIX, socket.SOCK_STREAM)
+		self.server_address = self.socket.getsockname()
+
+class ThreadingFilenoUnixStreamServer(socketserver.ThreadingMixIn, FilenoUnixStreamServer):
+	pass
+
+def cleanup_unix_socket(path):
+	if not os.path.exists(path):
+		return
+	conn = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+	try:
+		conn.connect(path)
+	except ConnectionRefusedError:
+		os.remove(path)
+	conn.close()
+
+class StdoutFilter(logging.Filter):
+	def filter(self, record):
+		return record.levelno <= logging.INFO
+
+@click.command(help='Socketmap proxy for integrating Postfix and other compatible MTAs with uffd SSO. Supports virtual alias lookups (request name "virtual").')
+@click.option('--socket-path', type=click.Path(), help='Path for UNIX domain socket')
+@click.option('--socket-fd', type=int, help='Use fd number as server socket (alternative to --socket-path)')
+@click.option('--api-url', required=True, help='Uffd base URL without API prefix or trailing slash (e.g. https://example.com)')
+@click.option('--api-key', required=True, help='API secret, do not set this on the command-line, use environment variable SERVER_API_KEY instead')
+def main(socket_path, socket_fd, api_url, api_key):
+	if (socket_path is None and socket_fd is None) or \
+	   (socket_path is not None and socket_fd is not None):
+		raise click.ClickException('Either --socket-path or --socket-fd must be specified')
+
+	stdout_handler = logging.StreamHandler(sys.stdout)
+	stdout_handler.setLevel(logging.DEBUG)
+	stdout_handler.addFilter(StdoutFilter())
+	stderr_handler = logging.StreamHandler(sys.stderr)
+	stderr_handler.setLevel(logging.WARNING)
+	logger.setLevel(logging.INFO)
+	logger.addHandler(stdout_handler)
+	logger.addHandler(stderr_handler)
+
+	api = UffdAPI(api_url, api_key)
+	RequestHandler = make_requesthandler(api)
+	if socket_path is not None:
+		cleanup_unix_socket(socket_path)
+		socketserver.ThreadingUnixStreamServer(socket_path, RequestHandler).serve_forever()
+	else:
+		ThreadingFilenoUnixStreamServer(socket_fd, RequestHandler).serve_forever()
+
+if __name__ == '__main__':
+	# Pylint does not seem to understand the click's decorators
+	# pylint: disable=unexpected-keyword-arg,no-value-for-parameter
+	main(auto_envvar_prefix='SERVER')

test_server.py

+import unittest
+
+from server import *
+
+class TestNetstring(unittest.TestCase):
+	def test_encode_netstring(self):
+		self.assertEqual(encode_netstring('hello world!'), b'12:hello world!,')
+		self.assertEqual(encode_netstring(''), b'0:,')
+		self.assertEqual(encode_netstring('ä'), b'2:\xc3\xa4,')
+
+	def test_decode_netstring(self):
+		self.assertEqual(decode_netstring(b'12:hello world!,'), ('hello world!', b''))
+		self.assertEqual(decode_netstring(b'0:,'), ('', b''))
+		self.assertEqual(decode_netstring(b'2:\xc3\xa4,'), ('ä', b''))
+		self.assertEqual(decode_netstring(b'12:hello world!,REST:THAT,CONTAINS,A,COLON'), ('hello world!', b'REST:THAT,CONTAINS,A,COLON'))
+		with self.assertRaises(ValueError):
+			decode_netstring(b'')
+		with self.assertRaises(ValueError):
+			decode_netstring(b'12:')
+		with self.assertRaises(ValueError):
+			decode_netstring(b'hello world!,') # missing length and colon
+		with self.assertRaises(ValueError):
+			decode_netstring(b':hello world!,') # invalid length
+		with self.assertRaises(ValueError):
+			decode_netstring(b'12:hello ,') # str too short
+		with self.assertRaises(ValueError):
+			decode_netstring(b'12:hello world!') # final comma missing
+
+	def test_is_netstring_complete(self):
+		self.assertTrue(is_netstring_complete(b'12:hello world!,'))
+		self.assertTrue(is_netstring_complete(b'0:,'))
+		self.assertTrue(is_netstring_complete(b'2:\xc3\xa4,'))
+		self.assertTrue(is_netstring_complete(b'12:hello world!,REST:THAT,CONTAINS,A,COLON'))
+		self.assertFalse(is_netstring_complete(b''))
+		self.assertFalse(is_netstring_complete(b'12:'))
+		self.assertFalse(is_netstring_complete(b'12:hello '))
+		self.assertFalse(is_netstring_complete(b'12:hello ,'))
+		self.assertFalse(is_netstring_complete(b'12:hello world!'))
+		with self.assertRaises(ValueError):
+			decode_netstring(b'hello world!,') # missing length and colon
+		with self.assertRaises(ValueError):
+			decode_netstring(b':hello world!,') # invalid length
+
+class MockConnection:
+	def __init__(self, data, chunksize):
+		self.data = data
+		self.chunksize = chunksize
+		self.sent = b''
+
+	def recv(self, length):
+		length = min(length, self.chunksize)
+		chunk = self.data[:length]
+		self.data = self.data[length:]
+		return chunk
+		
+	def sendall(self, data):
+		self.sent += data
+
+	def close(self):
+		pass
+
+class UffdAPIMock:
+	def __init__(self, aliases=None):
+		self.aliases = aliases or {}
+
+	def get_aliases(self, mail_address):
+		return self.aliases.get(mail_address, [])
+
+class TestSocketmapsRequestHandler(unittest.TestCase):
+	def test_handle(self):
+		api = UffdAPIMock(aliases={
+			'test@example.com': ['test-dest@example.com'],
+			'space test@example.com': ['space test dest@example.com'],
+			'multitest@example.com': ['test1@example.com', 'test2@example.com'],
+			'@example.com': ['catchall@example.com'],
+			'user-only': ['user-only@example.com'],
+		})
+		RequestHandler = make_requesthandler(api)
+		request = b'24:virtual test@example.com,'
+		response = b'24:OK test-dest@example.com,'
+		conn = MockConnection(request, 4096)
+		RequestHandler(conn, '', None).handle()
+		self.assertEqual(conn.sent, response)
+		conn = MockConnection(request, 1)
+		RequestHandler(conn, '', None).handle()
+		self.assertEqual(conn.sent, response)
+		conn = MockConnection(request, 15)
+		RequestHandler(conn, '', None).handle()
+		self.assertEqual(conn.sent, response)
+
+		request = b'30:virtual space test@example.com,'
+		response = b'30:OK space test dest@example.com,'
+		conn = MockConnection(request, 4096)
+		RequestHandler(conn, '', None).handle()
+		self.assertEqual(conn.sent, response)
+
+		request = b'29:virtual multitest@example.com,'
+		response = b'38:OK test1@example.com,test2@example.com,'
+		conn = MockConnection(request, 4096)
+		RequestHandler(conn, '', None).handle()
+		self.assertEqual(conn.sent, response)
+
+		request = b'32:virtual doesnotexist@example.com,'
+		response = b'23:OK catchall@example.com,'
+		conn = MockConnection(request, 4096)
+		RequestHandler(conn, '', None).handle()
+		self.assertEqual(conn.sent, response)
+
+		request = b'29:virtual user-only@example.com,'
+		response = b'24:OK user-only@example.com,'
+		conn = MockConnection(request, 4096)
+		RequestHandler(conn, '', None).handle()
+		self.assertEqual(conn.sent, response)
+
+		request = b'27:virtual foo@bar.example.com,'
+		response = b'9:NOTFOUND ,'
+		conn = MockConnection(request, 4096)
+		RequestHandler(conn, '', None).handle()
+		self.assertEqual(conn.sent, response)
+
+		request = b'0:,'
+		conn = MockConnection(request, 4096)
+		RequestHandler(conn, '', None).handle()
+		self.assertIn(b'PERM ', conn.sent)