[svn:qpsmtpd] r645 - in branches/0.3x: . config.sample lib/Qpsmtpd

Author: jpeacock
Date: Thu Jun 22 07:48:48 2006
New Revision: 645

Added:
   branches/0.3x/config.sample/tls_before_auth
Modified:
   branches/0.3x/Changes
   branches/0.3x/README
   branches/0.3x/lib/Qpsmtpd/SMTP.pm

Log:
Two patches from Robin Johnson:
Add SSL encryption method to FROM: header line.
Add new tls_before_auth configuration to hide AUTH until TLS is established.

Modified: branches/0.3x/Changes
==============================================================================
--- branches/0.3x/Changes	(original)
+++ branches/0.3x/Changes	Thu Jun 22 07:48:48 2006
@@ -1,5 +1,9 @@
 0.33
 
+  Add SSL encryption method to header to mirror other qmail/SSL patches.
+  Add tls_before_auth to suppress AUTH unless TLS has already been 
+  established (Robin Johnson).
+
   Fix "help" command when there's no "smtpgreeting" configured (the default)
   (Thanks to Thomas Ogrisegg)
 

Modified: branches/0.3x/README
==============================================================================
--- branches/0.3x/README	(original)
+++ branches/0.3x/README	Thu Jun 22 07:48:48 2006
@@ -176,6 +176,11 @@
 will default to use $ENV{HOME}/tmp/. This directory should be set with
 a mode of 700 and owned by the smtpd user.
 
+=item tls_before_auth
+
+If this file contains anything except a 0 on the first noncomment line, then 
+AUTH will not be offered unless TLS/SSL are in place, either with STARTTLS, 
+or SMTP-SSL on port 465.
 
 =item everything (?) that qmail-smtpd supports. 
 

Added: branches/0.3x/config.sample/tls_before_auth
==============================================================================
--- (empty file)
+++ branches/0.3x/config.sample/tls_before_auth	Thu Jun 22 07:48:48 2006
@@ -0,0 +1,2 @@
+# change the next line to 0 if you want to offer AUTH without TLS
+1

Modified: branches/0.3x/lib/Qpsmtpd/SMTP.pm
==============================================================================
--- branches/0.3x/lib/Qpsmtpd/SMTP.pm	(original)
+++ branches/0.3x/lib/Qpsmtpd/SMTP.pm	Thu Jun 22 07:48:48 2006
@@ -219,7 +219,9 @@
         }
     }
 
-    if ( %auth_mechanisms ) {
+    # Check if we should only offer AUTH after TLS is completed
+    my $tls_before_auth = ($self->config('tls_before_auth') ? ($self->config('tls_before_auth'))[0] && $self->transaction->notes('tls_enabled') : 0); 
+    if ( %auth_mechanisms && !$tls_before_auth) {
         push @capabilities, 'AUTH '.join(" ",keys(%auth_mechanisms));    
         $self->{_commands}->{'auth'} = "";
     }
@@ -248,6 +250,9 @@
         and $self->{_auth} == OK );
     return $self->respond( 503, "AUTH not defined for HELO" )
       if ( $self->connection->hello eq "helo" );
+    return $self->respond( 503, "SSL/TLS required before AUTH" )
+      if ( ($self->config('tls_before_auth'))[0] 
+      	and $self->transaction->notes('tls_enabled') );
 
     return $self->{_auth} = Qpsmtpd::Auth::SASL( $self, $arg, @stuff );
 }
@@ -584,13 +589,15 @@
   $self->transaction->header($header);
 
   my $smtp = $self->connection->hello eq "ehlo" ? "ESMTP" : "SMTP";
+  my $sslheader = (defined $self->connection->notes('tls_enabled') and $self->connection->notes('tls_enabled')) ? 
+    "(".$self->connection->notes('tls_socket')->get_cipher()." encrypted) " : "";
   my $authheader = (defined $self->{_auth} and $self->{_auth} == OK) ?
     "(smtp-auth username $self->{_auth_user}, mechanism $self->{_auth_mechanism})\n" : "";
 
   $header->add("Received", "from ".$self->connection->remote_info
                ." (HELO ".$self->connection->hello_host . ") (".$self->connection->remote_ip
                . ")\n  $authheader  by ".$self->config('me')." (qpsmtpd/".$self->version
-               .") with $smtp; ". (strftime('%a, %d %b %Y %H:%M:%S %z', localtime)),
+               .") with $sslheader$smtp; ". (strftime('%a, %d %b %Y %H:%M:%S %z', localtime)),
                0);
 
   # if we get here without seeing a terminator, the connection is