add faq for smtp smuggling, fix bug around handling "\nX\n" for any X, reject bare carriage returns and possibly smtp-smuggling attempts

mox was already strict in its "\r\n.\r\n" handling for end-of-message in an
smtp transaction.

due to a mostly unrelated bug, sequences of "\nX\n", including "\n.\n" were
rejected with a "local processing error".

the sequence "\r\n.\n" dropped the dot, not necessarily a big problem, this is
unlikely to happen in a legimate transaction and the behaviour not
unreasonable.

we take this opportunity to reject all bare \r.  we detect all slightly
incorrect combinations of "\r\n.\r\n" with an error mentioning smtp smuggling,
in part to appease the tools checking for it.

smtp errors are 500 "bad syntax", and mention smtp smuggling.

smtp/data.go

@@ -7,16 +7,19 @@ import (
 	"io"
 )
 
+var ErrCRLF = errors.New("invalid bare carriage return or newline")
+
 var errMissingCRLF = errors.New("missing crlf at end of message")
 
 // DataWrite reads data (a mail message) from r, and writes it to smtp
 // connection w with dot stuffing, as required by the SMTP data command.
+//
+// Messages with bare carriage returns or bare newlines result in an error.
 func DataWrite(w io.Writer, r io.Reader) error {
 	// ../rfc/5321:2003
 
 	var prevlast, last byte = '\r', '\n' // Start on a new line, so we insert a dot if the first byte is a dot.
 	// todo: at least for smtp submission we should probably set a max line length, eg 1000 octects including crlf. ../rfc/5321:3512
-	// todo: at least for smtp submission or a pedantic mode, we should refuse messages with bare \r or bare \n.
 	buf := make([]byte, 8*1024)
 	for {
 		nr, err := r.Read(buf)
@@ -32,13 +35,25 @@ func DataWrite(w io.Writer, r io.Reader) error {
 				}
 				// Look for the next newline, or end of buffer.
 				n := 0
+				firstcr := -1
 				for n < len(p) {
 					c := p[n]
-					n++
 					if c == '\n' {
+						if firstcr < 0 {
+							// Bare newline.
+							return ErrCRLF
+						} else if firstcr != n-1 {
+							// Bare carriage return.
+							return ErrCRLF
+						}
+						n++
 						break
+					} else if c == '\r' && firstcr < 0 {
+						firstcr = n
 					}
+					n++
 				}
+
 				if _, err := w.Write(p[:n]); err != nil {
 					return err
 				}
@@ -70,12 +85,20 @@ var dotcrlf = []byte(".\r\n")
 
 // DataReader is an io.Reader that reads data from an SMTP DATA command, doing dot
 // unstuffing and returning io.EOF when a bare dot is received. Use NewDataReader.
+//
+// Bare carriage returns, and the sequences "[^\r]\n." and "\n.\n" result in an
+// error.
 type DataReader struct {
 	// ../rfc/5321:2003
 	r           *bufio.Reader
 	plast, last byte
 	buf         []byte // From previous read.
 	err         error  // Read error, for after r.buf is exhausted.
+
+	// When we see invalid combinations of CR and LF, we keep reading, and report an
+	// error at the final "\r\n.\r\n". We cannot just stop reading and return an error,
+	// the SMTP protocol would become out of sync.
+	badcrlf bool
 }
 
 // NewDataReader returns an initialized DataReader.
@@ -108,16 +131,36 @@ func (r *DataReader) Read(p []byte) (int, error) {
 			}
 		}
 		if len(r.buf) > 0 {
-			// We require crlf. A bare LF is not a line ending. ../rfc/5321:2032
-			// todo: we could return an error for a bare \n.
+			// Reject bare \r.
+			for i, c := range r.buf {
+				if c == '\r' && (i == len(r.buf) || r.buf[i+1] != '\n') {
+					r.badcrlf = true
+				}
+			}
+
+			// We require crlf. A bare LF is not a line ending for the end of the SMTP
+			// transaction. ../rfc/5321:2032
+			// Bare newlines are accepted as message data, unless around a bare dot. The SMTP
+			// server adds missing carriage returns. We don't reject bare newlines outright,
+			// real-world messages like that occur.
 			if r.plast == '\r' && r.last == '\n' {
 				if bytes.Equal(r.buf, dotcrlf) {
 					r.buf = nil
 					r.err = io.EOF
+					if r.badcrlf {
+						r.err = ErrCRLF
+					}
 					break
 				} else if r.buf[0] == '.' {
+					// Reject "\r\n.\n".
+					if len(r.buf) >= 2 && r.buf[1] == '\n' {
+						r.badcrlf = true
+					}
 					r.buf = r.buf[1:]
 				}
+			} else if r.last == '\n' && (bytes.HasPrefix(r.buf, []byte(".\n")) || bytes.HasPrefix(r.buf, []byte(".\r\n"))) {
+				// Reject "[^\r]\n.\n" and "[^\r]\n.\r\n"
+				r.badcrlf = true
 			}
 			n := len(r.buf)
 			if n > len(p) {