mirror of
https://github.com/mjl-/mox.git
synced 2025-07-10 07:54:40 +03:00
new feature: when delivering messages from the queue, make it possible to use a "transport"
the default transport is still just "direct delivery", where we connect to the destination domain's MX servers. other transports are: - regular smtp without authentication, this is relaying to a smarthost. - submission with authentication, e.g. to a third party email sending service. - direct delivery, but with with connections going through a socks proxy. this can be helpful if your ip is blocked, you need to get email out, and you have another IP that isn't blocked. keep in mind that for all of the above, appropriate SPF/DKIM settings have to be configured. the "dnscheck" for a domain does a check for any SOCKS IP in the SPF record. SPF for smtp/submission (ranges? includes?) and any DKIM requirements cannot really be checked. which transport is used can be configured through routes. routes can be set on an account, a domain, or globally. the routes are evaluated in that order, with the first match selecting the transport. these routes are evaluated for each delivery attempt. common selection criteria are recipient domain and sender domain, but also which delivery attempt this is. you could configured mox to attempt sending through a 3rd party from the 4th attempt onwards. routes and transports are optional. if no route matches, or an empty/zero transport is selected, normal direct delivery is done. we could already "submit" emails with 3rd party accounts with "sendmail". but we now support more SASL authentication mechanisms with SMTP (not only PLAIN, but also SCRAM-SHA-256, SCRAM-SHA-1 and CRAM-MD5), which sendmail now also supports. sendmail will use the most secure mechanism supported by the server, or the explicitly configured mechanism. for issue #36 by dmikushin. also based on earlier discussion on hackernews.
This commit is contained in:
78
sendmail.go
78
sendmail.go
@ -3,8 +3,6 @@ package main
|
||||
import (
|
||||
"bufio"
|
||||
"context"
|
||||
"crypto/tls"
|
||||
"encoding/base64"
|
||||
"fmt"
|
||||
"io"
|
||||
"log"
|
||||
@ -17,12 +15,37 @@ import (
|
||||
|
||||
"github.com/mjl-/sconf"
|
||||
|
||||
"github.com/mjl-/mox/dns"
|
||||
"github.com/mjl-/mox/mlog"
|
||||
"github.com/mjl-/mox/mox-"
|
||||
"github.com/mjl-/mox/sasl"
|
||||
"github.com/mjl-/mox/smtp"
|
||||
"github.com/mjl-/mox/smtpclient"
|
||||
)
|
||||
|
||||
var submitconf struct {
|
||||
LocalHostname string `sconf-doc:"Hosts don't always have an FQDN, set it explicitly, for EHLO."`
|
||||
Host string `sconf-doc:"Host to dial for delivery, e.g. mail.<domain>."`
|
||||
Port int `sconf-doc:"Port to dial for delivery, e.g. 465 for submissions, 587 for submission, or perhaps 25 for smtp."`
|
||||
TLS bool `sconf-doc:"Connect with TLS. Usually for connections to port 465."`
|
||||
STARTTLS bool `sconf-doc:"After starting in plain text, use STARTTLS to enable TLS. For port 587 and 25."`
|
||||
Username string `sconf-doc:"For SMTP authentication."`
|
||||
Password string `sconf-doc:"For password-based SMTP authentication, e.g. SCRAM-SHA-256, SCRAM-SHA-1, CRAM-MD5, PLAIN."`
|
||||
AuthMethod string `sconf-doc:"If set, only attempt this authentication mechanism. E.g. SCRAM-SHA-256. If not set, any mutually supported algorithm can be used, in order of most to least secure."`
|
||||
From string `sconf-doc:"Address for MAIL FROM in SMTP and From-header in message."`
|
||||
DefaultDestination string `sconf:"optional" sconf-doc:"Used when specified address does not contain an @ and may be a local user (eg root)."`
|
||||
}
|
||||
|
||||
func cmdConfigDescribeSendmail(c *cmd) {
|
||||
c.params = ">/etc/moxsubmit.conf"
|
||||
c.help = `Describe configuration for mox when invoked as sendmail.`
|
||||
if len(c.Parse()) != 0 {
|
||||
c.Usage()
|
||||
}
|
||||
|
||||
err := sconf.Describe(os.Stdout, submitconf)
|
||||
xcheckf(err, "describe config")
|
||||
}
|
||||
|
||||
func cmdSendmail(c *cmd) {
|
||||
c.params = "[-Fname] [ignoredflags] [-t] [<message]"
|
||||
c.help = `Sendmail is a drop-in replacement for /usr/sbin/sendmail to deliver emails sent by unix processes like cron.
|
||||
@ -213,26 +236,49 @@ binary should be setgid that group:
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
var conn net.Conn
|
||||
addr := net.JoinHostPort(submitconf.Host, fmt.Sprintf("%d", submitconf.Port))
|
||||
d := net.Dialer{Timeout: 30 * time.Second}
|
||||
if submitconf.TLS {
|
||||
conn, err = tls.DialWithDialer(&d, "tcp", addr, nil)
|
||||
} else {
|
||||
conn, err = d.Dial("tcp", addr)
|
||||
}
|
||||
conn, err := d.Dial("tcp", addr)
|
||||
xcheckf(err, "dial submit server")
|
||||
|
||||
var auth []sasl.Client
|
||||
switch submitconf.AuthMethod {
|
||||
case "SCRAM-SHA-256":
|
||||
auth = []sasl.Client{sasl.NewClientSCRAMSHA256(submitconf.Username, submitconf.Password)}
|
||||
case "SCRAM-SHA-1":
|
||||
auth = []sasl.Client{sasl.NewClientSCRAMSHA1(submitconf.Username, submitconf.Password)}
|
||||
case "CRAM-MD5":
|
||||
auth = []sasl.Client{sasl.NewClientCRAMMD5(submitconf.Username, submitconf.Password)}
|
||||
case "PLAIN":
|
||||
auth = []sasl.Client{sasl.NewClientPlain(submitconf.Username, submitconf.Password)}
|
||||
default:
|
||||
auth = []sasl.Client{
|
||||
sasl.NewClientSCRAMSHA256(submitconf.Username, submitconf.Password),
|
||||
sasl.NewClientSCRAMSHA1(submitconf.Username, submitconf.Password),
|
||||
sasl.NewClientCRAMMD5(submitconf.Username, submitconf.Password),
|
||||
sasl.NewClientPlain(submitconf.Username, submitconf.Password),
|
||||
}
|
||||
}
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
|
||||
defer cancel()
|
||||
tlsMode := smtpclient.TLSStrict
|
||||
if !submitconf.STARTTLS {
|
||||
tlsMode = smtpclient.TLSSkip
|
||||
tlsMode := smtpclient.TLSSkip
|
||||
if submitconf.TLS {
|
||||
tlsMode = smtpclient.TLSStrictImmediate
|
||||
} else if submitconf.STARTTLS {
|
||||
tlsMode = smtpclient.TLSStrictStartTLS
|
||||
}
|
||||
// todo: should have more auth options, scram-sha-256 at least, perhaps cram-md5 for compatibility as well.
|
||||
authLine := fmt.Sprintf("AUTH PLAIN %s", base64.StdEncoding.EncodeToString([]byte(fmt.Sprintf("\u0000%s\u0000%s", submitconf.Username, submitconf.Password))))
|
||||
mox.Conf.Static.HostnameDomain.ASCII = submitconf.LocalHostname
|
||||
client, err := smtpclient.New(ctx, mlog.New("sendmail"), conn, tlsMode, submitconf.Host, authLine)
|
||||
|
||||
ourHostname, err := dns.ParseDomain(submitconf.LocalHostname)
|
||||
xcheckf(err, "parsing our local hostname")
|
||||
|
||||
var remoteHostname dns.Domain
|
||||
if net.ParseIP(submitconf.Host) != nil {
|
||||
remoteHostname, err = dns.ParseDomain(submitconf.Host)
|
||||
xcheckf(err, "parsing remote hostname")
|
||||
}
|
||||
|
||||
client, err := smtpclient.New(ctx, mlog.New("sendmail"), conn, tlsMode, ourHostname, remoteHostname, auth)
|
||||
xcheckf(err, "open smtp session")
|
||||
|
||||
err = client.Deliver(ctx, submitconf.From, recipient, int64(len(msg)), strings.NewReader(msg), true, false)
|
||||
|
Reference in New Issue
Block a user