Mirrors/go-chasquid-smtp
1
0
Fork 0
mirror of https://blitiri.com.ar/repos/chasquid synced 2026-01-07 17:47:14 +00:00
Code Releases Activity

sts: Update to draft-ietf-uta-mta-sts-18

Browse Source 
This patch updates the STS implementation from draft version 02 to 18.

The main changes are:

 - Policy is now in an ad-hoc format instead of JSON (😒).
 - Minor policy well-known URL change (now ends in ".txt").
 - Enforce HTTP media type == text/plain, as with the ad-hoc format this
   becomes much more important.
 - Simplify wildcard mx matching (same algorithm), extend test cases.
 - Valid modes are "enforce" (as before), "testing" (replaces "report"),
   and "none" (new).
This commit is contained in:
Alberto Bertogli
2018-05-20 14:45:38 +01:00
parent 23deaf1f88
commit 252ab5d3e3
3 changed files with 113 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
internal/courier/smtp.go
View File

@@ -192,7 +192,7 @@ retry:
if a.stsPolicy != nil && a.stsPolicy.Mode == sts.Enforce {
// The connection MUST be validated TLS.
// https://tools.ietf.org/html/draft-ietf-uta-mta-sts-03#section-4.2
// https://tools.ietf.org/html/draft-ietf-uta-mta-sts-18#section-4.2
if secLevel != domaininfo.SecLevel_TLS_SECURE {
stsSecurityResults.Add("fail", 1)
return a.tr.Errorf("invalid security level (%v) for STS policy",
@@ -317,7 +317,7 @@ func filterMXs(tr *trace.Trace, p *sts.Policy, mxs []string) []string {
// We don't want to return an empty set if the mode is not enforce.
// This prevents failures for policies in reporting mode.
// https://tools.ietf.org/html/draft-ietf-uta-mta-sts-03#section-5.2
// https://tools.ietf.org/html/draft-ietf-uta-mta-sts-18#section-5.1
if len(filtered) == 0 && p.Mode != sts.Enforce {
filtered = mxs
}