Mirrors/go-chasquid-smtp
1
0
Fork 0
mirror of https://blitiri.com.ar/repos/chasquid synced 2025-12-18 14:47:03 +00:00
Code Releases Activity

MTA-STS is now RFC 8461

Browse Source 
MTA-STS has been published as RFC 8461, with no major changes since the
last draft we updated (-18).

This patch updates the documentation accordingly (no code changes).
This commit is contained in:
Alberto Bertogli
2018-09-26 21:42:50 +01:00
parent 5878fc74f3
commit 2dfed059e4
3 changed files with 13 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
README.md
View File

@@ -43,7 +43,7 @@ It's written in [Go](https://golang.org), and distributed under the
[Let's Encrypt]: https://letsencrypt.org [Let's Encrypt]: https://letsencrypt.org
[Dovecot]: https://dovecot.org [Dovecot]: https://dovecot.org
[SPF]: https://en.wikipedia.org/wiki/Sender_Policy_Framework [SPF]: https://en.wikipedia.org/wiki/Sender_Policy_Framework
[MTA-STS]: https://datatracker.ietf.org/doc/draft-ietf-uta-mta-sts/ [MTA-STS]: https://tools.ietf.org/html/rfc8461
[Debian]: https://debian.org [Debian]: https://debian.org
[Ubuntu]: https://ubuntu.com [Ubuntu]: https://ubuntu.com

4
internal/courier/smtp.go
View File

@@ -191,8 +191,8 @@ retry:
slcResults.Add("pass", 1) slcResults.Add("pass", 1)
if a.stsPolicy != nil && a.stsPolicy.Mode == sts.Enforce { if a.stsPolicy != nil && a.stsPolicy.Mode == sts.Enforce {
// The connection MUST be validated TLS. // The connection MUST be validated by TLS.
// https://tools.ietf.org/html/draft-ietf-uta-mta-sts-18#section-4.2 // https://tools.ietf.org/html/rfc8461#section-4.2
if secLevel != domaininfo.SecLevel_TLS_SECURE { if secLevel != domaininfo.SecLevel_TLS_SECURE {
stsSecurityResults.Add("fail", 1) stsSecurityResults.Add("fail", 1)
return a.tr.Errorf("invalid security level (%v) for STS policy", return a.tr.Errorf("invalid security level (%v) for STS policy",

21
internal/sts/sts.go
View File

@@ -1,10 +1,9 @@
// Package sts implements the MTA-STS (Strict Transport Security), based on // Package sts implements the MTA-STS (Strict Transport Security), RFC 8461.
// the current draft, https://tools.ietf.org/html/draft-ietf-uta-mta-sts-18.
//
// This is an EXPERIMENTAL implementation for now.
// //
// Note that "report" mode is not supported. // Note that "report" mode is not supported.
// //
// Reference: https://tools.ietf.org/html/rfc8461
//
package sts package sts
import ( import (
@@ -52,7 +51,7 @@ var (
) )
// Policy represents a parsed policy. // Policy represents a parsed policy.
// https://tools.ietf.org/html/draft-ietf-uta-mta-sts-18#section-3.2 // https://tools.ietf.org/html/rfc8461#section-3.2
// The json annotations are used for serializing for caching purposes. // The json annotations are used for serializing for caching purposes.
type Policy struct { type Policy struct {
Version string `json:"version"` Version string `json:"version"`
@@ -144,7 +143,7 @@ func (p *Policy) Check() error {
} }
// MXIsAllowed checks if the given MX is allowed, according to the policy. // MXIsAllowed checks if the given MX is allowed, according to the policy.
// https://tools.ietf.org/html/draft-ietf-uta-mta-sts-18#section-4.1 // https://tools.ietf.org/html/rfc8461#section-4.1
func (p *Policy) MXIsAllowed(mx string) bool { func (p *Policy) MXIsAllowed(mx string) bool {
if p.Mode != Enforce { if p.Mode != Enforce {
return true return true
@@ -197,8 +196,8 @@ func urlForDomain(domain string) string {
} }
// URL composed from the domain, as explained in: // URL composed from the domain, as explained in:
// https://tools.ietf.org/html/draft-ietf-uta-mta-sts-18#section-3.3 // https://tools.ietf.org/html/rfc8461#section-3.3
// https://tools.ietf.org/html/draft-ietf-uta-mta-sts-18#section-3.2 // https://tools.ietf.org/html/rfc8461#section-3.2
return "https://mta-sts." + domain + "/.well-known/mta-sts.txt" return "https://mta-sts." + domain + "/.well-known/mta-sts.txt"
} }
@@ -225,7 +224,7 @@ func Fetch(ctx context.Context, domain string) (*Policy, error) {
func httpGet(ctx context.Context, url string) ([]byte, error) { func httpGet(ctx context.Context, url string) ([]byte, error) {
client := &http.Client{ client := &http.Client{
// We MUST NOT follow redirects, see // We MUST NOT follow redirects, see
// https://tools.ietf.org/html/draft-ietf-uta-mta-sts-18#section-3.3 // https://tools.ietf.org/html/rfc8461#section-3.3
CheckRedirect: rejectRedirect, CheckRedirect: rejectRedirect,
} }
@@ -242,7 +241,7 @@ func httpGet(ctx context.Context, url string) ([]byte, error) {
// Media type must be "text/plain" to guard against cases where webservers // Media type must be "text/plain" to guard against cases where webservers
// allow untrusted users to host non-text content (like HTML or images) at // allow untrusted users to host non-text content (like HTML or images) at
// a user-defined path. // a user-defined path.
// https://tools.ietf.org/html/draft-ietf-uta-mta-sts-18#section-3.2 // https://tools.ietf.org/html/rfc8461#section-3.2
mt, _, err := mime.ParseMediaType(resp.Header.Get("Content-type")) mt, _, err := mime.ParseMediaType(resp.Header.Get("Content-type"))
if err != nil { if err != nil {
return nil, fmt.Errorf("HTTP media type error: %v", err) return nil, fmt.Errorf("HTTP media type error: %v", err)
@@ -263,7 +262,7 @@ func rejectRedirect(req *http.Request, via []*http.Request) error {
} }
// matchDomain checks if the domain matches the given pattern, according to // matchDomain checks if the domain matches the given pattern, according to
// from https://tools.ietf.org/html/draft-ietf-uta-mta-sts-18#section-4.1 // from https://tools.ietf.org/html/rfc8461#section-4.1
// (based on https://tools.ietf.org/html/rfc6125#section-6.4). // (based on https://tools.ietf.org/html/rfc6125#section-6.4).
func matchDomain(domain, pattern string) bool { func matchDomain(domain, pattern string) bool {
domain, dErr := domainToASCII(domain) domain, dErr := domainToASCII(domain)