Mirrors/go-chasquid-smtp
1
0
Fork 0
mirror of https://blitiri.com.ar/repos/chasquid synced 2026-01-05 17:37:03 +00:00
Code Releases Activity

smtpsrv: Close the connection after 3 errors (lowering from 10)

Browse Source 
Today, we close the connection after 10 errors. While this is fine for
normal use, it is unnecessarily large.

Lowering it to 3 helps with defense-in-depth for cross-protocol attacks
(e.g. https://alpaca-attack.com/), while still being large enough for
useful troubleshooting and normal operation.

As part of this change, we also remove the AUTH-specific failures limit,
because they're covered by the connection limit.
This commit is contained in:
Alberto Bertogli
2021-06-10 18:41:28 +01:00
parent 44eb0b903a
commit 85305f4bd9
7 changed files with 62 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
internal/smtpsrv/conn.go
View File

@@ -145,9 +145,6 @@ type Conn struct {
// Have we successfully completed AUTH?
completedAuth bool
// How many times have we attempted AUTH?
authAttempts int
// Authenticated user and domain, empty if !completedAuth.
authUser string
authDomain string
@@ -291,8 +288,10 @@ loop:
// Be verbose about errors, to help troubleshooting.
c.tr.Errorf("%s failed: %d %s", cmd, code, msg)
// Close the connection after 3 errors.
// This helps prevent cross-protocol attacks.
errCount++
if errCount > 10 {
if errCount >= 3 {
// https://tools.ietf.org/html/rfc5321#section-4.3.2
c.tr.Errorf("too many errors, breaking connection")
_ = c.writeResponse(421, "4.5.0 Too many errors, bye")
@@ -1016,11 +1015,6 @@ func (c *Conn) AUTH(params string) (code int, msg string) {
return 503, "5.5.1 You are already wearing that!"
}
if c.authAttempts > 3 {
return 503, "5.7.8 Too many attempts, go away"
}
c.authAttempts++
// We only support PLAIN for now, so no need to make this too complicated.
// Params should be either "PLAIN" or "PLAIN <response>".
// If the response is not there, we reply with 334, and expect the

24
internal/smtpsrv/server_test.go
View File

@@ -214,25 +214,25 @@ func TestBrokenAuth(t *testing.T) {
}
func TestWrongMailParsing(t *testing.T) {
c := mustDial(t, ModeSMTP, false)
defer c.Close()
addrs := []string{"from", "a b c", "a @ b", "<x>", "<x y>", "><"}
for _, addr := range addrs {
c := mustDial(t, ModeSMTP, false)
if err := c.Mail(addr); err == nil {
t.Errorf("Mail not failed as expected with %q", addr)
}
}
if err := c.Mail("from@plain"); err != nil {
t.Errorf("Mail: %v", err)
}
for _, addr := range addrs {
if err := c.Rcpt(addr); err == nil {
t.Errorf("Rcpt not failed as expected with %q", addr)
if err := c.Mail("from@plain"); err != nil {
t.Errorf("Mail: %v", err)
}
for _, addr := range addrs {
if err := c.Rcpt(addr); err == nil {
t.Errorf("Rcpt not failed as expected with %q", addr)
}
}
c.Close()
}
}