smtpsrv: Reject HTTP commands

To help with defense-in-depth on cross-protocol attacks (e.g.
https://alpaca-attack.com/), this patch makes chasquid reject HTTP
commands.

docs/monitoring.md

@@ -66,6 +66,8 @@ List of exported variables:
   count of SPF checks, by result.
 - **chasquid/smtpIn/tlsCount** (tls status -> counter)  
   count of TLS statuses (plain/tls) for incoming SMTP connections.
+- **chasquid/smtpIn/wrongProtoCount** (command -> counter)  
+  count of commands for other protocols (e.g. HTTP commands).
 - **chasquid/smtpOut/securityLevelChecks** (result -> counter)  
   count of security level checks on outgoing connections, by result.
 - **chasquid/smtpOut/sts/mode** (mode -> counter)  

internal/smtpsrv/conn.go

@@ -51,6 +51,8 @@ var (
 		"result", "incoming security level check results")
 	hookResults = expvarom.NewMap("chasquid/smtpIn/hookResults",
 		"result", "count of hook invocations, by result")
+	wrongProtoCount = expvarom.NewMap("chasquid/smtpIn/wrongProtoCount",
+		"command", "count of commands for other protocols")
 )
 
 var (
@@ -272,6 +274,14 @@ loop:
 		case "QUIT":
 			_ = c.writeResponse(221, "2.0.0 Be seeing you...")
 			break loop
+		case "GET", "POST", "CONNECT":
+			// HTTP protocol detection, to prevent cross-protocol attacks
+			// (e.g. https://alpaca-attack.com/).
+			wrongProtoCount.Add(cmd, 1)
+			c.tr.Errorf("http command, closing connection")
+			_ = c.writeResponse(502,
+				"5.7.0 You hear someone cursing shoplifters")
+			break loop
 		default:
 			// Sanitize it a bit to avoid filling the logs and events with
 			// noisy data. Keep the first 6 bytes for debugging.

test/t-12-minor_dialogs/wrong_proto.cmy

@@ -0,0 +1,15 @@
+
+c tcp_connect localhost:1025
+c <~ 220
+c -> GET /evil HTTP/1.1
+c <- 502 5.7.0 You hear someone cursing shoplifters
+
+c tcp_connect localhost:1025
+c <~ 220
+c -> POST /evil HTTP/1.1
+c <- 502 5.7.0 You hear someone cursing shoplifters
+
+c tcp_connect localhost:1025
+c <~ 220
+c -> CONNECT www.evil.com:80 HTTP/1.1
+c <- 502 5.7.0 You hear someone cursing shoplifters