mirror of
https://blitiri.com.ar/repos/chasquid
synced 2025-12-17 14:37:02 +00:00
a996106eee
The RFCs are very clear that in DATA contents: > CR and LF MUST only occur together as CRLF; they MUST NOT appear > independently in the body. https://www.rfc-editor.org/rfc/rfc5322#section-2.3 https://www.rfc-editor.org/rfc/rfc5321#section-2.3.8 Allowing "independent" CR and LF can cause a number of problems. In particular, there is a new "SMTP smuggling attack" published recently that involves the server incorrectly parsing the end of DATA marker `\r\n.\r\n`, which an attacker can exploit to impersonate a server when email is transmitted server-to-server. https://www.postfix.org/smtp-smuggling.html https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/ Currently, chasquid is vulnerable to this attack, because Go's standard libraries net/textproto and net/mail do not enforce CRLF strictly. This patch fixes the problem by introducing a new "dot reader" function that strictly enforces CRLF when reading dot-terminated data, used in the DATA input processing. When an invalid newline terminator is found, the connection is aborted immediately because we cannot safely recover from that state. We still keep the internal representation as LF-terminated for convenience and simplicity. However, the MDA courier is changed to pass CRLF-terminated lines, since that is an external program which could be strict when receiving email messages. See https://github.com/albertito/chasquid/issues/47 for more details and discussion.
chasquid
chasquid is an SMTP (email) server with a focus on simplicity, security, and ease of operation.
It is designed mainly for individuals and small groups.
It's written in Go, and distributed under the Apache license 2.0.
Features
- Easy
- Easy to configure.
- Hard to mis-configure in ways that are harmful or insecure (e.g. no open relay, or clear-text authentication).
- Monitoring HTTP server, with exported variables and tracing to help debugging.
- Integrated with Debian, Ubuntu, and Arch.
- Supports using Dovecot for authentication.
- Useful
- Secure
- Tracking of per-domain TLS support, prevents connection downgrading.
- Multiple TLS certificates.
- Easy integration with Let's Encrypt.
- SPF and MTA-STS checking.
Documentation
The how-to guide and the installation guide are the best starting points on how to install, configure and run chasquid.
You will find all documentation here.
Contact
If you have any questions, comments or patches, please send them to the mailing
list,
chasquid@googlegroups.com.
To subscribe, send an email to chasquid+subscribe@googlegroups.com.
Security issues can be reported privately to albertito@blitiri.com.ar.
Bug reports and pull requests on GitHub are also welcome.
You can also reach out via IRC, #chasquid on OFTC.