mirror of
https://blitiri.com.ar/repos/chasquid
synced 2026-01-08 17:51:57 +00:00
d7006d0e16
On the smtp client package, there is no limit to the length of the server's replies, so an evil server could cause a memory exhaustion DoS by issuing very long lines. This patch fixes the bug by limiting the total size of received data. Ideally this would be done per-line instead, but gets much more complex, so this is a compromise. The limit chosen is 2 MiB, which should be plenty for any the total size of server-side replies, considering we only send a single message per connection anyway. This is similar to 06d808c (smtpsrv: Limit incoming line length), which was found and reported by Max Mazurov (fox.cpp@disroot.org).
chasquid
chasquid is an SMTP (email) server with a focus on simplicity, security, and ease of operation.
It is designed mainly for individuals and small groups.
It's written in Go, and distributed under the Apache license 2.0.
Features
- Easy
- Easy to configure.
- Hard to mis-configure in ways that are harmful or insecure (e.g. no open relay, or clear-text authentication).
- Monitoring HTTP server, with exported variables and tracing to help debugging.
- Integrated with Debian and Ubuntu.
- Supports using Dovecot for authentication.
- Useful
- Secure
- Tracking of per-domain TLS support, prevents connection downgrading.
- Multiple TLS certificates.
- Easy integration with Let's Encrypt.
- SPF and MTA-STS checking.
Documentation
The how-to guide and the installation guide are the best starting points on how to install, configure and run chasquid.
You will find all documentation here.
Contact
If you have any questions, comments or patches please send them to the mailing list, chasquid@googlegroups.com.
To subscribe, send an email to chasquid+subscribe@googlegroups.com.
You can also reach out via IRC, #chasquid on
freenode.