drew/smtprelay
1
0
Fork 1
mirror of https://github.com/decke/smtprelay.git synced 2025-12-25 07:43:06 -07:00
Code Issues Packages Projects Releases Wiki Activity

Require that networks in allowed_nets are networks and not hosts

Browse Source
This commit is contained in:
Jonathon Reinhart
2021-03-13 02:45:44 -05:00
parent 0503c12ccd
commit 918df65a3a
2 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
config.go
View File

@@ -5,6 +5,7 @@ import (
"net"
"github.com/vharitonsky/iniflags"
"github.com/sirupsen/logrus"
)
var (
@@ -22,7 +23,7 @@ var (
localCert = flag.String("local_cert", "", "SSL certificate for STARTTLS/TLS")
localKey = flag.String("local_key", "", "SSL private key for STARTTLS/TLS")
localForceTLS = flag.Bool("local_forcetls", false, "Force STARTTLS (needs local_cert and local_key)")
allowedNetsStr = flag.String("allowed_nets", "127.0.0.1/8 ::1/128", "Networks allowed to send mails")
allowedNetsStr = flag.String("allowed_nets", "127.0.0.0/8 ::1/128", "Networks allowed to send mails")
allowedNets = []*net.IPNet{}
allowedSender = flag.String("allowed_sender", "", "Regular expression for valid FROM EMail addresses")
allowedRecipients = flag.String("allowed_recipients", "", "Regular expression for valid TO EMail addresses")
@@ -38,13 +39,22 @@ var (
func setupAllowedNetworks() {
for _, netstr := range splitstr(*allowedNetsStr, ' ') {
_, allowedNet, err := net.ParseCIDR(netstr)
baseIP, allowedNet, err := net.ParseCIDR(netstr)
if err != nil {
log.WithField("netstr", netstr).
WithError(err).
Fatal("Invalid CIDR notation in allowed_nets")
}
// Reject any network specification where any host bits are set,
// meaning the address refers to a host and not a network.
if !allowedNet.IP.Equal(baseIP) {
log.WithFields(logrus.Fields{
"given_net": netstr,
"proper_net": allowedNet,
}).Fatal("Invalid network in allowed_nets (host bits set)")
}
allowedNets = append(allowedNets, allowedNet)
}
}