drew/smtprelay
1
0
Fork 1
mirror of https://github.com/decke/smtprelay.git synced 2025-12-25 16:42:28 -07:00
Code Issues Packages Projects Releases Wiki Activity

Require that networks in allowed_nets are networks and not hosts

Browse Source
This commit is contained in:
Jonathon Reinhart
2021-03-13 02:45:44 -05:00
parent 0503c12ccd
commit 918df65a3a
2 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
config.go
View File

@@ -5,6 +5,7 @@ import (
"net" "net"
"github.com/vharitonsky/iniflags" "github.com/vharitonsky/iniflags"
"github.com/sirupsen/logrus"
) )
var ( var (
@@ -22,7 +23,7 @@ var (
localCert = flag.String("local_cert", "", "SSL certificate for STARTTLS/TLS") localCert = flag.String("local_cert", "", "SSL certificate for STARTTLS/TLS")
localKey = flag.String("local_key", "", "SSL private key for STARTTLS/TLS") localKey = flag.String("local_key", "", "SSL private key for STARTTLS/TLS")
localForceTLS = flag.Bool("local_forcetls", false, "Force STARTTLS (needs local_cert and local_key)") localForceTLS = flag.Bool("local_forcetls", false, "Force STARTTLS (needs local_cert and local_key)")
allowedNetsStr = flag.String("allowed_nets", "127.0.0.1/8 ::1/128", "Networks allowed to send mails") allowedNetsStr = flag.String("allowed_nets", "127.0.0.0/8 ::1/128", "Networks allowed to send mails")
allowedNets = []*net.IPNet{} allowedNets = []*net.IPNet{}
allowedSender = flag.String("allowed_sender", "", "Regular expression for valid FROM EMail addresses") allowedSender = flag.String("allowed_sender", "", "Regular expression for valid FROM EMail addresses")
allowedRecipients = flag.String("allowed_recipients", "", "Regular expression for valid TO EMail addresses") allowedRecipients = flag.String("allowed_recipients", "", "Regular expression for valid TO EMail addresses")
@@ -38,13 +39,22 @@ var (
func setupAllowedNetworks() { func setupAllowedNetworks() {
for _, netstr := range splitstr(*allowedNetsStr, ' ') { for _, netstr := range splitstr(*allowedNetsStr, ' ') {
_, allowedNet, err := net.ParseCIDR(netstr) baseIP, allowedNet, err := net.ParseCIDR(netstr)
if err != nil { if err != nil {
log.WithField("netstr", netstr). log.WithField("netstr", netstr).
WithError(err). WithError(err).
Fatal("Invalid CIDR notation in allowed_nets") Fatal("Invalid CIDR notation in allowed_nets")
} }
// Reject any network specification where any host bits are set,
// meaning the address refers to a host and not a network.
if !allowedNet.IP.Equal(baseIP) {
log.WithFields(logrus.Fields{
"given_net": netstr,
"proper_net": allowedNet,
}).Fatal("Invalid network in allowed_nets (host bits set)")
}
allowedNets = append(allowedNets, allowedNet) allowedNets = append(allowedNets, allowedNet)
} }
} }

2
smtprelay.ini
View File

@@ -32,7 +32,7 @@
; Networks that are allowed to send mails to us ; Networks that are allowed to send mails to us
; Defaults to localhost. If set to "", then any address is allowed. ; Defaults to localhost. If set to "", then any address is allowed.
;allowed_nets = 127.0.0.1/8 ::1/128 ;allowed_nets = 127.0.0.0/8 ::1/128
; Regular expression for valid FROM EMail addresses ; Regular expression for valid FROM EMail addresses
; Example: ^(.*)@localhost.localdomain$ ; Example: ^(.*)@localhost.localdomain$