mirror of
https://github.com/decke/smtprelay.git
synced 2026-06-09 11:12:36 -06:00
Compare commits
26 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 dependabot[bot]
|
a423bbb7d3 | ||
|
dependabot[bot]
|
d17280e89f | ||
|
dependabot[bot]
|
5e395f8b8d | ||
|
dependabot[bot]
|
afbab2f216 | ||
|
dependabot[bot]
|
ed37d3a2cd | ||
|
dependabot[bot]
|
c0966d63ec | ||
|
dependabot[bot]
|
4d21cc3dfd | ||
|
dependabot[bot]
|
6ee45a7298 | ||
|
dependabot[bot]
|
c1be36e929 | ||
|
dependabot[bot]
|
0c3ca70805 | ||
|
dependabot[bot]
|
c60804397f | ||
|
dependabot[bot]
|
bc021a7bff | ||
|
dependabot[bot]
|
49c00bf7d8 | ||
|
StrongWind
|
8dcd6c8067 | ||
|
dependabot[bot]
|
d634a89b14 | ||
|
dependabot[bot]
|
85a9c49471 | ||
|
dependabot[bot]
|
808b662e01 | ||
|
dependabot[bot]
|
50b1fff623 | ||
|
dependabot[bot]
|
f0a4e5aeb5 | ||
|
dependabot[bot]
|
135676e570 | ||
|
dependabot[bot]
|
9def5c934f | ||
|
dependabot[bot]
|
c0e4739def | ||
|
dependabot[bot]
|
7554d4004d | ||
|
dependabot[bot]
|
80eca86f0e | ||
|
dependabot[bot]
|
7b6cbc924d | ||
|
dependabot[bot]
|
c42b696f57 |
@@ -38,16 +38,16 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Harden Runner
|
||||
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
|
||||
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
|
||||
with:
|
||||
egress-policy: audit
|
||||
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
|
||||
# Initializes the CodeQL tools for scanning.
|
||||
- name: Initialize CodeQL
|
||||
uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
|
||||
uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
|
||||
with:
|
||||
languages: ${{ matrix.language }}
|
||||
# If you wish to specify custom queries, you can do so here or in a config file.
|
||||
@@ -58,7 +58,7 @@ jobs:
|
||||
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
|
||||
# If this step fails, then you should remove it and run the build manually (see below)
|
||||
- name: Autobuild
|
||||
uses: github/codeql-action/autobuild@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
|
||||
uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
|
||||
|
||||
# ℹ️ Command-line programs to run using the OS shell.
|
||||
# 📚 https://git.io/JvXDl
|
||||
@@ -72,4 +72,4 @@ jobs:
|
||||
# make release
|
||||
|
||||
- name: Perform CodeQL Analysis
|
||||
uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
|
||||
uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
|
||||
|
||||
@@ -17,11 +17,11 @@ jobs:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Harden Runner
|
||||
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
|
||||
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
|
||||
with:
|
||||
egress-policy: audit
|
||||
|
||||
- name: 'Checkout Repository'
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
- name: 'Dependency Review'
|
||||
uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
|
||||
uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
|
||||
|
||||
@@ -10,11 +10,11 @@ jobs:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Harden Runner
|
||||
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
|
||||
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
|
||||
with:
|
||||
egress-policy: audit
|
||||
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
|
||||
with:
|
||||
go-version: 'stable'
|
||||
|
||||
@@ -27,7 +27,7 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Harden Runner
|
||||
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
|
||||
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
|
||||
with:
|
||||
egress-policy: audit
|
||||
|
||||
@@ -41,7 +41,7 @@ jobs:
|
||||
echo "REF=${GITHUB_REF}" >> $GITHUB_ENV
|
||||
fi
|
||||
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
with:
|
||||
ref: ${{ env.REF }}
|
||||
|
||||
|
||||
@@ -36,12 +36,12 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Harden Runner
|
||||
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
|
||||
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
|
||||
with:
|
||||
egress-policy: audit
|
||||
|
||||
- name: "Checkout code"
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
@@ -68,7 +68,7 @@ jobs:
|
||||
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
|
||||
# format to the repository Actions tab.
|
||||
- name: "Upload artifact"
|
||||
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
|
||||
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
||||
with:
|
||||
name: SARIF file
|
||||
path: results.sarif
|
||||
@@ -76,6 +76,6 @@ jobs:
|
||||
|
||||
# Upload the results to GitHub's code scanning dashboard.
|
||||
- name: "Upload to code-scanning"
|
||||
uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
|
||||
uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
|
||||
with:
|
||||
sarif_file: results.sarif
|
||||
|
||||
@@ -31,6 +31,7 @@ var (
|
||||
listenStr = flagset.String("listen", "127.0.0.1:25 [::1]:25", "Address and port to listen for incoming SMTP")
|
||||
localCert = flagset.String("local_cert", "", "SSL certificate for STARTTLS/TLS")
|
||||
localKey = flagset.String("local_key", "", "SSL private key for STARTTLS/TLS")
|
||||
tlsProfile = flagset.String("tls_profile", "default", "TLS profile: modern | intermediate | default | legacy")
|
||||
localForceTLS = flagset.Bool("local_forcetls", false, "Force STARTTLS (needs local_cert and local_key)")
|
||||
readTimeoutStr = flagset.String("read_timeout", "60s", "Socket timeout for read operations")
|
||||
writeTimeoutStr = flagset.String("write_timeout", "60s", "Socket timeout for write operations")
|
||||
|
||||
@@ -1,14 +1,14 @@
|
||||
module github.com/decke/smtprelay
|
||||
|
||||
require (
|
||||
github.com/DeRuina/timberjack v1.4.1
|
||||
github.com/chrj/smtpd v0.4.0
|
||||
github.com/fsnotify/fsnotify v1.9.0
|
||||
github.com/DeRuina/timberjack v1.4.5
|
||||
github.com/chrj/smtpd v1.0.0
|
||||
github.com/fsnotify/fsnotify v1.10.1
|
||||
github.com/google/uuid v1.6.0
|
||||
github.com/peterbourgon/ff/v3 v3.4.0
|
||||
github.com/rs/zerolog v1.35.0
|
||||
github.com/rs/zerolog v1.35.1
|
||||
github.com/stretchr/testify v1.11.1
|
||||
golang.org/x/crypto v0.49.0
|
||||
golang.org/x/crypto v0.53.0
|
||||
)
|
||||
|
||||
require (
|
||||
@@ -17,7 +17,7 @@ require (
|
||||
github.com/mattn/go-colorable v0.1.14 // indirect
|
||||
github.com/mattn/go-isatty v0.0.20 // indirect
|
||||
github.com/pmezard/go-difflib v1.0.0 // indirect
|
||||
golang.org/x/sys v0.42.0 // indirect
|
||||
golang.org/x/sys v0.46.0 // indirect
|
||||
gopkg.in/yaml.v3 v3.0.1 // indirect
|
||||
)
|
||||
|
||||
|
||||
@@ -1,13 +1,13 @@
|
||||
github.com/DeRuina/timberjack v1.4.1 h1:JftM5HN/ITKehAXjtdbGqN5XZIS1biHm7VSjU0Qbtqg=
|
||||
github.com/DeRuina/timberjack v1.4.1/go.mod h1:RLoeQrwrCGIEF8gO5nV5b/gMD0QIy7bzQhBUgpp1EqE=
|
||||
github.com/chrj/smtpd v0.4.0 h1:DPJY9XxJngESsV1O/GKeydN6c+iuV1dglW/dw0VlxFY=
|
||||
github.com/chrj/smtpd v0.4.0/go.mod h1:zEP61gNDlWp/jdUqBcq/ykIbgOERyRvwfMsRLl3h9gM=
|
||||
github.com/DeRuina/timberjack v1.4.5 h1:F/kms5MPNAXUeWdOILt5ALC6iDHWNRPevaeIVH7tqYU=
|
||||
github.com/DeRuina/timberjack v1.4.5/go.mod h1:RLoeQrwrCGIEF8gO5nV5b/gMD0QIy7bzQhBUgpp1EqE=
|
||||
github.com/chrj/smtpd v1.0.0 h1:jChSfLzAhrSxTky0EZ6oW+UKiqdnepdknWYRkPeA+ZE=
|
||||
github.com/chrj/smtpd v1.0.0/go.mod h1:zEP61gNDlWp/jdUqBcq/ykIbgOERyRvwfMsRLl3h9gM=
|
||||
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
|
||||
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8vw=
|
||||
github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
|
||||
github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
|
||||
github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
|
||||
github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
|
||||
github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
|
||||
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
|
||||
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||
github.com/klauspost/compress v1.18.4 h1:RPhnKRAQ4Fh8zU2FY/6ZFDwTVTxgJ/EMydqSTzE9a2c=
|
||||
@@ -20,15 +20,15 @@ github.com/peterbourgon/ff/v3 v3.4.0 h1:QBvM/rizZM1cB0p0lGMdmR7HxZeI/ZrBWB4DqLkM
|
||||
github.com/peterbourgon/ff/v3 v3.4.0/go.mod h1:zjJVUhx+twciwfDl0zBcFzl4dW8axCRyXE/eKY9RztQ=
|
||||
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
|
||||
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||
github.com/rs/zerolog v1.35.0 h1:VD0ykx7HMiMJytqINBsKcbLS+BJ4WYjz+05us+LRTdI=
|
||||
github.com/rs/zerolog v1.35.0/go.mod h1:EjML9kdfa/RMA7h/6z6pYmq1ykOuA8/mjWaEvGI+jcw=
|
||||
github.com/rs/zerolog v1.35.1 h1:m7xQeoiLIiV0BCEY4Hs+j2NG4Gp2o2KPKmhnnLiazKI=
|
||||
github.com/rs/zerolog v1.35.1/go.mod h1:EjML9kdfa/RMA7h/6z6pYmq1ykOuA8/mjWaEvGI+jcw=
|
||||
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
|
||||
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
|
||||
golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
|
||||
golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
|
||||
golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
|
||||
golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
|
||||
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
|
||||
golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
|
||||
golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
|
||||
golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
|
||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
|
||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
|
||||
|
||||
@@ -281,6 +281,7 @@ func generateUUID() string {
|
||||
}
|
||||
|
||||
func getTLSConfig() *tls.Config {
|
||||
// Certificate loading / validation
|
||||
if *localCert == "" || *localKey == "" {
|
||||
log.Fatal().
|
||||
Str("cert_file", *localCert).
|
||||
@@ -295,9 +296,60 @@ func getTLSConfig() *tls.Config {
|
||||
Msg("cannot load X509 keypair")
|
||||
}
|
||||
|
||||
return &tls.Config{
|
||||
// TLS profile configuration
|
||||
// tls.Config.CipherSuites only affects TLS 1.0–1.2.
|
||||
|
||||
// Base config: Go defaults unless overridden.
|
||||
conf := &tls.Config{
|
||||
Certificates: []tls.Certificate{cert},
|
||||
}
|
||||
|
||||
profile := strings.ToLower(strings.TrimSpace(*tlsProfile))
|
||||
if profile == "" {
|
||||
profile = "default"
|
||||
}
|
||||
|
||||
switch profile {
|
||||
case "default":
|
||||
// Go defaults (leave MinVersion/MaxVersion/CipherSuites unset).
|
||||
|
||||
case "modern":
|
||||
// TLS 1.3+.
|
||||
conf.MinVersion = tls.VersionTLS13
|
||||
|
||||
case "intermediate":
|
||||
// TLS 1.2+ with AEAD + ECDHE cipher suites only.
|
||||
// Mozilla "intermediate" — AEAD + ECDHE only.
|
||||
conf.MinVersion = tls.VersionTLS12
|
||||
conf.CipherSuites = []uint16{
|
||||
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
|
||||
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
|
||||
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
|
||||
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
|
||||
tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
}
|
||||
|
||||
case "legacy":
|
||||
// Last resort: TLS 1.0+ and everything Go exposes for TLS 1.0–1.2.
|
||||
conf.MinVersion = tls.VersionTLS10
|
||||
|
||||
allSuites := []uint16{}
|
||||
for _, cs := range tls.CipherSuites() {
|
||||
allSuites = append(allSuites, cs.ID)
|
||||
}
|
||||
for _, cs := range tls.InsecureCipherSuites() {
|
||||
allSuites = append(allSuites, cs.ID)
|
||||
}
|
||||
conf.CipherSuites = allSuites
|
||||
|
||||
default:
|
||||
log.Warn().
|
||||
Str("tls_profile", profile).
|
||||
Msg("unknown tls_profile; using default")
|
||||
}
|
||||
|
||||
return conf
|
||||
}
|
||||
|
||||
func watchAliasFile() {
|
||||
|
||||
@@ -35,6 +35,33 @@
|
||||
;local_cert = smtpd.pem
|
||||
;local_key = smtpd.key
|
||||
|
||||
; TLS PROFILE (STARTTLS / TLS listeners)
|
||||
; Controls the minimum TLS version and allowed cipher suites for inbound
|
||||
; connections when using listen protocols `starttls://` or `tls://`.
|
||||
; Profiles follow the Mozilla SSL Configuration Generator guidelines.
|
||||
;
|
||||
; default
|
||||
; Go standard library defaults. Tracks improvements as Go updates
|
||||
; its TLS defaults. Recommended for most deployments.
|
||||
;
|
||||
; modern
|
||||
; TLS 1.3+ only. Simplest and most secure, but rejects any client
|
||||
; that cannot negotiate TLS 1.3.
|
||||
; Matches Mozilla "modern" configuration.
|
||||
;
|
||||
; intermediate
|
||||
; TLS 1.2+. For TLS 1.2 connections only AEAD ciphers (AES-GCM,
|
||||
; ChaCha20-Poly1305) with ECDHE key exchange are allowed,
|
||||
; providing forward secrecy. TLS 1.3 ciphers are always available.
|
||||
; Matches Mozilla "intermediate" configuration.
|
||||
;
|
||||
; legacy
|
||||
; TLS 1.0+ with all cipher suites the Go standard library supports,
|
||||
; including insecure ones (RC4, 3DES). Use only when you must
|
||||
; support very old clients that cannot negotiate TLS 1.2.
|
||||
;
|
||||
;tls_profile=default
|
||||
|
||||
; Enforce encrypted connection on STARTTLS ports before
|
||||
; accepting mails from client.
|
||||
;local_forcetls = false
|
||||
|
||||
Reference in New Issue
Block a user