From b558d0986b5f12ba213d413b4a7c064ad33909a3 Mon Sep 17 00:00:00 2001 From: Matthias Schmidt Date: Mon, 4 Feb 2008 10:11:41 +0000 Subject: [PATCH] Add a new config option to dma(8). If a user wants to use plain text SMTP login over an insecure connection, he has to set the INSECURE option in the config file. Otherwise plain text login is only available over encrypted connections. Discussed-with: corecode@ --- etc/dma/dma.conf | 7 ++++++- libexec/dma/conf.c | 4 +++- libexec/dma/dma.8 | 10 +++++++++- libexec/dma/dma.h | 3 ++- libexec/dma/net.c | 33 ++++++++++++++++++++++----------- 5 files changed, 42 insertions(+), 15 deletions(-) diff --git a/etc/dma/dma.conf b/etc/dma/dma.conf index 1d3cdc806d..d4587adea0 100644 --- a/etc/dma/dma.conf +++ b/etc/dma/dma.conf @@ -1,4 +1,4 @@ -# $DragonFly: src/etc/dma/dma.conf,v 1.1 2008/02/02 18:24:00 matthias Exp $ +# $DragonFly: src/etc/dma/dma.conf,v 1.2 2008/02/04 10:11:41 matthias Exp $ # # Your smarthost (also called relayhost). Leave blank if you don't want # smarthost support. @@ -32,6 +32,11 @@ AUTHPATH /etc/dma/auth.conf # Path to your local SSL certificate #CERTFILE +# If you want to use plain text SMTP login without using encryption, change +# the SECURE entry below to INSECURE. Otherwise plain login will only work +# over a secure connection. Use this option with caution. +#SECURE + # Uncomment if you want to defer your mails. This is useful if you are # behind a dialup line. You have to submit your mails manually with dma -q #DEFER diff --git a/libexec/dma/conf.c b/libexec/dma/conf.c index 02a7ca9f92..47af9e5202 100644 --- a/libexec/dma/conf.c +++ b/libexec/dma/conf.c @@ -32,7 +32,7 @@ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * - * $DragonFly: src/libexec/dma/conf.c,v 1.1 2008/02/02 18:20:51 matthias Exp $ + * $DragonFly: src/libexec/dma/conf.c,v 1.2 2008/02/04 10:11:41 matthias Exp $ */ #include @@ -241,6 +241,8 @@ parse_conf(const char *config_path, struct config *config) config->features |= SECURETRANS; else if (strcmp(word, "DEFER") == 0) config->features |= DEFER; + else if (strcmp(word, "INSECURE") == 0) + config->features |= INSECURE; } } diff --git a/libexec/dma/dma.8 b/libexec/dma/dma.8 index 1fb168e4f1..bdbc1047c0 100644 --- a/libexec/dma/dma.8 +++ b/libexec/dma/dma.8 @@ -29,7 +29,7 @@ .\" OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.\" $DragonFly: src/libexec/dma/dma.8,v 1.5 2008/02/04 08:58:54 matthias Exp $ +.\" $DragonFly: src/libexec/dma/dma.8,v 1.6 2008/02/04 10:11:41 matthias Exp $ .\" .Dd February 4, 2008 .Dt DMA 8 @@ -197,6 +197,14 @@ Only useful together with (string, default=empty) .Xc Path to your SSL certificate file. +.It Ic SECURE Xo +(boolean, default=commented) +.Xc +Change this entry to +.Sq INSECURE +to use plain text SMTP login over an insecure connection. +You have to rename this variable manually to prevent that you send your +password accidently over an insecure connection. .It Ic DEFER Xo (boolean, default=commented) .Xc diff --git a/libexec/dma/dma.h b/libexec/dma/dma.h index 42813b7d08..644e380bee 100644 --- a/libexec/dma/dma.h +++ b/libexec/dma/dma.h @@ -32,7 +32,7 @@ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * - * $DragonFly: src/libexec/dma/dma.h,v 1.2 2008/02/03 11:06:17 matthias Exp $ + * $DragonFly: src/libexec/dma/dma.h,v 1.3 2008/02/04 10:11:41 matthias Exp $ */ #ifndef DMA_H @@ -63,6 +63,7 @@ #define SECURETRANS 0x4 /* SSL/TLS in general */ #define TLSINIT 0x8 /* Flag for TLS init phase */ #define DEFER 0x10 /* Defer mails */ +#define INSECURE 0x20 /* Allow plain login w/o encryption */ struct stritem { SLIST_ENTRY(stritem) next; diff --git a/libexec/dma/net.c b/libexec/dma/net.c index 7373aaa405..dc2d5a40cc 100644 --- a/libexec/dma/net.c +++ b/libexec/dma/net.c @@ -32,7 +32,7 @@ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * - * $DragonFly: src/libexec/dma/net.c,v 1.3 2008/02/04 08:58:54 matthias Exp $ + * $DragonFly: src/libexec/dma/net.c,v 1.4 2008/02/04 10:11:41 matthias Exp $ */ #include @@ -304,17 +304,28 @@ deliver_remote(struct qitem *it, const char **errmsg) } if (do_auth == 1) { - syslog(LOG_INFO, "%s: Use SMTP authentication", it->queueid); - error = smtp_login(it, fd, a->login, a->password); - if (error < 0) { - syslog(LOG_ERR, "%s: remote delivery failed:" - " SMTP login failed: %m", it->queueid); - return (-1); - } - /* SMTP login is not available, so try without */ - else if (error > 0) - syslog(LOG_ERR, "%s: SMTP login not available. Try without", + /* + * Check if the user wants plain text login without using + * encryption. + */ + if (((config->features & SECURETRANS) == 0) && + ((config->features & INSECURE) != 0)) { + syslog(LOG_INFO, "%s: Use SMTP authentication", it->queueid); + error = smtp_login(it, fd, a->login, a->password); + if (error < 0) { + syslog(LOG_ERR, "%s: remote delivery failed:" + " SMTP login failed: %m", it->queueid); + return (-1); + } + /* SMTP login is not available, so try without */ + else if (error > 0) + syslog(LOG_ERR, "%s: SMTP login not available." + " Try without", it->queueid); + } else { + syslog(LOG_ERR, "%s: Skip SMTP login. ", + it->queueid); + } } send_remote_command(fd, "MAIL FROM:<%s>", it->sender); -- 2.41.0