| 1 |
vip-ire |
1.1 |
diff -Nur qpsmtpd-0.84/lib/Qpsmtpd/SMTP.pm qpsmtpd-0.84_bz8863/lib/Qpsmtpd/SMTP.pm |
| 2 |
|
|
--- qpsmtpd-0.84/lib/Qpsmtpd/SMTP.pm 2015-05-15 15:38:15.796000000 +0200 |
| 3 |
|
|
+++ qpsmtpd-0.84_bz8863/lib/Qpsmtpd/SMTP.pm 2015-05-15 15:39:30.602000000 +0200 |
| 4 |
|
|
@@ -240,7 +240,11 @@ |
| 5 |
|
|
} |
| 6 |
|
|
|
| 7 |
|
|
# Check if we should only offer AUTH after TLS is completed |
| 8 |
|
|
- my $tls_before_auth = ($self->config('tls_before_auth') ? ($self->config('tls_before_auth'))[0] && $self->transaction->notes('tls_enabled') : 0); |
| 9 |
|
|
+ my $tls_before_auth = ($self->config('tls_before_auth') ? |
| 10 |
|
|
+ ( |
| 11 |
|
|
+ ($self->config('tls_before_auth'))[0] && |
| 12 |
|
|
+ ($self->transaction->notes('tls_enabled') || $self->connection->notes('tls_force_disabled')) |
| 13 |
|
|
+ ) : 0); |
| 14 |
|
|
if ( %auth_mechanisms && !$tls_before_auth) { |
| 15 |
|
|
push @capabilities, 'AUTH '.join(" ",keys(%auth_mechanisms)); |
| 16 |
|
|
$self->{_commands}->{'auth'} = ""; |
| 17 |
|
|
diff -Nur qpsmtpd-0.84/plugins/tls qpsmtpd-0.84_bz8863/plugins/tls |
| 18 |
|
|
--- qpsmtpd-0.84/plugins/tls 2015-05-15 15:38:15.791000000 +0200 |
| 19 |
|
|
+++ qpsmtpd-0.84_bz8863/plugins/tls 2015-05-15 15:55:06.719000000 +0200 |
| 20 |
|
|
@@ -107,9 +107,15 @@ |
| 21 |
|
|
} |
| 22 |
|
|
|
| 23 |
|
|
sub hook_ehlo { |
| 24 |
|
|
- my ($self, $transaction) = @_; |
| 25 |
|
|
+ my ($self, $transaction, $host) = @_; |
| 26 |
|
|
return DECLINED unless $self->can_do_tls; |
| 27 |
|
|
return DECLINED if $self->connection->notes('tls_enabled'); |
| 28 |
|
|
+ return DECLINED unless $host; |
| 29 |
|
|
+ if ($self->_is_in_notls($host)) { |
| 30 |
|
|
+ $self->log(LOGINFO, "Disabling TLS as host matches one of the notls config file"); |
| 31 |
|
|
+ $self->connection->notes('tls_force_disabled', 1); |
| 32 |
|
|
+ return DECLINED; |
| 33 |
|
|
+ } |
| 34 |
|
|
return DENY, "Command refused due to lack of security" if $transaction->notes('ssl_failed'); |
| 35 |
|
|
my $cap = $transaction->notes('capabilities'); |
| 36 |
|
|
$cap ||= []; |
| 37 |
|
|
@@ -165,6 +171,22 @@ |
| 38 |
|
|
return DECLINED; |
| 39 |
|
|
} |
| 40 |
|
|
|
| 41 |
|
|
+sub _is_in_notls { |
| 42 |
|
|
+ my ($self, $host) = @_; |
| 43 |
|
|
+ |
| 44 |
|
|
+ $host = lc $host; |
| 45 |
|
|
+ foreach my $line ($self->qp->config('notls')) { |
| 46 |
|
|
+ # If line is a regex |
| 47 |
|
|
+ if ($line =~ /[\{\}\[\]\(\)\^\$\|\*\+\?\\\!]/ && $host =~ /$line/) { |
| 48 |
|
|
+ return 1; |
| 49 |
|
|
+ } |
| 50 |
|
|
+ if ($host eq lc $line) { |
| 51 |
|
|
+ return 1; |
| 52 |
|
|
+ } |
| 53 |
|
|
+ } |
| 54 |
|
|
+ return; |
| 55 |
|
|
+} |
| 56 |
|
|
+ |
| 57 |
|
|
sub _convert_to_ssl { |
| 58 |
|
|
my ($self) = @_; |
| 59 |
|
|
|
Parent Directory
| 
Revision Log
| 
Revision Graph
