admin/felhom-controller
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v0.89.0: app-email plaintext-only listener (:2526) + split-From mapping

Browse Source 
Gap 1: third shim listener :2526, plaintext, does NOT advertise STARTTLS (TLSConfig
nil) — for opportunistic-STARTTLS clients with no cert-skip (cal.com, nextcloud).
Gap 2: SMTPMapping tls_mode (picks port 2525/2526/2465) + from_domain_var (split
local-part + domain for nextcloud's MAIL_FROM_ADDRESS/MAIL_DOMAIN). Default keeps
existing apps on 2525. Hub untouched.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
authentik Default Admin
2026-06-29 13:13:40 +02:00
parent 6692a2f631
commit a405505e81
8 changed files with 252 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
controller/internal/mailrelay/mailrelay_test.go
+60 -10
View File
@@ -212,11 +212,12 @@ func TestSanitizeReason(t *testing.T) {
func TestLifecycle_StartStopIdempotent(t *testing.T) {
fwd := &fakeForwarder{status: 200}
lc := NewLifecycle(Options{
PlainAddr: "127.0.0.1:0",
TLSAddr: "127.0.0.1:0",
Policy: NewPolicy([]string{"felhom.eu"}),
Forwarder: fwd,
Logger: quietLogger(),
PlainAddr: "127.0.0.1:0",
TLSAddr: "127.0.0.1:0",
PlainNoTLSAddr: "127.0.0.1:0",
Policy: NewPolicy([]string{"felhom.eu"}),
Forwarder: fwd,
Logger: quietLogger(),
})
if lc.Running() {
t.Fatal("should not be running before Apply")
@@ -257,14 +258,63 @@ func TestLifecycle_StartStopIdempotent(t *testing.T) {
}
}
// Gap-1: the :2526 listener must NOT advertise STARTTLS (TLSConfig nil), while :2525 must.
// Proven both at the config level and over a real EHLO.
func TestServer_PlainNoTLSListener_NoSTARTTLS(t *testing.T) {
fwd := &fakeForwarder{status: 200}
s, err := New(Options{
PlainAddr: "127.0.0.1:0",
TLSAddr: "127.0.0.1:0",
PlainNoTLSAddr: "127.0.0.1:0",
Policy: NewPolicy([]string{"felhom.eu"}),
Forwarder: fwd,
Logger: quietLogger(),
})
if err != nil {
t.Fatalf("New: %v", err)
}
// Config-level: STARTTLS is advertised iff TLSConfig != nil.
if s.plainNoTLSSrv.TLSConfig != nil {
t.Fatal(":2526 server must have TLSConfig==nil (so STARTTLS is not advertised)")
}
if s.plainSrv.TLSConfig == nil {
t.Fatal(":2525 server must keep TLSConfig (STARTTLS advertised)")
}
if err := s.Start(); err != nil {
t.Fatalf("Start: %v", err)
}
defer s.Close()
// Real EHLO: :2526 must NOT offer STARTTLS; :2525 must.
advertises := func(addr string) bool {
c, err := netsmtp.Dial(addr)
if err != nil {
t.Fatalf("dial %s: %v", addr, err)
}
defer c.Close()
if err := c.Hello("test.local"); err != nil {
t.Fatalf("EHLO %s: %v", addr, err)
}
ok, _ := c.Extension("STARTTLS")
return ok
}
if advertises(s.PlainNoTLSAddr()) {
t.Error(":2526 must NOT advertise STARTTLS over EHLO")
}
if !advertises(s.PlainAddr()) {
t.Error(":2525 must advertise STARTTLS over EHLO")
}
}
func TestServer_EndToEnd_STARTTLS(t *testing.T) {
fwd := &fakeForwarder{status: 200}
s, err := New(Options{
PlainAddr: "127.0.0.1:0",
TLSAddr: "127.0.0.1:0",
Policy: NewPolicy([]string{"felhom.eu"}),
Forwarder: fwd,
Logger: quietLogger(),
PlainAddr: "127.0.0.1:0",
TLSAddr: "127.0.0.1:0",
PlainNoTLSAddr: "127.0.0.1:0",
Policy: NewPolicy([]string{"felhom.eu"}),
Forwarder: fwd,
Logger: quietLogger(),
})
if err != nil {
t.Fatalf("New: %v", err)
controller/internal/mailrelay/server.go
+59 -15
View File
@@ -39,22 +39,25 @@ const forwardTimeout = 30 * time.Second
// Options configures the shim.
type Options struct {
PlainAddr string // plaintext + STARTTLS listener (default ":2525")
TLSAddr string // implicit-TLS listener (default ":2465")
ServiceName string // CN/SAN of the self-signed cert + SMTP greeting (e.g. "felhom-controller")
Policy *Policy // From-domain allowlist (required)
Forwarder Forwarder // hub forwarder (required)
Logger *log.Logger
PlainAddr string // plaintext + STARTTLS listener (default ":2525")
TLSAddr string // implicit-TLS listener (default ":2465")
PlainNoTLSAddr string // plaintext-only listener, STARTTLS NOT advertised (default ":2526")
ServiceName string // CN/SAN of the self-signed cert + SMTP greeting (e.g. "felhom-controller")
Policy *Policy // From-domain allowlist (required)
Forwarder Forwarder // hub forwarder (required)
Logger *log.Logger
}
// Server runs the two SMTP listeners.
// Server runs the three SMTP listeners.
type Server struct {
opts Options
tlsConf *tls.Config
plainSrv *smtp.Server
tlsSrv *smtp.Server
plainLn net.Listener
tlsLn net.Listener
opts Options
tlsConf *tls.Config
plainSrv *smtp.Server
tlsSrv *smtp.Server
plainNoTLSSrv *smtp.Server
plainLn net.Listener
tlsLn net.Listener
plainNoTLSLn net.Listener
}
// New builds the shim and its self-signed cert. It does not bind sockets — call Start.
@@ -71,6 +74,9 @@ func New(opts Options) (*Server, error) {
if opts.TLSAddr == "" {
opts.TLSAddr = ":2465"
}
if opts.PlainNoTLSAddr == "" {
opts.PlainNoTLSAddr = ":2526"
}
if opts.ServiceName == "" {
opts.ServiceName = "felhom-controller"
}
@@ -107,6 +113,19 @@ func New(opts Options) (*Server, error) {
s.tlsSrv.ReadTimeout = 60 * time.Second
s.tlsSrv.WriteTimeout = 60 * time.Second
// :2526 — plaintext, STARTTLS NOT advertised (TLSConfig stays nil ⇒ go-smtp omits the
// STARTTLS capability from EHLO). For clients that opportunistically upgrade to STARTTLS
// whenever it's offered AND then validate the cert with no skip-verify knob (cal.com /
// Nodemailer, nextcloud / Symfony Mailer): with no offer, they never attempt TLS. Accepted
// posture: plaintext on the single-tenant app Docker bridge only (never host/internet).
s.plainNoTLSSrv = smtp.NewServer(be)
s.plainNoTLSSrv.Addr = opts.PlainNoTLSAddr
s.plainNoTLSSrv.Domain = opts.ServiceName
s.plainNoTLSSrv.AllowInsecureAuth = true
s.plainNoTLSSrv.MaxMessageBytes = maxMessageBytes
s.plainNoTLSSrv.ReadTimeout = 60 * time.Second
s.plainNoTLSSrv.WriteTimeout = 60 * time.Second
return s, nil
}
@@ -123,10 +142,17 @@ func (s *Server) Start() error {
pl.Close()
return fmt.Errorf("mailrelay: listen TLS %s: %w", s.opts.TLSAddr, err)
}
s.plainLn, s.tlsLn = pl, tl
pn, err := net.Listen("tcp", s.opts.PlainNoTLSAddr)
if err != nil {
pl.Close()
tl.Close()
return fmt.Errorf("mailrelay: listen %s: %w", s.opts.PlainNoTLSAddr, err)
}
s.plainLn, s.tlsLn, s.plainNoTLSLn = pl, tl, pn
s.opts.Logger.Printf("[INFO] [mailrelay] plaintext+STARTTLS listener on %s", pl.Addr())
s.opts.Logger.Printf("[INFO] [mailrelay] implicit-TLS listener on %s", tl.Addr())
s.opts.Logger.Printf("[INFO] [mailrelay] plaintext-only (no STARTTLS) listener on %s", pn.Addr())
go func() {
if err := s.plainSrv.Serve(pl); err != nil && !isClosedErr(err) {
@@ -138,6 +164,11 @@ func (s *Server) Start() error {
s.opts.Logger.Printf("[ERROR] [mailrelay] implicit-TLS listener stopped: %v", err)
}
}()
go func() {
if err := s.plainNoTLSSrv.Serve(pn); err != nil && !isClosedErr(err) {
s.opts.Logger.Printf("[ERROR] [mailrelay] plaintext-only listener stopped: %v", err)
}
}()
return nil
}
@@ -157,7 +188,15 @@ func (s *Server) TLSAddr() string {
return s.opts.TLSAddr
}
// Close stops both listeners.
// PlainNoTLSAddr returns the bound plaintext-only (no-STARTTLS) address.
func (s *Server) PlainNoTLSAddr() string {
if s.plainNoTLSLn != nil {
return s.plainNoTLSLn.Addr().String()
}
return s.opts.PlainNoTLSAddr
}
// Close stops all listeners.
func (s *Server) Close() error {
var err error
if s.plainSrv != nil {
@@ -170,6 +209,11 @@ func (s *Server) Close() error {
err = e
}
}
if s.plainNoTLSSrv != nil {
if e := s.plainNoTLSSrv.Close(); e != nil {
err = e
}
}
return err
}