Files
selfpost/test/e2e/port25_client.go
T
mixandClaude Opus 5.5 8820294472 postfix: ETRN refused and not offered (audit S6)
Security audit 2026-10-17, finding S6 (low), stage 0 - proven from
outside: `ETRN <an inbound domain>` on port 25 answered "250 Queuing
started". smtpd_etrn_restrictions was empty (Postfix allows every client)
and fast_flush_domains = $relay_domains, so a stranger could flush the
deferred queue toward an inbound domain's upstream at will. Now
smtpd_etrn_restrictions=reject (etrn_cmd -> smtpd_check_etrn -> reject_code
554, Postfix 3.10.13 src/smtpd/smtpd.c) and smtpd_discard_ehlo_keywords=etrn.

e2e: testInboundRelay sends EHLO + ETRN for the inbound domain on port 25
and expects 554 and no ETRN in the EHLO reply (etrnPort25);
checkPostfixHardening reads both settings back. To be run on the server.

Docs: architecture.md § Postfix; CHANGELOG; plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-17 21:36:55 +03:00

165 lines
4.5 KiB
Go

package e2e
import (
"fmt"
"net"
"net/smtp"
"net/textproto"
"time"
)
// port25Addr is where compose.override.yml publishes port 25: no TLS required,
// no AUTH offered - a stranger's mail server talking to this one.
const port25Addr = "127.0.0.1:20025"
// deliverPort25 is one transaction on port 25 the way another mail server makes
// it: HELO, MAIL, RCPT, DATA with message as it stands. The result says at
// which stage it was refused, like attemptSend's.
func deliverPort25(from, to, message string) sendResult {
var res sendResult
conn, err := net.DialTimeout("tcp", port25Addr, 10*time.Second)
if err != nil {
res.dialErr = fmt.Errorf("dial %s: %w", port25Addr, err)
return res
}
c, err := smtp.NewClient(conn, selfpostHostname)
if err != nil {
res.dialErr = fmt.Errorf("smtp handshake: %w", err)
_ = conn.Close()
return res
}
defer c.Close()
if err := c.Hello("mx.stranger.e2e.test"); err != nil {
res.dialErr = err
return res
}
if err := c.Mail(from); err != nil {
res.mailErr = err
_ = c.Quit()
return res
}
if err := c.Rcpt(to); err != nil {
res.rcptErr = err
_ = c.Quit()
return res
}
w, err := c.Data()
if err != nil {
res.dataErr = err
_ = c.Quit()
return res
}
if _, err := w.Write([]byte(message)); err != nil {
res.dataErr = err
} else if err := w.Close(); err != nil {
res.dataErr = err
}
_ = c.Quit()
return res
}
// waitForPort25Ready polls port 25 until Postfix greets on it. A bare connect
// is not enough: Docker's proxy accepts on the published port whether or not
// anything listens behind it (seen on the stand, date not recorded - see
// waitForSMTPSReady).
func waitForPort25Ready(timeout time.Duration) error {
return waitFor("port 25 to greet", timeout, 500*time.Millisecond, func() (bool, error) {
conn, err := net.DialTimeout("tcp", port25Addr, 2*time.Second)
if err != nil {
return false, err
}
defer conn.Close()
_ = conn.SetReadDeadline(time.Now().Add(3 * time.Second))
buf := make([]byte, 4)
n, err := conn.Read(buf)
if err != nil {
return false, err
}
if string(buf[:n]) != "220 " {
return false, fmt.Errorf("greeting starts with %q", buf[:n])
}
return true, nil
})
}
// etrnPort25 sends EHLO and then ETRN domain on port 25 and returns ETRN's
// reply code and what EHLO offered.
func etrnPort25(domain string) (int, string, error) {
conn, err := net.DialTimeout("tcp", port25Addr, 10*time.Second)
if err != nil {
return 0, "", fmt.Errorf("dial %s: %w", port25Addr, err)
}
defer conn.Close()
_ = conn.SetDeadline(time.Now().Add(30 * time.Second))
tp := textproto.NewConn(conn)
if _, _, err := tp.ReadResponse(220); err != nil {
return 0, "", err
}
if err := tp.PrintfLine("EHLO mx.stranger.e2e.test"); err != nil {
return 0, "", err
}
_, ehlo, err := tp.ReadResponse(250)
if err != nil {
return 0, ehlo, err
}
if err := tp.PrintfLine("ETRN %s", domain); err != nil {
return 0, ehlo, err
}
code, _, err := tp.ReadResponse(0)
_ = tp.PrintfLine("QUIT")
if code != 0 {
err = nil // any code is the answer asked for
}
return code, ehlo, err
}
// deliverPort25Raw is deliverPort25 with the DATA bytes written as they
// stand. net/smtp's data writer would turn a bare LF into CRLF and stuff a
// lone "." (net/textproto, DotWriter), which is the very input this is for.
// It returns an error for a reply other than the one each step expects.
func deliverPort25Raw(from, to string, data []byte) error {
conn, err := net.DialTimeout("tcp", port25Addr, 10*time.Second)
if err != nil {
return fmt.Errorf("dial %s: %w", port25Addr, err)
}
defer conn.Close()
_ = conn.SetDeadline(time.Now().Add(60 * time.Second))
tp := textproto.NewConn(conn)
expect := func(code int, after string) error {
if _, _, err := tp.ReadResponse(code); err != nil {
return fmt.Errorf("after %s: %w", after, err)
}
return nil
}
if err := expect(220, "connect"); err != nil {
return err
}
for _, step := range []struct {
cmd string
code int
}{
{"HELO mx.stranger.e2e.test", 250},
{"MAIL FROM:<" + from + ">", 250},
{"RCPT TO:<" + to + ">", 250},
{"DATA", 354},
} {
if err := tp.PrintfLine("%s", step.cmd); err != nil {
return fmt.Errorf("%s: %w", step.cmd, err)
}
if err := expect(step.code, step.cmd); err != nil {
return err
}
}
if _, err := tp.W.Write(data); err != nil {
return fmt.Errorf("DATA content: %w", err)
}
if err := tp.W.Flush(); err != nil {
return fmt.Errorf("DATA content: %w", err)
}
if err := expect(250, "end of data"); err != nil {
return err
}
_ = tp.PrintfLine("QUIT")
return nil
}