mix
b4a9b93cf2
test / test (push) Waiting to run
Application client IP allow-list restricts which addresses may submit as a SASL login; level-2 rate limits override the domain ceiling per application (higher or lower, capped at L1). Migration 0009, authips form, milter enforcement, export/import, and operator docs. Co-authored-by: Cursor <cursoragent@cursor.com>
32 lines
861 B
Go
32 lines
861 B
Go
package milter
|
|
|
|
import (
|
|
"errors"
|
|
"log"
|
|
|
|
"github.com/mixeme/selfpost/internal/store"
|
|
)
|
|
|
|
// authIPAllowed reports whether the authenticated application may submit from
|
|
// the connecting client IP. When the application has no IP restriction, or the
|
|
// client IP is not known, the check passes. Store errors are fail-open (see
|
|
// overLimit).
|
|
func (s *session) authIPAllowed() bool {
|
|
if s.login == "" || s.clientIP == "" {
|
|
return true
|
|
}
|
|
a, err := s.rec.ApplicationByLogin(s.login)
|
|
if err != nil {
|
|
if errors.Is(err, store.ErrApplicationNotFound) {
|
|
return true
|
|
}
|
|
log.Printf("journal-milter: auth IP lookup application %q: %v (fail-open)", s.login, err)
|
|
return true
|
|
}
|
|
if a.AllowsAuthFromIP(s.clientIP) {
|
|
return true
|
|
}
|
|
log.Printf("journal-milter: application %q refused from %s — client IP not allowed", s.login, s.clientIP)
|
|
return false
|
|
}
|