From 25d9fe85a82e689c513e7c80d4ed010d2e00c2cd Mon Sep 17 00:00:00 2001
From: John Peacock <jpeacock@cpan.org>
Date: Thu, 22 Jun 2006 14:48:48 +0000
Subject: [PATCH] Two patches from Robin Johnson: Add SSL encryption method to
 FROM: header line. Add new tls_before_auth configuration to hide AUTH until
 TLS is established.

git-svn-id: https://svn.perl.org/qpsmtpd/branches/0.3x@645 958fd67b-6ff1-0310-b445-bb7760255be9
---
 Changes                       |  4 ++++
 README                        |  5 +++++
 config.sample/tls_before_auth |  2 ++
 lib/Qpsmtpd/SMTP.pm           | 11 +++++++++--
 4 files changed, 20 insertions(+), 2 deletions(-)
 create mode 100644 config.sample/tls_before_auth

diff --git a/Changes b/Changes
index 8247ed4..250d3a8 100644
--- a/Changes
+++ b/Changes
@@ -1,5 +1,9 @@
 0.33
 
+  Add SSL encryption method to header to mirror other qmail/SSL patches.
+  Add tls_before_auth to suppress AUTH unless TLS has already been 
+  established (Robin Johnson).
+
   Fix "help" command when there's no "smtpgreeting" configured (the default)
   (Thanks to Thomas Ogrisegg)
 
diff --git a/README b/README
index 53c3fc9..0e2979d 100644
--- a/README
+++ b/README
@@ -176,6 +176,11 @@ smtpd uses during the data transactions. If this file doesnt exist, it
 will default to use $ENV{HOME}/tmp/. This directory should be set with
 a mode of 700 and owned by the smtpd user.
 
+=item tls_before_auth
+
+If this file contains anything except a 0 on the first noncomment line, then 
+AUTH will not be offered unless TLS/SSL are in place, either with STARTTLS, 
+or SMTP-SSL on port 465.
 
 =item everything (?) that qmail-smtpd supports. 
 
diff --git a/config.sample/tls_before_auth b/config.sample/tls_before_auth
new file mode 100644
index 0000000..d9084c2
--- /dev/null
+++ b/config.sample/tls_before_auth
@@ -0,0 +1,2 @@
+# change the next line to 0 if you want to offer AUTH without TLS
+1
diff --git a/lib/Qpsmtpd/SMTP.pm b/lib/Qpsmtpd/SMTP.pm
index 577d7bf..cdace58 100644
--- a/lib/Qpsmtpd/SMTP.pm
+++ b/lib/Qpsmtpd/SMTP.pm
@@ -219,7 +219,9 @@ HOOK: foreach my $hook ( keys %{$self->{hooks}} ) {
         }
     }
 
-    if ( %auth_mechanisms ) {
+    # Check if we should only offer AUTH after TLS is completed
+    my $tls_before_auth = ($self->config('tls_before_auth') ? ($self->config('tls_before_auth'))[0] && $self->transaction->notes('tls_enabled') : 0); 
+    if ( %auth_mechanisms && !$tls_before_auth) {
         push @capabilities, 'AUTH '.join(" ",keys(%auth_mechanisms));    
         $self->{_commands}->{'auth'} = "";
     }
@@ -248,6 +250,9 @@ sub auth {
         and $self->{_auth} == OK );
     return $self->respond( 503, "AUTH not defined for HELO" )
       if ( $self->connection->hello eq "helo" );
+    return $self->respond( 503, "SSL/TLS required before AUTH" )
+      if ( ($self->config('tls_before_auth'))[0] 
+      	and $self->transaction->notes('tls_enabled') );
 
     return $self->{_auth} = Qpsmtpd::Auth::SASL( $self, $arg, @stuff );
 }
@@ -584,13 +589,15 @@ sub data {
   $self->transaction->header($header);
 
   my $smtp = $self->connection->hello eq "ehlo" ? "ESMTP" : "SMTP";
+  my $sslheader = (defined $self->connection->notes('tls_enabled') and $self->connection->notes('tls_enabled')) ? 
+    "(".$self->connection->notes('tls_socket')->get_cipher()." encrypted) " : "";
   my $authheader = (defined $self->{_auth} and $self->{_auth} == OK) ?
     "(smtp-auth username $self->{_auth_user}, mechanism $self->{_auth_mechanism})\n" : "";
 
   $header->add("Received", "from ".$self->connection->remote_info
                ." (HELO ".$self->connection->hello_host . ") (".$self->connection->remote_ip
                . ")\n  $authheader  by ".$self->config('me')." (qpsmtpd/".$self->version
-               .") with $smtp; ". (strftime('%a, %d %b %Y %H:%M:%S %z', localtime)),
+               .") with $sslheader$smtp; ". (strftime('%a, %d %b %Y %H:%M:%S %z', localtime)),
                0);
 
   # if we get here without seeing a terminator, the connection is