emersion / go-smtp

📤 An SMTP client & server library written in Go
MIT License
1.72k stars 216 forks source link

Fix anonymous authentication with empty trace information string #259

Closed albertony closed 5 months ago

albertony commented 5 months ago

With anonymous authentication according to RFC4505 the trace information string is optional, and SMTP authentication extension described in RFC4954 states that:

If the client is transmitting an initial response of zero
length, it MUST instead transmit the response as a single
equals sign ("=").  This indicates that the response is
present, but contains no data.

Fixes #258

emersion commented 5 months ago

These changes look good to me overall, just one comment: I think we probably need to also handle = when sent as a regular response (not an initial response)? See the other base64.StdEncoding.DecodeString call done below in the same function, inside the for loop.

albertony commented 5 months ago

I agree. Force pushed an update. I tested it with openssl s_client against my go-smtp based test server, and I assume a sequence like this is what you were thinking of:

EHLO localhost
250-Hello localhost
250-PIPELINING
250-8BITMIME
250-ENHANCEDSTATUSCODES
250-CHUNKING
250-AUTH ANONYMOUS
250-SIZE 1024
250 LIMITS RCPTMAX=10
AUTH ANONYMOUS
334
=

PTAL

emersion commented 5 months ago

Oh, CI is unhappy now… Maybe the test actually tests the no initial response case, as opposed to the empty initial response one?

emersion commented 5 months ago

Seems like it:

func (toServerEmptyAuth) Start() (proto string, toServer []byte, err error) {
    return "FOOAUTH", nil, nil
}
emersion commented 5 months ago

I've removed the test changes, and fixed up the outdated comments in 029f7513c5fe.

albertony commented 5 months ago

Ahhh, real sorry about that! I've been running that many times, and adjusted it in a previous iteration, but probably forgot about it during these last iterations. Thanks for fixing it (I'm not at computer right now anyway).

emersion commented 5 months ago

Yeah, no worries whatsoever, it's been a ride untangling this mess!