You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@james.apache.org by rc...@apache.org on 2024/01/19 03:17:23 UTC
(james-project) branch 3.8.x updated: [FIX] SMTP stack should recompute relaying rights upon PROXY message
This is an automated email from the ASF dual-hosted git repository.
rcordier pushed a commit to branch 3.8.x
in repository https://gitbox.apache.org/repos/asf/james-project.git
The following commit(s) were added to refs/heads/3.8.x by this push:
new ea70b25d83 [FIX] SMTP stack should recompute relaying rights upon PROXY message
ea70b25d83 is described below
commit ea70b25d8390d4682fecb1205b3af2d47c5c36a0
Author: Benoit TELLIER <bt...@linagora.com>
AuthorDate: Thu Jan 18 10:26:11 2024 +0100
[FIX] SMTP stack should recompute relaying rights upon PROXY message
Otherwise, the relaying information is taken from the
proxy and not from the source.
---
.../james/protocols/smtp/SMTPSessionImpl.java | 17 +-
.../james/smtpserver/SMTPProxyProtocolTest.java | 208 +++++++++++++++++++++
.../src/test/resources/smtpserver-proxy.xml | 52 ++++++
3 files changed, 276 insertions(+), 1 deletion(-)
diff --git a/protocols/smtp/src/main/java/org/apache/james/protocols/smtp/SMTPSessionImpl.java b/protocols/smtp/src/main/java/org/apache/james/protocols/smtp/SMTPSessionImpl.java
index 0c6c6eedc7..b5b35ac5c9 100644
--- a/protocols/smtp/src/main/java/org/apache/james/protocols/smtp/SMTPSessionImpl.java
+++ b/protocols/smtp/src/main/java/org/apache/james/protocols/smtp/SMTPSessionImpl.java
@@ -23,6 +23,7 @@ import java.util.Optional;
import org.apache.james.protocols.api.ProtocolSessionImpl;
import org.apache.james.protocols.api.ProtocolTransport;
+import org.apache.james.protocols.api.ProxyInformation;
import org.apache.james.protocols.api.Response;
/**
@@ -41,7 +42,15 @@ public class SMTPSessionImpl extends ProtocolSessionImpl implements SMTPSession
public SMTPSessionImpl(ProtocolTransport transport, SMTPConfiguration config) {
super(transport, config);
- relayingAllowed = config.isRelayingAllowed(getRemoteAddress().getAddress().getHostAddress());
+ relayingAllowed = computeRelayingAllowed(config);
+ }
+
+ private Boolean computeRelayingAllowed(SMTPConfiguration config) {
+ return Optional.ofNullable(getRemoteAddress())
+ .flatMap(address -> Optional.ofNullable(address.getAddress()))
+ .flatMap(address -> Optional.ofNullable(address.getHostAddress()))
+ .map(config::isRelayingAllowed)
+ .orElse(false);
}
@Override
@@ -49,6 +58,12 @@ public class SMTPSessionImpl extends ProtocolSessionImpl implements SMTPSession
return relayingAllowed;
}
+ @Override
+ public void setProxyInformation(ProxyInformation proxyInformation) {
+ super.setProxyInformation(proxyInformation);
+ relayingAllowed = computeRelayingAllowed((SMTPConfiguration) config);
+ }
+
@Override
public void resetState() {
// remember the ehlo mode between resets
diff --git a/server/protocols/protocols-smtp/src/test/java/org/apache/james/smtpserver/SMTPProxyProtocolTest.java b/server/protocols/protocols-smtp/src/test/java/org/apache/james/smtpserver/SMTPProxyProtocolTest.java
new file mode 100644
index 0000000000..6269fc20a5
--- /dev/null
+++ b/server/protocols/protocols-smtp/src/test/java/org/apache/james/smtpserver/SMTPProxyProtocolTest.java
@@ -0,0 +1,208 @@
+/****************************************************************
+ * Licensed to the Apache Software Foundation (ASF) under one *
+ * or more contributor license agreements. See the NOTICE file *
+ * distributed with this work for additional information *
+ * regarding copyright ownership. The ASF licenses this file *
+ * to you under the Apache License, Version 2.0 (the *
+ * "License"); you may not use this file except in compliance *
+ * with the License. You may obtain a copy of the License at *
+ * *
+ * http://www.apache.org/licenses/LICENSE-2.0 *
+ * *
+ * Unless required by applicable law or agreed to in writing, *
+ * software distributed under the License is distributed on an *
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY *
+ * KIND, either express or implied. See the License for the *
+ * specific language governing permissions and limitations *
+ * under the License. *
+ ****************************************************************/
+package org.apache.james.smtpserver;
+
+import static org.apache.james.jmap.JMAPTestingConstants.DOMAIN;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.nio.ByteBuffer;
+import java.nio.channels.SocketChannel;
+import java.nio.charset.StandardCharsets;
+
+import org.apache.commons.configuration2.BaseHierarchicalConfiguration;
+import org.apache.james.UserEntityValidator;
+import org.apache.james.core.Domain;
+import org.apache.james.core.Username;
+import org.apache.james.dnsservice.api.DNSService;
+import org.apache.james.dnsservice.api.InMemoryDNSService;
+import org.apache.james.domainlist.api.DomainList;
+import org.apache.james.domainlist.lib.DomainListConfiguration;
+import org.apache.james.domainlist.memory.MemoryDomainList;
+import org.apache.james.filesystem.api.FileSystem;
+import org.apache.james.mailbox.Authorizator;
+import org.apache.james.mailrepository.api.MailRepositoryStore;
+import org.apache.james.mailrepository.api.Protocol;
+import org.apache.james.mailrepository.memory.MailRepositoryStoreConfiguration;
+import org.apache.james.mailrepository.memory.MemoryMailRepository;
+import org.apache.james.mailrepository.memory.MemoryMailRepositoryStore;
+import org.apache.james.mailrepository.memory.MemoryMailRepositoryUrlStore;
+import org.apache.james.mailrepository.memory.SimpleMailRepositoryLoader;
+import org.apache.james.metrics.api.Metric;
+import org.apache.james.metrics.api.MetricFactory;
+import org.apache.james.metrics.tests.RecordingMetricFactory;
+import org.apache.james.protocols.api.utils.ProtocolServerUtils;
+import org.apache.james.protocols.lib.mock.MockProtocolHandlerLoader;
+import org.apache.james.queue.api.MailQueueFactory;
+import org.apache.james.queue.api.RawMailQueueItemDecoratorFactory;
+import org.apache.james.queue.memory.MemoryMailQueueFactory;
+import org.apache.james.rrt.api.AliasReverseResolver;
+import org.apache.james.rrt.api.CanSendFrom;
+import org.apache.james.rrt.api.RecipientRewriteTable;
+import org.apache.james.rrt.api.RecipientRewriteTableConfiguration;
+import org.apache.james.rrt.lib.AliasReverseResolverImpl;
+import org.apache.james.rrt.lib.CanSendFromImpl;
+import org.apache.james.rrt.memory.MemoryRecipientRewriteTable;
+import org.apache.james.server.core.configuration.Configuration;
+import org.apache.james.server.core.configuration.FileConfigurationProvider;
+import org.apache.james.server.core.filesystem.FileSystemImpl;
+import org.apache.james.smtpserver.netty.SMTPServer;
+import org.apache.james.smtpserver.netty.SmtpMetricsImpl;
+import org.apache.james.user.api.UsersRepository;
+import org.apache.james.user.memory.MemoryUsersRepository;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import com.google.common.collect.ImmutableList;
+import com.google.inject.TypeLiteral;
+
+class SMTPProxyProtocolTest {
+ public static final String LOCAL_DOMAIN = "example.local";
+ public static final Username BOB = Username.of("bob@localhost");
+ public static final String PASSWORD = "bobpwd";
+
+ protected MemoryDomainList domainList;
+ protected MemoryUsersRepository usersRepository;
+ protected SMTPServerTest.AlterableDNSServer dnsServer;
+ protected MemoryMailRepositoryStore mailRepositoryStore;
+ protected FileSystemImpl fileSystem;
+ protected Configuration configuration;
+ protected MockProtocolHandlerLoader chain;
+ protected MemoryMailQueueFactory queueFactory;
+ protected MemoryMailQueueFactory.MemoryCacheableMailQueue queue;
+
+ private SMTPServer smtpServer;
+
+ @BeforeEach
+ void setUp() throws Exception {
+ domainList = new MemoryDomainList(new InMemoryDNSService());
+ domainList.configure(DomainListConfiguration.DEFAULT);
+
+ domainList.addDomain(Domain.of(LOCAL_DOMAIN));
+ domainList.addDomain(Domain.of("examplebis.local"));
+ usersRepository = MemoryUsersRepository.withVirtualHosting(domainList);
+ usersRepository.addUser(BOB, PASSWORD);
+
+ createMailRepositoryStore();
+
+ setUpFakeLoader();
+ setUpSMTPServer();
+ }
+
+ protected void createMailRepositoryStore() throws Exception {
+ configuration = Configuration.builder()
+ .workingDirectory("../")
+ .configurationFromClasspath()
+ .build();
+ fileSystem = new FileSystemImpl(configuration.directories());
+ MemoryMailRepositoryUrlStore urlStore = new MemoryMailRepositoryUrlStore();
+
+ MailRepositoryStoreConfiguration configuration = MailRepositoryStoreConfiguration.forItems(
+ new MailRepositoryStoreConfiguration.Item(
+ ImmutableList.of(new Protocol("memory")),
+ MemoryMailRepository.class.getName(),
+ new BaseHierarchicalConfiguration()));
+
+ mailRepositoryStore = new MemoryMailRepositoryStore(urlStore, new SimpleMailRepositoryLoader(), configuration);
+ mailRepositoryStore.init();
+ }
+
+ protected SMTPServer createSMTPServer(SmtpMetricsImpl smtpMetrics) {
+ return new SMTPServer(smtpMetrics);
+ }
+
+ protected void setUpSMTPServer() {
+ SmtpMetricsImpl smtpMetrics = mock(SmtpMetricsImpl.class);
+ when(smtpMetrics.getCommandsMetric()).thenReturn(mock(Metric.class));
+ when(smtpMetrics.getConnectionMetric()).thenReturn(mock(Metric.class));
+ smtpServer = createSMTPServer(smtpMetrics);
+ smtpServer.setDnsService(dnsServer);
+ smtpServer.setFileSystem(fileSystem);
+ smtpServer.setProtocolHandlerLoader(chain);
+ }
+
+ protected void setUpFakeLoader() {
+ dnsServer = new SMTPServerTest.AlterableDNSServer();
+
+ MemoryRecipientRewriteTable rewriteTable = new MemoryRecipientRewriteTable();
+ rewriteTable.setConfiguration(RecipientRewriteTableConfiguration.DEFAULT_ENABLED);
+ AliasReverseResolver aliasReverseResolver = new AliasReverseResolverImpl(rewriteTable);
+ CanSendFrom canSendFrom = new CanSendFromImpl(rewriteTable, aliasReverseResolver);
+ queueFactory = new MemoryMailQueueFactory(new RawMailQueueItemDecoratorFactory());
+ queue = queueFactory.createQueue(MailQueueFactory.SPOOL);
+
+ chain = MockProtocolHandlerLoader.builder()
+ .put(binder -> binder.bind(DomainList.class).toInstance(domainList))
+ .put(binder -> binder.bind(new TypeLiteral<MailQueueFactory<?>>() {}).toInstance(queueFactory))
+ .put(binder -> binder.bind(RecipientRewriteTable.class).toInstance(rewriteTable))
+ .put(binder -> binder.bind(CanSendFrom.class).toInstance(canSendFrom))
+ .put(binder -> binder.bind(FileSystem.class).toInstance(fileSystem))
+ .put(binder -> binder.bind(MailRepositoryStore.class).toInstance(mailRepositoryStore))
+ .put(binder -> binder.bind(DNSService.class).toInstance(dnsServer))
+ .put(binder -> binder.bind(UsersRepository.class).toInstance(usersRepository))
+ .put(binder -> binder.bind(MetricFactory.class).to(RecordingMetricFactory.class))
+ .put(binder -> binder.bind(UserEntityValidator.class).toInstance(UserEntityValidator.NOOP))
+ .put(binder -> binder.bind(Authorizator.class).toInstance((userId, otherUserId) -> Authorizator.AuthorizationState.ALLOWED))
+ .build();
+ }
+
+ @AfterEach
+ void tearDown() {
+ smtpServer.destroy();
+ }
+
+ @Test
+ void rejectFutureReleaseUsageWhenUnauthenticated() throws Exception {
+ smtpServer.configure(FileConfigurationProvider.getConfig(
+ ClassLoader.getSystemResourceAsStream("smtpserver-proxy.xml")));
+ smtpServer.init();
+
+ String protocol = "TCP4";
+ String source = "255.255.255.254";
+ String destination = "255.255.255.255";
+
+ SocketChannel server = SocketChannel.open();
+ InetSocketAddress bindedAddress = new ProtocolServerUtils(smtpServer).retrieveBindedAddress();
+ server.connect(bindedAddress);
+ readBytes(server);
+
+ String proxyMessage = String.format("PROXY %s %s %s %d %d\r\n", protocol, source, destination, 65535, 65535);
+ server.write(ByteBuffer.wrap((proxyMessage).getBytes(StandardCharsets.UTF_8)));
+ server.write(ByteBuffer.wrap(("EHLO <" + DOMAIN + ">\r\n").getBytes(StandardCharsets.UTF_8)));
+ readBytes(server);
+ server.write(ByteBuffer.wrap(("MAIL FROM: <user@" + DOMAIN + ">\r\n").getBytes(StandardCharsets.UTF_8)));
+ readBytes(server);
+ server.write(ByteBuffer.wrap(("RCPT TO: <user@" + DOMAIN + ">\r\n").getBytes(StandardCharsets.UTF_8)));
+
+ assertThat(new String(readBytes(server))).contains("530 5.7.1 Authentication Required");
+ }
+
+ private byte[] readBytes(SocketChannel channel) throws IOException {
+ ByteBuffer line = ByteBuffer.allocate(1024);
+ channel.read(line);
+ line.rewind();
+ byte[] bline = new byte[line.remaining()];
+ line.get(bline);
+ return bline;
+ }
+}
diff --git a/server/protocols/protocols-smtp/src/test/resources/smtpserver-proxy.xml b/server/protocols/protocols-smtp/src/test/resources/smtpserver-proxy.xml
new file mode 100644
index 0000000000..671b7963ba
--- /dev/null
+++ b/server/protocols/protocols-smtp/src/test/resources/smtpserver-proxy.xml
@@ -0,0 +1,52 @@
+<?xml version="1.0"?>
+
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+ -->
+
+<!-- Read https://james.apache.org/server/config-smtp-lmtp.html#SMTP_Configuration for further details -->
+
+ <smtpserver enabled="true">
+ <bind>0.0.0.0:0</bind>
+ <connectionBacklog>200</connectionBacklog>
+ <tls socketTLS="false" startTLS="false">
+ <keystore>file://conf/keystore</keystore>
+ <secret>james72laBalle</secret>
+ <provider>org.bouncycastle.jce.provider.BouncyCastleProvider</provider>
+ <algorithm>SunX509</algorithm>
+ </tls>
+ <connectiontimeout>360</connectiontimeout>
+ <connectionLimit>0</connectionLimit>
+ <connectionLimitPerIP>0</connectionLimitPerIP>
+ <auth>
+ <announce>forUnauthorizedAddresses</announce>
+ <requireSSL>false</requireSSL>
+ </auth>
+ <authorizedAddresses>127.0.0.0/8</authorizedAddresses>
+ <verifyIdentity>true</verifyIdentity>
+ <maxmessagesize>0</maxmessagesize>
+ <addressBracketsEnforcement>true</addressBracketsEnforcement>
+ <smtpGreeting>Apache JAMES awesome SMTP Server</smtpGreeting>
+ <handlerchain>
+ <handler class="org.apache.james.smtpserver.CoreCmdHandlerLoader"/>
+ </handlerchain>
+ <gracefulShutdown>false</gracefulShutdown>
+ <proxyRequired>true</proxyRequired>
+ </smtpserver>
+
+
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@james.apache.org
For additional commands, e-mail: notifications-help@james.apache.org