foxcpp / foxcpp/maddy

Error Message should Validate Username is in Domain for Authentication Error

オープン
#649 コメント 1 件 リアクション 0 件 担当者 0 名 GitHub で見る
bug
主要言語
Go
スター
6.1k
フォーク
327
PR マージ指標
30日以内にマージされた PR はありません

説明

# Describe the bug

I am setting up and testing Maddy for the first time.

It appears I made a typo and missed off a character in our domain when testing via Thunderbird. This means that Thunderbird was trying to authenticate with a user whose email address' domain did no match the domain Maddy was configured to use.

From the docs, as far as I understand, all accounts must use and authenticate with a full email address, and I presume this ought to be an address under the domain Maddy is configured for. Therefore, an address under a different domain would be an error (please correct me if I am wrong). If this is the case, then I feel a different error message would be helpful - this is not so much an error in authenticating a user, as one of an invalid user. I think, if such addresses would be illegal, then testing the given username against the mailserver's domain and outputting a message specifically for this scenario could not only help in finding configuration mistakes, but also in identifying attempted attacks and the like - if someone were flooding the server with invalid addresses, we could filter those out easily.

Thanks!

# Steps to reproduce

Set up as container for 0.7.0 as in instructions
```
maddy creds create postmaster@example.org
maddy imap-acct create postmaster@example.org
```

Accidentally send SMTP message using account `postmaster@example.or`, or some other typo. Or try to sync with IMAP.

# Log files

```
imap: authentication failed {"reason":"no auth. provider accepted creds, last err: unknown credentials","src_ip":"1.2.3.4:12345","username":"postmaster.example.or"}
```
[Location]( https://github.com/foxcpp/maddy/blob/master/internal/auth/sasl.go#L114 )

# Configuration file
Basically the same as the defualt, all we have changed thus far is TLS certificate path and domain name.

# Environment information

* maddy version: 0.7.0

コントリビューションガイド

コントリビューションガイドを開く

調査の方向性

internal/auth/sasl.go の114行目付近から始め、ドメインが設定済みのドメインと異なるユーザー名で認証試行を再現します。そのケースで期待される処理とエラー文言を確認します。動作がカバーされ、結果のメッセージで無効なドメインと一般的な無効な認証情報が区別されれば完了です。

索引モデルが issue の本文から書いたものです。

評価

技術スタック
go
領域
authentication
issue の種類
バグ
難易度
3/5
見積もり時間
1〜2日
活発さ
停滞
明瞭さ
おおむね明確
初心者へのやさしさ
35/100

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。