inbuxa/inbuxa-server
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases 2 Wiki Activity

Legacy sign-in is refused while the switch is off (LP-6)

Browse Source 
The second lock. While legacy mail protocols are off, a sign-in over IMAP,
POP3, ManageSieve or SMTP AUTH is refused for every account, so a listener
that exists by mistake -- or submission, which the SMTP lock keeps open --
still lets nobody in.

The check sits at the top of each protocol's sign-in, before the
credentials are looked at. So the answer is the same for a right password,
a wrong one and an account that doesn't exist; it isn't auth.failed, so it
counts nothing against the account and never feeds the auto-ban; and the
session stays open, since the mail app is being told, not thrown off.

Mail apps read the spec's words (LP-12, at server scope):

  IMAP         NO [ALERT] This server allows only INBUXA webmail and JMAP
               apps. This mail app can't sign in.
  POP3         -ERR [AUTH] ...the same...
  ManageSieve  NO "This server allows only INBUXA webmail and JMAP apps."
  SMTP         535 5.7.0 This server allows only INBUXA webmail and JMAP
               apps. This mail app can't send.

SMTP AUTH is refused on every SMTP listener, port 25 included: only mail
apps authenticate, so inbound delivery is untouched. LMTP is left alone.

The policy is read from the store on each sign-in rather than cached, so
every node of a cluster answers the same the moment the switch turns.

Each refusal raises a new event, auth.legacy-protocol-refused (id 642, info
level, also in the packaged schema), with the protocol as source, the
policy's scope and the domain -- never the account. The session adds the
listener and remote IP.

tests/e2e/legacy_protocols.py now also proves, on a running server: a
normal IMAP and submission sign-in works with the switch on, before and
after; while off, submission refuses the right password and six wrong ones
with the same words and without hanging up; and an IMAP listener created by
mistake while off refuses the right password, a wrong one and an account
that doesn't exist. All 33 checks pass. SMTP sign-ins in the script wait
out a second first: every connection arrives from Docker's gateway, and the
stock inbound throttle takes five a second from one IP.
This commit is contained in:
jcoffey-dev
2026-09-21 09:49:40 -07:00
parent 3ce50abcaa
commit 04252000da
10 changed files with 337 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/common/src/network/legacy.rs
+152
View File
@@ -17,11 +17,16 @@
//! back on the next restart. Opening puts the object back first and then
//! spawns, for the same reason in reverse.
//!
//! Sign-in is the second lock (LP-6): while the switch is off, a sign-in over
//! a legacy protocol is refused before any password is looked at, so a
//! listener that exists by mistake still lets nobody in.
//!
//! Nothing here touches the host's firewall, NAT port-forwards or any proxy
//! (LP-20). The server stops answering; what still routes the port is the
//! operator's to reconcile.
use crate::{Server, config::server::Listeners, network::TcpAcceptor};
use directory::Credentials;
use inbuxa_features::security::{
listeners,
protocol_policy::{self, ProtocolPolicy, SavedListener},
@@ -209,3 +214,150 @@ impl Server {
.collect())
}
}
/// A protocol a mail app signs in over, which the switch refuses (LP-6).
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum LegacyProtocol {
Imap,
Pop3,
ManageSieve,
/// SMTP AUTH, on any SMTP listener: only mail apps authenticate, so
/// inbound delivery is untouched (LP-3).
Submission,
}
impl LegacyProtocol {
pub fn as_str(&self) -> &'static str {
match self {
LegacyProtocol::Imap => "imap",
LegacyProtocol::Pop3 => "pop3",
LegacyProtocol::ManageSieve => "manageSieve",
LegacyProtocol::Submission => "submission",
}
}
/// What the mail app is told, at server scope (LP-12, LP-6). Each
/// protocol's own framing — IMAP's `[ALERT]`, ManageSieve's quoting —
/// is added by its session; POP3 carries `[AUTH]` in the text, since its
/// errors have no separate code, and SMTP is the whole reply line.
pub fn refusal(&self) -> &'static str {
match self {
LegacyProtocol::Imap => {
"This server allows only INBUXA webmail and JMAP apps. This mail app can't sign in."
}
LegacyProtocol::Pop3 => {
"[AUTH] This server allows only INBUXA webmail and JMAP apps. This mail app can't sign in."
}
LegacyProtocol::ManageSieve => "This server allows only INBUXA webmail and JMAP apps.",
LegacyProtocol::Submission => {
"535 5.7.0 This server allows only INBUXA webmail and JMAP apps. This mail app can't send.\r\n"
}
}
}
/// The refusal as an error: `auth.legacy-protocol-refused`, not
/// `auth.failed`, so it never counts against the account or feeds the
/// auto-ban (LP-11). It names the protocol and the domain, never the
/// account; the session it is raised in adds the remote IP.
pub fn refused(&self, credentials: &Credentials) -> trc::Error {
trc::AuthEvent::LegacyProtocolRefused
.into_err()
.details(self.refusal())
.ctx(trc::Key::Source, self.as_str())
.ctx(trc::Key::Policy, "server")
.ctx_opt(trc::Key::Domain, domain_of(credentials))
}
}
/// The domain a sign-in is for, from the name it gives, if it gives one.
fn domain_of(credentials: &Credentials) -> Option<String> {
let username = match credentials {
Credentials::Basic { username, .. } => Some(username.as_str()),
Credentials::Bearer { username, .. } => username.as_deref(),
}?;
username
.rsplit_once('@')
.map(|(_, domain)| domain.trim().to_lowercase())
.filter(|domain| !domain.is_empty())
}
impl Server {
/// Refuses a sign-in over a legacy protocol while the server-wide switch
/// is off (LP-6). Called before the credentials are checked, so the
/// answer is the same for a right password, a wrong one and an account
/// that doesn't exist (LP-11).
///
/// Read from the store on each sign-in rather than cached, so every node
/// of a cluster answers the same the moment the switch turns.
pub async fn refuse_legacy_sign_in(
&self,
protocol: LegacyProtocol,
credentials: &Credentials,
) -> trc::Result<()> {
if self.protocol_policy().await?.legacy_protocols.is_disabled() {
Err(protocol.refused(credentials))
} else {
Ok(())
}
}
}
#[cfg(test)]
mod tests {
use super::*;
fn basic(username: &str) -> Credentials {
Credentials::Basic {
username: username.to_string(),
secret: "wrong or right, it is never read".to_string(),
mfa_token: None,
}
}
#[test]
fn refusals_read_as_the_spec_writes_them() {
// LP-12, with "Your organization" read as "This server" (LP-6).
assert_eq!(
LegacyProtocol::Imap.refusal(),
"This server allows only INBUXA webmail and JMAP apps. This mail app can't sign in."
);
assert!(
LegacyProtocol::Pop3
.refusal()
.starts_with("[AUTH] This server allows")
);
assert_eq!(
LegacyProtocol::ManageSieve.refusal(),
"This server allows only INBUXA webmail and JMAP apps."
);
assert_eq!(
LegacyProtocol::Submission.refusal(),
"535 5.7.0 This server allows only INBUXA webmail and JMAP apps. This mail app can't send.\r\n"
);
}
#[test]
fn a_refusal_is_not_a_failed_sign_in() {
let err = LegacyProtocol::Imap.refused(&basic("[email protected]"));
assert!(err.matches(trc::EventType::Auth(trc::AuthEvent::LegacyProtocolRefused)));
assert!(!err.matches(trc::EventType::Auth(trc::AuthEvent::Failed)));
// The session stays open: the mail app is told, not thrown off.
assert!(!err.must_disconnect());
assert!(err.should_write_err());
assert_eq!(err.value_as_str(trc::Key::Domain), Some("example.org"));
assert_eq!(err.value_as_str(trc::Key::Source), Some("imap"));
assert_eq!(err.value_as_str(trc::Key::AccountName), None);
}
#[test]
fn the_domain_comes_from_the_name_given() {
assert_eq!(domain_of(&basic("[email protected]")), Some("b.test".to_string()));
assert_eq!(domain_of(&basic("no-domain")), None);
assert_eq!(domain_of(&basic("trailing@")), None);
let bearer = Credentials::Bearer {
username: None,
token: "t".to_string(),
};
assert_eq!(domain_of(&bearer), None);
}
}
crates/imap/src/op/authenticate.rs
+9 -1
View File
@@ -2,12 +2,14 @@
* SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
*
* SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
*
* Modified by Coffey Labs in 2026 for INBUXA.
*/
use crate::core::{Session, SessionData, State};
use common::{
auth::AuthRequest,
network::{SessionStream, limiter::LimiterResult},
network::{SessionStream, legacy::LegacyProtocol, limiter::LimiterResult},
};
use directory::Credentials;
use imap_proto::{
@@ -67,6 +69,12 @@ impl<T: SessionStream> Session<T> {
}
pub async fn authenticate(&mut self, credentials: Credentials, tag: String) -> trc::Result<()> {
// inbuxa: legacy-protocols LP-6, before the password is looked at
self.server
.refuse_legacy_sign_in(LegacyProtocol::Imap, &credentials)
.await
.map_err(|err| err.code(ResponseCode::Alert).id(tag.clone()))?;
// Authenticate
let access_token = self
.server
crates/managesieve/src/op/authenticate.rs
+8 -1
View File
@@ -2,12 +2,14 @@
* SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
*
* SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
*
* Modified by Coffey Labs in 2026 for INBUXA.
*/
use crate::core::{Command, Session, State, StatusResponse};
use common::{
auth::AuthRequest,
network::{SessionStream, limiter::LimiterResult},
network::{SessionStream, legacy::LegacyProtocol, limiter::LimiterResult},
};
use directory::Credentials;
use imap_proto::{
@@ -65,6 +67,11 @@ impl<T: SessionStream> Session<T> {
}
};
// inbuxa: legacy-protocols LP-6, before the password is looked at
self.server
.refuse_legacy_sign_in(LegacyProtocol::ManageSieve, &credentials)
.await?;
// Authenticate
let access_token = self
.server
crates/pop3/src/op/authenticate.rs
+8 -1
View File
@@ -2,6 +2,8 @@
* SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
*
* SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
*
* Modified by Coffey Labs in 2026 for INBUXA.
*/
use crate::{
@@ -10,7 +12,7 @@ use crate::{
};
use common::{
auth::AuthRequest,
network::{SessionStream, limiter::LimiterResult},
network::{SessionStream, legacy::LegacyProtocol, limiter::LimiterResult},
};
use directory::Credentials;
use mail_parser::decoders::base64::base64_decode;
@@ -61,6 +63,11 @@ impl<T: SessionStream> Session<T> {
}
pub async fn handle_auth(&mut self, credentials: Credentials) -> trc::Result<()> {
// inbuxa: legacy-protocols LP-6, before the password is looked at
self.server
.refuse_legacy_sign_in(LegacyProtocol::Pop3, &credentials)
.await?;
// Authenticate
let access_token = self
.server
crates/smtp/src/inbound/auth.rs
+26 -1
View File
@@ -2,10 +2,15 @@
* SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
*
* SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
*
* Modified by Coffey Labs in 2026 for INBUXA.
*/
use crate::core::Session;
use common::{auth::AuthRequest, network::SessionStream};
use common::{
auth::AuthRequest,
network::{SessionStream, legacy::LegacyProtocol},
};
use directory::Credentials;
use mail_parser::decoders::base64::base64_decode;
use registry::schema::enums::Permission;
@@ -108,6 +113,26 @@ impl<T: SessionStream> Session<T> {
}
pub async fn authenticate(&mut self, credentials: Credentials) -> Result<bool, ()> {
// inbuxa: legacy-protocols LP-6. Refused before the password is looked
// at, and not counted as an authentication error (LP-11). Only mail
// apps authenticate, so this never touches inbound delivery (LP-3).
if let Err(err) = self
.server
.refuse_legacy_sign_in(LegacyProtocol::Submission, &credentials)
.await
{
let refused = err.matches(trc::EventType::Auth(AuthEvent::LegacyProtocolRefused));
trc::error!(err.span_id(self.data.session_id));
if refused {
self.write(LegacyProtocol::Submission.refusal().as_bytes())
.await?;
} else {
self.write(b"454 4.7.0 Temporary authentication failure\r\n")
.await?;
}
return Ok(false);
}
// Authenticate
let result = self
.server
crates/trc/src/event/enums.rs
+5 -2
View File
@@ -8,8 +8,9 @@
// This file is auto-generated. Do not edit directly.
// inbuxa: 637 to 641 are the fork's SCIM events (SCIM-54)
pub const TOTAL_EVENT_COUNT: usize = 642;
// inbuxa: 637 to 641 are the fork's SCIM events (SCIM-54); 642 is
// auth.legacy-protocol-refused (legacy-protocols LP-6)
pub const TOTAL_EVENT_COUNT: usize = 643;
pub const TOTAL_METRIC_COUNT: usize = 369;
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
@@ -116,6 +117,8 @@ pub enum AuthEvent {
Error = 34,
Warning = 595,
CredentialExpired = 276,
// inbuxa: legacy-protocols LP-6
LegacyProtocolRefused = 642,
}
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
crates/trc/src/event/enums_impl.rs
+16
View File
@@ -56,6 +56,8 @@ impl EventType {
b"auth.mfa-required" => EventType::Auth(AuthEvent::MfaRequired),
b"auth.too-many-attempts" => EventType::Auth(AuthEvent::TooManyAttempts),
b"auth.client-registration" => EventType::Auth(AuthEvent::ClientRegistration),
// inbuxa: legacy-protocols LP-6
b"auth.legacy-protocol-refused" => EventType::Auth(AuthEvent::LegacyProtocolRefused),
b"auth.error" => EventType::Auth(AuthEvent::Error),
b"auth.warning" => EventType::Auth(AuthEvent::Warning),
b"auth.credential-expired" => EventType::Auth(AuthEvent::CredentialExpired),
@@ -705,6 +707,8 @@ impl EventType {
EventType::Auth(AuthEvent::MfaRequired) => "auth.mfa-required",
EventType::Auth(AuthEvent::TooManyAttempts) => "auth.too-many-attempts",
EventType::Auth(AuthEvent::ClientRegistration) => "auth.client-registration",
// inbuxa: legacy-protocols LP-6
EventType::Auth(AuthEvent::LegacyProtocolRefused) => "auth.legacy-protocol-refused",
EventType::Auth(AuthEvent::Error) => "auth.error",
EventType::Auth(AuthEvent::Warning) => "auth.warning",
EventType::Auth(AuthEvent::CredentialExpired) => "auth.credential-expired",
@@ -1489,6 +1493,8 @@ impl EventType {
EventType::Auth(AuthEvent::MfaRequired) => 36,
EventType::Auth(AuthEvent::TooManyAttempts) => 38,
EventType::Auth(AuthEvent::ClientRegistration) => 555,
// inbuxa: legacy-protocols LP-6
EventType::Auth(AuthEvent::LegacyProtocolRefused) => 642,
EventType::Auth(AuthEvent::Error) => 34,
EventType::Auth(AuthEvent::Warning) => 595,
EventType::Auth(AuthEvent::CredentialExpired) => 276,
@@ -2137,6 +2143,8 @@ impl EventType {
36 => Some(EventType::Auth(AuthEvent::MfaRequired)),
38 => Some(EventType::Auth(AuthEvent::TooManyAttempts)),
555 => Some(EventType::Auth(AuthEvent::ClientRegistration)),
// inbuxa: legacy-protocols LP-6
642 => Some(EventType::Auth(AuthEvent::LegacyProtocolRefused)),
34 => Some(EventType::Auth(AuthEvent::Error)),
595 => Some(EventType::Auth(AuthEvent::Warning)),
276 => Some(EventType::Auth(AuthEvent::CredentialExpired)),
@@ -2848,6 +2856,8 @@ impl EventType {
EventType::Acme(AcmeEvent::TlsAlpnReceived) => Level::Info,
EventType::Auth(AuthEvent::Success) => Level::Info,
EventType::Auth(AuthEvent::ClientRegistration) => Level::Info,
// inbuxa: legacy-protocols LP-6
EventType::Auth(AuthEvent::LegacyProtocolRefused) => Level::Info,
EventType::Calendar(CalendarEvent::AlarmSent) => Level::Info,
EventType::Calendar(CalendarEvent::ItipMessageSent) => Level::Info,
EventType::Calendar(CalendarEvent::ItipMessageReceived) => Level::Info,
@@ -3187,6 +3197,8 @@ impl EventType {
EventType::Auth(AuthEvent::MfaRequired) => "Missing MFA token for authentication",
EventType::Auth(AuthEvent::TooManyAttempts) => "Too many authentication attempts",
EventType::Auth(AuthEvent::ClientRegistration) => "OAuth Client registration",
// inbuxa: legacy-protocols LP-6
EventType::Auth(AuthEvent::LegacyProtocolRefused) => "Legacy mail protocol sign-in refused",
EventType::Auth(AuthEvent::Error) => "Authentication error",
EventType::Auth(AuthEvent::Warning) => "Authentication warning",
EventType::Auth(AuthEvent::CredentialExpired) => "Credential expired",
@@ -3951,6 +3963,8 @@ impl EventType {
}
EventType::Auth(AuthEvent::TooManyAttempts) => "Too many authentication attempts",
EventType::Auth(AuthEvent::ClientRegistration) => "Authentication error",
// inbuxa: legacy-protocols LP-6
EventType::Auth(AuthEvent::LegacyProtocolRefused) => "This server allows only INBUXA webmail and JMAP apps",
EventType::Auth(AuthEvent::Error) => "Authentication error",
EventType::Auth(AuthEvent::CredentialExpired) => "Credential expired",
EventType::Imap(ImapEvent::ConnectionStart) => "IMAP error",
@@ -4259,6 +4273,8 @@ impl EventType {
EventType::Auth(AuthEvent::MfaRequired),
EventType::Auth(AuthEvent::TooManyAttempts),
EventType::Auth(AuthEvent::ClientRegistration),
// inbuxa: legacy-protocols LP-6
EventType::Auth(AuthEvent::LegacyProtocolRefused),
EventType::Auth(AuthEvent::Error),
EventType::Auth(AuthEvent::Warning),
EventType::Auth(AuthEvent::CredentialExpired),