mail-auth-proxy 0.4.0

Added

• A profile per backend (imap.backend, submission.backend, sieve.backend), every key
  reloadable:
  • tls = "starttls" | "implicit": how the proxy secures its connection to the backend.
    IMAP can now use STARTTLS (RFC 9051 §6.2.1: the capabilities are asked anew over
    TLS), submission and ManageSieve implicit TLS (RFC 8314). The EHLO and capability
    probes take the same way. Defaults as before: IMAP implicit, the others STARTTLS.
  • auth_forward = "xoauth2" | "oauthbearer": the mechanism a validated token is
    forwarded with, whichever the client used. OAUTHBEARER (RFC 7628 §3.1) carries the
    verified identity as GS2 authzid and the backend's name and port. A failure's error
    result is answered with %x01 (§3.2.3); a status of invalid_request is an outage,
    not a failed login. Default xoauth2, as before.
  • client_ip = "proxy_v2" | "xclient" | "none": how the backend learns the client
    address. The submission backend can now take a PROXY v2 header (with a LOCAL header
    on the EHLO probe); xclient is refused on the other backends. A backend with none,
    set or by default, gives a configuration warning: it sees every client as the proxy.
• submission.implicit_tls_listen: a second submission listener with implicit TLS (port
  465, RFC 8314 §3.3), next to STARTTLS on submission.listen, with the same dialog,
  gate and backend. Adding, moving or removing it needs a restart.
• The authresult line gets a last field listener (imap, submission,
  submissions, sieve), and mail_auth_proxy_listener_connections_total{listener} and
  mail_auth_proxy_listener_auth_attempts_total{listener,result} split connections and
  auth attempts by listener. Existing fields, families and labels are unchanged.
• Example configurations examples/config.dovecot-postfix.toml and
  examples/config.stalwart.toml (the latter untested, from the Stalwart documentation).
• ALPACA hardening for SMTP (RFC 9325 §3.8, RFC 7301 §3.2): on both submission
  listeners a client that offers an ALPN ID of another protocol from the IANA registry
  (http/1.1, h2, imap, …; GREASE values excepted) is refused before the ServerHello
  with the fatal alert no_application_protocol (120); the session-end line says
  TLS ALPN "<id>" names another protocol. Without ALPN, or with unregistered values,
  nothing changes and no protocol is selected.
• Fuzz target backend_auth: the backend's OAUTHBEARER error result, the ManageSieve
  challenge string, the OAUTHBEARER build/parse roundtrip.
• Named backends and routes: one endpoint in front of several mail systems.
  [backends.<name>] holds a backend profile; a protocol section names it
  (backend = "<name>") or [[routes]] choose it per credential. A route takes the
  domains of the validated identity (OAuth) or of the login (password), optionally
  narrowed by the token's issuers and audiences and the client's sni; the first
  matching route in file order wins, domains = ["*"] takes the rest. The SNI never
  selects a backend on its own. A credential no route takes is refused as
  unknown_domain without backend contact (a password with the wrong-password reply and
  delay), with a WARN … no route for the login's domain line and
  mail_auth_proxy_route_misses_total{proto}. Routes and backends are reloadable; a
  backend that stays keeps its capability cache and refusal timing. The inline
  backend = { … } keeps its meaning.
• The authresult line gets a last field backend: the name of the backend the
  credential was sent to (the section name for an inline backend), empty when none was.
  Earlier fields are unchanged.
• With several backends behind a protocol, the SMTP EHLO reply after TLS lists only the
  extensions every submission backend offers, with the smallest SIZE, and the
  ManageSieve capabilities before AUTHENTICATE are those all its backends have (SIEVE
  and NOTIFY narrowed, MAXREDIRECTS the smallest). The backends are probed together.

Changed

• The refusal timing of the legacy gate learns the rejection latencies per backend
  instead of per protocol. A refusal by the account check or the throttle waits like a
  wrong password at the backend the login goes to; a refusal before it (size, rule,
  domain, no route) waits for the slowest backend of the protocol. With one backend per protocol
  the timing is the same as before; the change keeps refusals and wrong passwords alike
  once a protocol has several backends.
• The submission auth ok and sieve auth ok log lines, and the IMAP lines oauth validated; proxying to backend and password auth; forwarding to backend, name the
  issuer of the token (issuer=, empty for a password).
• The startup lines imap listener up and the others name every backend of the protocol
  (backends=[<name>=<address>, …] instead of backend=<address>); the IMAP login lines
  carry backend=.
• backend.proxy_protocol and submission.xclient are short forms of client_ip;
  --print-config shows client_ip. submission.backend.proxy_protocol = true is now
  accepted (it was an error); combining a short form with client_ip, or both short
  forms, is an error.
• The ManageSieve backend login answers an error challenge to a forwarded token (a
  string instead of a verdict line) and reads the verdict after it; before, the challenge
  line was taken as a rejection and the backend connection dropped.
• The log line of a submission backend that advertises XCLIENT to a proxy not set to use
  it names submission.backend.client_ip instead of submission.xclient.

Fixed

• The usage text (-h, --help, an unknown option) lists -h and --help.

Install

Debian and Ubuntu: APT repository, see INSTALL.md.
Other systems: download the package or archive and SHA256SUMS, SHA256SUMS.asc and
release-signing-key.asc, then:

gpg --import release-signing-key.asc   # 0B58 3E99 144D CD9B 5A34  D96B E52C 6D1E FB67 927B
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum -c --ignore-missing SHA256SUMS