bbs.profullstack/agentbbs
1
0
Fork 0
mirror of https://github.com/profullstack/agentbbs.git synced 2026-08-13 14:27:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix(mailbox): verify SMTP STARTTLS against the mail host, not the dial IP

Browse source 
AgentMail compose/send failed with 'cannot validate certificate for 127.0.0.1
because it doesn't contain any IP SANs': the sender dialed the local relay at
127.0.0.1:25 and net/smtp pinned the TLS ServerName to the dial host, but the
relay's cert is for mail.<host>. Reimplement smtpSend (mirrors net/smtp.SendMail)
with an overridable IMAPConfig.SMTPServerName; default it to the mail host
(AGENTBBS_MAIL_SMTP_SERVERNAME). Now we dial the loopback for relay permission
yet verify the real hostname cert — no /etc/hosts hack. setup.sh upserts the new
var. Tested against a fake SMTP server (full MAIL/RCPT/DATA flow).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Anthony Ettinger 2026-06-23 15:54:30 +00:00
parent 25266845e0
commit 55d517feb4
5 changed files with 176 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

8
cmd/agentbbs/main.go
View file

@ -1481,8 +1481,12 @@ func (a *app) mailClientFor(su store.User) (*mailbox.Client, error) {
cfg := mailbox.IMAPConfig{
IMAPAddr: env("AGENTBBS_MAIL_IMAP_ADDR", a.mailHost+":993"),
SMTPAddr: env("AGENTBBS_MAIL_SMTP_ADDR", "127.0.0.1:25"),
Username: login,
Password: os.Getenv("AGENTBBS_MAIL_MASTER_PASS"),
// Dial the loopback relay but verify STARTTLS against the mail host, whose
// certificate it presents (the relay's cert is never for 127.0.0.1). This
// avoids the /etc/hosts loopback hack the transactional sender needs.
SMTPServerName: env("AGENTBBS_MAIL_SMTP_SERVERNAME", a.mailHost),
Username: login,
Password: os.Getenv("AGENTBBS_MAIL_MASTER_PASS"),
// Mailu's front nginx pre-authenticates against its user DB before
// proxying, which rejects the "<addr>*master" master login. The gateway
// therefore talks to Dovecot directly over loopback (plaintext, on-host)