bbs.profullstack/agentbbs
1
0
Fork 0
mirror of https://github.com/profullstack/agentbbs.git synced 2026-08-13 22:37:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix(mailbox): verify SMTP STARTTLS against the mail host, not the dial IP

Browse source 
AgentMail compose/send failed with 'cannot validate certificate for 127.0.0.1
because it doesn't contain any IP SANs': the sender dialed the local relay at
127.0.0.1:25 and net/smtp pinned the TLS ServerName to the dial host, but the
relay's cert is for mail.<host>. Reimplement smtpSend (mirrors net/smtp.SendMail)
with an overridable IMAPConfig.SMTPServerName; default it to the mail host
(AGENTBBS_MAIL_SMTP_SERVERNAME). Now we dial the loopback for relay permission
yet verify the real hostname cert — no /etc/hosts hack. setup.sh upserts the new
var. Tested against a fake SMTP server (full MAIL/RCPT/DATA flow).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Anthony Ettinger 2026-06-23 15:54:30 +00:00
parent 25266845e0
commit 55d517feb4
5 changed files with 176 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

7
internal/mailbox/imap.go
View file

@ -24,6 +24,11 @@ type IMAPConfig struct {
// SMTPUser/SMTPPass default to Username/Password when empty.
SMTPUser string
SMTPPass string
// SMTPServerName is the TLS server name verified during STARTTLS. Set it when
// the dial host differs from the certificate name — e.g. dialing the trusted
// local relay at 127.0.0.1:25 whose cert is mail.<host>. Empty = use the dial
// host (the net/smtp default).
SMTPServerName string
// Plaintext dials IMAP without TLS. Used only for a co-located backend over
// loopback (the Mailu gateway hitting Dovecot directly on 127.0.0.1, bypassing
// the front's auth proxy so master-user login works) — the password never
@ -219,7 +224,7 @@ func (t *imapTransport) Search(_ context.Context, opts SearchOptions) ([]Message
func (t *imapTransport) Send(_ context.Context, from string, d Draft) (SendResult, error) {
msg, msgID := buildRFC822(from, d)
// SMTPUser may be empty for a trusted local relay (no AUTH).
if err := smtpSend(t.cfg.SMTPAddr, t.cfg.SMTPUser, t.cfg.SMTPPass, from, recipients(d), msg); err != nil {
if err := smtpSend(t.cfg.SMTPAddr, t.cfg.SMTPServerName, t.cfg.SMTPUser, t.cfg.SMTPPass, from, recipients(d), msg); err != nil {
return SendResult{}, fmt.Errorf("smtp send: %w", err)
}
// Best-effort copy to Sent so the message shows in the member's mailbox.