mirror of
https://github.com/git/git
synced 2024-09-06 00:18:22 +00:00
Merge branch 'jv/send-email-selective-smtp-auth'
"git send-email" learned a new option --smtp-auth to limit the SMTP AUTH mechanisms to be used to a subset of what the system library supports. * jv/send-email-selective-smtp-auth: send-email: provide whitelist of SMTP AUTH mechanisms
This commit is contained in:
commit
629ac65f68
|
@ -171,6 +171,19 @@ Sending
|
||||||
to determine your FQDN automatically. Default is the value of
|
to determine your FQDN automatically. Default is the value of
|
||||||
'sendemail.smtpDomain'.
|
'sendemail.smtpDomain'.
|
||||||
|
|
||||||
|
--smtp-auth=<mechanisms>::
|
||||||
|
Whitespace-separated list of allowed SMTP-AUTH mechanisms. This setting
|
||||||
|
forces using only the listed mechanisms. Example:
|
||||||
|
+
|
||||||
|
------
|
||||||
|
$ git send-email --smtp-auth="PLAIN LOGIN GSSAPI" ...
|
||||||
|
------
|
||||||
|
+
|
||||||
|
If at least one of the specified mechanisms matches the ones advertised by the
|
||||||
|
SMTP server and if it is supported by the utilized SASL library, the mechanism
|
||||||
|
is used for authentication. If neither 'sendemail.smtpAuth' nor '--smtp-auth'
|
||||||
|
is specified, all mechanisms supported by the SASL library can be used.
|
||||||
|
|
||||||
--smtp-pass[=<password>]::
|
--smtp-pass[=<password>]::
|
||||||
Password for SMTP-AUTH. The argument is optional: If no
|
Password for SMTP-AUTH. The argument is optional: If no
|
||||||
argument is specified, then the empty string is used as
|
argument is specified, then the empty string is used as
|
||||||
|
|
|
@ -75,6 +75,8 @@ sub usage {
|
||||||
Pass an empty string to disable certificate
|
Pass an empty string to disable certificate
|
||||||
verification.
|
verification.
|
||||||
--smtp-domain <str> * The domain name sent to HELO/EHLO handshake
|
--smtp-domain <str> * The domain name sent to HELO/EHLO handshake
|
||||||
|
--smtp-auth <str> * Space-separated list of allowed AUTH mechanisms.
|
||||||
|
This setting forces to use one of the listed mechanisms.
|
||||||
--smtp-debug <0|1> * Disable, enable Net::SMTP debug.
|
--smtp-debug <0|1> * Disable, enable Net::SMTP debug.
|
||||||
|
|
||||||
Automating:
|
Automating:
|
||||||
|
@ -208,7 +210,7 @@ sub do_edit {
|
||||||
my ($to_cmd, $cc_cmd);
|
my ($to_cmd, $cc_cmd);
|
||||||
my ($smtp_server, $smtp_server_port, @smtp_server_options);
|
my ($smtp_server, $smtp_server_port, @smtp_server_options);
|
||||||
my ($smtp_authuser, $smtp_encryption, $smtp_ssl_cert_path);
|
my ($smtp_authuser, $smtp_encryption, $smtp_ssl_cert_path);
|
||||||
my ($identity, $aliasfiletype, @alias_files, $smtp_domain);
|
my ($identity, $aliasfiletype, @alias_files, $smtp_domain, $smtp_auth);
|
||||||
my ($validate, $confirm);
|
my ($validate, $confirm);
|
||||||
my (@suppress_cc);
|
my (@suppress_cc);
|
||||||
my ($auto_8bit_encoding);
|
my ($auto_8bit_encoding);
|
||||||
|
@ -239,6 +241,7 @@ sub do_edit {
|
||||||
"smtppass" => \$smtp_authpass,
|
"smtppass" => \$smtp_authpass,
|
||||||
"smtpsslcertpath" => \$smtp_ssl_cert_path,
|
"smtpsslcertpath" => \$smtp_ssl_cert_path,
|
||||||
"smtpdomain" => \$smtp_domain,
|
"smtpdomain" => \$smtp_domain,
|
||||||
|
"smtpauth" => \$smtp_auth,
|
||||||
"to" => \@initial_to,
|
"to" => \@initial_to,
|
||||||
"tocmd" => \$to_cmd,
|
"tocmd" => \$to_cmd,
|
||||||
"cc" => \@initial_cc,
|
"cc" => \@initial_cc,
|
||||||
|
@ -310,6 +313,7 @@ sub signal_handler {
|
||||||
"smtp-ssl-cert-path=s" => \$smtp_ssl_cert_path,
|
"smtp-ssl-cert-path=s" => \$smtp_ssl_cert_path,
|
||||||
"smtp-debug:i" => \$debug_net_smtp,
|
"smtp-debug:i" => \$debug_net_smtp,
|
||||||
"smtp-domain:s" => \$smtp_domain,
|
"smtp-domain:s" => \$smtp_domain,
|
||||||
|
"smtp-auth=s" => \$smtp_auth,
|
||||||
"identity=s" => \$identity,
|
"identity=s" => \$identity,
|
||||||
"annotate!" => \$annotate,
|
"annotate!" => \$annotate,
|
||||||
"no-annotate" => sub {$annotate = 0},
|
"no-annotate" => sub {$annotate = 0},
|
||||||
|
@ -1130,6 +1134,12 @@ sub smtp_auth_maybe {
|
||||||
Authen::SASL->import(qw(Perl));
|
Authen::SASL->import(qw(Perl));
|
||||||
};
|
};
|
||||||
|
|
||||||
|
# Check mechanism naming as defined in:
|
||||||
|
# https://tools.ietf.org/html/rfc4422#page-8
|
||||||
|
if ($smtp_auth !~ /^(\b[A-Z0-9-_]{1,20}\s*)*$/) {
|
||||||
|
die "invalid smtp auth: '${smtp_auth}'";
|
||||||
|
}
|
||||||
|
|
||||||
# TODO: Authentication may fail not because credentials were
|
# TODO: Authentication may fail not because credentials were
|
||||||
# invalid but due to other reasons, in which we should not
|
# invalid but due to other reasons, in which we should not
|
||||||
# reject credentials.
|
# reject credentials.
|
||||||
|
@ -1142,6 +1152,20 @@ sub smtp_auth_maybe {
|
||||||
'password' => $smtp_authpass
|
'password' => $smtp_authpass
|
||||||
}, sub {
|
}, sub {
|
||||||
my $cred = shift;
|
my $cred = shift;
|
||||||
|
|
||||||
|
if ($smtp_auth) {
|
||||||
|
my $sasl = Authen::SASL->new(
|
||||||
|
mechanism => $smtp_auth,
|
||||||
|
callback => {
|
||||||
|
user => $cred->{'username'},
|
||||||
|
pass => $cred->{'password'},
|
||||||
|
authname => $cred->{'username'},
|
||||||
|
}
|
||||||
|
);
|
||||||
|
|
||||||
|
return !!$smtp->auth($sasl);
|
||||||
|
}
|
||||||
|
|
||||||
return !!$smtp->auth($cred->{'username'}, $cred->{'password'});
|
return !!$smtp->auth($cred->{'username'}, $cred->{'password'});
|
||||||
});
|
});
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue