• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

albertito / chasquid / 7306049604
95%
main: 95%

Build:
Build:
LAST BUILD BRANCH: refs/tags/v1.17.0
DEFAULT BRANCH: main
Ran 23 Dec 2023 04:03AM UTC
Jobs 1
Files 36
Run time 3s
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

23 Dec 2023 04:00AM UTC coverage: 94.532% (+0.07%) from 94.467%
7306049604

push

albertito
WIP: smtpsrv: Strict CRLF enforcement in DATA contents

**WIP: THIS IS A WORK IN PROGRESS PATCH, AND IT MAY BE EDITED.**

The RFCs are very clear that in DATA contents:

> CR and LF MUST only occur together as CRLF; they MUST NOT appear
> independently in the body.

https://www.rfc-editor.org/rfc/rfc5322#section-2.3
https://www.rfc-editor.org/rfc/rfc5321#section-2.3.8

Allowing "independent" CR and LF can cause a number of problems.

In particular, there is a new "SMTP smuggling attack" published recently
that involves the server incorrectly parsing the end of DATA marker
`\r\n.\r\n`, which an attacker can exploit to impersonate a server when
email is transmitted server-to-server.

https://www.postfix.org/smtp-smuggling.html
https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/

Currently, chasquid is vulnerable to this attack, because Go's standard
libraries net/textproto and net/mail do not enforce CRLF strictly.

This patch fixes the problem by introducing a new "dot reader" function
that strictly enforces CRLF when reading dot-terminated data, used in
the DATA input processing.

When an invalid newline terminator is found, the connection is aborted
immediately because we cannot safely recover from that state.

See https://github.com/albertito/chasquid/issues/47 for more details and
discussion.

**WIP: THIS IS A WORK IN PROGRESS PATCH, AND IT MAY BE EDITED.**

77 of 77 new or added lines in 2 files covered. (100.0%)

1 existing line in 1 file now uncovered.

4391 of 4645 relevant lines covered (94.53%)

85472.92 hits per line

Jobs
ID Job ID Ran Files Coverage
1 7306049604.1 23 Dec 2023 04:03AM UTC 0
94.53
Source Files on build 7306049604
Detailed source file information is not available for this build.
  • Back to Repo
  • 606c3925 on github
  • Prev Build on next (#7290245498)
  • Next Build on next (#7308830757)
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc