Add support for "require TLS"-settings

1 files changed, 18 insertions, 3 deletions

diff --git a/qmail-smtpd.c b/qmail-smtpd.c
index 48a66b1..d0395fc 100644
--- a/qmail-smtpd.c
+++ b/qmail-smtpd.c
@@ -78,7 +78,7 @@ void tls_nogateway();
 int ssl_rfd = -1, ssl_wfd = -1; /* SSL_get_Xfd() are broken */
 stralloc proto = {0};
 int tls_before_auth = 0;
-int tls_require = 0;
+int tls_required = 0;
 #endif
 
 #ifdef SMTPUTF8
@@ -344,7 +344,7 @@ void setup()
 
 #ifdef TLS
   if (env_get("TLSBEFOREAUTH")) tls_before_auth = 1;
-  if (env_get("TLSREQUIRE")) tls_require = 1;
+  if (env_get("TLSREQUIRE")) tls_required = 1;
   if (env_get("SMTPS")) { smtps = 1; tls_init(); }
   else
 #endif
@@ -722,7 +722,7 @@ void smtp_mail(arg) char *arg;
 {
   if (!seenhelo) { err_wanthelo(); return; }
 #if defined(TLS)
-  if (tls_require && !ssl) { err_wantstarttls(); return; }
+  if (tls_required && !ssl) { err_wantstarttls(); return; }
 #endif
   if (!addrparse(arg)) { err_syntax(); return; }
   flagsize = 0;
@@ -818,6 +818,21 @@ void smtp_rcpt(arg) char *arg; {
       return;
     }
   }
+#if defined(TLS)
+  /* per-domain "require TLS"-settings */
+  if (!tls_required && !relayclient) {
+    int at = byte_rchr(addr.s, addr.len, '@') + 1;
+    if (at < addr.len) {
+      stralloc tmp = { 0 };
+      if (!stralloc_copys(&tmp, "control/tlsrequire/")
+          || !stralloc_catb(&tmp, addr.s + at, addr.len - at)) // addr is 0-terminated
+        die_nomem();
+      if (control_readint(&tls_required, tmp.s) == -1) die_control();
+      tls_required = (tls_required & 0x01) ? 1 : 0; // 1st bit is SMTP incoming
+      if (tls_required && !ssl) { err_wantstarttls(); return; }
+    }
+  }
+#endif
   spp_rcpt_accepted();
   if (!stralloc_cats(&rcptto,"T")) die_nomem();
   if (!stralloc_cats(&rcptto,addr.s)) die_nomem();