AkkomaGang/akkoma
AkkomaGang/akkoma
15
66
Fork 94
Code Issues 180 Pull requests 28 Projects 2 Releases 14 Packages Wiki Activity

Set customize_hostname_check for Swoosh.Adapters.SMTP #861

Open
norm wants to merge 1 commit from norm/akkoma:smtp-defaults-fix into develop
pull from: norm/akkoma:smtp-defaults-fix
merge into: AkkomaGang:develop
Conversation 2 Commits 1 Files changed 1 +7 -1
norm commented 2024-12-17 23:35:25 +00:00
Contributor
Copy link

This should hopefully fix issues with connecting to SMTP servers
with wildcard TLS certificates.

Taken from https://erlef.github.io/security-wg/secure_coding_and_deployment_hardening/ssl

Fixes #660

This should hopefully fix issues with connecting to SMTP servers with wildcard TLS certificates. Taken from https://erlef.github.io/security-wg/secure_coding_and_deployment_hardening/ssl Fixes https://akkoma.dev/AkkomaGang/akkoma/issues/660
norm added 1 commit 2024-12-17 23:35:26 +00:00
Set customize_hostname_check for Swoosh.Adapters.SMTP
Some checks are pending
ci/woodpecker/pr/build-amd64 Pipeline is pending approval
Details
ci/woodpecker/pr/build-arm64 Pipeline is pending approval
Details
ci/woodpecker/pr/docs Pipeline is pending approval
Details
ci/woodpecker/pr/lint Pipeline is pending approval
Details
ci/woodpecker/pr/test Pipeline is pending approval
Details
615c52cdde 
This should hopefully fix issues with connecting to SMTP servers
with wildcard TLS certificates.

Taken from https://erlef.github.io/security-wg/secure_coding_and_deployment_hardening/ssl

Fixes #660
floatingghost commented 2024-12-18 10:40:44 +00:00
Owner
Copy link

hm, i wonder, does this break non-ssl'd smtp connections? i doubt it but worth testing if we can

hm, i wonder, does this break _non_-ssl'd smtp connections? i doubt it but worth testing if we can
Oneric commented 2024-12-18 14:50:38 +00:00
Member
Copy link

It cannot ever break non-SSL connections since common_tls_opts to which the new argument is added, are never applied to the final socket options if ssl is set to false *(a few lines below the shown context). Otherwise it would already break with the existing defaults.

However, when i added the defaults comments in relevant threads suggested setting server_name_indication would already fix wildcard certificates; evidently this isn't the case here at least and tbh i was never sure why it should fix wildcard certs. Might be good to drop the wildcard comment from śerver_name_indication and just add it to the new setting here instead (but keep the SNI setting; can't hurt to explicitly request the right domain)

It cannot ever break non-SSL connections since `common_tls_opts` to which the new argument is added, are never applied to the final socket options if `ssl` is set to false *(a few lines below the shown context). Otherwise it would already break with the existing defaults. However, when i added the defaults comments in relevant threads suggested setting `server_name_indication` would already fix wildcard certificates; evidently this isn't the case here at least and tbh i was never sure why it should fix wildcard certs. Might be good to drop the wildcard comment from `śerver_name_indication` and just add it to the new setting here instead *(but keep the SNI setting; can't hurt to explicitly request the right domain)*
norm force-pushed smtp-defaults-fix from 615c52cdde to f19d5d1380 2024-12-18 19:37:35 +00:00 Compare
Oneric approved these changes 2024-12-18 19:57:16 +00:00
Some checks are pending
ci/woodpecker/pr/build-amd64 Pipeline is pending approval
Details
ci/woodpecker/pr/build-arm64 Pipeline is pending approval
Details
ci/woodpecker/pr/docs Pipeline is pending approval
Details
ci/woodpecker/pr/lint Pipeline is pending approval
Details
ci/woodpecker/pr/test Pipeline is pending approval
Details
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u smtp-defaults-fix:norm-smtp-defaults-fix
git checkout norm-smtp-defaults-fix
Sign in to join this conversation.
Reviewers
No reviewers
Oneric
Labels
Clear labels   
approved, awaiting change

   
bug

Something is not working

  
configuration

This requires config changes

  
documentation

This is about human-readable docs

  
duplicate

This issue or pull request already exists

  
enhancement

New feature

  
extremely low priority

   
feature request

Something new?

  
Fix it yourself

Support has been attempted

  
help wanted

Need some help

  
invalid

Something is wrong

  
mastodon_api

   
needs docs

   
needs tests

   
not a bug

   
planned

   
pleroma_api

   
privacy

   
question

More information is needed

  
static_fe

   
triage

   
wontfix

This won't be fixed

No labels
approved, awaiting change
bug
configuration
documentation
duplicate
enhancement
extremely low priority
feature request
Fix it yourself
help wanted
invalid
mastodon_api
needs docs
needs tests
not a bug
planned
pleroma_api
privacy
question
static_fe
triage
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: AkkomaGang/akkoma#861
No description provided.
Delete branch "norm/akkoma:smtp-defaults-fix"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?