serv/mox
1
0
Fork 0
mirror of https://github.com/mjl-/mox.git synced 2024-12-26 16:33:47 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

for external domains (for which we only accept external dmarc reports), don't try to fetch tls certificates at startup for autoconfig host

Browse source
This commit is contained in:
Mechiel Lukkien 2023-11-14 00:26:18 +01:00
parent 651fa68067
commit 51e314f65a
No known key found for this signature in database
2 changed files with 18 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
http/web.go
View file

@ -682,13 +682,22 @@ func Listen() {
if l.HostnameDomain.ASCII != "" {
hosts[l.HostnameDomain] = struct{}{}
}
// All domains are served on all listeners.
// All domains are served on all listeners. Gather autoconfig hostnames to ensure
// presence of TLS certificates for.
for _, name := range mox.Conf.Domains() {
dom, err := dns.ParseDomain("autoconfig." + name)
if dom, err := dns.ParseDomain(name); err != nil {
xlog.Errorx("parsing domain from config", err)
} else if d, _ := mox.Conf.Domain(dom); d.DMARC != nil && d.DMARC.Domain != "" && d.DMARC.DNSDomain != dom {
// Do not gather autoconfig name if this domain is configured to process reports
// for domains hosted elsewhere.
continue
}
autoconfdom, err := dns.ParseDomain("autoconfig." + name)
if err != nil {
xlog.Errorx("parsing domain from config for autoconfig", err)
} else {
hosts[dom] = struct{}{}
hosts[autoconfdom] = struct{}{}
}
}

6
mox-/config.go
View file

@ -251,6 +251,12 @@ func (c *Config) allowACMEHosts(checkACMEHosts bool) {
}
for _, dom := range c.Dynamic.Domains {
if dom.DMARC != nil && dom.DMARC.Domain != "" && dom.DMARC.DNSDomain != dom.Domain {
// Do not allow TLS certificates for domains for which we only accept DMARC reports
// as external party.
continue
}
if l.AutoconfigHTTPS.Enabled && !l.AutoconfigHTTPS.NonTLS {
if d, err := dns.ParseDomain("autoconfig." + dom.Domain.ASCII); err != nil {
xlog.Errorx("parsing autoconfig domain", err, mlog.Field("domain", dom.Domain))