MFA fix, added IP blacklist, update webmail client

internal/abuseguard/abuseguard.go

@@ -0,0 +1,96 @@
+// Package abuseguard automatically blacklists IPs that rack up too many failed
+// SMTP/IMAP auth attempts, and rejects connections from already-blacklisted IPs before
+// the SMTP/IMAP banner is ever sent. Deliberately separate from the web admin/webmail
+// login lockout (internal/webui/ratelimit.go) and from the relay-authorization
+// whitelist (esrv_whitelisted_ips) — see the [Security] section of settings.ini.
+package abuseguard
+
+import (
+	"net"
+	"time"
+
+	"gopkg.in/ini.v1"
+
+	"mailgoserver/internal/db"
+	"mailgoserver/internal/toolbox"
+)
+
+// RecordFailureAndMaybeBlacklist should be called after every failed SMTP AUTH or IMAP
+// login. It counts recent failures from ip and blacklists it once the configured
+// threshold is hit. Fails open (does nothing) on a DB error rather than blocking auth
+// over a transient issue.
+func RecordFailureAndMaybeBlacklist(database *db.DB, cfg *ini.File, logger *toolbox.Logger, ip string) {
+	if ip == "" || cfg == nil {
+		return
+	}
+	sec := cfg.Section("Security")
+	if !sec.Key("abuse_detection_enabled").MustBool(true) {
+		return
+	}
+	if whitelisted, err := database.IsIPAbuseWhitelisted(ip); err != nil || whitelisted {
+		return
+	}
+
+	threshold := sec.Key("abuse_failure_threshold").MustInt(8)
+	windowMinutes := sec.Key("abuse_detection_window_minutes").MustInt(10)
+	since := time.Now().Add(-time.Duration(windowMinutes) * time.Minute)
+
+	n, err := database.CountFailedAuthAttemptsByIP(ip, since)
+	if err != nil || n < threshold {
+		return
+	}
+
+	baseHours := sec.Key("abuse_blacklist_base_hours").MustInt(12)
+	maxHours := sec.Key("abuse_blacklist_max_hours").MustInt(168)
+	reason := "automatic: too many failed SMTP/IMAP auth attempts"
+	if err := database.BlacklistIP(ip, reason, baseHours, maxHours); err != nil && logger != nil {
+		logger.Error("abuseguard: failed to blacklist %s: %v", ip, err)
+		return
+	}
+	if logger != nil {
+		logger.Warning("abuseguard: blacklisted %s after %d failed attempts in %dm", ip, n, windowMinutes)
+	}
+}
+
+// guardedListener wraps a net.Listener so Accept() silently drops connections from
+// blacklisted IPs (never returning them to the caller) before any protocol banner is
+// written, and keeps looping rather than returning an error.
+type guardedListener struct {
+	net.Listener
+	database *db.DB
+	logger   *toolbox.Logger
+}
+
+// GuardListener wraps inner so every accepted connection is checked against the IP
+// blacklist (skipping the check entirely for abuse-whitelisted IPs) before the caller
+// ever sees it.
+func GuardListener(inner net.Listener, database *db.DB, logger *toolbox.Logger) net.Listener {
+	return &guardedListener{Listener: inner, database: database, logger: logger}
+}
+
+func (g *guardedListener) Accept() (net.Conn, error) {
+	for {
+		conn, err := g.Listener.Accept()
+		if err != nil {
+			return nil, err
+		}
+		host, _, splitErr := net.SplitHostPort(conn.RemoteAddr().String())
+		if splitErr != nil {
+			host = conn.RemoteAddr().String()
+		}
+		if whitelisted, wErr := g.database.IsIPAbuseWhitelisted(host); wErr == nil && whitelisted {
+			return conn, nil
+		}
+		blocked, bErr := g.database.IsIPBlacklisted(host)
+		if bErr != nil {
+			return conn, nil // fail open on a DB error
+		}
+		if !blocked {
+			return conn, nil
+		}
+		if g.logger != nil {
+			g.logger.Warning("abuseguard: rejected connection from blacklisted IP %s", host)
+		}
+		conn.Close()
+	}
+}