49 lines
1.9 KiB
Go
49 lines
1.9 KiB
Go
package imapserver
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"net"
|
|
|
|
goimapserver "github.com/emersion/go-imap/v2/imapserver"
|
|
)
|
|
|
|
func newSessionFunc(backend *Backend) func(*goimapserver.Conn) (goimapserver.Session, *goimapserver.GreetingData, error) {
|
|
return func(c *goimapserver.Conn) (goimapserver.Session, *goimapserver.GreetingData, error) {
|
|
host, _, err := net.SplitHostPort(c.NetConn().RemoteAddr().String())
|
|
if err != nil {
|
|
host = c.NetConn().RemoteAddr().String()
|
|
}
|
|
return backend.NewSession(host), nil, nil
|
|
}
|
|
}
|
|
|
|
// NewPlainServer mirrors smtpserver.NewPlainServer: no TLS at all, so STARTTLS is
|
|
// never offered. InsecureAuth is required here or LOGIN would always fail with
|
|
// [PRIVACYREQUIRED] on this listener.
|
|
func NewPlainServer(backend *Backend) *goimapserver.Server {
|
|
return goimapserver.New(&goimapserver.Options{
|
|
NewSession: newSessionFunc(backend),
|
|
InsecureAuth: true,
|
|
})
|
|
}
|
|
|
|
// NewTLSServer mirrors smtpserver.NewTLSServer: implicit TLS, the whole connection is
|
|
// encrypted from the first byte. Call ListenAndServeTLS (not ListenAndServe) to run
|
|
// it — TLSConfig here only takes effect for that method.
|
|
//
|
|
// InsecureAuth is set here too, same as smtpserver.NewTLSServer's AllowInsecureAuth:
|
|
// this server is only ever Serve()'d behind abuseguard's and idletimeout's listener/conn
|
|
// wrapper types, so go-imap's own isTLS check (conn.go: c.conn.(*tls.Conn)) sees our
|
|
// wrapper instead of the real *tls.Conn and always reports false. Without this, go-imap
|
|
// advertises LOGINDISABLED and refuses LOGIN even though the connection is already
|
|
// encrypted by construction (it's the dedicated implicit-TLS listener) — clients
|
|
// configured for SSL/TLS (not STARTTLS), like Thunderbird on port 993, can never
|
|
// authenticate.
|
|
func NewTLSServer(backend *Backend, tlsConfig *tls.Config) *goimapserver.Server {
|
|
return goimapserver.New(&goimapserver.Options{
|
|
NewSession: newSessionFunc(backend),
|
|
TLSConfig: tlsConfig,
|
|
InsecureAuth: true,
|
|
})
|
|
}
|