Expand allowedUsers email field to support comma-separated and domains

auth.go

@@ -30,14 +30,14 @@ func AuthReady() bool {
 
 // Returns bcrypt-hash, email
 // email can be empty in which case it is not checked
-func AuthFetch(username string) (string, string, error) {
+func AuthFetch(username string) (string, []string, error) {
 	if !AuthReady() {
-		return "", "", errors.New("Authentication file not specified. Call LoadFile() first")
+		return "", nil, errors.New("Authentication file not specified. Call LoadFile() first")
 	}
 
 	file, err := os.Open(filename)
 	if err != nil {
-		return "", "", err
+		return "", nil, err
 	}
 	defer file.Close()
 
@@ -54,16 +54,16 @@ func AuthFetch(username string) (string, string, error) {
 		}
 
 		hash := parts[1]
-		email := ""
+		email := []string(nil)
 
 		if len(parts) >= 3 {
-			email = parts[2]
+			email = strings.Split(parts[2], ",")
 		}
 
 		return hash, email, nil
 	}
 
-	return "", "", errors.New("User not found")
+	return "", nil, errors.New("User not found")
 }
 
 func AuthCheckPassword(username string, secret string) error {

main.go

@@ -36,15 +36,43 @@ func connectionChecker(peer smtpd.Peer) error {
 	return smtpd.Error{Code: 421, Message: "Denied"}
 }
 
+func addrAllowed(addr string, allowedAddrs []string) bool {
+	if allowedAddrs == nil {
+		return true
+	}
+
+	domidx := strings.LastIndex(addr, "@")
+	if domidx == -1 {
+		return false
+	}
+	domain := strings.ToLower(addr[domidx+1:])
+
+	for _, allowedAddr := range allowedAddrs {
+		allowedAddr = strings.ToLower(allowedAddr)
+
+		if strings.Index(allowedAddr, "@") == -1 {
+			if allowedAddr == domain {
+				return true
+			}
+		} else {
+			if allowedAddr == addr {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
 func senderChecker(peer smtpd.Peer, addr string) error {
 	// check sender address from auth file if user is authenticated
 	if *allowedUsers != "" && peer.Username != "" {
-		_, email, err := AuthFetch(peer.Username)
+		_, allowedAddrs, err := AuthFetch(peer.Username)
 		if err != nil {
 			return smtpd.Error{Code: 451, Message: "Bad sender address"}
 		}
 
-		if email != "" && strings.ToLower(addr) != strings.ToLower(email) {
+		if !addrAllowed(addr, allowedAddrs) {
 			return smtpd.Error{Code: 451, Message: "Bad sender address"}
 		}
 	}

main_test.go

@@ -0,0 +1,65 @@
+package main
+
+import (
+	"testing"
+)
+
+func TestAddrAllowedNoDomain(t *testing.T) {
+	allowedAddrs := []string{"[email protected]"}
+	if addrAllowed("bob.com", allowedAddrs) {
+		t.FailNow()
+	}
+}
+
+func TestAddrAllowedSingle(t *testing.T) {
+	allowedAddrs := []string{"[email protected]"}
+
+	if !addrAllowed("[email protected]", allowedAddrs) {
+		t.FailNow()
+	}
+	if addrAllowed("[email protected]", allowedAddrs) {
+		t.FailNow()
+	}
+}
+
+func TestAddrAllowedMulti(t *testing.T) {
+	allowedAddrs := []string{"[email protected]", "[email protected]"}
+	if !addrAllowed("[email protected]", allowedAddrs) {
+		t.FailNow()
+	}
+	if !addrAllowed("[email protected]", allowedAddrs) {
+		t.FailNow()
+	}
+	if addrAllowed("[email protected]", allowedAddrs) {
+		t.FailNow()
+	}
+}
+
+func TestAddrAllowedSingleDomain(t *testing.T) {
+	allowedAddrs := []string{"abc.com"}
+	if !addrAllowed("[email protected]", allowedAddrs) {
+		t.FailNow()
+	}
+	if addrAllowed("[email protected]", allowedAddrs) {
+		t.FailNow()
+	}
+}
+
+func TestAddrAllowedMixed(t *testing.T) {
+	allowedAddrs := []string{"[email protected]", "appsrv.example.com"}
+	if !addrAllowed("[email protected]", allowedAddrs) {
+		t.FailNow()
+	}
+	if addrAllowed("[email protected]", allowedAddrs) {
+		t.FailNow()
+	}
+	if !addrAllowed("[email protected]", allowedAddrs) {
+		t.FailNow()
+	}
+	if !addrAllowed("[email protected]", allowedAddrs) {
+		t.FailNow()
+	}
+	if addrAllowed("[email protected]", allowedAddrs) {
+		t.FailNow()
+	}
+}