Re: [msmtp-users] Proxy support patch

[Martin Lambers <marlam@...23...>]

Hi!

On Tue, 14 Oct 2014 09:49:02 +0000, CustaiCo wrote:
> > I propose the attached patch, which currently uses "localhost:1080"
> > as hardcoded proxy (this can be changed later). I tested it
> > against  'ssh -D 1080 -N mys-ssh-server'.
> > 
> > It is similar in functionality to your patch, but
> > - only implements SOCKS5 without authentication
> > - improves error diagnostics for the proxy connection
> > 
> > What do you think?
> 
> I tested the patch as well; it works just fine. 

OK, I pushed the patch to the git repository, complete with new
proxy_host and proxy_port commands and corresponding options, and
documentation.

Please test.

> My only concern is
> that it doesn't give the AI_NUMERICHOST hint when resolving the proxy
> server's address. Without that hint a malconfigured client could
> possibly attempt to do a nameserver query. Yes, it's the person who
> set it up's fault if that happens, but everybody makes mistakes. 

Hm, this may be a valid concern.

Should we add a new command "tor (on|off)" that does the following:
- Enforce proxy_host=127.0.0.1
- Enforce proxy_port=9050
- Enforce tls=on
- Enforce domain=localhost

The first and second should always have these values for Tor, right?

The third is highly recommended or even necessary for Tor as far as I
understand, because otherwise the exit node can read your SMTP session.

The fourth may be paranoid: it is the only place I can think of that
an SMTP session might leak clear text information before
TLS-via-STARTTLS sets in. And that requires user action, because
domain=localhost is the default.

The new command would serve only two purposes:
1) to add convenience and
2) to make it more difficult to shoot yourself in the foot.
It would not have another function; in particular you could achieve the
same effect by setting the four commands manually. So you still have a
way to configure for special cases, and if you then shoot yourself in
the foot, it is your own fault.

Does this make sense? Are there better ideas?

Martin