net-smtp 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 78828322ead199854db6be7e42250f1a185f13979020922e49c9865c499c7305
-  data.tar.gz: 88387d583063d1ee6478621d4e2d622582f09a7b7a11f50e9bd067575da8ba35
+  metadata.gz: f36274dfebf0d3d7960904ebb1ea198c7a6864adeed057c4095aa59607e0b965
+  data.tar.gz: c6a5037aae097aca70103a76eb496472541b62286b23299389b368000abb403f
 SHA512:
-  metadata.gz: fc0c2ba9462420db511321f9206db5035ecc3778e9e4b526634c7a98ffbc089bae94f4056a4385582f2cfe734a15f9ce8724f355cdbfbeb0c299fa3331d2f9e0
-  data.tar.gz: 86b82c9b891c41fea7829ea8c201835930cf3ba93966b51c636d56aeb54f9e132d530264b9b2b93a42364cfe5d841b287df4173a56b9541ca22f3c0f9bbb4b60
+  metadata.gz: e407c785d6f9f7eaf9a243b4be97cadf94485f00027f161f418ad7727a6a968a4e84398e1c797d3066947168c3ec3472f48b77825663b5848072581240097ff8
+  data.tar.gz: 155b3aaf44e0c39d6084bcded6ca3b17c53679a256214053e0d021c02c5fa2a4e503ca61cea2cc44749b1dbecaab390d5cbc7ab3209429be4b08c8cbb0f2766b

data/.github/workflows/test.yml

@@ -0,0 +1,24 @@
+name: test
+
+on: [push, pull_request]
+
+jobs:
+  build:
+    name: build (${{ matrix.ruby }} / ${{ matrix.os }})
+    strategy:
+      matrix:
+        ruby: [ 2.7, 2.6, 2.5, head ]
+        os: [ ubuntu-latest, macos-latest ]
+    runs-on: ${{ matrix.os }}
+    steps:
+    - uses: actions/checkout@master
+    - name: Set up Ruby
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: ${{ matrix.ruby }}
+    - name: Install dependencies
+      run: |
+        gem install bundler --no-document
+        bundle install
+    - name: Run test
+      run: rake test

data/NEWS.md

@@ -0,0 +1,44 @@
+# NEWS
+
+## Version 0.2.0 (2020-11-15)
+
+### Incompatible changes
+
+* Verify the server's certificate by default.
+  If you don't want verification, specify `start(tls_verify: false)`.
+  <https://github.com/ruby/net-smtp/pull/12>
+
+* Use STARTTLS by default if possible.
+  If you don't want starttls, specify:
+      ```
+      smtp = Net::SMTP.new(hostname, port)
+      smtp.disable_starttls
+      smtp.start do |s|
+        s.send_message ....
+      end
+      ```
+  <https://github.com/ruby/net-smtp/pull/9>
+
+### Improvements
+
+* Net::SMTP.start and Net::SMTP#start arguments are keyword arguments.
+      ```
+      start(address, port = nil, helo: 'localhost', user: nil, secret: nil, authtype: nil) { |smtp| ... }
+      ```
+  `password` is an alias of `secret`.
+  <https://github.com/ruby/net-smtp/pull/7>
+
+* Add `tls_hostname` parameter to `start()`.
+  If you want to use a different hostname than the certificate for the connection, you can specify the certificate hostname with `tls_hostname`.
+  <https://github.com/ruby/net-smtp/pull/14>
+
+* Add SNI support to net/smtp <https://github.com/ruby/net-smtp/pull/4>
+
+### Fixes
+
+* enable_starttls before disable_tls causes an error. <https://github.com/ruby/net-smtp/pull/10>
+* TLS should not check the hostname when verify_mode is disabled. <https://github.com/ruby/net-smtp/pull/6>
+
+## Version 0.1.0 (2019-12-03)
+
+This is the first release of net-smtp gem.

data/README.md

@@ -94,4 +94,4 @@ To install this gem onto your local machine, run `bundle exec rake install`. To
 
 ## Contributing
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/hsbt/net-smtp.
+Bug reports and pull requests are welcome on GitHub at https://github.com/ruby/net-smtp.

data/lib/net/smtp.rb

@@ -146,8 +146,8 @@ module Net
   # The SMTP server will judge whether it should send or reject
   # the SMTP session by inspecting the HELO domain.
   #
-  #     Net::SMTP.start('your.smtp.server', 25,
-  #                     'mail.from.domain') { |smtp| ... }
+  #     Net::SMTP.start('your.smtp.server', 25
+  #                     helo: 'mail.from.domain') { |smtp| ... }
   #
   # === SMTP Authentication
   #
@@ -157,17 +157,18 @@ module Net
   # SMTP.start/SMTP#start.
   #
   #     # PLAIN
-  #     Net::SMTP.start('your.smtp.server', 25, 'mail.from.domain',
-  #                     'Your Account', 'Your Password', :plain)
+  #     Net::SMTP.start('your.smtp.server', 25
+  #                     user: 'Your Account', secret: 'Your Password', authtype: :plain)
   #     # LOGIN
-  #     Net::SMTP.start('your.smtp.server', 25, 'mail.from.domain',
-  #                     'Your Account', 'Your Password', :login)
+  #     Net::SMTP.start('your.smtp.server', 25
+  #                     user: 'Your Account', secret: 'Your Password', authtype: :login)
   #
   #     # CRAM MD5
-  #     Net::SMTP.start('your.smtp.server', 25, 'mail.from.domain',
-  #                     'Your Account', 'Your Password', :cram_md5)
+  #     Net::SMTP.start('your.smtp.server', 25
+  #                     user: 'Your Account', secret: 'Your Password', authtype: :cram_md5)
   #
   class SMTP < Protocol
+    VERSION = "0.2.0"
 
     Revision = %q$Revision$.split[1]
 
@@ -190,8 +191,13 @@ module Net
       alias default_ssl_port default_tls_port
     end
 
-    def SMTP.default_ssl_context
-      OpenSSL::SSL::SSLContext.new
+    def SMTP.default_ssl_context(verify_peer=true)
+      context = OpenSSL::SSL::SSLContext.new
+      context.verify_mode = verify_peer ? OpenSSL::SSL::VERIFY_PEER : OpenSSL::SSL::VERIFY_NONE
+      store = OpenSSL::X509::Store.new
+      store.set_default_paths
+      context.cert_store = store
+      context
     end
 
     #
@@ -217,8 +223,9 @@ module Net
       @error_occurred = false
       @debug_output = nil
       @tls = false
-      @starttls = false
-      @ssl_context = nil
+      @starttls = :auto
+      @ssl_context_tls = nil
+      @ssl_context_starttls = nil
     end
 
     # Provide human-readable stringification of class state.
@@ -293,11 +300,11 @@ module Net
     # Enables SMTP/TLS (SMTPS: SMTP over direct TLS connection) for
     # this object.  Must be called before the connection is established
     # to have any effect.  +context+ is a OpenSSL::SSL::SSLContext object.
-    def enable_tls(context = SMTP.default_ssl_context)
+    def enable_tls(context = nil)
       raise 'openssl library not installed' unless defined?(OpenSSL)
-      raise ArgumentError, "SMTPS and STARTTLS is exclusive" if @starttls
+      raise ArgumentError, "SMTPS and STARTTLS is exclusive" if @starttls == :always
       @tls = true
-      @ssl_context = context
+      @ssl_context_tls = context
     end
 
     alias enable_ssl enable_tls
@@ -306,7 +313,7 @@ module Net
     # connection is established to have any effect.
     def disable_tls
       @tls = false
-      @ssl_context = nil
+      @ssl_context_tls = nil
     end
 
     alias disable_ssl disable_tls
@@ -330,27 +337,27 @@ module Net
 
     # Enables SMTP/TLS (STARTTLS) for this object.
     # +context+ is a OpenSSL::SSL::SSLContext object.
-    def enable_starttls(context = SMTP.default_ssl_context)
+    def enable_starttls(context = nil)
       raise 'openssl library not installed' unless defined?(OpenSSL)
       raise ArgumentError, "SMTPS and STARTTLS is exclusive" if @tls
       @starttls = :always
-      @ssl_context = context
+      @ssl_context_starttls = context
     end
 
     # Enables SMTP/TLS (STARTTLS) for this object if server accepts.
     # +context+ is a OpenSSL::SSL::SSLContext object.
-    def enable_starttls_auto(context = SMTP.default_ssl_context)
+    def enable_starttls_auto(context = nil)
       raise 'openssl library not installed' unless defined?(OpenSSL)
       raise ArgumentError, "SMTPS and STARTTLS is exclusive" if @tls
       @starttls = :auto
-      @ssl_context = context
+      @ssl_context_starttls = context
     end
 
     # Disables SMTP/TLS (STARTTLS) for this object.  Must be called
     # before the connection is established to have any effect.
     def disable_starttls
       @starttls = false
-      @ssl_context = nil
+      @ssl_context_starttls = nil
     end
 
     # The address of the SMTP server to connect to.
@@ -400,12 +407,16 @@ module Net
     # SMTP session control
     #
 
+    #
+    # :call-seq:
+    #  start(address, port = nil, helo: 'localhost', user: nil, secret: nil, authtype: nil, tls_verify: true, tls_hostname: nil) { |smtp| ... }
+    #  start(address, port = nil, helo = 'localhost', user = nil, secret = nil, authtype = nil) { |smtp| ... }
     #
     # Creates a new Net::SMTP object and connects to the server.
     #
     # This method is equivalent to:
     #
-    #   Net::SMTP.new(address, port).start(helo_domain, account, password, authtype)
+    #   Net::SMTP.new(address, port).start(helo: helo_domain, user: account, secret: password, authtype: authtype, tls_verify: flag, tls_hostname: hostname)
     #
     # === Example
     #
@@ -435,6 +446,9 @@ module Net
     # or other authentication token; and +authtype+ is the authentication
     # type, one of :plain, :login, or :cram_md5.  See the discussion of
     # SMTP Authentication in the overview notes.
+    # If +tls_verify+ is true, verify the server's certificate. The default is true.
+    # If the hostname in the server certificate is different from +address+,
+    # it can be specified with +tls_hostname+.
     #
     # === Errors
     #
@@ -449,10 +463,16 @@ module Net
     # * Net::ReadTimeout
     # * IOError
     #
-    def SMTP.start(address, port = nil, helo = 'localhost',
-                   user = nil, secret = nil, authtype = nil,
-                   &block)   # :yield: smtp
-      new(address, port).start(helo, user, secret, authtype, &block)
+    def SMTP.start(address, port = nil, *args, helo: nil,
+                   user: nil, secret: nil, password: nil, authtype: nil,
+                   tls_verify: true, tls_hostname: nil,
+                   &block)
+      raise ArgumentError, "wrong number of arguments (given #{args.size + 2}, expected 1..6)" if args.size > 4
+      helo ||= args[0] || 'localhost'
+      user ||= args[1]
+      secret ||= password || args[2]
+      authtype ||= args[3]
+      new(address, port).start(helo: helo, user: user, secret: secret, authtype: authtype, tls_verify: tls_verify, tls_hostname: tls_hostname, &block)
     end
 
     # +true+ if the SMTP session has been started.
@@ -460,6 +480,10 @@ module Net
       @started
     end
 
+    #
+    # :call-seq:
+    #  start(helo: 'localhost', user: nil, secret: nil, authtype: nil, tls_verify: true, tls_hostname: nil) { |smtp| ... }
+    #  start(helo = 'localhost', user = nil, secret = nil, authtype = nil) { |smtp| ... }
     #
     # Opens a TCP connection and starts the SMTP session.
     #
@@ -473,6 +497,9 @@ module Net
     # the type of authentication to attempt; it must be one of
     # :login, :plain, and :cram_md5.  See the notes on SMTP Authentication
     # in the overview.
+    # If +tls_verify+ is true, verify the server's certificate. The default is true.
+    # If the hostname in the server certificate is different from +address+,
+    # it can be specified with +tls_hostname+.
     #
     # === Block Usage
     #
@@ -487,7 +514,7 @@ module Net
     #
     #     require 'net/smtp'
     #     smtp = Net::SMTP.new('smtp.mail.server', 25)
-    #     smtp.start(helo_domain, account, password, authtype) do |smtp|
+    #     smtp.start(helo: helo_domain, user: account, secret: password, authtype: authtype) do |smtp|
     #       smtp.send_message msgstr, 'from@example.com', ['dest@example.com']
     #     end
     #
@@ -511,8 +538,20 @@ module Net
     # * Net::ReadTimeout
     # * IOError
     #
-    def start(helo = 'localhost',
-              user = nil, secret = nil, authtype = nil)   # :yield: smtp
+    def start(*args, helo: nil,
+              user: nil, secret: nil, password: nil, authtype: nil, tls_verify: true, tls_hostname: nil)
+      raise ArgumentError, "wrong number of arguments (given #{args.size}, expected 0..4)" if args.size > 4
+      helo ||= args[0] || 'localhost'
+      user ||= args[1]
+      secret ||= password || args[2]
+      authtype ||= args[3]
+      if @tls && @ssl_context_tls.nil?
+        @ssl_context_tls = SMTP.default_ssl_context(tls_verify)
+      end
+      if @starttls && @ssl_context_starttls.nil?
+        @ssl_context_starttls = SMTP.default_ssl_context(tls_verify)
+      end
+      @tls_hostname = tls_hostname
       if block_given?
         begin
           do_start helo, user, secret, authtype
@@ -549,16 +588,16 @@ module Net
         tcp_socket(@address, @port)
       end
       logging "Connection opened: #{@address}:#{@port}"
-      @socket = new_internet_message_io(tls? ? tlsconnect(s) : s)
+      @socket = new_internet_message_io(tls? ? tlsconnect(s, @ssl_context_tls) : s)
       check_response critical { recv_response() }
       do_helo helo_domain
-      if starttls_always? or (capable_starttls? and starttls_auto?)
+      if ! tls? and (starttls_always? or (capable_starttls? and starttls_auto?))
         unless capable_starttls?
           raise SMTPUnsupportedCommand,
               "STARTTLS is not supported on this server"
         end
         starttls
-        @socket = new_internet_message_io(tlsconnect(s))
+        @socket = new_internet_message_io(tlsconnect(s, @ssl_context_starttls))
         # helo response may be different after STARTTLS
         do_helo helo_domain
       end
@@ -576,14 +615,15 @@ module Net
       OpenSSL::SSL::SSLSocket.new socket, context
     end
 
-    def tlsconnect(s)
+    def tlsconnect(s, context)
       verified = false
-      s = ssl_socket(s, @ssl_context)
+      s = ssl_socket(s, context)
       logging "TLS connection started"
       s.sync_close = true
+      s.hostname = @tls_hostname || @address if s.respond_to? :hostname=
       ssl_socket_connect(s, @open_timeout)
-      if @ssl_context.verify_mode != OpenSSL::SSL::VERIFY_NONE
-        s.post_connection_check(@address)
+      if context.verify_mode && context.verify_mode != OpenSSL::SSL::VERIFY_NONE
+        s.post_connection_check(@tls_hostname || @address)
       end
       verified = true
       s
@@ -831,9 +871,6 @@ module Net
     end
 
     def mailfrom(from_addr)
-      if $SAFE > 0
-        raise SecurityError, 'tainted from_addr' if from_addr.tainted?
-      end
       getok("MAIL FROM:<#{from_addr}>")
     end
 
@@ -859,9 +896,6 @@ module Net
     end
 
     def rcptto(to_addr)
-      if $SAFE > 0
-        raise SecurityError, 'tainted to_addr' if to_addr.tainted?
-      end
       getok("RCPT TO:<#{to_addr}>")
     end
 
@@ -1048,7 +1082,7 @@ module Net
         return {} unless @string[3, 1] == '-'
         h = {}
         @string.lines.drop(1).each do |line|
-          k, *v = line[4..-1].chomp.split
+          k, *v = line[4..-1].split(' ')
           h[k] = v
         end
         h

data/net-smtp.gemspec

@@ -1,23 +1,29 @@
-lib = File.expand_path("lib", __dir__)
-$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
-require "net/smtp/version"
+# frozen_string_literal: true
+
+name = File.basename(__FILE__, ".gemspec")
+version = ["lib", Array.new(name.count("-"), "..").join("/")].find do |dir|
+  break File.foreach(File.join(__dir__, dir, "#{name.tr('-', '/')}.rb")) do |line|
+    /^\s*VERSION\s*=\s*"(.*)"/ =~ line and break $1
+  end rescue nil
+end
 
 Gem::Specification.new do |spec|
-  spec.name          = "net-smtp"
-  spec.version       = Net::SMTP::VERSION
-  spec.authors       = ["Hiroshi SHIBATA"]
-  spec.email         = ["hsbt@ruby-lang.org"]
+  spec.name          = name
+  spec.version       = version
+  spec.authors       = ["Yukihiro Matsumoto"]
+  spec.email         = ["matz@ruby-lang.org"]
 
   spec.summary       = %q{Simple Mail Transfer Protocol client library for Ruby.}
   spec.description   = %q{Simple Mail Transfer Protocol client library for Ruby.}
   spec.homepage      = "https://github.com/ruby/net-smtp"
   spec.license       = "BSD-2-Clause"
+  spec.required_ruby_version = ">= 2.5.0"
 
   spec.metadata["homepage_uri"] = spec.homepage
   spec.metadata["source_code_uri"] = spec.homepage
 
   spec.files         = Dir.chdir(File.expand_path('..', __FILE__)) do
-    `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
+    `git ls-files -z 2>/dev/null`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
   end
   spec.bindir        = "exe"
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }

metadata

@@ -1,32 +1,32 @@
 --- !ruby/object:Gem::Specification
 name: net-smtp
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
-- Hiroshi SHIBATA
-autorequire: 
+- Yukihiro Matsumoto
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2019-11-06 00:00:00.000000000 Z
+date: 2020-11-14 00:00:00.000000000 Z
 dependencies: []
 description: Simple Mail Transfer Protocol client library for Ruby.
 email:
-- hsbt@ruby-lang.org
+- matz@ruby-lang.org
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/workflows/test.yml"
 - ".gitignore"
-- ".travis.yml"
 - Gemfile
 - LICENSE.txt
+- NEWS.md
 - README.md
 - Rakefile
 - bin/console
 - bin/setup
 - lib/net/smtp.rb
-- lib/net/smtp/version.rb
 - net-smtp.gemspec
 homepage: https://github.com/ruby/net-smtp
 licenses:
@@ -34,7 +34,7 @@ licenses:
 metadata:
   homepage_uri: https://github.com/ruby/net-smtp
   source_code_uri: https://github.com/ruby/net-smtp
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -42,15 +42,15 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 2.5.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
-signing_key: 
+rubygems_version: 3.2.0.rc.1
+signing_key:
 specification_version: 4
 summary: Simple Mail Transfer Protocol client library for Ruby.
 test_files: []

data/.travis.yml

@@ -1,7 +0,0 @@
----
-sudo: false
-language: ruby
-cache: bundler
-rvm:
-  - 2.6.3
-before_install: gem install bundler -v 2.0.2

data/lib/net/smtp/version.rb

@@ -1,5 +0,0 @@
-module Net
-  module SMTP
-    VERSION = "0.1.0"
-  end
-end