support implicit TLS for mail submission agents

Fixes #2048

default.yaml

@@ -417,6 +417,7 @@ accounts:
             #     port: 25
             #     username: "admin"
             #     password: "hunter2"
+            #     implicit-tls: false # TLS from the first byte, typically on port 465
             blacklist-regexes:
             #    - ".*@mailinator.com"
             timeout: 60s

irc/email/email.go

@@ -28,6 +28,7 @@ type MTAConfig struct {
 	Port        int
 	Username    string
 	Password    string
+	ImplicitTLS bool `yaml:"implicit-tls"`
 }
 
 type MailtoConfig struct {
@@ -132,11 +133,13 @@ func SendMail(config MailtoConfig, recipient string, msg []byte) (err error) {
 
 	var addr string
 	var auth smtp.Auth
+	var implicitTLS bool
 	if !config.DirectSendingEnabled() {
 		addr = fmt.Sprintf("%s:%d", config.MTAReal.Server, config.MTAReal.Port)
 		if config.MTAReal.Username != "" && config.MTAReal.Password != "" {
 			auth = smtp.PlainAuth("", config.MTAReal.Username, config.MTAReal.Password, config.MTAReal.Server)
 		}
+		implicitTLS = config.MTAReal.ImplicitTLS
 	} else {
 		idx := strings.IndexByte(recipient, '@')
 		if idx == -1 {
@@ -149,5 +152,8 @@ func SendMail(config MailtoConfig, recipient string, msg []byte) (err error) {
 		addr = fmt.Sprintf("%s:smtp", mx)
 	}
 
-	return smtp.SendMail(addr, auth, config.HeloDomain, config.Sender, []string{recipient}, msg, config.RequireTLS, config.Timeout)
+	return smtp.SendMail(
+		addr, auth, config.HeloDomain, config.Sender, []string{recipient}, msg,
+		config.RequireTLS, implicitTLS, config.Timeout,
+	)
 }

irc/smtp/smtp.go

@@ -55,14 +55,17 @@ type Client struct {
 
 // Dial returns a new Client connected to an SMTP server at addr.
 // The addr must include a port, as in "mail.example.com:smtp".
-func Dial(addr string, timeout time.Duration) (*Client, error) {
+func Dial(addr string, timeout time.Duration, implicitTLS bool) (*Client, error) {
 	var conn net.Conn
 	var err error
+	dialer := net.Dialer{
+		Timeout: timeout,
+	}
 	start := time.Now()
-	if timeout == 0 {
-		conn, err = net.Dial("tcp", addr)
+	if !implicitTLS {
+		conn, err = dialer.Dial("tcp", addr)
 	} else {
-		conn, err = net.DialTimeout("tcp", addr, timeout)
+		conn, err = tls.DialWithDialer(&dialer, "tcp", addr, nil)
 	}
 	if err != nil {
 		return nil, err
@@ -338,7 +341,7 @@ var testHookStartTLS func(*tls.Config) // nil, except for tests
 // functionality. Higher-level packages exist outside of the standard
 // library.
 // XXX: modified in Ergo to add `requireTLS`, `heloDomain`, and `timeout` arguments
-func SendMail(addr string, a Auth, heloDomain string, from string, to []string, msg []byte, requireTLS bool, timeout time.Duration) error {
+func SendMail(addr string, a Auth, heloDomain string, from string, to []string, msg []byte, requireTLS, implicitTLS bool, timeout time.Duration) error {
 	if err := validateLine(from); err != nil {
 		return err
 	}
@@ -347,7 +350,7 @@ func SendMail(addr string, a Auth, heloDomain string, from string, to []string,
 			return err
 		}
 	}
-	c, err := Dial(addr, timeout)
+	c, err := Dial(addr, timeout, implicitTLS)
 	if err != nil {
 		return err
 	}
@@ -355,6 +358,7 @@ func SendMail(addr string, a Auth, heloDomain string, from string, to []string,
 	if err = c.Hello(heloDomain); err != nil {
 		return err
 	}
+	if !implicitTLS {
 		if ok, _ := c.Extension("STARTTLS"); ok {
 			var config *tls.Config
 			if requireTLS {
@@ -373,6 +377,7 @@ func SendMail(addr string, a Auth, heloDomain string, from string, to []string,
 		} else if requireTLS {
 			return errors.New("TLS required, but not negotiated")
 		}
+	}
 	if a != nil && c.ext != nil {
 		if _, ok := c.ext["AUTH"]; !ok {
 			return errors.New("smtp: server doesn't support AUTH")

traditional.yaml

@@ -390,6 +390,7 @@ accounts:
             #     port: 25
             #     username: "admin"
             #     password: "hunter2"
+            #     implicit-tls: false # TLS from the first byte, typically on port 465
             blacklist-regexes:
             #    - ".*@mailinator.com"
             timeout: 60s