Limit the number of messages that can be enqueued on a single SMTP

connection, and the number of recipients in each of them.

ok gilles@ chl@

2 files changed, 17 insertions, 2 deletions

diff --git a/usr.sbin/smtpd/smtp_session.c b/usr.sbin/smtpd/smtp_session.c
index 41148359a13..9ca5d957c79 100644
--- a/usr.sbin/smtpd/smtp_session.c
+++ b/usr.sbin/smtpd/smtp_session.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: smtp_session.c,v 1.172 2012/10/11 21:24:51 gilles Exp $	*/
+/*	$OpenBSD: smtp_session.c,v 1.173 2012/10/28 08:46:26 eric Exp $	*/
 
 /*
  * Copyright (c) 2008 Gilles Chehade <gilles@openbsd.org>
@@ -40,6 +40,9 @@
 #include "smtpd.h"
 #include "log.h"
 
+#define SMTP_MAXMAIL	100
+#define SMTP_MAXRCPT	1000
+
 #define ADVERTISE_TLS(s) \
 	((s)->s_l->flags & F_STARTTLS && !((s)->s_flags & F_SECURE))
 
@@ -420,6 +423,11 @@ session_rfc5321_mail_handler(struct session *s, char *args)
 		return 1;
 	}
 
+	if (s->mailcount >= SMTP_MAXMAIL) {
+		session_respond(s, "452 Too many messages sent");
+		return 1;
+	}
+
 	if (! session_set_mailaddr(&s->s_msg.sender, args)) {
 		/* No need to even transmit to MFA, path is invalid */
 		session_respond(s, "553 5.1.7 Sender address syntax error");
@@ -448,6 +456,11 @@ session_rfc5321_rcpt_handler(struct session *s, char *args)
 		return 1;
 	}
 
+	if (s->rcptcount >= SMTP_MAXRCPT) {
+		session_respond(s, "452 Too many recipients");
+		return 1;
+	}
+
 	if (! session_set_mailaddr(&s->s_msg.rcpt, args)) {
 		/* No need to even transmit to MFA, path is invalid */
 		session_respond(s, "553 5.1.3 Recipient address syntax error");
@@ -876,6 +889,7 @@ session_pickup(struct session *s, struct submit_status *ss)
 
 		session_enter_state(s, S_HELO);
 		s->s_msg.id = 0;
+		s->mailcount++;
 		bzero(&s->s_nresp, sizeof(s->s_nresp));
 		break;
 
diff --git a/usr.sbin/smtpd/smtpd.h b/usr.sbin/smtpd/smtpd.h
index 260b8d95287..91d4b403c24 100644
--- a/usr.sbin/smtpd/smtpd.h
+++ b/usr.sbin/smtpd/smtpd.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: smtpd.h,v 1.390 2012/10/16 12:02:23 eric Exp $	*/
+/*	$OpenBSD: smtpd.h,v 1.391 2012/10/28 08:46:26 eric Exp $	*/
 
 /*
  * Copyright (c) 2008 Gilles Chehade <gilles@openbsd.org>
@@ -543,6 +543,7 @@ struct session {
 	struct timeval			 s_tv;
 	struct envelope			 s_msg;
 	short				 s_nresp[STATE_COUNT];
+	size_t				 mailcount;
 	size_t				 rcptcount;
 	long				 s_datalen;