Today, we close the connection after 10 errors. While this is fine for normal use, it is unnecessarily large. Lowering it to 3 helps with defense-in-depth for cross-protocol attacks (e.g. https://alpaca-attack.com/), while still being large enough for useful troubleshooting and normal operation. As part of this change, we also remove the AUTH-specific failures limit, because they're covered by the connection limit.
15 lines
210 B
Plaintext
15 lines
210 B
Plaintext
|
|
c tls_connect localhost:1465
|
|
|
|
c <~ 220
|
|
c -> EHLO localhost
|
|
c <... 250 HELP
|
|
|
|
c -> AUTH PLAIN something
|
|
c <~ 501
|
|
c -> AUTH PLAIN something
|
|
c <~ 501
|
|
c -> AUTH PLAIN something
|
|
c <~ 421 4.5.0 Too many errors, bye
|
|
|