Add SMTP TLS and Authentication using libcurl by atomicturtle · Pull Request #2195 · ossec/ossec-hids

atomicturtle · 2026-03-14T22:15:59Z

Enable authenticated and TLS SMTP for ossec-maild when built with
USE_CURL=yes (off by default). Uses libcurl for SMTP AUTH (PLAIN/LOGIN)
and TLS/STARTTLS; credentials and TLS are validated and sanitized.

Security hardening: header/envelope CR/LF sanitization, hostname
validation for smtp_server, timeouts, mandatory TLS when AUTH is on,
post-parse credential validation, and secure clearing of password
in config and at exit.

CA bundle and chroot
ossec-maild runs inside a chroot (e.g. /var/ossec). libcurl uses
CURLOPT_SSL_VERIFYPEER=1 and by default looks for the system CA bundle
(e.g. /etc/ssl/certs/ca-certificates.crt). After chroot, that path
is not visible, so TLS verification fails (CURLE_PEER_FAILED_VERIFICATION)
and mail is dropped unless the CA bundle is available inside the chroot.
Installation (or the admin) must copy or symlink the system CA bundle
into the chroot (e.g. /etc/ssl/certs/ca-certificates.crt) and
either set CURLOPT_CAINFO to that path in code or ensure the default
path resolves inside the chroot. Do not disable VERIFYPEER.

Original idea and initial implementation from alexbartlow via
Allow TLS Email sends as a compile-time option
#1360

Credit: alexbartlow (PR #1360)

Enable authenticated and TLS SMTP for ossec-maild when built with USE_CURL=yes (off by default). Uses libcurl for SMTP AUTH (PLAIN/LOGIN) and TLS/STARTTLS; credentials and TLS are validated and sanitized. Security hardening: header/envelope CR/LF sanitization, hostname validation for smtp_server, timeouts, mandatory TLS when AUTH is on, post-parse credential validation, and secure clearing of password in config and at exit. CA bundle and chroot ossec-maild runs inside a chroot (e.g. /var/ossec). libcurl uses CURLOPT_SSL_VERIFYPEER=1 and by default looks for the system CA bundle (e.g. /etc/ssl/certs/ca-certificates.crt). After chroot, that path is not visible, so TLS verification fails (CURLE_PEER_FAILED_VERIFICATION) and mail is dropped unless the CA bundle is available inside the chroot. Installation (or the admin) must copy or symlink the system CA bundle into the chroot (e.g. <chroot>/etc/ssl/certs/ca-certificates.crt) and either set CURLOPT_CAINFO to that path in code or ensure the default path resolves inside the chroot. Do not disable VERIFYPEER. Original idea and initial implementation from alexbartlow via Allow TLS Email sends as a compile-time option ossec#1360 Credit: alexbartlow (PR ossec#1360) Signed-off-by: Scott R. Shinn <scott@atomicorp.com>

Copilot

Pull request overview

Adds an optional libcurl-based SMTP delivery path to ossec-maild (enabled only when building with USE_CURL=yes) to support SMTP AUTH and TLS/STARTTLS while running inside the project’s chrooted environment.

Changes:

Introduces USE_CURL build flag (USE_SMTP_CURL) and a new libcurl-based SMTP sender implementation.
Extends mail/global config parsing with auth_smtp, secure_smtp, smtp_user, smtp_password, and smtp_port, plus pre-resolution support for chroot.
Adds a new GitHub Actions multi-platform Make build workflow (Rocky + Windows cross-compile).

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
src/os_maild/sendmail.c	Compiles out legacy SMTP/local sendmail implementation when `USE_SMTP_CURL` is set.
src/os_maild/maild.c	Adds SMTP secret clearing and pre-chroot hostname resolution for curl mode.
src/os_maild/curlmail.c	New libcurl-based SMTP sender (TLS + AUTH) behind `USE_SMTP_CURL`.
src/os_maild/config.c	Initializes new mail config fields and adds curl-gated validation for AUTH.
src/monitord/main.c	Adjusts how monitord reads/validates `smtp_server` when `USE_SMTP_CURL` is defined.
src/config/mail-config.h	Adds SMTP TLS/AUTH-related fields to `MailConfig`.
src/config/global-config.h	Adds `authsmtp/securesmtp` flags to global config struct.
src/config/global-config.c	Parses new SMTP TLS/AUTH-related XML elements and pre-resolves SMTP host in curl mode.
src/Makefile	Adds `USE_CURL` toggle to enable `USE_SMTP_CURL` and link with `-lcurl`.
.github/workflows/make-multi-platform.yml	New CI workflow for Rocky Linux container builds + Windows cross-compile.
.github/workflows/README.md	Documents the workflows.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Signed-off-by: Scott R. Shinn <scott@atomicorp.com>

Copilot

Pull request overview

Adds an optional (compile-time) libcurl-based SMTP delivery path for ossec-maild, enabling SMTP AUTH and TLS/STARTTLS when built with USE_CURL=yes, along with related config parsing and build/CI wiring.

Changes:

Add new libcurl SMTP sender (OS_Sendmail) supporting AUTH + TLS/STARTTLS and hostname/IP pre-resolution for chrooted operation.
Extend global/mail config parsing with auth_smtp, secure_smtp, smtp_user, smtp_password, and smtp_port.
Add USE_CURL build switch (defines USE_SMTP_CURL, links -lcurl) and introduce a multi-platform GitHub Actions build workflow.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/os_maild/sendmail.c	Excludes the legacy sendmail/plain SMTP implementation when `USE_SMTP_CURL` is enabled.
src/os_maild/maild.c	Initializes/cleans up libcurl and pre-resolves SMTP hostnames before chroot; clears credentials in child.
src/os_maild/curlmail.c	New libcurl-based SMTP implementation (TLS/AUTH, CRLF sanitization, timeouts, CURLOPT_RESOLVE).
src/os_maild/config.c	Initializes new MailConfig fields and enforces option validity depending on `USE_SMTP_CURL`.
src/monitord/main.c	Adjusts SMTP server validation/storage to preserve hostname for libcurl builds.
src/config/mail-config.h	Extends `MailConfig` with curl/TLS/auth fields and pre-resolved SMTP IP.
src/config/global-config.h	Extends global `_Config` with auth/TLS flags.
src/config/global-config.c	Parses new SMTP auth/TLS options; pre-resolves SMTP host for chroot when curl is enabled.
src/Makefile	Adds `USE_CURL` switch to enable `USE_SMTP_CURL` and link `-lcurl`.
.github/workflows/make-multi-platform.yml	New CI workflow to build on Rocky Linux container + cross-compile Windows agent.
.github/workflows/README.md	Documents the workflows.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Signed-off-by: Scott R. Shinn <scott@atomicorp.com>

Copilot

Pull request overview

Adds an optional libcurl-backed SMTP implementation for ossec-maild (enabled with USE_CURL=yes) to support SMTP AUTH and TLS/STARTTLS, plus related config wiring and build/CI updates.

Changes:

Introduces src/os_maild/curlmail.c (libcurl SMTP sender) and gates the legacy sendmail.c implementation behind #ifndef USE_SMTP_CURL.
Extends global/mail configuration parsing and structs for auth_smtp, secure_smtp, smtp_user, smtp_password, and smtp_port, including pre-resolution storage for chrooted operation.
Adds USE_CURL build flag support and a new multi-platform GitHub Actions build workflow.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/os_maild/sendmail.c	Wraps legacy SMTP/sendmail implementation behind `!USE_SMTP_CURL`.
src/os_maild/maild.c	Initializes libcurl globally (curl build) and pre-resolves SMTP hostname before chroot.
src/os_maild/curlmail.c	New libcurl SMTP sender with TLS/AUTH support and sanitization/error logging.
src/os_maild/config.c	Initializes new MailConfig fields; enforces curl-build requirement for AUTH/TLS options.
src/monitord/main.c	Adjusts how `smtp_server` is validated/stored when `USE_SMTP_CURL` is enabled.
src/config/mail-config.h	Adds new SMTP AUTH/TLS fields and `smtpserver_resolved` to MailConfig.
src/config/global-config.h	Adds global `authsmtp/securesmtp` flags to the global config struct.
src/config/global-config.c	Parses new SMTP AUTH/TLS XML fields and pre-resolves SMTP host when curl is enabled.
src/Makefile	Adds `USE_CURL` option to define `USE_SMTP_CURL` and link `-lcurl`.
README.md	Documents libcurl SMTP error logging behavior at a high level.
.github/workflows/make-multi-platform.yml	Adds a new multi-platform build workflow (Rocky + Windows cross-compile).
.github/workflows/README.md	Documents the repository’s GitHub Actions workflows.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Monitord has a configurable email report that operates independently of ossec-maild in OS_SendCustomEmail2 - Implement libcurl-based SMTP send path in sendcustomemail.c with support for SMTP AUTH and TLS/SSL (CURLUSESSL_ALL). - Add auth_smtp, secure_smtp, smtp_port, smtp_user, and smtp_pass configuration options to monitord. Signed-off-by: Scott R. Shinn <scott@atomicorp.com>

Copilot

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Signed-off-by: Scott R. Shinn <scott@atomicorp.com>

- monitord main/sendcustomemail and os_maild config updates - Rocky 9 workflow: keep upstream CRB/deps; add USE_CURL matrix + libcurl-devel

Signed-off-by: Scott R. Shinn <scott@atomicorp.com>

Copilot

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-22T18:36:31Z

+    if (!is_valid_smtp_host(smtpserver)) {
+        merror("%s: ERROR: Invalid SMTP server '%s' (contains invalid characters).", ARGV0, smtpserver);
+        return (0);
+    }


In the libcurl path, invalid smtpserver currently logs an error but then returns 0 (success) and also skips the cleanup_curl path, leaking curl, body_fp, and header_buf. This should return an error (e.g., OS_INVALID) and go through the normal cleanup path (e.g., set res and goto cleanup_curl).

Copilot · 2026-03-22T18:36:31Z

+    if (n2 < 0 || (size_t)n2 >= sizeof(mail_url)) {
+        merror("%s: ERROR: SMTP server or URL too long (truncation).", ARGV0);
+        return (0);
+    }


On URL truncation, this path also returns 0 (success) and bypasses cleanup, leaking the libcurl handle / open file / header buffer. Please return an error and route through cleanup_curl (or otherwise free resources) before returning.

Copilot · 2026-03-22T18:36:32Z

+                if (mond.reports) {
+                    mond.smtp_user = OS_GetOneContentforElement(&xml, xml_smtp_user);
+                    mond.smtp_pass = OS_GetOneContentforElement(&xml, xml_smtp_pass);
+
+                    if (mond.authsmtp && (!mond.smtp_user || !mond.smtp_pass)) {
+                        merror("%s: ERROR: SMTP auth enabled but user/pass missing. Disabling email reports.", ARGV0);
+                        if (mond.emailfrom) {


Even in non-USE_SMTP_CURL builds, this reads and stores smtp_user/smtp_password into mond.*, but the secret-clearing atexit handler is only installed under USE_SMTP_CURL. This can leave credentials resident in memory unnecessarily. Please avoid reading these secrets when curl support is not compiled in (or ensure they are securely cleared regardless).

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

atomicturtle requested a review from Copilot March 14, 2026 22:15

Copilot started reviewing on behalf of atomicturtle March 14, 2026 22:16 View session

Copilot AI reviewed Mar 14, 2026

View reviewed changes

Code fixes

9e1fa8b

Signed-off-by: Scott R. Shinn <scott@atomicorp.com>

atomicturtle requested a review from Copilot March 14, 2026 22:48

Copilot started reviewing on behalf of atomicturtle March 14, 2026 22:48 View session

Copilot AI reviewed Mar 14, 2026

View reviewed changes

Comment thread src/os_maild/maild.c Outdated

Comment thread src/os_maild/config.c

Comment thread src/os_maild/curlmail.c

Comment thread src/os_maild/curlmail.c Outdated

Comment thread src/os_maild/curlmail.c

Potential fix for pull request finding

16a92d8

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

atomicturtle mentioned this pull request Mar 14, 2026

Configuring email alerts is a nerve racking endeavor #2161

Open

Improve logging for TLS failures

487ffb8

Signed-off-by: Scott R. Shinn <scott@atomicorp.com>

atomicturtle requested a review from Copilot March 22, 2026 01:20

Copilot started reviewing on behalf of atomicturtle March 22, 2026 01:20 View session

Copilot AI reviewed Mar 22, 2026

View reviewed changes

Comment thread src/os_maild/curlmail.c

Comment thread src/os_maild/curlmail.c Outdated

Comment thread src/os_maild/curlmail.c Outdated

Comment thread src/monitord/main.c

atomicturtle requested a review from Copilot March 22, 2026 17:10

Copilot started reviewing on behalf of atomicturtle March 22, 2026 17:10 View session

Copilot AI reviewed Mar 22, 2026

View reviewed changes

Comment thread src/monitord/sendcustomemail.c

Comment thread src/monitord/sendcustomemail.c

Comment thread src/monitord/main.c

Comment thread .github/workflows/make-multi-platform.yml

Comment thread src/os_maild/config.c

atomicturtle added 3 commits March 22, 2026 13:46

Merge branch 'master' into smtp-auth-01

6dba249

Signed-off-by: Scott R. Shinn <scott@atomicorp.com>

SMTP/monitord and CI: restore stashed changes after master merge

b9305d3

- monitord main/sendcustomemail and os_maild config updates - Rocky 9 workflow: keep upstream CRB/deps; add USE_CURL matrix + libcurl-devel

QA round 2

b7b7206

Signed-off-by: Scott R. Shinn <scott@atomicorp.com>

atomicturtle requested a review from Copilot March 22, 2026 18:30

Copilot started reviewing on behalf of atomicturtle March 22, 2026 18:31 View session

Copilot AI reviewed Mar 22, 2026

View reviewed changes

atomicturtle and others added 4 commits March 22, 2026 14:38

Update src/os_maild/curlmail.c

85e4015

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update src/os_maild/curlmail.c

353a5a0

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update src/os_maild/curlmail.c

9cd95f0

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update src/monitord/sendcustomemail.c

bcf5085

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

atomicturtle merged commit 7caaa78 into ossec:main Mar 22, 2026
5 checks passed

atomicturtle deleted the smtp-auth-01 branch April 11, 2026 19:35

Conversation

atomicturtle commented Mar 14, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Mar 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Mar 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants