open https://gitlab.synchro.net/main/sbbs/-/issues/1224

## Summary

`SMTP_AUTH_VIA_IP` no longer works on the message submission ports (587, and 465 for implicit TLS). A session that would be authorized by that option is refused at `MAIL FROM` with `530 Authentication required.`, because the IP-based lookup that establishes the authorization happens *after* the authentication gate that rejects it.

Introduced by b8332a4618 (chart-3-cause, 2026-08-10) for #1221. Port 25 is unaffected -- `SMTP_AUTH_VIA_IP` behaves there exactly as it always has.

## Mechanism

The submission ports now require authentication (RFC 6409 section 4.3), tested at the top of the `MAIL FROM` handler in `mailsrvr.cpp`:

```c
if (smtp->submission && relay_user.number == 0) {
... "530 Authentication required." ...
}
```

But the `SMTP_AUTH_VIA_IP` lookup that populates `relay_user` sits roughly 270 lines further down, inside the external-destination branch of the `RCPT TO` handler:

```c
if (relay_user.number == 0 /* not authenticated, search for IP */
&& startup->options & MAIL_OPT_SMTP_AUTH_VIA_IP) {
relay_user.number = finduserstr(&scfg, 0, USER_IPADDR, host_ip, ...);
if (relay_user.number) {
getuserdat(&scfg, &relay_user);
if (relay_user.laston < time(NULL) - (60 * 60)) /* logon in past hour? */
relay_user.number = 0;
}
}
```

`MAIL FROM` necessarily precedes `RCPT TO`, so `relay_user.number` is still 0 when the gate runs and the session never reaches the lookup.

## Why this is worth fixing rather than accepting

RFC 6409 section 4.3 anticipates exactly this case. The requirement is:

The MSA MUST, by default, issue an error response to the MAIL command if the session has not been authenticated using [SMTP-AUTH], **unless it has already independently established authentication or authorization (such as being within a protected subnetwork)**.

`SMTP_AUTH_VIA_IP` -- which requires the address to match a user record whose `laston` is within the past hour -- is precisely "independently established authorization". So honoring it on the submission ports is conformant, not a carve-out from the standard.

## Suggested fix

Resolve the IP-based authorization before the authentication gate rather than at `RCPT TO`: either at session start, or as a fallback inside the gate itself when `MAIL_OPT_SMTP_AUTH_VIA_IP` is set. The `RCPT TO` lookup then becomes redundant for those sessions and can consume the already-populated `relay_user`.

Doing so also closes the secondary gap, since sender validation is likewise gated on `relay_user.number != 0` at `MAIL FROM`: once the user is resolved earlier, an IP-authorized submission gets the same sender verification as a `SMTP AUTH` one, rather than being exempt from it.

## Note on the earlier description

The closing comment on #1221 characterized this as "sender validation does not reach them", which understates it. On the submission ports such sessions cannot submit at all; on the transfer port there is no sender validation to miss.

## Scope

`SMTP_AUTH_VIA_IP` is off by default, and it only matters in combination with `USE_SUBMISSION_PORT` or `TLS_SUBMISSION`. A sysop running both would see previously-working IP-authorized clients start getting `530` on 587/465.

-- *Authored by Claude (Claude Code), on behalf of @rswindell*
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)