feat: SPOOF_PROTECTION=1 support config to relax sender restrictions by login
#4044
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| /^user3@localhost.localdomain/ user1@localhost.localdomain |
File renamed without changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| From: User 1 <user1@localhost.localdomain> | ||
| To: Existing Local User <user1@localhost.localdomain> | ||
| Date: Sat, 22 May 2010 07:43:25 -0400 | ||
| Subject: Test Message | ||
| This is a test mail. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| From: User 3 <user3@localhost.localdomain> | ||
| To: Existing Local User <user3@localhost.localdomain> | ||
| Date: Sat, 22 May 2010 07:43:25 -0400 | ||
| Subject: Test Message | ||
| This is a test mail. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,105 @@ | ||
| load "${REPOSITORY_ROOT}/test/helper/common" | ||
| load "${REPOSITORY_ROOT}/test/helper/setup" | ||
|
|
||
| BATS_TEST_NAME_PREFIX='[Postfix] (sender spoofing) ' | ||
| CONTAINER_NAME='dms-test_postfix-spoofing' | ||
|
|
||
| function setup_file() { | ||
| _init_with_defaults | ||
|
|
||
| local CUSTOM_SETUP_ARGUMENTS=( | ||
| --env SPOOF_PROTECTION=1 | ||
| --env LOG_LEVEL=trace | ||
| --env SSL_TYPE='snakeoil' | ||
| ) | ||
|
|
||
| _common_container_setup 'CUSTOM_SETUP_ARGUMENTS' | ||
|
|
||
| _wait_for_service postfix | ||
| _wait_for_smtp_port_in_container_to_respond | ||
| } | ||
|
|
||
| function teardown_file() { _default_teardown ; } | ||
|
|
||
| # These tests ensure spoofing protection works, and that exceptions are available for aliases. | ||
| # user1 has aliases configured for the following accounts: | ||
| # - test\d* via /etc/postfix/regexp | ||
| # - alias1@localhost via /etc/postfix/virtual | ||
| # - user3@localhost via /etc/postfix/regexp-send-only | ||
|
|
||
| @test "allows forging as send-only alias" { | ||
| # An authenticated account should be able to send mail from a send-only alias, | ||
| # Verifies `main.cf:smtpd_sender_login_maps` includes /etc/postfix/regexp-send-only | ||
| _send_email \ | ||
| --port 587 -tls --auth PLAIN \ | ||
| --auth-user user1@localhost.localdomain \ | ||
| --auth-password mypassword \ | ||
| --ehlo mail \ | ||
| --from user3@localhost.localdomain \ | ||
| --data 'auth/added-smtp-auth-spoofed-from-user3.txt' | ||
| assert_success | ||
| assert_output --partial 'End data with' | ||
| } | ||
|
|
||
| @test "allows forging as regular alias" { | ||
| # An authenticated account should be able to send mail from an alias, | ||
| # Verifies `main.cf:smtpd_sender_login_maps` includes /etc/postfix/virtual | ||
| _send_email \ | ||
| --port 587 -tls --auth PLAIN \ | ||
| --auth-user user1@localhost.localdomain \ | ||
| --auth-password mypassword \ | ||
| --ehlo mail \ | ||
| --from alias1@localhost.localdomain \ | ||
| --data 'auth/added-smtp-auth-spoofed-from-alias1.txt' | ||
| assert_success | ||
| assert_output --partial 'End data with' | ||
| } | ||
|
|
||
| @test "allows forging as regular (regex) alias" { | ||
| # An authenticated account should be able to send mail from an alias, | ||
| # Verifies `main.cf:smtpd_sender_login_maps` includes /etc/postfix/regexp | ||
| _send_email \ | ||
| --port 587 -tls --auth PLAIN \ | ||
| --auth-user user1@localhost.localdomain \ | ||
| --auth-password mypassword \ | ||
| --ehlo mail \ | ||
| --from test123@localhost.localdomain \ | ||
| --data 'auth/added-smtp-auth-spoofed-from-test123.txt' | ||
| assert_success | ||
| assert_output --partial 'End data with' | ||
| } | ||
|
|
||
| @test "rejects sender forging" { | ||
| # An authenticated user cannot use an envelope sender (MAIL FROM) | ||
| # address they do not own according to `main.cf:smtpd_sender_login_maps` lookup | ||
| _send_email --expect-rejection \ | ||
| --port 587 -tls --auth PLAIN \ | ||
| --auth-user user3@localhost.localdomain \ | ||
| --auth-password mypassword \ | ||
| --ehlo mail \ | ||
| --from user1@localhost.localdomain \ | ||
| --data 'auth/added-smtp-auth-spoofed-from-user1.txt' | ||
| assert_output --partial 'Sender address rejected: not owned by user' | ||
| } | ||
|
|
||
| @test "send-only alias does not affect incoming mail" { | ||
| # user1 is allowed to send as user3, however, mail to user3 should still be delivered to user3. | ||
| # Verifies that /etc/postfix/regexp-send-only does not affect incoming mail. | ||
| _send_email \ | ||
| --port 587 -tls --auth PLAIN \ | ||
| --auth-user user1@localhost.localdomain \ | ||
| --auth-password mypassword \ | ||
| --ehlo mail \ | ||
| --from user1@localhost.localdomain \ | ||
| --to user3@localhost.localdomain \ | ||
| --data 'test-email.txt' | ||
| assert_success | ||
| assert_output --partial 'End data with' | ||
|
|
||
| _wait_for_empty_mail_queue_in_container | ||
|
|
||
| # would have an orig_to if it got forwarded | ||
| _service_log_should_contain_string 'mail' ': to=<user3@localhost.localdomain>' | ||
| assert_output --partial 'status=sent' | ||
| _should_output_number_of_lines 1 | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -281,39 +281,6 @@ EOF | |
| assert_success | ||
| } | ||
|
|
||
| # | ||
| # Pflogsumm delivery check | ||
| # | ||
|
|
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'd prefer not creating a file explicitly when it's not used.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I was just copying the regular postfix-regexp logic here — would I be OK to also remove the same thing in the
_handle_postfix_regexp_config()above (and corresponding# TODO: Investigate why this file is always created, nothing seems to append only the cp below?comment)?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There's probably a related issue already open about details for that.
Without looking for that, I can't quite say. I've not had as much time for DMS as I'd like, but if the change was delayed I may have detailed why. I'd leave it alone for now, unless you have time to sink 😅
Proper actionable feedback from me is going to need to wait until I have the time to refresh on related context like this. I'll try to get that sorted for you by this weekend if possible, sorry about the friction that adds.