[pmg-devel] [PATCH v2 pmg-api 1/4] fix #2437: config: Add new tls_inbound_domains postfix map

[Christoph Heiss]

Add a new configuration file /etc/pmg/tls_inbound_domains, which is a
postfix map containing all domains having `reject_plaintext_session`
action set. This is the only allowed action value and enforced while
parsing.

This map is then used for `smtpd_sender_restriction` in the main.cf
template.

Signed-off-by: Christoph Heiss <c.heiss at proxmox.com>
---
Changes v1 -> v2:
 * Rename `tls_inbound_policy` to `tls_inbound_domains`
 * Move API endpoint implementation to separate patch
 * Add `tls_inbound_domains` to cluster sync

 src/PMG/Cluster.pm       |  1 +
 src/PMG/Config.pm        | 56 ++++++++++++++++++++++++++++++++++++++++
 src/templates/main.cf.in |  1 +
 3 files changed, 58 insertions(+)

diff --git a/src/PMG/Cluster.pm b/src/PMG/Cluster.pm
index 31384b2..7622a88 100644
--- a/src/PMG/Cluster.pm
+++ b/src/PMG/Cluster.pm
@@ -464,6 +464,7 @@ sub sync_config_from_master {
 	'mynetworks',
 	'transport',
 	'tls_policy',
+	'tls_inbound_domains',
 	'fetchmailrc',
 	];

diff --git a/src/PMG/Config.pm b/src/PMG/Config.pm
index 699a622..08ba1f5 100755
--- a/src/PMG/Config.pm
+++ b/src/PMG/Config.pm
@@ -1160,6 +1160,61 @@ sub postmap_tls_policy {
     PMG::Utils::run_postmap($tls_policy_map_filename);
 }

+sub read_tls_inbound_domains {
+    my ($filename, $fh) = @_;
+
+    return {} if !defined($fh);
+
+    my $domains = {};
+
+    while (defined(my $line = <$fh>)) {
+	chomp $line;
+	next if $line =~ m/^\s*$/;
+	next if $line =~ m/^#(.*)\s*$/;
+
+	my $parse_error = sub {
+	    my ($err) = @_;
+	    die "parse error in '$filename': $line - $err";
+	};
+
+	if ($line =~ m/^(\S+) reject_plaintext_session$/) {
+	    my $domain = $1;
+
+	    eval { pmg_verify_transport_domain($domain) };
+	    if (my $err = $@) {
+		$parse_error->($err);
+		next;
+	    }
+
+	    $domains->{$domain} = 1;
+	} else {
+	    $parse_error->('wrong format');
+	}
+    }
+
+    return $domains;
+}
+
+sub write_tls_inbound_domains {
+    my ($filename, $fh, $domains) = @_;
+
+    return if !$domains;
+
+    foreach my $domain (sort keys %$domains) {
+	PVE::Tools::safe_print($filename, $fh, "$domain reject_plaintext_session\n");
+    }
+}
+
+my $tls_inbound_domains_map_filename = "/etc/pmg/tls_inbound_domains";
+PVE::INotify::register_file('tls_inbound_domains', $tls_inbound_domains_map_filename,
+			    \&read_tls_inbound_domains,
+			    \&write_tls_inbound_domains,
+			    undef, always_call_parser => 1);
+
+sub postmap_tls_inbound_domains {
+    PMG::Utils::run_postmap($tls_inbound_domains_map_filename);
+}
+
 my $transport_map_filename = "/etc/pmg/transport";

 sub postmap_pmg_transport {
@@ -1696,6 +1751,7 @@ sub rewrite_config_postfix {
     postmap_pmg_domains();
     postmap_pmg_transport();
     postmap_tls_policy();
+    postmap_tls_inbound_domains();

     rewrite_postfix_whitelist($rulecache) if $rulecache;

diff --git a/src/templates/main.cf.in b/src/templates/main.cf.in
index 190c913..1f4fa91 100644
--- a/src/templates/main.cf.in
+++ b/src/templates/main.cf.in
@@ -79,6 +79,7 @@ smtpd_sender_restrictions =
         reject_non_fqdn_sender
         check_client_access     cidr:/etc/postfix/clientaccess
         check_sender_access     regexp:/etc/postfix/senderaccess
+        check_sender_access     hash:/etc/pmg/tls_inbound_domains
         check_recipient_access  regexp:/etc/postfix/rcptaccess
 [%- IF pmg.mail.rejectunknown %] reject_unknown_client_hostname[% END %]
 [%- IF pmg.mail.rejectunknownsender %] reject_unknown_sender_domain[% END %]
--
2.39.2