Add optional inbound relay (backup-MX) behind INBOUND_RELAY_ENABLE.

Port 25 accepts only configured domains and listed recipients, then forwards to an upstream; the outbound path is unchanged when the flag is off. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-17 23:17:30 +03:00
parent 6218540211
commit 0d98d92642
49 changed files with 2495 additions and 86 deletions
@@ -0,0 +1,130 @@
+package postfix
+
+import (
+	"fmt"
+	"net"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+)
+
+// InboundRoute is one inbound domain's Postfix map material: the relay
+// domain, the next-hop transport, the TLS policy for that hop, and the
+// recipient list (or a domain catch-all).
+type InboundRoute struct {
+	Domain        string
+	Host          string
+	Port          int
+	TLSMode       string
+	RecipientMode string
+	Recipients    []string
+}
+
+func (p *Postfix) inboundMapPaths() (relayDomains, transport, recipients, tlsPolicy string) {
+	dir := filepath.Dir(p.senderLoginMapsPath)
+	return filepath.Join(dir, "relay_domains"),
+		filepath.Join(dir, "transport"),
+		filepath.Join(dir, "relay_recipients"),
+		filepath.Join(dir, "tls_policy")
+}
+
+// RebuildInboundMaps regenerates the inbound relay lookup tables from the full
+// set of configured routes and reloads Postfix. Domains with an empty host are
+// omitted so mail is never accepted with nowhere to send it. Full regeneration
+// keeps the files a pure function of the registry (security.md).
+func (p *Postfix) RebuildInboundMaps(routes []InboundRoute) error {
+	relay, transport, recipients, tlsPolicy, err := renderInboundMaps(routes)
+	if err != nil {
+		return err
+	}
+	rd, tr, rc, tl := p.inboundMapPaths()
+	if err := writeFileAtomic(rd, relay, 0o640); err != nil {
+		return err
+	}
+	if err := writeFileAtomic(tr, transport, 0o640); err != nil {
+		return err
+	}
+	if err := writeFileAtomic(rc, recipients, 0o640); err != nil {
+		return err
+	}
+	if err := writeFileAtomic(tl, tlsPolicy, 0o640); err != nil {
+		return err
+	}
+	return p.reload()
+}
+
+func renderInboundMaps(routes []InboundRoute) (relay, transport, recipients, tlsPolicy []byte, err error) {
+	sort.Slice(routes, func(i, j int) bool { return routes[i].Domain < routes[j].Domain })
+
+	var relayB, transportB, recipB, tlsB strings.Builder
+	for _, r := range routes {
+		if strings.TrimSpace(r.Host) == "" {
+			continue
+		}
+		if err := assertInboundRouteSafe(r); err != nil {
+			return nil, nil, nil, nil, err
+		}
+		nexthop := inboundNexthop(r.Host, r.Port)
+		fmt.Fprintf(&relayB, "%s OK\n", r.Domain)
+		fmt.Fprintf(&transportB, "%s smtp:%s\n", r.Domain, nexthop)
+		fmt.Fprintf(&tlsB, "%s %s\n", nexthop, r.TLSMode)
+		switch r.RecipientMode {
+		case "any":
+			fmt.Fprintf(&recipB, "@%s OK\n", r.Domain)
+		default:
+			addrs := append([]string(nil), r.Recipients...)
+			sort.Strings(addrs)
+			for _, addr := range addrs {
+				fmt.Fprintf(&recipB, "%s OK\n", addr)
+			}
+		}
+	}
+	return []byte(relayB.String()), []byte(transportB.String()), []byte(recipB.String()), []byte(tlsB.String()), nil
+}
+
+// inboundNexthop is the Postfix next-hop [host]:port form that disables MX
+// lookup for the explicit upstream.
+func inboundNexthop(host string, port int) string {
+	if ip := net.ParseIP(host); ip != nil && ip.To4() == nil {
+		return "[" + host + "]:" + strconv.Itoa(port)
+	}
+	return "[" + host + "]:" + strconv.Itoa(port)
+}
+
+func assertInboundRouteSafe(r InboundRoute) error {
+	if err := assertMapToken(r.Domain, "domain"); err != nil {
+		return err
+	}
+	if err := assertMapToken(r.Host, "host"); err != nil {
+		return err
+	}
+	if r.Port < 1 || r.Port > 65535 {
+		return fmt.Errorf("postfix: invalid inbound port %d", r.Port)
+	}
+	switch r.TLSMode {
+	case "may", "encrypt", "none":
+	default:
+		return fmt.Errorf("postfix: invalid tls mode %q", r.TLSMode)
+	}
+	if r.RecipientMode != "list" && r.RecipientMode != "any" {
+		return fmt.Errorf("postfix: invalid recipient mode %q", r.RecipientMode)
+	}
+	for _, addr := range r.Recipients {
+		if err := assertMapToken(addr, "recipient"); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// assertMapToken rejects values that could break out of a texthash line.
+func assertMapToken(v, what string) error {
+	if v == "" {
+		return fmt.Errorf("postfix: empty %s", what)
+	}
+	if strings.ContainsAny(v, " \t\r\n,\\") {
+		return fmt.Errorf("postfix: unsafe character in %s %q", what, v)
+	}
+	return nil
+}
@@ -0,0 +1,119 @@
+package postfix
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestRenderInboundMaps(t *testing.T) {
+	routes := []InboundRoute{
+		{
+			Domain: "zeta.example", Host: "192.0.2.20", Port: 25,
+			TLSMode: "none", RecipientMode: "any",
+		},
+		{
+			Domain: "lists.example.com", Host: "10.0.0.8", Port: 25,
+			TLSMode: "encrypt", RecipientMode: "list",
+			Recipients: []string{"staff@lists.example.com", "abuse@lists.example.com"},
+		},
+		{
+			Domain: "pending.example", Host: "", Port: 25,
+			TLSMode: "may", RecipientMode: "list",
+		},
+	}
+	relay, transport, recipients, tlsPolicy, err := renderInboundMaps(routes)
+	if err != nil {
+		t.Fatal(err)
+	}
+	wantRelay := "lists.example.com OK\nzeta.example OK\n"
+	if string(relay) != wantRelay {
+		t.Errorf("relay_domains =\n%q\nwant\n%q", relay, wantRelay)
+	}
+	wantTransport := "lists.example.com smtp:[10.0.0.8]:25\nzeta.example smtp:[192.0.2.20]:25\n"
+	if string(transport) != wantTransport {
+		t.Errorf("transport =\n%q\nwant\n%q", transport, wantTransport)
+	}
+	wantRecipients := "abuse@lists.example.com OK\nstaff@lists.example.com OK\n@zeta.example OK\n"
+	if string(recipients) != wantRecipients {
+		t.Errorf("relay_recipients =\n%q\nwant\n%q", recipients, wantRecipients)
+	}
+	wantTLS := "[10.0.0.8]:25 encrypt\n[192.0.2.20]:25 none\n"
+	if string(tlsPolicy) != wantTLS {
+		t.Errorf("tls_policy =\n%q\nwant\n%q", tlsPolicy, wantTLS)
+	}
+}
+
+func TestRenderInboundMapsIPv6(t *testing.T) {
+	routes := []InboundRoute{{
+		Domain: "v6.example", Host: "2001:db8::1", Port: 25,
+		TLSMode: "may", RecipientMode: "any",
+	}}
+	_, transport, _, tlsPolicy, err := renderInboundMaps(routes)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(transport) != "v6.example smtp:[2001:db8::1]:25\n" {
+		t.Errorf("transport = %q", transport)
+	}
+	if string(tlsPolicy) != "[2001:db8::1]:25 may\n" {
+		t.Errorf("tls_policy = %q", tlsPolicy)
+	}
+}
+
+func TestRenderInboundMapsRejectsInjection(t *testing.T) {
+	bad := []InboundRoute{
+		{Domain: "ex ample.com", Host: "10.0.0.1", Port: 25, TLSMode: "may", RecipientMode: "any"},
+		{Domain: "example.com", Host: "10.0.0.1\nrelay", Port: 25, TLSMode: "may", RecipientMode: "any"},
+		{Domain: "example.com", Host: "10.0.0.1", Port: 25, TLSMode: "evil", RecipientMode: "any"},
+		{Domain: "example.com", Host: "10.0.0.1", Port: 25, TLSMode: "may", RecipientMode: "list",
+			Recipients: []string{"a@example.com OK\nb@evil.com"}},
+	}
+	for i, r := range bad {
+		if _, _, _, _, err := renderInboundMaps([]InboundRoute{r}); err == nil {
+			t.Errorf("case %d: expected injection rejection", i)
+		}
+	}
+}
+
+func TestRebuildInboundMapsWritesAndReloads(t *testing.T) {
+	p, reloads := newTestPostfix(t)
+	err := p.RebuildInboundMaps([]InboundRoute{{
+		Domain: "lists.example.com", Host: "10.0.0.8", Port: 25,
+		TLSMode: "encrypt", RecipientMode: "any",
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if *reloads != 1 {
+		t.Errorf("reload called %d times, want 1", *reloads)
+	}
+	rd, _, _, _ := p.inboundMapPaths()
+	data, err := os.ReadFile(rd)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(data) != "lists.example.com OK\n" {
+		t.Errorf("relay_domains file = %q", data)
+	}
+	if filepath.Base(rd) != "relay_domains" {
+		t.Errorf("unexpected path %s", rd)
+	}
+}
+
+func TestRebuildInboundMapsEmptyOmitsPending(t *testing.T) {
+	p, _ := newTestPostfix(t)
+	if err := p.RebuildInboundMaps(nil); err != nil {
+		t.Fatal(err)
+	}
+	rd, tr, rc, tl := p.inboundMapPaths()
+	for _, path := range []string{rd, tr, rc, tl} {
+		data, err := os.ReadFile(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if len(data) != 0 {
+			t.Errorf("%s not empty: %q", path, data)
+		}
+	}
+}