Extend selective SRS management and add installer tests
This commit is contained in:
Regular → Executable
+3
@@ -34,6 +34,9 @@ POSTFIX_MASTER_CF="${POSTFIX_CONF_DIR}/master.cf"
|
||||
POSTFIX_SRS_DIR="/etc/postfix-srs"
|
||||
POSTFIX_SRS_DELIVERY_DIR="${POSTFIX_SRS_DIR}/delivery"
|
||||
SRS_STATE_FILE="${POSTFIX_SRS_DIR}/state.conf"
|
||||
# SRS bounce alias ownership is tracked by a comment marker in main.cf;
|
||||
# original version-1 state.conf is immutable and needs no unsafe migration.
|
||||
SRS_ALIAS_HELPER="${SRS_HELPERS_DIR}/srs-virtual-alias.py"
|
||||
|
||||
POSTSRSD_CONF_DIR="/etc/postsrsd-srs"
|
||||
POSTSRSD_CONF_FILE="${POSTSRSD_CONF_DIR}/postsrsd.conf"
|
||||
|
||||
@@ -0,0 +1,178 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Read-only, fail-closed public-DNS preflight for the approved SRS DNS profile.
|
||||
|
||||
Checks the authoritative nameservers, bypassing local hosts/systemd-resolved.
|
||||
This deliberately validates only the approved single-host DNS profile:
|
||||
exactly one MX pointing to this host and one SPF record `v=spf1 mx -all`.
|
||||
It is NOT a general-purpose SPF evaluator.
|
||||
"""
|
||||
import argparse
|
||||
import ipaddress
|
||||
import re
|
||||
import shutil
|
||||
import subprocess
|
||||
import sys
|
||||
|
||||
# A public resolver is used only to discover the delegated authoritative NS and
|
||||
# their numeric IPs. The actual TXT/MX/A/AAAA values are read from each NS.
|
||||
BOOTSTRAP_RESOLVERS = ('1.1.1.1', '9.9.9.9')
|
||||
DNS_TIMEOUT = 5
|
||||
|
||||
|
||||
def dig(server, name, kind, authoritative=False):
|
||||
command = ['dig', '@' + server, '+time=2', '+tries=1', '+noall', '+comments', '+answer']
|
||||
if authoritative:
|
||||
command.append('+norecurse')
|
||||
command.extend([name, kind])
|
||||
try:
|
||||
proc = subprocess.run(command, capture_output=True, text=True, timeout=DNS_TIMEOUT, check=False)
|
||||
except (OSError, subprocess.TimeoutExpired) as exc:
|
||||
raise ValueError(f'DNS request failed ({server}, {name}, {kind}): {exc}') from exc
|
||||
if proc.returncode != 0:
|
||||
raise ValueError(f'DNS request failed ({server}, {name}, {kind}): {proc.stderr.strip() or proc.returncode}')
|
||||
header = re.search(r'HEADER.*?status:\s*(\w+)', proc.stdout)
|
||||
if not header or header.group(1) != 'NOERROR':
|
||||
raise ValueError(f'DNS returned {header.group(1) if header else "no status"}: {server} {name} {kind}')
|
||||
flags = re.search(r'^;; flags:\s*(.*?);\s*QUERY:', proc.stdout, re.M)
|
||||
if authoritative and (not flags or 'aa' not in flags.group(1).split()):
|
||||
raise ValueError(f'Authoritative response missing AA flag: {server} {name} {kind}')
|
||||
rows = []
|
||||
for line in proc.stdout.splitlines():
|
||||
parts = line.split(None, 4)
|
||||
if len(parts) != 5 or parts[2].upper() != 'IN':
|
||||
continue
|
||||
owner, _ttl, _cls, rr_type, data = parts
|
||||
if rr_type.upper() == kind.upper() and owner.rstrip('.').lower() == name.rstrip('.').lower():
|
||||
rows.append(data.strip())
|
||||
return rows
|
||||
|
||||
|
||||
def public_lookup(name, kind):
|
||||
failures = []
|
||||
for server in BOOTSTRAP_RESOLVERS:
|
||||
try:
|
||||
return dig(server, name, kind)
|
||||
except ValueError as exc:
|
||||
failures.append(str(exc))
|
||||
raise ValueError('Public NS bootstrap failed: ' + ' | '.join(failures))
|
||||
|
||||
|
||||
def discover_nameservers(domain):
|
||||
labels = domain.rstrip('.').split('.')
|
||||
# Pick closest delegated zone. A zone without its own delegation has no NS.
|
||||
for i in range(len(labels) - 1):
|
||||
zone = '.'.join(labels[i:])
|
||||
ns = public_lookup(zone, 'NS')
|
||||
if ns:
|
||||
names = sorted({n.rstrip('.').lower() for n in ns})
|
||||
return zone, names
|
||||
raise ValueError(f'Cannot discover authoritative nameservers for {domain}')
|
||||
|
||||
|
||||
def addr_of_ns(ns):
|
||||
for kind in ('A', 'AAAA'):
|
||||
for value in public_lookup(ns, kind):
|
||||
try:
|
||||
return str(ipaddress.ip_address(value))
|
||||
except ValueError:
|
||||
continue
|
||||
raise ValueError(f'Cannot resolve nameserver {ns} to a public IP address')
|
||||
|
||||
|
||||
def parse_txt(value):
|
||||
# DNS may split a single TXT resource record into multiple quoted strings.
|
||||
parts = re.findall(r'"((?:\\.|[^"\\])*)"', value)
|
||||
if not parts:
|
||||
raise ValueError('Unexpected TXT presentation format: ' + value)
|
||||
return ''.join(parts).replace('\\"', '"')
|
||||
|
||||
|
||||
def check_server(ns_name, ns_ip, domain, hostname, bind4, bind6):
|
||||
errors = []
|
||||
def query(name, kind):
|
||||
try:
|
||||
return dig(ns_ip, name, kind, authoritative=True)
|
||||
except ValueError as exc:
|
||||
errors.append(str(exc))
|
||||
return []
|
||||
|
||||
spf_records = []
|
||||
for raw in query(domain, 'TXT'):
|
||||
try:
|
||||
text = parse_txt(raw)
|
||||
if text.lower().startswith('v=spf1'):
|
||||
spf_records.append(text)
|
||||
except ValueError as exc:
|
||||
errors.append(str(exc))
|
||||
if len(spf_records) != 1 or spf_records[0].lower().split() != ['v=spf1', 'mx', '-all']:
|
||||
errors.append('SPF is not the approved single-host profile: v=spf1 mx -all')
|
||||
|
||||
mx = query(domain, 'MX')
|
||||
if len(mx) != 1:
|
||||
errors.append(f'Expected exactly one MX pointing to {hostname}; found {mx}')
|
||||
else:
|
||||
parts = mx[0].split()
|
||||
if len(parts) != 2 or not parts[0].isdigit() or parts[1].rstrip('.').lower() != hostname:
|
||||
errors.append(f'MX is not the expected mailserver {hostname}: {mx[0]}')
|
||||
|
||||
for kind, configured in [('A', bind4), ('AAAA', bind6)]:
|
||||
answers = query(hostname, kind)
|
||||
normalized = []
|
||||
for entry in answers:
|
||||
try:
|
||||
normalized.append(str(ipaddress.ip_address(entry)))
|
||||
except ValueError:
|
||||
errors.append(f'Invalid {kind} address returned for {hostname}: {entry}')
|
||||
if not configured:
|
||||
errors.append(f'Postfix smtp_bind_address{("6" if kind == "AAAA" else "")} is empty; cannot verify outbound IP')
|
||||
elif configured not in normalized:
|
||||
errors.append(f'Postfix outbound {kind} address {configured} is not published for {hostname}: {normalized}')
|
||||
|
||||
print(f' Authoritative NS {ns_name} ({ns_ip}): ' + ('OK' if not errors else 'FAILED'))
|
||||
for err in errors:
|
||||
print(f' [ error ] {err}')
|
||||
return not errors
|
||||
|
||||
|
||||
def main():
|
||||
ap = argparse.ArgumentParser()
|
||||
ap.add_argument('--domain', required=True)
|
||||
ap.add_argument('--hostname', required=True)
|
||||
ap.add_argument('--ipv4', required=True)
|
||||
ap.add_argument('--ipv6', required=True)
|
||||
args = ap.parse_args()
|
||||
domain = args.domain.lower().rstrip('.')
|
||||
hostname = args.hostname.lower().rstrip('.')
|
||||
if not shutil.which('dig'):
|
||||
print(' [ error ] dig is required to verify public DNS')
|
||||
return 1
|
||||
try:
|
||||
bind4 = str(ipaddress.ip_address(args.ipv4)) if args.ipv4 else ''
|
||||
bind6 = str(ipaddress.ip_address(args.ipv6)) if args.ipv6 else ''
|
||||
zone, nameservers = discover_nameservers(domain)
|
||||
print(f' DNS delegation zone................: {zone}')
|
||||
print(f' Expected MX host...................: {hostname}')
|
||||
print(f' Expected SMTP IPv4.................: {bind4 or "unknown"}')
|
||||
print(f' Expected SMTP IPv6.................: {bind6 or "unknown"}')
|
||||
if len(nameservers) > 8:
|
||||
raise ValueError('More than eight authoritative nameservers; manual review required')
|
||||
ok = True
|
||||
for ns in nameservers:
|
||||
try:
|
||||
ip = addr_of_ns(ns)
|
||||
if not check_server(ns, ip, domain, hostname, bind4, bind6):
|
||||
ok = False
|
||||
except ValueError as exc:
|
||||
print(f' Authoritative NS {ns}: FAILED')
|
||||
print(f' [ error ] {exc}')
|
||||
ok = False
|
||||
print(' Public SRS DNS preflight...........: ' + ('OK' if ok else 'FAILED'))
|
||||
return 0 if ok else 1
|
||||
except ValueError as exc:
|
||||
print(f' [ error ] {exc}')
|
||||
print(' Public SRS DNS preflight...........: FAILED')
|
||||
return 1
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
sys.exit(main())
|
||||
Executable
+223
@@ -0,0 +1,223 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Track narrowly-scoped SRS virtual alias additions in a Postfix main.cf.
|
||||
|
||||
This helper never restores an old main.cf; it only adds/removes its exact two
|
||||
list items. An ownership marker is mandatory before removal. This is a
|
||||
review draft: do not use on a live mail server until the complete integration
|
||||
and rollback have been tested.
|
||||
"""
|
||||
|
||||
import argparse
|
||||
import os
|
||||
import re
|
||||
import stat
|
||||
import sys
|
||||
import tempfile
|
||||
from pathlib import Path
|
||||
|
||||
MARKER_PREFIX = '# OOPEN-SRS-ALIAS-OWNERSHIP v1 '
|
||||
PARAMS = ('virtual_alias_domains', 'virtual_alias_maps')
|
||||
|
||||
|
||||
class ConfigError(Exception):
|
||||
pass
|
||||
|
||||
|
||||
def read_entries(lines, param):
|
||||
"""Return [(first_line, last_line_exclusive, value_lines)] for a parameter.
|
||||
|
||||
Continuation lines must be indented, active, and not comments. A comment
|
||||
ends the immediately preceding value, leaving its original text untouched.
|
||||
"""
|
||||
pattern = re.compile(r'^\s*' + re.escape(param) + r'\s*=', re.I)
|
||||
found = []
|
||||
for i, line in enumerate(lines):
|
||||
if not pattern.match(line) or line.lstrip().startswith('#'):
|
||||
continue
|
||||
j = i + 1
|
||||
while j < len(lines) and lines[j].startswith((' ', '\t')) and lines[j].strip() and not lines[j].lstrip().startswith('#'):
|
||||
j += 1
|
||||
first_value = line.split('=', 1)[1].strip()
|
||||
values = [first_value] + [item.strip() for item in lines[i + 1:j]]
|
||||
found.append((i, j, values))
|
||||
if len(found) > 1:
|
||||
raise ConfigError(f'Duplicate active parameter {param}')
|
||||
return found
|
||||
|
||||
|
||||
def current_tokens(lines, param):
|
||||
entries = read_entries(lines, param)
|
||||
if not entries:
|
||||
return (False, [])
|
||||
values = entries[0][2]
|
||||
return (True, [part for part in re.split(r'[\s,]+', ' '.join(values)) if part])
|
||||
|
||||
|
||||
def make_marker(domain, reverse_map, orig):
|
||||
return (MARKER_PREFIX + f'domain={domain} map={reverse_map} '
|
||||
f'domains_was_set={int(orig[0])} maps_was_set={int(orig[1])}\n')
|
||||
|
||||
|
||||
def marker_state(lines, domain, reverse_map):
|
||||
markers = [line for line in lines if line.startswith('# OOPEN-SRS-ALIAS-OWNERSHIP')]
|
||||
if not markers:
|
||||
return None
|
||||
if len(markers) != 1:
|
||||
raise ConfigError('Multiple SRS alias ownership markers')
|
||||
marker = markers[0]
|
||||
expected = re.compile(r'^' + re.escape(MARKER_PREFIX) +
|
||||
r'domain=' + re.escape(domain) + r' map=' + re.escape(reverse_map) +
|
||||
r' domains_was_set=([01]) maps_was_set=([01])\n$')
|
||||
match = expected.fullmatch(marker)
|
||||
if not match:
|
||||
raise ConfigError('Foreign or malformed SRS alias ownership marker')
|
||||
return tuple(item == '1' for item in match.groups())
|
||||
|
||||
|
||||
def inspect(lines, domain, reverse_map):
|
||||
is_set_domains, domains = current_tokens(lines, PARAMS[0])
|
||||
is_set_maps, maps = current_tokens(lines, PARAMS[1])
|
||||
matches_domain = sum(token.lower() == domain.lower() for token in domains)
|
||||
matches_map = sum(token == reverse_map for token in maps)
|
||||
if matches_domain > 1 or matches_map > 1:
|
||||
raise ConfigError('Duplicate SRS domain or reverse map item')
|
||||
ownership = marker_state(lines, domain, reverse_map)
|
||||
if ownership is not None:
|
||||
if matches_domain != 1 or matches_map != 1:
|
||||
raise ConfigError('Ownership marker present but SRS tokens are incomplete')
|
||||
return 'managed', ownership
|
||||
if matches_domain and matches_map:
|
||||
return 'legacy', None
|
||||
if not matches_domain and not matches_map:
|
||||
return 'absent', (is_set_domains, is_set_maps)
|
||||
raise ConfigError('Partial/unmanaged SRS alias configuration')
|
||||
|
||||
|
||||
def append_token(lines, param, token):
|
||||
entries = read_entries(lines, param)
|
||||
if not entries:
|
||||
if lines and not lines[-1].endswith('\n'):
|
||||
lines[-1] += '\n'
|
||||
lines.append(f'{param} = {token}\n')
|
||||
return
|
||||
start, end, values = entries[0]
|
||||
if token in [part for part in re.split(r'[\s,]+', ' '.join(values)) if part]:
|
||||
raise ConfigError(f'SRS token already present in {param}')
|
||||
if end > start + 1:
|
||||
lines.insert(end, f' {token}\n')
|
||||
else:
|
||||
line = lines[start].rstrip('\r\n')
|
||||
lines[start] = line.rstrip() + ' ' + token + '\n'
|
||||
|
||||
|
||||
def remove_token(lines, param, token, was_set):
|
||||
entries = read_entries(lines, param)
|
||||
if len(entries) != 1:
|
||||
raise ConfigError(f'Cannot safely remove token from {param}: missing parameter')
|
||||
first, end, _ = entries[0]
|
||||
indices = []
|
||||
for idx in range(first, end):
|
||||
value = lines[idx].split('=', 1)[1] if idx == first else lines[idx]
|
||||
parts = [p for p in re.split(r'[\s,]+', value.strip()) if p]
|
||||
if token in parts:
|
||||
indices.append(idx)
|
||||
if len(indices) != 1:
|
||||
raise ConfigError(f'Expected exactly one SRS token in {param}')
|
||||
idx = indices[0]
|
||||
line = lines[idx]
|
||||
if idx == first:
|
||||
before, value = line.split('=', 1)
|
||||
remaining = [p for p in re.split(r'[\s,]+', value.strip()) if p != token]
|
||||
if not was_set and end == first + 1 and not remaining:
|
||||
del lines[first]
|
||||
else:
|
||||
lines[idx] = before.rstrip() + ' = ' + ' '.join(remaining) + '\n'
|
||||
else:
|
||||
remaining = [p for p in re.split(r'[\s,]+', line.strip()) if p != token]
|
||||
if remaining:
|
||||
lines[idx] = ' ' + ' '.join(remaining) + '\n'
|
||||
else:
|
||||
del lines[idx]
|
||||
if not was_set and not current_tokens(lines, param)[1]:
|
||||
entries = read_entries(lines, param)
|
||||
if entries:
|
||||
start, end, _ = entries[0]
|
||||
del lines[start:end]
|
||||
|
||||
|
||||
def write_atomic(path, content):
|
||||
st = os.stat(path)
|
||||
if not stat.S_ISREG(st.st_mode):
|
||||
raise ConfigError('main.cf is not a regular file')
|
||||
parent = os.path.dirname(os.path.abspath(path))
|
||||
fd, temp_path = tempfile.mkstemp(prefix='.main.cf.srs-alias.', dir=parent)
|
||||
try:
|
||||
with os.fdopen(fd, 'w', encoding='utf-8', newline='') as f:
|
||||
f.writelines(content)
|
||||
f.flush()
|
||||
os.fsync(f.fileno())
|
||||
os.chmod(temp_path, stat.S_IMODE(st.st_mode))
|
||||
os.chown(temp_path, st.st_uid, st.st_gid)
|
||||
os.replace(temp_path, path)
|
||||
finally:
|
||||
if os.path.exists(temp_path):
|
||||
os.unlink(temp_path)
|
||||
|
||||
|
||||
def run(args):
|
||||
path = Path(args.main_cf)
|
||||
lines = path.read_text(encoding='utf-8').splitlines(keepends=True)
|
||||
state, extra = inspect(lines, args.domain, args.reverse_map)
|
||||
if args.mode == 'status':
|
||||
print(state)
|
||||
return
|
||||
if args.mode == 'add':
|
||||
if state != 'absent':
|
||||
raise ConfigError('Add refused: expected absent state, got ' + state)
|
||||
# Add in reverse order so insertion indexes remain consistent.
|
||||
append_token(lines, PARAMS[1], args.reverse_map)
|
||||
append_token(lines, PARAMS[0], args.domain)
|
||||
lines.append(make_marker(args.domain, args.reverse_map, extra))
|
||||
elif args.mode == 'adopt':
|
||||
if state != 'legacy':
|
||||
raise ConfigError('Adoption refused: expected legacy state, got ' + state)
|
||||
if lines and not lines[-1].endswith('\n'):
|
||||
lines[-1] += '\n'
|
||||
lines.append(make_marker(args.domain, args.reverse_map, (True, True)))
|
||||
elif args.mode == 'remove':
|
||||
if state != 'managed':
|
||||
raise ConfigError('Removal refused: expected managed state, got ' + state)
|
||||
was_domains, was_maps = extra
|
||||
remove_token(lines, PARAMS[1], args.reverse_map, was_maps)
|
||||
remove_token(lines, PARAMS[0], args.domain, was_domains)
|
||||
lines[:] = [line for line in lines if not line.startswith(MARKER_PREFIX)]
|
||||
else:
|
||||
raise ConfigError('Unknown mode')
|
||||
expected = 'absent' if args.mode == 'remove' else 'managed'
|
||||
check, _ = inspect(lines, args.domain, args.reverse_map)
|
||||
if check != expected:
|
||||
raise ConfigError(f'Post-modification state unexpected: {check}')
|
||||
write_atomic(path, lines)
|
||||
print(check)
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument('mode', choices=['status', 'add', 'adopt', 'remove'])
|
||||
parser.add_argument('--main-cf', required=True)
|
||||
parser.add_argument('--domain', required=True)
|
||||
parser.add_argument('--reverse-map', required=True)
|
||||
args = parser.parse_args()
|
||||
if not re.fullmatch(r'[A-Za-z0-9.-]+', args.domain):
|
||||
parser.error('Unsafe domain')
|
||||
if not re.fullmatch(r'socketmap:inet:127\.0\.0\.1:[0-9]{1,5}:reverse', args.reverse_map):
|
||||
parser.error('Unexpected reverse map')
|
||||
try:
|
||||
run(args)
|
||||
except (ConfigError, OSError, UnicodeError) as exc:
|
||||
print(f'SRS alias configuration error: {exc}', file=sys.stderr)
|
||||
raise SystemExit(1)
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
Reference in New Issue
Block a user