serv/mox
1
0
Fork 0
mirror of https://github.com/mjl-/mox.git synced 2024-12-26 08:23:48 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

admin: in self-check for spf records against our ip's, don't try checking the unspecified addresses (0.0.0.0 and ::), and warn if there are no explicitly configured ips

Browse source 
based on question by spectral369 on #mox on matrix
This commit is contained in:
Mechiel Lukkien 2024-11-24 12:32:45 +01:00
parent 501f594a0a
commit 726c0931f7
No known key found for this signature in database
2 changed files with 10 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
mox-/admin.go
View file

@ -684,6 +684,9 @@ func DomainSPFIPs() (ips []net.IP) {
} }
for _, ipstr := range ipstrs { for _, ipstr := range ipstrs {
ip := net.ParseIP(ipstr) ip := net.ParseIP(ipstr)
if ip.IsUnspecified() {
continue
}
ips = append(ips, ip) ips = append(ips, ip)
} }
} }

9
webadmin/admin.go
View file

@ -953,6 +953,8 @@ EOF
defer logPanic(ctx) defer logPanic(ctx)
defer wg.Done() defer wg.Done()
ips := mox.DomainSPFIPs()
// Verify a domain with the configured IPs that do SMTP. // Verify a domain with the configured IPs that do SMTP.
verifySPF := func(isHost bool, domain dns.Domain) (string, *SPFRecord, spf.Record) { verifySPF := func(isHost bool, domain dns.Domain) (string, *SPFRecord, spf.Record) {
kind := "domain" kind := "domain"
@ -1000,10 +1002,9 @@ EOF
} }
} }
for _, ip := range mox.DomainSPFIPs() { for _, ip := range ips {
checkSPFIP(ip) checkSPFIP(ip)
} }
if !isHost { if !isHost {
spfr.Directives = append(spfr.Directives, spf.Directive{Mechanism: "mx"}) spfr.Directives = append(spfr.Directives, spf.Directive{Mechanism: "mx"})
} }
@ -1022,6 +1023,10 @@ EOF
// todo: possibly check all hosts for MX records? assuming they are also sending mail servers. // todo: possibly check all hosts for MX records? assuming they are also sending mail servers.
r.SPF.HostTXT, r.SPF.HostRecord, _ = verifySPF(true, mox.Conf.Static.HostnameDomain) r.SPF.HostTXT, r.SPF.HostRecord, _ = verifySPF(true, mox.Conf.Static.HostnameDomain)
if len(ips) == 0 {
addf(&r.SPF.Warnings, `No explicitly configured IPs found to check SPF policy against. Consider configuring public IPs instead of unspecified addresses (0.0.0.0 and/or ::) in the "public" listener in mox.conf, or NATIPs in case of NAT.`)
}
dtxt, err := dspfr.Record() dtxt, err := dspfr.Record()
if err != nil { if err != nil {
addf(&r.SPF.Errors, "Making SPF record for instructions: %s", err) addf(&r.SPF.Errors, "Making SPF record for instructions: %s", err)