Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Allow to override default networks #116

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

filipc
Copy link

@filipc filipc commented Oct 25, 2024

Description of the change

new ENV added which allows to override default network ranges.

Motivation and Context

The script was initially prepared to allow connection from all private network ranges (as defined in RFC 1918).
There was an ability to extend subnets with additional networks using SMTP_NETWORKS. In result it was adding defined extra networks after private networks. However it there is a need to limit private networks, there was no way to do it.
After adding SMTP_NETWORKS_OVERRIDE=yes the script will use only networks defined in SMTP_NETWORKS, without putting default private networks set in front of the config.

The conception:

  1. when there is no SMTP_NETWORKS provided, the nets should be
    10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
  2. when SMTP_NETWORK variable is set to value 1.2.3.4/32 and no SMTP_NETWORKS_OVERRIDE is set, nets should be
    10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 1.2.3.4/32
  3. when SMTP_NETWORKS="1.2.3.0/20" and SMTP_NETWORK_OVERRIDE=yes
    nets needs to have value of 1.2.3.0/20.

After a change the part of code responsible for network restrictions is more readable. The script initializes an empty array (nets) to hold the network specifications.
If SMTP_NETWORKS is empty, it adds DEFAULT_NETS to the nets array.
Otherwise, if SMTP_NETWORKS_OVERRIDE is not set to "yes", it also adds DEFAULT_NETS to the nets array before processing SMTP_NETWORKS.

The script then iterates over each network in SMTP_NETWORKS, validating that it matches either the IPv4 or IPv6 regular expression. If a network is valid, it adds it to the nets array. If a network is not valid, the script prints an error message and exits with a non-zero status code.

Finally, the script joins the elements of the nets array into a comma-separated string (nets_str) and use it to configure postfix.

How Has This Been Tested?

First build the new docker image with the changed script
docker build -t test .

After that verify configuration by executing command for each scenario:

  1. docker run --rm --name postfix -P -e SMTP_SERVER=smtp.bar.com -e SERVER_HOSTNAME=localhost test
    
the output contains:

    Setting configuration option mynetworks with value: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
  2. docker run --rm --name postfix -P -e SMTP_SERVER=smtp.bar.com -e SERVER_HOSTNAME=localhost -e SMTP_NETWORKS="1.2.3.4/32" test
    
the output contains:
    Setting configuration option mynetworks with value: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,1.2.3.4/32
  3. docker run --rm --name postfix -P -e SMTP_SERVER=smtp.bar.com -e SERVER_HOSTNAME=localhost -e SMTP_NETWORKS="1.2.3.0/20" -e SMTP_NETWORKS_OVERRIDE=yes test
    the output contains:

    Setting configuration option mynetworks with value: 1.2.3.0/20

Types of Changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Documentation (adding or updating documentation)

Checklist:

  • My change requires a change to the documentation and I have updated the documentation accordingly.
  • My change adds a new configuration variable and I have updated the .env.example file accordingly.

@filipc filipc changed the title Allow to override default networks feat: Allow to override default networks Oct 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant