feat: Allow to override default networks #116
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of the change
new ENV added which allows to override default network ranges.
Motivation and Context
The script was initially prepared to allow connection from all private network ranges (as defined in RFC 1918).
There was an ability to extend subnets with additional networks using
SMTP_NETWORKS
. In result it was adding defined extra networks after private networks. However it there is a need to limit private networks, there was no way to do it.After adding
SMTP_NETWORKS_OVERRIDE=yes
the script will use only networks defined inSMTP_NETWORKS
, without putting default private networks set in front of the config.The conception:
SMTP_NETWORKS
provided, the nets should be10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
SMTP_NETWORK
variable is set to value1.2.3.4/32
and noSMTP_NETWORKS_OVERRIDE
is set, nets should be10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 1.2.3.4/32
SMTP_NETWORKS="1.2.3.0/20"
andSMTP_NETWORK_OVERRIDE=yes
nets needs to have value of
1.2.3.0/20
.After a change the part of code responsible for network restrictions is more readable. The script initializes an empty array (nets) to hold the network specifications.
If
SMTP_NETWORKS
is empty, it addsDEFAULT_NETS
to the nets array.Otherwise, if
SMTP_NETWORKS_OVERRIDE
is not set to "yes", it also addsDEFAULT_NETS
to the nets array before processingSMTP_NETWORKS
.The script then iterates over each network in
SMTP_NETWORKS
, validating that it matches either the IPv4 or IPv6 regular expression. If a network is valid, it adds it to the nets array. If a network is not valid, the script prints an error message and exits with a non-zero status code.Finally, the script joins the elements of the nets array into a comma-separated string (nets_str) and use it to configure postfix.
How Has This Been Tested?
First build the new docker image with the changed script
docker build -t test .
After that verify configuration by executing command for each scenario:
docker run --rm --name postfix -P -e SMTP_SERVER=smtp.bar.com -e SERVER_HOSTNAME=localhost test
the output contains:
Setting configuration option mynetworks with value: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
docker run --rm --name postfix -P -e SMTP_SERVER=smtp.bar.com -e SERVER_HOSTNAME=localhost -e SMTP_NETWORKS="1.2.3.4/32" test
the output contains:
Setting configuration option mynetworks with value: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,1.2.3.4/32
docker run --rm --name postfix -P -e SMTP_SERVER=smtp.bar.com -e SERVER_HOSTNAME=localhost -e SMTP_NETWORKS="1.2.3.0/20" -e SMTP_NETWORKS_OVERRIDE=yes test
the output contains:
Setting configuration option mynetworks with value: 1.2.3.0/20
Types of Changes
Checklist:
.env.example
file accordingly.