amorfo77/mailcow-dockerized
1
0 Fork 0
mirror of https://github.com/mailcow/mailcow-dockerized.git synced 2026-11-08 10:13:37 +00:00
Code Issues Projects Releases Wiki Activity

[Web][Postfix] Add mail policies: per-recipient send/receive rules for mailboxes and groups

Browse Source
This commit is contained in:
FreddleSpl0it committed 2026-11-07 15:55:43 +01:00
1 parent 329bca1d46
commit 4484cfcd42
36 files changed
+2677 -42
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

tests/php/MailPolicy/Service/PolicyEngineTest.php
+188
View File
@@ -0,0 +1,188 @@
<?php
declare(strict_types=1);
namespace Mailcow\Tests\MailPolicy\Service;
use Mailcow\MailPolicy\Model\Policy;
use Mailcow\MailPolicy\Service\PolicyEngine;
use Mailcow\Tests\Support\FakeMailPolicyLookup;
use PHPUnit\Framework\TestCase;
class PolicyEngineTest extends TestCase
{
private FakeMailPolicyLookup $lookup;
private PolicyEngine $engine;
protected function setUp(): void
{
$this->lookup = new FakeMailPolicyLookup();
$this->lookup->domains = ['firma.de', 'tochter.de'];
$this->lookup->aliasDomains = ['firma.com' => 'firma.de'];
$this->lookup->mailboxes = [
'azubi@firma.de' => 'firma.de',
'kollege@firma.de' => 'firma.de',
'chef@firma.de' => 'firma.de',
'info@firma.de' => 'firma.de',
'andere@tochter.de' => 'tochter.de',
];
$this->lookup->groups = [
7 => ['address' => 'azubis@firma.de', 'members' => ['azubi@firma.de']],
8 => ['address' => 'vorstand@firma.de', 'members' => ['chef@firma.de']],
];
$this->engine = new PolicyEngine($this->lookup);
}
private static function policy(int $id, array $values): Policy
{
$policy = new Policy();
$policy->id = $id;
$policy->domain = 'firma.de';
$policy->name = 'policy ' . $id;
foreach ($values as $property => $value) {
$policy->$property = $value;
}
return $policy;
}
/** [allowed, side] of a check */
private function check(string $sender, string $recipient, string $login = '', int $port = 587): array
{
$decision = $this->engine->check($sender, $recipient, $login, $port);
return [$decision->allowed, $decision->side];
}
public function testWithoutPoliciesEverythingPasses(): void
{
$this->assertSame([true, ''], $this->check('x@extern.example', 'azubi@firma.de'));
$this->assertSame('DUNNO', $this->engine->check('azubi@firma.de', 'x@extern.example', 'azubi@firma.de')->action());
}
public function testSendOnlyInternalWithAllowedAndBlockedEntries(): void
{
$this->lookup->mailboxPolicies['azubi@firma.de'] = [self::policy(1, [
'sendMode' => 'internal', 'sendAllow' => ['partner.de', 'kunde@extern.example'], 'sendBlock' => ['chef@firma.de'],
])];
$this->assertSame([true, ''], $this->check('azubi@firma.de', 'kollege@firma.de', 'azubi@firma.de'));
// alias domain and sub-address are internal
$this->assertSame([true, ''], $this->check('azubi@firma.de', 'Kollege+x@firma.com', 'azubi@firma.de'));
$this->assertSame([false, 'send'], $this->check('azubi@firma.de', 'x@extern.example', 'azubi@firma.de'));
// another domain of the same mailcow is not internal
$this->assertSame([false, 'send'], $this->check('azubi@firma.de', 'andere@tochter.de', 'azubi@firma.de'));
$this->assertSame([true, ''], $this->check('azubi@firma.de', 'jemand@partner.de', 'azubi@firma.de'));
$this->assertSame([true, ''], $this->check('azubi@firma.de', 'kunde@extern.example', 'azubi@firma.de'));
$this->assertSame([false, 'send'], $this->check('azubi@firma.de', 'chef@firma.de', 'azubi@firma.de'));
// the rules belong to the login: without it nothing is sent as azubi
$this->assertSame([true, ''], $this->check('azubi@firma.de', 'x@extern.example'));
}
public function testSendOnlyListedRecipientsThroughAGroup(): void
{
$this->lookup->groupPolicies[7] = [self::policy(2, ['sendMode' => 'list', 'sendAllow' => ['group:8']])];
$this->assertSame([true, ''], $this->check('azubi@firma.de', 'vorstand@firma.de', 'azubi@firma.de'));
$this->assertSame([true, ''], $this->check('azubi@firma.de', 'chef@firma.de', 'azubi@firma.de'));
$this->assertSame([false, 'send'], $this->check('azubi@firma.de', 'kollege@firma.de', 'azubi@firma.de'));
// not a member: no rule
$this->assertSame([true, ''], $this->check('kollege@firma.de', 'x@extern.example', 'kollege@firma.de'));
}
public function testSendingAsAnotherMailboxAppliesItsPolicyToo(): void
{
$this->lookup->mailboxPolicies['info@firma.de'] = [self::policy(3, ['sendMode' => 'internal'])];
$this->assertSame([false, 'send'], $this->check('info@firma.de', 'x@extern.example', 'chef@firma.de'));
$this->assertSame([true, ''], $this->check('chef@firma.de', 'x@extern.example', 'chef@firma.de'));
}
public function testReceiveOnlyInternalCannotBeForged(): void
{
$this->lookup->mailboxPolicies['azubi@firma.de'] = [self::policy(4, ['receiveMode' => 'internal', 'receiveAllow' => ['partner.de'],
'receiveBlock' => ['chef@firma.de']])];
$this->assertSame([false, 'receive'], $this->check('x@extern.example', 'azubi@firma.de', '', 25));
// a forged internal sender is external
$this->assertSame([false, 'receive'], $this->check('kollege@firma.de', 'azubi@firma.de', '', 25));
$this->assertSame([true, ''], $this->check('kollege@firma.de', 'azubi+news@firma.com', 'kollege@firma.de'));
$this->assertSame([false, 'receive'], $this->check('andere@tochter.de', 'azubi@firma.de', 'andere@tochter.de'));
// an external domain on the list is compared with the envelope sender
$this->assertSame([true, ''], $this->check('jemand@partner.de', 'azubi@firma.de', '', 25));
$this->assertSame([false, 'receive'], $this->check('chef@firma.de', 'azubi@firma.de', 'chef@firma.de'));
// null sender (bounces) is external
$this->assertSame([false, 'receive'], $this->check('', 'azubi@firma.de', '', 25));
}
public function testListedLocalSendersMustBeLoggedIn(): void
{
$this->lookup->mailboxPolicies['chef@firma.de'] = [self::policy(5, ['receiveMode' => 'list',
'receiveAllow' => ['kollege@firma.de', 'group:7', 'tochter.de']])];
$this->assertSame([false, 'receive'], $this->check('kollege@firma.de', 'chef@firma.de', '', 25));
$this->assertSame([true, ''], $this->check('kollege@firma.de', 'chef@firma.de', 'kollege@firma.de'));
$this->assertSame([true, ''], $this->check('azubi@firma.de', 'chef@firma.de', 'azubi@firma.de'));
$this->assertSame([false, 'receive'], $this->check('azubi@firma.de', 'chef@firma.de', '', 25));
$this->assertSame([true, ''], $this->check('andere@tochter.de', 'chef@firma.de', 'andere@tochter.de'));
$this->assertSame([false, 'receive'], $this->check('andere@tochter.de', 'chef@firma.de', '', 25));
}
public function testGroupAddressAndMembersAsRecipients(): void
{
$this->lookup->groupPolicies[8] = [self::policy(6, ['receiveMode' => 'internal', 'receiveBlock' => ['group:7']])];
$this->assertSame([false, 'receive'], $this->check('x@extern.example', 'vorstand@firma.de', '', 25));
$this->assertSame([true, ''], $this->check('kollege@firma.de', 'vorstand@firma.de', 'kollege@firma.de'));
// the policy of a group applies to its members as well
$this->assertSame([false, 'receive'], $this->check('x@extern.example', 'chef@firma.de', '', 25));
$this->assertSame([false, 'receive'], $this->check('azubi@firma.de', 'chef@firma.de', 'azubi@firma.de'));
}
public function testInternalFlagOfAliasesAndGroups(): void
{
$this->lookup->internalAliases['team@firma.de'] = 'firma.de';
$this->assertSame([false, 'receive'], $this->check('x@extern.example', 'team@firma.de', '', 25));
// the old rspamd rule let forged senders of the domain pass
$this->assertSame([false, 'receive'], $this->check('kollege@firma.de', 'team@firma.com', '', 25));
$this->assertSame([true, ''], $this->check('kollege@firma.de', 'team@firma.de', 'kollege@firma.de'));
$this->assertSame([false, 'receive'], $this->check('andere@tochter.de', 'team@firma.de', 'andere@tochter.de'));
}
public function testTheStrictestPolicyWins(): void
{
$this->lookup->mailboxPolicies['azubi@firma.de'] = [self::policy(9, ['sendMode' => 'all'])];
$this->lookup->groupPolicies[7] = [self::policy(10, ['sendMode' => 'internal', 'rejectText' => 'Azubis senden nur intern'])];
$decision = $this->engine->check('azubi@firma.de', 'x@extern.example', 'azubi@firma.de', 587);
$this->assertSame(['send', 10, '550 5.7.1 Azubis senden nur intern'], [$decision->side, $decision->policy->id, $decision->action()]);
}
public function testDefaultTextsAndOwnDeliveries(): void
{
$this->lookup->mailboxPolicies['azubi@firma.de'] = [self::policy(11, ['sendMode' => 'internal', 'receiveMode' => 'internal'])];
$this->assertSame('550 5.7.1 Sending to this recipient is not allowed by the mail policy of the sender',
$this->engine->check('azubi@firma.de', 'x@extern.example', 'azubi@firma.de', 587)->action());
$this->assertSame('550 5.7.1 This recipient does not accept mail from this sender',
$this->engine->check('x@extern.example', 'azubi@firma.de', '', 25)->action());
// quarantine release (590) and BCC/archive copies (591) are not checked
$this->assertSame([true, ''], $this->check('x@extern.example', 'azubi@firma.de', '', 590));
$this->assertSame([true, ''], $this->check('x@extern.example', 'azubi@firma.de', '', 591));
}
public function testDovecotSubmissionsCountAsTheMailbox(): void
{
$this->lookup->mailboxPolicies['azubi@firma.de'] = [self::policy(12, ['sendMode' => 'internal'])];
$this->lookup->mailboxPolicies['chef@firma.de'] = [self::policy(13, ['receiveMode' => 'internal'])];
$this->lookup->internalAliases['team@firma.de'] = 'firma.de';
// a Sieve redirect of azubi to an external address follows its send rules
$this->assertSame([false, 'send'], $this->check('azubi+x@firma.de', 'x@extern.example', '', 588));
$this->assertSame([true, ''], $this->check('azubi@firma.de', 'chef@firma.de', '', 588));
$this->assertSame([true, ''], $this->check('kollege@firma.de', 'team@firma.de', '', 588));
// notifications of mailcow (e.g. quota warnings) are no mailbox
$this->assertSame([true, ''], $this->check('quota-warning@localhost', 'chef@firma.de', '', 588));
// on other ports the sender address is no login
$this->assertSame([false, 'receive'], $this->check('kollege@firma.de', 'team@firma.de', '', 25));
}
}
tests/php/MailPolicy/Service/PolicyServiceTest.php
+169
View File
@@ -0,0 +1,169 @@
<?php
declare(strict_types=1);
namespace Mailcow\Tests\MailPolicy\Service;
use Mailcow\Core\AccessDenied;
use Mailcow\Core\Context;
use Mailcow\Core\UserError;
use Mailcow\MailPolicy\Model\Policy;
use Mailcow\MailPolicy\Repository\PolicyRepository;
use Mailcow\MailPolicy\Service\PolicyEngine;
use Mailcow\MailPolicy\Service\PolicyService;
use Mailcow\Tests\Support\FakeContext;
use Mailcow\Tests\Support\FakeMailPolicyLookup;
use PHPUnit\Framework\Attributes\DataProvider;
use PHPUnit\Framework\MockObject\MockObject;
use PHPUnit\Framework\TestCase;
class PolicyServiceTest extends TestCase
{
private PolicyRepository&MockObject $repo;
private FakeMailPolicyLookup $lookup;
/** @var Policy[] saved policies */
private array $saved = [];
protected function setUp(): void
{
$this->repo = $this->createMock(PolicyRepository::class);
$this->repo->method('isDomain')->willReturnCallback(fn(string $domain): bool => in_array($domain, ['firma.de', 'tochter.de'], true));
$this->repo->method('mailboxDomain')->willReturnCallback(fn(string $username): ?string =>
['azubi@firma.de' => 'firma.de', 'chef@firma.de' => 'firma.de', 'andere@tochter.de' => 'tochter.de'][$username] ?? null);
$this->repo->method('groupDomain')->willReturnCallback(fn(int $id): ?string => [7 => 'firma.de', 9 => 'tochter.de'][$id] ?? null);
$this->repo->method('save')->willReturnCallback(function (Policy $policy): int {
$policy->id ??= 1;
$this->saved[] = clone $policy;
return $policy->id;
});
$this->lookup = new FakeMailPolicyLookup();
$this->lookup->domains = ['firma.de', 'tochter.de'];
$this->lookup->mailboxes = ['azubi@firma.de' => 'firma.de', 'chef@firma.de' => 'firma.de'];
}
private function service(?Context $context = null): PolicyService
{
return new PolicyService($this->repo, new PolicyEngine($this->lookup), $context ?? FakeContext::admin());
}
private function stored(array $values = []): Policy
{
$policy = new Policy();
$policy->id = 3;
$policy->domain = 'firma.de';
$policy->name = 'Azubis';
$policy->sendAllow = ['partner.de', 'group:7'];
foreach ($values as $property => $value) {
$policy->$property = $value;
}
return $policy;
}
private function expectUserError(string|array $msg, callable $call): void
{
try {
$call();
$this->fail('UserError ' . json_encode($msg) . ' expected');
} catch (UserError $e) {
$this->assertSame($msg, $e->msg());
}
}
public function testCreateNormalizesTheInput(): void
{
$policy = $this->service()->create([
'domain' => 'Firma.de', 'name' => 'Azubis', 'description' => 'Nur intern', 'active' => ['0', '1'],
'send_mode' => 'internal', 'send_allow' => "@Partner.de\nkunde@extern.example, partner.de", 'send_allow_groups' => ['', '7'],
'send_block' => '', 'receive_mode' => 'list', 'receive_allow' => ['group:7'], 'reject_text' => 'Nur intern erlaubt',
'mailboxes' => ['', 'Azubi@firma.de'], 'groups' => ['7'],
]);
$this->assertSame([
'domain' => 'firma.de', 'name' => 'Azubis', 'description' => 'Nur intern', 'send_mode' => 'internal',
'send_allow' => ['partner.de', 'kunde@extern.example', 'group:7'], 'send_block' => [], 'receive_mode' => 'list',
'receive_allow' => ['group:7'], 'receive_block' => [], 'reject_text' => 'Nur intern erlaubt', 'active' => 1,
'mailboxes' => ['azubi@firma.de'], 'groups' => [7],
], array_intersect_key($policy->toArray(), array_flip(['domain', 'name', 'description', 'send_mode', 'send_allow', 'send_block',
'receive_mode', 'receive_allow', 'receive_block', 'reject_text', 'active', 'mailboxes', 'groups'])));
$this->assertCount(1, $this->saved);
}
public function testUpdateKeepsMissingValuesAndReplacesListGroups(): void
{
$this->repo->method('find')->willReturn($this->stored());
$policy = $this->service()->update(3, ['description' => 'neu']);
$this->assertSame(['neu', ['partner.de', 'group:7']], [$policy->description, $policy->sendAllow]);
// the UI sends the groups apart: they replace the group entries, the other entries stay
$this->repo->method('find')->willReturn($this->stored());
$this->assertSame(['partner.de'], $this->service()->update(3, ['send_allow_groups' => ''])->sendAllow);
}
public static function invalidInput(): array
{
return [
'empty name' => [['name' => ''], 'mail_policy_name_invalid'],
'long name' => [['name' => str_repeat('a', 101)], 'mail_policy_name_invalid'],
'mode' => [['send_mode' => 'nobody'], 'mail_policy_mode_invalid'],
'domain without dot' => [['send_allow' => 'localhost'], ['mail_policy_entry_invalid', 'localhost']],
'address' => [['receive_block' => 'a@@b.de'], ['mail_policy_entry_invalid', 'a@@b.de']],
'unknown group' => [['receive_block_groups' => ['8']], ['mail_policy_entry_invalid', 'group:8']],
'reject text with line break' => [['reject_text' => "a\r\nb"], 'mail_policy_reject_text_invalid'],
'reject text not ASCII' => [['reject_text' => 'Nur für Azubis'], 'mail_policy_reject_text_invalid'],
'mailbox of another domain' => [['mailboxes' => 'andere@tochter.de'], ['mail_policy_member_invalid', 'andere@tochter.de']],
'group of another domain' => [['groups' => ['9']], ['mail_policy_member_invalid', '9']],
'unknown domain' => [['domain' => 'fremd.de'], ['domain_not_found', 'fremd.de']],
];
}
#[DataProvider('invalidInput')]
public function testInvalidInput(array $input, string|array $error): void
{
$this->expectUserError($error, fn() => $this->service()->create($input + ['domain' => 'firma.de', 'name' => 'Test']));
$this->assertSame([], $this->saved);
}
public function testNamesAreUniquePerDomain(): void
{
$this->repo->method('nameExists')->willReturn(true);
$this->expectUserError(['object_exists', 'Azubis'], fn() => $this->service()->create(['domain' => 'firma.de', 'name' => 'Azubis']));
}
public function testPermissions(): void
{
$this->repo->method('find')->willReturn($this->stored());
$da = FakeContext::domainAdmin([], ['firma.de'], ['mail_policies' => '1']);
$this->assertSame('Test', $this->service($da)->create(['domain' => 'firma.de', 'name' => 'Test'])->name);
$this->assertNotNull($this->service($da)->get(3));
// other domains, no ACL, users and read-only keys
$this->expectUserError('access_denied', fn() => $this->service($da)->create(['domain' => 'tochter.de', 'name' => 'Test']));
$this->expectUserError(['mail_policy_entry_invalid', 'group:9'],
fn() => $this->service($da)->create(['domain' => 'firma.de', 'name' => 'Test', 'send_block_groups' => ['9']]));
$this->assertNull($this->service(FakeContext::domainAdmin([], ['tochter.de'], ['mail_policies' => '1']))->get(3));
$this->expectUserError('access_denied', fn() => $this->service(FakeContext::domainAdmin([], ['firma.de'], []))->create(['domain' => 'firma.de', 'name' => 'Test']));
$this->expectUserError('access_denied', fn() => $this->service(FakeContext::user('azubi@firma.de'))->update(3, []));
$readOnly = new Context('admin', 'API', [], false, 'ro');
$this->assertNotNull($this->service($readOnly)->get(3));
$this->expectUserError('access_denied', fn() => $this->service($readOnly)->delete(3));
}
public function testRuleTest(): void
{
$policy = $this->stored(['sendMode' => 'internal', 'sendAllow' => []]);
$this->lookup->mailboxPolicies['azubi@firma.de'] = [$policy];
$this->assertSame(['allowed' => 0, 'side' => 'send', 'policy' => 'Azubis', 'internal_alias' => 0, 'logged_in' => 1,
'text' => 'Sending to this recipient is not allowed by the mail policy of the sender'],
$this->service()->test('azubi@firma.de', 'x@extern.example', true));
// not logged in: the send rules of the mailbox do not apply
$this->assertSame(1, $this->service()->test('azubi@firma.de', 'x@extern.example', false)['allowed']);
// an external sender is never logged in
$this->assertSame(0, $this->service()->test('x@extern.example', 'chef@firma.de', true)['logged_in']);
$this->expectUserError('mail_policy_test_invalid', fn() => $this->service()->test('azubi@firma.de', 'kein-empfaenger', true));
// domain admins test mail of their domains
$da = FakeContext::domainAdmin([], ['tochter.de'], ['mail_policies' => '1']);
$this->expectUserError('access_denied', fn() => $this->service($da)->test('azubi@firma.de', 'x@extern.example', true));
}
}
tests/php/Support/FakeMailPolicyLookup.php
+90
View File
@@ -0,0 +1,90 @@
<?php
declare(strict_types=1);
namespace Mailcow\Tests\Support;
use Mailcow\MailPolicy\Model\Policy;
use Mailcow\MailPolicy\Repository\LookupRepository;
/**
* Address tables and policy assignments in memory, with the conditions of the SQL already applied
* (only active rows are listed).
*/
class FakeMailPolicyLookup extends LookupRepository
{
/** username => domain */
public array $mailboxes = [];
/** alias domain => target domain */
public array $aliasDomains = [];
/** @var string[] domains of the mailcow (without alias domains) */
public array $domains = [];
/** id => ['address' => ?string, 'members' => string[]] */
public array $groups = [];
/** alias address => domain of aliases with the internal flag */
public array $internalAliases = [];
/** username => Policy[] assigned directly */
public array $mailboxPolicies = [];
/** group id => Policy[] */
public array $groupPolicies = [];
public function __construct()
{
}
public function mailbox(string $username): ?array
{
return isset($this->mailboxes[$username]) ? ['username' => $username, 'domain' => $this->mailboxes[$username]] : null;
}
public function aliasDomainTarget(string $domain): ?string
{
return $this->aliasDomains[$domain] ?? null;
}
public function isLocalDomain(string $domain): bool
{
return in_array($domain, $this->domains, true) || isset($this->aliasDomains[$domain]);
}
public function groupByAddress(string $address): ?int
{
foreach ($this->groups as $id => $group) {
if (($group['address'] ?? null) === $address) {
return $id;
}
}
return null;
}
public function groupAddress(int $id): ?string
{
return $this->groups[$id]['address'] ?? null;
}
public function isGroupMember(int $groupId, string $username): bool
{
return in_array($username, $this->groups[$groupId]['members'] ?? [], true);
}
public function internalAlias(string $address): ?string
{
return $this->internalAliases[$address] ?? null;
}
public function policiesForMailbox(string $username): array
{
$policies = $this->mailboxPolicies[$username] ?? [];
foreach ($this->groups as $id => $group) {
if (in_array($username, $group['members'] ?? [], true)) {
$policies = array_merge($policies, $this->groupPolicies[$id] ?? []);
}
}
return $policies;
}
public function policiesForGroup(int $groupId): array
{
return $this->groupPolicies[$groupId] ?? [];
}
}